@serifpersia/dango 3.0.3

package/server/dist/controllers/proxy.controller.js

@@ -0,0 +1,665 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProxyController = exports.axiosInstance = void 0;
+const axios_1 = __importDefault(require("axios"));
+const axios_retry_1 = __importDefault(require("axios-retry"));
+const got_scraping_1 = require("got-scraping");
+const path_1 = __importDefault(require("path"));
+const http_1 = __importDefault(require("http"));
+const https_1 = __importDefault(require("https"));
+const node_cache_1 = __importDefault(require("node-cache"));
+const config_1 = require("../config");
+const fs_1 = __importDefault(require("fs"));
+const logger_1 = __importDefault(require("../logger"));
+const cookie_utils_1 = require("../utils/cookie.utils");
+const security_utils_1 = require("../utils/security.utils");
+function firstString(value) {
+    if (typeof value === 'string')
+        return value;
+    if (Array.isArray(value)) {
+        const first = value[0];
+        if (typeof first === 'string')
+            return first;
+    }
+    return undefined;
+}
+const proxyCache = new node_cache_1.default({ stdTTL: 30, checkperiod: 60 });
+const httpAgent = new http_1.default.Agent({ keepAlive: true, maxSockets: 100 });
+const httpsAgent = new https_1.default.Agent({ keepAlive: true, maxSockets: 100 });
+httpAgent.setMaxListeners(100);
+httpsAgent.setMaxListeners(100);
+exports.axiosInstance = axios_1.default.create({
+    httpAgent,
+    httpsAgent,
+    timeout: 30000,
+});
+(0, axios_retry_1.default)(exports.axiosInstance, { retries: 3, retryDelay: axios_retry_1.default.exponentialDelay });
+class ProxyController {
+    static KWIK_DOMAINS = new Set(['kwik.cx', 'kwik.si', 'kwik.pro']);
+    static ANIMEPAHE_URL = 'https://animepahe.pw/';
+    static VAULT_CDN_HOSTS = new Set(['uwucdn.top', 'owocdn.top']);
+    static GOT_SCRAPING_HOSTS = new Set([
+        'kwik.cx',
+        'kwik.si',
+        'kwik.pro',
+        'animepahe.pw',
+        'animepahe.ru',
+    ]);
+    static GOT_SCRAPING_SUFFIXES = [
+        '.uwucdn.top',
+        '.owocdn.top',
+        '.streamzone1.site',
+        '.nekostream.site',
+        '.nukitashith.top',
+        '.aniwatchtv.site',
+    ];
+    static HANIME_HOSTS = new Set(['r2.1hanime.com', '1.1hanime.com']);
+    static OPPAI_HOSTS = new Set(['myspacecat.pictures']);
+    static KAA_HOSTS = new Set([
+        'hls.krussdomi.com',
+        'subst.krussdomi.com',
+        'krussdomi.com',
+        'st1.advancedairesearchlab.xyz',
+        'st1.habibikun.xyz',
+        'st1.babybayw.xyz',
+        'st1.narutokun.xyz',
+    ]);
+    static KAA_REFERER = 'https://krussdomi.com/';
+    static KAA_ORIGIN = 'https://krussdomi.com';
+    static isGotScrapingHost(urlStr) {
+        try {
+            const host = new URL(urlStr).hostname.toLowerCase();
+            if (ProxyController.GOT_SCRAPING_HOSTS.has(host))
+                return true;
+            if (ProxyController.HANIME_HOSTS.has(host))
+                return true;
+            return ProxyController.GOT_SCRAPING_SUFFIXES.some((s) => host.endsWith(s));
+        }
+        catch {
+            return false;
+        }
+    }
+    abortWhenClientLeaves(res, abortController) {
+        res.on('close', () => {
+            if (!res.writableEnded) {
+                abortController.abort();
+            }
+        });
+    }
+    validateKwikUrl(value) {
+        if (typeof value !== 'string')
+            return null;
+        try {
+            const url = new URL(value);
+            const isSecure = url.protocol === 'https:';
+            const isKwik = ProxyController.KWIK_DOMAINS.has(url.hostname.toLowerCase());
+            const isEmbedPath = /^\/e\/[A-Za-z0-9_-]+$/.test(url.pathname);
+            const noAuthOrQuery = !url.username && !url.password && !url.search && !url.hash;
+            return isSecure && isKwik && isEmbedPath && noAuthOrQuery ? url : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    pinVariant(body, idx) {
+        const lines = body.split('\n');
+        let streamIdx = -1;
+        let skipUri = false;
+        const out = [];
+        for (const line of lines) {
+            const trimmed = line.trim();
