From 917cd32e7769530d07c95afc45e1f29054bcd972 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Sun, 21 Dec 2025 01:00:40 +0000
Subject: [PATCH 1/4] Add Python video server with range support

Co-authored-by: mathieumoran1 <mathieumoran1@gmail.com>
---
 .gitignore                               |   6 +-
 README.md                                |  33 ++++
 __pycache__/video_server.cpython-312.pyc | Bin 0 -> 8803 bytes
 media/.gitkeep                           |   1 +
 public/js/app_player.js                  |   2 +-
 requirements.txt                         |   2 +
 video_server.py                          | 208 +++++++++++++++++++++++
 7 files changed, 250 insertions(+), 2 deletions(-)
 create mode 100644 __pycache__/video_server.cpython-312.pyc
 create mode 100644 media/.gitkeep
 create mode 100644 requirements.txt
 create mode 100644 video_server.py

diff --git a/.gitignore b/.gitignore
index 5af23d6..d6b7901 100644
--- a/.gitignore
+++ b/.gitignore
@@ -136,4 +136,8 @@ dist
 .pnp.*
 
 # ayylmao
-ayylmao.js
\ No newline at end of file
+ayylmao.js
+
+# Local media files (served by python video_server.py)
+media/*
+!media/.gitkeep
\ No newline at end of file
diff --git a/README.md b/README.md
index c3036f7..341d83a 100644
--- a/README.md
+++ b/README.md
@@ -14,3 +14,36 @@ Config those in your .env file:
 **OMDB_API=**`1234567` &nbsp;&nbsp;&nbsp;&nbsp;(for movie info)
 
 run with **node .\index.js**
+
+## Python video file server (mp4/mkv)
+This repo also includes a small Python server that serves local video files with **HTTP Range** support (required for HTML5 `<video>` seeking).
+
+- Put your files in: `./media/` (repo root)
+- Served as: `http://localhost:8001/media/<filename>`
+- List endpoint: `http://localhost:8001/api/media`
+
+### Install
+
+```bash
+python3 -m venv .venv
+source .venv/bin/activate
+pip install -r requirements.txt
+```
+
+### Run
+
+```bash
+python3 video_server.py
+```
+
+### Use in the web player
+Set the movie's `video_src` (or `vod_link`) to something like:
+
+- `http://localhost:8001/media/MyMovie.mp4`
+- `http://localhost:8001/media/MyMovie.mkv`
+
+If the Node app is on a different origin/port, the video server enables CORS by default. You can lock it down with:
+
+```bash
+export CORS_ORIGINS="http://localhost:5000"
+```
diff --git a/__pycache__/video_server.cpython-312.pyc b/__pycache__/video_server.cpython-312.pyc
new file mode 100644
index 0000000000000000000000000000000000000000..95df0ed27bb2741199b30dff498661821f698f19
GIT binary patch
literal 8803
zcmahuYj9K9dFMW)E9vSj*^&)jWX!{2{lI{EWnstI0=$6D+Ux^mcU7T#ZDjOt?!C6b
zk*J{Qtes`XqS+R8mp0laJMqra4%1&`+G&?2JIzdIIudeXaYH7aDKqW<)53O=lKkj*
zj(jEKu;hTwIrp6JeCIpod~g4U#bQEG{^97c=+B!F`Y-&U73*r}@n#mG8|XD8Ac2aZ
zV6~-!6#1ruG_-V#iL*hL!gEYa7uN^%aW2Tk4M9WP7&MY`HfD<RK|XE{n&XzBC2kE`
z$+#|Ni`#>C($~ivac9sOcLiPW%>~^w5?Qg~Q>seKM5jhvz5R5xJJD4i(|SR#=oJjJ
zJVL=H!6=x{)4^uINKfq5AnL8aYr6zD3TClIu!!s!D_Fn7244_tA`9Ow@NI|hO@agF
zouUuM45Cr=iM}x!t`Fhgm|k!JOsmjKR=EMH0e+1HS}$%ED1jPd2&75yd`A~-1B!Uj
zeal<he+!II6R*^1(|SUa(EKS~{hBzXjn-T3E`r;|?LzZ~c7!Ce&^%5B+eJ=n!F!5+
zVZ%$%CJu|+Ctj<s)Ox~3jfw%ZfFkrb{N8RuD2-C+c{|F~HTUx&uG81HvVbj(fSN56
zZ)iK#ThR{Z?hxBG3WSz%B)sr<6h6VNO`qzjkQ9Q|->k3FdV;UE&LVb=(L(EY*xG$`
zf6bcBYt}enP1~9^J7G;k!(MNNEy7k|+c<q|yY>=7J8*+vv;a3);q`Z{!Ldu+ExbtH
zVM4&tvnROcYu~m*=+rO<djZP#wUAvxw+5-vAKd%3&^v`54f=U6DD0Z1g8Kl=o{7o&
zX|<lPTkIA0iu-Qu`4qGPE)=>%U7{j1Mc#A<`S*T-hll)>%AO7@=l!f|JSHYYDXb(V
z)i9_)?_5k&4a1X4G?@s;RNa}W$(RUm+|jVC^qn45EyvHCIUTqd5ebOOjfmfx5@kg-
zjEM4NG9inA+}b}pGI}a12r+RcEQx+vHNP@CJfuOWj!{Jt!|`ZhTpOBoOh*MV**O-C
ziJh`2O^cGMi;F@uJj-^)C-*#o`oi?A>z#9#6j46Z{+6)A-%08%szDNCp-DK7s+UA%
zN=iglRS`Zb!Ys+a@9{sv=nX6)YiBV86cBj2_5c`qU4hxvRanSmi?Yh-u#yqjTRLs+
zRZ7uoOH&9dwF#s4U2ip(Pp^S~E*xz{DQW_+tuLt>T@;3}t)E9o+iM-o#<euVO8XzK
zoN)c&n1)SpYje|-wDvYk0{=ATQPhSMvj)8dNv<@r=JxagSBFnAS82hJW-c=`)C{`F
zoJBK~-#mN9<bwj7l8jA@zOZi!_@i@DN@9)?eE8vg;qh=ZAuGO9fq}uk(7@nGhi_66
zr^SQ<JXQr!q%bg*9FBDnbWf<ao>1M<_u*M*9jBtQi~%wC5$I27m6w&UG9`y1NkLTg
zf~bU}v1k^9n+Frq;aIe~_0X*KC|;FFD!#GgR6>Y;AHy`fmXN0=CzFx_BoegBrAg7x
ztDGcG#=;Rm8Iu($Iw@iPP>nUhF#tKJ$^%=6mFTn>Qj)6a^>A!T3`i2lDHoMP7^SM0
zr^d#j7gb#>IRo-y?mKyM_>I6oDDdW)Q9mm=2<Au_XcEGTsG5j8g`{LsQ5o@KM8;YI
zU+t6T?wO=?L7oJ<x``Zysv_7mc}ew#<nWjnTBRyf#epwf+78Pb;3pTM%Akq~*}coQ
zO-0+LJe!Y{Y&({1Jw;p3?Y5F_Z|3-Y-u1w`VUa29IksdyUN9Vg=xENpS#)e&ws#fn
zT_yX@%-{n@^Ri=e(XqMY*phjrLNmHkRN3HIHnbECExCy$gTG=x=7wc{W0Bvu#J{kL
zaA3(AC>R1OoPC+|6gkf_*HYwKO5CO&ri$F|RiG0~){_Op$ravRVBNp{%7x60j}QeL
zkons~OV<9Mxd7mI6$Xz!k-c!LyDg3*2hqPBH1;<#KVhu>4(2Bg9rRTe-@vo=OcvG=
zJp=9fGVu)EqRCX6N`c!!3=wsSuFJ?oO{3JYDK)K<LYijM+PA>@NYiO1MPH<3Q2hck
ziu~-5ghhPTPM){>VrM+8NJ;rZc-9-9oQy>yz-h@ucQT@gN+&QTXlK7p^1%|R6)M#j
zkH$sJ!m?@_2YoMx@Q2C(C~z7$F$lAiqUs`KoC?*LOWKAfU7_l#NHU>-RFc)wPME<S
zp?n0Y3@V$f3op*UxNO=`G;JuES~C4*&NMf6HC?u~KC}UAwH0k`KkQ#*e=u0GbzM20
z3C#7BdHX%StKjY`uw9P<3sTKeI594U&Wm9IWP+8Wvtne`9mDf=d!UC={7y2MNQF${
z>RB%YHlwERYk)P)s@;2<PSK!cISoRf1?Co8w+t!zSvp?OY3sjcUa!rkS$I=M;0T8}
zQ|xN*c{^&*yOo;lNU=41x|B{ZTxf<TejW~8in=fWFq~ij{?yGvFfvAug0)GJ{@SrM
zyD+s~^n}uVfPr5#U!x+yY8cX7N)LOz1^l2(>47qMpLLWOpSn+g|6?$UMSG1Dr|qM?
z2-%OrXYre6@0hS6JRO!~Y+<l50G*CK9p4CMCtsDFe919T@>2Yuuj+<?iI9{|F(HuE
zBgFZTeeGnp!w2JjUo;VkP066eJA6sWH<V0>zUY{SE-L%tRnyZg#wV3aRns&Qj>@7;
zcCYzacw4|#wL65v<tp${G>`3#TeC@P$(0)6^k2X<`T|RUiX`03HdJA-#gakn<*_Js
z`urTYaD79^0-=!rxL#o;a$eP~F;Tj4DLFN%GSLKB4{+W525A>ylXhdwR9xlAsY9}=
zgL6Y;sv4(IOiW-ra8aNk5`t_1czoBmRCR+HoHw}l5IL3vyoP{VklX@<XV8~sWcHSA
zu7?Kuf_2`SO)Y!;MUTJad9h^Z$n@Rk&8zzTl_l$mg5ktUL*tD%uD_9c^?Sj*<42y4
zJd2JWG|#=3Ikv)CvzxD`a}D{;A8c5+raJYo!JBLNUU1G-<{NU3@4o!NxoNS#uzzUD
zIb1Lg<3aWwzp?CY$SS$;^^4g<1+%YgcV}md_SXEK#nzAZ7i=8`L&rn2Ez7-kG7~6!
zTk_5i_-k!*;<X)%?%UKS-c0`rXU?)fhb~WjU|eULK;6A|_1jMmJ~Ub8BH2B;*6aIA
zrj4Kz&5rEuxt9v8N9uuVl8)f2A1c)pIX{)S5F#3ng#oQ#jnoFe#|Uop1XN$|1#42<
zi_&b0eWos?G#KzW=@f<afk4j!`ZU%j4AB*PVeK<CW?eU?m{iSY*6^kEDZNZ3yeZup
z>sHf#vmUa8{;%j86zr_+L|xkpK^y$jq#8mVIBXAS^%<~zXW_JXr0PrlJ@}Pi2~}D;
zC-nlwL>&A&l}%0pld`fXUQk&ueS&ldW>p4Q*Uu5-R=;H_fTyT2)hLN^a5_O#fYHMj
zFXMa0Tn(kl*rrevA}ZpmNy9K1f}fm*>VMF0!Q2@w3r+J)**))Vsvv{To9inZj0^gC
z{oK?wOWEzoZM}XX-+Fy`&RDj3a;@Ku1Lxg1dj06l-MQJt1EmeUCHLOBz<rmuY;P!=
z8*aLCuYK5DG`GzSmYtsOo~ZE1=FPRf7yk_h$bW-(_!3vYms@~>tIoc|)cbwzzFo{+
zzY+R(cj@}R!QI`*K_4PGof1{R!!+YSE;Kwccx-TJRHb&PmT(N5%}`Q`j)TMfgz7lz
zXH@1`;Ec*15A+SF-0<l$gTq7E{TzjDR7Vv)B8dWa#=|jLLjmr@`J_<$tSVS}mg|OI
z416nCT`LUq@b57WJ8nR<R=3vzeG_YNX6Ot=nRN1k%78xu2Qc)VJ{=nBI~Di@Rpo@Z
zA^IwE=}!R9W%$Y1K4j2}v+?G|BHvzM+X?WjsXIIw?IynNQ-t6rCWQPgh|&#IC*xV7
zg0o1sYGEaX#vwyfck9-yt+@<<eYFTR1FDI~0DAjf5CL!!pXEkqP9(|kP!l9$sNt%%
z6E#y<AJ<kXS{@NWI7eOUg*|Zau&&f8)@XWOhzRZwn!w?~x`LI)1PJr`qR}#e{qA)|
zU{mym=x=C2ce8dc6uLIgB4vXHD(F)vT2oHI5*%R(4r~i>o~#<gi&0q#B`-)Lumt#w
zylywJFPjL*#i|`+rX<LDfYioizg5Dx!4zH)q7uYfB$iWk(s(R+PTB-hb@y1>j6bnl
zsfMr|noP<NmFa;I!Qg>jfj|<QN1~Y}{0x3Z8pFU8*i(q|WXw`^tr5d?66&N$nD{gJ
z$@q3M=pk!)clgS1ZeVdwW_XF+SvFfUfd>}X`-3-zuMg+@OYZiP#s3JIb*4G0Y_l(1
zn!j}I+hw!6%$pbX&+lJ2Jb$>vZ}{O$MZO!4T5SvQ`S{Jjl6Bj%wYzBTE?Il#n6kmL
zV4gRxcsG>2P2bo5wf;lHvbVkHZ7(<Z@~*rt`=?)Wti}4jjNWLfSYWTOn!!frJo&8!
zZ+nUN7g&E)iae`#{B0bqk_^p395$sToYa(FhYAFh(-eWR28Cl_l2m%iamOJKzKh5I
z0$xnjj49Z+A*CJ$VK@9)(pclKwWe`(HKZhJGFVTkfC;1~u)DIZJS!2iHi4AZLApjK
znb$a<x)h@ss08HX(|X`&aNq^QO(tzj=`(M@PS{ynR|F$*_BSduX%tLRlrnxy3A}<+
z#iRi4)q99iA5*u?+D@Zuq(i~XS%szr3xp9?Y`8zgj0fe9V@<KQY+6<koPRwDGEHed
z#ivZf1+Wqqz+9zn4Q*zPHo=}UeTW1{iig^nVnCiD3xAXTm`X!n@to6J)|}p*GW_xL
zrA#Tlb~0G;H0_X%s%bk&N9{>-0)$mWyRe{N=(M4}Uy7S>R&Qu+4WsV0-_<@)rq_0j
z&}YFVNpqLE(bcw|&>~Jq!w@JE99T%$)txnvaKg8vTh)=CpMGNLuSUw9#94o0>5Jfu
zYxPS8{ed;8%B_aeDyNxGLm~;`dlGW4jC2vBHfwm!K)gO{=?_QFi=B8(O2&u?e(^H^
zdt%kVPKt?fNDR|t0|`GW@sfzYw7M-B)v`%A+@IA~>3>3XN?7B=>J(l$1JxJ*i3e;X
zStP~qXdG8K^snM!#zloV{Uj46@pu9sPQrFT)mOEH)PYCvyAemqZ;>S2mvM!Y4@7%Q
zUATvX5>-zk3PIY6NAMw3Ya|(uCljlA0lDtbK_ZSEnYaSjcdM1E6UUQO*s4DMb3k<i
ze)0z(am0&z$hYMOOMF*mpv>DA4$L2T?;Fef3q}5g%)kRPB*IGOt(ibYkK7w>ynOxT
zW!JW%Yg>NiHeGV<&YY~!I$e;u-`n^8#$0T1V9C+*nKGxZSW$B;#11P>ZC@I7jrz<G
zj2Nt$%Vpk)HF)mzdwkmi7tW>i3U{nf6^_5T6nwkz&bd-BQtTC$Tw=j2KCt;7m>VHh
zc{R`Gzx9!!WcHUqrMvsHmkaLx!uEat?7DO2pPGv9{<3G|S4N%PR6#n>=vL(PUU>zQ
zE4#}Ud$xD}o4KC(Q08cbW^MYi$y;Hdec0TR8~gCZ@`l#@*1TttT5MZvSPb807pDtN
zdmnKCkvRtWK!few%U3Sv8t-wN9@sqj{@b1<+kt}Nz(aoH1A`NSnua`6GHd~7w`}*6
zU0$HVtOqJ|`rm%lM<H|5BgDW3t!(RBR2IhyTY7)S6`iN&ID+g)!ygUb8U5GbkAsC*
z-(0et{kh@n?<yRI|Gm5q-sozdCD20Mwc7_;&|Tk=L-6s_7Gt29`RO))pn>_^MnV5`
zyAH-bZ_wd>GXs6q5DH<(J`_?NuMZ9chC`!)k=Fwwq2t4&XJ)ybUF6@oxzocV-~sR7
zxwA)gJ+){gaB>*jVyfpbj)zogr%DeEt8^l%>W+dlEULOO+^pv1R@1Hru?q`+$@wJw
zU4_L-Wc-(nSTZd5sVG8r<Ub(o!070t48e@3f|H}1k44W(Sf8tUkVyzjBy8v;ysf0i
z6}E6HHwJ&k0pC`_cC9LL*jFTCr+QW=yW+J!-E>8gk}To;z3R|rAr(yi&?6IHrYe>1
zU<kN5V#7nyM*N9|5L_?SaHMZEfRpmXp(4H#)?D#P@Cu~;cy}V*+i{QRg_m$|09Vtv
z!l9G&HdLw}bcL9hmJZ?%J0?wwL_&C&L>#tID4c-Y21#hj@QOMa@|%ik4GTi3elV5A
zZkCk6m{=hiQAkWc94^%e7X)eYDG1)Mz~gga7ZGrAQ`1q{HX&Vyap^B`^*s#1NK*;$
zWvHZ#E%8pGIi46^iYJAsn0Q#iz6YL=uYl_U`DKcFfb73SM)?0L<oz|;S3>*#8yza4
zL%%}1evJ;Tfch}p=WSWTdxw|#)*|0p;@g(_9Yuae#sH36cBW{4A!7u!;_&431>2^K
zd4+G7+qH0T{$Qc8qr`V+3>AGN)sUAf2%1IZF>Wfm^i+3Fs32(a@?+dooLebx4xpe}
zY$MI>_B*|wxju`0=Kb-@#a$;J<EbxCQ%1_0JySu@<N*$v#eUM<86{0&^sU0%=L*94
z!bGC*cA_|%e2js<^dd;E9ADD6WEjZZyIZomZXCFNAotGVXvx*H?Alj!?JKzs6p+2l
zxU%v+rn$Ujd%ibwD!V_|fBn!B+rHAif4Ti|vHkEJxzyhO3-_z}p3lDZ?=yF2KEITG
z6{mXs^6WkLtC>?Ph*?I?B65~l=Y3~mHeGUVEjMmZogHOYV|FWq!<6eQI5J&vB3k#Z
z=Za^psYJOdG)4KdEc_{e@;_z}?Ir_2>MG2}64h9t?bMF!$wvqp4C5gKm2DWN<w{Gz
z)_%M9&bHg#nU)fDq(XO5`n;=xpjn(D&7J*^@E2a%Pm%e`ISR4nx!HS6(=S;k{7nMh
z4s1uEp?%R`;`d|*?(^2UOLG!-;0sM1i(@5QZ;9UvM#j=OH?nYc{%pb1u^1^?b}d`>
z7cKismV<>OV!<M2j+R+l=GeO@uAC^?H$%>8;IqbGu*WMF#5Vumqd1KkMkpDJ^G{xC
MIBsTt>U2W=|0JgbN&o-=

literal 0
HcmV?d00001

diff --git a/media/.gitkeep b/media/.gitkeep
new file mode 100644
index 0000000..8b13789
--- /dev/null
+++ b/media/.gitkeep
@@ -0,0 +1 @@
+
diff --git a/public/js/app_player.js b/public/js/app_player.js
index 957ff71..8c87c09 100644
--- a/public/js/app_player.js
+++ b/public/js/app_player.js
@@ -87,7 +87,7 @@ function looksLikeHls(url) {
 function looksLikeVideoFile(url) {
   const s = String(url || '').toLowerCase();
   // common direct file extensions
-  return /\.(mp4|webm|ogg|ogv|mov|m4v)(\?|#|$)/.test(s);
+  return /\.(mp4|mkv|webm|ogg|ogv|mov|m4v)(\?|#|$)/.test(s);
 }
 
