From ded619a55f5202aa23ac864fcb21505cb65e4aab Mon Sep 17 00:00:00 2001
From: CyberMind-FR <gandalf@Gk2.net>
Date: Tue, 28 Jul 2026 13:51:41 +0200
Subject: [PATCH 01/17] docs(torrent): WebTorrent streaming pivot design spec
 (ref #917)

Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
---
 ...07-28-secubox-torrent-webtorrent-design.md | 204 ++++++++++++++++++
 1 file changed, 204 insertions(+)
 create mode 100644 docs/superpowers/specs/2026-07-28-secubox-torrent-webtorrent-design.md

diff --git a/docs/superpowers/specs/2026-07-28-secubox-torrent-webtorrent-design.md b/docs/superpowers/specs/2026-07-28-secubox-torrent-webtorrent-design.md
new file mode 100644
index 00000000..475aea3d
--- /dev/null
+++ b/docs/superpowers/specs/2026-07-28-secubox-torrent-webtorrent-design.md
@@ -0,0 +1,204 @@
+# secubox-torrent v2.0 — WebTorrent Streaming Pivot — Design Spec
+
+**Issue:** #917
+**Date:** 2026-07-28
+**Status:** Design approved, pending spec review → implementation plan
+
+## Goal
+
+Pivot the dormant `secubox-torrent` module from a Transmission download-manager
+into a **WebTorrent streaming** module: paste a magnet → watch it in the browser
+(HTML5 `<video>`, HTTP Range) while it downloads. Ephemeral by default, with an
+optional **Keep** action that retains a title in a persistent library on the
+SSD `/data`. True WebRTC-hybrid: the browser participates in the swarm.
+
+## Non-Goals (YAGNI)
+
+- No RSS / scheduled downloads (that was Transmission's job; dropped).
+- No multi-user quotas / per-user libraries (single admin-scoped tool; master
+  users gk2 + admin only).
+- No transcoding (serve the file as-is; the browser plays what it can — MP4/WebM
+  natively; MKV/AVI may not play — documented, not solved in v1).
+- No built-in search/indexer (paste magnets/torrent files only).
+- No antivirus scan hook in v1 (noted as a future SecuBox-native extension).
+
+## Context & Constraints
+
+- **Board:** MOCHAbin gk2, Debian bookworm **arm64**. Storage: eMMC (small, fills
+  up) + USB SSD mounted at `/data` (media MUST live here — see podcaster).
+- **Existing module:** `secubox-torrent` 1.0.0 (host FastAPI + Transmission via
+  Docker) — installed on gk2 but **dormant/inactive**. This pivot **replaces**
+  it; the package name, vhost, and menu entry are preserved (version → 2.0.0).
+- **SecuBox module pattern:** LXC-native app modules (peertube/podcaster/lyrion),
+  fronted by a host vhost → HAProxy (TLS 1.3) → sbxwaf (:8085) → nginx (:9080) →
+  LXC. Auth = JWT `sbx_token` (localStorage), master users gk2 + admin.
+- **Security posture:** torrent connects to **untrusted peers** — on a security
+  appliance the engine MUST be isolated in a dedicated LXC, never on the host.
+
+## Architecture
+
+```
+Browser (player webui, <video>)
+  │  https://torrent.gk2.secubox.in/  + /api/*  + /stream/*
+  ▼
+HAProxy (TLS 1.3) ──► sbxwaf (:8085) ──► nginx (:9080)
+  │  JWT gate (auth_request → secubox-auth) on /api + /stream + panel
+  ▼
+LXC "torrent" (isolated, 10.100.0.x, /data-backed)
+  └─ Node.js service (systemd inside LXC):
+       ├─ engine        (webtorrent-hybrid: BitTorrent + WebRTC via @roamhq/wrtc)
+       ├─ stream server (Fastify: GET /stream/:infohash/:file → Range → res)
+       ├─ library       (better-sqlite3: ephemeral/kept state + purge)
+       └─ api + static  (Fastify: /api/* JSON, serves the player webui)
+```
+
+**Isolation & egress:** the LXC's outbound torrent traffic is scoped by an nft
+rule set on the host (the LXC's veth), logged and rate-limitable. The webui is
+reachable ONLY through the WAF vhost; the LXC's Node port is not exposed on the
+LAN directly.
+
+**wrtc-arm64 risk (Task 1 spike):** `@roamhq/wrtc` ships arm64 prebuilds; if the
+prebuild fails to load in the bookworm-arm64 LXC, fall back to **BitTorrent-only**
+(`webtorrent` without the WebRTC transport). The player + streaming are identical;
+only browser-peer swarm participation is lost. The spike gates which npm dep the
+package pins.
+
+## Components
+
+Each is a focused unit with one responsibility and a mockable interface.
+
+### `engine.js` (torrent engine wrap)
+- Wraps a single `WebTorrent` client instance.
+- `add(magnetOrTorrent) → {infohash, name, files:[{idx,name,length,type}]}`
+  (resolves once metadata is available; timeout → error).
+- `get(infohash) → torrent | null`; `remove(infohash, {deleteData})`.
+- `stats(infohash) → {progress, downloadSpeed, uploadSpeed, numPeers, wires:[{type:'webrtc'|'tcp'|'utp', addr}]}`.
+- Enforces a max-concurrent-torrents cap (config) to bound memory.
+- Interface is injectable so tests use a `FakeWebTorrent` (no network).
+
+### `stream.js` (HTTP Range streaming)
+- `GET /stream/:infohash/:fileIdx` → validates infohash+idx, sets
+  `Content-Type` from file ext, honours the `Range` header, pipes
+  `file.stream({start,end})` to the response. Supports seeking (multiple Range
+  requests) while the torrent is still downloading (WebTorrent handles
+  out-of-order piece prioritisation on read).
+- 404 for unknown infohash/idx; 416 for unsatisfiable range.
+
+### `library.js` (persistence + retention)
+- SQLite (`better-sqlite3`) at `/data/torrent/library.db`.
+- Row per torrent: `infohash, name, magnet, added_at, last_played_at, kept(0/1),
+  path`. Ephemeral rows (kept=0) live under `/data/torrent/tmp/<infohash>/`;
+  kept rows under `/data/torrent/library/<infohash>/`.
+- `keep(infohash)` → move files tmp→library, set kept=1 (continues seeding).
+- `unkeep(infohash)`, `remove(infohash)`.
+- **Purge policy:** a periodic sweep removes ephemeral (kept=0) torrents whose
+  `last_played_at` is older than `ephemeral_ttl` (config, default 6 h) OR when
+  `/data` free space drops below a floor (config) — oldest-ephemeral-first.
+  Kept torrents are never auto-purged. All purges logged.
+
+### `api.js` (control API, Fastify)
+- `GET /api/v1/torrent/status` → engine up, counts, disk free.
+- `POST /api/v1/torrent/add {magnet}` → engine.add + library insert (kept=0).
+- `GET /api/v1/torrent/list` → library rows + live stats.
+- `GET /api/v1/torrent/files/:infohash` → file list.
+- `POST /api/v1/torrent/keep/:infohash`, `POST /api/v1/torrent/remove/:infohash`.
+- `GET /api/v1/torrent/health`.
+- All JSON; auth enforced at the host WAF layer (see below), the LXC service
+  trusts the proxied request (LXC is not LAN-exposed).
+
+### `www/` player webui
+- Single-page (SecuBox webui look per WEBUI-PANEL-GUIDELINES, reads `sbx_token`):
+  magnet input → on add, show file list → click a playable file → `<video
+  src="/stream/:infohash/:idx" controls>`; **📌 Keep** / **🗑 Remove** buttons;
+  a live stats strip (progress, peers, WebRTC vs TCP/uTP wire count).
+- Non-playable files (unknown container) show a **Download** link instead of the
+  player.
+
+### Host side (thin)
+- `debian/` package installs: the LXC (`install-lxc.sh`, idempotent, same
+  pattern as peertube/podcaster), the host **vhost** (`nginx/torrent.conf` →
+  proxies to the LXC), the **WAF route** (haproxy-routes.json), the **menu.d**
+  entry, `/etc/secubox/torrent.toml`, and an **nft egress drop-in** for the LXC
+  veth. No business logic on the host — it only proxies + authenticates.
+- Auth: the vhost uses the standard SecuBox `auth_request` → secubox-auth to
+  gate `/`, `/api/`, and `/stream/` with the `sbx_token` cookie/bearer, exactly
+  like other module vhosts.
+
+## Data Flow
+
+1. User pastes a magnet in the webui → `POST /api/v1/torrent/add`.
+2. `engine.add` fetches metadata → returns file list; `library` inserts kept=0
+   under `/data/torrent/tmp/<infohash>/`.
+3. User clicks a playable file → browser opens `<video src=/stream/:infohash/:idx>`.
+4. `stream.js` serves Range requests; WebTorrent prioritises the needed pieces →
+   playback starts before full download; seeking issues new Range requests.
+5. In hybrid mode, the browser (loading webtorrent in-page, optional v1.1) and the
+   LXC engine both peer over WebRTC + BitTorrent.
+6. User clicks **Keep** → files moved tmp→library, kept=1, seeding continues.
+   Otherwise the purge sweep removes the ephemeral torrent after TTL / on low disk.
+
+## Config (`/etc/secubox/torrent.toml`)
+
+```toml
+[engine]
+max_active = 5              # concurrent torrents cap
+download_dir = "/data/torrent"
+webrtc = true               # false forces BitTorrent-only (fallback)
+
+[retention]
+ephemeral_ttl_hours = 6     # purge ephemeral not played within this window
+disk_floor_gb = 5          # purge oldest ephemeral when /data free < this
+
+[net]
+# torrent listen port inside the LXC; host nft scopes egress on the veth
+listen_port = 6881
+```
+
+## Error Handling
+
+- `engine.add` metadata timeout → 504 + user-facing "magnet unreachable / no
+  peers".
+- wrtc load failure at boot → log once, run BitTorrent-only, expose
+  `webrtc:false` in `/status` so the webui shows a "BitTorrent-only" badge.
+- Disk full on `/data` → `add` refused with a clear error; purge sweep triggers.
+- LXC down → host vhost returns 502; a host watchdog (existing secubox-watchdog
+  pattern) may restart the LXC.
+- Stream of a still-metadata-less torrent → 409 "not ready".
+
+## Security & Confinement
+
+- **LXC isolation:** untrusted peer traffic never touches the host.
+- **nft egress scope:** host drop-in on the LXC veth — allow the torrent listen
+  port + DHT/WebRTC, log the rest; rate-limitable. (OUTPUT is `policy accept`
+  repo-wide, so containment is a **drop-based** rule on the veth, not an allow —
+  same lesson as the meshtastic on-grid note.)
+- **WAF + JWT:** webui/API/stream only reachable through sbxwaf + `auth_request`;
+  master users gk2 + admin.
+- **No host business logic:** compromise of the Node engine is contained to the LXC.
+- Future (not v1): scan **kept** files via antirootkit/ClamAV before they land in
+  the library.
+
+## Testing
+
+- `engine` against a `FakeWebTorrent` (deterministic metadata/files/stats) — no
+  network.
+- `stream` Range handling: full, partial, open-ended, unsatisfiable (416),
+  seeking mid-download (mock file stream).
+- `library`: insert/keep/unkeep/remove + purge policy (TTL + disk-floor) on a
+  tmp SQLite + tmp dirs.
+- `api`: each route, JSON shape, error codes (mock engine/library).
+- `packaging`: install-lxc.sh idempotency assertions, vhost + WAF route present,
+  nft drop-in sorts after the table-creator, config installed.
+- No real BitTorrent/WebRTC in tests. The **wrtc-arm64 spike (Task 1)** is a
+  manual/CI feasibility check, not a unit test.
+
+## Open Questions (resolved defaults)
+
+- **Name/version:** keep `secubox-torrent`, bump to **2.0.0-1~bookworm1**; the
+  1.0.0 Transmission code is removed. Vhost host = `torrent.gk2.secubox.in`
+  (existing) preserved.
+- **LXC provisioning:** reuse the existing `install-lxc.sh` LXC pattern
+  (peertube/podcaster), Debian bookworm arm64 base + Node LTS.
+- **Browser-side WebRTC peer (in-page webtorrent):** deferred to v1.1 — v1 ships
+  the server-side hybrid engine + player; the in-browser swarm participant is an
+  additive enhancement once the server path is proven.

From 98a03aa7ebc19a2093962b1816f5a0faecf50c1c Mon Sep 17 00:00:00 2001
From: CyberMind-FR <gandalf@Gk2.net>
Date: Tue, 28 Jul 2026 14:23:46 +0200
Subject: [PATCH 02/17] docs(torrent): implementation plan v2.0 WebTorrent (8
 tasks, ref #917)

Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
---
 .../2026-07-28-secubox-torrent-webtorrent.md  | 939 ++++++++++++++++++
 1 file changed, 939 insertions(+)
 create mode 100644 docs/superpowers/plans/2026-07-28-secubox-torrent-webtorrent.md

diff --git a/docs/superpowers/plans/2026-07-28-secubox-torrent-webtorrent.md b/docs/superpowers/plans/2026-07-28-secubox-torrent-webtorrent.md
new file mode 100644
index 00000000..8e5ad514
--- /dev/null
+++ b/docs/superpowers/plans/2026-07-28-secubox-torrent-webtorrent.md
@@ -0,0 +1,939 @@
+# secubox-torrent v2.0 — WebTorrent Streaming — Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Pivot the dormant `secubox-torrent` module from Transmission to a WebTorrent streaming service (paste magnet → watch in browser, ephemeral-by-default + Keep), running Node.js in an isolated LXC.
+
+**Architecture:** A Node.js service inside a dedicated `torrent` LXC runs the WebTorrent engine (hybrid WebRTC+BitTorrent), an HTTP Range streaming server, a SQLite library with a purge sweep, and a Fastify API serving the player webui. The host only provisions the LXC and proxies/authenticates a vhost through HAProxy→sbxwaf→nginx.
+
+**Tech Stack:** Node.js LTS (bookworm), `webtorrent` + `@roamhq/wrtc` (WebRTC hybrid), `fastify`, `better-sqlite3`; tests via Node built-in `node --test` (no test-framework dependency); Debian packaging (arch: all, LXC provisioned at postinst).
+
+## Global Constraints
+
+- Package name stays `secubox-torrent`; version `2.0.0-1~bookworm1`; the 1.0.0 Transmission code (api/main.py Python) is removed.
+- Public vhost host `torrent.gk2.secubox.in` is preserved.
+- Platform: Debian bookworm **arm64**. Media/state on the USB SSD at `/data` — never eMMC.
+- LXC pattern matches peertube/podcaster: `LXC_PATH=/data/lxc`, bridge `br-lxc`, gateway `10.100.0.1`, sentinel-file idempotency, `la()` = `lxc-attach -n <name> -P <path> --`.
+- Torrent engine runs ONLY inside the LXC (untrusted peers). The host runs no torrent logic.
+- Node service source lives under `lxc/app/` in the package and is copied into the LXC at provision time.
+- Tests are `node --test` files named `*.test.js`, run from `lxc/app/`, use fakes — NEVER real BitTorrent/WebRTC/network.
+- Auth: the LXC service trusts the proxied request; the host vhost enforces `sbx_token` via `auth_request` (master users gk2 + admin). No auth logic inside the Node service.
+- Config: `/etc/secubox/torrent.toml` on the host; the relevant values are passed into the LXC env at service start.
+- SecuBox webui look per `.claude/WEBUI-PANEL-GUIDELINES.md` (cyan hybrid-dark, reads `localStorage.sbx_token`).
+
+---
+
+## File Structure
+
+```
+packages/secubox-torrent/
+├── lxc/
+│   ├── app/                         ← Node service (copied into LXC)
+│   │   ├── package.json             ← deps + "test": "node --test"
+│   │   ├── engine.js                ← WebTorrent wrap
+│   │   ├── engine.test.js
+│   │   ├── stream.js                ← HTTP Range handler
+│   │   ├── stream.test.js
+│   │   ├── library.js               ← better-sqlite3 + purge
+│   │   ├── library.test.js
+│   │   ├── api.js                   ← Fastify app factory
+│   │   ├── api.test.js
+│   │   ├── server.js                ← wires engine+stream+library+api, reads env
+│   │   └── fakes.js                 ← FakeWebTorrent/FakeTorrent/FakeFile
+│   ├── install-lxc.sh               ← idempotent LXC provisioner
+│   └── secubox-torrent.service      ← systemd unit INSIDE the LXC
+├── www/torrent/index.html           ← player webui (replaces old panel)
+├── nginx/torrent.conf               ← host vhost → LXC
+├── nft/torrent-egress.nft           ← host egress drop-in for the LXC veth
+├── menu.d/…-torrent.json            ← dashboard entry (kept)
+├── conf/torrent.toml                ← default config
+├── README.md
+└── debian/                          ← control/rules/postinst/postrm/changelog
+```
+
+Removed: `packages/secubox-torrent/api/main.py`, `systemd/secubox-torrent.service` (old host FastAPI), and Transmission references.
+
+---
+
+### Task 1: LXC skeleton + wrtc-arm64 spike
+
+**Files:**
+- Create: `packages/secubox-torrent/lxc/app/package.json`
+- Create: `packages/secubox-torrent/lxc/app/wrtc-probe.js`
+- Create: `packages/secubox-torrent/lxc/install-lxc.sh` (skeleton: create LXC + Node)
+- Create: `packages/secubox-torrent/lxc/SPIKE-RESULT.md`
+
+**Interfaces:**
+- Produces: the pinned npm dependency set (whether `@roamhq/wrtc` is included) and `WEBRTC_AVAILABLE` (bool) recorded in `SPIKE-RESULT.md`, consumed by every later task's `package.json` + `engine.js`.
+
+- [ ] **Step 1: Write package.json**
+
+```json
+{
+  "name": "secubox-torrent",
+  "version": "2.0.0",
+  "private": true,
+  "type": "module",
+  "engines": { "node": ">=18" },
+  "scripts": { "test": "node --test" },
+  "dependencies": {
+    "webtorrent": "^2.5.1",
+    "@roamhq/wrtc": "^0.8.0",
+    "fastify": "^4.28.1",
+    "better-sqlite3": "^11.3.0"
+  }
+}
+```
+
+- [ ] **Step 2: Write wrtc-probe.js** (decides WebRTC availability)
+
+```javascript
+// Exits 0 and prints WEBRTC_AVAILABLE=true if @roamhq/wrtc loads a
+// RTCPeerConnection on this arch; exits 0 with =false otherwise (fallback).
+try {
+  const wrtc = await import('@roamhq/wrtc');
+  const pc = new wrtc.default.RTCPeerConnection();
+  pc.close();
+  console.log('WEBRTC_AVAILABLE=true');
+} catch (e) {
+  console.log('WEBRTC_AVAILABLE=false');
+  console.error('wrtc load failed:', e.message);
+}
+```
+
+- [ ] **Step 3: Write install-lxc.sh skeleton** (create LXC + install Node, idempotent)
+
+```bash
+#!/usr/bin/env bash
+set -euo pipefail
+readonly LXC_NAME="${SECUBOX_LXC_NAME:-torrent}"
+readonly LXC_IP="${SECUBOX_LXC_IP:-10.100.0.130}"
+readonly LXC_PATH="${SECUBOX_LXC_PATH:-/data/lxc}"
+readonly LXC_BRIDGE="${SECUBOX_LXC_BRIDGE:-br-lxc}"
+readonly LXC_GW="${SECUBOX_LXC_GW:-10.100.0.1}"
+readonly DATA_DIR="${SECUBOX_DATA_DIR:-/data/torrent}"
+readonly STATE_DIR="${SECUBOX_STATE_DIR:-/var/lib/secubox/torrent}"
+readonly SENTINEL="$STATE_DIR/.lxc-provisioned"
+log() { printf '[torrent-install] %s\n' "$*"; }
+la()  { lxc-attach -n "$LXC_NAME" -P "$LXC_PATH" -- "$@"; }
+
+mkdir -p "$STATE_DIR" "$DATA_DIR"
+if [ -f "$SENTINEL" ]; then log "already provisioned; skipping create"; else
+  lxc-create -n "$LXC_NAME" -P "$LXC_PATH" -t debian -- -r bookworm -a arm64
+  # network: static IP on br-lxc (config appended to the container config)
+  cat >> "$LXC_PATH/$LXC_NAME/config" <<EOF
+lxc.net.0.type = veth
+lxc.net.0.link = $LXC_BRIDGE
+lxc.net.0.flags = up
+lxc.net.0.ipv4.address = $LXC_IP/24
+lxc.net.0.ipv4.gateway = $LXC_GW
+EOF
+  lxc-start -n "$LXC_NAME" -P "$LXC_PATH"
+  sleep 5
+  la apt-get update
+  la apt-get install -y --no-install-recommends nodejs npm ca-certificates
+  touch "$SENTINEL"
+fi
+log "node version: $(la node --version 2>/dev/null || echo MISSING)"
+```
+
+- [ ] **Step 4: Run the spike (manual/CI, on gk2 or an arm64 runner)**
+
+Run: provision the LXC, then inside it `npm ci` in the app dir and `node wrtc-probe.js`.
+Expected: prints `WEBRTC_AVAILABLE=true` OR `=false` without crashing npm install.
+
+- [ ] **Step 5: Record SPIKE-RESULT.md + adjust package.json**
+
+Write `SPIKE-RESULT.md` with the observed `WEBRTC_AVAILABLE` value, the Node version, and the arm64 npm-install outcome. **If false:** remove `@roamhq/wrtc` from `package.json` dependencies (BitTorrent-only build) and note it. This value is the `webrtc` default for `engine.js`.
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add packages/secubox-torrent/lxc/
+git commit -m "feat(torrent): LXC skeleton + wrtc-arm64 spike (ref #917)"
+```
+
+---
+
+### Task 2: engine.js — WebTorrent wrap
+
+**Files:**
+- Create: `packages/secubox-torrent/lxc/app/engine.js`
+- Create: `packages/secubox-torrent/lxc/app/fakes.js`
+- Test: `packages/secubox-torrent/lxc/app/engine.test.js`
+
+**Interfaces:**
+- Consumes: `WEBRTC_AVAILABLE` from Task 1 (the `webrtc` option default).
+- Produces:
+  - `class Engine { constructor({ WebTorrentCtor, downloadDir, maxActive, webrtc }) }`
+  - `await engine.add(magnet) → { infohash, name, files: [{ idx, name, length, type }] }`
+  - `engine.get(infohash) → torrent | null`
+  - `engine.stats(infohash) → { progress, downloadSpeed, uploadSpeed, numPeers, wires: [{ type }] }`
+  - `engine.remove(infohash, { deleteData }) → void`
+  - `type` is the lowercased file extension without the dot (e.g. `"mp4"`).
+
+- [ ] **Step 1: Write fakes.js**
+
+```javascript
+export class FakeFile {
+  constructor(name, length) { this.name = name; this.length = length; }
+}
+export class FakeTorrent {
+  constructor(infoHash, name, files, { failMeta = false } = {}) {
+    this.infoHash = infoHash; this.name = name;
+    this.files = files.map((f, i) => Object.assign(new FakeFile(f.name, f.length), { idx: i }));
+    this.progress = 0.1; this.downloadSpeed = 1000; this.uploadSpeed = 500;
+    this.numPeers = 3; this.wires = [{ type: 'webrtc' }, { type: 'tcp' }];
+    this._failMeta = failMeta; this._handlers = {};
+  }
+  on(ev, cb) { this._handlers[ev] = cb; if (ev === 'metadata' && !this._failMeta) queueMicrotask(cb); }
+  destroy(_opts, cb) { if (cb) cb(); }
+}
+export class FakeWebTorrent {
+  constructor() { this.torrents = []; }
+  add(magnet, _opts, cb) {
+    const t = this._next || new FakeTorrent('a'.repeat(40), 'Fake', [{ name: 'movie.mp4', length: 100 }]);
+    this.torrents.push(t); if (cb) queueMicrotask(() => cb(t)); return t;
+  }
+  get(infohash) { return this.torrents.find(t => t.infoHash === infohash) || null; }
+  destroy(cb) { if (cb) cb(); }
+}
+```
+
+- [ ] **Step 2: Write the failing test**
+
+```javascript
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { Engine } from './engine.js';
+import { FakeWebTorrent } from './fakes.js';
+
+test('add returns infohash, name and typed file list', async () => {
+  const eng = new Engine({ WebTorrentCtor: FakeWebTorrent, downloadDir: '/tmp/x', maxActive: 5, webrtc: true });
+  const r = await eng.add('magnet:?xt=urn:btih:' + 'a'.repeat(40));
+  assert.equal(r.infohash, 'a'.repeat(40));
+  assert.equal(r.files[0].type, 'mp4');
+  assert.equal(r.files[0].idx, 0);
+});
+
+test('stats returns wire types', () => {
+  const eng = new Engine({ WebTorrentCtor: FakeWebTorrent, downloadDir: '/tmp/x', maxActive: 5, webrtc: true });
+  return eng.add('magnet:?xt=urn:btih:' + 'a'.repeat(40)).then(r => {
+    const s = eng.stats(r.infohash);
+    assert.deepEqual(s.wires.map(w => w.type).sort(), ['tcp', 'webrtc']);
+    assert.equal(s.numPeers, 3);
+  });
+});
+
+test('maxActive cap rejects beyond limit', async () => {
+  const eng = new Engine({ WebTorrentCtor: FakeWebTorrent, downloadDir: '/tmp/x', maxActive: 1, webrtc: true });
+  await eng.add('magnet:?xt=urn:btih:' + 'a'.repeat(40));
+  eng.client.torrents.push({ infoHash: 'b'.repeat(40) }); // simulate a second active
+  await assert.rejects(() => eng.add('magnet:?xt=urn:btih:' + 'c'.repeat(40)), /max active/);
+});
+```
+
+- [ ] **Step 2b: Run test to verify it fails** — `cd lxc/app && node --test engine.test.js` → FAIL (Engine not defined).
+
+- [ ] **Step 3: Write engine.js**
+
+```javascript
+import path from 'node:path';
+
+export class Engine {
+  constructor({ WebTorrentCtor, downloadDir, maxActive, webrtc }) {
+    this.downloadDir = downloadDir; this.maxActive = maxActive;
+    // webrtc=false (spike fallback) tells WebTorrent to skip the WebRTC transport.
+    this.client = new WebTorrentCtor(webrtc ? {} : { tracker: { wrtc: false } });
+  }
+  add(magnet) {
+    if (this.client.torrents.length >= this.maxActive) {
+      return Promise.reject(new Error('max active torrents reached'));
+    }
+    return new Promise((resolve, reject) => {
+      const to = setTimeout(() => reject(new Error('metadata timeout')), 60000);
+      const t = this.client.add(magnet, { path: this.downloadDir }, () => {});
+      const done = () => {
+        clearTimeout(to);
+        resolve({
+          infohash: t.infoHash, name: t.name,
+          files: t.files.map((f, i) => ({ idx: i, name: f.name, length: f.length, type: ext(f.name) })),
+        });
+      };
+      t.on('metadata', done);
+      if (t.files && t.files.length) done();
+    });
+  }
+  get(infohash) { return this.client.get(infohash); }
+  stats(infohash) {
+    const t = this.get(infohash); if (!t) return null;
+    return { progress: t.progress, downloadSpeed: t.downloadSpeed, uploadSpeed: t.uploadSpeed,
+             numPeers: t.numPeers, wires: (t.wires || []).map(w => ({ type: w.type })) };
+  }
+  remove(infohash, { deleteData } = {}) {
+    const t = this.get(infohash); if (t) t.destroy({ destroyStore: !!deleteData }, () => {});
+  }
+}
+function ext(name) { const m = /\.([A-Za-z0-9]+)$/.exec(name); return m ? m[1].toLowerCase() : ''; }
+```
+
+- [ ] **Step 4: Run test to verify it passes** — `node --test engine.test.js` → PASS.
+
+- [ ] **Step 5: Commit** — `git commit -m "feat(torrent): engine.js WebTorrent wrap + fakes (ref #917)"`
+
+---
+
+### Task 3: stream.js — HTTP Range handler
+
+**Files:**
+- Create: `packages/secubox-torrent/lxc/app/stream.js`
+- Test: `packages/secubox-torrent/lxc/app/stream.test.js`
+
+**Interfaces:**
+- Consumes: `Engine.get(infohash)` (returns a torrent whose `.files[idx]` has `.length`, `.name`, and `.stream({ start, end }) → ReadableStream`).
+- Produces: `handleStream(engine, req, res)` where `req = { params: { infohash, fileIdx }, headers }` and `res` is a Node ServerResponse-like object. Sets status + headers, pipes the file stream. Returns nothing.
+
+- [ ] **Step 1: Write the failing test**
+
+```javascript
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { Readable } from 'node:stream';
+import { handleStream } from './stream.js';
+
+function fakeRes() {
+  return { statusCode: 200, headers: {}, ended: false, body: '',
+    setHeader(k, v) { this.headers[k.toLowerCase()] = v; },
+    writeHead(c, h) { this.statusCode = c; Object.assign(this.headers, lower(h || {})); },
+    end(s) { if (s) this.body += s; this.ended = true; } };
+}
+const lower = o => Object.fromEntries(Object.entries(o).map(([k, v]) => [k.toLowerCase(), v]));
+function fakeEngine(len = 100) {
+  const file = { name: 'movie.mp4', length: len,
+    stream: ({ start, end }) => Readable.from([`bytes[${start}-${end}]`]) };
+  return { get: () => ({ files: [file] }) };
+}
+
+test('full request returns 200 with content-length and type', async () => {
+  const res = fakeRes();
+  await handleStream(fakeEngine(100), { params: { infohash: 'a', fileIdx: '0' }, headers: {} }, res);
+  assert.equal(res.statusCode, 200);
+  assert.equal(res.headers['content-length'], 100);
+  assert.match(res.headers['content-type'], /mp4/);
+});
+
+test('range request returns 206 with content-range', async () => {
+  const res = fakeRes();
+  await handleStream(fakeEngine(100), { params: { infohash: 'a', fileIdx: '0' }, headers: { range: 'bytes=10-19' } }, res);
+  assert.equal(res.statusCode, 206);
+  assert.equal(res.headers['content-range'], 'bytes 10-19/100');
+  assert.equal(res.headers['content-length'], 10);
+});
+
+test('unsatisfiable range returns 416', async () => {
+  const res = fakeRes();
+  await handleStream(fakeEngine(100), { params: { infohash: 'a', fileIdx: '0' }, headers: { range: 'bytes=200-300' } }, res);
+  assert.equal(res.statusCode, 416);
+});
+
+test('unknown infohash returns 404', async () => {
+  const res = fakeRes();
+  await handleStream({ get: () => null }, { params: { infohash: 'z', fileIdx: '0' }, headers: {} }, res);
+  assert.equal(res.statusCode, 404);
+});
+```
+
+- [ ] **Step 2: Run to verify it fails** — `node --test stream.test.js` → FAIL.
+
+- [ ] **Step 3: Write stream.js**
+
+```javascript
+const MIME = { mp4: 'video/mp4', webm: 'video/webm', mkv: 'video/x-matroska',
+  m4v: 'video/mp4', mp3: 'audio/mpeg', m4a: 'audio/mp4', ogg: 'audio/ogg',
+  flac: 'audio/flac', wav: 'audio/wav' };
+
+export async function handleStream(engine, req, res) {
+  const t = engine.get(req.params.infohash);
+  const idx = Number(req.params.fileIdx);
+  const file = t && t.files && t.files[idx];
+  if (!file) { res.writeHead(404); res.end('not found'); return; }
+  const type = mimeOf(file.name);
+  const total = file.length;
+  const range = req.headers.range;
+  if (!range) {
+    res.writeHead(200, { 'Content-Length': total, 'Content-Type': type, 'Accept-Ranges': 'bytes' });
+    file.stream({ start: 0, end: total - 1 }).pipe(res);
+    return;
+  }
+  const m = /bytes=(\d+)-(\d*)/.exec(range);
+  const start = m ? Number(m[1]) : 0;
+  const end = m && m[2] ? Number(m[2]) : total - 1;
+  if (start >= total || end >= total || start > end) {
+    res.writeHead(416, { 'Content-Range': `bytes */${total}` }); res.end(); return;
+  }
+  res.writeHead(206, { 'Content-Range': `bytes ${start}-${end}/${total}`,
+    'Content-Length': end - start + 1, 'Content-Type': type, 'Accept-Ranges': 'bytes' });
+  file.stream({ start, end }).pipe(res);
+}
+function mimeOf(name) { const e = (/\.([A-Za-z0-9]+)$/.exec(name) || [])[1]; return MIME[(e || '').toLowerCase()] || 'application/octet-stream'; }
+```
+
+- [ ] **Step 4: Run to verify it passes** — PASS.
+
+- [ ] **Step 5: Commit** — `git commit -m "feat(torrent): stream.js HTTP Range handler (ref #917)"`
+
+---
+
+### Task 4: library.js — SQLite library + purge
+
+**Files:**
+- Create: `packages/secubox-torrent/lxc/app/library.js`
+- Test: `packages/secubox-torrent/lxc/app/library.test.js`
+
+**Interfaces:**
+- Produces:
+  - `class Library { constructor(dbPath) }`
+  - `lib.add({ infohash, name, magnet, path }) → void` (inserts kept=0)
+  - `lib.list() → [{ infohash, name, magnet, added_at, last_played_at, kept, path }]`
+  - `lib.touch(infohash) → void` (sets last_played_at = now)
+  - `lib.keep(infohash, newPath) → void`; `lib.get(infohash) → row | null`; `lib.remove(infohash) → void`
+  - `lib.expiredEphemeral(ttlSeconds, now) → [infohash]` (kept=0 AND last_played_at < now-ttl)
+
+- [ ] **Step 1: Write the failing test**
+
+```javascript
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { Library } from './library.js';
+
+const mk = () => new Library(':memory:');
+
+test('add then list yields one ephemeral row', () => {
+  const lib = mk();
+  lib.add({ infohash: 'a', name: 'A', magnet: 'm', path: '/tmp/a' });
+  const rows = lib.list();
+  assert.equal(rows.length, 1);
+  assert.equal(rows[0].kept, 0);
+});
+
+test('keep flips kept and updates path', () => {
+  const lib = mk();
+  lib.add({ infohash: 'a', name: 'A', magnet: 'm', path: '/tmp/a' });
+  lib.keep('a', '/data/torrent/library/a');
+  assert.equal(lib.get('a').kept, 1);
+  assert.equal(lib.get('a').path, '/data/torrent/library/a');
+});
+
+test('expiredEphemeral returns only stale unkept torrents', () => {
+  const lib = mk();
+  lib.add({ infohash: 'old', name: 'O', magnet: 'm', path: '/tmp/o' });
+  lib.add({ infohash: 'fresh', name: 'F', magnet: 'm', path: '/tmp/f' });
+  lib.add({ infohash: 'kept', name: 'K', magnet: 'm', path: '/tmp/k' });
+  lib.touchAt('old', 1000); lib.touchAt('fresh', 9000); lib.touchAt('kept', 1000);
+  lib.keep('kept', '/data/k');
+  const exp = lib.expiredEphemeral(3600, 10000); // now=10000, ttl=3600 → cutoff 6400
+  assert.deepEqual(exp, ['old']);
+});
+```
+
+- [ ] **Step 2: Run to verify it fails** — FAIL.
+
+- [ ] **Step 3: Write library.js**
+
+```javascript
+import Database from 'better-sqlite3';
+
+export class Library {
+  constructor(dbPath) {
+    this.db = new Database(dbPath);
+    this.db.exec(`CREATE TABLE IF NOT EXISTS torrents (
+      infohash TEXT PRIMARY KEY, name TEXT, magnet TEXT, path TEXT,
+      added_at INTEGER, last_played_at INTEGER, kept INTEGER DEFAULT 0)`);
+  }
+  add({ infohash, name, magnet, path }) {
+    const now = Math.floor(Date.now() / 1000);
+    this.db.prepare(`INSERT OR REPLACE INTO torrents
+      (infohash,name,magnet,path,added_at,last_played_at,kept)
+      VALUES (?,?,?,?,?,?,0)`).run(infohash, name, magnet, path, now, now);
+  }
+  list() { return this.db.prepare('SELECT * FROM torrents ORDER BY added_at DESC').all(); }
+  get(infohash) { return this.db.prepare('SELECT * FROM torrents WHERE infohash=?').get(infohash) || null; }
+  touch(infohash) { this.touchAt(infohash, Math.floor(Date.now() / 1000)); }
+  touchAt(infohash, ts) { this.db.prepare('UPDATE torrents SET last_played_at=? WHERE infohash=?').run(ts, infohash); }
+  keep(infohash, newPath) { this.db.prepare('UPDATE torrents SET kept=1, path=? WHERE infohash=?').run(newPath, infohash); }
+  remove(infohash) { this.db.prepare('DELETE FROM torrents WHERE infohash=?').run(infohash); }
+  expiredEphemeral(ttlSeconds, now = Math.floor(Date.now() / 1000)) {
+    const cutoff = now - ttlSeconds;
+    return this.db.prepare('SELECT infohash FROM torrents WHERE kept=0 AND last_played_at < ?')
+      .all(cutoff).map(r => r.infohash);
+  }
+}
+```
+
+- [ ] **Step 4: Run to verify it passes** — PASS.
+
+- [ ] **Step 5: Commit** — `git commit -m "feat(torrent): library.js SQLite + purge selection (ref #917)"`
+
+---
+
+### Task 5: api.js — Fastify routes
+
+**Files:**
+- Create: `packages/secubox-torrent/lxc/app/api.js`
+- Test: `packages/secubox-torrent/lxc/app/api.test.js`
+
+**Interfaces:**
+- Consumes: `Engine` (Task 2), `Library` (Task 4), `handleStream` (Task 3).
+- Produces: `buildApi({ engine, library, diskFreeBytes }) → fastify instance` with routes:
+  `GET /api/v1/torrent/status`, `POST /api/v1/torrent/add`, `GET /api/v1/torrent/list`,
+  `GET /api/v1/torrent/files/:infohash`, `POST /api/v1/torrent/keep/:infohash`,
+  `POST /api/v1/torrent/remove/:infohash`, `GET /api/v1/torrent/health`,
+  `GET /stream/:infohash/:fileIdx`. `diskFreeBytes` is an injected `() → number`.
+
+- [ ] **Step 1: Write the failing test** (uses fastify `.inject`, no network)
+
+```javascript
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { buildApi } from './api.js';
+import { Library } from './library.js';
+import { Engine } from './engine.js';
+import { FakeWebTorrent } from './fakes.js';
+
+function build() {
+  const engine = new Engine({ WebTorrentCtor: FakeWebTorrent, downloadDir: '/tmp', maxActive: 5, webrtc: true });
+  const library = new Library(':memory:');
+  return buildApi({ engine, library, diskFreeBytes: () => 10 * 1e9 });
+}
+
+test('health returns ok', async () => {
+  const app = build();
+  const r = await app.inject({ method: 'GET', url: '/api/v1/torrent/health' });
+  assert.equal(r.statusCode, 200);
+  assert.equal(r.json().status, 'ok');
+});
+
+test('add then list returns the torrent', async () => {
+  const app = build();
+  await app.inject({ method: 'POST', url: '/api/v1/torrent/add',
+    payload: { magnet: 'magnet:?xt=urn:btih:' + 'a'.repeat(40) } });
+  const r = await app.inject({ method: 'GET', url: '/api/v1/torrent/list' });
+  assert.equal(r.json().length, 1);
+  assert.equal(r.json()[0].kept, 0);
+});
+
+test('keep flips kept=1', async () => {
+  const app = build();
+  await app.inject({ method: 'POST', url: '/api/v1/torrent/add',
+    payload: { magnet: 'magnet:?xt=urn:btih:' + 'a'.repeat(40) } });
+  const r = await app.inject({ method: 'POST', url: '/api/v1/torrent/keep/' + 'a'.repeat(40) });
+  assert.equal(r.statusCode, 200);
+  const list = await app.inject({ method: 'GET', url: '/api/v1/torrent/list' });
+  assert.equal(list.json()[0].kept, 1);
+});
+```
+
+- [ ] **Step 2: Run to verify it fails** — FAIL.
+
+- [ ] **Step 3: Write api.js**
+
+```javascript
+import Fastify from 'fastify';
+import path from 'node:path';
+import { handleStream } from './stream.js';
+
+export function buildApi({ engine, library, diskFreeBytes }) {
+  const app = Fastify({ logger: false });
+
+  app.get('/api/v1/torrent/health', async () => ({ status: 'ok' }));
+  app.get('/api/v1/torrent/status', async () => ({
+    active: engine.client.torrents.length, disk_free: diskFreeBytes(), webrtc: engine.webrtc !== false }));
+
+  app.post('/api/v1/torrent/add', async (req, reply) => {
+    const magnet = (req.body || {}).magnet;
+    if (!magnet) return reply.code(400).send({ error: 'magnet required' });
+    let meta;
+    try { meta = await engine.add(magnet); }
+    catch (e) { return reply.code(504).send({ error: e.message }); }
+    library.add({ infohash: meta.infohash, name: meta.name, magnet,
+      path: path.join(engine.downloadDir, 'tmp', meta.infohash) });
+    return meta;
+  });
+
+  app.get('/api/v1/torrent/list', async () =>
+    library.list().map(r => ({ ...r, stats: engine.stats(r.infohash) })));
+
+  app.get('/api/v1/torrent/files/:infohash', async (req, reply) => {
+    const t = engine.get(req.params.infohash);
+    if (!t) return reply.code(404).send({ error: 'not found' });
+    return t.files.map((f, i) => ({ idx: i, name: f.name, length: f.length }));
+  });
+
+  app.post('/api/v1/torrent/keep/:infohash', async (req, reply) => {
+    const ih = req.params.infohash;
+    if (!library.get(ih)) return reply.code(404).send({ error: 'not found' });
+    library.keep(ih, path.join(engine.downloadDir, 'library', ih));
+    return { status: 'kept' };
+  });
+
+  app.post('/api/v1/torrent/remove/:infohash', async (req) => {
+    engine.remove(req.params.infohash, { deleteData: true });
+    library.remove(req.params.infohash);
+    return { status: 'removed' };
+  });
+
+  app.get('/stream/:infohash/:fileIdx', (req, reply) => {
+    library.touch(req.params.infohash);
+    return handleStream(engine, req, reply.raw)
+      .then(() => { reply.hijack(); });
+  });
+
+  return app;
+}
+```
+
+Note: `engine.webrtc` — add `this.webrtc = webrtc;` to the Engine constructor (Task 2) so `/status` reports it; if you reach here and it is missing, add that one line and re-run Task 2 tests.
+
+- [ ] **Step 4: Run to verify it passes** — PASS. Also re-run `node --test` (whole dir) to confirm nothing regressed.
+
+- [ ] **Step 5: Commit** — `git commit -m "feat(torrent): api.js Fastify routes + stream mount (ref #917)"`
+
+---
+
+### Task 6: server.js + purge sweep + player webui
+
+**Files:**
+- Create: `packages/secubox-torrent/lxc/app/server.js`
+- Create: `packages/secubox-torrent/www/torrent/index.html` (replaces the old panel)
+- Test: `packages/secubox-torrent/lxc/app/server.test.js` (purge sweep only)
+
+**Interfaces:**
+- Consumes: everything above.
+- Produces: `runPurge(engine, library, { ttlSeconds, diskFloorBytes, diskFreeBytes }) → [infohash]` (the swept list); `server.js` wires env → Engine/Library/buildApi and starts listening + schedules `runPurge` on an interval.
+
+- [ ] **Step 1: Write the failing purge test**
+
+```javascript
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { runPurge } from './server.js';
+import { Library } from './library.js';
+
+test('purge removes expired ephemeral and calls engine.remove', () => {
+  const lib = new Library(':memory:');
+  lib.add({ infohash: 'old', name: 'O', magnet: 'm', path: '/tmp/o' });
+  lib.touchAt('old', 0);
+  const removed = [];
+  const engine = { remove: (ih) => removed.push(ih) };
+  const swept = runPurge(engine, lib, { ttlSeconds: 10, diskFloorBytes: 0, diskFreeBytes: () => 1e12 });
+  assert.deepEqual(swept, ['old']);
+  assert.deepEqual(removed, ['old']);
+  assert.equal(lib.get('old'), null);
+});
+```
+
+- [ ] **Step 2: Run to verify it fails** — FAIL.
+
+- [ ] **Step 3: Write server.js** (purge + wiring)
+
+```javascript
+import os from 'node:os';
+import WebTorrent from 'webtorrent';
+import { Engine } from './engine.js';
+import { Library } from './library.js';
+import { buildApi } from './api.js';
+
+export function runPurge(engine, library, { ttlSeconds, diskFloorBytes, diskFreeBytes }) {
+  const now = Math.floor(Date.now() / 1000);
+  let victims = library.expiredEphemeral(ttlSeconds, now);
+  if (diskFreeBytes() < diskFloorBytes) {
+    const extra = library.list().filter(r => r.kept === 0).map(r => r.infohash);
+    victims = [...new Set([...victims, ...extra])];
+  }
+  for (const ih of victims) { engine.remove(ih, { deleteData: true }); library.remove(ih); }
+  return victims;
+}
+
+export function start() {
+  const cfg = {
+    downloadDir: process.env.TORRENT_DOWNLOAD_DIR || '/data/torrent',
+    maxActive: Number(process.env.TORRENT_MAX_ACTIVE || 5),
+    webrtc: process.env.TORRENT_WEBRTC !== 'false',
+    port: Number(process.env.TORRENT_PORT || 8090),
+    ttl: Number(process.env.TORRENT_EPHEMERAL_TTL_HOURS || 6) * 3600,
+    floor: Number(process.env.TORRENT_DISK_FLOOR_GB || 5) * 1e9,
+  };
+  const engine = new Engine({ WebTorrentCtor: WebTorrent, ...cfg });
+  const library = new Library(`${cfg.downloadDir}/library.db`);
+  const diskFreeBytes = () => { try { return os.freemem(); } catch { return Infinity; } }; // replaced by statvfs helper at impl
+  const app = buildApi({ engine, library, diskFreeBytes });
+  app.register(import('@fastify/static'), { root: '/opt/secubox-torrent/www' });
+  setInterval(() => runPurge(engine, library, { ttlSeconds: cfg.ttl, diskFloorBytes: cfg.floor, diskFreeBytes }), 300000);
+  app.listen({ host: '0.0.0.0', port: cfg.port });
+}
+if (process.argv[1] && process.argv[1].endsWith('server.js')) start();
+```
+
+Note: `diskFreeBytes` must report `/data` free space, not RAM — implement with a small `statvfs` call (e.g. `child_process.execSync('df -B1 --output=avail /data')` parsed, or the `node:fs` statfs API `fs.statfsSync('/data')` on Node ≥ 18.15 → `bavail * bsize`). Use `fs.statfsSync` if available; the test injects `diskFreeBytes` so this detail is not under test. Add `@fastify/static` to package.json deps.
+
+- [ ] **Step 4: Run to verify it passes** — PASS.
+
+- [ ] **Step 5: Write www/torrent/index.html** (player webui — replaces old panel)
+
+Full single-page player following `.claude/WEBUI-PANEL-GUIDELINES.md`: reads `localStorage.sbx_token`, sends it as `Authorization: Bearer` on every fetch; a magnet `<input>` + Add button → `POST /api/v1/torrent/add`; a list from `GET /api/v1/torrent/list` showing name + progress + peer/wire counts + **📌 Garder** / **🗑** buttons; clicking a playable file (type in mp4/webm/m4v/mp3/m4a/ogg) sets `<video controls src="/stream/{infohash}/{idx}">`, others render a Download link; a status strip from `/status` showing a **"BitTorrent-only"** badge when `webrtc:false`. Delete the old Transmission panel content entirely.
+
+- [ ] **Step 6: Commit** — `git add packages/secubox-torrent/lxc/app/server.js packages/secubox-torrent/www/torrent/index.html && git commit -m "feat(torrent): server wiring + purge sweep + player webui (ref #917)"`
+
+---
+
+### Task 7: Host integration — install-lxc.sh (full) + vhost + WAF + nft + menu + config
+
+**Files:**
+- Modify: `packages/secubox-torrent/lxc/install-lxc.sh` (extend Task 1 skeleton: copy app, npm ci, install the in-LXC service, start it)
+- Create: `packages/secubox-torrent/lxc/secubox-torrent.service` (systemd unit INSIDE the LXC)
+- Create: `packages/secubox-torrent/nginx/torrent.conf` (host vhost → LXC)
+- Create: `packages/secubox-torrent/nft/torrent-egress.nft`
+- Modify: `packages/secubox-torrent/menu.d/*.json` (keep entry, ensure host = torrent.gk2.secubox.in)
+- Create: `packages/secubox-torrent/conf/torrent.toml`
+
+**Interfaces:**
+- Consumes: the `app/` service (Tasks 2-6), env vars from `torrent.toml`.
+- Produces: an idempotent provisioner; a host vhost proxying `/`, `/api/`, `/stream/` to `http://10.100.0.130:8090` with `auth_request` JWT; an nft drop-in scoping the LXC veth egress.
+
+- [ ] **Step 1: Write the in-LXC systemd unit** `lxc/secubox-torrent.service`
+
+```ini
+[Unit]
+Description=SecuBox Torrent (WebTorrent streaming)
+After=network-online.target
+Wants=network-online.target
+[Service]
+WorkingDirectory=/opt/secubox-torrent/app
+EnvironmentFile=/opt/secubox-torrent/torrent.env
+ExecStart=/usr/bin/node server.js
+Restart=on-failure
+RestartSec=5
+[Install]
+WantedBy=multi-user.target
+```
+
+- [ ] **Step 2: Extend install-lxc.sh** (append after the skeleton's Node install; idempotent copy + build + service)
+
+```bash
+# --- app deploy (runs every postinst; idempotent) ---
+APP_SRC="${SECUBOX_APP_SRC:-/usr/lib/secubox/torrent/app}"
+la mkdir -p /opt/secubox-torrent/app /opt/secubox-torrent/www
+tar -C "$APP_SRC" -cf - . | la tar -C /opt/secubox-torrent/app -xf -
+tar -C /usr/share/secubox/www/torrent -cf - . | la tar -C /opt/secubox-torrent/www -xf -
+la bash -lc 'cd /opt/secubox-torrent/app && npm ci --omit=dev || npm install --omit=dev'
+# env file from host TOML values (exported by postinst into these vars)
+la bash -c "cat > /opt/secubox-torrent/torrent.env <<EOF
+TORRENT_DOWNLOAD_DIR=/data/torrent
+TORRENT_MAX_ACTIVE=${TORRENT_MAX_ACTIVE:-5}
+TORRENT_WEBRTC=${TORRENT_WEBRTC:-true}
+TORRENT_PORT=8090
+TORRENT_EPHEMERAL_TTL_HOURS=${TORRENT_TTL:-6}
+TORRENT_DISK_FLOOR_GB=${TORRENT_FLOOR:-5}
+EOF"
+install -m 644 /dev/stdin_UNUSED 2>/dev/null || true
+tar -C "$(dirname "$0")" -cf - secubox-torrent.service | la tar -C /etc/systemd/system -xf -
+la systemctl daemon-reload
+la systemctl enable --now secubox-torrent.service
+log "torrent LXC app deployed + started on $LXC_IP:8090"
+```
+
+- [ ] **Step 3: Write host vhost** `nginx/torrent.conf` (proxies to LXC, JWT via auth_request — mirror peertube/podcaster vhost)
+
+```nginx
+server {
+    listen 0.0.0.0:9080;
+    server_name torrent.gk2.secubox.in;
+    location = /__sbx_auth_verify { internal; proxy_pass http://unix:/run/secubox/aggregator.sock:/api/v1/auth/verify; proxy_pass_request_body off; proxy_set_header Content-Length ""; }
+    location / {
+        auth_request /__sbx_auth_verify;
+        proxy_pass http://10.100.0.130:8090;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_buffering off;                # streaming: don't buffer video
+        proxy_request_buffering off;
+        proxy_read_timeout 3600s;
+    }
+}
+```
+
+- [ ] **Step 4: Write nft egress drop-in** `nft/torrent-egress.nft` (host, scopes the LXC veth — drop-based, logged; sorts AFTER the table creator via zz- naming at install)
+
+```
+# Scope the torrent LXC's egress. OUTPUT is policy accept repo-wide, so this
+# is an explicit LOG+limit on the LXC veth, not an allow. Applied on the host.
+table inet secubox_torrent {
+    chain forward_torrent {
+        type filter hook forward priority 0;
+        iifname "veth-torrent*" ct state new log prefix "[SECUBOX-TORRENT] " level info
+    }
+}
+```
+
+- [ ] **Step 5: Write conf/torrent.toml**
+
+```toml
+[engine]
+max_active = 5
+webrtc = true          # set false to force BitTorrent-only
+[retention]
+ephemeral_ttl_hours = 6
+disk_floor_gb = 5
+```
+
+- [ ] **Step 6: Verify menu.d entry** — ensure `menu.d/*.json` keeps the 🌊 Torrent entry pointing at `torrent.gk2.secubox.in` (Media category). Edit only if the host/URL is wrong.
+
+- [ ] **Step 7: Commit** — `git add packages/secubox-torrent/{lxc,nginx,nft,conf,menu.d} && git commit -m "feat(torrent): host LXC provisioner + vhost + nft egress + config (ref #917)"`
+
+---
+
+### Task 8: Debian packaging v2.0.0 (remove Transmission)
+
+**Files:**
+- Delete: `packages/secubox-torrent/api/main.py`, `packages/secubox-torrent/systemd/secubox-torrent.service` (old host FastAPI)
+- Modify: `packages/secubox-torrent/debian/control`, `debian/rules`, `debian/postinst`, `debian/postrm`, `debian/changelog`
+- Test: `packages/secubox-torrent/tests/test_packaging.py` (structural, pytest — reuse SecuBox packaging-test convention)
+
+**Interfaces:**
+- Produces: a `secubox-torrent_2.0.0-1~bookworm1_all.deb` that installs the app source to `/usr/lib/secubox/torrent/app`, the webui to `/usr/share/secubox/www/torrent`, the vhost/nft/menu/conf, and runs `install-lxc.sh` at postinst.
+
+- [ ] **Step 1: Write the failing packaging test**
+
+```python
+from pathlib import Path
+ROOT = Path(__file__).resolve().parent.parent
+
+def _read(p): return (ROOT / p).read_text()
+
+def test_control_is_v2_no_transmission():
+    c = _read("debian/control")
+    assert "python3-uvicorn" not in c          # old FastAPI gone
+    assert "transmission" not in c.lower()
+    assert "lxc" in c.lower()
+
+def test_changelog_is_2_0_0():
+    assert _read("debian/changelog").startswith("secubox-torrent (2.0.0-1~bookworm1)")
+
+def test_postinst_runs_install_lxc():
+    assert "install-lxc.sh" in _read("debian/postinst")
+
+def test_no_old_fastapi_main():
+    assert not (ROOT / "api" / "main.py").exists()
+```
+
+- [ ] **Step 2: Run to verify it fails** — `cd packages/secubox-torrent && python3 -m pytest tests/test_packaging.py` → FAIL.
+
+- [ ] **Step 3: Rewrite debian/control**
+
+```
+Source: secubox-torrent
+Section: net
+Priority: optional
+Maintainer: Gerald KERMA <devel@cybermind.fr>
+Build-Depends: debhelper-compat (= 13)
+Standards-Version: 4.6.2
+
+Package: secubox-torrent
+Architecture: all
+Depends: ${misc:Depends}, secubox-core (>= 1.0), lxc, debootstrap, nftables
+Description: WebTorrent streaming for SecuBox (LXC-native)
+ Paste a magnet and stream it in the browser (HTTP Range) while it downloads.
+ Ephemeral by default with an optional Keep to a persistent library on /data.
+ The WebTorrent engine (hybrid WebRTC+BitTorrent) runs isolated in a dedicated
+ LXC; the host only proxies an authenticated vhost.
+```
+
+- [ ] **Step 4: Rewrite debian/rules** (install app source, webui, vhost, nft, conf, menu)
+
+```make
+#!/usr/bin/make -f
+%:
+	dh $@
+override_dh_auto_install:
+	install -d $(CURDIR)/debian/secubox-torrent/usr/lib/secubox/torrent
+	cp -r $(CURDIR)/lxc/app $(CURDIR)/debian/secubox-torrent/usr/lib/secubox/torrent/
+	install -m 755 $(CURDIR)/lxc/install-lxc.sh $(CURDIR)/debian/secubox-torrent/usr/lib/secubox/torrent/
+	install -m 644 $(CURDIR)/lxc/secubox-torrent.service $(CURDIR)/debian/secubox-torrent/usr/lib/secubox/torrent/
+	install -d $(CURDIR)/debian/secubox-torrent/usr/share/secubox/www/torrent
+	cp -r $(CURDIR)/www/torrent/* $(CURDIR)/debian/secubox-torrent/usr/share/secubox/www/torrent/
+	install -d $(CURDIR)/debian/secubox-torrent/etc/nginx/secubox-vhost.d
+	install -m 644 $(CURDIR)/nginx/torrent.conf $(CURDIR)/debian/secubox-torrent/etc/nginx/secubox-vhost.d/
+	install -d $(CURDIR)/debian/secubox-torrent/etc/secubox/nft.d
+	install -m 644 $(CURDIR)/nft/torrent-egress.nft $(CURDIR)/debian/secubox-torrent/etc/secubox/nft.d/zz-torrent-egress.nft
+	install -d $(CURDIR)/debian/secubox-torrent/etc/secubox
+	install -m 644 $(CURDIR)/conf/torrent.toml $(CURDIR)/debian/secubox-torrent/etc/secubox/torrent.toml
+	install -d $(CURDIR)/debian/secubox-torrent/usr/share/secubox/menu.d
+	install -m 644 $(CURDIR)/menu.d/*.json $(CURDIR)/debian/secubox-torrent/usr/share/secubox/menu.d/
+```
+
+Note: confirm the host vhost include dir the board actually uses for full `server{}` vhosts (peertube/podcaster ship theirs there — check `packages/secubox-peertube/debian/rules` for the exact path and match it; the plan uses `etc/nginx/secubox-vhost.d` as the placeholder, correct it to peertube's path in this step).
+
+- [ ] **Step 5: Rewrite debian/postinst** (run provisioner + reload nginx/nft)
+
+```bash
+#!/bin/sh
+set -e
+case "$1" in configure)
+  # export config → env for install-lxc.sh (parse the TOML minimally)
+  export TORRENT_MAX_ACTIVE=$(grep -E '^max_active' /etc/secubox/torrent.toml | grep -oE '[0-9]+' | head -1)
+  export TORRENT_WEBRTC=$(grep -E '^webrtc' /etc/secubox/torrent.toml | grep -oE 'true|false' | head -1)
+  export TORRENT_TTL=$(grep -E '^ephemeral_ttl_hours' /etc/secubox/torrent.toml | grep -oE '[0-9]+' | head -1)
+  export TORRENT_FLOOR=$(grep -E '^disk_floor_gb' /etc/secubox/torrent.toml | grep -oE '[0-9]+' | head -1)
+  sh /usr/lib/secubox/torrent/install-lxc.sh || echo "torrent: LXC provisioning deferred (run install-lxc.sh manually)"
+  nft -f /etc/secubox/nft.d/zz-torrent-egress.nft 2>/dev/null || true
+  if command -v nginx >/dev/null 2>&1 && nginx -t >/dev/null 2>&1; then systemctl reload nginx 2>/dev/null || true; fi
+  ;;
+esac
+#DEBHELPER#
+exit 0
+```
+
+- [ ] **Step 6: Rewrite debian/postrm** (stop + optionally destroy LXC on purge)
+
+```bash
+#!/bin/sh
+set -e
+case "$1" in
+  purge)
+    lxc-stop -n torrent -P /data/lxc 2>/dev/null || true
+    lxc-destroy -n torrent -P /data/lxc 2>/dev/null || true
+    rm -f /var/lib/secubox/torrent/.lxc-provisioned 2>/dev/null || true
+    ;;
+esac
+#DEBHELPER#
+exit 0
+```
+
+- [ ] **Step 7: Add debian/changelog entry**
+
+```
+secubox-torrent (2.0.0-1~bookworm1) bookworm; urgency=medium
+
+  * Pivot from Transmission to WebTorrent streaming (LXC-native, #917).
+  * Browser player (HTTP Range), ephemeral-by-default + Keep library on /data.
+  * Hybrid WebRTC+BitTorrent engine isolated in a dedicated LXC.
+
+ -- Gerald KERMA <devel@cybermind.fr>  Tue, 28 Jul 2026 14:00:00 +0200
+```
+
+- [ ] **Step 8: Run packaging test to verify it passes** — PASS.
+
+- [ ] **Step 9: Build the .deb** — `cd packages/secubox-torrent && dpkg-buildpackage -a arm64 --host-arch arm64 -us -uc -b` → produces `secubox-torrent_2.0.0-1~bookworm1_all.deb`.
+
+- [ ] **Step 10: Commit** — `git add -A packages/secubox-torrent && git commit -m "feat(torrent): debian packaging v2.0.0, remove Transmission (ref #917)"`
+
+---
+
+## Self-Review
+
+**Spec coverage:** ✅ LXC-native isolated (T1/T7), engine hybrid (T2), Range streaming (T3), library ephemeral/kept+purge (T4/T6), API (T5), player webui (T6), host vhost+WAF+JWT (T7), nft egress (T7), packaging v2.0.0 removing Transmission (T8), wrtc-arm64 spike + fallback (T1 → threads through engine `webrtc` + `/status` badge). Retention TTL + disk-floor: T4 selection + T6 sweep. Config TOML: T7/T8.
+
+**Placeholder scan:** the two intentional impl-detail notes (statvfs `diskFreeBytes`, exact nginx vhost include path) are flagged inline with the concrete resolution to apply, not left vague. No TBD/TODO.
+
+**Type consistency:** `add()→{infohash,name,files:[{idx,name,length,type}]}` consistent T2→T5→T6; `Library` method names (add/list/get/touch/touchAt/keep/remove/expiredEphemeral) consistent T4→T5→T6; `handleStream(engine,req,res)` consistent T3→T5; `buildApi({engine,library,diskFreeBytes})` consistent T5→T6; `runPurge(engine,library,{ttlSeconds,diskFloorBytes,diskFreeBytes})` consistent T6. `engine.webrtc` field flagged in T5 note to add in T2.
+
+**Known cross-task fixups the implementer must honor:** (a) add `this.webrtc = webrtc;` to Engine (T2) — used by `/status` (T5); (b) resolve the nginx vhost include dir against peertube (T8 Step 4); (c) `diskFreeBytes` real impl via `fs.statfsSync('/data')` (T6).

