ossclip 0.1.33 → 0.1.35

package/src/program.ts

@@ -3,14 +3,21 @@ import { existsSync, readFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { Command, InvalidArgumentError } from "commander";
 import { z } from "zod/v4";
-import { CleanupLevelSchema, COVER_MAX_WORDS, SceneComponentIdSchema } from "@ossclip/core";
+import {
+  CleanupLevelSchema,
+  COVER_MAX_WORDS,
+  RESOLUTION_CHOICES,
+  ResolutionChoiceSchema,
+  SceneComponentIdSchema,
+  SfxLevelSchema,
+} from "@ossclip/core";
 import { STUDIO_ENTRY } from "@ossclip/renderer";
 import { loadEnvFiles } from "./env";
 import { ExportFormatSchema, runAnalyze } from "./analyze";
 import { expandHome } from "./paths";
 import { phaseBucketProps } from "./phase-timing";
-import { dictionaryFlag, jumpCutsFlag, produce, reviewFlag } from "./produce";
-import { accountsFlag, atFlag, platformsFlag } from "./publish";
+import { dictionaryFlag, jumpCutsFlag, produce, reviewFlag, sfxFlag } from "./produce";
+import { accountsFlag, atFlag, deliveryFlag, platformsFlag, youtubePrivacyFlag } from "./publish";
 // The one interactive import that is STATIC rather than `await import()`: the
 // `resetInputSource()` run boundary in `buildProgram` has to run synchronously
 // while the program is being built, and `buildProgram` cannot await. The graph
@@ -300,6 +307,22 @@ export function buildProgram(): Command {
       "output shape: 9:16 (vertical, default) or 16:9 (landscape, 1920x1080)",
       "9:16",
     )
+    .option(
+      "--resolution <height>",
+      "output height: 1080 (default), 1440, 2160, or auto (keep what the source has, " +
+        "capped at 2160). Config key: \"resolution\"",
+      (v: string) => {
+        // Parse, never coerce (CLAUDE.md): a typo'd `--resolution 2610` must
+        // not silently render 1080p, and `Number()` on "auto" is NaN.
+        const parsed = ResolutionChoiceSchema.safeParse(v.trim());
+        if (!parsed.success) {
+          throw new InvalidArgumentError(
+            `--resolution wants one of ${RESOLUTION_CHOICES.join(", ")}, got "${v}"`,
+          );
+        }
+        return parsed.data;
+      },
+    )
     .option("--produce", "run the LLM producer brain to plan title cards & graphics", false)
     .option(
       "--clip <seconds>",
@@ -321,6 +344,31 @@ export function buildProgram(): Command {
         "runs so the editor's Render replays the same window without an LLM call",
     )
     .option("--intent <text>", "what the video should be ('educational video about agents…')")
+    .option(
+      "--sfx",
+      // No commander default, the `--watermark` contract: untyped must stay
+      // UNDEFINED so the config's `sfx` key can supply it — a `false` default
+      // here would make every run's flag beat the config it was written for.
+      "place sound effects from the bundled pack (and any pack in ~/.ossclip/sfx) " +
+        "on the beats the producer planned. Requires --produce. Config key: \"sfx\"",
+    )
+    .option(
+      "--sfx-level <level>",
+      "how much sound design: subtle | normal (default) | meme (unlocks the " +
+        "meme-tagged sounds). Implies --sfx. Config key: \"sfxLevel\"",
+      (v: string) => {
+        // Parse, never coerce (CLAUDE.md): a typo'd `--sfx-level mem` must not
+        // silently fall back to `normal` — the level decides whether a vine
+        // boom can land in the video at all.
+        const parsed = SfxLevelSchema.safeParse(v.trim());
+        if (!parsed.success) {
+          throw new InvalidArgumentError(
+            `--sfx-level wants one of ${SfxLevelSchema.options.join(", ")}, got "${v}"`,
+          );
+        }
+        return parsed.data;
+      },
+    )
     .option(
       "--llm <provider>",
       // Must state `defaultProviderName`'s real order — the old text omitted
@@ -357,6 +405,12 @@ export function buildProgram(): Command {
       "--whisper-language <code>",
       "transcription language code for a multilingual model, e.g. ur | de | auto (whisper defaults to en)",
     )
+    .option(
+      "--whisper-translate",
+      "translate the speech to ENGLISH captions instead of transcribing it verbatim " +
+        "(whisper's -tr; pair with --whisper-language for the SOURCE language)",
+      false,
+    )
     // COMMA-SEPARATED in one value, not variadic: a variadic option swallows
     // the optional positional [input] whenever the flag precedes the path,
     // and commander offers no way to give the positional priority.
