@gentbajko/slopify 2.5.0 → 3.0.0

package/dist/edge/http/style-preview.js

@@ -0,0 +1,100 @@
+import { createReadStream } from "node:fs";
+import { Readable } from "node:stream";
+import { zValidator } from "@hono/zod-validator";
+import { Hono } from "hono";
+import { z } from "zod";
+import { StylePreviewError } from "../../slices/style-preview/render.js";
+import { stylePreviewRequestSchema } from "../../slices/style-preview/schema.js";
+import { onInvalid, problem, titleOf } from "./problem.js";
+// POST renders (or finds) the preview for a set of caption and Look settings and answers where
+// to play it; GET streams the mp4, with byte ranges so the browser's player can seek.
+const fileParam = z.object({ file: z.string().regex(/^[a-f0-9]{64}\.mp4$/) });
+export function stylePreviewRoutes(deps) {
+    return new Hono()
+        .post("/", zValidator("json", stylePreviewRequestSchema, onInvalid), async (c) => {
+        const previews = deps.stylePreviews;
+        if (previews === undefined)
+            return unavailable(c);
+        try {
+            const result = await previews.render(c.req.valid("json"));
+            c.header("Cache-Control", "no-store");
+            return c.json({
+                hash: result.hash,
+                url: `/api/style-preview/${result.hash}.mp4?v=${String(result.version)}`,
+                cached: result.cached,
+                seconds: result.seconds,
+            });
+        }
+        catch (error) {
+            if (!(error instanceof StylePreviewError))
+                throw error;
+            const status = error.reason === "font-missing" ? 409 : error.reason === "ffmpeg-missing" ? 503 : 500;
+            return problem(c, {
+                status,
+                title: titleOf(status),
+                detail: error.message,
+                extensions: { reason: error.reason },
+            });
+        }
+    })
+        .get("/:file", zValidator("param", fileParam, onInvalid), (c) => {
+        const saved = deps.stylePreviews?.file(c.req.valid("param").file.slice(0, 64));
+        if (saved === undefined)
+            return problem(c, {
+                status: 404,
+                title: titleOf(404),
+                detail: "This style preview is no longer saved; Slopify keeps only the most recent ones. Press Render again to make it.",
+            });
+        const headers = {
+            "content-type": "video/mp4",
+            "accept-ranges": "bytes",
+            "cache-control": "no-cache",
+            "x-content-type-options": "nosniff",
+        };
+        const range = byteRange(c.req.header("range"), saved.bytes);
+        if (range === "unsatisfiable")
+            return new Response(null, {
+                status: 416,
+                headers: { ...headers, "content-range": `bytes */${String(saved.bytes)}` },
+            });
+        const { start, end } = range ?? { start: 0, end: saved.bytes - 1 };
+        const body = Readable.toWeb(createReadStream(saved.path, { start, end }));
+        return new Response(body, {
+            status: range === undefined ? 200 : 206,
+            headers: {
+                ...headers,
+                "content-length": String(end - start + 1),
+                ...(range === undefined
+                    ? {}
+                    : { "content-range": `bytes ${String(start)}-${String(end)}/${String(saved.bytes)}` }),
+            },
+        });
+    });
+}
+// One `bytes=` range, as browsers ask for media; anything else is answered with the whole file.
+export function byteRange(header, size) {
+    const matched = /^bytes=(\d*)-(\d*)$/.exec(header?.trim() ?? "");
+    if (matched === null)
+        return undefined;
+    const [, from = "", to = ""] = matched;
+    if (from === "" && to === "")
+        return undefined;
+    if (from === "") {
+        const suffix = Number(to);
+        if (suffix === 0)
+            return "unsatisfiable";
+        return { start: Math.max(0, size - suffix), end: size - 1 };
+    }
+    const start = Number(from);
+    const end = to === "" ? size - 1 : Math.min(Number(to), size - 1);
+    if (start >= size || end < start)
+        return "unsatisfiable";
+    return { start, end };
+}
+function unavailable(c) {
+    return problem(c, {
+        status: 503,
+        title: titleOf(503),
+        detail: "The style preview isn't available because this Slopify started without its video renderer. Restart Slopify, then press Render again.",
+    });
+}

