@gentbajko/slopify 2.5.0 → 3.0.0

package/dist/edge/http/run-cost.js

@@ -0,0 +1,25 @@
+import { zValidator } from "@hono/zod-validator";
+import { Hono } from "hono";
+import { z } from "zod";
+import { projectExists } from "../../slices/admission/repo.js";
+import { runCostOf } from "../../slices/run-cost/panel.js";
+import { onInvalid, problem, titleOf } from "./problem.js";
+const idParam = z.object({ id: z.string().min(1).max(64) });
+// The project's Run cost tab and its "Waiting for … limits" line: what the run's provider
+// calls used and cost, and any CLI plan limit a stage is waiting on. Read from the stored
+// calls alone; nothing here reaches a provider.
+//
+// The return type is inferred so Hono keeps the route types the SPA's client is generated
+// from; see stagingRoutes.
+export function runCostRoutes(deps) {
+    return new Hono().get("/:id/run-cost", zValidator("param", idParam, onInvalid), (c) => {
+        const id = c.req.valid("param").id;
+        if (!projectExists(deps.db, id))
+            return problem(c, {
+                status: 404,
+                title: titleOf(404),
+                detail: "This project no longer exists. Go back to Projects to pick another.",
+            });
+        return c.json(runCostOf(deps.db, id));
+    });
+}

package/dist/edge/http/schedules.js

@@ -2,14 +2,24 @@ import { zValidator } from "@hono/zod-validator";
 import { Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
 import { z } from "zod";
-import { scheduleCreateSchema, scheduleRunSchema, scheduleSummarySchema, scheduleUpdateSchema, } from "../../slices/schedules/schema.js";
+import { calendarRange } from "../../slices/schedules/agenda.js";
+import { calendarMaxDays, calendarSchema, heldTopicSchema, queueMax, scheduleCreateSchema, scheduleRunSchema, scheduleSummarySchema, scheduleUpdateSchema, topicMoveSchema, topicTransferSchema, } from "../../slices/schedules/schema.js";
 import { cancelSchedule, createSchedule, deleteSchedule, listScheduleRuns, listSchedules, pauseSchedule, resumeSchedule, updateSchedule, } from "../../slices/schedules/service.js";
+import { approveHeldTopics, editHeldTopic, heldTopics, moveTopic, rejectHeldTopic, transferTopic, } from "../../slices/schedules/topics.js";
 import { onInvalid, problem, titleOf } from "./problem.js";
 const id = z.object({ id: z.uuid() });
+const topicParam = z.object({ id: z.uuid(), topicId: z.string().min(1).max(100) });
 function refused(c, result) {
-    const status = ["not-found", "missing-template"].includes(result.reason)
+    const status = ["not-found", "missing-template", "topic-not-found"].includes(result.reason)
         ? 404
-        : ["conflict", "cancel-required", "spend-limit", "unsupported-media"].includes(result.reason)
+        : [
+            "conflict",
+            "cancel-required",
+            "spend-limit",
+            "unsupported-media",
+            "queue-full",
+            "busy",
+        ].includes(result.reason)
             ? 409
             : 400;
     const detail = {
@@ -18,15 +28,19 @@ function refused(c, result) {
         conflict: "This schedule changed while you were editing, possibly because a run just started. Reload the page to see the latest, then make your change again.",
         "cancel-required": "This schedule is still active. Cancel it first, then delete it. Completed schedules can be deleted straight away.",
         "missing-template": "The template you picked was deleted or changed. Choose a template again, then save.",
-        "unsupported-media": "This template uses audio, images, a thumbnail or shorts background music you supplied, so it cannot run on a schedule: a scheduled run has no one to attach the file again. Pick a template that generates these instead, or remove the music under Outputs → Export → More shorts options on Play and save the template again.",