@@ -633,6 +687,12 @@ export function buildProgram(): Command {
           noiseDb: opts.noiseDb,
           produce: opts.produce,
           intent: opts.intent,
+          // `--sfx-level` implies `--sfx` (sfxFlag), resolved HERE so the
+          // implication is one pure function rather than a condition produce
+          // has to remember. Untyped stays undefined, which is what lets the
+          // config's `sfx` key decide (`resolveSfx` at the use site).
+          sfx: sfxFlag(opts.sfx, opts.sfxLevel),
+          sfxLevel: opts.sfxLevel,
           provider,
           llmModel: opts.llmModel,
           llmFastModel: opts.llmFastModel,
@@ -644,6 +704,7 @@ export function buildProgram(): Command {
           repair: opts.repair,
           whisperModel: opts.whisperModel,
           whisperLanguage,
+          whisperTranslate: opts.whisperTranslate === true,
           // Split/trim/drop-empties (dictionaryFlag) — undefined stays
           // undefined so the config's dictionary can supply the default.
           dictionary: dictionaryFlag(opts.dictionary),
@@ -687,6 +748,9 @@ export function buildProgram(): Command {
           // Validated by concurrencyFlag at parse time; undefined = "not
           // typed", which is what lets the config supply it.
           concurrency: opts.concurrency,
+          // Same contract: validated by the flag's own parser, and undefined
+          // means "not typed" so the config's `resolution` can supply it.
+          resolution: opts.resolution,
         });
         // Counts, buckets and names only — the duration crosses the wire as a
         // bucket, and nothing here can carry a path (assertSafeProps enforces
@@ -729,7 +793,13 @@ export function buildProgram(): Command {
         // run does write. Reusing this path is what gives --review the edit
         // command's whole posture (resolveEditorPageDir's loud "run pnpm
         // build" degrade, startEditServer, openInBrowser) for free.
-        await offerEditor(result, { flag: openEditor, port: opts.editorPort });
+        await offerEditor(result, {
+          flag: openEditor,
+          port: opts.editorPort,
+          // Typed-only, like `edit`'s --port: commander's 5174 default is not
+          // a choice, so a busy port still attaches or bumps for it.
+          portPinned: command.getOptionValueSource("editorPort") === "cli",
+        });
         // Deliberately LAST — after the render summary and the editor offer —
         // so the one question ossclip ever asks is the last thing on screen.
         await maybeAskRating(telemetry);
@@ -758,6 +828,12 @@ export function buildProgram(): Command {
       "--whisper-language <code>",
       "transcription language code for a multilingual model, e.g. ur | de | auto (whisper defaults to en)",
     )
+    .option(
+      "--whisper-translate",
+      "translate the speech to ENGLISH captions instead of transcribing it verbatim " +
+        "(whisper's -tr; pair with --whisper-language for the SOURCE language)",
+      false,
+    )
     .action(async (input: string, opts) => {
       const cleanup = CleanupLevelSchema.parse(opts.cleanup);
       const result = await produce(input, {
@@ -769,6 +845,7 @@ export function buildProgram(): Command {
         noiseDb: opts.noiseDb,
         whisperModel: opts.whisperModel,
         // Same guard as produce's: empty must error, not become a bare `-l`.
+        whisperTranslate: opts.whisperTranslate === true,
         whisperLanguage:
           opts.whisperLanguage !== undefined
             ? z.string().trim().min(1, "--whisper-language needs a code, e.g. ur").parse(opts.whisperLanguage)
@@ -917,7 +994,7 @@ export function buildProgram(): Command {
     .argument("[workdir]", "a work directory containing render-props.json")
     .option("--port <n>", "port to listen on", (v) => Number.parseInt(v, 10), 5174)
     .option("--no-open", "do not open a browser")
-    .action(async (workdir: string | undefined, opts) => {
+    .action(async (workdir: string | undefined, opts, command: Command) => {
       const { startEditServer, resolveEditorPageDir } = await import("./edit");
       // An npm install ships the page prebuilt (editor-dist/); a clone builds
       // it once with `pnpm build`. A server that starts fine but 404s every
@@ -937,11 +1014,29 @@ export function buildProgram(): Command {
       const target =
         workdir === undefined ? undefined : await resolveWorkdirArgument(workdir, "edit");
 
-      const server = await startEditServer(target, { port: opts.port, pageDir });
-      console.log(`▸ editor at ${server.url}`);
+      // A busy port is not a crash. `openEditServer` owns the whole ladder —
+      // attach to our own editor already serving THIS project, prompt about
+      // one serving another, step around a stranger — and it needs to know
+      // whether the port was TYPED: someone who passes `--port` has a reason
+      // for that number (a bookmark, a tunnel), so their run refuses rather
+      // than silently landing somewhere else. `getOptionValueSource` is the
+      // same "did the user type it" test `--sort` uses.
