diff --git a/Cargo.lock b/Cargo.lock
index 4a4701b..1872c07 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -202,6 +202,15 @@ version = "2.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3ded4057c258ba199e2d26386d3af3780957ecaee6c4ef4041c6b4b8b97c0b06"
 
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
 [[package]]
 name = "block2"
 version = "0.5.1"
@@ -426,6 +435,15 @@ dependencies = [
  "unicode-segmentation",
 ]
 
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "crc32fast"
 version = "1.5.2"
@@ -456,12 +474,32 @@ version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
 
+[[package]]
+name = "crypto-common"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
 [[package]]
 name = "cursor-icon"
 version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f27ae1dd37df86211c42e150270f82743308803d90a6f6e6651cd730d5e1732f"
 
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer",
+ "crypto-common",
+]
+
 [[package]]
 name = "directories"
 version = "6.0.0"
@@ -724,6 +762,16 @@ dependencies = [
  "slab",
 ]
 
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
 [[package]]
 name = "gethostname"
 version = "1.1.0"
@@ -2323,6 +2371,17 @@ dependencies = [
  "serde_core",
 ]
 
+[[package]]
+name = "sha2"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
 [[package]]
 name = "shlex"
 version = "2.0.1"
@@ -2472,6 +2531,7 @@ dependencies = [
  "serde_json",
  "stet-core",
  "stet-substack",
+ "stet-youtube",
  "toml",
  "ureq",
  "wgpu",
@@ -2505,6 +2565,16 @@ dependencies = [
  "ureq",
 ]
 
+[[package]]
+name = "stet-youtube"
+version = "0.3.0"
+dependencies = [
+ "getrandom 0.3.4",
+ "serde_json",
+ "sha2",
+ "ureq",
+]
+
 [[package]]
 name = "str_indices"
 version = "0.4.4"
@@ -2807,6 +2877,12 @@ dependencies = [
  "syntect",
 ]
 
+[[package]]
+name = "typenum"
+version = "1.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
+
 [[package]]
 name = "unicase"
 version = "2.10.0"
diff --git a/Cargo.toml b/Cargo.toml
index a430b53..804ee0d 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [workspace]
 resolver = "2"
-members = ["crates/stet-core", "crates/stet-app", "crates/stet-substack"]
+members = ["crates/stet-core", "crates/stet-app", "crates/stet-substack", "crates/stet-youtube"]
 
 [workspace.package]
 version = "0.3.0"
diff --git a/README.md b/README.md
index 3070a0b..c911236 100644
--- a/README.md
+++ b/README.md
@@ -491,8 +491,11 @@ takes you to it. Nothing is ever sent to readers from here: publishing stays a b
 you press on Substack.
 
 1. **Signing in.** Substack has no publishing API, so Stet uses the one its own editor does, with your session cookie. The first time, the menu asks for it: in your browser, on substack.com, DevTools → Application → Cookies → `substack.sid`. It is kept in the macOS login keychain and nowhere else, never shown, and sent only to Substack over HTTPS (to a custom domain only once Substack says the domain is yours).
-2. **What carries over.** Headings, emphasis, links, lists, quotes, code, pictures with captions, footnotes. A table goes up as preformatted text, and a local video as a link, because Substack's editor has neither; the menu says so before you send.
-3. **It may break.** This is Substack's private interface, undocumented and theirs to change.
+2. **What carries over.** Headings, emphasis, links, lists, quotes, code, pictures with captions, footnotes. A table goes up as preformatted text, because Substack's editor has none; the menu says so before you send.
+3. **Videos.** A YouTube address becomes an embed. A local video is either uploaded to YouTube and embedded, or left as a link: the menu's **Videos** line picks which. Each video is uploaded once. Stet remembers the file by its contents (in `youtube-uploads.json` beside its settings), so publishing the same post again, or another post with the same video, reuses the upload, and only uploads again if that video was deleted from YouTube.
+4. **It may break.** This is Substack's private interface, undocumented and theirs to change.
+
+**Connecting YouTube.** `:youtube` (File → Connect YouTube…) signs in with your own Google OAuth client. Make one first: in Google Cloud, enable the *YouTube Data API v3*, then Credentials → Create OAuth client ID → *Desktop app*. Paste its ID and secret, and **Sign in with Google** finishes in your browser. The client and the sign-in are kept in the macOS login keychain. Once you're signed in, the same page shows the channel and who sees uploads (Unlisted by default, which is enough for an embed). Google's rules apply: a project that has not passed YouTube's API audit can only upload private videos, and while its consent screen is in *Testing* the sign-in lapses after seven days.
 
 Pages like this one are how Stet asks for settings. They sit in the command menu's panel and work the way it does: ↑ and ↓ move, typing fills in the selected line, ← and → change a choice, Enter acts, Esc closes.
 
diff --git a/crates/stet-app/Cargo.toml b/crates/stet-app/Cargo.toml
index 4434fc7..9102c1d 100644
--- a/crates/stet-app/Cargo.toml
+++ b/crates/stet-app/Cargo.toml
@@ -29,6 +29,7 @@ serde_json = "1"
 open = "5"
 ureq = { version = "3", optional = true }
 stet-substack = { path = "../stet-substack", optional = true }
+stet-youtube = { path = "../stet-youtube", optional = true }
 
 [target.'cfg(target_os = "macos")'.dependencies]
 muda = { version = "0.21", default-features = false }
@@ -36,8 +37,10 @@ objc2 = "0.5"
 objc2-foundation = { version = "0.2", features = ["NSArray", "NSString", "NSURL"] }
 
 [features]
-default = ["remote-images", "substack"]
+default = ["remote-images", "substack", "youtube"]
 # Publish a document to Substack as a draft.
 substack = ["dep:stet-substack"]
+# Sign in to YouTube, and upload a published document's videos there.
+youtube = ["dep:stet-youtube"]
 # Fetch images referenced by http(s) URLs.
 remote-images = ["dep:ureq"]
diff --git a/crates/stet-app/src/app.rs b/crates/stet-app/src/app.rs
index 8dfebd0..cad283c 100644
--- a/crates/stet-app/src/app.rs
+++ b/crates/stet-app/src/app.rs
@@ -356,7 +356,9 @@ impl Running {
                 editor,
                 view,
                 #[cfg(feature = "substack")]
-                publish: crate::publish::Publisher::new(wake),
+                publish: crate::publish::Publisher::new(wake.clone()),
+                #[cfg(feature = "youtube")]
+                youtube: crate::youtube::Connector::new(wake),
             },
             gpu: Gpu::new(device, queue, format),
             surface,
@@ -439,6 +441,8 @@ impl Running {
         self.gpu.free_images(&stale);
         #[cfg(feature = "substack")]
         self.session.publish.poll(&mut self.session.editor);
+        #[cfg(feature = "youtube")]
+        self.session.youtube.poll(&mut self.session.editor);
         if !self.drawn {
             crate::timing("first redraw requested");
         }
@@ -543,7 +547,8 @@ impl Running {
             prose_font: editor.config.prose_font.first().cloned(),
             mono_font: editor.config.mono_font.first().cloned(),
             window: self.window.fullscreen().is_none().then_some((size.width, size.height)),
-            substack: platform::State::load().substack,
+            // Kept by the sheets that set them, not by the window.
+            ..platform::State::load()
         }
         .save();
     }
@@ -1207,11 +1212,19 @@ fn headless_session(args: &Args) -> Session {
         publish.offline = true;
         publish
     };
+    #[cfg(feature = "youtube")]
+    let youtube = {
+        let mut youtube = crate::youtube::Connector::new(no_wake());
+        youtube.offline = true;
+        youtube
+    };
     Session {
         editor,
         view,
         #[cfg(feature = "substack")]
         publish,
+        #[cfg(feature = "youtube")]
+        youtube,
     }
 }
 
diff --git a/crates/stet-app/src/macos.rs b/crates/stet-app/src/macos.rs
index 1f6a20e..6ffa3d6 100644
--- a/crates/stet-app/src/macos.rs
+++ b/crates/stet-app/src/macos.rs
@@ -105,6 +105,7 @@ const MENUS: &[(&str, &[(&str, &str)])] = &[
             ("Save", "<D-s>"),
             ("Save As…", "<D-S-s>"),
             ("Publish to Substack…", ":publish"),
+            ("Connect YouTube…", ":youtube"),
             ("", ""),
             ("Close Tab", "<D-w>"),
         ],
diff --git a/crates/stet-app/src/main.rs b/crates/stet-app/src/main.rs
index a627003..4fc193c 100644
--- a/crates/stet-app/src/main.rs
+++ b/crates/stet-app/src/main.rs
@@ -15,6 +15,8 @@ mod retouch;
 mod session;
 mod text;
 mod view;
+#[cfg(feature = "youtube")]
+mod youtube;
 
 use std::path::PathBuf;
 use std::sync::Arc;
diff --git a/crates/stet-app/src/platform.rs b/crates/stet-app/src/platform.rs
index cce243b..f1c8d74 100644
--- a/crates/stet-app/src/platform.rs
+++ b/crates/stet-app/src/platform.rs
@@ -126,6 +126,10 @@ pub struct State {
     pub window: Option<(f32, f32)>,
     /// The Substack publication last published to.
     pub substack: Option<String>,
+    /// Who sees uploaded videos: `unlisted`, `public` or `private`.
+    pub youtube_privacy: Option<String>,
+    /// What publishing did with local videos last: `youtube` or `link`.
+    pub videos: Option<String>,
 }
 
 impl State {
diff --git a/crates/stet-app/src/publish.rs b/crates/stet-app/src/publish.rs
index 8b1a02b..e83d27d 100644
--- a/crates/stet-app/src/publish.rs
+++ b/crates/stet-app/src/publish.rs
@@ -14,12 +14,24 @@ use stet_substack::{
 
 pub const SHEET: &str = "publish";
 const AUDIENCES: [(&str, &str); 2] = [("Everyone", "everyone"), ("Paid subscribers", "only_paid")];
+/// What to do with local videos, and the word the choice is remembered by.
+#[cfg(feature = "youtube")]
+const VIDEOS: [(&str, &str); 2] = [("Upload to YouTube", "youtube"), ("Link to the file", "link")];
 
 enum Event {
     /// Who the stored cookie belongs to; the flag says Substack refused it.
     Profile(Result<Profile, (bool, String)>),
+    /// How the work is going, for the sheet's status line.
+    Progress(String),
     /// The draft, and which publication it went to.
-    Made(Result<Created, String>, String),
+    Made(Result<(Created, Videos), String>, String),
+}
+
+/// What became of the document's local videos.
+#[derive(Default)]
+struct Videos {
+    uploaded: usize,
+    reused: usize,
 }
 
 pub struct Publisher {
@@ -55,6 +67,82 @@ fn primary(id: &'static str, label: &str, enabled: bool) -> Button {
     }
 }
 
