deploy: cdbc8841 - 2026-10-10 20:06 UTC

Dockerfile

@@ -0,0 +1,27 @@
+FROM python:3.11-slim
+
+WORKDIR /bootstrap
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    bash git ca-certificates curl openssh-client rsync unar \
+  && rm -rf /var/lib/apt/lists/* \
+  && (curl -fsSL -o /tmp/rar.tar.gz https://www.rarlab.com/rar/rarlinux-x64-712.tar.gz \
+      || curl -fsSL -o /tmp/rar.tar.gz https://www.rarlab.com/rar/rarlinux-x64-623.tar.gz) \
+  && tar -xzf /tmp/rar.tar.gz -C /tmp \
+  && install -m 0755 /tmp/rar/unrar /usr/local/bin/unrar \
+  && rm -rf /tmp/rar /tmp/rar.tar.gz \
+  && unrar | head -2 \
+  || echo "WARNING: unrar kurulamadi, rar acmada unar fallback kullanilacak"
+
+ENV PYTHONUNBUFFERED=1
+ENV PORT=7860
+
+COPY start.sh /bootstrap/start.sh
+RUN chmod +x /bootstrap/start.sh
+
+EXPOSE 7860
+
+HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \
+  CMD python3 -c "import http.client; c=http.client.HTTPConnection('127.0.0.1',int(__import__('os').environ.get('PORT','7860')),timeout=5); c.request('GET','/api/health'); r=c.getresponse(); exit(0 if r.status==200 else 1)"
+
+CMD ["/bootstrap/start.sh"]

LAST_COMMIT_DATE.txt

@@ -0,0 +1 @@
+2026-10-10T23:05:53+03:00

README.md

@@ -0,0 +1,16 @@
+---
+title: Pulltime Storage Service
+emoji: 💾
+colorFrom: indigo
+colorTo: blue
+sdk: docker
+app_port: 7860
+pinned: false
+---
+
+Bootstrap runtime for this private web-game infrastructure (inspired port).
+Not affiliated with Rockstar Games. Contains no GTA5/brand assets.
+Source code is fetched from private GitHub at container startup via GH_REPO_TOKEN.
+Game asset folder (.mirror / mirror/) is NEVER committed. Only user-provided
+legal files live in the Space Bucket mounted at /data and are copied to local
+disk at boot. No torrent runs in the Space.

SOURCE_COMMIT_SHA.txt

@@ -0,0 +1 @@
+cdbc88410147cd95f43f5d4fa230dfe006db4e5b

start.sh

@@ -0,0 +1,935 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Bootstrap v4: private GitHub -> /runtime/app, bucket /data -> local disk, then serve.
+#
+# v3 -> v4 duzeltmeleri (GoFile HTTP 401 Unauthorized):
+#   1) GoFile /contents artik HER istekte token istiyor. Tokensiz cagri = 401
+#      (status=error-token). v3 sadece "?token=" gonderiyor ve GOFILE_TOKEN
+#      bossa hicbir sey gondermiyordu -> hep 401.
+#   2) v4 once GOFILE_TOKEN'i, yoksa gecici "guest" token uretiyor:
+#      POST https://api.gofile.io/accounts  -> {"data":{"token":"..."}}
+#      ve istekleri "Authorization: Bearer <token>" header'i ile atiyor.
+#   3) GoFile ayrica "website token" (wt) istiyor. v4 wt'yi
+#      https://gofile.io/dist/js/config.js icinden canli cekiyor,
+#      bulamazsa son bilinen degere (4fd6sg89d7s6) dusuyor ve
+#      /contents cagrisina ?wt= olarak ekliyor.
+#   4) HF Spaces / VPS gibi DATACENTER IP'ler GoFile tarafindan listeleme
+#      seviyesinde engelleniyor (status=error-notPremium). Bu durumda API
+#      hicbir token ile calismaz. v4 bunu acikca loglar ve iki bypass sunar:
+#        ARCHIVE_URL        = arsivin duz http(s) linki (onerilen: HF dataset,
+#                             R2/S3 presigned URL). GoFile API hic kullanilmaz.
+#        GOFILE_DIRECT_URL  = storeX.gofile.io/download/... direkt linki.
+#                             /contents listesi atlanir, datacenterda da calisir.
+#   5) v3, indirme BASARISIZKEN bile once bucket'taki eski veriyi siliyordu
+#      (clean_legacy_bucket) -> veri kaybi. v4 silmeyi SADECE yeni arsiv
+#      dogrulandiktan SONRA yapiyor.
+#
+# Secrets (Space Settings -> Variables and secrets):
+#   GH_REPO_TOKEN (required)  fine-grained PAT, read-only to the private repo
+#   GAME_PASSWORD (required)  login password for /
+#   GOFILE_TOKEN  (onerilen)  GoFile account token. Bossa guest token denenir ama
+#                             datacenter IP'de (HF Spaces) listeleme engellidir.
