jukebox-media-server 0.1.0 → 0.2.0

package/dist/server/index.js

@@ -1,19 +1,26 @@
+import { createReadStream, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync } from "fs";
+import path, { basename, extname, join } from "path";
+import { fileURLToPath } from "url";
 import { createServer } from "http";
 import { Http2ServerRequest, constants } from "http2";
 import { Readable } from "stream";
-import crypto$1 from "crypto";
-import { createServer as createServer$1 } from "vite";
-import { createReadStream, existsSync, mkdirSync, readFileSync, statSync } from "fs";
-import path, { basename, extname, join } from "path";
-import { fileURLToPath } from "url";
+import crypto$1, { randomBytes, scrypt, timingSafeEqual } from "crypto";
 import { versions } from "process";
 import Database from "better-sqlite3";
 import crypto$2 from "node:crypto";
 import fs from "node:fs";
 import { readdir, stat, writeFile } from "fs/promises";
-import { homedir } from "os";
+import os, { homedir } from "os";
+import { promisify } from "util";
+import { spawn } from "child_process";
 //#region \0rolldown/runtime.js
+var __create = Object.create;
 var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __commonJSMin = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
 var __exportAll = (all, no_symbols) => {
 	let target = {};
 	for (var name in all) __defProp(target, name, {
@@ -23,6 +30,20 @@ var __exportAll = (all, no_symbols) => {
 	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
 	return target;
 };
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
 //#endregion
 //#region node_modules/@hono/node-server/dist/index.mjs
 var RequestError = class extends Error {
@@ -2500,7 +2521,7 @@ var colorStatus = async (status) => {
 async function log(fn, prefix, method, path, status = 0, elapsed) {
 	fn(prefix === "<--" ? `${prefix} ${method} ${path}` : `${prefix} ${method} ${path} ${await colorStatus(status)} ${elapsed}`);
 }
-var logger = (fn = console.log) => {
+var logger$1 = (fn = console.log) => {
 	return async function logger2(c, next) {
 		const { method, url } = c.req;
 		const path = url.slice(url.indexOf("/", 8));
@@ -3719,6 +3740,109 @@ function mapRelationalRow(tablesConfig, tableConfig, row, buildQueryResultSelect
 	return result;
 }
 //#endregion
+//#region node_modules/hono/dist/helper/factory/index.js
+var createMiddleware = (middleware) => middleware;
+//#endregion
+//#region node_modules/hono/dist/utils/cookie.js
+var validCookieNameRegEx = /^[\w!#$%&'*.^`|~+-]+$/;
+var validCookieValueRegEx = /^[ !#-:<-[\]-~]*$/;
+var parse = (cookie, name) => {
+	if (name && cookie.indexOf(name) === -1) return {};
+	const pairs = cookie.trim().split(";");
+	const parsedCookie = {};
+	for (let pairStr of pairs) {
+		pairStr = pairStr.trim();
+		const valueStartPos = pairStr.indexOf("=");
+		if (valueStartPos === -1) continue;
+		const cookieName = pairStr.substring(0, valueStartPos).trim();
+		if (name && name !== cookieName || !validCookieNameRegEx.test(cookieName)) continue;
+		let cookieValue = pairStr.substring(valueStartPos + 1).trim();
+		if (cookieValue.startsWith("\"") && cookieValue.endsWith("\"")) cookieValue = cookieValue.slice(1, -1);
+		if (validCookieValueRegEx.test(cookieValue)) {
+			parsedCookie[cookieName] = cookieValue.indexOf("%") !== -1 ? tryDecode(cookieValue, decodeURIComponent_) : cookieValue;
+			if (name) break;
+		}
+	}
+	return parsedCookie;
+};
+var _serialize = (name, value, opt = {}) => {
+	let cookie = `${name}=${value}`;
+	if (name.startsWith("__Secure-") && !opt.secure) throw new Error("__Secure- Cookie must have Secure attributes");
+	if (name.startsWith("__Host-")) {
+		if (!opt.secure) throw new Error("__Host- Cookie must have Secure attributes");
+		if (opt.path !== "/") throw new Error("__Host- Cookie must have Path attributes with \"/\"");
+		if (opt.domain) throw new Error("__Host- Cookie must not have Domain attributes");
+	}
+	if (opt && typeof opt.maxAge === "number" && opt.maxAge >= 0) {
+		if (opt.maxAge > 3456e4) throw new Error("Cookies Max-Age SHOULD NOT be greater than 400 days (34560000 seconds) in duration.");
+		cookie += `; Max-Age=${opt.maxAge | 0}`;
+	}
+	if (opt.domain && opt.prefix !== "host") cookie += `; Domain=${opt.domain}`;
+	if (opt.path) cookie += `; Path=${opt.path}`;
+	if (opt.expires) {
+		if (opt.expires.getTime() - Date.now() > 3456e7) throw new Error("Cookies Expires SHOULD NOT be greater than 400 days (34560000 seconds) in the future.");
+		cookie += `; Expires=${opt.expires.toUTCString()}`;
+	}
+	if (opt.httpOnly) cookie += "; HttpOnly";
+	if (opt.secure) cookie += "; Secure";
+	if (opt.sameSite) cookie += `; SameSite=${opt.sameSite.charAt(0).toUpperCase() + opt.sameSite.slice(1)}`;
+	if (opt.priority) cookie += `; Priority=${opt.priority.charAt(0).toUpperCase() + opt.priority.slice(1)}`;
+	if (opt.partitioned) {
+		if (!opt.secure) throw new Error("Partitioned Cookie must have Secure attributes");
+		cookie += "; Partitioned";
+	}
+	return cookie;
+};
+var serialize = (name, value, opt) => {
+	value = encodeURIComponent(value);
+	return _serialize(name, value, opt);
+};
+//#endregion
+//#region node_modules/hono/dist/helper/cookie/index.js
+var getCookie = (c, key, prefix) => {
+	const cookie = c.req.raw.headers.get("Cookie");
+	if (typeof key === "string") {
+		if (!cookie) return;
+		let finalKey = key;
+		if (prefix === "secure") finalKey = "__Secure-" + key;
+		else if (prefix === "host") finalKey = "__Host-" + key;
+		return parse(cookie, finalKey)[finalKey];
+	}
+	if (!cookie) return {};
+	return parse(cookie);
+};
+var generateCookie = (name, value, opt) => {
+	let cookie;
+	if (opt?.prefix === "secure") cookie = serialize("__Secure-" + name, value, {
+		path: "/",
+		...opt,
+		secure: true
+	});
+	else if (opt?.prefix === "host") cookie = serialize("__Host-" + name, value, {
+		...opt,
+		path: "/",
+		secure: true,
+		domain: void 0
+	});
+	else cookie = serialize(name, value, {
+		path: "/",
+		...opt
+	});
+	return cookie;
+};
+var setCookie = (c, name, value, opt) => {
+	const cookie = generateCookie(name, value, opt);
+	c.header("Set-Cookie", cookie, { append: true });
+};
+var deleteCookie = (c, name, opt) => {
+	const deletedCookie = getCookie(c, name, opt?.prefix);
+	setCookie(c, name, "", {
+		...opt,
+		maxAge: 0
+	});
+	return deletedCookie;
+};
+//#endregion
 //#region node_modules/drizzle-orm/selection-proxy.js
 var SelectionProxyHandler = class SelectionProxyHandler {
 	static [entityKind] = "SelectionProxyHandler";
@@ -4269,6 +4393,55 @@ const sqliteTable = (name, columns, extraConfig) => {
 	return sqliteTableBase(name, columns, extraConfig);
 };
 //#endregion
+//#region node_modules/drizzle-orm/sqlite-core/indexes.js
+var IndexBuilderOn = class {
+	constructor(name, unique) {
+		this.name = name;
+		this.unique = unique;
+	}
+	static [entityKind] = "SQLiteIndexBuilderOn";
+	on(...columns) {
+		return new IndexBuilder(this.name, columns, this.unique);
+	}
+};
+var IndexBuilder = class {
+	static [entityKind] = "SQLiteIndexBuilder";
+	/** @internal */
+	config;
+	constructor(name, columns, unique) {
+		this.config = {
+			name,
+			columns,
+			unique,
+			where: void 0
+		};
+	}
+	/**
+	* Condition for partial index.