+      const { openEditServer, liveEditPortDeps } = await import("./edit-port");
+      const opened = await openEditServer(
+        target ?? null,
+        { port: opts.port, pinned: command.getOptionValueSource("port") === "cli" },
+        liveEditPortDeps((port) => startEditServer(target, { port, pageDir })),
+      );
+      // The user picked "cancel" at the conflict prompt: nothing started,
+      // nothing to open, exit 0.
+      if (opened.kind === "cancelled") return;
+      const url = opened.kind === "attached" ? opened.url : opened.server.url;
+      // The attach path already printed "▸ already open at …" — saying
+      // "editor at" underneath it would read as a second server.
+      if (opened.kind === "started") console.log(`▸ editor at ${url}`);
       if (opts.open) {
         const { openInBrowser } = await import("./open");
-        openInBrowser(server.url);
+        openInBrowser(url);
       }
       // Fire-and-forget on purpose: the server keeps the process alive for
       // the request's lifetime, and awaiting here would put a metrics POST
@@ -1035,6 +1130,18 @@ export function buildProgram(): Command {
     .option("--dry-run", "print the targets and the exact payload; send nothing", false)
     .option("-y, --yes", "skip the confirmation prompt", false)
     .option("--force", "publish again even though this workdir already has a publish receipt", false)
+    .option(
+      "--youtube-privacy <level>",
+      "YouTube visibility: private (default), unlisted or public",
+      youtubePrivacyFlag,
+    )
+    .option(
+      "--delivery <mode>",
+      "what to upload — auto: a ≤1080p ~10 Mbps delivery encode, built once and " +
+        "cached in the workdir; master: the untouched render",
+      deliveryFlag,
+      "auto",
+    )
     .action(async (workdir: string | undefined, opts) => {
       const { runPublish } = await import("./publish");
       const target = await resolveWorkdirArgument(workdir ?? ".", "publish");
@@ -1046,6 +1153,10 @@ export function buildProgram(): Command {
         dryRun: opts.dryRun,
         yes: opts.yes,
         force: opts.force,
+        // Validated by youtubePrivacyFlag at parse time; undefined means the
+        // payload's own safe default (private).
+        youtubePrivacy: opts.youtubePrivacy,
+        delivery: opts.delivery,
       });
       telemetry.record("publish_run", {
         scheduled: opts.at !== undefined,

package/src/publish.ts

@@ -1,14 +1,24 @@
 import { existsSync } from "node:fs";
-import { readFile, writeFile } from "node:fs/promises";
+import { readFile, stat, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { InvalidArgumentError } from "commander";
+import { z } from "zod/v4";
 import {
+  PLATFORM_SIZE_CAP_BYTES,
   YOUTUBE_APPROVED_BASENAME,
   YoutubePackSchema,
   buildPostsPayload,
   captionForProvider,
+  checkDurationCaps,
   createPostizProvider,
+  deliveryEncodePlan,
+  encodeEta,
+  ensureDeliveryFile,
+  formatMinSec,
   loadConfig,
+  probe,
+  type DeliveryPlan,
+  type DurationViolation,
   type OssclipConfig,
   type PublishPost,
   type PublishProvider,
@@ -155,14 +165,204 @@ export function selectTargets(
  * the pack's first title — the one required settings field Postiz won't
  * default.