+        "unsupported-media": "This template uses audio, images, a thumbnail, shorts background music or an ambient sound file you supplied, so it cannot run on a schedule: a scheduled run has no one to attach the file again. Pick a template that generates these instead, or on Play remove the music under Outputs → Export → More shorts options (or pick Rain, Fireplace or Wind under Outputs → Export → Ambient sound) and save the template again.",
         "not-due": "This one-off time has already passed. Choose a time in the future.",
         "spend-limit": "The estimated cost is above this schedule's spend limit, or some prices are unknown. Raise the spend limit or choose models with known prices.",
         readiness: "A provider this template needs is not ready, for example a missing API key, model or voice. Check Settings → Providers, then try again.",
+        "queue-full": `A schedule's topic queue holds at most ${String(queueMax)} topics. Remove some under Schedules → Edit, then try again.`,
+        "topic-not-found": "This topic was already approved, turned down or used. Reload the page to see the topics waiting now.",
+        busy: "Slopify is already generating topics for this schedule. Wait for it to finish, then try again.",
+        "invalid-topics": "Some topics name keywords this template does not use. Check each topic under Schedules → Edit and save again.",
     };
     return problem(c, {
         status,
         title: titleOf(status),
-        detail: detail[result.reason],
+        detail: result.message ?? detail[result.reason],
         extensions: { reason: result.reason },
     });
 }
@@ -39,7 +53,7 @@ function routes(deps) {
             throw new HTTPException(404);
         return deps;
     };
-    return new Hono()
+    return (new Hono()
         .get("/", (c) => c.json({
         schedules: listSchedules(service()).map((schedule) => scheduleSummarySchema.parse(schedule)),
     }))
@@ -96,5 +110,96 @@ function routes(deps) {
             id: c.req.valid("param").id,
         });
         return result.ok ? c.json(result.value) : refused(c, result);
+    })
+        .get("/:id/topics/held", zValidator("param", id, onInvalid), (c) => {
+        const scheduleId = c.req.valid("param").id;
+        if (listSchedules(service()).every((item) => item.id !== scheduleId))
+            return refused(c, { ok: false, reason: "not-found" });
+        return c.json({
+            topics: heldTopics(service(), scheduleId).map((topic) => heldTopicSchema.parse(topic)),
+        });
+    })
+        // Starts a generation in the background; the schedule's `topics` says when it is done.
+        .post("/:id/topics/generate", zValidator("param", id, onInvalid), (c) => {
+        const deps = service();
+        const scheduleId = c.req.valid("param").id;
+        const schedule = listSchedules(deps).find((item) => item.id === scheduleId);
+        if (schedule === undefined || schedule.deletedAt !== null)
+            return refused(c, { ok: false, reason: "not-found" });
+        const refusal = schedule.topicGeneration.mode === "off"
+            ? "Topic generation is off for this schedule. Turn it on under Edit → Topic generation, then save."
+            : schedule.status === "canceled" || schedule.status === "completed"
+                ? `This schedule is ${schedule.status}, so it needs no more topics.`
+                : schedule.topics.generatingSince !== null
+                    ? "Slopify is already generating topics for this schedule. They appear here when it finishes."
+                    : deps.requestTopics === undefined
+                        ? "Topic generation is not available in this Slopify. Restart Slopify and try again."