+	*/
+	where(condition) {
+		this.config.where = condition;
+		return this;
+	}
+	/** @internal */
+	build(table) {
+		return new Index(this.config, table);
+	}
+};
+var Index = class {
+	static [entityKind] = "SQLiteIndex";
+	config;
+	constructor(config, table) {
+		this.config = {
+			...config,
+			table
+		};
+	}
+};
+function uniqueIndex(name) {
+	return new IndexBuilderOn(name, true);
+}
+//#endregion
 //#region node_modules/drizzle-orm/sqlite-core/utils.js
 function extractUsedTable(table) {
 	if (is(table, SQLiteTable)) return [`${table[Table.Symbol.BaseName]}`];
@@ -6633,13 +6806,23 @@ async function saveConfig(config) {
 //#endregion
 //#region src/database/schema.ts
 var schema_exports = /* @__PURE__ */ __exportAll({
+	authConfig: () => authConfig,
 	episodes: () => episodes,
+	favorites: () => favorites,
 	libraries: () => libraries,
 	movies: () => movies,
+	profiles: () => profiles,
 	seasons: () => seasons,
+	sessions: () => sessions$1,
 	shows: () => shows,
 	watchProgress: () => watchProgress
 });
+const profiles = sqliteTable("profiles", {
+	id: integer("id").primaryKey({ autoIncrement: true }),
+	name: text("name").notNull().unique(),
+	emoji: text("emoji").notNull(),
+	createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+});
 const libraries = sqliteTable("libraries", {
 	id: integer("id").primaryKey({ autoIncrement: true }),
 	name: text("name").notNull(),
@@ -6709,23 +6892,600 @@ const episodes = sqliteTable("episodes", {
 });
 const watchProgress = sqliteTable("watch_progress", {
 	id: integer("id").primaryKey({ autoIncrement: true }),
+	profileId: integer("profile_id").notNull().references(() => profiles.id, { onDelete: "cascade" }),
 	movieId: integer("movie_id").references(() => movies.id),
 	episodeId: integer("episode_id").references(() => episodes.id),
 	currentTime: integer("current_time").notNull(),
 	duration: integer("duration"),
 	updatedAt: integer("updated_at", { mode: "timestamp" }).notNull()
+}, (table) => [uniqueIndex("watch_progress_profile_movie_idx").on(table.profileId, table.movieId), uniqueIndex("watch_progress_profile_episode_idx").on(table.profileId, table.episodeId)]);
+const favorites = sqliteTable("favorites", {
+	id: integer("id").primaryKey({ autoIncrement: true }),
+	profileId: integer("profile_id").notNull().references(() => profiles.id, { onDelete: "cascade" }),
+	movieId: integer("movie_id").references(() => movies.id, { onDelete: "cascade" }),
+	showId: integer("show_id").references(() => shows.id, { onDelete: "cascade" }),
+	createdAt: integer("created_at", { mode: "timestamp" }).notNull()
+}, (table) => [uniqueIndex("favorites_profile_movie_idx").on(table.profileId, table.movieId), uniqueIndex("favorites_profile_show_idx").on(table.profileId, table.showId)]);
+const authConfig = sqliteTable("auth_config", {
+	id: integer("id").primaryKey(),
+	passwordHash: text("password_hash"),
+	updatedAt: integer("updated_at").notNull()
+});
+const sessions$1 = sqliteTable("sessions", {
+	id: text("id").primaryKey(),
+	createdAt: integer("created_at").notNull(),
+	expiresAt: integer("expires_at").notNull(),
+	lastSeenAt: integer("last_seen_at").notNull(),
+	userAgent: text("user_agent")
 });
 //#endregion
 //#region src/database/index.ts
 ensureConfigDirectory();
 const sqlite = new Database(databasePath);
 const db = drizzle(sqlite, { schema: schema_exports });
-const __dirname$1 = path.dirname(fileURLToPath(import.meta.url));
-migrate(db, { migrationsFolder: path.resolve(__dirname$1, "../../drizzle") });
+const __dirname$2 = path.dirname(fileURLToPath(import.meta.url));
+migrate(db, { migrationsFolder: path.resolve(__dirname$2, "../../drizzle") });
+//#endregion
+//#region node_modules/tiny-invariant/dist/esm/tiny-invariant.js
+var import_dayjs_min = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exports, module) => {
+	(function(t, e) {
+		"object" == typeof exports && "undefined" != typeof module ? module.exports = e() : "function" == typeof define && define.amd ? define(e) : (t = "undefined" != typeof globalThis ? globalThis : t || self).dayjs = e();
+	})(exports, (function() {
+		"use strict";
+		var t = 1e3, e = 6e4, n = 36e5, r = "millisecond", i = "second", s = "minute", u = "hour", a = "day", o = "week", c = "month", f = "quarter", h = "year", d = "date", l = "Invalid Date", $ = /^(\d{4})[-/]?(\d{1,2})?[-/]?(\d{0,2})[Tt\s]*(\d{1,2})?:?(\d{1,2})?:?(\d{1,2})?[.:]?(\d+)?$/, y = /\[([^\]]+)]|Y{1,4}|M{1,4}|D{1,2}|d{1,4}|H{1,2}|h{1,2}|a|A|m{1,2}|s{1,2}|Z{1,2}|SSS/g, M = {
+			name: "en",
+			weekdays: "Sunday_Monday_Tuesday_Wednesday_Thursday_Friday_Saturday".split("_"),
+			months: "January_February_March_April_May_June_July_August_September_October_November_December".split("_"),
+			ordinal: function(t) {
+				var e = [
+					"th",
+					"st",
+					"nd",
+					"rd"
+				], n = t % 100;
+				return "[" + t + (e[(n - 20) % 10] || e[n] || e[0]) + "]";
+			}
+		}, m = function(t, e, n) {
+			var r = String(t);
+			return !r || r.length >= e ? t : "" + Array(e + 1 - r.length).join(n) + t;
+		}, v = {
+			s: m,
+			z: function(t) {
+				var e = -t.utcOffset(), n = Math.abs(e), r = Math.floor(n / 60), i = n % 60;
+				return (e <= 0 ? "+" : "-") + m(r, 2, "0") + ":" + m(i, 2, "0");
+			},
+			m: function t(e, n) {
+				if (e.date() < n.date()) return -t(n, e);
+				var r = 12 * (n.year() - e.year()) + (n.month() - e.month()), i = e.clone().add(r, c), s = n - i < 0, u = e.clone().add(r + (s ? -1 : 1), c);
+				return +(-(r + (n - i) / (s ? i - u : u - i)) || 0);
+			},
+			a: function(t) {
+				return t < 0 ? Math.ceil(t) || 0 : Math.floor(t);
+			},
+			p: function(t) {
+				return {
+					M: c,
+					y: h,
+					w: o,
+					d: a,
+					D: d,
+					h: u,
+					m: s,
+					s: i,
+					ms: r,
+					Q: f
+				}[t] || String(t || "").toLowerCase().replace(/s$/, "");
+			},
+			u: function(t) {
+				return void 0 === t;
+			}
+		}, g = "en", D = {};
+		D[g] = M;
+		var p = "$isDayjsObject", S = function(t) {
+			return t instanceof _ || !(!t || !t[p]);
+		}, w = function t(e, n, r) {
+			var i;
+			if (!e) return g;
+			if ("string" == typeof e) {
+				var s = e.toLowerCase();
+				D[s] && (i = s), n && (D[s] = n, i = s);
+				var u = e.split("-");
+				if (!i && u.length > 1) return t(u[0]);
+			} else {
+				var a = e.name;
+				D[a] = e, i = a;
+			}
+			return !r && i && (g = i), i || !r && g;
+		}, O = function(t, e) {
+			if (S(t)) return t.clone();
+			var n = "object" == typeof e ? e : {};
+			return n.date = t, n.args = arguments, new _(n);
+		}, b = v;
+		b.l = w, b.i = S, b.w = function(t, e) {
+			return O(t, {
+				locale: e.$L,
+				utc: e.$u,
+				x: e.$x,
+				$offset: e.$offset
+			});
+		};
+		var _ = function() {
+			function M(t) {
+				this.$L = w(t.locale, null, !0), this.parse(t), this.$x = this.$x || t.x || {}, this[p] = !0;
+			}
+			var m = M.prototype;
+			return m.parse = function(t) {
+				this.$d = function(t) {
+					var e = t.date, n = t.utc;
+					if (null === e) return /* @__PURE__ */ new Date(NaN);
+					if (b.u(e)) return /* @__PURE__ */ new Date();
+					if (e instanceof Date) return new Date(e);
+					if ("string" == typeof e && !/Z$/i.test(e)) {
+						var r = e.match($);
+						if (r) {
+							var i = r[2] - 1 || 0, s = (r[7] || "0").substring(0, 3);
+							return n ? new Date(Date.UTC(r[1], i, r[3] || 1, r[4] || 0, r[5] || 0, r[6] || 0, s)) : new Date(r[1], i, r[3] || 1, r[4] || 0, r[5] || 0, r[6] || 0, s);
+						}
+					}
+					return new Date(e);
+				}(t), this.init();
+			}, m.init = function() {
+				var t = this.$d;
+				this.$y = t.getFullYear(), this.$M = t.getMonth(), this.$D = t.getDate(), this.$W = t.getDay(), this.$H = t.getHours(), this.$m = t.getMinutes(), this.$s = t.getSeconds(), this.$ms = t.getMilliseconds();
+			}, m.$utils = function() {
+				return b;
+			}, m.isValid = function() {