From 30f89dcf6f91a32f935ad3f5794ab9b4603505a6 Mon Sep 17 00:00:00 2001
From: CyberMind-FR <gandalf@Gk2.net>
Date: Tue, 28 Jul 2026 14:31:06 +0200
Subject: [PATCH 03/17] feat(torrent): LXC skeleton + wrtc-arm64 spike (ref
 #917)

Node app skeleton (package.json, wrtc-probe.js) and idempotent
install-lxc.sh skeleton for the secubox-torrent v2.0 WebTorrent
streaming pivot.

Validated @roamhq/wrtc on arm64 via the existing peertube LXC on gk2
(Node v22.22.2, Debian 12 aarch64) since the dev workstation is x86-64
and the dedicated torrent LXC is not provisioned yet: npm install
resolved a linux-arm64 prebuild cleanly, and the shipped wrtc-probe.js
printed WEBRTC_AVAILABLE=true with a working RTCPeerConnection. Result
recorded in SPIKE-RESULT.md; @roamhq/wrtc stays in package.json.

Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
---
 packages/secubox-torrent/lxc/SPIKE-RESULT.md  | 52 +++++++++++++++++++
 packages/secubox-torrent/lxc/app/package.json | 14 +++++
 .../secubox-torrent/lxc/app/wrtc-probe.js     | 15 ++++++
 packages/secubox-torrent/lxc/install-lxc.sh   | 41 +++++++++++++++
 4 files changed, 122 insertions(+)
 create mode 100644 packages/secubox-torrent/lxc/SPIKE-RESULT.md
 create mode 100644 packages/secubox-torrent/lxc/app/package.json
 create mode 100644 packages/secubox-torrent/lxc/app/wrtc-probe.js
 create mode 100755 packages/secubox-torrent/lxc/install-lxc.sh

diff --git a/packages/secubox-torrent/lxc/SPIKE-RESULT.md b/packages/secubox-torrent/lxc/SPIKE-RESULT.md
new file mode 100644
index 00000000..624bbe2f
--- /dev/null
+++ b/packages/secubox-torrent/lxc/SPIKE-RESULT.md
@@ -0,0 +1,52 @@
+# secubox-torrent v2.0 — wrtc-arm64 spike result
+
+**Date:** 2026-07-28
+**Ref:** #917
+
+## Result
+
+```
+WEBRTC_AVAILABLE=true
+```
+
+`@roamhq/wrtc` loads a working `RTCPeerConnection` on arm64. The pinned
+dependency set in `app/package.json` (including `@roamhq/wrtc`) is kept
+as-is — no fallback removal needed.
+
+## How it was validated
+
+The dev workstation is x86-64 and cannot answer the arm64 question. Per
+the task-1 resolution, an EXISTING arm64 Node environment on gk2 was used
+instead of provisioning the `torrent` LXC on prod (that provisioning is
+Task 7's job):
+
+- Host: gk2 (`ssh root@192.168.1.200`), Debian 12.14 aarch64.
+- Container: the `peertube` LXC (`lxc-attach -n peertube -P /data/lxc`),
+  which already has Node installed.
+- Node version tested: **v22.22.2** (npm 10.9.7).
+- Scratch dir: `/tmp/wrtc-spike` inside the `peertube` LXC — `npm init -y`
+  then `npm install @roamhq/wrtc`.
+- **npm install outcome:** clean, no errors. Resolved `@roamhq/wrtc@0.10.0`
+  (brief pins `^0.8.0`; the installed prebuild satisfies the same major
+  API and pulled in the `@roamhq/wrtc-linux-arm64` optional prebuild
+  package — confirms a linux-arm64 native binding exists and installs
+  without a source build). `npm warn deprecated domexception@4.0.0` only
+  (transitive, non-blocking).
+- Ran the exact shipped `app/wrtc-probe.js` (ESM, matching this package's
+  `"type": "module"`) against the scratch install: printed
+  `WEBRTC_AVAILABLE=true`, exit 0, no crash.
+- Also ran an equivalent CommonJS one-liner
+  (`require('@roamhq/wrtc'); new RTCPeerConnection(); pc.close()`)
+  directly — same result, confirming the binding itself (not just the
+  ESM interop wrapper) works.
+- Scratch dirs (`/tmp/wrtc-spike`, `/tmp/wrtc-spike2`) removed after the
+  test; nothing persisted in the `peertube` LXC or on gk2.
+
+## Consequence for later tasks
+
+- `WEBRTC_AVAILABLE=true` is the default for `engine.js`'s `webrtc` mode
+  in later tasks (webtorrent + WebRTC hybrid streaming, as designed).
+- `@roamhq/wrtc` stays in `app/package.json` — no removal required.
+- Final confirmation still happens when the dedicated `torrent` LXC is
+  provisioned in Task 7 (this spike used a neighboring LXC's Node/OS
+  environment as a stand-in, same host arch/Debian release/kernel).
diff --git a/packages/secubox-torrent/lxc/app/package.json b/packages/secubox-torrent/lxc/app/package.json
new file mode 100644
index 00000000..1f884df5
--- /dev/null
+++ b/packages/secubox-torrent/lxc/app/package.json
@@ -0,0 +1,14 @@
+{
+  "name": "secubox-torrent",
+  "version": "2.0.0",
+  "private": true,
+  "type": "module",
+  "engines": { "node": ">=18" },
+  "scripts": { "test": "node --test" },
+  "dependencies": {
+    "webtorrent": "^2.5.1",
+    "@roamhq/wrtc": "^0.8.0",
+    "fastify": "^4.28.1",
+    "better-sqlite3": "^11.3.0"
+  }
+}
diff --git a/packages/secubox-torrent/lxc/app/wrtc-probe.js b/packages/secubox-torrent/lxc/app/wrtc-probe.js
new file mode 100644
index 00000000..4903b2b9
--- /dev/null
+++ b/packages/secubox-torrent/lxc/app/wrtc-probe.js
@@ -0,0 +1,15 @@
+// SPDX-License-Identifier: LicenseRef-CMSD-1.0
+// Copyright (c) 2026 CyberMind — Gérald Kerma <devel@cybermind.fr>
+// SecuBox-Deb :: secubox-torrent :: wrtc-probe.js — CyberMind https://cybermind.fr
+//
+// Exits 0 and prints WEBRTC_AVAILABLE=true if @roamhq/wrtc loads a
+// RTCPeerConnection on this arch; exits 0 with =false otherwise (fallback).
+try {
+  const wrtc = await import('@roamhq/wrtc');
+  const pc = new wrtc.default.RTCPeerConnection();
+  pc.close();
+  console.log('WEBRTC_AVAILABLE=true');
+} catch (e) {
+  console.log('WEBRTC_AVAILABLE=false');
+  console.error('wrtc load failed:', e.message);
+}
diff --git a/packages/secubox-torrent/lxc/install-lxc.sh b/packages/secubox-torrent/lxc/install-lxc.sh
new file mode 100755
index 00000000..cc06b804
--- /dev/null
+++ b/packages/secubox-torrent/lxc/install-lxc.sh
@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: LicenseRef-CMSD-1.0
+# SecuBox-Deb :: secubox-torrent :: install-lxc.sh
+# CyberMind — https://cybermind.fr
+#
+# Skeleton, idempotent LXC bootstrap for the secubox-torrent module (v2.0,
+# WebTorrent streaming pivot). Creates the dedicated Debian LXC + installs
+# Node so later tasks can layer the WebTorrent engine (webtorrent + fastify
+# + better-sqlite3, optionally @roamhq/wrtc — see SPIKE-RESULT.md) on top.
+# NOT executed against prod in this task; full provisioning (bridge/nat
+# setup, app deploy, systemd unit, nginx wiring) lands in a later task.
+set -euo pipefail
+readonly LXC_NAME="${SECUBOX_LXC_NAME:-torrent}"
+readonly LXC_IP="${SECUBOX_LXC_IP:-10.100.0.130}"
+readonly LXC_PATH="${SECUBOX_LXC_PATH:-/data/lxc}"
+readonly LXC_BRIDGE="${SECUBOX_LXC_BRIDGE:-br-lxc}"
+readonly LXC_GW="${SECUBOX_LXC_GW:-10.100.0.1}"
+readonly DATA_DIR="${SECUBOX_DATA_DIR:-/data/torrent}"
+readonly STATE_DIR="${SECUBOX_STATE_DIR:-/var/lib/secubox/torrent}"
+readonly SENTINEL="$STATE_DIR/.lxc-provisioned"
+log() { printf '[torrent-install] %s\n' "$*"; }
+la()  { lxc-attach -n "$LXC_NAME" -P "$LXC_PATH" -- "$@"; }
+
+mkdir -p "$STATE_DIR" "$DATA_DIR"
+if [ -f "$SENTINEL" ]; then log "already provisioned; skipping create"; else
+  lxc-create -n "$LXC_NAME" -P "$LXC_PATH" -t debian -- -r bookworm -a arm64
+  # network: static IP on br-lxc (config appended to the container config)
+  cat >> "$LXC_PATH/$LXC_NAME/config" <<EOF
+lxc.net.0.type = veth
+lxc.net.0.link = $LXC_BRIDGE
+lxc.net.0.flags = up
+lxc.net.0.ipv4.address = $LXC_IP/24
+lxc.net.0.ipv4.gateway = $LXC_GW
+EOF
+  lxc-start -n "$LXC_NAME" -P "$LXC_PATH"
+  sleep 5
+  la apt-get update
+  la apt-get install -y --no-install-recommends nodejs npm ca-certificates
+  touch "$SENTINEL"
+fi
+log "node version: $(la node --version 2>/dev/null || echo MISSING)"

From e7adb31cc81a3d6b95af8b3a6f33d83cf3d067b4 Mon Sep 17 00:00:00 2001
From: CyberMind-FR <gandalf@Gk2.net>
Date: Tue, 28 Jul 2026 14:35:25 +0200
Subject: [PATCH 04/17] feat(torrent): engine.js WebTorrent wrap + fakes (ref
 #917)

TDD complete: 3/3 tests passing. Engine constructor stores webrtc flag for
API /status route to report transport availability. Fakes enable unit tests
without real WebTorrent network or WebRTC dependencies.

Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
---
 packages/secubox-torrent/lxc/app/engine.js    | 45 +++++++++++++++++++
 .../secubox-torrent/lxc/app/engine.test.js    | 34 ++++++++++++++
 packages/secubox-torrent/lxc/app/fakes.js     | 31 +++++++++++++
 3 files changed, 110 insertions(+)
 create mode 100644 packages/secubox-torrent/lxc/app/engine.js
 create mode 100644 packages/secubox-torrent/lxc/app/engine.test.js
 create mode 100644 packages/secubox-torrent/lxc/app/fakes.js

diff --git a/packages/secubox-torrent/lxc/app/engine.js b/packages/secubox-torrent/lxc/app/engine.js
new file mode 100644
index 00000000..1c4fad25
--- /dev/null
+++ b/packages/secubox-torrent/lxc/app/engine.js
@@ -0,0 +1,45 @@
+// SPDX-License-Identifier: LicenseRef-CMSD-1.0
+// Copyright (c) 2026 CyberMind — Gérald Kerma <devel@cybermind.fr>
+// SecuBox-Deb :: secubox-torrent :: engine.js — CyberMind https://cybermind.fr
+//
+// WebTorrent engine wrapper: lifecycle, metadata, stats, peer/wire inspection.
+
+import path from 'node:path';
+
+export class Engine {
+  constructor({ WebTorrentCtor, downloadDir, maxActive, webrtc }) {
+    this.downloadDir = downloadDir; this.maxActive = maxActive;
+    this.webrtc = webrtc;
+    // webrtc=false (spike fallback) tells WebTorrent to skip the WebRTC transport.
+    this.client = new WebTorrentCtor(webrtc ? {} : { tracker: { wrtc: false } });
+  }
+  add(magnet) {
+    if (this.client.torrents.length >= this.maxActive) {
+      return Promise.reject(new Error('max active torrents reached'));
+    }
+    return new Promise((resolve, reject) => {
+      const to = setTimeout(() => reject(new Error('metadata timeout')), 60000);
+      const t = this.client.add(magnet, { path: this.downloadDir }, () => {});
+      const done = () => {
+        clearTimeout(to);
+        resolve({
+          infohash: t.infoHash, name: t.name,
+          files: t.files.map((f, i) => ({ idx: i, name: f.name, length: f.length, type: ext(f.name) })),
+        });
+      };
+      t.on('metadata', done);
+      if (t.files && t.files.length) done();
+    });
+  }
+  get(infohash) { return this.client.get(infohash); }
+  stats(infohash) {
+    const t = this.get(infohash); if (!t) return null;
+    return { progress: t.progress, downloadSpeed: t.downloadSpeed, uploadSpeed: t.uploadSpeed,
+             numPeers: t.numPeers, wires: (t.wires || []).map(w => ({ type: w.type })) };
+  }
+  remove(infohash, { deleteData } = {}) {
+    const t = this.get(infohash); if (t) t.destroy({ destroyStore: !!deleteData }, () => {});
+  }
+}
+
+function ext(name) { const m = /\.([A-Za-z0-9]+)$/.exec(name); return m ? m[1].toLowerCase() : ''; }
diff --git a/packages/secubox-torrent/lxc/app/engine.test.js b/packages/secubox-torrent/lxc/app/engine.test.js
new file mode 100644
index 00000000..e1a679cc
--- /dev/null
+++ b/packages/secubox-torrent/lxc/app/engine.test.js
@@ -0,0 +1,34 @@
+// SPDX-License-Identifier: LicenseRef-CMSD-1.0
+// Copyright (c) 2026 CyberMind — Gérald Kerma <devel@cybermind.fr>
+// SecuBox-Deb :: secubox-torrent :: engine.test.js — CyberMind https://cybermind.fr
+//
+// Unit tests for Engine (WebTorrent wrap). Uses fakes, no real network.
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { Engine } from './engine.js';
+import { FakeWebTorrent } from './fakes.js';
+
+test('add returns infohash, name and typed file list', async () => {
+  const eng = new Engine({ WebTorrentCtor: FakeWebTorrent, downloadDir: '/tmp/x', maxActive: 5, webrtc: true });
+  const r = await eng.add('magnet:?xt=urn:btih:' + 'a'.repeat(40));
+  assert.equal(r.infohash, 'a'.repeat(40));
+  assert.equal(r.files[0].type, 'mp4');
+  assert.equal(r.files[0].idx, 0);
+});
+
+test('stats returns wire types', () => {
+  const eng = new Engine({ WebTorrentCtor: FakeWebTorrent, downloadDir: '/tmp/x', maxActive: 5, webrtc: true });
+  return eng.add('magnet:?xt=urn:btih:' + 'a'.repeat(40)).then(r => {
+    const s = eng.stats(r.infohash);
+    assert.deepEqual(s.wires.map(w => w.type).sort(), ['tcp', 'webrtc']);
+    assert.equal(s.numPeers, 3);
+  });
+});
+
+test('maxActive cap rejects beyond limit', async () => {
+  const eng = new Engine({ WebTorrentCtor: FakeWebTorrent, downloadDir: '/tmp/x', maxActive: 1, webrtc: true });
+  await eng.add('magnet:?xt=urn:btih:' + 'a'.repeat(40));
+  eng.client.torrents.push({ infoHash: 'b'.repeat(40) }); // simulate a second active
+  await assert.rejects(() => eng.add('magnet:?xt=urn:btih:' + 'c'.repeat(40)), /max active/);
+});
diff --git a/packages/secubox-torrent/lxc/app/fakes.js b/packages/secubox-torrent/lxc/app/fakes.js
new file mode 100644
index 00000000..051abc4c
--- /dev/null
+++ b/packages/secubox-torrent/lxc/app/fakes.js
@@ -0,0 +1,31 @@
+// SPDX-License-Identifier: LicenseRef-CMSD-1.0
+// Copyright (c) 2026 CyberMind — Gérald Kerma <devel@cybermind.fr>
+// SecuBox-Deb :: secubox-torrent :: fakes.js — CyberMind https://cybermind.fr
+//
+// Fake WebTorrent client + torrent objects for unit tests (no real network, no wrtc).
+
+export class FakeFile {
+  constructor(name, length) { this.name = name; this.length = length; }
+}
+
+export class FakeTorrent {
+  constructor(infoHash, name, files, { failMeta = false } = {}) {
+    this.infoHash = infoHash; this.name = name;
+    this.files = files.map((f, i) => Object.assign(new FakeFile(f.name, f.length), { idx: i }));
+    this.progress = 0.1; this.downloadSpeed = 1000; this.uploadSpeed = 500;
+    this.numPeers = 3; this.wires = [{ type: 'webrtc' }, { type: 'tcp' }];
+    this._failMeta = failMeta; this._handlers = {};
+  }
+  on(ev, cb) { this._handlers[ev] = cb; if (ev === 'metadata' && !this._failMeta) queueMicrotask(cb); }
+  destroy(_opts, cb) { if (cb) cb(); }
+}
+
+export class FakeWebTorrent {
+  constructor() { this.torrents = []; }
+  add(magnet, _opts, cb) {
+    const t = this._next || new FakeTorrent('a'.repeat(40), 'Fake', [{ name: 'movie.mp4', length: 100 }]);
+    this.torrents.push(t); if (cb) queueMicrotask(() => cb(t)); return t;
+  }
+  get(infohash) { return this.torrents.find(t => t.infoHash === infohash) || null; }
+  destroy(cb) { if (cb) cb(); }
+}

From f57ccfc035a0f21fa0449b4056bf2896f4eaffa3 Mon Sep 17 00:00:00 2001
From: CyberMind-FR <gandalf@Gk2.net>
Date: Tue, 28 Jul 2026 14:40:49 +0200
Subject: [PATCH 05/17] fix(torrent): engine.remove() capacity-release + unused
 import (ref #917)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

FakeTorrent now stores client reference and splices itself from torrents[]
on destroy(), matching real webtorrent semantics. New test verifies
remove→add within maxActive limit succeeds (capacity freed).

Also remove unused 'import path' from engine.js.

4/4 tests passing.

Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
---
 packages/secubox-torrent/lxc/app/engine.js      |  2 --
 packages/secubox-torrent/lxc/app/engine.test.js | 12 +++++++++++-
 packages/secubox-torrent/lxc/app/fakes.js       | 12 +++++++++---
 3 files changed, 20 insertions(+), 6 deletions(-)

diff --git a/packages/secubox-torrent/lxc/app/engine.js b/packages/secubox-torrent/lxc/app/engine.js
index 1c4fad25..5a8eb7c6 100644
--- a/packages/secubox-torrent/lxc/app/engine.js
+++ b/packages/secubox-torrent/lxc/app/engine.js
@@ -4,8 +4,6 @@
 //
 // WebTorrent engine wrapper: lifecycle, metadata, stats, peer/wire inspection.
 
-import path from 'node:path';
-
 export class Engine {
   constructor({ WebTorrentCtor, downloadDir, maxActive, webrtc }) {
     this.downloadDir = downloadDir; this.maxActive = maxActive;
diff --git a/packages/secubox-torrent/lxc/app/engine.test.js b/packages/secubox-torrent/lxc/app/engine.test.js
index e1a679cc..287cc89d 100644
--- a/packages/secubox-torrent/lxc/app/engine.test.js
+++ b/packages/secubox-torrent/lxc/app/engine.test.js
@@ -7,7 +7,7 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import { Engine } from './engine.js';
-import { FakeWebTorrent } from './fakes.js';
+import { FakeWebTorrent, FakeTorrent } from './fakes.js';
 
 test('add returns infohash, name and typed file list', async () => {
   const eng = new Engine({ WebTorrentCtor: FakeWebTorrent, downloadDir: '/tmp/x', maxActive: 5, webrtc: true });
@@ -32,3 +32,13 @@ test('maxActive cap rejects beyond limit', async () => {
   eng.client.torrents.push({ infoHash: 'b'.repeat(40) }); // simulate a second active
   await assert.rejects(() => eng.add('magnet:?xt=urn:btih:' + 'c'.repeat(40)), /max active/);
 });
+
+test('remove frees capacity for new add', async () => {
+  const eng = new Engine({ WebTorrentCtor: FakeWebTorrent, downloadDir: '/tmp/x', maxActive: 1, webrtc: true });
+  const r1 = await eng.add('magnet:?xt=urn:btih:' + 'a'.repeat(40));
+  eng.remove(r1.infohash);
+  // Set up FakeWebTorrent to return a different torrent for the second add
+  eng.client._next = new FakeTorrent('b'.repeat(40), 'Fake2', [{ name: 'video.mp4', length: 200 }]);
+  const r2 = await eng.add('magnet:?xt=urn:btih:' + 'b'.repeat(40));
+  assert.equal(r2.infohash, 'b'.repeat(40));
+});
diff --git a/packages/secubox-torrent/lxc/app/fakes.js b/packages/secubox-torrent/lxc/app/fakes.js
index 051abc4c..5424ac9e 100644
--- a/packages/secubox-torrent/lxc/app/fakes.js
+++ b/packages/secubox-torrent/lxc/app/fakes.js
@@ -14,17 +14,23 @@ export class FakeTorrent {
     this.files = files.map((f, i) => Object.assign(new FakeFile(f.name, f.length), { idx: i }));
     this.progress = 0.1; this.downloadSpeed = 1000; this.uploadSpeed = 500;
     this.numPeers = 3; this.wires = [{ type: 'webrtc' }, { type: 'tcp' }];
-    this._failMeta = failMeta; this._handlers = {};
+    this._failMeta = failMeta; this._handlers = {}; this._client = null;
   }
   on(ev, cb) { this._handlers[ev] = cb; if (ev === 'metadata' && !this._failMeta) queueMicrotask(cb); }
-  destroy(_opts, cb) { if (cb) cb(); }
+  destroy(_opts, cb) {
+    if (this._client) {
+      const idx = this._client.torrents.indexOf(this);
+      if (idx !== -1) this._client.torrents.splice(idx, 1);
+    }
+    if (cb) cb();
+  }
 }
 
 export class FakeWebTorrent {
   constructor() { this.torrents = []; }
   add(magnet, _opts, cb) {
     const t = this._next || new FakeTorrent('a'.repeat(40), 'Fake', [{ name: 'movie.mp4', length: 100 }]);
-    this.torrents.push(t); if (cb) queueMicrotask(() => cb(t)); return t;
+    t._client = this; this.torrents.push(t); if (cb) queueMicrotask(() => cb(t)); return t;
   }
   get(infohash) { return this.torrents.find(t => t.infoHash === infohash) || null; }
   destroy(cb) { if (cb) cb(); }

From a6cc0df72049e8938cbadcdf98dba90563dec990 Mon Sep 17 00:00:00 2001
From: CyberMind-FR <gandalf@Gk2.net>
Date: Tue, 28 Jul 2026 14:44:39 +0200
Subject: [PATCH 06/17] feat(torrent): stream.js HTTP Range handler (ref #917)

Implement handleStream(engine, req, res) for WebTorrent streaming with
HTTP Range support. Handles 200 full, 206 partial, 416 unsatisfiable,
404 not found responses. MIME type detection from file extension.
Tests via node --test with fake engine/request/response (all green).

Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
---
 packages/secubox-torrent/lxc/app/stream.js    | 39 ++++++++++++
 .../secubox-torrent/lxc/app/stream.test.js    | 60 +++++++++++++++++++
 2 files changed, 99 insertions(+)
 create mode 100644 packages/secubox-torrent/lxc/app/stream.js
 create mode 100644 packages/secubox-torrent/lxc/app/stream.test.js

diff --git a/packages/secubox-torrent/lxc/app/stream.js b/packages/secubox-torrent/lxc/app/stream.js
new file mode 100644
index 00000000..32f38bef
--- /dev/null
+++ b/packages/secubox-torrent/lxc/app/stream.js
@@ -0,0 +1,39 @@
+// SPDX-License-Identifier: LicenseRef-CMSD-1.0
+// Copyright (c) 2026 CyberMind — Gérald Kerma <devel@cybermind.fr>
+// Source-Disclosed License — All rights reserved except as expressly granted.
+// See LICENCE-CMSD-1.0.md for terms.
+
+/**
+ * SecuBox-Deb :: secubox-torrent HTTP Range streaming handler
+ * CyberMind — https://cybermind.fr
+ */
+
+const MIME = { mp4: 'video/mp4', webm: 'video/webm', mkv: 'video/x-matroska',
+  m4v: 'video/mp4', mp3: 'audio/mpeg', m4a: 'audio/mp4', ogg: 'audio/ogg',
+  flac: 'audio/flac', wav: 'audio/wav' };
+
+export async function handleStream(engine, req, res) {
+  const t = engine.get(req.params.infohash);
+  const idx = Number(req.params.fileIdx);
+  const file = t && t.files && t.files[idx];
+  if (!file) { res.writeHead(404); res.end('not found'); return; }
+  const type = mimeOf(file.name);
+  const total = file.length;
+  const range = req.headers.range;
+  if (!range) {
+    res.writeHead(200, { 'Content-Length': total, 'Content-Type': type, 'Accept-Ranges': 'bytes' });
+    file.stream({ start: 0, end: total - 1 }).pipe(res);
+    return;
+  }
+  const m = /bytes=(\d+)-(\d*)/.exec(range);
+  const start = m ? Number(m[1]) : 0;
+  const end = m && m[2] ? Number(m[2]) : total - 1;
+  if (start >= total || end >= total || start > end) {
+    res.writeHead(416, { 'Content-Range': `bytes */${total}` }); res.end(); return;
+  }
+  res.writeHead(206, { 'Content-Range': `bytes ${start}-${end}/${total}`,
+    'Content-Length': end - start + 1, 'Content-Type': type, 'Accept-Ranges': 'bytes' });
+  file.stream({ start, end }).pipe(res);
+}
+
+function mimeOf(name) { const e = (/\.([A-Za-z0-9]+)$/.exec(name) || [])[1]; return MIME[(e || '').toLowerCase()] || 'application/octet-stream'; }
diff --git a/packages/secubox-torrent/lxc/app/stream.test.js b/packages/secubox-torrent/lxc/app/stream.test.js
new file mode 100644
index 00000000..db80d7a1
--- /dev/null
+++ b/packages/secubox-torrent/lxc/app/stream.test.js
@@ -0,0 +1,60 @@
+// SPDX-License-Identifier: LicenseRef-CMSD-1.0
+// Copyright (c) 2026 CyberMind — Gérald Kerma <devel@cybermind.fr>
+// Source-Disclosed License — All rights reserved except as expressly granted.
+// See LICENCE-CMSD-1.0.md for terms.
+
+/**
+ * SecuBox-Deb :: secubox-torrent stream handler tests
+ * CyberMind — https://cybermind.fr
+ */
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { Readable } from 'node:stream';
+import { handleStream } from './stream.js';
+
+function fakeRes() {
+  const listeners = {};
+  return { statusCode: 200, headers: {}, ended: false, body: '',
+    setHeader(k, v) { this.headers[k.toLowerCase()] = v; },
+    writeHead(c, h) { this.statusCode = c; Object.assign(this.headers, lower(h || {})); },
+    end(s) { if (s) this.body += s; this.ended = true; },
+    on(event, listener) { if (!listeners[event]) listeners[event] = []; listeners[event].push(listener); return this; },
+    once(event, listener) { const wrapped = (...args) => { listener(...args); const idx = listeners[event].indexOf(wrapped); if (idx >= 0) listeners[event].splice(idx, 1); }; if (!listeners[event]) listeners[event] = []; listeners[event].push(wrapped); return this; },
+    write(chunk, encoding, cb) { this.body += chunk; if (cb) cb(); return true; },
+    emit(event, data) { if (listeners[event]) listeners[event].forEach(l => l(data)); } };
+}
+const lower = o => Object.fromEntries(Object.entries(o).map(([k, v]) => [k.toLowerCase(), v]));
+function fakeEngine(len = 100) {
+  const file = { name: 'movie.mp4', length: len,
+    stream: ({ start, end }) => Readable.from([`bytes[${start}-${end}]`]) };
+  return { get: () => ({ files: [file] }) };
+}
+
+test('full request returns 200 with content-length and type', async () => {
+  const res = fakeRes();
+  await handleStream(fakeEngine(100), { params: { infohash: 'a', fileIdx: '0' }, headers: {} }, res);
+  assert.equal(res.statusCode, 200);
+  assert.equal(res.headers['content-length'], 100);
+  assert.match(res.headers['content-type'], /mp4/);
+});
+
+test('range request returns 206 with content-range', async () => {
+  const res = fakeRes();
+  await handleStream(fakeEngine(100), { params: { infohash: 'a', fileIdx: '0' }, headers: { range: 'bytes=10-19' } }, res);
+  assert.equal(res.statusCode, 206);
+  assert.equal(res.headers['content-range'], 'bytes 10-19/100');
+  assert.equal(res.headers['content-length'], 10);
+});
+
+test('unsatisfiable range returns 416', async () => {
+  const res = fakeRes();
+  await handleStream(fakeEngine(100), { params: { infohash: 'a', fileIdx: '0' }, headers: { range: 'bytes=200-300' } }, res);
+  assert.equal(res.statusCode, 416);
+});
+
+test('unknown infohash returns 404', async () => {
+  const res = fakeRes();
+  await handleStream({ get: () => null }, { params: { infohash: 'z', fileIdx: '0' }, headers: {} }, res);
+  assert.equal(res.statusCode, 404);
+});

From d45803db0cfc8f7687388036abb0a416171db1b1 Mon Sep 17 00:00:00 2001
From: CyberMind-FR <gandalf@Gk2.net>
Date: Tue, 28 Jul 2026 14:51:18 +0200
Subject: [PATCH 07/17] fix(torrent): stream.js Critical/Important review fixes
 (ref #917)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Critical: Change file.stream({start,end}) → file.createReadStream({start,end})
to match real webtorrent ^2.5.1 API (WHATWG ReadableStream vs Node Readable).

Important #1: RFC 7233 compliance — clamp end >= total to total-1 instead
of rejecting with 416. Only reject when start >= total or start > end.

Important #2: Attach stream error handlers to prevent unhandled crashes
on peer disconnect or missing pieces.

Minor: Add tests for range clamping (bytes=50-999999 on 100-byte file)
and out-of-range fileIdx. All 6 tests passing (green).

Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
---
 packages/secubox-torrent/lxc/app/stream.js      | 15 ++++++++++-----
 packages/secubox-torrent/lxc/app/stream.test.js | 16 +++++++++++++++-
 2 files changed, 25 insertions(+), 6 deletions(-)

diff --git a/packages/secubox-torrent/lxc/app/stream.js b/packages/secubox-torrent/lxc/app/stream.js
index 32f38bef..4e275361 100644
--- a/packages/secubox-torrent/lxc/app/stream.js
+++ b/packages/secubox-torrent/lxc/app/stream.js
@@ -22,18 +22,23 @@ export async function handleStream(engine, req, res) {
   const range = req.headers.range;
   if (!range) {
     res.writeHead(200, { 'Content-Length': total, 'Content-Type': type, 'Accept-Ranges': 'bytes' });
-    file.stream({ start: 0, end: total - 1 }).pipe(res);
+    const stream = file.createReadStream({ start: 0, end: total - 1 });
+    stream.on('error', () => { try { res.destroy(); } catch {} });
+    stream.pipe(res);
     return;
   }
   const m = /bytes=(\d+)-(\d*)/.exec(range);
-  const start = m ? Number(m[1]) : 0;
-  const end = m && m[2] ? Number(m[2]) : total - 1;
-  if (start >= total || end >= total || start > end) {
+  let start = m ? Number(m[1]) : 0;
+  let end = m && m[2] ? Number(m[2]) : total - 1;
+  if (end >= total) end = total - 1;
+  if (start >= total || start > end) {
     res.writeHead(416, { 'Content-Range': `bytes */${total}` }); res.end(); return;
   }
   res.writeHead(206, { 'Content-Range': `bytes ${start}-${end}/${total}`,
     'Content-Length': end - start + 1, 'Content-Type': type, 'Accept-Ranges': 'bytes' });
-  file.stream({ start, end }).pipe(res);
+  const stream = file.createReadStream({ start, end });
+  stream.on('error', () => { try { res.destroy(); } catch {} });
+  stream.pipe(res);
 }
 
 function mimeOf(name) { const e = (/\.([A-Za-z0-9]+)$/.exec(name) || [])[1]; return MIME[(e || '').toLowerCase()] || 'application/octet-stream'; }
diff --git a/packages/secubox-torrent/lxc/app/stream.test.js b/packages/secubox-torrent/lxc/app/stream.test.js
index db80d7a1..9daa14fe 100644
--- a/packages/secubox-torrent/lxc/app/stream.test.js
+++ b/packages/secubox-torrent/lxc/app/stream.test.js
@@ -27,7 +27,7 @@ function fakeRes() {
 const lower = o => Object.fromEntries(Object.entries(o).map(([k, v]) => [k.toLowerCase(), v]));
 function fakeEngine(len = 100) {
   const file = { name: 'movie.mp4', length: len,
-    stream: ({ start, end }) => Readable.from([`bytes[${start}-${end}]`]) };
+    createReadStream: ({ start, end }) => Readable.from([`bytes[${start}-${end}]`]) };
   return { get: () => ({ files: [file] }) };
 }
 
@@ -58,3 +58,17 @@ test('unknown infohash returns 404', async () => {
   await handleStream({ get: () => null }, { params: { infohash: 'z', fileIdx: '0' }, headers: {} }, res);
   assert.equal(res.statusCode, 404);
 });
+
+test('range clamping: bytes=50-999999 on 100-byte file returns 206 with clamped end', async () => {
+  const res = fakeRes();
+  await handleStream(fakeEngine(100), { params: { infohash: 'a', fileIdx: '0' }, headers: { range: 'bytes=50-999999' } }, res);
+  assert.equal(res.statusCode, 206);
+  assert.equal(res.headers['content-range'], 'bytes 50-99/100');
+  assert.equal(res.headers['content-length'], 50);
+});
+
+test('out-of-range fileIdx returns 404', async () => {
+  const res = fakeRes();
+  await handleStream(fakeEngine(100), { params: { infohash: 'a', fileIdx: '5' }, headers: {} }, res);
+  assert.equal(res.statusCode, 404);
+});

From 7aaa8d5409cdfe6cd6236a7d1052ee183f965d94 Mon Sep 17 00:00:00 2001
From: CyberMind-FR <gandalf@Gk2.net>
Date: Tue, 28 Jul 2026 15:00:32 +0200
Subject: [PATCH 08/17] feat(torrent): library.js SQLite + purge selection (ref
 #917)

Adds SQLite-backed torrent library (add/list/get/touch/keep/remove) and
the expiredEphemeral() query the purge job uses to find stale
kept=0 torrents (last_played_at < now-ttl). Includes package-lock.json
and a lxc/app .gitignore for node_modules.

Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
---
 packages/secubox-torrent/lxc/app/.gitignore   |    1 +
 packages/secubox-torrent/lxc/app/library.js   |   34 +
 .../secubox-torrent/lxc/app/library.test.js   |   38 +
 .../secubox-torrent/lxc/app/package-lock.json | 3061 +++++++++++++++++
 4 files changed, 3134 insertions(+)
 create mode 100644 packages/secubox-torrent/lxc/app/.gitignore
 create mode 100644 packages/secubox-torrent/lxc/app/library.js
 create mode 100644 packages/secubox-torrent/lxc/app/library.test.js
 create mode 100644 packages/secubox-torrent/lxc/app/package-lock.json

diff --git a/packages/secubox-torrent/lxc/app/.gitignore b/packages/secubox-torrent/lxc/app/.gitignore
new file mode 100644
index 00000000..c2658d7d
--- /dev/null
+++ b/packages/secubox-torrent/lxc/app/.gitignore
@@ -0,0 +1 @@
+node_modules/
diff --git a/packages/secubox-torrent/lxc/app/library.js b/packages/secubox-torrent/lxc/app/library.js
new file mode 100644
index 00000000..eea1f708
--- /dev/null
+++ b/packages/secubox-torrent/lxc/app/library.js
@@ -0,0 +1,34 @@
+// SPDX-License-Identifier: LicenseRef-CMSD-1.0
+// Copyright (c) 2026 CyberMind — Gérald Kerma <devel@cybermind.fr>
+// SecuBox-Deb :: secubox-torrent :: library.js — CyberMind https://cybermind.fr
+//
+// SQLite-backed torrent library: ephemeral (kept=0) vs. kept torrents, plus
+// the selection query used by the purge job to find stale ephemeral entries.
+
+import Database from 'better-sqlite3';
+
+export class Library {
+  constructor(dbPath) {
+    this.db = new Database(dbPath);
+    this.db.exec(`CREATE TABLE IF NOT EXISTS torrents (
+      infohash TEXT PRIMARY KEY, name TEXT, magnet TEXT, path TEXT,
+      added_at INTEGER, last_played_at INTEGER, kept INTEGER DEFAULT 0)`);
+  }
+  add({ infohash, name, magnet, path }) {
+    const now = Math.floor(Date.now() / 1000);
+    this.db.prepare(`INSERT OR REPLACE INTO torrents
+      (infohash,name,magnet,path,added_at,last_played_at,kept)
+      VALUES (?,?,?,?,?,?,0)`).run(infohash, name, magnet, path, now, now);
+  }
+  list() { return this.db.prepare('SELECT * FROM torrents ORDER BY added_at DESC').all(); }
+  get(infohash) { return this.db.prepare('SELECT * FROM torrents WHERE infohash=?').get(infohash) || null; }
+  touch(infohash) { this.touchAt(infohash, Math.floor(Date.now() / 1000)); }
+  touchAt(infohash, ts) { this.db.prepare('UPDATE torrents SET last_played_at=? WHERE infohash=?').run(ts, infohash); }
+  keep(infohash, newPath) { this.db.prepare('UPDATE torrents SET kept=1, path=? WHERE infohash=?').run(newPath, infohash); }
+  remove(infohash) { this.db.prepare('DELETE FROM torrents WHERE infohash=?').run(infohash); }
+  expiredEphemeral(ttlSeconds, now = Math.floor(Date.now() / 1000)) {
+    const cutoff = now - ttlSeconds;
+    return this.db.prepare('SELECT infohash FROM torrents WHERE kept=0 AND last_played_at < ?')
+      .all(cutoff).map(r => r.infohash);
+  }
+}
diff --git a/packages/secubox-torrent/lxc/app/library.test.js b/packages/secubox-torrent/lxc/app/library.test.js
new file mode 100644
index 00000000..09a740ee
--- /dev/null
+++ b/packages/secubox-torrent/lxc/app/library.test.js
@@ -0,0 +1,38 @@
+// SPDX-License-Identifier: LicenseRef-CMSD-1.0
+// Copyright (c) 2026 CyberMind — Gérald Kerma <devel@cybermind.fr>
+// SecuBox-Deb :: secubox-torrent :: library.test.js — CyberMind https://cybermind.fr
+//
+// Tests for the SQLite-backed torrent library + ephemeral purge selection.
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { Library } from './library.js';
+
+const mk = () => new Library(':memory:');
+
+test('add then list yields one ephemeral row', () => {
+  const lib = mk();
+  lib.add({ infohash: 'a', name: 'A', magnet: 'm', path: '/tmp/a' });
+  const rows = lib.list();
+  assert.equal(rows.length, 1);
+  assert.equal(rows[0].kept, 0);
+});
+
+test('keep flips kept and updates path', () => {
+  const lib = mk();
+  lib.add({ infohash: 'a', name: 'A', magnet: 'm', path: '/tmp/a' });
+  lib.keep('a', '/data/torrent/library/a');
+  assert.equal(lib.get('a').kept, 1);
+  assert.equal(lib.get('a').path, '/data/torrent/library/a');
+});
+
+test('expiredEphemeral returns only stale unkept torrents', () => {
+  const lib = mk();
+  lib.add({ infohash: 'old', name: 'O', magnet: 'm', path: '/tmp/o' });
+  lib.add({ infohash: 'fresh', name: 'F', magnet: 'm', path: '/tmp/f' });
+  lib.add({ infohash: 'kept', name: 'K', magnet: 'm', path: '/tmp/k' });
+  lib.touchAt('old', 1000); lib.touchAt('fresh', 9000); lib.touchAt('kept', 1000);
+  lib.keep('kept', '/data/k');
+  const exp = lib.expiredEphemeral(3600, 10000); // now=10000, ttl=3600 → cutoff 6400
+  assert.deepEqual(exp, ['old']);
+});
diff --git a/packages/secubox-torrent/lxc/app/package-lock.json b/packages/secubox-torrent/lxc/app/package-lock.json
new file mode 100644
index 00000000..49bb608d
--- /dev/null
+++ b/packages/secubox-torrent/lxc/app/package-lock.json
@@ -0,0 +1,3061 @@
+{
+  "name": "secubox-torrent",
+  "version": "2.0.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "secubox-torrent",
+      "version": "2.0.0",
+      "dependencies": {
+        "@roamhq/wrtc": "^0.8.0",
+        "better-sqlite3": "^11.3.0",
+        "fastify": "^4.28.1",
+        "webtorrent": "^2.5.1"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@fastify/ajv-compiler": {
+      "version": "3.6.0",
+      "resolved": "https://registry.npmjs.org/@fastify/ajv-compiler/-/ajv-compiler-3.6.0.tgz",
+      "integrity": "sha512-LwdXQJjmMD+GwLOkP7TVC68qa+pSSogeWWmznRJ/coyTcfe9qA05AHFSe1eZFwK6q+xVRpChnvFUkf1iYaSZsQ==",
+      "license": "MIT",
+      "dependencies": {
+        "ajv": "^8.11.0",
+        "ajv-formats": "^2.1.1",
+        "fast-uri": "^2.0.0"
+      }
+    },
+    "node_modules/@fastify/error": {
+      "version": "3.4.1",
+      "resolved": "https://registry.npmjs.org/@fastify/error/-/error-3.4.1.tgz",
+      "integrity": "sha512-wWSvph+29GR783IhmvdwWnN4bUxTD01Vm5Xad4i7i1VuAOItLvbPAb69sb0IQ2N57yprvhNIwAP5B6xfKTmjmQ==",
+      "license": "MIT"
+    },
+    "node_modules/@fastify/fast-json-stringify-compiler": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/@fastify/fast-json-stringify-compiler/-/fast-json-stringify-compiler-4.3.0.tgz",
+      "integrity": "sha512-aZAXGYo6m22Fk1zZzEUKBvut/CIIQe/BapEORnxiD5Qr0kPHqqI69NtEMCme74h+at72sPhbkb4ZrLd1W3KRLA==",
+      "license": "MIT",
+      "dependencies": {
+        "fast-json-stringify": "^5.7.0"
+      }
+    },
+    "node_modules/@fastify/merge-json-schemas": {
+      "version": "0.1.1",
+      "resolved": "https://registry.npmjs.org/@fastify/merge-json-schemas/-/merge-json-schemas-0.1.1.tgz",
+      "integrity": "sha512-fERDVz7topgNjtXsJTTW1JKLy0rhuLRcquYqNR9rF7OcVpCa2OVW49ZPDIhaRRCaUuvVxI+N416xUoF76HNSXA==",
+      "license": "MIT",
+      "dependencies": {
+        "fast-deep-equal": "^3.1.3"
+      }
+    },
+    "node_modules/@pinojs/redact": {
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/@pinojs/redact/-/redact-0.4.0.tgz",
+      "integrity": "sha512-k2ENnmBugE/rzQfEcdWHcCY+/FM3VLzH9cYEsbdsoqrvzAKRhUZeRNhAZvB8OitQJ1TBed3yqWtdjzS6wJKBwg==",
+      "license": "MIT"
+    },
+    "node_modules/@roamhq/wrtc": {
+      "version": "0.8.0",
+      "resolved": "https://registry.npmjs.org/@roamhq/wrtc/-/wrtc-0.8.0.tgz",
+      "integrity": "sha512-C0V/nqc4/2xzORI5qa4mIeN/8UO3ywN1kInrJ9u6GljFx0D18JMUJEqe8yYHa61RrEeoWN3PKdW++k8TocSx/A==",
+      "license": "BSD-2-Clause",
+      "optionalDependencies": {
+        "@roamhq/wrtc-darwin-arm64": "0.8.0",
+        "@roamhq/wrtc-darwin-x64": "0.8.0",
+        "@roamhq/wrtc-linux-arm64": "0.8.1",
+        "@roamhq/wrtc-linux-x64": "0.8.1",
+        "@roamhq/wrtc-win32-x64": "0.8.0",
+        "domexception": "^4.0.0"
+      }
+    },
+    "node_modules/@roamhq/wrtc-darwin-arm64": {
+      "version": "0.8.0",
+      "resolved": "https://registry.npmjs.org/@roamhq/wrtc-darwin-arm64/-/wrtc-darwin-arm64-0.8.0.tgz",
+      "integrity": "sha512-OtV2KWO7zOG3L8TF3KCt9aucynVCD/ww2xeXXgg+FLkya3ca0uzehN8EQJ3BL4tkInksbFJ2ssyu9cehfJ3ZuA==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "BSD-2-Clause",
+      "optional": true,
+      "os": [
+        "darwin"
+      ]
+    },
+    "node_modules/@roamhq/wrtc-darwin-x64": {
+      "version": "0.8.0",
+      "resolved": "https://registry.npmjs.org/@roamhq/wrtc-darwin-x64/-/wrtc-darwin-x64-0.8.0.tgz",
+      "integrity": "sha512-VY7Vzt/SDDDCpW//h8GW9bOZrOr8gWXPZVD9473ypl4jyBIoO57yyLbHzd1G0vBUkS6szsHlQCz1WwpI30YL+g==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "BSD-2-Clause",
+      "optional": true,
+      "os": [
+        "darwin"
+      ]
+    },
+    "node_modules/@roamhq/wrtc-linux-arm64": {
+      "version": "0.8.1",
+      "resolved": "https://registry.npmjs.org/@roamhq/wrtc-linux-arm64/-/wrtc-linux-arm64-0.8.1.tgz",
+      "integrity": "sha512-FBJLLazlWkGQUXaokC/rTbrUQbb0CNFYry52fZGstufrGLTWu+g4HcwXdVvxh1tnVtVMvkQGk+mlOL52sCxw0A==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "BSD-2-Clause",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@roamhq/wrtc-linux-x64": {
+      "version": "0.8.1",
+      "resolved": "https://registry.npmjs.org/@roamhq/wrtc-linux-x64/-/wrtc-linux-x64-0.8.1.tgz",
+      "integrity": "sha512-I9oWG7b4uvWO1IOR/aF34n+ID6TKVuSs0jd19h5KdhfRtw7FFh9xxuwN9rONPxLVa6fS0q+MCZgAf8Scz89L8Q==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "BSD-2-Clause",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@roamhq/wrtc-win32-x64": {
+      "version": "0.8.0",
+      "resolved": "https://registry.npmjs.org/@roamhq/wrtc-win32-x64/-/wrtc-win32-x64-0.8.0.tgz",
+      "integrity": "sha512-R2fxl41BLWPiP4eaTHGLzbbVvRjx1mV/OsgINCvawO7Hwz5Zx9I45+Fhrw3hd4n5amIeSG9VIF7Kz8eeTFXTGQ==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "BSD-2-Clause",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
+    "node_modules/@silentbot1/nat-api": {
+      "version": "0.4.9",
+      "resolved": "https://registry.npmjs.org/@silentbot1/nat-api/-/nat-api-0.4.9.tgz",
+      "integrity": "sha512-Bm2Fr0sJyGr4B/XgKjQxjGe7Rzs/OlK91OIHsghObxhP3Y4j2y8o7Xjlledu/pxzFEIWaTbZIBSl8ABqoP/WhQ==",
+      "license": "MIT",
+      "dependencies": {
+        "chrome-dgram": "^3.0.6",
+        "cross-fetch-ponyfill": "^1.0.3",
+        "debug": "^4.4.0",
+        "default-gateway": "^7.2.2",
+        "unordered-array-remove": "^1.0.2",
+        "xml2js": "^0.6.2"
+      },
+      "engines": {
+        "node": ">=10.0.0"
+      }
+    },
+    "node_modules/@thaunknown/simple-peer": {
+      "version": "10.1.2",
+      "resolved": "https://registry.npmjs.org/@thaunknown/simple-peer/-/simple-peer-10.1.2.tgz",
+      "integrity": "sha512-pcG35e815X43Crr/HVmOWlbsx9Jz3KD27HOhy/BwIjQkDlafzJFl0NKb8B+bf+bsnfQL/BB6Z44cMZPQaYHLYQ==",
+      "license": "MIT",
+      "dependencies": {
+        "debug": "^4.4.3",
+        "err-code": "^3.0.1",
+        "streamx": "^2.28.0",
+        "uint8-util": "^2.3.2",
+        "webrtc-polyfill": "^1.2.2"
+      }
+    },
+    "node_modules/@thaunknown/simple-peer/node_modules/streamx": {
+      "version": "2.28.0",
+      "resolved": "https://registry.npmjs.org/streamx/-/streamx-2.28.0.tgz",
+      "integrity": "sha512-1Yowhzjf0ivGMrTIkY9hav5TxobO9qIVqUE41fiCGMGgc3CLlf4MY+9AHmZqBWgDTue0fY9zWjYFVyf6Diuobw==",
+      "license": "MIT",
+      "dependencies": {
+        "events-universal": "^1.0.0",
+        "fast-fifo": "^1.3.2",
+        "text-decoder": "^1.1.0"
+      }
+    },
+    "node_modules/@thaunknown/simple-websocket": {
+      "version": "9.1.5",
+      "resolved": "https://registry.npmjs.org/@thaunknown/simple-websocket/-/simple-websocket-9.1.5.tgz",
+      "integrity": "sha512-FTrycAOMeJIHxHxH4iiq0EHMlmITvim04FGpwRcrytykg4jCFPaRYJqjo8wvBVx88TYfxrtQCaHhzaKLDKS71w==",
+      "license": "MIT",
+      "dependencies": {
+        "debug": "^4.4.3",
+        "queue-microtask": "^1.2.3",
+        "streamx": "^2.28.0",
+        "uint8-util": "^2.3.2",
+        "ws": "^8.21.1"
+      }
+    },
+    "node_modules/@thaunknown/simple-websocket/node_modules/streamx": {
+      "version": "2.28.0",
+      "resolved": "https://registry.npmjs.org/streamx/-/streamx-2.28.0.tgz",
+      "integrity": "sha512-1Yowhzjf0ivGMrTIkY9hav5TxobO9qIVqUE41fiCGMGgc3CLlf4MY+9AHmZqBWgDTue0fY9zWjYFVyf6Diuobw==",
+      "license": "MIT",
+      "dependencies": {
+        "events-universal": "^1.0.0",
+        "fast-fifo": "^1.3.2",
+        "text-decoder": "^1.1.0"
+      }
+    },
+    "node_modules/@thaunknown/thirty-two": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/@thaunknown/thirty-two/-/thirty-two-1.0.6.tgz",
+      "integrity": "sha512-Uz2kFb0cNeHg7hds8BtI/umcwzaSMUdbkeQgZrIZQbp3gWRFjrvrvBHNEB6SQYChVxC3rWHovKx1Ya/vSRRMYA==",
+      "license": "MIT",
+      "dependencies": {
+        "uint8-util": "^2.3.2"
+      },
+      "engines": {
+        "node": ">=0.2.6"
+      }
+    },
+    "node_modules/@webtorrent/http-node": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/@webtorrent/http-node/-/http-node-1.3.0.tgz",
+      "integrity": "sha512-GWZQKroPES4z91Ijx6zsOsb7+USOxjy66s8AoTWg0HiBBdfnbtf9aeh3Uav0MgYn4BL8Q7tVSUpd0gGpngKGEQ==",
+      "license": "MIT",
+      "dependencies": {
+        "freelist": "^1.0.3",
+        "http-parser-js": "^0.4.3"
+      }
+    },
+    "node_modules/abort-controller": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/abort-controller/-/abort-controller-3.0.0.tgz",
+      "integrity": "sha512-h8lQ8tacZYnR3vNQTgibj+tODHI5/+l06Au2Pcriv/Gmet0eaj4TwWH41sO9wnHDiQsEj19q0drzdWdeAHtweg==",
+      "license": "MIT",
+      "dependencies": {
+        "event-target-shim": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=6.5"
+      }
+    },
+    "node_modules/abstract-logging": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/abstract-logging/-/abstract-logging-2.0.1.tgz",
+      "integrity": "sha512-2BjRTZxTPvheOvGbBslFSYOUkr+SjPtOnrLP33f+VIWLzezQpZcqVg7ja3L4dBXmzzgwT+a029jRx5PCi3JuiA==",
+      "license": "MIT"
+    },
+    "node_modules/addr-to-ip-port": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/addr-to-ip-port/-/addr-to-ip-port-2.0.0.tgz",
+      "integrity": "sha512-9bYbtjamtdLHZSqVIUXhilOryNPiL+x+Q5J/Unpg4VY3ZIkK3fT52UoErj1NdUeVm3J1t2iBEAur4Ywbl/bahw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=12.20.0"
+      }
+    },
+    "node_modules/ajv": {
+      "version": "8.20.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz",
+      "integrity": "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==",
+      "license": "MIT",
+      "dependencies": {
+        "fast-deep-equal": "^3.1.3",
+        "fast-uri": "^3.0.1",
+        "json-schema-traverse": "^1.0.0",
+        "require-from-string": "^2.0.2"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/epoberezkin"
+      }
+    },
+    "node_modules/ajv-formats": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/ajv-formats/-/ajv-formats-2.1.1.tgz",
+      "integrity": "sha512-Wx0Kx52hxE7C18hkMEggYlEifqWZtYaRgouJor+WMdPnQyEK13vgEWyVNup7SoeeoLMsr4kf5h6dOW11I15MUA==",
+      "license": "MIT",
+      "dependencies": {
+        "ajv": "^8.0.0"
+      },
+      "peerDependencies": {
+        "ajv": "^8.0.0"
+      },
+      "peerDependenciesMeta": {
+        "ajv": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/ajv/node_modules/fast-uri": {
+      "version": "3.1.4",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.4.tgz",
+      "integrity": "sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/atomic-sleep": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/atomic-sleep/-/atomic-sleep-1.0.0.tgz",
+      "integrity": "sha512-kNOjDqAh7px0XWNI+4QbzoiR/nTkHAWNud2uvnJquD1/x5a7EQZMJT0AczqK0Qn67oY/TTQ1LbUKajZpp3I9tQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8.0.0"
+      }
+    },
+    "node_modules/avvio": {
+      "version": "8.4.0",
+      "resolved": "https://registry.npmjs.org/avvio/-/avvio-8.4.0.tgz",
+      "integrity": "sha512-CDSwaxINFy59iNwhYnkvALBwZiTydGkOecZyPkqBpABYR1KqGEsET0VOOYDwtleZSUIdeY36DC2bSZ24CO1igA==",
+      "license": "MIT",
+      "dependencies": {
+        "@fastify/error": "^3.3.0",
+        "fastq": "^1.17.1"
+      }
+    },
+    "node_modules/b4a": {
+      "version": "1.8.1",
+      "resolved": "https://registry.npmjs.org/b4a/-/b4a-1.8.1.tgz",
+      "integrity": "sha512-aiqre1Nr0B/6DgE2N5vwTc+2/oQZ4Wh1t4NznYY4E00y8LCt6NqdRv81so00oo27D8MVKTpUa/MwUUtBLXCoDw==",
+      "license": "Apache-2.0",
+      "peerDependencies": {
+        "react-native-b4a": "*"
+      },
+      "peerDependenciesMeta": {
+        "react-native-b4a": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/bare-addon-resolve": {
+      "version": "1.10.1",
+      "resolved": "https://registry.npmjs.org/bare-addon-resolve/-/bare-addon-resolve-1.10.1.tgz",
+      "integrity": "sha512-F/SD2du8keuYSb4xipnGz5j2E6yhNdHA8ZVxtHae6h2uOrpBIjjbhXvjzKZbr5XUOzqBzh/i8GVFycj2DlFQIA==",
+      "license": "Apache-2.0",
+      "optional": true,
+      "dependencies": {
+        "bare-module-resolve": "^1.10.0",
+        "bare-semver": "^1.0.0"
+      },
+      "peerDependencies": {
+        "bare-url": "*"
+      },
+      "peerDependenciesMeta": {
+        "bare-url": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/bare-events": {
+      "version": "2.9.1",
+      "resolved": "https://registry.npmjs.org/bare-events/-/bare-events-2.9.1.tgz",
+      "integrity": "sha512-Z0oHEHAFDZkffN8Qc39zNZjQlMDkPJRyyyZieU1VH7u8c5S+qHZ2S8ixdKIAxEjfHO7FJxXmJWgteOghVanIsg==",
+      "license": "Apache-2.0",
+      "peer": true,
+      "peerDependencies": {
+        "bare-abort-controller": "*"
+      },
+      "peerDependenciesMeta": {
+        "bare-abort-controller": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/bare-fs": {
+      "version": "4.7.4",
+      "resolved": "https://registry.npmjs.org/bare-fs/-/bare-fs-4.7.4.tgz",
+      "integrity": "sha512-y1kC+ffIx/tPLdTE693uNjHfzTfr+ravR5tvWlMXe25nELbkqV400S71qHDwbkAQ1FVEZobB1NFRzFbCCcyBCQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "bare-events": "^2.5.4",
+        "bare-path": "^3.0.0",
+        "bare-stream": "^2.6.4",
+        "bare-url": "^2.2.2",
+        "fast-fifo": "^1.3.2"
+      },
+      "engines": {
+        "bare": ">=1.16.0"
+      },
+      "peerDependencies": {
+        "bare-buffer": "*"
+      },
+      "peerDependenciesMeta": {
+        "bare-buffer": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/bare-module-resolve": {
+      "version": "1.12.4",
+      "resolved": "https://registry.npmjs.org/bare-module-resolve/-/bare-module-resolve-1.12.4.tgz",
+      "integrity": "sha512-xcfgg2u7HqgJiBmah71O9vvdFAgHCvkqC/WSC2O7Bbgosoc1eC/BWe/6IDJ4OsfKlkxuvC/TDWXC+oH5yeW8mA==",
+      "license": "Apache-2.0",
+      "optional": true,
+      "dependencies": {
+        "bare-semver": "^1.0.0"
+      },
+      "peerDependencies": {
+        "bare-url": "*"
+      },
+      "peerDependenciesMeta": {
+        "bare-url": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/bare-path": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/bare-path/-/bare-path-3.1.1.tgz",
+      "integrity": "sha512-JprUlveX3QjApC1cTpsUOiscADftCGVWkzitbHsRqv84hzYwYHw2mbluddsq5TvI8mH/8Ov1f4BiMAdcB0oYnQ==",
+      "license": "Apache-2.0"
+    },
+    "node_modules/bare-semver": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/bare-semver/-/bare-semver-1.1.0.tgz",
+      "integrity": "sha512-1Hw5qJ7hXdVt3uPUqjeFTuxyvBUJauvz5A1I2jk8gzjZMHp04n//6nV9MDbG9CMw78JHY2lGV0w6s//LrASm2w==",
+      "license": "Apache-2.0",
+      "optional": true
+    },
+    "node_modules/bare-stream": {
+      "version": "2.13.3",
+      "resolved": "https://registry.npmjs.org/bare-stream/-/bare-stream-2.13.3.tgz",
+      "integrity": "sha512-Kc+brLqvEqGkjyfiwJmImAOqLZL7OsoLKuavx+hJjgVV3nLTOjloJyPMFxjUPerGGHrNH0fLU06jjykMLWrERQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "b4a": "^1.8.1",
+        "streamx": "^2.25.0",
+        "teex": "^1.0.1"
+      },
+      "peerDependencies": {
+        "bare-abort-controller": "*",
+        "bare-buffer": "*",
+        "bare-events": "*"
+      },
+      "peerDependenciesMeta": {
+        "bare-abort-controller": {
+          "optional": true
+        },
+        "bare-buffer": {
+          "optional": true
+        },
+        "bare-events": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/bare-stream/node_modules/streamx": {
+      "version": "2.28.0",
+      "resolved": "https://registry.npmjs.org/streamx/-/streamx-2.28.0.tgz",
+      "integrity": "sha512-1Yowhzjf0ivGMrTIkY9hav5TxobO9qIVqUE41fiCGMGgc3CLlf4MY+9AHmZqBWgDTue0fY9zWjYFVyf6Diuobw==",
+      "license": "MIT",
+      "dependencies": {
+        "events-universal": "^1.0.0",
+        "fast-fifo": "^1.3.2",
+        "text-decoder": "^1.1.0"
+      }
+    },
+    "node_modules/bare-url": {
+      "version": "2.4.6",
+      "resolved": "https://registry.npmjs.org/bare-url/-/bare-url-2.4.6.tgz",
+      "integrity": "sha512-iQxPClE07hETVpbRoX7JXX3v/ZQViCxe/SYCxylRLzdEx1xJAufPptfiOqR8tqiCtmbtMDANKWszzjLu1PMAZQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "bare-path": "^3.0.0"
+      }
+    },
+    "node_modules/base64-js": {
+      "version": "1.5.1",
+      "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz",
+      "integrity": "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/bencode": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/bencode/-/bencode-4.0.1.tgz",
+      "integrity": "sha512-/bCR3FvgfB8AZk4LlowShU+nfaTNRM2vruJ9aejDa5LpgkCoRjFyEauFiZFxbpxVxQbBFapYCN42Er2dkE/Qgw==",
+      "license": "MIT",
+      "dependencies": {
+        "uint8-util": "^2.2.2"
+      },
+      "engines": {
+        "node": ">=12.20.0"
+      }
+    },
+    "node_modules/bep53-range": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/bep53-range/-/bep53-range-2.0.1.tgz",
+      "integrity": "sha512-VWN7j7sqUssWD6ROZe2m709YL3u5A1IAx1qvAbH3DAhszHt4WPvCzJLRJ+mzmZn1qWIb4mpflwdn95qezz3n8g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=12.20.0"
+      }
+    },
+    "node_modules/better-sqlite3": {
+      "version": "11.10.0",
+      "resolved": "https://registry.npmjs.org/better-sqlite3/-/better-sqlite3-11.10.0.tgz",
+      "integrity": "sha512-EwhOpyXiOEL/lKzHz9AW1msWFNzGc/z+LzeB3/jnFJpxu+th2yqvzsSWas1v9jgs9+xiXJcD5A8CJxAG2TaghQ==",
+      "hasInstallScript": true,
+      "license": "MIT",
+      "dependencies": {
+        "bindings": "^1.5.0",
+        "prebuild-install": "^7.1.1"
+      }
+    },
+    "node_modules/bindings": {
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/bindings/-/bindings-1.5.0.tgz",
+      "integrity": "sha512-p2q/t/mhvuOj/UeLlV6566GD/guowlr0hHxClI0W9m7MWYkL1F0hLo+0Aexs9HSPCtR1SXQ0TD3MMKrXZajbiQ==",
+      "license": "MIT",
+      "dependencies": {
+        "file-uri-to-path": "1.0.0"
+      }
+    },
+    "node_modules/bitfield": {
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/bitfield/-/bitfield-4.2.0.tgz",
+      "integrity": "sha512-kUTatQb/mBd8uhvdLrUkouGDBUQiJaIOvPlptUwOWp6MFqih4d1MiVf0m3ATxfZSzu+LjW/awFeABltYa62uIA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/fb55"
+      }
+    },
+    "node_modules/bittorrent-dht": {
+      "version": "11.0.12",
+      "resolved": "https://registry.npmjs.org/bittorrent-dht/-/bittorrent-dht-11.0.12.tgz",
+      "integrity": "sha512-bFmQq874HMIBon/6KNMf/U1OG+UxJ0UzI9oPra2IRlZLuPA7VwBiA7uEpWaO2ww8G76OFjxB1p1XCOS94FuCPQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "bencode": "^4.0.1",
+        "debug": "^4.4.3",
+        "k-bucket": "^5.1.0",
+        "k-rpc": "^5.1.0",
+        "last-one-wins": "^1.0.4",
+        "lru": "^3.1.0",
+        "randombytes": "^2.1.0",
+        "record-cache": "^1.2.0"
+      },
+      "engines": {
+        "node": ">=12.20.0"
+      }
+    },
+    "node_modules/bittorrent-lsd": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/bittorrent-lsd/-/bittorrent-lsd-2.0.3.tgz",
+      "integrity": "sha512-FE4ImhpJZo8ahzDS/Qk1Ol+3Ea1sIhCPWE2WSjiv1s8YoCSEf7JBL3bbCJW5hdVNK5ohtZ3vH5xGjZ9QWFiatQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "chrome-dgram": "^3.0.6",
+        "debug": "^4.2.0"
+      },
+      "engines": {
+        "node": ">=12.20.0"
+      }
+    },
+    "node_modules/bittorrent-peerid": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/bittorrent-peerid/-/bittorrent-peerid-2.0.2.tgz",
+      "integrity": "sha512-V2iUvbtv31uLA8XFxbhB3f/fKTxWGaa6FI/3wSm93YAS/DS8IkeRWCyYGQ13Xbc9ajR40nsxNjGtVt7OHB3VOQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=12.20.0"
+      }
+    },
+    "node_modules/bittorrent-protocol": {
+      "version": "4.1.21",
+      "resolved": "https://registry.npmjs.org/bittorrent-protocol/-/bittorrent-protocol-4.1.21.tgz",
+      "integrity": "sha512-CcuPt6BL7gXa8BF+0GckYcQmr44ARfSPM0rYwMeYgWg+jftekWgy5vuxX6wJDpC5bKFvqNG+74bPBjyM7Swxrw==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "bencode": "^4.0.0",
+        "bitfield": "^4.2.0",
+        "debug": "^4.4.3",
+        "rc4": "^0.1.5",
+        "streamx": "^2.22.1",
+        "throughput": "^1.0.2",
+        "uint8-util": "^2.2.5",
+        "unordered-array-remove": "^1.0.2"
+      },
+      "engines": {
+        "node": ">=12.20.0"
+      }
+    },
+    "node_modules/bittorrent-tracker": {
+      "version": "11.2.3",
+      "resolved": "https://registry.npmjs.org/bittorrent-tracker/-/bittorrent-tracker-11.2.3.tgz",
+      "integrity": "sha512-i9pWOf1YAQWyTjDnpWwcTfEYDi5XwqD6f48pKmIHByb7x2XU86CqK+IsyMy1buKkDZ3rDKht2jIeKCZf1Dmd8g==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "@thaunknown/simple-peer": "^10.0.8",
+        "@thaunknown/simple-websocket": "^9.1.3",
+        "bencode": "^4.0.0",
+        "bittorrent-peerid": "^2.0.0",
+        "chrome-dgram": "^3.0.6",
+        "compact2string": "^1.4.1",
+        "cross-fetch-ponyfill": "^1.0.3",
+        "debug": "^4.3.4",
+        "ip": "^2.0.1",
+        "lru": "^3.1.0",
+        "minimist": "^1.2.8",
+        "once": "^1.4.0",
+        "queue-microtask": "^1.2.3",
+        "random-iterate": "^1.0.1",
+        "run-parallel": "^1.2.0",
+        "run-series": "^1.1.9",
+        "socks": "^2.8.3",
+        "string2compact": "^2.0.1",
+        "uint8-util": "^2.2.5",
+        "unordered-array-remove": "^1.0.2",
+        "ws": "^8.17.0"
+      },
+      "bin": {
+        "bittorrent-tracker": "bin/cmd.js"
+      },
+      "engines": {
+        "node": ">=16.0.0"
+      },
+      "optionalDependencies": {
+        "bufferutil": "^4.0.8",
+        "utf-8-validate": "^6.0.4"
+      }
+    },
+    "node_modules/bl": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/bl/-/bl-4.1.0.tgz",
+      "integrity": "sha512-1W07cM9gS6DcLperZfFSj+bWLtaPGSOHWhPiGzXmvVJbRLdG82sH/Kn8EtW1VqWVA54AKf2h5k5BbnIbwF3h6w==",
+      "license": "MIT",
+      "dependencies": {
+        "buffer": "^5.5.0",
+        "inherits": "^2.0.4",
+        "readable-stream": "^3.4.0"
+      }
+    },
+    "node_modules/block-iterator": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/block-iterator/-/block-iterator-1.1.2.tgz",
+      "integrity": "sha512-yAHUP44v2K25xLPdrgVTgwtuQctlullzjczu9CoUZom5AP3g4p1R1+aWHjS1GHG9JtcSUVUnbEPiuXiW5YZ24w==",
+      "license": "MIT"
+    },
+    "node_modules/buffer": {
+      "version": "5.7.1",
+      "resolved": "https://registry.npmjs.org/buffer/-/buffer-5.7.1.tgz",
+      "integrity": "sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "base64-js": "^1.3.1",
+        "ieee754": "^1.1.13"
+      }
+    },
+    "node_modules/cache-chunk-store": {
+      "version": "3.2.2",
+      "resolved": "https://registry.npmjs.org/cache-chunk-store/-/cache-chunk-store-3.2.2.tgz",
+      "integrity": "sha512-2lJdWbgHFFxcSth9s2wpId3CR3v1YC63KjP4T9WhpW7LWlY7Hiiei3QwwqzkWqlJTfR8lSy9F5kRQECeyj+yQA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "lru": "^3.1.0",
+        "queue-microtask": "^1.2.3"
+      }
+    },
+    "node_modules/chownr": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/chownr/-/chownr-1.1.4.tgz",
+      "integrity": "sha512-jJ0bqzaylmJtVnNgzTeSOs8DPavpbYgEr/b0YL8/2GO3xJEhInFmhKMUnEJQjZumK7KXGFhUy89PrsJWlakBVg==",
+      "license": "ISC"
+    },
+    "node_modules/chrome-dgram": {
+      "version": "3.0.6",
+      "resolved": "https://registry.npmjs.org/chrome-dgram/-/chrome-dgram-3.0.6.tgz",
+      "integrity": "sha512-bqBsUuaOiXiqxXt/zA/jukNJJ4oaOtc7ciwqJpZVEaaXwwxqgI2/ZdG02vXYWUhHGziDlvGMQWk0qObgJwVYKA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "inherits": "^2.0.4",
+        "run-series": "^1.1.9"
+      }
+    },
+    "node_modules/chrome-dns": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/chrome-dns/-/chrome-dns-1.0.1.tgz",
+      "integrity": "sha512-HqsYJgIc8ljJJOqOzLphjAs79EUuWSX3nzZi2LNkzlw3GIzAeZbaSektC8iT/tKvLqZq8yl1GJu5o6doA4TRbg==",
+      "license": "MIT",
+      "dependencies": {
+        "chrome-net": "^3.3.2"
+      }
+    },
+    "node_modules/chrome-net": {
+      "version": "3.3.4",
+      "resolved": "https://registry.npmjs.org/chrome-net/-/chrome-net-3.3.4.tgz",
+      "integrity": "sha512-Jzy2EnzmE+ligqIZUsmWnck9RBXLuUy6CaKyuNMtowFG3ZvLt8d+WBJCTPEludV0DHpIKjAOlwjFmTaEdfdWCw==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "inherits": "^2.0.1"
+      }
+    },
+    "node_modules/chunk-store-iterator": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/chunk-store-iterator/-/chunk-store-iterator-1.0.4.tgz",
+      "integrity": "sha512-LGjzJNmk7W1mrdaBoJNztPumT2ACmgjHmI1AMm8aeGYOl4+LKaYC/yfnx27i++LiAtoe/dR+3jC8HRzb6gW4/A==",
+      "license": "MIT",
+      "dependencies": {
+        "block-iterator": "^1.1.1"
+      }
+    },
+    "node_modules/compact2string": {
+      "version": "1.4.1",
+      "resolved": "https://registry.npmjs.org/compact2string/-/compact2string-1.4.1.tgz",
+      "integrity": "sha512-3D+EY5nsRhqnOwDxveBv5T8wGo4DEvYxjDtPGmdOX+gfr5gE92c2RC0w2wa+xEefm07QuVqqcF3nZJUZ92l/og==",
+      "license": "BSD",
+      "dependencies": {
+        "ipaddr.js": ">= 0.1.5"
+      }
+    },
+    "node_modules/cookie": {
+      "version": "0.7.2",
+      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz",
+      "integrity": "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/cpus": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/cpus/-/cpus-1.0.3.tgz",
+      "integrity": "sha512-PXHBvGLuL69u55IkLa5e5838fLhIMHxmkV4ge42a8alGyn7BtawYgI0hQ849EedvtHIOLNNH3i6eQU1BiE9SUA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/create-torrent": {
+      "version": "6.1.3",
+      "resolved": "https://registry.npmjs.org/create-torrent/-/create-torrent-6.1.3.tgz",
+      "integrity": "sha512-/XARuf6/TmOLICFkUU7pf4KPL/vlIFyk2xOJjQ4np8Xzl8xLt9W7KJps1EVnZyUCMHbAm5xYfCoDrgVw3F4FxA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "bencode": "^4.0.1",
+        "block-iterator": "^1.1.2",
+        "fast-readable-async-iterator": "^2.0.0",
+        "is-file": "^1.0.0",
+        "join-async-iterator": "^1.1.1",
+        "junk": "^4.0.1",
+        "minimist": "^1.2.8",
+        "once": "^1.4.0",
+        "piece-length": "^2.0.1",
+        "queue-microtask": "^1.2.3",
+        "run-parallel": "^1.2.0",
+        "uint8-util": "^2.3.2"
+      },
+      "bin": {
+        "create-torrent": "bin/cmd.js"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/cross-fetch-ponyfill": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/cross-fetch-ponyfill/-/cross-fetch-ponyfill-1.0.3.tgz",
+      "integrity": "sha512-uOBkDhUAGAbx/FEzNKkOfx3w57H8xReBBXoZvUnOKTI0FW0Xvrj3GrYv2iZXUqlffC1LMGfQzhmBM/ke+6eTDA==",
+      "license": "MIT",
+      "dependencies": {
+        "abort-controller": "^3.0.0",
+        "node-fetch": "^3.3.0"
+      }
+    },
+    "node_modules/cross-spawn": {
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
+      "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
+      "license": "MIT",
+      "dependencies": {
+        "path-key": "^3.1.0",
+        "shebang-command": "^2.0.0",
+        "which": "^2.0.1"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/data-uri-to-buffer": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/data-uri-to-buffer/-/data-uri-to-buffer-4.0.1.tgz",
+      "integrity": "sha512-0R9ikRb668HB7QDxT1vkpuUBtqc53YyAwMwGeUFKRojY/NWKvdZ+9UYtRfGmhqNbRkTSVpMbmyhXipFFv2cb/A==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 12"
+      }
+    },
+    "node_modules/debug": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
+      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
+      "license": "MIT",
+      "dependencies": {
+        "ms": "^2.1.3"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/decompress-response": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/decompress-response/-/decompress-response-6.0.0.tgz",
+      "integrity": "sha512-aW35yZM6Bb/4oJlZncMH2LCoZtJXTRxES17vE3hoRiowU2kWHaJKFkSBDnDR+cm9J+9QhXmREyIfv0pji9ejCQ==",
+      "license": "MIT",
+      "dependencies": {
+        "mimic-response": "^3.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/deep-extend": {
+      "version": "0.6.0",
+      "resolved": "https://registry.npmjs.org/deep-extend/-/deep-extend-0.6.0.tgz",
+      "integrity": "sha512-LOHxIOaPYdHlJRtCQfDIVZtfw/ufM8+rVj649RIHzcm/vGwQRXFt6OPqIFWsm2XEMrNIEtWR64sY1LEKD2vAOA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=4.0.0"
+      }
+    },
+    "node_modules/default-gateway": {
+      "version": "7.2.2",
+      "resolved": "https://registry.npmjs.org/default-gateway/-/default-gateway-7.2.2.tgz",
+      "integrity": "sha512-AD7TrdNNPXRZIGw63dw+lnGmT4v7ggZC5NHNJgAYWm5njrwoze1q5JSAW9YuLy2tjnoLUG/r8FEB93MCh9QJPg==",
+      "license": "BSD-2-Clause",
+      "dependencies": {
+        "execa": "^7.1.1"
+      },
+      "engines": {
+        "node": ">= 16"
+      }
+    },
+    "node_modules/detect-libc": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
+      "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/domexception": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/domexception/-/domexception-4.0.0.tgz",
+      "integrity": "sha512-A2is4PLG+eeSfoTMA95/s4pvAoSo2mKtiM5jlHkAVewmiO8ISFTFKZjH7UAM1Atli/OT/7JHOrJRJiMKUZKYBw==",
+      "deprecated": "Use your platform's native DOMException instead",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "webidl-conversions": "^7.0.0"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/end-of-stream": {
+      "version": "1.4.5",
+      "resolved": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.5.tgz",
+      "integrity": "sha512-ooEGc6HP26xXq/N+GCGOT0JKCLDGrq2bQUZrQ7gyrJiZANJ/8YDTxTpQBXGMn+WbIQXNVpyWymm7KYVICQnyOg==",
+      "license": "MIT",
+      "dependencies": {
+        "once": "^1.4.0"
+      }
+    },
+    "node_modules/err-code": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/err-code/-/err-code-3.0.1.tgz",
+      "integrity": "sha512-GiaH0KJUewYok+eeY05IIgjtAe4Yltygk9Wqp1V5yVWLdhf0hYZchRjNIT9bb0mSwRcIusT3cx7PJUf3zEIfUA==",
+      "license": "MIT"
+    },
+    "node_modules/escape-html": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz",
+      "integrity": "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==",
+      "license": "MIT"
+    },
+    "node_modules/event-target-shim": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/event-target-shim/-/event-target-shim-5.0.1.tgz",
+      "integrity": "sha512-i/2XbnSz/uxRCU6+NdVJgKWDTM427+MqYbkQzD321DuCQJUqOuJKIA0IM2+W2xtYHdKOmZ4dR6fExsd4SXL+WQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/events-universal": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/events-universal/-/events-universal-1.0.1.tgz",
+      "integrity": "sha512-LUd5euvbMLpwOF8m6ivPCbhQeSiYVNb8Vs0fQ8QjXo0JTkEHpz8pxdQf0gStltaPpw0Cca8b39KxvK9cfKRiAw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "bare-events": "^2.7.0"
+      }
+    },
+    "node_modules/execa": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/execa/-/execa-7.2.0.tgz",
+      "integrity": "sha512-UduyVP7TLB5IcAQl+OzLyLcS/l32W/GLg+AhHJ+ow40FOk2U3SAllPwR44v4vmdFwIWqpdwxxpQbF1n5ta9seA==",
+      "license": "MIT",
+      "dependencies": {
+        "cross-spawn": "^7.0.3",
+        "get-stream": "^6.0.1",
+        "human-signals": "^4.3.0",
+        "is-stream": "^3.0.0",
+        "merge-stream": "^2.0.0",
+        "npm-run-path": "^5.1.0",
+        "onetime": "^6.0.0",
+        "signal-exit": "^3.0.7",
+        "strip-final-newline": "^3.0.0"
+      },
+      "engines": {
+        "node": "^14.18.0 || ^16.14.0 || >=18.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sindresorhus/execa?sponsor=1"
+      }
+    },
+    "node_modules/expand-template": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/expand-template/-/expand-template-2.0.3.tgz",
+      "integrity": "sha512-XYfuKMvj4O35f/pOXLObndIRvyQ+/+6AhODh+OKWj9S9498pHHn/IMszH+gt0fBCRWMNfk1ZSp5x3AifmnI2vg==",
+      "license": "(MIT OR WTFPL)",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/fast-content-type-parse": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/fast-content-type-parse/-/fast-content-type-parse-1.1.0.tgz",
+      "integrity": "sha512-fBHHqSTFLVnR61C+gltJuE5GkVQMV0S2nqUO8TJ+5Z3qAKG8vAx4FKai1s5jq/inV1+sREynIWSuQ6HgoSXpDQ==",
+      "license": "MIT"
+    },
+    "node_modules/fast-decode-uri-component": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/fast-decode-uri-component/-/fast-decode-uri-component-1.0.1.tgz",
+      "integrity": "sha512-WKgKWg5eUxvRZGwW8FvfbaH7AXSh2cL+3j5fMGzUMCxWBJ3dV3a7Wz8y2f/uQ0e3B6WmodD3oS54jTQ9HVTIIg==",
+      "license": "MIT"
+    },
+    "node_modules/fast-deep-equal": {
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
+      "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
+      "license": "MIT"
+    },
+    "node_modules/fast-fifo": {
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/fast-fifo/-/fast-fifo-1.3.2.tgz",
+      "integrity": "sha512-/d9sfos4yxzpwkDkuN7k2SqFKtYNmCTzgfEpz82x34IM9/zc8KGxQoXg1liNC/izpRM/MBdt44Nmx41ZWqk+FQ==",
+      "license": "MIT"
+    },
+    "node_modules/fast-json-stringify": {
+      "version": "5.16.1",
+      "resolved": "https://registry.npmjs.org/fast-json-stringify/-/fast-json-stringify-5.16.1.tgz",
+      "integrity": "sha512-KAdnLvy1yu/XrRtP+LJnxbBGrhN+xXu+gt3EUvZhYGKCr3lFHq/7UFJHHFgmJKoqlh6B40bZLEv7w46B0mqn1g==",
+      "license": "MIT",
+      "dependencies": {
+        "@fastify/merge-json-schemas": "^0.1.0",
+        "ajv": "^8.10.0",
+        "ajv-formats": "^3.0.1",
+        "fast-deep-equal": "^3.1.3",
+        "fast-uri": "^2.1.0",
+        "json-schema-ref-resolver": "^1.0.1",
+        "rfdc": "^1.2.0"
+      }
+    },
+    "node_modules/fast-json-stringify/node_modules/ajv-formats": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/ajv-formats/-/ajv-formats-3.0.1.tgz",
+      "integrity": "sha512-8iUql50EUR+uUcdRQ3HDqa6EVyo3docL8g5WJ3FNcWmu62IbkGUue/pEyLBW8VGKKucTPgqeks4fIU1DA4yowQ==",
+      "license": "MIT",
+      "dependencies": {
+        "ajv": "^8.0.0"
+      },
+      "peerDependencies": {
+        "ajv": "^8.0.0"
+      },
+      "peerDependenciesMeta": {
+        "ajv": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/fast-querystring": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/fast-querystring/-/fast-querystring-1.1.2.tgz",
+      "integrity": "sha512-g6KuKWmFXc0fID8WWH0jit4g0AGBoJhCkJMb1RmbsSEUNvQ+ZC8D6CUZ+GtF8nMzSPXnhiePyyqqipzNNEnHjg==",
+      "license": "MIT",
+      "dependencies": {
+        "fast-decode-uri-component": "^1.0.1"
+      }
+    },
+    "node_modules/fast-readable-async-iterator": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/fast-readable-async-iterator/-/fast-readable-async-iterator-2.0.0.tgz",
+      "integrity": "sha512-8Sld+DuyWRIftl86ZguJxR2oXCBccOiJxrY/Rj9/7ZBynW8pYMWzIcqxFL1da+25jaWJZVa+HHX/8SsA21JdTA==",
+      "license": "MIT"
+    },
+    "node_modules/fast-uri": {
+      "version": "2.4.3",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-2.4.3.tgz",
+      "integrity": "sha512-8V8UrSDUkYpi4AXM7Na0G6hctXSaRHBGMuANOotuFdHEFtTdqDTRNfcDczA9WkKODI17o7o10iQvzdMIxXb8eA==",
+      "license": "MIT"
+    },
+    "node_modules/fastify": {
+      "version": "4.29.1",
+      "resolved": "https://registry.npmjs.org/fastify/-/fastify-4.29.1.tgz",
+      "integrity": "sha512-m2kMNHIG92tSNWv+Z3UeTR9AWLLuo7KctC7mlFPtMEVrfjIhmQhkQnT9v15qA/BfVq3vvj134Y0jl9SBje3jXQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "@fastify/ajv-compiler": "^3.5.0",
+        "@fastify/error": "^3.4.0",
+        "@fastify/fast-json-stringify-compiler": "^4.3.0",
+        "abstract-logging": "^2.0.1",
+        "avvio": "^8.3.0",
+        "fast-content-type-parse": "^1.1.0",
+        "fast-json-stringify": "^5.8.0",
+        "find-my-way": "^8.0.0",
+        "light-my-request": "^5.11.0",
+        "pino": "^9.0.0",
+        "process-warning": "^3.0.0",
+        "proxy-addr": "^2.0.7",
+        "rfdc": "^1.3.0",
+        "secure-json-parse": "^2.7.0",
+        "semver": "^7.5.4",
+        "toad-cache": "^3.3.0"
+      }
+    },
+    "node_modules/fastq": {
+      "version": "1.20.1",
+      "resolved": "https://registry.npmjs.org/fastq/-/fastq-1.20.1.tgz",
+      "integrity": "sha512-GGToxJ/w1x32s/D2EKND7kTil4n8OVk/9mycTc4VDza13lOvpUZTGX3mFSCtV9ksdGBVzvsyAVLM6mHFThxXxw==",
+      "license": "ISC",
+      "dependencies": {
+        "reusify": "^1.0.4"
+      }
+    },
+    "node_modules/fetch-blob": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/fetch-blob/-/fetch-blob-3.2.0.tgz",
+      "integrity": "sha512-7yAQpD2UMJzLi1Dqv7qFYnPbaPx7ZfFK6PiIxQ4PfkGPyNyl2Ugx+a/umUonmKqjhM4DnfbMvdX6otXq83soQQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/jimmywarting"
+        },
+        {
+          "type": "paypal",
+          "url": "https://paypal.me/jimmywarting"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "node-domexception": "^1.0.0",
+        "web-streams-polyfill": "^3.0.3"
+      },
+      "engines": {
+        "node": "^12.20 || >= 14.13"
+      }
+    },
+    "node_modules/file-uri-to-path": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/file-uri-to-path/-/file-uri-to-path-1.0.0.tgz",
+      "integrity": "sha512-0Zt+s3L7Vf1biwWZ29aARiVYLx7iMGnEUl9x33fbB/j3jR81u/O2LbqK+Bm1CDSNDKVtJ/YjwY7TUd5SkeLQLw==",
+      "license": "MIT"
+    },
+    "node_modules/filename-reserved-regex": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/filename-reserved-regex/-/filename-reserved-regex-3.0.0.tgz",
+      "integrity": "sha512-hn4cQfU6GOT/7cFHXBqeBg2TbrMBgdD0kcjLhvSQYYwm3s4B6cjvBfb7nBALJLAXqmU5xajSa7X2NnUud/VCdw==",
+      "license": "MIT",
+      "engines": {
+        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/find-my-way": {
+      "version": "8.2.2",
+      "resolved": "https://registry.npmjs.org/find-my-way/-/find-my-way-8.2.2.tgz",
+      "integrity": "sha512-Dobi7gcTEq8yszimcfp/R7+owiT4WncAJ7VTTgFH1jYJ5GaG1FbhjwDG820hptN0QDFvzVY3RfCzdInvGPGzjA==",
+      "license": "MIT",
+      "dependencies": {
+        "fast-deep-equal": "^3.1.3",
+        "fast-querystring": "^1.0.0",
+        "safe-regex2": "^3.1.0"
+      },
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/formdata-polyfill": {
+      "version": "4.0.10",
+      "resolved": "https://registry.npmjs.org/formdata-polyfill/-/formdata-polyfill-4.0.10.tgz",
+      "integrity": "sha512-buewHzMvYL29jdeQTVILecSaZKnt/RJWjoZCF5OW60Z67/GmSLBkOFM7qh1PI3zFNtJbaZL5eQu1vLfazOwj4g==",
+      "license": "MIT",
+      "dependencies": {
+        "fetch-blob": "^3.1.2"
+      },
+      "engines": {
+        "node": ">=12.20.0"
+      }
+    },
+    "node_modules/forwarded": {
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/forwarded/-/forwarded-0.2.0.tgz",
+      "integrity": "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/freelist": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/freelist/-/freelist-1.0.3.tgz",
+      "integrity": "sha512-Ji7fEnMdZDGbS5oXElpRJsn9jPvBR8h/037D3bzreNmS8809cISq/2D9//JbA/TaZmkkN8cmecXwmQHmM+NHhg==",
+      "license": "MIT"
+    },
+    "node_modules/fs-chunk-store": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/fs-chunk-store/-/fs-chunk-store-5.0.1.tgz",
+      "integrity": "sha512-bhD1YfAzdOugxu4VepYjxvzZwik9Qunn69Ogj47DZmogD6h/VkD/4vArNRoQ+kPYYOFqex3c9Ob2iAOkNYdkgw==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "filename-reserved-regex": "^3.0.0",
+        "queue-microtask": "^1.2.2",
+        "random-access-file": "^4.0.0",
+        "run-parallel": "^1.1.2",
+        "thunky": "^1.0.1",
+        "uint8-util": "^2.2.5"
+      },
+      "engines": {
+        "node": ">=12.20.0"
+      }
+    },
+    "node_modules/fs-constants": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/fs-constants/-/fs-constants-1.0.0.tgz",
+      "integrity": "sha512-y6OAwoSIf7FyjMIv94u+b5rdheZEjzR63GTyZJm5qh4Bi+2YgwLCcI/fPFZkL5PSixOt6ZNKm+w+Hfp/Bciwow==",
+      "license": "MIT"
+    },
+    "node_modules/fs-native-extensions": {
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/fs-native-extensions/-/fs-native-extensions-1.5.0.tgz",
+      "integrity": "sha512-nuZLFm9mGCxvyi7Llww/J4OyifKCS21nEUTAmnlTZp3FObPOvA32aCedCmt4Z+8yk+caqfClNaSCfn/P7T7FLQ==",
+      "license": "Apache-2.0",
+      "optional": true,
+      "dependencies": {
+        "require-addon": "^1.1.0",
+        "which-runtime": "^1.2.0"
+      }
+    },
+    "node_modules/fsa-chunk-store": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/fsa-chunk-store/-/fsa-chunk-store-1.3.0.tgz",
+      "integrity": "sha512-0WCfuxqqSB6Tz/g7Ar/nwAxMoigXaIXuvfrnLIEFYIA9uc6w9eNaHuBGzU1X3lyM4cpLKCOTUmKAA/gCiTvzMQ==",
+      "license": "MIT",
+      "dependencies": {
+        "filename-reserved-regex": "^3.0.0"
+      }
+    },
+    "node_modules/get-stdin": {
+      "version": "10.0.0",
+      "resolved": "https://registry.npmjs.org/get-stdin/-/get-stdin-10.0.0.tgz",
+      "integrity": "sha512-eWSePJ4zXFdqz+/Lyfopob4rIcoF/U2XfE8nJc7iZV6lnebWc9k7DoQQpX+2a9jc0AOvBsXvbe5YkjXl/MHbpg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=20"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/get-stream": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/get-stream/-/get-stream-6.0.1.tgz",
+      "integrity": "sha512-ts6Wi+2j3jQjqi70w5AlN8DFnkSwC+MqmxEzdEALB2qXZYV3X/b1CTfgPLGJNMeAWxdPfU8FO1ms3NUfaHCPYg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/github-from-package": {
+      "version": "0.0.0",
+      "resolved": "https://registry.npmjs.org/github-from-package/-/github-from-package-0.0.0.tgz",
+      "integrity": "sha512-SyHy3T1v2NUXn29OsWdxmK6RwHD+vkj3v8en8AOBZ1wBQ/hCAQ5bAQTD02kW4W9tUp/3Qh6J8r9EvntiyCmOOw==",
+      "license": "MIT"
+    },
+    "node_modules/http-parser-js": {
+      "version": "0.4.13",
+      "resolved": "https://registry.npmjs.org/http-parser-js/-/http-parser-js-0.4.13.tgz",
+      "integrity": "sha512-u8u5ZaG0Tr/VvHlucK2ufMuOp4/5bvwgneXle+y228K5rMbJOlVjThONcaAw3ikAy8b2OO9RfEucdMHFz3UWMA==",
+      "license": "MIT"
+    },
+    "node_modules/human-signals": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/human-signals/-/human-signals-4.3.1.tgz",
+      "integrity": "sha512-nZXjEF2nbo7lIw3mgYjItAfgQXog3OjJogSbKa2CQIIvSGWcKgeJnQlNXip6NglNzYH45nSRiEVimMvYL8DDqQ==",
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=14.18.0"
+      }
+    },
+    "node_modules/ieee754": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/ieee754/-/ieee754-1.2.1.tgz",
