[nataliagranato]

What this is

Public, ad-free page where someone pastes a link from Instagram (post, Reel, or public Story), TikTok, X, or YouTube and downloads the media. The API never logs in, never sends cookies, and does not keep the file after the response finishes.

• api/: FastAPI plus pinned yt-dlp. Host allowlist now includes youtube.com, m.youtube.com, and youtu.be, including Shorts. Playlists and live streams are rejected. YouTube video options keep the progressive file and add merged H.264 + AAC up to 1080p (ffmpeg remux, -c copy, no video re-encode). Every video also gets Baixar MP3 (192 kbps, one ffmpeg thread). Temp files are deleted after streaming. MAX_FILE_BYTES and the download timeout still apply.
• YouTube bot-check (Sign in to confirm you're not a bot) returns a Portuguese explanation. Datacenter IPs such as Render's are often blocked; the README says so. The API does not try to log in around it.
• web/: same single page, now in a monochrome layout (Geist Sans and Geist Mono, 1px borders, system light/dark). No Vercel logos or assets.

Verification

• API: ruff and 101 pytest cases, network blocked. New coverage: YouTube URL shapes, playlist/live rejection, bot-check mapping, merged H.264 options (VP9 is not re-encoded), MP3 command and temp-dir cleanup, MP3 download response.
• Web: eslint, tsc --noEmit, and next build.
• Browser: light and dark home, phone width, a real playlist URL rejected by the API, and the preview showing 1080p, 360p, and Baixar MP3.

Página clara
Página escura
Opções de vídeo e MP3
Playlist do YouTube recusada no celular

The preview card uses a local stand-in response so the screenshot does not pull a real video. The API tests build that same shape from mocked yt-dlp data. The playlist error is the live API.

Still needs a person

• Render account and render.yaml (or the Docker service in api/). If plan: free is rejected, use the smallest web instance. YouTube downloads from that IP may fail the bot check.
• Vercel project, root directory web, NEXT_PUBLIC_API_URL=https://api.baixa.nataliagranato.xyz.
• DNS for baixa.nataliagranato.xyz and api.baixa.nataliagranato.xyz.
• DOWNLOAD_TOKEN_SECRET from the blueprint. Do not commit it.
• Optional Sentry DSNs. Leave them empty to keep Sentry off.
• ffmpeg is already in the API image. A local uvicorn needs ffmpeg on the PATH for MP3 and YouTube remux.

_{To show artifacts inline, enable in settings.}