@serifpersia/dango 3.3.9 → 3.4.0

package/server/dist/{controllers/proxy.controller.js → hono/proxy.js}

@@ -1,7 +1,5 @@
 import { gotScraping } from 'got-scraping';
 import path from 'path';
-import { Readable } from 'stream';
-import { pipeline } from 'stream/promises';
 import { AppCache } from '../utils/cache.utils.js';
 import { CONFIG } from '../config.js';
 import fs from 'fs';
@@ -84,172 +82,257 @@ function assToVtt(body) {
         return null;
     return `WEBVTT\n\n${cues.join('\n\n')}\n`;
 }
-export class ProxyController {
-    static KWIK_DOMAINS = new Set(['kwik.cx', 'kwik.si', 'kwik.pro']);
-    static ANIMEPAHE_URL = 'https://animepahe.pw/';
-    static VAULT_CDN_HOSTS = new Set(['uwucdn.top', 'owocdn.top']);
-    static GOT_SCRAPING_HOSTS = new Set([
-        'kwik.cx',
-        'kwik.si',
-        'kwik.pro',
-        'animepahe.pw',
-        'animepahe.ru',
-    ]);
-    static GOT_SCRAPING_SUFFIXES = [
-        '.uwucdn.top',
-        '.owocdn.top',
-        '.streamzone1.site',
-        '.nekostream.site',
-        '.nukitashith.top',
-        '.aniwatchtv.site',
-    ];
-    static HANIME_HOSTS = new Set(['r2.1hanime.com', '1.1hanime.com']);
-    static OPPAI_HOSTS = new Set(['myspacecat.pictures']);
-    static KAA_HOSTS = new Set([
-        'hls.krussdomi.com',
-        'subst.krussdomi.com',
-        'krussdomi.com',
-        'st1.advancedairesearchlab.xyz',
-        'st1.habibikun.xyz',
-        'st1.babybayw.xyz',
-        'st1.narutokun.xyz',
-    ]);
-    static KAA_REFERER = 'https://krussdomi.com/';
-    static KAA_ORIGIN = 'https://krussdomi.com';
-    static ANILIGHT_REFERER = 'https://anilight.live/';
-    static ANILIGHT_ORIGIN = 'https://anilight.live';
-    static ANILIGHT_HOSTS = [
-        'anilight.live',
-        'api.anilight.live',
-        'lostproject.club',
-        'streamzone1.site',
-        'nukitashi.top',
-        'vivibebe.site',
-        'vibeplayer.site',
-        'aniwatchtv.site',
-    ];
-    static NEXABLOOM_FAMILY_SUFFIXES = [
-        '.quavex.top',
-        '.nexabloom.top',
-        '.hiddenvertex.top',
-        '.ironhorizon.top',
-        '.solarhaven.top',
-    ];
-    static NEXABLOOM_FALLBACK_HOSTS = ['fetch.nexabloom.top'];
-    static nexabloomFallbackUrls(urlStr) {
-        let host = '';
+const KWIK_DOMAINS = new Set(['kwik.cx', 'kwik.si', 'kwik.pro']);
+const ANIMEPAHE_URL = 'https://animepahe.pw/';
+const VAULT_CDN_HOSTS = new Set(['uwucdn.top', 'owocdn.top']);
+const GOT_SCRAPING_HOSTS = new Set([
+    'kwik.cx',
+    'kwik.si',
+    'kwik.pro',
+    'animepahe.pw',
+    'animepahe.ru',
+]);
+const GOT_SCRAPING_SUFFIXES = [
+    '.uwucdn.top',
+    '.owocdn.top',
+    '.streamzone1.site',
+    '.nekostream.site',
+    '.nukitashith.top',
+    '.aniwatchtv.site',
+];
+const HANIME_HOSTS = new Set(['r2.1hanime.com', '1.1hanime.com']);
+const OPPAI_HOSTS = new Set(['myspacecat.pictures']);
+const KAA_HOSTS = new Set([
+    'hls.krussdomi.com',
+    'subst.krussdomi.com',
+    'krussdomi.com',
+    'st1.advancedairesearchlab.xyz',
+    'st1.habibikun.xyz',
+    'st1.babybayw.xyz',
+    'st1.narutokun.xyz',
+]);
+const KAA_REFERER = 'https://krussdomi.com/';
+const KAA_ORIGIN = 'https://krussdomi.com';
+const ANILIGHT_REFERER = 'https://anilight.live/';
+const ANILIGHT_ORIGIN = 'https://anilight.live';
+const ANILIGHT_HOSTS = [
+    'anilight.live',
+    'api.anilight.live',
+    'lostproject.club',
+    'streamzone1.site',
+    'nukitashi.top',
+    'vivibebe.site',
+    'vibeplayer.site',
+    'aniwatchtv.site',
+];
+const NEXABLOOM_FAMILY_SUFFIXES = [
+    '.quavex.top',
+    '.nexabloom.top',
+    '.hiddenvertex.top',
+    '.ironhorizon.top',
+    '.solarhaven.top',
+];
+const NEXABLOOM_FALLBACK_HOSTS = ['fetch.nexabloom.top'];
+function nexabloomFallbackUrls(urlStr) {
+    let host = '';
+    try {
+        host = new URL(urlStr).hostname.toLowerCase();
+    }
+    catch {
+        return [urlStr];
+    }
+    if (!NEXABLOOM_FAMILY_SUFFIXES.some((s) => host.endsWith(s))) {
+        return [urlStr];
+    }
+    const urls = [urlStr];
+    for (const fallback of NEXABLOOM_FALLBACK_HOSTS) {
+        if (fallback === host)
+            continue;
         try {
-            host = new URL(urlStr).hostname.toLowerCase();
+            const candidate = new URL(urlStr);
+            candidate.hostname = fallback;
+            urls.push(candidate.href);
         }
         catch {
-            return [urlStr];
-        }
-        if (!ProxyController.NEXABLOOM_FAMILY_SUFFIXES.some((s) => host.endsWith(s))) {
-            return [urlStr];
+            // ignore
         }
-        const urls = [urlStr];
-        for (const fallback of ProxyController.NEXABLOOM_FALLBACK_HOSTS) {
-            if (fallback === host)
-                continue;
-            try {
-                const candidate = new URL(urlStr);
-                candidate.hostname = fallback;
-                urls.push(candidate.href);
-            }
-            catch {
-                // ignore
-            }
-        }
-        return urls;
     }
-    static isGotScrapingHost(urlStr) {
-        try {
-            const host = new URL(urlStr).hostname.toLowerCase();
-            if (ProxyController.GOT_SCRAPING_HOSTS.has(host))
-                return true;
-            if (ProxyController.HANIME_HOSTS.has(host))
-                return true;
-            return ProxyController.GOT_SCRAPING_SUFFIXES.some((s) => host.endsWith(s));
+    return urls;
+}
+function isGotScrapingHost(urlStr) {
+    try {
+        const host = new URL(urlStr).hostname.toLowerCase();
+        if (GOT_SCRAPING_HOSTS.has(host))
+            return true;
+        if (HANIME_HOSTS.has(host))
+            return true;
+        return GOT_SCRAPING_SUFFIXES.some((s) => host.endsWith(s));
+    }
+    catch {
+        return false;
+    }
+}
+function validateKwikUrl(value) {
+    if (typeof value !== 'string')