+impl Videos {
+    fn said(&self) -> String {
+        let count = |n: usize, what: &str| match n {
+            1 => format!("one {what}"),
+            n => format!("{n} {what}s"),
+        };
+        match (self.uploaded, self.reused) {
+            (0, 0) => String::new(),
+            (up, 0) => format!(" {} uploaded to YouTube.", capital(&count(up, "video"))),
+            (0, re) => format!(" {} already on YouTube, reused.", capital(&count(re, "video"))),
+            (up, re) => format!(" {} uploaded to YouTube, {re} reused.", capital(&count(up, "video"))),
+        }
+    }
+}
+
+fn capital(text: &str) -> String {
+    let mut chars = text.chars();
+    chars
+        .next()
+        .map_or(String::new(), |first| first.to_uppercase().chain(chars).collect())
+}
+
+/// Each local video to YouTube, once: the ledger finds what was uploaded
+/// before. Returns where each video went, by the address it is written with.
+#[cfg(feature = "youtube")]
+fn upload_videos(
+    sources: &[String],
+    folder: &std::path::Path,
+    title: &str,
+    progress: &dyn Fn(String),
+) -> Result<(std::collections::HashMap<String, String>, Videos), String> {
+    use stet_youtube::{Error as YouTubeError, Outcome};
+    if sources.is_empty() {
+        return Ok(Default::default());
+    }
+    let said = |err: YouTubeError| match err {
+        YouTubeError::SignedOut(_) => {
+            "Google no longer accepts the YouTube sign-in: run :youtube to sign in again.".to_string()
+        }
+        err => err.to_string(),
+    };
+    let ledger = crate::platform::config_dir()
+        .ok_or("there is no settings folder to remember uploads in")?
+        .join("youtube-uploads.json");
+    progress("Signing in to YouTube…".into());
+    let client = stet_youtube::Client::from_keychain().map_err(said)?;
+    let channel = client.channel().map_err(said)?;
+    let privacy = crate::youtube::privacy();
+    let mut hosted = std::collections::HashMap::new();
+    let mut videos = Videos::default();
+    for (at, src) in sources.iter().enumerate() {
+        let path = stet_substack::resolve(src, folder);
+        let name = path.file_name().and_then(|n| n.to_str()).unwrap_or(src).to_string();
+        let of = match sources.len() {
+            1 => String::new(),
+            all => format!(" ({} of {all})", at + 1),
+        };
+        progress(format!("Sending {name} to YouTube{of}…"));
+        let stem = path.file_stem().and_then(|n| n.to_str()).unwrap_or(&name);
+        let video_title = match (title.is_empty(), sources.len()) {
+            (true, _) => stem.to_string(),
+            (false, 1) => title.to_string(),
+            (false, _) => format!("{title} – {stem}"),
+        };
+        let outcome =
+            stet_youtube::upload_once(&client, &channel, &ledger, &path, &video_title, privacy).map_err(said)?;
+        match &outcome {
+            Outcome::Uploaded(_) => videos.uploaded += 1,
+            Outcome::Reused(_) => videos.reused += 1,
+        }
+        hosted.insert(src.clone(), stet_youtube::watch_url(outcome.video()));
+    }
+    progress("Creating the draft…".into());
+    Ok((hosted, videos))
+}
+
 impl Publisher {
     pub fn new(wake: Arc<dyn Fn() + Send + Sync>) -> Publisher {
         let (sender, receiver) = channel();
@@ -70,17 +158,22 @@ impl Publisher {
     }
 
     /// Runs `work` off the UI thread and wakes the window with its answer.
-    fn spawn(&self, work: impl FnOnce() -> Event + Send + 'static) {
+    /// `work` can say how it is going on the way.
+    fn spawn(&self, work: impl FnOnce(&dyn Fn(String)) -> Event + Send + 'static) {
         let (sender, wake, run) = (self.sender.clone(), self.wake.clone(), self.run);
         std::thread::spawn(move || {
-            let _ = sender.send((run, work()));
+            let progress = |said: String| {
+                let _ = sender.send((run, Event::Progress(said)));
+                wake();
+            };
+            let _ = sender.send((run, work(&progress)));
             wake();
         });
     }
 
     /// Asks Substack whose cookie the keychain holds.
     fn check(&self) {
-        self.spawn(|| {
+        self.spawn(|_| {
             // The profile lives on substack.com itself, whatever the publication.
             let profile = Client::from_keychain("substack").and_then(|client| client.profile());
             Event::Profile(profile.map_err(|err| (matches!(err, Error::CookieRejected { .. }), err.to_string())))
@@ -114,6 +207,14 @@ impl Publisher {
         ));
         let audiences = AUDIENCES.map(|(label, _)| label);
         rows.push(Row::choice("audience", "Audience", &audiences, 0));
+        #[cfg(feature = "youtube")]
+        if !document.local_videos.is_empty() {
+            // Upload, unless linking was chosen last time or YouTube is not signed in.
+            let remembered = crate::platform::State::load().videos;
+            let link = remembered.as_deref() == Some("link") || (!self.offline && !stet_youtube::keychain::signed_in());
+            let options = VIDEOS.map(|(label, _)| label);
+            rows.push(Row::choice("videos", "Videos", &options, link as usize));
+        }
         let pictures = match document.local_images().len() {
             0 => String::new(),
             1 => " One picture will be uploaded.".to_string(),
@@ -124,8 +225,16 @@ impl Publisher {
             "",
             &format!("It goes up as a draft; nothing is sent to readers.{pictures}"),
         ));
-        if let Some(first) = document.warnings.first() {
-            let more = match document.warnings.len() - 1 {
+        // The videos row says what becomes of them; their warnings would repeat it.
+        let warnings: Vec<&String> = document
+            .warnings
+            .iter()
+            .filter(|warning| {
+                !(cfg!(feature = "youtube") && document.local_videos.iter().any(|v| warning.contains(v.as_str())))
+            })
+            .collect();
+        if let Some(first) = warnings.first() {
+            let more = match warnings.len() - 1 {
                 0 => String::new(),
                 more => format!(" (and {more} more)"),
             };
@@ -183,7 +292,29 @@ impl Publisher {
                     return;
                 };
                 let markdown = editor.buf.text();
-                let local = !convert(&markdown, &Options::default()).local_images().is_empty();
+                let document = convert(&markdown, &Options::default());
+                #[cfg(feature = "youtube")]
+                let to_youtube: Vec<String> = match sheet.chosen("videos") {
+                    Some(0) => document.local_videos.clone(),
+                    _ => Vec::new(),
+                };
+                #[cfg(feature = "youtube")]
+                if let Some(chosen) = sheet.chosen("videos") {
+                    if chosen == 0 && !stet_youtube::keychain::signed_in() {
+                        sheet.status = Some((
+                            "YouTube is not signed in: run :youtube first, or link the videos.".into(),
+                            true,
+                        ));
+                        return;
+                    }
+                    let mut state = crate::platform::State::load();
+                    state.videos = Some(VIDEOS[chosen.min(1)].1.to_string());
+                    state.save();
+                }
+                #[cfg(feature = "youtube")]
+                let local = !document.local_images().is_empty() || !to_youtube.is_empty();
+                #[cfg(not(feature = "youtube"))]
+                let local = !document.local_images().is_empty();
                 // Pictures are found beside the document; without any, anywhere will do.
                 let beside = editor.path.as_deref().and_then(std::path::Path::parent);
                 let Some(folder) = beside.or((!local).then_some(std::path::Path::new("."))) else {
@@ -191,7 +322,10 @@ impl Publisher {
                     return;
                 };
                 let folder = folder.to_path_buf();
-                let options = DraftOptions {
+                #[cfg(feature = "youtube")]
+                let post_title = sheet.text("title").unwrap_or("").trim().to_string();
+                #[cfg_attr(not(feature = "youtube"), allow(unused_mut))]
+                let mut options = DraftOptions {
                     audience: AUDIENCES[sheet.chosen("audience").unwrap_or(0).min(1)].1.to_string(),
                     title: sheet.text("title").map(str::to_string),
                     subtitle: sheet.text("subtitle").map(str::to_string),
@@ -199,11 +333,27 @@ impl Publisher {
                 };
                 sheet.busy = true;
                 sheet.status = Some(("Creating the draft…".into(), false));
-                self.spawn(move || {
+                self.spawn(move |progress| {
+                    #[cfg(feature = "youtube")]
+                    let videos = match upload_videos(&to_youtube, &folder, &post_title, progress) {
+                        Ok((hosted, videos)) => {
+                            options.convert.videos = hosted;
+                            videos
+                        }
+                        Err(why) => return Event::Made(Err(why), publication),
+                    };
+                    #[cfg(not(feature = "youtube"))]
+                    let videos = {
+                        let _ = progress;
+                        Videos::default()
+                    };
                     let made = Client::from_keychain(&publication).and_then(|client| {
                         create_draft_from_markdown(&client, &markdown, &folder, "Untitled", &options)
                     });
-                    Event::Made(made.map_err(|err| err.to_string()), publication)
+                    Event::Made(
+                        made.map(|created| (created, videos)).map_err(|err| err.to_string()),
+                        publication,
+                    )
                 });
             }
             _ => editor.close_sheet(),
@@ -256,7 +406,9 @@ impl Publisher {
                     };
                     sheet.status = Some((said, true));
                 }
-                (Event::Made(Ok(created), publication), sheet) => {
+                (Event::Progress(said), Some(sheet)) => sheet.status = Some((said, false)),
+                (Event::Progress(_), None) => {}
+                (Event::Made(Ok((created, videos)), publication), sheet) => {
                     let mut state = crate::platform::State::load();
                     state.substack = Some(publication);
                     state.save();
@@ -265,6 +417,7 @@ impl Publisher {
                         1 => " One picture uploaded.".to_string(),
                         count => format!(" {count} pictures uploaded."),
                     };
+                    let pictures = pictures + &videos.said();
                     match sheet {
                         Some(sheet) => {
                             sheet.busy = false;
diff --git a/crates/stet-app/src/session.rs b/crates/stet-app/src/session.rs
index 5e69060..bb759be 100644
--- a/crates/stet-app/src/session.rs
+++ b/crates/stet-app/src/session.rs
@@ -12,6 +12,8 @@ pub struct Session {
     pub view: View,
     #[cfg(feature = "substack")]
     pub publish: crate::publish::Publisher,
+    #[cfg(feature = "youtube")]
+    pub youtube: crate::youtube::Connector,
 }
 