+            if (trimmed.startsWith('#EXT-X-STREAM-INF')) {
+                streamIdx++;
+                skipUri = streamIdx !== idx;
+                if (!skipUri)
+                    out.push(line);
+                continue;
+            }
+            if (skipUri && trimmed && !trimmed.startsWith('#')) {
+                skipUri = false;
+                continue;
+            }
+            out.push(line);
+        }
+        if (streamIdx < 0 || idx > streamIdx)
+            return null;
+        return out.join('\n');
+    }
+    handleProxy = async (req, res) => {
+        const { url, referer, cookie } = req.query;
+        if (!url)
+            return res.status(400).send('URL required');
+        const safeCheck = (0, security_utils_1.isSafeExternalUrl)(url);
+        if (!safeCheck.safe) {
+            return res.status(400).send(safeCheck.error || 'Invalid URL');
+        }
+        const urlStr = url;
+        const refererStr = referer || '';
+        const cookieStr = cookie || '';
+        const variantIdx = req.query.variant !== undefined ? parseInt(req.query.variant, 10) : NaN;
+        const pinVariant = Number.isInteger(variantIdx) && variantIdx >= 0;
+        const cacheKey = `m3u8-${urlStr}-${refererStr}${pinVariant ? `-v${variantIdx}` : ''}`;
+        const abortController = new AbortController();
+        this.abortWhenClientLeaves(res, abortController);
+        try {
+            const isVaultCdn = Array.from(ProxyController.VAULT_CDN_HOSTS).some((host) => urlStr.includes(host));
+            const isHanime = Array.from(ProxyController.HANIME_HOSTS).some((host) => urlStr.includes(host));
+            const isOppai = Array.from(ProxyController.OPPAI_HOSTS).some((host) => urlStr.includes(host));
+            const isKaa = refererStr.startsWith(ProxyController.KAA_ORIGIN) ||
+                Array.from(ProxyController.KAA_HOSTS).some((host) => urlStr.includes(host));
+            const headers = {
+                'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0',
+            };
+            if (referer)
+                headers['Referer'] = refererStr;
+            if (isVaultCdn) {
+                headers['Origin'] = refererStr || ProxyController.ANIMEPAHE_URL;
+                const cookieHeader = (0, cookie_utils_1.buildCfClearanceCookie)(cookieStr);
+                if (cookieHeader)
+                    headers['Cookie'] = cookieHeader;
+            }
+            if (isHanime) {
+                if (!headers['Referer'])
+                    headers['Referer'] = refererStr || 'https://nhplayer.com/';
+                headers['Origin'] = 'https://nhplayer.com';
+            }
+            if (isOppai) {
+                if (!headers['Referer'])
+                    headers['Referer'] = refererStr || 'https://oppai.stream/';
+                headers['Origin'] = 'https://oppai.stream';
+            }
+            if (isKaa) {
+                if (!headers['Referer'])
+                    headers['Referer'] = refererStr || ProxyController.KAA_REFERER;
+                headers['Origin'] = ProxyController.KAA_ORIGIN;
+            }
+            if (urlStr.includes('weeabo0.xyz') || urlStr.includes('weeab0o.xyz')) {
+                if (!headers['Referer'])
+                    headers['Referer'] = refererStr || 'https://japaneseasmr.com/';
+                const jasmrCookieHeader = (0, cookie_utils_1.buildCfClearanceCookie)(cookieStr);
+                if (jasmrCookieHeader)
+                    headers['Cookie'] = jasmrCookieHeader;
+                const jasmrUa = req.query.ua || '';
+                if (jasmrUa)
+                    headers['User-Agent'] = jasmrUa;
+            }
+            if (req.headers.range)
+                headers['Range'] = req.headers.range;
+            if (urlStr.includes('.m3u8')) {
+                const cached = proxyCache.get(cacheKey);
+                if (cached) {
+                    return res
+                        .set('Content-Type', 'application/vnd.apple.mpegurl')
+                        .set('Access-Control-Allow-Origin', '*')
+                        .send(cached);
+                }
+                const resp = await (0, got_scraping_1.gotScraping)({
+                    url: urlStr,
+                    method: 'GET',