+                        : undefined;
+        if (refusal !== undefined)
+            return problem(c, {
+                status: 409,
+                title: titleOf(409),
+                detail: refusal,
+                extensions: { reason: "busy" },
+            });
+        deps.requestTopics?.(scheduleId);
+        return c.json({ started: true }, 202);
+    })
+        .post("/:id/topics/held/approve-all", zValidator("param", id, onInvalid), (c) => {
+        const result = approveHeldTopics(service(), c.req.valid("param").id, "all");
+        return result.ok ? c.json(scheduleSummarySchema.parse(result.value)) : refused(c, result);
+    })
+        .post("/:id/topics/held/:topicId/approve", zValidator("param", topicParam, onInvalid), zValidator("json", z.object({ title: z.string().optional() }).strict(), onInvalid), (c) => {
+        const { id: scheduleId, topicId } = c.req.valid("param");
+        const { title } = c.req.valid("json");
+        const result = approveHeldTopics(service(), scheduleId, [topicId], title === undefined ? {} : { [topicId]: title });
+        return result.ok ? c.json(scheduleSummarySchema.parse(result.value)) : refused(c, result);
+    })
+        .post("/:id/topics/held/:topicId/reject", zValidator("param", topicParam, onInvalid), (c) => {
+        const { id: scheduleId, topicId } = c.req.valid("param");
+        const result = rejectHeldTopic(service(), scheduleId, topicId);
+        return result.ok ? c.json(scheduleSummarySchema.parse(result.value)) : refused(c, result);
+    })
+        .put("/:id/topics/held/:topicId", zValidator("param", topicParam, onInvalid), zValidator("json", z.object({ title: z.string() }).strict(), onInvalid), (c) => {
+        const { id: scheduleId, topicId } = c.req.valid("param");
+        const result = editHeldTopic(service(), scheduleId, topicId, c.req.valid("json").title);
+        return result.ok ? c.json(heldTopicSchema.parse(result.value)) : refused(c, result);
+    })
+        .post("/:id/topics/move", zValidator("param", id, onInvalid), zValidator("json", topicMoveSchema, onInvalid), (c) => {
+        const result = moveTopic(service(), c.req.valid("param").id, c.req.valid("json"));
+        return result.ok ? c.json(scheduleSummarySchema.parse(result.value)) : refused(c, result);
+    })
+        .post("/:id/topics/transfer", zValidator("param", id, onInvalid), zValidator("json", topicTransferSchema, onInvalid), (c) => {
+        const result = transferTopic(service(), c.req.valid("param").id, c.req.valid("json"));
+        return result.ok
+            ? c.json({
+                source: scheduleSummarySchema.parse(result.value.source),
+                target: scheduleSummarySchema.parse(result.value.target),
+            })
+            : refused(c, result);
+    }));
+}
+const calendarQuery = z
+    .object({ from: z.iso.datetime({ offset: true }), to: z.iso.datetime({ offset: true }) })
+    .partial();
+// The coming weeks on one screen. Without `from`/`to`: now to four weeks from now.
+export function calendarRoutes(deps) {
+    return new Hono().get("/", zValidator("query", calendarQuery, onInvalid), (c) => {
+        if (deps === undefined)
+            throw new HTTPException(404);
+        const query = c.req.valid("query");
+        const from = query.from === undefined ? deps.clock.now() : new Date(query.from);
+        const to = query.to === undefined
+            ? new Date(from.valueOf() + 28 * 24 * 60 * 60_000)
+            : new Date(query.to);
+        const result = calendarRange(deps, from, to);
+        if (!result.ok)
+            return problem(c, {
+                status: 400,
+                title: titleOf(400),
+                detail: `Choose a range whose end is after its start and at most ${String(calendarMaxDays)} days long.`,
+                extensions: { reason: result.reason },
+            });
+        return c.json(calendarSchema.parse(result.value));
     });
 }

package/dist/edge/http/settings.js

@@ -6,7 +6,9 @@ import { createNotificationSender, sendFailureText } from "../../slices/notifica
 import { readNotificationUrl, saveNotificationUrl } from "../../slices/notifications/settings.js";
 import { appearances, providerIds } from "../../slices/settings/model.js";
 import { readSettings, saveSettings } from "../../slices/settings/playback.js";
-import { addVoice, removeVoice, voiceIdMax, voiceNameMax, voices, } from "../../slices/settings/voices.js";
+import { addVoice, removeVoice, setVoiceImitatesRealPerson, setVoiceLanguages, voiceIdMax, voiceNameMax, voices, } from "../../slices/settings/voices.js";
+import { readChannelLinks, writeChannelLinks } from "../../slices/youtube/edits-repo.js";
+import { channelLinkNameMax, channelLinksMax, channelLinksProblem, channelLinkUrlMax, } from "../../slices/youtube/placeholders.js";
 import { onInvalid, problem, titleOf } from "./problem.js";
 const idParam = z.object({ id: z.string().min(1).max(64) });
 // Shape only. The rules - trimming, emptiness, length, the provider speaking at all -
@@ -15,13 +17,29 @@ const voiceBody = z.object({
     provider: z.enum(providerIds),
     name: z.string(),
     voiceId: z.string(),
+    languages: z.array(z.string().max(20)).max(60).optional(),
 });
+const voiceLanguagesBody = z.object({ languages: z.array(z.string().max(20)).max(60) });
+const voiceRealPersonBody = z.object({ imitatesRealPerson: z.boolean() });
 // Length and scheme are the slice's rules, so their sentences reach the field; this bound only
 // keeps a pasted novel off the parser.
 const notificationBody = z.object({ url: z.string().max(notificationUrlMax * 2) });
+// Shape and a generous bound only; `channelLinksProblem` says what is wrong in Settings' words.