 impl Session {
@@ -136,6 +138,14 @@ impl Session {
                 }
                 #[cfg(not(feature = "substack"))]
                 Effect::Publish => self.say(Err("this build of stet cannot publish".to_string())),
+                #[cfg(feature = "youtube")]
+                Effect::YouTube => self.youtube.open(&mut self.editor),
+                #[cfg(feature = "youtube")]
+                Effect::Sheet { sheet, button } if sheet == crate::youtube::SHEET => {
+                    self.youtube.act(&mut self.editor, button)
+                }
+                #[cfg(not(feature = "youtube"))]
+                Effect::YouTube => self.say(Err("this build of stet cannot upload to YouTube".to_string())),
                 Effect::Zoom(step) => {
                     self.view.set_zoom(step);
                     rest.push(Effect::Zoom(step));
diff --git a/crates/stet-app/src/youtube.rs b/crates/stet-app/src/youtube.rs
new file mode 100644
index 0000000..1c4fc90
--- /dev/null
+++ b/crates/stet-app/src/youtube.rs
@@ -0,0 +1,236 @@
+//! YouTube, where a published document's videos go: the sheet that signs in
+//! and says to which channel, and the work behind its buttons. As with
+//! Substack, the network is never touched on the UI thread, and what is
+//! typed goes from the sheet into the keychain without being kept here.
+
+use std::sync::Arc;
+use std::sync::mpsc::{Receiver, Sender, channel};
+use std::time::Duration;
+use stet_core::Editor;
+use stet_core::editor::{Button, Row, Sheet};
+use stet_youtube::{Channel, Client, Error, Privacy, Ureq, keychain, oauth};
+
+pub const SHEET: &str = "youtube";
+/// How long the browser has to come back from Google.
+const SIGN_IN_WAIT: Duration = Duration::from_secs(300);
+
+enum Event {
+    /// The channel the stored sign-in uploads to; the flag says Google refused it.
+    Channel(Result<Channel, (bool, String)>),
+}
+
+pub struct Connector {
+    wake: Arc<dyn Fn() + Send + Sync>,
+    sender: Sender<(u64, Event)>,
+    receiver: Receiver<(u64, Event)>,
+    /// Which opening of the sheet answers belong to; late ones are dropped.
+    run: u64,
+    /// No keychain and no network: a screenshot wants only the sheet.
+    pub offline: bool,
+}
+
+/// Who sees uploads, as last chosen.
+pub fn privacy() -> Privacy {
+    crate::platform::State::load()
+        .youtube_privacy
+        .as_deref()
+        .and_then(Privacy::parse)
+        .unwrap_or_default()
+}
+
+fn sign_in_rows(client_id: &str) -> [Row; 3] {
+    [
+        Row::text("client-id", "Client ID", client_id, "….apps.googleusercontent.com"),
+        Row::secret("client-secret", "Client secret", "GOCSPX-…"),
+        Row::note(
+            "client-help",
+            "",
+            "In Google Cloud: enable the YouTube Data API v3, then Credentials → Create OAuth client ID → Desktop app",
+        ),
+    ]
+}
+
+fn signed_in_rows() -> [Row; 3] {
+    let labels = Privacy::ALL.map(Privacy::label);
+    let chosen = Privacy::ALL.iter().position(|p| *p == privacy()).unwrap_or(0);
+    [
+        Row::note("channel", "Channel", "Checking your sign-in…"),
+        Row::choice("privacy", "Privacy", &labels, chosen),
+        Row::note(
+            "about",
+            "",
+            "Publishing uploads each video once; publishing again reuses it.",
+        ),
+    ]
+}
+
+fn signed_in_buttons() -> Vec<Button> {
+    vec![Button::new("signout", "Sign out"), Button::new("done", "Done")]
+}
+
+/// The sheet as it is when signed out, with `why` if there is something to say.
+fn show_signed_out(sheet: &mut Sheet, why: Option<String>) {
+    // The client id is not secret; it stays for another try.
+    let client_id = sheet.text("client-id").unwrap_or("").to_string();
+    for id in ["channel", "privacy", "about"] {
+        sheet.remove(id);
+    }
+    for (at, row) in sign_in_rows(&client_id).into_iter().enumerate() {
+        sheet.put(at, row);
+    }
+    sheet.buttons = vec![Button::new("signin", "Sign in with Google")];
+    sheet.busy = false;
+    sheet.focus_first();
+    sheet.status = why.map(|why| (why, true));
+}
+
+impl Connector {
+    pub fn new(wake: Arc<dyn Fn() + Send + Sync>) -> Connector {
+        let (sender, receiver) = channel();
+        Connector {
+            wake,
+            sender,
+            receiver,
+            run: 0,
+            offline: false,
+        }
+    }
+
+    fn spawn(&self, work: impl FnOnce() -> Event + Send + 'static) {
+        let (sender, wake, run) = (self.sender.clone(), self.wake.clone(), self.run);
+        std::thread::spawn(move || {
+            let _ = sender.send((run, work()));
+            wake();
+        });
+    }
+
+    /// Asks Google which channel the stored sign-in belongs to.
+    fn check(&self) {
+        self.spawn(|| {
+            let channel = Client::from_keychain().and_then(|client| client.channel());
+            Event::Channel(channel.map_err(|err| (matches!(err, Error::SignedOut(_)), err.to_string())))
+        });
+    }
+
+    /// `:youtube`: signed in, the channel and who sees uploads; if not, how to sign in.
+    pub fn open(&mut self, editor: &mut Editor) {
+        self.run += 1;
+        let signed_in = !self.offline && keychain::signed_in();
+        let sheet = match signed_in {
+            true => Sheet::new(SHEET, "YouTube", signed_in_rows().to_vec(), signed_in_buttons()),
+            false => Sheet::new(
+                SHEET,
+                "Connect YouTube",
+                sign_in_rows("").to_vec(),
+                vec![Button::new("signin", "Sign in with Google")],
+            ),
+        };
+        if signed_in {
+            self.check();
+        }
+        editor.open_sheet(sheet);
+    }
+
+    /// A button of the sheet was pressed.
+    pub fn act(&mut self, editor: &mut Editor, button: &str) {
+        let Some(sheet) = editor.sheet.as_mut().filter(|sheet| sheet.id == SHEET) else {
+            return;
+        };
+        match button {
+            "signin" => {
+                let id = sheet.text("client-id").unwrap_or("").trim().to_string();
+                let secret = sheet.text("client-secret").unwrap_or("").trim().to_string();
+                if id.is_empty() || secret.is_empty() {
+                    sheet.status = Some(("Paste the client ID and its secret first.".into(), true));
+                    return;
+                }
+                let begun = match oauth::begin(&id) {
+                    Ok(begun) => begun,
+                    Err(err) => {
+                        sheet.status = Some((err.to_string(), true));
+                        return;
+                    }
+                };
+                if let Err(err) = open::that_detached(&begun.url) {
+                    sheet.status = Some((format!("cannot open the browser: {err}"), true));
+                    return;
+                }
+                // What was typed does not stay in the window while the browser is out.
+                sheet.remove("client-secret");
+                sheet.busy = true;
+                sheet.status = Some(("Finish signing in in your browser…".into(), false));
+                self.spawn(move || {
+                    let channel = begun
+                        .finish(&Ureq::default(), &id, &secret, SIGN_IN_WAIT)
+                        .and_then(|credentials| {
+                            keychain::store(&credentials)?;
+                            Client::signed_in(Ureq::default(), &credentials)?.channel()
+                        });
+                    Event::Channel(channel.map_err(|err| (false, err.to_string())))
+                });
+            }
+            "signout" => {
+                let said = match keychain::forget() {
+                    Ok(_) => "Signed out. Videos already uploaded stay on YouTube.".to_string(),
+                    Err(err) => err.to_string(),
+                };
+                sheet.title = "Connect YouTube".into();
+                show_signed_out(sheet, None);
+                sheet.status = Some((said, false));
+            }
+            "done" => {
+                if let Some(chosen) = sheet.chosen("privacy") {
+                    let mut state = crate::platform::State::load();
+                    state.youtube_privacy = Some(Privacy::ALL[chosen.min(2)].as_str().to_string());
+                    state.save();
+                }
+                editor.close_sheet();
+            }
+            _ => editor.close_sheet(),
+        }
+    }
+
+    /// Takes in what Google answered. True if anything changed.
+    pub fn poll(&mut self, editor: &mut Editor) -> bool {
+        let mut changed = false;
+        while let Ok((run, event)) = self.receiver.try_recv() {
+            if run != self.run {
+                continue;
+            }
+            changed = true;
+            let Some(sheet) = editor.sheet.as_mut().filter(|sheet| sheet.id == SHEET) else {
+                continue;
+            };
+            match event {
+                Event::Channel(Ok(channel)) => {
+                    let had_sign_in = sheet.row("client-id").is_some();
+                    sheet.title = "YouTube".into();
+                    for id in ["client-id", "client-secret", "client-help"] {
+                        sheet.remove(id);
+                    }
+                    for (at, row) in signed_in_rows().into_iter().enumerate() {
+                        sheet.put(at, row);
+                    }
+                    sheet.put(0, Row::note("channel", "Channel", &channel.title));
+                    sheet.buttons = signed_in_buttons();
+                    sheet.busy = false;
+                    sheet.focus_first();
+                    sheet.status = had_sign_in.then(|| ("Signed in. Videos will go to this channel.".into(), false));
+                }
+                Event::Channel(Err((true, _))) => show_signed_out(
+                    sheet,
+                    Some("Google no longer accepts the saved sign-in. Sign in again.".into()),
+                ),
+                Event::Channel(Err((false, why))) => match sheet.row("client-id") {
+                    // A sign-in that failed: try again from the start.
+                    Some(_) => show_signed_out(sheet, Some(why)),
+                    None => {
+                        sheet.busy = false;
+                        sheet.status = Some((why, true));
+                    }
+                },
+            }
+        }
+        changed
+    }
+}
diff --git a/crates/stet-core/src/editor/command.rs b/crates/stet-core/src/editor/command.rs
index b31c45c..4df8269 100644
--- a/crates/stet-core/src/editor/command.rs
+++ b/crates/stet-core/src/editor/command.rs
@@ -166,6 +166,7 @@ impl Editor {
             "pasteplain" => self.paste(true),
             "image" | "retouch" => self.effects.push(super::Effect::EditImage),
             "publish" | "substack" => self.effects.push(super::Effect::Publish),
+            "youtube" => self.effects.push(super::Effect::YouTube),
             "margin" | "scratch" => self.toggle_margin(),
             "pane" | "other" => self.switch_pane(),
             "send" | "copyover" => self.send_to_other_pane(false),
diff --git a/crates/stet-core/src/editor/mod.rs b/crates/stet-core/src/editor/mod.rs
index 7e1b305..11289cb 100644
--- a/crates/stet-core/src/editor/mod.rs
+++ b/crates/stet-core/src/editor/mod.rs
@@ -144,6 +144,8 @@ pub enum Effect {
     EditImage,
     /// Offer to publish the document.
     Publish,
+    /// Offer to sign in to YouTube, where a published document's videos go.
+    YouTube,
     /// A sheet's button was pressed.
     Sheet {
         sheet: &'static str,
diff --git a/crates/stet-core/src/editor/palette.rs b/crates/stet-core/src/editor/palette.rs
index f7b8deb..f0c346b 100644
--- a/crates/stet-core/src/editor/palette.rs
+++ b/crates/stet-core/src/editor/palette.rs
@@ -262,6 +262,7 @@ impl Editor {
             command("Paste as plain text", chord(true, "V"), "pasteplain"),
             command("Retouch the picture on this line", ":image".to_string(), "image"),
             command("Publish to Substack…", ":publish".to_string(), "publish"),
+            command("Connect YouTube…", ":youtube".to_string(), "youtube"),
             command("Tidy the table", ":table".to_string(), "table"),
             command("Add a table row", ":table row".to_string(), "table row"),
             command("Add a table column", ":table column".to_string(), "table column"),
diff --git a/crates/stet-core/src/editor/tests.rs b/crates/stet-core/src/editor/tests.rs
index 2dcaf20..e517f57 100644
--- a/crates/stet-core/src/editor/tests.rs
+++ b/crates/stet-core/src/editor/tests.rs
@@ -1862,6 +1862,8 @@ fn a_sheet_takes_the_keyboard_and_reports_its_buttons() {
     );
     keys(&mut ed, ":publish<CR>");
     assert_eq!(ed.take_effects(), vec![Effect::Publish]);
+    keys(&mut ed, ":youtube<CR>");
+    assert_eq!(ed.take_effects(), vec![Effect::YouTube]);
     let rows = vec![
         Row::note("about", "", "Words to read"),
         Row::secret("key", "Key", "paste it"),
diff --git a/crates/stet-substack/src/convert.rs b/crates/stet-substack/src/convert.rs
index b33af3e..cea6f0b 100644
--- a/crates/stet-substack/src/convert.rs
+++ b/crates/stet-substack/src/convert.rs
@@ -24,6 +24,9 @@ pub struct Options {
     pub code_block: CodeBlockNode,
     /// Show an image's alt text as its caption when it has no title.
     pub alt_as_caption: bool,
+    /// Local videos already hosted elsewhere, by the address they are written
+    /// with: a YouTube address here makes the video an embed, not a link.
+    pub videos: HashMap<String, String>,
 }
 
 #[derive(Clone, Debug, PartialEq)]
@@ -34,6 +37,8 @@ pub struct Document {
     pub body: Value,
     /// Things that were approximated or dropped.
     pub warnings: Vec<String>,
+    /// Addresses of local videos, in order, without repeats; hosted or not.
+    pub local_videos: Vec<String>,
 }
 
 /// A hosted image to swap in for a local one.
@@ -150,6 +155,7 @@ pub fn convert(markdown: &str, options: &Options) -> Document {
         pos: 0,
         options,
         warnings: Vec::new(),
+        local_videos: Vec::new(),
         numbers: HashMap::new(),
         refs: Vec::new(),
     };
@@ -167,6 +173,7 @@ struct Conv<'a> {
     pos: usize,
     options: &'a Options,
     warnings: Vec<String>,
+    local_videos: Vec<String>,
     /// Footnote label to its number, by first reference.
     numbers: HashMap<String, usize>,
     /// Labels referenced inside the top-level block being read.
@@ -230,6 +237,7 @@ impl<'a> Conv<'a> {
             subtitle: subtitle.filter(|s| !s.is_empty()),
             body: json!({"type": "doc", "content": content}),
             warnings: std::mem::take(&mut self.warnings),
+            local_videos: std::mem::take(&mut self.local_videos),
         }
     }
 