package/dist/edge/http/subtitles.js

@@ -16,7 +16,7 @@ function revisionRequired(c) {
     return problem(c, {
         status: 409,
         title: titleOf(409),
-        detail: "This change is now made from the Edit tab. Choose Edit project, save your change, then use Rebuild affected outputs.",
+        detail: "This change is now made from the Edit tab. Choose Edit project, save your change, then use Choose what to remake (in the project's More menu).",
         extensions: { reason: "revision-required" },
     });
 }

package/dist/edge/http/trash.js

@@ -0,0 +1,69 @@
+import { zValidator } from "@hono/zod-validator";
+import { Hono } from "hono";
+import { z } from "zod";
+import { withProjectControl } from "../../slices/control/lock.js";
+import { trashKinds } from "../../slices/trash/model.js";
+import { deleteNow, listTrash, restoreItem } from "../../slices/trash/service.js";
+import { onInvalid, problem, titleOf } from "./problem.js";
+const itemParam = z.object({
+    kind: z.enum(trashKinds),
+    id: z
+        .string()
+        .min(1)
+        .max(64)
+        .regex(/^[0-9A-Za-z_-]+$/),
+});
+const status = {
+    "not-found": 404,
+    running: 409,
+    files: 500,
+    "template-in-trash": 409,
+    "template-gone": 409,
+};
+const details = {
+    "not-found": "This item is no longer in the trash: it was restored or removed for good. Reload Settings → Trash to see what is left.",
+    running: "This project is still running. Use Cancel run on the project page first, then try again.",
+    files: "Some of this project's files could not be removed. Close any program using files in the project folder, then press Delete now again.",
+    "template-in-trash": "This schedule's template is in the trash too. Restore the template first (it is listed here), then restore the schedule.",
+    "template-gone": "This schedule's template was removed for good, so the schedule has nothing to run. It cannot be restored; Delete now removes it from the trash.",
+};
+function refused(c, reason, detail) {
+    return problem(c, {
+        status: status[reason],
+        title: titleOf(status[reason]),
+        detail: detail === undefined ? details[reason] : `${details[reason]} (${detail})`,
+        extensions: { reason },
+    });
+}
+// Settings → Trash: the list, Restore and Delete now. The daily purge runs from main.ts.
+export function trashRoutes(deps) {
+    const trash = {
+        db: deps.db,
+        paths: deps.paths,
+        clock: deps.clock,
+        log: deps.log,
+        hasInflight: deps.runner.hasInflight,
+    };
+    return new Hono()
+        .get("/", (c) => c.json({ items: listTrash(trash) }))
+        .post("/:kind/:id/restore", zValidator("param", itemParam, onInvalid), (c) => {
+        const { kind, id } = c.req.valid("param");
+        const result = restoreItem(trash, kind, id);
+        if (!result.ok)
+            return refused(c, result.reason);
+        // A restored project picks up where it was: unfinished work goes on, a queued batch
+        // item is back in its place.
+        if (kind === "project")
+            deps.runner.tick(id);
+        return c.json({ restored: result.value });
+    })
+        .delete("/:kind/:id", zValidator("param", itemParam, onInvalid), async (c) => {
+        const { kind, id } = c.req.valid("param");
+        const result = kind === "project"
+            ? await withProjectControl(deps.db, id, () => deleteNow(trash, kind, id))
+            : deleteNow(trash, kind, id);
+        if (!result.ok)
+            return refused(c, result.reason, result.detail);
+        return c.body(null, 204);
+    });
+}