+export const channelLinksBody = z.object({
+    links: z
+        .array(z.object({
+        name: z.string().max(channelLinkNameMax * 4),
+        url: z.string().max(channelLinkUrlMax * 2),
+    }))
+        .max(channelLinksMax * 2),
+});
 const playbackBody = z.object({
     silenceGapSeconds: z.number(),
     appearance: z.enum(appearances),
+    // Absent keeps what is saved, so a client from before the setting still saves the others.
+    loudness: z
+        .object({ enabled: z.boolean(), videoLufs: z.number(), audioFilesLufs: z.number() })
+        .optional(),
 });
 // The return type is inferred so Hono keeps the route types the SPA's client is
 // generated from; see stagingRoutes.
@@ -29,10 +47,14 @@ export function settingsRoutes(deps) {
     const playback = { db: deps.db, log: deps.log };
     const voiceDeps = { db: deps.db, ids: deps.ids };
     const send = deps.sendNotification ?? createNotificationSender(globalThis.fetch);
-    return new Hono()
+    return (new Hono()
         .get("/", (c) => c.json(readSettings(playback)))
         .put("/", zValidator("json", playbackBody, onInvalid), (c) => {
-        const result = saveSettings(playback, c.req.valid("json"));
+        const body = c.req.valid("json");
+        const result = saveSettings(playback, {
+            ...body,
+            loudness: body.loudness ?? readSettings(playback).loudness,
+        });
         if (!result.ok) {
             return problem(c, {
                 status: 400,
@@ -42,6 +64,21 @@ export function settingsRoutes(deps) {
             });
         }
         return c.json(result.settings);
+    })
+        // The named links `{{Name}}` placeholders in YouTube descriptions fill from
+        // (`slices/youtube/placeholders.ts`).
+        .get("/channel-links", (c) => c.json({ links: readChannelLinks(deps.db) }))
+        .put("/channel-links", zValidator("json", channelLinksBody, onInvalid), (c) => {
+        const { links } = c.req.valid("json");
+        const refused = channelLinksProblem(links);
+        if (refused !== undefined)
+            return problem(c, {
+                status: 400,
+                title: titleOf(400),
+                detail: `The channel links weren't saved: ${refused} Then press Save in Settings → Channel links.`,
+            });
+        writeChannelLinks(deps.db, links);
+        return c.json({ links: readChannelLinks(deps.db) });
     })
         .get("/notifications", (c) => c.json({ url: readNotificationUrl(deps.db) }))
         .put("/notifications", zValidator("json", notificationBody, onInvalid), (c) => {
@@ -81,8 +118,16 @@ export function settingsRoutes(deps) {
         return c.json({ sent: true });
     })
         .get("/voices", (c) => c.json({ voices: voices(voiceDeps) }))
-        .post("/voices", zValidator("json", voiceBody, onInvalid), (c) => {
-        const result = addVoice(voiceDeps, c.req.valid("json"));
+        .post("/voices", zValidator("json", voiceBody, onInvalid), async (c) => {
+        const body = c.req.valid("json");
+        // Languages left blank are asked of the provider, when it says; no answer is unknown.
+        const languages = body.languages !== undefined && body.languages.length > 0
+            ? body.languages
+            : await deps.voiceLanguages?.(body.provider, body.voiceId.trim(), c.req.raw.signal);
+        const result = addVoice(voiceDeps, {
+            ...body,
+            ...(languages === undefined ? {} : { languages }),
+        });
         if (!result.ok) {
             // A voice ID already listed for its provider is a conflict with
             // a row that exists, which the form shows under the Voice ID input.
