videobook 0.1.0 → 0.2.1

package/dist/cli/run-command.js

@@ -1,13 +1,17 @@
+import { setTimeout as delay } from "node:timers/promises";
 import { Client, StreamableHTTPClientTransport } from "@modelcontextprotocol/client";
 import { z } from "zod";
+import { onePasswordWarnings } from "./key-report.js";
 import { gcLibraryCatalogs } from "../catalog-gc.js";
 import { bookManager, scopedEngine } from "../engine.js";
-import { waitForJob } from "../queue.js";
 import { MCP_PROTOCOL_VERSION, SERVER_VERSION } from "../server.js";
 import { inspectServerOwner } from "../server-lock.js";
 import { startServer } from "../serve.js";
 import { getAllToolDefs } from "../tools/index.js";
 const REQUEST_GRACE_MS = 60_000;
+const JOB_POLL_MS = 1_000;
+const FINISHED_JOB_STATES = new Set(["done", "failed", "aborted"]);
+const SETTLED_STATUSES = new Set(["completed", "done"]);
 function newClient() {
     return new Client({ name: "videobook-cli", version: SERVER_VERSION }, {
         capabilities: {},
@@ -27,6 +31,8 @@ function refuseUnresponsive(owner) {
 }
 async function temporaryOwner() {
     const running = await startServer({ port: 0, ui: false });
+    for (const warning of onePasswordWarnings())
+        process.stderr.write(`videobook: ${warning}\n`);
     await running.ready;
     const client = await connect(running.mcpUrl);
     return {
@@ -64,17 +70,51 @@ function stringField(record, key) {
     const value = record?.[key];
     return typeof value === "string" && value !== "" ? value : null;
 }
-async function waitInProcess(jobId, timeoutSeconds) {
-    process.stderr.write(`Waiting for job ${jobId}...\n`);
-    try {
-        await waitForJob(jobId, timeoutSeconds * 1000);
+function jobReference(first) {
+    const value = first?.job_id;
+    if (typeof value === "number" && Number.isInteger(value) && value > 0)
+        return { job_ids: [value] };
+    if (typeof value === "string" && value !== "")
+        return { job_keys: [value] };
+    return null;
+}
+function parseSnapshot(result) {
+    if (result.isError)
+        return null;
+    const rows = JSON.parse(textOf(result)[0] ?? "[]");
+    const job = Array.isArray(rows) ? rows[0] : undefined;
+    if (!job || typeof job.state !== "string")
+        return null;
+    return { state: job.state, error: typeof job.error?.message === "string" ? job.error.message : null };
+}
+async function jobSnapshot(client, bookId, reference) {
+    const result = await client.callTool({ name: "list_jobs", arguments: { book_id: bookId, ...reference } });
+    return parseSnapshot(result);
+}
+function reportJob(label, job) {
+    if (job.state === "done") {
+        process.stderr.write(`Job ${label} completed.\n`);
+        return 0;
     }
-    catch (error) {
-        process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
-        return 1;
+    process.stderr.write(`Job ${label} ${job.state}${job.error ? `: ${job.error}` : ""}\n`);
+    return 1;
+}
+async function waitForJob(client, bookId, reference, label, timeoutSeconds) {
+    process.stderr.write(`Waiting for job ${label}...\n`);
+    const deadline = Date.now() + timeoutSeconds * 1000;
+    let job = await jobSnapshot(client, bookId, reference);
+    while (job && !FINISHED_JOB_STATES.has(job.state) && Date.now() < deadline) {
+        await delay(JOB_POLL_MS);
+        job = await jobSnapshot(client, bookId, reference);
     }
-    process.stderr.write(`Job ${jobId} completed.\n`);
-    return 0;
+    if (!job) {
+        process.stderr.write(`Job ${label} is not tracked by the server; check it with list_jobs.\n`);
+        return 0;
+    }
+    if (FINISHED_JOB_STATES.has(job.state))
+        return reportJob(label, job);
+    process.stderr.write(`Job ${label} did not finish within ${timeoutSeconds} s.\n`);
+    return 1;
 }
 async function waitForAsset(client, bookId, assetId, timeoutSeconds) {
     process.stderr.write(`Waiting for asset ${assetId}...\n`);
@@ -84,17 +124,21 @@ async function waitForAsset(client, bookId, assetId, timeoutSeconds) {
     return result.isError ? 1 : 0;
 }
 async function waitForOutcome(session, flags, args, first) {
-    const jobId = stringField(first, "job_id");
+    const reference = jobReference(first);
     const assetId = stringField(first, "asset_id");
     const bookId = typeof args.book_id === "string" ? args.book_id : null;
-    if (session.temporary && jobId)
-        return waitInProcess(jobId, flags.timeoutSeconds);
-    if (!flags.wait || !jobId)
+    const status = stringField(first, "status");
+    if (!reference || (status && SETTLED_STATUSES.has(status)))
+        return 0;
+    if (!flags.wait && !session.temporary)
         return 0;
     if (assetId && bookId)
         return waitForAsset(session.client, bookId, assetId, flags.timeoutSeconds);
-    process.stderr.write(`Job ${jobId} is queued on the running server; follow it with list_jobs.\n`);
-    return 0;
+    if (!bookId) {
+        process.stderr.write(`Job ${String(first?.job_id)} was queued; pass book_id to wait for it.\n`);
+        return 0;
+    }
+    return waitForJob(session.client, bookId, reference, String(first?.job_id), flags.timeoutSeconds);
 }
 async function callOnce(session, flags, tool, args) {
     try {