+                    headers,
+                    responseType: 'text',
+                    timeout: { request: 30000 },
+                    followRedirect: true,
+                    throwHttpErrors: false,
+                });
+                if (resp.statusCode !== 200 && resp.statusCode !== 206) {
+                    return res.status(resp.statusCode ?? 502).send('Upstream error');
+                }
+                const finalUrl = resp.url || urlStr;
+                const baseUrl = new URL(finalUrl);
+                const proxiedMediaUrl = (targetUrl) => `/api/proxy?url=${encodeURIComponent(targetUrl)}&referer=${encodeURIComponent(refererStr)}` +
+                    (cookieStr ? `&cookie=${encodeURIComponent((0, cookie_utils_1.sanitizeCfClearance)(cookieStr))}` : '') +
+                    (req.query.ua ? `&ua=${encodeURIComponent(req.query.ua)}` : '');
+                const needsProxy = Boolean(refererStr);
+                const isProxied = (value) => value.includes('/api/proxy');
+                let playlistBody = resp.body;
+                if (pinVariant) {
+                    const pinned = this.pinVariant(playlistBody, variantIdx);
+                    if (pinned)
+                        playlistBody = pinned;
+                }
+                const rewritten = playlistBody
+                    .split('\n')
+                    .map((line) => {
+                    const trimmed = line.trim();
+                    if (!trimmed)
+                        return line;
+                    if (trimmed.startsWith('#')) {
+                        return trimmed.replace(/URI="([^"]+)"/g, (_, uri) => {
+                            if (isProxied(uri))
+                                return `URI="${uri}"`;
+                            const absolute = new URL(uri, baseUrl).href;
+                            return `URI="${needsProxy || absolute.includes('.m3u8') ? proxiedMediaUrl(absolute) : absolute}"`;
+                        });
+                    }
+                    if (isProxied(trimmed))
+                        return line;
+                    const absolute = new URL(trimmed, baseUrl).href;
+                    return proxiedMediaUrl(absolute);
+                })
+                    .join('\n');
+                proxyCache.set(cacheKey, rewritten);
+                res
+                    .set('Content-Type', 'application/vnd.apple.mpegurl')
+                    .set('Access-Control-Allow-Origin', '*')
+                    .send(rewritten);
+            }
+            else {
+                if (ProxyController.isGotScrapingHost(urlStr)) {
+                    if (req.headers.range)
+                        headers['Range'] = req.headers.range;
+                    const resp = await (0, got_scraping_1.gotScraping)({
+                        url: urlStr,
+                        method: 'GET',
+                        headers,
+                        responseType: 'buffer',
+                        timeout: { request: 30000 },
+                        followRedirect: true,
+                        throwHttpErrors: false,
+                    });
+                    if (resp.statusCode !== 200 && resp.statusCode !== 206) {
+                        return res.status(resp.statusCode ?? 502).send('Upstream error');
+                    }
+                    const ct = resp.headers['content-type'];
+                    const isVtt = urlStr.endsWith('.vtt') || urlStr.includes('.vtt?');
+                    res.set('Content-Type', isVtt ? 'text/vtt; charset=utf-8' : ct || 'application/octet-stream');
+                    const cl = resp.headers['content-length'];
+                    if (cl)
+                        res.set('Content-Length', cl);
+                    const cr = resp.headers['content-range'];
+                    if (cr)
+                        res.set('Content-Range', cr);
+                    const ar = resp.headers['accept-ranges'];
+                    if (ar)
+                        res.set('Accept-Ranges', ar);
+                    res.set('Access-Control-Allow-Origin', '*');
+                    res.send(resp.body);
+                }
+                else {
+                    // Plain media streams (yt-mp4, etc.)