@@ -502,6 +510,12 @@ impl<'a> Conv<'a> {
         if let Some(id) = youtube_id(src) {
             return vec![Seg::Block(json!({"type": "youtube2", "attrs": {"videoId": id}}))];
         }
+        if is_video(src) && !is_remote(src) && !self.local_videos.iter().any(|seen| seen == src) {
+            self.local_videos.push(src.to_string());
+        }
+        if let Some(id) = self.options.videos.get(src).and_then(|url| youtube_id(url)) {
+            return vec![Seg::Block(json!({"type": "youtube2", "attrs": {"videoId": id}}))];
+        }
         if is_video(src) {
             // image2 only takes pictures and a video cannot be uploaded this way: link it.
             self.warnings
@@ -981,6 +995,25 @@ mod tests {
         assert_eq!(d.body["content"][1]["content"][0]["text"], "x.webm");
         assert_eq!(d.warnings.len(), 2);
         assert!(d.local_images().is_empty());
+        assert_eq!(d.local_videos, ["clips/demo.MP4", "x.webm"]);
+    }
+
+    #[test]
+    fn a_hosted_local_video_becomes_an_embed() {
+        let options = Options {
+            videos: HashMap::from([("clips/demo.mp4".to_string(), "https://youtu.be/dQw4w9WgXcQ".to_string())]),
+            ..Options::default()
+        };
+        let d = convert(
+            "![demo](clips/demo.mp4)\n\n![](clips/demo.mp4)\n\n![](other.mov)",
+            &options,
+        );
+        let embed = json!({"type": "youtube2", "attrs": {"videoId": "dQw4w9WgXcQ"}});
+        assert_eq!(d.body["content"][0], embed);
+        assert_eq!(d.body["content"][1], embed);
+        assert_eq!(d.body["content"][2]["content"][0]["text"], "other.mov");
+        assert_eq!(d.warnings.len(), 1, "{:?}", d.warnings);
+        assert_eq!(d.local_videos, ["clips/demo.mp4", "other.mov"]);
     }
 