package/dist/cli/serve-command.js

@@ -1,4 +1,5 @@
 import { resolvePort } from "./args.js";
+import { onePasswordSummary, onePasswordWarnings } from "./key-report.js";
 import { openInBrowser } from "./open-browser.js";
 import { logger } from "../logger.js";
 import { SERVER_VERSION } from "../server.js";
@@ -12,14 +13,18 @@ function uiLine(running) {
     return `not built at ${running.uiDir}; serving MCP and API only`;
 }
 function printBanner(running) {
+    const keys = onePasswordSummary();
     process.stdout.write([
         `videobook ${SERVER_VERSION}`,
         `Library  ${running.libraryDir}`,
         `UI       ${uiLine(running)}`,
         `MCP      ${running.mcpUrl}`,
+        ...(keys ? [`Keys     ${keys}`] : []),
         "Agents   claude mcp add videobook -- videobook mcp",
         "",
     ].join("\n"));
+    for (const warning of onePasswordWarnings())
+        process.stderr.write(`videobook: ${warning}\n`);
 }
 function reportStartupFailure(error, port) {
     if (error instanceof ServerAlreadyRunningError) {

package/dist/cli/setup-command.js

@@ -0,0 +1,60 @@
+import { readEnvValues, updateEnvFile } from "../env-file.js";
+import { MANAGED_ENV_KEYS, getDefaultSecretStore } from "../env-secrets.js";
+import { OP_TOKEN_SETTING, OP_VAULT_SETTING, listVaultItemTitles, opErrorMessage, resolveServiceToken, } from "../one-password.js";
+const AMBIENT_TOKEN_VARIABLE = "OP_SERVICE_ACCOUNT_TOKEN";
+function savedSetting(name, file) {
+    return process.env[name]?.trim() || file[name]?.trim() || null;
+}
+function chosenVault(flags, file) {
+    return flags.vault?.trim() || savedSetting(OP_VAULT_SETTING, file);
+}
+function chosenToken(flags, file) {
+    const explicit = flags.token?.trim() || savedSetting(OP_TOKEN_SETTING, file);
+    if (explicit)
+        return explicit;
+    return process.env[AMBIENT_TOKEN_VARIABLE]?.trim() ? `env:${AMBIENT_TOKEN_VARIABLE}` : null;
+}
+function describeToken(token) {
+    if (!token)
+        return "op's own sign-in";
+    const resolved = resolveServiceToken(token, process.env);
+    if (resolved.source === "literal")
+        return "a literal token (stored in the file; prefer env:VAR)";
+    return resolved.value ? token : `${token}, which is not set in this shell`;
+}
+async function removeSettings(envPath) {
+    await updateEnvFile(envPath, { [OP_VAULT_SETTING]: null, [OP_TOKEN_SETTING]: null });
+    process.stdout.write(`Removed ${OP_VAULT_SETTING} and ${OP_TOKEN_SETTING} from ${envPath}\n`);
+    return 0;
+}
+function verifyVault(vault, token) {
+    const value = token ? resolveServiceToken(token, process.env).value : null;
+    try {
+        const titles = listVaultItemTitles(vault, process.env, value);
+        const found = MANAGED_ENV_KEYS.filter((key) => titles.has(key));
+        const missing = MANAGED_ENV_KEYS.filter((key) => !titles.has(key));
+        process.stdout.write(`1Password vault ${vault}: ${found.length} of ${MANAGED_ENV_KEYS.length} videobook keys found\n`);
+        if (missing.length > 0)
+            process.stdout.write(`Not in the vault: ${missing.join(", ")}\n`);
+        return 0;
+    }
+    catch (error) {
+        process.stderr.write(`Could not list 1Password vault ${vault}: ${opErrorMessage(error, value)}\n`);
+        return 1;
+    }
+}
+export async function runSetupCommand(flags) {
+    const envPath = getDefaultSecretStore().envPath();
+    if (flags.remove)
+        return removeSettings(envPath);
+    const file = readEnvValues(envPath);
+    const vault = chosenVault(flags, file);
+    if (!vault) {
+        process.stderr.write("setup 1password needs --op-vault <vault>, the vault whose items are named after videobook's keys\n");
+        return 2;
+    }
+    const token = chosenToken(flags, file);
+    await updateEnvFile(envPath, { [OP_VAULT_SETTING]: vault, [OP_TOKEN_SETTING]: token });
+    process.stdout.write(`Saved ${OP_VAULT_SETTING}=${vault} and the token setting (${describeToken(token)}) to ${envPath}\n`);
+    return flags.verify ? verifyVault(vault, token) : 0;
+}

package/dist/dancing-workflow.js

@@ -3,6 +3,7 @@ import { dirname, join, resolve } from "node:path";
 import { tmpdir } from "node:os";
 import { fileURLToPath } from "node:url";
 import { YtDlp } from "ytdlp-nodejs";
+import { ytdlpRunOptions } from "./ytdlp-binary.js";
 import { findVideoFile, resolveNotebookCellArtifactId, } from "videobook-engine";
 import { probeImage } from "./image.js";
 import { notebookCellFingerprint } from "./jobs/run-notebook.js";
@@ -73,7 +74,7 @@ async function hasFile(engine, artifactId, filename) {
         && manifest.value.files.some((file) => file.name === filename);
 }
 async function downloadDancingVideo(destination) {
-    const ytdlp = new YtDlp();
+    const ytdlp = new YtDlp(ytdlpRunOptions());
     await ytdlp
         .download(DANCING_SOURCE_URL)
         .setOutputTemplate(destination)

