Phase-0: v2 adapter contract + grant-stream core + Jellyfin & Invidious adapters

.gitignore

@@ -56,3 +56,6 @@ stream-proxy/target/
 .claude/
 sv-agentation
 CLAUDE.md
+
+# Runtime data (live DB, backups) — never commit
+data/

.npmrc

@@ -1 +1 @@
-enable-pre-post-scripts=true
+verify-deps-before-run=false

Dockerfile

@@ -8,7 +8,7 @@
 # tracking doesn't always detect source changes when a cached dummy build is
 # replaced with real source, producing a binary from the dummy. Accepting a
 # longer first-build time in exchange for a correct build every time.
-FROM rust:1.85-alpine AS rust-build
+FROM rust:1.88-alpine AS rust-build
 RUN apk add --no-cache musl-dev pkgconfig openssl-dev openssl-libs-static
 WORKDIR /stream-proxy
 COPY stream-proxy/Cargo.toml stream-proxy/Cargo.lock ./
@@ -18,7 +18,7 @@ RUN cargo build --release
 
 FROM node:22-alpine AS deps
 WORKDIR /app
-RUN corepack enable && corepack prepare pnpm@latest --activate
+RUN corepack enable && corepack prepare pnpm@11.1.2 --activate
 # python3 + build tools: better-sqlite3 tries prebuild-install first but falls
 # back to node-gyp compilation when the prebuilt binary for this exact Node
 # version isn't available. Without these, the fallback fails with "gyp ERR!
@@ -33,14 +33,14 @@ RUN pnpm install --frozen-lockfile
 
 FROM node:22-alpine AS build
 WORKDIR /app
-RUN corepack enable && corepack prepare pnpm@latest --activate
+RUN corepack enable && corepack prepare pnpm@11.1.2 --activate
 COPY --from=deps /app/node_modules ./node_modules
 COPY . .
 RUN pnpm build
 
 FROM node:22-alpine AS runtime
 WORKDIR /app
-RUN corepack enable && corepack prepare pnpm@latest --activate
+RUN corepack enable && corepack prepare pnpm@11.1.2 --activate
 # Same reason as deps stage — better-sqlite3 may fall back to node-gyp.
 RUN apk add --no-cache python3 make g++
 

README.md

@@ -43,16 +43,11 @@ Self-hosters running multiple media services who want:
 
 | Service | Status | What it provides |
 |---------|--------|-----------------|
-| **Jellyfin** | ✅ stable | Media server — movies, shows, music, live TV |
-| **Plex** | ✅ beta | Media server — movies, shows, music (playback path stabilized in v0.1.0-beta.2) |
-| **Invidious** | ✅ stable | Privacy-respecting YouTube alternative (transcode pipe via Rust stream-proxy) |
-| **Calibre-Web** | ✅ beta | Book library — OPDS browse, search, formats, in-browser reader. UI polish ongoing |
-| **RomM** | ✅ stable | Retro game ROM management with in-browser emulation |
-| **Overseerr / Seerr** | ✅ stable | Media requests and TMDB-powered discovery |
-| **Radarr / Sonarr / Lidarr** | ✅ stable | Calendar, queue, quality profiles |
-| **Bazarr** | ✅ stable | Subtitle management, sync, translation |
-| **Prowlarr** | ✅ stable | Indexer management and stats |
-| **StreamyStats** | ✅ stable | ML-powered recommendations and analytics |
+| **Jellyfin** | ✅ working | Movies & shows — library, recently-added, and transcoded playback end-to-end via the Rust stream-proxy |
+| **Invidious** | ⚠️ playback only | Privacy-respecting YouTube — playback works end-to-end; browse/search not yet wired, so it doesn't surface on the home page yet |
+| **Plex** | 🚧 unwired | Adapter is implemented but has no config path in phase-0 (no env/DB/UI to add a Plex server), so it's not reachable yet |
+
+> **Phase-0 is a clean re-implementation, not a port.** It ships exactly these three media-source adapters plus the streaming core, the home feed, and a bare playback test page. The earlier project's broader service list (Overseerr/Seerr, Radarr/Sonarr/Lidarr, Bazarr, Prowlarr, Calibre-Web, RomM, StreamyStats) is **not** part of this build. Those will be reintroduced only when actually built and verified — this table tracks reality, not intent.
 