+                    // Proxy using axios streaming (got-scraping does not support stream/buffer for these hosts)
+                    const axiosResp = await (0, exports.axiosInstance)({
+                        url: urlStr,
+                        method: 'get',
+                        headers,
+                        responseType: 'stream',
+                        timeout: 30000,
+                        signal: abortController.signal,
+                    });
+                    const status = axiosResp.status;
+                    if (status !== 200 && status !== 206) {
+                        return res.status(status ?? 502).send('Upstream error');
+                    }
+                    res.status(status);
+                    const isVtt = urlStr.endsWith('.vtt') || urlStr.includes('.vtt?');
+                    const ct = firstString(axiosResp.headers['content-type']);
+                    res.set('Content-Type', isVtt ? 'text/vtt; charset=utf-8' : ct || 'application/octet-stream');
+                    const cl = firstString(axiosResp.headers['content-length']);
+                    if (cl)
+                        res.set('Content-Length', cl);
+                    const cr = axiosResp.headers['content-range'];
+                    if (cr)
+                        res.set('Content-Range', cr);
+                    const ar = axiosResp.headers['accept-ranges'];
+                    if (ar)
+                        res.set('Accept-Ranges', ar);
+                    res.set('Access-Control-Allow-Origin', '*');
+                    axiosResp.data.pipe(res);
+                }
+            }
+        }
+        catch (e) {
+            if (axios_1.default.isCancel(e))
+                return;
+            if (!res.headersSent) {
+                logger_1.default.error({ url: urlStr, error: e?.message }, '[proxy] upstream request failed');
+                res.status(500).send('Proxy error');
+            }
+        }
+    };
+    handleEmbedProxy = async (req, res) => {
+        const kwikUrl = this.validateKwikUrl(req.query.url);
+        if (!kwikUrl)
+            return res.status(400).send('Invalid or unsupported gateway URL');
+        const cookieStr = req.query.cookie || '';
+        const abortController = new AbortController();
+        this.abortWhenClientLeaves(res, abortController);
+        try {
+            const headers = {
+                'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0',
+                Referer: ProxyController.ANIMEPAHE_URL,
+                Origin: 'https://animepahe.pw',
+            };
+            if (cookieStr) {
+                const cookieHeader = (0, cookie_utils_1.buildCfClearanceCookie)(cookieStr);
+                if (cookieHeader)
+                    headers['Cookie'] = cookieHeader;
+            }
+            const response = await (0, got_scraping_1.gotScraping)({
+                url: kwikUrl.href,
+                method: 'GET',
+                headers,
+                responseType: 'text',
+                timeout: { request: 30000 },
+                followRedirect: true,
+                throwHttpErrors: false,
+            });
+            const originalHtml = response.body;
+            const patched = this.applyKwikPatches(originalHtml, kwikUrl, cookieStr);
+            if (!patched)
+                return res.status(502).send('Failed to patch video gateway');
+            return res
+                .status(200)
+                .set('Content-Type', 'text/html; charset=utf-8')
+                .set('Cache-Control', 'private, max-age=120')
+                .send(patched);
+        }
+        catch (e) {
+            if (axios_1.default.isCancel(e))
+                return;
+            if (abortController.signal.aborted)
+                return;
+            if (!res.headersSent)
+                res.status(502).send('Gateway proxy error');
+        }
+    };
+    applyKwikPatches(html, kwikUrl, cookieStr = '') {
+        const safeReferer = JSON.stringify(kwikUrl.href).replace(/</g, '\\u003c');
+        const safeCookie = JSON.stringify(cookieStr).replace(/</g, '\\u003c');
+        const patched = html.replace(/\b(src|href|url)\s*[=:]\s*(["']?)(\/\/[^"'>)]+|\/(?!\/)[^"'>)]*)\2/gi, (match, attr, quote, path) => {
+            const full = path.startsWith('//') ? `https:${path}` : `${kwikUrl.origin}${path}`;
+            const prefix = match.startsWith('url') ? `url(` : `${attr}=`;
+            const suffix = match.startsWith('url') ? `)` : '';
+            return `${prefix}${quote}${full}${quote}${suffix}`;
+        });