 function toYoutubeEmbed(url) {
diff --git a/requirements.txt b/requirements.txt
new file mode 100644
index 0000000..3fb50f0
--- /dev/null
+++ b/requirements.txt
@@ -0,0 +1,2 @@
+fastapi==0.115.6
+uvicorn[standard]==0.34.0
diff --git a/video_server.py b/video_server.py
new file mode 100644
index 0000000..53b6aca
--- /dev/null
+++ b/video_server.py
@@ -0,0 +1,208 @@
+import mimetypes
+import os
+import re
+from pathlib import Path
+from typing import Generator, Iterable, Optional, Tuple
+
+from fastapi import FastAPI, HTTPException, Request, Response
+from fastapi.middleware.cors import CORSMiddleware
+from fastapi.responses import JSONResponse, StreamingResponse
+
+APP_NAME = "video-file-server"
+BASE_DIR = Path(__file__).resolve().parent
+MEDIA_DIR = BASE_DIR / "media"
+
+# Allow common video types (what browsers can play is separate from what we serve).
+ALLOWED_EXTS = {".mp4", ".mkv"}
+
+RANGE_RE = re.compile(r"^bytes=(\d*)-(\d*)$")
+
+
+def _safe_resolve_media_path(rel_path: str) -> Path:
+    """
+    Resolve a user-provided path against MEDIA_DIR, preventing path traversal.
+    """
+    # Normalize separators and strip leading slashes.
+    rel_path = rel_path.replace("\\", "/").lstrip("/")
+    if not rel_path:
+        raise HTTPException(status_code=404, detail="Missing file path")
+
+    candidate = (MEDIA_DIR / rel_path).resolve()
+    media_root = MEDIA_DIR.resolve()
+    try:
+        candidate.relative_to(media_root)
+    except ValueError as exc:
+        raise HTTPException(status_code=400, detail="Invalid path") from exc
+
+    if not candidate.is_file():
+        raise HTTPException(status_code=404, detail="File not found")
+
+    if candidate.suffix.lower() not in ALLOWED_EXTS:
+        raise HTTPException(status_code=415, detail="Unsupported file type")
+
+    return candidate
+
+
+def _guess_content_type(path: Path) -> str:
+    ext = path.suffix.lower()
+    if ext == ".mkv":
+        return "video/x-matroska"
+    # Let mimetypes handle mp4 and others.
+    ctype, _ = mimetypes.guess_type(str(path))
+    return ctype or "application/octet-stream"
+
+
+def _parse_range(range_header: str, size: int) -> Optional[Tuple[int, int]]:
+    """
+    Parse a single HTTP Range header of form: bytes=start-end
+    Returns (start, end) inclusive, or None if header is missing/empty.
+    Raises HTTPException for invalid ranges.
+    """
+    if not range_header:
+        return None
+
+    m = RANGE_RE.match(range_header.strip())
+    if not m:
+        raise HTTPException(status_code=416, detail="Invalid Range header")
+
+    start_s, end_s = m.group(1), m.group(2)
+
+    if start_s == "" and end_s == "":
+        raise HTTPException(status_code=416, detail="Invalid Range header")
+
+    if start_s == "":
+        # suffix range: last N bytes
+        suffix_len = int(end_s)
+        if suffix_len <= 0:
+            raise HTTPException(status_code=416, detail="Invalid Range header")
+        if suffix_len > size:
+            return (0, size - 1)
+        return (size - suffix_len, size - 1)
+
+    start = int(start_s)
+    end = int(end_s) if end_s != "" else size - 1
+
+    if start >= size or start < 0:
+        raise HTTPException(status_code=416, detail="Range not satisfiable")
+
+    if end < start:
+        raise HTTPException(status_code=416, detail="Range not satisfiable")
+
+    end = min(end, size - 1)
+    return (start, end)
+
+
+def _iter_file(path: Path, start: int, end: int, chunk_size: int = 1024 * 1024) -> Generator[bytes, None, None]:
+    with path.open("rb") as f:
+        f.seek(start)
+        remaining = end - start + 1
+        while remaining > 0:
+            chunk = f.read(min(chunk_size, remaining))
+            if not chunk:
+                break
+            remaining -= len(chunk)
+            yield chunk
+
+
+app = FastAPI(title=APP_NAME)
+
+# Default to permissive CORS because the player may be on another port/host.
+# Configure with env: CORS_ORIGINS="http://localhost:5000,http://127.0.0.1:5000"
+cors_origins_env = os.getenv("CORS_ORIGINS", "*").strip()
+if cors_origins_env == "*":
+    allow_origins: Iterable[str] = ["*"]
+else:
+    allow_origins = [o.strip() for o in cors_origins_env.split(",") if o.strip()]
+
+app.add_middleware(
+    CORSMiddleware,
+    allow_origins=list(allow_origins),
+    allow_credentials=False,
+    allow_methods=["GET", "HEAD", "OPTIONS"],
+    allow_headers=["*"],
+)
+
+
+@app.get("/health")
+def health() -> dict:
+    return {"ok": True, "app": APP_NAME}
+
+
+@app.get("/api/media")
+def list_media() -> JSONResponse:
+    MEDIA_DIR.mkdir(parents=True, exist_ok=True)
+    items = []
+    for p in sorted(MEDIA_DIR.rglob("*")):
+        if not p.is_file():
+            continue
+        if p.suffix.lower() not in ALLOWED_EXTS:
+            continue
+        rel = p.relative_to(MEDIA_DIR).as_posix()
+        items.append(
+            {
+                "name": rel,
+                "size": p.stat().st_size,
+                "url": f"/media/{rel}",
+            }
+        )
+    return JSONResponse({"items": items})
+
+
+@app.api_route("/media/{file_path:path}", methods=["GET", "HEAD"])
+async def serve_media(file_path: str, request: Request) -> Response:
+    path = _safe_resolve_media_path(file_path)
+    size = path.stat().st_size
+    ctype = _guess_content_type(path)
+
+    # Support byte ranges for HTML5 video seeking.
+    range_header = request.headers.get("range", "")
+    try:
+        parsed = _parse_range(range_header, size) if range_header else None
+    except HTTPException as exc:
+        # Required by RFC: include */size
+        headers = {"Content-Range": f"bytes */{size}", "Accept-Ranges": "bytes"}
+        return Response(status_code=exc.status_code, content=exc.detail, headers=headers)
+
+    common_headers = {
+        "Accept-Ranges": "bytes",
+        "Content-Type": ctype,
+        # Helps some players / proxies behave better with range requests.
+        "Cache-Control": "no-store",
+    }
+
+    if parsed is None:
+        if request.method == "HEAD":
+            return Response(status_code=200, headers={**common_headers, "Content-Length": str(size)})
+        return StreamingResponse(
+            _iter_file(path, 0, size - 1),
+            status_code=200,
+            headers={**common_headers, "Content-Length": str(size)},
+            media_type=ctype,
+        )
+
+    start, end = parsed
+    length = end - start + 1
+    headers = {
+        **common_headers,
+        "Content-Length": str(length),
+        "Content-Range": f"bytes {start}-{end}/{size}",
+    }
+    if request.method == "HEAD":
+        return Response(status_code=206, headers=headers)
+
+    return StreamingResponse(
+        _iter_file(path, start, end),
+        status_code=206,
+        headers=headers,
+        media_type=ctype,
+    )
+
+
+if __name__ == "__main__":
+    import uvicorn
+
+    host = os.getenv("VIDEO_SERVER_HOST", "0.0.0.0")
+    port = int(os.getenv("VIDEO_SERVER_PORT", "8001"))
+    reload = os.getenv("VIDEO_SERVER_RELOAD", "1").strip() not in {"0", "false", "False", "no", "NO"}
+    uvicorn.run("video_server:app", host=host, port=port, reload=reload)
+
-- 
2.54.0


From 2935ba73a60fe893ac90b63468291d0fdb3d4313 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Sun, 21 Dec 2025 01:03:39 +0000
Subject: [PATCH 2/4] feat: Add HLS support for MKV playback

Add HLS generation and serving for MKV files to improve browser compatibility.

Co-authored-by: mathieumoran1 <mathieumoran1@gmail.com>
---
 .gitignore                               |   5 +-
 README.md                                |  11 ++
 __pycache__/video_server.cpython-312.pyc | Bin 8803 -> 17747 bytes
 public/js/app_player.js                  |  53 +++++-
 video_server.py                          | 203 ++++++++++++++++++++++-
 5 files changed, 267 insertions(+), 5 deletions(-)

diff --git a/.gitignore b/.gitignore
index d6b7901..7647573 100644
--- a/.gitignore
+++ b/.gitignore
@@ -140,4 +140,7 @@ ayylmao.js
 
 # Local media files (served by python video_server.py)
 media/*
-!media/.gitkeep
\ No newline at end of file
+!media/.gitkeep
+
+# HLS cache (generated by video_server.py via ffmpeg)
+.hls_cache/
\ No newline at end of file
diff --git a/README.md b/README.md
index 341d83a..e90f967 100644
--- a/README.md
+++ b/README.md
@@ -22,6 +22,17 @@ This repo also includes a small Python server that serves local video files with
 - Served as: `http://localhost:8001/media/<filename>`
 - List endpoint: `http://localhost:8001/api/media`
 