  */
-export function buildPublishPosts(pack: YoutubePack, targets: PublishTarget[]): PublishPost[] {
+export function buildPublishPosts(
+  pack: YoutubePack,
+  targets: PublishTarget[],
+  opts: { youtubePrivacy?: YoutubePrivacy } = {},
+): PublishPost[] {
   return targets.map((target) => ({
     target,
     caption: captionForProvider(pack, target.provider),
-    ...(target.provider === "youtube" ? { title: pack.titles[0] } : {}),
+    ...(target.provider === "youtube"
+      ? {
+          title: pack.titles[0],
+          // Undefined here means `buildPostsPayload`'s own safe default
+          // (private) — one place decides it, not two (2026-08-28).
+          ...(opts.youtubePrivacy !== undefined
+            ? { youtubePrivacy: opts.youtubePrivacy }
+            : {}),
+        }
+      : {}),
   }));
 }
 
+/** `--youtube-privacy` — the values Postiz's own DTO accepts, nothing else. */
+export const YOUTUBE_PRIVACIES = ["public", "unlisted", "private"] as const;
+export type YoutubePrivacy = (typeof YOUTUBE_PRIVACIES)[number];
+
+/**
+ * `--youtube-privacy <public|unlisted|private>` → a validated choice.
+ * Rejected rather than coerced (§93a, the `--clip` idiom): a typo'd
+ * `--youtube-privacy pubic` must not silently fall back to a value that
+ * publishes to a subscriber list. Exported so the rejection matrix is
+ * testable without commander's exit behaviour.
+ */
+export function youtubePrivacyFlag(v: string): YoutubePrivacy {
+  const found = YOUTUBE_PRIVACIES.find((p) => p === v.trim());
+  if (found === undefined) {
+    throw new InvalidArgumentError(
+      `--youtube-privacy wants one of ${YOUTUBE_PRIVACIES.join(", ")}, got "${v}"`,
+    );
+  }
+  return found;
+}
+
+/** `--delivery` — what actually uploads (2026-08-29 handoff, item 1). */
+export const DELIVERY_MODES = ["auto", "master"] as const;
+export type DeliveryMode = (typeof DELIVERY_MODES)[number];
+
+/**
+ * `--delivery <auto|master>` → a validated choice, zod-parsed and rejected
+ * rather than coerced (§93a): a typo'd `--delivery masterr` silently falling
+ * back to `auto` would re-encode the one run where the user explicitly wanted
+ * the untouched master. Exported so the rejection matrix is testable without
+ * commander's exit behaviour.
+ */
+export function deliveryFlag(v: string): DeliveryMode {
+  const parsed = z.enum(DELIVERY_MODES).safeParse(v.trim());
+  if (!parsed.success) {
+    throw new InvalidArgumentError(
+      `--delivery wants one of ${DELIVERY_MODES.join(", ")}, got "${v}"`,
+    );
+  }
+  return parsed.data;
+}
+
+/** Seconds → "5:20" for the duration-cap messages — a cap named in seconds
+ * ("video is 320s") makes the user do the platform's arithmetic. Moved to
+ * core with the encode-progress work (2026-08-29) so the editor server spells
+ * ETAs the same way; re-exported here so callers keep their import. */
+export { formatMinSec } from "@ossclip/core";
+
+/**
+ * The encode-progress line: `▸ encoding delivery … 42% · ~1:50 left (1.6x)`.
+ * ETA and speed drop off rather than print garbage when ffmpeg hasn't said
+ * yet (its warm-up block is all N/A). Pure so the wording is pinned by a
+ * test; whether it lands as a \r-rewrite or a log line is the TTY shell's
+ * call below.
+ */
+export function encodeProgressLine(
+  durationSec: number,
+  p: { outTimeSec?: number; speed?: number },
+): string {
+  const pct =
+    durationSec > 0 && p.outTimeSec !== undefined
+      ? Math.min(100, Math.floor((p.outTimeSec / durationSec) * 100))
+      : 0;
+  const eta =
+    p.outTimeSec !== undefined && p.speed !== undefined
+      ? encodeEta(durationSec, p.outTimeSec, p.speed)
+      : null;
+  const tail =
+    eta !== null ? ` · ~${formatMinSec(eta)} left (${p.speed!.toFixed(1)}x)` : "";
+  return `▸ encoding delivery … ${pct}%${tail}`;
+}
+
+/**
+ * One loud line per refused channel — the platform hard-fails an over-cap
+ * upload anyway (the 5:20 take was doomed on Threads' 5:00 cap before a
+ * single byte uploaded), so the refusal names the cap instead of letting the
+ * platform's opaque error do it. Pure so the wording is pinned by a test.