@@ -100,6 +145,34 @@ export function settingsRoutes(deps) {
                 });
         }
         return c.json(result.voice, 201);
+    })
+        .put("/voices/:id/languages", zValidator("param", idParam, onInvalid), zValidator("json", voiceLanguagesBody, onInvalid), (c) => {
+        const result = setVoiceLanguages(voiceDeps, c.req.valid("param").id, c.req.valid("json").languages);
+        if (result.ok)
+            return c.body(null, 204);
+        return result.reason === "missing"
+            ? problem(c, {
+                status: 404,
+                title: titleOf(404),
+                detail: "This voice no longer exists; it may have been deleted. Reload Settings → Voices to see your voices.",
+            })
+            : problem(c, {
+                status: 400,
+                title: titleOf(400),
+                detail: "The languages weren't saved. Fix the highlighted field and try again.",
+                extensions: { fields: [fieldOf("unknown-language")] },
+            });
+    })
+        // "Imitates a real person": the voice's narration answers Yes to YouTube's AI use.
+        .put("/voices/:id/real-person", zValidator("param", idParam, onInvalid), zValidator("json", voiceRealPersonBody, onInvalid), (c) => {
+        const result = setVoiceImitatesRealPerson(voiceDeps, c.req.valid("param").id, c.req.valid("json").imitatesRealPerson);
+        return result.ok
+            ? c.body(null, 204)
+            : problem(c, {
+                status: 404,
+                title: titleOf(404),
+                detail: "This voice no longer exists; it may have been deleted. Reload Settings → Voices to see your voices.",
+            });
     })
         .delete("/voices/:id", zValidator("param", idParam, onInvalid), (c) => {
         if (!removeVoice(voiceDeps, c.req.valid("param").id).ok) {
@@ -110,7 +183,7 @@ export function settingsRoutes(deps) {
             });
         }
         return c.body(null, 204);
-    });
+    }));
 }
 function fieldOf(reason) {
     switch (reason) {
@@ -131,6 +204,11 @@ function fieldOf(reason) {
                 field: "voiceId",
                 message: `A voice ID is at most ${String(voiceIdMax)} characters. Check you copied only the ID.`,
             };
+        case "unknown-language":
+            return {
+                field: "languages",
+                message: "Enter language codes separated by commas, such as es, de or pt, or leave it blank to ask the provider.",
+            };
         case "not-a-tts-provider":
             return {
                 field: "provider",

package/dist/edge/http/storage-files.js

@@ -0,0 +1,50 @@
+import { zValidator } from "@hono/zod-validator";
+import { Hono } from "hono";
+import { HTTPException } from "hono/http-exception";
+import { z } from "zod";
+import { onInvalid, problem, titleOf } from "./problem.js";
+// Settings → Backup & storage → Your files: where projects and backups are, Open folder, and
+// moving them. A move copies and checks every file, so it answers at once and the screen polls.
+export function filesRoutes(deps) {
+    const files = () => {
+        if (deps.files === undefined)
+            throw new HTTPException(404);
+        return deps.files;
+    };
+    return new Hono()
+        .get("/", async (c) => {
+        c.header("Cache-Control", "no-store");
+        return c.json(await files().view());
+    })
+        .post("/move", zValidator("json", z.object({ target: z.string().min(1).max(4096) }).strict(), onInvalid), async (c) => {
+        const started = await files().move(c.req.valid("json").target);
+        if (!started.ok)
+            return problem(c, {
+                status: started.status,
+                title: titleOf(started.status),
+                detail: started.detail,
+                extensions: { field: "target" },
+            });
+        return c.json(await files().view(), 202);
+    })
+        .post("/open", async (c) => {
+        const origin = c.req.header("origin");
+        if (origin !== undefined && origin !== new URL(c.req.url).origin)
+            return problem(c, {
+                status: 403,
+                title: titleOf(403),
+                detail: "For your safety, folders can only be opened from the Slopify page itself. Open Slopify and try again there.",
+            });
+        try {
+            return c.json(await files().open());
+        }
+        catch (error) {