+        const iconProxy = `/api/proxy?url=${encodeURIComponent(`${kwikUrl.origin}/app/js/vendor/plyr.svg`)}&referer=${encodeURIComponent(kwikUrl.href)}`;
+        const plyrPatch = `<script>if(window.Plyr) Plyr.defaults.iconUrl=${JSON.stringify(iconProxy).replace(/</g, '\\u003c')};</script>`;
+        const hlsPatch = `<script>
+      (function() {
+        var hook = function() {
+          if (!window.Hls) return;
+          var original = Hls.prototype.loadSource;
+          Hls.prototype.loadSource = function(src) {
+            if (typeof src === 'string' && src.includes('.m3u8')) {
+              src = window.location.origin + '/api/proxy?url=' + encodeURIComponent(src) + '&referer=' + encodeURIComponent(${safeReferer}) + (${safeCookie} ? '&cookie=' + encodeURIComponent(${safeCookie}) : '');
+            }
+            return original.call(this, src);
+          };
+        };
+        if (window.Hls) hook();
+        else {
+          var observer = new MutationObserver(function() {
+            if (window.Hls) { hook(); observer.disconnect(); }
+          });
+          observer.observe(document.documentElement, { childList: true, subtree: true });
+        }
+      })();
+    </script>`;
+        const endBridgePatch = `<script>
+      (function() {
+        var notified = false;
+        var notifyEnded = function() {
+          if (notified) return;
+          notified = true;
+          window.parent.postMessage({ type: 'ANI_WEB_MEDIA_ENDED' }, window.location.origin);
+        };
+
+        var attachToVideos = function(root) {
+          var scope = root || document;
+          var videos = scope.querySelectorAll ? scope.querySelectorAll('video') : [];
+          Array.prototype.forEach.call(videos, function(video) {
+            if (video.dataset && video.dataset.aniWebEndedBridge === 'true') return;
+            if (video.dataset) video.dataset.aniWebEndedBridge = 'true';
+            video.addEventListener('ended', notifyEnded, { once: true });
+          });
+        };
+
+        attachToVideos(document);
+
+        var observer = new MutationObserver(function() {
+          attachToVideos(document);
+        });
+
+        observer.observe(document.documentElement, { childList: true, subtree: true });
+      })();
+    </script>`;
+        const beforePlyr = patched.replace(/(<script[^>]+\/plyr\.min\.js[^>]*><\/script>)/i, `$1${plyrPatch}`);
+        const final = beforePlyr
+            .replace(/(<script[^>]+hls(?:\.min)?\.js[^>]*><\/script>)/i, `$1${hlsPatch}`)
+            .replace(/<\/body>/i, `${endBridgePatch}</body>`);
+        return final === html ? null : final;
+    }
+    handleSubtitleProxy = async (req, res) => {
+        const { url, referer } = req.query;
+        if (!url)
+            return res.status(400).send('URL required');
+        const safeCheck = (0, security_utils_1.isSafeExternalUrl)(url);
+        if (!safeCheck.safe) {
+            return res.status(400).send(safeCheck.error || 'Invalid URL');
+        }
+        const abortController = new AbortController();
+        this.abortWhenClientLeaves(res, abortController);
+        try {
+            const headers = {
+                'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
+            };
+            if (referer)
+                headers['Referer'] = referer;
+            const subUrl = url;
+            if (referer?.startsWith(ProxyController.KAA_ORIGIN) ||
+                Array.from(ProxyController.KAA_HOSTS).some((host) => subUrl.includes(host))) {
+                headers['Origin'] = ProxyController.KAA_ORIGIN;
+            }
+            const response = await exports.axiosInstance.get(url, {
+                headers,
+                responseType: 'text',
+                signal: abortController.signal,
+            });
+            const body = String(response.data ?? '').replace(/^\uFEFF/, '');
+            if (/#EXTM3U/i.test(body.slice(0, 1000))) {
+                const segUrls = body
+                    .split('\n')
+                    .map((l) => l.trim())
+                    .filter((l) => l && !l.startsWith('#'))
+                    .slice(0, 200)
+                    .map((u) => {
+                    try {
+                        return new URL(u, subUrl).href;
+                    }
+                    catch {
+                        return null;
+                    }
+                })
+                    .filter((u) => Boolean(u));
+                const parts = [];
+                for (const seg of segUrls) {
+                    try {
+                        const segRes = await exports.axiosInstance.get(seg, {