+# Variables (all optional):
+#   GH_REPO_SLUG   default shs3131/playgta5-private
+#   GH_REPO_REF    default main
+#   BUCKET_DIR     default /data
+#   LOCAL_DATA_DIR default /runtime/game-data
+#   IO_WORKERS     default 48   (parallel copy/extract threads)
+#   RANGE_MB       default 64   (big files are split into ranges of this size)
+#   SHARDS         default 8    (parallel tar shards for fast cold starts)
+#   DATA_VERSION   default pA901JJr (bucket arsiv surum isareti)
+#   GOFILE_URL     default https://gofile.io/d/pA901JJr
+#   ARCHIVE_NAME   default mirror.rar
+#   ARCHIVE_URL    default ""   (duz http(s) link, GoFile API bypass; onerilen)
+#   GOFILE_DIRECT_URL default "" (storeX.gofile.io/download/... direkt link, liste atlanir)
+#   GOFILE_PASSWORD   default "" (klasor sifreliyse duz parola)
+#
+# Bucket layout (any ONE of these works, fastest first):
+#   $BUCKET_DIR/harbor-heist.shardN.tar + .harbor-shards-ready   (auto-built after first boot)
+#   $BUCKET_DIR/harbor-heist.rar (veya .zip/.tar.*) + .harbor-version (bucket arsivi)
+#   $BUCKET_DIR/mirror/newgame.zip                               (first boot, extracted straight to local disk)
+#   $BUCKET_DIR/harbor-heist/ + .harbor-ready                    (legacy folder)
+
+if [ -z "${GH_REPO_TOKEN:-}" ]; then
+  echo "GH_REPO_TOKEN secret missing. Set it in Space Settings -> Variables and secrets." >&2
+  exit 1
+fi
+if [ -z "${GAME_PASSWORD:-}" ]; then
+  echo "GAME_PASSWORD secret missing. Set it in Space Settings -> Variables and secrets." >&2
+  exit 1
+fi
+
+REPO_SLUG="${GH_REPO_SLUG:-shs3131/playgta5-private}"
+REPO_REF="${GH_REPO_REF:-main}"
+APP_DIR="/runtime/app"
+BUCKET_DIR="${BUCKET_DIR:-/data}"
+LOCAL_DATA_DIR="${LOCAL_DATA_DIR:-/runtime/game-data}"
+PORT="${PORT:-7860}"
+IO_WORKERS="${IO_WORKERS:-48}"
+RANGE_MB="${RANGE_MB:-64}"
+SHARDS="${SHARDS:-8}"
+export BIG_WORKERS="${BIG_WORKERS:-8}"
+export COPY_CHUNK_MB="${COPY_CHUNK_MB:-4}"
+BUILD_SHARDS="${BUILD_SHARDS:-0}"         # 1 = pack tar shards into the bucket after load
+# Ham Space degerleri (panel dosyasi bunlari ezemez, oncelik: Space > panel > default)
+_RAW_DIRECT="${GOFILE_DIRECT_URL:-}"
+_RAW_ARCHIVE="${ARCHIVE_URL:-}"
+DATA_VERSION="${DATA_VERSION:-pA901JJr}"
+GOFILE_URL="${GOFILE_URL:-https://gofile.io/d/pA901JJr}"
+GOFILE_TOKEN="${GOFILE_TOKEN:-}"
+GOFILE_PASSWORD="${GOFILE_PASSWORD:-}"
+GOFILE_DIRECT_URL="${GOFILE_DIRECT_URL:-https://store3.gofile.io/download/web/07e3192f-cdef-47c1-a8ec-e79f3bfd6330/mirror.rar}"
+ARCHIVE_URL="${ARCHIVE_URL:-}"
+ARCHIVE_NAME="${ARCHIVE_NAME:-mirror.rar}"
+VERSION_FILE="$BUCKET_DIR/.harbor-version"
+ARCHIVE_BUCKET_PATH="$BUCKET_DIR/$ARCHIVE_NAME"
+
+DST="$LOCAL_DATA_DIR/harbor-heist"
+DONE_MARK="$DST/.local-complete"
+MIRROR_DST="$LOCAL_DATA_DIR/mirror"
+MIRROR_DONE="$MIRROR_DST/.local-complete"
+TOOLS="/runtime/.tools"
+T_START=$SECONDS
+echo "[boot] bootstrap v4 (bearer+guest+wt gofile fix, safe bucket)"
+
+mkdir -p /runtime "$TOOLS" "$LOCAL_DATA_DIR"
+
+# Boot ciktisini hem konsola (HF Logs) hem dosyaya (panel log gorunumu) yaz.
+LOG_FILE="${BOOT_LOG:-/runtime/boot.log}"
+export BOOT_LOG="$LOG_FILE"
+if ! exec > >(tee -a "$LOG_FILE") 2>&1; then echo "[boot] log tee kapali, konsola devam" >&2; fi
+
+# ---------------------------------------------------------------------------
+# 1) Clone in background (runs in parallel with the data load)
+# ---------------------------------------------------------------------------
+rm -rf "$APP_DIR"
+(
+  echo "[clone] ${REPO_SLUG}@${REPO_REF} ..."
+  git clone --quiet --depth 1 --single-branch --branch "$REPO_REF" \
+    "https://x-access-token:${GH_REPO_TOKEN}@github.com/${REPO_SLUG}.git" "$APP_DIR" 2>&1 \
+    | sed "s/${GH_REPO_TOKEN}/***/g" || true
+  # do not leave the token in .git/config
+  git -C "$APP_DIR" remote set-url origin "https://github.com/${REPO_SLUG}.git"
+  echo "[clone] done"
+) &
+CLONE_PID=$!
+
+# ---------------------------------------------------------------------------
+# 2) Helper tools (python, stdlib only)
+# ---------------------------------------------------------------------------
+
+# --- entry-point finder: lifts a single top-level dir, exit 0 if entry found
+cat > "$TOOLS/find_entry.py" <<'PYEOF'
+import os, shutil, sys
+from pathlib import Path
+dst = Path(sys.argv[1])
+ENTRY = ('index.html', 'homepage.html')
+if not dst.is_dir():
+    raise SystemExit(1)
+if (dst / 'index.html').exists():
+    print("entry: index.html"); raise SystemExit(0)
+for sub in [p for p in dst.iterdir() if p.is_dir()]:
+    if (sub / 'index.html').exists():
+        for item in list(sub.iterdir()):
+            shutil.move(str(item), str(dst / item.name))
+        try: sub.rmdir()
+        except OSError: pass
+        print(f"lifted single top-level dir: {sub.name}"); print("entry: index.html")
+        raise SystemExit(0)
+best = None
+for root, dirs, files in os.walk(dst):
+    depth = len(Path(root).relative_to(dst).parts)
+    if depth > 4:
+        dirs[:] = []; continue
+    dirs[:] = [d for d in dirs if d != '__MACOSX']
+    for fn in ENTRY:
+        if fn in files:
+            cand = Path(root) / fn
+            rel = cand.relative_to(dst).as_posix()
+            if 'mirror/playgta5.com' in rel or (Path(root) / 'loader.js').exists():
+                print(f"entry: {rel}"); raise SystemExit(0)
+            if best is None: best = cand
+if best is not None:
+    print(f"entry: {best.relative_to(dst)}"); raise SystemExit(0)
+print("WARNING: no index.html/homepage.html found"); raise SystemExit(1)
+PYEOF
+
+# --- parallel zip extract straight to local disk (no bucket write, no 2nd copy)
+cat > "$TOOLS/unzip_par.py" <<'PYEOF'
+import os, shutil, sys, threading, time, zipfile
+from concurrent.futures import ThreadPoolExecutor
+from pathlib import Path
+src, dst, workers = sys.argv[1], Path(sys.argv[2]), int(sys.argv[3])
+CHUNK = 16 * 1024 * 1024
+dst.mkdir(parents=True, exist_ok=True)
+tl = threading.local(); lock = threading.Lock()
+done = n = errs = 0
+
+def safe(name):
+    name = name.replace('\\', '/').lstrip('/')
+    if ':' in name: return None
+    parts = [p for p in name.split('/') if p not in ('', '.')]