+ */
+export function durationCapMessages(violations: DurationViolation[], durationSec: number): string[] {
+  return violations.map(
+    (v) =>
+      `▸ ${v.target.provider} capped at ${formatMinSec(v.capSec)}, video is ` +
+      `${formatMinSec(durationSec)} — skipping ${v.target.name}`,
+  );
+}
+
+/**
+ * The surviving targets grouped by their platform's byte ceiling
+ * (`PLATFORM_SIZE_CAP_BYTES`) — one delivery encode per distinct cap, not per
+ * channel, so two capped accounts on the same platform share one file.
+ * Uncapped targets don't appear; they ride the default delivery encode.
+ */
+export function sizeCapGroups(targets: PublishTarget[]): Map<number, PublishTarget[]> {
+  const groups = new Map<number, PublishTarget[]>();
+  for (const t of targets) {
+    const capBytes = PLATFORM_SIZE_CAP_BYTES[t.provider];
+    if (capBytes === undefined) continue;
+    const group = groups.get(capBytes);
+    if (group !== undefined) group.push(t);
+    else groups.set(capBytes, [t]);
+  }
+  return groups;
+}
+
+/**
+ * One loud line per refused channel when a platform's size cap cannot be met
+ * above the quality floor (delivery.ts: below ~1 Mbps, 1080p h264 is mush the
+ * platform would host forever) — same drop-and-continue semantics as the
+ * duration caps. The line carries the arithmetic that doomed the channel so
+ * the fix (shorten, or publish by hand) is obvious. Pure so the wording is
+ * pinned by a test.
+ */
+export function sizeCapUnattainableMessages(
+  group: PublishTarget[],
+  capBytes: number,
+  fittedKbps: number,
+  durationSec: number,
+): string[] {
+  const capMb = Math.round(capBytes / 1_000_000);
+  return group.map(
+    (t) =>
+      `▸ ${t.provider} needs ≤${capMb}MB but a ${formatMinSec(durationSec)} video fits only ` +
+      `~${fittedKbps} kbps — skipping ${t.name}; publish it manually or shorten the cut`,
+  );
+}
+
+/**
+ * The over-cap warning for `--delivery master`: master mode bypasses the
+ * encode entirely, INCLUDING the size-capped variant, so a capped platform
+ * may get a file its ingest will bounce (Instagram's 2207077). The user
+ * explicitly chose master, so this warns loudly and proceeds — the one size
+ * decision the user is allowed to overrule. Pure so the wording is pinned.
+ */
+export function masterOverCapWarning(
+  group: PublishTarget[],
+  capBytes: number,
+  masterBytes: number,
+): string {
+  const providers = [...new Set(group.map((t) => t.provider))].join(", ");
+  return (
+    `▸ WARNING: the master is ${Math.round(masterBytes / 1_000_000)}MB, over the ` +
+    `${Math.round(capBytes / 1_000_000)}MB ${providers} cap — uploading it anyway (--delivery master)`
+  );
+}
+
+/**
+ * Posts → posts with their per-platform media override set: a size-capped
+ * platform carries its own smaller encode (`PublishPost.videoPath`), everyone
+ * else rides the request's default. A capped path that EQUALS the default
+ * (the fitted bitrate came out at the 10 Mbps target, so both plans named the
+ * same file) sets no override — the provider would dedupe the upload anyway,
+ * but a redundant override obscures which posts genuinely differ.
+ */
+export function attachDeliveryMedia(
+  posts: PublishPost[],
+  defaultPath: string,
+  cappedPaths: ReadonlyMap<number, string>,
+): PublishPost[] {
+  return posts.map((p) => {
+    const capBytes = PLATFORM_SIZE_CAP_BYTES[p.target.provider];
+    const path = capBytes !== undefined ? cappedPaths.get(capBytes) : undefined;
+    return path !== undefined && path !== defaultPath ? { ...p, videoPath: path } : p;
+  });
+}
+
+/**
+ * What the confirm prompt says will upload — decided BEFORE the "yes" so the
+ * user approves the actual file, not a surprise re-encode after it. Pure;
+ * the encode itself runs post-confirm.