package/dist/env-file.js

@@ -0,0 +1,91 @@
+import { randomUUID } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { chmod, mkdir, readFile, rename, stat, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
+import { parse } from "dotenv";
+const KEY_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/u;
+const NEW_FILE_MODE = 0o600;
+const NEW_DIRECTORY_MODE = 0o700;
+function assignmentPattern(key) {
+    return new RegExp(`^\\s*(?:export\\s+)?${key}\\s*=`, "u");
+}
+export function hasControlCharacters(value) {
+    return [...value].some((character) => {
+        const code = character.codePointAt(0) ?? 0;
+        return code < 32 || code === 127;
+    });
+}
+export function formatEnvValue(value) {
+    if (!/[#'"\s]/u.test(value))
+        return value;
+    if (!value.includes("'"))
+        return `'${value}'`;
+    if (!value.includes("\""))
+        return `"${value}"`;
+    throw new Error("value cannot contain both single and double quotes");
+}
+function withoutAssignments(lines, key) {
+    const pattern = assignmentPattern(key);
+    return lines.filter((line) => !pattern.test(line));
+}
+function withAssignment(lines, key, value) {
+    const pattern = assignmentPattern(key);
+    const line = `${key}=${formatEnvValue(value)}`;
+    const last = lines.reduce((found, candidate, index) => pattern.test(candidate) ? index : found, -1);
+    if (last >= 0)
+        return lines.map((candidate, index) => index === last ? line : candidate);
+    return [...lines, line];
+}
+function splitLines(raw) {
+    if (raw === "")
+        return [];
+    const lines = raw.split("\n");
+    return lines.at(-1) === "" ? lines.slice(0, -1) : lines;
+}
+export function applyEnvUpdates(raw, updates) {
+    let lines = splitLines(raw);
+    for (const [key, value] of Object.entries(updates)) {
+        if (!KEY_PATTERN.test(key))
+            throw new Error(`${key} is not a valid environment variable name`);
+        lines = value === null ? withoutAssignments(lines, key) : withAssignment(lines, key, value);
+    }
+    return lines.length === 0 ? "" : `${lines.join("\n")}\n`;
+}
+export function readEnvValues(path) {
+    try {
+        return parse(readFileSync(path, "utf8"));
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return {};
+        throw error;
+    }
+}
+async function readIfPresent(path) {
+    try {
+        return await readFile(path, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+}
+async function existingMode(path) {
+    try {
+        return (await stat(path)).mode & 0o777;
+    }
+    catch {
+        return NEW_FILE_MODE;
+    }
+}
+export async function updateEnvFile(path, updates) {
+    const raw = await readIfPresent(path);
+    const next = applyEnvUpdates(raw ?? "", updates);
+    await mkdir(dirname(path), { recursive: true, mode: NEW_DIRECTORY_MODE });
+    const mode = raw === null ? NEW_FILE_MODE : await existingMode(path);
+    const temporary = `${path}.tmp.${randomUUID()}`;
+    await writeFile(temporary, next, { encoding: "utf8", mode });
+    await chmod(temporary, mode);
+    await rename(temporary, path);
+}

