# myCodec — Complete Technical & Architectural Reference for LLMs (llms-full.txt)

Canonical Domain: https://mycodec.app
Control Dashboard: https://dash.mycodec.app
Private Player Subdomain Pattern: https://{username}.mycodec.app

## 1. Executive Summary & Use Cases
myCodec is a cloud-native private media player SaaS built on Cloudflare Workers, Cloudflare Containers (Durable Objects: `LightContainer` and `StreamContainer`), Cloudflare D1, and EmDash CMS.
Its primary use case is enabling front-seat passengers and rear-seat passengers to watch streaming video inside in-vehicle infotainment browsers (such as the Tesla Chromium Browser) while the vehicle is in motion (Gear: Drive), as well as on other restricted browser environments where standard HTML5 `<video>` elements are throttled, blocked, or suspended.

> Legal & Safety Notice: Under the Road Traffic Act of Japan (Article 71, Item 5-5), drivers are strictly prohibited from viewing or operating displays while driving. myCodec is designed exclusively for passenger operation while in motion, or driver use only while parked.

## 2. Three `<video>`-Free Streaming Engines
1. **Direct (`direct` — fMP4 + WebCodecs + WebAudio)**
   - Endpoint: `/api/direct-stream`
   - Container tier: `LightContainer` (1/4 vCPU, instant boot)
   - Pipeline: Remuxes H.264 video and AAC audio into fragmented MP4 (`-c:v copy -f mp4 -movflags frag_keyframe+empty_moov+default_base_moof`) without server-side video transcoding. Demuxed in browser via MP4Box and decoded on GPU via WebCodecs `VideoDecoder` onto `<canvas>`.
   - Advantage: ~70% bandwidth reduction compared to MJPEG/WebP frame streams, near-zero server CPU load, 60fps hardware decoding.
2. **Canvas RT (`mpegts` — MPEG-TS + JSMpeg Single-Clock)**
   - Endpoint: `/api/mpegts`
   - Container tier: `StreamContainer` (Standard-2, full FFmpeg)
   - Pipeline: Transcodes to MPEG-1 Video + MP2 Audio over MPEG-TS, rendered via JSMpeg WebGL + WebAudio with single-clock A/V sync.
3. **Frame Safe (`frames` — WebP/JPEG Binary Stream + WebGPU/WebGL2/2D + LIVE Governor)**
   - Endpoints: `/api/frames` + `/api/audio`
   - Container tier: `StreamContainer`
   - Pipeline: Binary SOI/EOI framed WebP/JPEG stream with WebGPU -> WebGL2 -> 2D Canvas renderer fallback and automatic LIVE latency governor.

## 3. SaaS Multi-Tenancy, Onboarding & Strict Quotas
- **Google OAuth 2.0 Login**: `/api/auth/google/login` -> callback at `https://mycodec.app/?code=...&state=...`
- **Step 1 (Username Selection)**: New users pick a unique `username` (`/api/onboarding/username`), provisioning `https://{username}.mycodec.app`.
- **Step 2 (Plugin Selection & Skip Option)**: Users select community plugins (`/api/onboarding/plugins`). Detailed configuration (API keys, Cookies, Proxy) can be skipped (`skipDetailedConfig: true`), in which case the Cloudflare Worker edge transparently falls back to server-side keys/proxy without ever exposing credentials to the client.
- **Quotas**:
  - Max 1 private player page per user (`{username}.mycodec.app`).
  - No concurrent viewing (`maxConcurrentStreamsPerUser: 1`). Enforced via D1 `mc_active_streams` lease lock (`HTTP 409 CONCURRENT_STREAM_LIMIT_EXCEEDED`).
  - Users can start (deploy) or stop their player anytime at `https://dash.mycodec.app`.

