umedia 0.3.0 → 0.4.0

package/lib/providers/snapchat.js

@@ -0,0 +1,106 @@
+import { fetchJson, fetchText, hostMatches } from "../util.js";
+import { Codes, UMediaError } from "../errors.js";
+
+/**
+ * Snapchat — Spotlight videos (preload link on the page) and public stories
+ * (the page's __NEXT_DATA__ snap list — ALL snaps, in order).
+ * Reference: cobalt snapchat service.
+ */
+export const name = "snapchat";
+
+const SPOTLIGHT_PRELOAD = /<link data-react-helmet="true" rel="preload" href="([^"]+)" as="video"\/>/;
+const NEXT_DATA = /<script id="__NEXT_DATA__" type="application\/json">({.+?})<\/script>/;
+
+export function canHandle(url) {
+  try {
+    return hostMatches(new URL(String(url)).hostname, ["snapchat.com", "t.snapchat.com"]);
+  } catch { return false; }
+}
+
+export async function resolve(url, ctx = {}) {
+  const attempt = { provider: name, status: "skipped" };
+  ctx.attempts?.push(attempt);
+  const t0 = Date.now();
+
+  let target = String(url);
+  if (/t\.snapchat\.com\//i.test(target)) {
+    try {
+      const res = await fetch(target, { redirect: "follow", headers: { "user-agent": "Mozilla/5.0" } });
+      target = res.url || target;
+    } catch { /* keep original */ }
+  }
+
+  const media = [];
+  let title = null;
+  let author = null;
+
+  const spotlight = target.match(/\/spotlight\/([\w-]+)/i);
+  const story = target.match(/\/add\/([\w.-]+)(?:\/([\w-]+))?/i);
+
+  if (spotlight) {
+    const r = await fetchText(`https://www.snapchat.com/spotlight/${spotlight[1]}`, { headers: { "user-agent": "Mozilla/5.0" } }, 18_000).catch(() => null);
+    const v = r?.text?.match(SPOTLIGHT_PRELOAD)?.[1];
+    if (v && new URL(v).hostname.endsWith("sc-cdn.net")) {
+      media.push({
+        type: "video", index: 0, url: v, thumbnail: null,
+        mimeType: "video/mp4", width: null, height: null, duration: null, size: null,
+        quality: null, hasAudio: true, hasVideo: true, source: name, variants: [],
+      });
+      title = (r.text.match(/"title":"([^"]{1,120})"/) || r.text.match(/<title[^>]*>([^<]*)/i) || [])[1] || null;
+    }
+  } else if (story) {
+    const r = await fetchText(`https://www.snapchat.com/add/${story[1]}${story[2] ? "/" + story[2] : ""}`,
+      { headers: { "user-agent": "Mozilla/5.0" } }, 18_000).catch(() => null);
+    const raw = r?.text?.match(NEXT_DATA)?.[1];
+    if (raw) {
+      const data = JSON.parse(raw);
+      author = story[1];
+      const snaps = data?.props?.pageProps?.story?.snapList
+        || data?.props?.pageProps?.curatedHighlights?.[0]?.snapList
+        || [];
+      snaps.forEach((snap) => {
+        const isPhoto = snap.snapMediaType === 0;
+        const u = snap.snapUrls?.mediaUrl;
+        if (!u) return;
+        media.push({
+          type: isPhoto ? "image" : "video", index: media.length, url: u,
+          thumbnail: snap.snapUrls?.mediaPreviewUrl?.value || u,
+          mimeType: isPhoto ? "image/jpeg" : "video/mp4",
+          width: null, height: null,
+          duration: snap.duration ? Math.round(snap.duration / 1000) : null,
+          size: null, quality: null,
+          hasAudio: !isPhoto, hasVideo: !isPhoto, source: name, variants: [],
+        });
+      });
+    }
+  }