+        return null;
+    try {
+        const url = new URL(value);
+        const isSecure = url.protocol === 'https:';
+        const isKwik = KWIK_DOMAINS.has(url.hostname.toLowerCase());
+        const isEmbedPath = /^\/e\/[A-Za-z0-9_-]+$/.test(url.pathname);
+        const noAuthOrQuery = !url.username && !url.password && !url.search && !url.hash;
+        return isSecure && isKwik && isEmbedPath && noAuthOrQuery ? url : null;
+    }
+    catch {
+        return null;
+    }
+}
+function pinVariant(body, idx) {
+    const lines = body.split('\n');
+    let streamIdx = -1;
+    let skipUri = false;
+    const out = [];
+    for (const line of lines) {
+        const trimmed = line.trim();
+        if (trimmed.startsWith('#EXT-X-STREAM-INF')) {
+            streamIdx++;
+            skipUri = streamIdx !== idx;
+            if (!skipUri)
+                out.push(line);
+            continue;
         }
-        catch {
-            return false;
+        if (skipUri && trimmed && !trimmed.startsWith('#')) {
+            skipUri = false;
+            continue;
         }
+        out.push(line);
     }
-    abortWhenClientLeaves(res, abortController) {
-        res.on('close', () => {
-            if (!res.writableEnded) {
-                abortController.abort();
+    if (streamIdx < 0 || idx > streamIdx)
+        return null;
+    return out.join('\n');
+}
+function applyKwikPatches(html, kwikUrl, cookieStr = '') {
+    const safeReferer = JSON.stringify(kwikUrl.href).replace(/</g, '\\u003c');
+    const safeCookie = JSON.stringify(cookieStr).replace(/</g, '\\u003c');
+    const patched = html.replace(/\b(src|href|url)\s*[=:]\s*(["']?)(\/\/[^"'>)]+|\/(?!\/)[^"'>)]*)\2/gi, (match, attr, quote, path) => {
+        const full = path.startsWith('//') ? `https:${path}` : `${kwikUrl.origin}${path}`;
+        const prefix = match.startsWith('url') ? `url(` : `${attr}=`;
+        const suffix = match.startsWith('url') ? `)` : '';
+        return `${prefix}${quote}${full}${quote}${suffix}`;
+    });
+    const iconProxy = `/api/proxy?url=${encodeURIComponent(`${kwikUrl.origin}/app/js/vendor/plyr.svg`)}&referer=${encodeURIComponent(kwikUrl.href)}`;
+    const plyrPatch = `<script>if(window.Plyr) Plyr.defaults.iconUrl=${JSON.stringify(iconProxy).replace(/</g, '\\u003c')};</script>`;
+    const hlsPatch = `<script>
+      (function() {
+        var hook = function() {
+          if (!window.Hls) return;
+          var original = Hls.prototype.loadSource;
+          Hls.prototype.loadSource = function(src) {
+            if (typeof src === 'string' && src.includes('.m3u8')) {
+              src = window.location.origin + '/api/proxy?url=' + encodeURIComponent(src) + '&referer=' + encodeURIComponent(${safeReferer}) + (${safeCookie} ? '&cookie=' + encodeURIComponent(${safeCookie}) : '');
             }
+            return original.call(this, src);
+          };
+        };
+        if (window.Hls) hook();
+        else {
+          var observer = new MutationObserver(function() {
+            if (window.Hls) { hook(); observer.disconnect(); }
+          });
+          observer.observe(document.documentElement, { childList: true, subtree: true });
+        }
+      })();
+    </script>`;
+    const endBridgePatch = `<script>
+      (function() {
+        var notified = false;
+        var notifyEnded = function() {
+          if (notified) return;
+          notified = true;
+          window.parent.postMessage({ type: 'ANI_WEB_MEDIA_ENDED' }, window.location.origin);
+        };
+
+        var attachToVideos = function(root) {
+          var scope = root || document;
+          var videos = scope.querySelectorAll ? scope.querySelectorAll('video') : [];
+          Array.prototype.forEach.call(videos, function(video) {
+            if (video.dataset && video.dataset.aniWebEndedBridge === 'true') return;
+            if (video.dataset) video.dataset.aniWebEndedBridge = 'true';
+            video.addEventListener('ended', notifyEnded, { once: true });
+          });
+        };
+
+        attachToVideos(document);
+
+        var observer = new MutationObserver(function() {
+          attachToVideos(document);
         });
-    }
-    validateKwikUrl(value) {
-        if (typeof value !== 'string')
-            return null;
+
+        observer.observe(document.documentElement, { childList: true, subtree: true });
+      })();
+    </script>`;
+    const beforePlyr = patched.replace(/(<script[^>]+\/plyr\.min\.js[^>]*><\/script>)/i, `$1${plyrPatch}`);
+    const final = beforePlyr
+        .replace(/(<script[^>]+hls(?:\.min)?\.js[^>]*><\/script>)/i, `$1${hlsPatch}`)
+        .replace(/<\/body>/i, `${endBridgePatch}</body>`);
+    return final === html ? null : final;
+}
+function placeholderSvg() {
+    const possiblePaths = [
+        path.join(CONFIG.PACKAGE_ROOT, 'client/public/placeholder.svg'),
+        path.join(CONFIG.PACKAGE_ROOT, 'client/dist/placeholder.svg'),
+        path.join(CONFIG.SERVER_ROOT, '..', 'client/public/placeholder.svg'),
+    ];
+    for (const p of possiblePaths) {
         try {
-            const url = new URL(value);
-            const isSecure = url.protocol === 'https:';
-            const isKwik = ProxyController.KWIK_DOMAINS.has(url.hostname.toLowerCase());
-            const isEmbedPath = /^\/e\/[A-Za-z0-9_-]+$/.test(url.pathname);
-            const noAuthOrQuery = !url.username && !url.password && !url.search && !url.hash;
-            return isSecure && isKwik && isEmbedPath && noAuthOrQuery ? url : null;
+            if (fs.existsSync(p)) {
+                const headers = new Headers();
+                headers.set('Cache-Control', 'no-store');
+                headers.set('Content-Type', 'image/svg+xml');
+                return new Response(fs.readFileSync(p), { headers });
+            }
         }
         catch {
-            return null;
-        }