+				return !(this.$d.toString() === l);
+			}, m.isSame = function(t, e) {
+				var n = O(t);
+				return this.startOf(e) <= n && n <= this.endOf(e);
+			}, m.isAfter = function(t, e) {
+				return O(t) < this.startOf(e);
+			}, m.isBefore = function(t, e) {
+				return this.endOf(e) < O(t);
+			}, m.$g = function(t, e, n) {
+				return b.u(t) ? this[e] : this.set(n, t);
+			}, m.unix = function() {
+				return Math.floor(this.valueOf() / 1e3);
+			}, m.valueOf = function() {
+				return this.$d.getTime();
+			}, m.startOf = function(t, e) {
+				var n = this, r = !!b.u(e) || e, f = b.p(t), l = function(t, e) {
+					var i = b.w(n.$u ? Date.UTC(n.$y, e, t) : new Date(n.$y, e, t), n);
+					return r ? i : i.endOf(a);
+				}, $ = function(t, e) {
+					return b.w(n.toDate()[t].apply(n.toDate("s"), (r ? [
+						0,
+						0,
+						0,
+						0
+					] : [
+						23,
+						59,
+						59,
+						999
+					]).slice(e)), n);
+				}, y = this.$W, M = this.$M, m = this.$D, v = "set" + (this.$u ? "UTC" : "");
+				switch (f) {
+					case h: return r ? l(1, 0) : l(31, 11);
+					case c: return r ? l(1, M) : l(0, M + 1);
+					case o:
+						var g = this.$locale().weekStart || 0, D = (y < g ? y + 7 : y) - g;
+						return l(r ? m - D : m + (6 - D), M);
+					case a:
+					case d: return $(v + "Hours", 0);
+					case u: return $(v + "Minutes", 1);
+					case s: return $(v + "Seconds", 2);
+					case i: return $(v + "Milliseconds", 3);
+					default: return this.clone();
+				}
+			}, m.endOf = function(t) {
+				return this.startOf(t, !1);
+			}, m.$set = function(t, e) {
+				var n, o = b.p(t), f = "set" + (this.$u ? "UTC" : ""), l = (n = {}, n[a] = f + "Date", n[d] = f + "Date", n[c] = f + "Month", n[h] = f + "FullYear", n[u] = f + "Hours", n[s] = f + "Minutes", n[i] = f + "Seconds", n[r] = f + "Milliseconds", n)[o], $ = o === a ? this.$D + (e - this.$W) : e;
+				if (o === c || o === h) {
+					var y = this.clone().set(d, 1);
+					y.$d[l]($), y.init(), this.$d = y.set(d, Math.min(this.$D, y.daysInMonth())).$d;
+				} else l && this.$d[l]($);
+				return this.init(), this;
+			}, m.set = function(t, e) {
+				return this.clone().$set(t, e);
+			}, m.get = function(t) {
+				return this[b.p(t)]();
+			}, m.add = function(r, f) {
+				var d, l = this;
+				r = Number(r);
+				var $ = b.p(f), y = function(t) {
+					var e = O(l);
+					return b.w(e.date(e.date() + Math.round(t * r)), l);
+				};
+				if ($ === c) return this.set(c, this.$M + r);
+				if ($ === h) return this.set(h, this.$y + r);
+				if ($ === a) return y(1);
+				if ($ === o) return y(7);
+				var M = (d = {}, d[s] = e, d[u] = n, d[i] = t, d)[$] || 1, m = this.$d.getTime() + r * M;
+				return b.w(m, this);
+			}, m.subtract = function(t, e) {
+				return this.add(-1 * t, e);
+			}, m.format = function(t) {
+				var e = this, n = this.$locale();
+				if (!this.isValid()) return n.invalidDate || l;
+				var r = t || "YYYY-MM-DDTHH:mm:ssZ", i = b.z(this), s = this.$H, u = this.$m, a = this.$M, o = n.weekdays, c = n.months, f = n.meridiem, h = function(t, n, i, s) {
+					return t && (t[n] || t(e, r)) || i[n].slice(0, s);
+				}, d = function(t) {
+					return b.s(s % 12 || 12, t, "0");
+				}, $ = f || function(t, e, n) {
+					var r = t < 12 ? "AM" : "PM";
+					return n ? r.toLowerCase() : r;
+				};
+				return r.replace(y, (function(t, r) {
+					return r || function(t) {
+						switch (t) {
+							case "YY": return String(e.$y).slice(-2);
+							case "YYYY": return b.s(e.$y, 4, "0");
+							case "M": return a + 1;
+							case "MM": return b.s(a + 1, 2, "0");
+							case "MMM": return h(n.monthsShort, a, c, 3);
+							case "MMMM": return h(c, a);
+							case "D": return e.$D;
+							case "DD": return b.s(e.$D, 2, "0");
+							case "d": return String(e.$W);
+							case "dd": return h(n.weekdaysMin, e.$W, o, 2);
+							case "ddd": return h(n.weekdaysShort, e.$W, o, 3);
+							case "dddd": return o[e.$W];
+							case "H": return String(s);
+							case "HH": return b.s(s, 2, "0");
+							case "h": return d(1);
+							case "hh": return d(2);
+							case "a": return $(s, u, !0);
+							case "A": return $(s, u, !1);
+							case "m": return String(u);
+							case "mm": return b.s(u, 2, "0");
+							case "s": return String(e.$s);
+							case "ss": return b.s(e.$s, 2, "0");
+							case "SSS": return b.s(e.$ms, 3, "0");
+							case "Z": return i;
+						}
+						return null;
+					}(t) || i.replace(":", "");
+				}));
+			}, m.utcOffset = function() {
+				return 15 * -Math.round(this.$d.getTimezoneOffset() / 15);
+			}, m.diff = function(r, d, l) {
+				var $, y = this, M = b.p(d), m = O(r), v = (m.utcOffset() - this.utcOffset()) * e, g = this - m, D = function() {
+					return b.m(y, m);
+				};
+				switch (M) {
+					case h:
+						$ = D() / 12;
+						break;
+					case c:
+						$ = D();
+						break;
+					case f:
+						$ = D() / 3;
+						break;
+					case o:
+						$ = (g - v) / 6048e5;
+						break;
+					case a:
+						$ = (g - v) / 864e5;
+						break;
+					case u:
+						$ = g / n;
+						break;
+					case s:
+						$ = g / e;
+						break;
+					case i:
+						$ = g / t;
+						break;
+					default: $ = g;
+				}
+				return l ? $ : b.a($);
+			}, m.daysInMonth = function() {
+				return this.endOf(c).$D;
+			}, m.$locale = function() {
+				return D[this.$L];
+			}, m.locale = function(t, e) {
+				if (!t) return this.$L;
+				var n = this.clone(), r = w(t, e, !0);
+				return r && (n.$L = r), n;
+			}, m.clone = function() {
+				return b.w(this.$d, this);
+			}, m.toDate = function() {
+				return new Date(this.valueOf());
+			}, m.toJSON = function() {
+				return this.isValid() ? this.toISOString() : null;
+			}, m.toISOString = function() {
+				return this.$d.toISOString();
+			}, m.toString = function() {
+				return this.$d.toUTCString();
+			}, M;
+		}(), k = _.prototype;
+		return O.prototype = k, [
+			["$ms", r],
+			["$s", i],
+			["$m", s],
+			["$H", u],
+			["$W", a],
+			["$M", c],
+			["$y", h],
+			["$D", d]
+		].forEach((function(t) {
+			k[t[1]] = function(e) {
+				return this.$g(e, t[0], t[1]);
+			};
+		})), O.extend = function(t, e) {
+			return t.$i || (t(e, _, O), t.$i = !0), O;
+		}, O.locale = w, O.isDayjs = S, O.unix = function(t) {
+			return O(1e3 * t);
+		}, O.en = D[g], O.Ls = D, O.p = {}, O;
+	}));
+})))(), 1);
+var isProduction = process.env.NODE_ENV === "production";
+var prefix = "Invariant failed";
+function invariant(condition, message) {
+	if (condition) return;
+	if (isProduction) throw new Error(prefix);
+	var provided = typeof message === "function" ? message() : message;
+	var value = provided ? "".concat(prefix, ": ").concat(provided) : prefix;
+	throw new Error(value);
+}
+//#endregion
+//#region src/api/routes/auth.ts
+const scryptAsync = promisify(scrypt);
+const sessionCookieName = "jukebox_session";
+const rateLimitWindowMs = 900 * 1e3;
+const rateLimitBuckets = /* @__PURE__ */ new Map();
+function clientIp(headers) {
+	const forwarded = headers.get("x-forwarded-for");
+	if (forwarded) {
+		const first = forwarded.split(",")[0]?.trim();
+		if (first) return first;
+	}
+	return headers.get("x-real-ip") ?? "unknown";
+}
+function checkRateLimit(ip) {
+	const now = Date.now();
+	const cutoff = now - rateLimitWindowMs;
+	const entry = rateLimitBuckets.get(ip) ?? { attempts: [] };
+	entry.attempts = entry.attempts.filter((time) => time > cutoff);
+	if (entry.attempts.length >= 5) {
+		const retryAfterMs = (entry.attempts[0] ?? now) + rateLimitWindowMs - now;
+		const retryAfterSeconds = Math.max(1, Math.ceil(retryAfterMs / 1e3));
+		rateLimitBuckets.set(ip, entry);
+		return {
+			allowed: false,
+			retryAfterSeconds
+		};
+	}
+	rateLimitBuckets.set(ip, entry);
+	return {
+		allowed: true,
+		retryAfterSeconds: 0
+	};
+}
+function recordFailedAttempt(ip) {