+            deps.log.write("warn", "storage.open-files", { detail: String(error) });
+            return problem(c, {
+                status: 503,
+                title: titleOf(503),
+                detail: "Slopify could not open a file manager window on the computer it runs on. Make sure you are signed in to that computer's desktop, or open the folder shown in Settings → Backup & storage yourself.",
+            });
+        }
+    });
+}

package/dist/edge/http/storage.js

@@ -1,9 +1,19 @@
+import { zValidator } from "@hono/zod-validator";
 import { Hono } from "hono";
+import { z } from "zod";
 import { BackupBusyError, planBackup, streamBackup, } from "../../slices/storage/backup-export.js";
 import { BackupImportRefused, importBackup } from "../../slices/storage/backup-import.js";
 import { importPortable, portableMaxArchiveBytes, storageUsage, } from "../../slices/storage/portable.js";
 import { reconcileStorage } from "../../slices/storage/reconcile.js";
-import { problem, titleOf } from "./problem.js";
+import { keepOutputsOnly } from "../../slices/storage/trim.js";
+import { onInvalid, problem, titleOf } from "./problem.js";
+const idParam = z.object({
+    id: z
+        .string()
+        .min(1)
+        .max(64)
+        .regex(/^[0-9A-Za-z_-]+$/),
+});
 const exportFailed = "Slopify could not create the backup. Check there is free disk space and try again; if it keeps failing, use Download diagnostics in Settings and report it.";
 export function storageRoutes(deps) {
     const backup = () => ({
@@ -15,7 +25,24 @@ export function storageRoutes(deps) {
         hasInflight: deps.runner.hasInflight,
     });
     return (new Hono()
-        .get("/", (c) => c.json(storageUsage({ db: deps.db, paths: deps.paths })))
+        .get("/", (c) => c.json(storageUsage({ db: deps.db, paths: deps.paths, hasInflight: deps.runner.hasInflight })))
+        // Keep outputs only: a finished project drops its working files (`slices/storage/trim.ts`).
+        .post("/projects/:id/keep-outputs", zValidator("param", idParam, onInvalid), (c) => {
+        const result = keepOutputsOnly({ db: deps.db, paths: deps.paths, hasInflight: deps.runner.hasInflight }, c.req.valid("param").id);
+        if (result.ok)
+            return c.json(result);
+        return result.reason === "no-project"
+            ? problem(c, {
+                status: 404,
+                title: titleOf(404),
+                detail: "This project no longer exists. Reload Settings → Storage to see the current list.",
+            })
+            : problem(c, {
+                status: 409,
+                title: titleOf(409),
+                detail: "Only a finished project can drop its working files, and this one is running, waiting or has unfinished steps. Let it finish (or cancel it on its project page), then use Keep outputs only again.",
+            });
+    })
         // What Export everything would write, asked before the download starts: a download
         // link cannot show a refusal, the browser would save it as the file.
         .get("/export/summary", (c) => {

package/dist/edge/http/studio.js

@@ -0,0 +1,207 @@
+import { createReadStream } from "node:fs";
+import { Readable } from "node:stream";
+import { zValidator } from "@hono/zod-validator";
+import { Hono } from "hono";
+import { z } from "zod";
+import { findDownload } from "../../slices/storage/downloads.js";
+import { studioPlaylistMax } from "../../slices/studio/model.js";
+import { packItem, uploadPack } from "../../slices/studio/pack.js";
+import { bearerToken, isExtensionOrigin, pairStudioExtension, readStudioPlaylist, resetStudioPairing, saveRealFootage, saveStudioPlaylist, studioPairing, studioPlaylistProblem, studioRequestAllowed, } from "../../slices/studio/settings.js";
+import { onInvalid, problem, titleOf } from "./problem.js";
+const id = z
+    .string()
+    .min(1)
+    .max(64)
+    .regex(/^[0-9A-Za-z_-]+$/);
+const projectParam = z.object({ projectId: id });
+const fileParam = z.object({
+    projectId: id,
+    asset: z
+        .string()
+        .max(64)
+        .regex(/^[a-z0-9-]+$/),
+});
+const chooseBody = z.object({ short: z.number().int().min(1).max(99).optional() });
+const playlistBody = z.object({ playlist: z.string().max(studioPlaylistMax * 2) });
+const realFootageBody = z.object({ realFootage: z.boolean() });
+// How long a "Fill in YouTube Studio" choice stays the one the extension fills in.