-    }
-    pinVariant(body, idx) {
-        const lines = body.split('\n');
-        let streamIdx = -1;
-        let skipUri = false;
-        const out = [];
-        for (const line of lines) {
-            const trimmed = line.trim();
-            if (trimmed.startsWith('#EXT-X-STREAM-INF')) {
-                streamIdx++;
-                skipUri = streamIdx !== idx;
-                if (!skipUri)
-                    out.push(line);
-                continue;
-            }
-            if (skipUri && trimmed && !trimmed.startsWith('#')) {
-                skipUri = false;
-                continue;
-            }
-            out.push(line);
+            // ignore
         }
-        if (streamIdx < 0 || idx > streamIdx)
-            return null;
-        return out.join('\n');
     }
-    handleProxy = async (req, res) => {
-        const { url, referer, cookie } = req.query;
+    return null;
+}
+const PROXY_UA = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0';
+function linkAbort(signal, abort) {
+    signal.addEventListener('abort', () => abort.abort(), { once: true });
+}
+export function registerProxy(app) {
+    app.get('/api/proxy', async (c) => {
+        const url = c.req.query('url');
         if (!url)
-            return res.status(400).send('URL required');
+            return c.text('URL required', 400);
         const safeCheck = isSafeExternalUrl(url);
         if (!safeCheck.safe) {
-            return res.status(400).send(safeCheck.error || 'Invalid URL');
+            return c.text(safeCheck.error || 'Invalid URL', 400);
         }
         const urlStr = url;
-        const refererStr = referer || '';
-        const cookieStr = cookie || '';
-        const variantIdx = req.query.variant !== undefined ? parseInt(req.query.variant, 10) : NaN;
-        const pinVariant = Number.isInteger(variantIdx) && variantIdx >= 0;
-        const cacheKey = `m3u8-${urlStr}-${refererStr}${pinVariant ? `-v${variantIdx}` : ''}`;
-        const abortController = new AbortController();
-        this.abortWhenClientLeaves(res, abortController);
+        const refererStr = c.req.query('referer') || '';
+        const cookieStr = c.req.query('cookie') || '';
+        const variantRaw = c.req.query('variant');
+        const variantIdx = variantRaw !== undefined ? parseInt(variantRaw, 10) : NaN;
+        const pinVar = Number.isInteger(variantIdx) && variantIdx >= 0;
+        const cacheKey = `m3u8-${urlStr}-${refererStr}${pinVar ? `-v${variantIdx}` : ''}`;
+        const abort = new AbortController();
+        linkAbort(c.req.raw.signal, abort);
         try {
-            const isVaultCdn = Array.from(ProxyController.VAULT_CDN_HOSTS).some((host) => urlStr.includes(host));
-            const isHanime = Array.from(ProxyController.HANIME_HOSTS).some((host) => urlStr.includes(host));
-            const isOppai = Array.from(ProxyController.OPPAI_HOSTS).some((host) => urlStr.includes(host));
-            const isKaa = refererStr.startsWith(ProxyController.KAA_ORIGIN) ||
-                Array.from(ProxyController.KAA_HOSTS).some((host) => urlStr.includes(host));
+            const isVaultCdn = Array.from(VAULT_CDN_HOSTS).some((host) => urlStr.includes(host));
+            const isHanime = Array.from(HANIME_HOSTS).some((host) => urlStr.includes(host));
+            const isOppai = Array.from(OPPAI_HOSTS).some((host) => urlStr.includes(host));
+            const isKaa = refererStr.startsWith(KAA_ORIGIN) ||
+                Array.from(KAA_HOSTS).some((host) => urlStr.includes(host));
             const headers = {
-                'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0',
+                'User-Agent': PROXY_UA,
             };
-            if (referer)
+            if (refererStr)
                 headers['Referer'] = refererStr;
             if (isVaultCdn) {
-                headers['Origin'] = refererStr || ProxyController.ANIMEPAHE_URL;
+                headers['Origin'] = refererStr || ANIMEPAHE_URL;
                 const cookieHeader = buildCfClearanceCookie(cookieStr);
                 if (cookieHeader)
                     headers['Cookie'] = cookieHeader;
@@ -266,8 +349,8 @@ export class ProxyController {
             }
             if (isKaa) {
                 if (!headers['Referer'])
-                    headers['Referer'] = refererStr || ProxyController.KAA_REFERER;
-                headers['Origin'] = ProxyController.KAA_ORIGIN;
+                    headers['Referer'] = refererStr || KAA_REFERER;
+                headers['Origin'] = KAA_ORIGIN;
             }
             const isMegaplay = refererStr.startsWith(MEGAPLAY_ORIGIN) || urlStr.includes('nexabloom.top');
             if (isMegaplay && !headers['Origin']) {
@@ -279,23 +362,24 @@ export class ProxyController {
                 const jasmrCookieHeader = buildCfClearanceCookie(cookieStr);
                 if (jasmrCookieHeader)
                     headers['Cookie'] = jasmrCookieHeader;
-                const jasmrUa = req.query.ua || '';
+                const jasmrUa = c.req.query('ua') || '';
                 if (jasmrUa)
                     headers['User-Agent'] = jasmrUa;
             }
-            if (req.headers.range)
-                headers['Range'] = req.headers.range;
+            const range = c.req.header('range');
+            if (range)
+                headers['Range'] = range;
             if (urlStr.includes('.m3u8')) {
                 const cached = proxyCache.get(cacheKey);
                 if (cached) {
-                    return res
-                        .set('Content-Type', 'application/vnd.apple.mpegurl')
-                        .set('Access-Control-Allow-Origin', '*')
-                        .send(cached);
+                    const headers = new Headers();
+                    headers.set('Content-Type', 'application/vnd.apple.mpegurl');