+
+  if (!media.length) {
+    attempt.status = "failed";
+    attempt.error = "no snap media exposed (removed, private, or login-gated)";
+    throw new UMediaError(Codes.MEDIA_NOT_FOUND,
+      `Snapchat exposes no media for this URL (${attempt.error}) — the yt-dlp tier covers gated stories.`, { attempts: [attempt] });
+  }
+
+  attempt.status = "success";
+  attempt.latencyMs = Date.now() - t0;
+  return {
+    result: {
+      sourceUrl: url,
+      platform: name,
+      title: title || (author ? `Snapchat story @${author}` : null),
+      author,
+      thumbnail: media[0].thumbnail,
+      itemCount: media.length,
+      counts: { images: media.filter((m) => m.type === "image").length, videos: media.filter((m) => m.type === "video").length, audios: 0, other: 0 },
+      truncated: false,
+      media,
+      streamUrlsAvailable: true,
+    },
+    engine: { attempts: ctx.attempts || [attempt], finalProvider: name, totalLatencyMs: Date.now() - t0 },
+  };
+}
+
+export async function search() {
+  return [];
+}

package/lib/providers/threads.js

@@ -0,0 +1,103 @@
+import { fetchText, hostMatches } from "../util.js";
+import { Codes, UMediaError } from "../errors.js";
+
+/**
+ * Threads (Meta) — the share page's server-rendered state (`video_url` /
+ * `image_urls` in the post JSON) plus official og: meta. Best-effort like all
+ * Meta surfaces (login-gated on some networks); yt-dlp tier covers gated ones.
+ */
+export const name = "threads";
+
+export function canHandle(url) {
+  try {
+    return hostMatches(new URL(String(url)).hostname, ["threads.net", "threads.com"]);
+  } catch { return false; }
+}
+
+export async function resolve(url, ctx = {}) {
+  const attempt = { provider: name, status: "skipped" };
+  ctx.attempts?.push(attempt);
+  const t0 = Date.now();
+
+  let html;
+  try {
+    const r = await fetchText(String(url), {
+      headers: {
+        "user-agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36",
+        accept: "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
+        "accept-language": "en-US,en;q=0.9",
+      },
+    }, 18_000);
+    html = r.text;
+  } catch (e) {
+    attempt.status = "failed";
+    attempt.error = e.message;
+    throw new UMediaError(Codes.PROVIDER_UNAVAILABLE, `Threads page not retrievable. ${e.message}`, { attempts: [attempt] });
+  }
+
+  const un = (s) => { try { return JSON.parse(`"${s}"`); } catch { return s.replace(/\\\//g, "/"); } };
+  const media = [];
+
+  // post state: video_url + display_url (escaped JSON strings inside the SSR payload)
+  const video = html.match(/\\"video_url\\":\\"((?:[^"\\]|\\.)+?)\\"/) || html.match(/"video_url":"((?:[^"\\]|\\.)+?)"/);
+  const image = html.match(/\\"display_url\\":\\"((?:[^"\\]|\\.)+?)\\"/) || html.match(/"display_url":"((?:[^"\\]|\\.)+?)"/);
+  if (video?.[1]) {
+    const u = un(video[1]);
+    if (/^https?:/.test(u)) media.push({
+      type: "video", index: 0, url: u, thumbnail: image ? un(image[1]) : u,
+      mimeType: "video/mp4", width: null, height: null, duration: null, size: null,
+      quality: null, hasAudio: true, hasVideo: true, source: name, variants: [],
+    });
+  }
+  if (!media.length && image?.[1]) {
+    const u = un(image[1]);