+	const entry = rateLimitBuckets.get(ip) ?? { attempts: [] };
+	entry.attempts.push(Date.now());
+	rateLimitBuckets.set(ip, entry);
+}
+function clearAttempts(ip) {
+	rateLimitBuckets.delete(ip);
+}
+async function loadAuthConfig() {
+	const [existing] = await db.select().from(authConfig).where(eq(authConfig.id, 1)).limit(1);
+	if (existing) return existing;
+	const [created] = await db.insert(authConfig).values({
+		id: 1,
+		passwordHash: null,
+		updatedAt: Date.now()
+	}).returning();
+	invariant(created, "Failed to initialize auth config.");
+	return created;
+}
+const scryptKeyLength = 64;
+async function hashPassword(password) {
+	const salt = randomBytes(16);
+	const derived = await scryptAsync(password, salt, scryptKeyLength);
+	return `scrypt$${salt.toString("base64")}$${derived.toString("base64")}`;
+}
+async function verifyPassword(password, stored) {
+	const parts = stored.split("$");
+	if (parts.length !== 3 || parts[0] !== "scrypt") return false;
+	try {
+		const salt = Buffer.from(parts[1] ?? "", "base64");
+		const expected = Buffer.from(parts[2] ?? "", "base64");
+		const derived = await scryptAsync(password, salt, expected.length);
+		if (derived.length !== expected.length) return false;
+		return timingSafeEqual(derived, expected);
+	} catch {
+		return false;
+	}
+}
+function createSessionToken() {
+	return randomBytes(32).toString("base64url");
+}
+async function createSession(userAgent) {
+	const now = (0, import_dayjs_min.default)();
+	const token = createSessionToken();
+	await db.insert(sessions$1).values({
+		id: token,
+		createdAt: now.valueOf(),
+		expiresAt: now.add(30, "day").valueOf(),
+		lastSeenAt: now.valueOf(),
+		userAgent
+	});
+	return token;
+}
+async function deleteAllSessions() {
+	await db.delete(sessions$1);
+}
+async function deleteSession(id) {
+	await db.delete(sessions$1).where(eq(sessions$1.id, id));
+}
+function sessionCookieOptions() {
+	return {
+		httpOnly: true,
+		maxAge: 720 * 60 * 60,
+		path: "/",
+		sameSite: "Lax",
+		secure: process.env.NODE_ENV === "production"
+	};
+}
+const authRoutes = new Hono();
+authRoutes.get("/status", async (context) => {
+	if (!((await loadAuthConfig()).passwordHash !== null)) return context.json({
+		enabled: false,
+		authenticated: true
+	});
+	const cookie = getCookie(context, sessionCookieName);
+	if (!cookie) return context.json({
+		enabled: true,
+		authenticated: false
+	});
+	const [session] = await db.select().from(sessions$1).where(eq(sessions$1.id, cookie)).limit(1);
+	const authenticated = session !== void 0 && session.expiresAt > Date.now();
+	return context.json({
+		enabled: true,
+		authenticated
+	});
+});
+authRoutes.post("/login", async (context) => {
+	const ip = clientIp(context.req.raw.headers);
+	const limit = checkRateLimit(ip);
+	if (!limit.allowed) {
+		const minutes = Math.ceil(limit.retryAfterSeconds / 60);
+		context.header("Retry-After", String(limit.retryAfterSeconds));
+		return context.json({ error: { message: `Too many attempts. Try again in ${minutes} ${minutes === 1 ? "minute" : "minutes"}.` } }, 429);
+	}
+	let body;
+	try {
+		body = await context.req.json();
+	} catch {
+		return context.json({ error: { message: "Invalid request body." } }, 400);
+	}
+	const password = typeof body.password === "string" ? body.password : "";
+	if (password.length === 0) return context.json({ error: { message: "Incorrect password." } }, 401);
+	const config = await loadAuthConfig();
+	if (config.passwordHash === null) return context.json({ error: { message: "Password login is disabled on this server." } }, 400);
+	if (!await verifyPassword(password, config.passwordHash)) {
+		recordFailedAttempt(ip);
+		return context.json({ error: { message: "Incorrect password." } }, 401);
+	}
+	clearAttempts(ip);
+	setCookie(context, sessionCookieName, await createSession(context.req.header("user-agent") ?? null), sessionCookieOptions());
+	return context.body(null, 204);
+});
+authRoutes.post("/logout", async (context) => {
+	const token = getCookie(context, sessionCookieName);
+	if (token) await deleteSession(token);
+	deleteCookie(context, sessionCookieName, { path: "/" });
+	return context.body(null, 204);
+});
+authRoutes.post("/password", async (context) => {
+	let body;
+	try {
+		body = await context.req.json();
+	} catch {
+		return context.json({ error: { message: "Invalid request body." } }, 400);
+	}
+	const newPassword = typeof body.newPassword === "string" ? body.newPassword : "";
+	const currentPassword = typeof body.currentPassword === "string" ? body.currentPassword : "";
+	const config = await loadAuthConfig();
+	if (config.passwordHash !== null) {
+		if (!await verifyPassword(currentPassword, config.passwordHash ?? "")) return context.json({ error: { message: "Current password is incorrect." } }, 401);
+	}
+	if (newPassword.length === 0) {
+		await db.update(authConfig).set({
+			passwordHash: null,
+			updatedAt: Date.now()
+		}).where(eq(authConfig.id, 1));
+		await deleteAllSessions();
+		deleteCookie(context, sessionCookieName, { path: "/" });
+		return context.json({ enabled: false });
+	}
+	if (newPassword.length < 8) return context.json({ error: { message: `Choose a password of at least 8 characters.` } }, 400);
+	const hash = await hashPassword(newPassword);
+	await db.update(authConfig).set({
+		passwordHash: hash,
+		updatedAt: Date.now()
+	}).where(eq(authConfig.id, 1));
+	await deleteAllSessions();
+	setCookie(context, sessionCookieName, await createSession(context.req.header("user-agent") ?? null), sessionCookieOptions());
+	return context.json({ enabled: true });
+});
+//#endregion
+//#region src/api/middleware/auth.ts
+const lastSeenThrottleMs = 60 * 1e3;
+let lastSweepAt = 0;
+const sweepIntervalMs = 300 * 1e3;
+async function sweepExpiredSessions(now) {
+	if (now - lastSweepAt < sweepIntervalMs) return;
+	lastSweepAt = now;
+	await db.delete(sessions$1).where(lt(sessions$1.expiresAt, now));
+}
+const authMiddleware = createMiddleware(async (context, next) => {
+	const pathname = new URL(context.req.url).pathname;
+	if (pathname.startsWith("/api/auth") || pathname.startsWith("/api/setup")) return next();
+	const [config] = await db.select().from(authConfig).where(eq(authConfig.id, 1)).limit(1);
+	if (!config || config.passwordHash === null) return next();
+	const token = getCookie(context, sessionCookieName);
+	if (!token) return context.json({ error: { message: "Authentication required." } }, 401);
+	const [session] = await db.select().from(sessions$1).where(eq(sessions$1.id, token)).limit(1);
+	const now = Date.now();
+	await sweepExpiredSessions(now);
+	if (!session || session.expiresAt <= now) {
+		if (session) await db.delete(sessions$1).where(eq(sessions$1.id, session.id));
+		return context.json({ error: { message: "Your session has expired. Please sign in again." } }, 401);
+	}
+	if (now - session.lastSeenAt > lastSeenThrottleMs) await db.update(sessions$1).set({ lastSeenAt: now }).where(eq(sessions$1.id, session.id));
+	return next();
+});
+//#endregion
+//#region src/api/middleware/profile.ts
+const profileCookieName = "jukebox_profile_id";
+const oneYearSeconds = 3600 * 24 * 365;
+function setProfileCookie(context, profileId) {
+	setCookie(context, profileCookieName, String(profileId), {
+		httpOnly: true,
+		maxAge: oneYearSeconds,
+		path: "/",
+		sameSite: "Lax"
+	});
+}
+async function readProfileFromCookie(rawCookieValue) {
+	if (!rawCookieValue) return null;
+	const parsedId = parseInt(rawCookieValue, 10);
+	if (isNaN(parsedId)) return null;
+	const [profile] = await db.select().from(profiles).where(eq(profiles.id, parsedId)).limit(1);
+	return profile ?? null;
+}
+async function fallbackProfile() {
+	const [latest] = await db.select().from(profiles).orderBy(desc(profiles.createdAt)).limit(1);
+	if (latest) return latest;
+	const now = /* @__PURE__ */ new Date();
