# Unspooled Clean Architecture (2026-05-31)

## Architecture: Debrid-Only, No Web Scraping

```mermaid
flowchart TD
    subgraph "Stream Sources"
        AIO[AIOStreams<br/>configuredManifestUrl]
        USER[User-Installed<br/>Stremio Addons]
        DEBRID[Debrid Search /<br/>User Library]
    end

    subgraph "Provider Registry"
        REG[ProviderRegistry]
        SCRAPER[ScraperProvider<br/>Stremio addon-based]
    end

    subgraph "Debrid Auth"
        OAuth[OAuth Device Code<br/>RD, PM]
        APIKey[API Key via QR<br/>TB, AD, Debrider, Offcloud]
    end

    AIO --> SCRAPER
    USER --> SCRAPER
    DEBRID --> SCRAPER
    SCRAPER --> REG
    DebridService --> OAuth
    DebridService --> APIKey
    REG -.->|only when<br/>debrid connected| Streams[Stream Results]
```

## Key Decisions

### What was REMOVED (May 2026)
- All web scraping: SmashyStream, VidSrc, AutoEmbed, AllMovieLand, SwiftStreamz
- Go scraper proxy server (archived to ~/Unspooled-archive/)
- Embed source provider (EmbedSourceProvider.kt)
- Direct link provider (DirectLinkProvider.kt)
- System pre-bundled addon providers (CometProvider, MediaFusionProvider, TorrentioProvider)
- All free/embed tier from ProviderRegistry
- Web remote (was hosted on scraper-proxy)
- Nginx scraper proxy routes

### What was KEPT
- AIOStreamsProvider (recommended preset, auto-configures with debrid)
- Stremio addon infrastructure (SystemAddonCatalog, ScraperProvider, StreamScraperEngine)
- Metadata/catalog addons (Cinemeta, TMDB Addon, OpenSubtitles, More Like This)
- Debrid service authentication (all 6 providers)
- Addon config sessions (Cloudflare Worker, Durable Objects)
- QR code infrastructure (QrCodeGenerator, DeviceIpAddress)

### What was ADDED
- Cloudflare Worker auth sessions (AuthSessionDO)
- QR-based debrid auth (OAuth device code + API key entry)
- QR-based addon URL entry
- ProviderRegistryProvidedSourcesTest (5 tests, verifies no banned providers)

## Source Priority

1. AIOStreams configuredManifestUrl (auto-configured)
2. User-installed Stremio addons (via URL)
3. Debrid Search / debrid library
4. *(No fallback - empty results)*

## File Layout

### Removed
```
app/src/main/java/com/unspooled/app/data/provider/EmbedSourceProvider.kt
app/src/main/java/com/unspooled/app/data/provider/DirectLinkProvider.kt
app/src/main/java/com/unspooled/app/data/provider/CometProvider.kt
app/src/main/java/com/unspooled/app/data/provider/MediaFusionProvider.kt
app/src/main/java/com/unspooled/app/data/provider/TorrentioProvider.kt
app/src/main/java/com/unspooled/app/service/RemoteInputService.kt
res/xml/remote_input_service_config.xml
~/scraper-proxy/ (entire Go server, Docker, nginx config)
```

### Added/Updated
```
app/src/main/java/com/unspooled/app/data/addon/cloud/DebridAuthApiClient.kt
app/src/main/java/com/unspooled/app/data/addon/cloud/AddonUrlApiClient.kt
app/src/main/java/com/unspooled/app/data/provider/ProviderRegistry.kt (rewritten)
app/src/main/java/com/unspooled/app/data/addon/SystemAddonCatalog.kt (cleaned)
app/src/test/.../ProviderRegistryProvidedSourcesTest.kt
services/addon-config-worker/src/auth_session_do.ts
services/addon-config-worker/src/auth_page.ts
services/addon-config-worker/src/auth_models.ts
services/addon-config-worker/src/index.ts (extended with auth routes)
```

## Test Coverage

`ProviderRegistryProvidedSourcesTest` (5 tests):
- `providers list contains NO embed or direct-link scrapers`
- `no providers available without debrid connection`
- `only debrid scraper provider registered when debrid connected`
- `no embed source URLs or scraper proxy URLs in any provider config`
- `provider registry has no alwaysEnabled free-tier providers`

Run: `./gradlew :app:testDebugUnitTest --tests "*ProviderRegistryProvidedSourcesTest"`