+    if (/^https?:/.test(u)) media.push({
+      type: "image", index: 0, url: u, thumbnail: u,
+      mimeType: "image/jpeg", width: null, height: null, duration: null, size: null,
+      quality: null, hasAudio: false, hasVideo: false, source: name, variants: [],
+    });
+  }
+
+  // og: meta fallback
+  if (!media.length) {
+    const ogv = (html.match(/property="og:video"[^>]+content="([^"]+)"/) || html.match(/content="([^"]+)"[^>]+property="og:video"/) || [])[1];
+    const ogi = (html.match(/property="og:image"[^>]+content="([^"]+)"/) || html.match(/content="([^"]+)"[^>]+property="og:image"/) || [])[1];
+    const u = ogv || ogi;
+    if (u && /^https?:/.test(u)) media.push({
+      type: ogv ? "video" : "image", index: 0, url: u.replace(/&/g, "&"), thumbnail: (ogi || u).replace(/&/g, "&"),
+      mimeType: ogv ? "video/mp4" : "image/jpeg", width: null, height: null,
+      duration: null, size: null, quality: null,
+      hasAudio: Boolean(ogv), hasVideo: Boolean(ogv), source: name, variants: [],
+    });
+  }
+
+  if (!media.length) {
+    attempt.status = "failed";
+    attempt.error = "no media in the public page (login-gated or removed)";
+    throw new UMediaError(Codes.MEDIA_NOT_FOUND,
+      `Threads exposes no media for this URL (${attempt.error}) — the yt-dlp tier covers gated posts.`, { attempts: [attempt] });
+  }
+
+  const title = (html.match(/"caption":"((?:[^"\\]|\\.){1,200})"/) || html.match(/<title[^>]*>([^<]*)/i) || [])[1] || null;
+  attempt.status = "success";
+  attempt.latencyMs = Date.now() - t0;
+  return {
+    result: {
+      sourceUrl: url,
+      platform: name,
+      title: title ? un(title).slice(0, 200) : null,
+      author: (String(url).match(/@([\w.]+)/) || [])[1] || null,
+      thumbnail: media[0].thumbnail,
+      itemCount: media.length,
+      counts: { images: media.filter((m) => m.type === "image").length, videos: media.filter((m) => m.type === "video").length, audios: 0, other: 0 },
+      truncated: false,
+      media,
+      streamUrlsAvailable: true,
+    },
+    engine: { attempts: ctx.attempts || [attempt], finalProvider: name, totalLatencyMs: Date.now() - t0 },
+  };
+}
+
+export async function search() {
+  return [];
+}

package/lib/providers/tumblr.js

@@ -0,0 +1,153 @@
+import { fetchJson, hostMatches } from "../util.js";
+import { Codes, UMediaError } from "../errors.js";
+
+/**
+ * Tumblr — the public mobile API (api-http2.tumblr.com, the same endpoint the
+ * official iPhone app calls with its public api_key). Videos, audio, photos —
+ * including reblog trails. Reference: cobalt tumblr service.
+ */
+export const name = "tumblr";
+
+const API_KEY = "jrsCWX1XDuVxAFO4GkK147syAoN8BJZ5voz8tS80bPcj26Vc5Z";
+const API_BASE = "https://api-http2.tumblr.com";
+const MOBILE = {
+  "user-agent": "Tumblr/iPhone/33.3/333010/17.3.1/tumblr",
+  "x-version": "iPhone/33.3/333010/17.3.1/tumblr",
+};
+
+export function canHandle(url) {
+  try {
+    return hostMatches(new URL(String(url)).hostname, ["tumblr.com"]);
+  } catch { return false; }
+}
+
+export function parseUrl(url) {
+  const u = new URL(String(url));
+  const host = u.hostname.replace(/^www\./, "");
+  let m;
+  // https://{user}.tumblr.com/post/{id}/...
