@serifpersia/dango 3.6.5 → 3.6.7

package/server/dist/hono/proxy.js

@@ -7,7 +7,6 @@ import logger from '../logger.js';
 import { buildCfClearanceCookie, sanitizeCfClearance } from '../utils/cookie.utils.js';
 import { isSafeExternalUrl } from '../utils/security.utils.js';
 import { fetchWithRetry, linkAbort, setProxyHeaders } from '../utils/http.utils.js';
-import { MEGAPLAY_ORIGIN, isNexabloomMasterUrl, signNexabloomMasterUrl, } from '../utils/megaplay.utils.js';
 const proxyCache = new AppCache({ ttlSeconds: 30, maxKeys: 500 });
 const imageCache = new AppCache({ ttlSeconds: 86400, maxKeys: 3000 });
 function assTimeToVtt(value) {
@@ -127,87 +126,45 @@ function rewrapVttCues(vtt) {
     })
         .join('\n\n');
 }
-const KWIK_DOMAINS = new Set(['kwik.cx', 'kwik.si', 'kwik.pro']);
-const ANIMEPAHE_URL = 'https://animepahe.pw/';
-const VAULT_CDN_HOSTS = new Set(['uwucdn.top', 'owocdn.top']);
-const GOT_SCRAPING_HOSTS = new Set([
-    'kwik.cx',
-    'kwik.si',
-    'kwik.pro',
-    'animepahe.pw',
-    'animepahe.ru',
-]);
-const GOT_SCRAPING_SUFFIXES = [
-    '.uwucdn.top',
-    '.owocdn.top',
-    '.streamzone1.site',
-    '.nekostream.site',
-    '.nukitashith.top',
-    '.aniwatchtv.site',
-    '.settlar.io',
-];
-const HANIME_HOSTS = new Set(['r2.1hanime.com', '1.1hanime.com']);
-const OPPAI_HOSTS = new Set(['myspacecat.pictures']);
-const KAA_HOSTS = new Set([
-    'hls.krussdomi.com',
-    'subst.krussdomi.com',
-    'krussdomi.com',
-    'st1.advancedairesearchlab.xyz',
-    'st1.habibikun.xyz',
-    'st1.babybayw.xyz',
-    'st1.narutokun.xyz',
-]);
-const KAA_REFERER = 'https://krussdomi.com/';
-const KAA_ORIGIN = 'https://krussdomi.com';
-const ANILIGHT_REFERER = 'https://anilight.live/';
-const ANILIGHT_ORIGIN = 'https://anilight.live';
-const ANILIGHT_HOSTS = [
-    'anilight.live',
-    'api.anilight.live',
-    'lostproject.club',
-    'streamzone1.site',
-    'nukitashi.top',
-    'vivibebe.site',
-    'vibeplayer.site',
-    'aniwatchtv.site',
-];
-const NEXABLOOM_FAMILY_SUFFIXES = [
-    '.quavex.top',
-    '.nexabloom.top',
-    '.hiddenvertex.top',
-    '.ironhorizon.top',
-    '.solarhaven.top',
-];
-const NEXABLOOM_FALLBACK_HOSTS = ['fetch.nexabloom.top'];
-function nexabloomFallbackUrls(urlStr) {
-    let host = '';
+function matchProxyRule(urlStr, rules) {
+    let host;
     try {
         host = new URL(urlStr).hostname.toLowerCase();
     }
     catch {
+        return undefined;
+    }
+    return rules.find((r) => r.hosts?.some((h) => h === host) || r.suffixes?.some((s) => host.endsWith(s)));
+}
+function resolveOrigin(rule, referer, queryOrigin) {
+    return queryOrigin || (rule?.originFromReferer ? referer : '') || rule?.origin || '';
+}
+function mirrorUrls(urlStr, mirrors) {
+    if (!mirrors?.length)
         return [urlStr];
+    let current;
+    try {
+        current = new URL(urlStr);
     }
-    if (!NEXABLOOM_FAMILY_SUFFIXES.some((s) => host.endsWith(s))) {
+    catch {
         return [urlStr];
     }
+    const seen = new Set([current.hostname.toLowerCase()]);
     const urls = [urlStr];
-    for (const fallback of NEXABLOOM_FALLBACK_HOSTS) {
-        if (fallback === host)
+    for (const mirror of mirrors) {
+        const host = mirror.toLowerCase();
+        if (seen.has(host))
             continue;
-        try {
-            const candidate = new URL(urlStr);
-            candidate.hostname = fallback;
-            urls.push(candidate.href);
-        }
-        catch {
-            // ignore
-        }
+        seen.add(host);
+        const candidate = new URL(current.href);
+        candidate.hostname = host;
+        urls.push(candidate.href);
     }
     return urls;
 }
-async function fetchNexabloomFallback(urlStr, signal, attempt, isOk) {
+async function fetchWithMirrors(urlStr, mirrors, signal, attempt, isOk) {
     let last = null;
-    for (const candidate of nexabloomFallbackUrls(urlStr)) {
+    for (const candidate of mirrorUrls(urlStr, mirrors)) {
         if (signal.aborted)
             break;
         const r = await attempt(candidate).catch(() => null);
@@ -219,34 +176,6 @@ async function fetchNexabloomFallback(urlStr, signal, attempt, isOk) {
     }
     return last;
 }
-function isGotScrapingHost(urlStr) {