package/dist/env-secrets.js

@@ -1,29 +1,30 @@
 /**
  * Secret-source detection and .env editing.
  *
- * Secrets reach the server two ways:
+ * Secrets reach the server three ways:
  *   1. `op run --env-file=.env.tpl --` resolves op:// references and injects
  *      them into the environment BEFORE Node starts (npm run dev:server).
  *   2. A plain `.env` file, loaded here with dotenv semantics: never override
  *      a var that is already set, so op-injected values always win.
+ *   3. op:// references left in the environment or `.env`, plus the vault
+ *      named by VIDEOBOOK_OP_VAULT, resolved through the 1Password CLI by
+ *      resolveOnePassword() before a server starts.
  *
- * A managed key that was already set before `.env` loaded is therefore
- * "1password" — externally managed and read-only, because a `.env` write
- * would be silently shadowed on the next start. A key whose value arrived
- * via `.env` is "env" and editable. A shell-exported var is also classified
- * "1password"; the label is approximate but the read-only behavior is right.
+ * A managed key that was already set before `.env` loaded, or that 1Password
+ * resolved, is therefore "1password" — externally managed and read-only,
+ * because a `.env` write would be silently shadowed on the next start. A key
+ * whose literal value arrived via `.env` is "env" and editable. A
+ * shell-exported var is also classified "1password"; the label is
+ * approximate but the read-only behavior is right.
  *
  * `.env` lives in the data home (the repo root in a source checkout) and is
  * server runtime configuration, not a project artifact, so direct node:fs is
  * correct here — the videobook-engine rule covers managed artifacts and their
  * materialized workspaces.
  */
-import { readFileSync } from "node:fs";
-import { mkdir, readFile, writeFile, rename } from "node:fs/promises";
-import { dirname } from "node:path";
-import { randomUUID } from "node:crypto";
-import { parse } from "dotenv";
 import { dataLayout } from "./data-home.js";
+import { hasControlCharacters, readEnvValues, updateEnvFile } from "./env-file.js";
+import { resolveOnePasswordEnv } from "./one-password.js";
 export const MANAGED_ENV_KEYS = [
     "OPENAI_API_KEY",
     "KIE_API_KEY",
@@ -62,41 +63,6 @@ export function maskEnvValue(value) {
 /** Raised on rejected writes. Messages never include the secret value. */
 export class SecretWriteError extends Error {
 }
-function hasControlCharacters(value) {
-    for (const ch of value) {
-        const code = ch.codePointAt(0) ?? 0;
-        if (code < 32 || code === 127)
-            return true;
-    }
-    return false;
-}
-function formatEnvValue(value) {
-    const needsQuoting = /[#'"\s]/.test(value);
-    if (!needsQuoting)
-        return value;
-    if (!value.includes("'"))
-        return `'${value}'`;
-    if (!value.includes('"'))
-        return `"${value}"`;
-    throw new SecretWriteError("value cannot contain both single and double quotes");
-}
-/** Replace the last `KEY=...` line (last one wins in dotenv) or append. Other lines are untouched. */
-function upsertEnvLine(raw, key, newLine) {
-    const lines = raw.split("\n");
-    const matcher = new RegExp(`^\\s*(?:export\\s+)?${key}\\s*=`);
-    let lastIndex = -1;
-    for (let i = 0; i < lines.length; i++) {
-        if (matcher.test(lines[i]))
-            lastIndex = i;
-    }
-    if (lastIndex >= 0) {
-        lines[lastIndex] = newLine;