+    if not parts or '..' in parts: return None
+    return parts
+
+with zipfile.ZipFile(src) as z:
+    infos = [i for i in z.infolist()
+             if not (i.filename.startswith('__MACOSX/') or i.filename.endswith('.DS_Store'))]
+jobs, parents = [], set()
+for i in infos:
+    parts = safe(i.filename)
+    if parts is None: continue
+    t = dst.joinpath(*parts)
+    if i.is_dir(): parents.add(t)
+    else:
+        jobs.append((i, t)); parents.add(t.parent)
+for p in parents: p.mkdir(parents=True, exist_ok=True)
+total = sum(i.file_size for i, _ in jobs) or 1
+jobs.sort(key=lambda j: j[0].file_size, reverse=True)
+
+def work(job):
+    global done, n, errs
+    info, t = job
+    z = getattr(tl, 'z', None)
+    if z is None:
+        z = tl.z = zipfile.ZipFile(src)
+    try:
+        with z.open(info) as fi, open(t, 'wb') as fo:
+            while True:
+                b = fi.read(CHUNK)
+                if not b: break
+                fo.write(b)
+                with lock: done += len(b)
+        try:
+            ts = time.mktime(tuple(info.date_time) + (0, 0, -1)); os.utime(t, (ts, ts))
+        except Exception: pass
+        with lock: n += 1
+    except Exception as e:
+        with lock: errs += 1
+        print(f"UNZIP-ERR {info.filename}: {e}", flush=True)
+
+stop = threading.Event(); t0 = time.monotonic()
+def prog():
+    while not stop.wait(5):
+        with lock: d, c = done, n
+        el = time.monotonic() - t0
+        print(f"[unzip] {d/2**30:.2f}/{total/2**30:.2f} GiB ({100*d/total:.1f}%) files={c}/{len(jobs)} {d/2**20/max(el,1):.0f} MiB/s elapsed={el:.0f}s", flush=True)
+threading.Thread(target=prog, daemon=True).start()
+with ThreadPoolExecutor(max_workers=workers) as ex:
+    list(ex.map(work, jobs))
+stop.set()
+print(f"[unzip] done: {n}/{len(jobs)} files, {done/2**30:.2f} GiB, errs={errs} in {time.monotonic()-t0:.0f}s", flush=True)
+raise SystemExit(0 if (errs == 0 and n > 0) else 1)
+PYEOF
+
+# --- parallel tree copy; big files are split into ranges so ONE huge file uses MANY streams
+cat > "$TOOLS/copy_par.py" <<'PYEOF'
+import os, sys, threading, time, faulthandler
+faulthandler.dump_traceback_later(45, exit=False)   # prints where every thread is blocked if no bytes moved
+from concurrent.futures import ThreadPoolExecutor
+from pathlib import Path
+src, dst = Path(sys.argv[1]), Path(sys.argv[2])
+workers, RANGE = int(sys.argv[3]), int(sys.argv[4]) * 1024 * 1024
+BIG_WORKERS = int(os.environ.get("BIG_WORKERS", "8"))
+CH = max(1, int(os.environ.get("COPY_CHUNK_MB", "4"))) * 1024 * 1024
+lock = threading.Lock()
+done = nfiles = errs = 0
+files = []
+for root, dirs, fs in os.walk(src):
+    for f in fs:
+        p = Path(root) / f
+        try: st = p.stat()
+        except OSError as e:
+            print(f"COPY-ERR stat {p}: {e}", flush=True); continue
+        files.append((p, st.st_size, st.st_mtime))
+total = sum(s for _, s, _ in files) or 1
+files.sort(key=lambda x: x[1], reverse=True)
+remaining, failed = {}, set()
+active = {}
+FADV_DONTNEED = getattr(os, "POSIX_FADV_DONTNEED", None)
+
+def finish(idx, p, t, mt):
+    global nfiles
+    if idx in failed:
+        try: t.unlink()
+        except OSError: pass
+        return
+    try: os.utime(t, (mt, mt))
+    except OSError: pass
+    with lock: nfiles += 1
+
+def rng(idx, p, t, mt, off, ln):
+    global done, errs
+    err = None
+    active[threading.get_ident()] = (p.relative_to(src).as_posix(), off, ln)
+    for att in range(5):
+        fi = fo = None
+        got = 0
+        try:
+            fi = os.open(p, os.O_RDONLY); fo = os.open(t, os.O_WRONLY)
+            pos, end = off, off + ln
+            while pos < end:
+                b = os.pread(fi, min(CH, end - pos), pos)
+                if not b: raise OSError("short read")
+                w = 0
+                while w < len(b): w += os.pwrite(fo, b[w:], pos + w)
+                pos += len(b)
+                got += len(b)
+                with lock: done += len(b)
+            if FADV_DONTNEED is not None:
+                try: os.posix_fadvise(fi, off, ln, FADV_DONTNEED)
+                except OSError: pass
+                try: os.posix_fadvise(fo, off, ln, FADV_DONTNEED)
+                except OSError: pass
+            err = None; break
+        except OSError as e:
+            err = e
+            with lock: done -= got   # retry must not double-count progress
+            time.sleep(1 + att)
+        finally:
+            for fd in (fi, fo):
+                if fd is not None:
+                    try: os.close(fd)
+                    except OSError: pass
+    active.pop(threading.get_ident(), None)
+    if err is not None:
+        with lock: failed.add(idx); errs += 1
+        print(f"COPY-ERR {p.relative_to(src)} @ {off}: {err}", flush=True)
+    with lock:
+        remaining[idx] -= 1; last = remaining[idx] == 0
+    if last: finish(idx, p, t, mt)
+
+stop = threading.Event(); t0 = time.monotonic()
+def prog():
+    while not stop.wait(5):
+        with lock: d, c = done, nfiles
+        if d > 0: faulthandler.cancel_dump_traceback_later()
+        el = time.monotonic() - t0
+        if d == 0 and el >= 30 and not getattr(prog, "shown", False):
+            prog.shown = True
+            print("[copy] STALLED, reads blocked on (file, offset, len):", flush=True)
+            for a in sorted(set(active.values()))[:20]: print(f"   {a}", flush=True)
+        print(f"[copy] {d/2**30:.2f}/{total/2**30:.2f} GiB ({100*d/total:.1f}%) files={c}/{len(files)} {d/2**20/max(el,1):.0f} MiB/s elapsed={el:.0f}s", flush=True)
+threading.Thread(target=prog, daemon=True).start()
+
+# Two pools: small files can never be starved by slow big-file reads.