+ */
+export function describeUpload(mode: DeliveryMode, plan: DeliveryPlan | null): string {
+  if (mode === "master") return "master (--delivery master)";
+  return plan === null
+    ? "master (already within delivery limits)"
+    : `${plan.fileName} (delivery encode, cached in workdir)`;
+}
+
 /**
  * The pack this publish reads: the APPROVED file when the editor wrote one
  * (an edited pack is the user's decision), else the provider-keyed cache
@@ -237,6 +437,10 @@ export interface PublishFlags {
   dryRun?: boolean;
   yes?: boolean;
   force?: boolean;
+  /** `--youtube-privacy`; undefined = the payload's safe `private` default. */
+  youtubePrivacy?: YoutubePrivacy;
+  /** `--delivery`; undefined = `auto` (upload the delivery encode). */
+  delivery?: DeliveryMode;
 }
 
 /**
@@ -251,6 +455,12 @@ export async function runPublish(
     provider?: PublishProvider;
     config?: OssclipConfig;
     env?: NodeJS.ProcessEnv;
+    /** The two ffmpeg-family shell-outs, injectable so tests never spawn a
+     * binary (the `provider` seam applied to ffprobe/ffmpeg): `probeVideo`
+     * feeds the duration caps and the upload summary, `ensureDelivery`
+     * builds — or reuses — the cached delivery encode. */
+    probeVideo?: typeof probe;
+    ensureDelivery?: typeof ensureDeliveryFile;
   } = {},
 ): Promise<void> {
   const config = deps.config ?? loadConfig();
@@ -309,9 +519,87 @@ export async function runPublish(
     ) as PublishTarget[];
   }
 
+  // Probe ONCE, before the confirm prompt: the duration caps and the upload
+  // summary both need it, and a channel this video can never land on must be
+  // refused before the user says yes — not after minutes of x264 (2026-08-29
+  // handoff: Threads' 5:00 cap vs a 5:20 take).
+  const tools = { ffmpegPath: config.ffmpegPath, ffprobePath: config.ffprobePath };
+  const masterProbe = await (deps.probeVideo ?? probe)(tools, out);
+  const violations = checkDurationCaps(picked, masterProbe.duration);
+  if (violations.length > 0) {
+    for (const line of durationCapMessages(violations, masterProbe.duration)) console.log(line);
+    const over = new Set(violations.map((v) => v.target.id));
+    picked = picked.filter((t) => !over.has(t.id));
+    if (picked.length === 0) {
+      throw new Error(
+        `every selected channel refuses a ${formatMinSec(masterProbe.duration)} video — ` +
+          "nothing to publish (shorten the cut, or pick channels without a duration cap)",
+      );
+    }
+  }
+  // The plans are recomputed pure here so the confirm prompt can NAME the
+  // files that will upload; ensureDeliveryFile re-derives them (and re-probes,
+  // one cheap ffprobe each) after the "yes" to keep its cache logic
+  // self-contained.
+  const deliveryMode = flags.delivery ?? "auto";
+  const masterSizeBytes = (await stat(out)).size;
+  const src = {
+    width: masterProbe.width,
+    height: masterProbe.height,
+    fps: masterProbe.fps,
+    duration: masterProbe.duration,
+    sizeBytes: masterSizeBytes,
+  };
+  // Size-capped platforms get their own smaller encode (2026-08-29, live:
+  // Instagram's URL-fetch ingest bounced the 409MB file with 2207077 twice,
+  // then published the same take at 88MB — PLATFORM_SIZE_CAP_BYTES). A cap
+  // the video cannot fit above the quality floor drops the channel HERE,
+  // before the confirm and before a wasted encode, with the duration caps'
+  // drop-and-continue semantics.