+                            headers,
+                            responseType: 'text',
+                            signal: abortController.signal,
+                        });
+                        let segBody = String(segRes.data ?? '').replace(/^\uFEFF/, '');
+                        if (/#EXTM3U/i.test(segBody.slice(0, 200)))
+                            continue;
+                        segBody = segBody
+                            .replace(/\r\n/g, '\n')
+                            .replace(/(\d{2}:\d{2}:\d{2}),(\d{3})/g, '$1.$2');
+                        if (/^\s*WEBVTT/i.test(segBody)) {
+                            segBody = segBody.replace(/^\s*WEBVTT[^\n]*\n(\n|.*\n)?/, '');
+                        }
+                        segBody = segBody.trim();
+                        if (segBody)
+                            parts.push(segBody);
+                        if (parts.join('\n').length > 2_000_000)
+                            break;
+                    }
+                    catch (e) {
+                        if (axios_1.default.isCancel(e))
+                            return;
+                    }
+                }
+                if (parts.length === 0) {
+                    return res.status(502).send('Subtitle playlist empty');
+                }
+                res.set('Content-Type', 'text/vtt; charset=utf-8');
+                return res.send(`WEBVTT\n\n${parts.join('\n\n')}\n`);
+            }
+            res.set('Content-Type', 'text/vtt; charset=utf-8');
+            if (/^\s*WEBVTT/i.test(body))
+                return res.send(body);
+            return res.send(`WEBVTT\n\n${body.replace(/\r\n/g, '\n').replace(/(\d{2}:\d{2}:\d{2}),(\d{3})/g, '$1.$2')}`);
+        }
+        catch (e) {
+            if (axios_1.default.isCancel(e))
+                return;
+            res.status(500).send('Proxy error');
+        }
+    };
+    handleImageProxy = async (req, res) => {
+        const { url, cookie, ua } = req.query;
+        if (!url)
+            return res.status(400).send('URL required');
+        const safeCheck = (0, security_utils_1.isSafeExternalUrl)(url);
+        if (!safeCheck.safe) {
+            return res.status(400).send(safeCheck.error || 'Invalid URL');
+        }
+        const targetUrl = url;
+        const abortController = new AbortController();
+        this.abortWhenClientLeaves(res, abortController);
+        let refererValue = 'https://anilist.co/';
+        const headers = {
+            'User-Agent': ua ||
+                'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
+        };
+        try {
+            if (targetUrl.includes('animepahe')) {
+                refererValue = 'https://animepahe.pw/';
+                const rawCookie = cookie || '';
+                let sanitized = rawCookie.trim();
+                sanitized = sanitized.replace(/^cf_clearance/i, '');
+                sanitized = sanitized.replace(/^[:=]\s*/, '');
+                sanitized = sanitized.replace(/["']/g, '').trim();
+                headers['Cookie'] = `cf_clearance=${sanitized}`;
+            }
+            else if (targetUrl.includes('anilist.co')) {
+                refererValue = 'https://anilist.co/';
+            }
+            else if (targetUrl.includes('gogocdn.net')) {
+                refererValue = 'https://gogoanime.lu/';
+            }
+            else if (targetUrl.includes('animeya.cc')) {
+                refererValue = 'https://animeya.cc/';
+            }
+            else if (targetUrl.includes('myspacecat.pictures')) {
+                refererValue = 'https://oppai.stream/';
+            }
+            else if (targetUrl.includes('weeabo0.xyz')) {
+                refererValue = 'https://japaneseasmr.com/';
+                const rawCookie = cookie || '';
+                let sanitized = rawCookie.trim();
+                sanitized = sanitized.replace(/^cf_clearance/i, '');
+                sanitized = sanitized.replace(/^[:=]\s*/, '');
+                sanitized = sanitized.replace(/["']/g, '').trim();
+                if (sanitized)
+                    headers['Cookie'] = `cf_clearance=${sanitized}`;
+                const uaParam = ua || '';
+                if (uaParam)
+                    headers['User-Agent'] = uaParam;
+            }
+            headers['Referer'] = refererValue;
+            // Use got-scraping for a browser-like TLS fingerprint (needed for hosts
+            // like i.animepahe.pw that reject axios's fingerprint with 403). Retry a
+            // couple times since Cloudflare can intermittently challenge.
