@gentbajko/slopify 2.5.0 → 3.0.0

package/dist/kernel/db/migrations/0031-prompt-history-and-description-edits.sql

@@ -0,0 +1,33 @@
+-- Every save of a Library prompt or intro/outro keeps a version, so History can show and
+-- restore any of them. One table serves both libraries: `item_kind` says which, `kind` holds the
+-- prompt's kind or the entry's category, and `mode` the entry's mode (NULL for a prompt). No
+-- foreign key: the row it belongs to lives in one of two tables, and the save path deletes the
+-- versions with the prompt or entry.
+CREATE TABLE library_versions (
+  item_kind TEXT NOT NULL CHECK(item_kind IN ('prompt','entry')),
+  item_id TEXT NOT NULL,
+  version INTEGER NOT NULL CHECK(version >= 1),
+  kind TEXT NOT NULL,
+  mode TEXT CHECK(mode IS NULL OR mode IN ('text','llm')),
+  name TEXT NOT NULL,
+  body TEXT NOT NULL,
+  author TEXT NOT NULL,
+  restored_from INTEGER,
+  created_at TEXT NOT NULL,
+  PRIMARY KEY(item_kind,item_id,version)
+);
+-- What is saved today becomes version 1 of each.
+INSERT INTO library_versions (item_kind,item_id,version,kind,mode,name,body,author,restored_from,created_at)
+  SELECT 'prompt',id,1,kind,NULL,name,body,'you',NULL,updated_at FROM prompts;
+INSERT INTO library_versions (item_kind,item_id,version,kind,mode,name,body,author,restored_from,created_at)
+  SELECT 'entry',id,1,category,mode,name,body,'you',NULL,updated_at FROM entries;
+-- The project page's hand edits to the YouTube description, chapters, hashtags and tags. Each
+-- field keeps the user's text and the generated text it was edited from, so a regenerated
+-- description can tell whether the user changed that field. `links_json` holds this project's
+-- own channel links (such as "Previous video"), which win over the Settings list.
+CREATE TABLE youtube_description_edits (
+  project_id TEXT PRIMARY KEY REFERENCES projects(id) ON DELETE CASCADE,
+  fields_json TEXT NOT NULL CHECK(json_valid(fields_json)),
+  links_json TEXT NOT NULL CHECK(json_valid(links_json)),
+  updated_at TEXT NOT NULL
+);

package/dist/kernel/db/migrations/0032-channels.sql

@@ -0,0 +1,65 @@
+-- Channels: the brand kit, the cast library and the series brief that templates, schedules
+-- and projects belong to. Every install gets one default channel, "My channel", with a fixed
+-- id so a backup made on one install names the same default on another, and everything that
+-- exists moves into it. Nothing about a project's config changes, so no fingerprint does.
+--
+-- A template's channel is a plain column and a project's is a row of project_channels, neither
+-- with a foreign key to channels: a backup can bring in a row naming a channel this install
+-- never had, and such a row (like none at all) reads as the default channel. The projects
+-- table itself is left as it is. A schedule's channel is its template's.
+CREATE TABLE channels (
+  id TEXT PRIMARY KEY,
+  name TEXT NOT NULL CHECK(length(trim(name)) BETWEEN 1 AND 200),
+  is_default INTEGER NOT NULL DEFAULT 0 CHECK(is_default IN (0,1)),
+  brand_json TEXT NOT NULL DEFAULT '{}' CHECK(json_valid(brand_json)),
+  series_brief TEXT NOT NULL DEFAULT '',
+  version INTEGER NOT NULL DEFAULT 1 CHECK(version >= 1),
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+CREATE UNIQUE INDEX channels_one_default ON channels(is_default) WHERE is_default = 1;
+INSERT INTO channels (id, name, is_default, created_at, updated_at) VALUES (
+  '00000000-0000-4000-8000-000000000001', 'My channel', 1,
+  strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+);
+-- The characters, creatures, places and objects a channel keeps drawing the same way.
+CREATE TABLE cast_members (
+  id TEXT PRIMARY KEY,
+  channel_id TEXT NOT NULL REFERENCES channels(id) ON DELETE CASCADE,
+  kind TEXT NOT NULL CHECK(kind IN ('character','creature','place','object')),
+  name TEXT NOT NULL CHECK(length(trim(name)) BETWEEN 1 AND 200),
+  aliases_json TEXT NOT NULL DEFAULT '[]' CHECK(json_valid(aliases_json)),
+  description TEXT NOT NULL DEFAULT '',
+  version INTEGER NOT NULL DEFAULT 1 CHECK(version >= 1),
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+CREATE INDEX cast_members_channel ON cast_members(channel_id);
+-- Picture bytes by content hash: cast reference images and the brand kit's end screen image.
+-- A project names the hashes it was started with, so a row is never removed while it may be
+-- named; the bytes are in the database so every database backup carries them.
+CREATE TABLE image_blobs (
+  sha256 TEXT PRIMARY KEY,
+  mime TEXT NOT NULL CHECK(mime IN ('image/png','image/jpeg')),
+  bytes BLOB NOT NULL,
+  created_at TEXT NOT NULL
+);
+CREATE TABLE cast_images (
+  id TEXT PRIMARY KEY,
+  member_id TEXT NOT NULL REFERENCES cast_members(id) ON DELETE CASCADE,
+  source TEXT NOT NULL CHECK(source IN ('upload','generate')),
+  prompt TEXT,
+  state TEXT NOT NULL CHECK(state IN ('ready','generating','failed')),
+  error TEXT,
+  sha256 TEXT REFERENCES image_blobs(sha256),
+  created_at TEXT NOT NULL
+);
+CREATE INDEX cast_images_member ON cast_images(member_id);
+ALTER TABLE project_templates ADD COLUMN channel_id TEXT;
+CREATE TABLE project_channels (
+  project_id TEXT PRIMARY KEY REFERENCES projects(id) ON DELETE CASCADE,
+  channel_id TEXT NOT NULL
+);
+UPDATE project_templates SET channel_id = '00000000-0000-4000-8000-000000000001';
+INSERT INTO project_channels (project_id, channel_id)
+  SELECT id, '00000000-0000-4000-8000-000000000001' FROM projects;