+const choiceMs = 6 * 60 * 60 * 1000;
+// The Studio routes. The ones under `/ext` are the only routes of the app a page from another
+// origin may read, and only the paired browser extension: every request carries the pairing
+// token, and the CORS headers name the paired extension's origin, never a web page's and never
+// `*`. The rest are the Slopify page's own, refused from any other origin.
+export function studioRoutes(deps) {
+    // What the person chose to fill in last; kept in memory, so a restart asks them to choose
+    // again rather than filling in an old choice.
+    let chosen;
+    const samePage = (c) => {
+        const origin = c.req.header("origin");
+        if (origin === undefined || origin === new URL(c.req.url).origin)
+            return undefined;
+        return problem(c, {
+            status: 403,
+            title: titleOf(403),
+            detail: "For your safety, YouTube Studio settings can only be changed from the Slopify page itself. Open Slopify and try again there.",
+        });
+    };
+    // The CORS headers for the extension: its own origin, echoed only when it is allowed.
+    const allowOrigin = (c, pairing) => {
+        const origin = c.req.header("origin");
+        const paired = studioPairing(deps.db).origin;
+        c.header("Vary", "Origin");
+        if (!isExtensionOrigin(origin))
+            return;
+        if (origin === paired || pairing) {
+            c.header("Access-Control-Allow-Origin", origin);
+            c.header("Access-Control-Allow-Headers", "authorization, content-type");
+            c.header("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
+            c.header("Access-Control-Max-Age", "600");
+        }
+    };
+    const refused = (c) => problem(c, {
+        status: 401,
+        title: "Unauthorized",
+        detail: "The Slopify Studio extension isn't paired with this Slopify. Copy the pairing token from Slopify's Settings → YouTube Studio into the extension's options and press Pair.",
+    });
+    return (new Hono()
+        .get("/settings", (c) => {
+        // The token is read only by the Slopify page, never by another origin's.
+        const denied = samePage(c);
+        if (denied !== undefined)
+            return denied;
+        return c.json({ playlist: readStudioPlaylist(deps.db), pairing: studioPairing(deps.db) });
+    })
+        .put("/settings/playlist", zValidator("json", playlistBody, onInvalid), (c) => {
+        const denied = samePage(c);
+        if (denied !== undefined)
+            return denied;
+        const raw = c.req.valid("json").playlist;
+        const invalid = studioPlaylistProblem(raw);
+        if (invalid !== undefined)
+            return problem(c, {
+                status: 400,
+                title: titleOf(400),
+                detail: invalid,
+                extensions: { fields: [{ field: "playlist", message: invalid }] },
+            });
+        return c.json({ playlist: saveStudioPlaylist(deps.db, raw) });
+    })
+        .post("/settings/pairing", (c) => {
+        const denied = samePage(c);
+        if (denied !== undefined)
+            return denied;
+        return c.json({ pairing: resetStudioPairing(deps.db) });
+    })
+        .get("/packs/:projectId", zValidator("param", projectParam, onInvalid), (c) => {
+        const result = uploadPack(deps, c.req.valid("param").projectId);
+        if (!result.ok)
+            return unknownProject(c);
+        return c.json(result.pack);
+    })
+        // Prepare upload's AI use tick: the project's uploaded clips are real footage.