+  let capGroups = sizeCapGroups(picked);
+  const cappedPlans = new Map<number, DeliveryPlan | null>();
+  if (deliveryMode === "auto") {
+    for (const [capBytes, group] of capGroups) {
+      const capped = deliveryEncodePlan(src, { sizeCapBytes: capBytes });
+      if (capped !== null && "unattainable" in capped) {
+        for (const line of sizeCapUnattainableMessages(
+          group,
+          capBytes,
+          capped.fittedKbps,
+          masterProbe.duration,
+        )) {
+          console.log(line);
+        }
+        const over = new Set(group.map((t) => t.id));
+        picked = picked.filter((t) => !over.has(t.id));
+      } else {
+        cappedPlans.set(capBytes, capped);
+      }
+    }
+    if (picked.length === 0) {
+      throw new Error(
+        `every selected channel's size cap is unattainable for a ` +
+          `${formatMinSec(masterProbe.duration)} video — nothing to publish ` +
+          "(shorten the cut, or publish it manually)",
+      );
+    }
+    capGroups = sizeCapGroups(picked);
+  }
+  const plan = deliveryMode === "master" ? null : deliveryEncodePlan(src);
+
   const when: PublishWhen = flags.at ? { kind: "at", iso: flags.at } : { kind: "now" };
-  const posts = buildPublishPosts(pack, picked);
+  const posts = buildPublishPosts(pack, picked, { youtubePrivacy: flags.youtubePrivacy });
   console.log(summarizePosts(posts, when));
+  console.log(`▸ upload: ${describeUpload(deliveryMode, plan)}`);
+  for (const [capBytes, group] of capGroups) {
+    const label = [...new Set(group.map((t) => t.provider))].join(", ");
+    console.log(
+      `▸ upload (${label}): ${describeUpload(deliveryMode, cappedPlans.get(capBytes) ?? null)}`,
+    );
+    if (deliveryMode === "master" && masterSizeBytes > capBytes) {
+      console.log(masterOverCapWarning(group, capBytes, masterSizeBytes));
+    }
+  }
 
   if (flags.dryRun === true) {
     const payload = buildPostsPayload({
@@ -338,8 +626,64 @@ export async function runPublish(
     }
   }
 
-  console.log(`▸ uploading ${out} to Postiz...`);
-  const result = await provider.publish({ videoPath: out, posts, when });
+  // The encodes run AFTER the confirm — 1–3 minutes of x264 each is a bad
+  // price for a "no" — and before the upload, which takes the delivery paths.
+  let uploadPath = out;
+  const cappedPaths = new Map<number, string>();
+  if (deliveryMode === "auto") {
+    // Live progress (2026-08-29): a TTY gets one \r-rewritten line; anything
+    // else (CI, a pipe) gets a plain line per 10% step — a 5-minute encode at
+    // 2 blocks/sec would otherwise write ~600 lines into the log. The state
+    // is per encode: the size-capped variant restarts the decile counter, and
+    // the onStart line names each file so the two encodes stay
+    // distinguishable in the log.
+    const isTty = process.stdout.isTTY === true;
+    const runEnsure = async (sizeCapBytes?: number): ReturnType<typeof ensureDeliveryFile> => {
+      let progressShown = false;
+      let lastDecile = -1;
+      const ensured = await (deps.ensureDelivery ?? ensureDeliveryFile)(tools, workdir, out, {
+        ...(sizeCapBytes !== undefined ? { sizeCapBytes } : {}),
+        onStart: (name) => console.log(`▸ encoding delivery file ${name} (cached in workdir)`),
+        onProgress: (p) => {
+          const line = encodeProgressLine(masterProbe.duration, p);
+          if (isTty) {
+            progressShown = true;
+            process.stdout.write(`\r${line}`);
+          } else {
+            const decile =
+              p.outTimeSec !== undefined && masterProbe.duration > 0
+                ? Math.floor((p.outTimeSec / masterProbe.duration) * 10)
+                : 0;
+            if (decile > lastDecile) {
+              lastDecile = decile;
+              console.log(line);
+            }
+          }
+        },
+      });
+      // The \r line never newline-terminated itself — without this the next
+      // line would overwrite it mid-sentence.
+      if (progressShown) process.stdout.write("\n");
+      return ensured;
+    };
+    const ensured = await runEnsure();
+    uploadPath = ensured.path;
+    if (!ensured.encoded && ensured.path !== out) {
+      console.log(`▸ delivery file already cached — reusing ${ensured.path}`);
+    }
+    // Size-capped variants next, sequentially — two ffmpegs racing for cores
+    // would slow BOTH encodes down, and the unattainable groups were already
+    // dropped above so ensureDeliveryFile's throw cannot fire here.
+    for (const capBytes of capGroups.keys()) {
+      cappedPaths.set(capBytes, (await runEnsure(capBytes)).path);
+    }
+  }
+  console.log(`▸ uploading ${uploadPath} to Postiz...`);
+  const result = await provider.publish({
+    videoPath: uploadPath,
+    posts: attachDeliveryMedia(posts, uploadPath, cappedPaths),
+    when,
+  });
   await writeFile(publishReceiptPath(workdir), `${JSON.stringify(result, null, 2)}\n`);
   const where = configured.baseUrl.replace(/\/+$/, "");
   console.log(