🧋 harden video player and infra stack

.dockerignore

@@ -13,4 +13,6 @@ yarn-debug.log*
 .DS_Store
 .env
 .env.*
+apps/web/.env
+apps/web/.env.*
 certificates

.env.example

@@ -32,7 +32,6 @@ FLIPT_URL=http://127.0.0.1:8090
 FLIPT_ENVIRONMENT=default
 FLIPT_NAMESPACE=default
 FLIPT_API_TOKEN=
-FLIPT_FLAG_CACHE_TTL_MS=600000
 # Public asset CDN origin (must match next.config assetPrefix / Bunny pull zone)
 NEXT_PUBLIC_CDN_ORIGIN=https://cdn.nyumatflix.com
 IMGPROXY_PORT=9081

.github/workflows/ci.yml

@@ -12,7 +12,6 @@ env:
   FLIPT_URL: http://flipt:8080
   FLIPT_ENVIRONMENT: default
   FLIPT_NAMESPACE: default
-  FLIPT_FLAG_CACHE_TTL_MS: "30000"
 
 on:
   push:
@@ -87,7 +86,6 @@ jobs:
           FLIPT_ENVIRONMENT=${FLIPT_ENVIRONMENT}
           FLIPT_NAMESPACE=${FLIPT_NAMESPACE}
           FLIPT_API_TOKEN=${FLIPT_API_TOKEN}
-          FLIPT_FLAG_CACHE_TTL_MS=${FLIPT_FLAG_CACHE_TTL_MS}
           EOF
 
       - name: Build WASM and app

.gitignore

@@ -7,6 +7,7 @@ node_modules/
 
 # testing
 /coverage
+/benchmark-results/
 
 # next.js
 **/.next/

.husky/check-emoji.js

@@ -1,22 +1,21 @@
 import fs from "fs";
-import emojiRegex from "emojibase-regex";
 
 const msgFile = process.argv[2];
 
 if (!msgFile) {
   console.error("No commit message file found");
-  process.exit(1);
+  process.exit(2);
 }
 
 const msg = fs.readFileSync(msgFile, "utf8");
 const firstLine = (msg.split(/\r?\n/)[0] ?? "").trim();
 
-// emojibase-regex covers most sequences; avoid the `g` flag so .test() does not
-// depend on lastIndex. Extended_Pictographic catches edge cases the base pattern misses.
-const emojibasePattern = new RegExp(emojiRegex.source, "u");
 const hasEmojiInSubject =
-  emojibasePattern.test(firstLine) ||
-  /\p{Extended_Pictographic}/u.test(firstLine);
+  /\p{Extended_Pictographic}/u.test(firstLine) ||
+  /\p{Emoji_Presentation}/u.test(firstLine);
+
+if (hasEmojiInSubject) {
+  process.exit(0);
+}
 
-if (hasEmojiInSubject) process.exit(0);
 process.exit(1);

.husky/prepare-commit-msg

@@ -20,12 +20,40 @@ if ! command -v node >/dev/null 2>&1; then
   fi
 fi
 
-# Always run the checker when possible so we skip emojify if the subject already has an emoji.
-# Previously, the no-bun path skipped the checker and always ran emojify (duplicate emojis).
-if command -v bun >/dev/null 2>&1; then
-  bun "$SCRIPT_DIR/check-emoji.js" "$1" || bunx --bun @humankode/git-commit-emojify@latest "$1"
-elif command -v node >/dev/null 2>&1; then
-  node "$SCRIPT_DIR/check-emoji.js" "$1" || npx --yes @humankode/git-commit-emojify@latest "$1"
-else
+run_checker() {
+  if command -v bun >/dev/null 2>&1; then
+    bun "$SCRIPT_DIR/check-emoji.js" "$1"
+    return $?
+  fi
+
+  if command -v node >/dev/null 2>&1; then
+    node "$SCRIPT_DIR/check-emoji.js" "$1"
+    return $?
+  fi
+
+  return 2
+}
+
+run_emojify() {
+  if command -v bun >/dev/null 2>&1; then
+    bunx --bun @humankode/git-commit-emojify@latest "$1"
+    return $?
+  fi
+
   npx --yes @humankode/git-commit-emojify@latest "$1"
+}
+
+run_checker "$1"
+status=$?
+
+if [ "$status" -eq 0 ]; then
+  exit 0
 fi
+
+if [ "$status" -eq 1 ]; then
+  run_emojify "$1"
+  exit $?
+fi
+
+echo "prepare-commit-msg: emoji check failed (exit $status)" >&2
+exit "$status"

Dockerfile

@@ -10,9 +10,11 @@ FROM oven/bun:1 AS builder
 WORKDIR /app
 
 ENV NEXT_TELEMETRY_DISABLED=1
+ENV SKIP_ENSURE_ENV=1
 
 ARG TMDB_API_KEY
 ARG CAP_API_ENDPOINT
+ARG SKIP_PLAYER_BUILD=0
 ENV TMDB_API_KEY=$TMDB_API_KEY
 ENV CAP_API_ENDPOINT=$CAP_API_ENDPOINT
 
@@ -23,7 +25,15 @@ COPY packages ./packages
 RUN test -f packages/player/dist/wasm/movi.js || (echo "missing packages/player/dist/wasm/movi.js — run: bunx turbo build:wasm --filter=@nyumatflix/player" && exit 1)
 RUN node apps/web/scripts/prepare-anime-mappings.mjs
 RUN bunx turbo build --filter=@calluspirates/shared --filter=@nyumatflix/playback
-RUN cd packages/player && bun run build
+RUN if [ "$SKIP_PLAYER_BUILD" = "1" ] && \
+      [ -f packages/player/dist/element.js ] && \
+      [ -f packages/player/dist/wasm/movi.js ] && \
+      [ -f apps/web/public/vendor/player/element.js ]; then \
+      echo "[build] player artifacts present — skipping player rebuild"; \
+    else \
+      cd packages/player && bun run build; \
+    fi
+RUN cd apps/web && bun install --foreground-scripts sharp @img/sharp-linux-x64
 RUN cd apps/web && bun run build
 
 FROM node:24.15.0-slim AS runner