+                    headers.set('Access-Control-Allow-Origin', '*');
+                    return new Response(cached, { headers });
                 }
                 const resp = await (async () => {
                     let last = null;
-                    for (const candidate of ProxyController.nexabloomFallbackUrls(urlStr)) {
+                    for (const candidate of nexabloomFallbackUrls(urlStr)) {
                         const attempt = await gotScraping({
                             url: isNexabloomMasterUrl(candidate) ? signNexabloomMasterUrl(candidate) : candidate,
                             method: 'GET',
@@ -312,18 +396,18 @@ export class ProxyController {
                     return last;
                 })();
                 if (!resp || (resp.statusCode !== 200 && resp.statusCode !== 206)) {
-                    return res.status(resp?.statusCode ?? 502).send('Upstream error');
+                    return c.text('Upstream error', (resp?.statusCode || 502));
                 }
                 const finalUrl = resp.url || urlStr;
                 const baseUrl = new URL(finalUrl);
                 const proxiedMediaUrl = (targetUrl) => `/api/proxy?url=${encodeURIComponent(targetUrl)}&referer=${encodeURIComponent(refererStr)}` +
                     (cookieStr ? `&cookie=${encodeURIComponent(sanitizeCfClearance(cookieStr))}` : '') +
-                    (req.query.ua ? `&ua=${encodeURIComponent(req.query.ua)}` : '');
+                    (c.req.query('ua') ? `&ua=${encodeURIComponent(c.req.query('ua'))}` : '');
                 const needsProxy = Boolean(refererStr);
                 const isProxied = (value) => value.includes('/api/proxy');
                 let playlistBody = resp.body;
-                if (pinVariant) {
-                    const pinned = this.pinVariant(playlistBody, variantIdx);
+                if (pinVar) {
+                    const pinned = pinVariant(playlistBody, variantIdx);
                     if (pinned)
                         playlistBody = pinned;
                 }
@@ -348,17 +432,17 @@ export class ProxyController {
                 })
                     .join('\n');
                 proxyCache.set(cacheKey, rewritten);
-                res
-                    .set('Content-Type', 'application/vnd.apple.mpegurl')
-                    .set('Access-Control-Allow-Origin', '*')
-                    .send(rewritten);
+                const outHeaders = new Headers();
+                outHeaders.set('Content-Type', 'application/vnd.apple.mpegurl');
+                outHeaders.set('Access-Control-Allow-Origin', '*');
+                return new Response(rewritten, { headers: outHeaders });
             }
             else {
-                if (ProxyController.isGotScrapingHost(urlStr)) {
-                    if (req.headers.range)
-                        headers['Range'] = req.headers.range;
+                if (isGotScrapingHost(urlStr)) {
+                    if (range)
+                        headers['Range'] = range;
                     let resp = null;
-                    for (const candidate of ProxyController.nexabloomFallbackUrls(urlStr)) {
+                    for (const candidate of nexabloomFallbackUrls(urlStr)) {
                         const attempt = await gotScraping({
                             url: candidate,
                             method: 'GET',
@@ -373,30 +457,34 @@ export class ProxyController {
                             break;
                     }
                     if (!resp || (resp.statusCode !== 200 && resp.statusCode !== 206)) {
-                        return res.status(resp?.statusCode ?? 502).send('Upstream error');
+                        return c.text('Upstream error', (resp?.statusCode || 502));
                     }
                     const ct = resp.headers['content-type'];
                     const isVtt = urlStr.endsWith('.vtt') || urlStr.includes('.vtt?');
-                    res.set('Content-Type', isVtt ? 'text/vtt; charset=utf-8' : ct || 'application/octet-stream');
+                    const outHeaders = new Headers();
+                    outHeaders.set('Content-Type', isVtt ? 'text/vtt; charset=utf-8' : ct || 'application/octet-stream');
                     const cl = resp.headers['content-length'];
                     if (cl)
-                        res.set('Content-Length', cl);
+                        outHeaders.set('Content-Length', cl);
                     const cr = resp.headers['content-range'];
                     if (cr)
-                        res.set('Content-Range', cr);
+                        outHeaders.set('Content-Range', cr);
                     const ar = resp.headers['accept-ranges'];
                     if (ar)
-                        res.set('Accept-Ranges', ar);
-                    res.set('Access-Control-Allow-Origin', '*');
-                    res.send(resp.body);
+                        outHeaders.set('Accept-Ranges', ar);
+                    outHeaders.set('Access-Control-Allow-Origin', '*');
+                    return new Response(resp.body, {
+                        status: resp.statusCode,
+                        headers: outHeaders,
+                    });
                 }
                 else {
                     let upstream = null;
-                    for (const candidate of ProxyController.nexabloomFallbackUrls(urlStr)) {
-                        if (abortController.signal.aborted)
+                    for (const candidate of nexabloomFallbackUrls(urlStr)) {
+                        if (abort.signal.aborted)
                             break;
                         try {
-                            const attempt = await fetchWithRetry(candidate, { method: 'GET', headers }, { retries: 3, timeoutMs: 30000, signal: abortController.signal });
+                            const attempt = await fetchWithRetry(candidate, { method: 'GET', headers }, { retries: 3, timeoutMs: 30000, signal: abort.signal });