+bigq, smallq, smallf = [], [], []
+with ThreadPoolExecutor(max_workers=workers) as exs, ThreadPoolExecutor(max_workers=BIG_WORKERS) as exb:
+    for idx, (p, sz, mt) in enumerate(files):
+        t = dst / p.relative_to(src)
+        t.parent.mkdir(parents=True, exist_ok=True)
+        try:
+            ts = t.stat()
+            if ts.st_size == sz and int(ts.st_mtime) == int(mt):
+                with lock: done += sz; nfiles += 1
+                continue
+        except OSError: pass
+        with open(t, 'wb') as f:
+            if sz: f.truncate(sz)
+        if sz == 0:
+            finish(idx, p, t, mt); continue
+        nr = (sz + RANGE - 1) // RANGE
+        remaining[idx] = nr
+        for r in range(nr):
+            off = r * RANGE
+            if sz >= RANGE:
+                bigq.append((idx, p, t, mt, off, min(RANGE, sz - off)))
+            else:
+                smallq.append((idx, p, t, mt, off, min(RANGE, sz - off)))
+    # Phase 1: every small file first, SMALLEST first (this order is what worked on this mount)
+    for a in reversed(smallq): smallf.append(exs.submit(rng, *a))
+    for f in smallf: f.result()
+    print(f"[copy] phase 1 (small files) done in {time.monotonic()-t0:.0f}s; starting {len(bigq)} big-file ranges", flush=True)
+    # Phase 2: big files first to reduce tail latency, ranges ascending
+    bigq.sort(key=lambda a: (-files[a[0]][1], a[0], a[4]))
+    for a in bigq: exb.submit(rng, *a)
+stop.set()
+print(f"[copy] done: {nfiles}/{len(files)} files, {done/2**30:.2f} GiB, errs={errs} in {time.monotonic()-t0:.0f}s", flush=True)
+raise SystemExit(0 if (errs == 0 and nfiles > 0) else 1)
+PYEOF
+
+# --- size-balanced shard lists (null separated) for parallel tar
+cat > "$TOOLS/make_shards.py" <<'PYEOF'
+import heapq, os, sys
+from pathlib import Path
+root, out, n = Path(sys.argv[1]), Path(sys.argv[2]), int(sys.argv[3])
+out.mkdir(parents=True, exist_ok=True)
+files = []
+for r, d, fs in os.walk(root):
+    for f in fs:
+        p = Path(r) / f
+        if f == '.local-complete': continue
+        try: files.append((p.relative_to(root).as_posix(), p.stat().st_size))
+        except OSError: pass
+files.sort(key=lambda x: x[1], reverse=True)
+heap = [(0, i) for i in range(n)]; heapq.heapify(heap)
+lists = [[] for _ in range(n)]
+for name, sz in files:
+    load, i = heapq.heappop(heap)
+    lists[i].append(name); heapq.heappush(heap, (load + sz, i))
+for i, l in enumerate(lists):
+    with open(out / f"shard_{i}.lst", 'wb') as f:
+        f.write(b'\0'.join(x.encode() for x in l))
+PYEOF
+
+# --- GoFile klasor/dosya linkinden indirme (en buyuk dosya). PC'de kanitli sema:
+# Bearer + guest token + X-Website-Token header (sha256(UA::lang::token::t//14400::salt)),
+# listeleyen token ile indirme (Cookie: accountToken). stdlib only.
+cat > "$TOOLS/download_gofile.py" <<'PYEOF'
+import hashlib, json, os, re, subprocess, sys, time, urllib.request, urllib.error
+from pathlib import Path
+from urllib.parse import quote, urlparse
+
+UA = "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36"
+WT_LANG = "en-US"
+WT_SALT = "12af056dacea0b"
+
+url, out = sys.argv[1], Path(sys.argv[2])
+tmp = out.parent / (out.name + ".part")
+token_env = (os.environ.get("GOFILE_TOKEN") or "").strip()
+password_plain = (os.environ.get("GOFILE_PASSWORD") or "").strip()
+
+def req_json(u, token=None, method="GET", payload=None, headers=None):
+    data = json.dumps(payload).encode() if payload is not None else None
+    h = {"User-Agent": UA, "Accept": "application/json",
+         "Origin": "https://gofile.io", "Referer": "https://gofile.io/"}
+    if token:
+        h["Authorization"] = f"Bearer {token}"
+    if headers:
+        h.update(headers)
+    if payload is not None:
+        h["Content-Type"] = "application/json"
+    r = urllib.request.Request(u, data=data, headers=h, method=method)
+    try:
+        with urllib.request.urlopen(r, timeout=60) as resp:
+            return json.loads(resp.read().decode("utf-8", "replace"))
+    except urllib.error.HTTPError as e:
+        try:
+            body = e.read().decode("utf-8", "replace")[:500]
+        except Exception:
+            body = ""
+        raise SystemExit(f"GoFile API HTTP {e.code} for {u.split('?')[0]}: {body}")
+
+def create_guest_token():
+    print("[gofile] no GOFILE_TOKEN, creating guest token ...", flush=True)
+    try:
+        d = req_json("https://api.gofile.io/accounts", method="POST", payload={})
+    except SystemExit as e:
+        raise SystemExit(f"{e}\n[gofile] guest token uretilemedi. Rate-limit ya da IP engeli olabilir.")
+    tok = (d.get("data") or {}).get("token") or ""
+    if d.get("status") != "ok" or not tok:
+        raise SystemExit(f"guest token failed: {d.get('status')} {str(d)[:300]}")
+    print("[gofile] guest token ok", flush=True)
+    return tok
+
+def website_token(token):
+    raw = f"{UA}::{WT_LANG}::{token}::{int(time.time() / 14400)}::{WT_SALT}"
+    return hashlib.sha256(raw.encode()).hexdigest()
+
+def resolve_id(u):
+    p = urlparse(u)
+    m = re.search(r"/d/([A-Za-z0-9_-]+)", p.path or "")
+    if m:
+        return m.group(1)
+    raise SystemExit(f"Invalid GoFile URL: {u}")
+
+def collect_files(node, acc):
+    if not isinstance(node, dict):
+        return
+    if node.get("type") == "file" and node.get("link"):
+        acc.append(node)
+    kids = node.get("children")
+    if isinstance(kids, dict):
+        for ch in kids.values():
+            collect_files(ch, acc)
+
+def download_stream(link, dest_tmp, token, referer):
+    h = {"User-Agent": UA, "Referer": referer, "Origin": "https://gofile.io"}
+    if token:
+        h["Authorization"] = f"Bearer {token}"
+        h["Cookie"] = f"accountToken={token}"
+    r = urllib.request.Request(link, headers=h)
+    dest_tmp.parent.mkdir(parents=True, exist_ok=True)
+    total = 0
+    try:
+        with urllib.request.urlopen(r, timeout=120) as resp, open(dest_tmp, "wb") as f:
+            while True:
+                b = resp.read(8 * 1024 * 1024)
+                if not b:
+                    break
+                f.write(b)
+                total += len(b)
+                if total and (total // (512 * 1024 * 1024)) != ((total - len(b)) // (512 * 1024 * 1024)):
+                    print(f"[gofile] ... {total/2**30:.2f} GiB", flush=True)
+    except urllib.error.HTTPError as e:
+        raise SystemExit(f"GoFile download HTTP {e.code}: link suresi dolmus ya da token/IP engeli olabilir.")
