deploy beb5a90

backend/Dockerfile

@@ -27,14 +27,14 @@ ENV PATH="/opt/tool-venv/bin:$PATH"
 
 # shared has its own deps (zod) the schemas need
 WORKDIR /app/shared
-COPY shared/ ./
+COPY web/shared/ ./
 RUN npm ci
 
 WORKDIR /app/backend
-COPY backend/package*.json ./
+COPY web/backend/package*.json ./
 RUN npm ci
 
-COPY backend/ ./
+COPY web/backend/ ./
 RUN npx tsc
 
 RUN mkdir -p temp && chmod 777 temp

backend/README.md

@@ -1,6 +1,6 @@
 # Backend
 
-the Express 5 + TypeScript service that powers stream resolution, muxing, the Spotify resolution race, and the Remix Lab API. for the project overview see [`../README.md`](../README.md). for self-hosting see [`../docs/run-an-instance.md`](../docs/run-an-instance.md).
+the Express 5 + TypeScript service that powers stream resolution, muxing, the Spotify resolution race, and the Remix Lab API. for the project overview see [`../../README.md`](../../README.md). for self-hosting see [`../../docs/run-an-instance.md`](../../docs/run-an-instance.md).
 
 ## Layout
 
@@ -53,11 +53,11 @@ backend/
 
 `remix.routes.ts` proxies the Python Remix Lab kernel and serves stem/chord/beat results. `keychanger.routes.ts` handles pitch-shift uploads. `/convert` and `/proxy` are gated by `concurrencyGuard(2)` (`utils/network/security.util.ts`) to keep memory bounded on Termux and free-tier hosts.
 
-response shapes for `/info` and `/convert` are documented in [`../docs/api.md`](../docs/api.md).
+response shapes for `/info` and `/convert` are documented in [`../../docs/api.md`](../../docs/api.md).
 
 ## Environment
 
-configure via `backend/.env`. the full reference is in [`../docs/env-variables.md`](../docs/env-variables.md). the backend boots without most of these — they enable optional features and degrade gracefully when unset. minimum to get something useful:
+configure via `web/backend/.env`. the full reference is in [`../../docs/env-variables.md`](../../docs/env-variables.md). the backend boots without most of these — they enable optional features and degrade gracefully when unset. minimum to get something useful:
 
 - `REDIS_URL` — Redis for the metadata cache and BullMQ job queue (defaults to `redis://127.0.0.1:6379`).
 - `GEMINI_API_KEY` and/or `GROQ_API_KEY` — at least one for the AI fallback in Spotify resolution.
@@ -97,4 +97,4 @@ other scripts:
 - **MP4 finalization**: `-movflags +faststart` is set on finalized MP4 downloads so playback can start before the file finishes.
 - **SSE**: `/events` is the canonical telemetry channel. resolvers, downloaders, and the seeder push progress through `utils/network/sse.util.ts`.
 
-before putting an instance on the public internet, read [`../docs/protect-an-instance.md`](../docs/protect-an-instance.md).
+before putting an instance on the public internet, read [`../../docs/protect-an-instance.md`](../../docs/protect-an-instance.md).

backend/ci-results/security-scan-tests.json

@@ -0,0 +1,4 @@
+{
+  "items": [],
+  "next_page_token": null
+}

backend/ci-results/test-frontend-tests.json

@@ -0,0 +1,4 @@
+{
+  "items": [],
+  "next_page_token": null
+}

backend/eslint.config.js

@@ -4,13 +4,13 @@ import tseslint from 'typescript-eslint';
 import sonarjs from 'eslint-plugin-sonarjs';
 import prettierConfig from 'eslint-config-prettier';
 import { existsSync } from 'node:fs';
-import { join } from 'node:path';
-import process from 'node:process';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
 