                             upstream = attempt;
                             if (attempt.status === 200 || attempt.status === 206)
                                 break;
@@ -412,7 +500,7 @@ export class ProxyController {
                         }
                     }
                     if (!upstream) {
-                        return res.status(502).send('Upstream error');
+                        return c.text('Upstream error', 502);
                     }
                     const status = upstream.status;
                     if (status !== 200 && status !== 206) {
@@ -422,60 +510,47 @@ export class ProxyController {
                         catch {
                             // ignore
                         }
-                        return res.status(status).send('Upstream error');
+                        return c.text('Upstream error', status);
                     }
-                    res.status(status);
                     const isVtt = urlStr.endsWith('.vtt') || urlStr.includes('.vtt?');
                     const ct = upstream.headers.get('content-type');
-                    res.set('Content-Type', isVtt ? 'text/vtt; charset=utf-8' : ct || 'application/octet-stream');
+                    const outHeaders = new Headers();
+                    outHeaders.set('Content-Type', isVtt ? 'text/vtt; charset=utf-8' : ct || 'application/octet-stream');
                     const cl = upstream.headers.get('content-length');
                     if (cl)
-                        res.set('Content-Length', cl);
+                        outHeaders.set('Content-Length', cl);
                     const cr = upstream.headers.get('content-range');
                     if (cr)
-                        res.set('Content-Range', cr);
+                        outHeaders.set('Content-Range', cr);
                     const ar = upstream.headers.get('accept-ranges');
                     if (ar)
-                        res.set('Accept-Ranges', ar);
-                    res.set('Access-Control-Allow-Origin', '*');
+                        outHeaders.set('Accept-Ranges', ar);
+                    outHeaders.set('Access-Control-Allow-Origin', '*');
                     if (!upstream.body) {
-                        return res.status(502).send('Upstream error');
-                    }
-                    try {
-                        await pipeline(Readable.from(upstream.body), res);
-                    }
-                    catch (e) {
-                        if (!res.headersSent) {
-                            logger.error({ url: urlStr, error: e?.message }, '[proxy] upstream stream failed');
-                            res.status(500).send('Proxy error');
-                        }
-                        else {
-                            res.destroy();
-                        }
+                        return c.text('Upstream error', 502);
                     }
+                    return new Response(upstream.body, { status: status, headers: outHeaders });
                 }
             }
         }
         catch (e) {
-            if (abortController.signal.aborted)
-                return;
-            if (!res.headersSent) {
-                logger.error({ url: urlStr, error: e?.message }, '[proxy] upstream request failed');
-                res.status(500).send('Proxy error');
-            }
+            if (abort.signal.aborted)
+                return new Response(null, { status: 499 });
+            logger.error({ url: urlStr, error: e?.message }, '[proxy] upstream request failed');
+            return c.text('Proxy error', 500);
         }
-    };
-    handleEmbedProxy = async (req, res) => {
-        const kwikUrl = this.validateKwikUrl(req.query.url);
+    });
+    app.get('/api/embed-proxy', async (c) => {
+        const kwikUrl = validateKwikUrl(c.req.query('url'));
         if (!kwikUrl)
-            return res.status(400).send('Invalid or unsupported gateway URL');
-        const cookieStr = req.query.cookie || '';
-        const abortController = new AbortController();
-        this.abortWhenClientLeaves(res, abortController);
+            return c.text('Invalid or unsupported gateway URL', 400);
+        const cookieStr = c.req.query('cookie') || '';
+        const abort = new AbortController();
+        linkAbort(c.req.raw.signal, abort);
         try {
             const headers = {
-                'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0',
-                Referer: ProxyController.ANIMEPAHE_URL,
+                'User-Agent': PROXY_UA,
+                Referer: ANIMEPAHE_URL,
                 Origin: 'https://animepahe.pw',
             };
             if (cookieStr) {
@@ -493,102 +568,33 @@ export class ProxyController {
                 throwHttpErrors: false,
             });
             const originalHtml = response.body;
-            const patched = this.applyKwikPatches(originalHtml, kwikUrl, cookieStr);
+            const patched = applyKwikPatches(originalHtml, kwikUrl, cookieStr);
             if (!patched)
-                return res.status(502).send('Failed to patch video gateway');
-            return res
-                .status(200)
-                .set('Content-Type', 'text/html; charset=utf-8')
-                .set('Cache-Control', 'private, max-age=120')
-                .send(patched);
+                return c.text('Failed to patch video gateway', 502);
+            const outHeaders = new Headers();
+            outHeaders.set('Content-Type', 'text/html; charset=utf-8');
+            outHeaders.set('Cache-Control', 'private, max-age=120');
+            return new Response(patched, { status: 200, headers: outHeaders });
         }
-        catch (e) {
-            if (abortController.signal.aborted)
-                return;
-            if (!res.headersSent)