package/dist/kernel/db/migrations/0034-script-prompts.sql

@@ -0,0 +1,23 @@
+-- Multiple voices.
+--
+-- Library prompts of the new "script" kind: what a multi-voice run (audiobook, podcast, radio
+-- drama, interview) asks the text model for in place of an article - speaker turns. SQLite
+-- cannot change a CHECK in place, so the table is copied into one whose CHECK lists the new
+-- kind, like 0025 did for "review".
+CREATE TABLE prompts_script_upgrade (
+  id TEXT PRIMARY KEY,
+  kind TEXT NOT NULL CHECK (kind IN ('article','image','thumbnail','narration','description','shorts','review','script')),
+  name TEXT NOT NULL,
+  body TEXT NOT NULL,
+  slots TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+INSERT INTO prompts_script_upgrade (id,kind,name,body,slots,updated_at)
+  SELECT id,kind,name,body,slots,updated_at FROM prompts;
+DROP TABLE prompts;
+ALTER TABLE prompts_script_upgrade RENAME TO prompts;
+CREATE UNIQUE INDEX prompts_name ON prompts(kind,lower(name));
+-- A cast member's voice: provider, model, voice, pace and pronunciations, so a character or a
+-- channel's host sounds the same in every episode. NULL is no voice, which every member saved
+-- before this has.
+ALTER TABLE cast_members ADD COLUMN voice_json TEXT CHECK (voice_json IS NULL OR json_valid(voice_json));

package/dist/kernel/db/migrations/0035-narration-aliases.sql

@@ -0,0 +1,13 @@
+-- Library → Aliases: words the narrator says differently from how they are written ("Dr." as
+-- "Doctor"). A project keeps its own copy of the list it started with, so nothing references
+-- these rows and editing them never changes a project behind its back. `position` is the
+-- order the editor shows them in.
+CREATE TABLE narration_aliases (
+  id TEXT PRIMARY KEY,
+  position INTEGER NOT NULL,
+  written TEXT NOT NULL CHECK (length(trim(written)) > 0),
+  spoken TEXT NOT NULL CHECK (length(trim(spoken)) > 0),
+  whole_word INTEGER NOT NULL CHECK (whole_word IN (0, 1)),
+  case_sensitive INTEGER NOT NULL CHECK (case_sensitive IN (0, 1)),
+  updated_at TEXT NOT NULL
+);

