videobook 0.0.0-stage → 0.2.0

package/dist/one-password.js

@@ -0,0 +1,200 @@
+import { execFileSync } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+export const OP_VAULT_SETTING = "VIDEOBOOK_OP_VAULT";
+export const OP_TOKEN_SETTING = "VIDEOBOOK_OP_SERVICE_TOKEN";
+const OP_TIMEOUT_MS = 10_000;
+const TEMPLATE_UNSAFE = /[\r\n]|\{\{|\}\}/u;
+const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/u;
+export function isOpReference(value) {
+    return typeof value === "string" && value.trim().startsWith("op://");
+}
+export function vaultReference(vault, key) {
+    return `op://${vault}/${key}/password`;
+}
+export function resolveServiceToken(raw, env) {
+    const value = raw?.trim();
+    if (!value)
+        return { value: null, source: null };
+    const name = value.startsWith("env:") ? value.slice(4) : value.startsWith("$") ? value.slice(1) : value;
+    if (value !== name || /^[A-Z_][A-Z0-9_]*$/u.test(value)) {
+        if (!ENV_NAME.test(name))
+            return { value: null, source: `env:${name}` };
+        return { value: env[name]?.trim() || null, source: `env:${name}` };
+    }
+    return { value, source: "literal" };
+}
+export function readOnePasswordSettings(env) {
+    return {
+        vault: env[OP_VAULT_SETTING]?.trim() || null,
+        token: resolveServiceToken(env[OP_TOKEN_SETTING], env),
+    };
+}
+export function redactToken(text, token) {
+    return token ? text.split(token).join("***") : text;
+}
+export function planReferences(env, managedKeys, vault, vaultTitles) {
+    const explicit = Object.entries(env)
+        .filter((entry) => isOpReference(entry[1]))
+        .map(([key, reference]) => [key, reference.trim()]);
+    const covered = new Set(explicit.map(([key]) => key));
+    const convention = vault
+        ? managedKeys
+            .filter((key) => !covered.has(key) && !env[key]?.trim() && vaultTitles.has(key))
+            .map((key) => [key, vaultReference(vault, key)])
+        : [];
+    return { explicit, convention };
+}
+function startMarker(nonce, key) {
+    return `<<<${nonce}:${key}>>>`;
+}
+function endMarker(nonce, key) {
+    return `<<<${nonce}/${key}>>>`;
+}
+export function injectionTemplate(entries, nonce) {
+    return entries.map(([key, reference]) => `${startMarker(nonce, key)}{{ ${reference} }}${endMarker(nonce, key)}`).join("\n");
+}
+export function parseInjection(output, keys, nonce) {
+    const values = new Map();
+    for (const key of keys) {
+        const start = output.indexOf(startMarker(nonce, key));
+        if (start < 0)
+            continue;
+        const from = start + startMarker(nonce, key).length;
+        const end = output.indexOf(endMarker(nonce, key), from);
+        if (end < 0)
+            continue;
+        const value = output.slice(from, end);
+        if (value !== "")
+            values.set(key, value);
+    }
+    return values;
+}
+function opEnvironment(env, token) {
+    return token ? { ...env, OP_SERVICE_ACCOUNT_TOKEN: token } : env;
+}
+export function opErrorMessage(error, token) {
+    const failure = error;
+    if (failure.code === "ENOENT")
+        return "the 1Password CLI (op) is not on PATH";
+    if (failure.code === "ETIMEDOUT" || failure.signal === "SIGTERM")
+        return "op timed out";
+    const line = String(failure.stderr ?? "").trim().split("\n")[0]?.trim().replace(/^\[ERROR\]\s+\S+\s+\S+\s+/u, "");
+    return redactToken(line || failure.message || "op failed", token);
+}
+function runOp(args, env, token) {
+    return execFileSync("op", args, {
+        env: opEnvironment(env, token),
+        encoding: "utf8",
+        timeout: OP_TIMEOUT_MS,
+        maxBuffer: 8 * 1024 * 1024,
+        stdio: ["ignore", "pipe", "pipe"],
+    });
+}
+export function listVaultItemTitles(vault, env, token) {
+    const parsed = JSON.parse(runOp(["item", "list", "--vault", vault, "--format", "json"], env, token));
+    if (!Array.isArray(parsed))
+        throw new Error("op item list did not return a list");
+    return new Set(parsed.flatMap((item) => {
+        const title = item && typeof item === "object" ? item.title : undefined;