-                res.status(502).send('Gateway proxy error');
-        }
-    };
-    applyKwikPatches(html, kwikUrl, cookieStr = '') {
-        const safeReferer = JSON.stringify(kwikUrl.href).replace(/</g, '\\u003c');
-        const safeCookie = JSON.stringify(cookieStr).replace(/</g, '\\u003c');
-        const patched = html.replace(/\b(src|href|url)\s*[=:]\s*(["']?)(\/\/[^"'>)]+|\/(?!\/)[^"'>)]*)\2/gi, (match, attr, quote, path) => {
-            const full = path.startsWith('//') ? `https:${path}` : `${kwikUrl.origin}${path}`;
-            const prefix = match.startsWith('url') ? `url(` : `${attr}=`;
-            const suffix = match.startsWith('url') ? `)` : '';
-            return `${prefix}${quote}${full}${quote}${suffix}`;
-        });
-        const iconProxy = `/api/proxy?url=${encodeURIComponent(`${kwikUrl.origin}/app/js/vendor/plyr.svg`)}&referer=${encodeURIComponent(kwikUrl.href)}`;
-        const plyrPatch = `<script>if(window.Plyr) Plyr.defaults.iconUrl=${JSON.stringify(iconProxy).replace(/</g, '\\u003c')};</script>`;
-        const hlsPatch = `<script>
-      (function() {
-        var hook = function() {
-          if (!window.Hls) return;
-          var original = Hls.prototype.loadSource;
-          Hls.prototype.loadSource = function(src) {
-            if (typeof src === 'string' && src.includes('.m3u8')) {
-              src = window.location.origin + '/api/proxy?url=' + encodeURIComponent(src) + '&referer=' + encodeURIComponent(${safeReferer}) + (${safeCookie} ? '&cookie=' + encodeURIComponent(${safeCookie}) : '');
-            }
-            return original.call(this, src);
-          };
-        };
-        if (window.Hls) hook();
-        else {
-          var observer = new MutationObserver(function() {
-            if (window.Hls) { hook(); observer.disconnect(); }
-          });
-          observer.observe(document.documentElement, { childList: true, subtree: true });
+        catch {
+            if (abort.signal.aborted)
+                return new Response(null, { status: 499 });
+            return c.text('Gateway proxy error', 502);
         }
-      })();
-    </script>`;
-        const endBridgePatch = `<script>
-      (function() {
-        var notified = false;
-        var notifyEnded = function() {
-          if (notified) return;
-          notified = true;
-          window.parent.postMessage({ type: 'ANI_WEB_MEDIA_ENDED' }, window.location.origin);
-        };
-
-        var attachToVideos = function(root) {
-          var scope = root || document;
-          var videos = scope.querySelectorAll ? scope.querySelectorAll('video') : [];
-          Array.prototype.forEach.call(videos, function(video) {
-            if (video.dataset && video.dataset.aniWebEndedBridge === 'true') return;
-            if (video.dataset) video.dataset.aniWebEndedBridge = 'true';
-            video.addEventListener('ended', notifyEnded, { once: true });
-          });
-        };
-
-        attachToVideos(document);
-
-        var observer = new MutationObserver(function() {
-          attachToVideos(document);
-        });
-
-        observer.observe(document.documentElement, { childList: true, subtree: true });
-      })();
-    </script>`;
-        const beforePlyr = patched.replace(/(<script[^>]+\/plyr\.min\.js[^>]*><\/script>)/i, `$1${plyrPatch}`);
-        const final = beforePlyr
-            .replace(/(<script[^>]+hls(?:\.min)?\.js[^>]*><\/script>)/i, `$1${hlsPatch}`)
-            .replace(/<\/body>/i, `${endBridgePatch}</body>`);
-        return final === html ? null : final;
-    }
-    handleSubtitleProxy = async (req, res) => {
-        const { url, referer } = req.query;
+    });
+    app.get('/api/subtitle-proxy', async (c) => {
+        const url = c.req.query('url');
         if (!url)
-            return res.status(400).send('URL required');
+            return c.text('URL required', 400);
         const safeCheck = isSafeExternalUrl(url);
         if (!safeCheck.safe) {
-            return res.status(400).send(safeCheck.error || 'Invalid URL');
+            return c.text(safeCheck.error || 'Invalid URL', 400);
         }
-        const abortController = new AbortController();
-        this.abortWhenClientLeaves(res, abortController);
+        const abort = new AbortController();
+        linkAbort(c.req.raw.signal, abort);
         const subUrl = url;
-        const refererStr = referer || '';
-        const isAnilight = refererStr.includes('anilight.live') ||
-            ProxyController.ANILIGHT_HOSTS.some((host) => subUrl.includes(host));
+        const refererStr = c.req.query('referer') || '';
+        const isAnilight = refererStr.includes('anilight.live') || ANILIGHT_HOSTS.some((host) => subUrl.includes(host));
         const innerRawUrl = (() => {
             try {
                 const parsed = new URL(subUrl);
@@ -614,25 +620,25 @@ export class ProxyController {
                 headers['Referer'] = refererStr;
             }
             else if (isAnilight) {
-                headers['Referer'] = ProxyController.ANILIGHT_REFERER;
+                headers['Referer'] = ANILIGHT_REFERER;
             }
-            if (refererStr.startsWith(ProxyController.KAA_ORIGIN) ||
-                Array.from(ProxyController.KAA_HOSTS).some((host) => subUrl.includes(host))) {
-                headers['Origin'] = ProxyController.KAA_ORIGIN;
+            if (refererStr.startsWith(KAA_ORIGIN) ||
+                Array.from(KAA_HOSTS).some((host) => subUrl.includes(host))) {
+                headers['Origin'] = KAA_ORIGIN;
             }
             else if (isAnilight) {
-                headers['Origin'] = ProxyController.ANILIGHT_ORIGIN;
+                headers['Origin'] = ANILIGHT_ORIGIN;
             }
             return headers;
         };
         const fetchText = async (target, retries = 1) => {
             const headers = buildHeaders();