     #[test]
diff --git a/crates/stet-youtube/Cargo.toml b/crates/stet-youtube/Cargo.toml
new file mode 100644
index 0000000..8887126
--- /dev/null
+++ b/crates/stet-youtube/Cargo.toml
@@ -0,0 +1,15 @@
+[package]
+name = "stet-youtube"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+rust-version.workspace = true
+repository.workspace = true
+homepage.workspace = true
+description = "Upload a document's videos to YouTube, once each, over the YouTube Data API"
+
+[dependencies]
+getrandom = "0.3"
+serde_json = "1"
+sha2 = "0.10"
+ureq = "3"
diff --git a/crates/stet-youtube/src/client.rs b/crates/stet-youtube/src/client.rs
new file mode 100644
index 0000000..aec70e7
--- /dev/null
+++ b/crates/stet-youtube/src/client.rs
@@ -0,0 +1,348 @@
+//! The YouTube Data API v3, one method per call.
+
+use crate::error::{Error, Result, summary};
+use crate::http::{Body, Method, Request, Response, Transport, Ureq};
+use crate::keychain::Credentials;
+use crate::oauth;
+use serde_json::{Value, json};
+use std::path::Path;
+
+const API: &str = "https://www.googleapis.com/youtube/v3";
+const UPLOAD: &str = "https://www.googleapis.com/upload/youtube/v3/videos?uploadType=resumable&part=snippet,status";
+/// YouTube's own limit on a title.
+const TITLE_CHARS: usize = 100;
+
+/// Who sees an uploaded video.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub enum Privacy {
+    /// Anyone with the address, which is what an embed needs.
+    #[default]
+    Unlisted,
+    Public,
+    Private,
+}
+
+impl Privacy {
+    pub const ALL: [Privacy; 3] = [Privacy::Unlisted, Privacy::Public, Privacy::Private];
+
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Privacy::Unlisted => "unlisted",
+            Privacy::Public => "public",
+            Privacy::Private => "private",
+        }
+    }
+
+    pub fn label(self) -> &'static str {
+        match self {
+            Privacy::Unlisted => "Unlisted",
+            Privacy::Public => "Public",
+            Privacy::Private => "Private",
+        }
+    }
+
+    pub fn parse(text: &str) -> Option<Privacy> {
+        Privacy::ALL.into_iter().find(|privacy| privacy.as_str() == text)
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct Channel {
+    pub id: String,
+    pub title: String,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct UploadedVideo {
+    pub id: String,
+}
+
+/// What became of a video that was uploaded before.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum VideoState {
+    /// Still there, on this channel, and not rejected.
+    Live,
+    /// Deleted, rejected, failed, or not this channel's to reuse.
+    Gone,
+}
+
+pub struct Client<T: Transport = Ureq> {
+    transport: T,
+    access_token: String,
+}
+
+impl Client<Ureq> {
+    /// Signed in with what the keychain holds.
+    pub fn from_keychain() -> Result<Self> {
+        Self::signed_in(Ureq::default(), &crate::keychain::credentials()?)
+    }
+}
+
+impl<T: Transport> Client<T> {
+    /// Trades the refresh token for an access token, once.
+    pub fn signed_in(transport: T, credentials: &Credentials) -> Result<Self> {
+        let access_token = oauth::access_token(&transport, credentials)?;
+        Ok(Client {
+            transport,
+            access_token,
+        })
+    }
+
+    pub fn with_token(transport: T, access_token: &str) -> Self {
+        Client {
+            transport,
+            access_token: access_token.to_string(),
+        }
+    }
+
+    fn send(&self, method: Method, url: &str, headers: Vec<(String, String)>, body: Body) -> Result<Response> {
+        let mut all = vec![("Authorization".to_string(), format!("Bearer {}", self.access_token))];
+        all.extend(headers);
+        let response = self.transport.send(&Request {
+            method,
+            url: url.to_string(),
+            headers: all,
+            body,
+        })?;
+        match response.status {
+            200..=299 => Ok(response),
+            401 => Err(Error::SignedOut(summary(&response.body))),
+            status => Err(Error::Status {
+                status,
+                body: summary(&response.body),
+            }),
+        }
+    }
+
+    fn json(response: &Response) -> Result<Value> {
+        serde_json::from_str(&response.body).map_err(|_| Error::Response("the answer is not JSON".into()))
+    }
+
+    /// GET channels?mine=true: the channel videos go to.
+    pub fn channel(&self) -> Result<Channel> {
+        let response = self.send(
+            Method::Get,
+            &format!("{API}/channels?part=snippet&mine=true"),
+            Vec::new(),
+            Body::None,
+        )?;
+        let value = Self::json(&response)?;
+        let item = &value["items"][0];
+        let id = item["id"].as_str().ok_or_else(|| {
+            Error::Config("this Google account has no YouTube channel; make one on youtube.com first".into())
+        })?;
+        Ok(Channel {
+            id: id.to_string(),
+            title: item["snippet"]["title"].as_str().unwrap_or(id).to_string(),
+        })
+    }
+
+    /// GET videos?id=: whether an earlier upload can be used again.
+    pub fn video_state(&self, id: &str, channel: &str) -> Result<VideoState> {
+        let url = format!("{API}/videos?part=snippet,status&id={}", oauth::encode(id));
+        let value = Self::json(&self.send(Method::Get, &url, Vec::new(), Body::None)?)?;
+        let item = &value["items"][0];
+        let ours = item["snippet"]["channelId"].as_str() == Some(channel);
+        let broken = matches!(
+            item["status"]["uploadStatus"].as_str(),
+            Some("deleted" | "failed" | "rejected")
+        );
+        Ok(match item.is_object() && ours && !broken {
+            true => VideoState::Live,
+            false => VideoState::Gone,
+        })
+    }
+
+    /// The resumable upload: POST the details for a session address, then
+    /// PUT the file there. The file is streamed from disk.
+    pub fn upload(&self, path: &Path, title: &str, privacy: Privacy) -> Result<UploadedVideo> {
+        let size = std::fs::metadata(path)
+            .map_err(|err| Error::File(path.to_path_buf(), err))?
+            .len();
+        let mime = mime(path);
+        let details = json!({
+            "snippet": {"title": clean_title(title, path)},
+            "status": {"privacyStatus": privacy.as_str(), "selfDeclaredMadeForKids": false},
+        });
+        let started = self.send(
+            Method::Post,
+            UPLOAD,
+            vec![
+                ("Content-Type".into(), "application/json; charset=UTF-8".into()),
+                ("X-Upload-Content-Length".into(), size.to_string()),
+                ("X-Upload-Content-Type".into(), mime.into()),
+            ],
+            Body::Bytes(details.to_string().into_bytes()),
+        )?;
+        let session = started
+            .header("location")
+            .filter(|url| url.starts_with("https://www.googleapis.com/"))
+            .ok_or_else(|| Error::Response("YouTube gave no upload address".into()))?
+            .to_string();
+        let done = self.send(
+            Method::Put,
+            &session,
+            vec![("Content-Type".into(), mime.into())],
+            Body::File(path.to_path_buf()),
+        )?;
+        let value = Self::json(&done)?;
+        let id = value["id"]
+            .as_str()
+            .ok_or_else(|| Error::Response("the upload answer has no video id".into()))?;
+        Ok(UploadedVideo { id: id.to_string() })
+    }
+}
+
+/// A title YouTube takes: no angle brackets, at most 100 characters, never empty.
+fn clean_title(title: &str, path: &Path) -> String {
+    let stem = path.file_stem().and_then(|s| s.to_str()).unwrap_or("Video");
+    let title = match title.trim() {
+        "" => stem,
+        title => title,
+    };
+    let clean: String = title
+        .chars()
+        .filter(|c| !matches!(c, '<' | '>'))
+        .take(TITLE_CHARS)
+        .collect();
+    match clean.trim() {
+        "" => "Video".to_string(),
+        clean => clean.to_string(),
+    }
+}
+
+fn mime(path: &Path) -> &'static str {
+    let ext = path
+        .extension()
+        .and_then(|e| e.to_str())
+        .unwrap_or("")
+        .to_ascii_lowercase();
+    match ext.as_str() {
+        "mp4" | "m4v" => "video/mp4",
+        "mov" => "video/quicktime",
+        "webm" => "video/webm",
+        "ogv" => "video/ogg",
+        "avi" => "video/x-msvideo",
+        "mkv" => "video/x-matroska",
+        _ => "application/octet-stream",
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::http::mock::Mock;
+
+    fn client(mock: &Mock) -> Client<&Mock> {
+        Client::with_token(mock, "ya29.token")
+    }
+
+    #[test]
+    fn the_channel_is_read() {
+        let mock = Mock::default().reply(
+            200,
+            r#"{"items":[{"id":"UC1","snippet":{"title":"The Building Machine"}}]}"#,
+        );
+        let channel = client(&mock).channel().unwrap();
+        assert_eq!(
+            channel,
+            Channel {
+                id: "UC1".into(),
+                title: "The Building Machine".into()
+            }
+        );
+        let sent = mock.sent.borrow();
+        assert_eq!(
+            sent[0].url,
+            "https://www.googleapis.com/youtube/v3/channels?part=snippet&mine=true"
+        );
+        assert_eq!(sent[0].header("authorization"), Some("Bearer ya29.token"));
+    }
+
+    #[test]
+    fn an_account_without_a_channel_says_so() {
+        let mock = Mock::default().reply(200, r#"{"items":[]}"#);
+        assert!(
+            client(&mock)
+                .channel()
+                .unwrap_err()
+                .to_string()
+                .contains("no YouTube channel")
+        );
+    }
+
+    #[test]
+    fn video_state_checks_owner_and_status() {
+        let live = r#"{"items":[{"snippet":{"channelId":"UC1"},"status":{"uploadStatus":"processed"}}]}"#;
+        let other = r#"{"items":[{"snippet":{"channelId":"UC2"},"status":{"uploadStatus":"processed"}}]}"#;
+        let rejected = r#"{"items":[{"snippet":{"channelId":"UC1"},"status":{"uploadStatus":"rejected"}}]}"#;
+        let mock = Mock::default()
+            .reply(200, live)
+            .reply(200, other)
+            .reply(200, rejected)
+            .reply(200, r#"{"items":[]}"#);
+        let c = client(&mock);
+        assert_eq!(c.video_state("abc", "UC1").unwrap(), VideoState::Live);
+        assert_eq!(c.video_state("abc", "UC1").unwrap(), VideoState::Gone);
+        assert_eq!(c.video_state("abc", "UC1").unwrap(), VideoState::Gone);
+        assert_eq!(c.video_state("abc", "UC1").unwrap(), VideoState::Gone);
+        assert!(
+            mock.sent.borrow()[0]
+                .url
+                .ends_with("/videos?part=snippet,status&id=abc")
+        );
+    }
+
+    #[test]
+    fn upload_is_resumable_and_streams_the_file() {
+        let dir = std::env::temp_dir().join(format!("stet-youtube-client-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let path = dir.join("demo.mp4");
+        std::fs::write(&path, b"0123456789").unwrap();
+        let session = "https://www.googleapis.com/upload/youtube/v3/videos?uploadType=resumable&upload_id=X";
+        let mock = Mock::default()
+            .reply_with(200, &[("Location", session)], "")
+            .reply(200, r#"{"id":"vid123"}"#);
+        let uploaded = client(&mock).upload(&path, "A <b>post</b>", Privacy::Unlisted).unwrap();
+        assert_eq!(uploaded.id, "vid123");
+        let sent = mock.sent.borrow();
+        assert_eq!(sent[0].method, Method::Post);
+        assert_eq!(sent[0].url, UPLOAD);
+        assert_eq!(sent[0].header("x-upload-content-length"), Some("10"));
+        assert_eq!(sent[0].header("x-upload-content-type"), Some("video/mp4"));
+        let details: Value = serde_json::from_str(sent[0].text().unwrap()).unwrap();
+        assert_eq!(details["snippet"]["title"], "A bpost/b");
+        assert_eq!(details["status"]["privacyStatus"], "unlisted");
+        assert_eq!(sent[1].method, Method::Put);
+        assert_eq!(sent[1].url, session);
+        assert_eq!(sent[1].body, Body::File(path.clone()));
+        let _ = std::fs::remove_dir_all(dir);
+    }
+
+    #[test]
+    fn an_upload_address_elsewhere_is_refused() {
+        let dir = std::env::temp_dir().join(format!("stet-youtube-elsewhere-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let path = dir.join("demo.mp4");
+        std::fs::write(&path, b"x").unwrap();
+        let mock = Mock::default().reply_with(200, &[("Location", "https://evil.example/u")], "");
+        assert!(client(&mock).upload(&path, "t", Privacy::Unlisted).is_err());
+        assert_eq!(mock.sent.borrow().len(), 1);
+        let _ = std::fs::remove_dir_all(dir);
+    }
+
+    #[test]
+    fn titles_are_cleaned() {
+        let path = Path::new("/x/clip.mov");
+        assert_eq!(clean_title("  ", path), "clip");
+        assert_eq!(clean_title("<>", path), "Video");
+        assert_eq!(clean_title(&"a".repeat(150), path).len(), 100);
+    }
+
+    #[test]
+    fn a_401_means_signed_out() {
+        let mock = Mock::default().reply(401, r#"{"error":{"message":"Invalid Credentials"}}"#);
+        let err = client(&mock).channel().unwrap_err();
+        assert!(matches!(err, Error::SignedOut(_)), "{err}");
+    }
+}
diff --git a/crates/stet-youtube/src/error.rs b/crates/stet-youtube/src/error.rs
new file mode 100644
index 0000000..a8c8eeb
--- /dev/null
+++ b/crates/stet-youtube/src/error.rs
@@ -0,0 +1,51 @@
+use std::fmt;
+use std::path::PathBuf;
+
+pub type Result<T> = std::result::Result<T, Error>;
+
+#[derive(Debug)]
+pub enum Error {
+    /// Something handed in is unusable, or the keychain is not there; nothing was sent.
+    Config(String),
+    /// A local file could not be read or written.
+    File(PathBuf, std::io::Error),
+    /// The request never got an answer.
+    Network(String),
+    /// Google no longer accepts the sign-in: revoked, lapsed, or for another client.
+    SignedOut(String),
+    /// The browser sign-in did not finish: refused, timed out or answered wrongly.
+    SignIn(String),
+    /// Any other non-2xx answer; `body` is trimmed.
+    Status { status: u16, body: String },
+    /// A 2xx answer that is not what was expected.
+    Response(String),
+}
+
+impl fmt::Display for Error {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Error::Config(message) => write!(f, "{message}"),
+            Error::File(path, error) => write!(f, "cannot read {}: {error}", path.display()),
+            Error::Network(message) => write!(f, "network error: {message}"),