+    print(f"[gofile] stream done: {total/2**30:.2f} GiB", flush=True)
+
+def main():
+    fid = resolve_id(url)
+    token = token_env or create_guest_token()
+    xwt = website_token(token)
+    api = (f"https://api.gofile.io/contents/{quote(fid)}"
+           f"?contentFilter=&page=1&pageSize=1000&sortField=name&sortDirection=1")
+    if password_plain:
+        api += f"&password={hashlib.sha256(password_plain.encode()).hexdigest()}"
+    data = req_json(api, token=token,
+                    headers={"X-Website-Token": xwt, "X-BL": WT_LANG})
+    st = data.get("status")
+    if st != "ok":
+        if st in ("error-token", "error-wrongToken"):
+            raise SystemExit(
+                f"[gofile] {st}: token reddedildi. GOFILE_TOKEN kontrol et, restart edip tekrar dene.")
+        if st == "error-notPremium":
+            raise SystemExit(
+                "[gofile] error-notPremium: bu IP GoFile listeleme icin engelli "
+                "(HF Spaces/VPS datacenter IP). Cozum: ARCHIVE_URL secretina duz link koy, "
+                "ya da GOFILE_DIRECT_URL'e store linki koy, ya da /data'ya klasor yukle.")
+        if st == "error-notFound":
+            raise SystemExit(f"[gofile] {st}: link silinmis/suresi dolmus olabilir: {url}")
+        if st in ("error-owner", "error-notOwner"):
+            raise SystemExit(f"[gofile] {st}: icerik baska hesaba ait, o hesabin tokeni gerekli.")
+        raise SystemExit(f"GoFile API failed: {st} {str(data)[:500]}")
+    root = data.get("data") or {}
+    files = []
+    if root.get("type") == "file" and root.get("link"):
+        files = [root]
+    else:
+        collect_files(root, files)
+    files = [x for x in files if x.get("link")]
+    if not files:
+        raise SystemExit("No downloadable file found in GoFile folder (bos ya da sifreli olabilir).")
+    files.sort(key=lambda x: int(x.get("size") or 0), reverse=True)
+    print(f"[gofile] {len(files)} dosya, en buyuk indiriliyor:", flush=True)
+    for x in files[:5]:
+        print(f"  - {x.get('name')} size={int(x.get('size') or 0)}", flush=True)
+    download_stream(files[0]["link"], tmp, token, referer=url)
+    tmp.replace(out)
+    print(f"[gofile] downloaded -> {out}", flush=True)
+    _v = subprocess.run([sys.executable, str(Path(__file__).with_name("validate_archive.py")), str(out)])
+    if _v.returncode != 0:
+        out.unlink(missing_ok=True)
+        raise SystemExit("[gofile] indirilen dosya gecerli arsiv degil, yukaridaki teshise bak.")
+
+main()
+PYEOF
+
+# --- duz direkt indirme (ARCHIVE_URL / GOFILE_DIRECT_URL icin). gofile linklerinde
+# token yoksa guest uretip Cookie ile gonderir (baglisiz direkt erisim cogunlukla
+# HTML doner; validate yakalar). stdlib only.
+cat > "$TOOLS/download_url.py" <<'PYEOF'
+import json, os, subprocess, sys, urllib.request
+UA = "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36"
+url, out = sys.argv[1], sys.argv[2]
+tmp = out + ".part"
+token = (os.environ.get("GOFILE_TOKEN") or "").strip()
+
+def guest_token():
+    h = {"User-Agent": UA, "Accept": "application/json",
+         "Origin": "https://gofile.io", "Referer": "https://gofile.io/",
+         "Content-Type": "application/json"}
+    r = urllib.request.Request("https://api.gofile.io/accounts", data=b"{}",
+                               headers=h, method="POST")
+    try:
+        with urllib.request.urlopen(r, timeout=60) as resp:
+            d = json.loads(resp.read().decode("utf-8", "replace"))
+        t = (d.get("data") or {}).get("token") or ""
+        return t if d.get("status") == "ok" and t else ""
+    except Exception as e:
+        print(f"[direct] guest token alinamadi: {e}", flush=True)
+        return ""
+
+h = {"User-Agent": UA}
+if "gofile.io" in url:
+    if not token:
+        token = guest_token()
+    if token:
+        h["Authorization"] = f"Bearer {token}"
+        h["Cookie"] = f"accountToken={token}"
+    h["Referer"] = os.environ.get("GOFILE_URL", "https://gofile.io/")
+r = urllib.request.Request(url, headers=h)
+d = os.path.dirname(out)
+if d:
+    os.makedirs(d, exist_ok=True)
+total = 0
+with urllib.request.urlopen(r, timeout=120) as resp, open(tmp, "wb") as f:
+    while True:
+        b = resp.read(8 * 1024 * 1024)
+        if not b:
+            break
+        f.write(b)
+        total += len(b)
+        if total and (total // (512 * 1024 * 1024)) != ((total - len(b)) // (512 * 1024 * 1024)):
+            print(f"[direct] ... {total/2**30:.2f} GiB", flush=True)
+os.replace(tmp, out)
+print(f"[direct] downloaded {total/2**30:.2f} GiB -> {out}", flush=True)
+_v = subprocess.run([sys.executable, os.path.join(os.path.dirname(os.path.abspath(__file__)), "validate_archive.py"), out])
+if _v.returncode != 0:
+    try: os.remove(out)
+    except OSError: pass
+    raise SystemExit("[direct] indirilen dosya gecerli arsiv degil, yukaridaki teshise bak.")
+PYEOF
+
+# --- arsiv acma (rar icin unar, zip/tar stdlib). stdlib + unar.