             if (innerRawUrl && target === innerRawUrl) {
-                headers['Referer'] = ProxyController.ANILIGHT_REFERER;
-                headers['Origin'] = ProxyController.ANILIGHT_ORIGIN;
+                headers['Referer'] = ANILIGHT_REFERER;
+                headers['Origin'] = ANILIGHT_ORIGIN;
             }
             try {
-                const upstream = await fetchWithRetry(target, { method: 'GET', headers }, { retries, timeoutMs: 15000, signal: abortController.signal });
+                const upstream = await fetchWithRetry(target, { method: 'GET', headers }, { retries, timeoutMs: 15000, signal: abort.signal });
                 if (!upstream.ok) {
                     logger.warn({ target, status: upstream.status }, '[subtitle-proxy] upstream returned error status');
                     try {
@@ -651,26 +657,34 @@ export class ProxyController {
                 return { status: upstream.status, body };
             }
             catch (e) {
-                if (abortController.signal.aborted)
+                if (abort.signal.aborted)
                     return null;
                 logger.warn({ target, error: e?.message }, '[subtitle-proxy] upstream fetch failed');
                 return { status: 502, body: '' };
             }
         };
+        const vttHeaders = (cacheControl) => {
+            const headers = new Headers();
+            headers.set('Content-Type', 'text/vtt; charset=utf-8');
+            headers.set('Access-Control-Allow-Origin', '*');
+            headers.set('Cache-Control', cacheControl);
+            return headers;
+        };
         try {
             const headers = buildHeaders();
             let result = await fetchText(subUrl, 1);
-            if (abortController.signal.aborted)
-                return;
+            if (abort.signal.aborted)
+                return new Response(null, { status: 499 });
             if ((!result || !result.body) && innerRawUrl) {
                 result = await fetchText(innerRawUrl, 0);
-                if (abortController.signal.aborted)
-                    return;
+                if (abort.signal.aborted)
+                    return new Response(null, { status: 499 });
             }
             if (!result || !result.body) {
-                res.set('Access-Control-Allow-Origin', '*');
-                res.set('Cache-Control', 'no-store');
-                return res.status(502).send('Subtitle upstream error');
+                const headers = new Headers();
+                headers.set('Access-Control-Allow-Origin', '*');
+                headers.set('Cache-Control', 'no-store');
+                return new Response('Subtitle upstream error', { status: 502, headers });
             }
             const body = result.body;
             const baseForSegments = innerRawUrl || subUrl;
@@ -692,7 +706,7 @@ export class ProxyController {
                 const parts = [];
                 for (const seg of segUrls) {
                     try {
-                        const segRes = await fetchWithRetry(seg, { method: 'GET', headers }, { retries: 1, timeoutMs: 15000, signal: abortController.signal });
+                        const segRes = await fetchWithRetry(seg, { method: 'GET', headers }, { retries: 1, timeoutMs: 15000, signal: abort.signal });
                         if (!segRes.ok)
                             continue;
                         let segBody = (await segRes.text()).replace(/^\uFEFF/, '');
@@ -710,53 +724,53 @@ export class ProxyController {
                         if (parts.join('\n').length > 2_000_000)
                             break;
                     }
-                    catch (e) {
-                        if (abortController.signal.aborted)
-                            return;
+                    catch {
+                        if (abort.signal.aborted)
+                            return new Response(null, { status: 499 });
                     }
                 }
                 if (parts.length === 0) {
-                    res.set('Access-Control-Allow-Origin', '*');
-                    res.set('Cache-Control', 'no-store');
-                    return res.status(502).send('Subtitle playlist empty');
+                    const headers = new Headers();
+                    headers.set('Access-Control-Allow-Origin', '*');
+                    headers.set('Cache-Control', 'no-store');
+                    return new Response('Subtitle playlist empty', { status: 502, headers });
                 }
-                res.set('Content-Type', 'text/vtt; charset=utf-8');
-                res.set('Access-Control-Allow-Origin', '*');
-                res.set('Cache-Control', 'public, max-age=86400');
-                return res.send(`WEBVTT\n\n${parts.join('\n\n')}\n`);
-            }
-            res.set('Content-Type', 'text/vtt; charset=utf-8');
-            res.set('Access-Control-Allow-Origin', '*');
-            res.set('Cache-Control', 'public, max-age=86400');
-            if (/^\s*WEBVTT/i.test(body))
-                return res.send(body);
+                return new Response(`WEBVTT\n\n${parts.join('\n\n')}\n`, {
+                    headers: vttHeaders('public, max-age=86400'),
+                });
+            }
+            if (/^\s*WEBVTT/i.test(body)) {
+                return new Response(body, { headers: vttHeaders('public, max-age=86400') });
+            }
             const vttFromAss = assToVtt(body);
-            if (vttFromAss)
-                return res.send(vttFromAss);
-            return res.send(`WEBVTT\n\n${body.replace(/\r\n/g, '\n').replace(/(\d{2}:\d{2}:\d{2}),(\d{3})/g, '$1.$2')}`);
-        }
-        catch (e) {
-            if (abortController.signal.aborted)
-                return;
-            logger.warn({ url: subUrl, error: e?.message }, '[subtitle-proxy] failed');
-            if (!res.headersSent) {
-                res.set('Access-Control-Allow-Origin', '*');