+            let lastStatus = 0;
+            let body = null;
+            let contentType = 'image/webp';
+            for (let attempt = 0; attempt < 3 && !body; attempt++) {
+                const resp = await (0, got_scraping_1.gotScraping)({
+                    url: targetUrl,
+                    method: 'GET',
+                    headers,
+                    responseType: 'buffer',
+                    followRedirect: true,
+                    throwHttpErrors: false,
+                    timeout: { request: 30000 },
+                });
+                lastStatus = resp.statusCode;
+                if (resp.statusCode === 200 && resp.rawBody?.length) {
+                    body = Buffer.from(resp.rawBody);
+                    contentType = String(resp.headers['content-type'] || 'image/webp');
+                }
+                else {
+                    if (attempt < 2)
+                        await new Promise((r) => setTimeout(r, 400 * (attempt + 1)));
+                }
+            }
+            if (body) {
+                res.set('Cache-Control', 'public, max-age=604800, immutable');
+                res.set('Content-Type', contentType);
+                res.set('Access-Control-Allow-Origin', '*');
+                return res.send(body);
+            }
+            this.sendPlaceholder(res);
+        }
+        catch (e) {
+            if (abortController.signal.aborted)
+                return;
+            const err = e;
+            if (!res.headersSent) {
+                this.sendPlaceholder(res);
+            }
+        }
+    };
+    handleResolve = async (req, res) => {
+        const targetUrl = req.query.url;
+        if (!targetUrl || typeof targetUrl !== 'string') {
+            return res.status(400).json({ error: 'URL required' });
+        }
+        const safeCheck = (0, security_utils_1.isSafeExternalUrl)(targetUrl);
+        if (!safeCheck.safe) {
+            return res.status(400).json({ error: safeCheck.error || 'Invalid URL' });
+        }
+        try {
+            const response = await fetch(targetUrl, {
+                method: 'GET',
+                headers: {
+                    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
+                    Accept: 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
+                },
+                redirect: 'follow',
+            });
+            res.json({
+                finalUrl: response.url,
+                status: response.status,
+            });
+        }
+        catch (e) {
+            const err = e;
+            res.status(500).json({ error: err.message || 'Resolve failed' });
+        }
+    };
+    sendPlaceholder(res) {
+        if (!res.headersSent)
+            res.set('Cache-Control', 'no-store');
+        const possiblePaths = [
+            path_1.default.join(config_1.CONFIG.PACKAGE_ROOT, 'client/public/placeholder.svg'),
+            path_1.default.join(config_1.CONFIG.PACKAGE_ROOT, 'client/dist/placeholder.svg'),
+            path_1.default.join(config_1.CONFIG.SERVER_ROOT, '..', 'client/public/placeholder.svg'),
+        ];
+        for (const p of possiblePaths) {
+            if (fs_1.default.existsSync(p)) {
+                return res.sendFile(p, (err) => {
+                    if (err && !res.headersSent) {
+                        res.status(404).send('Not Found');
+                    }
+                });
+            }
+        }
+        res.status(404).send('Not Found');
+    }
+}
+exports.ProxyController = ProxyController;