+### HLS (for better browser compatibility, especially MKV)
+The Python server can also **generate and serve HLS** (`.m3u8` + `.ts`) using `ffmpeg`, and the web player will automatically try this when a `/media/*.mkv` file is used (or when direct playback fails).
+
+- Prepare endpoint: `http://localhost:8001/api/hls?source=<path relative to media>`
+- Playlist served from: `http://localhost:8001/hls/<id>/index.m3u8`
+- Output is cached under: `./.hls_cache/` (ignored by git)
+
+Example:
+- Source: `http://localhost:8001/media/MyMovie.mkv`
+- The player will request: `http://localhost:8001/api/hls?source=MyMovie.mkv` and then play the returned `.m3u8`.
+
 ### Install
 
 ```bash
diff --git a/__pycache__/video_server.cpython-312.pyc b/__pycache__/video_server.cpython-312.pyc
index 95df0ed27bb2741199b30dff498661821f698f19..d24902ed056edb6a80db581f4e7ab6f34e00788f 100644
GIT binary patch
literal 17747
zcmb_@X>c3YnP4}%ao+?%f|MwMq9hU$Pmz)+T8Al;lBk1}N%;_C2Z7K{3KR~e8>A!{
zbYN|&LdMz>RdH5`?M&cxQlZP58qL%mO6}IJ6(?g)c4`+e=n!r*8%>S2cDz5PU`t!$
zkyE?-eXr2~NK<mAW}EEyUccjeuU~)fyYXMlW&;J+@uNorukE6!zr_dTvJ?vU7u6JX
zgL<0cD2@(NV{%T9(d1b*rXo2r#*myHV@a+aQ<GdXrh!}))P{6pIvU3^L4C+DW(XO_
zj3LvQDP$fqlX^C230cRiA={WOWFNDKD#j{8jxh&mQwJ+U&M_w`Yl2mw>apsOYs>}D
z+OZlH#q0RmcW8ONlY5mHDCO@Iij&=?I;AvL$JcSXn31B!HX$Uq>B)miYbodS(Bg)^
z2JEZM_Kr&Kp*%ls_OW`-$eGTo#<l<?)#Q;9Y^B7R6*yyCIScRRth{cV<!s+&$F^~H
zUI))^c&>ow?VJPJEBQvKGx27=k#8JV)c_#8$2FW2`ZRIJ$*3ymRSma`^fvGwj^^lb
zhV(RWHQ!Z_?I?p@3nO=yJ#T>LX6^*H5$3N$2ryQ|ZGurPqz<21ZZq_1<=n+J*28lf
zw*}VNP<Rgww-xHz;oYr#&CPAaH|==jj&J80mHnOMl|3ru%2yrh<U6^>3r!Ryn7GCX
zdaR2#@@{-PemB>&AM)@)zH>5E8mW{xkFtt>>Kf%&O~Cy^14YeJaq4k1iuBdW$M?9d
zy1I=8XtNZoreiXq%vj2KC%ktz-=(a8+c80LJO4F}Z*a5u9XNA%(G-jp<#Kt-wG_u$
z`JQnV*ZN(yxF1hEVoY1vm}(f)UN&a`BgS+nV_>y*ZWq^ivrG9V<21LMui*BO?^_Kx
zvG=>`;u;PByxH;<%Vn;c+sE}xsBS)?Kq=w~!m{#?aUHk6Y+Z*Q0q4M1;2eZ?C@?hK
zp)wdx^1a-X1V1J@q+y504nGp-dbz{O%EtPjSK}jl_Hq46Pi2qB`XAYQfIFh}ejH|T
zM`!4<0f2IN^6EOfcZ~1j`}u*JgYU3%D@|RdFVlV%O>pfZ<vIB&HVk=ai9PL$p7*el
z{wN>j1z$8GNV>r&l+FctNjE$d4Mf7eprk%CJr(3VYDs&<Cq{cu4@%}^XU?1+xa8+a
z7fJopG%sA1v?Khtr+G0d=|*^QDiRiXn8VUHJTiJJz;QwTqEFyGD#>(wba+VVA=yWx
z0`Ch2!V^kW%svy~_(;omAjr3fyfDKHk~+k50UykJa@5<`+jnfh+dnuGGqj!$ieA6Z
zf1Z!At)Z!|hmc;Fi8;P`?sAkD4>Uc`?eMgabgQHj_@H+RURcryd~{j}`wQ%VY!e<P
z2JZWR0kt>qaF@4|E)*aJrz(CT?7ilK*1{+x5286*IHE9;;n<sMW$YC?s!@i<DP$It
zdgZy4D+gt^toLL4sq|Ewo&;!XuXu4?H1@ErZ3kvms9LjTefgSUr0uICCmmm{Q=mmF
zm9`mLDBleOXIu?=lxm=&CZ+dQN^s0FWxJ>0w59%W=8B5b%`z`B7wL=CCFU%3k@lEk
zXAEw*0Er^O8Q$%4PXp?-ObHQ0CeDo?-tC+41;S#~eQKb8uop3?**zujGkiD-=qGoH
z3O>L$(HCqb;2zS?Kcw3}eHA`y%zi2$ir5hmlk|RDB^kx2FFFlK7~yzH!|_pHAo%G5
zb~g=%XMDkcJoQk_as)?(BT@HwWID`!`V;Kqd^#*nPfbOHC@hhHjb5JOJw{0@@KZsb
zA3z4hs1TSE5I-b+apBm3yr^UZwDv^<GrTt%kqpoHg46tfAizo121GA{lr-Y>_;}!w
zqz*<d!cj8yo;*4H>_ESF;JGuS9#+8bC+YpZFc;u_QC>2TqvjPNk*LJ*m;55q5!~8`
zwQUz8!Ub^(*40Lis8>Fnty7mJmsj+S^WMU$yfO^jbfFoB*TOAkAW2Yp17&k9TQ_H{
zn^SDcpSA8-wsvH!9k&{?);)=19~&JjmJN$cy6fnY<ycyG?4G?g`CP`nZQ0hEv9)Gx
z?TNt^d+oA)OUAw>Yu}nUo>wvIQ*=&eU)I%SbalzeC7ma)qfE|a<Hn3}<C1Yx0bu`<
zWgx8^xU01-YpXNb>Sb+RMq8KFZvJUJqwOqoI<aIqnbw`WYphJOm0vt?P^PNSDH<jq
z?YD-OEPWq1pu?AW25TRRE_kaub@szO)GvGVeO1hRjHS=cyk}QKSz>Vq)~7QIFpkg}
z$k$$z>(CbEOwH195X}gyqA#mTXJoQSQA*IFMXC}niK7Jy^*o5Bv#MDpuDV2vz#KSc
zl=84cLIn(u*~sT@yVMf$MTLlX!S~SRo0<v+{D5hZa9hM5<)bZtm_WGSRtwu;h_D?J
zNgoP?ctl}QGE4v~5WV;yG0^pGR%pR4fKpLO?I-oLw}@QAPHc2|<x&1fI0~ndj22KL
z?}S@C3`v5@87$X!&hK0{Y{(ckWDRwRzMR%DH-2R{XRW_y1=MQDSQ~!Yx5&OVn6<XP
zd@M0A*O4>YJ~XzbD_hfS>wSPiNhZM;p5VRbc^?O7f)xWX-d_;Zv7IXN0}a&TcM^e#
zMoAMU>wO{M8AW<u>{z6%Mb4m#tANUCl^&dmV{Wn~&Jb6vN8>rQGX4?m8l`=fg>TAm
zT7n@Jakfx;+>A=^&ZtpYRh%utQ^(bu?gE@(px}>QwK`5;=!ZU9P6zm@j)BrRt{Mey
z6DQ^Jy0TfA;w&1nQc%nUV_AD~6=7C^FsqGgV6Nu@AJlOTtPH--nw9BS?I-mAx;{~J
z@x8UmJjxd#^J(#2Jcih90}{g1K0!ndgUkSEI?6)s5kx1qj85*zI1qUu)Z>=L5MU8P
zw1p3IWb_CTK16pDscv>dy~iC0`-9UWQ1NDWL~sv9!n`{$u7C@O?vTuS+W62^^s>yF
zMtlL07s>2JNerh2STf%s7%s}4hXN_&H<b!cDqpUEdeEmx7CyxjAW;HlF{j)IIhF{=
zUK|ggSm@D$bk{p{big|@08*JR>OU{3%UG0pLWoRHNlYLN+ykUKk51?TXu=Z+nGQ)>
z^44BaQp0;gW{{baH^_$(4r~-qh%hJWpg-<4UNUVkf$#?V?j^4!oP>7N+r&Cpc!K)O
zM44PUtK*)|cFi(xS%@!JdotCYZ1v8pt~t^BvC&kZ@5h%cC(^nTcb!!?p1uBT@~Iz;
zrR+biezSVf{#NbW(}|;ZwU&h~S7wvW)RxyatQjLW-E+E<&L51;8FEHv(*FHJD;1j;
z`_kP*OBKUu(=b-D9~w92DxC|_r0@Erg#&4mJ7=q0h-GZ`sjkKPH@nl;=CrQ)p2@nP
zedT0gAm^$}RlH`r+Azmo-LY7Ci+<ac=)0>mEwHc-b&7sXzlJvfxqJG`i>oW|8O(G3
zg|1}%_3o@;BhW;XeW7!1f10fp_Q5s@$1ynpiDdAfpAKK}5{kz{g>vE9Zh-qf1v`2I
zl1EFy%BkH=&9ZTJU0O&heL&(=#c8AmoGJ$3XOW&TgjVc<vFlLG5|xQF@uJMEz?;>?
zH6k5$#nolptw{Z1)no?Ezf#?xVP<6}`syA~>)=m0)u0r?%XR=&zX-hVEW9n&$g<?0
zf?NrlP*Mr!gafc*avVVWVIxz3q^!vE7bF%~A14eztHc26dbEVOm3CP;g-!Ihq!;)Q
z2%SJFfa&4Ji@48-)o{s(ZSV#_=OVJ2@GLZPaEquI{~h%Ousgl^TFrdTLf0#s^OR2Q
zO7`Y-`fHkb&D``=bFQ*Fx$XLiRQ>hgIepGjovi<U2r%!)k?Tj^=uE~I_hmQi&Q|W3
z8~E7a%GsPblk*Kn^6A%WGp2^Q!CXc4_fO=Fl+~52e<kz}S^)kJIKyX{{6VaP6<n$4
zJxIUWTiLsdx#Q78`OYqN?-SZPd$mwrU#@urhW+#98lb{VLB?VKKgu|2pyHaLhw9c)
z=X7_hu3V;>33ILZ%!3}uPfQEJhfHf!j2UD}C^WSzDzw3?3GJA4L9#}4v3rRwS}wSJ
z1A0wiPb5~45?m&(yp*%Hq6ouZiRY{vR{jVPh8*ejw;v3sk36_hr0e8T4%2$auT0RS
zCW{PT8Cg;lXW>}C4k|GSBuK2+T!j{5J6_%NI`w1qWRc;P+RBt?CR$Wc*Hby;MX}*=
z$|rnkX6PXuf2f|0j<<As48j(eOmIUY>3pJhDk6eX!~)NWB3B{=5!E?wC<;QXH!MmT
zK1|d)?RlSgJ{UL$ozMF^B>j2*5*L^NLkDP2vP=s)n4|*32XleHye?h@I4`hfSuGMK
zVF^eI#q*F5yjV8WW(>7&?8_RqEgM=hhSsd19cZ|G^k3PKIGi)v<^~q*3%hRgT<=+E
zPWn=+pIhFvq&K&v4eiT@y&1#a+uE$*$wc3ZvEthP`Ta>IYuvbO+@3LR&l;Q3Y!ks5
zNgs^(FUVF9J-%jS8eV*r;EP`z)sOqf09$TQQIreFg{xkB6>$Yj4|*zER9hy?8B1YM
z8CfqXBPEPn4~NQH*TJJ0thB60(Rff=Blb`T{w%X<eTwIz)R~Gir4^RFiLI<lp{Trd
z@f4v7z2@SI3{Y7CUA{j>!$@gZ39Eq>slXgk+Rd-&tr$UIOqBu;Oelw7#y{%o#Z}0j
z3j(}3isB%-zGAd0K?8MQ?Zp+DFf!CItE_5)zH0GkW5*51@kRq7AhEKk15wc(jktX?
z5wMbg%IBXJ1kn22V1o&Zc=ALd&qmMlAc2NJBIaaaR`@2&Jrwv6EGM=JEQ0O{*?bAA
zsoNJs&V1P|Oox%_64`b_UTXS~$0D(a^^z(g3a6n~K)q7Z4tx7X271p(nqe@C^qmCL
zr}x>B;h~dfCG|xCn6spr;G<IkPVi%QwLcgUdC7_foq<aMF)9*+i)^A%i$R{B0>W?s
z!3PO=BG&Spq#Ebe5C^l@=l}L}K;XT&83Gc8m*E!Qha^Eg&{0;$wZMGfl?#cZp!Vif
z27TR%-EpJ(dNuIzv#)QuS@CDJZ`b~tbN@c@=Yfpp(66?<zw^${jOSF=J~Ve23?t^c
z6<fs(-F02E;*HUtR{Xr?&6>A1Wb0a%>$);^UALai)*V=~9lWRXdDWCNRebS)p<oU&
z=!d2+?^!o}PBAbqEame2<yT%zKAW*_O<n%b+P+fNaEnRre}1Xzg|zL36_f4S@%iHm
z(chXj=Cv^5;b(TrXce2`U2gPR`>LrsjlI<21Jo}Yo$&C>1J!+%%zKp#l;5lFRrhaZ
zezl2)bQNDiIwDgegaS0?QHI%@WhPD(?MjpZP6C4%d6`l$68ORyuuK~YN|iTq0j$!R
z>2NR*z98v~%9MvDA5lcCFNkVpFmMHVA7~-udwmC5UWHrS0STD4RIJ)e3{kF(&Xwv<
z>s%k{JYTFBD?g`HYV+UdOnEir4@IO^S1O#;5B2p-imqoAo7-2cML@vh*S`dEayc<B
z*>k`;Tx9DYXB*L~6IXF^2`mARWAOs8@X@lZT94g>eL{7UDI;QKvjLN5f2<;NvSreE
zQER91gFSu)<~Y5czE4x->mq`Nx-b*y508DP>XJ4;xgMEU!~1AT?*q_qm)Bfhd274U
zVG<2wYc39~9ty-s=bA=%R2asrCi-|ddd~1i!O?yV9B?B4QE+r$1INr+{wO$la7<dS
z)0_=%JKPm;JK(OoPDeo_ldlraLW>jbszP23xeM+ZxNEP|aUJ9vAlE{^5$-y;H^H+W
z^38C&;jV{g4dh$kZh(6$+}q&ZzG_A_*I4d~U(-g;h{D9L)3XK;5sJ)javc^IHxRsN
zdZ)meQMY|8E^hrN;^L#vLJ4os(7NU-+vB30u&k~~8kKK}UZ6*vIv|}J74XClV~lQA
zo;eS<<K|8UO56y3nC4mIOU8?I6wTn|nsgTmWf{O3oHfRclPH0&xeC_jmdR~v8sL#@
z<=SqxEAu_}WSLg2vLkLPz}*GvhHCvaE9?N?7^tRvmF%8$iCuKY&J*FK;3WmI#20p>
z-0{qCzZ={%mxCY#5K+bFo&XzO*iGCYvXm1bT}w{Og7L0k1Vq^eAt|Cw%n%53{3W8F
zo&oog7HnQ15{Z(IM@a)%RZQKAya)W9(a;odF>_!d9037>N2d?;Ll5bh!BYbgy+_jG
zL*K{|Nwup}GT_7Mk%7^HGm;K`T$jhenJd|`w)g4&!C~*=!80ShX9gs;V^8}9Ni#l<
zig3)-avmIL-gCY%xQJu=mS6;Io-?5DsL6~mRm)|#12GnS1yeC~d(TWydyH-G@g0IH
zf6t7h1<mQwu035bEqLR2k&j}%Fiu*1665pvp?I#x2T;Z(29#)+1XXDi)M6E+sO)jU
zn=ljMVg}MM9`sF!QYG#g*k(9%8HoHu2zM;zBs~g`#JUm&Au?u!8t=CD-5hB5!1lo?
z!}~8t7Qb%_e8RjJ6r!o=Xy5_LmX-1r5T_mb4Sm5N&k>1oNH(gW94c&r1ipht{s6IR
z*wAu;bQ~OlJlErnnF`QIKTjpm0tGzQFqBA<U{1Zj1q31m3Mg8D=k7eLB?u1d5cpbn
z0b@jnEXs#xgv0P4%dcQVJqM0XKlocD1_WQpj-u&MBzgorjRS}nvT$0_M_%Ey+?O=K
z98vIq2<W>+kz0NpvydQD;dcmdk`~oOSehhbC($2?Y$Ry`2}z4i`D79UA6L@IpIS2e
zrnx}GdoBPnJ;>3FKg0<rED3KyBBB)lwSwX$8^oMm9^9hvF%V`+ZN3S;(YhpZKz>0w
zHc*z$$ynCBBXI<5p~>-#Wh;ouc2{zL#@?7Xp3~ZwwXTfTwWO`hS)Fs{d#rt#t<JF3
zDRwamhS4RqYsFTV+LLNp+?IB?XNYT&wJ&&<*o}ErAFZyxYb-etbB>w^PpT+=)k5GS
zo%_KoO*!1DXHv%&`%`V1ijFyL4ixW$^9PrV8&*se*G|o!N;clA{K&K?r?Xx&&zqCn
z;+Z+~l5W>Mhx5k1>-&;pi;k?LW!cf0adc)KyXSN(78?rtNqwp-YiU}xv}P==SxfsI
zgCc*;^_t}V#oDaBYuVnDvG-){`{y((uG*jIf22=u*?ns!>pHmX>d(0Pv#uj^<~&<(
zHRMc{c?R;krrNw3^1OyJyYgBr=_qq$UXLXMWwz&ySTbSB45bGa%4}OOyfU1(V!e$r
zJMwlcRp2NGmMXE%iKQwmRb$D8r5Y^NQs%1s1}tsFQXQ5yVe4irxv^A_r7bW|z5z>H
zv2Gidwo~Scd?S{cu+D>}9hA8?zY|N%xW*PNwPL?EEVbiXbzo^1Wp?H}vD8JG>+`#@
zv<Lg`#ZotAuF3DiQV(Tr$UlLl{gioY{s5F79K?6lCR;ML#;mC+e+cWIq~*%yjBR_?
z)R^z3p>~eRAE7n+i}Z@A>e|r!P_i?{-R}Cx^dxMQ$x%Rod#h0ZaK}(Y9WA9dUNg)a
zUhQ1C_=EjFb)=qsYvYox6>#*P&PlNAiwB!2TRr%l^=IjF_rlZ9rA^O$xniwZwl-(1
z&7f7lGICWlHzu!7epuC*>RWcUWt?rdwD0QE&bF-c__FhK#(6sH9GN>J!|8b{J@VX#
zBa`XpC(}<|NOuR9Dne;-CT*Je5_A)Q_T__GWuXtn<8a#UY_K11rtWn2?}O|wce##r
zQtum@p#1(p52PP->W_Pv5B6II4a{E|s-XN=?q2rzR^~Tb)$s5e4+EWk(`-Jzj}hJi
zaFW3%0uLZ0WR=|s9RWns`+Fe0<*LqPQQ?3dg$t~XMa#~rkd?L0RC-<EUJbU20@QV#
ztwl=)I@?#l2SLBwxflhziF_5pc-FCN7KMLM%VY&@J?m$&7ucylWh&Y~75HGEDT;9*
zzA=xpe6Crsp?t+Kavf{ZWKl>j&8Mu0Gp-5VF>&VA5J~V((N0E$#xkQlh|FaU**FVA
zBe;!TV#|VeEJHEVH+(JQ?JfIWc(JQ}RzL|fW>K7#$Wg)gf}**A1}*_tE1<*~t59Nc
z2v(7xoLGf2uB^`5i&$3*zd4AXUl_yWEGFpeh*gzG<H&<aIF1QiLA<0NpAH6z!;>&m
z!YBn4jR_MM>any1lLkz-VuB(q35@Wl3Gxen3Kifxg3uZPVo@o=3Pr?x!U1LOSG_ut
z26-S^i|`lFFAul)0Fnf?Vl)#&uXV9%$=F`-1}ZTw_6^JShK#)-)xX$~wYM(YcW3Oo
zZ~3$Kp2YEwjm|>vV@sC7v~KX8sU~?OW7@K8+?g@%%o<w~{W-fcX@CfuW!uh-ZD-cj
zk{HA|o6)j38*WM0ux^~qz>?)iT6YAv4aDTEj<iWP?#*cT7G^)WWI2`Aol-(=oP|)E
zQ90Bm-G!_BKuqgKNUY7M5^HnF-shs;bLsoKnD^=}eQnHpZE7fk2&Rq(q7d(7!iYof
z@W|lN!J$!!-T^{L5JI245g{-EV%$Tz`G|*+n4=&Ev&RN{`@#Nq`pn?)5C%j2JJ?#u
zF8B8fJW7-SUr<y)Kyb_X2v>ZR-Th)r+Xkf|MEbz!;)TSF5Hvh*H^5O6EjDqgH!z+6
z%}^?^MP2|YcnW2CUGM4B-l5)818-BZfVmTfNE#Wq@E$yD1mZ}<rUZ4jqUw!HnUZZk
zW@z(G1=@(}v1%bjBhsJ9l(o2w^&Gbt_YJnR0(GRR35awqIp9jKur6IK`ehWQx}SRC
zdti_PD!Lw>RVWOJm8K_)w6wTD>T#4ZS~TteeWI`KhB=B#atT6d#mbr<M>)ZCMy;o2
zBISM@jhrm1zonTuHm*YDlT*J@+!va<I?qzk4N5Og6Q=@2PXVBWcIb?71zLrF3kl#A
z`I>Ejt}H4qaufvv&PhoPX6caVu@HZj@FVCAl01ncl+?mRFmi4U1riz&Dxpta(it!g
zG$!F&Snb0Ex6{K2??WchQ^Ew~BH}NQrh=au)!c#$>#w1q9&r)BVS>8Hn!h*v@^G?$
zu`4mW#J1;5mc+n{+41V&jp6IVslIGwQ`YSHoHD5mb9ByXLre127ePMF8BN!^=etpA
z${IKPbbrR!hP4*!wa|R%jlryC`?94iV`<A;I_8+1&V0=@Z@TN+kaN}iMDruf>$+uE
zQ^wVlt8u3sDfPm4KGU*h%l~FHdPCj}bAc>lawV%%+tRM4tkIKZJ>*!$bmXJ}Wo?b^
zJdJ^&N(?2sBU<H6cQ^5^6Rqx3mrp?iDL92M%y{608o?>yhj>g3gTok1Io=s|ep>La
z4j{vDJaYUOp-?W*#Eaj1R#o!xl(>6&;45I`I$?c9OfH7^!4!q7<ae57IaQni6D{*&
zW>#Hh;((xvIQu#TM-c2}OV|ncr;h#0HKvXx2n=<T5Npx%7`q49Bz(a#yGN^mz)^yo
zz+eJC9t7npSxlZDIq41tF7Q3>Hux58`vcs;wvzdSj3=x<rY7w%V_7R;>Ra&2lBsAL
zz*Au>KKagxUa0YCNc^dQx}&Tt>&~J19y@CUIc|v{zDD@3*yX=rlE8#OXR)(nE<!~E
zy@+1~4h3BDxiEsRi)I>BSA}J0+>Hl=hXN?67OG;$;`Xe)BXNAiyd~9>HMfGgYP8H<
zlw)ACM)$I@F=K381cz-iFy5*S$s@_`)D!8-w#2CwWA)vtjk%4UTtj1O`(oXqHSO*O
zB-b16Ga8d7PifQ|8KpOqEqW29g#b6(_977(h?L!fi=Gv3<4gSl62M|@fsgqSL6r-g
z`2Pa#`+tB$j{hmS5944lRG0$B7p})T6mq_v^LLglIaf=LPK*Uw&u@Tn_HQr{>7!bY
zDHI|@%q80@kXp^nVx$mw4vOM)$-WISktD_tU7d>k7RSZaH+9NSB}OR{`=cLvs0&9R
zz7_0h9_FE`PY&v6IRmk*4=u{mNj^LgJ^#?$hd)1P!CD~_Bs=`+2e5;0s|2(lOWJ~v
zK%$69Jki?>X%X&Xb0ONA$eDT~;+2tP3?PxQRwI8g0X;_oz8#4ag0Le*QzBN%_>18P
zgi8o}uyhxauLc}hN!T{AuE>(*J?J)wNc&wVkf@`3#x1Emi#=K69zaQ>_1eDqeXl&R
zY}}MFZc6m8nCg;T*3^&~02!}l(@HHozV6A@GyrB=HHo8ONzhrp_tMKRC96KvZeFog
zr}}PHFIo4cb^GoaH?HU^AWqGm>`!(4=vY>_4Puybw(6Y2^+2yilvb-X|47c*mENA-
z{dBClzyx0$2cuRQMuR}ERIE}Ykth;8{!bvpd=-xs;)!0ee=-)Ag$R@pY=})=FMMIW
zUt*O1f@D?=s-9XfmGBq{bJ5clh96JPY5+qaf|t|5Y0$?tiDzLZ)PUApoc;o+6T-$4
zwsVF671#fa=8PqeM(NxI=%3Lyiyk64FGYbQii!}qz=vptGh<nGUcMG;oV{r+ou;^k
zM421V_8&Kp7(fg9xMxlB>dMw;QoajkiyMGx+2ck?E0BTxSi?EqQ2mUag~;N^yuG>X
z?JMKDuYbR|A#N;E0vNG+?cfzC3YehMcFk%zpnEdQ1d&cPTjo29YuED%LM@8^Yc5!s
zMw!*GIt$T$v)Y%mqlLVr6cbA190F+$Ba4MY04Am*@x<;OZIYUlJSreR1>!`absw60
z{rID-7V;zllay(YU+zTcfgk}WX!&1|37=r{J4}!@2>%_E6-<7Q32Fgy2;|>DDW;L9
ze@M3ww(L>KT|b4kPmz0itTMCx7L;X~vKvcxA(0q}pddlJvhqym7_Ln~)D!*|6O6?u
zqits4e_#b+%WKG54>W*@8N-1K=H$CrWAR5qp-8w8)GwBzG2vG<gjhey;0!(i_?1~f
zwEY}FeG7@<YmgL(VMA&#YiwPY6vD4qvZif>6jpAyap?M?Wyki6V|(i2EmhXhnK+qO
zsnuij$Gdx9-Ixq6_Al8x-i^*_@)oML9s+;w0@2i~t2BursL@#xFBPoF$!9(^Hmo@C
zhcLUj+ZIUD$DUgndm;VJbJ;O}W;eIw;L|34#p(ttBm^2im10xhep8n<d2%2fSN1Ku
zl&<UpZTmkuZlC!NHJQr3T=hnvuQmhFR}hXtDsjDh9DW(m34vt`yXU`=?3ni^jz9o|
zRg*Kg@(kqnfUJ+dzB9L>KD8}Xy+|)MEIJo`x7fv*bj_a63zXjQ^_1S3VzRoe>rnYG
z9`w?bsRp7;V1w>%Z(WQoj;FWo{y>|lI6bE&Y~$y{Zw}uc{m)~+7)w9(+>-U|N4m3L
zLTm~2|AV*}zSEUn^FSSa$7buVqwcs5AApBn)#(RnnO|-93^<uzTWKi&+NOs3Upv)U
zu4SMs>AYTy%Jq6B`!j?61H<0YfstnhM!d&{N6*Bx?XBc*P21_=5il5Zx3_mlj#Yz3
z22Kux6@l(Jh?X3QZkJR;!;&f-k<>@PcEC&Oam)%osww<tss}ZGQ0vY|zzN6VFTn6;
ziNT1E^Uwi`vVoWucn;2==cv#DP>JhD_%kfMhRKgH31h-Rf^NbnMkoplK50Ojz}P1i
z+i^_-imZYb+qCHQ13Q6$;+}jKQSTOvnBb|DstY|@L&YC$w)(-fD4=aqvMa6N$|FDV
z6p7*}pW8dw1NN3MW-l>`kz)#06iIiuca;2UQ`T6~kt3gYRN9GlDrw>TP61CBp2VtV
zOb7w#$I?km{tlC8F(IPSB$i^Bd<T=8n4pzRco&nykVrOMx?=hPztW6s;<0+Y;Lwaf
z>?bI4BH)2qgr7G>C5w;ayrmbHSk!rizeh+c7w|`k5k~lH1do!wq=&79pUO=`0QWtt
zMB;%vfZ94h)lSa@U;$y_|6t?)#e@Q?BK!%IKn|xPB)F)Z=n)Tf`$G|KI>;XsDxnYj
zQ{ubuJ>iFDG`&LEKB4sF-~0(>|AaDrLRo%CxqeUW%~E^+C)NKE)&Dzc*YBwVcR@na
zeQdNY=w3OvY^={1>$Ap&W#f*FaYsT2y7j`vjA>Is|1ta`;q1c5jkDL!CcpFN%&lX$
z<C(4#+4hrJ=c%l1Xxa8m#`a9s_FTdYGM>FUsYzQmCrscFo7;7*XTB$0)r@vRU0zc~
zJ5yqwf^0E*AG7=}4c(UHKsTY=QsRBg@)g@?R}y+bw%9<jTTQojzw3C{|E}v7hcdfP
z+{dQRPSbkYwQwd+L6(AkkS+F+?Di<h(xcC(UpSZM&Zj5C=@-J8(a3%5ly_-i%KkhB
zS!(n?X8B5%_FxrcSOwW<78_lc1n7`0`bl=X|2{tDx2tJ0wm_ER?qim>Jw?;?DR>Rc
z7vViH&!1P}`@)(ay9H~4?DiS*+Mn&B;P)ZNmNaz<2F#+Bbr7qIZoY3Wj%FPl%Z|Mn
z$KI@CUz)Pz7{`M6Ayb>%+L+p%IJMB7?7MzoiEX;u)V<tvFw=DKwwP_|`)%b@sg8HQ
z{r<%}7k_<u;VJyJ$`8+eSou`q)Ln{MrYbU2MUJibxT0!dHe0a`)JCbIIp?Ta*ai{(
zwBrG6y9)euD)slOU#_03$<mIzil#jaEO?b@&wYkcRgwx=YN5}@EM1jX+2|b$CqIWx
z*@1nkNd@@i3Vmv`bmhnGU`S3MjV`rMe+K<D$!gq64SrY1z(D;XeN=@IGzh_o5HvD`
zx|i$H)^_;r+i$le>asNabkjj=@Iym(tCM8!0yKE~;JME+LkK5m(hXdHum}R8>DKPs
z+iwvN5aiejARKuLvc-!eyWRacKH=Ct7z@SxIhtZkbFmMZnormYFgODegGQ5fHZ6Lx
z#;!#F$Doj3o)ge4m9A-C9M4*J%c_sLYHsA(+4-~S>gGj%*1T)k+?_FZXU#q7!+hGz
zCywM;YvSnlPP}{~ZQBCB-RXa~>bLB%yqRKa|MBxamU52JB--!Soz4?h_Am7nkp4em
CW~C?q

delta 2168
zcmYjS&2JM|5PxsIUfc0U948@8NE#;rVnb}_JJ1FwBz#pxNKpE*Eo>LRXJ?&Vulsfr
z5(}E5f>f$XDD0u9URojAChf(4LVKu$#3k)z+lm9KDsFHrr_Ni)BrEUu&CGA+&71k{
z?$($1>3r-_G}?mT`uX%3?T_yDSW*}i*V6-<p!*C_7BM1-_;kM^$&wL}14d8|8X-C4
z*+sp@2+Lt3B1ep<95rHc%(MITRwFLQy|tvb83{RIw9D<F2jmU`QIU3TV7@6r<*c(F
z=*g9H4RyDalQc<!wJ<_*HwlrJ1wrnCV4*zi;6(dcxS2xkB@x<3qEsx3Bz9YrUn8wl
z1icURIOzSP4g3k30$Y%VXo{waLN{#1@1jK70W(0Ryr>R9b;7;JLrZj!V1kQ257|Px
zZu{jSs3A-{5}V0a1?&S8F2BXgiguHp4WV(2@_Bx?v^-3QNzY;$Ar>J$B`l|DfcEi>
zG(+~z!hhu$9WGzy;eEZ$r1R(=DhMUGuM8n{6Wu_KbU_P$)zMTO*%zKm(|zUl8awWm
zG!9jb&~!5)=_?`f+P9dOu-U)iZ(uQk=nwhU1F2WYD9sfGGH_em*iI<tU!ewfp%Q=^
z+JzbgRDtI@wU6v42TH=`aI+UA4I{|VD2yNmEkC#`YMf4xLtcBz1QD!H%9A_&>>452
zW)67@?5Q2!-W<s{ea))m=^cM`l#Dg~jpjwj_%fDf05Vyw@<N9u=oFo%Gn<neVzVKu
zcoi1}44uD;uA|Jf^Sgfri%vx9c19$%{=IZXz?vh4av-NdLm)p0-NkLr(~#mHh9sT!
zGc7;jBXL;P;>#MLW_~4Ws5UdLMYWbxt5sbqsJ3QS@@B!NcGj{PRgH|Fr67b2I0qyB
zVn$?X=X|8M{{YzBcBQmLElVkw6`NLU#a^vaHVU3x{fo#)KD@{Ir}e5d&ci31bMe`v
z7Zp*eDzm7<)Jlo6dGOBEzlk5f;V}+8$;Dj#aoZTiQ}=;+N5SCwbXv&-7?8Dz;Hy*4
zk@o$2yreCPW>cmVHJ!2x;8PsC{h{+i?livSJkQ-tdbvHMv_MteUSJ;s>Qm&b=R5IO
z{bBwQUdsq>07`?CSZ<K6XqK&*i|iucYJt2#iKgZ=K3A-$24xdqb$v@rcm1%jVP#@$
zFE{y(MWQiRvP@=E;`&)hH?OgNaBa7duLim3<M5zrDOJ<bR$NIvTdmRxaYf5kZ8rd$
zTUw2>D8Mp4R^(`0b$yKLmJgIvD#aQn*Lk5{d8`VK&ymwNUKja+om+>yGwd>~*t;My
z*bNxeUNDK}hIpr75cYx_VDu9hqg{V+_^E(roV#z#taSn04Q$WV4M58XWmYX%F@Y8)
zqfpTbKx&b>#^|%}!02nyIkm7rv)sl^-P`loZvcB4Yr@{9m6E-X5g6Zq)wtkqB{l^D
zayG4N$ZhdX<WZ_7U0b!Om3oP@tdj!;c7q392l4DNH?%U&aHex%aKTCFrFVTLYI`JO
zA#Q`$Hfn5>gq15b`oTuHImQJiPi8I37*{MVJks%bGyXMToX)P~QJAp(+`^CH#tNok
zm=$HaRoguFu)tk7w8bY0Q`@;3^9x&)Ez|7*-T}<l2-W|ay(Pqsu!B5aFfCVL)Om3H
zjPv4n&su~V+lngiq^ji@wW?;tqL#;$#u=`1L{Rab21Q}LT;&x5v)$my6PHdY^XD#l
zeD$cv2W?dOlXDo5jb3>D^t#Bu1dRqR^VNk6msdcz610|9mf7oEi5E;}DJIiOTE$Yh
z`I58s=J>#8+$j>RV0%xTM^QHfl`G6#f=Bj_GkT)y{dGXG`&>92?_*09U@JB){yiS`
z8uc<bYnWt7r^gt7|8s|R3&``_hcW&O#s5Sh`2CHNPteR3n)w$U-9ks5jT2c%IQgCM
hBIz8Od*a-i|EbFmQ0GN#@izW4+j%x3{+dXD{2y-048#Bc

diff --git a/public/js/app_player.js b/public/js/app_player.js
index 8c87c09..cd89673 100644
--- a/public/js/app_player.js
+++ b/public/js/app_player.js
@@ -90,6 +90,36 @@ function looksLikeVideoFile(url) {
   return /\.(mp4|mkv|webm|ogg|ogv|mov|m4v)(\?|#|$)/.test(s);
 }
 
+function isMkv(url) {
+  try {
+    const u = new URL(url, window.location.origin);
+    return u.pathname.toLowerCase().endsWith('.mkv');
+  } catch (_) {
+    return /\.mkv(\?|#|$)/i.test(String(url || ''));
+  }
+}
+
+async function tryGetGeneratedHlsPlaylist(rawUrl) {
+  // Only supports the python server's /media/<path> URLs.
+  try {
+    const u = new URL(rawUrl, window.location.origin);
+    if (!u.pathname.startsWith('/media/')) return null;
+    const rel = decodeURIComponent(u.pathname.slice('/media/'.length));
+    if (!rel) return null;
+
+    const api = new URL('/api/hls', u.origin);
+    api.searchParams.set('source', rel);
+    const res = await fetch(api.toString(), { method: 'GET' });
+    if (!res.ok) return null;
+    const data = await res.json().catch(() => null);
+    const playlist = data?.playlist_abs_url || data?.playlist_url;
+    if (!playlist) return null;
+    return playlist.startsWith('http') ? playlist : new URL(playlist, u.origin).toString();
+  } catch (_) {
+    return null;
+  }
+}
+
 function toYoutubeEmbed(url) {
   try {
     const u = new URL(url);