package/dist/kernel/db/migrations/0037-project-uploads.sql

@@ -0,0 +1,8 @@
+-- "Mark uploaded" on Home: the person says a finished video is on YouTube, so it leaves Ready
+-- to upload. A row of its own rather than a projects column, like project_channels: nothing
+-- about the project's config changes, so no fingerprint does, and deleting the project takes
+-- the row with it.
+CREATE TABLE project_uploads (
+  project_id TEXT PRIMARY KEY REFERENCES projects(id) ON DELETE CASCADE,
+  uploaded_at TEXT NOT NULL
+);

package/dist/kernel/db/migrations/0038-voice-languages.sql

@@ -0,0 +1,7 @@
+-- Other languages.
+--
+-- The languages a saved voice speaks, as a JSON array of primary language codes (["es"]):
+-- looked up from the provider when the voice is added, or typed in Settings → Voices. Play
+-- lists a project's voices by it. NULL is unknown, which every voice saved before this is,
+-- and an unknown voice is offered for every language.
+ALTER TABLE voices ADD COLUMN languages_json TEXT CHECK (languages_json IS NULL OR json_valid(languages_json));

package/dist/kernel/db/migrations/0039-channel-essentials.sql

@@ -0,0 +1,64 @@
+-- Channel essentials.
+--
+-- Trash: deleting a project, a Library prompt or intro/outro, or a template now only stamps
+-- `deleted_at`; Settings → Trash lists the stamped rows for 30 days, and a daily purge removes
+-- them for good. Every list and lookup skips stamped rows. The name indexes only count rows
+-- that are not in the trash, so a name can be reused while the old one waits there. A later
+-- migration that rebuilds one of these tables must carry `deleted_at` over.
+--
+-- A project's stamp lives in its own table rather than a column: the projects table is read
+-- and written positionally in many places, and a project has no name index to relax.
+CREATE TABLE project_trash (
+  project_id TEXT PRIMARY KEY REFERENCES projects(id) ON DELETE CASCADE,
+  deleted_at TEXT NOT NULL
+);
+ALTER TABLE prompts ADD COLUMN deleted_at TEXT;
+ALTER TABLE entries ADD COLUMN deleted_at TEXT;
+ALTER TABLE project_templates ADD COLUMN deleted_at TEXT;
+DROP INDEX prompts_name;
+CREATE UNIQUE INDEX prompts_name ON prompts(kind,lower(name)) WHERE deleted_at IS NULL;
+DROP INDEX entries_name;
+CREATE UNIQUE INDEX entries_name ON entries(category,lower(name)) WHERE deleted_at IS NULL;
+-- A schedule already kept a `deleted_at` (0010: its history outlives it). `purged_at` marks one
+-- that has left the trash; every schedule deleted before the trash existed counts as left.
+ALTER TABLE schedules ADD COLUMN purged_at TEXT;
+UPDATE schedules SET purged_at = deleted_at WHERE deleted_at IS NOT NULL;
+
+-- Episode memory: a short summary each finished project leaves on its channel, read back into
+-- the article and script prompts of later related episodes while the channel's setting is on.
+-- No foreign key to projects: the memory outlives the project it came from.
+CREATE TABLE episode_memories (
+  id TEXT PRIMARY KEY,
+  channel_id TEXT NOT NULL REFERENCES channels(id) ON DELETE CASCADE,
+  project_id TEXT NOT NULL,
+  title TEXT NOT NULL,
+  summary TEXT NOT NULL CHECK(length(trim(summary)) > 0),
+  cast_json TEXT NOT NULL DEFAULT '[]' CHECK(json_valid(cast_json)),
+  source TEXT NOT NULL CHECK(source IN ('generated','edited')),
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+CREATE UNIQUE INDEX episode_memories_project ON episode_memories(project_id);
+CREATE INDEX episode_memories_channel ON episode_memories(channel_id, created_at);
+-- Off for every channel that exists; a channel made from now on starts with it on. A fresh
+-- install (no project yet) counts its default channel as new.
+ALTER TABLE channels ADD COLUMN episode_memory INTEGER NOT NULL DEFAULT 0 CHECK(episode_memory IN (0,1));
+UPDATE channels SET episode_memory = 1 WHERE NOT EXISTS (SELECT 1 FROM projects);
+-- YouTube's "Altered or synthetic content" answer Studio prep gives: 'auto' follows the rule in
+-- slices/studio/disclosure.ts, 'yes' and 'no' override it for the channel.
+ALTER TABLE channels ADD COLUMN ai_disclosure TEXT NOT NULL DEFAULT 'auto' CHECK(ai_disclosure IN ('auto','yes','no'));
+
+-- The channel's videos made before (or outside) Slopify: titles pasted or imported from a
+-- YouTube Studio CSV, so topic suggestions and duplicate checks skip them too.
+CREATE TABLE channel_videos (
+  id TEXT PRIMARY KEY,
+  channel_id TEXT NOT NULL REFERENCES channels(id) ON DELETE CASCADE,
+  title TEXT NOT NULL CHECK(length(trim(title)) BETWEEN 1 AND 500),
+  created_at TEXT NOT NULL
+);
+CREATE UNIQUE INDEX channel_videos_title ON channel_videos(channel_id, lower(title));
+
+-- Episode memory (appended): what a generated summary was made from, a SHA-256 of the prompt
+-- version, title and article text, so finishing the same article again asks no LLM. A summary
+-- the user edited is never replaced by a later finish.
+ALTER TABLE episode_memories ADD COLUMN recipe TEXT;