+        return typeof title === "string" ? [title] : [];
+    }));
+}
+function injectBatch(entries, env, token) {
+    const nonce = randomUUID().replaceAll("-", "");
+    const directory = mkdtempSync(join(tmpdir(), "videobook-op-"));
+    try {
+        const template = join(directory, "template");
+        writeFileSync(template, injectionTemplate(entries, nonce), { mode: 0o600 });
+        const output = runOp(["inject", "--in-file", template], env, token);
+        return parseInjection(output, entries.map(([key]) => key), nonce);
+    }
+    finally {
+        rmSync(directory, { recursive: true, force: true });
+    }
+}
+function readOne(key, reference, env, token) {
+    try {
+        const value = runOp(["read", "--no-newline", reference], env, token);
+        return value === ""
+            ? { values: new Map(), failures: [{ key, reference, reason: "the item has no value" }] }
+            : { values: new Map([[key, value]]), failures: [] };
+    }
+    catch (error) {
+        return { values: new Map(), failures: [{ key, reference, reason: opErrorMessage(error, token) }] };
+    }
+}
+function mergeResults(results) {
+    return {
+        values: new Map(results.flatMap((result) => [...result.values])),
+        failures: results.flatMap((result) => result.failures),
+    };
+}
+function resolveEntries(entries, env, token) {
+    const unsafe = entries.filter(([, reference]) => TEMPLATE_UNSAFE.test(reference));
+    const safe = entries.filter(([, reference]) => !TEMPLATE_UNSAFE.test(reference));
+    const refused = unsafe.map(([key, reference]) => ({ key, reference, reason: "malformed op:// reference" }));
+    if (safe.length === 0)
+        return { values: new Map(), failures: refused };
+    try {
+        const values = injectBatch(safe, env, token);
+        const missing = safe.filter(([key]) => !values.has(key)).map(([key, reference]) => ({ key, reference, reason: "op inject returned no value" }));
+        return { values, failures: [...refused, ...missing] };
+    }
+    catch {
+        const individual = mergeResults(safe.map(([key, reference]) => readOne(key, reference, env, token)));
+        return { values: individual.values, failures: [...refused, ...individual.failures] };
+    }
+}
+function vaultTitles(settings, env) {
+    if (!settings.vault)
+        return { titles: new Set(), error: null };
+    try {
+        return { titles: listVaultItemTitles(settings.vault, env, settings.token.value), error: null };
+    }
+    catch (error) {
+        return { titles: new Set(), error: `could not list vault ${settings.vault}: ${opErrorMessage(error, settings.token.value)}` };
+    }
+}
+function emptyResolution(settings) {
+    return {
+        attempted: false,
+        vault: settings.vault,
+        tokenSource: settings.token.source,
+        fromReferences: [],
+        fromVault: [],
+        unresolved: [],
+        error: null,
+    };
+}
+export function resolveOnePasswordEnv(env, managedKeys) {
+    const settings = readOnePasswordSettings(env);
+    const hasReferences = Object.values(env).some((value) => isOpReference(value));
+    if (!hasReferences && !settings.vault)
+        return emptyResolution(settings);
+    const listing = vaultTitles(settings, env);
+    const plan = planReferences(env, managedKeys, settings.vault, listing.titles);
+    const result = resolveEntries([...plan.explicit, ...plan.convention], env, settings.token.value);
+    for (const [key] of plan.explicit) {
+        const value = result.values.get(key);
+        if (value === undefined)
+            delete env[key];
+        else
+            env[key] = value;
+    }
+    for (const [key] of plan.convention) {
+        const value = result.values.get(key);
+        if (value !== undefined)
+            env[key] = value;
+    }
+    return {
+        ...emptyResolution(settings),
+        attempted: true,
+        fromReferences: plan.explicit.map(([key]) => key).filter((key) => result.values.has(key)),
+        fromVault: plan.convention.map(([key]) => key).filter((key) => result.values.has(key)),
+        unresolved: result.failures,
+        error: listing.error,
+    };
+}