@@ -210,14 +240,31 @@ async function playVodLink(vodLink) {
 
   // Direct video file
   if (looksLikeVideoFile(raw)) {
+    // MKV is commonly not playable in browsers; try HLS generation first if it's from our python server.
+    if (isMkv(raw)) {
+      const playlist = await tryGetGeneratedHlsPlaylist(raw);
+      if (playlist) {
+        setSourceLabel('HLS (generated)');
+        return await playVodLink(playlist);
+      }
+    }
+
     setSourceLabel('Direct video file');
     const videoEl = showVideoPlayer();
     if (!videoEl) return;
     videoEl.src = raw;
     videoEl.addEventListener('error', () => {
-      // If the browser can't play it (or CORS blocks), fall back to iframe.
-      setSourceLabel('Embed (fallback)');
-      showEmbedPlayer(raw);
+      // If the browser can't play it (or CORS blocks), try HLS from the python server, then fall back to iframe.
+      (async () => {
+        const playlist = await tryGetGeneratedHlsPlaylist(raw);
+        if (playlist) {
+          setSourceLabel('HLS (generated)');
+          await playVodLink(playlist);
+          return;
+        }
+        setSourceLabel('Embed (fallback)');
+        showEmbedPlayer(raw);
+      })();
     }, { once: true });
     try { videoEl.load(); } catch (_) {}
     return;
diff --git a/video_server.py b/video_server.py
index 53b6aca..99bcaf0 100644
--- a/video_server.py
+++ b/video_server.py
@@ -1,16 +1,21 @@
 import mimetypes
 import os
 import re
+import shutil
+import subprocess
+import time
+import hashlib
 from pathlib import Path
 from typing import Generator, Iterable, Optional, Tuple
 
-from fastapi import FastAPI, HTTPException, Request, Response
+from fastapi import FastAPI, HTTPException, Query, Request, Response
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import JSONResponse, StreamingResponse
 
 APP_NAME = "video-file-server"
 BASE_DIR = Path(__file__).resolve().parent
 MEDIA_DIR = BASE_DIR / "media"
+HLS_CACHE_DIR = Path(os.getenv("HLS_CACHE_DIR", str(BASE_DIR / ".hls_cache"))).resolve()
 
 # Allow common video types (what browsers can play is separate from what we serve).
 ALLOWED_EXTS = {".mp4", ".mkv"}
@@ -104,6 +109,159 @@ def _iter_file(path: Path, start: int, end: int, chunk_size: int = 1024 * 1024)
             yield chunk
 
 
+def _hls_content_type(path: Path) -> str:
+    ext = path.suffix.lower()
+    if ext == ".m3u8":
+        return "application/vnd.apple.mpegurl"
+    if ext == ".ts":
+        return "video/mp2t"
+    ctype, _ = mimetypes.guess_type(str(path))
+    return ctype or "application/octet-stream"
+
+
+def _hls_id_for_media(path: Path) -> str:
+    rel = path.relative_to(MEDIA_DIR).as_posix()
+    st = path.stat()
+    key = f"{rel}|{st.st_size}|{st.st_mtime_ns}".encode("utf-8")
+    return hashlib.sha1(key).hexdigest()
+
+
+def _acquire_lock(lock_path: Path, timeout_s: int = 600) -> None:
+    """
+    Simple file lock to avoid concurrent transcodes for the same id.
+    """
+    started = time.time()
+    while True:
+        try:
+            fd = os.open(str(lock_path), os.O_CREAT | os.O_EXCL | os.O_WRONLY)
+            try:
+                os.write(fd, str(os.getpid()).encode("utf-8"))
+            finally:
+                os.close(fd)
+            return
+        except FileExistsError:
+            if time.time() - started > timeout_s:
+                raise HTTPException(status_code=409, detail="HLS generation already running")
+            time.sleep(0.25)
+
+
+def _release_lock(lock_path: Path) -> None:
+    try:
+        lock_path.unlink(missing_ok=True)
+    except Exception:
+        # Best-effort; lock will be overwritten on next run if needed.
+        pass
+
+
+def _ensure_hls_for_media(media_path: Path) -> str:
+    """
+    Generates an HLS VOD playlist for a given media file in HLS_CACHE_DIR.
+    Returns the HLS id.
+    """
+    hls_id = _hls_id_for_media(media_path)
+    out_dir = HLS_CACHE_DIR / hls_id
+    index_path = out_dir / "index.m3u8"
+    if index_path.exists():
+        return hls_id
+
+    HLS_CACHE_DIR.mkdir(parents=True, exist_ok=True)
+    lock_path = HLS_CACHE_DIR / f"{hls_id}.lock"
+    _acquire_lock(lock_path)
+    try:
+        # Another process might have finished while we waited.
+        if index_path.exists():
+            return hls_id
+
+        tmp_dir = HLS_CACHE_DIR / f"{hls_id}.tmp"
+        if tmp_dir.exists():
+            shutil.rmtree(tmp_dir, ignore_errors=True)
+        tmp_dir.mkdir(parents=True, exist_ok=True)
+
+        hls_time = os.getenv("HLS_TIME", "6").strip()
+        crf = os.getenv("HLS_CRF", "23").strip()
+        preset = os.getenv("HLS_PRESET", "veryfast").strip()
+        audio_bitrate = os.getenv("HLS_AUDIO_BITRATE", "160k").strip()
+
+        cmd = [
+            "ffmpeg",
+            "-hide_banner",
+            "-loglevel",
+            "error",
+            "-y",
+            "-i",
+            str(media_path),
+            "-map",
+            "0:v:0",
+            "-map",
+            "0:a?",
+            "-c:v",
+            "libx264",
+            "-preset",
+            preset,
+            "-crf",
+            crf,
+            "-c:a",
+            "aac",
+            "-b:a",
+            audio_bitrate,
+            "-f",
+            "hls",
+            "-hls_time",
+            hls_time,
+            "-hls_playlist_type",
+            "vod",
+            "-hls_flags",
+            "independent_segments",
+            "-hls_segment_filename",
+            str(tmp_dir / "seg_%05d.ts"),
+            str(tmp_dir / "index.m3u8"),
+        ]
+
+        try:
+            subprocess.run(cmd, check=True, capture_output=True)
+        except FileNotFoundError as exc:
+            raise HTTPException(status_code=500, detail="ffmpeg not installed") from exc
+        except subprocess.CalledProcessError as exc:
+            stderr = (exc.stderr or b"").decode("utf-8", errors="replace").strip()
+            raise HTTPException(status_code=500, detail=f"HLS generation failed: {stderr or 'ffmpeg error'}") from exc
+
+        # Move into place.
+        if out_dir.exists():
+            # Race: someone else created it; keep theirs.
+            shutil.rmtree(tmp_dir, ignore_errors=True)
+            return hls_id
+
+        os.replace(str(tmp_dir), str(out_dir))
+        return hls_id
+    finally:
+        _release_lock(lock_path)
+
+
+def _safe_resolve_hls_asset(hls_id: str, asset_path: str) -> Path:
+    if not re.fullmatch(r"[a-f0-9]{40}", hls_id):
+        raise HTTPException(status_code=400, detail="Invalid HLS id")
+
+    asset_path = asset_path.replace("\\", "/").lstrip("/")
+    if not asset_path:
+        raise HTTPException(status_code=404, detail="Missing asset path")
+
+    root = (HLS_CACHE_DIR / hls_id).resolve()
+    candidate = (root / asset_path).resolve()
+    try:
+        candidate.relative_to(root)
+    except ValueError as exc:
+        raise HTTPException(status_code=400, detail="Invalid asset path") from exc
+
+    if not candidate.is_file():
+        raise HTTPException(status_code=404, detail="Asset not found")
+
+    # Restrict to typical HLS outputs.
+    if candidate.suffix.lower() not in {".m3u8", ".ts"}:
+        raise HTTPException(status_code=415, detail="Unsupported asset type")
+
+    return candidate
+
+
 app = FastAPI(title=APP_NAME)
 
 # Default to permissive CORS because the player may be on another port/host.
@@ -148,6 +306,49 @@ def list_media() -> JSONResponse:
     return JSONResponse({"items": items})
 
 
+@app.get("/api/hls")
+def prepare_hls(request: Request, source: str = Query(..., description="Path relative to ./media (e.g. MyMovie.mkv)")) -> JSONResponse:
+    """
+    Generates (and caches) an HLS VOD playlist for a local media file.
+
+    Returns an id and a playlist URL like: /hls/<id>/index.m3u8
+    """
+    media_path = _safe_resolve_media_path(source)
+    hls_id = _ensure_hls_for_media(media_path)
+    base = str(request.base_url).rstrip("/")
+    playlist_path = f"/hls/{hls_id}/index.m3u8"
+    return JSONResponse(
+        {
+            "hls_id": hls_id,
+            "playlist_url": playlist_path,
+            "playlist_abs_url": f"{base}{playlist_path}",
+        }
+    )
+
+
+@app.api_route("/hls/{hls_id}/{asset_path:path}", methods=["GET", "HEAD"])
+async def serve_hls_asset(hls_id: str, asset_path: str, request: Request) -> Response:
+    path = _safe_resolve_hls_asset(hls_id, asset_path)
+    size = path.stat().st_size
+    ctype = _hls_content_type(path)
+
+    headers = {
+        "Content-Type": ctype,
+        "Content-Length": str(size),
+        "Cache-Control": "no-store",
+    }
+
+    if request.method == "HEAD":
+        return Response(status_code=200, headers=headers)
+
+    return StreamingResponse(
+        _iter_file(path, 0, size - 1),
+        status_code=200,
+        headers=headers,
+        media_type=ctype,
+    )
+
+
 @app.api_route("/media/{file_path:path}", methods=["GET", "HEAD"])
 async def serve_media(file_path: str, request: Request) -> Response:
     path = _safe_resolve_media_path(file_path)
-- 
2.54.0


From c1f6b139e79fe6ee0d053b8437d27c83292a1953 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Sun, 21 Dec 2025 01:06:53 +0000
Subject: [PATCH 3/4] feat: Add JWT authentication to video server

Co-authored-by: mathieumoran1 <mathieumoran1@gmail.com>
---
 README.md                                |  14 +++
 __pycache__/video_server.cpython-312.pyc | Bin 17747 -> 21972 bytes
 public/js/app_player.js                  |  37 ++++++--
 requirements.txt                         |   2 +
 video_server.py                          | 110 +++++++++++++++++++++--
 5 files changed, 148 insertions(+), 15 deletions(-)

diff --git a/README.md b/README.md
index e90f967..c9328ab 100644
--- a/README.md
+++ b/README.md
@@ -22,6 +22,20 @@ This repo also includes a small Python server that serves local video files with
 - Served as: `http://localhost:8001/media/<filename>`
 - List endpoint: `http://localhost:8001/api/media`
 
+### Authentication (required)
+By default, the Python server requires a valid Oscar-Pool JWT (same `JWT_SECRET` as your Node app).
+
+- The server loads `./.env` automatically (so it can reuse `JWT_SECRET`)
+- The web player sends auth automatically:
+  - direct `/media/*` and `/hls/*` requests use `?token=<jwt>` (needed for the `<video>` tag)
+  - `/api/hls` uses `Authorization: Bearer <jwt>`
+
+To disable auth (not recommended):
+
+```bash
+export VIDEO_AUTH_REQUIRED=0
+```
+
 ### HLS (for better browser compatibility, especially MKV)
 The Python server can also **generate and serve HLS** (`.m3u8` + `.ts`) using `ffmpeg`, and the web player will automatically try this when a `/media/*.mkv` file is used (or when direct playback fails).
 
diff --git a/__pycache__/video_server.cpython-312.pyc b/__pycache__/video_server.cpython-312.pyc
index d24902ed056edb6a80db581f4e7ab6f34e00788f..bf420e154bcdb206ccb605195fb96c0c7f7f7ab2 100644
GIT binary patch
delta 8229
zcma($32+<Nb-Tdg1_*!v2=EfYo1jEe5^w6Dc<HhwSt4ag@PUBbB?$@#^>=BB6ll<~
z8<Vv%qOxtx87C7qbrQK!W|&diXvUsIa_otcGzlrNLwYMulw&$^rjx>wJ57~l+V?&P
zl5*T>cZm1@fB(IIz4zbonf!Bh`5K$`V~fSez^6NSAoSbzD_I`ZE$x-6gNca2Z-^NE
z#)!#pVi}&{)nRkQ;<wN`7tV@U{nm)hZ;ROd_DHrro8sB9!|woEP1qT6`CXA5e@?{h
zcSk&aPbAl$OKG&>yhy%3pVoEZf=HpiFtWwJ1=@Olk%|#4g7+HB=x|NUNSAy?msdT~
zO<Ruvf2mN)8zxK)<1a%l_^~60Wj5PUX@q(O^qR02#-iUf)mpjMP7mGSuQcH1%;Bnt
z&+lUyVD$m3Wiu-*EsM7ftNdG`S2c1PC$ZZy1N&<>rncDm?94<X&*9q5yyFGdU$;S$
zaIQ0M=UqYtpCecXIo|yW=ikA51P`?BLPaht7O=U1-MNOXhjt#c8~A*|0#p^yE`W9;
zUkIaY5t=Axw$LOr4XTizj-lm?fTo#$nsRxCrUYLMq$QNxDzxw{&km|7sgW;zMdNSX
zG<+Gbwry&cLwgs0im!kLRN@H0tL3YJYd6JVo8x^zwTG`>U*uM3@8!3_B5UCH1nyVM
z*8;MguLHz(_~CA}{0_kF<99xWs|Q>MoSsW4y56vUa-AFJX=&t}9zXIbf0xk3H=V6w
z7-Hs|hFE{MU`rpV(8D+HhNFq@6}m>gh;l4!$qd@fTxJGTL-2d9lwl^BIFpv3USuyh
zGY#3VHg$Ciog<gi+O!!8`LL>kLU(3BzIBM<+rGx)60YyMrb*MX3~<Xhb@A?X${eA7
zP{r?gg}b&kp#N}&s(kM{Ra!d=;fUKeQ9hBO+_Nu33F~n49en5YuFS~{vQ&$@=~)-T
zS@*o6S)c1k7~u_EQR9C80Do{ub^TC=Z(VHZxpN2g{NYV=AI)&~Jn<)-Pr_UoE-im#
z6W1}}DgG!G&j?&SHhkQFd_$h@WBgN@+5IN~-?Y(}f1E#&>C5cZ-@DOo>HX~M*9RoW
zNB$PKnCKHu2)#nz^^@1Qj6lZOaki8Zs>>L{vCJ7}R(0u1=a~!YGt7B*K*fSaOfu&g
z-|3H#;i!*O45L9J3W0NCSTT%|un--H@q(g<syG@BNs19_V^Lc7u?qK8P#Q+A142}g
zf2;Yf3y`L8EXW7=m?T7BnBZyw%2%}|4#(4nx_gcVI!^W-44mjWe)7<X9=WQ$#H<((
zpXv+r_H>=->AUem?e|oyMV>L7VZHLN3;|6mtgBK!VEhlSjtJ+*1W_7TvvPEcxKTCy
z9(J<wGp1U3q26R+<1A6d*<Mt0PTu9LkZW{C;{{d(!@Q2#w%w?oRK-<fe_SQss&>lT
z)q44Uwada~PM=gl&$o3>C$HhP8PV`sv?n7Lw0{X05{{5(dYN&?r#q@>q}W*@s#t<!
z(r}D~CW2BZ2F;Gm%?Vw<5F`TeK4QHe;ZA%y#SHr*;{iDNU_?~ZLxQB}hJ_$65Ruda
ziDDF`Ad$rLA!%6Aq~)Lyr349$`qZQiDcExghtrC97+$ZJv>-MsAY710a6k&sm61b$
z+y_7LRRB}WeZ6%>U$CSvSkZfz^xk=QQtzAU_&}#$wc4ijDJ^4mTyCFfUomZ2GHsbl
zBu#a9O{W%`ztjHh_LchmONsjZw-U+vQ&Zg^=uETR>&7ca*}P(_T(VVOH7wh9u38<J
zCuSz*O6Sfct;O@jOV+X#YxR<~I%(Z@*V?eaE$SOqP1c977UnUbqB&U;D#N_aNJv0G
zQ5Ay2maq@Lrx_4uMp}~~b<rZNSt17R9<REt&WP>vtfWmd!R9wpalB?Tm4T5A@{67V
zZ+sI2uLUEgyS6rKFH_1$dU@VcunjJiV^a0locfK?;;PT9cxF=dqUt;g3?0P<iT^)C
z=8pOdM?+UYO(xu^MM6{x4N$G};$;XCfhQHPua7=KlC8Z0c>y#l5)ubu(ZSHr81%P!
zH*QzL8xp<InB)~f!!!qbcQ!V`bu|XVL!hnFa73K&9E!dW42O7cjCh3$qd0+=s*X<&
zdc5i8c2iv<7MPqA0Z`N<=OsnU3)Eb=deXeTp`mC{f@Sm&5+h2&zBYUx-V=&j(_ey~
zi!=jxT!AftwS5Lqxk(=o96_Qt08B9-nmnsk`?TTL=DfM)q`7pe=L3`NURM59^<u-3
z<*cKN`lBD3Tx*Ena#o^$QQx29G@3K)J!>}A&GI+%Zn|$8maUzO`p)0qGi9xq%9c!J
z4;U7S(nB3x&N{Yu^7Nwq^dBgJcgf`a-w0A_WPBu+!UDfj(BWimI~|={)VC|MIvUmX
z+l@KUc-NHGnX7&`SJSyg-fjAO)-69U?bPlB4pJ{yn@iY}@)2`E5xv2Vz!2CxF#rMu
za|-u(d{iKx1JZyzZ9c3bhi@#KZE7tl0of=2*4kP|_G29dqiBXmY;06fhoX|Aj)bB<
zJqcoGzkJBH+e61UqtyX>PlC}Qft-Wh;TvDERj{VRNEkyfdgG_|9W1-=OOC>V5kM$v
z@CrU1Ik`cBH6ph<%5&(T#z06CNMJA&7DycWW^YK2Ikxc>lAT8IEC3NrH(07QQ)Lef
zhd;H=DIoZ=+~GRO9=`FqtC7{#0fN-XcXN)y5f!`h*%o<^+pWQP<s0%D_c@^ZvHM3V
z_GS66@~YVi`F38eb_{u*k?-f#veU9PzrdM388IvfqdtzzV)qrfJwGp(F5MCc4$zAg
z2*(D_lCMJdw{DR9OKcfZifFLc7L2MH7J_hgl=4mJxpkwYa9Ov5JPGv)=ip#uR2ZW7
zEffU<9uBYF)}w?T?#n<$wgPxdt}L(LkGmi)0E$+)5E3O((L~PjAwt(caCk*44v$Hp
zu%aaqi3kGu3yK7H0WLNz_Gjez@+$D3KP)fGBFAw=oWN%xUzh*0yqKMp^D9~k@tTnz
z01)vkPz38AX^}@O@-<6<zjI@@;vF@6=f;t0pQ_vkn2D^6bvXEBuQ!x7Jp?tKlp!dW
z-`Lh^N?`Rx1l96yw$+@$Ip`|LHmu<eNi6~@&Fxs*fgr8_Q1fZX9Yov(pl~D>lSm`B
zsdYg6PFD*njn))uSD;<M-ndfZVNWRPF%qJdWMC~Jf=-6f!w+ru!+!+;-UMYxzfI0V
zmGLPIvtiD`{ZG|9`+4@dD&t4iy^Wez$JH;eL=$J@P)GA68P>*S;;IpvcV^n@60qjS
zG1vlZmK@A>xa^s}xH>ZnEWlpmOblu=h+f9W9qj{~Z9fa@8|V)Qqh|wPu)##oefx|A
z4@lwo(11j6(~5@176iQ?=+D5g5D^q@RFFVv(>EBep`sro!J!Bk7`PIvfS{u(8n6wL
zm>>rL^C#C8gOPMt5lBz*3!rL*!xf)_$`o_Y?40d=?Z{NmJ-zwTnc1<|FJ8I0z%N^N
zCH1?fI#zXAv%w{ud)1XU%}!U&81I=}Koh?bpFjD{XaD-yg~so+eY@?Q@jLdn_r~v>
z{MqwAe10+K*`(>YMeaFzeH7iAN&IYCL(UDd9s>6(&lY&hnFH)*o*R<wO(ptCF3u5q
zoRe=CIx#%tNcLJBIFf7jUTTSRlbTHe1u<t-U{aeVRK?X09lDA%aV@XT1P7UUSmsiQ
zV|We%#S2>t5+FCt#LGrh+zy@>z3tSe?y0S<1@Gz=f&;_elP3;&!=b3)tr7()32~eE
ztT2vvs0q?Qt<M{ZdV}84aBw^f_Mw&zcPttnhcU)Lu;|*OH3P8-%5fWQ2$4}~+#627
zxMG^V?-5%{_JM$i003f7BMm2UW-)C-x&g0fgQKHDlqV=tdU+LYBnA#dM}CPIRCmP?
z8<PT*Q31blo>mnO5mbc~0};+cSOLZ<A>xw<y|x*1?*Z$Hy+R;TKh_f1P$q)6bPuZ0
z7ojr6q>N0#mZ?Ll&ioZ;#gemPUP?N*Jzxx)z0(k;x-Y*t^J3CkG|hcrb<9eyC$1#s
z#bx)_RkLfwT(D#=m^-~}u6T0Q?7W|qJ+1z=vwVKwYGcy5W7@E)x3B0uOM1_oXC>FS
zl<T`%dUgC}aWZ%JKk4_R956x3$(XY)H_tTBwkA!5i(Da9Jo&BK{cK83)y}x78K-VT
z3*mYg0+c_(ng`_Bx*Qw!O&IHfqoKNpz=wkJxx$=^zoT0DSr&+8q;;D`buv}wu(A@K
z8~w0XR;u&mn(ZDnq%D}3K+0lqf2L6xv0{FbE!i^cV5!(kjlfo{cgp|ha>x(2J22zf
zGO3QUBkl~@Mj2OwVaml(<eWU0ngeCuyThF*%uw*!I2&R!>JIv?JK9IS3BBas08Hr8
zo38Vz6)qZ#2&5mdXrIH12813FeO4OGks4(A9(HQQ7?A{C(U75Vtp8I!fixgp-2lQ@
z5c~^*KSS^Z1la(<bYUt)SU6;b9VM5b@hPii#ETQ4@*o-@8%9050d!N$uQ~f{<uaFd
zPp;hg7JFD;+WEwBSkf375FWEIXh^9y`7TsG+nazak%E3;H((C@Fj0{0tq!YtL#mLC
z>fwwXx-}Xq)rI<8@ZdkH{|B~AeyJgky(53Qp{!k(J}*p%3A$&3R#wsXV*rB3swJWX
z`C$4awCR(;VaeB#_>TOjp{$mws%ex6VAlnVw}=%eCgCSWfNF~Q#K~x~)5l=<$=!_s
zIEXhJ%e4=1jEC~i8uPcJV|y8X4~Ib`pJ3R>&p?&gEuMk=-;Ft*P40BvuYvKUuGPr1
z^r@r?wCny_3jPI;vt&{e=Om09=oepif4quUe_1`Lm8|ktnmlNLr*fQfSuRc9t9dOQ
zOpq|dNOP_)XDw6LP3q$65jQ@T)aiM{b>q5G*T;3lEMab+=7jd9KK)2O@|@IXwl`^z
ztn0J}9-PU>dZqPC5;tV%Gi7=Q*G(CJ0dEwKZ9VaSZXJ^?`bou^8U!HbxCY*JK{lCz
zVM*FJcReff64c9lOMRa8S&tG-w;$=Fu^Lf|5y7W^WbR7m7Bzk2qq4QxoA?OBueVgB
z5(?6VfQEDEFbIl19nHN1HOSt6iHHqKPzp#y0KBE%z$!+1<!JKav!@jq12-}SK+#47
zcrM}BZ*wB8+XRi*MpQ`iP4p@7v?SrH2Kosyjo<<T2ZA^Nh=JC_$MiKgiCxblKr58q
z5%pjk4g|qcPzs8u*J%%>#R9_1#b#Fm!-&7c`vK4A%x{?AZ?Y4nlKG~qZAnwpRQEk|
z;T%u%&-=QpS6_VT#krijx*~l37@rw`?c$2HWXW1G&D}33zPF`#zU+<AYGLKaI?iF7
z)_r1RY@Ye91^2SGby436Z!UWCs~2CoxT5nc={$*~E^lt=uCDx^ZOh#Gq^<I<t>)^^
zX$=kyj&E-0YG@kVUkkWDNPHbzuXZn#Cmk)*-AHh8<|1Up*3xP2p4GkT^sIXFSIev4
z8F;Vs7XN+U+tI~9XvsP9iH@@wQw(P?rp%1lcDZ$?^|f8;7oVx_?A4;Ochon#-!?4v
zJ-?I{m^yGzeyU{~*S)=ar##iNt7ZAKjKI3dd(04Sywsrkx?Na+!8JFjh6fjWt6M(1
zy;45b>SC?3&|1TK<ST8t?g9y=N<ZEhV&aCcv%E>lm%rayYFfW!Qjz>|YbBd6=eG3#
z47BZ_-1)3S{#IM=V{}VxTUnd@$F`#4^>O365oczOjWVv2ue3Vl<GY$!L7v&woS+I$
zRh`}k_>U0kei;<Rfxv|TZx+eHniGK=!TNn59%xQz`^O~+)E==lG-dLs(xj!(_t8&*
z-Dlfm<~Q71;&V7Oow^fi=MbQQOkWbZx+-ku;hg9hHr)pcDMBpujr1z?V?VtQL8vKO
z`U1ey{EE(@WML2)iv}`pkg-$9F-nOc_aB01Mw~o-UDjaw!O<k*6V#fAt%hmehM)K~