package/dist/kernel/db/migrations/0040-standalone-usage.sql

@@ -0,0 +1,35 @@
+-- What every successful provider call made outside a project used and cost: a schedule's
+-- topic generation, a channel's episode summary and its cast pictures. provider_usage cannot
+-- hold them, since each of its rows belongs to a project. Priced the same way when the call
+-- lands. There is no link to the schedule or channel: deleting one keeps what it cost this
+-- week. `channel_id` is the channel the call was made for, resolved when it landed, for Home's
+-- channel filter. A CLI's plan windows reported around the call ride along (`account`,
+-- `reading_json`), so Home's plan standings read them beside a project's.
+CREATE TABLE standalone_usage (
+ id TEXT PRIMARY KEY,
+ owner_kind TEXT NOT NULL CHECK(owner_kind IN ('schedule','channel')),
+ owner_id TEXT NOT NULL,
+ channel_id TEXT NOT NULL,
+ purpose TEXT NOT NULL,
+ kind TEXT NOT NULL CHECK(kind IN ('llm','tts','image','video')),
+ provider TEXT NOT NULL,
+ model TEXT NOT NULL,
+ tokens_in INTEGER,
+ tokens_out INTEGER,
+ tokens_cached INTEGER,
+ characters INTEGER,
+ images INTEGER,
+ seconds REAL,
+ size TEXT,
+ quality TEXT,
+ wall_ms INTEGER NOT NULL,
+ on_plan INTEGER NOT NULL DEFAULT 0 CHECK(on_plan IN (0,1)),
+ cost REAL,
+ api_model TEXT,
+ api_cost REAL,
+ price_json TEXT CHECK(price_json IS NULL OR json_valid(price_json)),
+ account TEXT,
+ reading_json TEXT CHECK(reading_json IS NULL OR json_valid(reading_json)),
+ created_at TEXT NOT NULL
+);
+CREATE INDEX standalone_usage_created ON standalone_usage(created_at);

package/dist/kernel/paths.js

@@ -1,18 +1,38 @@
 import { chmodSync, mkdirSync } from "node:fs";
 import { join, resolve } from "node:path";
-export function layout(dataDir) {
+export function layout(dataDir, files) {
     const root = resolve(dataDir);
+    const projects = join(root, "projects");
     return {
         dataDir: root,
         db: join(root, "slopify.db"),
-        projects: join(root, "projects"),
+        projects: files?.projects ?? projects,
+        backups: files?.backups ?? join(projects, "Backups"),
+        exports: files === undefined ? null : files.exports,
         staging: join(root, "staging"),
         logs: join(root, "logs"),
         lock: join(root, ".lock"),
     };
 }
+// Points a running install's Paths at moved files. The one object every slice was handed is
+// changed in place, so the next file each one reads or writes is in the new place.
+export function repoint(paths, files) {
+    Object.assign(paths, {
+        projects: files.projects,
+        backups: files.backups,
+        exports: files.exports,
+    });
+}
 export function ensureDirs(paths, options) {
-    for (const dir of [paths.dataDir, paths.projects, paths.staging, paths.logs]) {
+    ensureDataDirs(paths, options);
+    ensureOwnerOnly([paths.projects], options);
+}
+// The data dir's own folders, before it is known where the user-visible files go.
+export function ensureDataDirs(paths, options) {
+    ensureOwnerOnly([paths.dataDir, paths.staging, paths.logs], options);
+}
+function ensureOwnerOnly(dirs, options) {
+    for (const dir of dirs) {
         mkdirSync(dir, { recursive: true, mode: options.mode });
         // mkdir's mode is masked by the umask and ignored for a directory that already
         // exists; provider keys sit in this tree, so the mode has to be forced.
@@ -20,7 +40,8 @@ export function ensureDirs(paths, options) {
     }
 }
 // The subtitle-timing model's cache. The app readies it at start and every captioned render
-// reads it, so both name it through here.
-export function subtitleModelDir(dataDir) {
-    return join(dataDir, "models", "english-subtitles");
+// reads it, so both name it through here. Other languages use the multilingual model, kept
+// in a folder of its own and downloaded on first use, never at start.
+export function subtitleModelDir(dataDir, language = "en") {
+    return join(dataDir, "models", language === "en" ? "english-subtitles" : "multilingual-subtitles");
 }