-const pluginPath = join(process.cwd(), '../scripts/eslint-plugin-nexstream.js');
+const pluginPath = join(dirname(fileURLToPath(import.meta.url)), '../../scripts/eslint-plugin-nexstream.js');
 const hasPlugin = existsSync(pluginPath);
 const nexstreamPlugin = hasPlugin
-  ? (await import('../scripts/eslint-plugin-nexstream.js')).default
+  ? (await import('../../scripts/eslint-plugin-nexstream.js')).default
   : null;
 
 export default tseslint.config(

backend/facebook_cookies.txt

@@ -0,0 +1,11 @@
+# Netscape HTTP Cookie File
+# This file is generated by yt-dlp.  Do not edit.
+
+.facebook.com	TRUE	/	TRUE	1784546865	datr	5WD3Z2AfXZVSxZCH4yapnyD9
+.facebook.com	TRUE	/	TRUE	1805180241	sb	5WD3Z1jSQy5EgJXUVh5vgb89
+.facebook.com	TRUE	/	TRUE	1779253025	ps_l	1
+.facebook.com	TRUE	/	TRUE	1779253025	ps_n	1
+.facebook.com	TRUE	/	TRUE	1808801368	c_user	61558851086624
+.facebook.com	TRUE	/	TRUE	1785041368	fr	19UDONV88XhKGe2RF.AWf4M4X9z4Ngaor9pvZ5MbZyPg_kHIz-h5WV6izpvU192apVcUI.Bp7urX..AAA.0.0.Bp7urX.AWeV8ErxwjQi2vTc5yCctfMZQGE
+.facebook.com	TRUE	/	TRUE	1808801368	xs	45%3Abib84KIB5WBKnA%3A2%3A1770620237%3A-1%3A-1%3A%3AAcwTxaZyeBZFm282q3eAouldL84OxiuyfhsHaO40ug
+.facebook.com	TRUE	/	TRUE	0	presence	C%7B%22t3%22%3A%5B%5D%2C%22utc3%22%3A1777265373434%2C%22v%22%3A1%7D

backend/src/services/extractors/instagram/fetcher.ts

@@ -106,7 +106,7 @@ export function shortcodeToMediaId(shortcode: string): string {
   return pk.toString();
 }
 
-// Set-Cookie -> replayable header (anonymous csrftoken/mid, NOT login cookie)
+// Set-Cookie -> replayable header (anonymous csrftoken/mid, NOT login cookie) // eslint-disable-line nexstream/nexstream-comments
 function jarFromResponse(
   response: globalThis.Response
 ): Record<string, string> {
@@ -184,7 +184,7 @@ async function getSession(
 }
 
 // logged-out post resolve: reuse cached page tokens, then /api/graphql.
-// IG gates old shortcode query behind auth, but this media_id query is
+// IG gates old shortcode query behind auth, but this media_id query is // eslint-disable-line nexstream/nexstream-comments
 // served logged-out — sec-fetch headers keep IG returning JSON not html shell
 export async function fetchLoggedOutMedia(
   shortcode: string,

backend/src/services/extractors/instagram/index.ts

@@ -45,7 +45,7 @@ async function resolveParsed(
       const parsed = await resolve();
       if (parsed && parsed.media.length > 0) return parsed;
     } catch (error: unknown) {
-      // IG rate-limiting — stop cascade rather than hammering every path
+      // IG rate-limiting — stop cascade rather than hammering every path // eslint-disable-line nexstream/nexstream-comments
       if ((error as { retryable?: boolean })?.retryable) throw error;
       console.debug(`[JS-IG] path failed: ${(error as Error).message}`);
     }

backend/src/services/ytdlp/info-youtube.ts

@@ -126,7 +126,7 @@ export async function handleYoutubeTiktokInfo(
       };
       await setCachedInfo(cacheKey, fullInfo);
 
-      // JS already returned HD; only enhance via yt-dlp when opted in
+      // JS already returned HD; only enhance via yt-dlp when opted in // eslint-disable-line nexstream/nexstream-comments
       if (!isTikTok && process.env.YT_DLP_ENHANCE === '1')
         void runYtdlpEnhancement(
           cacheKey,