-                res.set('Cache-Control', 'no-store');
-                res.status(502).send('Subtitle upstream error');
+            if (vttFromAss) {
+                return new Response(vttFromAss, { headers: vttHeaders('public, max-age=86400') });
             }
+            return new Response(`WEBVTT\n\n${body.replace(/\r\n/g, '\n').replace(/(\d{2}:\d{2}:\d{2}),(\d{3})/g, '$1.$2')}`, { headers: vttHeaders('public, max-age=86400') });
         }
-    };
-    handleImageProxy = async (req, res) => {
-        const { url, cookie, ua } = req.query;
+        catch {
+            if (abort.signal.aborted)
+                return new Response(null, { status: 499 });
+            logger.warn({ url: subUrl }, '[subtitle-proxy] failed');
+            const headers = new Headers();
+            headers.set('Access-Control-Allow-Origin', '*');
+            headers.set('Cache-Control', 'no-store');
+            return new Response('Subtitle upstream error', { status: 502, headers });
+        }
+    });
+    app.get('/api/image-proxy', async (c) => {
+        const url = c.req.query('url');
         if (!url)
-            return res.status(400).send('URL required');
+            return c.text('URL required', 400);
         const safeCheck = isSafeExternalUrl(url);
         if (!safeCheck.safe) {
-            return res.status(400).send(safeCheck.error || 'Invalid URL');
+            return c.text(safeCheck.error || 'Invalid URL', 400);
         }
         const targetUrl = url;
-        const abortController = new AbortController();
-        this.abortWhenClientLeaves(res, abortController);
+        const cookie = c.req.query('cookie') || '';
+        const ua = c.req.query('ua') || '';
+        const abort = new AbortController();
+        linkAbort(c.req.raw.signal, abort);
         let refererValue = 'https://anilist.co/';
         const headers = {
             'User-Agent': ua ||
@@ -798,9 +812,6 @@ export class ProxyController {
                     headers['User-Agent'] = uaParam;
             }
             headers['Referer'] = refererValue;
-            // Use got-scraping for a browser-like TLS fingerprint (needed for hosts
-            // like i.animepahe.pw that reject stock clients with 403). Retry a
-            // couple times since Cloudflare can intermittently challenge.
             let lastStatus = 0;
             let body = null;
             let contentType = 'image/webp';
@@ -825,30 +836,34 @@ export class ProxyController {
                 }
             }
             if (body) {
-                res.set('Cache-Control', 'public, max-age=604800, immutable');
-                res.set('Content-Type', contentType);
-                res.set('Access-Control-Allow-Origin', '*');
-                return res.send(body);
-            }
-            this.sendPlaceholder(res);
+                const outHeaders = new Headers();
+                outHeaders.set('Cache-Control', 'public, max-age=604800, immutable');
+                outHeaders.set('Content-Type', contentType);
+                outHeaders.set('Access-Control-Allow-Origin', '*');
+                return new Response(body, { headers: outHeaders });
+            }
+            const placeholder = placeholderSvg();
+            if (placeholder)
+                return placeholder;
+            return c.text('Not Found', 404);
         }
-        catch (e) {
-            if (abortController.signal.aborted)
-                return;
-            const err = e;
-            if (!res.headersSent) {
-                this.sendPlaceholder(res);
-            }
+        catch {
+            if (abort.signal.aborted)
+                return new Response(null, { status: 499 });
+            const placeholder = placeholderSvg();
+            if (placeholder)
+                return placeholder;
+            return c.text('Not Found', 404);
         }
-    };
-    handleResolve = async (req, res) => {
-        const targetUrl = req.query.url;
+    });
+    app.get('/api/resolve', async (c) => {
+        const targetUrl = c.req.query('url');
         if (!targetUrl || typeof targetUrl !== 'string') {
-            return res.status(400).json({ error: 'URL required' });
+            return c.json({ error: 'URL required' }, 400);
         }
         const safeCheck = isSafeExternalUrl(targetUrl);
         if (!safeCheck.safe) {
-            return res.status(400).json({ error: safeCheck.error || 'Invalid URL' });
+            return c.json({ error: safeCheck.error || 'Invalid URL' }, 400);
         }
         try {
             const response = await fetch(targetUrl, {
@@ -859,33 +874,14 @@ export class ProxyController {
                 },
                 redirect: 'follow',
             });
-            res.json({
+            return c.json({
                 finalUrl: response.url,
                 status: response.status,
             });
         }
         catch (e) {
             const err = e;
-            res.status(500).json({ error: err.message || 'Resolve failed' });
-        }
-    };
-    sendPlaceholder(res) {
-        if (!res.headersSent)
-            res.set('Cache-Control', 'no-store');
-        const possiblePaths = [
-            path.join(CONFIG.PACKAGE_ROOT, 'client/public/placeholder.svg'),
-            path.join(CONFIG.PACKAGE_ROOT, 'client/dist/placeholder.svg'),
-            path.join(CONFIG.SERVER_ROOT, '..', 'client/public/placeholder.svg'),
-        ];
-        for (const p of possiblePaths) {
-            if (fs.existsSync(p)) {
-                return res.sendFile(p, (err) => {
-                    if (err && !res.headersSent) {
-                        res.status(404).send('Not Found');
-                    }
-                });
-            }
+            return c.json({ error: err.message || 'Resolve failed' }, 500);
         }
-        res.status(404).send('Not Found');
-    }
+    });
 }