+  m = u.pathname.match(/^\/post\/(\d+)/);
+  if (m && host !== "tumblr.com") return { user: host.split(".")[0], id: m[1] };
+  // https://www.tumblr.com/{user}/{id} or /blog/view/{user}/{id}
+  m = u.pathname.match(/^\/(?:blog\/view\/)?([\w.-]+)\/(\d+)/);
+  if (m) return { user: m[1], id: m[2] };
+  return null;
+}
+
+export async function resolve(url, ctx = {}) {
+  const attempt = { provider: name, status: "skipped" };
+  ctx.attempts?.push(attempt);
+  const t0 = Date.now();
+
+  const parsed = parseUrl(url);
+  if (!parsed) {
+    attempt.status = "failed";
+    throw new UMediaError(Codes.INVALID_URL, "Not a Tumblr post URL (expected {user}.tumblr.com/post/{id} or tumblr.com/{user}/{id})", { attempts: [attempt] });
+  }
+
+  let data;
+  try {
+    data = await fetchJson(
+      `${API_BASE}/v2/blog/${encodeURIComponent(parsed.user)}.tumblr.com/posts/${parsed.id}/permalink?api_key=${API_KEY}`, { headers: MOBILE }, 20_000);
+  } catch (e) {
+    attempt.status = "failed";
+    attempt.error = e.message;
+    throw new UMediaError(Codes.PROVIDER_UNAVAILABLE, `Tumblr API unavailable. ${e.message}`, { attempts: [attempt] });
+  }
+
+  const element = data?.response?.timeline?.elements?.[0];
+  if (!element) {
+    attempt.status = "failed";
+    attempt.error = data?.meta?.msg || "post not found";
+    throw new UMediaError(Codes.MEDIA_NOT_FOUND, `Tumblr: ${attempt.error}`, { attempts: [attempt] });
+  }
+
+  // contents: the post itself + any reblog trail, in order — ALL of it
+  const contents = [
+    ...(element.content || []),
+    ...(element.trail || []).flatMap((t) => t.content || []),
+  ];
+
+  const media = [];
+  for (const c of contents) {
+    if (c.type === "video" && (c.provider === "tumblr" || !c.provider) && c.media?.url) {
+      media.push({
+        type: "video", index: media.length, url: c.media.url,
+        thumbnail: c.poster?.[0]?.url || null,
+        mimeType: "video/mp4", width: c.width ?? null, height: c.height ?? null,
+        duration: null, size: null, quality: null,
+        hasAudio: true, hasVideo: true, source: name, variants: [],
+      });
+    } else if (c.type === "audio" && c.media?.url) {
+      media.push({
+        type: "audio", index: media.length, url: c.media.url,
+        thumbnail: null, mimeType: "audio/mpeg", width: null, height: null,
+        duration: null, size: null, quality: null,
+        hasAudio: true, hasVideo: false, source: name, variants: [],
+      });
+    } else if (c.type === "image" || c.type === "photo") {
+      // image content carries media as an ARRAY of renditions — take the best
+      // one as the item, keep the rest as variants. never inflate items.
+      const items = (Array.isArray(c.media) ? c.media : (c.media?.url ? [c.media] : []))
+        .filter((mm) => mm?.url);
+      const uniq = [...new Map(items.map((mm) => [mm.url, mm])).values()]
+        .sort((a, b) => ((b.width || 0) * (b.height || 0)) - ((a.width || 0) * (a.height || 0)));
+      const best = uniq[0];
+      if (best) {
+        media.push({
+          type: "image", index: media.length, url: best.url,
+          thumbnail: best.url, mimeType: "image/jpeg",
+          width: best.width ?? null, height: best.height ?? null,
+          duration: null, size: null, quality: best.width ? `${best.width}px` : null,
+          hasAudio: false, hasVideo: false, source: name,
+          variants: uniq.map((x) => ({
+            height: x.height ?? null, width: x.width ?? null, url: x.url,
+            hasAudio: false, hasVideo: false, quality: x.width ? `${x.width}px` : null, mimeType: "image/jpeg",
+          })),
+        });