z0H3-%rSpf9@LbEbxNa2hNw5u`o+|cszOB28xxKY>4>aDZGW3+I-`nBq@v7g?W1;?j
zz6S8`do@@uSNBxO%X?4ChufPIPm?paKum|pGJ;zOzK=jgFatm_gO?14`fKTKX>LR~
z?9?Ej>5*;}9<zaj=#X9uPc5P75Yb~lrgj8P1Ti6a3V@;;3_?~9Z)7e^>(b)L!Ww!8
zVv~Q@UYNk7PO+~M))GM+jYUO>v@u>ui|7wXp%2i<l0blF##AB@!z=pEj^3U?_n{N%
zFzH=nqQXTF2aj#^g`MOe`fm_4AR6+b$SA(N3^ELu(*4+R3;}u$LgR-+So>!LeF#2>
zAcTPGRS8IoT2gAB$z|;LDuOo=EFqxA`xjWFR`?Or6x%?Ihyi#=9D>)50KQ117!TmB
zfj}?{kB;=&QiLt`0JZ$PeeMdX$`~=zSd7LZiUAHZ0Iyc?euTD{RI~Dqj-1x*Sl@wQ
zCxZ8Y39?`|MjvFhQ{8){-yMnZV_{)0*$*`E$A~f~PjwVHe$I3ynXV5R&(E3WB-8vW
z#`tsj8y(O0YgogFT*)su>#TmRX~|Z+%#}d8VRz4I7p+B8=KChs^v=s|Gi{4G+mfc5
zDgAw0?yTx{!xh6~UfqHtX=_}u?OL+!O4{};_6#rDhNmp6mYnGmm(R?cnT;ncWm87E
zsMA$rWNmW?QVbMV^$U)-EDy1o%CoX(*tzBugXO&Rkd~=3xuNsl+fq9<?DOngeTu<y
zUQCx)#fP+=vf0=z^8+aciiJ{I+$?>Ft&c0@tzGXY>}>U%F2z7G|KtNK9;z9YJEekJ
zs)|u*UUk3Zp3Y0M&X2W>!!xH|^gX?ted=S4lhv+ToGCSw_s!N6w!tB3vmfZ7hGV!=
zD#X>|7=<qtE?T$WY`j%*vu>&|$sSIrN?7eYtfwE!1z0;2x7@V2bNT_caEK>ZN|!ne
z|Bqf9q-vq@X2k*>q%)<egFzfA28yfaX>qgV0k)923z(sr;^iN7i|xNp4P`NUJ3Pg*
y28GkZ(<^KEuLlzb#&v=fw}AZLZLlA)GC$biI+D-b(PabtiB)sNqyCAT1^7R9EY^hp

delta 4708
zcmZ`6TWnOv_0HYhyKAr4>j&%gYwfl1g9VIjjKMbMVPoSLp&=AC*{WF<&)8mjAI{us
z5?oW87O5enZPKX}nvjSDRU*PkX{;h5RfH&^jnXJ30x9Wjo+?#BKdJ>%wT-Hz=geh|
zL(`G>+%t0?Gv_g9j<1|1mmeXyfADy+6&QnkeX%FjK9*aoo^m|4qJM-aRH3$bRw6r`
zop6WUiJWjw!V~t$b$dKF;SGBedEvZ7emFl-5H3g*h6^Rl5nq<@g?$p&;zbF6*q<m4
z7sK2cE>RWcVx^}E?x-l^8^oc?(v{<F)^sTh2Uvi*rrnAXu0SF9k@3yq`oOX}K!ZTc
zMq)<OY1I<W%q`7%;VSB;Ib&+L8idsG?c!}u;jAaa6t1DUEJ(e~HDafEhwb57n$KJ?
z55l|v=5@3X=*w6=tmQBdt7r8iY6<LwzY&f4fM*3Alu|{&<%eIf<j!UxN+=nzNzQCq
za@Y}GX=$I8>Pta%)spSXV7{6T(Q-II09AmnMk_$9L9XH4PAh?H4Gk_HvI^#nv>Fb%
z{FWgat%0>BFxSgU=4%&CZMGZ;=N4Byd7e62pK;kZ!yv2(x3CskKe0klcn+-}CE<0<
z&4PG*)=F1&!Z*2@wTvgwg(M`tu$2)eu6I`26idO*$JC>>c4b&SsDNnmcnT!$7|aKU
zXk+U#hoUP-6}swKg4@lnKJBpBi2~9(Zd28;$mwMrBPv~U*naw!&hW-XuEr%?e&A|a
z!qu7K+SHukf-~gPwX|h^UB&|=gtoE*x?Z}_4{qOZ*s-|JCeUyYPt)2)+iAzBI=?X^
zx9E73_Oike7wufK_m+%g@23Be+zfkVq%^u^iPTosMYqZ@j8lb@cz3wl3LT!o-$lDK
zyN9>Idi`x$**4mfp=E3h_uQs?dg=BI-3nO_?b}bny};5veiYS*`q?(t!+PfjPTMoV
zI6w}NVU@_hKB$CtTtmW65p=#KY_95sQP+8uWQjWWeWXy#xg(C%KrR(m-T!phC!@xg
zc(klYTq-z53Ph}MtyT+EUMHR@tgdJP)U>gO4AU`e9GGM#iRid%5C&f*J}xYAU|nbt
zUltCkH<g8<WqCFY^YI!HQGa`u>Cg=xo8(#I8NXla00Q4A&igxyR{?6~L?)wLXAvGv
zjxxRjmO2*-itC8G9T^7^3@vOcX(k<;5XbTna+vniBukohov{hi&RLZ5ULcsZI7^0{
z98Y{p6tTO+3#GM1a<}YA%wRk+5{onbEuhhbYo*6XYa_BXAy@}siFGhD^CM$%Ju;k1
z8Z2o<&;$J2us$iymhZ9SDbaNcwSjV?Rl|%2MPJ3vcFSv=#Z6T=OxpxI@U?1VG%}Ln
zkp!c$C?5y$Y4KLY1EhUnYvmg%xnH=eSIWCR3M3epwuEv`yAew;Q%&joZdl?iVo&uN
zIt(ZTD4x=p>D><Y^*$8S4ZWB16z5rzsK*(b4B7bvO2u)>sT)ylFlwqJ^p4|sBGKUo
zred5$;;G>YJ`L=L7CxyyN@`GC$A<x;k4iidu#!a~hLUp@)_%V5c+C~3E%q4^$<-x3
zOop9Y2K0VFc?E!wIKH}NJ6g>10hk(-=QSOP2^!;aKaQ$QO&^;wVsTUB34=4nv0j<l
zD1&J1=iMmZB76-iAh$O+ROXu+Wy2}TtUWw@PE0gZkqPnRhPF*Bk@*<_x(5KJ@8Ym5
z@kLltp8}IH;J3pv58THW)HT1gk&_EAH;2^Pa#)$p9Z2qv#$z<tzhieWMmbu^ixBt`
z6bsL~Zg&{b`w#>~cwNJN7zuecUWpi*&Z`i})LD*L4Fc=_0Ty!bleq9a07&&z%HUA?
z6^_Q}Sc#<#a1TFP7tmgWd0JVpwH6c6v2i;&D-LZu;+Kw>q0+`!G;WOXSAnlwRCN|L
zA#FOlF*+G*lsSlLv^boA+2D8cX$be@iUFuN<0=!!Itx6Cft$-=C?Z@N5LY^j9b|@#
zXUW%wjAx53PoX&8UnsU_xk5&6hJ8Qb<Y+4}qVabO*g`xKTn-Z1WJY`$@@X?FaQgA(
z6W9BFo9#2|lgd*nbsV>4Y9~>S9<eJ%Sw<DrW|SDoP<JaK=gx2P?*o<pMg%weW;X(A
z+NOBibU-mk=%HL5MCvbaUDH$YLOA$nJhktRSnzt}laY!@=IA7pA<FmSaufj?8M5);
z!^b3(9B-|T9)uuSDV7~Cg==~1zP|~SDsZiS8jv~Vs`y~@bEI87yk)4z$=L%_3@Qg4
zXo?TBVHH?1Ljy#{<rE+g7f@l1nMJb?s)kKG&|jEiyB(()LCSsVX(D#4EfX&Uv&8qd
zdWl>7Wb4^-%-Cs1BjkPKw7W5ur0k(JiI%B0u;rxK+f~z{@zub>@hb2Z0H$jn-gxw)
z#;y7;ZP)l)$nr-7a|lj~SG#KJWcIlyIfG&^uNQv@h^=Tl17uG5ELSO5DSX`#uz#w%
zRy&8XFNqV~W%VvVe*nLm{{b+hkgr;-fX&i3Vz#Y%a2y||JH|n~fr%`~%wpCYbj&ym
zyp7hnJ(Dlc4XVd&2Q~5QK+!O@$p_wJV8M`s+Gn(RN9K9ntr*@6#aK+|85^XaojRwp
zq3^{w!9ckg$Gj`^Uhh_(w>?NgSvy5rZ~H8N30SVZ4&XVJm%_(%!cB!LrppJ9<J0$?
zO;Y$rNY0j*RX#?cERNTHNfP4gWCck}Fk>u5c@D1NN#&ylFXTzYv82dw%~~%eUJSk-
z!AAgebQ<I>4l8%PI^+AT;uzI+X7H=PF@P~V49KU-zaWL()hE`U>bUG)KiBiF+xye@
zBke!h_>Q~cZFj|7&wDw6WAt*)^10r$rj%5?R|?Z7L+_R>&${lkd$qZ~bdET3SG9Py
zug2ch(bXy5=-cQ#55a|?i@lwG?VviNj@z&n6n|}?ZH5za-cMYz^4#z&6KDFD5s$do
z-$07sUy>4k`Rypt?3gl>^-DtCMu}KHu-v^^K#YLcHBe7V#DRfcfG-a;OX)I_FFb=K
zU*T&WTt#xlcLpo{x1;YIF93Jk8sgw!rFe00J=r3z4Q`mVVtcEXkZ$HCaKbhF8+`bm
z5xkE86M}z$;5`H%BEU44slY!5Y+BoQz+igtbJ8FmoRDg<V&8WSFJZ`Q-Pyf>Th*xz
zA5<%WZ18}}ZcFwCR)XN+IC_Eq1p!|3B}wDqf5ioPy&Dj_oh}_PH8t7CQTZ@gd*lwM
z5{XnYl1b%3r4Pi0Br`N>qsG|(dx+gurdeIl4G`FiS@r|~E6Wy=JDw!#JiP((N?u-1
zKzSwDy$L3-1+sceZLigZdVRKwUIO^VJO`{_^f?eOwe<$Xrk#64yQ@n4Z0CmAKHiLm
zU`N4!h2RMUPa#Mmpa4uKcE|D9K8`op)S&;1B}X~d8ICU?$70O!u9(h|DD+d4F^(0>
z@+(vTg}V{p6*T>~IMyU$l*UEs8}3=GEM|UYoilwhmDHIoUlPmvuONpjBAeDoM0N|(
z+0c!euI{egy^)@Qd#oqyIPN6lhUqAuE7J*4n8bc}D=x_@j_o?{L9k;j!cP%kJ1iSp
z*@oV3z^s}tOUwmi=@xtME-F6@sOgPFqRC{+h#E0CbR+_u{$xC6h)3`C&;A`5>@+rP
z$ZmtbiLzMq%`9+Hgr}yU5x<Iy7+<t68BH+I;hfqZ8&2^g{{o3$B7mB&@TUO_5tF23
z@7W|v(&w(uM2b$u*=D{Bc;HXbFF>5qHWA!aoc+F1{Gqbpva;b5F|_M`aeh~sFRc|3
z-w8dfz~_{46F=#-;;wuCp<Z7rW_Dkk%_A!x-El*K&rO@6`qL_4={iMq{Lp{M|8VJL
zvg}Vyt!IWW^%+;1rmh2@cFdo~&#C3|lU9`Pl0FqRXsE%58Z=8o;85U_x9ME#g}QT%
zbAiibFs&96?F0zI=S&NJ?$s`UI+(tG?+yH*iXkHT(yQ?lQpbujt>@~_NFCj2bq(k!
yOe^p?^`QKmYrBCnl-&lhfTs6}>OFeNzi(`_E53V(j@fvz#W&=&|1PTl;C}&|m{N=Y

diff --git a/public/js/app_player.js b/public/js/app_player.js
index cd89673..2d35165 100644
--- a/public/js/app_player.js
+++ b/public/js/app_player.js
@@ -90,6 +90,25 @@ function looksLikeVideoFile(url) {
   return /\.(mp4|mkv|webm|ogg|ogv|mov|m4v)(\?|#|$)/.test(s);
 }
 
+function getAuthToken() {
+  return localStorage.getItem('auth_token');
+}
+
+function withAuthTokenQuery(url) {
+  const token = getAuthToken();
+  if (!token) return url;
+  try {
+    const u = new URL(url, window.location.origin);
+    const p = u.pathname || '';
+    // Only attach tokens to our python video endpoints.
+    if (!(p.startsWith('/media/') || p.startsWith('/hls/'))) return url;
+    if (!u.searchParams.has('token')) u.searchParams.set('token', token);
+    return u.toString();
+  } catch (_) {
+    return url;
+  }
+}
+
 function isMkv(url) {
   try {
     const u = new URL(url, window.location.origin);
@@ -109,12 +128,17 @@ async function tryGetGeneratedHlsPlaylist(rawUrl) {
 
     const api = new URL('/api/hls', u.origin);
     api.searchParams.set('source', rel);
-    const res = await fetch(api.toString(), { method: 'GET' });
+    const token = getAuthToken();
+    const res = await fetch(api.toString(), {
+      method: 'GET',
+      headers: token ? { 'Authorization': `Bearer ${token}` } : undefined,
+    });
     if (!res.ok) return null;
     const data = await res.json().catch(() => null);
     const playlist = data?.playlist_abs_url || data?.playlist_url;
     if (!playlist) return null;
-    return playlist.startsWith('http') ? playlist : new URL(playlist, u.origin).toString();
+    const abs = playlist.startsWith('http') ? playlist : new URL(playlist, u.origin).toString();
+    return withAuthTokenQuery(abs);
   } catch (_) {
     return null;
   }
@@ -221,7 +245,7 @@ async function playVodLink(vodLink) {
   }
 
   // "Open original" button
-  setOpenOriginal(raw);
+  setOpenOriginal(withAuthTokenQuery(raw));
 
   // Prefer known embed providers
   const yt = toYoutubeEmbed(raw);
@@ -252,7 +276,7 @@ async function playVodLink(vodLink) {
     setSourceLabel('Direct video file');
     const videoEl = showVideoPlayer();
     if (!videoEl) return;
-    videoEl.src = raw;
+    videoEl.src = withAuthTokenQuery(raw);
     videoEl.addEventListener('error', () => {
       // If the browser can't play it (or CORS blocks), try HLS from the python server, then fall back to iframe.
       (async () => {
@@ -275,10 +299,11 @@ async function playVodLink(vodLink) {
     setSourceLabel('HLS stream (.m3u8)');
     const videoEl = showVideoPlayer();
     if (!videoEl) return;
+    const hlsUrl = withAuthTokenQuery(raw);
 
     // Native HLS (Safari) first
     if (videoEl.canPlayType('application/vnd.apple.mpegurl')) {
-      videoEl.src = raw;
+      videoEl.src = hlsUrl;
       try { videoEl.load(); } catch (_) {}
       return;
     }
@@ -288,7 +313,7 @@ async function playVodLink(vodLink) {
       const hls = new window.Hls({
         enableWorker: true,
       });
-      hls.loadSource(raw);
+      hls.loadSource(hlsUrl);
       hls.attachMedia(videoEl);
       hls.on(window.Hls.Events.ERROR, function (_evt, data) {
         if (data?.fatal) {
diff --git a/requirements.txt b/requirements.txt
index 3fb50f0..e1b0cd6 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,2 +1,4 @@
 fastapi==0.115.6
 uvicorn[standard]==0.34.0
+PyJWT==2.10.1
+python-dotenv==1.2.1
diff --git a/video_server.py b/video_server.py
index 99bcaf0..db990af 100644
--- a/video_server.py
+++ b/video_server.py
@@ -5,9 +5,11 @@ import shutil
 import subprocess
 import time
 import hashlib
+from urllib.parse import parse_qsl, urlencode, urlsplit, urlunsplit
 from pathlib import Path
 from typing import Generator, Iterable, Optional, Tuple
 
+import jwt
 from fastapi import FastAPI, HTTPException, Query, Request, Response
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import JSONResponse, StreamingResponse
@@ -17,11 +19,22 @@ BASE_DIR = Path(__file__).resolve().parent
 MEDIA_DIR = BASE_DIR / "media"
 HLS_CACHE_DIR = Path(os.getenv("HLS_CACHE_DIR", str(BASE_DIR / ".hls_cache"))).resolve()
 
+# Load repo .env (shared with the Node app) if present.
+try:
+    from dotenv import load_dotenv  # type: ignore
+
+    load_dotenv(BASE_DIR / ".env")
+except Exception:
+    pass
+
 # Allow common video types (what browsers can play is separate from what we serve).
 ALLOWED_EXTS = {".mp4", ".mkv"}
 
 RANGE_RE = re.compile(r"^bytes=(\d*)-(\d*)$")
 
+AUTH_REQUIRED = os.getenv("VIDEO_AUTH_REQUIRED", "1").strip() not in {"0", "false", "False", "no", "NO"}
+JWT_SECRET = os.getenv("JWT_SECRET")
+
 
 def _safe_resolve_media_path(rel_path: str) -> Path:
     """
@@ -48,6 +61,37 @@ def _safe_resolve_media_path(rel_path: str) -> Path:
     return candidate
 
 
+def _extract_token(request: Request) -> Optional[str]:
+    # Query-param token (works for <video> and Safari HLS)
+    q = request.query_params.get("token")
+    if q:
+        return q
+
+    # Authorization: Bearer <token> (works for fetch/hls.js)
+    auth = request.headers.get("authorization") or request.headers.get("Authorization")
+    if auth and auth.lower().startswith("bearer "):
+        return auth.split(" ", 1)[1].strip() or None
+    return None
+
+
+def _require_auth(request: Request) -> dict:
+    if not AUTH_REQUIRED:
+        return {}
+
+    token = _extract_token(request)
+    if not token:
+        raise HTTPException(status_code=401, detail="Authentication required")
+    if not JWT_SECRET:
+        raise HTTPException(status_code=500, detail="Server misconfigured: JWT_SECRET is not set")
+
+    try:
+        return jwt.decode(token, JWT_SECRET, algorithms=["HS256"])
+    except jwt.ExpiredSignatureError as exc:
+        raise HTTPException(status_code=401, detail="Invalid or expired token") from exc
+    except jwt.InvalidTokenError as exc:
+        raise HTTPException(status_code=401, detail="Invalid or expired token") from exc
+
+
 def _guess_content_type(path: Path) -> str:
     ext = path.suffix.lower()
     if ext == ".mkv":
@@ -262,6 +306,33 @@ def _safe_resolve_hls_asset(hls_id: str, asset_path: str) -> Path:
     return candidate
 
 
+def _with_token_query(uri: str, token: str) -> str:
+    parts = urlsplit(uri)
+    q = dict(parse_qsl(parts.query, keep_blank_values=True))
+    if "token" not in q:
+        q["token"] = token
+    return urlunsplit((parts.scheme, parts.netloc, parts.path, urlencode(q), parts.fragment))
+
+
+def _rewrite_m3u8_with_token(content: str, token: str) -> str:
+    """
+    Adds ?token=... to each URI line (segments, key URIs, etc.) in a playlist.
+    Only touches non-comment, non-empty lines.
+    """
+    out_lines: list[str] = []
+    for raw_line in content.splitlines(True):
+        line = raw_line.strip()
+        if not line or line.startswith("#"):
+            out_lines.append(raw_line)
+            continue
+        # Preserve original newline by rewriting only the URI portion.
+        uri = line
+        # If the line already includes leading/trailing whitespace, normalize to original.
+        rewritten = _with_token_query(uri, token)
+        out_lines.append(raw_line.replace(uri, rewritten, 1))
+    return "".join(out_lines)
+
+
 app = FastAPI(title=APP_NAME)
 
 # Default to permissive CORS because the player may be on another port/host.
@@ -287,7 +358,8 @@ def health() -> dict:
 
 
 @app.get("/api/media")
-def list_media() -> JSONResponse:
+def list_media(request: Request) -> JSONResponse:
+    _require_auth(request)
     MEDIA_DIR.mkdir(parents=True, exist_ok=True)
     items = []
     for p in sorted(MEDIA_DIR.rglob("*")):
@@ -307,12 +379,16 @@ def list_media() -> JSONResponse:
 
 
 @app.get("/api/hls")
-def prepare_hls(request: Request, source: str = Query(..., description="Path relative to ./media (e.g. MyMovie.mkv)")) -> JSONResponse:
+def prepare_hls(
+    request: Request,
+    source: str = Query(..., description="Path relative to ./media (e.g. MyMovie.mkv)"),
+) -> JSONResponse:
     """
     Generates (and caches) an HLS VOD playlist for a local media file.
 
     Returns an id and a playlist URL like: /hls/<id>/index.m3u8
     """
+    _require_auth(request)
     media_path = _safe_resolve_media_path(source)
     hls_id = _ensure_hls_for_media(media_path)
     base = str(request.base_url).rstrip("/")
@@ -328,19 +404,34 @@ def prepare_hls(request: Request, source: str = Query(..., description="Path rel
 
 @app.api_route("/hls/{hls_id}/{asset_path:path}", methods=["GET", "HEAD"])
 async def serve_hls_asset(hls_id: str, asset_path: str, request: Request) -> Response:
+    _require_auth(request)
     path = _safe_resolve_hls_asset(hls_id, asset_path)
-    size = path.stat().st_size
     ctype = _hls_content_type(path)
 
-    headers = {
-        "Content-Type": ctype,
-        "Content-Length": str(size),
-        "Cache-Control": "no-store",
-    }
-
     if request.method == "HEAD":
+        size = path.stat().st_size
+        headers = {
+            "Content-Type": ctype,
+            "Content-Length": str(size),
+            "Cache-Control": "no-store",
+        }
         return Response(status_code=200, headers=headers)
 
+    # For playlists, inject token into segment URIs so the browser can fetch them without headers.
+    if path.suffix.lower() == ".m3u8":
+        token = _extract_token(request) or ""
+        text = path.read_text("utf-8", errors="replace")
+        if token:
+            text = _rewrite_m3u8_with_token(text, token)
+        data = text.encode("utf-8")
+        return Response(
+            content=data,
+            status_code=200,
+            headers={"Content-Type": ctype, "Content-Length": str(len(data)), "Cache-Control": "no-store"},
+        )
+
+    size = path.stat().st_size
+    headers = {"Content-Type": ctype, "Content-Length": str(size), "Cache-Control": "no-store"}
     return StreamingResponse(
         _iter_file(path, 0, size - 1),
         status_code=200,
@@ -351,6 +442,7 @@ async def serve_hls_asset(hls_id: str, asset_path: str, request: Request) -> Res
 
 @app.api_route("/media/{file_path:path}", methods=["GET", "HEAD"])
 async def serve_media(file_path: str, request: Request) -> Response:
+    _require_auth(request)
     path = _safe_resolve_media_path(file_path)
     size = path.stat().st_size
     ctype = _guess_content_type(path)
-- 
2.54.0


From 65cc7ba4d760b4420c073c19cf645fb2688b348a Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Sun, 21 Dec 2025 01:10:37 +0000
Subject: [PATCH 4/4] feat: Add adaptive bitrate HLS and concurrency controls

Co-authored-by: mathieumoran1 <mathieumoran1@gmail.com>
---
 README.md                                |  24 ++++
 __pycache__/video_server.cpython-312.pyc | Bin 21972 -> 27473 bytes
 video_server.py                          | 172 ++++++++++++++++++++---
 3 files changed, 175 insertions(+), 21 deletions(-)

diff --git a/README.md b/README.md
index c9328ab..266ab5e 100644
--- a/README.md
+++ b/README.md
@@ -47,6 +47,30 @@ Example:
 - Source: `http://localhost:8001/media/MyMovie.mkv`
 - The player will request: `http://localhost:8001/api/hls?source=MyMovie.mkv` and then play the returned `.m3u8`.
 
+### Multi-stream / adaptive bitrate
+HLS is generated as **multi-rendition adaptive bitrate** by default (a master playlist `index.m3u8` pointing to multiple variant streams).
+
+You can configure variants with:
+
+```bash
+export HLS_VARIANTS="1080:5500,720:3000,480:1500,360:900"
+```
+
+### Concurrency (many viewers at once)
+- **Serving** multiple viewers is handled by Uvicorn/FastAPI; for heavy traffic run with more workers:
+
+```bash
+export VIDEO_SERVER_RELOAD=0
+export VIDEO_SERVER_WORKERS=4
+python3 video_server.py
+```
+
+- **Transcoding** is CPU-heavy; it is throttled with:
+
+```bash
+export HLS_MAX_JOBS=2
+```
+
 ### Install
 