+	const [created] = await db.insert(profiles).values({
+		name: "Default",
+		emoji: "🍿",
+		createdAt: now
+	}).returning();
+	if (!created) throw new Error("Failed to create default profile");
+	return created;
+}
+const profileMiddleware = createMiddleware(async (context, next) => {
+	const fromCookie = await readProfileFromCookie(getCookie(context, profileCookieName));
+	const profile = fromCookie ?? await fallbackProfile();
+	if (!fromCookie || fromCookie.id !== profile.id) setProfileCookie(context, profile.id);
+	context.set("profileId", profile.id);
+	await next();
+});
 //#endregion
 //#region src/api/routes/episode-progress.ts
 const episodeProgressRoutes = new Hono();
 episodeProgressRoutes.get("/show/:showId", async (context) => {
+	const profileId = context.get("profileId");
 	const showId = parseInt(context.req.param("showId"), 10);
 	if (isNaN(showId)) return context.json({ error: { message: "Invalid show ID" } }, 400);
 	const episodeIds = (await db.select({ id: episodes.id }).from(episodes).where(eq(episodes.showId, showId))).map((episode) => episode.id);
@@ -6735,7 +7495,7 @@ episodeProgressRoutes.get("/show/:showId", async (context) => {
 		currentTime: watchProgress.currentTime,
 		duration: watchProgress.duration,
 		updatedAt: watchProgress.updatedAt
-	}).from(watchProgress).where(and(inArray(watchProgress.episodeId, episodeIds), gt(watchProgress.currentTime, 0)));
+	}).from(watchProgress).where(and(eq(watchProgress.profileId, profileId), inArray(watchProgress.episodeId, episodeIds), gt(watchProgress.currentTime, 0)));
 	const progressMap = {};
 	for (const row of progressRows) if (row.episodeId !== null) progressMap[row.episodeId] = {
 		currentTime: row.currentTime,
@@ -6745,9 +7505,10 @@ episodeProgressRoutes.get("/show/:showId", async (context) => {
 	return context.json(progressMap);
 });
 episodeProgressRoutes.get("/:episodeId", async (context) => {
+	const profileId = context.get("profileId");
 	const episodeId = parseInt(context.req.param("episodeId"), 10);
 	if (isNaN(episodeId)) return context.json({ error: { message: "Invalid episode ID" } }, 400);
-	const [progress] = await db.select().from(watchProgress).where(eq(watchProgress.episodeId, episodeId)).limit(1);
+	const [progress] = await db.select().from(watchProgress).where(and(eq(watchProgress.profileId, profileId), eq(watchProgress.episodeId, episodeId))).limit(1);
 	if (!progress) return context.json({
 		currentTime: 0,
 		duration: null
@@ -6758,18 +7519,20 @@ episodeProgressRoutes.get("/:episodeId", async (context) => {
 	});
 });
 episodeProgressRoutes.put("/:episodeId", async (context) => {
+	const profileId = context.get("profileId");
 	const episodeId = parseInt(context.req.param("episodeId"), 10);
 	if (isNaN(episodeId)) return context.json({ error: { message: "Invalid episode ID" } }, 400);
 	const body = await context.req.json();
 	if (typeof body.currentTime !== "number") return context.json({ error: { message: "currentTime is required" } }, 400);
-	const [existing] = await db.select().from(watchProgress).where(eq(watchProgress.episodeId, episodeId)).limit(1);
+	const [existing] = await db.select().from(watchProgress).where(and(eq(watchProgress.profileId, profileId), eq(watchProgress.episodeId, episodeId))).limit(1);
 	const now = /* @__PURE__ */ new Date();
 	if (existing) await db.update(watchProgress).set({
 		currentTime: Math.floor(body.currentTime),
 		duration: body.duration ? Math.floor(body.duration) : existing.duration,
 		updatedAt: now
-	}).where(eq(watchProgress.episodeId, episodeId));
+	}).where(eq(watchProgress.id, existing.id));
 	else await db.insert(watchProgress).values({
+		profileId,
 		episodeId,
 		currentTime: Math.floor(body.currentTime),
 		duration: body.duration ? Math.floor(body.duration) : null,
@@ -6778,17 +7541,6 @@ episodeProgressRoutes.put("/:episodeId", async (context) => {
 	return context.json({ success: true });
 });
 //#endregion
-//#region node_modules/tiny-invariant/dist/esm/tiny-invariant.js
-var isProduction = process.env.NODE_ENV === "production";
-var prefix = "Invariant failed";
-function invariant(condition, message) {
-	if (condition) return;
-	if (isProduction) throw new Error(prefix);
-	var provided = typeof message === "function" ? message() : message;
-	var value = provided ? "".concat(prefix, ": ").concat(provided) : prefix;
-	throw new Error(value);
-}
-//#endregion
 //#region src/api/routes/episode-stream.ts
 const mimeTypes$1 = {
 	".avi": "video/x-msvideo",
@@ -6856,8 +7608,8 @@ helloRoutes.get("/:name", (c) => c.json({ message: `Hello, ${c.req.param("name")
 //#region src/api/routes/library.ts
 const libraryRoutes = new Hono();
 libraryRoutes.get("/movies", async (c) => {
-	const movies$2 = await db.select().from(movies).orderBy(movies.title);
-	return c.json(movies$2);
+	const movies$3 = await db.select().from(movies).orderBy(movies.title);
+	return c.json(movies$3);
 });
 libraryRoutes.get("/movies/:id", async (c) => {
 	const id = parseInt(c.req.param("id"), 10);
@@ -6870,7 +7622,8 @@ libraryRoutes.get("/movies/:id", async (c) => {
 //#region src/api/routes/progress.ts
 const progressRoutes = new Hono();
 progressRoutes.get("/continue-watching", async (context) => {
-	const inProgressFilter = and(gt(watchProgress.currentTime, 0), sql`(${watchProgress.duration} IS NULL OR ${watchProgress.currentTime} < ${watchProgress.duration} * 0.9)`);
+	const profileId = context.get("profileId");
+	const inProgressFilter = and(eq(watchProgress.profileId, profileId), gt(watchProgress.currentTime, 0), sql`(${watchProgress.duration} IS NULL OR ${watchProgress.currentTime} < ${watchProgress.duration} * 0.9)`);
 	const movieResults = await db.select({
 		currentTime: watchProgress.currentTime,
 		duration: watchProgress.duration,
@@ -6884,7 +7637,7 @@ progressRoutes.get("/continue-watching", async (context) => {
 		show: shows,
 		updatedAt: watchProgress.updatedAt
 	}).from(watchProgress).innerJoin(episodes, eq(watchProgress.episodeId, episodes.id)).innerJoin(shows, eq(episodes.showId, shows.id)).where(inProgressFilter);
-	const movies$1 = movieResults.map((result) => ({
+	const movies$2 = movieResults.map((result) => ({
 		...result,
 		type: "movie"
 	}));
@@ -6892,13 +7645,14 @@ progressRoutes.get("/continue-watching", async (context) => {
 		...result,
 		type: "episode"
 	}));
-	const combined = [...movies$1, ...episodes$2].sort((a, b) => b.updatedAt.getTime() - a.updatedAt.getTime()).slice(0, 20);
+	const combined = [...movies$2, ...episodes$2].sort((a, b) => b.updatedAt.getTime() - a.updatedAt.getTime()).slice(0, 20);
 	return context.json(combined);
 });
 progressRoutes.get("/:movieId", async (c) => {
+	const profileId = c.get("profileId");
 	const movieId = parseInt(c.req.param("movieId"), 10);
 	if (isNaN(movieId)) return c.json({ error: { message: "Invalid movie ID" } }, 400);
-	const [progress] = await db.select().from(watchProgress).where(eq(watchProgress.movieId, movieId)).limit(1);
+	const [progress] = await db.select().from(watchProgress).where(and(eq(watchProgress.profileId, profileId), eq(watchProgress.movieId, movieId))).limit(1);
 	if (!progress) return c.json({
 		currentTime: 0,
 		duration: null
@@ -6909,18 +7663,20 @@ progressRoutes.get("/:movieId", async (c) => {
 	});
 });
 progressRoutes.put("/:movieId", async (c) => {
+	const profileId = c.get("profileId");
 	const movieId = parseInt(c.req.param("movieId"), 10);
 	if (isNaN(movieId)) return c.json({ error: { message: "Invalid movie ID" } }, 400);
 	const body = await c.req.json();
 	if (typeof body.currentTime !== "number") return c.json({ error: { message: "currentTime is required" } }, 400);
-	const [existing] = await db.select().from(watchProgress).where(eq(watchProgress.movieId, movieId)).limit(1);
+	const [existing] = await db.select().from(watchProgress).where(and(eq(watchProgress.profileId, profileId), eq(watchProgress.movieId, movieId))).limit(1);