package/dist/kernel/pipeline.js

@@ -24,12 +24,15 @@ export const stageStates = [
     "skipped",
 ];
 // A persisted pause overrides the stage-derived status. A completed run need not
-// include a video: all selected stages being satisfied is enough.
+// include a video: all selected stages being satisfied is enough. `partial` is a run whose
+// main output was made while another step failed (the video is there, its thumbnail is
+// not): done with problems, not failed.
 export const projectStates = [
     "running",
     "paused",
     "canceled",
     "failed",
+    "partial",
     "done",
     "pending",
 ];

package/dist/kernel/ports/host-cli.js

@@ -5,7 +5,20 @@ import { llmDocumentsSchema } from "./llm-documents.js";
 import { providerErrorKinds } from "./model.js";
 export const hostLlmIds = ["claude-code", "codex", "gemini"];
 export const hostCliIds = [...hostLlmIds, "codex-image"];
+// The health answer's protocol stays 1: both sides read it as an exact value, so bumping it
+// would lock an older app out of a newer helper and the other way round. Richer stream frames
+// are negotiated per request instead, with `hostFramesHeader`.
 export const hostCliProtocol = 1;
+// Sent by the app on every LLM request: the frame version it can read. A helper puts the
+// cached-token count, the answering model and the plan windows on the `done` frame only when
+// this says 2 or more, because an app from before them rejects any field it does not know.
+// An older helper ignores the header and sends the plain frame, which reads as "not reported".
+export const hostFramesHeader = "x-slopify-frames";
+export const hostFramesVersion = 2;
+// What the Codex CLI reported spending on a bridged image (its tokens and plan windows), as
+// base64url JSON. A header rather than a body change, so an older app just ignores it and a
+// newer app reads a missing one as "not reported".
+export const hostImageReportHeader = "x-slopify-image-report";
 export const bridgeLimits = {
     request: 16 * 1024 * 1024,
     status: 64 * 1024,
@@ -39,6 +52,15 @@ export const hostLlmSchema = z
     webSearch: z.boolean().optional(),
 })
     .strict();
+const bridgedImage = z
+    .object({
+    mime: z.enum(["image/png", "image/jpeg"]),
+    base64: z
+        .string()
+        .max(Math.ceil(bridgeLimits.reference / 3) * 4)
+        .regex(/^[A-Za-z0-9+/]*={0,2}$/),
+})
+    .strict();
 export const hostImageSchema = z
     .object({
     // "codex-imagegen" is the Codex default; any other is one of the Codex CLI's models.
@@ -57,6 +79,18 @@ export const hostImageSchema = z
     })
         .strict()
         .optional(),
+    // The cast members the brief mentions, with their pictures (`ImageRequest.cast`); the
+    // whole request still has to fit `bridgeLimits.request`.
+    cast: z
+        .array(z
+        .object({
+        name: z.string().min(1).max(200),
+        description: z.string().max(2000),
+        images: z.array(bridgedImage).min(1).max(4),
+    })
+        .strict())
+        .max(4)
+        .optional(),
 })
     .strict();
 export const hostOpenFolderSchema = z
@@ -102,25 +136,99 @@ export const hostHealthSchema = z
     accepting: z.boolean(),
 })
     .strict();
-export const hostFaultSchema = z
-    .object({
+// Faults and frames are read leniently: a field this side does not know is dropped, never an
+// error, so a newer helper can add optional fields without breaking this app. (Apps before
+// frame version 2 read them strictly, which is why the helper asks before adding any.)
+export const hostFaultSchema = z.object({
     type: z.literal("error"),
     kind: z.enum(providerErrorKinds),
     message: z.string().max(4096),
-})
-    .strict();
+});
+const limitWindowSchema = z.object({
+    kind: z.enum(["five_hour", "weekly", "other"]),
+    usedPercent: z.number().min(0).max(1_000_000),
+    resetsAt: z.string().max(64).nullable(),
+});
+const limitWindowsSchema = z.array(limitWindowSchema).max(16);
+const planLimitReadingSchema = z.object({