+cat > "$TOOLS/extract_archive.py" <<'PYEOF'
+import shutil, subprocess, sys, tarfile, zipfile
+from pathlib import Path
+
+src, dst = Path(sys.argv[1]), Path(sys.argv[2])
+name = src.name.lower()
+dst.mkdir(parents=True, exist_ok=True)
+
+if name.endswith(".zip"):
+    with zipfile.ZipFile(src) as z:
+        z.extractall(dst)
+    raise SystemExit(0)
+
+if name.endswith((".tar", ".tar.gz", ".tgz", ".tar.xz", ".txz", ".tar.bz2", ".tbz2")):
+    with tarfile.open(src, "r:*") as t:
+        t.extractall(dst)
+    raise SystemExit(0)
+
+if name.endswith(".rar"):
+    if shutil.which("unrar") is not None:
+        print("[extract] unrar ile aciliyor (RAR5 uyumlu) ...", flush=True)
+        r = subprocess.run(
+            ["unrar", "x", "-o+", "-y", str(src), str(dst) + "/"],
+            check=False,
+        )
+        raise SystemExit(r.returncode)
+    print("[extract] UYARI: unrar yok, unar deneniyor (RAR5 acamayabilir) ...", flush=True)
+    if shutil.which("unar") is None:
+        try:
+            subprocess.run(["apt-get", "update", "-qq"], check=False, timeout=120)
+            subprocess.run(["apt-get", "install", "-y", "-qq", "unar"], check=False, timeout=300)
+        except Exception:
+            pass
+    if shutil.which("unar") is None:
+        raise SystemExit("unrar/unar yok (.rar icin unrar gerekli). Dockerfile unrar kurulumuna bak.")
+    r = subprocess.run(
+        ["unar", "-quiet", "-force-overwrite", "-output-directory", str(dst), str(src)],
+        check=False,
+    )
+    raise SystemExit(r.returncode)
+
+raise SystemExit(f"Unsupported archive type: {src.name}")
+PYEOF
+
+# --- indirilen arsiv saglam mi? (boyut + imza). Bozuk 3.5K HTML sayfalarini
+# eler; teshisi loga basar. Cikis 0=saglam, 1=bozuk.
+cat > "$TOOLS/validate_archive.py" <<'PYEOF'
+import sys
+from pathlib import Path
+
+MIN_BYTES = 1 * 1024 * 1024
+MAGIC = {
+    ".rar": (b"Rar!\x1a\x07", "RAR imzasi yok"),
+    ".zip": (b"PK", "ZIP imzasi yok (PK)"),
+    ".gz": (b"\x1f\x8b", "GZIP imzasi yok"),
+    ".tgz": (b"\x1f\x8b", "GZIP imzasi yok"),
+}
+
+p = Path(sys.argv[1])
+try:
+    size = p.stat().st_size
+except OSError as e:
+    print(f"[validate] yok/okunamiyor: {p}: {e}", flush=True)
+    raise SystemExit(1)
+print(f"[validate] {p.name}: {size} bytes", flush=True)
+if size < MIN_BYTES:
+    try:
+        preview = p.read_bytes()[:300].decode("utf-8", "replace")
+    except OSError:
+        preview = "?"
+    print(f"[validate] BOZUK: {size} bytes < {MIN_BYTES} (minik dosya = hata sayfasi?).", flush=True)
+    print(f"[validate] ilk 300 karakter: {preview}", flush=True)
+    raise SystemExit(1)
+name = p.name.lower()
+need = None
+for ext, spec in MAGIC.items():
+    if name.endswith(ext):
+        need = spec
+        break
+if need is not None:
+    with open(p, "rb") as f:
+        head = f.read(8)
+    if not head.startswith(need[0]):
+        print(f"[validate] BOZUK: {need[1]}. ilk baytlar: {head!r}", flush=True)
+        raise SystemExit(1)
+print("[validate] saglam.", flush=True)
+PYEOF
+
+# --- TMP'deki acilmis agaci tek katman mirror/ duzenine tasir.
+# mirror.rar icindeki mirror/ veya .mirror/ sarmalini seffaf gecer, boylece
+# mirror/mirror/ nesting olmaz. Giris: mirror/playgta5.com/index.html (tercih)
+# ya da mirror/index.html (duz arsiv). Cikis 0=tamam, 1=giris yok.
+cat > "$TOOLS/layout_mirror.py" <<'PYEOF'
+import shutil, sys
+from pathlib import Path
+
+tmp, dst = Path(sys.argv[1]), Path(sys.argv[2])
+WRAP = ("mirror", ".mirror")
+SKIP = ("__MACOSX",)
+
+node = tmp
+for _ in range(3):
+    try:
+        kids = [k for k in node.iterdir() if k.name not in SKIP]
+    except OSError as e:
+        print(f"[layout] okunamiyor: {node}: {e}", flush=True)
+        raise SystemExit(1)
+    if len(kids) == 1 and kids[0].is_dir() and kids[0].name in WRAP:
+        print(f"[layout] sarmal kaldirildi: {kids[0].name}/", flush=True)
+        node = kids[0]
+    else:
+        break
+
+dst.mkdir(parents=True, exist_ok=True)
+if any(dst.iterdir()):
+    print(f"[layout] BOZUK: hedef dolu, once temizlenmeli: {dst}", flush=True)
+    raise SystemExit(1)
+moved = 0
+for k in node.iterdir():
+    if k.name in SKIP or k.name.endswith(".DS_Store"):
+        continue
+    shutil.move(str(k), str(dst / k.name))
+    moved += 1
+shutil.rmtree(tmp, ignore_errors=True)
+print(f"[layout] {moved} oge -> {dst}", flush=True)
+
+for cand in (dst / "playgta5.com" / "index.html", dst / "playgta5.com" / "homepage.html",
+             dst / "index.html", dst / "homepage.html"):
+    if cand.exists():
+        print(f"entry: {cand.relative_to(dst)}", flush=True)
+        raise SystemExit(0)
+top = sorted(k.name for k in dst.iterdir())[:15]
+print(f"[layout] BOZUK: giris (index.html) yok. ust duzey: {top}", flush=True)
+raise SystemExit(1)
+PYEOF
+
+# ---------------------------------------------------------------------------
+# 3) Data load: pick the fastest available source
+# ---------------------------------------------------------------------------
+mark_done() { date -u +%Y-%m-%dT%H:%M:%SZ > "$DONE_MARK"; }
+
+# background: pack local tree into N tar shards in the bucket so next cold starts are fast
+build_shards_bg() {
+  [ "$BUILD_SHARDS" = "1" ] || { echo "[shards] skipped (BUILD_SHARDS=0)"; return 0; }
+  (
+    set +e
+    nice -n 10 true
+    echo "[shards] building $SHARDS tar shards in bucket (background) ..."