package/dist/edge/http/update.js

@@ -10,7 +10,7 @@ export function updateRoutes(deps) {
         status: "idle",
         blockedReason: "This copy of Slopify cannot update itself from the app. Update it the way you installed it, for example by running the launcher again.",
     };
-    return new Hono()
+    return (new Hono()
         .get("/ready", (c) => {
         c.header("Cache-Control", "no-store");
         if (!deps.updater?.ready(c.req.header("X-Slopify-Update-Token") ?? ""))
@@ -31,6 +31,23 @@ export function updateRoutes(deps) {
         return c.json(deps.updater === undefined
             ? unavailable
             : await deps.updater.check(c.req.query("refresh") === "1"));
+    })
+        // Drops an update that is waiting for running work to finish.
+        .delete("/", async (c) => {
+        const origin = c.req.header("Origin");
+        if (origin !== undefined && origin !== new URL(c.req.url).origin)
+            return problem(c, {
+                status: 403,
+                title: titleOf(403),
+                detail: "For your safety, updates can only be changed from the Slopify page itself. Open Slopify and try again there.",
+            });
+        if (deps.updater?.cancelWaiting() !== true)
+            return problem(c, {
+                status: 409,
+                title: titleOf(409),
+                detail: "No update is waiting to install. Reload the page to see the current update status.",
+            });
+        return c.json(await deps.updater.check());
     })
         .post("/", async (c) => {
         const origin = c.req.header("Origin");
@@ -41,7 +58,11 @@ export function updateRoutes(deps) {
                 detail: "For your safety, updates can only be started from the Slopify page itself. Open Slopify and try again there.",
             });
         if (deps.updater === undefined)
-            return problem(c, { status: 409, title: titleOf(409), detail: unavailable.blockedReason });
+            return problem(c, {
+                status: 409,
+                title: titleOf(409),
+                detail: unavailable.blockedReason,
+            });
         const result = await deps.updater.start();
         if (result.ok)
             return c.json(result.info, 202);
@@ -53,5 +74,5 @@ export function updateRoutes(deps) {
                 result.info.error ??
                 "You already have the latest version of Slopify.",
         });
-    });
+    }));
 }

package/dist/edge/http/whats-new.js

@@ -0,0 +1,15 @@
+import { Hono } from "hono";
+import { markPatchNotesSeen } from "../../slices/patch-notes/seen.js";
+import { dismissWhatsNew, readWhatsNew } from "../../slices/settings/whats-new.js";
+// Preserve Hono's inferred route types for the web client.
+export function whatsNewRoutes(deps) {
+    return (new Hono()
+        .get("/", (c) => c.json(readWhatsNew(deps.db, deps.version)))
+        // The tour stands in for the patch notes on a major update (its last step links to
+        // them), so closing it also closes this version's notes: never two popups in a row.
+        .post("/seen", (c) => {
+        const view = dismissWhatsNew(deps.db, deps.version);
+        markPatchNotesSeen(deps.db, deps.version);
+        return c.json(view);
+    }));
+}