-    try {
-        const host = new URL(urlStr).hostname.toLowerCase();
-        if (GOT_SCRAPING_HOSTS.has(host))
-            return true;
-        if (HANIME_HOSTS.has(host))
-            return true;
-        return GOT_SCRAPING_SUFFIXES.some((s) => host.endsWith(s));
-    }
-    catch {
-        return false;
-    }
-}
-function validateKwikUrl(value) {
-    if (typeof value !== 'string')
-        return null;
-    try {
-        const url = new URL(value);
-        const isSecure = url.protocol === 'https:';
-        const isKwik = KWIK_DOMAINS.has(url.hostname.toLowerCase());
-        const isEmbedPath = /^\/e\/[A-Za-z0-9_-]+$/.test(url.pathname);
-        const noAuthOrQuery = !url.username && !url.password && !url.search && !url.hash;
-        return isSecure && isKwik && isEmbedPath && noAuthOrQuery ? url : null;
-    }
-    catch {
-        return null;
-    }
-}
 function pinVariant(body, idx) {
     const lines = body.split('\n');
     let streamIdx = -1;
@@ -271,16 +200,16 @@ function pinVariant(body, idx) {
         return null;
     return out.join('\n');
 }
-function applyKwikPatches(html, kwikUrl, cookieStr = '') {
-    const safeReferer = JSON.stringify(kwikUrl.href).replace(/</g, '\\u003c');
+function applyEmbedPatches(html, embedUrl, cookieStr = '') {
+    const safeReferer = JSON.stringify(embedUrl.href).replace(/</g, '\\u003c');
     const safeCookie = JSON.stringify(cookieStr).replace(/</g, '\\u003c');
     const patched = html.replace(/\b(src|href|url)\s*[=:]\s*(["']?)(\/\/[^"'>)]+|\/(?!\/)[^"'>)]*)\2/gi, (match, attr, quote, path) => {
-        const full = path.startsWith('//') ? `https:${path}` : `${kwikUrl.origin}${path}`;
+        const full = path.startsWith('//') ? `https:${path}` : `${embedUrl.origin}${path}`;
         const prefix = match.startsWith('url') ? `url(` : `${attr}=`;
         const suffix = match.startsWith('url') ? `)` : '';
         return `${prefix}${quote}${full}${quote}${suffix}`;
     });
-    const iconProxy = `/api/proxy?url=${encodeURIComponent(`${kwikUrl.origin}/app/js/vendor/plyr.svg`)}&referer=${encodeURIComponent(kwikUrl.href)}`;
+    const iconProxy = `/api/proxy?url=${encodeURIComponent(`${embedUrl.origin}/app/js/vendor/plyr.svg`)}&referer=${encodeURIComponent(embedUrl.href)}`;
     const plyrPatch = `<script>if(window.Plyr) Plyr.defaults.iconUrl=${JSON.stringify(iconProxy).replace(/</g, '\\u003c')};</script>`;
     const hlsPatch = `<script>
       (function() {
@@ -359,7 +288,7 @@ function placeholderSvg() {
     return null;
 }
 const PROXY_UA = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0';
-export function registerProxy(app) {
+export function registerProxy(app, getProxyRules) {
     app.get('/api/proxy', async (c) => {
         const url = c.req.query('url');
         if (!url)
@@ -369,60 +298,32 @@ export function registerProxy(app) {
             return c.text(safeCheck.error || 'Invalid URL', 400);
         }
         const urlStr = url;
-        const refererStr = c.req.query('referer') || '';
+        const rule = matchProxyRule(urlStr, getProxyRules());
+        const refererStr = c.req.query('referer') || rule?.referer || '';
+        const originStr = resolveOrigin(rule, refererStr, c.req.query('origin'));
+        const uaStr = c.req.query('ua') || '';
         const cookieStr = c.req.query('cookie') || '';
+        const useScrape = c.req.query('scrape') === '1' || rule?.scrape === true;
+        const useCf = c.req.query('cf') === '1' || rule?.cfCookie === true;
         const variantRaw = c.req.query('variant');
         const variantIdx = variantRaw !== undefined ? parseInt(variantRaw, 10) : NaN;
         const pinVar = Number.isInteger(variantIdx) && variantIdx >= 0;
-        const cacheKey = `m3u8-${urlStr}-${refererStr}${pinVar ? `-v${variantIdx}` : ''}`;
+        const cacheKey = `m3u8-${urlStr}-${refererStr}-${originStr}-${uaStr}${pinVar ? `-v${variantIdx}` : ''}`;
         const abort = new AbortController();
         linkAbort(c.req.raw.signal, abort);
         try {
-            const isVaultCdn = Array.from(VAULT_CDN_HOSTS).some((host) => urlStr.includes(host));
-            const isHanime = Array.from(HANIME_HOSTS).some((host) => urlStr.includes(host));
