Clip deletion, and M8 — AI generation via fal.ai

[davior]

Clip deletion

Clips couldn't be deleted from anywhere you'd look for them. Fixed:

• From the parent's Clip tab: each clip row links to the clip's own page and has a delete button with an inline confirm. A newly saved clip appears in the grid straight away.
• Together with the parent: the delete guard now offers Delete clips too alongside Promote and delete. This uses DELETE /api/assets/{id}?with_clips=true, which removes the clips and the parent in one transaction. A client that leaves out the flag still gets the 409.
• Data-loss bug fixed: a clip shares its parent's thumb_key, so deleting a clip deleted the parent's poster image, and the poster of every other clip cut from it. Files are now removed only when no surviving row still uses them.
• Refused deletes explain themselves. A delete is refused with 409 extraction_in_progress while an extraction is running, and the reason now shows on the page that asked. Previously the optimistic store delete unmounted the panel before the refusal arrived, so the message was lost.

M8 — AI generation via fal.ai

Spec and as-built record: docs/m8-ai-generation.md.

• What it does: text → image, image → image (several base images) and image → video (start frame, plus an end frame where the model takes one), all through fal's queue API.
• Own worker queue: generation has a separate queue, so a video that takes minutes doesn't hold up transcription.
• Base images are sent to fal as data URIs after downscaling. Nothing of yours is uploaded to fal's public CDN.
• Model catalogue: admin-editable, and each entry records the endpoint's exact field names and accepted values. Nine models are seeded, three per kind, each checked against fal's generated endpoint types.
• Admins are named in ADMIN_USERS, matched exactly. A Notes user id is recommended.
• Provenance: model, prompt, parameters as sent, base images and seed are stored on the asset. This drives Regenerate, Regenerate with the same seed and Edit and generate.
• Cost: x-fal-billable-units × the unit price from fal's pricing API, falling back to an estimate that is labelled as one.
• Robustness:
  • fal's request ids are saved before polling starts, so a restart picks up the same request instead of paying for a second one.
  • A cancel or a timeout also cancels the request at fal.
  • Every request fal billed gets a usage row, even when its outputs fail to download.
  • Downloads are retried, capped and checked against SSRF at every redirect, and only uncompressed bodies are accepted.

Review

An adversarial review (four lenses, each finding independently verified) confirmed 12 findings. A hand-run live smoke test then found a 13th. All are fixed in 59f760c, each with a test that fails without the fix:

• usage was lost when a download failed after fal had billed;
• a download was never retried;
• a result-fetch 5xx was polled for 30 minutes;
• a restart during ingest duplicated an asset;
• cancelling a recovered queued job never cancelled it at fal;
• case-insensitive ADMIN_USERS let a renamed Notes user become admin;
• a brotli body could exhaust memory despite the size cap;
• the fal-key host guard had no test;
• a refused delete was silent;
• the outputs of a partly failed generation never reached the grid;
• the audio checkbox showed one value and sent another;
• plan-of-attack.md was stale;
• the migration's downgrade failed on any populated library. SQLite ignores PRAGMA foreign_keys inside a transaction. The migration tests couldn't see this: their engine never enforced foreign keys, and they reused a connection an earlier revision had left with them off. They now enforce foreign keys and use a fresh connection, as production does.

Live run on this sandbox:

• migrated a populated pre-M8 database up, down and up again;
• ran 18 API checks against uvicorn (clip and parent deletes on disk, catalogue CRUD, key handling, generation error paths);
• drove the UI in Chromium: the + panel, deleting a clip from the Clip tab, the Generate tab, Settings → Image and video generation. No console errors and no 5xx responses.

Not yet verified against fal

This sandbox cannot reach fal.ai. The first real generation will answer three questions:

• whether queue results carry the billing header;
• whether the pricing API accepts an ordinary key;
• whether every seeded model accepts data-URI base images.

The first two fall back to an estimated cost if not.

Checks (local, at 59f760c)

• backend pytest -q: 1204 passed
• frontend: format, lint and build pass; vitest: 377 passed

🤖 Generated with Claude Code

https://claude.ai/code/session_01TPmZjuM4q96DFRfU9cHL33