package/dist/openai-intelligence.js

@@ -0,0 +1,99 @@
+import { createOpenAi } from "./usage-providers.js";
+import { withRetry } from "@apicity/openai";
+export const INTELLIGENCE_MODEL = "gpt-5.6-sol";
+export const INTELLIGENCE_REASONING_EFFORT = "medium";
+export const OPENAI_ANALYSIS_TOOL = "openai_responses_analysis";
+export const ANALYSIS_REASONING_EFFORT = "high";
+export function intelligenceRequest(request, options = {}) {
+    return {
+        ...request,
+        model: options.model ?? INTELLIGENCE_MODEL,
+        reasoning: {
+            effort: options.reasoningEffort ?? INTELLIGENCE_REASONING_EFFORT,
+        },
+        store: false,
+    };
+}
+function normalizeRequest(request, options) {
+    const normalized = intelligenceRequest(request, {
+        model: options.model,
+        reasoningEffort: request.reasoning?.effort
+            ?? options.reasoningEffort
+            ?? INTELLIGENCE_REASONING_EFFORT,
+    });
+    delete normalized.temperature;
+    delete normalized.top_p;
+    return normalized;
+}
+export function buildIntelligenceResponses(apiKey, options = {}) {
+    if (!apiKey) {
+        throw new Error("OPENAI_API_KEY is not set");
+    }
+    const timeout = options.timeout ?? 180_000;
+    const provider = createOpenAi({
+        apiKey,
+        timeout,
+        ...(options.fetch ? { fetch: options.fetch } : {}),
+        ...(options.baseURL ? { baseURL: options.baseURL } : {}),
+    });
+    const call = withRetry(provider.post.v1.responses, { retries: options.retries ?? 2, baseMs: 500 });
+    return async (request, signal) => {
+        const deadline = new AbortController();
+        const timer = setTimeout(() => deadline.abort(new Error(`OpenAI Responses request exceeded ${timeout}ms`)), timeout);
+        const combinedSignal = signal
+            ? AbortSignal.any([signal, deadline.signal])
+            : deadline.signal;
+        try {
+            return await call(normalizeRequest(request, {
+                model: options.model,
+                reasoningEffort: options.reasoningEffort,
+            }), combinedSignal);
+        }
+        catch (error) {
+            if (signal?.aborted) {
+                throw signal.reason instanceof Error
+                    ? signal.reason
+                    : new Error("OpenAI Responses request was cancelled");
+            }
+            if (deadline.signal.aborted) {
+                throw deadline.signal.reason instanceof Error
+                    ? deadline.signal.reason
+                    : new Error(`OpenAI Responses request exceeded ${timeout}ms`);
+            }
+            throw error;
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    };
+}
+export function firstResponseText(response) {
+    if (response.error) {
+        throw new Error(`OpenAI Responses error ${response.error.code}: ${response.error.message}`);
+    }
+    if (response.status === "incomplete") {
+        const reason = response.incomplete_details?.reason ?? "unknown reason";
+        throw new Error(`OpenAI Responses output was incomplete: ${reason}`);
+    }
+    if (response.status !== "completed") {
+        throw new Error(`OpenAI Responses request did not complete (status=${response.status})`);
+    }
+    const texts = [];
+    for (const item of response.output) {
+        if (item.type !== "message")
+            continue;
+        for (const content of item.content) {
+            if (content.type === "refusal") {
+                throw new Error(`OpenAI Responses refused the request: ${content.refusal}`);
+            }
+            if (content.type === "output_text") {
+                texts.push(content.text);
+            }
+        }
+    }
+    const text = texts.join("").trim();
+    if (!text) {
+        throw new Error("OpenAI Responses returned no text content");
+    }
+    return text;
+}

package/dist/original-media-file.js

@@ -0,0 +1,12 @@
+import { findAudioFile, findPrimaryMediaFile, findVideoFile } from "videobook-engine";
+export function findOriginalMediaFile(files, kind) {
+    const originals = files.filter((file) => /^original\./i.test(file.name));
+    if (kind === "video")
+        return findVideoFile(originals);
+    if (kind === "audio") {
+        return findAudioFile(originals, kind)
+            ?? originals.find((file) => /^original\.webm$/i.test(file.name))
+            ?? null;
+    }
+    return findPrimaryMediaFile(files, kind);
+}