package/dist/edge/http/youtube-edits.js

@@ -0,0 +1,83 @@
+import { zValidator } from "@hono/zod-validator";
+import { Hono } from "hono";
+import { z } from "zod";
+import { transact } from "../../kernel/db/tx.js";
+import { projectExists } from "../../slices/admission/repo.js";
+import { descriptionFields, withEdit, withoutEdit } from "../../slices/youtube/edits.js";
+import { readDescriptionEdits, writeDescriptionEdits } from "../../slices/youtube/edits-repo.js";
+import { descriptionMaxCharacters } from "../../slices/youtube/model.js";
+import { channelLinksProblem } from "../../slices/youtube/placeholders.js";
+import { onInvalid, problem, titleOf } from "./problem.js";
+import { channelLinksBody } from "./settings.js";
+const idParam = z.object({ id: z.string().min(1).max(64) });
+const fieldParam = idParam.extend({ field: z.enum(descriptionFields) });
+// A field is at most a description long; the bound keeps a pasted novel off the table, and
+// YouTube's own limit is shown beside the field rather than refused here.
+const fieldBody = z.object({
+    text: z.string().max(descriptionMaxCharacters * 4),
+    base: z.string().max(descriptionMaxCharacters * 4),
+});
+const gone = "This project no longer exists. Go back to Projects to pick another.";
+// The project page's hand edits to the YouTube description (`slices/youtube/edits.ts`). The
+// server keeps them; the page applies the merge rules to the text it shows.
+export function youtubeEditRoutes(deps) {
+    const exists = (id) => projectExists(deps.db, id);
+    const missing = (c) => problem(c, { status: 404, title: titleOf(404), detail: gone });
+    const now = () => deps.clock.now().toISOString();
+    return (new Hono()
+        .get("/:id/youtube-edits", zValidator("param", idParam, onInvalid), (c) => {
+        const { id } = c.req.valid("param");
+        return exists(id) ? c.json(readDescriptionEdits(deps.db, id)) : missing(c);
+    })
+        // Saves the user's text for one field with the generated text it was edited from; text
+        // equal to that generated text clears the edit. "Keep mine" is this call with the new
+        // generated text as the base.
+        .put("/:id/youtube-edits/fields/:field", zValidator("param", fieldParam, onInvalid), zValidator("json", fieldBody, onInvalid), (c) => {
+        const { id, field } = c.req.valid("param");
+        if (!exists(id))
+            return missing(c);
+        const { text, base } = c.req.valid("json");
+        const saved = transact(deps.db, () => {
+            const current = readDescriptionEdits(deps.db, id);
+            const next = { ...current, fields: withEdit(current.fields, field, text, base) };
+            writeDescriptionEdits(deps.db, id, next, now());
+            return next;
+        });
+        return c.json(saved);
+    })
+        // "Use it": the field follows the generated text again.
+        .delete("/:id/youtube-edits/fields/:field", zValidator("param", fieldParam, onInvalid), (c) => {
+        const { id, field } = c.req.valid("param");
+        if (!exists(id))
+            return missing(c);
+        const saved = transact(deps.db, () => {
+            const current = readDescriptionEdits(deps.db, id);
+            const next = { ...current, fields: withoutEdit(current.fields, field) };
+            writeDescriptionEdits(deps.db, id, next, now());
+            return next;
+        });
+        return c.json(saved);
+    })
+        // The project's own links, such as its "Previous video"; they win over Settings' list.
+        .put("/:id/youtube-edits/links", zValidator("param", idParam, onInvalid), zValidator("json", channelLinksBody, onInvalid), (c) => {
+        const { id } = c.req.valid("param");
+        if (!exists(id))
+            return missing(c);
+        const links = c.req
+            .valid("json")
+            .links.map((link) => ({ name: link.name.trim(), url: link.url.trim() }));
+        const refused = channelLinksProblem(links);
+        if (refused !== undefined)
+            return problem(c, {
+                status: 400,
+                title: titleOf(400),
+                detail: `This project's links weren't saved: ${refused} Then press Save links under YouTube on the Video section.`,
+            });
+        const saved = transact(deps.db, () => {
+            const next = { ...readDescriptionEdits(deps.db, id), links };
+            writeDescriptionEdits(deps.db, id, next, now());
+            return next;
+        });
+        return c.json(saved);
+    }));
+}