+      }
+    }
+  }
+
+  // reblog trails repeat media from earlier hops — dedupe by URL, keep first order
+  const seen = new Set();
+  const deduped = [];
+  for (const mm of media) {
+    if (seen.has(mm.url)) continue;
+    seen.add(mm.url);
+    deduped.push({ ...mm, index: deduped.length });
+  }
+  media.length = 0;
+  media.push(...deduped);
+
+  if (!media.length) {
+    attempt.status = "failed";
+    throw new UMediaError(Codes.MEDIA_NOT_FOUND, "Tumblr post contains no downloadable media (text/link post, or third-party embed — use the yt-dlp tier for YouTube/Vimeo embeds)", { attempts: [attempt] });
+  }
+
+  attempt.status = "success";
+  attempt.latencyMs = Date.now() - t0;
+  return {
+    result: {
+      sourceUrl: url,
+      platform: name,
+      title: (element.summary || element.let || "").slice(0, 200) || null,
+      author: element.blog_name || parsed.user,
+      thumbnail: media[0].thumbnail,
+      itemCount: media.length,
+      counts: {
+        images: media.filter((m) => m.type === "image").length,
+        videos: media.filter((m) => m.type === "video").length,
+        audios: media.filter((m) => m.type === "audio").length, other: 0,
+      },
+      truncated: false,
+      media,
+      streamUrlsAvailable: true,
+    },
+    engine: { attempts: ctx.attempts || [attempt], finalProvider: name, totalLatencyMs: Date.now() - t0 },
+  };
+}
+
+export async function search() {
+  return [];
+}

package/lib/providers/x.js

@@ -1,69 +1,213 @@
 import { fetchJson, hostMatches } from "../util.js";
 import { Codes, UMediaError } from "../errors.js";
 
-/** X (Twitter) — syndication endpoint for public posts. Best-effort, honestly labeled. */
+/**
+ * X / Twitter — two proven public routes, no login:
+ *  1. syndication embed API with the computed token (the route embed widgets use)
+ *  2. GraphQL TweetDetail with a guest token (the route the logged-out web uses)
+ * Both are the exact techniques from yt-dlp's twitter extractor and cobalt's
+ * twitter service. Photos, videos (best bitrate mp4), gifs.
+ */
 export const name = "x";
 
+const BEARER = "AAAAAAAAAAAAAAAAAAAAANRILgAAAAAAnNwIzUejRCOuH5E6I8xnZz4puTs%3D1Zv7ttfk8LF81IUq16cHjhLTvJu4FA33AGWWjCpTnA";
+const GQL_FEATURES = JSON.stringify({
+  rweb_video_screen_enabled: false, payments_enabled: false, rweb_xchat_enabled: false,
+  profile_label_improvements_pcf_label_in_post_enabled: true, rweb_tipjar_consumption_enabled: true,
+  verified_phone_label_enabled: false, creator_subscriptions_tweet_preview_api_enabled: true,
+  responsive_web_graphql_timeline_navigation_enabled: true, responsive_web_graphql_skip_user_profile_image_extensions_enabled: false,
+  premium_content_api_read_enabled: false, communities_web_enable_tweet_community_results_fetch: true,
+  c9s_tweet_anatomy_moderator_badge_enabled: true, responsive_web_grok_analyze_button_fetch_trends_enabled: false,
+  responsive_web_grok_analyze_post_followups_enabled: true, responsive_web_jetfuel_frame: true,
+  responsive_web_grok_share_attachment_enabled: true, articles_preview_enabled: true,
+  responsive_web_edit_tweet_api_enabled: true, graphql_is_translatable_rweb_tweet_is_translatable_enabled: true,
+  view_counts_everywhere_api_enabled: true, longform_notetweets_consumption_enabled: true,
+  responsive_web_twitter_article_tweet_consumption_enabled: true, tweet_awards_web_tipping_enabled: false,
+  creator_subscriptions_quote_tweet_preview_enabled: false, freedom_of_speech_not_reach_fetch_enabled: true,
+  standardized_nudges_misinfo: true, tweet_with_visibility_results_prefer_gql_limited_actions_policy_enabled: true,