+            Error::SignedOut(why) => write!(f, "Google no longer accepts the YouTube sign-in ({why}); sign in again"),
+            Error::SignIn(message) => write!(f, "{message}"),
+            Error::Status { status, body } => write!(f, "YouTube answered HTTP {status}: {body}"),
+            Error::Response(message) => write!(f, "unexpected response: {message}"),
+        }
+    }
+}
+
+impl std::error::Error for Error {}
+
+/// The answer's own error message, or its first few hundred bytes.
+pub(crate) fn summary(body: &str) -> String {
+    let parsed: Option<serde_json::Value> = serde_json::from_str(body).ok();
+    let said = parsed.as_ref().and_then(|value| {
+        value["error"]["message"]
+            .as_str()
+            .or_else(|| value["error_description"].as_str())
+            .or_else(|| value["error"].as_str())
+            .map(str::to_string)
+    });
+    said.unwrap_or_else(|| body.chars().take(300).collect::<String>().trim().to_string())
+}
diff --git a/crates/stet-youtube/src/http.rs b/crates/stet-youtube/src/http.rs
new file mode 100644
index 0000000..605f4da
--- /dev/null
+++ b/crates/stet-youtube/src/http.rs
@@ -0,0 +1,215 @@
+//! The seam between request building and the network.
+
+use crate::error::{Error, Result};
+use std::fmt;
+use std::path::PathBuf;
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Method {
+    Get,
+    Post,
+    Put,
+}
+
+impl Method {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Method::Get => "GET",
+            Method::Post => "POST",
+            Method::Put => "PUT",
+        }
+    }
+}
+
+#[derive(Clone, PartialEq, Eq)]
+pub enum Body {
+    None,
+    /// Bytes in memory: JSON or a form. Its type is a header of the request.
+    Bytes(Vec<u8>),
+    /// A file, streamed rather than read in: a video can be gigabytes.
+    File(PathBuf),
+}
+
+impl fmt::Debug for Body {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Body::None => write!(f, "none"),
+            Body::Bytes(bytes) => write!(f, "{} bytes", bytes.len()),
+            Body::File(path) => write!(f, "{}", path.display()),
+        }
+    }
+}
+
+#[derive(Clone, PartialEq, Eq)]
+pub struct Request {
+    pub method: Method,
+    pub url: String,
+    pub headers: Vec<(String, String)>,
+    pub body: Body,
+}
+
+impl Request {
+    pub fn header(&self, name: &str) -> Option<&str> {
+        self.headers
+            .iter()
+            .find(|(k, _)| k.eq_ignore_ascii_case(name))
+            .map(|(_, v)| v.as_str())
+    }
+
+    /// The body as text, for tests and for nothing that is printed.
+    pub fn text(&self) -> Option<&str> {
+        match &self.body {
+            Body::Bytes(bytes) => std::str::from_utf8(bytes).ok(),
+            _ => None,
+        }
+    }
+}
+
+/// Tokens ride in the authorization header and in form bodies; neither is printed.
+impl fmt::Debug for Request {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        let headers: Vec<_> = self
+            .headers
+            .iter()
+            .map(|(k, v)| match k.eq_ignore_ascii_case("authorization") {
+                true => (k.as_str(), "<redacted>"),
+                false => (k.as_str(), v.as_str()),
+            })
+            .collect();
+        f.debug_struct("Request")
+            .field("method", &self.method)
+            .field("url", &self.url)
+            .field("headers", &headers)
+            .field("body", &self.body)
+            .finish()
+    }
+}
+
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct Response {
+    pub status: u16,
+    pub headers: Vec<(String, String)>,
+    pub body: String,
+}
+
+impl Response {
+    pub fn header(&self, name: &str) -> Option<&str> {
+        self.headers
+            .iter()
+            .find(|(k, _)| k.eq_ignore_ascii_case(name))
+            .map(|(_, v)| v.as_str())
+    }
+}
+
+/// Sends one request and returns whatever came back, whatever the status.
+pub trait Transport {
+    fn send(&self, request: &Request) -> Result<Response>;
+}
+
+/// `ureq`, with no redirects and no status-as-error. There is no overall
+/// time limit, since an upload takes as long as the video is big; a
+/// connection that stops answering still fails.
+pub struct Ureq {
+    agent: ureq::Agent,
+}
+
+impl Default for Ureq {
+    fn default() -> Self {
+        let minute = Some(std::time::Duration::from_secs(60));
+        let agent: ureq::Agent = ureq::Agent::config_builder()
+            .timeout_connect(minute)
+            .timeout_recv_response(Some(std::time::Duration::from_secs(300)))
+            .http_status_as_error(false)
+            .max_redirects(0)
+            .max_redirects_will_error(false)
+            .build()
+            .into();
+        Ureq { agent }
+    }
+}
+
+impl Transport for Ureq {
+    fn send(&self, request: &Request) -> Result<Response> {
+        let net = |e: ureq::Error| Error::Network(e.to_string());
+        macro_rules! headers {
+            ($builder:expr) => {{
+                let mut builder = $builder;
+                for (name, value) in &request.headers {
+                    builder = builder.header(name, value);
+                }
+                builder
+            }};
+        }
+        macro_rules! with_body {
+            ($builder:expr) => {{
+                let builder = headers!($builder);
+                match &request.body {
+                    Body::None => builder.send_empty().map_err(net)?,
+                    Body::Bytes(bytes) => builder.send(bytes.as_slice()).map_err(net)?,
+                    Body::File(path) => {
+                        let file = std::fs::File::open(path).map_err(|e| Error::File(path.clone(), e))?;
+                        builder.send(&file).map_err(net)?
+                    }
+                }
+            }};
+        }
+        let mut response = match request.method {
+            Method::Get => headers!(self.agent.get(&request.url)).call().map_err(net)?,
+            Method::Post => with_body!(self.agent.post(&request.url)),
+            Method::Put => with_body!(self.agent.put(&request.url)),
+        };
+        let status = response.status().as_u16();
+        let headers = response
+            .headers()
+            .iter()
+            .filter_map(|(k, v)| Some((k.as_str().to_string(), v.to_str().ok()?.to_string())))
+            .collect();
+        let body = response.body_mut().read_to_string().map_err(net)?;
+        Ok(Response { status, headers, body })
+    }
+}
+
+/// A transport that records requests and replays canned answers.
+#[cfg(test)]
+pub(crate) mod mock {
+    use super::*;
+    use std::cell::RefCell;
+    use std::collections::VecDeque;
+
+    #[derive(Default)]
+    pub struct Mock {
+        pub sent: RefCell<Vec<Request>>,
+        replies: RefCell<VecDeque<Response>>,
+    }
+
+    impl Mock {
+        pub fn reply(self, status: u16, body: &str) -> Self {
+            self.reply_with(status, &[], body)
+        }
+
+        pub fn reply_with(self, status: u16, headers: &[(&str, &str)], body: &str) -> Self {
+            self.replies.borrow_mut().push_back(Response {
+                status,
+                headers: headers.iter().map(|(k, v)| (k.to_string(), v.to_string())).collect(),
+                body: body.into(),
+            });
+            self
+        }
+
+        /// Method and URL of each request sent, in order.
+        pub fn steps(&self) -> Vec<(&'static str, String)> {
+            self.sent
+                .borrow()
+                .iter()
+                .map(|r| (r.method.as_str(), r.url.clone()))
+                .collect()
+        }
+    }
+
+    impl Transport for &Mock {
+        fn send(&self, request: &Request) -> Result<Response> {
+            self.sent.borrow_mut().push(request.clone());
+            Ok(self.replies.borrow_mut().pop_front().expect("unexpected request"))
+        }
+    }
+}
diff --git a/crates/stet-youtube/src/keychain.rs b/crates/stet-youtube/src/keychain.rs
new file mode 100644
index 0000000..f35ea3a
--- /dev/null
+++ b/crates/stet-youtube/src/keychain.rs
@@ -0,0 +1,184 @@
+//! Where the sign-in is kept: the macOS login keychain, through the system's
+//! own `security` tool, as one item holding the OAuth client and its refresh
+//! token. The value reaches `security` on its standard input, hex encoded,
+//! never on a command line, in an environment variable or in a file of ours.
+
+use crate::error::{Error, Result};
+use serde_json::{Value, json};
+use std::fmt;
+use std::process::{Command, Stdio};
+
+const TOOL: &str = "/usr/bin/security";
+pub const SERVICE: &str = "stet-youtube";
+pub const ACCOUNT: &str = "google-oauth";
+const LABEL: &str = "Stet: YouTube sign-in";
+
+/// The registered OAuth client and what signing in gave it.
+#[derive(Clone, PartialEq, Eq)]
+pub struct Credentials {
+    pub client_id: String,
+    pub client_secret: String,
+    pub refresh_token: String,
+}
+
+impl fmt::Debug for Credentials {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("Credentials")
+            .field("client_id", &self.client_id)
+            .finish_non_exhaustive()
+    }
+}
+
+impl Credentials {
+    fn to_json(&self) -> String {
+        json!({
+            "client_id": self.client_id,
+            "client_secret": self.client_secret,
+            "refresh_token": self.refresh_token,
+        })
+        .to_string()
+    }
+
+    fn from_json(text: &str) -> Result<Credentials> {
+        let value: Value = serde_json::from_str(text.trim())
+            .map_err(|_| Error::Config("the YouTube sign-in in the keychain is unreadable; sign in again".into()))?;
+        let field = |name: &str| {
+            value[name]
+                .as_str()
+                .filter(|text| !text.is_empty())
+                .map(str::to_string)
+                .ok_or_else(|| Error::Config(format!("the YouTube sign-in in the keychain has no {name}")))
+        };
+        Ok(Credentials {
+            client_id: field("client_id")?,
+            client_secret: field("client_secret")?,
+            refresh_token: field("refresh_token")?,
+        })
+    }
+}
+
+fn macos() -> Result<()> {
+    match cfg!(target_os = "macos") {
+        true => Ok(()),
+        false => Err(Error::Config(
+            "the YouTube sign-in is kept in the macOS keychain; there is none here".into(),
+        )),
+    }
+}
+
+/// The stored sign-in.
+pub fn credentials() -> Result<Credentials> {
+    read(SERVICE)
+}
+
+/// Whether there is a stored sign-in, without asking Google if it still works.
+pub fn signed_in() -> bool {
+    credentials().is_ok()
+}
+
+/// Keeps the sign-in, replacing an earlier one.
+pub fn store(credentials: &Credentials) -> Result<()> {
+    keep(SERVICE, credentials)
+}
+
+/// Removes the stored sign-in. True if there was one.
+pub fn forget() -> Result<bool> {
+    macos()?;
+    let gone = Command::new(TOOL)
+        .args(["delete-generic-password", "-s", SERVICE, "-a", ACCOUNT])
+        .stdout(Stdio::null())
+        .stderr(Stdio::null())
+        .status()
+        .map_err(|err| Error::Config(format!("{TOOL}: {err}")))?;
+    Ok(gone.success())
+}
+
+fn read(service: &str) -> Result<Credentials> {
+    macos()?;
+    let found = Command::new(TOOL)
+        .args(["find-generic-password", "-s", service, "-a", ACCOUNT, "-w"])
+        .stderr(Stdio::null())
+        .output()
+        .map_err(|err| Error::Config(format!("{TOOL}: {err}")))?;
+    if !found.status.success() {
+        return Err(Error::Config("YouTube is not signed in".into()));
+    }
+    Credentials::from_json(&String::from_utf8_lossy(&found.stdout))
+}
+
+fn keep(service: &str, credentials: &Credentials) -> Result<()> {
+    use std::io::Write;
+    macos()?;
+    let failed = |err: std::io::Error| Error::Config(format!("{TOOL}: {err}"));
+    let mut shell = Command::new(TOOL)
+        .arg("-i")
+        .stdin(Stdio::piped())
+        .stdout(Stdio::null())
+        .stderr(Stdio::null())
+        .spawn()
+        .map_err(failed)?;
+    // Hex, so the JSON's quotes need no escaping in `security`'s own syntax.
+    let hex: String = credentials
+        .to_json()
+        .bytes()
+        .map(|byte| format!("{byte:02x}"))
+        .collect();
+    let line = format!("add-generic-password -U -s {service} -a {ACCOUNT} -l \"{LABEL}\" -X {hex}\n");
+    shell
+        .stdin
+        .take()
+        .map(|mut stdin| stdin.write_all(line.as_bytes()))
+        .transpose()
+        .map_err(failed)?;
+    match shell.wait().map_err(failed)?.success() {
+        true => Ok(()),
+        false => Err(Error::Config(
+            "the YouTube sign-in could not be stored in the keychain".into(),
+        )),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn sample() -> Credentials {
+        Credentials {
+            client_id: "1-abc.apps.googleusercontent.com".into(),
+            client_secret: "GOCSPX-\"quoted\"".into(),
+            refresh_token: "1//0g-refresh".into(),
+        }
+    }
+
+    #[test]
+    fn credentials_round_trip_through_json() {
+        assert_eq!(Credentials::from_json(&sample().to_json()).unwrap(), sample());
+        assert!(Credentials::from_json("{\"client_id\":\"x\"}").is_err());
+        assert!(Credentials::from_json("not json").is_err());
+    }
+
+    #[test]
+    fn debug_shows_no_secrets() {
+        let shown = format!("{:?}", sample());
+        assert!(!shown.contains("GOCSPX") && !shown.contains("refresh"), "{shown}");
+    }
+
+    // Run by hand (`cargo test -- --ignored`): it writes to the login keychain.
+    #[cfg(target_os = "macos")]
+    #[test]
+    #[ignore = "writes to the login keychain"]
+    fn a_sign_in_is_kept_and_read_back() {
+        // Under a name of its own, so a real sign-in is never touched.
+        let service = "stet-youtube-selftest";
+        keep(service, &sample()).unwrap();
+        assert_eq!(read(service).unwrap(), sample());
+        let gone = Command::new(TOOL)
+            .args(["delete-generic-password", "-s", service, "-a", ACCOUNT])
+            .stdout(Stdio::null())
+            .stderr(Stdio::null())
+            .status()
+            .unwrap();
+        assert!(gone.success());
+        assert!(read(service).is_err());
+    }
+}
diff --git a/crates/stet-youtube/src/ledger.rs b/crates/stet-youtube/src/ledger.rs
new file mode 100644
index 0000000..85d393f
--- /dev/null
+++ b/crates/stet-youtube/src/ledger.rs
@@ -0,0 +1,295 @@
+//! What has been uploaded already, so the same video is never uploaded
+//! twice: each file is known by the SHA-256 of its bytes (not its name or