## 4. Security & Zero-Leakage Proofs
- **Per-Player Encrypted Settings**: Stored in Cloudflare D1 (`mc_player_configs`) encrypted with Web Crypto **AES-256-GCM** (`v1.<iv>.<ciphertext>`), replacing browser `localStorage`.
- **Header Spoofing Prevention**: Incoming `x-internal-player-config` headers from external clients are stripped at the edge.
- **Redaction**: `redactSensitiveInfo()` strips API keys, Bearer tokens, Cookie headers, and `http://user:pass@host` proxy credentials from all client responses and logs.
- **`.mjs` Code Plugin Sandbox**: `analyzeMjsPluginCode()` blocks `eval`, `Function`, `process.env`, `globalThis`, `WebSocket`, dynamic `import()`, and `isSafeExternalUrl()` blocks SSRF to loopback/RFC1918/link-local IPs.
- **Live Verification Endpoint**: `GET https://mycodec.app/api/security/proof`

## 5. Community Marketplace Plugins (User-Contributed, Self-Responsibility)
All plugins are user-contributed modules shared in the Community Marketplace and used at the user's own risk and responsibility:
- **YouTube** (`id: "youtube"`, version `1.0.0`, contributed by `@kenji_ev_audio`): YouTube VOD (分離DASHトラック + ローカルRange継続プロキシ + キーフレーム音ズレ補正) および YouTube LIVE ストリーミング再生・検索・急上昇・関連動画・ライブチャット機能を提供します。 (Hosts: youtube.com, youtu.be, youtube-nocookie.com)
- **ABEMA** (`id: "abema"`, version `1.0.0`, contributed by `@sora_stream_jp`): ABEMA のリアルタイム放送チャンネル一覧取得・CM自動待機付きライブ再生・コメント取得プラグイン。日本国内IP(またはSTREAM_PROXY)を使用します。 (Hosts: abema.tv)
- **Twitch** (`id: "twitch"`, version `1.0.0`, contributed by `@ren_live_dev`): Twitch ライブ配信プラグイン。URL直接指定の再生はAPIキー不要で動作し、Client ID / Secret を設定するとトップページ一覧と検索が有効になります。 (Hosts: twitch.tv)
- **Kick** (`id: "kick"`, version `1.0.0`, contributed by `@miku_kick_mod`): Kick ライブ配信プラグイン。URL直接指定の再生はAPIキー不要で動作し、Kick 公式APIの Client ID / Secret を設定するとトップページ一覧と検索が有効になります。 (Hosts: kick.com)
- **TikTok** (`id: "tiktok"`, version `1.0.0`, contributed by `@yuta_short_stream`): TikTok LIVE (streamlink) および TikTok ショート動画 (yt-dlp ローカルキャッシュ + Creative Center トレンド連携) プラグイン。 (Hosts: tiktok.com)
- **TVer** (`id: "tver"`, version `1.0.0`, contributed by `@haruka_catchup_tv`): 民放公式テレビ配信サービス TVer プラグイン。人気番組ランキング・検索(クライアントXHR)および分離HLSストリーム再生を提供します。 (Hosts: tver.jp)
- **ニコニコ動画 / ニコ生** (`id: "niconico"`, version `1.0.0`, contributed by `@takumi_nico_danmaku`): ニコニコ動画(H.264/AAC分離ストリーム)およびニコニコ生放送のURL再生に対応するコミュニティプラグイン。 (Hosts: nicovideo.jp, live.nicovideo.jp, nico.ms)
- **Bilibili (ビリビリ)** (`id: "bilibili"`, version `1.0.0`, contributed by `@lin_acg_stream`): Bilibili 動画・ライブ配信の再生プラグイン。言語プレフィックス正規化・モバイルUA互換に対応。 (Hosts: bilibili.com, b23.tv, live.bilibili.com)
- **Vimeo** (`id: "vimeo"`, version `1.0.0`, contributed by `@kaito_cinema_hd`): Vimeo のVOD動画再生プラグイン。player.vimeo.com 埋め込み形式への自動正規化に対応。 (Hosts: vimeo.com, player.vimeo.com)
- **Dailymotion** (`id: "dailymotion"`, version `1.0.0`, contributed by `@nao_euro_video`): Dailymotion の高画質VOD動画再生プラグイン(映像+音声分離ストリーム合成対応)。 (Hosts: dailymotion.com, dai.ly)