+    before: limitWindowsSchema.optional(),
+    after: limitWindowsSchema.optional(),
+});
+const usageSchema = z.object({
+    inputTokens: z.number().nonnegative(),
+    outputTokens: z.number().nonnegative(),
+    // Frame version 2 on; an older helper never sends them.
+    cachedInputTokens: z.number().nonnegative().optional(),
+    model: short.optional(),
+});
 export const hostFrameSchema = z.discriminatedUnion("type", [
-    z.object({ type: z.literal("delta"), text: z.string().max(bridgeLimits.frame) }).strict(),
-    z.object({ type: z.literal("activity") }).strict(),
-    z
-        .object({
+    z.object({ type: z.literal("delta"), text: z.string().max(bridgeLimits.frame) }),
+    z.object({ type: z.literal("activity") }),
+    z.object({
         type: z.literal("done"),
-        usage: z
-            .object({ inputTokens: z.number().nonnegative(), outputTokens: z.number().nonnegative() })
-            .strict()
-            .nullable(),
+        usage: usageSchema.nullable(),
         finishReason: z.string().max(256).nullable(),
-    })
-        .strict(),
+        // Frame version 2 on.
+        limits: planLimitReadingSchema.optional(),
+    }),
     hostFaultSchema,
 ]);
+// The `done` frame the helper sends to an app that reads frame `version`. Version 1 is the
+// original shape exactly; version 2 adds what the CLI reported, each part kept only when it is
+// well formed so one odd value never costs the answer.
+export function hostDoneFrame(event, version) {
+    const plain = event.usage === null
+        ? null
+        : { inputTokens: event.usage.inputTokens, outputTokens: event.usage.outputTokens };
+    if (!(version >= 2))
+        return { type: "done", usage: plain, finishReason: event.finishReason };
+    const cached = z.number().nonnegative().safeParse(event.usage?.cachedInputTokens);
+    const model = short.safeParse(event.usage?.model);
+    const limits = planLimitReadingSchema.safeParse(event.limits);
+    return {
+        type: "done",
+        usage: plain === null
+            ? null
+            : {
+                ...plain,
+                ...(cached.success ? { cachedInputTokens: cached.data } : {}),
+                ...(model.success ? { model: model.data } : {}),
+            },
+        finishReason: event.finishReason,
+        ...(event.limits !== undefined && limits.success ? { limits: limits.data } : {}),
+    };
+}
+const imageReportSchema = z.object({
+    usage: usageSchema.optional(),
+    limits: planLimitReadingSchema.optional(),
+});
+// The image report header's value, or undefined when there is nothing well formed to report.
+export function encodeHostImageReport(image) {
+    const report = imageReportSchema.safeParse({
+        ...(image.usage === undefined ? {} : { usage: image.usage }),
+        ...(image.limits === undefined ? {} : { limits: image.limits }),
+    });
+    if (!report.success || (report.data.usage === undefined && report.data.limits === undefined))
+        return undefined;
+    const value = Buffer.from(JSON.stringify(report.data)).toString("base64url");
+    // Well inside Node's 16 KB header allowance; a larger report is dropped, never the image.
+    return value.length > 8192 ? undefined : value;
+}
+// The usage and plan windows a helper sent beside an image: empty when it sent none (an older
+// helper) or something unreadable, which only costs the report.
+export function decodeHostImageReport(value) {
+    if (typeof value !== "string" || value.length > 8192)
+        return {};
+    try {
+        const report = imageReportSchema.safeParse(JSON.parse(Buffer.from(value, "base64url").toString("utf8")));
+        if (!report.success)
+            return {};
+        return {
+            ...(report.data.usage === undefined ? {} : { usage: report.data.usage }),
+            ...(report.data.limits === undefined ? {} : { limits: report.data.limits }),
+        };
+    }
+    catch {
+        return {};
+    }
+}

package/dist/kernel/ports/key-probe.js

@@ -0,0 +1 @@
+export {};