package/dist/edge/native-update.js

@@ -0,0 +1,62 @@
+import { setTimeout as delay } from "node:timers/promises";
+/**
+ * `slopify update` for a native install: asks the running app to update itself, exactly as the
+ * Update button in Settings does (wait for running work, install, back up the database, start the
+ * new version, roll back if it doesn't come up), and follows it until it has finished.
+ */
+export async function runNativeUpdate(deps) {
+    const poll = deps.pollMs ?? 2000;
+    const read = async (refresh = false) => {
+        const response = await deps.fetch(`${deps.origin}/api/update${refresh ? "?refresh=1" : ""}`);
+        if (!response.ok)
+            throw new Error(`Slopify answered ${response.status}.`);
+        return (await response.json());
+    };
+    let info;
+    try {
+        info = await read(true);
+    }
+    catch {
+        throw new Error(`Slopify isn't running at ${deps.origin}, so there is nothing to update. Start it (npx @gentbajko/slopify) and run slopify update again; if it runs on another port, add --port <number>. To just start the newest version, run npx @gentbajko/slopify@latest.`);
+    }
+    if (info.status === "error" && info.error !== undefined && info.latestVersion === null)
+        throw new Error(info.error);
+    if (!info.available) {
+        deps.report(`Slopify ${info.currentVersion} is already the newest version.`);
+        return;
+    }
+    const target = info.latestVersion;
+    let told = false;
+    while (info.busy) {
+        if (!told)
+            deps.report("Slopify is generating right now. Waiting for running work to finish before updating (press Ctrl+C to cancel; nothing has been changed yet)...");
+        told = true;
+        await delay(poll);
+        info = await read();
+    }
+    if (!info.canUpdate)
+        throw new Error(info.blockedReason ??
+            info.error ??
+            "Slopify can't update right now. Open Settings in Slopify to see why.");
+    const started = await deps.fetch(`${deps.origin}/api/update`, { method: "POST" });
+    if (!started.ok) {
+        const body = (await started.json().catch(() => ({})));
+        throw new Error(body.detail ?? `Slopify refused to start the update (${started.status}).`);
+    }
+    deps.report(`Updating Slopify ${info.currentVersion} to ${target}...`);
+    const deadline = Date.now() + (deps.restartMs ?? 10 * 60_000);
+    while (Date.now() < deadline) {
+        await delay(poll);
+        const now = await read().catch(() => undefined);
+        if (now === undefined || now.status === "installing" || now.status === "restarting")
+            continue;
+        if (now.currentVersion === target && now.status !== "error") {
+            deps.report(`Slopify ${target} is running at ${deps.origin}`);
+            return;
+        }
+        if (now.status === "error" || now.error !== undefined)
+            throw new Error(now.error ??
+                "The update did not finish, so Slopify kept or put back the previous version. The reason is in logs/updates.log inside your Slopify data folder.");
+    }
+    throw new Error(`Slopify didn't answer at ${deps.origin} within 10 minutes after the update started. Check it in the browser; the updater puts the previous version back on its own if the new one doesn't start, and the reason is in logs/updates.log inside your Slopify data folder.`);
+}

package/dist/host-cli/open-folder.js

@@ -1,10 +1,10 @@
 import { spawn } from "node:child_process";
 import { lstat, readdir } from "node:fs/promises";
 import { isAbsolute, join, relative, sep } from "node:path";
-import { readState, receiptSchema } from "../edge/docker-projects/state.js";
+import { installSchema, readState } from "../edge/docker-install/state.js";
 import { HostFolderRefused } from "../kernel/ports/host-cli.js";
 import { hasCode } from "./paths.js";
-const again = "run the Docker launcher again (npx @gentbajko/slopify@latest --docker)";
+const again = "run the Docker install again (npx @gentbajko/slopify@latest --docker)";
 /** Starts the desktop's opener and returns once it is running; the file manager is not awaited. */
 export function launchXdgOpen(directory) {
     return new Promise((resolve, reject) => {
@@ -24,7 +24,7 @@ export function launchXdgOpen(directory) {
         });
     });
 }
-/** Only folders inside a launcher receipt's project folder, reached through real folders you own, are opened. */
+/** Only folders inside an installation's recorded project folder, reached through real folders you own, are opened. */
 export function createHostFolderOpener(deps) {
     async function receipts() {
         const found = [];
@@ -42,9 +42,9 @@ export function createHostFolderOpener(deps) {
             if (!entry.isDirectory())
                 continue;
             try {
-                const receipt = await readState(join(deps.root, entry.name, "receipt.json"), receiptSchema, deps.uid);
-                if (receipt)
-                    found.push(receipt);
+                const install = await readState(join(deps.root, entry.name, "install.json"), installSchema, deps.uid);
+                if (install)
+                    found.push(install);
             }
             catch {
                 // An unreadable or damaged receipt grants nothing; the others still count.
@@ -59,13 +59,13 @@ export function createHostFolderOpener(deps) {
             root.uid !== BigInt(deps.uid) ||
             String(root.dev) !== identity.dev ||
             String(root.ino) !== identity.ino)
-            throw new HostFolderRefused(`The Slopify host helper did not open this folder because the project folder ${projects} was moved or replaced since the Docker launcher set it up. Put the original folder back, or ${again}.`);
+            throw new HostFolderRefused(`The Slopify host helper did not open this folder because the project folder ${projects} was moved or replaced since the Docker install set it up. Put the original folder back, or ${again}.`);
         let current = projects;
         for (const part of r === "" ? [] : r.split(sep)) {
             current = join(current, part);
             const s = await lstat(current).catch(() => undefined);
             if (!s?.isDirectory() || s.isSymbolicLink() || s.uid !== deps.uid)
-                throw new HostFolderRefused(`The Slopify host helper did not open ${current} because it is missing, a link or a file, or isn't owned by you. Use Re-run section on the project page to make the file again, or copy the path into your file manager.`);
+                throw new HostFolderRefused(`The Slopify host helper did not open ${current} because it is missing, a link or a file, or isn't owned by you. Use More → make it again in its section on the project page to make the file again, or copy the path into your file manager.`);
         }
     }
     return async (path) => {
@@ -77,7 +77,7 @@ export function createHostFolderOpener(deps) {
             if (r === ".." || r.startsWith(`..${sep}`) || isAbsolute(r))
                 continue;
             try {
-                await verify(receipt.projects, receipt.directoryIdentity, r);
+                await verify(receipt.projects, receipt.projectsIdentity, r);
             }
             catch (error) {
                 if (!(error instanceof HostFolderRefused))
@@ -90,6 +90,6 @@ export function createHostFolderOpener(deps) {
             return;
         }
         throw (refusal ??
-            new HostFolderRefused(`The Slopify host helper did not open ${path} because it isn't inside a project folder set up by the Docker launcher. Copy the path into your file manager, or if you moved your project folder, ${again}.`));
+            new HostFolderRefused(`The Slopify host helper did not open ${path} because it isn't inside a project folder set up by the Docker install. Copy the path into your file manager, or if you moved your project folder, ${again}.`));
     };
 }