 	const now = /* @__PURE__ */ new Date();
 	if (existing) await db.update(watchProgress).set({
 		currentTime: Math.floor(body.currentTime),
 		duration: body.duration ? Math.floor(body.duration) : existing.duration,
 		updatedAt: now
-	}).where(eq(watchProgress.movieId, movieId));
+	}).where(eq(watchProgress.id, existing.id));
 	else await db.insert(watchProgress).values({
+		profileId,
 		movieId,
 		currentTime: Math.floor(body.currentTime),
 		duration: body.duration ? Math.floor(body.duration) : null,
@@ -7850,6 +8606,157 @@ setupRoutes.post("/complete", async (context) => {
 	return context.json({ success: true });
 });
 //#endregion
+//#region src/api/routes/profiles.ts
+const profileRoutes = new Hono();
+profileRoutes.get("/", async (context) => {
+	const profiles$1 = await db.select().from(profiles).orderBy(desc(profiles.createdAt));
+	return context.json(profiles$1);
+});
+profileRoutes.get("/active", async (context) => {
+	const profileId = context.get("profileId");
+	const [profile] = await db.select().from(profiles).where(eq(profiles.id, profileId)).limit(1);
+	if (!profile) return context.json({ error: { message: "Active profile not found" } }, 404);
+	return context.json(profile);
+});
+profileRoutes.post("/", async (context) => {
+	const body = await context.req.json();
+	const name = body.name?.trim();
+	const emoji = body.emoji?.trim();
+	if (!name || !emoji) return context.json({ error: { message: "name and emoji are required" } }, 400);
+	const now = /* @__PURE__ */ new Date();
+	try {
+		const [created] = await db.insert(profiles).values({
+			name,
+			emoji,
+			createdAt: now
+		}).returning();
+		return context.json(created, 201);
+	} catch (error) {
+		const message = error instanceof Error && error.message.includes("UNIQUE") ? "A profile with that name already exists" : "Failed to create profile";
+		return context.json({ error: { message } }, 400);
+	}
+});
+profileRoutes.patch("/:id", async (context) => {
+	const id = parseInt(context.req.param("id"), 10);
+	if (isNaN(id)) return context.json({ error: { message: "Invalid profile id" } }, 400);
+	const body = await context.req.json();
+	const updates = {};
+	if (typeof body.name === "string" && body.name.trim()) updates.name = body.name.trim();
+	if (typeof body.emoji === "string" && body.emoji.trim()) updates.emoji = body.emoji.trim();
+	if (Object.keys(updates).length === 0) return context.json({ error: { message: "Nothing to update" } }, 400);
+	try {
+		const [updated] = await db.update(profiles).set(updates).where(eq(profiles.id, id)).returning();
+		if (!updated) return context.json({ error: { message: "Profile not found" } }, 404);
+		return context.json(updated);
+	} catch (error) {
+		const message = error instanceof Error && error.message.includes("UNIQUE") ? "A profile with that name already exists" : "Failed to update profile";
+		return context.json({ error: { message } }, 400);
+	}
+});
+profileRoutes.delete("/:id", async (context) => {
+	const id = parseInt(context.req.param("id"), 10);
+	if (isNaN(id)) return context.json({ error: { message: "Invalid profile id" } }, 400);
+	const all = await db.select({ id: profiles.id }).from(profiles);
+	if (all.length <= 1) return context.json({ error: { message: "Cannot delete the last remaining profile" } }, 400);
+	await db.delete(profiles).where(eq(profiles.id, id));
+	if (context.get("profileId") === id) {
+		const next = all.find((profile) => profile.id !== id);
+		if (next) setProfileCookie(context, next.id);
+	}
+	return context.json({ success: true });
+});
+profileRoutes.post("/:id/activate", async (context) => {
+	const id = parseInt(context.req.param("id"), 10);
+	if (isNaN(id)) return context.json({ error: { message: "Invalid profile id" } }, 400);
+	const [profile] = await db.select().from(profiles).where(eq(profiles.id, id)).limit(1);
+	if (!profile) return context.json({ error: { message: "Profile not found" } }, 404);
+	setProfileCookie(context, profile.id);
+	return context.json(profile);
+});
+//#endregion
+//#region src/api/routes/favorites.ts
+const favoriteRoutes = new Hono();
+favoriteRoutes.get("/", async (context) => {
+	const profileId = context.get("profileId");
+	const movieFavorites = await db.select({
+		createdAt: favorites.createdAt,
+		movie: movies
+	}).from(favorites).innerJoin(movies, eq(favorites.movieId, movies.id)).where(eq(favorites.profileId, profileId)).orderBy(desc(favorites.createdAt));
+	const showFavorites = await db.select({
+		createdAt: favorites.createdAt,
+		show: shows
+	}).from(favorites).innerJoin(shows, eq(favorites.showId, shows.id)).where(eq(favorites.profileId, profileId)).orderBy(desc(favorites.createdAt));
+	const movies$1 = movieFavorites.map((row) => ({
+		...row,
+		type: "movie"
+	}));
+	const shows$2 = showFavorites.map((row) => ({
+		...row,
+		type: "show"
+	}));
+	const combined = [...movies$1, ...shows$2].sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime());
+	return context.json(combined);
+});
+favoriteRoutes.get("/status", async (context) => {
+	const profileId = context.get("profileId");
+	const movieIdParam = context.req.query("movieId");
+	const showIdParam = context.req.query("showId");
+	if (movieIdParam) {
+		const movieId = parseInt(movieIdParam, 10);
+		if (isNaN(movieId)) return context.json({ error: { message: "Invalid movie ID" } }, 400);
+		const [favorite] = await db.select({ id: favorites.id }).from(favorites).where(and(eq(favorites.profileId, profileId), eq(favorites.movieId, movieId))).limit(1);
+		return context.json({ favorite: !!favorite });
+	}
+	if (showIdParam) {
+		const showId = parseInt(showIdParam, 10);
+		if (isNaN(showId)) return context.json({ error: { message: "Invalid show ID" } }, 400);
+		const [favorite] = await db.select({ id: favorites.id }).from(favorites).where(and(eq(favorites.profileId, profileId), eq(favorites.showId, showId))).limit(1);
+		return context.json({ favorite: !!favorite });
+	}
+	return context.json({ error: { message: "movieId or showId required" } }, 400);
+});
+favoriteRoutes.post("/", async (context) => {
+	const profileId = context.get("profileId");
+	const body = await context.req.json();
+	if (typeof body.movieId !== "number" && typeof body.showId !== "number" || typeof body.movieId === "number" && typeof body.showId === "number") return context.json({ error: { message: "Provide exactly one of movieId or showId" } }, 400);
+	const now = /* @__PURE__ */ new Date();
+	try {
+		await db.insert(favorites).values({
+			profileId,
+			movieId: body.movieId ?? null,
+			showId: body.showId ?? null,
+			createdAt: now
+		});
+	} catch (error) {
+		if (!(error instanceof Error) || !error.message.includes("UNIQUE")) throw error;
+	}
+	return context.json({ success: true });
+});
+favoriteRoutes.delete("/", async (context) => {
+	const profileId = context.get("profileId");
+	const body = await context.req.json();
+	if (typeof body.movieId === "number") {
+		await db.delete(favorites).where(and(eq(favorites.profileId, profileId), eq(favorites.movieId, body.movieId)));
+		return context.json({ success: true });
+	}
+	if (typeof body.showId === "number") {
+		await db.delete(favorites).where(and(eq(favorites.profileId, profileId), eq(favorites.showId, body.showId)));
+		return context.json({ success: true });
+	}
+	return context.json({ error: { message: "movieId or showId required" } }, 400);
+});
+//#endregion
+//#region src/lib/watched.ts
+/**
+* Shared "watched" threshold used across the server and client.
+*
+* An episode (or movie) is considered complete once the profile has
+* progressed at least this fraction of the total duration. Kept in a single
+* module so server endpoints ("Up Next", next-episode) and client overlays
+* ("Up Next" countdown) can't drift.