+      "integrity": "sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/immediate-chunk-store": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/immediate-chunk-store/-/immediate-chunk-store-2.2.0.tgz",
+      "integrity": "sha512-1bHBna0hCa6arRXicu91IiL9RvvkbNYLVq+mzWdaLGZC3hXvX4doh8e1dLhMKez5siu63CYgO5NrGJbRX5lbPA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "queue-microtask": "^1.2.3"
+      }
+    },
+    "node_modules/inherits": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
+      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
+      "license": "ISC"
+    },
+    "node_modules/ini": {
+      "version": "1.3.8",
+      "resolved": "https://registry.npmjs.org/ini/-/ini-1.3.8.tgz",
+      "integrity": "sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew==",
+      "license": "ISC"
+    },
+    "node_modules/ip": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/ip/-/ip-2.0.1.tgz",
+      "integrity": "sha512-lJUL9imLTNi1ZfXT+DU6rBBdbiKGBuay9B6xGSPVjUeQwaH1RIGqef8RZkUtHioLmSNpPR5M4HVKJGm1j8FWVQ==",
+      "license": "MIT"
+    },
+    "node_modules/ip-address": {
+      "version": "10.3.1",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.3.1.tgz",
+      "integrity": "sha512-1e9d3kb97NHJTIJDZW9rKqW2h6+dFa50Dy0fpPSMQp2ADje5gvKsXmdiK6dwY5t76TaTt5+P5N1Y/LoToIxP6g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 12"
+      }
+    },
+    "node_modules/ip-set": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/ip-set/-/ip-set-3.0.0.tgz",
+      "integrity": "sha512-EkKzllMFYKMHOoeNxM8v10IJM2n9K6L3ruaQx4A/5RrkOInV8cjp9IwkVU0/cpzwwkq1zGNudrAdCjSR97Rf5w==",
+      "hasInstallScript": true,
+      "license": "MIT",
+      "dependencies": {
+        "ip-address": "^10.0.1"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/ipaddr.js": {
+      "version": "1.9.1",
+      "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz",
+      "integrity": "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.10"
+      }
+    },
+    "node_modules/is-file": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/is-file/-/is-file-1.0.0.tgz",
+      "integrity": "sha512-ZGMuc+xA8mRnrXtmtf2l/EkIW2zaD2LSBWlaOVEF6yH4RTndHob65V4SwWWdtGKVthQfXPVKsXqw4TDUjbVxVQ==",
+      "license": "MIT"
+    },
+    "node_modules/is-stream": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/is-stream/-/is-stream-3.0.0.tgz",
+      "integrity": "sha512-LnQR4bZ9IADDRSkvpqMGvt/tEJWclzklNgSw48V5EAaAeDd6qGvN8ei6k5p0tvxSR171VmGyHuTiAOfxAbr8kA==",
+      "license": "MIT",
+      "engines": {
+        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/isexe": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
+      "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
+      "license": "ISC"
+    },
+    "node_modules/join-async-iterator": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/join-async-iterator/-/join-async-iterator-1.1.1.tgz",
+      "integrity": "sha512-ATse+nuNeKZ9K1y27LKdvPe/GCe9R/u9dw9vI248e+vILeRK3IcJP4JUPAlSmKRCDK0cKhEwfmiw4Skqx7UnGQ==",
+      "license": "MIT"
+    },
+    "node_modules/json-schema-ref-resolver": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/json-schema-ref-resolver/-/json-schema-ref-resolver-1.0.1.tgz",
+      "integrity": "sha512-EJAj1pgHc1hxF6vo2Z3s69fMjO1INq6eGHXZ8Z6wCQeldCuwxGK9Sxf4/cScGn3FZubCVUehfWtcDM/PLteCQw==",
+      "license": "MIT",
+      "dependencies": {
+        "fast-deep-equal": "^3.1.3"
+      }
+    },
+    "node_modules/json-schema-traverse": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
+      "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
+      "license": "MIT"
+    },
+    "node_modules/junk": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/junk/-/junk-4.0.1.tgz",
+      "integrity": "sha512-Qush0uP+G8ZScpGMZvHUiRfI0YBWuB3gVBYlI0v0vvOJt5FLicco+IkP0a50LqTTQhmts/m6tP5SWE+USyIvcQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=12.20"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/k-bucket": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/k-bucket/-/k-bucket-5.1.0.tgz",
+      "integrity": "sha512-Fac7iINEovXIWU20GPnOMLUbjctiS+cnmyjC4zAUgvs3XPf1vo9akfCHkigftSic/jiKqKl+KA3a/vFcJbHyCg==",
+      "license": "MIT",
+      "dependencies": {
+        "randombytes": "^2.1.0"
+      }
+    },
+    "node_modules/k-rpc": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/k-rpc/-/k-rpc-5.1.0.tgz",
+      "integrity": "sha512-FGc+n70Hcjoa/X2JTwP+jMIOpBz+pkRffHnSl9yrYiwUxg3FIgD50+u1ePfJUOnRCnx6pbjmVk5aAeB1wIijuQ==",
+      "license": "MIT",
+      "dependencies": {
+        "k-bucket": "^5.0.0",
+        "k-rpc-socket": "^1.7.2",
+        "randombytes": "^2.0.5"
+      }
+    },
+    "node_modules/k-rpc-socket": {
+      "version": "1.11.1",
+      "resolved": "https://registry.npmjs.org/k-rpc-socket/-/k-rpc-socket-1.11.1.tgz",
+      "integrity": "sha512-8xtA8oqbZ6v1Niryp2/g4GxW16EQh5MvrUylQoOG+zcrDff5CKttON2XUXvMwlIHq4/2zfPVFiinAccJ+WhxoA==",
+      "license": "MIT",
+      "dependencies": {
+        "bencode": "^2.0.0",
+        "chrome-dgram": "^3.0.2",
+        "chrome-dns": "^1.0.0",
+        "chrome-net": "^3.3.2"
+      }
+    },
+    "node_modules/k-rpc-socket/node_modules/bencode": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/bencode/-/bencode-2.0.3.tgz",
+      "integrity": "sha512-D/vrAD4dLVX23NalHwb8dSvsUsxeRPO8Y7ToKA015JQYq69MLDOMkC0uGZYA/MPpltLO8rt8eqFC2j8DxjTZ/w==",
+      "license": "MIT"
+    },
+    "node_modules/last-one-wins": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/last-one-wins/-/last-one-wins-1.0.4.tgz",
+      "integrity": "sha512-t+KLJFkHPQk8lfN6WBOiGkiUXoub+gnb2XTYI2P3aiISL+94xgZ1vgz1SXN/N4hthuOoLXarXfBZPUruyjQtfA==",
+      "license": "MIT"
+    },
+    "node_modules/light-my-request": {
+      "version": "5.14.0",
+      "resolved": "https://registry.npmjs.org/light-my-request/-/light-my-request-5.14.0.tgz",
+      "integrity": "sha512-aORPWntbpH5esaYpGOOmri0OHDOe3wC5M2MQxZ9dvMLZm6DnaAn0kJlcbU9hwsQgLzmZyReKwFwwPkR+nHu5kA==",
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "cookie": "^0.7.0",
+        "process-warning": "^3.0.0",
+        "set-cookie-parser": "^2.4.1"
+      }
+    },
+    "node_modules/limiter": {
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/limiter/-/limiter-1.1.5.tgz",
+      "integrity": "sha512-FWWMIEOxz3GwUI4Ts/IvgVy6LPvoMPgjMdQ185nN6psJyBJ4yOpzqm695/h5umdLJg2vW3GR5iG11MAkR2AzJA=="
+    },
+    "node_modules/load-ip-set": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/load-ip-set/-/load-ip-set-3.0.2.tgz",
+      "integrity": "sha512-UD1GM3CLlkC3b0gAKIxd+6SFJb1WQttWyYhwvjdWjGpJKzu32HnaSMfWtUtVgRtFY+K5vgrvecuVQLRxx5Ojag==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "cross-fetch-ponyfill": "^1.0.1",
+        "ip-set": "^3.0.0",
+        "netmask": "^2.0.1",
+        "once": "^1.4.0",
+        "queue-microtask": "^1.2.3",
+        "split": "^1.0.1"
+      },
+      "engines": {
+        "node": ">=12.20.0"
+      }
+    },
+    "node_modules/lru": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/lru/-/lru-3.1.0.tgz",
+      "integrity": "sha512-5OUtoiVIGU4VXBOshidmtOsvBIvcQR6FD/RzWSvaeHyxCGB+PCUCu+52lqMfdc0h/2CLvHhZS4TwUmMQrrMbBQ==",
+      "license": "MIT",
+      "dependencies": {
+        "inherits": "^2.0.1"
+      },
+      "engines": {
+        "node": ">= 0.4.0"
+      }
+    },
+    "node_modules/lt_donthave": {
+      "version": "2.0.7",
+      "resolved": "https://registry.npmjs.org/lt_donthave/-/lt_donthave-2.0.7.tgz",
+      "integrity": "sha512-FdfetmgzUr0IC2ZXHaOhAMEsvw8BFo7kDM7JzfYsJ5pO5+xzjfZIPdLSQWE4+/UTlQA7D8IU5ZJ0LTuLE4BRBQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "debug": "^4.2.0",
+        "unordered-array-remove": "^1.0.2"
+      },
+      "engines": {
+        "node": ">=12.20.0"
+      }
+    },
+    "node_modules/magnet-uri": {
+      "version": "7.0.10",
+      "resolved": "https://registry.npmjs.org/magnet-uri/-/magnet-uri-7.0.10.tgz",
+      "integrity": "sha512-PjS/xWnvq9RK6P/8+dWG7ka3mFGGt/R9xiq5A+P8a8MpE40Dw6yNyTdjCFuJHS3apn6p5bJUCzMSceW3VxezRA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "@thaunknown/thirty-two": "^1.0.6",
+        "bep53-range": "^2.0.0",
+        "uint8-util": "^2.3.2"
+      },
+      "engines": {
+        "node": ">=12.20.0"
+      }
+    },
+    "node_modules/memory-chunk-store": {
+      "version": "1.3.5",
+      "resolved": "https://registry.npmjs.org/memory-chunk-store/-/memory-chunk-store-1.3.5.tgz",
+      "integrity": "sha512-E1Xc1U4ifk/FkC2ZsWhCaW1xg9HbE/OBmQTLe2Tr9c27YPSLbW7kw1cnb3kQWD1rDtErFJHa7mB9EVrs7aTx9g==",
+      "license": "MIT",
+      "dependencies": {
+        "queue-microtask": "^1.2.3"
+      }
+    },
+    "node_modules/merge-stream": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/merge-stream/-/merge-stream-2.0.0.tgz",
+      "integrity": "sha512-abv/qOcuPfk3URPfDzmZU1LKmuw8kT+0nIHvKrKgFrwifol/doWcdA4ZqsWQ8ENrFKkd67Mfpo/LovbIUsbt3w==",
+      "license": "MIT"
+    },
+    "node_modules/mime": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/mime/-/mime-3.0.0.tgz",
+      "integrity": "sha512-jSCU7/VB1loIWBZe14aEYHU/+1UMEHoaO7qxCOVJOw9GgH72VAWppxNcjU+x9a2k3GSIBXNKxXQFqRvvZ7vr3A==",
+      "license": "MIT",
+      "bin": {
+        "mime": "cli.js"
+      },
+      "engines": {
+        "node": ">=10.0.0"
+      }
+    },
+    "node_modules/mimic-fn": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/mimic-fn/-/mimic-fn-4.0.0.tgz",
+      "integrity": "sha512-vqiC06CuhBTUdZH+RYl8sFrL096vA45Ok5ISO6sE/Mr1jRbGH4Csnhi8f3wKVl7x8mO4Au7Ir9D3Oyv1VYMFJw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/mimic-response": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/mimic-response/-/mimic-response-3.1.0.tgz",
+      "integrity": "sha512-z0yWI+4FDrrweS8Zmt4Ej5HdJmky15+L2e6Wgn3+iK5fWzb6T3fhNFq2+MeTRb064c6Wr4N/wv0DzQTjNzHNGQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/minimist": {
+      "version": "1.2.8",
+      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
+      "integrity": "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/mkdirp-classic": {
+      "version": "0.5.3",
+      "resolved": "https://registry.npmjs.org/mkdirp-classic/-/mkdirp-classic-0.5.3.tgz",
+      "integrity": "sha512-gKLcREMhtuZRwRAfqP3RFW+TK4JqApVBtOIftVgjuABpAtpxhPGaDcfvbhNvD0B8iD1oUr/txX35NjcaY6Ns/A==",
+      "license": "MIT"
+    },
+    "node_modules/ms": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+      "license": "MIT"
+    },
+    "node_modules/napi-build-utils": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/napi-build-utils/-/napi-build-utils-2.0.0.tgz",
+      "integrity": "sha512-GEbrYkbfF7MoNaoh2iGG84Mnf/WZfB0GdGEsM8wz7Expx/LlWf5U8t9nvJKXSp3qr5IsEbK04cBGhol/KwOsWA==",
+      "license": "MIT"
+    },
+    "node_modules/napi-macros": {
+      "version": "2.2.2",
+      "resolved": "https://registry.npmjs.org/napi-macros/-/napi-macros-2.2.2.tgz",
+      "integrity": "sha512-hmEVtAGYzVQpCKdbQea4skABsdXW4RUh5t5mJ2zzqowJS2OyXZTU1KhDVFhx+NlWZ4ap9mqR9TcDO3LTTttd+g==",
+      "license": "MIT",
+      "optional": true
+    },
+    "node_modules/netmask": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/netmask/-/netmask-2.1.1.tgz",
+      "integrity": "sha512-eonl3sLUha+S1GzTPxychyhnUzKyeQkZ7jLjKrBagJgPla13F+uQ71HgpFefyHgqrjEbCPkDArxYsjY8/+gLKA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4.0"
+      }
+    },
+    "node_modules/node-abi": {
+      "version": "3.94.0",
+      "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-3.94.0.tgz",
+      "integrity": "sha512-W5ZNO5KRPB5TkYmGVD9F6YqhsglXJzE6etpbmT+f6EQElhiX/UTG551cnsRGvLG3fyZEg9HwaDmNmj5nwJ4z9g==",
+      "license": "MIT",
+      "dependencies": {
+        "semver": "^7.3.5"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/node-datachannel": {
+      "version": "0.32.3",
+      "resolved": "https://registry.npmjs.org/node-datachannel/-/node-datachannel-0.32.3.tgz",
+      "integrity": "sha512-Aok1ZhLsll472lRefgWYuWJ0070jh0ecHravTdRyZEmoESumebMEQV8Y+poBwSW2ZbEwAokAOGsK5Cu8pDDT2g==",
+      "hasInstallScript": true,
+      "license": "MPL 2.0",
+      "dependencies": {
+        "prebuild-install": "^7.1.3"
+      },
+      "engines": {
+        "node": ">=18.20.0"
+      }
+    },
+    "node_modules/node-domexception": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/node-domexception/-/node-domexception-1.0.0.tgz",
+      "integrity": "sha512-/jKZoMpw0F8GRwl4/eLROPA3cfcXtLApP0QzLmUT/HuPCZWyB7IY9ZrMeKw2O/nFIqPQB3PVM9aYm0F312AXDQ==",
+      "deprecated": "Use your platform's native DOMException instead",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/jimmywarting"
+        },
+        {
+          "type": "github",
+          "url": "https://paypal.me/jimmywarting"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=10.5.0"
+      }
+    },
+    "node_modules/node-fetch": {
+      "version": "3.3.2",
+      "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-3.3.2.tgz",
+      "integrity": "sha512-dRB78srN/l6gqWulah9SrxeYnxeddIG30+GOqK/9OlLVyLg3HPnr6SqOWTWOXKRwC2eGYCkZ59NNuSgvSrpgOA==",
+      "license": "MIT",
+      "dependencies": {
+        "data-uri-to-buffer": "^4.0.0",
+        "fetch-blob": "^3.1.4",
+        "formdata-polyfill": "^4.0.10"
+      },
+      "engines": {
+        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/node-fetch"
+      }
+    },
+    "node_modules/node-gyp-build": {
+      "version": "4.8.4",
+      "resolved": "https://registry.npmjs.org/node-gyp-build/-/node-gyp-build-4.8.4.tgz",
+      "integrity": "sha512-LA4ZjwlnUblHVgq0oBF3Jl/6h/Nvs5fzBLwdEF4nuxnFdsfajde4WfxtJr3CaiH+F6ewcIB/q4jQ4UzPyid+CQ==",
+      "license": "MIT",
+      "optional": true,
+      "bin": {
+        "node-gyp-build": "bin.js",
+        "node-gyp-build-optional": "optional.js",
+        "node-gyp-build-test": "build-test.js"
+      }
+    },
+    "node_modules/npm-run-path": {
+      "version": "5.3.0",
+      "resolved": "https://registry.npmjs.org/npm-run-path/-/npm-run-path-5.3.0.tgz",
+      "integrity": "sha512-ppwTtiJZq0O/ai0z7yfudtBpWIoxM8yE6nHi1X47eFR2EWORqfbu6CnPlNsjeN683eT0qG6H/Pyf9fCcvjnnnQ==",
+      "license": "MIT",
+      "dependencies": {
+        "path-key": "^4.0.0"
+      },
+      "engines": {
+        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/npm-run-path/node_modules/path-key": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/path-key/-/path-key-4.0.0.tgz",
+      "integrity": "sha512-haREypq7xkM7ErfgIyA0z+Bj4AGKlMSdlQE2jvJo6huWD1EdkKYV+G/T4nq0YEF2vgTT8kqMFKo1uHn950r4SQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/on-exit-leak-free": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/on-exit-leak-free/-/on-exit-leak-free-2.1.2.tgz",
+      "integrity": "sha512-0eJJY6hXLGf1udHwfNftBqH+g73EU4B504nZeKpz1sYRKafAghwxEJunB2O7rDZkL4PGfsMVnTXZ2EjibbqcsA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
+    "node_modules/once": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
+      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
+      "license": "ISC",
+      "dependencies": {
+        "wrappy": "1"
+      }
+    },
+    "node_modules/onetime": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/onetime/-/onetime-6.0.0.tgz",
+      "integrity": "sha512-1FlR+gjXK7X+AsAHso35MnyN5KqGwJRi/31ft6x0M194ht7S+rWAvd7PHss9xSKMzE0asv1pyIHaJYq+BbacAQ==",
+      "license": "MIT",
+      "dependencies": {
+        "mimic-fn": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/parse-torrent": {
+      "version": "11.0.24",
+      "resolved": "https://registry.npmjs.org/parse-torrent/-/parse-torrent-11.0.24.tgz",
+      "integrity": "sha512-6nNWYiJq6egD8pMqZYL1mfnAly9ZH32DHkAYgZuAfwWij52ce7e3BtrWGVw2q1Bpb5Us8YQVGN7ML/47z/bVIA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "bencode": "^4.0.1",
+        "cross-fetch-ponyfill": "^1.0.3",
+        "get-stdin": "^10.0.0",
+        "magnet-uri": "^7.0.10",
+        "queue-microtask": "^1.2.3",
+        "uint8-util": "^2.3.2"
+      },
+      "bin": {
+        "parse-torrent": "bin/cmd.js"
+      },
+      "engines": {
+        "node": ">=12.20.0"
+      }
+    },
+    "node_modules/path-key": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
+      "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/piece-length": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/piece-length/-/piece-length-2.0.1.tgz",
+      "integrity": "sha512-dBILiDmm43y0JPISWEmVGKBETQjwJe6mSU9GND+P9KW0SJGUwoU/odyH1nbalOP9i8WSYuqf1lQnaj92Bhw+Ug==",
+      "license": "MIT"
+    },
+    "node_modules/pino": {
+      "version": "9.14.0",
+      "resolved": "https://registry.npmjs.org/pino/-/pino-9.14.0.tgz",
+      "integrity": "sha512-8OEwKp5juEvb/MjpIc4hjqfgCNysrS94RIOMXYvpYCdm/jglrKEiAYmiumbmGhCvs+IcInsphYDFwqrjr7398w==",
+      "license": "MIT",
+      "dependencies": {
+        "@pinojs/redact": "^0.4.0",
+        "atomic-sleep": "^1.0.0",
+        "on-exit-leak-free": "^2.1.0",
+        "pino-abstract-transport": "^2.0.0",
+        "pino-std-serializers": "^7.0.0",
+        "process-warning": "^5.0.0",
+        "quick-format-unescaped": "^4.0.3",
+        "real-require": "^0.2.0",
+        "safe-stable-stringify": "^2.3.1",
+        "sonic-boom": "^4.0.1",
+        "thread-stream": "^3.0.0"
+      },
+      "bin": {
+        "pino": "bin.js"
+      }
+    },
+    "node_modules/pino-abstract-transport": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/pino-abstract-transport/-/pino-abstract-transport-2.0.0.tgz",
+      "integrity": "sha512-F63x5tizV6WCh4R6RHyi2Ml+M70DNRXt/+HANowMflpgGFMAym/VKm6G7ZOQRjqN7XbGxK1Lg9t6ZrtzOaivMw==",
+      "license": "MIT",
+      "dependencies": {
+        "split2": "^4.0.0"
+      }
+    },
+    "node_modules/pino-std-serializers": {
+      "version": "7.1.0",
+      "resolved": "https://registry.npmjs.org/pino-std-serializers/-/pino-std-serializers-7.1.0.tgz",
+      "integrity": "sha512-BndPH67/JxGExRgiX1dX0w1FvZck5Wa4aal9198SrRhZjH3GxKQUKIBnYJTdj2HDN3UQAS06HlfcSbQj2OHmaw==",
+      "license": "MIT"
+    },
+    "node_modules/pino/node_modules/process-warning": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/process-warning/-/process-warning-5.0.0.tgz",
+      "integrity": "sha512-a39t9ApHNx2L4+HBnQKqxxHNs1r7KF+Intd8Q/g1bUh6q0WIp9voPXJ/x0j+ZL45KF1pJd9+q2jLIRMfvEshkA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/prebuild-install": {
+      "version": "7.1.3",
+      "resolved": "https://registry.npmjs.org/prebuild-install/-/prebuild-install-7.1.3.tgz",
+      "integrity": "sha512-8Mf2cbV7x1cXPUILADGI3wuhfqWvtiLA1iclTDbFRZkgRQS0NqsPZphna9V+HyTEadheuPmjaJMsbzKQFOzLug==",
+      "deprecated": "No longer maintained. Please contact the author of the relevant native addon; alternatives are available.",
+      "license": "MIT",
+      "dependencies": {
+        "detect-libc": "^2.0.0",
+        "expand-template": "^2.0.3",
+        "github-from-package": "0.0.0",
+        "minimist": "^1.2.3",
+        "mkdirp-classic": "^0.5.3",
+        "napi-build-utils": "^2.0.0",
+        "node-abi": "^3.3.0",
+        "pump": "^3.0.0",
+        "rc": "^1.2.7",
+        "simple-get": "^4.0.0",
+        "tar-fs": "^2.0.0",
+        "tunnel-agent": "^0.6.0"
+      },
+      "bin": {
+        "prebuild-install": "bin.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/process-warning": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/process-warning/-/process-warning-3.0.0.tgz",
+      "integrity": "sha512-mqn0kFRl0EoqhnL0GQ0veqFHyIN1yig9RHh/InzORTUiZHFRAur+aMtRkELNwGs9aNwKS6tg/An4NYBPGwvtzQ==",
+      "license": "MIT"
+    },
+    "node_modules/proxy-addr": {
+      "version": "2.0.7",
+      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
+      "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==",
+      "license": "MIT",
+      "dependencies": {
+        "forwarded": "0.2.0",
+        "ipaddr.js": "1.9.1"
+      },
+      "engines": {
+        "node": ">= 0.10"
+      }
+    },
+    "node_modules/pump": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/pump/-/pump-3.0.4.tgz",
+      "integrity": "sha512-VS7sjc6KR7e1ukRFhQSY5LM2uBWAUPiOPa/A3mkKmiMwSmRFUITt0xuj+/lesgnCv+dPIEYlkzrcyXgquIHMcA==",
+      "license": "MIT",
+      "dependencies": {
+        "end-of-stream": "^1.1.0",
+        "once": "^1.3.1"
+      }
+    },
+    "node_modules/queue-microtask": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/queue-microtask/-/queue-microtask-1.2.3.tgz",
+      "integrity": "sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/queue-tick": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/queue-tick/-/queue-tick-1.0.1.tgz",
+      "integrity": "sha512-kJt5qhMxoszgU/62PLP1CJytzd2NKetjSRnyuj31fDd3Rlcz3fzlFdFLD1SItunPwyqEOkca6GbV612BWfaBag==",
+      "license": "MIT"
+    },
+    "node_modules/quick-format-unescaped": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/quick-format-unescaped/-/quick-format-unescaped-4.0.4.tgz",
+      "integrity": "sha512-tYC1Q1hgyRuHgloV/YXs2w15unPVh8qfu/qCTfhTYamaw7fyhumKa2yGpdSo87vY32rIclj+4fWYQXUMs9EHvg==",
+      "license": "MIT"
+    },
+    "node_modules/random-access-file": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/random-access-file/-/random-access-file-4.1.2.tgz",
+      "integrity": "sha512-GQM6R78DceZDcQod8KxlDFwXIiUvlvuy1EOzxTDsjuDjW5NlnlZi0MOk6iI4itAj/2vcvdqcEExYbVpC/dJcEw==",
+      "license": "MIT",
+      "dependencies": {
+        "bare-fs": "^4.0.1",
+        "bare-path": "^3.0.0",
+        "random-access-storage": "^3.0.0"
+      },
+      "optionalDependencies": {
+        "fs-native-extensions": "^1.3.1"
+      }
+    },
+    "node_modules/random-access-storage": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/random-access-storage/-/random-access-storage-3.0.2.tgz",
+      "integrity": "sha512-Es9maUyWdJXWKckKy9s1+vT+DEgAt+PBb9lxPaake/0EDUsHehloKGv9v1zimS2V3gpFAcQXubvc1Rgci2sDPQ==",
+      "license": "MIT",
+      "dependencies": {
+        "bare-events": "^2.2.0",
+        "queue-tick": "^1.0.0"
+      }
+    },
+    "node_modules/random-iterate": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/random-iterate/-/random-iterate-1.0.1.tgz",
+      "integrity": "sha512-Jdsdnezu913Ot8qgKgSgs63XkAjEsnMcS1z+cC6D6TNXsUXsMxy0RpclF2pzGZTEiTXL9BiArdGTEexcv4nqcA==",
+      "license": "MIT"
+    },
+    "node_modules/randombytes": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/randombytes/-/randombytes-2.1.0.tgz",
+      "integrity": "sha512-vYl3iOX+4CKUWuxGi9Ukhie6fsqXqS9FE2Zaic4tNFD2N2QQaXOMFbuKK4QmDHC0JO6B1Zp41J0LpT0oR68amQ==",
+      "license": "MIT",
+      "dependencies": {
+        "safe-buffer": "^5.1.0"
+      }
+    },
+    "node_modules/range-parser": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.3.0.tgz",
+      "integrity": "sha512-hek2mFQpPuI4E1BBKrSto+BU3e3x4xuarsbiwr3+lf7p44juvFMV0XFWQAP3xUyqXA4RrXLIoaSUGbSt056ZMw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/rc": {
+      "version": "1.2.8",
+      "resolved": "https://registry.npmjs.org/rc/-/rc-1.2.8.tgz",
+      "integrity": "sha512-y3bGgqKj3QBdxLbLkomlohkvsA8gdAiUQlSBJnBhfn+BPxg4bc62d8TcBW15wavDfgexCgccckhcZvywyQYPOw==",
+      "license": "(BSD-2-Clause OR MIT OR Apache-2.0)",
+      "dependencies": {
+        "deep-extend": "^0.6.0",
+        "ini": "~1.3.0",
+        "minimist": "^1.2.0",
+        "strip-json-comments": "~2.0.1"
+      },
+      "bin": {
+        "rc": "cli.js"
+      }
+    },
+    "node_modules/rc4": {
+      "version": "0.1.5",
+      "resolved": "https://registry.npmjs.org/rc4/-/rc4-0.1.5.tgz",
+      "integrity": "sha512-xdDTNV90z5x5u25Oc871Xnvu7yAr4tV7Eluh0VSvrhUkry39q1k+zkz7xroqHbRq+8PiazySHJPArqifUvz9VA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/readable-stream": {
+      "version": "3.6.2",
+      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz",
+      "integrity": "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==",
+      "license": "MIT",
+      "dependencies": {
+        "inherits": "^2.0.3",
+        "string_decoder": "^1.1.1",
+        "util-deprecate": "^1.0.1"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/real-require": {
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/real-require/-/real-require-0.2.0.tgz",
+      "integrity": "sha512-57frrGM/OCTLqLOAh0mhVA9VBMHd+9U7Zb2THMGdBUoZVOtGbJzjxsYGDJ3A9AYYCP4hn6y1TVbaOfzWtm5GFg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 12.13.0"
+      }
+    },
+    "node_modules/record-cache": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/record-cache/-/record-cache-1.2.0.tgz",
+      "integrity": "sha512-kyy3HWCez2WrotaL3O4fTn0rsIdfRKOdQQcEJ9KpvmKmbffKVvwsloX063EgRUlpJIXHiDQFhJcTbZequ2uTZw==",
+      "license": "MIT",
+      "dependencies": {
+        "b4a": "^1.3.1"
+      }
+    },
+    "node_modules/require-addon": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/require-addon/-/require-addon-1.2.0.tgz",
+      "integrity": "sha512-VNPDZlYgIYQwWp9jMTzljx+k0ZtatKlcvOhktZ/anNPI3dQ9NXk7cq2U4iJ1wd9IrytRnYhyEocFWbkdPb+MYA==",
+      "license": "Apache-2.0",
+      "optional": true,
+      "dependencies": {
+        "bare-addon-resolve": "^1.3.0"
+      },
+      "engines": {
+        "bare": ">=1.10.0"
+      }
+    },
+    "node_modules/require-from-string": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
+      "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/ret": {
+      "version": "0.4.3",
+      "resolved": "https://registry.npmjs.org/ret/-/ret-0.4.3.tgz",
+      "integrity": "sha512-0f4Memo5QP7WQyUEAYUO3esD/XjOc3Zjjg5CPsAq1p8sIu0XPeMbHJemKA0BO7tV0X7+A0FoEpbmHXWxPyD3wQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/reusify": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/reusify/-/reusify-1.1.0.tgz",
+      "integrity": "sha512-g6QUff04oZpHs0eG5p83rFLhHeV00ug/Yf9nZM6fLeUrPguBTkTQOdpAWWspMh55TZfVQDPaN3NQJfbVRAxdIw==",
+      "license": "MIT",
+      "engines": {
+        "iojs": ">=1.0.0",
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/rfdc": {
+      "version": "1.4.1",
+      "resolved": "https://registry.npmjs.org/rfdc/-/rfdc-1.4.1.tgz",
+      "integrity": "sha512-q1b3N5QkRUWUl7iyylaaj3kOpIT0N2i9MqIEQXP73GVsN9cw3fdx8X63cEmWhJGi2PPCF23Ijp7ktmd39rawIA==",
+      "license": "MIT"
+    },
+    "node_modules/run-parallel": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/run-parallel/-/run-parallel-1.2.0.tgz",
+      "integrity": "sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "queue-microtask": "^1.2.2"
+      }
+    },
+    "node_modules/run-parallel-limit": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/run-parallel-limit/-/run-parallel-limit-1.1.0.tgz",
+      "integrity": "sha512-jJA7irRNM91jaKc3Hcl1npHsFLOXOoTkPCUL1JEa1R82O2miplXXRaGdjW/KM/98YQWDhJLiSs793CnXfblJUw==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "queue-microtask": "^1.2.2"
+      }
+    },
+    "node_modules/run-series": {
+      "version": "1.1.9",
+      "resolved": "https://registry.npmjs.org/run-series/-/run-series-1.1.9.tgz",
+      "integrity": "sha512-Arc4hUN896vjkqCYrUXquBFtRZdv1PfLbTYP71efP6butxyQ0kWpiNJyAgsxscmQg1cqvHY32/UCBzXedTpU2g==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/safe-buffer": {
+      "version": "5.2.1",
+      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
+      "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/safe-regex2": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/safe-regex2/-/safe-regex2-3.1.0.tgz",
+      "integrity": "sha512-RAAZAGbap2kBfbVhvmnTFv73NWLMvDGOITFYTZBAaY8eR+Ir4ef7Up/e7amo+y1+AH+3PtLkrt9mvcTsG9LXug==",
+      "license": "MIT",
+      "dependencies": {
+        "ret": "~0.4.0"
+      }
+    },
+    "node_modules/safe-stable-stringify": {
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/safe-stable-stringify/-/safe-stable-stringify-2.5.0.tgz",
+      "integrity": "sha512-b3rppTKm9T+PsVCBEOUR46GWI7fdOs00VKZ1+9c1EWDaDMvjQc6tUwuFyIprgGgTcWoVHSKrU8H31ZHA2e0RHA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/sax": {
+      "version": "1.6.1",
+      "resolved": "https://registry.npmjs.org/sax/-/sax-1.6.1.tgz",
+      "integrity": "sha512-42tBVwLWnaQvW5zc4HbZrTuWccECCZfBi92FDuwtqxasH+JbPB3/FOKb1m222K42R4WxuxzzMsTswfzgtSu64Q==",
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": ">=11.0.0"
+      }
+    },
+    "node_modules/secure-json-parse": {
+      "version": "2.7.0",
+      "resolved": "https://registry.npmjs.org/secure-json-parse/-/secure-json-parse-2.7.0.tgz",
+      "integrity": "sha512-6aU+Rwsezw7VR8/nyvKTx8QpWH9FrcYiXXlqC4z5d5XQBDRqtbfsRjnwGyqbi3gddNtWHuEk9OANUotL26qKUw==",
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/semver": {
+      "version": "7.8.5",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
+      "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==",
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/set-cookie-parser": {
+      "version": "2.7.2",
+      "resolved": "https://registry.npmjs.org/set-cookie-parser/-/set-cookie-parser-2.7.2.tgz",
+      "integrity": "sha512-oeM1lpU/UvhTxw+g3cIfxXHyJRc/uidd3yK1P242gzHds0udQBYzs3y8j4gCCW+ZJ7ad0yctld8RYO+bdurlvw==",
+      "license": "MIT"
+    },
+    "node_modules/shebang-command": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
+      "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
+      "license": "MIT",
+      "dependencies": {
+        "shebang-regex": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/shebang-regex": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
+      "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/signal-exit": {
+      "version": "3.0.7",
+      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz",
+      "integrity": "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==",
+      "license": "ISC"
+    },
+    "node_modules/simple-concat": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/simple-concat/-/simple-concat-1.0.1.tgz",
+      "integrity": "sha512-cSFtAPtRhljv69IK0hTVZQ+OfE9nePi/rtJmw5UjHeVyVroEqJXP1sFztKUy1qU+xvz3u/sfYJLa947b7nAN2Q==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/simple-get": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/simple-get/-/simple-get-4.0.1.tgz",
+      "integrity": "sha512-brv7p5WgH0jmQJr1ZDDfKDOSeWWg+OVypG99A/5vYGPqJ6pxiaHLy8nxtFjBA7oMa01ebA9gfh1uMCFqOuXxvA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "decompress-response": "^6.0.0",
+        "once": "^1.3.1",
+        "simple-concat": "^1.0.0"
+      }
+    },
+    "node_modules/smart-buffer": {
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/smart-buffer/-/smart-buffer-4.2.0.tgz",
+      "integrity": "sha512-94hK0Hh8rPqQl2xXc3HsaBoOXKV20MToPkcXvwbISWLEs+64sBq5kFgn2kJDHb1Pry9yrP0dxrCI9RRci7RXKg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 6.0.0",
+        "npm": ">= 3.0.0"
+      }
+    },
+    "node_modules/socks": {
+      "version": "2.8.9",
+      "resolved": "https://registry.npmjs.org/socks/-/socks-2.8.9.tgz",
+      "integrity": "sha512-LJhUYUvItdQ0LkJTmPeaEObWXAqFyfmP85x0tch/ez9cahmhlBBLbIqDFnvBnUJGagb0JbIQrkBs1wJ+yRYpEw==",
+      "license": "MIT",
+      "dependencies": {
+        "ip-address": "^10.1.1",
+        "smart-buffer": "^4.2.0"
+      },
+      "engines": {
+        "node": ">= 10.0.0",
+        "npm": ">= 3.0.0"
+      }
+    },
+    "node_modules/sonic-boom": {
+      "version": "4.2.1",
+      "resolved": "https://registry.npmjs.org/sonic-boom/-/sonic-boom-4.2.1.tgz",
+      "integrity": "sha512-w6AxtubXa2wTXAUsZMMWERrsIRAdrK0Sc+FUytWvYAhBJLyuI4llrMIC1DtlNSdI99EI86KZum2MMq3EAZlF9Q==",
+      "license": "MIT",
+      "dependencies": {
+        "atomic-sleep": "^1.0.0"
+      }
+    },
+    "node_modules/speed-limiter": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/speed-limiter/-/speed-limiter-1.0.2.tgz",
+      "integrity": "sha512-Ax+TbUOho84bWUc3AKqWtkIvAIVws7d6QI4oJkgH4yQ5Yil+lR3vjd/7qd51dHKGzS5bFxg0++QwyNRN7s6rZA==",
+      "license": "MIT",
+      "dependencies": {
+        "limiter": "^1.1.5",
+        "streamx": "^2.10.3"
+      }
+    },
+    "node_modules/split": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/split/-/split-1.0.1.tgz",
+      "integrity": "sha512-mTyOoPbrivtXnwnIxZRFYRrPNtEFKlpB2fvjSnCQUiAA6qAZzqwna5envK4uk6OIeP17CsdF3rSBGYVBsU0Tkg==",
+      "license": "MIT",
+      "dependencies": {
+        "through": "2"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/split2": {
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/split2/-/split2-4.2.0.tgz",
+      "integrity": "sha512-UcjcJOWknrNkF6PLX83qcHM6KHgVKNkV62Y8a5uYDVv9ydGQVwAHMKqHdJje1VTWpljG0WYpCDhrCdAOYH4TWg==",
+      "license": "ISC",
+      "engines": {
+        "node": ">= 10.x"
+      }
+    },
+    "node_modules/streamx": {
+      "version": "2.22.1",
+      "resolved": "https://registry.npmjs.org/streamx/-/streamx-2.22.1.tgz",
+      "integrity": "sha512-znKXEBxfatz2GBNK02kRnCXjV+AA4kjZIUxeWSr3UGirZMJfTE9uiwKHobnbgxWyL/JWro8tTq+vOqAK1/qbSA==",
+      "license": "MIT",
+      "dependencies": {
+        "fast-fifo": "^1.3.2",
+        "text-decoder": "^1.1.0"
+      },
+      "optionalDependencies": {
+        "bare-events": "^2.2.0"
+      }
+    },
+    "node_modules/string_decoder": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz",
+      "integrity": "sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==",
+      "license": "MIT",
+      "dependencies": {
+        "safe-buffer": "~5.2.0"
+      }
+    },
+    "node_modules/string2compact": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/string2compact/-/string2compact-2.0.2.tgz",
+      "integrity": "sha512-ZUUIyrS+sSj84gR6fFoz/boiqCptyw37/hMxIehReuf6ekpJOlwSXhTfEasqc5t3QucBXi2ghwLlHOSC8hjEaw==",
+      "license": "MIT",
+      "dependencies": {
+        "addr-to-ip-port": "^2.0.0",
+        "ipaddr.js": "2.0.1"
+      },
+      "engines": {
+        "node": ">=12.20.0"
+      }
+    },
+    "node_modules/string2compact/node_modules/ipaddr.js": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-2.0.1.tgz",
+      "integrity": "sha512-1qTgH9NG+IIJ4yfKs2e6Pp1bZg8wbDbKHT21HrLIeYBTRLgMYKnMTPAuI3Lcs61nfx5h1xlXnbJtH1kX5/d/ng==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/strip-final-newline": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/strip-final-newline/-/strip-final-newline-3.0.0.tgz",
+      "integrity": "sha512-dOESqjYr96iWYylGObzd39EuNTa5VJxyvVAEm5Jnh7KGo75V43Hk1odPQkNDyXNmUR6k+gEiDVXnjB8HJ3crXw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/strip-json-comments": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-2.0.1.tgz",
+      "integrity": "sha512-4gB8na07fecVVkOI6Rs4e7T6NOTki5EmL7TUduTs6bu3EdnSycntVJ4re8kgZA+wx9IueI2Y11bfbgwtzuE0KQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/tar-fs": {
+      "version": "2.1.5",
+      "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.5.tgz",
+      "integrity": "sha512-OboTd8mmMhZDNPV+UjQcK9yKAatXu2aJ+r1w4im1Otd4M4fl2hwvdoXUxIYHFTHWK/3y3FarBP70v3vwmGlOxw==",
+      "license": "MIT",
+      "dependencies": {
+        "chownr": "^1.1.1",
+        "mkdirp-classic": "^0.5.2",
+        "pump": "^3.0.0",
+        "tar-stream": "^2.1.4"
+      }
+    },
+    "node_modules/tar-stream": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/tar-stream/-/tar-stream-2.2.0.tgz",
+      "integrity": "sha512-ujeqbceABgwMZxEJnk2HDY2DlnUZ+9oEcb1KzTVfYHio0UE6dG71n60d8D2I4qNvleWrrXpmjpt7vZeF1LnMZQ==",
+      "license": "MIT",
+      "dependencies": {
+        "bl": "^4.0.3",
+        "end-of-stream": "^1.4.1",
+        "fs-constants": "^1.0.0",
+        "inherits": "^2.0.3",
+        "readable-stream": "^3.1.1"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/teex": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/teex/-/teex-1.0.1.tgz",
+      "integrity": "sha512-eYE6iEI62Ni1H8oIa7KlDU6uQBtqr4Eajni3wX7rpfXD8ysFx8z0+dri+KWEPWpBsxXfxu58x/0jvTVT1ekOSg==",
+      "license": "MIT",
+      "dependencies": {
+        "streamx": "^2.12.5"
+      }
+    },
+    "node_modules/text-decoder": {
+      "version": "1.2.7",
+      "resolved": "https://registry.npmjs.org/text-decoder/-/text-decoder-1.2.7.tgz",
+      "integrity": "sha512-vlLytXkeP4xvEq2otHeJfSQIRyWxo/oZGEbXrtEEF9Hnmrdly59sUbzZ/QgyWuLYHctCHxFF4tRQZNQ9k60ExQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "b4a": "^1.6.4"
+      }
+    },
+    "node_modules/thread-stream": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/thread-stream/-/thread-stream-3.2.0.tgz",
+      "integrity": "sha512-zLBvqpwr4Esa0kRjcrzGU6zL25lePWaCLMx0RQFrmteozIfeNdaMLpG5U7PeHzvlFkAWaRKA9/KVW4F60iB+qw==",
+      "license": "MIT",
+      "dependencies": {
+        "real-require": "^0.2.0"
+      }
+    },
+    "node_modules/through": {
+      "version": "2.3.8",
+      "resolved": "https://registry.npmjs.org/through/-/through-2.3.8.tgz",
+      "integrity": "sha512-w89qg7PI8wAdvX60bMDP+bFoD5Dvhm9oLheFp5O4a2QF0cSBGsBX4qZmadPMvVqlLJBBci+WqGGOAPvcDeNSVg==",
+      "license": "MIT"
+    },
+    "node_modules/throughput": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/throughput/-/throughput-1.0.2.tgz",
+      "integrity": "sha512-jvK1ZXuhsggjb3qYQjMiU/AVYYiTeqT5thWvYR2yuy2LGM84P5MSSyAinwHahGsdBYKR9m9HncVR/3f3nFKkxg==",
+      "license": "MIT"
+    },
+    "node_modules/thunky": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/thunky/-/thunky-1.1.0.tgz",
+      "integrity": "sha512-eHY7nBftgThBqOyHGVN+l8gF0BucP09fMo0oO/Lb0w1OF80dJv+lDVpXG60WMQvkcxAkNybKsrEIE3ZtKGmPrA==",
+      "license": "MIT"
+    },
+    "node_modules/timeout-refresh": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/timeout-refresh/-/timeout-refresh-1.0.3.tgz",
+      "integrity": "sha512-Mz0CX4vBGM5lj8ttbIFt7o4ZMxk/9rgudJRh76EvB7xXZMur7T/cjRiH2w4Fmkq0zxf2QpM8IFvOSRn8FEu3gA==",
+      "license": "MIT",
+      "optional": true
+    },
+    "node_modules/toad-cache": {
+      "version": "3.7.4",
+      "resolved": "https://registry.npmjs.org/toad-cache/-/toad-cache-3.7.4.tgz",
+      "integrity": "sha512-m1TdR/rvT7kgGJZhspNtXdsdYk0fddFpJJFlG5s+UkPFo6lkLoZ3YLOaovPYjq1R75NP5JfeTlSHaOsE09peCg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=20"
+      }
+    },
+    "node_modules/torrent-discovery": {
+      "version": "11.0.21",
+      "resolved": "https://registry.npmjs.org/torrent-discovery/-/torrent-discovery-11.0.21.tgz",
+      "integrity": "sha512-x+RGu60qJp2u4S7B7XglyYCrfDJWKB0RIexODlA5dpBpMh94q4MbmRjusdbvxN+XD4NHhpwEfub/CRA9pUXjEQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "bittorrent-dht": "^11.0.12",
+        "bittorrent-lsd": "^2.0.3",
+        "bittorrent-tracker": "^11.2.3",
+        "debug": "^4.4.3",
+        "run-parallel": "^1.2.0"
+      },
+      "engines": {
+        "node": ">=16.0.0"
+      }
+    },
+    "node_modules/torrent-piece": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/torrent-piece/-/torrent-piece-3.0.2.tgz",
+      "integrity": "sha512-K1A5tZ3BolFrUtnBpk9iDg8av1na0OgQ7E0IlA9tj0bcsPhLhzvln+oMtMmtkqAwmUsbNCilRm2ymUdZg0rVbQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "uint8-util": "^2.1.9"
+      },
+      "engines": {
+        "node": ">=12.20.0"
+      }
+    },
+    "node_modules/tunnel-agent": {
+      "version": "0.6.0",
+      "resolved": "https://registry.npmjs.org/tunnel-agent/-/tunnel-agent-0.6.0.tgz",
+      "integrity": "sha512-McnNiV1l8RYeY8tBgEpuodCC1mLUdbSN+CYBL7kJsJNInOP8UjDDEwdk6Mw60vdLLrr5NHKZhMAOSrR2NZuQ+w==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "safe-buffer": "^5.0.1"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/uint8-util": {
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/uint8-util/-/uint8-util-2.3.2.tgz",
+      "integrity": "sha512-u1c0/eiT1IW+c5+ogbmE2Fu2hmtJQPkuzDmXD/4crMU4FPMjkTkFnjJ2NN/9AsZ9YWcc7yE869uc3WB8wIZEEA==",
+      "license": "MIT"
+    },
+    "node_modules/unordered-array-remove": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/unordered-array-remove/-/unordered-array-remove-1.0.2.tgz",
+      "integrity": "sha512-45YsfD6svkgaCBNyvD+dFHm4qFX9g3wRSIVgWVPtm2OCnphvPxzJoe20ATsiNpNJrmzHifnxm+BN5F7gFT/4gw==",
+      "license": "MIT"
+    },
+    "node_modules/unordered-set": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/unordered-set/-/unordered-set-2.0.1.tgz",
+      "integrity": "sha512-eUmNTPzdx+q/WvOHW0bgGYLWvWHNT3PTKEQLg0MAQhc0AHASHVHoP/9YytYd4RBVariqno/mEUhVZN98CmD7bg==",
+      "license": "MIT",
+      "optional": true
+    },
+    "node_modules/ut_metadata": {
+      "version": "4.0.3",
+      "resolved": "https://registry.npmjs.org/ut_metadata/-/ut_metadata-4.0.3.tgz",
+      "integrity": "sha512-2tovup0VDYpT8t8+EhhhKBmbgIyiYyJQZ+Hf+/61+SvjuRS2MEeA5CiSARP4q+9/83Wu09OsGrUre/Zv6OI5NA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "bencode": "^4.0.0",
+        "bitfield": "^4.0.0",
+        "debug": "^4.2.0",
+        "uint8-util": "^2.1.3"
+      },
+      "engines": {
+        "node": ">=12.20.0"
+      }
+    },
+    "node_modules/ut_pex": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/ut_pex/-/ut_pex-4.0.4.tgz",
+      "integrity": "sha512-isVTbp2TKGoMOu+4Zh/i6ijpYr0VG83xjRPgCXaUjKzgXXndjCMWg32/9kZjubD+kxEXcmXMkoS8IttS9FZE8g==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "bencode": "^4.0.0",
+        "compact2string": "^1.4.1",
+        "string2compact": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=12.20.0"
+      }
+    },
+    "node_modules/util-deprecate": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
+      "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
+      "license": "MIT"
+    },
+    "node_modules/utp-native": {
+      "version": "2.5.3",
+      "resolved": "https://registry.npmjs.org/utp-native/-/utp-native-2.5.3.tgz",
+      "integrity": "sha512-sWTrWYXPhhWJh+cS2baPzhaZc89zwlWCfwSthUjGhLkZztyPhcQllo+XVVCbNGi7dhyRlxkWxN4NKU6FbA9Y8w==",
+      "hasInstallScript": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "napi-macros": "^2.0.0",
+        "node-gyp-build": "^4.2.0",
+        "readable-stream": "^3.0.2",
+        "timeout-refresh": "^1.0.0",
+        "unordered-set": "^2.0.1"
+      },
+      "bin": {
+        "ucat": "ucat.js"
+      },
+      "engines": {
+        "node": ">=8.12"
+      }
+    },
+    "node_modules/web-streams-polyfill": {
+      "version": "3.3.3",
+      "resolved": "https://registry.npmjs.org/web-streams-polyfill/-/web-streams-polyfill-3.3.3.tgz",
+      "integrity": "sha512-d2JWLCivmZYTSIoge9MsgFCZrt571BikcWGYkjC1khllbTeDlGqZ2D8vD8E/lJa8WGWbb7Plm8/XJYV7IJHZZw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/webidl-conversions": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-7.0.0.tgz",
+      "integrity": "sha512-VwddBukDzu71offAQR975unBIGqfKZpM+8ZX6ySk8nYhVoo5CYaZyzt3YBvYtRtO+aoGlqxPg/B87NGVZ/fu6g==",
+      "license": "BSD-2-Clause",
+      "optional": true,
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/webrtc-polyfill": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/webrtc-polyfill/-/webrtc-polyfill-1.2.2.tgz",
+      "integrity": "sha512-t/H2OySa7lZSq2f5j4whmr+IWCl5TqF4daGotE8VhPP7U+E4x5x8MK1wqOkqlb4xxRlag4kBB9enU4oxNk//+g==",
+      "license": "MIT",
+      "dependencies": {
+        "node-datachannel": "^0.32.3"
+      },
+      "engines": {
+        "node": ">=16.0.0"
+      }
+    },
+    "node_modules/webtorrent": {
+      "version": "2.8.5",
+      "resolved": "https://registry.npmjs.org/webtorrent/-/webtorrent-2.8.5.tgz",
+      "integrity": "sha512-oIjpuBrypApJ+RCZ8RRaHEncVSkt2cd25/I4Trb2sk9nlaEF92Dg1u8BCwqA4eJR7wIZQM95GyO7Wo4QTbrUUA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "@silentbot1/nat-api": "^0.4.9",
+        "@thaunknown/simple-peer": "^10.0.11",
+        "@webtorrent/http-node": "^1.3.0",
+        "addr-to-ip-port": "^2.0.0",
+        "bitfield": "^4.2.0",
+        "bittorrent-dht": "^11.0.10",
+        "bittorrent-protocol": "^4.1.20",
+        "cache-chunk-store": "^3.2.2",
+        "chunk-store-iterator": "^1.0.4",
+        "cpus": "^1.0.3",
+        "create-torrent": "^6.1.0",
+        "cross-fetch-ponyfill": "^1.0.3",
+        "debug": "^4.4.1",
+        "escape-html": "^1.0.3",
+        "fs-chunk-store": "^5.0.0",
+        "fsa-chunk-store": "^1.3.0",
+        "immediate-chunk-store": "^2.2.0",
+        "join-async-iterator": "^1.1.1",
+        "load-ip-set": "^3.0.1",
+        "lt_donthave": "^2.0.5",
+        "memory-chunk-store": "^1.3.5",
+        "mime": "^3.0.0",
+        "once": "^1.4.0",
+        "parse-torrent": "^11.0.18",
+        "pump": "^3.0.2",
+        "queue-microtask": "^1.2.3",
+        "random-iterate": "^1.0.1",
+        "range-parser": "^1.2.1",
+        "run-parallel": "^1.2.0",
+        "run-parallel-limit": "^1.1.0",
+        "speed-limiter": "^1.0.2",
+        "streamx": "2.22.1",
+        "throughput": "^1.0.2",
+        "torrent-discovery": "^11.0.17",
+        "torrent-piece": "^3.0.2",
+        "uint8-util": "^2.2.5",
+        "unordered-array-remove": "^1.0.2",
+        "ut_metadata": "^4.0.3",
+        "ut_pex": "^4.0.4"
+      },
+      "engines": {
+        "node": ">=16"
+      },
+      "optionalDependencies": {
+        "utp-native": "^2.5.3"
+      }
+    },
+    "node_modules/which": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
+      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
+      "license": "ISC",
+      "dependencies": {
+        "isexe": "^2.0.0"
+      },
+      "bin": {
+        "node-which": "bin/node-which"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/which-runtime": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/which-runtime/-/which-runtime-1.4.0.tgz",
+      "integrity": "sha512-0ugbP4CJW4e2D20jvEcC4973dCgIaHI4Rw1PT+26U9zEve7FyYdWAIwUnoeOYvoCfn+wXHoHTKb1KhkYlb60Pw==",
+      "license": "Apache-2.0",
+      "optional": true
+    },
+    "node_modules/wrappy": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
+      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
+      "license": "ISC"
+    },
+    "node_modules/ws": {
+      "version": "8.21.1",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.1.tgz",
+      "integrity": "sha512-+0NTnW77fFN/DjQi6k/Sq/Yvk4Sgajw7urW8V+asjXnRgDs9gyGkdb7EzgfhA4goXsRIZKE28fzIXBHEzhuiWw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10.0.0"
+      },
+      "peerDependencies": {
+        "bufferutil": "^4.0.1",
+        "utf-8-validate": ">=5.0.2"
+      },
+      "peerDependenciesMeta": {
+        "bufferutil": {
+          "optional": true
+        },
+        "utf-8-validate": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/xml2js": {
+      "version": "0.6.2",
+      "resolved": "https://registry.npmjs.org/xml2js/-/xml2js-0.6.2.tgz",
+      "integrity": "sha512-T4rieHaC1EXcES0Kxxj4JWgaUQHDk+qwHcYOCFHfiwKz7tOVPLq7Hjq9dM1WCMhylqMEfP7hMcOIChvotiZegA==",
+      "license": "MIT",
+      "dependencies": {
+        "sax": ">=0.6.0",
+        "xmlbuilder": "~11.0.0"
+      },
+      "engines": {
+        "node": ">=4.0.0"
+      }
+    },
+    "node_modules/xmlbuilder": {
+      "version": "11.0.1",
+      "resolved": "https://registry.npmjs.org/xmlbuilder/-/xmlbuilder-11.0.1.tgz",
+      "integrity": "sha512-fDlsI/kFEx7gLvbecc0/ohLG50fugQp8ryHzMTuW9vSa1GJ0XYWKnhsUx7oie3G98+r56aTQIUB4kht42R3JvA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=4.0"
+      }
+    }
+  }
+}