package/dist/host-cli/runtime.js

@@ -5,6 +5,7 @@ import { codexImage, codexImageTimeoutMs } from "../adapters/image/codex.js";
 import { claudeCodeLlm } from "../adapters/llm/claude-code.js";
 import { nodeClaudeCodeModels } from "../adapters/llm/claude-code-models.js";
 import { codexLlm } from "../adapters/llm/codex.js";
+import { nodeCodexLimits } from "../adapters/llm/codex-limits.js";
 import { nodeCodexModels } from "../adapters/llm/codex-models.js";
 import { geminiLlm } from "../adapters/llm/gemini.js";
 import { nodeGeminiModels } from "../adapters/llm/gemini-models.js";
@@ -12,6 +13,7 @@ import { providerError } from "../kernel/ports/model.js";
 import { createHostFolderOpener } from "./open-folder.js";
 import { createHostStatus } from "./status.js";
 export function createHostRuntime(deps) {
+    const readCodexLimits = deps.readCodexLimits ?? nodeCodexLimits;
     const status = createHostStatus(deps);
     async function command(id) {
         const ready = await status(id);
@@ -56,6 +58,7 @@ export function createHostRuntime(deps) {
                         binary,
                         env: deps.env,
                         readModels: () => models(id),
+                        ...(id === "codex" ? { readLimits: () => readCodexLimits(binary, deps.env) } : {}),
                     }).complete({
                         ...request,
                         ...(id === "codex" && request.thinking !== undefined
@@ -79,7 +82,12 @@ export function createHostRuntime(deps) {
             models: () => codexImage({ run: deps.run, readModels: () => models("codex") }).models(),
             generate: async (request) => {
                 const binary = await command("codex-image");
-                return codexImage({ run: deps.run, binary, env: deps.env }).generate(request);
+                return codexImage({
+                    run: deps.run,
+                    binary,
+                    env: deps.env,
+                    readLimits: () => readCodexLimits(binary, deps.env),
+                }).generate(request);
             },
         },
     };