+*/
+const watchedThreshold = .9;
+//#endregion
 //#region src/api/routes/shows.ts
 const showRoutes = new Hono();
 showRoutes.get("/", async (context) => {
@@ -7876,6 +8783,40 @@ showRoutes.get("/episodes/:id", async (context) => {
 		show
 	});
 });
+showRoutes.get("/:showId/next-episode", async (context) => {
+	const profileId = context.get("profileId");
+	const showId = parseInt(context.req.param("showId"), 10);
+	const afterEpisodeIdParam = context.req.query("afterEpisodeId");
+	const afterEpisodeId = afterEpisodeIdParam ? parseInt(afterEpisodeIdParam, 10) : NaN;
+	if (isNaN(showId) || isNaN(afterEpisodeId)) return context.json({ error: { message: "Provide a numeric showId and a numeric afterEpisodeId query parameter." } }, 400);
+	const [currentEpisode] = await db.select().from(episodes).where(and(eq(episodes.id, afterEpisodeId), eq(episodes.showId, showId))).limit(1);
+	if (!currentEpisode) return context.json({ error: { message: "That episode does not belong to this show. Double-check the showId and afterEpisodeId." } }, 404);
+	const laterEpisodes = (await db.select().from(episodes).where(eq(episodes.showId, showId)).orderBy(episodes.seasonNumber, episodes.episodeNumber)).filter((candidate) => {
+		if (candidate.seasonNumber > currentEpisode.seasonNumber) return true;
+		if (candidate.seasonNumber < currentEpisode.seasonNumber) return false;
+		return candidate.episodeNumber > currentEpisode.episodeNumber;
+	});
+	if (laterEpisodes.length === 0) return context.json({ error: { message: "No more episodes after this one." } }, 404);
+	const laterIds = laterEpisodes.map((candidate) => candidate.id);
+	const progressRows = await db.select().from(watchProgress).where(eq(watchProgress.profileId, profileId));
+	const progressByEpisodeId = /* @__PURE__ */ new Map();
+	for (const row of progressRows) if (row.episodeId !== null && laterIds.includes(row.episodeId)) progressByEpisodeId.set(row.episodeId, {
+		currentTime: row.currentTime,
+		duration: row.duration
+	});
+	const nextEpisode = laterEpisodes.find((candidate) => {
+		const progress = progressByEpisodeId.get(candidate.id);
+		if (!progress) return true;
+		if (!progress.duration || progress.duration <= 0) return true;
+		return progress.currentTime / progress.duration < watchedThreshold;
+	});
+	if (!nextEpisode) return context.json({ error: { message: "No more episodes after this one." } }, 404);
+	const [show] = await db.select().from(shows).where(eq(shows.id, showId)).limit(1);
+	return context.json({
+		episode: nextEpisode,
+		show
+	});
+});
 showRoutes.get("/:id", async (context) => {
 	const id = parseInt(context.req.param("id"), 10);
 	if (isNaN(id)) return context.json({ error: { message: "Invalid show ID" } }, 400);
@@ -7952,26 +8893,276 @@ streamRoutes.get("/:id", async (context) => {
 	} });
 });
 //#endregion
+//#region src/api/routes/transcode.ts
+const logger = {
+	error: (...args) => console.error("[transcode]", ...args),
+	info: (...args) => console.info("[transcode]", ...args),
+	warn: (...args) => console.warn("[transcode]", ...args)
+};
+const reapIdleMs = 1800 * 1e3;
+const reaperIntervalMs = 300 * 1e3;
+const sessions = /* @__PURE__ */ new Map();
+function sessionKey(fileId, profileId) {
+	return `${fileId}:${profileId}`;
+}
+function safeDirectoryName(fileId, profileId) {
+	return `${fileId}__${profileId}`;
+}
+function getTranscodeRoot() {
+	return path.join(os.tmpdir(), "jukebox-transcode");
+}
+function waitForPlaylist(playlistPath, timeoutMs) {
+	return new Promise((resolve, reject) => {
+		const startedAt = Date.now();
+		const check = () => {
+			if (existsSync(playlistPath)) {
+				resolve();
+				return;
+			}
+			if (Date.now() - startedAt > timeoutMs) {
+				reject(/* @__PURE__ */ new Error("Couldn't prepare this file for casting. Check that ffmpeg is installed."));
+				return;
+			}
+			setTimeout(check, 200);
+		};
+		check();
+	});
+}
+function startTranscode({ fileId, filePath, profileId, spawnImplementation }) {
+	const key = sessionKey(fileId, profileId);
+	const existing = sessions.get(key);
+	if (existing) {
+		existing.lastAccessedAt = Date.now();
+		return existing;
+	}
+	const tempDir = path.join(getTranscodeRoot(), safeDirectoryName(fileId, profileId));
+	mkdirSync(tempDir, { recursive: true });
+	const playlistPath = path.join(tempDir, "index.m3u8");
+	const args = [
+		"-i",
+		filePath,
+		"-c:v",
+		"copy",
+		"-c:a",
+		"aac",
+		"-ac",
+		"2",
+		"-f",
+		"hls",
+		"-hls_time",
+		"6",
+		"-hls_list_size",
+		"0",
+		"-hls_segment_filename",
+		path.join(tempDir, "segment-%03d.ts"),
+		playlistPath
+	];
+	const spawner = spawnImplementation ?? spawn;
+	let ffmpegProcess;
+	try {
+		ffmpegProcess = spawner("ffmpeg", args, { stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		] });
+	} catch (error) {
+		logger.error(`Failed to spawn ffmpeg for ${fileId}:`, error);
+		throw new Error("Couldn't prepare this file for casting. Check that ffmpeg is installed.", { cause: error });
+	}
+	ffmpegProcess.on("error", (error) => {
+		logger.error(`ffmpeg process error for ${fileId}:`, error);
+	});
+	ffmpegProcess.on("exit", (code) => {
+		logger.info(`ffmpeg exited for ${fileId} with code ${code}`);
+	});
+	const readyPromise = waitForPlaylist(playlistPath, 3e4);
+	const session = {
+		fileId,
+		ffmpegProcess,
+		lastAccessedAt: Date.now(),
+		playlistPath,
+		tempDir,
+		readyPromise
+	};
+	sessions.set(key, session);
+	return session;
+}
+function stopSession(key) {
+	const session = sessions.get(key);
+	if (!session) return;
+	if (session.ffmpegProcess && session.ffmpegProcess.exitCode === null) try {
+		session.ffmpegProcess.kill("SIGTERM");
+	} catch (error) {
+		logger.warn(`Failed to kill ffmpeg for ${session.fileId}:`, error);
+	}
+	try {
+		rmSync(session.tempDir, {
+			recursive: true,
+			force: true
+		});
+	} catch (error) {
+		logger.warn(`Failed to remove temp dir ${session.tempDir}:`, error);
+	}
+	sessions.delete(key);
+}
+function reapIdleSessions(now = Date.now()) {
+	for (const [key, session] of sessions.entries()) if (now - session.lastAccessedAt > reapIdleMs) {
+		logger.info(`Reaping idle transcode session ${key}`);
+		stopSession(key);
+	}
+}
+if (typeof setInterval !== "undefined" && process.env.NODE_ENV !== "test") setInterval(() => reapIdleSessions(), reaperIntervalMs).unref?.();
+async function resolveFile(fileId) {
+	if (fileId.startsWith("episode-")) {
+		const episodeId = parseInt(fileId.slice(8), 10);
+		if (isNaN(episodeId)) return null;
+		const [episode] = await db.select().from(episodes).where(eq(episodes.id, episodeId)).limit(1);
+		if (!episode) return null;
+		return { filePath: episode.filePath };
+	}
+	if (fileId.startsWith("movie-")) {
+		const movieId = parseInt(fileId.slice(6), 10);
+		if (isNaN(movieId)) return null;
+		const [movie] = await db.select().from(movies).where(eq(movies.id, movieId)).limit(1);
+		if (!movie) return null;
+		return { filePath: movie.filePath };
+	}
+	return null;
+}
+const transcodeRoutes = new Hono();
+transcodeRoutes.get("/:fileId/index.m3u8", async (context) => {
+	const fileId = context.req.param("fileId");
+	const profileIdRaw = context.req.header("x-jukebox-profile-id") ?? "0";
+	const profileId = parseInt(profileIdRaw, 10);
+	const resolved = await resolveFile(fileId);
+	if (!resolved) return context.json({ error: { message: "File not found" } }, 404);
+	if (!existsSync(resolved.filePath)) return context.json({ error: { message: "Video file not found" } }, 404);
+	try {
+		const session = startTranscode({
+			fileId,
+			filePath: resolved.filePath,
+			profileId: isNaN(profileId) ? 0 : profileId
+		});
+		session.lastAccessedAt = Date.now();
+		await session.readyPromise;
+		const playlistStream = createReadStream(session.playlistPath);
+		const webStream = Readable.toWeb(playlistStream);
+		return new Response(webStream, { headers: {
+			"Content-Type": "application/vnd.apple.mpegurl",
+			"Cache-Control": "no-store"
+		} });
+	} catch (error) {