+  longform_notetweets_rich_text_read_enabled: true, longform_notetweets_inline_media_enabled: true,
+  responsive_web_grok_image_annotation_enabled: true, responsive_web_grok_imagine_annotation_enabled: true,
+  responsive_web_grok_community_note_auto_translation_is_enabled: false, responsive_web_enhance_cards_enabled: false,
+});
+
+const GQL_HEADERS = {
+  authorization: `Bearer ${BEARER}`,
+  "x-twitter-client-language": "en",
+  "x-twitter-active-user": "yes",
+  "accept-language": "en",
+  "user-agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36",
+};
+
 export function canHandle(url) {
   try {
     return hostMatches(new URL(String(url)).hostname, ["twitter.com", "x.com"]);
   } catch { return false; }
 }
 
+export function tweetId(url) {
+  const m = String(url).match(/\/status(?:es)?\/(\d{8,25})/);
+  return m ? m[1] : null;
+}
+
+// the syndication embed token — computed from the tweet id (yt-dlp technique)
+const syndicationToken = (id) => ((Number(id) / 1e15) * Math.PI).toString(36).replace(/(0+|\.)/g, "");
+
+let _guestToken = null;
+async function guestToken() {
+  if (_guestToken) return _guestToken;
+  try {
+    const j = await fetchJson("https://api.x.com/1.1/guest/activate.json", {
+      method: "POST", headers: GQL_HEADERS,
+    }, 15_000);
+    if (j?.guest_token) return (_guestToken = j.guest_token);
+  } catch { /* syndication may still work */ }
+  return null;
+}
+
+function mediaFromEntities(entities, media) {
+  for (const m of entities || []) {
+    const isPhoto = m.type === "photo";
+    const isVideo = m.type === "video" || m.type === "animated_gif";
+    if (isPhoto && m.media_url_https) {
+      media.push({
+        type: "image", index: media.length, url: m.media_url_https, thumbnail: m.media_url_https,
+        mimeType: "image/jpeg", width: m.original_info?.width ?? null, height: m.original_info?.height ?? null,
+        duration: null, size: null, quality: "original",
+        hasAudio: false, hasVideo: false, source: name, variants: [],
+      });
+    } else if (isVideo && m.video_info?.variants?.length) {
+      const mp4s = m.video_info.variants
+        .filter((v) => v.content_type === "video/mp4" && v.url)
+        .map((v) => ({
+          height: null, width: null,
+          // cobalt strips the flaky `tag` param from twitter mp4 urls
+          url: (() => { try { const u = new URL(v.url); u.searchParams.delete("tag"); return u.toString(); } catch { return v.url; } })(),
+          hasAudio: true, hasVideo: true,
+          quality: v.bitrate ? `${Math.round(v.bitrate / 1000)}kbps` : "mp4",
+          mimeType: "video/mp4", bitrate: v.bitrate ?? null,
+        }))
+        .sort((a, b) => (b.bitrate || 0) - (a.bitrate || 0));
+      const best = mp4s[0]
+        || m.video_info.variants.filter((v) => v.url).map((v) => ({
+          height: null, width: null, url: v.url, hasAudio: true, hasVideo: true,
+          quality: null, mimeType: v.content_type || "application/x-mpegURL", bitrate: null,
+        }))[0];
+      if (best) {
+        media.push({
+          type: "video", index: media.length, url: best.url,
+          thumbnail: m.media_url_https || null,
+          mimeType: best.mimeType, width: m.original_info?.width ?? null, height: m.original_info?.height ?? null,
+          duration: m.video_info.duration_millis ? Math.round(m.video_info.duration_millis / 1000) : null,
+          size: null, quality: best.quality,
+          hasAudio: true, hasVideo: true, source: name, variants: mp4s,
+        });
+      }
+    }
+  }
+}
+
 export async function resolve(url, ctx = {}) {
   const attempt = { provider: name, status: "skipped" };