+//! place, which change), and maps to the video it became on which channel.
+//! A small JSON file, written whole and swapped into place.
+
+use crate::client::{Channel, Client, Privacy, VideoState};
+use crate::error::{Error, Result};
+use crate::http::Transport;
+use serde_json::{Map, Value, json};
+use sha2::{Digest, Sha256};
+use std::io::Read;
+use std::path::{Path, PathBuf};
+use std::sync::Mutex;
+
+/// One upload at a time in this process, so two publishes of the same post
+/// cannot both miss the ledger and both upload.
+static UPLOADING: Mutex<()> = Mutex::new(());
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct Entry {
+    pub video: String,
+    pub channel: String,
+    /// The file's name when it was uploaded, for whoever reads the ledger.
+    pub file: String,
+}
+
+#[derive(Debug, Default)]
+pub struct Ledger {
+    path: PathBuf,
+    entries: Map<String, Value>,
+}
+
+impl Ledger {
+    /// The ledger at `path`; empty if there is none yet.
+    pub fn load(path: &Path) -> Result<Ledger> {
+        let entries = match std::fs::read_to_string(path) {
+            Ok(text) => match serde_json::from_str::<Value>(&text) {
+                Ok(Value::Object(mut root)) => match root.remove("videos") {
+                    Some(Value::Object(videos)) => videos,
+                    _ => Map::new(),
+                },
+                // Unreadable is not empty: starting over would upload everything again.
+                _ => {
+                    return Err(Error::Config(format!(
+                        "{} is not readable as JSON; fix or remove it",
+                        path.display()
+                    )));
+                }
+            },
+            Err(err) if err.kind() == std::io::ErrorKind::NotFound => Map::new(),
+            Err(err) => return Err(Error::File(path.to_path_buf(), err)),
+        };
+        Ok(Ledger {
+            path: path.to_path_buf(),
+            entries,
+        })
+    }
+
+    /// The video this file became on `channel`, if it was uploaded there.
+    pub fn get(&self, digest: &str, channel: &str) -> Option<Entry> {
+        let entry = self.entries.get(digest)?;
+        let video = entry["video"].as_str()?;
+        (entry["channel"].as_str() == Some(channel)).then(|| Entry {
+            video: video.to_string(),
+            channel: channel.to_string(),
+            file: entry["file"].as_str().unwrap_or("").to_string(),
+        })
+    }
+
+    /// Writes down an upload, and saves at once.
+    pub fn record(&mut self, digest: &str, entry: &Entry) -> Result<()> {
+        self.entries.insert(
+            digest.to_string(),
+            json!({"video": entry.video, "channel": entry.channel, "file": entry.file}),
+        );
+        self.save()
+    }
+
+    pub fn forget(&mut self, digest: &str) -> Result<()> {
+        if self.entries.remove(digest).is_some() {
+            self.save()?;
+        }
+        Ok(())
+    }
+
+    fn save(&self) -> Result<()> {
+        let failed = |err| Error::File(self.path.clone(), err);
+        if let Some(dir) = self.path.parent() {
+            std::fs::create_dir_all(dir).map_err(failed)?;
+        }
+        let text = serde_json::to_string_pretty(&json!({"videos": self.entries})).expect("JSON from JSON");
+        let temporary = self.path.with_extension("json.tmp");
+        std::fs::write(&temporary, text + "\n").map_err(failed)?;
+        std::fs::rename(&temporary, &self.path).map_err(failed)
+    }
+}
+
+/// The SHA-256 of a file's bytes, read in pieces.
+pub fn file_digest(path: &Path) -> Result<String> {
+    let failed = |err| Error::File(path.to_path_buf(), err);
+    let mut file = std::fs::File::open(path).map_err(failed)?;
+    let mut hasher = Sha256::new();
+    let mut buf = vec![0u8; 1 << 20];
+    loop {
+        let read = file.read(&mut buf).map_err(failed)?;
+        if read == 0 {
+            break;
+        }
+        hasher.update(&buf[..read]);
+    }
+    Ok(hasher.finalize().iter().map(|byte| format!("{byte:02x}")).collect())
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum Outcome {
+    /// Uploaded before and still there.
+    Reused(String),
+    Uploaded(String),
+}
+
+impl Outcome {
+    pub fn video(&self) -> &str {
+        match self {
+            Outcome::Reused(id) | Outcome::Uploaded(id) => id,
+        }
+    }
+}
+
+/// The video for this file on `channel`: the one it became before if that
+/// is still there, or else a new upload, written down before returning.
+pub fn upload_once<T: Transport>(
+    client: &Client<T>,
+    channel: &Channel,
+    ledger: &Path,
+    path: &Path,
+    title: &str,
+    privacy: Privacy,
+) -> Result<Outcome> {
+    let _one_at_a_time = UPLOADING.lock().unwrap_or_else(|poisoned| poisoned.into_inner());
+    let digest = file_digest(path)?;
+    // Read under the lock: an upload that just finished elsewhere is in it.
+    let mut known = Ledger::load(ledger)?;
+    if let Some(entry) = known.get(&digest, &channel.id) {
+        match client.video_state(&entry.video, &channel.id)? {
+            VideoState::Live => return Ok(Outcome::Reused(entry.video)),
+            VideoState::Gone => known.forget(&digest)?,
+        }
+    }
+    let uploaded = client.upload(path, title, privacy)?;
+    let file = path.file_name().and_then(|n| n.to_str()).unwrap_or("").to_string();
+    known.record(
+        &digest,
+        &Entry {
+            video: uploaded.id.clone(),
+            channel: channel.id.clone(),
+            file,
+        },
+    )?;
+    Ok(Outcome::Uploaded(uploaded.id))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::http::mock::Mock;
+
+    const SESSION: &str = "https://www.googleapis.com/upload/youtube/v3/videos?upload_id=1";
+
+    fn scratch(name: &str) -> PathBuf {
+        let dir = std::env::temp_dir().join(format!("stet-youtube-ledger-{name}-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+        dir
+    }
+
+    fn channel() -> Channel {
+        Channel {
+            id: "UC1".into(),
+            title: "Mine".into(),
+        }
+    }
+
+    fn live(channel: &str) -> String {
+        format!(r#"{{"items":[{{"snippet":{{"channelId":"{channel}"}},"status":{{"uploadStatus":"processed"}}}}]}}"#)
+    }
+
+    #[test]
+    fn digests_are_sha256() {
+        let dir = scratch("digest");
+        let path = dir.join("a.mp4");
+        std::fs::write(&path, b"abc").unwrap();
+        assert_eq!(
+            file_digest(&path).unwrap(),
+            "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad"
+        );
+        let _ = std::fs::remove_dir_all(dir);
+    }
+
+    #[test]
+    fn the_same_video_is_uploaded_once() {
+        let dir = scratch("once");
+        let ledger = dir.join("youtube.json");
+        let video = dir.join("demo.mp4");
+        std::fs::write(&video, b"frames").unwrap();
+
+        let first = Mock::default()
+            .reply_with(200, &[("Location", SESSION)], "")
+            .reply(200, r#"{"id":"v1"}"#);
+        let client = Client::with_token(&first, "t");
+        let made = upload_once(&client, &channel(), &ledger, &video, "Post", Privacy::Unlisted).unwrap();
+        assert_eq!(made, Outcome::Uploaded("v1".into()));
+
+        // Published again, even from a copy under another name: reused, no upload.
+        let copy = dir.join("renamed.mp4");
+        std::fs::copy(&video, &copy).unwrap();
+        let again = Mock::default().reply(200, &live("UC1"));
+        let client = Client::with_token(&again, "t");
+        let reused = upload_once(&client, &channel(), &ledger, &copy, "Post", Privacy::Unlisted).unwrap();
+        assert_eq!(reused, Outcome::Reused("v1".into()));
+        let steps = again.steps();
+        assert_eq!(steps.len(), 1);
+        assert!(steps[0].1.contains("/youtube/v3/videos?part=snippet,status&id=v1"));
+        let _ = std::fs::remove_dir_all(dir);
+    }
+
+    #[test]
+    fn a_deleted_video_is_uploaded_again() {
+        let dir = scratch("deleted");
+        let ledger = dir.join("youtube.json");
+        let video = dir.join("demo.mp4");
+        std::fs::write(&video, b"frames").unwrap();
+        let digest = file_digest(&video).unwrap();
+        let entry = Entry {
+            video: "old".into(),
+            channel: "UC1".into(),
+            file: "demo.mp4".into(),
+        };
+        Ledger::load(&ledger).unwrap().record(&digest, &entry).unwrap();
+
+        let mock = Mock::default()
+            .reply(200, r#"{"items":[]}"#)
+            .reply_with(200, &[("Location", SESSION)], "")
+            .reply(200, r#"{"id":"new"}"#);
+        let client = Client::with_token(&mock, "t");
+        let made = upload_once(&client, &channel(), &ledger, &video, "Post", Privacy::Unlisted).unwrap();
+        assert_eq!(made, Outcome::Uploaded("new".into()));
+        assert_eq!(Ledger::load(&ledger).unwrap().get(&digest, "UC1").unwrap().video, "new");
+        let _ = std::fs::remove_dir_all(dir);
+    }
+
+    #[test]
+    fn another_channel_gets_its_own_upload() {
+        let dir = scratch("channel");
+        let ledger = dir.join("youtube.json");
+        let video = dir.join("demo.mp4");
+        std::fs::write(&video, b"frames").unwrap();
+        let digest = file_digest(&video).unwrap();
+        let entry = Entry {
+            video: "theirs".into(),
+            channel: "UC-other".into(),
+            file: "demo.mp4".into(),
+        };
+        Ledger::load(&ledger).unwrap().record(&digest, &entry).unwrap();
+        let mock = Mock::default()
+            .reply_with(200, &[("Location", SESSION)], "")
+            .reply(200, r#"{"id":"mine"}"#);
+        let client = Client::with_token(&mock, "t");
+        let made = upload_once(&client, &channel(), &ledger, &video, "Post", Privacy::Unlisted).unwrap();
+        assert_eq!(made, Outcome::Uploaded("mine".into()));
+        let _ = std::fs::remove_dir_all(dir);
+    }
+
+    #[test]
+    fn a_failed_upload_records_nothing() {
+        let dir = scratch("failed");
+        let ledger = dir.join("youtube.json");
+        let video = dir.join("demo.mp4");
+        std::fs::write(&video, b"frames").unwrap();
+        let mock = Mock::default().reply(403, r#"{"error":{"message":"quotaExceeded"}}"#);
+        let client = Client::with_token(&mock, "t");
+        let err = upload_once(&client, &channel(), &ledger, &video, "Post", Privacy::Unlisted).unwrap_err();
+        assert!(err.to_string().contains("quotaExceeded"), "{err}");
+        assert!(!ledger.exists());
+        let _ = std::fs::remove_dir_all(dir);
+    }
+
+    #[test]
+    fn an_unreadable_ledger_stops_rather_than_starting_over() {
+        let dir = scratch("broken");
+        let ledger = dir.join("youtube.json");
+        std::fs::write(&ledger, "{nope").unwrap();
+        assert!(Ledger::load(&ledger).is_err());
+        let _ = std::fs::remove_dir_all(dir);
+    }
+}
diff --git a/crates/stet-youtube/src/lib.rs b/crates/stet-youtube/src/lib.rs
new file mode 100644
index 0000000..109b2e6
--- /dev/null
+++ b/crates/stet-youtube/src/lib.rs
@@ -0,0 +1,43 @@
+//! A document's local videos, uploaded to YouTube so a Substack draft can
+//! embed them.
+//!
+//! YouTube is reached through the YouTube Data API v3, signed in with Google
+//! OAuth as an installed app: the user registers their own OAuth client
+//! (a "Desktop app" client in Google Cloud, with the YouTube Data API
+//! enabled), and [`oauth`] runs the loopback sign-in with PKCE.
+//!
+//! The client id, its secret and the refresh token are kept together in the
+//! macOS login keychain ([`keychain`]) and nowhere else: never in a file, an
+//! environment variable or a command line, and never printed.
+//!
+//! A video is uploaded once. [`Ledger`] remembers each file by the SHA-256 of
+//! its bytes and the video it became; publishing the same post again finds
+//! the video there, checks it is still on the channel, and reuses it.
+//!
+//! - [`Client`]: one method per endpoint, over a [`Transport`].
+//! - [`upload_once`]: the ledger, the check and the upload together.
+//!
+//! # Google's rules that apply
+//!
+//! - Videos uploaded through an API project that has not passed YouTube's
+//!   audit are locked to private, whatever privacy was asked for.
+//! - An OAuth client whose consent screen is still "Testing" gets refresh
+//!   tokens that lapse after seven days; signing in again renews it.
+
+mod client;
+mod error;
+mod http;
+pub mod keychain;
+mod ledger;
+pub mod oauth;
+
+pub use client::{Channel, Client, Privacy, UploadedVideo, VideoState};
+pub use error::{Error, Result};
+pub use http::{Body, Method, Request, Response, Transport, Ureq};
+pub use keychain::Credentials;
+pub use ledger::{Entry, Ledger, Outcome, file_digest, upload_once};
+
+/// A watch address for a video id: what the Substack converter embeds.
+pub fn watch_url(id: &str) -> String {
+    format!("https://youtu.be/{id}")
+}
diff --git a/crates/stet-youtube/src/oauth.rs b/crates/stet-youtube/src/oauth.rs
new file mode 100644
index 0000000..60d96ae
--- /dev/null
+++ b/crates/stet-youtube/src/oauth.rs
@@ -0,0 +1,408 @@
+//! Google sign-in for an installed app: the browser asks the user, Google
+//! sends them back to a one-off listener on 127.0.0.1 with a code, and the
+//! code (with the PKCE verifier only this process knows) becomes a refresh
+//! token. <https://developers.google.com/identity/protocols/oauth2/native-app>
+
+use crate::error::{Error, Result, summary};
+use crate::http::{Body, Method, Request, Transport};
+use crate::keychain::Credentials;
+use sha2::{Digest, Sha256};
+use std::io::{BufRead, BufReader, Write};
+use std::net::{TcpListener, TcpStream};
+use std::time::{Duration, Instant};
+
+pub const AUTH_URL: &str = "https://accounts.google.com/o/oauth2/v2/auth";
+pub const TOKEN_URL: &str = "https://oauth2.googleapis.com/token";
+/// Upload, and read the channel's name and its videos (to find one again).
+pub const SCOPES: &str =
+    "https://www.googleapis.com/auth/youtube.upload https://www.googleapis.com/auth/youtube.readonly";
+
+/// A sign-in under way: the browser goes to `url`, and [`SignIn::finish`]
+/// waits for it to come back.
+pub struct SignIn {
+    pub url: String,
+    listener: TcpListener,
+    redirect: String,
+    verifier: String,
+    state: String,
+}
+
+/// Opens the listener and writes the address the browser is sent to.
+pub fn begin(client_id: &str) -> Result<SignIn> {
+    let client_id = client_id.trim();
+    if client_id.is_empty() {
+        return Err(Error::Config("the OAuth client id is empty".into()));