From fd6809b873262effced02db9af833ba52516019c Mon Sep 17 00:00:00 2001
From: CyberMind-FR <gandalf@Gk2.net>
Date: Tue, 28 Jul 2026 15:07:46 +0200
Subject: [PATCH 09/17] feat(torrent): api.js Fastify routes + stream mount
 (ref #917)

Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
---
 packages/secubox-torrent/lxc/app/api.js       | 59 +++++++++++++++++++
 packages/secubox-torrent/lxc/app/api.test.js  | 45 ++++++++++++++
 .../secubox-torrent/lxc/app/package-lock.json |  2 +-
 packages/secubox-torrent/lxc/app/package.json | 14 +++--
 4 files changed, 114 insertions(+), 6 deletions(-)
 create mode 100644 packages/secubox-torrent/lxc/app/api.js
 create mode 100644 packages/secubox-torrent/lxc/app/api.test.js

diff --git a/packages/secubox-torrent/lxc/app/api.js b/packages/secubox-torrent/lxc/app/api.js
new file mode 100644
index 00000000..de17e1ee
--- /dev/null
+++ b/packages/secubox-torrent/lxc/app/api.js
@@ -0,0 +1,59 @@
+// SPDX-License-Identifier: LicenseRef-CMSD-1.0
+// Copyright (c) 2026 CyberMind — Gérald Kerma <devel@cybermind.fr>
+// SecuBox-Deb :: secubox-torrent :: api.js — CyberMind https://cybermind.fr
+//
+// Fastify control API: torrent lifecycle (add/list/keep/remove) + status/health,
+// plus the /stream mount that hands off to the Range streaming handler.
+
+import Fastify from 'fastify';
+import path from 'node:path';
+import { handleStream } from './stream.js';
+
+export function buildApi({ engine, library, diskFreeBytes }) {
+  const app = Fastify({ logger: false });
+
+  app.get('/api/v1/torrent/health', async () => ({ status: 'ok' }));
+  app.get('/api/v1/torrent/status', async () => ({
+    active: engine.client.torrents.length, disk_free: diskFreeBytes(), webrtc: engine.webrtc !== false }));
+
+  app.post('/api/v1/torrent/add', async (req, reply) => {
+    const magnet = (req.body || {}).magnet;
+    if (!magnet) return reply.code(400).send({ error: 'magnet required' });
+    let meta;
+    try { meta = await engine.add(magnet); }
+    catch (e) { return reply.code(504).send({ error: e.message }); }
+    library.add({ infohash: meta.infohash, name: meta.name, magnet,
+      path: path.join(engine.downloadDir, 'tmp', meta.infohash) });
+    return meta;
+  });
+
+  app.get('/api/v1/torrent/list', async () =>
+    library.list().map(r => ({ ...r, stats: engine.stats(r.infohash) })));
+
+  app.get('/api/v1/torrent/files/:infohash', async (req, reply) => {
+    const t = engine.get(req.params.infohash);
+    if (!t) return reply.code(404).send({ error: 'not found' });
+    return t.files.map((f, i) => ({ idx: i, name: f.name, length: f.length }));
+  });
+
+  app.post('/api/v1/torrent/keep/:infohash', async (req, reply) => {
+    const ih = req.params.infohash;
+    if (!library.get(ih)) return reply.code(404).send({ error: 'not found' });
+    library.keep(ih, path.join(engine.downloadDir, 'library', ih));
+    return { status: 'kept' };
+  });
+
+  app.post('/api/v1/torrent/remove/:infohash', async (req) => {
+    engine.remove(req.params.infohash, { deleteData: true });
+    library.remove(req.params.infohash);
+    return { status: 'removed' };
+  });
+
+  app.get('/stream/:infohash/:fileIdx', (req, reply) => {
+    library.touch(req.params.infohash);
+    return handleStream(engine, req, reply.raw)
+      .then(() => { reply.hijack(); });
+  });
+
+  return app;
+}
diff --git a/packages/secubox-torrent/lxc/app/api.test.js b/packages/secubox-torrent/lxc/app/api.test.js
new file mode 100644
index 00000000..04235777
--- /dev/null
+++ b/packages/secubox-torrent/lxc/app/api.test.js
@@ -0,0 +1,45 @@
+// SPDX-License-Identifier: LicenseRef-CMSD-1.0
+// Copyright (c) 2026 CyberMind — Gérald Kerma <devel@cybermind.fr>
+// SecuBox-Deb :: secubox-torrent :: api.test.js — CyberMind https://cybermind.fr
+//
+// Unit tests for the Fastify control API. Uses fastify .inject (no network),
+// the Engine with FakeWebTorrent, and an in-memory Library.
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { buildApi } from './api.js';
+import { Library } from './library.js';
+import { Engine } from './engine.js';
+import { FakeWebTorrent } from './fakes.js';
+
+function build() {
+  const engine = new Engine({ WebTorrentCtor: FakeWebTorrent, downloadDir: '/tmp', maxActive: 5, webrtc: true });
+  const library = new Library(':memory:');
+  return buildApi({ engine, library, diskFreeBytes: () => 10 * 1e9 });
+}
+
+test('health returns ok', async () => {
+  const app = build();
+  const r = await app.inject({ method: 'GET', url: '/api/v1/torrent/health' });
+  assert.equal(r.statusCode, 200);
+  assert.equal(r.json().status, 'ok');
+});
+
+test('add then list returns the torrent', async () => {
+  const app = build();
+  await app.inject({ method: 'POST', url: '/api/v1/torrent/add',
+    payload: { magnet: 'magnet:?xt=urn:btih:' + 'a'.repeat(40) } });
+  const r = await app.inject({ method: 'GET', url: '/api/v1/torrent/list' });
+  assert.equal(r.json().length, 1);
+  assert.equal(r.json()[0].kept, 0);
+});
+
+test('keep flips kept=1', async () => {
+  const app = build();
+  await app.inject({ method: 'POST', url: '/api/v1/torrent/add',
+    payload: { magnet: 'magnet:?xt=urn:btih:' + 'a'.repeat(40) } });
+  const r = await app.inject({ method: 'POST', url: '/api/v1/torrent/keep/' + 'a'.repeat(40) });
+  assert.equal(r.statusCode, 200);
+  const list = await app.inject({ method: 'GET', url: '/api/v1/torrent/list' });
+  assert.equal(list.json()[0].kept, 1);
+});
diff --git a/packages/secubox-torrent/lxc/app/package-lock.json b/packages/secubox-torrent/lxc/app/package-lock.json
index 49bb608d..28091776 100644
--- a/packages/secubox-torrent/lxc/app/package-lock.json
+++ b/packages/secubox-torrent/lxc/app/package-lock.json
@@ -10,7 +10,7 @@
       "dependencies": {
         "@roamhq/wrtc": "^0.8.0",
         "better-sqlite3": "^11.3.0",
-        "fastify": "^4.28.1",
+        "fastify": "^4.29.1",
         "webtorrent": "^2.5.1"
       },
       "engines": {
diff --git a/packages/secubox-torrent/lxc/app/package.json b/packages/secubox-torrent/lxc/app/package.json
index 1f884df5..47269c3e 100644
--- a/packages/secubox-torrent/lxc/app/package.json
+++ b/packages/secubox-torrent/lxc/app/package.json
@@ -3,12 +3,16 @@
   "version": "2.0.0",
   "private": true,
   "type": "module",
-  "engines": { "node": ">=18" },
-  "scripts": { "test": "node --test" },
+  "engines": {
+    "node": ">=18"
+  },
+  "scripts": {
+    "test": "node --test"
+  },
   "dependencies": {
-    "webtorrent": "^2.5.1",
     "@roamhq/wrtc": "^0.8.0",
-    "fastify": "^4.28.1",
-    "better-sqlite3": "^11.3.0"
+    "better-sqlite3": "^11.3.0",
+    "fastify": "^4.29.1",
+    "webtorrent": "^2.5.1"
   }
 }

From 405d287f06e5b993d4cfd5aff511759398a30097 Mon Sep 17 00:00:00 2001
From: CyberMind-FR <gandalf@Gk2.net>
Date: Tue, 28 Jul 2026 15:15:56 +0200
Subject: [PATCH 10/17] feat(torrent): server wiring + purge sweep + player
 webui (ref #917)

Adds server.js (env-driven Engine/Library/buildApi wiring, ephemeral
torrent purge sweep on a timer, static webui serving) and the runPurge
unit tests (TTL + kept-flag + disk-floor sweep, in-memory Library only).
webtorrent and @fastify/static are imported dynamically inside start()
so runPurge stays testable without the native wrtc build.

Replaces the old Transmission-container panel with a single-page
WebTorrent player webui (magnet add, list with keep/remove, in-browser
playback via /stream, BitTorrent-only status badge) per the cyan
hybrid-dark self-contained module vhost guidelines.

Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
---
 .../secubox-torrent/lxc/app/package-lock.json |  521 ++++++
 packages/secubox-torrent/lxc/app/package.json |    1 +
 packages/secubox-torrent/lxc/app/server.js    |   76 +
 .../secubox-torrent/lxc/app/server.test.js    |   62 +
 .../secubox-torrent/www/torrent/index.html    | 1629 ++++-------------
 5 files changed, 1033 insertions(+), 1256 deletions(-)
 create mode 100644 packages/secubox-torrent/lxc/app/server.js
 create mode 100644 packages/secubox-torrent/lxc/app/server.test.js

diff --git a/packages/secubox-torrent/lxc/app/package-lock.json b/packages/secubox-torrent/lxc/app/package-lock.json
index 28091776..2c78f539 100644
--- a/packages/secubox-torrent/lxc/app/package-lock.json
+++ b/packages/secubox-torrent/lxc/app/package-lock.json
@@ -8,6 +8,7 @@
       "name": "secubox-torrent",
       "version": "2.0.0",
       "dependencies": {
+        "@fastify/static": "^7.0.0",
         "@roamhq/wrtc": "^0.8.0",
         "better-sqlite3": "^11.3.0",
         "fastify": "^4.29.1",
@@ -17,6 +18,15 @@
         "node": ">=18"
       }
     },
+    "node_modules/@fastify/accept-negotiator": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@fastify/accept-negotiator/-/accept-negotiator-1.1.0.tgz",
+      "integrity": "sha512-OIHZrb2ImZ7XG85HXOONLcJWGosv7sIvM2ifAPQVhg9Lv7qdmMBNVaai4QTdyuaqbKM5eO6sLSQOYI7wEQeCJQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=14"
+      }
+    },
     "node_modules/@fastify/ajv-compiler": {
       "version": "3.6.0",
       "resolved": "https://registry.npmjs.org/@fastify/ajv-compiler/-/ajv-compiler-3.6.0.tgz",
@@ -52,12 +62,75 @@
         "fast-deep-equal": "^3.1.3"
       }
     },
+    "node_modules/@fastify/send": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/@fastify/send/-/send-2.1.0.tgz",
+      "integrity": "sha512-yNYiY6sDkexoJR0D8IDy3aRP3+L4wdqCpvx5WP+VtEU58sn7USmKynBzDQex5X42Zzvw2gNzzYgP90UfWShLFA==",
+      "license": "MIT",
+      "dependencies": {
+        "@lukeed/ms": "^2.0.1",
+        "escape-html": "~1.0.3",
+        "fast-decode-uri-component": "^1.0.1",
+        "http-errors": "2.0.0",
+        "mime": "^3.0.0"
+      }
+    },
+    "node_modules/@fastify/static": {
+      "version": "7.0.4",
+      "resolved": "https://registry.npmjs.org/@fastify/static/-/static-7.0.4.tgz",
+      "integrity": "sha512-p2uKtaf8BMOZWLs6wu+Ihg7bWNBdjNgCwDza4MJtTqg+5ovKmcbgbR9Xs5/smZ1YISfzKOCNYmZV8LaCj+eJ1Q==",
+      "license": "MIT",
+      "dependencies": {
+        "@fastify/accept-negotiator": "^1.0.0",
+        "@fastify/send": "^2.0.0",
+        "content-disposition": "^0.5.3",
+        "fastify-plugin": "^4.0.0",
+        "fastq": "^1.17.0",
+        "glob": "^10.3.4"
+      }
+    },
+    "node_modules/@isaacs/cliui": {
+      "version": "8.0.2",
+      "resolved": "https://registry.npmjs.org/@isaacs/cliui/-/cliui-8.0.2.tgz",
+      "integrity": "sha512-O8jcjabXaleOG9DQ0+ARXWZBTfnP4WNAqzuiJK7ll44AmxGKv/J2M4TPjxjY3znBCfvBXFzucm1twdyFybFqEA==",
+      "license": "ISC",
+      "dependencies": {
+        "string-width": "^5.1.2",
+        "string-width-cjs": "npm:string-width@^4.2.0",
+        "strip-ansi": "^7.0.1",
+        "strip-ansi-cjs": "npm:strip-ansi@^6.0.1",
+        "wrap-ansi": "^8.1.0",
+        "wrap-ansi-cjs": "npm:wrap-ansi@^7.0.0"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@lukeed/ms": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/@lukeed/ms/-/ms-2.0.2.tgz",
+      "integrity": "sha512-9I2Zn6+NJLfaGoz9jN3lpwDgAYvfGeNYdbAIjJOqzs4Tpc+VU3Jqq4IofSUBKajiDS8k9fZIg18/z13mpk1bsA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/@pinojs/redact": {
       "version": "0.4.0",
       "resolved": "https://registry.npmjs.org/@pinojs/redact/-/redact-0.4.0.tgz",
       "integrity": "sha512-k2ENnmBugE/rzQfEcdWHcCY+/FM3VLzH9cYEsbdsoqrvzAKRhUZeRNhAZvB8OitQJ1TBed3yqWtdjzS6wJKBwg==",
       "license": "MIT"
     },
+    "node_modules/@pkgjs/parseargs": {
+      "version": "0.11.0",
+      "resolved": "https://registry.npmjs.org/@pkgjs/parseargs/-/parseargs-0.11.0.tgz",
+      "integrity": "sha512-+1VkjdD0QBLPodGrJUeqarH8VAIvQODIbwh9XpP5Syisf7YoQgsJKPNFoqqLQlu+VQ/tVSshMR6loPMn8U+dPg==",
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">=14"
+      }
+    },
     "node_modules/@roamhq/wrtc": {
       "version": "0.8.0",
       "resolved": "https://registry.npmjs.org/@roamhq/wrtc/-/wrtc-0.8.0.tgz",
@@ -300,6 +373,30 @@
       ],
       "license": "BSD-3-Clause"
     },
+    "node_modules/ansi-regex": {
+      "version": "6.2.2",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.2.2.tgz",
+      "integrity": "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-regex?sponsor=1"
+      }
+    },
+    "node_modules/ansi-styles": {
+      "version": "6.2.3",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-6.2.3.tgz",
+      "integrity": "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
     "node_modules/atomic-sleep": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/atomic-sleep/-/atomic-sleep-1.0.0.tgz",
@@ -333,6 +430,12 @@
         }
       }
     },
+    "node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "license": "MIT"
+    },
     "node_modules/bare-addon-resolve": {
       "version": "1.10.1",
       "resolved": "https://registry.npmjs.org/bare-addon-resolve/-/bare-addon-resolve-1.10.1.tgz",
@@ -728,6 +831,15 @@
       "integrity": "sha512-yAHUP44v2K25xLPdrgVTgwtuQctlullzjczu9CoUZom5AP3g4p1R1+aWHjS1GHG9JtcSUVUnbEPiuXiW5YZ24w==",
       "license": "MIT"
     },
+    "node_modules/brace-expansion": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.3.tgz",
+      "integrity": "sha512-DRdx5neNsG/QXbniLFWi2YmC/68oeOOmKz6zOjVk6ZS1ZLXgLIKqVEc6hWsmkjBbgii0SwaBTcJ5XKj5gzY/4A==",
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0"
+      }
+    },
     "node_modules/buffer": {
       "version": "5.7.1",
       "resolved": "https://registry.npmjs.org/buffer/-/buffer-5.7.1.tgz",
@@ -847,6 +959,24 @@
         "block-iterator": "^1.1.1"
       }
     },
+    "node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "license": "MIT",
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "license": "MIT"
+    },
     "node_modules/compact2string": {
       "version": "1.4.1",
       "resolved": "https://registry.npmjs.org/compact2string/-/compact2string-1.4.1.tgz",
@@ -856,6 +986,18 @@
         "ipaddr.js": ">= 0.1.5"
       }
     },
+    "node_modules/content-disposition": {
+      "version": "0.5.4",
+      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-0.5.4.tgz",
+      "integrity": "sha512-FveZTNuGw04cxlAiWbzi6zTAL/lhehaWbTtgluJh4/E95DqMwTmha3KZN1aAWA8cFIhHzMZUvLevkw5Rqk+tSQ==",
+      "license": "MIT",
+      "dependencies": {
+        "safe-buffer": "5.2.1"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
     "node_modules/cookie": {
       "version": "0.7.2",
       "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz",
@@ -1011,6 +1153,15 @@
         "node": ">= 16"
       }
     },
+    "node_modules/depd": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz",
+      "integrity": "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
     "node_modules/detect-libc": {
       "version": "2.1.2",
       "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
@@ -1034,6 +1185,18 @@
         "node": ">=12"
       }
     },
+    "node_modules/eastasianwidth": {
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/eastasianwidth/-/eastasianwidth-0.2.0.tgz",
+      "integrity": "sha512-I88TYZWc9XiYHRQ4/3c5rjjfgkjhLyW2luGIheGERbNQ6OY7yTybanSpDXZa8y7VUP9YmDcYa+eyq4ca7iLqWA==",
+      "license": "MIT"
+    },
+    "node_modules/emoji-regex": {
+      "version": "9.2.2",
+      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-9.2.2.tgz",
+      "integrity": "sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg==",
+      "license": "MIT"
+    },
     "node_modules/end-of-stream": {
       "version": "1.4.5",
       "resolved": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.5.tgz",
@@ -1216,6 +1379,12 @@
         "toad-cache": "^3.3.0"
       }
     },
+    "node_modules/fastify-plugin": {
+      "version": "4.5.1",
+      "resolved": "https://registry.npmjs.org/fastify-plugin/-/fastify-plugin-4.5.1.tgz",
+      "integrity": "sha512-stRHYGeuqpEZTL1Ef0Ovr2ltazUT9g844X5z/zEBFLG8RYlpDiOCIG+ATvYEp+/zmc7sN29mcIMp8gvYplYPIQ==",
+      "license": "MIT"
+    },
     "node_modules/fastq": {
       "version": "1.20.1",
       "resolved": "https://registry.npmjs.org/fastq/-/fastq-1.20.1.tgz",
@@ -1280,6 +1449,34 @@
         "node": ">=14"
       }
     },
+    "node_modules/foreground-child": {
+      "version": "3.3.1",
+      "resolved": "https://registry.npmjs.org/foreground-child/-/foreground-child-3.3.1.tgz",
+      "integrity": "sha512-gIXjKqtFuWEgzFRJA9WCQeSJLZDjgJUOMCMzxtvFq/37KojM1BFGufqsCy0r4qSQmYLsZYMeyRqzIWOMup03sw==",
+      "license": "ISC",
+      "dependencies": {
+        "cross-spawn": "^7.0.6",
+        "signal-exit": "^4.0.1"
+      },
+      "engines": {
+        "node": ">=14"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/foreground-child/node_modules/signal-exit": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-4.1.0.tgz",
+      "integrity": "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=14"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
     "node_modules/formdata-polyfill": {
       "version": "4.0.10",
       "resolved": "https://registry.npmjs.org/formdata-polyfill/-/formdata-polyfill-4.0.10.tgz",
@@ -1394,6 +1591,43 @@
       "integrity": "sha512-SyHy3T1v2NUXn29OsWdxmK6RwHD+vkj3v8en8AOBZ1wBQ/hCAQ5bAQTD02kW4W9tUp/3Qh6J8r9EvntiyCmOOw==",
       "license": "MIT"
     },
+    "node_modules/glob": {
+      "version": "10.5.0",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-10.5.0.tgz",
+      "integrity": "sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg==",
+      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
+      "license": "ISC",
+      "dependencies": {
+        "foreground-child": "^3.1.0",
+        "jackspeak": "^3.1.2",
+        "minimatch": "^9.0.4",
+        "minipass": "^7.1.2",
+        "package-json-from-dist": "^1.0.0",
+        "path-scurry": "^1.11.1"
+      },
+      "bin": {
+        "glob": "dist/esm/bin.mjs"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/http-errors": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.0.tgz",
+      "integrity": "sha512-FtwrG/euBzaEjYeRqOgly7G0qviiXoJWnvEH2Z1plBdXgbyjv34pHTSb9zoeHMyDy33+DWy5Wt9Wo+TURtOYSQ==",
+      "license": "MIT",
+      "dependencies": {
+        "depd": "2.0.0",
+        "inherits": "2.0.4",
+        "setprototypeof": "1.2.0",
+        "statuses": "2.0.1",
+        "toidentifier": "1.0.1"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
     "node_modules/http-parser-js": {
       "version": "0.4.13",
       "resolved": "https://registry.npmjs.org/http-parser-js/-/http-parser-js-0.4.13.tgz",
@@ -1507,6 +1741,15 @@
       "integrity": "sha512-ZGMuc+xA8mRnrXtmtf2l/EkIW2zaD2LSBWlaOVEF6yH4RTndHob65V4SwWWdtGKVthQfXPVKsXqw4TDUjbVxVQ==",
       "license": "MIT"
     },
+    "node_modules/is-fullwidth-code-point": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
+      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/is-stream": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/is-stream/-/is-stream-3.0.0.tgz",
@@ -1525,6 +1768,21 @@
       "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
       "license": "ISC"
     },
+    "node_modules/jackspeak": {
+      "version": "3.4.3",
+      "resolved": "https://registry.npmjs.org/jackspeak/-/jackspeak-3.4.3.tgz",
+      "integrity": "sha512-OGlZQpz2yfahA/Rd1Y8Cd9SIEsqvXkLVoSw/cgwhnhFMDbsQFeZYoJJ7bIZBS9BcamUW96asq/npPWugM+RQBw==",
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "@isaacs/cliui": "^8.0.2"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      },
+      "optionalDependencies": {
+        "@pkgjs/parseargs": "^0.11.0"
+      }
+    },
     "node_modules/join-async-iterator": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/join-async-iterator/-/join-async-iterator-1.1.1.tgz",
@@ -1661,6 +1919,12 @@
         "node": ">= 0.4.0"
       }
     },
+    "node_modules/lru-cache": {
+      "version": "10.4.3",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
+      "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==",
+      "license": "ISC"
+    },
     "node_modules/lt_donthave": {
       "version": "2.0.7",
       "resolved": "https://registry.npmjs.org/lt_donthave/-/lt_donthave-2.0.7.tgz",
@@ -1767,6 +2031,21 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/minimatch": {
+      "version": "9.0.9",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz",
+      "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==",
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^2.0.2"
+      },
+      "engines": {
+        "node": ">=16 || 14 >=14.17"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
     "node_modules/minimist": {
       "version": "1.2.8",
       "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
@@ -1776,6 +2055,15 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/minipass": {
+      "version": "7.1.3",
+      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz",
+      "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==",
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": ">=16 || 14 >=14.17"
+      }
+    },
     "node_modules/mkdirp-classic": {
       "version": "0.5.3",
       "resolved": "https://registry.npmjs.org/mkdirp-classic/-/mkdirp-classic-0.5.3.tgz",
@@ -1945,6 +2233,12 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/package-json-from-dist": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/package-json-from-dist/-/package-json-from-dist-1.0.1.tgz",
+      "integrity": "sha512-UEZIS3/by4OC8vL3P2dTXRETpebLI2NiI5vIrjaD/5UtrkFX/tNbwjTSRAGC/+7CAo2pIcBaRgWmcBBHcsaCIw==",
+      "license": "BlueOak-1.0.0"
+    },
     "node_modules/parse-torrent": {
       "version": "11.0.24",
       "resolved": "https://registry.npmjs.org/parse-torrent/-/parse-torrent-11.0.24.tgz",
@@ -1988,6 +2282,22 @@
         "node": ">=8"
       }
     },
+    "node_modules/path-scurry": {
+      "version": "1.11.1",
+      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-1.11.1.tgz",
+      "integrity": "sha512-Xa4Nw17FS9ApQFJ9umLiJS4orGjm7ZzwUrwamcGQuHSzDyth9boKDaycYdDcZDuqYATXw4HFXgaqWTctW/v1HA==",
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "lru-cache": "^10.2.0",
+        "minipass": "^5.0.0 || ^6.0.2 || ^7.0.0"
+      },
+      "engines": {
+        "node": ">=16 || 14 >=14.18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
     "node_modules/piece-length": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/piece-length/-/piece-length-2.0.1.tgz",
@@ -2427,6 +2737,12 @@
       "integrity": "sha512-oeM1lpU/UvhTxw+g3cIfxXHyJRc/uidd3yK1P242gzHds0udQBYzs3y8j4gCCW+ZJ7ad0yctld8RYO+bdurlvw==",
       "license": "MIT"
     },
+    "node_modules/setprototypeof": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
+      "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==",
+      "license": "ISC"
+    },
     "node_modules/shebang-command": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
@@ -2563,6 +2879,15 @@
         "node": ">= 10.x"
       }
     },
+    "node_modules/statuses": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.1.tgz",
+      "integrity": "sha512-RwNA9Z/7PrK06rYLIzFMlaF+l73iwpzsqRIFgbMLbTcLD6cOao82TaWefPXQvB2fOC4AjuYSEndS7N/mTCbkdQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
     "node_modules/streamx": {
       "version": "2.22.1",
       "resolved": "https://registry.npmjs.org/streamx/-/streamx-2.22.1.tgz",
@@ -2585,6 +2910,65 @@
         "safe-buffer": "~5.2.0"
       }
     },
+    "node_modules/string-width": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-5.1.2.tgz",
+      "integrity": "sha512-HnLOCR3vjcY8beoNLtcjZ5/nxn2afmME6lhrDrebokqMap+XbeW8n9TXpPDOqdGK5qcI3oT0GKTW6wC7EMiVqA==",
+      "license": "MIT",
+      "dependencies": {
+        "eastasianwidth": "^0.2.0",
+        "emoji-regex": "^9.2.2",
+        "strip-ansi": "^7.0.1"
+      },
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/string-width-cjs": {
+      "name": "string-width",
+      "version": "4.2.3",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
+      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
+      "license": "MIT",
+      "dependencies": {
+        "emoji-regex": "^8.0.0",
+        "is-fullwidth-code-point": "^3.0.0",
+        "strip-ansi": "^6.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/string-width-cjs/node_modules/ansi-regex": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
+      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/string-width-cjs/node_modules/emoji-regex": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
+      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
+      "license": "MIT"
+    },
+    "node_modules/string-width-cjs/node_modules/strip-ansi": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+      "license": "MIT",
+      "dependencies": {
+        "ansi-regex": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/string2compact": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/string2compact/-/string2compact-2.0.2.tgz",
@@ -2607,6 +2991,43 @@
         "node": ">= 10"
       }
     },
+    "node_modules/strip-ansi": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.2.0.tgz",
+      "integrity": "sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w==",
+      "license": "MIT",
+      "dependencies": {
+        "ansi-regex": "^6.2.2"
+      },
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/strip-ansi?sponsor=1"
+      }
+    },
+    "node_modules/strip-ansi-cjs": {
+      "name": "strip-ansi",
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+      "license": "MIT",
+      "dependencies": {
+        "ansi-regex": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/strip-ansi-cjs/node_modules/ansi-regex": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
+      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/strip-final-newline": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/strip-final-newline/-/strip-final-newline-3.0.0.tgz",
@@ -2717,6 +3138,15 @@
         "node": ">=20"
       }
     },
+    "node_modules/toidentifier": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
+      "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.6"
+      }
+    },
     "node_modules/torrent-discovery": {
       "version": "11.0.21",
       "resolved": "https://registry.npmjs.org/torrent-discovery/-/torrent-discovery-11.0.21.tgz",
@@ -3008,6 +3438,97 @@
       "license": "Apache-2.0",
       "optional": true
     },
+    "node_modules/wrap-ansi": {
+      "version": "8.1.0",
+      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-8.1.0.tgz",
+      "integrity": "sha512-si7QWI6zUMq56bESFvagtmzMdGOtoxfR+Sez11Mobfc7tm+VkUckk9bW2UeffTGVUbOksxmSw0AA2gs8g71NCQ==",
+      "license": "MIT",
+      "dependencies": {
+        "ansi-styles": "^6.1.0",
+        "string-width": "^5.0.1",
+        "strip-ansi": "^7.0.1"
+      },
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
+      }
+    },
+    "node_modules/wrap-ansi-cjs": {
+      "name": "wrap-ansi",
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
+      "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==",
+      "license": "MIT",
+      "dependencies": {
+        "ansi-styles": "^4.0.0",
+        "string-width": "^4.1.0",
+        "strip-ansi": "^6.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
+      }
+    },
+    "node_modules/wrap-ansi-cjs/node_modules/ansi-regex": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
+      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/wrap-ansi-cjs/node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "license": "MIT",
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/wrap-ansi-cjs/node_modules/emoji-regex": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
+      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
+      "license": "MIT"
+    },
+    "node_modules/wrap-ansi-cjs/node_modules/string-width": {
+      "version": "4.2.3",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
+      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
+      "license": "MIT",
+      "dependencies": {
+        "emoji-regex": "^8.0.0",
+        "is-fullwidth-code-point": "^3.0.0",
+        "strip-ansi": "^6.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/wrap-ansi-cjs/node_modules/strip-ansi": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+      "license": "MIT",
+      "dependencies": {
+        "ansi-regex": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/wrappy": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
diff --git a/packages/secubox-torrent/lxc/app/package.json b/packages/secubox-torrent/lxc/app/package.json
index 47269c3e..1b713822 100644
--- a/packages/secubox-torrent/lxc/app/package.json
+++ b/packages/secubox-torrent/lxc/app/package.json
@@ -10,6 +10,7 @@
     "test": "node --test"
   },
   "dependencies": {
+    "@fastify/static": "^7.0.0",
     "@roamhq/wrtc": "^0.8.0",
     "better-sqlite3": "^11.3.0",
     "fastify": "^4.29.1",
diff --git a/packages/secubox-torrent/lxc/app/server.js b/packages/secubox-torrent/lxc/app/server.js
new file mode 100644
index 00000000..5536e456
--- /dev/null
+++ b/packages/secubox-torrent/lxc/app/server.js
@@ -0,0 +1,76 @@
+// SPDX-License-Identifier: LicenseRef-CMSD-1.0
+// Copyright (c) 2026 CyberMind — Gérald Kerma <devel@cybermind.fr>
+// SecuBox-Deb :: secubox-torrent :: server.js — CyberMind https://cybermind.fr
+//
+// Wires env → Engine/Library/buildApi, serves the player webui, and schedules
+// the ephemeral-torrent purge sweep. `webtorrent` and `@fastify/static` are
+// imported dynamically inside start() — this keeps runPurge (and this whole
+// module) importable in a plain `node --test` run with no native deps built
+// (webtorrent needs @roamhq/wrtc, which only builds on the target LXC).
+
+import fs from 'node:fs';
+import { Engine } from './engine.js';
+import { Library } from './library.js';
+import { buildApi } from './api.js';
+
+/**
+ * Sweep ephemeral (kept=0) torrents that have outlived their TTL, plus —
+ * if free disk has dropped below the configured floor — every remaining
+ * ephemeral torrent regardless of age (kept torrents are NEVER swept).
+ * Returns the list of infohashes removed.
+ */
+export function runPurge(engine, library, { ttlSeconds, diskFloorBytes, diskFreeBytes }) {
+  const now = Math.floor(Date.now() / 1000);
+  let victims = library.expiredEphemeral(ttlSeconds, now);
+  if (diskFreeBytes() < diskFloorBytes) {
+    const extra = library.list().filter(r => r.kept === 0).map(r => r.infohash);
+    victims = [...new Set([...victims, ...extra])];
+  }
+  for (const ih of victims) {
+    engine.remove(ih, { deleteData: true });
+    library.remove(ih);
+  }
+  return victims;
+}
+
+/** Free bytes available on /data — the real disk-floor signal (not RAM). */
+export function diskFreeBytesOnData() {
+  try {
+    const st = fs.statfsSync('/data');
+    return st.bavail * st.bsize;
+  } catch {
+    return Infinity;
+  }
+}
+
+export async function start() {
+  const cfg = {
+    downloadDir: process.env.TORRENT_DOWNLOAD_DIR || '/data/torrent',
+    maxActive: Number(process.env.TORRENT_MAX_ACTIVE || 5),
+    webrtc: process.env.TORRENT_WEBRTC !== 'false',
+    port: Number(process.env.TORRENT_PORT || 8090),
+    ttl: Number(process.env.TORRENT_EPHEMERAL_TTL_HOURS || 6) * 3600,
+    floor: Number(process.env.TORRENT_DISK_FLOOR_GB || 5) * 1e9,
+  };
+
+  const { default: WebTorrent } = await import('webtorrent');
+  const engine = new Engine({ WebTorrentCtor: WebTorrent, ...cfg });
+  const library = new Library(`${cfg.downloadDir}/library.db`);
+  const diskFreeBytes = diskFreeBytesOnData;
+
+  const app = buildApi({ engine, library, diskFreeBytes });
+
+  const fastifyStatic = await import('@fastify/static');
+  await app.register(fastifyStatic.default, { root: '/opt/secubox-torrent/www' });
+
+  setInterval(() => {
+    runPurge(engine, library, { ttlSeconds: cfg.ttl, diskFloorBytes: cfg.floor, diskFreeBytes });
+  }, 300000);
+
+  await app.listen({ host: '0.0.0.0', port: cfg.port });
+  return app;
+}
+
+if (process.argv[1] && process.argv[1].endsWith('server.js')) {
+  start().catch((err) => { console.error(err); process.exit(1); });
+}
diff --git a/packages/secubox-torrent/lxc/app/server.test.js b/packages/secubox-torrent/lxc/app/server.test.js
new file mode 100644
index 00000000..afda8153
--- /dev/null
+++ b/packages/secubox-torrent/lxc/app/server.test.js
@@ -0,0 +1,62 @@
+// SPDX-License-Identifier: LicenseRef-CMSD-1.0
+// Copyright (c) 2026 CyberMind — Gérald Kerma <devel@cybermind.fr>
+// SecuBox-Deb :: secubox-torrent :: server.test.js — CyberMind https://cybermind.fr
+//
+// Unit tests for the purge sweep (runPurge) only. server.js's start() imports
+// webtorrent/@fastify/static dynamically inside the function body, so this
+// file never pulls those heavy/native deps in — no network, no real disk.
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { runPurge } from './server.js';
+import { Library } from './library.js';
+
+test('purge removes expired ephemeral and calls engine.remove', () => {
+  const lib = new Library(':memory:');
+  lib.add({ infohash: 'old', name: 'O', magnet: 'm', path: '/tmp/o' });
+  lib.touchAt('old', 0);
+  const removed = [];
+  const engine = { remove: (ih) => removed.push(ih) };
+  const swept = runPurge(engine, lib, { ttlSeconds: 10, diskFloorBytes: 0, diskFreeBytes: () => 1e12 });
+  assert.deepEqual(swept, ['old']);
+  assert.deepEqual(removed, ['old']);
+  assert.equal(lib.get('old'), null);
+});
+
+test('purge keeps fresh ephemeral torrents under the disk floor', () => {
+  const lib = new Library(':memory:');
+  lib.add({ infohash: 'fresh', name: 'F', magnet: 'm', path: '/tmp/f' });
+  const removed = [];
+  const engine = { remove: (ih) => removed.push(ih) };
+  const swept = runPurge(engine, lib, { ttlSeconds: 3600, diskFloorBytes: 0, diskFreeBytes: () => 1e12 });
+  assert.deepEqual(swept, []);
+  assert.deepEqual(removed, []);
+  assert.ok(lib.get('fresh'));
+});
+
+test('purge never sweeps kept torrents even when stale', () => {
+  const lib = new Library(':memory:');
+  lib.add({ infohash: 'keeper', name: 'K', magnet: 'm', path: '/tmp/k' });
+  lib.keep('keeper', '/tmp/k-kept');
+  lib.touchAt('keeper', 0);
+  const removed = [];
+  const engine = { remove: (ih) => removed.push(ih) };
+  const swept = runPurge(engine, lib, { ttlSeconds: 10, diskFloorBytes: 0, diskFreeBytes: () => 1e12 });
+  assert.deepEqual(swept, []);
+  assert.deepEqual(removed, []);
+  assert.ok(lib.get('keeper'));
+});
+
+test('purge below the disk floor also sweeps fresh ephemeral entries (but never kept ones)', () => {
+  const lib = new Library(':memory:');
+  lib.add({ infohash: 'fresh', name: 'F', magnet: 'm', path: '/tmp/f' });
+  lib.add({ infohash: 'keeper', name: 'K', magnet: 'm', path: '/tmp/k' });
+  lib.keep('keeper', '/tmp/k-kept');
+  const removed = [];
+  const engine = { remove: (ih) => removed.push(ih) };
+  const swept = runPurge(engine, lib, { ttlSeconds: 3600, diskFloorBytes: 10e9, diskFreeBytes: () => 1e9 });
+  assert.deepEqual(swept, ['fresh']);
+  assert.deepEqual(removed, ['fresh']);
+  assert.equal(lib.get('fresh'), null);
+  assert.ok(lib.get('keeper'));
+});
diff --git a/packages/secubox-torrent/www/torrent/index.html b/packages/secubox-torrent/www/torrent/index.html
index 46bc2ee8..98849740 100644
--- a/packages/secubox-torrent/www/torrent/index.html
+++ b/packages/secubox-torrent/www/torrent/index.html
@@ -1,1274 +1,391 @@
+<!-- SPDX-License-Identifier: LicenseRef-CMSD-1.0
+     Copyright (c) 2026 CyberMind — Gérald Kerma <devel@cybermind.fr>
+     SecuBox-Deb :: secubox-torrent :: www/torrent/index.html — CyberMind https://cybermind.fr
+     Player webui — self-contained module vhost variant of the SecuBox WebUI
+     Panel Guidelines (cyan hybrid-dark terminal): no /shared/, no external
+     URLs (offline-clean), palette + component classes inlined verbatim. -->
 <!DOCTYPE html>
 <html lang="en">
 <head>
-    <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>SecuBox - Torrent Client</title>
-    <link rel="stylesheet" href="/shared/sidebar.css">
-    <link rel="stylesheet" href="/shared/crt-light.css">
-    <link rel="stylesheet" href="/shared/hybrid-dark.css">
-    <style>
-        :root {
-            --p31-peak: #00dd44;
-            --p31-dim: #006622;
-            --p31-glow: rgba(0, 221, 68, 0.15);
-            --tube-light: #e8f5e9;
-            --tube-mid: #c8e6c9;
-            --tube-dark: #a5d6a7;
-            --text-primary: #1b5e20;
-            --text-secondary: #388e3c;
-            --text-dim: #66bb6a;
-            --surface: #f1f8e9;
-            --surface-alt: #dcedc8;
-            --border: #c5e1a5;
-            --error: #c62828;
-            --warning: #f57c00;
-            --success: #2e7d32;
-            --torrent: #22c55e;
-            --torrent-dark: #16a34a;
-        }
-        * { box-sizing: border-box; margin: 0; padding: 0; }
-        body {
-            font-family: 'JetBrains Mono', 'Fira Code', monospace;
-            background: linear-gradient(135deg, var(--tube-light) 0%, var(--tube-mid) 100%);
-            color: var(--text-primary);
-            min-height: 100vh;
-            display: flex;
-        }
-        body.crt-light { background: linear-gradient(135deg, var(--tube-light) 0%, var(--tube-mid) 100%); }
-        .main { flex: 1; margin-left: 220px; padding: 1.5rem; max-width: calc(100% - 220px); }
-        .header {
-            display: flex;
-            justify-content: space-between;
-            align-items: center;
-            margin-bottom: 1.5rem;
-            padding-bottom: 1rem;
-            border-bottom: 2px solid var(--torrent);
-        }
-        .header h1 { font-size: 1.5rem; color: var(--torrent); }
-        .header-actions { display: flex; gap: 0.5rem; }
-
-        /* Stats Row */
-        .stats-row {
-            display: grid;
-            grid-template-columns: repeat(auto-fit, minmax(140px, 1fr));
-            gap: 1rem;
-            margin-bottom: 1.5rem;
-        }
-        .stat-card {
-            background: var(--surface);
-            border: 1px solid var(--border);
-            border-radius: 8px;
-            padding: 1rem;
-            text-align: center;
-            box-shadow: 0 2px 8px var(--p31-glow);
-        }
-        .stat-card .label { font-size: 0.75rem; color: var(--text-dim); text-transform: uppercase; }
-        .stat-card .value { font-size: 1.25rem; font-weight: bold; color: var(--p31-dim); margin-top: 0.25rem; }
-        .stat-card.running .value { color: var(--success); }
-        .stat-card.stopped .value { color: var(--error); }
-        .stat-card .speed { color: var(--torrent); }
-
-        /* Tabs */
-        .tabs { display: flex; gap: 0; margin-bottom: 1.5rem; border-bottom: 2px solid var(--border); overflow-x: auto; }
-        .tab {
-            padding: 0.75rem 1.25rem;
-            cursor: pointer;
-            border: 1px solid transparent;
-            border-bottom: none;
-            border-radius: 8px 8px 0 0;
-            background: transparent;
-            color: var(--text-secondary);
-            font-weight: 500;
-            transition: all 0.2s;
-            white-space: nowrap;
-        }
-        .tab:hover { background: var(--surface-alt); }
-        .tab.active {
-            background: var(--surface);
-            border-color: var(--border);
-            color: var(--torrent);
-            margin-bottom: -2px;
-            border-bottom: 2px solid var(--surface);
-        }
-
-        .tab-content { display: none; }
-        .tab-content.active { display: block; }
-
-        /* Cards */
-        .card {
-            background: var(--surface);
-            border: 1px solid var(--border);
-            border-radius: 8px;
-            padding: 1.25rem;
-            margin-bottom: 1rem;
-            box-shadow: 0 2px 8px var(--p31-glow);
-        }
-        .card h3 {
-            font-size: 1rem;
-            color: var(--torrent);
-            margin-bottom: 1rem;
-            padding-bottom: 0.5rem;
-            border-bottom: 1px solid var(--border);
-        }
-
-        /* Buttons */
-        .btn {
-            padding: 0.5rem 1rem;
-            border-radius: 6px;
-            border: 1px solid var(--torrent);
-            background: var(--surface);
-            color: var(--torrent);
-            cursor: pointer;
-            font-weight: 500;
-            transition: all 0.2s;
-        }
-        .btn:hover { background: var(--torrent); color: white; }
-        .btn-primary { background: var(--torrent); color: white; }
-        .btn-primary:hover { background: var(--torrent-dark); }
-        .btn-danger { border-color: var(--error); color: var(--error); }
-        .btn-danger:hover { background: var(--error); color: white; }
-        .btn-success { border-color: var(--success); color: var(--success); }
-        .btn-success:hover { background: var(--success); color: white; }
-        .btn-sm { padding: 0.25rem 0.5rem; font-size: 0.875rem; }
-        .btn:disabled { opacity: 0.5; cursor: not-allowed; }
-        .btn-icon { padding: 0.25rem 0.5rem; font-size: 1rem; }
-
-        /* Tables */
-        table { width: 100%; border-collapse: collapse; }
-        th, td { padding: 0.75rem; text-align: left; border-bottom: 1px solid var(--border); }
-        th { color: var(--text-dim); font-weight: 500; font-size: 0.75rem; text-transform: uppercase; }
-        tr:hover { background: var(--surface-alt); }
-
-        /* Forms */
-        .form-group { margin-bottom: 1rem; }
-        .form-group label { display: block; margin-bottom: 0.25rem; color: var(--text-secondary); font-size: 0.875rem; }
-        input, select, textarea {
-            width: 100%;
-            padding: 0.5rem;
-            border: 1px solid var(--border);
-            border-radius: 6px;
-            background: white;
-            color: var(--text-primary);
-            font-family: inherit;
-        }
-        input:focus, select:focus, textarea:focus { outline: none; border-color: var(--torrent); box-shadow: 0 0 5px rgba(34, 197, 94, 0.3); }
-        .form-row { display: grid; grid-template-columns: repeat(auto-fit, minmax(200px, 1fr)); gap: 1rem; }
-
-        /* Badges */
-        .badge {
-            display: inline-block;
-            padding: 0.25rem 0.5rem;
-            border-radius: 4px;
-            font-size: 0.75rem;
-            font-weight: 500;
-        }
-        .badge-success { background: #c8e6c9; color: #2e7d32; }
-        .badge-error { background: #ffcdd2; color: #c62828; }
-        .badge-warning { background: #ffe0b2; color: #e65100; }
-        .badge-info { background: #b3e5fc; color: #01579b; }
-        .badge-downloading { background: #bbdefb; color: #1565c0; }
-        .badge-seeding { background: #c8e6c9; color: #2e7d32; }
-        .badge-stopped { background: #e0e0e0; color: #616161; }
-
-        /* Progress bar */
-        .progress-bar {
-            height: 6px;
-            background: var(--border);
-            border-radius: 3px;
-            overflow: hidden;
-            margin-top: 0.25rem;
-        }
-        .progress-bar .fill {
-            height: 100%;
-            background: var(--torrent);
-            transition: width 0.3s;
-        }
-        .progress-bar.seeding .fill { background: var(--success); }
-
-        /* Install Banner */
-        .install-banner {
-            background: linear-gradient(135deg, #e8f5e9 0%, #c8e6c9 100%);
-            border: 2px solid var(--torrent);
-            border-radius: 12px;
-            padding: 2rem;
-            text-align: center;
-            margin-bottom: 1.5rem;
-        }
-        .install-banner h2 { color: var(--torrent); margin-bottom: 1rem; }
-        .install-banner p { color: var(--text-secondary); margin-bottom: 1.5rem; }
-
-        /* Modal */
-        .modal {
-            display: none;
-            position: fixed;
-            top: 0;
-            left: 0;
-            right: 0;
-            bottom: 0;
-            background: rgba(0,0,0,0.5);
-            z-index: 1000;
-            align-items: center;
-            justify-content: center;
-        }
-        .modal.active { display: flex; }
-        .modal-content {
-            background: var(--surface);
-            border-radius: 12px;
-            padding: 1.5rem;
-            max-width: 500px;
-            width: 90%;
-            max-height: 80vh;
-            overflow-y: auto;
-            box-shadow: 0 10px 40px rgba(0,0,0,0.2);
-        }
-        .modal-header {
-            display: flex;
-            justify-content: space-between;
-            align-items: center;
-            margin-bottom: 1rem;
-            padding-bottom: 0.5rem;
-            border-bottom: 1px solid var(--border);
-        }
-        .modal-header h3 { color: var(--torrent); }
-        .modal-close {
-            background: none;
-            border: none;
-            font-size: 1.5rem;
-            cursor: pointer;
-            color: var(--text-dim);
-        }
-
-        /* Logs */
-        .logs-container {
-            background: #1a1a1a;
-            color: #00dd44;
-            padding: 1rem;
-            border-radius: 8px;
-            font-family: monospace;
-            font-size: 0.8rem;
-            max-height: 400px;
-            overflow-y: auto;
-            white-space: pre-wrap;
-            word-break: break-all;
-        }
-
-        /* Speed graph placeholder */
-        .speed-graph {
-            height: 200px;
-            background: var(--surface-alt);
-            border-radius: 8px;
-            display: flex;
-            align-items: center;
-            justify-content: center;
-            color: var(--text-dim);
-        }
-
-        /* Toast */
-        .toast {
-            position: fixed;
-            bottom: 1rem;
-            right: 1rem;
-            padding: 1rem 1.5rem;
-            border-radius: 8px;
-            color: white;
-            z-index: 1001;
-            animation: slideIn 0.3s ease;
-        }
-        .toast-success { background: var(--success); }
-        .toast-error { background: var(--error); }
-        @keyframes slideIn { from { transform: translateX(100%); opacity: 0; } to { transform: translateX(0); opacity: 1; } }
-
-        .spinner {
-            display: inline-block;
-            width: 1rem;
-            height: 1rem;
-            border: 2px solid var(--border);
-            border-top-color: var(--torrent);
-            border-radius: 50%;
-            animation: spin 1s linear infinite;
-        }
-        @keyframes spin { to { transform: rotate(360deg); } }
-
-        /* Torrent name truncation */
-        .torrent-name {
-            max-width: 300px;
-            overflow: hidden;
-            text-overflow: ellipsis;
-            white-space: nowrap;
-        }
-
-        /* File upload */
-        .file-drop {
-            border: 2px dashed var(--border);
-            border-radius: 8px;
-            padding: 2rem;
-            text-align: center;
-            cursor: pointer;
-            transition: all 0.2s;
-        }
-        .file-drop:hover, .file-drop.dragover {
-            border-color: var(--torrent);
-            background: rgba(34, 197, 94, 0.05);
-        }
-        .file-drop input { display: none; }
-
-        @media (max-width: 768px) {
-            .main { margin-left: 0; max-width: 100%; padding: 1rem; }
-            .stats-row { grid-template-columns: repeat(2, 1fr); }
-            .torrent-name { max-width: 150px; }
-        }
-    </style>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<title>SecuBox — Torrent</title>
+<style>
+  :root {
+    --p31-dim: #6b7b8b; --bg-dark: #0d1117; --bg-card: rgba(30, 40, 55, 0.8);
+    --bg-row:  rgba(20, 30, 45, 0.6); --border: rgba(100, 150, 200, 0.2);
+    --text: #e8e6d9; --cyan: #00d4ff; --red: #ff4466; --orange: #ff9944;
+    --yellow: #ffcc00; --green: #00dd44; --blue: #4488ff; --purple: #a371f7;
+  }
+  * { box-sizing: border-box; }
+  body {
+    font-family: 'Courier Prime', 'Courier New', monospace;
+    background: var(--bg-dark); color: var(--text); margin: 0; min-height: 100vh;
+    background-image: linear-gradient(135deg, rgba(10,15,25,.96), rgba(15,25,40,.92));
+  }
+  a { color: var(--cyan); }
+  .main { max-width: 60rem; margin: 0 auto; padding: 1.5rem 1.2rem 4rem; }
+  .header { display: flex; justify-content: space-between; align-items: center;
+    margin-bottom: 1.2rem; flex-wrap: wrap; gap: .6rem; padding-bottom: 1rem;
+    border-bottom: 1px solid var(--border); }
+  .header h1 { margin: 0; font-size: 1.4rem; color: var(--cyan); text-shadow: 0 0 10px var(--cyan); }
+  .header .sub { font-size: .72rem; color: var(--p31-dim); letter-spacing: .05em; margin-top: .25rem; }
+  .btn-group { display: flex; flex-wrap: wrap; gap: .5rem; }
+  .btn { font-family: inherit; font-size: .72rem; text-transform: uppercase; letter-spacing: .05em;
+    text-decoration: none; color: var(--text); background: var(--bg-row); border: 1px solid var(--border);
+    border-radius: 6px; padding: .5rem .9rem; cursor: pointer; transition: border-color .15s, box-shadow .15s;
+    display: inline-flex; align-items: center; gap: .35rem; }
+  .btn:hover { border-color: var(--cyan); box-shadow: 0 0 8px rgba(0,212,255,.4); }
+  .btn.primary { border-color: var(--cyan); color: var(--cyan); background: rgba(0,212,255,.12); }
+  .btn.danger { border-color: var(--red); color: var(--red); background: rgba(255,68,102,.12); }
+  .btn.good { border-color: var(--green); color: var(--green); background: rgba(0,221,68,.12); }
+  .btn.sm { padding: .3rem .55rem; font-size: .68rem; }
+  .btn:disabled { opacity: .5; cursor: not-allowed; }
+  .grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(120px,1fr)); gap: .75rem; margin-bottom: 1.2rem; }
+  .stat-card { background: var(--bg-card); border: 1px solid var(--border); border-radius: 8px;
+    padding: .75rem; text-align: center; backdrop-filter: blur(10px); }
+  .stat-card .value { font-size: 1.4rem; font-weight: bold; text-shadow: 0 0 10px currentColor;
+    font-variant-numeric: tabular-nums; color: var(--text); }
+  .stat-card .label { font-size: .6rem; color: var(--p31-dim); letter-spacing: .1em; margin-top: .2rem; text-transform: uppercase; }
+  .stat-card.cyan .value { color: var(--cyan); }
+  .stat-card.green .value { color: var(--green); }
+  .stat-card.orange .value { color: var(--orange); }
+  .badge { display: inline-block; padding: .2rem .55rem; border-radius: 999px; font-size: .62rem;
+    text-transform: uppercase; letter-spacing: .06em; border: 1px solid var(--border); }
+  .badge.bt-only { border-color: var(--orange); color: var(--orange); }
+  .card { background: var(--bg-card); border: 1px solid var(--border); border-radius: 8px;
+    padding: 1.1rem 1.2rem; margin-bottom: 1rem; backdrop-filter: blur(10px); }
+  .card h3 { margin: 0 0 .8rem; font-size: .95rem; color: var(--cyan); letter-spacing: .03em; }
+  .add-row { display: flex; gap: .5rem; flex-wrap: wrap; }
+  .add-row input[type=text] { flex: 1 1 20rem; }
+  input[type=text] { font-family: inherit; background: var(--bg-row); border: 1px solid var(--border);
+    border-radius: 6px; color: var(--text); padding: .6rem .7rem; font-size: .85rem; }
+  input[type=text]:focus { outline: none; border-color: var(--cyan); box-shadow: 0 0 6px rgba(0,212,255,.25); }
+  .item { background: var(--bg-row); border-left: 3px solid var(--border); border-radius: 5px;
+    padding: .6rem .8rem; margin-bottom: .5rem; }
+  .item.kept { border-left-color: var(--green); }
+  .item.ephemeral { border-left-color: var(--orange); }
+  .item-top { display: flex; justify-content: space-between; align-items: center; gap: .6rem; flex-wrap: wrap; }
+  .item .title { color: var(--text); font-size: .88rem; overflow: hidden; text-overflow: ellipsis;
+    white-space: nowrap; max-width: 26rem; cursor: pointer; }
+  .item .title:hover { color: var(--cyan); }
+  .item .meta { color: var(--p31-dim); font-size: .68rem; margin-top: .3rem; font-variant-numeric: tabular-nums; }
+  .item .row-actions { display: flex; gap: .35rem; flex: none; }
+  .progress-bar { height: 5px; background: var(--border); border-radius: 3px; overflow: hidden; margin-top: .35rem; }
+  .progress-bar .fill { height: 100%; background: var(--cyan); transition: width .3s; }
+  .item.kept .progress-bar .fill { background: var(--green); }
+  .files { margin-top: .55rem; padding-top: .5rem; border-top: 1px solid var(--border); display: none; }
+  .files.open { display: block; }
+  .file-row { display: flex; justify-content: space-between; align-items: center; gap: .5rem;
+    padding: .3rem .4rem; border-radius: 4px; font-size: .78rem; }
+  .file-row:hover { background: rgba(0,212,255,.08); }
+  .file-row .fname { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; cursor: pointer; }
+  .file-row .fname.playable:hover { color: var(--cyan); }
+  .file-row .fname:not(.playable) { color: var(--p31-dim); cursor: default; }
+  .muted { color: var(--p31-dim); font-size: .8rem; }
+  #player video { width: 100%; max-height: 60vh; background: #000; border-radius: 6px; }
+  #playerCard { display: none; }
+  .toast { position: fixed; bottom: 1rem; right: 1rem; max-width: 22rem; background: var(--cyan);
+    color: #07121a; padding: .65rem 1rem; border-radius: 6px; font-size: .78rem; opacity: 0;
+    pointer-events: none; transition: opacity .2s; z-index: 50; }
+  .toast.show { opacity: 1; pointer-events: auto; }
+  .toast.error { background: var(--red); color: #fff; }
+  .toast .x { float: right; margin-left: .6rem; cursor: pointer; font-weight: bold; }
+  ::-webkit-scrollbar { width: 5px; }
+  ::-webkit-scrollbar-thumb { background: var(--p31-dim); border-radius: 3px; }
+  ::-webkit-scrollbar-thumb:hover { background: var(--cyan); }
+  @media (max-width: 768px) {
+    .main { padding: 1rem .8rem; }
+    .item .title { max-width: 12rem; }
+  }
+</style>
 </head>
-<body class="crt-light hybrid-dark">
-    <nav class="sidebar" id="sidebar"></nav>
-    <script src="/shared/sidebar.js"></script>
-
-    <main class="main">
-        <header class="header">
-            <h1>Torrent Client</h1>
-            <div class="header-actions">
-                <button class="btn" onclick="openAddModal()">+ Add Torrent</button>
-                <button class="btn" onclick="refresh()">Refresh</button>
-                <button class="btn btn-primary" id="btnToggle" onclick="toggleService()">Start</button>
-            </div>
-        </header>
-
-        <!-- Install Banner -->
-        <div id="installBanner" class="install-banner" style="display: none;">
-            <h2>Welcome to SecuBox Torrent</h2>
-            <p>Download and share files with BitTorrent. Powered by Transmission.</p>
-            <button class="btn btn-primary" onclick="installTorrent()">Install Transmission</button>
-        </div>
-
-        <!-- Stats Row -->
-        <div class="stats-row">
-            <div class="stat-card" id="statStatus">
-                <div class="label">Status</div>
-                <div class="value">-</div>
-            </div>
-            <div class="stat-card">
-                <div class="label">Download</div>
-                <div class="value speed" id="statDownload">0 B/s</div>
-            </div>
-            <div class="stat-card">
-                <div class="label">Upload</div>
-                <div class="value speed" id="statUpload">0 B/s</div>
-            </div>
-            <div class="stat-card">
-                <div class="label">Active</div>
-                <div class="value" id="statActive">0</div>
-            </div>
-            <div class="stat-card">
-                <div class="label">Disk Usage</div>
-                <div class="value" id="statDisk">-</div>
-            </div>
-        </div>
-
-        <!-- Tabs -->
-        <div class="tabs">
-            <div class="tab active" onclick="showTab('torrents')">Torrents</div>
-            <div class="tab" onclick="showTab('stats')">Statistics</div>
-            <div class="tab" onclick="showTab('rss')">RSS Feeds</div>
-            <div class="tab" onclick="showTab('settings')">Settings</div>
-            <div class="tab" onclick="showTab('logs')">Logs</div>
-        </div>
-
-        <!-- Torrents Tab -->
-        <div id="tab-torrents" class="tab-content active">
-            <div class="card">
-                <h3>Active Torrents</h3>
-                <table>
-                    <thead>
-                        <tr>
-                            <th>Name</th>
-                            <th>Size</th>
-                            <th>Progress</th>
-                            <th>Speed</th>
-                            <th>Status</th>
-                            <th>Actions</th>
-                        </tr>
-                    </thead>
-                    <tbody id="torrentsTable">
-                        <tr><td colspan="6">Loading...</td></tr>
-                    </tbody>
-                </table>
-            </div>
-        </div>
-
-        <!-- Statistics Tab -->
-        <div id="tab-stats" class="tab-content">
-            <div class="card">
-                <h3>Transfer Statistics</h3>
-                <div class="form-row">
-                    <div class="stat-card">
-                        <div class="label">Total Downloaded</div>
-                        <div class="value" id="totalDownloaded">0 B</div>
-                    </div>
-                    <div class="stat-card">
-                        <div class="label">Total Uploaded</div>
-                        <div class="value" id="totalUploaded">0 B</div>
-                    </div>
-                    <div class="stat-card">
-                        <div class="label">Active Torrents</div>
-                        <div class="value" id="activeTorrents">0</div>
-                    </div>
-                    <div class="stat-card">
-                        <div class="label">Paused Torrents</div>
-                        <div class="value" id="pausedTorrents">0</div>
-                    </div>
-                </div>
-            </div>
-            <div class="card">
-                <h3>Speed History</h3>
-                <div class="speed-graph">Speed graph visualization coming soon</div>
-            </div>
-        </div>
-
-        <!-- RSS Feeds Tab -->
-        <div id="tab-rss" class="tab-content">
-            <div class="card">
-                <h3>RSS Feed Subscriptions</h3>
-                <div style="margin-bottom: 1rem;">
-                    <div class="form-row">
-                        <div class="form-group">
-                            <label>Feed Name</label>
-                            <input type="text" id="rssName" placeholder="My RSS Feed">
-                        </div>
-                        <div class="form-group">
-                            <label>Feed URL</label>
-                            <input type="text" id="rssUrl" placeholder="https://...">
-                        </div>
-                        <div class="form-group">
-                            <label>Category</label>
-                            <select id="rssCategory">
-                                <option value="">None</option>
-                            </select>
-                        </div>
-                        <div class="form-group" style="display: flex; align-items: flex-end;">
-                            <button class="btn btn-primary" onclick="addRssFeed()">Add Feed</button>
-                        </div>
-                    </div>
-                </div>
-                <table>
-                    <thead>
-                        <tr>
-                            <th>Name</th>
-                            <th>URL</th>
-                            <th>Category</th>
-                            <th>Auto-Download</th>
-                            <th>Actions</th>
-                        </tr>
-                    </thead>
-                    <tbody id="rssTable">
-                        <tr><td colspan="5">No RSS feeds configured</td></tr>
-                    </tbody>
-                </table>
-            </div>
-        </div>
-
-        <!-- Settings Tab -->
-        <div id="tab-settings" class="tab-content">
-            <div class="card">
-                <h3>Connection Settings</h3>
-                <form id="settingsForm" onsubmit="saveSettings(event)">
-                    <div class="form-row">
-                        <div class="form-group">
-                            <label>Web UI Port</label>
-                            <input type="number" id="cfgPort" value="9091" min="1024" max="65535">
-                        </div>
-                        <div class="form-group">
-                            <label>Peer Port</label>
-                            <input type="number" id="cfgPeerPort" value="51413" min="1024" max="65535">
-                        </div>
-                    </div>
-                    <div class="form-row">
-                        <div class="form-group">
-                            <label>Data Path</label>
-                            <input type="text" id="cfgDataPath" value="/srv/torrent">
-                        </div>
-                        <div class="form-group">
-                            <label>Download Directory</label>
-                            <input type="text" id="cfgDownloadDir" value="/srv/torrent/downloads">
-                        </div>
-                    </div>
-                    <div class="form-row">
-                        <div class="form-group">
-                            <label>Timezone</label>
-                            <select id="cfgTimezone">
-                                <option value="Europe/Paris">Europe/Paris</option>
-                                <option value="Europe/London">Europe/London</option>
-                                <option value="America/New_York">America/New_York</option>
-                                <option value="America/Los_Angeles">America/Los_Angeles</option>
-                                <option value="Asia/Tokyo">Asia/Tokyo</option>
-                                <option value="UTC">UTC</option>
-                            </select>
-                        </div>
-                        <div class="form-group">
-                            <label>Docker Image</label>
-                            <input type="text" id="cfgImage" value="linuxserver/transmission:latest">
-                        </div>
-                    </div>
-                    <button type="submit" class="btn btn-primary">Save Connection Settings</button>
-                </form>
-            </div>
-
-            <div class="card">
-                <h3>Speed Limits</h3>
-                <div class="form-row">
-                    <div class="form-group">
-                        <label>Download Limit (KB/s, 0 = unlimited)</label>
-                        <input type="number" id="cfgDownloadLimit" value="0" min="0">
-                    </div>
-                    <div class="form-group">
-                        <label>Upload Limit (KB/s, 0 = unlimited)</label>
-                        <input type="number" id="cfgUploadLimit" value="0" min="0">
-                    </div>
-                </div>
-                <div class="form-row">
-                    <div class="form-group">
-                        <label>Alt Download Limit (KB/s)</label>
-                        <input type="number" id="cfgAltDownloadLimit" value="1000" min="0">
-                    </div>
-                    <div class="form-group">
-                        <label>Alt Upload Limit (KB/s)</label>
-                        <input type="number" id="cfgAltUploadLimit" value="500" min="0">
-                    </div>
-                </div>
-                <div class="form-group">
-                    <label>
-                        <input type="checkbox" id="cfgAltSpeedEnabled"> Enable Alternative Speed Limits (Turtle Mode)
-                    </label>
-                </div>
-                <button class="btn" onclick="saveSpeedLimits()">Save Speed Limits</button>
-            </div>
-
-            <div class="card">
-                <h3>Seeding Settings</h3>
-                <div class="form-row">
-                    <div class="form-group">
-                        <label>Seed Ratio Limit</label>
-                        <input type="number" id="cfgSeedRatio" value="2.0" min="0" step="0.1">
-                    </div>
-                    <div class="form-group">
-                        <label>
-                            <input type="checkbox" id="cfgSeedRatioEnabled" checked> Enable Seed Ratio Limit
-                        </label>
-                    </div>
-                </div>
-                <button class="btn" onclick="saveSeedingSettings()">Save Seeding Settings</button>
-            </div>
-
-            <div class="card">
-                <h3>Categories</h3>
-                <div style="margin-bottom: 1rem;">
-                    <div class="form-row">
-                        <div class="form-group">
-                            <label>Category Name</label>
-                            <input type="text" id="catName" placeholder="e.g., Movies">
-                        </div>
-                        <div class="form-group">
-                            <label>Save Path (optional)</label>
-                            <input type="text" id="catPath" placeholder="/downloads/movies">
-                        </div>
-                        <div class="form-group" style="display: flex; align-items: flex-end;">
-                            <button class="btn" onclick="addCategory()">Add Category</button>
-                        </div>
-                    </div>
-                </div>
-                <table>
-                    <thead>
-                        <tr>
-                            <th>Name</th>
-                            <th>Save Path</th>
-                            <th>Actions</th>
-                        </tr>
-                    </thead>
-                    <tbody id="categoriesTable">
-                        <tr><td colspan="3">Loading...</td></tr>
-                    </tbody>
-                </table>
-            </div>
-
-            <div class="card">
-                <h3>Maintenance</h3>
-                <div style="display: flex; gap: 1rem; flex-wrap: wrap;">
-                    <button class="btn" onclick="restartContainer()">Restart Client</button>
-                    <button class="btn btn-danger" onclick="uninstallTorrent()">Uninstall</button>
-                </div>
-            </div>
-        </div>
-
-        <!-- Logs Tab -->
-        <div id="tab-logs" class="tab-content">
-            <div class="card">
-                <h3>Container Logs</h3>
-                <div style="margin-bottom: 1rem; display: flex; gap: 0.5rem; align-items: center;">
-                    <label>Lines:</label>
-                    <select id="logLines" onchange="loadLogs()">
-                        <option value="50">50</option>
-                        <option value="100" selected>100</option>
-                        <option value="200">200</option>
-                    </select>
-                    <button class="btn" onclick="loadLogs()">Refresh</button>
-                </div>
-                <div class="logs-container" id="logsContainer">Loading logs...</div>
-            </div>
-        </div>
-    </main>
-
-    <!-- Add Torrent Modal -->
-    <div class="modal" id="addModal">
-        <div class="modal-content">
-            <div class="modal-header">
-                <h3>Add Torrent</h3>
-                <button class="modal-close" onclick="closeAddModal()">&times;</button>
-            </div>
-            <div class="form-group">
-                <label>Magnet Link or URL</label>
-                <textarea id="addMagnet" rows="3" placeholder="magnet:?xt=urn:btih:... or https://..."></textarea>
-            </div>
-            <div class="form-group">
-                <label>Or Upload .torrent File</label>
-                <div class="file-drop" id="fileDrop" onclick="document.getElementById('torrentFile').click()">
-                    <input type="file" id="torrentFile" accept=".torrent" onchange="handleFileSelect(this)">
-                    <p>Click or drag .torrent file here</p>
-                    <span id="fileName"></span>
-                </div>
-            </div>
-            <div class="form-row">
-                <div class="form-group">
-                    <label>Category</label>
-                    <select id="addCategory">
-                        <option value="">None</option>
-                    </select>
-                </div>
-                <div class="form-group">
-                    <label>
-                        <input type="checkbox" id="addPaused"> Start Paused
-                    </label>
-                </div>
-            </div>
-            <div style="display: flex; gap: 0.5rem; justify-content: flex-end;">
-                <button class="btn" onclick="closeAddModal()">Cancel</button>
-                <button class="btn btn-primary" onclick="addTorrent()">Add Torrent</button>
-            </div>
-        </div>
+<body>
+<main class="main">
+  <header class="header">
+    <div>
+      <h1>📥 Torrent</h1>
+      <div class="sub" id="sub">BitTorrent + WebTorrent player · chargement…</div>
     </div>
+    <div class="btn-group">
+      <button class="btn" id="btnRefresh">↻ Refresh</button>
+    </div>
+  </header>
 