   ctx.attempts?.push(attempt);
-  const m = String(url).match(/status\/(\d+)/);
-  if (!m) throw new UMediaError(Codes.INVALID_URL, `No status id in ${url}`);
   const t0 = Date.now();
+
+  const id = tweetId(url);
+  if (!id) {
+    attempt.status = "failed";
+    throw new UMediaError(Codes.INVALID_URL, "Not a tweet URL (expected x.com/{user}/status/{id})", { attempts: [attempt] });
+  }
+
+  const media = [];
+  let title = null;
+  let author = null;
+
+  // 1) GraphQL TweetDetail with guest token (fullest data)
   try {
-    const tw = await fetchJson(`https://cdn.syndication.twimg.com/tweet-result?id=${m[1]}&lang=en`, {}, 12_000);
-    const media = [];
-    const photos = tw.photos || [];
-    photos.forEach((p, i) => media.push({
-      type: "image", index: i, url: p.url, thumbnail: p.url,
-      mimeType: "image/jpeg", width: p.width ?? null, height: p.height ?? null,
-      duration: null, size: null, quality: p.width && p.height ? `${p.width}x${p.height}` : null,
-      hasAudio: false, hasVideo: false, source: name, variants: [],
-    }));
-    const vids = tw.video?.variants || [];
-    const mp4s = vids.filter((v) => v.src?.includes(".mp4")).sort((a, b) => (b.bitrate || 0) - (a.bitrate || 0));
-    if (mp4s.length) {
-      const best = mp4s[0];
-      media.push({
-        type: "video", index: media.length, url: best.src, thumbnail: tw.video?.poster ?? null,
-        mimeType: "video/mp4", width: null, height: null,
-        duration: tw.video?.duration_millis ? tw.video.duration_millis / 1000 : null,
-        size: null, quality: best.bitrate ? `~${Math.round(best.bitrate / 1000)}kbps` : null,
-        hasAudio: true, hasVideo: true, source: name,
-        variants: mp4s.map((v) => ({
-          quality: v.bitrate ? `~${Math.round(v.bitrate / 1000)}kbps` : "unknown",
-          url: v.src, mimeType: "video/mp4", hasAudio: true, hasVideo: true,
-        })),
-      });
+    const token = await guestToken();
+    if (token) {
+      const u = new URL("https://api.x.com/graphql/4Siu98E55GquhG52zHdY5w/TweetDetail");
+      u.searchParams.set("variables", JSON.stringify({
+        focalTweetId: id, with_rux_injections: false, rankingMode: "Relevance",
+        includePromotedContent: true, withCommunity: true,
+        withQuickPromoteEligibilityTweetFields: true, withBirdwatchNotes: true, withVoice: true,
+      }));
+      u.searchParams.set("features", GQL_FEATURES);
+      u.searchParams.set("fieldToggles", JSON.stringify({ withArticleRichContentState: true, withArticlePlainText: false }));
+      const j = await fetchJson(u.toString(), {
+        headers: { ...GQL_HEADERS, "content-type": "application/json", "x-guest-token": token, cookie: `guest_id=v1%3A${token}` },
+      }, 20_000);
+      const entries = j?.data?.threaded_conversation_with_injections_v2?.instructions
+        ?.find((i) => i.type === "TimelineAddEntries")?.entries || [];
+      const node = entries.find((e) => e.entryId === `tweet-${id}`)?.content?.itemContent?.tweet_results?.result;
+      let base = node?.legacy;
+      if (node?.__typename === "TweetWithVisibilityResults") base = node.tweet?.legacy;
+      const rep = base?.retweeted_status_result?.result?.legacy?.extended_entities
+        || base?.retweeted_status_result?.result?.tweet?.legacy?.extended_entities;
+      if (base?.full_text) title = base.full_text;
+      author = node?.core?.user_results?.result?.legacy?.screen_name
+        || node?.tweet?.core?.user_results?.result?.legacy?.screen_name || null;
+      mediaFromEntities(rep?.media || base?.extended_entities?.media, media);
     }