-            const isOppai = Array.from(OPPAI_HOSTS).some((host) => urlStr.includes(host));
-            const isKaa = refererStr.startsWith(KAA_ORIGIN) ||
-                Array.from(KAA_HOSTS).some((host) => urlStr.includes(host));
             const headers = {
-                'User-Agent': PROXY_UA,
+                'User-Agent': uaStr || PROXY_UA,
             };
             if (refererStr)
                 headers['Referer'] = refererStr;
-            if (isVaultCdn) {
-                headers['Origin'] = refererStr || ANIMEPAHE_URL;
-                const cookieHeader = buildCfClearanceCookie(cookieStr);
+            if (originStr)
+                headers['Origin'] = originStr;
+            if (cookieStr) {
+                const cookieHeader = useCf ? buildCfClearanceCookie(cookieStr) : cookieStr;
                 if (cookieHeader)
                     headers['Cookie'] = cookieHeader;
             }
-            if (isHanime) {
-                if (!headers['Referer'])
-                    headers['Referer'] = refererStr || 'https://nhplayer.com/';
-                headers['Origin'] = 'https://nhplayer.com';
-            }
-            if (isOppai) {
-                if (!headers['Referer'])
-                    headers['Referer'] = refererStr || 'https://oppai.stream/';
-                headers['Origin'] = 'https://oppai.stream';
-            }
-            if (isKaa) {
-                if (!headers['Referer'])
-                    headers['Referer'] = refererStr || KAA_REFERER;
-                headers['Origin'] = KAA_ORIGIN;
-            }
-            const isMegaplay = refererStr.startsWith(MEGAPLAY_ORIGIN) || urlStr.includes('nexabloom.top');
-            if (isMegaplay && !headers['Origin']) {
-                headers['Origin'] = MEGAPLAY_ORIGIN;
-            }
-            if (urlStr.includes('weeabo0.xyz') || urlStr.includes('weeab0o.xyz')) {
-                if (!headers['Referer'])
-                    headers['Referer'] = refererStr || 'https://japaneseasmr.com/';
-                const jasmrCookieHeader = buildCfClearanceCookie(cookieStr);
-                if (jasmrCookieHeader)
-                    headers['Cookie'] = jasmrCookieHeader;
-                const jasmrUa = c.req.query('ua') || '';
-                if (jasmrUa)
-                    headers['User-Agent'] = jasmrUa;
-            }
             const range = c.req.header('range');
             if (range)
                 headers['Range'] = range;
@@ -434,10 +335,23 @@ export function registerProxy(app) {
             };
             const rewritePlaylist = (playlistBody, finalUrl) => {
                 const baseUrl = new URL(finalUrl);
-                const proxiedMediaUrl = (targetUrl) => `/api/proxy?url=${encodeURIComponent(targetUrl)}&referer=${encodeURIComponent(refererStr)}` +
-                    (cookieStr ? `&cookie=${encodeURIComponent(sanitizeCfClearance(cookieStr))}` : '') +
-                    (c.req.query('ua') ? `&ua=${encodeURIComponent(c.req.query('ua'))}` : '');
-                const needsProxy = Boolean(refererStr);
+                const proxiedMediaUrl = (targetUrl) => {
+                    const params = new URLSearchParams({ url: targetUrl });
+                    if (refererStr)
+                        params.set('referer', refererStr);
+                    if (originStr)
+                        params.set('origin', originStr);
+                    if (uaStr)
+                        params.set('ua', uaStr);
+                    if (cookieStr)
+                        params.set('cookie', sanitizeCfClearance(cookieStr));
+                    if (useScrape)
+                        params.set('scrape', '1');
+                    if (useCf)
+                        params.set('cf', '1');
+                    return `/api/proxy?${params}`;
+                };
+                const needsProxy = Boolean(refererStr || originStr || uaStr || useScrape);
                 const isProxied = (value) => value.includes('/api/proxy');
                 const pinned = pinVar ? pinVariant(playlistBody, variantIdx) : null;
                 return (pinned || playlistBody)
@@ -469,8 +383,8 @@ export function registerProxy(app) {
                     headers.set('Access-Control-Allow-Origin', '*');