 ```bash
diff --git a/__pycache__/video_server.cpython-312.pyc b/__pycache__/video_server.cpython-312.pyc
index bf420e154bcdb206ccb605195fb96c0c7f7f7ab2..5fddb13a1e258d67403f77cd0588b53131b27851 100644
GIT binary patch
delta 10716
zcmbVy3s75Emf(B(3w=RCLVSfV24S!PV{FR?n?L@60TbIwY*}z0AS@yLp1@cmMNV(J
zR!-a-+;3)0lFmfQOz+ZVZ;xx3nqq3YdYn$D)1RttVH{iYhN?-=rg}EpGrQQG+UYn`
zy?f4+1lZ&4t=boJbndz5oO|xMzjN-*{af_P16uzxoi2xh?|=37_$CH!=nEtdlsBs9
zCIcq7DPVS+1NrWJnj#dT{T8=H{I$BR@GJKh1Z-|wpwL|yC~_ACirvM55_gHntMHcw
z%G_lluJqdj<?ix;!|i~w%3UF$7#*|i7LBb^)Z{V#m9oN`$>ZtbR_Lx`s)#zQp(uAX
z3c(*eImoZ*OjS96*FdcXYqP3uNz&5Ua$0qhdxskB*ZOM%b?!Qv0?|4U)om38%k;!B
zA#v}5TFK-EY$Vs1Rpf5iY?}X)*3t~x%-bb$<?bytha@?<O;FxL@&Pt)*61w6nl)}x
zl#R{NoCF%RW}C=XyZ3^aWpa9}AJRCpH_PkZPYReCVq<h;GE(@e%<UpYOfi(rOpOhg
zfm#gI0~zW;D3?IFg_JTn;HrUgtPBXP#13l8nPyQmpJ`^A$0VpgRH7gb;5kHI6vZll
zYa9Gkirl%(VL}snOe%8bknOL^-ECXcSAk^vmU1<eJ2GV>44fgBZU`)KLRBYuiPV5?
zJ5V{ORghXx*d@}iEF*Qm)lGJ8*uM+PJ)|DYZ^(E;K^lS9OLjxKNu<?)o;^T2LYkkV
z?FE|cD7e|iRNUUT;nZVW#%n)uWd|fZUe)g7%yHtnSWQu^mbk`g_X#F1?QN!y95@J0
zn`&i_Pri#2hd#*vPFe($<k7)0DV0{xcSCZ$QbvtRq7;Z8n|v=ls9PaZ1{Mr3C$bii
zmT`)-zE5Lww-4Qtr+H}#q`!^Llpo&Uv@r+AB&6+C*{zI1_fVFrvVDUqJxR*JogG^^
zPh~k<I<uT$M-k~F-M4$PUKpdr$<!-4wj3OL<W>1bTf?B?zo12Xj*?^K__*ZuiLBhl
z5T)BL8B>wIEp4C9N_O@C8_AQ<R#r+u2DV6@Va}34aVXvr_anF4y*YN)A#y6)y8A_-
zZ&`;$!{mi*UAC|8mo{Z}r%7J6K0R!>#x>`j)}lM}ESEjAn)5c4o@dUn5|Zye52EhL
z@1t{C&N44DFEQts^S9lbgL#F%LRV1C&TSMcqp7phy!5*1GBqbXOI@Z%VTZs8bD46U
z<Nry~Ql%86ZBthSS*LF_B&d6sDTeiif~=rA5&~?*&j_;PJ}$I$NLfW&KF1AK(Doi5
z@|<Wp<2l;jJ|xhMOJl0Pk<dndyXGvtoxiH_$PWQq?b2tOHzX3af}hbl=>7bH-d=wg
z#pz3e%sUgB;G|Hp+wE*CQuQ8YF2s6AL!MCZA~VJI0kLc8zv=TNbS?jtaaMx_)`-Bt
zM{-*V4kOx*pasCDGJYl3BtHwJ!KKf0V>DgJ`%I0BeaN_<f6wG7bpt9$p*2B18oDyg
z2(*Wj0S!z6Tlim^Y;p#Qg#X{BV|4%0F|$#ss73J#-fML!jv;E~-?Lg3V~CFP-?ttt
z5c{C@OnX_5@vz>hafY3R+Q3p?!FF2HkBlJ%GfN$|2HI7DI36udxgZNpGgE?$W0;GA
zjAgup4MK$=^)pjWC5zT(L=n5pf48vGBDR*}@xc&z#(aK;eFf_NXzBC91$xg*$aW5a
z7r>UDK}pE<O!zs^XmBdTOo6AN_w3h!{vQ9A#lteRlAkZKELD~i(~3P%Vt4aBrG5L;
z9%C85AmKuS^dfWRxoUmHGZth$0fzXz>>q;oE&k`Fml{#+C{CR0rv(JZ{x^95Z$cD6
zBt%MNL{1b$NmNA5w>6t(<2g~9f49tTiO?hm|GTZZg~J42R1%T!c9S_LvqrR&YB)TL
ztWsi}qoazbl9(dWS&FSyQxWN;30KO1iI}s?5LPD@RYldI{IoiXim0-yYzs}DrA3ud
z#fFjjV59|%v}TRWK_l&v98&O%k(v;mWa1am{9AJi`MYNIxHh6-B@rd33+b}Va9kDM
zHe`+c8XZwYlo2f{`j&Kvs-Qw*WQDx2yiHNr7C9Z!Z^}hvUy~4HRQ9s$G98leuNliK
z_C;k8*(5HZXTGQ17?VGxGdCj7ZbffX??|5CLUwxr`z%@IV4o7gk<5^srLKRrh3oh9
zBKCjlMpoQe93IZW)jG(8X4omtKH}wkqjulaSkUer3C@J<p$P_x(}2xzzNvBh*w{21
z9ARAcKe+58p^4fF#y36@s-5t19`6kC1*1DfeS#7hW55}f)XfTVhGm0n*igqYeg-xs
zE(EJHz=fr=uKKX9j++Qx_P{b?eGC^ir7K&u>JLlnf@5LLC^y?O-BR!3TINnUrLgHt
zFrya*{it^utY<u6FBmGwLb(4;g7aeR0Kjm5#%TLgFa(|9LSDb0AuR4hePLs^a?A_M
zpSbK{U6vvmEzol;?lEDh7i`sLjPp$qW-hGE7}U+yBS+Qn6gM+H9b`icvE$l}d0qB^
zj}sj?>my9io)$;j#qJ4;wEqP4h69~C_5vsqa=4ihaP=s|ae|bcnGzISh(Hfn+%<*V
zZZNhl80rqrOpz{huDGEKc^zWkPNoI<lXd#oQQ&8%P)OZ1H_A+hd_mYFM}k2=G?m_u
zMgv5krv=I73GoDA{}e^Oh2R~OlV0|K4HE$5!0GV{64;#o7-~3NX*hj0zU&DkP7-mL
zV=&I_cY*KEQQ$|gdtIg0b0~FQN~KMy3@Mc@rP8HT)|9G5MDo{Ent12y>h*k$Msc-c
zy+A1s&}&-D8-3UM7Ir7da?@RMUwbT0r}Tz5Caz7qHnre*sH<4fRjleN<C1kfWhqR`
zY*)MD-6>^Gd?fbDm34_s?MPW|H|K85C8UXgRcqC?-gw8nX|1>{A$_~|Pe&Ik{$ygl
zIo|br!z`j<xtoUR6j!^}3uN*a=rx`7jq}&eFLW*DFNc1-?Y^!*E?F}dEI8hEzUh2x
zSAu;Qv(>NI>Q`-ztLEKt^&=If&3#j`rY~BQCY#RP*Pl<S&VQO;m>65$zoO|%%DR60
zMGsABOCD1+s!#JByRSc<92`!nhQC_V<UiC@uV|_tQxb4YDlh+L&5fFSd5(nSVXku}
z*SVUzBc9RU+<kZUUaaRra^OO;+na0}xvw8h`us_i|EqO5N`Li59%ZyaQ{bMG@}#yr
z-u2Dybtx3T`eNJfF#=e?xF;M25;ymD?4mxf?&z{oKPYIUx@xEocd5I~(hv9PI~CF&
zDt20+@WbNWT?Xk#207p#S#@1i(vP;&2y4{c3h76?_1(1eN3<O9rH-<XC3KwEIBM*;
zK*!+^zT_dN9u~GQzzC8c$A*E#Uf_ovJIOZyg?Z@@a*SZWRnavEK^C`VO~^Sv!%RD6
z?4P039pqQS9)PP<kc^RM4q%<fJ9=rx2iu81IC_!&KCu6K=^q_0)3xlk0e8}(8V*n4
zOuVJ@z<JJiAzBe7egHMU<8N+zNrUHucsf7H;XMZnmMoQrBm-6;ieF?SGluhX^L$ei
z9TqlD%$!hBMu3W_iT<fN4KYNud}Mo>)ELq7f4sd?tsAGJ`iO3_1W)Rs+^m*P>J7uF
zWE|qvbFi014H3gPYl;;decdc#_Koz%&`F&;4ID<27ctJ#EPY)SF{ZV}@`x#Wl#1tm
zZZuC#ZLxf#wWw(ebtCGInj;W7Tr7lLKprutG0=Y~Vv6L5RQh^XL_b-c?d|3-aG1v=
zv215(>iSt37148s5N^!kNAe>%S>uRhOfpVK^`XjaZKx`XMfBi`{87mSx&mULXnrLB
zo097aG55>Qwm__}QbcmQ;1-S^e4xuo#nL!5oMnqzh;4F5hP>q`RF^G8ELmP?)|wds
z6)3cl!ie>4iWI#g1>fh0&2QW`L<^p$A+|+@d5enTh(2P)X+g{gL1|ib$va9=ZIMw?
z8#GrMvAj)13ZS;^9T_Qmp4kyw)>vF#(L!P;<-|cM$Tm_L+O^sLjk!s-M+(Q)(W2*B
z3-btOdej;zB2^m(NyjB&I5MI|5e>|}T(Pb?OS^7^K`kOqQj?{Ga<hJ%%!7FPwe7jm
z9i$fLd8|0pkgeMs4`}l|MTv9MD#DUz>6V#TO6tP$Ei0?+sk)s{)!D(4T{uGTNJu?t
zh^R<oL`in1DUs3`_^}D9_GAcUnR0WcY|oVUl6~X)EnPkdYWHW<y2ybHck#F^&2#;N
z=z@c!C87Wgt?z6)tcV;Uhe=yRLE1?NiFM)y01Qgzi^xgO)(bPzOXzWJwqbS`Ir6*#
zfBv{_%u@&~Vd5M`Bgrw*R2fVtEzZ?gbaS$nPwn{sQm@=p|BeI{tDji}<>0I1k@BZH
zc_P!vVX@!i(sU1D7i!FUVh=@AAxyZ$Z?ZXyZT^B<2`uiu?Ba&Nx*z|$CE>4E|A7<p
z;Ag(ACS;dLXcu4aY>s6v0SuQhpD4}BZMiNmXG84_XZ~eypLlU#{eNK<R0GA)mx22%
zbP9I8MEc?ZTEZM0zhF9bafA+}%diQYBm=hxvs+=r0jW!W)bX+dQkSMI&m>-mJ@bLd
zN1~31W3u&`3MgihmZ8ZuJXPeU$nfnKa1}OGJk{>$NJWP8jF{d$#|pl$W(R$i57!7W
zF|-t;$Z$nN{l0qFo;~&TwR;=uUAyZ6X#z?EQg%1jyY|=Dr>{z0Xd67z)^}>?30?by
zc8PJhnEU&Zkcj%0HP58SK%`9Y_Z!TUZ&DFRka3F~qMVXgpD6epJkZ|;+Li<TiRz%=
z8yF$p)^HVMB^;&}nCow3<U0?-LGSf*t$?H%4?;M=VIp>wx;t?9(g&xmQY<FxP6^Ay
zkDz3kSqAPi#H=JNd2#lMgFY9|Imdw-rlqdY6_y0gg*7kMyJpXE(|%v5<q3U&59}z9
zu{S{;a;Pit=Ys?a?kMo8Vl)_-_Cp3Ds|$Fi!?Jpp_fS|>H|?AAj0Hl1^2*F?Q)B(K
zkc;<AZNr^M`aSJOP7Su5>JnrP&Gi?@%f9~Wf#uRihce;SZx4m#b)&9Xm!S0fM&=ru
zo5ISvX_nz)ObFT-Wyhd?1ncRGVGXo72UlARl%X&(GsgMCVgWL_QBP<B<R*fC!j_=v
zsMqTfq+ai+sKe_D=hlHMM;Q;?et5=MZvc`$Gcz~My2e9Hb*Od<Jw3{hnkTfA|N9-|
zXY?F1?x~#hRMzhyJ3}0JA>ifE3)6nj6o|83qL08DX)UNX)XjR?Op572_o!woXLkm6
z&+LQYSO8Y`O#prD03WC=G-8k`jujh6tbt#s-4k<&mo97pPy_`d29$z4aFO^}F(70y
z#)E`xVkYGC3ko&>=`6!8iNtXRE`(;qEKN*%#MF!ZPpDhW#BfIv6y9mLsmfeWDL64>
z6l8t~T-hkppB7}3LEn@hPhWpsKoK=FH3MA*w+mVi4l7(4dWO1Au<t@Gn?UeB0t`CY
zKS3a7aW5c-XQgu+`yqd^uAKfe{u_1MVlvF}1v$r#dM3nGC>RMd=AH3}Jm5W_cPhjQ
z+AIdEU{+9NOY9=36J(GBhS*z(N=G0yq$dP=M4)E{dP<;ukiOzH_Jq9SoS+k@IbN^9
zpmBm8kl2<<%>HLoq7$zVJR?51x`aMTJQIRq#B*_EniG_n`6ehcb4^g<2*c2BrmNgG
zP_mJR{vITqp*r%PyRumwEMx^P=5;x*+DYJkx%^YixQbUa#rHL(DU<Ds!!k;3nfHC7
zvVRek^4E9nlYgP0%ohIRoxQQo3?&Pbs|IIWwq`WVcP<p%=vy^b#O0V0ninpv*lJeI
zJL2kf1y$TeCshS&kd$7zaV1fjY-n4xwm-D?u2_3ltw-b9R84JMm8x!fSnXP=b}jE-
ztv>X?d?L|sx8dWxAME{T|NOws(>G54(b;?E6OSpax;oyOGUUY;wq1**j0Guc(arFU
zaH1k{Y1QgX=em#t>uhUg>w=W;ou@YtFvXZV-}c(<Lhge1Eei@8jPqTuhXK23xM4`-
zCfX8;PmERTHfZHhF=Z@RvlTB4B`V)8Tili`*p;-_$9q3B*}k=HabN5~SyRIMK7FsO
zX|-_AU$rKOPTx13iL2JMhI!TNC*m};W+_0!|04g+rKN%gC9cJ`ge1`bmJYn-yI0~`
z%|8&&Svx+E931*t?}LKjyO$Ok7rfA1&f>m1ZQnU?=hAmtlQpho$MV2($1;1*)}AaF
zj_UxVinb?WmlC6kHH*b}29mbD%N2i9{a4j@TUK2IE4G2S9@^IBr?iDBtu>`JrL;!)
zhlb_6-k;KzK*hQ#r!Xfj{i1-%v(8`Q3m#Ka@M~KNc)Axxz!B0!<HFITscJ=A74HxX
z1u3IxL6J}-tyL?=svFXEWj+Yt6@qp?XW>ZFuzf|fJudx>H}0~<*2=0E3s%b-A5&&^
zFMX{)-gYfAFPZONv)C54Cz{@@TeVcjd(x%dZ`Q6_s^UG+aw^ZdK+kjYnv~Hd{(}*M
zf2K{k$u?iTP(H6s<&~hLlE(6ssc_!8&@ivtLW*tBjAbCcUScroA5jLKKHl-z4tD_9
zmC6LYz%6JJ!;8$FwmZ8Qk1dxZtvxHo9_X4AtzNH%t|g5X$*Kd(z00n<1Ifysq@j03
z)f<<7s?vxq%@y5iPHF8aE#L(yts|waSc`!ZmC3@I6=Th+c8BQif_0nDnDdCzsln-w
zN-1rA%3`}Yabx0p@@4N|s~(iK-DyZT5(9~j1h?3*Sn<C8URm3!rTtpZr)j>ws9dI(
zsvndcSR6?6y|21gc3{<V5Im>SfFlxnZ+F~LF4wHocQ&rpb|nqnE2{3ebX}%YU#8b`
zOCC|Qu8UqX7T(m~&@XU{+m=J07(4$(iq!Qy{@wcCo-ZGtl~VbA^l!h=Q|3~*Dbd*k
zV*%WM=xqP`*i6~?eEC>Kl^*y~C>Z|o@yj%2Z>PWfhq43zq7rq8`oH?jVCVn2{%f)S
z2|LsWMY+Ru)Cc=I&G7RhZT_H3_9I6g!X`UVKF+rc9+G^#!-)97CV)S#R}UGqKi=O6
z_)m7|hRmv;>_gd~YHdR{*-tCmG*I|iL%SY+eonQS;O7@6!%(T}7Y<aIlxT-4R7ri&
za9xZ_)+mOWsARous9L(BRsp_}TMbP2<W7VxIl@EgA+3B>B?Wv{LnE#&M!Z@+)Sz6g
zQ-aiLlX|#Dy4s>YrIFs(SOC9Y-X<Halzvhvhr%Z{DEvvCZrCMdAK~7f<K;MJ>BkLr
zNhPK%Vf~S*S+Czm>~N0Red(K6)(JIi4T2rKuBlz~Dx&`mK|SwosyizlY<QBf80?E@
zGm9ZDD?YE_vC8g6kba*6%qbUJXZ5h3!*ftD7-BI@PCs%%BA7ld;GOEzrV_acnBH2F
z>?xz^_9aJi1^n>cdmEeaf|Qj35L6JVj0fPB8g7!zz%9O*335CJIrcbkY`I9{zq{8e
zhyU4vTH=4Ym%!84u6;?m6>lrV2+*m_oR5Cr6vL%sg(Fz`-w~jkcx1Ex3`KajDivGf
z+gxQO*s!2xnaiv%1aSrjNmRNU;)7e%RVv>O9DmIxT>p{o=l33{EoYO!(hWDx(w?qU
zf~>czty56;pFDM>zi$Y7QbY4!JMi@qb`@L3kTrci!o9TD50Ts+(DqBd{GbK;u<zhM
z(8`aH#Yyw!t>zd8kAifD^$T)%KMQb91A7*$cO&=}f?p$toE`TEN1hoR)`j)r&|O1J
z?D=bmy^bIs09bbz@%`9+j5*jF05-jxdAq}?Df3cx062fe|E%?UU~T-+_vm7rPGR{j
zh~9UFHM_)1`*a`(6O+Htw!KBP7vEULlb^i+n4p435XOVuQm_z^`KHs>DALxnpfw+&
z#3TO0wry6-mjn&O$}kbcJb~>3j<5LNwavl^%(Pc3cc4Tqz4Tr?FOk&Jd~;Vv3~z|o
zUIgL{pF}Jje<Jo@0XU`Uao^;`Y(`9Zz9VHfs6vkTNGLu)I&;(h$GI#%Mhc1m6PgGT
zcGIyJP>G2_xUo>g7h;@MUg8noPH+yf-#{LWMp+AjR{%J3Hdj>I8{+a9#d@3!=^nKs
z_7(vCe7B`o^p62jpV@R4g<C<09fB52lBN0XlQJdyKTu$j|NQ9Qv|q&eE;^?d*uW8I
z(4Hd*jv=T;a2&x=1Sb$|IEU?nVpuV9CB$&{Cv=^-r9j{>vYv*z&wmchIgM#oi9^5X
zotWqtvFRQ(Y8HVJfeC@=^__^F#5OM=w&@%ldkU$Ckt+H{bcyI3eBKrmFhe+acWOZf
zYy)1df`LGA$^(myKxE8{=`=edGQ*qoIK1rZpkUwnrPrq>?a=fC@p))=zhvp`@%@sR
zV1D69XIDRD27@nj4SG)Z4<73p910u7=O>RS#kwH-aLNSPL=fJfW%ynNGoA4Vy+lx6
z4zd@)6esPYC?h1tzBAxi=LPmW8oh+Th@JdL#Kg=4pLN*(06@^flHnis^|oNP&7$F~
z9_eb#2)zVe57}WXE5{&v^G^F%1G0$T%|#6E_`uKnx&D$E+;74gSB7sV<df6EDGqi@
z+!oRvZvra>l}CKD_jtsEKy)zd&w{GGZK%uBd1NrX6Mc?C7Z9ZLIT92zG#gUBjR3bI
zL5V3f{to~b;oT4>8djV_;J{ibrXW*T#5_Y#4>6E^OaxhmT}PrgjrtI?qIbkyMVw0F
z1bP8!uVC%h5&R*7?;`j<f*&Bjyn_|jE$;p*R$PI*Y2JG>KUM=2!Qk<Dr{Mk4i_do)
z^!O-<33@Lfo`8=KKXVzjANHS6mpF5A<7RO`6t^Qm4gU79@O;RKOOM4VgYLuh+2awE
zGqb+YAUnk}C^3d$9Ki&D9b$6nqy;+2L6NE#XCPdX1cGG7&$O~H0~IScr<^YysLJVm
zNcFBzy?;j;`JRCv9)1KFhH1Xx#^{1G{VbN~yVJ2+xbI<M>q=qkYT@B~g*|sWRxQ1&
zh9g(CDT5<^<)Oi`VsIo5t{UpEYI)7z-<GfIo9S+P!Msl4Z(<vSgdK^w_jdk9EI(pt
z{#S!LEfTssLDs1O_+8|FBmS;W$d+n`1|+e+)#uJT=N&hlH=N1hMzA1n-^0AtmAux~
zyu<hM&;ot$)t+A}A!;_ol_{CwYR|tv_R6uO(XnX0(|OmD960kpc6L3Vk`?}T-J3_L
zav>U|)q+d~(IBn<*T*3pl|M*xrQnGlwC45~Qa{n=_ivZ|#E}Q^7n(wOe}(iH4jSP9
E0Y+=RcmMzZ