+    L="/runtime/.shard-lists"; rm -rf "$L"
+    python3 "$TOOLS/make_shards.py" "$DST" "$L" "$SHARDS" || exit 0
+    rm -f "$BUCKET_DIR"/harbor-heist.shard*.tar "$BUCKET_DIR"/harbor-heist.shard*.tar.part "$BUCKET_DIR/.harbor-shards-ready"
+    seq 0 $((SHARDS-1)) | xargs -P "$SHARDS" -I{} sh -c \
+      "nice -n 10 tar -cf '$BUCKET_DIR/harbor-heist.shard{}.tar.part' -C '$DST' --null -T '$L/shard_{}.lst' \
+        && mv '$BUCKET_DIR/harbor-heist.shard{}.tar.part' '$BUCKET_DIR/harbor-heist.shard{}.tar'"
+    if [ "$(ls "$BUCKET_DIR"/harbor-heist.shard*.tar 2>/dev/null | wc -l)" -eq "$SHARDS" ]; then
+      echo "$SHARDS" > "$BUCKET_DIR/.harbor-shards-ready"
+      echo "[shards] ready ($SHARDS shards)."
+    else
+      echo "[shards] incomplete, will retry next boot." >&2
+    fi
+  ) &
+}
+
+# Eski bucket kalabaligini SADECE yeni arsiv dogrulandiktan sonra temizle.
+# (Indirme basarisizken silmek veri kaybina yol acar.)
+clean_legacy_bucket_after_success() {
+  echo "[bucket] yeni arsiv saglam, legacy kalabaligi temizliyorum ..."
+  rm -rf \
+    "$BUCKET_DIR/harbor-heist" \
+    "$BUCKET_DIR/mirror" \
+    "$BUCKET_DIR"/harbor-heist.shard*.tar \
+    "$BUCKET_DIR"/harbor-heist.shard*.tar.part \
+    "$BUCKET_DIR"/newgame.* \
+    "$BUCKET_DIR"/harbor-heist.zip \
+    "$BUCKET_DIR"/harbor-heist.tar* \
+    "$BUCKET_DIR"/harbor-heist.rar \
+    "$BUCKET_DIR/.harbor-ready" \
+    "$BUCKET_DIR/.mirror-ready" \
+    "$BUCKET_DIR/.harbor-shards-ready" \
+    "$BUCKET_DIR/.ingest-ready" || true
+}
+
+ensure_bucket_archive() {
+  mkdir -p "$BUCKET_DIR"
+  local marker=""
+  if [ -f "$VERSION_FILE" ]; then
+    marker="$(cat "$VERSION_FILE" 2>/dev/null || true)"
+  fi
+  if [ "$marker" = "$DATA_VERSION" ] && [ -s "$ARCHIVE_BUCKET_PATH" ]; then
+    return 0
+  fi
+  # 0) Duz direkt link: GoFile API'ye hic dokunmaz (datacenter dostu)
+  if [ -n "$ARCHIVE_URL" ]; then
+    echo "[bucket] ARCHIVE_URL'den cekiliyor ..."
+    if python3 "$TOOLS/download_url.py" "$ARCHIVE_URL" "$ARCHIVE_BUCKET_PATH"; then
+      echo "$DATA_VERSION" > "$VERSION_FILE"
+      date -u +%Y-%m-%dT%H:%M:%SZ > "$BUCKET_DIR/.ingest-ready"
+      clean_legacy_bucket_after_success
+      return 0
+    else
+      echo "[bucket] ARCHIVE_URL indirmesi basarisiz, siradaki kaynaga geciliyor." >&2
+      rm -f "$ARCHIVE_BUCKET_PATH.part"
+    fi
+  fi
+  # 1) GoFile direkt store linki: /contents listesi atlanir
+  if [ -n "$GOFILE_DIRECT_URL" ]; then
+    echo "[bucket] GOFILE_DIRECT_URL'den cekiliyor (liste atlandi) ..."
+    if python3 "$TOOLS/download_url.py" "$GOFILE_DIRECT_URL" "$ARCHIVE_BUCKET_PATH"; then
+      echo "$DATA_VERSION" > "$VERSION_FILE"
+      date -u +%Y-%m-%dT%H:%M:%SZ > "$BUCKET_DIR/.ingest-ready"
+      clean_legacy_bucket_after_success
+      return 0
+    else
+      echo "[bucket] GOFILE_DIRECT_URL basarisiz." >&2
+      rm -f "$ARCHIVE_BUCKET_PATH.part"
+    fi
+  fi
+  # 2) Klasik GoFile klasor linki (ev IP'sinde calisir, datacenterda error-notPremium verebilir)
+  echo "[bucket] fetching release from $GOFILE_URL ..."
+  if GOFILE_TOKEN="$GOFILE_TOKEN" GOFILE_PASSWORD="$GOFILE_PASSWORD" \
+      python3 "$TOOLS/download_gofile.py" "$GOFILE_URL" "$ARCHIVE_BUCKET_PATH"; then
+    echo "$DATA_VERSION" > "$VERSION_FILE"
+    date -u +%Y-%m-%dT%H:%M:%SZ > "$BUCKET_DIR/.ingest-ready"
+    clean_legacy_bucket_after_success
+    return 0
+  else
+    echo "[bucket] GoFile indirmesi basarisiz (yukaridaki [gofile] satirina bak)." >&2
+    rm -f "$ARCHIVE_BUCKET_PATH.part"
+    return 1
+  fi
+}
+
+SHARDS_READY=0
+# Panelden kaydedilen linkler (yazan: /panel, okuyan: ensure_bucket_archive)
+if [ -f "$BUCKET_DIR/.panel-env" ]; then
+  echo "[panel] kayitli linkler yukleniyor ..."
+  if [ -z "$_RAW_DIRECT" ]; then
+    eval "$(grep -E '^GOFILE_DIRECT_URL=https?://' "$BUCKET_DIR/.panel-env" 2>/dev/null || true)"
+  fi
+  if [ -z "$_RAW_ARCHIVE" ]; then
+    eval "$(grep -E '^ARCHIVE_URL=https?://' "$BUCKET_DIR/.panel-env" 2>/dev/null || true)"
+  fi
+fi
+export GOFILE_URL GOFILE_DIRECT_URL ARCHIVE_URL
+if [ -f "$BUCKET_DIR/.harbor-shards-ready" ]; then
+  SHARDS_READY="$(cat "$BUCKET_DIR/.harbor-shards-ready" 2>/dev/null || echo 0)"
+fi
+LOADED=0
+SOURCE=none
+t0=$SECONDS
+
+if ! ensure_bucket_archive; then
+  echo "[bucket] WARNING: archive not ready in bucket, fallback sources will be used." >&2
+fi
+
+if [ -f "$DONE_MARK" ] || [ -f "$MIRROR_DONE" ]; then
+  echo "[data] local copy already complete, skipping load."