                     return new Response(cached, { headers });
                 }
-                const resp = await fetchNexabloomFallback(urlStr, abort.signal, (candidate) => gotScraping({
-                    url: isNexabloomMasterUrl(candidate) ? signNexabloomMasterUrl(candidate) : candidate,
+                const resp = await fetchWithMirrors(urlStr, rule?.mirrors, abort.signal, (candidate) => gotScraping({
+                    url: candidate,
                     method: 'GET',
                     headers,
                     responseType: 'text',
@@ -486,10 +400,10 @@ export function registerProxy(app) {
                 return playlistResponse(rewritten);
             }
             else {
-                if (isGotScrapingHost(urlStr)) {
+                if (useScrape) {
                     if (range)
                         headers['Range'] = range;
-                    const resp = await fetchNexabloomFallback(urlStr, abort.signal, (candidate) => gotScraping({
+                    const resp = await fetchWithMirrors(urlStr, rule?.mirrors, abort.signal, (candidate) => gotScraping({
                         url: candidate,
                         method: 'GET',
                         headers,
@@ -521,7 +435,7 @@ export function registerProxy(app) {
                     });
                 }
                 else {
-                    const upstream = await fetchNexabloomFallback(urlStr, abort.signal, async (candidate) => {
+                    const upstream = await fetchWithMirrors(urlStr, rule?.mirrors, abort.signal, async (candidate) => {
                         const attempt = await fetchWithRetry(candidate, { method: 'GET', headers }, { retries: 3, timeoutMs: 30000, signal: abort.signal });
                         if (attempt.status !== 200 && attempt.status !== 206) {
                             try {
@@ -566,25 +480,36 @@ export function registerProxy(app) {
         }
     });
     app.get('/api/embed-proxy', async (c) => {
-        const kwikUrl = validateKwikUrl(c.req.query('url'));
-        if (!kwikUrl)
+        const rawUrl = c.req.query('url');
+        if (!rawUrl)
+            return c.text('URL required', 400);
+        const safeCheck = isSafeExternalUrl(rawUrl);
+        if (!safeCheck.safe)
+            return c.text(safeCheck.error || 'Invalid URL', 400);
+        const rule = matchProxyRule(rawUrl, getProxyRules());
+        if (!rule?.embedPatch)
             return c.text('Invalid or unsupported gateway URL', 400);
+        const embedUrl = new URL(rawUrl);
         const cookieStr = c.req.query('cookie') || '';
+        const refererStr = c.req.query('referer') || rule.referer || '';
+        const originStr = resolveOrigin(rule, refererStr, c.req.query('origin'));
         const abort = new AbortController();
         linkAbort(c.req.raw.signal, abort);
         try {
             const headers = {
-                'User-Agent': PROXY_UA,
-                Referer: ANIMEPAHE_URL,
-                Origin: 'https://animepahe.pw',
+                'User-Agent': c.req.query('ua') || PROXY_UA,
             };
+            if (refererStr)
+                headers['Referer'] = refererStr;
+            if (originStr)
+                headers['Origin'] = originStr;
             if (cookieStr) {
-                const cookieHeader = buildCfClearanceCookie(cookieStr);
+                const cookieHeader = c.req.query('cf') === '1' || rule.cfCookie ? buildCfClearanceCookie(cookieStr) : cookieStr;
                 if (cookieHeader)
                     headers['Cookie'] = cookieHeader;
             }
             const response = await gotScraping({
-                url: kwikUrl.href,
+                url: embedUrl.href,
                 method: 'GET',
                 headers,
                 responseType: 'text',
@@ -593,7 +518,7 @@ export function registerProxy(app) {
                 throwHttpErrors: false,
             });
             const originalHtml = response.body;
-            const patched = applyKwikPatches(originalHtml, kwikUrl, cookieStr);
+            const patched = applyEmbedPatches(originalHtml, embedUrl, cookieStr);
             if (!patched)
                 return c.text('Failed to patch video gateway', 502);
             const outHeaders = new Headers();