delta 5405
zcmZ`-d2pM@b^rFmMdBdA0|3Dj6i@KJL{T(vQ4&c>JS0k%;G__UU6P;x0$O~eB$hJO
zL}~4*Gm^4N$1`pkw>g?rYDQE1(@vd<oq8h0nRKlBi25~?NzzQGZaoQV>5q)k>%9d*
zQMQ8NzWwdnw{LgfzJ2>X-g}?Cdz0k-(BZHu@Uu)Dj{L{)jl2@|b@PqJi>HV}6-uH-
zfg-3)(c+jZ;EK5e?wBXwiIoIOV%~sP%9x|2v9ds!#Fl7ztRhems|-{^J10=3D$K!r
zHwn(5C@Tj9sVHq)8P7C#(?AWYp}8A2MG4g6ASh&IN=y@vp`O)<Wl}}t;M0MITwIww
z+8FZ({6qmkKMZx?(Cj=gcOK1ORs+q@tFD~hJy8ZzXI3`Qx;@n+nBvp8K07U1CxP~D
z_J~@s)j?gXp1PT1(MUa4je$;D!b+fB!0NrA54c|7c5QRJp<N2?9$Lm6AXN|Ta%k_R
z6`-Y(^~#Zjte5pJsyJTiFw-iK*+);wQ9h8WhO!5xw^%;wqlA)0gA}#WnyaS3{$1*8
zVQBxZb{({zq0iEKSU>}+fU#!U2%`oh58FoS2dP2Yw6n-&Xb;gASY+$=cFnX6c%fn1
z4vY@TtOrG%z#O4nPw={dHwrd$v8r1=JH{Q$Sn(+bu$T7UR5Sb)Y4+2B1MC3pJ=drx
z+)jI!NMM{fGX`b{>AnGwT^(WvRzCj}WqsKR$CYbJSY3kh=^913tZXV7<vB_6QgOB+
z>?YfRaW=Mc?USll8LW7Mjb|0o{Ywh%{|kZ(y7kOWQ)UEFV6+gg8p~(lFuNC3I(XH1
zb6Z<r3OhfknhxzK&A3kmoWby}aYv-mfT?^7*5IL|bnMoFtc@0l^saGv1{H7y2d|oT
zCOirQUwO)ehv;ECv83Lb%xc*=+{^;Ji#c>^*8--u^=y4i7d`R`MMq&FStVwAY?qQ5
zHcO}FDXz!}G8dTpolY=AXR}KS90#f1jO6sk=7%PoqsOzNSu+Ms{7%IuXkk`5;{XA9
zspnz9+{#})Mg2TG&Q7rTTPJTCGrdH)L@tpUg*DYG+(?u&%60XnFI-SA8qO#eNLVG{
zW0#c+ivP4wa|Yc;J@+tMWjv(Cxt=qr0a}Q%)M8EpNqsf<yDD*ru>B12iSO8hru{HQ
zL#o<wO;tZ2;&1ZzkZ$o_zOSPn_&PbS8$)Z_a?$`TpU=npkee4|7d0LVYe6l3j;-=Z
zV2-5foP{c>7k!26He_%Ik}C0cg@aNT$4kTa0eMoHBgonLwFqZHoQThZz_C<)(H0>d
z@r~jxa~BTl7C$ZCLrx0fDkpuS(&aUs1$IyjxQ>vi)C(@B!Ca4WBjV3W`pt(BI>b*)
zJmwI>1@YUGffBiNdoU5=NfzXx)g{KyL+^5G##>KpQz#fml1N=C?Iisph%qSmO}a6j
zV5_<@$=EsF$XST;73k0nQMT&0@RKN+8H$LD|17I>%h{~K2pB)O7>P2z34Pa7_2n;<
z{%29_G?GsNN#Y@cZMThE5L}KXgW>q9##X_=mlBL$0f9e7$)jS_RVIom_nL9JVIuzA
zRh(L=EGOo6X!BNawQ9Nom!lgvi|T4p(+%g?rCl?KUsrid7;3&DY`*hGRFfKRyrYuO
z3QKd74~@741%7W2`}1_87Kt%kjVJjUu=sOguDOl8Ag(l*7vu5jreu_{gx|=oWA_bl
zySdaWckT#=!kJTz#>40MSD^c^Q~%ohJn7PN4_*wjgcgaf`iUHu#20yc_vj5#7J?I!
z<GuzxuZz#Oe#&M6giiS2qDfqtFG<<khE?(9j!J`r=7~gK-BvEd#{3(EI-wLmDTGo4
zrT7NXJTOrHHg}$7=y5@DZ`U5EOQ3k6l-?klIZ&5DZGpNRN(GckXy-y*1;q!Y8ro*4
z_duyR3ZxcF9hCYfrZmxp-TA=B`pA=gm#w*q<`r8_<<?CrRjGQb@uops@BMwaS)&z2
zuE#quWh0N~5k32Q$7&R<JiASZ5=ED7T2;19{j}*;b2bQV+CHPwmdm#1Z5N1El9gHU
ziF*Yu%j9L-rfp@9_+Ov5taYU>+xxhtZM6MX2b#Ro{=^KOoA!$&39*QFy`p?secF8D
z`+dz2UOwv6y?VjK(G$VZljD;!!LiBt<D>Hjbz^65$2sv~e|4j7Vw}hMhT3`wN@T;>
z8Ve;hOdb8}{T&;|j{eXvu)_W8V)GfV6H!PvghF9pF7$_lZD6UvmSju8x{kfHO-uS!
z-4tGC;d6RkIF!)VAlAg!w8WamkBYYjN(<2Ir@4#(p9RR9#lwNUImI0B33rLk!J<}l
zV2<9Xo0H3HS|qBQc}(Ms@h?i|5`*iy&Sm6zPK?yK#6n#W#M$*apJNWkHUsfH_}9h%
z4OWxuqI#&d)Dc>vk$7++0<lzMx*;5+GCuM<;#YNUh;zfkWwv`T?k<!hH3&9LeZ*A#
zGn?zjw(@(n@^@{O_lvv_M^q)(eLeDCj_=`RB0d=IGyJm1CF(~e$WO%9n0G5}tj@RI
zw-=`kQ2)$cnl?e5HY<*jv;|R);wVn%BC;xug0u~h9gzdj!#u^|yl(yDnRGt#or<F<
zU4W<%M-?F|MxG0i8<7W52_i3|(k;c|PM0ApM^u5R61%Gq`4Ckj+5;1%YY^2UuMSbY
z;wVfvAZkROA5oLyC`~sbYQaUeB5Fgqc0?VxtxiN;io=!euFl`Grh61eb$Tx{dr@#7
zqCUmpP47q4uQ+Pb&mbC59JT2|Ko5s-*Or%C?>QUZu{WlNkvBpz%$9r3`giON=}`jQ
z7Yyk`#GHG9{KW3QHvQuC%iXWizwLR?J_4q)7hM~AaY#&$kD7n;uu5@Oi}%MrGmC!q
zMp?mBi}FU__<pFq-&Hcvt=zFT0=_fk2YR<Vcgk<LJCHYNHT=Np2K)oxsBx;+@K&t}
z8gKaxAoNy?V`{&F-%TAm<X7wbpmif}a&<ivjZh!lEnkFkbZic}r^0KI)QMLn#%!2S
z@#m2=iGQDHJtN;~bWh%b#D$~{iF{K!5OpHSJj8(fCXOD-{|N{@hw-?^_hMVV?U<C}
zV+QeDtWH*#ehlsM)b+_KLIzT|r)r=Q?;hzoj;|EQmru`G<e{Y)Ja+Jm+(+&Ja!v3~
zYe{|>@UG_zdkTUVBHD5$^$4C{WBd~TIq>(2(?=;J1K&CNHW?cM24_J07TuamL?c=>
zvdWT~`#BDL-5g55n@;6Wc{z3CN<4zk`7dznfcW8bm3m(hA5NFTO|;BZnmz>nplF);
z6EY><m}#kcL|P8{4Z7j*!Fk;{ad328x6I7WPtHuAfQ_UTkvIFf(r+o5up-|?^D+xX
zA;tM0P!txoXWg*cJF~wamcPUqf31ky$BVZX0PBV|9@R~dJH(Rye3=sQR+RZJcAArM
zt}&{c_);{!@UgSuJt!wn?kb{xL-IK!e~6?I2&@isJ5J!))k%WC1dSaNdomfGH5y53
z!5E{F5I2F`vN&_%HCV2D{xwpLzO-R#hcu;q!`2>IrR-u`tb47`56&olb+UdCb2yH9
zCCBK+p97-jEa0P#`!e&S#v_T$TFjZXSYQtRbrilU=1$dmq`hnj&cF*8CPX|RBrc1W
zPOXFW4bRqDK0@IKN~--?p{frQ@#dKWTMfuNfJC}Co<Gk7bVRQKfhEf0eJqI?9v=bn
zEd$@->Q=dRnSJ>SG6#T;EHg3P9AnyYobEC!?vOj>#oD<gGAq_|F<T63m@lLM@E4F=
zL{fxg6NumX_&Q~*A@9cTVLy69W=HZ;7*UaKq#-Sov_co&v&;{V&8z77NygWu!GfV=
zl4%_N^`U%;q$-}9HRgiH$gGzMEx0dZENKjBu|g08>(t^w6d`dTd4Th~5fvlxAlb1P
zFM;NUdEt`AlD<czRR$Tqnh~vmz7PHphWniv`$>Oz?1@`vQMH_U4AFTcG88!x$)kX;
zZ-tlQoYKILE#}}=$dzs^jV0|QEf#_?x>+Xq+pj6k0S|vX7K^V2;R;g5lRR!h-3jsS
zvz3_-1IQQ9av7Iz0_}fKQolUAUp>9yT#rx|56XVt4`Bl?y>U4XxwSC?Hxc}qMdKmr
zClN()Do~vU3;9p+GdKfg2mD<muOs;fB=|YbUld;q&(_QW)Gdplq!vm<xE(vB4e}7>
zBXNpqT0siLF!hw;?albjZvp8!LHT774DvRSfd9<M5b-^fk>+xtjG4w|V&X>jSCRA}
z+XCiD;8)2avJN4cK~jZ8o|OEA`xk7^BRPu%Hn@FId(iyoyz)k55~Z!LVEb!G<h7R<
z=I7Xyp8p7t?hMCyG8pHPrO0YBh#6BF+4;d>XmvHNh48B&2^%_y+`JH_!B~XSD7ye*
zKsRDg;?i3%gv!7q<AR<G)(hG>By~)BJiKh*W}f{WxXMl>T}a-9L4Kl>xcuPgkdf|D
z&Oj_q*P?8Q9|9TpQ<B0c42uoMeeWpyM9<=zqHpP+)&I&9UCV85LaJY-X=M)TZzdne
zI=!r>)|cnhGxv@8R}TNtkv}-{wsX%ni*Jv=?tb4mk#;D?(%+<)@|2u{j}$_3bz@H2
t0QG-=w2`a0j+101O!>W@f@As0ole)WGUHuKA<!S?n~s$je&iuQ{~u(0{E7eo