backend/temp_cookies.txt

@@ -0,0 +1,26 @@
+# Netscape HTTP Cookie File
+# This file is generated by yt-dlp.  Do not edit.
+
+.youtube.com	TRUE	/	FALSE	0	PREF	f6=40000000&tz=UTC&f7=100&f4=4000000&hl=en
+.youtube.com	TRUE	/	FALSE	1802593048	HSID	AMY9owAf1zjps8RNZ
+.youtube.com	TRUE	/	TRUE	1802593048	SSID	Al0WBDo16MQQN0E62
+.youtube.com	TRUE	/	FALSE	1802593048	APISID	-6sBzQS5APgo0h2H/Afd_pLBBCBr7BtEni
+.youtube.com	TRUE	/	TRUE	1802593048	SAPISID	QKYsvlhchM0hAEvv/Av0Bn7_pR3oGo4ksY
+.youtube.com	TRUE	/	TRUE	1802593048	__Secure-1PAPISID	QKYsvlhchM0hAEvv/Av0Bn7_pR3oGo4ksY
+.youtube.com	TRUE	/	TRUE	1802593048	__Secure-3PAPISID	QKYsvlhchM0hAEvv/Av0Bn7_pR3oGo4ksY
+.youtube.com	TRUE	/	FALSE	1802593048	SID	g.a0005ghxRHGB_w-Qxm9zoJuKGR4ftChQ5g3l-mAROSkNtWaCtmDsUxQkqwHEC6_3ZyDTAFYpKAACgYKAY4SARcSFQHGX2MiOPuh0Fc1utZateAkAiVxwhoVAUF8yKrcFGutbai4YSuMtaKSYLKC0076
+.youtube.com	TRUE	/	TRUE	1802593048	__Secure-1PSID	g.a0005ghxRHGB_w-Qxm9zoJuKGR4ftChQ5g3l-mAROSkNtWaCtmDsTNI-N1qsAsxtQ64wQq3nHgACgYKAVkSARcSFQHGX2MiJjRw70uN3fX8dMxG6dcz2xoVAUF8yKpBbIAXR7NCncXL_zgM7JFS0076
+.youtube.com	TRUE	/	TRUE	1802593048	__Secure-3PSID	g.a0005ghxRHGB_w-Qxm9zoJuKGR4ftChQ5g3l-mAROSkNtWaCtmDssC8jNY6aRqqtU956ISzcVwACgYKAcUSARcSFQHGX2Mi6Z6gOSXcF6VdmU0exBgVvBoVAUF8yKqdEewjtu72m0dkdI7Bb3b20076
+.youtube.com	TRUE	/	TRUE	1802593049	LOGIN_INFO	AFmmF2swRgIhAM396oCYxY_Gt8eWWvTIPaxkddQw9kqmxVv9iRZto3P5AiEAuBV0gMFQgizqziQ9NrGNKOSNG6Un0sCdV7Wf7NBY6JI:QUQ3MjNmeVlmS192dk1mWHNEdFB4TjhTcjJ0Sm5oWlZtMFBHdDgwZmZNZEpBV1IzQzRkTVpHZ3o1ZkMyMEJSR01zM3dTRVEycnNveEdscWcxS0VsUkxNRl9wek1LUGpyWXQ2UEpCcFZldG02VkhKcENHZlFHNzB4WFlPNk84akdoVk1pWVFVMGh6em1QbHR1MFBWckZGQ25xYXh1VE54SW93
+.youtube.com	TRUE	/	TRUE	1802022626	__Secure-1PSIDTS	sidts-CjUB7I_69Gg5PPVJMY3ZmUw7MbeMoHvwd4AgOfyBuTwf-oUo0etiGiy9dfmi3cJZG3QDI4gDWhAA
+.youtube.com	TRUE	/	TRUE	1802022626	__Secure-3PSIDTS	sidts-CjUB7I_69Gg5PPVJMY3ZmUw7MbeMoHvwd4AgOfyBuTwf-oUo0etiGiy9dfmi3cJZG3QDI4gDWhAA
+.youtube.com	TRUE	/	FALSE	1802104616	SIDCC	AKEyXzW6rJpfJu1AAtIQa3UnncmZlJQz2FgPDJ2JWb37lI2o67HxxSKlXljqIaJE1eaWkoKB
+.youtube.com	TRUE	/	TRUE	1802104616	__Secure-1PSIDCC	AKEyXzX6fTh1uav-l_51ixvEJlc6U2Kh01Bj5ovhYia6JxWJ1t-0ckJEM0CBXRN4GnryOx0NTA
+.youtube.com	TRUE	/	TRUE	1802104616	__Secure-3PSIDCC	AKEyXzW6JYTeluTH5xCTcjo26uOqyKcHZfnfXUCQefrB0lcAyF6GXvc9ukP4P8Eu1eFuNuw1Yw
+.youtube.com	TRUE	/	TRUE	0	YSC	bqf6NUS4Q6g
+.youtube.com	TRUE	/	TRUE	1786120616	VISITOR_INFO1_LIVE	dp3e_nSe7tU
+.youtube.com	TRUE	/	TRUE	1786120616	VISITOR_PRIVACY_METADATA	CgJQSBIEGgAgDw%3D%3D
+.youtube.com	TRUE	/	TRUE	1786120215	__Secure-ROLLOUT_TOKEN	CMWQ_MCe_Z25jgEQ86i-y6jKkgMY3tevzKjKkgM%3D
+.youtube.com	TRUE	/	TRUE	1833640616	__Secure-YT_TVFAS	t=491824&s=2
+.youtube.com	TRUE	/	TRUE	1786120616	DEVICE_INFO	ChxOell3TkRVek1qVTROemt6TVRjNU1ESXlPQT09EKj3oswGGJn0oswG
+.youtube.com	TRUE	/tv	TRUE	1803400616	__Secure-YT_DERP	CPGatM2BBA%3D%3D

