Phase-0: v2 adapter contract + grant-stream core + Jellyfin & Invidious adapters - #64

Draft

returnsvoidjanet wants to merge 44 commits into

PetalNet:mainfrom

returnsvoidjanet:rebuild/phase-0

Commits on Jun 21, 2026

phase-0: v2 adapter contract + conformance gate

returnsvoidjanet
and
claude
committed
6d15305
phase-0: PASETO v4.local grant stream-proxy core (held-cred, m3u8 rewrite, golden-vector)

returnsvoidjanet
and
claude
committed
2cdcb9d
phase-0: Jellyfin v2 adapter + negotiate/stream-proxy glue + test harness

returnsvoidjanet
and
claude
committed
fb0da7a
phase-0(stream): complete copy-paste/identity binding end-to-end

returnsvoidjanet
and
claude
committed
039cb13
chore(dev): bypass pnpm verify-deps so vite dev runs the local proxy harness

returnsvoidjanet
and
claude
committed
8c6b303
phase-0(invidious): v2 adapter — Nexus-identity, grant-gated, local=true

returnsvoidjanet
and
claude
committed
a1ce335
phase-0(stream): fix gzipped-text upstreams (proxy negotiates identity)

returnsvoidjanet
and
claude
committed
6e872b1
phase-0(stream): fail CLOSED on proxy handoff + widen handoff timeout

returnsvoidjanet
and
claude
committed
1de4530
phase-0(reaping): abandoned-session reaper + force-kill transcode on stop

returnsvoidjanet
and
claude
committed
ff51287
phase-0(playback): reactive recovery on mid-stream grant expiry (decision 2)

returnsvoidjanet
and
claude
committed
9bea3d7
phase-0(invidious): adaptive DASH up to 4K through Nexus

returnsvoidjanet
and
claude
committed
5f4bdf4
phase-0(playback): smart bitrate — direct-play first + measured-bandwidth pick

returnsvoidjanet
and
claude
committed
f6f9b38
phase-0(playback): mid-stream adaptation watchdog + player buffer/fast-start tuning (#3)

returnsvoidjanet
and
claude
committed
fe0a9e4
phase-0(playback): fix probe var collision — mid-stream downshift now proven E2E

returnsvoidjanet
and
claude
committed
551d53a
phase-0(account): wire v2 playback → continue-watching (progress persist + resume)

returnsvoidjanet
and
claude
committed
79efdfd
security(proxy): close critical SSRF holes found by adversarial review

returnsvoidjanet
and
claude
committed
5d7692f
security(adversarial): non-waivable conformance + session cap + progress clamp

returnsvoidjanet
and
claude
committed
23399dc
security(proxy): seam↔proxy shared secret + remove the 'legacy' identity fallback

returnsvoidjanet
and
claude
committed
37dd9b1
security(seam): fix allowlist traversal bypass (adversarial review of the fix)

returnsvoidjanet
and
claude
committed
c87bc9e
security(proxy): remove the legacy SSRF routes outright (belt-and-suspenders)

returnsvoidjanet
and
claude
committed
c39e81c
phase-0(account): add Better Auth + config foundation (identity layer)

returnsvoidjanet
and
claude
committed
4864ecb
phase-0(account): wire Better Auth live — login/register/logout + session layer

returnsvoidjanet
and
claude
committed
1e4aa9f
fix: clear pre-existing typecheck errors from the streaming phases

returnsvoidjanet
and
claude
committed
02f4022
phase-0(plex): v2 Plex adapter — verified E2E against a live Plex server

returnsvoidjanet
and
claude
committed
0612d8b
phase-0(requests): native request system → Radarr/Sonarr (verified E2E)

returnsvoidjanet
and
claude
committed
9e17804
phase-0(cleanup): change-password via BA, decommission v1 Plex login, env→DB configs

returnsvoidjanet
and
claude
committed
3c00db3
phase-0(tests): backend test suite + extract Plex capability gate

returnsvoidjanet
and
claude
committed
5b3d7c2
phase-0(auth): OIDC scopes for Authentik login

returnsvoidjanet
and
claude
committed
bf63921
phase-0(auth): OIDC user mapping + account linking — login verified E2E

returnsvoidjanet
and
claude
committed
93da194

Commits on Jun 22, 2026

phase-0(auth): idempotent boot-time credential-account backfill

returnsvoidjanet
and
claude
committed
784bccc
phase-0(ui): paper+ink Nexus Home preview at /dev + design tokens

returnsvoidjanet
and
claude
committed
0664f43
fix(build): approve better-sqlite3/esbuild builds + pin pnpm 11.1.2

returnsvoidjanet
and
claude
committed
d7888a5
fix(build): guard module-load side effects with building flag

returnsvoidjanet
and
claude
committed
ac30278
phase-0: clean re-implementation — strip all legacy code

returnsvoidjanet
and
claude
committed
f19ca6e
fix: restore /api/health endpoint (over-deleted in the strip; healthcheck needs it)

returnsvoidjanet
and
claude
committed
34f41eb
phase-0(auth): Authentik SSO passthrough, delete app login/welcome

returnsvoidjanet
and
claude
committed
4719c2c
fix(home): image proxy by service type, smooth rail, wire avatar

returnsvoidjanet
and
claude
committed
32dd518
fix(home): gmail-style rail + don't stream non-video items

returnsvoidjanet
and
claude
committed
f578224
fix(home): pin rail icons to constant offset (no horizontal jump)

returnsvoidjanet
and
claude
committed
1fd1c9f
feat(home): external art fallback (iTunes) + thin theme-aware scrollbars

returnsvoidjanet
and
claude
committed
6d539d4
fix(art): fire iTunes fallback for artless albums (posterItemId fell to artist)

returnsvoidjanet
and
claude
committed
b7de9cf
fix(home): graceful onerror on card art (degrade to clean tile)

returnsvoidjanet
and
claude
committed
84f583c

Commits on Jun 23, 2026