+  LOADED=1; SOURCE=local-cache
+
+elif [ "$SHARDS_READY" -gt 0 ] 2>/dev/null; then
+  echo "[data] source: tar shards ($SHARDS_READY parallel streams) ..."
+  mkdir -p "$DST"
+  ( while sleep 5; do echo "[tar] local size: $(du -sm "$DST" 2>/dev/null | cut -f1) MiB elapsed=$((SECONDS-t0))s"; done ) &
+  PROG_PID=$!
+  if ls "$BUCKET_DIR"/harbor-heist.shard*.tar | xargs -P "$SHARDS_READY" -I{} tar -xf {} -C "$DST" --no-same-owner; then
+    LOADED=1; SOURCE=tar-shards
+  else
+    echo "[data] shard extract failed, falling back." >&2
+  fi
+  kill "$PROG_PID" 2>/dev/null || true
+
+fi
+
+if [ "$LOADED" -eq 0 ] && [ -s "$ARCHIVE_BUCKET_PATH" ]; then
+  echo "[data] source: bucket archive ($ARCHIVE_NAME) -> validate + extract to mirror/ ..."
+  if ! python3 "$TOOLS/validate_archive.py" "$ARCHIVE_BUCKET_PATH"; then
+    echo "[data] bucket arsivi bozuk, silinip sonraki boot'ta yeniden indirilecek." >&2
+    rm -f "$ARCHIVE_BUCKET_PATH" "$VERSION_FILE"
+  else
+    rm -rf "$MIRROR_DST"; mkdir -p "$MIRROR_DST"
+    TMPX="$LOCAL_DATA_DIR/.mirror-tmp"; rm -rf "$TMPX"; mkdir -p "$TMPX"
+    LOCAL_ARCHIVE="$LOCAL_DATA_DIR/$ARCHIVE_NAME"
+    echo "[data] bucket->local kopyalaniyor: $(du -h "$ARCHIVE_BUCKET_PATH" 2>/dev/null | cut -f1) ..."
+    cp -f "$ARCHIVE_BUCKET_PATH" "$LOCAL_ARCHIVE"
+    if python3 "$TOOLS/extract_archive.py" "$LOCAL_ARCHIVE" "$TMPX"; then
+      rm -f "$LOCAL_ARCHIVE"
+      if python3 "$TOOLS/layout_mirror.py" "$TMPX" "$MIRROR_DST"; then
+        LOADED=1; SOURCE=mirror-archive
+        date -u +%Y-%m-%dT%H:%M:%SZ > "$MIRROR_DONE"
+      else
+        echo "Mirror duzeni kurulamadi. Arsiv ic yapisini kontrol et." >&2
+        rm -rf "$TMPX" "$MIRROR_DST"
+      fi
+    else
+      rm -f "$LOCAL_ARCHIVE"; rm -rf "$TMPX"
+      echo "Archive extract FAILED." >&2
+    fi
+  fi
+fi
+
+if [ "$LOADED" -eq 0 ] && [ -f "$BUCKET_DIR/mirror/newgame.zip" ]; then
+  echo "[data] source: newgame.zip -> parallel extract straight to local disk ($IO_WORKERS threads) ..."
+  rm -rf "$DST"; mkdir -p "$DST"
+  if python3 "$TOOLS/unzip_par.py" "$BUCKET_DIR/mirror/newgame.zip" "$DST" "$IO_WORKERS"; then
+    if python3 "$TOOLS/find_entry.py" "$DST"; then
+      LOADED=1; SOURCE=zip
+      build_shards_bg
+    else
+      echo "Giris dosyasi bulunamadi. Zip ic yapisini kontrol et." >&2
+    fi
+  else
+    echo "Zip extract FAILED. Yukaridaki UNZIP-ERR satirlarina bak." >&2
+  fi
+fi
+
+if [ "$LOADED" -eq 0 ] && [ -d "$BUCKET_DIR/harbor-heist" ] && [ -f "$BUCKET_DIR/.harbor-ready" ]; then
+  echo "[data] source: legacy bucket folder -> range-parallel copy ($IO_WORKERS threads, ${RANGE_MB}MB ranges) ..."
+  mkdir -p "$DST"
+  if python3 "$TOOLS/copy_par.py" "$BUCKET_DIR/harbor-heist" "$DST" "$IO_WORKERS" "$RANGE_MB"; then
+    LOADED=1; SOURCE=legacy-folder
+    build_shards_bg
+  else
+    echo "Bucket -> disk copy FAILED. COPY-ERR satirlarina bak." >&2
+  fi
+fi
+
+if [ "$LOADED" -eq 0 ] && [ -d "$BUCKET_DIR/mirror" ] && [ -f "$BUCKET_DIR/.mirror-ready" ]; then
+  echo "[data] source: legacy mirror/ -> range-parallel copy ..."
+  mkdir -p "$LOCAL_DATA_DIR/mirror"
+  if python3 "$TOOLS/copy_par.py" "$BUCKET_DIR/mirror" "$LOCAL_DATA_DIR/mirror" "$IO_WORKERS" "$RANGE_MB"; then
+    SOURCE=legacy-mirror
+  else
+    echo "WARNING: mirror copy failed, continuing without it." >&2
+  fi
+fi
+
+if [ "$LOADED" -eq 1 ] && [ "$SOURCE" != "local-cache" ]; then
+  mark_done
+fi
+if [ "$LOADED" -eq 0 ] && [ "$SOURCE" = "none" ]; then
+  echo "No usable game data in $BUCKET_DIR. Starting in SETUP mode." >&2
+fi
+echo "[data] source=$SOURCE loaded=$LOADED in $((SECONDS-t0))s"
+
+# ---------------------------------------------------------------------------
+# 4) Wait for clone, then serve
+# ---------------------------------------------------------------------------
+if ! wait "$CLONE_PID"; then
+  echo "git clone failed. Check GH_REPO_TOKEN / GH_REPO_SLUG / GH_REPO_REF." >&2
+  exit 1
+fi
+
+cd "$APP_DIR"
+if [ ! -f space_server.py ]; then
+  echo "space_server.py not found in repo root. Check GH_REPO_SLUG/REF." >&2
+  exit 1
+fi
+
+echo "[boot] total bootstrap time: $((SECONDS-T_START))s -> starting server on :$PORT"
+exec python3 space_server.py --port "$PORT" --app-dir "$APP_DIR" --local-data "$LOCAL_DATA_DIR" \
+  --bucket-dir "$BUCKET_DIR" --boot-log "$LOG_FILE" --tools-dir "$TOOLS" --data-version "$DATA_VERSION"