diff --git a/video_server.py b/video_server.py
index db990af..96309ae 100644
--- a/video_server.py
+++ b/video_server.py
@@ -7,7 +7,8 @@ import time
 import hashlib
 from urllib.parse import parse_qsl, urlencode, urlsplit, urlunsplit
 from pathlib import Path
-from typing import Generator, Iterable, Optional, Tuple
+from typing import Any, Dict, Generator, Iterable, List, Optional, Tuple
+import threading
 
 import jwt
 from fastapi import FastAPI, HTTPException, Query, Request, Response
@@ -35,6 +36,10 @@ RANGE_RE = re.compile(r"^bytes=(\d*)-(\d*)$")
 AUTH_REQUIRED = os.getenv("VIDEO_AUTH_REQUIRED", "1").strip() not in {"0", "false", "False", "no", "NO"}
 JWT_SECRET = os.getenv("JWT_SECRET")
 
+# Limit concurrent ffmpeg transcodes (HLS generation) to avoid CPU overload.
+HLS_MAX_JOBS = max(1, int(os.getenv("HLS_MAX_JOBS", "2").strip() or "2"))
+_HLS_JOB_SEM = threading.Semaphore(HLS_MAX_JOBS)
+
 
 def _safe_resolve_media_path(rel_path: str) -> Path:
     """
@@ -170,6 +175,63 @@ def _hls_id_for_media(path: Path) -> str:
     return hashlib.sha1(key).hexdigest()
 
 
+def _probe_streams(path: Path) -> Dict[str, Any]:
+    """
+    Returns basic info about the input using ffprobe: {width,height,has_audio}.
+    """
+    cmd = [
+        "ffprobe",
+        "-v",
+        "error",
+        "-select_streams",
+        "v:0",
+        "-show_entries",
+        "stream=width,height",
+        "-of",
+        "csv=p=0:s=x",
+        str(path),
+    ]
+    try:
+        p = subprocess.run(cmd, check=True, capture_output=True, text=True)
+        wh = (p.stdout or "").strip()
+    except FileNotFoundError as exc:
+        raise HTTPException(status_code=500, detail="ffprobe not installed") from exc
+    except subprocess.CalledProcessError as exc:
+        stderr = (exc.stderr or "").strip()
+        raise HTTPException(status_code=500, detail=f"ffprobe failed: {stderr or 'ffprobe error'}") from exc
+
+    width = height = None
+    if "x" in wh:
+        try:
+            w_s, h_s = wh.split("x", 1)
+            width, height = int(w_s), int(h_s)
+        except Exception:
+            width = height = None
+
+    cmd_a = [
+        "ffprobe",
+        "-v",
+        "error",
+        "-select_streams",
+        "a:0",
+        "-show_entries",
+        "stream=index",
+        "-of",
+        "csv=p=0",
+        str(path),
+    ]
+    try:
+        pa = subprocess.run(cmd_a, check=False, capture_output=True, text=True)
+        has_audio = bool((pa.stdout or "").strip())
+    except FileNotFoundError as exc:
+        raise HTTPException(status_code=500, detail="ffprobe not installed") from exc
+
+    if not width or not height:
+        raise HTTPException(status_code=415, detail="Unsupported media: missing video stream")
+
+    return {"width": width, "height": height, "has_audio": has_audio}
+
+
 def _acquire_lock(lock_path: Path, timeout_s: int = 600) -> None:
     """
     Simple file lock to avoid concurrent transcodes for the same id.
@@ -221,12 +283,45 @@ def _ensure_hls_for_media(media_path: Path) -> str:
             shutil.rmtree(tmp_dir, ignore_errors=True)
         tmp_dir.mkdir(parents=True, exist_ok=True)
 
+        # Multi-rendition adaptive HLS (master + variants).
         hls_time = os.getenv("HLS_TIME", "6").strip()
         crf = os.getenv("HLS_CRF", "23").strip()
         preset = os.getenv("HLS_PRESET", "veryfast").strip()
-        audio_bitrate = os.getenv("HLS_AUDIO_BITRATE", "160k").strip()
 
-        cmd = [
+        info = _probe_streams(media_path)
+        src_h = int(info["height"])
+        has_audio = bool(info["has_audio"])
+
+        # Variant syntax: "height:video_kbps,height:video_kbps,..."
+        default_variants = "1080:5500,720:3000,480:1500,360:900"
+        variants_env = os.getenv("HLS_VARIANTS", default_variants).strip()
+        variants: List[Tuple[int, int]] = []
+        for part in [p.strip() for p in variants_env.split(",") if p.strip()]:
+            if ":" not in part:
+                continue
+            h_s, b_s = part.split(":", 1)
+            try:
+                h = int(h_s)
+                b = int(b_s)
+            except ValueError:
+                continue
+            if h <= 0 or b <= 0:
+                continue
+            if h <= src_h:
+                variants.append((h, b))
+
+        if not variants:
+            variants = [(min(720, src_h), 3000)]
+
+        variants = sorted(list({v for v in variants}), key=lambda x: x[0], reverse=True)
+        n = len(variants)
+
+        # Build filter_complex split+scale for N renditions
+        split_tags = "".join([f"[v{i}]" for i in range(n)])
+        scale_filters = [f"[v{i}]scale=-2:{variants[i][0]}[v{i}o]" for i in range(n)]
+        filter_complex = f"[0:v]split={n}{split_tags};" + ";".join(scale_filters)
+
+        cmd: List[str] = [
             "ffmpeg",
             "-hide_banner",
             "-loglevel",
@@ -234,20 +329,43 @@ def _ensure_hls_for_media(media_path: Path) -> str:
             "-y",
             "-i",
             str(media_path),
-            "-map",
-            "0:v:0",
-            "-map",
-            "0:a?",
-            "-c:v",
-            "libx264",
-            "-preset",
-            preset,
-            "-crf",
-            crf,
-            "-c:a",
-            "aac",
-            "-b:a",
-            audio_bitrate,
+            "-filter_complex",
+            filter_complex,
+        ]
+
+        for i in range(n):
+            cmd += ["-map", f"[v{i}o]"]
+            if has_audio:
+                cmd += ["-map", "0:a?"]
+
+        cmd += ["-pix_fmt", "yuv420p"]
+
+        audio_bitrate = os.getenv("HLS_AUDIO_BITRATE", "160k").strip()
+        for i, (_h, b_kbps) in enumerate(variants):
+            maxrate = int(b_kbps * 1.07)
+            bufsize = int(b_kbps * 1.5)
+            cmd += [
+                f"-c:v:{i}",
+                "libx264",
+                "-preset",
+                preset,
+                "-crf",
+                crf,
+                f"-b:v:{i}",
+                f"{b_kbps}k",
+                f"-maxrate:v:{i}",
+                f"{maxrate}k",
+                f"-bufsize:v:{i}",
+                f"{bufsize}k",
+                "-sc_threshold",
+                "0",
+            ]
+            if has_audio:
+                cmd += [f"-c:a:{i}", "aac", f"-b:a:{i}", audio_bitrate]
+
+        cmd += ["-force_key_frames", f"expr:gte(t,n_forced*{hls_time})"]
+
+        cmd += [
             "-f",
             "hls",
             "-hls_time",
@@ -257,12 +375,20 @@ def _ensure_hls_for_media(media_path: Path) -> str:
             "-hls_flags",
             "independent_segments",
             "-hls_segment_filename",
-            str(tmp_dir / "seg_%05d.ts"),
-            str(tmp_dir / "index.m3u8"),
+            str(tmp_dir / "seg_%v_%05d.ts"),
+            "-master_pl_name",
+            "index.m3u8",
         ]
 
+        if has_audio:
+            var_map = " ".join([f"v:{i},a:{i}" for i in range(n)])
+        else:
+            var_map = " ".join([f"v:{i}" for i in range(n)])
+        cmd += ["-var_stream_map", var_map, str(tmp_dir / "v%v.m3u8")]
+
         try:
-            subprocess.run(cmd, check=True, capture_output=True)
+            with _HLS_JOB_SEM:
+                subprocess.run(cmd, check=True, capture_output=True)
         except FileNotFoundError as exc:
             raise HTTPException(status_code=500, detail="ffmpeg not installed") from exc
         except subprocess.CalledProcessError as exc:
@@ -497,5 +623,9 @@ if __name__ == "__main__":
     host = os.getenv("VIDEO_SERVER_HOST", "0.0.0.0")
     port = int(os.getenv("VIDEO_SERVER_PORT", "8001"))
     reload = os.getenv("VIDEO_SERVER_RELOAD", "1").strip() not in {"0", "false", "False", "no", "NO"}
-    uvicorn.run("video_server:app", host=host, port=port, reload=reload)
+    workers = int(os.getenv("VIDEO_SERVER_WORKERS", "1").strip() or "1")
+    # Uvicorn ignores/limits workers when reload=True.
+    if reload:
+        workers = 1
+    uvicorn.run("video_server:app", host=host, port=port, reload=reload, workers=workers)
 
-- 
2.54.0