-        return lines.join("\n");
-    }
-    if (raw === "")
-        return `${newLine}\n`;
-    return raw.endsWith("\n") ? `${raw}${newLine}\n` : `${raw}\n${newLine}\n`;
-}
 function defaultEnvPath() {
     return process.env.VIDEOBOOK_ENV_PATH ?? dataLayout().envPath;
 }
@@ -104,17 +70,9 @@ export function createSecretStore(options = {}) {
     const envPath = options.envPath ?? defaultEnvPath();
     const processEnv = options.processEnv ?? process.env;
     const preSet = new Set();
+    const fromOnePassword = new Set();
     let loaded = false;
-    function readEnvFileSync() {
-        try {
-            return readFileSync(envPath, "utf8");
-        }
-        catch (err) {
-            if (err.code === "ENOENT")
-                return "";
-            throw err;
-        }
-    }
+    let resolution = null;
     function loadDotenv() {
         if (loaded)
             return;
@@ -124,8 +82,7 @@ export function createSecretStore(options = {}) {
             if (value !== undefined && value !== "")
                 preSet.add(key);
         }
-        const parsed = parse(readEnvFileSync());
-        for (const [key, value] of Object.entries(parsed)) {
+        for (const [key, value] of Object.entries(readEnvValues(envPath))) {
             if (processEnv[key] === undefined)
                 processEnv[key] = value;
         }
@@ -139,7 +96,7 @@ export function createSecretStore(options = {}) {
         const value = processEnv[key];
         if (!value || value.startsWith("op://"))
             return "missing";
-        if (preSet.has(key))
+        if (preSet.has(key) || fromOnePassword.has(key))
             return "1password";
         return "env";
     }
@@ -157,24 +114,31 @@ export function createSecretStore(options = {}) {
         if (getSource(key) === "1password") {
             throw new SecretWriteError(`${key} is managed by 1Password; edit it in the vault`);
         }
-        const line = `${key}=${formatEnvValue(value)}`;
-        let raw;
-        try {
-            raw = await readFile(envPath, "utf8");
+        if (value.includes("'") && value.includes("\"")) {
+            throw new SecretWriteError("value cannot contain both single and double quotes");
         }
-        catch (err) {
-            if (err.code !== "ENOENT")
-                throw err;
-            raw = "";
-        }
-        const updated = upsertEnvLine(raw, key, line);
-        await mkdir(dirname(envPath), { recursive: true });
-        const tmp = `${envPath}.tmp.${randomUUID()}`;
-        await writeFile(tmp, updated, "utf8");
-        await rename(tmp, envPath);
+        await updateEnvFile(envPath, { [key]: value });
         processEnv[key] = value;
     }
-    return { loadDotenv, getValue, getSource, setEnvSecret };
+    function resolveOnePassword() {
+        if (resolution)
+            return resolution;
+        loadDotenv();
+        const resolved = resolveOnePasswordEnv(processEnv, MANAGED_ENV_KEYS);
+        for (const key of [...resolved.fromReferences, ...resolved.fromVault])
+            fromOnePassword.add(key);
+        resolution = resolved;
+        return resolved;
+    }
+    return {
+        loadDotenv,
+        getValue,
+        getSource,
+        setEnvSecret,
+        resolveOnePassword,
+        onePasswordResolution: () => resolution,
+        envPath: () => envPath,
+    };
 }
 let defaultStore = null;
 export function getDefaultSecretStore() {

