nx_video_sniff.nx

nx_video_sniff.nx -- the DISCOVERY->DOWNLOAD bridge for JS-hardened video sites. Runs a page's JS on the sovereign engine (via nx_media_jsexec), captures the stream/media URLs its obfuscated code CONSTRUCTS and fetches, RANKS them (a manifest beats a raw segment beats nothing), and emits a DOWNLOAD PLAN routing the best target to the EXISTING X-DLP engine: .m3u8 -> nx_hls_get (handles master/variant + #EXT-X-KEY AES-128 decrypt + TS->fMP4), .mp4/.webm -> nx_video_get. This is the "sniff the video URL" step a browser video-download extension does, made native. HONEST CAPABILITY LINE (what this + the X-DLP engine actually beat, and what they don't): * OBFUSCATION -> BEATEN by EXECUTING the bundle (we run its JS) rather than reading it. The URL the code builds at runtime surfaces regardless of how the source is mangled. * SIGNED/TOKENED URLs -> captured WHEN the page builds them client-side from page data (id/hash/consts). If a signed URL requires a SERVER round-trip (fetch config -> server returns signed manifest), round-1 pending-capture does NOT have it -> that needs the MULTI-ROUND real-network capture (next rung; here the fetches PEND, no network). Named honestly, not overclaimed. * #EXT-X-KEY AES-128 HLS encryption -> BEATEN (nx_hls_get + nx_aes_cbc, NIST-KAT'd, live-verified). * WIDEVINE / PLAYREADY / FAIRPLAY EME DRM -> the REAL WALL. Content is decrypted by a closed CDM blob with keys from a license server; decrypted frames never touch JS. NOT defeatable natively (needs a CDM) and legally fraught. (ClearKey EME, which puts keys in JS, is the one EME variant that IS reachable -- a later rung.) A site with genuine Widevine is out of reach no matter how good discovery is; MANY sites that LOOK DRM'd are actually just obfuscation + signing + AES-128 = fully in reach.