-    <script>
-        const API = '/api/v1/torrent';
-        let isRunning = false;
-        let containerStatus = 'not_installed';
-        let categories = [];
+  <div class="grid" id="statGrid">
+    <div class="stat-card cyan"><div class="value" id="statActive">–</div><div class="label">📦 Actifs</div></div>
+    <div class="stat-card green"><div class="value" id="statDisk">–</div><div class="label">💾 Disque libre</div></div>
+    <div class="stat-card orange" style="display:flex;align-items:center;justify-content:center">
+      <span class="badge bt-only" id="webrtcBadge" style="display:none">🧲 BitTorrent-only</span>
+      <span class="muted" id="webrtcOk" style="display:none">🕸️ WebRTC actif</span>
+    </div>
+  </div>
 
-        function getToken() {
-            return localStorage.getItem('jwt_token') || localStorage.getItem('token') || '';
+  <div class="card">
+    <h3>➕ Ajouter un magnet</h3>
+    <div class="add-row">
+      <input type="text" id="magnetInput" placeholder="magnet:?xt=urn:btih:…">
+      <button class="btn primary" id="btnAdd">➕ Add</button>
+    </div>
+  </div>
+
+  <div class="card" id="playerCard">
+    <h3>▶ Lecture</h3>
+    <div id="player"></div>
+  </div>
+
+  <div class="card">
+    <h3>📚 Torrents</h3>
+    <div id="list"><p class="muted">Chargement…</p></div>
+  </div>
+</main>
+
+<div class="toast" id="toast"></div>
+
+<script>
+(function () {
+  'use strict';
+  var API = '/api/v1/torrent';
+  var PLAYABLE = ['mp4', 'webm', 'm4v', 'mp3', 'm4a', 'ogg'];
+  var openFiles = Object.create(null); // infohash -> bool (files panel expanded)
+
+  function esc(s) {
+    return String(s == null ? '' : s).replace(/[<>&"]/g, function (c) {
+      return { '<': '&lt;', '>': '&gt;', '&': '&amp;', '"': '&quot;' }[c];
+    });
+  }
+
+  function extOf(name) {
+    var m = /\.([A-Za-z0-9]+)$/.exec(name || '');
+    return m ? m[1].toLowerCase() : '';
+  }
+
+  function fmtBytes(n) {
+    if (n == null || !isFinite(n)) return '∞';
+    if (n === 0) return '0 B';
+    var units = ['B', 'KB', 'MB', 'GB', 'TB'];
+    var i = Math.min(units.length - 1, Math.floor(Math.log(n) / Math.log(1024)));
+    return (n / Math.pow(1024, i)).toFixed(i === 0 ? 0 : 1) + ' ' + units[i];
+  }
+
+  var toastTimer = null;
+  function toast(msg) {
+    var t = document.getElementById('toast');
+    t.textContent = msg;
+    t.className = 'toast show';
+    clearTimeout(toastTimer);
+    toastTimer = setTimeout(function () { t.className = 'toast'; }, 3000);
+  }
+  function errorToast(msg) {
+    var t = document.getElementById('toast');
+    clearTimeout(toastTimer);
+    t.innerHTML = '';
+    t.appendChild(document.createTextNode('⚠ ' + msg));
+    var x = document.createElement('span');
+    x.className = 'x';
+    x.textContent = '✕';
+    x.addEventListener('click', function () { t.className = 'toast'; });
+    t.appendChild(x);
+    t.className = 'toast show error';
+  }
+
+  function authHeaders() {
+    var h = {};
+    var tok = localStorage.getItem('sbx_token');
+    if (tok) h['Authorization'] = 'Bearer ' + tok;
+    return h;
+  }
+
+  function api(path, opts) {
+    opts = opts || {};
+    var headers = Object.assign({ 'Content-Type': 'application/json' }, opts.headers, authHeaders());
+    return fetch(path, Object.assign({}, opts, { headers: headers })).then(function (res) {
+      if (res.status === 401) {
+        errorToast('🔒 Login required');
+        throw new Error('unauthorized');
+      }
+      return res.json().catch(function () { return {}; }).then(function (body) {
+        if (!res.ok) throw new Error(body && body.error ? body.error : ('HTTP ' + res.status));
+        return body;
+      });
+    });
+  }
+
+  function refreshStatus() {
+    return api(API + '/status').then(function (s) {
+      document.getElementById('statActive').textContent = s.active != null ? s.active : '–';
+      document.getElementById('statDisk').textContent = fmtBytes(s.disk_free);
+      var badgeEl = document.getElementById('webrtcBadge');
+      var okEl = document.getElementById('webrtcOk');
+      var btOnly = s.webrtc === false;
+      badgeEl.style.display = btOnly ? 'inline-block' : 'none';
+      okEl.style.display = btOnly ? 'none' : 'inline';
+      document.getElementById('sub').textContent = btOnly
+        ? 'BitTorrent + WebTorrent player · mode BitTorrent-only (WebRTC désactivé)'
+        : 'BitTorrent + WebTorrent player · WebRTC actif';
+    }).catch(function (e) { console.error(e); });
+  }
+
+  function statsLine(stats) {
+    if (!stats) return '<span class="muted">pas de session active</span>';
+    var pct = Math.round((stats.progress || 0) * 100);
+    var wires = (stats.wires || []).length;
+    return pct + '% · ⬇ ' + fmtBytes(stats.downloadSpeed) + '/s · ⬆ ' + fmtBytes(stats.uploadSpeed) +
+      '/s · 🤝 ' + (stats.numPeers || 0) + ' peers · 🔌 ' + wires + ' wires';
+  }
+
+  function renderList(rows) {
+    var el = document.getElementById('list');
+    if (!rows.length) {
+      el.innerHTML = '<p class="muted">Aucun torrent — colle un lien magnet ci-dessus.</p>';
+      return;
+    }
+    el.innerHTML = rows.map(function (r) {
+      var pct = r.stats ? Math.round((r.stats.progress || 0) * 100) : 0;
+      var kept = r.kept === 1;
+      var filesOpen = !!openFiles[r.infohash];
+      return (
+        '<div class="item ' + (kept ? 'kept' : 'ephemeral') + '" data-ih="' + esc(r.infohash) + '">' +
+          '<div class="item-top">' +
+            '<div class="title" data-action="toggle-files" title="' + esc(r.name) + '">' +
+              (kept ? '📌 ' : '⏳ ') + esc(r.name) +
+            '</div>' +
+            '<div class="row-actions">' +
+              (kept ? '' : '<button class="btn sm good" data-action="keep">📌 Garder</button>') +
+              '<button class="btn sm danger" data-action="remove">🗑</button>' +
+            '</div>' +
+          '</div>' +
+          '<div class="progress-bar"><div class="fill" style="width:' + pct + '%"></div></div>' +
+          '<div class="meta">' + statsLine(r.stats) + '</div>' +
+          '<div class="files' + (filesOpen ? ' open' : '') + '" data-role="files">' +
+            '<p class="muted">Chargement des fichiers…</p>' +
+          '</div>' +
+        '</div>'
+      );
+    }).join('');
+    Object.keys(openFiles).forEach(function (ih) {
+      if (openFiles[ih]) loadFiles(ih);
+    });
+  }
+
+  function refreshList() {
+    return api(API + '/list').then(renderList).catch(function (e) {
+      document.getElementById('list').innerHTML = '<p class="muted">Erreur de chargement.</p>';
+      console.error(e);
+    });
+  }
+
+  function loadFiles(infohash) {
+    var itemEl = document.querySelector('.item[data-ih="' + cssEscape(infohash) + '"]');
+    if (!itemEl) return;
+    var filesEl = itemEl.querySelector('[data-role="files"]');
+    api(API + '/files/' + encodeURIComponent(infohash)).then(function (files) {
+      if (!files.length) {
+        filesEl.innerHTML = '<p class="muted">Métadonnées pas encore disponibles.</p>';
+        return;
+      }
+      filesEl.innerHTML = files.map(function (f) {
+        var ext = extOf(f.name);
+        var playable = PLAYABLE.indexOf(ext) !== -1;
+        if (playable) {
+          return '<div class="file-row">' +
+            '<span class="fname playable" data-action="play" data-idx="' + f.idx + '">▶ ' + esc(f.name) + '</span>' +
+            '<span class="muted">' + fmtBytes(f.length) + '</span></div>';
         }
+        var href = '/stream/' + encodeURIComponent(infohash) + '/' + f.idx;
+        return '<div class="file-row">' +
+          '<span class="fname">' + esc(f.name) + '</span>' +
+          '<a class="btn sm" href="' + href + '" download>⬇ Download</a></div>';
+      }).join('');
+    }).catch(function (e) {
+      filesEl.innerHTML = '<p class="muted">Erreur de chargement des fichiers.</p>';
+      console.error(e);
+    });
+  }
 
-        async function api(endpoint, options = {}) {
-            const token = getToken();
-            const headers = { 'Content-Type': 'application/json', ...options.headers };
-            if (token) headers['Authorization'] = `Bearer ${token}`;
-            const res = await fetch(API + endpoint, { ...options, headers, credentials: 'include' });
-            if (res.status === 401) {
-                window.location.href = '/login.html?redirect=' + encodeURIComponent(window.location.pathname);
-                throw new Error('Unauthorized');
-            }
-            return res.json();
-        }
+  function cssEscape(s) {
+    return String(s).replace(/["\\]/g, '\\$&');
+  }
 
-        function showTab(name) {
-            document.querySelectorAll('.tab').forEach(t => t.classList.remove('active'));
-            document.querySelectorAll('.tab-content').forEach(c => c.classList.remove('active'));
-            const tabs = ['torrents', 'stats', 'rss', 'settings', 'logs'];
-            const idx = tabs.indexOf(name);
-            if (idx >= 0) {
-                document.querySelectorAll('.tab')[idx].classList.add('active');
-                document.getElementById('tab-' + name).classList.add('active');
-            }
-            if (name === 'logs') loadLogs();
-            if (name === 'stats') loadStats();
-        }
+  function playFile(infohash, idx, name) {
+    var card = document.getElementById('playerCard');
+    var player = document.getElementById('player');
+    card.style.display = 'block';
+    var src = '/stream/' + encodeURIComponent(infohash) + '/' + idx;
+    player.innerHTML = '<video controls autoplay src="' + esc(src) + '"></video>' +
+      '<p class="muted" style="margin-top:.5rem">' + esc(name) + '</p>';
+    card.scrollIntoView({ behavior: 'smooth', block: 'start' });
+  }
 
-        function toast(msg, type = 'success') {
-            const t = document.createElement('div');
-            t.className = 'toast toast-' + type;
-            t.textContent = msg;
-            document.body.appendChild(t);
-            setTimeout(() => t.remove(), 3000);
-        }
+  function onListClick(ev) {
+    var actionEl = ev.target.closest('[data-action]');
+    if (!actionEl) return;
+    var itemEl = ev.target.closest('.item');
+    if (!itemEl) return;
+    var ih = itemEl.getAttribute('data-ih');
+    var action = actionEl.getAttribute('data-action');
 
-        function formatBytes(bytes) {
-            if (bytes === 0) return '0 B';
-            const k = 1024;
-            const sizes = ['B', 'KB', 'MB', 'GB', 'TB'];
-            const i = Math.floor(Math.log(bytes) / Math.log(k));
-            return parseFloat((bytes / Math.pow(k, i)).toFixed(2)) + ' ' + sizes[i];
-        }
+    if (action === 'toggle-files') {
+      openFiles[ih] = !openFiles[ih];
+      var filesEl = itemEl.querySelector('[data-role="files"]');
+      filesEl.classList.toggle('open', openFiles[ih]);
+      if (openFiles[ih]) loadFiles(ih);
+      return;
+    }
+    if (action === 'keep') {
+      api(API + '/keep/' + encodeURIComponent(ih), { method: 'POST' }).then(function () {
+        toast('📌 Torrent conservé');
+        refreshList();
+      }).catch(function (e) { errorToast('Échec: ' + e.message); });
+      return;
+    }
+    if (action === 'remove') {
+      if (!confirm('Supprimer ce torrent et ses données ?')) return;
+      api(API + '/remove/' + encodeURIComponent(ih), { method: 'POST' }).then(function () {
+        toast('🗑 Torrent supprimé');
+        delete openFiles[ih];
+        refreshList();
+      }).catch(function (e) { errorToast('Échec: ' + e.message); });
+      return;
+    }
+    if (action === 'play') {
+      var idx = actionEl.getAttribute('data-idx');
+      var name = actionEl.textContent.replace(/^▶\s*/, '');
+      playFile(ih, idx, name);
+      return;
+    }
+  }
 
-        function formatSpeed(bytesPerSec) {
-            return formatBytes(bytesPerSec) + '/s';
-        }
+  function addTorrent() {
+    var input = document.getElementById('magnetInput');
+    var magnet = input.value.trim();
+    if (!magnet) { errorToast('Lien magnet requis'); return; }
+    var btn = document.getElementById('btnAdd');
+    btn.disabled = true;
+    api(API + '/add', { method: 'POST', body: JSON.stringify({ magnet: magnet }) }).then(function (meta) {
+      toast('➕ Torrent ajouté: ' + (meta.name || meta.infohash || 'ok'));
+      input.value = '';
+      refreshList();
+    }).catch(function (e) {
+      errorToast('Échec de l\'ajout: ' + e.message);
+    }).finally(function () { btn.disabled = false; });
+  }
 
-        function getStatusBadge(status) {
-            const classes = {
-                'downloading': 'badge-downloading',
-                'seeding': 'badge-seeding',
-                'stopped': 'badge-stopped',
-                'queued_download': 'badge-info',
-                'queued_seed': 'badge-info',
-                'verifying': 'badge-warning',
-                'queued_verify': 'badge-warning',
-            };
-            return `<span class="badge ${classes[status] || 'badge-info'}">${status}</span>`;
-        }
+  function refresh() {
+    refreshStatus();
+    refreshList();
+  }
 
-        async function refresh() {
-            try {
-                const status = await api('/status');
-                containerStatus = status.container_status;
-                isRunning = status.container_status === 'running';
+  document.getElementById('btnRefresh').addEventListener('click', refresh);
+  document.getElementById('btnAdd').addEventListener('click', addTorrent);
+  document.getElementById('magnetInput').addEventListener('keydown', function (e) {
+    if (e.key === 'Enter') addTorrent();
+  });
+  document.getElementById('list').addEventListener('click', onListClick);
 