package/dist/kernel/db/migrations/0025-automatic-reviews.sql

@@ -0,0 +1,40 @@
+-- Automatic reviews. Library prompts of the new "review" kind are what a reviewer model is
+-- asked per stage; SQLite cannot change a CHECK in place, so the table is copied into one whose
+-- CHECK lists the new kind, like 0019 did for "shorts".
+CREATE TABLE prompts_review_upgrade (
+  id TEXT PRIMARY KEY,
+  kind TEXT NOT NULL CHECK (kind IN ('article','image','thumbnail','narration','description','shorts','review')),
+  name TEXT NOT NULL,
+  body TEXT NOT NULL,
+  slots TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+INSERT INTO prompts_review_upgrade (id,kind,name,body,slots,updated_at)
+  SELECT id,kind,name,body,slots,updated_at FROM prompts;
+DROP TABLE prompts;
+ALTER TABLE prompts_review_upgrade RENAME TO prompts;
+CREATE UNIQUE INDEX prompts_name ON prompts(kind,lower(name));
+-- Every verdict a reviewer gave, with its reasons, what Slopify did about it (passed, flagged,
+-- or sent back to be made again) and what the person did (overruled it, or had it redone).
+-- One row per review step fingerprint: the same review of the same output is not asked twice.
+CREATE TABLE review_verdicts (
+ id TEXT PRIMARY KEY,
+ project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+ revision_id TEXT NOT NULL,
+ item_key TEXT NOT NULL,
+ stage TEXT NOT NULL CHECK(stage IN ('article','images','narration','thumbnail','shorts')),
+ item_fingerprint TEXT NOT NULL,
+ review_fingerprint TEXT NOT NULL,
+ passed INTEGER NOT NULL CHECK(passed IN (0,1)),
+ reasons TEXT NOT NULL,
+ outcome TEXT NOT NULL CHECK(outcome IN ('passed','flagged','redo')),
+ attempt INTEGER NOT NULL CHECK(attempt >= 1),
+ action TEXT CHECK(action IN ('overruled','redone')),
+ action_at TEXT,
+ redo_state TEXT CHECK(redo_state IN ('pending','started','failed')),
+ redo_error TEXT,
+ created_at TEXT NOT NULL,
+ UNIQUE(project_id,review_fingerprint)
+);
+CREATE INDEX review_verdicts_item ON review_verdicts(project_id,item_key);
+CREATE INDEX review_verdicts_redo ON review_verdicts(redo_state);

package/dist/kernel/db/migrations/0026-schedule-topic-generation.sql

@@ -0,0 +1,23 @@
+-- A schedule can find its own topics: a series brief, a generation mode and how many topics to
+-- keep queued. `topic_llm_json` is NULL for the template's own LLM. The generating/failed
+-- columns are the generation's own bookkeeping and never bump the schedule's version.
+ALTER TABLE schedules ADD COLUMN brief TEXT;
+ALTER TABLE schedules ADD COLUMN topic_mode TEXT NOT NULL DEFAULT 'off' CHECK(topic_mode IN ('off','queue','hold'));
+ALTER TABLE schedules ADD COLUMN topic_min INTEGER NOT NULL DEFAULT 10 CHECK(topic_min BETWEEN 1 AND 100);
+ALTER TABLE schedules ADD COLUMN topic_llm_json TEXT CHECK(topic_llm_json IS NULL OR json_valid(topic_llm_json));
+ALTER TABLE schedules ADD COLUMN topics_generating_at TEXT;
+ALTER TABLE schedules ADD COLUMN topics_generated_at TEXT;
+ALTER TABLE schedules ADD COLUMN topics_failed_at TEXT;
+ALTER TABLE schedules ADD COLUMN topics_error TEXT;
+-- Topics outside the queue: generated ones held for approval, ones the user rejected, and ones
+-- a run used. Rejected and used rows stay so a later generation never suggests them again.
+CREATE TABLE schedule_topics (
+  id TEXT PRIMARY KEY,
+  schedule_id TEXT NOT NULL REFERENCES schedules(id) ON DELETE CASCADE,
+  title TEXT NOT NULL CHECK(length(trim(title)) BETWEEN 1 AND 200),
+  state TEXT NOT NULL CHECK(state IN ('held','rejected','used')),
+  rank INTEGER NOT NULL,
+  created_at TEXT NOT NULL,
+  decided_at TEXT
+);
+CREATE INDEX schedule_topics_schedule ON schedule_topics(schedule_id, state, rank);