package/dist/osg-assets.js

@@ -0,0 +1,36 @@
+import { join, extname } from "node:path";
+const OSG_POSITIONS = [
+    "top-left", "top-center", "top-right",
+    "middle-left", "middle-center", "middle-right",
+    "bottom-left", "bottom-center", "bottom-right",
+];
+export function isOsgPosition(value) {
+    return OSG_POSITIONS.includes(value);
+}
+export function isOsgSize(value) {
+    return value === "small" || value === "medium" || value === "large";
+}
+// Wider than _image-inputs' set: OSG accepts svg since Remotion renders it in
+// a browser, while provider uploads (the _image-inputs consumers) cannot.
+const OSG_IMAGE_EXTENSIONS = new Set(["png", "jpg", "jpeg", "webp", "gif", "svg"]);
+function findOsgImageFile(files) {
+    const images = files.filter((file) => {
+        const ext = (file.extension ?? extname(file.name)).replace(/^\./, "").toLowerCase();
+        return OSG_IMAGE_EXTENSIONS.has(ext);
+    });
+    // Manifests are alphabetically sorted, so a bare images[0] would pick a
+    // cover-crop preview variant (landscape.jpg) over the transparent source.
+    return images.find((file) => file.name.startsWith("original")) ?? images[0] ?? null;
+}
+/** Resolve an OSG image asset id to the on-disk path of its source image. */
+export async function resolveOsgImagePath(engine, osgAssetId) {
+    const manifest = await engine.files.manifest(osgAssetId);
+    if (!manifest.ok) {
+        return { ok: false, error: `OSG asset error: ${manifest.error.message}` };
+    }
+    const imgFile = findOsgImageFile(manifest.value.files);
+    if (!imgFile) {
+        return { ok: false, error: `No image file found in OSG asset ${osgAssetId}` };
+    }
+    return { ok: true, path: join(manifest.value.path, imgFile.name) };
+}

package/dist/osg-placement-cache.js

@@ -0,0 +1,64 @@
+import { createHash } from "node:crypto";
+import { z } from "zod";
+export const OSG_PLACEMENT_VERSION = 1;
+const OSG_PLACEMENT_METADATA_KEY = "osg.placement";
+const regionSchema = z.object({
+    kind: z.enum(["face", "text", "graphic"]),
+    confidence: z.number().min(0).max(1),
+    x: z.number().min(0).max(1),
+    y: z.number().min(0).max(1),
+    width: z.number().positive().max(1),
+    height: z.number().positive().max(1),
+}).strict().refine((region) => region.x + region.width <= 1.001 && region.y + region.height <= 1.001, { message: "occupied region extends beyond the source frame" });
+const positionSchema = z.enum([
+    "top-left", "top-center", "top-right",
+    "middle-left", "middle-center", "middle-right",
+    "bottom-left", "bottom-center", "bottom-right",
+]);
+const analysisSchema = z.object({
+    version: z.literal(OSG_PLACEMENT_VERSION),
+    fingerprint: z.string().min(1),
+    sourceWidth: z.number().positive(),
+    sourceHeight: z.number().positive(),
+    frameTimes: z.array(z.number().nonnegative()).min(1),
+    regions: z.array(regionSchema),
+    positions: z.object({
+        landscape: positionSchema,
+        portrait: positionSchema,
+        square: positionSchema,
+    }).strict(),
+    analyzedAt: z.string().min(1),
+}).strict();
+export function osgPlacementFingerprint(videoFile, frameNames, box) {
+    const payload = {
+        version: OSG_PLACEMENT_VERSION,
+        video: {
+            name: videoFile.name,
+            size: videoFile.sizeBytes,
+            objectHash: videoFile.objectHash,
+        },
+        frames: frameNames,
+        box: {
+            aspect: Number(box.aspect.toFixed(4)),
+            minDimFraction: box.minDimFraction,
+            userScale: Number(box.userScale.toFixed(2)),
+        },
+    };
+    return createHash("sha256").update(JSON.stringify(payload)).digest("hex");
+}
+export function parseOsgPlacementAnalysis(raw) {
+    return analysisSchema.parse(raw);
+}
+export async function readOsgPlacementAnalysis(engine, assetId) {
+    const result = await engine.metadata.artifacts.read(assetId, OSG_PLACEMENT_METADATA_KEY);
+    if (!result.ok)
+        return null;
+    const parsed = analysisSchema.safeParse(result.value);
+    return parsed.success ? parsed.data : null;
+}
+export async function writeOsgPlacementAnalysis(engine, assetId, analysis) {
+    const parsed = parseOsgPlacementAnalysis(analysis);
+    const result = await engine.metadata.artifacts.write(assetId, OSG_PLACEMENT_METADATA_KEY, parsed);
+    if (!result.ok)
+        throw new Error(`Failed to persist OSG placement analysis: ${result.error.message}`);
+}