backend/youtube_cookies.txt

@@ -0,0 +1,15 @@
+# Netscape HTTP Cookie File
+# This file is generated by yt-dlp.  Do not edit.
+
+.youtube.com	TRUE	/	FALSE	0	PREF	tz=UTC&f4=4000000&f7=100&f6=40000000&hl=en
+.youtube.com	TRUE	/	TRUE	1808440699	__Secure-3PAPISID	y5pQqHVUZStFH2AW/AvSBkKTBRTnYjk4qH
+.youtube.com	TRUE	/	TRUE	1808440699	__Secure-3PSID	g.a0007wh5iBXFaaHEI-Hz4oBHuJ6p0KdK3Nk96GklcE0wV-RlAySfnIV2i0xahOVmDgg10caxqQACgYKASESARASFQHGX2MidghmVUD0__2OGBxPY_UdthoVAUF8yKoCyoiqxb_wWpc1G8FhmjUb0076
+.youtube.com	TRUE	/	TRUE	1805831903	__Secure-1PSIDTS	sidts-CjQBWhotCdNFAk0zmZcDTj_czZQglenZfRqtaUUENxqHxIOgRgTk_qIQZIwpWUcb0H947CewEAA
+.youtube.com	TRUE	/	TRUE	1805831903	__Secure-3PSIDTS	sidts-CjQBWhotCdNFAk0zmZcDTj_czZQglenZfRqtaUUENxqHxIOgRgTk_qIQZIwpWUcb0H947CewEAA
+.youtube.com	TRUE	/	TRUE	1805831906	__Secure-3PSIDCC	AKEyXzWYdD85_KP4QfHB0Mlo2dDFxE9sni9k-NN-tIGfwaHW6vk55jQVSZpsUvEOhft2kqgNbj8
+.youtube.com	TRUE	/	TRUE	1794591135	__Secure-YNID	18.YT=1YFLiGwm0cW5oCQ7iscXhoG5_9Tg27oIWqfmPKjyPKCG5hAWnT9uB2nkwRf75MghUBc8SdEsgZR8-wdRp4ZgXgVn_veGdJFeGKI5Jt6wdbIUql6GzveMD9NWNZa0dwEPmdQQwLB61GPMYJrt60i49TLSxC5gZE4xJXFE16i7GalsEgKGvxXjHxirWHJjOUpivWoTuhNfrXmnn6ECH0695OqrH7nopBRDF6XJN7OxLgaOj_eZxRNIoe7Pi_iSh-g6Nl0y_woTCSUWuHEQPa78pePgcHeRubtgwFO990s4So5O3760PeBrHiQxpcYkKmkop8Q3doceyJ5cyzLUjEf5jw
+.youtube.com	TRUE	/	TRUE	1779040935	GPS	1
+.youtube.com	TRUE	/	TRUE	0	YSC	uUrb1X-RXqo
+.youtube.com	TRUE	/	TRUE	1794591135	VISITOR_INFO1_LIVE	T67cF3c6mv0
+.youtube.com	TRUE	/	TRUE	1794591135	VISITOR_PRIVACY_METADATA	CgJQSBIEGgAgYg%3D%3D
+.youtube.com	TRUE	/	TRUE	1794591135	__Secure-ROLLOUT_TOKEN	COLw-NOisYO2VRDsmMWd7cCUAxjsmMWd7cCUAw%3D%3D