+        .put("/packs/:projectId/real-footage", zValidator("param", projectParam, onInvalid), zValidator("json", realFootageBody, onInvalid), (c) => {
+        const denied = samePage(c);
+        if (denied !== undefined)
+            return denied;
+        const { projectId } = c.req.valid("param");
+        if (!uploadPack(deps, projectId).ok)
+            return unknownProject(c);
+        saveRealFootage(deps.db, projectId, c.req.valid("json").realFootage);
+        const result = uploadPack(deps, projectId);
+        return result.ok ? c.json(result.pack) : unknownProject(c);
+    })
+        .post("/packs/:projectId/choose", zValidator("param", projectParam, onInvalid), zValidator("json", chooseBody, onInvalid), (c) => {
+        const denied = samePage(c);
+        if (denied !== undefined)
+            return denied;
+        const { projectId } = c.req.valid("param");
+        const { short } = c.req.valid("json");
+        const result = uploadPack(deps, projectId);
+        if (!result.ok)
+            return unknownProject(c);
+        if (packItem(result.pack, short) === undefined)
+            return problem(c, {
+                status: 404,
+                title: titleOf(404),
+                detail: `This project has no short ${String(short)}. Reload the project page and press Prepare upload again.`,
+            });
+        chosen = { projectId, short, at: deps.clock.now().getTime() };
+        return c.json({ chosen: { projectId, short: short ?? null } });
+    })
+        // The extension's routes.
+        .options("/ext/pair", (c) => {
+        allowOrigin(c, true);
+        return c.body(null, 204);
+    })
+        .options("/ext/*", (c) => {
+        allowOrigin(c, false);
+        return c.body(null, 204);
+    })
+        .post("/ext/pair", (c) => {
+        allowOrigin(c, true);
+        const result = pairStudioExtension(deps.db, bearerToken(c.req.header("authorization")), c.req.header("origin"), deps.clock.now());
+        if (!result.ok)
+            return result.reason === "bad-token"
+                ? refused(c)
+                : problem(c, {
+                    status: 403,
+                    title: titleOf(403),
+                    detail: "Only the Slopify Studio browser extension can pair with Slopify. Install it (see Settings → YouTube Studio) and pair from its options page.",
+                });
+        // The origin is paired now; the response carries its headers.
+        allowOrigin(c, false);
+        return c.json({ paired: true, origin: result.pairing.origin });
+    })
+        .get("/ext/pack", (c) => {
+        allowOrigin(c, false);
+        if (!studioRequestAllowed(deps.db, bearerToken(c.req.header("authorization")), c.req.header("origin")))
+            return refused(c);
+        const fresh = chosen !== undefined && deps.clock.now().getTime() - chosen.at <= choiceMs
+            ? chosen
+            : undefined;
+        if (fresh === undefined)
+            return problem(c, {
+                status: 404,
+                title: titleOf(404),
+                detail: "Nothing is chosen to fill in. In Slopify, open the project, press Prepare upload, then Fill in YouTube Studio.",
+            });
+        const result = uploadPack(deps, fresh.projectId);
+        const item = result.ok ? packItem(result.pack, fresh.short) : undefined;
+        if (!result.ok || item === undefined)
+            return problem(c, {
+                status: 404,
+                title: titleOf(404),
+                detail: "The project chosen to fill in is gone. In Slopify, open the project again and press Fill in YouTube Studio.",
+            });
+        return c.json({ pack: result.pack, item });
+    })
+        .get("/ext/files/:projectId/:asset", zValidator("param", fileParam, onInvalid), (c) => {
+        allowOrigin(c, false);
+        if (!studioRequestAllowed(deps.db, bearerToken(c.req.header("authorization")), c.req.header("origin")))
+            return refused(c);
+        const { projectId, asset } = c.req.valid("param");
+        // Only the thumbnails of a pack: the extension needs nothing else from the disk.
+        const result = uploadPack(deps, projectId);
+        const listed = result.ok &&
+            result.pack.items.some((item) => item.thumbnails.some((thumbnail) => thumbnail.asset === asset));
+        const found = listed ? findDownload(deps, projectId, asset) : undefined;
+        if (found === undefined || !found.ok)
+            return problem(c, {
+                status: 404,
+                title: titleOf(404),
+                detail: "That thumbnail isn't in the project's upload pack any more. Reload the project in Slopify and press Fill in YouTube Studio again.",
+            });
+        return c.body(Readable.toWeb(createReadStream(found.download.path)), 200, {
+            "content-type": found.download.contentType,
+            "content-length": String(found.download.bytes),
+            "x-content-type-options": "nosniff",
+        });
+    }));
+}
+function unknownProject(c) {
+    return problem(c, {
+        status: 404,
+        title: titleOf(404),
+        detail: "This project no longer exists. Go back to Projects and open it again.",
+    });
+}