 New adapters can be added by contributors without modifying any existing code. See [CONTRIBUTING.md](CONTRIBUTING.md) for the adapter development guide.
 

docs/ROADMAP.md

@@ -16,25 +16,29 @@ Updated as work progresses. Each item links to its GitHub issue and/or spec/plan
 
 ---
 
-## Milestone 0: Foundation (DONE)
+## Phase-0 Rebuild — Actual Status
+
+This is a **clean re-implementation**. The current build ships only what this table
+lists. Everything below "Milestone 1" describes the **pre-rebuild project** and is kept
+only as historical / feature reference — it does **not** reflect what runs today.
+
+| Status | Item |
+|--------|------|
+| ✅ done | Jellyfin adapter — library, recently-added, transcoded playback (verified end-to-end against live Jellyfin) |
+| ✅ done | Streaming core — negotiate + PASETO grants + Rust stream-proxy (real decodable bytes, SSRF-guarded, fail-closed) |
+| ✅ done | Home feed — real Jellyfin content, backend-agnostic rows, real library-type filters (no fake chrome) |
+| ✅ done | Auth — Authentik SSO passthrough (no app-owned login screens) |
+| ✅ done | Bare playback test page (`/test-play`) — the sanctioned "dumb streaming page" |
+| ⚠️ partial | Invidious adapter — playback works end-to-end; browse/search/listing NOT implemented, so it doesn't surface on the home yet |
+| 🚧 unwired | Plex adapter — fully implemented but no config path (no env/DB/UI), so it's unreachable |
+| ❌ not built | Search — `adapter.search` exists but is unwired; no `/api/search`, no search UI |
+| ❌ not built | Subtitle delivery — negotiate advertises track URLs, but `/api/subtitles/*` route is missing (they 404) |
+| ❌ not built | Media detail pages; now-playing/sessions UI |
+| ❌ not built | Request management / Radarr / Sonarr / Overseerr — **no code path exists; do not advertise as available** |
+| ❌ not built | Analytics / stats / admin dashboard |
+| ❌ not built | Calibre-Web, RomM, StreamyStats, Bazarr, Prowlarr adapters |
 
-Everything needed to run Nexus as a functional media platform.
-
-| Status | Item | Issue | Spec/Plan |
-|--------|------|-------|-----------|
-| done | Core adapters (Jellyfin, Radarr, Sonarr, Lidarr, Overseerr, Prowlarr, Bazarr) | — | — |
-| done | Per-user auth with service account linking | — | — |
-| done | Homepage with personalized recommendations | — | [spec](docs/superpowers/specs/2026-03-11-personalized-homepage-design.md) |
-| done | Media detail pages with cast, similar, seasons | — | — |
-| done | Search across all services | — | — |
-| done | Request management (Overseerr) | — | [spec](docs/superpowers/specs/2026-03-12-requests-page-fixes-design.md) |
-| done | Analytics engine + stats | — | [spec](docs/superpowers/specs/2026-03-13-tracking-system-rebuild-design.md) |
-| done | Admin dashboard (sessions, health, requests) | — | — |
-| done | Invidious adapter (privacy video) | — | — |
-| done | Calibre-Web adapter (books) | — | — |
-| done | RomM adapter (retro games + EmulatorJS) | — | — |
-| done | StreamyStats adapter (ML recommendations) | — | — |
-| done | Bazarr adapter (subtitle enrichment) | — | — |
+---
 
 ## Milestone 1: Polish & Beta (DONE)
 

package.json

@@ -39,12 +39,16 @@
 		"tailwindcss": "^4.1.0",
 		"typescript": "^5.9.3",
 		"vite": "^7.3.1",
+		"vite-plugin-wasm": "^3.6.0",
 		"vitest": "^4.1.2"
 	},
 	"dependencies": {
 		"@fontsource-variable/dm-sans": "^5.2.8",
+		"@fontsource-variable/geist": "^5.2.9",
+		"@fontsource-variable/geist-mono": "^5.2.8",
 		"@fontsource-variable/jetbrains-mono": "^5.2.8",
 		"@fontsource-variable/playfair-display": "^5.2.8",
+		"better-auth": "^1.6.20",
 		"better-sqlite3": "^11.10.0",
 		"chart.js": "^4.5.1",
 		"dashjs": "^5.1.1",
@@ -53,6 +57,8 @@
 		"hls.js": "^1.6.15",
 		"lru-cache": "^11.3.5",
 		"lucide-svelte": "0.469.0",
+		"nucleo-matcher-wasm": "^0.4.0",
+		"paseto-ts": "^2.0.6",
 		"pdfjs-dist": "5.5.207",
 		"undici": "^8.1.0",
 		"ws": "^8.19.0",