package/dist/osg-settings.js

@@ -0,0 +1,27 @@
+const ORIENTATIONS = ["landscape", "portrait", "square"];
+/**
+ * Merge OSG fields into every orientation's `.render` metadata without
+ * triggering a render. `patch` receives the orientation and its existing
+ * metadata so callers can vary fields per orientation (the frame-aware
+ * watermark stores a different corner for each) or derive defaults from the
+ * stored values.
+ */
+export async function writeOsgSettings(engine, assetId, patch) {
+    const settings = {};
+    try {
+        for (const orientation of ORIENTATIONS) {
+            const existing = await engine.metadata.artifacts.read(assetId, `${orientation}.render`);
+            const base = existing.ok ? existing.value : {};
+            settings[orientation] = { ...base, ...patch(orientation, base) };
+        }
+    }
+    catch (error) {
+        return { ok: false, error: error instanceof Error ? error.message : String(error) };
+    }
+    for (const orientation of ORIENTATIONS) {
+        const written = await engine.metadata.artifacts.write(assetId, `${orientation}.render`, settings[orientation]);
+        if (!written.ok)
+            return { ok: false, error: written.error.message };
+    }
+    return { ok: true, settings };
+}

package/dist/paid-tools.js

@@ -0,0 +1,22 @@
+/**
+ * Tools that spend provider money: generation, analysis, transcription,
+ * tagging, and the notebook run entry points that dispatch paid cells.
+ */
+export const BILLABLE_TOOL_NAMES = new Set([
+    "prepare_cold_open", "analyze_video", "analyze_jokes", "suggest_cuts", "suggest_sfx", "apply_sfx",
+    "transcribe", "translate_subtitles", "isolate_vocals", "clean_video_audio",
+    "make_cover_song", "extend_audio_asset", "rewrite_prompt", "rewrite_script",
+    "describe_image", "analyze_image_subjects", "edit_image_subjects", "rename_all",
+    "retag_asset", "verify_x_mentions",
+    "backfill_asset_tags", "retry_generation", "retry_job",
+    "run_notebook", "run_notebook_cell", "enqueue_notebook_run", "continue_notebook_generation",
+    "generate_image", "generate_video", "generate_audio",
+]);
+/**
+ * One answer to "does running this cost the user money", shared by the workspace
+ * action catalog's confirmation policy and the chain's per-step approval gate so
+ * the two can never drift apart.
+ */
+export function toolSpendsMoney(name) {
+    return BILLABLE_TOOL_NAMES.has(name);
+}

package/dist/platform-guidance.js

@@ -0,0 +1,26 @@
+export function platformGuidance(p) {
+    switch (p) {
+        case "ig":
+            return ("PLATFORM: Instagram. Target 4:5 portrait or 1:1 square framing. " +
+                "Aesthetic-candid register — curated but unstaged: natural daylight or soft indoor light, " +
+                "warm/golden cast acceptable, light film grain tolerated. Mild VSCO-style lift in shadows; " +
+                "skin kept natural with no heavy beautify. Avoid HDR crunch, over-saturation, and harsh " +
+                "on-camera flash unless the image is clearly a flash-aesthetic shot. Default device read: " +
+                "iPhone main camera. Never use editorial/film-stock vocabulary unless the image is clearly " +
+                "a professional editorial photo.");
+        case "tiktok":
+            return ("PLATFORM: TikTok. Target 9:16 vertical framing. Raw phone snapshot energy — candid framing, " +
+                "slight motion softness, mild compression artifacts, auto-HDR lifted blacks. Indoor scenes: " +
+                "ring-light rim or warm tungsten acceptable; at night, harsh on-camera flash is on-brand. " +
+                "Front-camera selfies (with visible mirror/arm) are native to the platform. Skin unretouched, " +
+                "tiny chromatic aberration on high-contrast edges. Never apply editorial polish, cinematic " +
+                "color grading, or named film-stock vocabulary (Portra, Cinestill, etc.). No 'cinematic', " +
+                "'masterpiece', 'editorial' — this is a phone snapshot.");
+        case "youtube":
+            return ("PLATFORM: YouTube. Default to 16:9 landscape unless the image is clearly a Short (then 9:16). " +
+                "Slightly elevated production versus TikTok: punchier contrast, cleaner key light, faces " +
+                "expressive and readable at small thumbnail sizes. Colour can sit slightly saturated for " +
+                "thumbnail legibility but avoid over-stylised filters. Keep the result photographic rather " +
+                "than graphic-design; no logo overlays, no title text baked in.");
+    }
+}