-    if (!media.length) throw new UMediaError(Codes.MEDIA_NOT_FOUND, "Post has no media (or it is not public)");
-    attempt.status = "success";
-    attempt.latencyMs = Date.now() - t0;
-    return {
-      result: {
-        sourceUrl: url, platform: "x", title: (tw.text || "").slice(0, 120) || null,
-        author: tw.user?.screen_name ?? null, thumbnail: media[0].thumbnail ?? null,
-        itemCount: media.length,
-        counts: {
-          images: media.filter((x) => x.type === "image").length,
-          videos: media.filter((x) => x.type === "video").length, audios: 0, other: 0,
-        },
-        truncated: false, media,
-      },
-      engine: { attempts: ctx.attempts || [attempt], finalProvider: name, totalLatencyMs: Date.now() - t0 },
-    };
   } catch (e) {
+    attempt.note = `graphql: ${String(e.message).slice(0, 60)}`;
+  }
+
+  // 2) syndication embed API with the computed token (embed-widget route)
+  if (!media.length) {
+    try {
+      const j = await fetchJson(
+        `https://cdn.syndication.twimg.com/tweet-result?id=${id}&token=${syndicationToken(id)}&lang=en`, {}, 15_000);
+      title = title || j?.text || null;
+      author = author || j?.user?.screen_name || null;
+      mediaFromEntities(j?.mediaDetails, media);
+      if (!media.length && j?.video?.variants) {
+        const mp4s = j.video.variants.filter((v) => v.type === "video/mp4").sort((a, b) => (b.bitrate || 0) - (a.bitrate || 0));
+        if (mp4s[0]) media.push({
+          type: "video", index: 0, url: mp4s[0].src, thumbnail: j.thumbnail?.image?.src || null,
+          mimeType: "video/mp4", width: null, height: null,
+          duration: j.video.duration_millis ? Math.round(j.video.duration_millis / 1000) : null,
+          size: null, quality: mp4s[0].bitrate ? `${Math.round(mp4s[0].bitrate / 1000)}kbps` : null,
+          hasAudio: true, hasVideo: true, source: name,
+          variants: mp4s.map((v) => ({ height: null, width: null, url: v.src, hasAudio: true, hasVideo: true, quality: v.bitrate ? `${Math.round(v.bitrate / 1000)}kbps` : null, mimeType: "video/mp4", bitrate: v.bitrate ?? null })),
+        });
+      }
+    } catch (e) {
+      attempt.note = `${attempt.note ? attempt.note + " · " : ""}syndication: ${String(e.message).slice(0, 60)}`;
+    }
+  }
+
+  if (!media.length) {
     attempt.status = "failed";
-    attempt.error = e.message;
-    if (e instanceof UMediaError) throw e;
-    throw new UMediaError(Codes.PROVIDER_UNAVAILABLE, `X unavailable: ${e.message}`, { attempts: [attempt] });
+    attempt.error = j_err(attempt.note);
+    throw new UMediaError(Codes.MEDIA_NOT_FOUND,
+      `X exposes no media for this tweet (${attempt.error}) — protected/removed tweets stay inaccessible; the yt-dlp tier adds cookie support.`, { attempts: [attempt] });
   }
+
+  attempt.status = "success";
+  attempt.latencyMs = Date.now() - t0;
+  return {
+    result: {
+      sourceUrl: url,
+      platform: name,
+      title: title ? title.slice(0, 200) : null,
+      author,
+      thumbnail: media[0].thumbnail,
+      itemCount: media.length,
+      counts: {
+        images: media.filter((m) => m.type === "image").length,
+        videos: media.filter((m) => m.type === "video").length,
+        audios: 0, other: 0,
+      },
+      truncated: false,
+      media,
+      streamUrlsAvailable: true,
+    },
+    engine: { attempts: ctx.attempts || [attempt], finalProvider: name, totalLatencyMs: Date.now() - t0 },
+  };
+}
+
+function j_err(note) {
+  return (note || "no media in public routes").replace(/^.*?(graphql|syndication)/, "$1");
 }
 
 export async function search() {