package/dist/ffprobe-binary.js

@@ -1,4 +1,4 @@
-import { closeSync, openSync, readSync } from "node:fs";
+import { accessSync, chmodSync, closeSync, constants, openSync, readSync, statSync } from "node:fs";
 import { createRequire } from "node:module";
 const MACH_O_64_MAGIC_LE = 0xfeedfacf;
 const FAT_MAGIC_BE = 0xcafebabe;
@@ -40,16 +40,38 @@ export function readBinaryHeader(path) {
         return null;
     }
 }
-/**
- * ffprobe-static ships an x86_64 build under darwin/arm64, which cannot spawn
- * on Apple Silicon without Rosetta. An explicit override wins; otherwise the
- * bundled binary is used only when its CPU matches, else `ffprobe` on PATH.
- */
+export function ensureExecutable(path) {
+    try {
+        accessSync(path, constants.X_OK);
+        return true;
+    }
+    catch {
+        try {
+            chmodSync(path, statSync(path).mode | 0o111);
+            accessSync(path, constants.X_OK);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+}
 export function resolveFfprobePath(bundledPath, override, hostArch) {
     if (override)
         return override;
+    if (!bundledPath)
+        return "ffprobe";
     const header = readBinaryHeader(bundledPath);
     return header && binaryRunsOnHost(header, hostArch) ? bundledPath : "ffprobe";
 }
 const require = createRequire(import.meta.url);
-export const FFPROBE = resolveFfprobePath(require("ffprobe-static").path, process.env.VIDEOBOOK_FFPROBE_PATH, process.arch);
+export function bundledFfprobe() {
+    try {
+        const { path } = require("@ffprobe-installer/ffprobe");
+        return ensureExecutable(path) ? path : null;
+    }
+    catch {
+        return null;
+    }
+}
+export const FFPROBE = resolveFfprobePath(bundledFfprobe(), process.env.VIDEOBOOK_FFPROBE_PATH, process.arch);

package/dist/hydration.js

@@ -0,0 +1,56 @@
+import { startPostMetricsScheduler } from "./posts/post-metrics.js";
+import { queue } from "./queue.js";
+import { loadAndArmAll } from "./scheduled-posts.js";
+const runDirectly = async (step) => await step.run();
+function openBooks(books) {
+    return books.list().flatMap((book) => {
+        const selected = books.get(book.bookId);
+        return selected.ok ? [selected.value] : [];
+    });
+}
+function bookTag(book) {
+    return `${book.name} [${book.bookId.slice(0, 8)}]`;
+}
+async function loadReconcilers(run) {
+    const imageSubjects = await run({ phase: "import", label: "jobs/image-subjects (hydrate)", run: () => import("./jobs/image-subjects.js") });
+    const runNotebook = await run({ phase: "import", label: "jobs/run-notebook (hydrate)", run: () => import("./jobs/run-notebook.js") });
+    return { imageSubjects, runNotebook };
+}
+async function ensureDevFixtures(books, run) {
+    const dancing = await run({ phase: "import", label: "dancing-workflow (fixtures)", run: () => import("./dancing-workflow.js") });
+    await run({ phase: "reconcile", label: "ensureDancingWorkflow()", run: () => dancing.ensureDancingWorkflow(books) });
+}
+async function reconcileBeforeQueue(books, run, reconcilers) {
+    const { imageSubjects, runNotebook } = reconcilers;
+    for (const book of openBooks(books)) {
+        const tag = bookTag(book);
+        await run({ phase: "reconcile", label: `${tag} jobs.queue.reap()`, run: () => book.engine.jobs.queue.reap() });
+        await run({ phase: "reconcile", label: `${tag} reconcileImageSubjectJobFailures`, run: () => imageSubjects.reconcileImageSubjectJobFailures(book.engine, book.bookId) });
+        await run({ phase: "reconcile", label: `${tag} abortLeasedNotebookRunsOnStartup`, run: () => runNotebook.abortLeasedNotebookRunsOnStartup(book.engine) });
+        await run({ phase: "reconcile", label: `${tag} reconcileGenerationMediaOutputs`, run: () => runNotebook.reconcileGenerationMediaOutputs(book.engine) });
+        await run({ phase: "reconcile", label: `${tag} reconcileQueuedNotebookCells`, run: () => runNotebook.reconcileQueuedNotebookCells(book.engine) });
+    }
+}
+async function reconcileAfterQueue(books, run, reconcilers) {
+    for (const book of openBooks(books)) {
+        await run({
+            phase: "reconcile",
+            label: `${bookTag(book)} reconcileAwaitingNotebookOutputs`,
+            run: () => reconcilers.runNotebook.reconcileAwaitingNotebookOutputs(book.engine, book.bookId),
+        });
+    }
+}
+export async function hydrateLibrary(books, options) {
+    const run = options.runStep ?? runDirectly;
+    await run({ phase: "open", label: "bookManager.ready()", run: () => books.ready() });
+    if (options.devFixtures)
+        await ensureDevFixtures(books, run);
+    const reconcilers = await loadReconcilers(run);
+    await reconcileBeforeQueue(books, run, reconcilers);
+    if (options.startQueue !== false)
+        await run({ phase: "reconcile", label: "queue.start()", run: () => queue.start() });
+    await reconcileAfterQueue(books, run, reconcilers);
+    await run({ phase: "reconcile", label: "loadAndArmAll()", run: () => loadAndArmAll() });
+    if (options.startPostMetrics !== false)
+        startPostMetricsScheduler();
+}