@@ -618,51 +543,24 @@ export function registerProxy(app) {
         const abort = new AbortController();
         linkAbort(c.req.raw.signal, abort);
         const subUrl = url;
-        const refererStr = c.req.query('referer') || '';
-        const isAnilight = refererStr.includes('anilight.live') || ANILIGHT_HOSTS.some((host) => subUrl.includes(host));
-        const innerRawUrl = (() => {
-            try {
-                const parsed = new URL(subUrl);
-                if (parsed.hostname.toLowerCase().endsWith('anilight.live') &&
-                    parsed.pathname.includes('/proxy/captions')) {
-                    const inner = parsed.searchParams.get('url');
-                    if (inner && (inner.startsWith('http://') || inner.startsWith('https://'))) {
-                        return inner;
-                    }
-                }
-            }
-            catch {
-                // ignore
-            }
-            return null;
-        })();
+        const rule = matchProxyRule(subUrl, getProxyRules());
+        const refererStr = c.req.query('referer') || rule?.referer || '';
+        const originStr = resolveOrigin(rule, refererStr, c.req.query('origin'));
+        const useScrape = c.req.query('scrape') === '1' || rule?.scrape === true;
         const buildHeaders = () => {
             const headers = {
                 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
                 Accept: 'text/vtt,text/plain,*/*;q=0.8',
             };
-            if (refererStr) {
+            if (refererStr)
                 headers['Referer'] = refererStr;
-            }
-            else if (isAnilight) {
-                headers['Referer'] = ANILIGHT_REFERER;
-            }
-            if (refererStr.startsWith(KAA_ORIGIN) ||
-                Array.from(KAA_HOSTS).some((host) => subUrl.includes(host))) {
-                headers['Origin'] = KAA_ORIGIN;
-            }
-            else if (isAnilight) {
-                headers['Origin'] = ANILIGHT_ORIGIN;
-            }
+            if (originStr)
+                headers['Origin'] = originStr;
             return headers;
         };
         const fetchText = async (target, retries = 1) => {
             const headers = buildHeaders();
-            if (innerRawUrl && target === innerRawUrl) {
-                headers['Referer'] = ANILIGHT_REFERER;
-                headers['Origin'] = ANILIGHT_ORIGIN;
-            }
-            if (isGotScrapingHost(target)) {
+            if (useScrape) {
                 try {
                     const upstream = await gotScraping({
                         url: target,
@@ -732,19 +630,14 @@ export function registerProxy(app) {
         };
         try {
             const headers = buildHeaders();
-            let result = await fetchText(subUrl, 1);
+            const result = await fetchText(subUrl, 1);
             if (abort.signal.aborted)
                 return new Response(null, { status: 499 });
-            if ((!result || !result.body) && innerRawUrl) {
-                result = await fetchText(innerRawUrl, 0);
-                if (abort.signal.aborted)
-                    return new Response(null, { status: 499 });
-            }
             if (!result || !result.body) {
                 return subtitleError('Subtitle upstream error');
             }
             const body = result.body;
-            const baseForSegments = innerRawUrl || subUrl;
+            const baseForSegments = subUrl;
             if (/#EXTM3U/i.test(body.slice(0, 1000))) {
                 const segUrls = body
                     .split('\n')
@@ -825,14 +718,16 @@ export function registerProxy(app) {
         const cookie = c.req.query('cookie') || '';
         const ua = c.req.query('ua') || '';
         const strict = c.req.query('strict') === '1';
+        const rule = matchProxyRule(targetUrl, getProxyRules());
+        const refererValue = c.req.query('referer') || rule?.referer || '';
+        const originValue = resolveOrigin(rule, refererValue, c.req.query('origin'));
         const abort = new AbortController();
         linkAbort(c.req.raw.signal, abort);
-        let refererValue = 'https://anilist.co/';
         const headers = {