+		const message = error instanceof Error ? error.message : "Couldn't prepare this file for casting. Check that ffmpeg is installed.";
+		return context.json({ error: { message } }, 500);
+	}
+});
+transcodeRoutes.get("/:fileId/:segment", async (context) => {
+	const fileId = context.req.param("fileId");
+	const segment = context.req.param("segment");
+	const profileIdRaw = context.req.header("x-jukebox-profile-id") ?? "0";
+	const profileId = parseInt(profileIdRaw, 10);
+	const key = sessionKey(fileId, isNaN(profileId) ? 0 : profileId);
+	const session = sessions.get(key);
+	if (!session) return context.json({ error: { message: "Transcode session not found" } }, 404);
+	if (!/^segment-\d+\.ts$/.test(segment)) return context.json({ error: { message: "Invalid segment" } }, 400);
+	const segmentPath = path.join(session.tempDir, segment);
+	const startedAt = Date.now();
+	while (!existsSync(segmentPath) && Date.now() - startedAt < 15e3) await new Promise((resolve) => setTimeout(resolve, 200));
+	if (!existsSync(segmentPath)) return context.json({ error: { message: "Segment not ready" } }, 404);
+	session.lastAccessedAt = Date.now();
+	const size = statSync(segmentPath).size;
+	const nodeStream = createReadStream(segmentPath);
+	const webStream = Readable.toWeb(nodeStream);
+	return new Response(webStream, { headers: {
+		"Content-Type": "video/mp2t",
+		"Content-Length": String(size),
+		"Cache-Control": "no-store"
+	} });
+});
+try {
+	const root = getTranscodeRoot();
+	if (existsSync(root)) for (const entry of readdirSync(root)) rmSync(path.join(root, entry), {
+		recursive: true,
+		force: true
+	});
+} catch (error) {
+	logger.warn("Failed to clear transcode root on boot:", error);
+}
+//#endregion
+//#region src/api/routes/up-next.ts
+const upNextRoutes = new Hono();
+upNextRoutes.get("/", async (context) => {
+	const profileId = context.get("profileId");
+	const episodeProgressRows = await db.select({
+		currentTime: watchProgress.currentTime,
+		duration: watchProgress.duration,
+		episode: episodes,
+		updatedAt: watchProgress.updatedAt
+	}).from(watchProgress).innerJoin(episodes, eq(watchProgress.episodeId, episodes.id)).where(eq(watchProgress.profileId, profileId)).orderBy(desc(watchProgress.updatedAt));
+	const latestRowByShow = /* @__PURE__ */ new Map();
+	for (const row of episodeProgressRows) if (!latestRowByShow.has(row.episode.showId)) latestRowByShow.set(row.episode.showId, row);
+	const items = [];
+	for (const [showId, row] of latestRowByShow.entries()) {
+		if (!((row.duration && row.duration > 0 ? row.currentTime / row.duration : 0) >= .9)) continue;
+		const laterEpisodes = (await db.select().from(episodes).where(eq(episodes.showId, showId)).orderBy(episodes.seasonNumber, episodes.episodeNumber)).filter((candidate) => {
+			if (candidate.seasonNumber > row.episode.seasonNumber) return true;
+			if (candidate.seasonNumber < row.episode.seasonNumber) return false;
+			return candidate.episodeNumber > row.episode.episodeNumber;
+		});
+		if (laterEpisodes.length === 0) continue;
+		const laterIds = new Set(laterEpisodes.map((candidate) => candidate.id));
+		const laterProgress = episodeProgressRows.filter((progressRow) => progressRow.episode.id !== row.episode.id && laterIds.has(progressRow.episode.id));
+		const progressByEpisodeId = /* @__PURE__ */ new Map();
+		for (const progressRow of laterProgress) progressByEpisodeId.set(progressRow.episode.id, {
+			currentTime: progressRow.currentTime,
+			duration: progressRow.duration
+		});
+		const nextEpisode = laterEpisodes.find((candidate) => {
+			const progress = progressByEpisodeId.get(candidate.id);
+			if (!progress) return true;
+			if (!progress.duration || progress.duration <= 0) return true;
+			return progress.currentTime / progress.duration < watchedThreshold;
+		});
+		if (!nextEpisode) continue;
+		const [show] = await db.select().from(shows).where(eq(shows.id, showId)).limit(1);
+		if (!show) continue;
+		items.push({
+			episode: nextEpisode,
+			show,
+			lastWatchedAt: row.updatedAt.toISOString()
+		});
+	}
+	items.sort((a, b) => new Date(b.lastWatchedAt).getTime() - new Date(a.lastWatchedAt).getTime());
+	return context.json(items.slice(0, 20));
+});
+//#endregion
 //#region src/api/index.ts
 const app = new Hono();
-app.use("*", logger());
+app.use("*", logger$1());
+app.use("/api/*", authMiddleware);
+app.use("/api/*", profileMiddleware);
 app.onError((error, context) => {
 	console.error("Unhandled error:", error);
 	const message = error instanceof Error ? error.message : "An unexpected error occurred";
 	return context.json({ error: { message } }, 500);
 });
+app.route("/api/auth", authRoutes);
 app.route("/api/hello", helloRoutes);
 app.route("/api/library/shows", showRoutes);
+app.route("/api/library/up-next", upNextRoutes);
 app.route("/api/library", libraryRoutes);
 app.route("/api/progress/episode", episodeProgressRoutes);
 app.route("/api/progress", progressRoutes);
 app.route("/api/scan", scanRoutes);
+app.route("/api/profiles", profileRoutes);
+app.route("/api/favorites", favoriteRoutes);
 app.route("/api/setup", setupRoutes);
 app.route("/api/stream/episode", episodeStreamRoutes);
 app.route("/api/stream", streamRoutes);
+app.route("/api/transcode", transcodeRoutes);
 app.get("/api", (c) => c.json({ message: "Jukebox API" }));
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-const clientDir = path.resolve(__dirname, "../client");
+const __dirname$1 = path.dirname(fileURLToPath(import.meta.url));
+const clientDir = path.resolve(__dirname$1, "../client");
 function setupStaticServing() {
 	app.use("*", serveStatic({
 		root: clientDir,
@@ -8000,7 +9191,9 @@ function setupViteProxy(vitePort) {
 		if (c.req.path.startsWith("/api")) return next();
 		const viteUrl = `http://localhost:${vitePort}${c.req.path}`;
 		const headers = new Headers();
-		for (const [key, value] of c.req.raw.headers.entries()) if (!hopByHopHeaders.has(key.toLowerCase())) headers.set(key, value);
+		c.req.raw.headers.forEach((value, key) => {
+			if (!hopByHopHeaders.has(key.toLowerCase())) headers.set(key, value);
+		});
 		try {
 			const response = await fetch(viteUrl, {
 				method: c.req.method,
@@ -8021,9 +9214,20 @@ function setupViteProxy(vitePort) {
 const port = process.env.PORT ? Number(process.env.PORT) : 1990;
 const vitePort = 5173;
 const isDevelopment = process.env.NODE_ENV !== "production";
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+function readPackageVersion() {
+	const candidates = [path.resolve(__dirname, "../../package.json"), path.resolve(__dirname, "../package.json")];
+	for (const candidate of candidates) try {
+		const content = JSON.parse(readFileSync(candidate, "utf-8"));
+		if (content.name === "jukebox-media-server" && content.version) return content.version;
+	} catch {}
+	return "unknown";
+}
+const version = readPackageVersion();
 let viteServer = null;
 if (isDevelopment) {
-	viteServer = await createServer$1({
+	const { createServer } = await import("vite");
+	viteServer = await createServer({
 		configFile: "./vite.config.ts",
 		server: {
 			port: vitePort,
@@ -8031,15 +9235,30 @@ if (isDevelopment) {
 		}
 	});
 	await viteServer.listen();
-	console.log(`Vite dev server running at http://localhost:${vitePort}`);
 	setupViteProxy(vitePort);
 } else setupStaticServing();
 const server = serve({
 	fetch: app.fetch,
 	port
 }, (info) => {
-	console.log(`Jukebox running at http://localhost:${info.port}`);
+	printWelcome(info.port);
 });
+function printWelcome(boundPort) {
+	const url = `http://localhost:${boundPort}`;
+	const bold = "\x1B[1m";
+	const cyan = "\x1B[36m";
+	const dim = "\x1B[2m";
+	const reset = "\x1B[0m";
+	const lines = [
+		"",
+		`  ${bold}Jukebox${reset} ${dim}v${version}${reset}`,
+		"",
+		`  ${cyan}➜${reset}  Open ${cyan}${url}${reset} in your browser`,
+		`  ${dim}Press Ctrl+C to stop${reset}`,
+		""
+	];
+	console.log(lines.join("\n"));
+}
 function shutdown(signal) {
 	console.log(`\nReceived ${signal}, shutting down...`);
 	setTimeout(() => process.exit(1), 2e3).unref();