package/dist/jobs/archive-clip.js

@@ -5,6 +5,7 @@ import { mkdtemp, readFile, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { extname, join, posix } from "node:path";
 import { YtDlp } from "ytdlp-nodejs";
+import { ytdlpRunOptions } from "../ytdlp-binary.js";
 import { registerJobHandler } from "../queue.js";
 import { getApiKey, requireApiKey } from "../api-key.js";
 import { probeVideo } from "../ffmpeg.js";
@@ -117,7 +118,7 @@ async function prepareUrlMedia(payload) {
         throw new Error("url archive requires url");
     const dir = await mkdtemp(join(tmpdir(), "videocity-archive-"));
     const outputPath = join(dir, "original.mp4");
-    const ytdlp = new YtDlp();
+    const ytdlp = new YtDlp(ytdlpRunOptions());
     try {
         await ytdlp
             .download(payload.url)

package/dist/jobs/download-video.js

@@ -1,6 +1,7 @@
 import { join } from "node:path";
 import { stat, unlink } from "node:fs/promises";
 import { YtDlp } from "ytdlp-nodejs";
+import { ytdlpRunOptions } from "../ytdlp-binary.js";
 import { extractOpenGraph } from "@devmehq/open-graph-extractor";
 import { queue, registerJobHandler } from "../queue.js";
 import { runFfmpeg, probeVideo, H264_MEDIUM, AUDIO_OPTS } from "../ffmpeg.js";
@@ -178,8 +179,8 @@ export function imageExtension(info) {
     return IMAGE_EXTENSIONS.has(ext) ? `.${ext}` : ".jpg";
 }
 export function registerDownloadVideoJob(engine) {
-    const ytdlp = new YtDlp();
     registerJobHandler("download_video", async (payload, ctx) => {
+        const ytdlp = new YtDlp(ytdlpRunOptions());
         const { url, assetId, assetDir, exportVideos, sourcePrefix, requestedRange, } = payload;
         const bookId = payload.bookId ?? "";
         const outputPath = join(assetDir, "original.mp4");

package/dist/load-env.js

@@ -3,7 +3,10 @@
  * every entry point: ESM executes it before the other imports' module bodies,
  * so env vars are populated before any module reads them at import time. It
  * also snapshots which managed keys were set before `.env` loaded, which is
- * how the secret store tells 1Password-injected keys from `.env`-backed ones.
+ * how the secret store tells 1Password-injected keys from `.env`-backed ones,
+ * then resolves op:// references and the configured vault through `op`.
  */
 import { getDefaultSecretStore } from "./env-secrets.js";
-getDefaultSecretStore().loadDotenv();
+const store = getDefaultSecretStore();
+store.loadDotenv();
+store.resolveOnePassword();