package/dist/kernel/db/migrations/0027-run-cost.sql

@@ -0,0 +1,58 @@
+-- What every successful provider call used and cost, for the project's Run cost tab. The price
+-- is worked out when the call lands and stored with the rates it used, so a later catalogue
+-- change never rewrites what a finished run cost. A CLI call costs nothing on the user's plan
+-- (`on_plan`); `api_cost` is what the same tokens would have cost through the API.
+CREATE TABLE provider_usage (
+ id TEXT PRIMARY KEY,
+ project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+ stage TEXT NOT NULL,
+ kind TEXT NOT NULL CHECK(kind IN ('llm','tts','image','video')),
+ provider TEXT NOT NULL,
+ model TEXT NOT NULL,
+ tokens_in INTEGER,
+ tokens_out INTEGER,
+ tokens_cached INTEGER,
+ characters INTEGER,
+ images INTEGER,
+ seconds REAL,
+ size TEXT,
+ quality TEXT,
+ wall_ms INTEGER NOT NULL,
+ on_plan INTEGER NOT NULL DEFAULT 0 CHECK(on_plan IN (0,1)),
+ cost REAL,
+ api_model TEXT,
+ api_cost REAL,
+ price_json TEXT CHECK(price_json IS NULL OR json_valid(price_json)),
+ created_at TEXT NOT NULL
+);
+CREATE INDEX provider_usage_project ON provider_usage(project_id, created_at);
+
+-- The plan windows a CLI reported around a project's calls, in the order they arrived, so the
+-- tab can say how much of the 5-hour and weekly allowance the run took.
+CREATE TABLE plan_limit_readings (
+ id TEXT PRIMARY KEY,
+ project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+ account TEXT NOT NULL,
+ reading_json TEXT NOT NULL CHECK(json_valid(reading_json)),
+ created_at TEXT NOT NULL
+);
+CREATE INDEX plan_limit_readings_project ON plan_limit_readings(project_id, created_at);
+
+-- A CLI whose plan allowance is used up, until when. One row per account: every project's
+-- calls to it wait on the same reset.
+CREATE TABLE plan_limit_waits (
+ account TEXT PRIMARY KEY,
+ resets_at TEXT,
+ retry_at TEXT NOT NULL,
+ detected_at TEXT NOT NULL
+);
+
+-- The stages waiting on an account. They outlive a restart: the boot resumes these projects
+-- instead of leaving the stage interrupted.
+CREATE TABLE plan_limit_waiters (
+ project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+ stage TEXT NOT NULL,
+ account TEXT NOT NULL,
+ since TEXT NOT NULL,
+ PRIMARY KEY(project_id, stage, account)
+);

package/dist/kernel/db/migrations/0030-automatic-retries.sql

@@ -0,0 +1,18 @@
+-- A step that failed on something time can fix (a rate limit, a timeout, a dropped connection
+-- or CLI) waits and runs again by itself. The wait is kept on the row, so a restart keeps it,
+-- and the count is what caps it. `failure_kind` is the provider error's kind, which picks the
+-- fix-it button a failed step shows.
+ALTER TABLE revision_work ADD COLUMN auto_retries INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE revision_work ADD COLUMN retry_at TEXT;
+ALTER TABLE revision_work ADD COLUMN failure_kind TEXT;
+CREATE INDEX revision_work_retry ON revision_work(retry_at) WHERE retry_at IS NOT NULL;
+ALTER TABLE stages ADD COLUMN retry_at TEXT;
+ALTER TABLE stages ADD COLUMN failure_kind TEXT;
+-- Soften and retry: the image step whose prompt a content filter refused rewords it with the
+-- project's AI model before drawing again. One request per step, cleared once it succeeds.
+CREATE TABLE prompt_softening (
+ project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+ work_key TEXT NOT NULL,
+ requested_at TEXT NOT NULL,
+ PRIMARY KEY(project_id, work_key)
+);