Cobalt is a privacy-focused media downloader web application with a SvelteKit frontend and Node.js/Express API backend. Users paste a URL from supported platforms (YouTube, TikTok, Instagram, Twitter/X, Vimeo, Reddit, SoundCloud, Twitch, Bilibili, and 15+ others) and receive a downloadable media file. The architecture is a monorepo with three packages: @imput/cobalt-web (static frontend), @imput/cobalt-api (processing backend), and @imput/version-info (build-time version helper). The API acts as a fancy proxy - it fetches media streams from source platforms, optionally remuxes/transcodes via FFmpeg (server-side or client-side via libav.js WebAssembly), and streams results back without ever writing to disk. The frontend handles URL input, settings management (localStorage with migration), a processing queue with Web Workers for client-side FFmpeg, i18n (EN/RU), and PWA features. Key data flows: user submits URL → API validates/matches service → extracts stream URLs → returns tunnel/redirect/picker response → frontend either streams directly, proxies via API, or processes locally via Web Workers. External dependencies: FFmpeg (via ffmpeg-static), youtubei.js for YouTube, hls-parser, undici for HTTP, Redis (optional for rate limiting), Cloudflare Turnstile (optional bot protection).
Prosopo is a privacy-focused, self-hosted CAPTCHA alternative that provides multiple challenge types—image selection, puzzle (image jigsaw), proof-of-work, and frictionless (behavioral bot detection). The system comprises an Express-based provider API (with MongoDB and Redis for persistence and caching), a CLI for administrative tasks, client-side embeddable widgets (vanilla JS bundle, React/Angular/Vue/Svelte wrappers), and a suite of supporting libraries for cryptography, locale, datasets, and native Rust modules (JA4 TLS fingerprinting, Merkle tree acceleration, puzzle rendering). Bot detection is multi-layered: client-side behavioral data (mouse/keyboard/touch events, SIMD readings) is collected and server-side scored, combined with JA4 TLS fingerprint analysis, IP reputation (ipapi.is + MaxMind), DNS asymmetry detection, spam email heuristics, and custom decision machines per site key. The architecture is a monorepo with ~70 workspaces, leveraging Vite for bundling, Vitest for unit/integration tests, and Cypress for E2E visual regression testing. The provider enforces access policies (allow/block/restrict) via a Redis-backed rules engine and maintains usage counters for rate limiting. Asset sealing (AES-256-GCM) protects image CDN URLs, and puzzle difficulty is sampled with a CSPRNG-stratified ladder to frustrate solver calibration.