+    }
+    let listener = TcpListener::bind("127.0.0.1:0")
+        .map_err(|err| Error::SignIn(format!("cannot listen for the sign-in: {err}")))?;
+    let port = listener
+        .local_addr()
+        .map_err(|err| Error::SignIn(err.to_string()))?
+        .port();
+    let redirect = format!("http://127.0.0.1:{port}");
+    let verifier = random_token(48)?;
+    let state = random_token(16)?;
+    let url = authorize_url(client_id, &redirect, &challenge(&verifier), &state);
+    Ok(SignIn {
+        url,
+        listener,
+        redirect,
+        verifier,
+        state,
+    })
+}
+
+pub fn authorize_url(client_id: &str, redirect: &str, challenge: &str, state: &str) -> String {
+    let query = form(&[
+        ("client_id", client_id),
+        ("redirect_uri", redirect),
+        ("response_type", "code"),
+        ("scope", SCOPES),
+        ("code_challenge", challenge),
+        ("code_challenge_method", "S256"),
+        ("state", state),
+        // A refresh token, and a fresh one each time: the old may have lapsed.
+        ("access_type", "offline"),
+        ("prompt", "consent"),
+    ]);
+    format!("{AUTH_URL}?{query}")
+}
+
+impl SignIn {
+    /// Waits for the browser to come back, then trades its code for a
+    /// refresh token. Gives up after `timeout`.
+    pub fn finish<T: Transport>(
+        self,
+        transport: &T,
+        client_id: &str,
+        client_secret: &str,
+        timeout: Duration,
+    ) -> Result<Credentials> {
+        let code = self.wait(timeout)?;
+        let answer = token_call(
+            transport,
+            &[
+                ("code", code.as_str()),
+                ("client_id", client_id.trim()),
+                ("client_secret", client_secret.trim()),
+                ("redirect_uri", &self.redirect),
+                ("grant_type", "authorization_code"),
+                ("code_verifier", &self.verifier),
+            ],
+        )?;
+        let refresh_token = answer["refresh_token"]
+            .as_str()
+            .ok_or_else(|| Error::Response("Google sent no refresh token".into()))?;
+        Ok(Credentials {
+            client_id: client_id.trim().to_string(),
+            client_secret: client_secret.trim().to_string(),
+            refresh_token: refresh_token.to_string(),
+        })
+    }
+
+    fn wait(&self, timeout: Duration) -> Result<String> {
+        let deadline = Instant::now() + timeout;
+        self.listener
+            .set_nonblocking(true)
+            .map_err(|err| Error::SignIn(err.to_string()))?;
+        loop {
+            match self.listener.accept() {
+                Ok((stream, _)) => {
+                    if let Some(answer) = self.answer(stream) {
+                        return answer;
+                    }
+                }
+                Err(err) if err.kind() == std::io::ErrorKind::WouldBlock => {
+                    if Instant::now() >= deadline {
+                        return Err(Error::SignIn(
+                            "the sign-in was not finished in the browser in time".into(),
+                        ));
+                    }
+                    std::thread::sleep(Duration::from_millis(100));
+                }
+                Err(err) => return Err(Error::SignIn(err.to_string())),
+            }
+        }
+    }
+
+    /// Reads one request; None if it was not the sign-in coming back.
+    fn answer(&self, stream: TcpStream) -> Option<Result<String>> {
+        let _ = stream.set_nonblocking(false);
+        let _ = stream.set_read_timeout(Some(Duration::from_secs(5)));
+        let mut line = String::new();
+        BufReader::new(&stream).read_line(&mut line).ok()?;
+        let Some(answer) = parse_callback(&line, &self.state) else {
+            reply(stream, "404 Not Found", "");
+            return None;
+        };
+        let words = match &answer {
+            Ok(_) => "Signed in to YouTube. You can close this tab and go back to Stet.",
+            Err(_) => "The YouTube sign-in did not finish. Go back to Stet and try again.",
+        };
+        reply(stream, "200 OK", words);
+        Some(answer)
+    }
+}
+
+fn reply(mut stream: TcpStream, status: &str, words: &str) {
+    let page = format!(
+        "<!doctype html><meta charset=utf-8><title>Stet</title>\
+         <body style=\"font:16px -apple-system,sans-serif;margin:4em auto;max-width:32em\">{words}</body>"
+    );
+    let _ = write!(
+        stream,
+        "HTTP/1.1 {status}\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{page}",
+        page.len()
+    );
+}
+
+/// The code in a request line like `GET /?state=..&code=.. HTTP/1.1`.
+/// None for anything else the browser asks for (a favicon).
+pub fn parse_callback(request_line: &str, state: &str) -> Option<Result<String>> {
+    let target = request_line.split_whitespace().nth(1)?;
+    let (path, query) = target.split_once('?').unwrap_or((target, ""));
+    if path != "/" {
+        return None;
+    }
+    let pairs: Vec<(String, String)> = query
+        .split('&')
+        .filter_map(|pair| pair.split_once('='))
+        .map(|(k, v)| (decode(k), decode(v)))
+        .collect();
+    let get = |name: &str| pairs.iter().find(|(k, _)| k == name).map(|(_, v)| v.as_str());
+    if let Some(error) = get("error") {
+        let said = match error {
+            "access_denied" => "the sign-in was declined in the browser".to_string(),
+            other => format!("Google refused the sign-in: {other}"),
+        };
+        return Some(Err(Error::SignIn(said)));
+    }
+    if get("state") != Some(state) {
+        return Some(Err(Error::SignIn("the sign-in came back for another request".into())));
+    }
+    Some(
+        get("code")
+            .filter(|code| !code.is_empty())
+            .map(str::to_string)
+            .ok_or_else(|| Error::SignIn("the sign-in came back without a code".into())),
+    )
+}
+
+/// An access token for the next hour, from the stored refresh token.
+pub fn access_token<T: Transport>(transport: &T, credentials: &Credentials) -> Result<String> {
+    let answer = token_call(
+        transport,
+        &[
+            ("client_id", &credentials.client_id),
+            ("client_secret", &credentials.client_secret),
+            ("refresh_token", &credentials.refresh_token),
+            ("grant_type", "refresh_token"),
+        ],
+    )?;
+    answer["access_token"]
+        .as_str()
+        .map(str::to_string)
+        .ok_or_else(|| Error::Response("Google sent no access token".into()))
+}
+
+fn token_call<T: Transport>(transport: &T, fields: &[(&str, &str)]) -> Result<serde_json::Value> {
+    let request = Request {
+        method: Method::Post,
+        url: TOKEN_URL.into(),
+        headers: vec![("Content-Type".into(), "application/x-www-form-urlencoded".into())],
+        body: Body::Bytes(form(fields).into_bytes()),
+    };
+    let response = transport.send(&request)?;
+    let value: Option<serde_json::Value> = serde_json::from_str(&response.body).ok();
+    let error = value.as_ref().and_then(|v| v["error"].as_str());
+    match response.status {
+        200..=299 => value.ok_or_else(|| Error::Response("the token answer is not JSON".into())),
+        // A refresh token that was revoked or lapsed, or a client that was deleted.
+        400 | 401 if matches!(error, Some("invalid_grant" | "invalid_client" | "unauthorized_client")) => {
+            Err(Error::SignedOut(summary(&response.body)))
+        }
+        status => Err(Error::Status {
+            status,
+            body: summary(&response.body),
+        }),
+    }
+}
+
+/// The S256 PKCE challenge for a verifier.
+pub fn challenge(verifier: &str) -> String {
+    base64url(&Sha256::digest(verifier.as_bytes()))
+}
+
+fn random_token(bytes: usize) -> Result<String> {
+    let mut buf = vec![0u8; bytes];
+    getrandom::fill(&mut buf).map_err(|err| Error::SignIn(format!("no randomness: {err}")))?;
+    Ok(base64url(&buf))
+}
+
+fn base64url(bytes: &[u8]) -> String {
+    const ALPHABET: &[u8; 64] = b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+    let mut out = String::with_capacity(bytes.len().div_ceil(3) * 4);
+    for chunk in bytes.chunks(3) {
+        let n = chunk
+            .iter()
+            .enumerate()
+            .fold(0u32, |n, (i, b)| n | (*b as u32) << (16 - 8 * i));
+        for i in 0..=chunk.len() {
+            out.push(ALPHABET[(n >> (18 - 6 * i) & 63) as usize] as char);
+        }
+    }
+    out
+}
+
+/// `application/x-www-form-urlencoded`, which is also a query string.
+pub fn form(fields: &[(&str, &str)]) -> String {
+    fields
+        .iter()
+        .map(|(k, v)| format!("{}={}", encode(k), encode(v)))
+        .collect::<Vec<_>>()
+        .join("&")
+}
+
+pub(crate) fn encode(text: &str) -> String {
+    let mut out = String::with_capacity(text.len());
+    for byte in text.bytes() {
+        match byte {
+            b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'-' | b'.' | b'_' | b'~' => out.push(byte as char),
+            _ => out.push_str(&format!("%{byte:02X}")),
+        }
+    }
+    out
+}
+
+fn decode(text: &str) -> String {
+    let bytes = text.as_bytes();
+    let mut out = Vec::with_capacity(bytes.len());
+    let mut i = 0;
+    while i < bytes.len() {
+        let hex = |b: u8| (b as char).to_digit(16);
+        if bytes[i] == b'%'
+            && i + 2 < bytes.len()
+            && let (Some(hi), Some(lo)) = (hex(bytes[i + 1]), hex(bytes[i + 2]))
+        {
+            out.push((hi * 16 + lo) as u8);
+            i += 3;
+            continue;
+        }
+        out.push(if bytes[i] == b'+' { b' ' } else { bytes[i] });
+        i += 1;
+    }
+    String::from_utf8_lossy(&out).into_owned()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::http::mock::Mock;
+
+    fn credentials() -> Credentials {
+        Credentials {
+            client_id: "id.apps.googleusercontent.com".into(),
+            client_secret: "shh".into(),
+            refresh_token: "1//refresh".into(),
+        }
+    }
+
+    #[test]
+    fn pkce_challenge_matches_rfc_7636() {
+        // Appendix B of RFC 7636.
+        assert_eq!(
+            challenge("dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"),
+            "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM"
+        );
+    }
+
+    #[test]
+    fn the_authorize_address_asks_for_offline_upload() {
+        let url = authorize_url("id", "http://127.0.0.1:5000", "chal", "st");
+        assert!(url.starts_with("https://accounts.google.com/o/oauth2/v2/auth?client_id=id&"));
+        assert!(url.contains("redirect_uri=http%3A%2F%2F127.0.0.1%3A5000"));
+        assert!(url.contains("youtube.upload"));
+        assert!(url.contains("code_challenge=chal&code_challenge_method=S256&state=st"));
+        assert!(url.contains("access_type=offline"));
+    }
+
+    #[test]
+    fn callbacks_are_read() {
+        let ok = parse_callback("GET /?state=s1&code=4%2F0Ab HTTP/1.1\r\n", "s1");
+        assert_eq!(ok.unwrap().unwrap(), "4/0Ab");
+        assert!(parse_callback("GET /favicon.ico HTTP/1.1", "s1").is_none());
+        let declined = parse_callback("GET /?error=access_denied&state=s1 HTTP/1.1", "s1");
+        assert!(declined.unwrap().unwrap_err().to_string().contains("declined"));
+        let forged = parse_callback("GET /?state=other&code=x HTTP/1.1", "s1");
+        assert!(forged.unwrap().is_err());
+        let empty = parse_callback("GET /?state=s1 HTTP/1.1", "s1");
+        assert!(empty.unwrap().is_err());
+    }
+
+    #[test]
+    fn the_browser_comes_back_to_the_listener() {
+        let sign_in = begin("id").unwrap();
+        let port = sign_in.redirect.rsplit(':').next().unwrap().to_string();
+        let state = sign_in.state.clone();
+        let browser = std::thread::spawn(move || {
+            let get = |path: &str| {
+                let mut stream = TcpStream::connect(format!("127.0.0.1:{port}")).unwrap();
+                write!(stream, "GET {path} HTTP/1.1\r\nHost: x\r\n\r\n").unwrap();
+                let mut page = String::new();
+                let _ = std::io::Read::read_to_string(&mut stream, &mut page);
+                page
+            };
+            assert!(get("/favicon.ico").starts_with("HTTP/1.1 404"));
+            get(&format!("/?code=the-code&state={state}"))
+        });
+        let mock = Mock::default().reply(200, r#"{"access_token":"a","refresh_token":"1//r","expires_in":3599}"#);
+        let credentials = sign_in
+            .finish(&&mock, " id ", "secret", Duration::from_secs(10))
+            .unwrap();
+        assert!(browser.join().unwrap().contains("Signed in to YouTube"));
+        assert_eq!(credentials.refresh_token, "1//r");
+        assert_eq!(credentials.client_id, "id");
+        let sent = mock.sent.borrow();
+        assert_eq!(sent[0].url, TOKEN_URL);
+        let body = sent[0].text().unwrap();
+        assert!(body.contains("code=the-code"), "{body}");
+        assert!(body.contains("grant_type=authorization_code"));
+        assert!(body.contains("code_verifier="));
+    }
+
+    #[test]
+    fn a_sign_in_nobody_finishes_times_out() {
+        let sign_in = begin("id").unwrap();
+        let err = sign_in
+            .finish(&&Mock::default(), "id", "s", Duration::from_millis(150))
+            .unwrap_err();
+        assert!(err.to_string().contains("in time"), "{err}");
+    }
+
+    #[test]
+    fn refreshing_gives_an_access_token() {
+        let mock = Mock::default().reply(200, r#"{"access_token":"ya29.x","expires_in":3599}"#);
+        assert_eq!(access_token(&&mock, &credentials()).unwrap(), "ya29.x");
+        let body = mock.sent.borrow()[0].text().unwrap().to_string();
+        assert!(body.contains("grant_type=refresh_token"));
+        assert!(body.contains("refresh_token=1%2F%2Frefresh"));
+    }
+
+    #[test]
+    fn a_lapsed_refresh_token_means_signed_out() {
+        let mock = Mock::default().reply(
+            400,
+            r#"{"error":"invalid_grant","error_description":"Token has been expired or revoked."}"#,
+        );
+        let err = access_token(&&mock, &credentials()).unwrap_err();
+        assert!(matches!(err, Error::SignedOut(_)), "{err}");
+        assert!(err.to_string().contains("expired or revoked"));
+    }
+
+    #[test]
+    fn forms_are_encoded_and_decoded() {
+        assert_eq!(form(&[("a b", "x/y+z"), ("k", "~ok")]), "a%20b=x%2Fy%2Bz&k=~ok");
+        assert_eq!(decode("a+b%2Fc%zz%"), "a b/c%zz%");
+        assert_eq!(base64url(b"\xfb\xff"), "-_8");
+    }
+}