-                // Show/hide install banner
-                document.getElementById('installBanner').style.display =
-                    status.container_status === 'not_installed' ? 'block' : 'none';
-
-                // Update stats
-                const statEl = document.getElementById('statStatus');
-                statEl.querySelector('.value').textContent = status.container_status;
-                statEl.className = 'stat-card ' + (isRunning ? 'running' : 'stopped');
-
-                document.getElementById('statDisk').textContent = status.disk_usage || '-';
-
-                // Update toggle button
-                const btn = document.getElementById('btnToggle');
-                if (status.container_status === 'not_installed') {
-                    btn.textContent = 'Install';
-                    btn.className = 'btn btn-primary';
-                    btn.onclick = installTorrent;
-                } else if (isRunning) {
-                    btn.textContent = 'Stop';
-                    btn.className = 'btn btn-danger';
-                    btn.onclick = () => toggleService();
-                } else {
-                    btn.textContent = 'Start';
-                    btn.className = 'btn btn-success';
-                    btn.onclick = () => toggleService();
-                }
-
-                // Load settings
-                document.getElementById('cfgPort').value = status.port || 9091;
-                document.getElementById('cfgPeerPort').value = status.peer_port || 51413;
-                document.getElementById('cfgDataPath').value = status.data_path || '/srv/torrent';
-                document.getElementById('cfgDownloadDir').value = status.download_dir || '/srv/torrent/downloads';
-                document.getElementById('cfgTimezone').value = status.timezone || 'Europe/Paris';
-                document.getElementById('cfgImage').value = status.image || 'linuxserver/transmission:latest';
-                document.getElementById('cfgDownloadLimit').value = status.download_limit || 0;
-                document.getElementById('cfgUploadLimit').value = status.upload_limit || 0;
-                document.getElementById('cfgAltSpeedEnabled').checked = status.alt_speed_enabled || false;
-
-                // Load torrents
-                await loadTorrents();
-                // Load categories
-                await loadCategories();
-                // Load RSS
-                await loadRssFeeds();
-                // Load stats
-                await loadStats();
-
-            } catch (e) {
-                console.error(e);
-                toast('Failed to load status', 'error');
-            }
-        }
-
-        async function loadTorrents() {
-            if (!isRunning) {
-                document.getElementById('torrentsTable').innerHTML = '<tr><td colspan="6">Service not running</td></tr>';
-                return;
-            }
-
-            try {
-                const data = await api('/torrents');
-                const tbody = document.getElementById('torrentsTable');
-
-                if (data.error) {
-                    tbody.innerHTML = `<tr><td colspan="6">${data.error}</td></tr>`;
-                    return;
-                }
-
-                const torrents = data.torrents || [];
-                if (torrents.length === 0) {
-                    tbody.innerHTML = '<tr><td colspan="6">No torrents. Click "Add Torrent" to start.</td></tr>';
-                    return;
-                }
-
-                // Update speed stats
-                let totalDown = 0, totalUp = 0, active = 0;
-                torrents.forEach(t => {
-                    totalDown += t.download_speed || 0;
-                    totalUp += t.upload_speed || 0;
-                    if (t.status === 'downloading' || t.status === 'seeding') active++;
-                });
-
-                document.getElementById('statDownload').textContent = formatSpeed(totalDown);
-                document.getElementById('statUpload').textContent = formatSpeed(totalUp);
-                document.getElementById('statActive').textContent = active;
-
-                tbody.innerHTML = torrents.map(t => `
-                    <tr>
-                        <td>
-                            <div class="torrent-name" title="${t.name}">${t.name}</div>
-                            <div class="progress-bar ${t.status === 'seeding' ? 'seeding' : ''}">
-                                <div class="fill" style="width: ${t.progress}%"></div>
-                            </div>
-                        </td>
-                        <td>${formatBytes(t.size)}</td>
-                        <td>${t.progress}%</td>
-                        <td>
-                            <div style="font-size: 0.8rem;">
-                                <span style="color: var(--torrent);">${formatSpeed(t.download_speed)}</span><br>
-                                <span style="color: var(--text-dim);">${formatSpeed(t.upload_speed)}</span>
-                            </div>
-                        </td>
-                        <td>${getStatusBadge(t.status)}</td>
-                        <td>
-                            ${t.status === 'stopped' ?
-                                `<button class="btn btn-sm btn-success" onclick="resumeTorrent(${t.id})">Resume</button>` :
-                                `<button class="btn btn-sm" onclick="pauseTorrent(${t.id})">Pause</button>`
-                            }
-                            <button class="btn btn-sm btn-danger" onclick="removeTorrent(${t.id}, false)">Remove</button>
-                        </td>
-                    </tr>
-                `).join('');
-
-            } catch (e) {
-                console.error(e);
-            }
-        }
-
-        async function loadStats() {
-            if (!isRunning) return;
-            try {
-                const data = await api('/stats');
-                document.getElementById('statDownload').textContent = formatSpeed(data.download_speed || 0);
-                document.getElementById('statUpload').textContent = formatSpeed(data.upload_speed || 0);
-                document.getElementById('totalDownloaded').textContent = formatBytes(data.total_downloaded || 0);
-                document.getElementById('totalUploaded').textContent = formatBytes(data.total_uploaded || 0);
-                document.getElementById('activeTorrents').textContent = data.active_torrents || 0;
-                document.getElementById('pausedTorrents').textContent = data.paused_torrents || 0;
-            } catch (e) {
-                console.error(e);
-            }
-        }
-
-        async function loadCategories() {
-            try {
-                const data = await api('/categories');
-                categories = data.categories || [];
-                
-                // Update categories table
-                const tbody = document.getElementById('categoriesTable');
-                if (categories.length === 0) {
-                    tbody.innerHTML = '<tr><td colspan="3">No categories</td></tr>';
-                } else {
-                    tbody.innerHTML = categories.map(c => `
-                        <tr>
-                            <td>${c.name}</td>
-                            <td><code>${c.save_path}</code></td>
-                            <td><button class="btn btn-sm btn-danger" onclick="removeCategory('${c.id}')">Remove</button></td>
-                        </tr>
-                    `).join('');
-                }
-
-                // Update category dropdowns
-                const options = '<option value="">None</option>' + 
-                    categories.map(c => `<option value="${c.id}">${c.name}</option>`).join('');
-                document.getElementById('addCategory').innerHTML = options;
-                document.getElementById('rssCategory').innerHTML = options;
-
-            } catch (e) {
-                console.error(e);
-            }
-        }
-
-        async function loadRssFeeds() {
-            try {
-                const data = await api('/rss/feeds');
-                const feeds = data.feeds || [];
-                const tbody = document.getElementById('rssTable');
-                
-                if (feeds.length === 0) {
-                    tbody.innerHTML = '<tr><td colspan="5">No RSS feeds configured</td></tr>';
-                } else {
-                    tbody.innerHTML = feeds.map(f => `
-                        <tr>
-                            <td>${f.name}</td>
-                            <td style="max-width: 200px; overflow: hidden; text-overflow: ellipsis;">${f.url}</td>
-                            <td>${f.category || '-'}</td>
-                            <td>${f.auto_download ? 'Yes' : 'No'}</td>
-                            <td><button class="btn btn-sm btn-danger" onclick="removeRssFeed('${f.id}')">Remove</button></td>
-                        </tr>
-                    `).join('');
-                }
-            } catch (e) {
-                console.error(e);
-            }
-        }
-
-        async function toggleService() {
-            const action = isRunning ? 'stop' : 'start';
-            try {
-                document.getElementById('btnToggle').disabled = true;
-                document.getElementById('btnToggle').innerHTML = '<span class="spinner"></span>';
-                const res = await api('/container/' + action, { method: 'POST' });
-                if (res.success) {
-                    toast(action === 'start' ? 'Torrent client started!' : 'Torrent client stopped!');
-                } else {
-                    toast(res.error || 'Action failed', 'error');
-                }
-                await refresh();
-            } catch (e) {
-                toast('Action failed: ' + e.message, 'error');
-            } finally {
-                document.getElementById('btnToggle').disabled = false;
-            }
-        }
-
-        async function installTorrent() {
-            if (!confirm('Install Transmission? This will download the Docker image.')) return;
-            toast('Installing Transmission... This may take a few minutes.');
-            try {
-                const res = await api('/container/install', { method: 'POST' });
-                if (res.success) {
-                    toast('Transmission installed! Starting...');
-                    await api('/container/start', { method: 'POST' });
-                    await refresh();
-                } else {
-                    toast(res.error || 'Install failed', 'error');
-                }
-            } catch (e) {
-                toast('Install failed: ' + e.message, 'error');
-            }
-        }
-
-        // Modal functions
-        function openAddModal() {
-            document.getElementById('addModal').classList.add('active');
-            document.getElementById('addMagnet').value = '';
-            document.getElementById('torrentFile').value = '';
-            document.getElementById('fileName').textContent = '';
-        }
-
-        function closeAddModal() {
-            document.getElementById('addModal').classList.remove('active');
-        }
-
-        function handleFileSelect(input) {
-            if (input.files.length > 0) {
-                document.getElementById('fileName').textContent = input.files[0].name;
-            }
-        }
-
-        // File drop handling
-        const fileDrop = document.getElementById('fileDrop');
-        fileDrop.addEventListener('dragover', (e) => {
-            e.preventDefault();
-            fileDrop.classList.add('dragover');
-        });
-        fileDrop.addEventListener('dragleave', () => {
-            fileDrop.classList.remove('dragover');
-        });
-        fileDrop.addEventListener('drop', (e) => {
-            e.preventDefault();
-            fileDrop.classList.remove('dragover');
-            const files = e.dataTransfer.files;
-            if (files.length > 0 && files[0].name.endsWith('.torrent')) {
-                document.getElementById('torrentFile').files = files;
-                document.getElementById('fileName').textContent = files[0].name;
-            }
-        });
-
-        async function addTorrent() {
-            const magnet = document.getElementById('addMagnet').value.trim();
-            const fileInput = document.getElementById('torrentFile');
-            const category = document.getElementById('addCategory').value;
-            const paused = document.getElementById('addPaused').checked;
-
-            if (!magnet && fileInput.files.length === 0) {
-                toast('Please enter a magnet link or upload a file', 'error');
-                return;
-            }
-
-            try {
-                let res;
-                if (fileInput.files.length > 0) {
-                    // Upload file
-                    const formData = new FormData();
-                    formData.append('torrent_file', fileInput.files[0]);
-                    const token = getToken();
-                    res = await fetch(API + '/torrent/add', {
-                        method: 'POST',
-                        headers: { 'Authorization': `Bearer ${token}` },
-                        body: formData,
-                    }).then(r => r.json());
-                } else {
-                    // Send magnet/URL
-                    res = await api('/torrent/add', {
-                        method: 'POST',
-                        body: JSON.stringify({ magnet, paused, category })
-                    });
-                }
-
-                if (res.success) {
-                    toast('Torrent added: ' + (res.torrent?.name || 'Unknown'));
-                    closeAddModal();
-                    await loadTorrents();
-                } else {
-                    toast(res.error || 'Failed to add torrent', 'error');
-                }
-            } catch (e) {
-                toast('Failed: ' + e.message, 'error');
-            }
-        }
-
-        async function pauseTorrent(id) {
-            try {
-                const res = await api(`/torrent/${id}/pause`, { method: 'POST' });
-                if (res.success) {
-                    toast('Torrent paused');
-                    await loadTorrents();
-                } else {
-                    toast(res.error || 'Failed', 'error');
-                }
-            } catch (e) {
-                toast('Failed: ' + e.message, 'error');
-            }
-        }
-
-        async function resumeTorrent(id) {
-            try {
-                const res = await api(`/torrent/${id}/resume`, { method: 'POST' });
-                if (res.success) {
-                    toast('Torrent resumed');
-                    await loadTorrents();
-                } else {
-                    toast(res.error || 'Failed', 'error');
-                }
-            } catch (e) {
-                toast('Failed: ' + e.message, 'error');
-            }
-        }
-
-        async function removeTorrent(id, deleteData) {
-            const msg = deleteData ? 
-                'Remove torrent AND delete files?' : 
-                'Remove torrent? (files will be kept)';
-            if (!confirm(msg)) return;
-
-            try {
-                const res = await api(`/torrent/${id}?delete_data=${deleteData}`, { method: 'DELETE' });
-                if (res.success) {
-                    toast('Torrent removed');
-                    await loadTorrents();
-                } else {
-                    toast(res.error || 'Failed', 'error');
-                }
-            } catch (e) {
-                toast('Failed: ' + e.message, 'error');
-            }
-        }
-
-        async function addCategory() {
-            const name = document.getElementById('catName').value.trim();
-            const path = document.getElementById('catPath').value.trim();
-            if (!name) return toast('Category name required', 'error');
-
-            try {
-                const res = await api('/categories', {
-                    method: 'POST',
-                    body: JSON.stringify({ name, save_path: path || null })
-                });
-                if (res.success) {
-                    toast('Category added');
-                    document.getElementById('catName').value = '';
-                    document.getElementById('catPath').value = '';
-                    await loadCategories();
-                } else {
-                    toast(res.error || 'Failed', 'error');
-                }
-            } catch (e) {
-                toast('Failed: ' + e.message, 'error');
-            }
-        }
-
-        async function removeCategory(id) {
-            if (!confirm('Remove this category?')) return;
-            try {
-                const res = await api(`/categories/${id}`, { method: 'DELETE' });
-                if (res.success) {
-                    toast('Category removed');
-                    await loadCategories();
-                } else {
-                    toast(res.error || 'Failed', 'error');
-                }
-            } catch (e) {
-                toast('Failed: ' + e.message, 'error');
-            }
-        }
-
-        async function addRssFeed() {
-            const name = document.getElementById('rssName').value.trim();
-            const url = document.getElementById('rssUrl').value.trim();
-            const category = document.getElementById('rssCategory').value;
-            
-            if (!name || !url) return toast('Name and URL required', 'error');
-
-            try {
-                const res = await api('/rss/add', {
-                    method: 'POST',
-                    body: JSON.stringify({ name, url, category, auto_download: false })
-                });
-                if (res.success) {
-                    toast('RSS feed added');
-                    document.getElementById('rssName').value = '';
-                    document.getElementById('rssUrl').value = '';
-                    await loadRssFeeds();
-                } else {
-                    toast(res.error || 'Failed', 'error');
-                }
-            } catch (e) {
-                toast('Failed: ' + e.message, 'error');
-            }
-        }
-
-        async function removeRssFeed(id) {
-            if (!confirm('Remove this RSS feed?')) return;
-            try {
-                const res = await api(`/rss/${id}`, { method: 'DELETE' });
-                if (res.success) {
-                    toast('RSS feed removed');
-                    await loadRssFeeds();
-                } else {
-                    toast(res.error || 'Failed', 'error');
-                }
-            } catch (e) {
-                toast('Failed: ' + e.message, 'error');
-            }
-        }
-
-        async function saveSettings(e) {
-            e.preventDefault();
-            try {
-                const res = await api('/config', {
-                    method: 'POST',
-                    body: JSON.stringify({
-                        port: parseInt(document.getElementById('cfgPort').value),
-                        peer_port: parseInt(document.getElementById('cfgPeerPort').value),
-                        data_path: document.getElementById('cfgDataPath').value,
-                        download_dir: document.getElementById('cfgDownloadDir').value,
-                        timezone: document.getElementById('cfgTimezone').value,
-                        image: document.getElementById('cfgImage').value,
-                    })
-                });
-                if (res.success) {
-                    toast('Settings saved! Restart client to apply.');
-                } else {
-                    toast('Save failed', 'error');
-                }
-            } catch (e) {
-                toast('Failed: ' + e.message, 'error');
-            }
-        }
-
-        async function saveSpeedLimits() {
-            try {
-                const res = await api('/config', {
-                    method: 'POST',
-                    body: JSON.stringify({
-                        download_limit: parseInt(document.getElementById('cfgDownloadLimit').value),
-                        upload_limit: parseInt(document.getElementById('cfgUploadLimit').value),
-                        alt_download_limit: parseInt(document.getElementById('cfgAltDownloadLimit').value),
-                        alt_upload_limit: parseInt(document.getElementById('cfgAltUploadLimit').value),
-                        alt_speed_enabled: document.getElementById('cfgAltSpeedEnabled').checked,
-                    })
-                });
-                if (res.success) {
-                    toast('Speed limits saved');
-                } else {
-                    toast('Save failed', 'error');
-                }
-            } catch (e) {
-                toast('Failed: ' + e.message, 'error');
-            }
-        }
-
-        async function saveSeedingSettings() {
-            try {
-                const res = await api('/config', {
-                    method: 'POST',
-                    body: JSON.stringify({
-                        seed_ratio_limit: parseFloat(document.getElementById('cfgSeedRatio').value),
-                        seed_ratio_enabled: document.getElementById('cfgSeedRatioEnabled').checked,
-                    })
-                });
-                if (res.success) {
-                    toast('Seeding settings saved');
-                } else {
-                    toast('Save failed', 'error');
-                }
-            } catch (e) {
-                toast('Failed: ' + e.message, 'error');
-            }
-        }
-
-        async function loadLogs() {
-            const lines = document.getElementById('logLines').value;
-            try {
-                const data = await api('/logs?lines=' + lines);
-                document.getElementById('logsContainer').textContent = data.logs || 'No logs available';
-            } catch (e) {
-                document.getElementById('logsContainer').textContent = 'Error loading logs';
-            }
-        }
-
-        async function restartContainer() {
-            if (!confirm('Restart torrent client?')) return;
-            try {
-                toast('Restarting...');
-                const res = await api('/container/restart', { method: 'POST' });
-                if (res.success) {
-                    toast('Client restarted');
-                    await refresh();
-                } else {
-                    toast(res.error || 'Restart failed', 'error');
-                }
-            } catch (e) {
-                toast('Failed: ' + e.message, 'error');
-            }
-        }
-
-        async function uninstallTorrent() {
-            if (!confirm('Uninstall Transmission? This will remove the container (data is preserved).')) return;
-            try {
-                const res = await api('/container/uninstall', { method: 'POST' });
-                if (res.success) {
-                    toast('Torrent client uninstalled');
-                    await refresh();
-                } else {
-                    toast(res.error || 'Uninstall failed', 'error');
-                }
-            } catch (e) {
-                toast('Failed: ' + e.message, 'error');
-            }
-        }
-
-        // Initialize
-        refresh();
-        setInterval(refresh, 15000);
-        // More frequent torrent list refresh when running
-        setInterval(() => { if (isRunning) loadTorrents(); }, 5000);
-    </script>
+  refresh();
+  setInterval(refresh, 15000);
+})();
+</script>
 </body>
 </html>

From 7890587a9236457aa4e78e1d28a46c3cf71e8d49 Mon Sep 17 00:00:00 2001
From: CyberMind-FR <gandalf@Gk2.net>
Date: Tue, 28 Jul 2026 15:37:56 +0200
Subject: [PATCH 11/17] feat(torrent): host LXC provisioner + vhost + nft
 egress + config (ref #917)

Extends the Task 1 install-lxc.sh skeleton with the full app deploy
(tar-copy app/+www/ into the LXC, npm ci, torrent.env, in-LXC systemd
unit enable+start), plus the standalone torrent.gk2.secubox.in nginx
vhost, an nft egress visibility tap on the LXC veth, conf/torrent.toml,
and the menu.d entry (icon/category/description).

Picks 10.100.0.160 for the LXC (10.100.0.130 was already taken), pins
a predictable veth (veth-torrent0) so the nft rule can target it, and
bind-mounts /data/torrent from the host so downloaded data and the
disk-floor statfs() check in server.js see real storage instead of
LXC-overlay space.

The nginx vhost is a full standalone server{} block (own server_name),
so it targets sites-available/ (not secubox.d/, which is merged into
the shared hub server block and can't hold a nested server{}) -- Task 8
must update debian/rules accordingly. Its auth gate mirrors the current
LAN-only $lan_client stub (Authelia was decommissioned; there is no
aggregator JWT-verify endpoint to proxy to yet), not the brief's
aggregator/api/v1/auth/verify snippet.

Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
---
 packages/secubox-torrent/conf/torrent.toml    |  28 +++++
 packages/secubox-torrent/lxc/install-lxc.sh   |  46 ++++++--
 .../lxc/secubox-torrent.service               |  14 +++
 .../secubox-torrent/menu.d/612-torrent.json   |   6 +-
 .../secubox-torrent/nft/torrent-egress.nft    |  27 +++++
 packages/secubox-torrent/nginx/torrent.conf   | 102 +++++++++++++++++-
 6 files changed, 208 insertions(+), 15 deletions(-)
 create mode 100644 packages/secubox-torrent/conf/torrent.toml
 create mode 100644 packages/secubox-torrent/lxc/secubox-torrent.service
 create mode 100644 packages/secubox-torrent/nft/torrent-egress.nft

diff --git a/packages/secubox-torrent/conf/torrent.toml b/packages/secubox-torrent/conf/torrent.toml
new file mode 100644
index 00000000..768924b7
--- /dev/null
+++ b/packages/secubox-torrent/conf/torrent.toml
@@ -0,0 +1,28 @@
+# /etc/secubox/torrent.toml — SecuBox Torrent module configuration
+#
+# Operator-facing override of the package defaults. Edit values then re-run
+# install-lxc.sh (Task 8's postinst exports these into TORRENT_* env vars
+# consumed by lxc/install-lxc.sh, which writes them into the in-LXC
+# /opt/secubox-torrent/torrent.env read by server.js).
+
+# ── LXC ─────────────────────────────────────────────────────────────────
+[lxc]
+name  = "torrent"
+ip    = "10.100.0.160"
+gateway = "10.100.0.1"
+bridge  = "br-lxc"
+path    = "/data/lxc"
+
+# ── WebTorrent engine (inside the LXC) ─────────────────────────────────
+[engine]
+max_active = 5
+webrtc      = true     # set false to force BitTorrent-only (no @roamhq/wrtc)
+
+# ── Ephemeral retention (purge sweep, server.js runPurge) ──────────────
+[retention]
+ephemeral_ttl_hours = 6
+disk_floor_gb        = 5
+
+# ── Public exposure (nginx vhost :9080 → LXC :8090; HAProxy SNI ACL) ───
+[exposure]
+public_hostname = "torrent.gk2.secubox.in"
diff --git a/packages/secubox-torrent/lxc/install-lxc.sh b/packages/secubox-torrent/lxc/install-lxc.sh
index cc06b804..a51aeefc 100755
--- a/packages/secubox-torrent/lxc/install-lxc.sh
+++ b/packages/secubox-torrent/lxc/install-lxc.sh
@@ -3,18 +3,22 @@
 # SecuBox-Deb :: secubox-torrent :: install-lxc.sh
 # CyberMind — https://cybermind.fr
 #
-# Skeleton, idempotent LXC bootstrap for the secubox-torrent module (v2.0,
-# WebTorrent streaming pivot). Creates the dedicated Debian LXC + installs
-# Node so later tasks can layer the WebTorrent engine (webtorrent + fastify
-# + better-sqlite3, optionally @roamhq/wrtc — see SPIKE-RESULT.md) on top.
-# NOT executed against prod in this task; full provisioning (bridge/nat
-# setup, app deploy, systemd unit, nginx wiring) lands in a later task.
+# Idempotent LXC bootstrap + app deploy for the secubox-torrent module
+# (v2.0, WebTorrent streaming pivot). Creates the dedicated Debian LXC,
+# installs Node, then deploys the WebTorrent engine (webtorrent + fastify
+# + better-sqlite3, optionally @roamhq/wrtc — see SPIKE-RESULT.md) and its
+# in-LXC systemd unit. The host nginx vhost (../nginx/torrent.conf) proxies
+# torrent.gk2.secubox.in to this LXC at $LXC_IP:8090.
 set -euo pipefail
 readonly LXC_NAME="${SECUBOX_LXC_NAME:-torrent}"
-readonly LXC_IP="${SECUBOX_LXC_IP:-10.100.0.130}"
+readonly LXC_IP="${SECUBOX_LXC_IP:-10.100.0.160}"
 readonly LXC_PATH="${SECUBOX_LXC_PATH:-/data/lxc}"
 readonly LXC_BRIDGE="${SECUBOX_LXC_BRIDGE:-br-lxc}"
 readonly LXC_GW="${SECUBOX_LXC_GW:-10.100.0.1}"
+# Predictable veth pair name (default LXC naming is a random vethXXXXXX on
+# every start) — the host nft egress drop-in (../nft/torrent-egress.nft)
+# matches on this exact name.
+readonly LXC_VETH="${SECUBOX_LXC_VETH:-veth-torrent0}"
 readonly DATA_DIR="${SECUBOX_DATA_DIR:-/data/torrent}"
 readonly STATE_DIR="${SECUBOX_STATE_DIR:-/var/lib/secubox/torrent}"
 readonly SENTINEL="$STATE_DIR/.lxc-provisioned"
@@ -29,8 +33,14 @@ if [ -f "$SENTINEL" ]; then log "already provisioned; skipping create"; else
 lxc.net.0.type = veth
 lxc.net.0.link = $LXC_BRIDGE
 lxc.net.0.flags = up
+lxc.net.0.veth.pair = $LXC_VETH
 lxc.net.0.ipv4.address = $LXC_IP/24
 lxc.net.0.ipv4.gateway = $LXC_GW
+
+# Persist downloaded torrent data + the library DB on host storage (survives
+# LXC re-provisioning). server.js also statfs()'s /data for the disk-floor
+# purge signal, so this must be a real mount, not container-overlay space.
+lxc.mount.entry = $DATA_DIR data/torrent none bind,create=dir 0 0
 EOF
   lxc-start -n "$LXC_NAME" -P "$LXC_PATH"
   sleep 5
@@ -39,3 +49,25 @@ EOF
   touch "$SENTINEL"
 fi
 log "node version: $(la node --version 2>/dev/null || echo MISSING)"
+
+# --- app deploy (runs every postinst; idempotent) ---
+APP_SRC="${SECUBOX_APP_SRC:-/usr/lib/secubox/torrent/app}"
+la mkdir -p /opt/secubox-torrent/app /opt/secubox-torrent/www
+tar -C "$APP_SRC" -cf - . | la tar -C /opt/secubox-torrent/app -xf -
+tar -C /usr/share/secubox/www/torrent -cf - . | la tar -C /opt/secubox-torrent/www -xf -
+la bash -lc 'cd /opt/secubox-torrent/app && npm ci --omit=dev || npm install --omit=dev'
+# env file from host TOML values (exported by postinst into these vars)
+la bash -c "cat > /opt/secubox-torrent/torrent.env <<EOF
+TORRENT_DOWNLOAD_DIR=/data/torrent
+TORRENT_MAX_ACTIVE=${TORRENT_MAX_ACTIVE:-5}
+TORRENT_WEBRTC=${TORRENT_WEBRTC:-true}
+TORRENT_PORT=8090
+TORRENT_EPHEMERAL_TTL_HOURS=${TORRENT_TTL:-6}
+TORRENT_DISK_FLOOR_GB=${TORRENT_FLOOR:-5}
+EOF"
+# the unit ships alongside this script (Task 8 installs both under the same
+# /usr/lib/secubox/torrent/ dir so $(dirname "$0") resolves on the board)
+tar -C "$(dirname "$0")" -cf - secubox-torrent.service | la tar -C /etc/systemd/system -xf -
+la systemctl daemon-reload
+la systemctl enable --now secubox-torrent.service
+log "torrent LXC app deployed + started on $LXC_IP:8090"
diff --git a/packages/secubox-torrent/lxc/secubox-torrent.service b/packages/secubox-torrent/lxc/secubox-torrent.service
new file mode 100644
index 00000000..55e8edd6
--- /dev/null
+++ b/packages/secubox-torrent/lxc/secubox-torrent.service
@@ -0,0 +1,14 @@
+[Unit]
+Description=SecuBox Torrent (WebTorrent streaming)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+WorkingDirectory=/opt/secubox-torrent/app
+EnvironmentFile=/opt/secubox-torrent/torrent.env
+ExecStart=/usr/bin/node server.js
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
diff --git a/packages/secubox-torrent/menu.d/612-torrent.json b/packages/secubox-torrent/menu.d/612-torrent.json
index 67085848..7e03831f 100644
--- a/packages/secubox-torrent/menu.d/612-torrent.json
+++ b/packages/secubox-torrent/menu.d/612-torrent.json
@@ -1,9 +1,9 @@
 {
   "name": "Torrent",
   "path": "/torrent/",
-  "icon": "📥",
-  "category": "mesh",
+  "icon": "🌊",
+  "category": "media",
   "order": 612,
-  "description": "BitTorrent client management",
+  "description": "WebTorrent streaming (torrent.gk2.secubox.in)",
   "id": "torrent"
 }
diff --git a/packages/secubox-torrent/nft/torrent-egress.nft b/packages/secubox-torrent/nft/torrent-egress.nft
new file mode 100644
index 00000000..899980e8
--- /dev/null
+++ b/packages/secubox-torrent/nft/torrent-egress.nft
@@ -0,0 +1,27 @@
+# SecuBox-Deb :: secubox-torrent :: host nft egress scope
+# CyberMind — https://cybermind.fr
+#
+# Scopes the torrent LXC's egress. FORWARD/OUTPUT are policy-accept
+# repo-wide (see CLAUDE.md nftables rules) — no blanket DROP is introduced
+# here. This is an explicit visibility tap (LOG on new connections) on the
+# LXC's veth, not an allow/deny gate.
+#
+# Own, fully self-contained table + base chain (mirrors
+# packages/secubox-p2p/nft/secubox-p2p-ephemeral.nft): loads independently
+# of any other table already present on the board, and never issues a
+# global ruleset reset.
+#
+# Matches the exact veth pair name pinned by install-lxc.sh
+# (`lxc.net.0.veth.pair = veth-torrent0`) — LXC otherwise assigns a random
+# vethXXXXXX name on every start, which a static nft rule can't target.
+#
+# Loaded by /etc/nftables.conf via `include "/etc/nftables.d/*.nft"`. Ship
+# this file as zz-torrent-egress.nft at install time (Task 8) so it sorts
+# after any table-creator base file, per repo convention (see
+# feedback_nft_layered_dropins_persistence).
+table inet secubox_torrent {
+    chain forward_torrent {
+        type filter hook forward priority 0; policy accept;
+        iifname "veth-torrent0" ct state new log prefix "[SECUBOX-TORRENT] " level info
+    }
+}
diff --git a/packages/secubox-torrent/nginx/torrent.conf b/packages/secubox-torrent/nginx/torrent.conf
index 5c7b45fc..18cf64b3 100644
--- a/packages/secubox-torrent/nginx/torrent.conf
+++ b/packages/secubox-torrent/nginx/torrent.conf
@@ -1,6 +1,98 @@
-# /etc/nginx/secubox.d/torrent.conf
-# Installed by secubox-torrent — auto-registered on install, removed on purge
-location /api/v1/torrent/ {
-    proxy_pass http://unix:/run/secubox/torrent.sock:/;
-    include /etc/nginx/snippets/secubox-proxy.conf;
+# /etc/nginx/sites-available/torrent.conf — SecuBox Torrent public vhost
+# Installed by secubox-torrent; operator enables with:
+#   ln -s ../sites-available/torrent.conf /etc/nginx/sites-enabled/
+#   systemctl reload nginx
+#
+# IMPORTANT for packaging (Task 8): this is a full, standalone server{}
+# block with its own server_name (torrent.gk2.secubox.in) — it must go to
+# /etc/nginx/sites-available/ (+ sites-enabled symlink), NOT
+# /etc/nginx/secubox.d/. secubox.d/*.conf files are location-only snippets
+# that get merged into the shared admin/hub server block via
+# `include /etc/nginx/secubox.d/*.conf;` (see common/nginx/secubox.conf) —
+# nginx does not allow a nested `server {}` inside another `server {}`, so
+# dropping this file into secubox.d/ would fail nginx -t. Verified against
+# the real peertube pattern: its full vhost is
+# packages/secubox-peertube/conf/peertube.nginx.conf, installed to
+# etc/nginx/sites-available/peertube.conf by debian/rules — the file
+# peertube ships under secubox.d/ is only the legacy /api/v1/peertube/
+# location snippet, not a full vhost.
+#
+# Public chain: Browser → HAProxy:443 (TLS) → sbxwaf (WAF) → nginx:9080
+#               (this vhost) → torrent LXC at 10.100.0.160:8090.
+# Requires: sbxwaf route (haproxy-routes.json "torrent.gk2.secubox.in" →
+# [<host-ip>, 9080]) + HAProxy ACL (use_backend mitmproxy_inspector).
+#
+# Auth: the shared SecuBox LAN-only gate stub (`/__sbx_auth_verify` +
+# `@sbx_auth_login`; see packages/secubox-hub/nginx/zz-sbx-authgate.conf).
+# secubox-authelia (SSO) was decommissioned (v2.14.0) — the stub is now a
+# simple default-deny check against $lan_client (defined globally by
+# packages/secubox-hub/nginx/secubox-lan-geo.conf, available in every
+# server block since conf.d/*.conf loads at the http{} level). Because this
+# is a standalone server{} (own file, not merged into the hub's block), the
+# two named locations are re-declared here — same pattern as
+# packages/secubox-grafana/nginx/grafana-vhost.conf and
+# packages/secubox-spiderfoot/nginx/spiderfoot.gk2.conf.
+server {
+    listen 0.0.0.0:9080;
+    server_name torrent.gk2.secubox.in;
+
+    # ACME HTTP-01 challenge — outside the auth gate so renewals work.
+    location ^~ /.well-known/acme-challenge/ {
+        root /usr/share/secubox/www;
+        try_files $uri =404;
+    }
+
+    sub_filter_types text/html;
+    sub_filter_once on;
+    sub_filter "</body>" '<script src="/shared/health-banner.js"></script></body>';
+
+    location /shared/ {
+        allow 127.0.0.1;
+        allow 10.0.0.0/8;
+        allow 172.16.0.0/12;
+        allow 192.168.0.0/16;
+        deny all;
+        add_header Access-Control-Allow-Origin "*" always;
+        alias /usr/share/secubox/www/shared/;
+    }
+
+    location / {
+        auth_request /__sbx_auth_verify;
+        error_page 401 = @sbx_auth_login;
+
+        proxy_pass http://10.100.0.160:8090;
+        proxy_http_version 1.1;
+        proxy_set_header Host              $host;
+        proxy_set_header X-Real-IP         $remote_addr;
+        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_set_header X-Forwarded-Host  $host;
+
+        # Streaming: don't buffer video/torrent data either direction, and
+        # keep long-lived connections (large seeds, live range requests).
+        proxy_buffering off;
+        proxy_request_buffering off;
+        proxy_read_timeout 3600s;
+
+        # WebRTC signalling (webtorrent trackers) rides over the same
+        # WebSocket upgrade path.
+        proxy_set_header Upgrade    $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+
+    # Re-declared per-server because auth_request lives at server scope.
+    # LAN-only default-deny — matches zz-sbx-authgate.conf's current
+    # (post-Authelia) semantics, NOT a JWT/aggregator check (no such
+    # endpoint exists yet — see task-7-report.md for the rationale).
+    location = /__sbx_auth_verify {
+        internal;
+        if ($lan_client) { return 204; }
+        return 403;
+    }
+    location @sbx_auth_login {
+        return 403;
+    }
+
+    access_log /var/log/nginx/torrent_access.log;
+    error_log  /var/log/nginx/torrent_error.log;
 }

From 6edd0dfe9d3647da3f731efd0fa218b73b347c9b Mon Sep 17 00:00:00 2001
From: CyberMind-FR <gandalf@Gk2.net>
Date: Tue, 28 Jul 2026 15:51:10 +0200
Subject: [PATCH 12/17] feat(torrent): debian packaging v2.0.0, remove
 Transmission (ref #917)

Pivots the secubox-torrent Debian package to the WebTorrent/LXC-native
design (Tasks 1-7): control/rules/postinst/postrm now ship the Node app
to /usr/lib/secubox/torrent/app, run install-lxc.sh at configure, load
the nft egress scope from /etc/nftables.d/ (not the brief's unused
/etc/secubox/nft.d/), and symlink the standalone vhost into
sites-available/sites-enabled instead of the location-snippet secubox.d/.

Deletes the old host-side Transmission FastAPI (api/main.py) and its
systemd unit; Depends drops python3-uvicorn/transmission in favour of
lxc, debootstrap, nftables. Structural packaging test added
(tests/test_packaging.py). Builds cleanly to
secubox-torrent_2.0.0-1~bookworm1_all.deb.

Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
---
 packages/secubox-torrent/README.md            |  31 +-
 packages/secubox-torrent/api/main.py          | 903 ------------------
 packages/secubox-torrent/debian/changelog     |   8 +
 packages/secubox-torrent/debian/control       |  23 +-
 packages/secubox-torrent/debian/postinst      |  58 +-
 packages/secubox-torrent/debian/postrm        |  17 +
 packages/secubox-torrent/debian/prerm         |  20 +-
 packages/secubox-torrent/debian/rules         |  47 +-
 packages/secubox-torrent/debian/secubox.yaml  |   6 +-
 .../systemd/secubox-torrent.service           |  28 -
 .../secubox-torrent/tests/test_packaging.py   |  52 +
 11 files changed, 189 insertions(+), 1004 deletions(-)
 delete mode 100644 packages/secubox-torrent/api/main.py
 create mode 100755 packages/secubox-torrent/debian/postrm
 delete mode 100644 packages/secubox-torrent/systemd/secubox-torrent.service
 create mode 100644 packages/secubox-torrent/tests/test_packaging.py

diff --git a/packages/secubox-torrent/README.md b/packages/secubox-torrent/README.md
index f2036461..5a91288f 100644
--- a/packages/secubox-torrent/README.md
+++ b/packages/secubox-torrent/README.md
@@ -1,6 +1,8 @@
 # 🌊 Torrent
 
-BitTorrent client
+WebTorrent streaming, LXC-native (v2.0.0). Paste a magnet and stream it in
+the browser over HTTP Range while it downloads. Ephemeral by default, with
+an optional Keep into a persistent library on `/data`.
 
 **Category:** Media
 
@@ -8,12 +10,19 @@ BitTorrent client
 
 ![Torrent](../../docs/screenshots/vm/torrent.png)
 
-## Features
+## Architecture
 
-- Downloads
-- RSS
-- Remote control
-- Bandwidth limits
+The hybrid WebRTC+BitTorrent engine (`webtorrent` + `fastify` +
+`better-sqlite3`) runs isolated inside a dedicated LXC (`torrent`,
+`10.100.0.160`). The host only ships:
+
+- the public vhost `torrent.gk2.secubox.in` (nginx, proxies to the LXC's
+  `:8090`, streamed via HTTP Range with no buffering),
+- an nft egress visibility scope for the LXC's veth,
+- `install-lxc.sh`, which provisions the container and deploys the app.
+
+v1 (Transmission via Docker/Podman, host FastAPI on
+`/api/v1/torrent/*`) was removed in 2.0.0 — see `debian/changelog`.
 
 ## Installation
 
@@ -27,12 +36,10 @@ sudo apt install secubox-torrent
 
 ## Configuration
 
-Configuration file: `/etc/secubox/torrent.toml`
-
-## API Endpoints
-
-- `GET /api/v1/torrent/status` - Module status
-- `GET /api/v1/torrent/health` - Health check
+Configuration file: `/etc/secubox/torrent.toml` (LXC network, engine
+`max_active`/`webrtc`, ephemeral retention `ephemeral_ttl_hours`/
+`disk_floor_gb`). Edit then re-run
+`/usr/lib/secubox/torrent/install-lxc.sh` to apply.
 
 ## License
 
diff --git a/packages/secubox-torrent/api/main.py b/packages/secubox-torrent/api/main.py
deleted file mode 100644
index dde911b7..00000000
--- a/packages/secubox-torrent/api/main.py
+++ /dev/null
@@ -1,903 +0,0 @@
-"""secubox-torrent — FastAPI application for BitTorrent client management.
-
-Provides Transmission/qBittorrent Docker container management with
-torrent lifecycle, RSS feeds, and speed limiting.
-
-SecuBox-Deb :: secubox-torrent
-CyberMind — https://cybermind.fr
-Author: Gerald Kerma <devel@cybermind.fr>
-License: Proprietary / ANSSI CSPN candidate
-"""
-import asyncio
-import json
-import shutil
-import subprocess
-from datetime import datetime
-from pathlib import Path
-from typing import List, Optional, Dict, Any
-
-from fastapi import FastAPI, APIRouter, Depends, HTTPException, UploadFile, File, Form
-from pydantic import BaseModel
-
-from secubox_core.auth import router as auth_router, require_jwt
-from secubox_core.logger import get_logger
-
-app = FastAPI(title="secubox-torrent", version="1.0.0", root_path="/api/v1/torrent")
-
-# ══════════════════════════════════════════════════════════════════
-# Health Check Endpoint (public, no auth)
-# ══════════════════════════════════════════════════════════════════
-
-@app.get("/health")
-async def health_check():
-    """Public health check endpoint for sidebar status."""
-    return {"status": "ok", "module": "deb"}
-
-app.include_router(auth_router, prefix="/auth")
-router = APIRouter()
-log = get_logger("torrent")
-
-# Configuration
-CONFIG_FILE = Path("/etc/secubox/torrent.toml")
-CONTAINER_NAME = "secbx-torrent"
-CACHE_DIR = Path("/var/cache/secubox/torrent")
-RSS_FILE = Path("/etc/secubox/torrent-rss.json")
-CATEGORIES_FILE = Path("/etc/secubox/torrent-categories.json")
-
-DEFAULT_CONFIG = {
-    "enabled": False,
-    "client": "transmission",  # transmission or qbittorrent
-    "image": "linuxserver/transmission:latest",
-    "port": 9091,
-    "peer_port": 51413,
-    "data_path": "/srv/torrent",
-    "download_dir": "/srv/torrent/downloads",
-    "watch_dir": "/srv/torrent/watch",
-    "timezone": "Europe/Paris",
-    "domain": "torrent.secubox.local",
-    "haproxy": False,
-    "auth_enabled": True,
-    "username": "admin",
-    "password_hash": "",
-    # Speed limits (KB/s, 0 = unlimited)
-    "download_limit": 0,
-    "upload_limit": 0,
-    "alt_download_limit": 1000,
-    "alt_upload_limit": 500,
-    "alt_speed_enabled": False,
-    # Schedule (24h format)
-    "schedule_enabled": False,
-    "schedule_start": "08:00",
-    "schedule_end": "23:00",
-    # Seeding
-    "seed_ratio_limit": 2.0,
-    "seed_ratio_enabled": True,
-}
-
-
-# ============================================================================
-# Models
-# ============================================================================
-
-class TorrentConfig(BaseModel):
-    enabled: bool = False
-    client: str = "transmission"
-    image: str = "linuxserver/transmission:latest"
-    port: int = 9091
-    peer_port: int = 51413
-    data_path: str = "/srv/torrent"
-    download_dir: str = "/srv/torrent/downloads"
-    watch_dir: str = "/srv/torrent/watch"
-    timezone: str = "Europe/Paris"
-    domain: str = "torrent.secubox.local"
-    haproxy: bool = False
-    download_limit: int = 0
-    upload_limit: int = 0
-    alt_download_limit: int = 1000
-    alt_upload_limit: int = 500
-    alt_speed_enabled: bool = False
-    schedule_enabled: bool = False
-    schedule_start: str = "08:00"
-    schedule_end: str = "23:00"
-    seed_ratio_limit: float = 2.0
-    seed_ratio_enabled: bool = True
-
-
-class AddTorrentRequest(BaseModel):
-    magnet: Optional[str] = None
-    url: Optional[str] = None
-    paused: bool = False
-    download_dir: Optional[str] = None
-    category: Optional[str] = None
-
-
-class RSSFeed(BaseModel):
-    name: str
-    url: str
-    category: Optional[str] = None
-    auto_download: bool = False
-    filter_pattern: Optional[str] = None
-
-
-class Category(BaseModel):
-    name: str
-    save_path: Optional[str] = None
-
-
-# ============================================================================
-# Helpers
-# ============================================================================
-
-def get_config() -> dict:
-    """Load torrent configuration."""
-    if CONFIG_FILE.exists():
-        try:
-            import tomllib
-            return tomllib.loads(CONFIG_FILE.read_text())
-        except Exception:
-            pass
-    return DEFAULT_CONFIG.copy()
-
-
-def save_config(config: dict):
-    """Save torrent configuration."""
-    CONFIG_FILE.parent.mkdir(parents=True, exist_ok=True)
-    lines = ["# Torrent client configuration"]
-    for k, v in config.items():
-        if isinstance(v, bool):
-            lines.append(f"{k} = {str(v).lower()}")
-        elif isinstance(v, (int, float)):
-            lines.append(f"{k} = {v}")
-        elif isinstance(v, list):
-            lines.append(f'{k} = {v}')
-        else:
-            lines.append(f'{k} = "{v}"')
-    CONFIG_FILE.write_text("\n".join(lines) + "\n")
-
-
-def detect_runtime() -> Optional[str]:
-    """Detect container runtime."""
-    if shutil.which("podman"):
-        return "podman"
-    if shutil.which("docker"):
-        return "docker"
-    return None
-
-
-def get_container_status() -> dict:
-    """Get torrent container status."""
-    rt = detect_runtime()
-    if not rt:
-        return {"status": "no_runtime", "uptime": ""}
-
-    try:
-        result = subprocess.run(
-            [rt, "ps", "--filter", f"name={CONTAINER_NAME}", "--format", "{{.Status}}"],
-            capture_output=True, text=True, timeout=5
-        )
-        if result.stdout.strip():
-            return {"status": "running", "uptime": result.stdout.strip()}
-
-        result = subprocess.run(
-            [rt, "ps", "-a", "--filter", f"name={CONTAINER_NAME}", "--format", "{{.Status}}"],
-            capture_output=True, text=True, timeout=5
-        )
-        if result.stdout.strip():
-            return {"status": "stopped", "uptime": ""}
-
-        return {"status": "not_installed", "uptime": ""}
-    except Exception:
-        return {"status": "error", "uptime": ""}
-
-
-def is_running() -> bool:
-    """Check if container is running."""
-    return get_container_status()["status"] == "running"
-
-
-def get_rss_feeds() -> List[dict]:
-    """Get RSS feed subscriptions."""
-    if RSS_FILE.exists():
-        try:
-            return json.loads(RSS_FILE.read_text())
-        except Exception:
-            pass
-    return []
-
-
-def save_rss_feeds(feeds: List[dict]):
-    """Save RSS feeds."""
-    RSS_FILE.parent.mkdir(parents=True, exist_ok=True)
-    RSS_FILE.write_text(json.dumps(feeds, indent=2))
-
-
-def get_categories() -> List[dict]:
-    """Get torrent categories."""
-    if CATEGORIES_FILE.exists():
-        try:
-            return json.loads(CATEGORIES_FILE.read_text())
-        except Exception:
-            pass
-    # Default categories
-    return [
-        {"id": "movies", "name": "Movies", "save_path": "/downloads/movies"},
-        {"id": "tv", "name": "TV Shows", "save_path": "/downloads/tv"},
-        {"id": "music", "name": "Music", "save_path": "/downloads/music"},
-        {"id": "software", "name": "Software", "save_path": "/downloads/software"},
-    ]
-
-
-def save_categories(categories: List[dict]):
-    """Save categories."""
-    CATEGORIES_FILE.parent.mkdir(parents=True, exist_ok=True)
-    CATEGORIES_FILE.write_text(json.dumps(categories, indent=2))
-
-
-def get_transmission_rpc_url() -> str:
-    """Get Transmission RPC URL."""
-    cfg = get_config()
-    return f"http://127.0.0.1:{cfg.get('port', 9091)}/transmission/rpc"
-
-
-def transmission_rpc(method: str, arguments: dict = None) -> dict:
-    """Call Transmission RPC API."""
-    import urllib.request
-    import urllib.error
-
-    cfg = get_config()
-    url = get_transmission_rpc_url()
-    session_id = ""
-
-    payload = {"method": method}
-    if arguments:
-        payload["arguments"] = arguments
-
-    headers = {
-        "Content-Type": "application/json",
-        "X-Transmission-Session-Id": session_id,
-    }
-
-    try:
-        # First request to get session ID
-        req = urllib.request.Request(
-            url,
-            data=json.dumps(payload).encode(),
-            headers=headers,
-            method="POST"
-        )
-        urllib.request.urlopen(req, timeout=5)
-    except urllib.error.HTTPError as e:
-        if e.code == 409:
-            # Get session ID from response
-            session_id = e.headers.get("X-Transmission-Session-Id", "")
-            headers["X-Transmission-Session-Id"] = session_id
-        else:
-            raise
-
-    # Retry with session ID
-    req = urllib.request.Request(
-        url,
-        data=json.dumps(payload).encode(),
-        headers=headers,
-        method="POST"
-    )
-    response = urllib.request.urlopen(req, timeout=10)
-    return json.loads(response.read().decode())
-
-
-# ============================================================================
-# Cache for stats
-# ============================================================================
-
-_stats_cache: dict = {}
-
-
-async def refresh_stats_cache():
-    """Background task to refresh statistics cache."""
-    global _stats_cache
-    while True:
-        try:
-            if is_running():
-                # Get session stats from Transmission
-                try:
-                    result = transmission_rpc("session-stats")
-                    if result.get("result") == "success":
-                        args = result.get("arguments", {})
-                        _stats_cache = {
-                            "download_speed": args.get("downloadSpeed", 0),
-                            "upload_speed": args.get("uploadSpeed", 0),
-                            "active_torrents": args.get("activeTorrentCount", 0),
-                            "paused_torrents": args.get("pausedTorrentCount", 0),
-                            "total_downloaded": args.get("cumulative-stats", {}).get("downloadedBytes", 0),
-                            "total_uploaded": args.get("cumulative-stats", {}).get("uploadedBytes", 0),
-                            "updated": datetime.now().isoformat(),
-                        }
-                except Exception as e:
-                    log.debug(f"Stats cache refresh failed: {e}")
-            else:
-                _stats_cache = {}
-
-            # Cache to file
-            CACHE_DIR.mkdir(parents=True, exist_ok=True)
-            (CACHE_DIR / "stats.json").write_text(json.dumps(_stats_cache))
-        except Exception as e:
-            log.error(f"Stats cache error: {e}")
-
-        await asyncio.sleep(10)
-
-
-@app.on_event("startup")
-async def startup():
-    asyncio.create_task(refresh_stats_cache())
-
-
-# ============================================================================
-# Public Endpoints
-# ============================================================================
-
-@router.get("/health")
-async def health():
-    """Health check."""
-    return {"status": "ok", "module": "torrent"}
-
-
-@router.get("/status")
-def status():
-    """Get torrent service status."""
-    cfg = get_config()
-    rt = detect_runtime()
-    container = get_container_status()
-    rss_feeds = get_rss_feeds()
-    categories = get_categories()
-
-    # Disk usage
-    disk_usage = ""
-    data_path = Path(cfg.get("data_path", "/srv/torrent"))
-    if data_path.exists():
-        try:
-            result = subprocess.run(
-                ["du", "-sh", str(data_path)],
-                capture_output=True, text=True, timeout=10
-            )
-            disk_usage = result.stdout.split()[0] if result.stdout else ""
-        except Exception:
-            pass
-
-    return {
-        "enabled": cfg.get("enabled", False),
-        "client": cfg.get("client", "transmission"),
-        "image": cfg.get("image", "linuxserver/transmission:latest"),
-        "port": cfg.get("port", 9091),
-        "peer_port": cfg.get("peer_port", 51413),
-        "data_path": cfg.get("data_path", "/srv/torrent"),
-        "download_dir": cfg.get("download_dir", "/srv/torrent/downloads"),
-        "timezone": cfg.get("timezone", "Europe/Paris"),
-        "domain": cfg.get("domain", "torrent.secubox.local"),
-        "haproxy": cfg.get("haproxy", False),
-        "docker_available": rt is not None,
-        "runtime": rt or "none",
-        "container_status": container["status"],
-        "container_uptime": container["uptime"],
-        "disk_usage": disk_usage,
-        "rss_count": len(rss_feeds),
-        "category_count": len(categories),
-        "download_limit": cfg.get("download_limit", 0),
-        "upload_limit": cfg.get("upload_limit", 0),
-        "alt_speed_enabled": cfg.get("alt_speed_enabled", False),
-    }
-
-
-# ============================================================================
-# Protected Endpoints — Configuration
-# ============================================================================
-
-@router.get("/config")
-async def get_torrent_config(user=Depends(require_jwt)):
-    """Get torrent configuration."""
-    return get_config()
-
-
-@router.post("/config")
-async def set_torrent_config(config: TorrentConfig, user=Depends(require_jwt)):
-    """Update torrent configuration."""
-    cfg = get_config()
-    cfg.update(config.dict())
-    save_config(cfg)
-    log.info(f"Config updated by {user.get('sub', 'unknown')}")
-    return {"success": True}
-
-
-# ============================================================================
-# Protected Endpoints — Torrents
-# ============================================================================
-
-@router.get("/torrents")
-async def list_torrents(user=Depends(require_jwt)):
-    """List all torrents."""
-    if not is_running():
-        return {"torrents": [], "error": "Service not running"}
-
-    try:
-        result = transmission_rpc("torrent-get", {
-            "fields": [
-                "id", "name", "status", "percentDone", "totalSize",
-                "downloadedEver", "uploadedEver", "rateDownload", "rateUpload",
-                "eta", "addedDate", "doneDate", "error", "errorString",
-                "trackerStats", "labels", "downloadDir", "isFinished",
-                "peersConnected", "seedRatioLimit", "uploadRatio"
-            ]
-        })
-
-        if result.get("result") != "success":
-            return {"torrents": [], "error": result.get("result")}
-
-        torrents = []
-        for t in result.get("arguments", {}).get("torrents", []):
-            status_map = {
-                0: "stopped",
-                1: "queued_verify",
-                2: "verifying",
-                3: "queued_download",
-                4: "downloading",
-                5: "queued_seed",
-                6: "seeding",
-            }
-            torrents.append({
-                "id": t["id"],
-                "name": t["name"],
-                "status": status_map.get(t["status"], "unknown"),
-                "progress": round(t["percentDone"] * 100, 1),
-                "size": t["totalSize"],
-                "downloaded": t["downloadedEver"],
-                "uploaded": t["uploadedEver"],
-                "download_speed": t["rateDownload"],
-                "upload_speed": t["rateUpload"],
-                "eta": t["eta"] if t["eta"] >= 0 else None,
-                "added": datetime.fromtimestamp(t["addedDate"]).isoformat() if t["addedDate"] else None,
-                "completed": datetime.fromtimestamp(t["doneDate"]).isoformat() if t["doneDate"] else None,
-                "error": t["errorString"] if t["error"] else None,
-                "peers": t["peersConnected"],
-                "ratio": round(t["uploadRatio"], 2),
-                "category": t.get("labels", [""])[0] if t.get("labels") else "",
-                "download_dir": t["downloadDir"],
-            })
-
-        return {"torrents": torrents}
-
-    except Exception as e:
-        log.error(f"Failed to list torrents: {e}")
-        return {"torrents": [], "error": str(e)}
-
-
-@router.post("/torrent/add")
-async def add_torrent(
-    request: AddTorrentRequest = None,
-    torrent_file: UploadFile = File(None),
-    magnet: str = Form(None),
-    user=Depends(require_jwt)
-):
-    """Add a torrent from magnet link, URL, or file."""
-    if not is_running():
-        raise HTTPException(503, "Service not running")
-
-    try:
-        args = {"paused": False}
-
-        # Handle different input types
-        if torrent_file:
-            # Upload torrent file
-            import base64
-            content = await torrent_file.read()
-            args["metainfo"] = base64.b64encode(content).decode()
-        elif magnet:
-            args["filename"] = magnet
-        elif request:
-            if request.magnet:
-                args["filename"] = request.magnet
-            elif request.url:
-                args["filename"] = request.url
-            args["paused"] = request.paused
-            if request.download_dir:
-                args["download-dir"] = request.download_dir
-        else:
-            raise HTTPException(400, "No torrent source provided")
-
-        result = transmission_rpc("torrent-add", args)
-
-        if result.get("result") == "success":
-            torrent_info = result.get("arguments", {})
-            added = torrent_info.get("torrent-added") or torrent_info.get("torrent-duplicate")
-            log.info(f"Torrent added by {user.get('sub', 'unknown')}: {added.get('name', 'unknown')}")
-            return {
-                "success": True,
-                "torrent": {
-                    "id": added.get("id"),
-                    "name": added.get("name"),
-                    "hash": added.get("hashString"),
-                }
-            }
-        else:
-            return {"success": False, "error": result.get("result")}
-
-    except HTTPException:
-        raise
-    except Exception as e:
-        log.error(f"Add torrent failed: {e}")
-        return {"success": False, "error": str(e)}
-
-
-@router.delete("/torrent/{torrent_id}")
-async def remove_torrent(torrent_id: int, delete_data: bool = False, user=Depends(require_jwt)):
-    """Remove a torrent."""
-    if not is_running():
-        raise HTTPException(503, "Service not running")
-
-    try:
-        result = transmission_rpc("torrent-remove", {
-            "ids": [torrent_id],
-            "delete-local-data": delete_data,
-        })
-
-        if result.get("result") == "success":
-            log.info(f"Torrent {torrent_id} removed by {user.get('sub', 'unknown')} (delete_data={delete_data})")
-            return {"success": True}
-        else:
-            return {"success": False, "error": result.get("result")}
-
-    except Exception as e:
-        log.error(f"Remove torrent failed: {e}")
-        return {"success": False, "error": str(e)}
-
-
-@router.post("/torrent/{torrent_id}/pause")
-async def pause_torrent(torrent_id: int, user=Depends(require_jwt)):
-    """Pause a torrent."""
-    if not is_running():
-        raise HTTPException(503, "Service not running")
-
-    try:
-        result = transmission_rpc("torrent-stop", {"ids": [torrent_id]})
-        if result.get("result") == "success":
-            log.info(f"Torrent {torrent_id} paused by {user.get('sub', 'unknown')}")
-            return {"success": True}
-        return {"success": False, "error": result.get("result")}
-    except Exception as e:
-        return {"success": False, "error": str(e)}
-
-
-@router.post("/torrent/{torrent_id}/resume")
-async def resume_torrent(torrent_id: int, user=Depends(require_jwt)):
-    """Resume a torrent."""
-    if not is_running():
-        raise HTTPException(503, "Service not running")
-
-    try:
-        result = transmission_rpc("torrent-start", {"ids": [torrent_id]})
-        if result.get("result") == "success":
-            log.info(f"Torrent {torrent_id} resumed by {user.get('sub', 'unknown')}")
-            return {"success": True}
-        return {"success": False, "error": result.get("result")}
-    except Exception as e:
-        return {"success": False, "error": str(e)}
-
-
-@router.get("/torrent/{torrent_id}/files")
-async def get_torrent_files(torrent_id: int, user=Depends(require_jwt)):
-    """Get files in a torrent."""
-    if not is_running():
-        raise HTTPException(503, "Service not running")
-
-    try:
-        result = transmission_rpc("torrent-get", {
-            "ids": [torrent_id],
-            "fields": ["files", "fileStats"]
-        })
-
-        if result.get("result") != "success":
-            return {"files": [], "error": result.get("result")}
-
-        torrents = result.get("arguments", {}).get("torrents", [])
-        if not torrents:
-            return {"files": [], "error": "Torrent not found"}
-
-        t = torrents[0]
-        files = []
-        for i, f in enumerate(t.get("files", [])):
-            stats = t.get("fileStats", [])[i] if i < len(t.get("fileStats", [])) else {}
-            files.append({
-                "name": f["name"],
-                "size": f["length"],
-                "downloaded": f["bytesCompleted"],
-                "progress": round(f["bytesCompleted"] / f["length"] * 100, 1) if f["length"] > 0 else 0,
-                "wanted": stats.get("wanted", True),
-                "priority": stats.get("priority", 0),
-            })
-
-        return {"files": files}
-
-    except Exception as e:
-        return {"files": [], "error": str(e)}
-
-
-# ============================================================================
-# Statistics
-# ============================================================================
-
-@router.get("/stats")
-async def get_stats(user=Depends(require_jwt)):
-    """Get download/upload statistics."""
-    if _stats_cache:
-        return _stats_cache
-
-    # Try loading from cache file
-    cache_file = CACHE_DIR / "stats.json"
-    if cache_file.exists():
-        try:
-            return json.loads(cache_file.read_text())
-        except Exception:
-            pass
-
-    return {
-        "download_speed": 0,
-        "upload_speed": 0,
-        "active_torrents": 0,
-        "paused_torrents": 0,
-        "total_downloaded": 0,
-        "total_uploaded": 0,
-    }
-
-
-# ============================================================================
-# RSS Feeds
-# ============================================================================
-
-@router.get("/rss/feeds")
-async def list_rss_feeds(user=Depends(require_jwt)):
-    """List RSS feed subscriptions."""
-    return {"feeds": get_rss_feeds()}
-
-
-@router.post("/rss/add")
-async def add_rss_feed(feed: RSSFeed, user=Depends(require_jwt)):
-    """Add an RSS feed subscription."""
-    feeds = get_rss_feeds()
-
-    # Check for duplicate
-    for f in feeds:
-        if f.get("url") == feed.url:
-            return {"success": False, "error": "Feed URL already exists"}
-
-    feeds.append({
-        "id": f"rss_{len(feeds)+1}_{int(datetime.now().timestamp())}",
-        "name": feed.name,
-        "url": feed.url,
-        "category": feed.category,
-        "auto_download": feed.auto_download,
-        "filter_pattern": feed.filter_pattern,
-        "added": datetime.now().isoformat(),
-    })
-    save_rss_feeds(feeds)
-
-    log.info(f"RSS feed added: {feed.name} by {user.get('sub', 'unknown')}")
-    return {"success": True}
-
-
-@router.delete("/rss/{feed_id}")
-async def remove_rss_feed(feed_id: str, user=Depends(require_jwt)):
-    """Remove an RSS feed."""
-    feeds = get_rss_feeds()
-    new_feeds = [f for f in feeds if f.get("id") != feed_id]
-
-    if len(new_feeds) == len(feeds):
-        return {"success": False, "error": "Feed not found"}
-
-    save_rss_feeds(new_feeds)
-    log.info(f"RSS feed removed: {feed_id} by {user.get('sub', 'unknown')}")
-    return {"success": True}
-
-
-# ============================================================================
-# Categories
-# ============================================================================
-
-@router.get("/categories")
-async def list_categories(user=Depends(require_jwt)):
-    """List torrent categories."""
-    return {"categories": get_categories()}
-
-
-@router.post("/categories")
-async def add_category(category: Category, user=Depends(require_jwt)):
-    """Add a category."""
-    categories = get_categories()
-
-    for c in categories:
-        if c.get("name").lower() == category.name.lower():
-            return {"success": False, "error": "Category already exists"}
-
-    categories.append({
-        "id": category.name.lower().replace(" ", "_"),
-        "name": category.name,
-        "save_path": category.save_path or f"/downloads/{category.name.lower()}",
-    })
-    save_categories(categories)
-
-    log.info(f"Category added: {category.name} by {user.get('sub', 'unknown')}")
-    return {"success": True}
-
-
-@router.delete("/categories/{category_id}")
-async def remove_category(category_id: str, user=Depends(require_jwt)):
-    """Remove a category."""
-    categories = get_categories()
-    new_cats = [c for c in categories if c.get("id") != category_id]
-
-    if len(new_cats) == len(categories):
-        return {"success": False, "error": "Category not found"}
-
-    save_categories(new_cats)
-    log.info(f"Category removed: {category_id} by {user.get('sub', 'unknown')}")
-    return {"success": True}
-
-
-# ============================================================================
-# Container Management
-# ============================================================================
-
-@router.get("/container/status")
-async def container_status(user=Depends(require_jwt)):
-    """Get container status."""
-    return get_container_status()
-
-
-@router.post("/container/install")
-def install_container(user=Depends(require_jwt)):
-    """Install torrent container."""
-    rt = detect_runtime()
-    if not rt:
-        return {"success": False, "error": "No container runtime (docker/podman) found"}
-
-    cfg = get_config()
-    data_path = Path(cfg.get("data_path", "/srv/torrent"))
-
-    # Create directories
-    (data_path / "config").mkdir(parents=True, exist_ok=True)
-    (data_path / "downloads").mkdir(parents=True, exist_ok=True)
-    (data_path / "watch").mkdir(parents=True, exist_ok=True)
-
-    image = cfg.get("image", "linuxserver/transmission:latest")
-    log.info(f"Installing torrent client ({image}) by {user.get('sub', 'unknown')}")
-
-    try:
-        result = subprocess.run(
-            [rt, "pull", image],
-            capture_output=True, text=True, timeout=300
-        )
-        if result.returncode != 0:
-            return {"success": False, "error": result.stderr.strip(), "output": result.stdout}
-
-        return {"success": True, "output": "Image pulled successfully"}
-    except subprocess.TimeoutExpired:
-        return {"success": False, "error": "Pull timeout"}
-    except Exception as e:
-        return {"success": False, "error": str(e)}
-
-
-@router.post("/container/start")
-async def start_container(user=Depends(require_jwt)):
-    """Start torrent container."""
-    if is_running():
-        return {"success": False, "error": "Already running"}
-
-    rt = detect_runtime()
-    if not rt:
-        return {"success": False, "error": "No container runtime"}
-
-    cfg = get_config()
-    data_path = Path(cfg.get("data_path", "/srv/torrent"))
-    port = cfg.get("port", 9091)
-    peer_port = cfg.get("peer_port", 51413)
-    image = cfg.get("image", "linuxserver/transmission:latest")
-    tz = cfg.get("timezone", "Europe/Paris")
-
-    # Ensure directories exist
-    (data_path / "config").mkdir(parents=True, exist_ok=True)
-    (data_path / "downloads").mkdir(parents=True, exist_ok=True)
-    (data_path / "watch").mkdir(parents=True, exist_ok=True)
-
-    cmd = [
-        rt, "run", "-d",
-        "--name", CONTAINER_NAME,
-        "-v", f"{data_path}/config:/config",
-        "-v", f"{data_path}/downloads:/downloads",
-        "-v", f"{data_path}/watch:/watch",
-        "-e", f"TZ={tz}",
-        "-e", "PUID=1000",
-        "-e", "PGID=1000",
-        "-p", f"127.0.0.1:{port}:9091",
-        "-p", f"{peer_port}:51413",
-        "-p", f"{peer_port}:51413/udp",
-        "--restart", "unless-stopped",
-    ]
-
-    cmd.append(image)
-
-    log.info(f"Starting torrent client by {user.get('sub', 'unknown')}")
-
-    try:
-        subprocess.run([rt, "rm", "-f", CONTAINER_NAME], capture_output=True, timeout=10)
-        result = subprocess.run(cmd, capture_output=True, text=True, timeout=60)
-        await asyncio.sleep(3)
-
-        if is_running():
-            return {"success": True}
-        else:
-            return {"success": False, "error": result.stderr.strip() or "Failed to start"}
-    except Exception as e:
-        return {"success": False, "error": str(e)}
-
-
-@router.post("/container/stop")
-async def stop_container(user=Depends(require_jwt)):
-    """Stop torrent container."""
-    rt = detect_runtime()
-    if not rt:
-        return {"success": False, "error": "No container runtime"}
-
-    log.info(f"Stopping torrent client by {user.get('sub', 'unknown')}")
-
-    try:
-        subprocess.run([rt, "stop", CONTAINER_NAME], capture_output=True, timeout=30)
-        return {"success": True}
-    except Exception as e:
-        return {"success": False, "error": str(e)}
-
-
-@router.post("/container/restart")
-async def restart_container(user=Depends(require_jwt)):
-    """Restart torrent container."""
-    await stop_container(user)
-    await asyncio.sleep(2)
-    return await start_container(user)
-
-
-@router.post("/container/uninstall")
-def uninstall_container(user=Depends(require_jwt)):
-    """Uninstall torrent container."""
-    rt = detect_runtime()
-    if not rt:
-        return {"success": False, "error": "No container runtime"}
-
-    log.info(f"Uninstalling torrent client by {user.get('sub', 'unknown')}")
-
-    try:
-        subprocess.run([rt, "stop", CONTAINER_NAME], capture_output=True, timeout=30)
-        subprocess.run([rt, "rm", "-f", CONTAINER_NAME], capture_output=True, timeout=10)
-        return {"success": True}
-    except Exception as e:
-        return {"success": False, "error": str(e)}
-
-
-# ============================================================================
-# Logs
-# ============================================================================
-
-@router.get("/logs")
-def get_logs(lines: int = 100, user=Depends(require_jwt)):
-    """Get container logs."""
-    rt = detect_runtime()
-    if not rt:
-        return {"logs": "No container runtime"}
-
-    try:
-        result = subprocess.run(
-            [rt, "logs", "--tail", str(lines), CONTAINER_NAME],
-            capture_output=True, text=True, timeout=10
-        )
-        logs = result.stdout + result.stderr
-        return {"logs": logs}
-    except Exception:
-        return {"logs": "No logs available"}
-
-
-app.include_router(router)
diff --git a/packages/secubox-torrent/debian/changelog b/packages/secubox-torrent/debian/changelog
index d9b24c74..ff3b494a 100644
--- a/packages/secubox-torrent/debian/changelog
+++ b/packages/secubox-torrent/debian/changelog
@@ -1,3 +1,11 @@
+secubox-torrent (2.0.0-1~bookworm1) bookworm; urgency=medium
+
+  * Pivot from Transmission to WebTorrent streaming (LXC-native, #917).
+  * Browser player (HTTP Range), ephemeral-by-default + Keep library on /data.
+  * Hybrid WebRTC+BitTorrent engine isolated in a dedicated LXC.
+
+ -- Gerald KERMA <devel@cybermind.fr>  Tue, 28 Jul 2026 14:00:00 +0200
+
 secubox-torrent (1.1.0-1~bookworm2) bookworm; urgency=medium
 
