feat(tracker-adapters): add Simurg registry entry

[patrickdundas]

Adds Simurg, a books/audiobooks/comics tracker launched in August 2026.

Registry-only. Simurg runs stock Gazelle with the Ocelot tracker daemon — it names both in its own rules — so the existing gazelle adapter, gazelleEnrich, and the /ajax.php default path already cover it. No adapter work needed.

Two site-specific facts that change how we operate

Freeleech autosnatching is prohibited outright (rule 5.3). There is no carve-out for autodl-irssi or autobrr; the site references a dedicated Freeleech Autosnatching Policy article. Compare phoenixproject, whose rules explicitly permit both tools. Because Simurg's entire catalogue is freeleech at launch, this rules out autobrr for this tracker completely. Manual adds only.

There is no minimum seed time and no concurrent-torrent cap. Quoting the site: "Seeding Rules: There aren't any." So seedTimeHours: 0 is a real measured zero rather than an unknown, and no floor should be copied here from a neighbouring entry. There is also no hit-and-run system, which matches the Gazelle adapter already reporting hitAndRuns: null.

Deliberate zero

loginIntervalDays is 0 because the real value is unknown, not because there is no requirement. Accounts must log in regularly or be disabled, and seeding does not count as activity. The threshold is configurable per-site and Simurg's own wiki says to rely on the warning email and current site notice rather than a copied number, so guessing one here would be worse than recording the uncertainty.

Other notes captured in fullRulesMarkdown

• Bonus points reward contribution and preservation rather than volume: 1,000 BP per upload, a 0.05 BP/hour floor per seeded torrent regardless of size, a scarcity multiplier up to 2x as last seeder, and a longevity multiplier reaching 5x after 365 credited days. The site pays the higher of the preservation reward and the size-based reward, never the sum.
• API limit is 5 requests per 10-second window and HTML scraping is prohibited. Hourly polling is well inside this, and the adapter's 1.5s enrichment pause is fine.
• Required ratio is personalised; the first 5 GiB of counted downloads is protected; falling below starts a two-week ratio watch.
• minimumRatio: 0.65 is the demotion floor, not a target. Below it any class above User drops back to User.

The class ladder (User → Member → Power User → Elite → Torrent Master) is recorded with its real thresholds. The site says Power TM, Elite TM and Ultimate TM exist but are not yet documented, so that is noted rather than invented.

Tests

Typecheck clean, biome clean, 2946 passing. The single failure in chart-transforms.test.ts is pre-existing on main and unrelated.

🤖 Generated with Claude Code

[github-actions]

⚠️ Tracker registry warnings

Simurg (`simurg`) — Warnings (7)

Field	Status
profileUrlPattern defined but supportsTransitPapers is not true	⚠️ Warning
Missing releaseGroups	⚠️ Warning
Missing notableMembers	⚠️ Warning
Missing bannedGroups	⚠️ Warning
Missing stats	⚠️ Warning
Missing logo	⚠️ Warning
Missing trackerHubSlug	⚠️ Warning

---

Allowed content categories: Movies, TV, Music, Games, Apps, Sports, Books, Audiobooks, Comics, Manga, Anime, XXX, Documentaries, Education, Tutorials, Fanres

See src/data/__tests__/tracker-registry.test.ts for all validation rules.

[github-actions]

Knip Code Analysis

Found 9 total issues

Category	Count
Unused Dependencies	1
Unused Dev Dependencies	3
Unused Exports	5

View details

Run pnpm knip locally to see the full report.

Use pnpm knip:filter pattern to filter results by file path.

---

Use /** @public */ JSDoc tags to mark intentionally exported symbols.

[github-actions]

🚫 Security audit failed

Critical Failures

Check	File	Details
External fetch calls have timeouts	src/lib/adapters/btn.ts:69	fetch() call without a timeout signal — add signal: AbortSignal.timeout(ms)

Warnings

Check	File	Details
No swallowed errors in catch blocks	src/lib/adapters/iptorrents.ts:108	catch block swallows error without logging or re-throwing
No swallowed errors in catch blocks	src/lib/adapters/iptorrents.ts:114	catch block swallows error without logging or re-throwing
No swallowed errors in catch blocks	src/lib/adapters/iptorrents.ts:175	catch block swallows error without logging or re-throwing
No swallowed errors in catch blocks	src/lib/adapters/iptorrents.ts:181	catch block swallows error without logging or re-throwing

Passed (36/38)

• ✅ Auth enforcement on protected routes (per-handler)
• ✅ No dangerous functions (eval, innerHTML, etc.)
• ✅ No hardcoded secrets in source
• ✅ Security headers in next.config.ts
• ✅ Cookie security (httpOnly, sameSite, secure)
• ✅ No sensitive fields in API responses
• ✅ No .env files committed to repo
• ✅ No raw SQL in API routes
• ✅ No fetch/redirect with unvalidated URLs in routes
• ✅ Timing-safe comparison for secret values
• ✅ No raw SQL migration files (schema-first only)
• ✅ Docker container runs as non-root user
• ✅ Public routes match proxy allowlist
• ✅ File delete operations have path traversal defense
• ✅ Password hashing uses Argon2 (not SHA-256/bcrypt)
• ✅ Encrypted columns written via encrypt()
• ✅ TOTP 2FA flow integrity
• ✅ Emergency lockdown flow integrity
• ✅ Scrub & delete (nuke) flow integrity
• ✅ Backup restore flow integrity
• ✅ Login flow integrity
• ✅ Auth result checked before proceeding
• ✅ Backup password inputs bounded before key derivation
• ✅ Webhook delivery fetch uses redirect: "error"
• ✅ SESSION_SECRET minimum-length guard in auth/crypto modules
• ✅ Notification URL validators include SSRF protection
• ✅ Dockerfile does not COPY sensitive files
• ✅ No secret env vars in client components
• ✅ Adapter Cookie headers guard against injection
• ✅ Adapter files do not log credential values
• ✅ No console.log in API routes
• ✅ No TODO/FIXME in security-critical files
• ✅ JSON.parse wrapped in try-catch
• ✅ Request body size validation on upload routes
• ✅ BigInt fields use string serialization
• ✅ No raw error messages in API responses

---

Summary: 36/38 checks passed
— 1 critical failure(s)
— 1 warning(s)

See scripts/security-audit.ts for check definitions and SECURITY.md for the full security architecture.