package/dist/posts/dropbox-auth.js

@@ -0,0 +1,91 @@
+import { createHash, randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+import { createDropbox } from "@apicity/dropbox";
+import { appState } from "../app-state.js";
+const KEY = "dropbox.oauth.tokens";
+const REDIRECT = "http://127.0.0.1:8766/callback";
+let pending = false;
+let lastError = null;
+let closeFlow = null;
+let refreshing = null;
+function oauthClient() {
+    const clientId = process.env.DROPBOX_CLIENT_ID;
+    if (!clientId)
+        throw new Error("Set DROPBOX_CLIENT_ID to your Dropbox app key before connecting");
+    return createDropbox({ clientId, clientSecret: process.env.DROPBOX_CLIENT_SECRET });
+}
+export async function dropboxClient() {
+    if (refreshing)
+        return refreshing;
+    refreshing = (async () => {
+        const tokens = await appState.get(KEY);
+        if (!tokens)
+            throw new Error("Connect Dropbox in Settings before uploading");
+        if (new Date(tokens.expiresAt).getTime() > Date.now() + 60_000)
+            return createDropbox({ oauthToken: tokens.accessToken });
+        const refreshed = await oauthClient().oauth2.token({ grant_type: "refresh_token", refresh_token: tokens.refreshToken });
+        await appState.set(KEY, { accessToken: refreshed.access_token, refreshToken: refreshed.refresh_token ?? tokens.refreshToken, expiresAt: new Date(Date.now() + refreshed.expires_in * 1000).toISOString() });
+        return createDropbox({ oauthToken: refreshed.access_token });
+    })();
+    try {
+        return await refreshing;
+    }
+    finally {
+        refreshing = null;
+    }
+}
+export async function dropboxStatus() {
+    const tokens = await appState.get(KEY);
+    return { connected: Boolean(tokens), pending, has_credentials: Boolean(process.env.DROPBOX_CLIENT_ID), error: lastError, redirect_uri: REDIRECT };
+}
+export async function startDropboxConnect() {
+    const client = oauthClient();
+    if (closeFlow)
+        throw new Error("Dropbox connection is already in progress. Complete it in the browser first.");
+    const verifier = randomBytes(32).toString("base64url");
+    const state = randomBytes(24).toString("base64url");
+    const url = new URL("https://www.dropbox.com/oauth2/authorize");
+    url.search = new URLSearchParams({ client_id: process.env.DROPBOX_CLIENT_ID, response_type: "code", redirect_uri: REDIRECT, token_access_type: "offline", code_challenge: createHash("sha256").update(verifier).digest("base64url"), code_challenge_method: "S256", state }).toString();
+    const server = createServer((req, res) => {
+        const callback = new URL(req.url ?? "/", REDIRECT);
+        if (callback.pathname !== "/callback") {
+            res.writeHead(404).end();
+            return;
+        }
+        if (callback.searchParams.get("state") !== state || !callback.searchParams.get("code")) {
+            res.writeHead(400).end("Invalid authorization callback");
+            return;
+        }
+        void (async () => {
+            try {
+                const result = await client.oauth2.token({ grant_type: "authorization_code", code: callback.searchParams.get("code"), redirect_uri: REDIRECT, code_verifier: verifier });
+                if (closeFlow !== closeCurrent) {
+                    res.writeHead(400).end("Authorization expired. Connect again from Videobook.");
+                    return;
+                }
+                if (!result.refresh_token)
+                    throw new Error("Dropbox did not grant offline access");
+                await appState.set(KEY, { accessToken: result.access_token, refreshToken: result.refresh_token, expiresAt: new Date(Date.now() + result.expires_in * 1000).toISOString() });
+                res.writeHead(200, { "Content-Type": "text/plain; charset=utf-8" }).end("Dropbox connected. Return to Videobook.");
+            }
+            catch {
+                lastError = "Dropbox authorization failed. Try connecting again.";
+                res.writeHead(400).end(lastError);
+            }
+            finally {
+                closeCurrent();
+            }
+        })();
+    });
+    const timeout = setTimeout(() => { lastError = "Dropbox connection timed out"; closeCurrent(); }, 5 * 60_000);
+    timeout.unref();
+    const closeCurrent = () => { clearTimeout(timeout); server.close(); if (closeFlow === closeCurrent) {
+        pending = false;
+        closeFlow = null;
+    } };
+    closeFlow = closeCurrent;
+    await new Promise((resolve, reject) => { server.once("error", reject); server.listen(8766, "127.0.0.1", resolve); }).catch((error) => { closeCurrent(); throw error; });
+    pending = true;
+    lastError = null;
+    return { authorize_url: url.toString() };
+}