   * Phase 2: Requires=secubox-core.service -> Wants= on this module's unit
diff --git a/packages/secubox-torrent/debian/control b/packages/secubox-torrent/debian/control
index 1dba150d..cd9cb819 100644
--- a/packages/secubox-torrent/debian/control
+++ b/packages/secubox-torrent/debian/control
@@ -7,20 +7,9 @@ Standards-Version: 4.6.2
 
 Package: secubox-torrent
 Architecture: all
-Depends: ${misc:Depends}, secubox-core (>= 1.0), python3-uvicorn | python3-pip
-Recommends: docker.io | podman
-Description: BitTorrent client management for SecuBox
- SecuBox module for managing BitTorrent downloads via Transmission.
- Provides Docker container management, torrent lifecycle (add/remove/
- pause/resume), RSS feed subscriptions, category management, and
- speed limiting.
- .
- Features:
-  - Transmission daemon via Docker/Podman
-  - Torrent add via magnet links, URLs, or .torrent files
-  - Download/upload speed limiting with scheduling
-  - RSS feed subscriptions for automatic downloads
-  - Category/label management
-  - P31 Phosphor light theme web UI
- .
- Provides FastAPI backend on /api/v1/torrent/ via Unix socket.
+Depends: ${misc:Depends}, secubox-core (>= 1.0), lxc, debootstrap, nftables
+Description: WebTorrent streaming for SecuBox (LXC-native)
+ Paste a magnet and stream it in the browser (HTTP Range) while it downloads.
+ Ephemeral by default with an optional Keep to a persistent library on /data.
+ The WebTorrent engine (hybrid WebRTC+BitTorrent) runs isolated in a dedicated
+ LXC; the host only proxies an authenticated vhost.
diff --git a/packages/secubox-torrent/debian/postinst b/packages/secubox-torrent/debian/postinst
index 2ff65538..a28236f8 100755
--- a/packages/secubox-torrent/debian/postinst
+++ b/packages/secubox-torrent/debian/postinst
@@ -1,27 +1,53 @@
-#!/bin/bash
+#!/bin/sh
+# SPDX-License-Identifier: LicenseRef-CMSD-1.0
+# Copyright (c) 2026 CyberMind — Gérald Kerma <devel@cybermind.fr>
 set -e
 case "$1" in
   configure)
-    # Ensure secubox user exists
+    # Ensure secubox user exists (shared across all secubox-* modules).
     id -u secubox >/dev/null 2>&1 || \
       adduser --system --group --no-create-home \
         --home /var/lib/secubox --shell /usr/sbin/nologin secubox
-    # Create runtime directories
+
+    # Runtime + state directories (shared conventions; do not chown the
+    # /etc/secubox parent here — secubox-core owns it).
     install -d -o root -g root -m 1777 /run/secubox
     install -d -o secubox -g secubox -m 755 /var/lib/secubox
-    install -d -o secubox -g secubox -m 750 /var/cache/secubox/torrent
-    # Create data directories
-    install -d -m 755 /srv/torrent/config
-    install -d -m 755 /srv/torrent/downloads
-    install -d -m 755 /srv/torrent/watch
-    # Ensure nginx secubox.d directory exists
-    install -d -m 755 /etc/nginx/secubox.d
-    # Enable and start service
-    systemctl daemon-reload
-    systemctl enable secubox-torrent.service
-    systemctl start  secubox-torrent.service || true
-    # Reload nginx to pick up new location
-    systemctl reload nginx 2>/dev/null || true
+    [ -d /etc/secubox ] || install -d -o secubox -g secubox -m 755 /etc/secubox
+
+    # Parse the operator-facing TOML into the env vars install-lxc.sh (via
+    # lxc/install-lxc.sh's torrent.env writer) expects. Minimal grep parse —
+    # matches the flat `key = value` lines under [engine]/[retention].
+    TORRENT_MAX_ACTIVE=$(grep -E '^max_active' /etc/secubox/torrent.toml 2>/dev/null | grep -oE '[0-9]+' | head -1)
+    TORRENT_WEBRTC=$(grep -E '^webrtc' /etc/secubox/torrent.toml 2>/dev/null | grep -oE 'true|false' | head -1)
+    TORRENT_TTL=$(grep -E '^ephemeral_ttl_hours' /etc/secubox/torrent.toml 2>/dev/null | grep -oE '[0-9]+' | head -1)
+    TORRENT_FLOOR=$(grep -E '^disk_floor_gb' /etc/secubox/torrent.toml 2>/dev/null | grep -oE '[0-9]+' | head -1)
+    export TORRENT_MAX_ACTIVE TORRENT_WEBRTC TORRENT_TTL TORRENT_FLOOR
+
+    # Provision/refresh the dedicated WebTorrent LXC (idempotent: creates
+    # the container once, then redeploys the app + restarts the in-LXC
+    # unit on every upgrade). Never fail the postinst if LXC tooling isn't
+    # ready yet (e.g. first apt run before /data is mounted).
+    sh /usr/lib/secubox/torrent/install-lxc.sh \
+      || echo "secubox-torrent: LXC provisioning deferred (run /usr/lib/secubox/torrent/install-lxc.sh manually)"
+
+    # Load the egress visibility scope for the torrent LXC's veth.
+    if [ -f /etc/nftables.d/zz-torrent-egress.nft ]; then
+      nft -f /etc/nftables.d/zz-torrent-egress.nft 2>/dev/null || true
+    fi
+
+    # Symlink the public vhost into sites-enabled (idempotent). Proxies
+    # torrent.gk2.secubox.in -> torrent LXC at 10.100.0.160:8090. Operator
+    # wires the HAProxy SNI ACL + ACME cert + sbxwaf route separately.
+    if [ -f /etc/nginx/sites-available/torrent.conf ] && [ -d /etc/nginx/sites-enabled ]; then
+      ln -sf ../sites-available/torrent.conf /etc/nginx/sites-enabled/torrent.conf
+    fi
+
+    if command -v nginx >/dev/null 2>&1 && nginx -t >/dev/null 2>&1; then
+      systemctl reload nginx 2>/dev/null || true
+    fi
     ;;
 esac
+
 #DEBHELPER#
+exit 0
diff --git a/packages/secubox-torrent/debian/postrm b/packages/secubox-torrent/debian/postrm
new file mode 100755
index 00000000..21e9a517
--- /dev/null
+++ b/packages/secubox-torrent/debian/postrm
@@ -0,0 +1,17 @@
+#!/bin/sh
+# SPDX-License-Identifier: LicenseRef-CMSD-1.0
+# Copyright (c) 2026 CyberMind — Gérald Kerma <devel@cybermind.fr>
+set -e
+case "$1" in
+  purge)
+    # Destroy the dedicated WebTorrent LXC and its provisioning sentinel.
+    # Downloaded/kept media on /data/torrent is left in place (operator
+    # data, not package state) — same convention as other LXC-native
+    # modules (peertube, picobrew).
+    lxc-stop    -n torrent -P /data/lxc 2>/dev/null || true
+    lxc-destroy -n torrent -P /data/lxc 2>/dev/null || true
+    rm -f /var/lib/secubox/torrent/.lxc-provisioned 2>/dev/null || true
+    ;;
+esac
+#DEBHELPER#
+exit 0
diff --git a/packages/secubox-torrent/debian/prerm b/packages/secubox-torrent/debian/prerm
index bb4fc3b1..d19a7583 100755
--- a/packages/secubox-torrent/debian/prerm
+++ b/packages/secubox-torrent/debian/prerm
@@ -1,14 +1,16 @@
-#!/bin/bash
+#!/bin/sh
+# SPDX-License-Identifier: LicenseRef-CMSD-1.0
+# Copyright (c) 2026 CyberMind — Gérald Kerma <devel@cybermind.fr>
 set -e
 case "$1" in
-  remove|upgrade)
-    # Remove nginx location config
-    rm -f /etc/nginx/secubox.d/torrent.conf
-    # Stop and disable service
-    systemctl stop    secubox-torrent.service 2>/dev/null || true
-    systemctl disable secubox-torrent.service 2>/dev/null || true
-    # Reload nginx to remove location
-    systemctl reload nginx 2>/dev/null || true
+  remove|upgrade|deconfigure)
+    # No host-side daemon to stop (the WebTorrent engine runs inside the
+    # dedicated LXC, not as a host systemd unit). Just unwire the vhost.
+    rm -f /etc/nginx/sites-enabled/torrent.conf
+    if command -v nginx >/dev/null 2>&1 && nginx -t >/dev/null 2>&1; then
+      systemctl reload nginx 2>/dev/null || true
+    fi
     ;;
 esac
 #DEBHELPER#
+exit 0
diff --git a/packages/secubox-torrent/debian/rules b/packages/secubox-torrent/debian/rules
index b2880ff6..b60728a7 100755
--- a/packages/secubox-torrent/debian/rules
+++ b/packages/secubox-torrent/debian/rules
@@ -3,18 +3,37 @@
 	dh $@
 
 override_dh_auto_install:
-	# API files
-	install -d debian/secubox-torrent/usr/lib/secubox/torrent/
-	cp -r api debian/secubox-torrent/usr/lib/secubox/torrent/
-	# Static www files
-	install -d debian/secubox-torrent/usr/share/secubox/www
-	[ -d www ] && cp -r www/. debian/secubox-torrent/usr/share/secubox/www/ || true
-	# Menu definitions
+	# WebTorrent LXC app source. Ships package-lock.json (needed by
+	# `npm ci` at provision time inside the LXC) but NOT node_modules
+	# (gitignored dev artifact; install-lxc.sh runs npm ci in the LXC).
+	install -d debian/secubox-torrent/usr/lib/secubox/torrent/app
+	cp -r lxc/app/. debian/secubox-torrent/usr/lib/secubox/torrent/app/
+	rm -rf debian/secubox-torrent/usr/lib/secubox/torrent/app/node_modules
+	# LXC bootstrap script + in-LXC systemd unit (installed side by side so
+	# install-lxc.sh's $(dirname "$0") resolves the unit file on the board).
+	install -m 755 lxc/install-lxc.sh debian/secubox-torrent/usr/lib/secubox/torrent/install-lxc.sh
+	install -m 644 lxc/secubox-torrent.service debian/secubox-torrent/usr/lib/secubox/torrent/secubox-torrent.service
+	# Webui (browser player)
+	install -d debian/secubox-torrent/usr/share/secubox/www/torrent
+	cp -r www/torrent/. debian/secubox-torrent/usr/share/secubox/www/torrent/
+	# Menu definition
 	install -d debian/secubox-torrent/usr/share/secubox/menu.d
-	[ -d menu.d ] && cp -r menu.d/. debian/secubox-torrent/usr/share/secubox/menu.d/ || true
-	# Modular nginx config
-	install -d debian/secubox-torrent/etc/nginx/secubox.d
-	[ -f nginx/torrent.conf ] && cp nginx/torrent.conf debian/secubox-torrent/etc/nginx/secubox.d/ || true
-	# Systemd service
-	install -d debian/secubox-torrent/lib/systemd/system
-	[ -f systemd/secubox-torrent.service ] && cp systemd/secubox-torrent.service debian/secubox-torrent/lib/systemd/system/ || true
+	install -m 644 menu.d/612-torrent.json debian/secubox-torrent/usr/share/secubox/menu.d/
+	# Config
+	install -d debian/secubox-torrent/etc/secubox
+	install -m 644 conf/torrent.toml debian/secubox-torrent/etc/secubox/torrent.toml
+	# Public vhost: full standalone server{} block (own server_name), so it
+	# MUST land in sites-available/ (+ postinst symlink into sites-enabled),
+	# NOT etc/nginx/secubox.d/ — that dir is location-only snippets merged
+	# into the shared hub server block (see nginx/torrent.conf header and
+	# packages/secubox-peertube/debian/rules for the verified pattern).
+	install -d debian/secubox-torrent/etc/nginx/sites-available
+	install -m 644 nginx/torrent.conf debian/secubox-torrent/etc/nginx/sites-available/torrent.conf
+	# nft egress scope: ship straight to /etc/nftables.d/ with a zz- prefix
+	# so it sorts after any table-creator base file (repo convention; see
+	# secubox-p2p/secubox-toolbox/secubox-threatmesh debian/rules+postinst).
+	# NOTE: /etc/secubox/nft.d/ is not an include path anywhere on the board
+	# (/etc/nftables.conf only does `include "/etc/nftables.d/*.nft"`) — the
+	# original task brief's path would ship a rule that never loads.
+	install -d debian/secubox-torrent/etc/nftables.d
+	install -m 644 nft/torrent-egress.nft debian/secubox-torrent/etc/nftables.d/zz-torrent-egress.nft
diff --git a/packages/secubox-torrent/debian/secubox.yaml b/packages/secubox-torrent/debian/secubox.yaml
index f294ef00..cb61b15a 100644
--- a/packages/secubox-torrent/debian/secubox.yaml
+++ b/packages/secubox-torrent/debian/secubox.yaml
@@ -4,14 +4,10 @@
 name: secubox-torrent
 category: misc
 tier: lite
-description: "BitTorrent client management for SecuBox"
+description: "WebTorrent streaming for SecuBox (LXC-native)"
 
 depends:
   - secubox-core
 
-api:
-  socket: /run/secubox/torrent.sock
-  health: /api/v1/torrent/health
-
 ui:
   path: /srv/secubox/www/torrent
diff --git a/packages/secubox-torrent/systemd/secubox-torrent.service b/packages/secubox-torrent/systemd/secubox-torrent.service
deleted file mode 100644
index d24e9677..00000000
--- a/packages/secubox-torrent/systemd/secubox-torrent.service
+++ /dev/null
@@ -1,28 +0,0 @@
-[Unit]
-# Only start if explicitly enabled (backend installed)
-ConditionPathExists=/etc/secubox/torrent/enabled
-Description=SecuBox Torrent — BitTorrent Client Management API
-After=network.target secubox-core.service
-Wants=secubox-core.service
-
-[Service]
-UMask=0000
-Type=simple
-User=secubox
-Group=secubox
-WorkingDirectory=/usr/lib/secubox/torrent
-ExecStart=/usr/bin/python3 -m uvicorn api.main:app \
-    --uds /run/secubox/torrent.sock \
-    --log-level warning
-Restart=on-failure
-RestartSec=5
-PrivateTmp=true
-NoNewPrivileges=true
-RuntimeDirectory=secubox
-RuntimeDirectoryPreserve=yes
-RuntimeDirectoryMode=0775
-ProtectSystem=full
-ReadWritePaths=/run/secubox /var/lib/secubox /var/cache/secubox /etc/secubox /srv/torrent
-
-[Install]
-WantedBy=multi-user.target
diff --git a/packages/secubox-torrent/tests/test_packaging.py b/packages/secubox-torrent/tests/test_packaging.py
new file mode 100644
index 00000000..82dcd3c9
--- /dev/null
+++ b/packages/secubox-torrent/tests/test_packaging.py
@@ -0,0 +1,52 @@
+# SPDX-License-Identifier: LicenseRef-CMSD-1.0
+# Copyright (c) 2026 CyberMind — Gérald Kerma <devel@cybermind.fr>
+# Source-Disclosed License — All rights reserved except as expressly granted.
+# See LICENCE-CMSD-1.0.md for terms.
+
+"""
+SecuBox-Deb :: secubox-torrent :: packaging structural tests (v2.0.0 pivot)
+
+Guards the Transmission -> WebTorrent/LXC packaging pivot (#917, Task 8):
+old FastAPI/Transmission control-plane gone, LXC deps present, install-lxc.sh
+wired into postinst, and the public vhost lands in sites-available (not the
+location-snippet secubox.d/ dir).
+"""
+
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parent.parent
+
+
+def _read(p):
+    return (ROOT / p).read_text()
+
+
+def test_control_is_v2_no_transmission():
+    c = _read("debian/control")
+    assert "python3-uvicorn" not in c          # old FastAPI gone
+    assert "transmission" not in c.lower()
+    assert "lxc" in c.lower()
+
+
+def test_changelog_is_2_0_0():
+    assert _read("debian/changelog").startswith("secubox-torrent (2.0.0-1~bookworm1)")
+
+
+def test_postinst_runs_install_lxc():
+    assert "install-lxc.sh" in _read("debian/postinst")
+
+
+def test_no_old_fastapi_main():
+    assert not (ROOT / "api" / "main.py").exists()
+
+
+def test_no_old_host_systemd_unit():
+    assert not (ROOT / "systemd" / "secubox-torrent.service").exists()
+
+
+def test_vhost_installed_to_sites_available_not_secubox_d():
+    rules = _read("debian/rules")
+    assert "sites-available" in rules
+    # Guard against reintroducing the location-snippet dir for this full vhost.
+    assert "secubox-torrent/etc/nginx/secubox.d/torrent.conf" not in rules
+    assert "secubox-torrent/etc/nginx/secubox-vhost.d" not in rules

From fd4e507a400f052236c750c47e68966b23539466 Mon Sep 17 00:00:00 2001
From: CyberMind-FR <gandalf@Gk2.net>
Date: Tue, 28 Jul 2026 16:10:06 +0200
Subject: [PATCH 13/17] fix(torrent): run install-lxc.sh via bash, add
 secubox-hub dep, build-essential fallback (ref #917)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

postinst invoked the bash provisioner through /bin/sh (dash), which rejects
`set -o pipefail` on line 1 and silently aborted LXC provisioning behind the
`|| echo … deferred …` guard — apt install exited 0 with no LXC ever
created. Also add secubox-hub to Depends (owns the $lan_client nginx map
torrent.conf's auth gate references) and python3/build-essential to the
in-LXC apt install so npm can compile better-sqlite3/@roamhq/wrtc from
source on bookworm's Node 18 when an arm64 prebuild is missing.

Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
---
 packages/secubox-torrent/debian/control     | 2 +-
 packages/secubox-torrent/debian/postinst    | 2 +-
 packages/secubox-torrent/lxc/install-lxc.sh | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/packages/secubox-torrent/debian/control b/packages/secubox-torrent/debian/control
index cd9cb819..972022b4 100644
--- a/packages/secubox-torrent/debian/control
+++ b/packages/secubox-torrent/debian/control
@@ -7,7 +7,7 @@ Standards-Version: 4.6.2
 
 Package: secubox-torrent
 Architecture: all
-Depends: ${misc:Depends}, secubox-core (>= 1.0), lxc, debootstrap, nftables
+Depends: ${misc:Depends}, secubox-core (>= 1.0), secubox-hub, lxc, debootstrap, nftables
 Description: WebTorrent streaming for SecuBox (LXC-native)
  Paste a magnet and stream it in the browser (HTTP Range) while it downloads.
  Ephemeral by default with an optional Keep to a persistent library on /data.
diff --git a/packages/secubox-torrent/debian/postinst b/packages/secubox-torrent/debian/postinst
index a28236f8..40a00743 100755
--- a/packages/secubox-torrent/debian/postinst
+++ b/packages/secubox-torrent/debian/postinst
@@ -28,7 +28,7 @@ case "$1" in
     # the container once, then redeploys the app + restarts the in-LXC
     # unit on every upgrade). Never fail the postinst if LXC tooling isn't
     # ready yet (e.g. first apt run before /data is mounted).
-    sh /usr/lib/secubox/torrent/install-lxc.sh \
+    bash /usr/lib/secubox/torrent/install-lxc.sh \
       || echo "secubox-torrent: LXC provisioning deferred (run /usr/lib/secubox/torrent/install-lxc.sh manually)"
 
     # Load the egress visibility scope for the torrent LXC's veth.
diff --git a/packages/secubox-torrent/lxc/install-lxc.sh b/packages/secubox-torrent/lxc/install-lxc.sh
index a51aeefc..f21bd4f2 100755
--- a/packages/secubox-torrent/lxc/install-lxc.sh
+++ b/packages/secubox-torrent/lxc/install-lxc.sh
@@ -45,7 +45,7 @@ EOF
   lxc-start -n "$LXC_NAME" -P "$LXC_PATH"
   sleep 5
   la apt-get update
-  la apt-get install -y --no-install-recommends nodejs npm ca-certificates
+  la apt-get install -y --no-install-recommends nodejs npm ca-certificates python3 build-essential
   touch "$SENTINEL"
 fi
 log "node version: $(la node --version 2>/dev/null || echo MISSING)"

From 252fb6825a64ef5460561a3520026286ccbf4554 Mon Sep 17 00:00:00 2001
From: CyberMind-FR <gandalf@Gk2.net>
Date: Tue, 28 Jul 2026 16:10:15 +0200
Subject: [PATCH 14/17] fix(torrent): preserve kept flag on re-add, resume
 library at startup, honest paths (ref #917)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

library.js add() used INSERT OR REPLACE, so re-adding an already-kept
magnet reset kept=0 and added_at — the ephemeral purge sweep would then
delete it 6h later as if it had never been kept. Switch to
INSERT ... ON CONFLICT DO UPDATE SET last_played_at only, preserving kept/
added_at/name/magnet/path across a re-add.

server.js never resynced the WebTorrent engine with the library DB at
startup: kept titles 404'd on /stream after any restart (engine.get()
returns null for a torrent the engine never re-learned about), and
runPurge's engine.remove() became a silent no-op for ephemeral rows,
leaking their downloaded bytes on disk while their DB rows vanished. Add
resumeLibrary(engine, library, { rmrf }), wired into start(): kept rows are
re-added to the engine (try/catch + promise .catch so one bad magnet can't
abort the loop); ephemeral rows are dropped from the library and their
download dir is reclaimed via an injectable rmrf.

api.js recorded a fictitious tmp/<infohash> (add) and library/<infohash>
(keep) path that no code ever moves files into — files download flat to
downloadDir. Record path.join(downloadDir, infohash) in both places so the
path resumeLibrary's rmrf acts on matches where files actually live.

Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
---
 packages/secubox-torrent/lxc/app/api.js       |  4 +-
 packages/secubox-torrent/lxc/app/library.js   |  9 ++++-
 .../secubox-torrent/lxc/app/library.test.js   | 12 ++++++
 packages/secubox-torrent/lxc/app/server.js    | 40 +++++++++++++++++++
 .../secubox-torrent/lxc/app/server.test.js    | 39 +++++++++++++++++-
 5 files changed, 99 insertions(+), 5 deletions(-)

diff --git a/packages/secubox-torrent/lxc/app/api.js b/packages/secubox-torrent/lxc/app/api.js
index de17e1ee..043a0bc4 100644
--- a/packages/secubox-torrent/lxc/app/api.js
+++ b/packages/secubox-torrent/lxc/app/api.js
@@ -23,7 +23,7 @@ export function buildApi({ engine, library, diskFreeBytes }) {
     try { meta = await engine.add(magnet); }
     catch (e) { return reply.code(504).send({ error: e.message }); }
     library.add({ infohash: meta.infohash, name: meta.name, magnet,
-      path: path.join(engine.downloadDir, 'tmp', meta.infohash) });
+      path: path.join(engine.downloadDir, meta.infohash) });
     return meta;
   });
 
@@ -39,7 +39,7 @@ export function buildApi({ engine, library, diskFreeBytes }) {
   app.post('/api/v1/torrent/keep/:infohash', async (req, reply) => {
     const ih = req.params.infohash;
     if (!library.get(ih)) return reply.code(404).send({ error: 'not found' });
-    library.keep(ih, path.join(engine.downloadDir, 'library', ih));
+    library.keep(ih, path.join(engine.downloadDir, ih));
     return { status: 'kept' };
   });
 
diff --git a/packages/secubox-torrent/lxc/app/library.js b/packages/secubox-torrent/lxc/app/library.js
index eea1f708..4a38a77e 100644
--- a/packages/secubox-torrent/lxc/app/library.js
+++ b/packages/secubox-torrent/lxc/app/library.js
@@ -16,9 +16,14 @@ export class Library {
   }
   add({ infohash, name, magnet, path }) {
     const now = Math.floor(Date.now() / 1000);
-    this.db.prepare(`INSERT OR REPLACE INTO torrents
+    // ON CONFLICT touches last_played_at only — re-adding an already-known
+    // infohash (e.g. a kept magnet pasted again) must NOT clobber its
+    // `kept` flag or `added_at`, or the purge sweep would later delete it.
+    this.db.prepare(`INSERT INTO torrents
       (infohash,name,magnet,path,added_at,last_played_at,kept)
-      VALUES (?,?,?,?,?,?,0)`).run(infohash, name, magnet, path, now, now);
+      VALUES (?,?,?,?,?,?,0)
+      ON CONFLICT(infohash) DO UPDATE SET last_played_at=excluded.last_played_at`)
+      .run(infohash, name, magnet, path, now, now);
   }
   list() { return this.db.prepare('SELECT * FROM torrents ORDER BY added_at DESC').all(); }
   get(infohash) { return this.db.prepare('SELECT * FROM torrents WHERE infohash=?').get(infohash) || null; }
diff --git a/packages/secubox-torrent/lxc/app/library.test.js b/packages/secubox-torrent/lxc/app/library.test.js
index 09a740ee..4c7dc787 100644
--- a/packages/secubox-torrent/lxc/app/library.test.js
+++ b/packages/secubox-torrent/lxc/app/library.test.js
@@ -26,6 +26,18 @@ test('keep flips kept and updates path', () => {
   assert.equal(lib.get('a').path, '/data/torrent/library/a');
 });
 
+test('re-adding an already-kept infohash does not un-keep it', () => {
+  const lib = mk();
+  lib.add({ infohash: 'a', name: 'A', magnet: 'm', path: '/tmp/a' });
+  lib.touchAt('a', 1000);
+  lib.keep('a', '/data/torrent/a');
+  const addedAtBefore = lib.get('a').added_at;
+  lib.add({ infohash: 'a', name: 'A', magnet: 'm', path: '/tmp/a' });
+  const row = lib.get('a');
+  assert.equal(row.kept, 1);
+  assert.equal(row.added_at, addedAtBefore);
+});
+
 test('expiredEphemeral returns only stale unkept torrents', () => {
   const lib = mk();
   lib.add({ infohash: 'old', name: 'O', magnet: 'm', path: '/tmp/o' });
diff --git a/packages/secubox-torrent/lxc/app/server.js b/packages/secubox-torrent/lxc/app/server.js
index 5536e456..c06e0484 100644
--- a/packages/secubox-torrent/lxc/app/server.js
+++ b/packages/secubox-torrent/lxc/app/server.js
@@ -43,6 +43,44 @@ export function diskFreeBytesOnData() {
   }
 }
 
+/**
+ * Re-sync the WebTorrent engine with the library DB at startup. Kept rows
+ * survive a service/LXC restart only in the DB (the engine's in-memory
+ * torrent list is empty on every process start) — re-add them so /stream
+ * and purge see them again. Ephemeral (kept=0) rows can't be meaningfully
+ * resumed (no seek/priority state was persisted) and would otherwise leak
+ * their downloaded bytes forever once runPurge's engine.remove() becomes a
+ * no-op for a torrent the engine never re-learned about — so they're
+ * dropped from the library and their download dir is reclaimed here
+ * instead of waiting on a purge sweep that can no longer see them.
+ */
+export function resumeLibrary(engine, library, { rmrf = defaultRmrf } = {}) {
+  for (const row of library.list()) {
+    if (row.kept) {
+      try {
+        // engine.add() is async in the real Engine (Promise) but the fake
+        // used in tests may be sync — handle both without letting either
+        // path abort the loop or leave an unhandled rejection.
+        const result = engine.add(row.magnet);
+        if (result && typeof result.catch === 'function') {
+          result.catch((e) =>
+            console.error(`secubox-torrent: resume failed for ${row.infohash}: ${e.message}`));
+        }
+      } catch (e) {
+        console.error(`secubox-torrent: resume failed for ${row.infohash}: ${e.message}`);
+      }
+    } else {
+      library.remove(row.infohash);
+      try { rmrf(row.path); }
+      catch (e) { console.error(`secubox-torrent: cleanup failed for ${row.path}: ${e.message}`); }
+    }
+  }
+}
+
+function defaultRmrf(p) {
+  if (p) fs.rmSync(p, { recursive: true, force: true });
+}
+
 export async function start() {
   const cfg = {
     downloadDir: process.env.TORRENT_DOWNLOAD_DIR || '/data/torrent',
@@ -58,6 +96,8 @@ export async function start() {
   const library = new Library(`${cfg.downloadDir}/library.db`);
   const diskFreeBytes = diskFreeBytesOnData;
 
+  resumeLibrary(engine, library);
+
   const app = buildApi({ engine, library, diskFreeBytes });
 
   const fastifyStatic = await import('@fastify/static');
diff --git a/packages/secubox-torrent/lxc/app/server.test.js b/packages/secubox-torrent/lxc/app/server.test.js
index afda8153..2fd3520d 100644
--- a/packages/secubox-torrent/lxc/app/server.test.js
+++ b/packages/secubox-torrent/lxc/app/server.test.js
@@ -8,7 +8,7 @@
 
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
-import { runPurge } from './server.js';
+import { runPurge, resumeLibrary } from './server.js';
 import { Library } from './library.js';
 
 test('purge removes expired ephemeral and calls engine.remove', () => {
@@ -60,3 +60,40 @@ test('purge below the disk floor also sweeps fresh ephemeral entries (but never
   assert.equal(lib.get('fresh'), null);
   assert.ok(lib.get('keeper'));
 });
+
+test('resumeLibrary re-adds kept torrents to the engine and reaps ephemeral ones', () => {
+  const lib = new Library(':memory:');
+  lib.add({ infohash: 'keeper', name: 'K', magnet: 'magnet:keeper', path: '/data/torrent/keeper' });
+  lib.keep('keeper', '/data/torrent/keeper');
+  lib.add({ infohash: 'eph', name: 'E', magnet: 'magnet:eph', path: '/data/torrent/eph' });
+
+  const added = [];
+  const engine = { add: (magnet) => { added.push(magnet); } };
+  const rmrfCalls = [];
+  const rmrf = (p) => rmrfCalls.push(p);
+
+  resumeLibrary(engine, lib, { rmrf });
+
+  assert.deepEqual(added, ['magnet:keeper']);
+  assert.ok(lib.get('keeper'));
+  assert.equal(lib.get('eph'), null);
+  assert.deepEqual(rmrfCalls, ['/data/torrent/eph']);
+});
+
+test('resumeLibrary does not abort the loop if engine.add throws for one kept row', () => {
+  const lib = new Library(':memory:');
+  lib.add({ infohash: 'bad', name: 'B', magnet: 'magnet:bad', path: '/data/torrent/bad' });
+  lib.keep('bad', '/data/torrent/bad');
+  lib.add({ infohash: 'good', name: 'G', magnet: 'magnet:good', path: '/data/torrent/good' });
+  lib.keep('good', '/data/torrent/good');
+
+  const added = [];
+  const engine = {
+    add: (magnet) => {
+      if (magnet === 'magnet:bad') throw new Error('boom');
+      added.push(magnet);
+    },
+  };
+  resumeLibrary(engine, lib, { rmrf: () => {} });
+  assert.deepEqual(added, ['magnet:good']);
+});

From 41b83eb5a2bcb77a63f44ee193493e1b9dedf22e Mon Sep 17 00:00:00 2001
From: CyberMind-FR <gandalf@Gk2.net>
Date: Tue, 28 Jul 2026 16:21:28 +0200
Subject: [PATCH 15/17] fix(torrent): LXC create via download template +
 unprivileged idmap (gk2 rejects -t debian for unprivileged) (ref #917)

Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
---
 packages/secubox-torrent/lxc/install-lxc.sh | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/packages/secubox-torrent/lxc/install-lxc.sh b/packages/secubox-torrent/lxc/install-lxc.sh
index f21bd4f2..4df5968a 100755
--- a/packages/secubox-torrent/lxc/install-lxc.sh
+++ b/packages/secubox-torrent/lxc/install-lxc.sh
@@ -22,14 +22,25 @@ readonly LXC_VETH="${SECUBOX_LXC_VETH:-veth-torrent0}"
 readonly DATA_DIR="${SECUBOX_DATA_DIR:-/data/torrent}"
 readonly STATE_DIR="${SECUBOX_STATE_DIR:-/var/lib/secubox/torrent}"
 readonly SENTINEL="$STATE_DIR/.lxc-provisioned"
+# Unprivileged LXC: container-root maps to this host UID (idmap below). The
+# bind-mounted /data/torrent must be owned by it so the container can write.
+readonly LXC_ROOT_UID="${SECUBOX_LXC_ROOT_UID:-100000}"
 log() { printf '[torrent-install] %s\n' "$*"; }
 la()  { lxc-attach -n "$LXC_NAME" -P "$LXC_PATH" -- "$@"; }
 
 mkdir -p "$STATE_DIR" "$DATA_DIR"
+chown -R "$LXC_ROOT_UID:$LXC_ROOT_UID" "$DATA_DIR"
 if [ -f "$SENTINEL" ]; then log "already provisioned; skipping create"; else
-  lxc-create -n "$LXC_NAME" -P "$LXC_PATH" -t debian -- -r bookworm -a arm64
-  # network: static IP on br-lxc (config appended to the container config)
+  # Use the DOWNLOAD template (not -t debian): gk2 runs UNPRIVILEGED containers
+  # and the debian template refuses ("can't be used for unprivileged
+  # containers"). Download template + idmap is the working pattern (matches
+  # secubox-peertube).
+  lxc-create -n "$LXC_NAME" -t download -P "$LXC_PATH" -- \
+    --dist debian --release bookworm --arch "$(dpkg --print-architecture)"
+  # unprivileged idmap + static IP on br-lxc (config appended)
   cat >> "$LXC_PATH/$LXC_NAME/config" <<EOF
+lxc.idmap = u 0 $LXC_ROOT_UID 65536
+lxc.idmap = g 0 $LXC_ROOT_UID 65536
 lxc.net.0.type = veth
 lxc.net.0.link = $LXC_BRIDGE
 lxc.net.0.flags = up

From 8dfcad291ed9f2ed6d1e530e5a6cfa509f7359c0 Mon Sep 17 00:00:00 2001
From: CyberMind-FR <gandalf@Gk2.net>
Date: Tue, 28 Jul 2026 16:25:26 +0200
Subject: [PATCH 16/17] fix(torrent): only add lxc.idmap if absent
 (default.conf already provides it; duplicate aborts container) (ref #917)

Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
---
 packages/secubox-torrent/lxc/install-lxc.sh | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/packages/secubox-torrent/lxc/install-lxc.sh b/packages/secubox-torrent/lxc/install-lxc.sh
index 4df5968a..40f0f97d 100755
--- a/packages/secubox-torrent/lxc/install-lxc.sh
+++ b/packages/secubox-torrent/lxc/install-lxc.sh
@@ -37,10 +37,16 @@ if [ -f "$SENTINEL" ]; then log "already provisioned; skipping create"; else
   # secubox-peertube).
   lxc-create -n "$LXC_NAME" -t download -P "$LXC_PATH" -- \
     --dist debian --release bookworm --arch "$(dpkg --print-architecture)"
-  # unprivileged idmap + static IP on br-lxc (config appended)
+  # idmap: the download template copies /etc/lxc/default.conf, which on gk2
+  # already provides the unprivileged u/g 0->100000 65536 mapping. Only add it
+  # if absent — a DUPLICATE mapping makes newuidmap fail ("write to uid_map
+  # failed: Invalid argument") and the container ABORTS at start.
+  if ! grep -q '^lxc.idmap' "$LXC_PATH/$LXC_NAME/config"; then
+    printf 'lxc.idmap = u 0 %s 65536\nlxc.idmap = g 0 %s 65536\n' \
+      "$LXC_ROOT_UID" "$LXC_ROOT_UID" >> "$LXC_PATH/$LXC_NAME/config"
+  fi
+  # static IP on br-lxc (config appended)
   cat >> "$LXC_PATH/$LXC_NAME/config" <<EOF
-lxc.idmap = u 0 $LXC_ROOT_UID 65536
-lxc.idmap = g 0 $LXC_ROOT_UID 65536
 lxc.net.0.type = veth
 lxc.net.0.link = $LXC_BRIDGE
 lxc.net.0.flags = up

From de3e56d72f3db3f07f14566784984ece75ee1249 Mon Sep 17 00:00:00 2001
From: CyberMind-FR <gandalf@Gk2.net>
Date: Tue, 28 Jul 2026 16:28:26 +0200
Subject: [PATCH 17/17] fix(torrent): seed /etc/resolv.conf in LXC (download
 rootfs has none, apt/npm can't resolve) (ref #917)

Co-Authored-By: Gerald KERMA <devel@cybermind.fr>
---
 packages/secubox-torrent/lxc/install-lxc.sh | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/packages/secubox-torrent/lxc/install-lxc.sh b/packages/secubox-torrent/lxc/install-lxc.sh
index 40f0f97d..fbcdea3d 100755
--- a/packages/secubox-torrent/lxc/install-lxc.sh
+++ b/packages/secubox-torrent/lxc/install-lxc.sh
@@ -61,6 +61,9 @@ lxc.mount.entry = $DATA_DIR data/torrent none bind,create=dir 0 0
 EOF
   lxc-start -n "$LXC_NAME" -P "$LXC_PATH"
   sleep 5
+  # Seed DNS: the download-template rootfs ships no resolver, so apt/npm can't
+  # resolve deb.debian.org / the npm registry. Matches secubox-peertube.
+  la sh -c 'rm -f /etc/resolv.conf; printf "nameserver 1.1.1.1\nnameserver 9.9.9.9\n" > /etc/resolv.conf'
   la apt-get update
   la apt-get install -y --no-install-recommends nodejs npm ca-certificates python3 build-essential
   touch "$SENTINEL"