             'User-Agent': ua ||
                 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
         };
-        const cacheKey = `${targetUrl}|${cookie}|${ua}`;
+        const cacheKey = `${targetUrl}|${cookie}|${ua}|${refererValue}|${originValue}`;
         const cached = imageCache.get(cacheKey);
         if (cached) {
             const hit = new Headers();
@@ -843,32 +738,15 @@ export function registerProxy(app) {
             return new Response(cached.body, { headers: hit });
         }
         try {
-            if (targetUrl.includes('animepahe')) {
-                refererValue = 'https://animepahe.pw/';
-                headers['Cookie'] = `cf_clearance=${sanitizeCfClearance(cookie)}`;
-            }
-            else if (targetUrl.includes('anilist.co')) {
-                refererValue = 'https://anilist.co/';
-            }
-            else if (targetUrl.includes('gogocdn.net')) {
-                refererValue = 'https://gogoanime.lu/';
-            }
-            else if (targetUrl.includes('animeya.cc')) {
-                refererValue = 'https://animeya.cc/';
-            }
-            else if (targetUrl.includes('myspacecat.pictures')) {
-                refererValue = 'https://oppai.stream/';
-            }
-            else if (targetUrl.includes('weeabo0.xyz')) {
-                refererValue = 'https://japaneseasmr.com/';
-                const jasmrCookieHeader = buildCfClearanceCookie(cookie);
-                if (jasmrCookieHeader)
-                    headers['Cookie'] = jasmrCookieHeader;
-                const uaParam = ua || '';
-                if (uaParam)
-                    headers['User-Agent'] = uaParam;
+            if (refererValue)
+                headers['Referer'] = refererValue;
+            if (originValue)
+                headers['Origin'] = originValue;
+            if (c.req.query('cf') === '1' || rule?.cfCookie) {
+                const cookieHeader = buildCfClearanceCookie(cookie);
+                if (cookieHeader)
+                    headers['Cookie'] = cookieHeader;
             }
-            headers['Referer'] = refererValue;
             let body = null;
             let contentType = 'image/webp';
             for (let attempt = 0; attempt < 3 && !body; attempt++) {

package/server/dist/hono/tv.js

@@ -24,6 +24,28 @@ function rewriteTvPlaylist(body, baseUrl, refererStr, providerStr) {
     })
         .join('\n');
 }
+function pinTvVariant(body, idx) {
+    const lines = body.split('\n');
+    let streamIdx = -1;
+    let skipUri = false;
+    const out = [];
+    for (const line of lines) {
+        const trimmed = line.trim();
+        if (trimmed.startsWith('#EXT-X-STREAM-INF')) {
+            streamIdx++;
+            skipUri = streamIdx !== idx;
+            if (!skipUri)
+                out.push(line);
+            continue;
+        }
+        if (skipUri && trimmed && !trimmed.startsWith('#')) {
+            skipUri = false;
+            continue;
+        }
+        out.push(line);
+    }
+    return streamIdx >= 0 && idx <= streamIdx ? out.join('\n') : body;
+}
 function isPlaylistBody(body) {
     return (body.length >= 7 &&
         body
@@ -67,13 +89,22 @@ export function registerTv(app, getTvProvider) {
         }
     });
     app.get('/api/tv/stream-proxy', async (c) => {
-        const urlStr = c.req.query('url') ?? '';
+        const requestedUrl = c.req.query('url') ?? '';
+        const variantMatch = requestedUrl.match(/#v=(\d+)$/);
+        const variantIdx = variantMatch ? parseInt(variantMatch[1], 10) : NaN;
+        const urlStr = requestedUrl.replace(/#.*$/, '');
         const refererStr = c.req.query('referer') || '';
         const providerStr = (c.req.query('provider') || '').toLowerCase();
         if (!urlStr)
             return c.text('URL required', 400);
         const providerMod = providerStr ? getTvProvider(providerStr) : undefined;
-        const rewrite = (body, baseUrl) => rewriteTvPlaylist(providerMod?.rewritePlaylist?.(body, baseUrl.href) ?? body, baseUrl, refererStr, providerStr);
+        const rewrite = (body, baseUrl) => {
+            const providerBody = providerMod?.rewritePlaylist?.(body, baseUrl.href) ?? body;
+            const pinned = Number.isInteger(variantIdx)
+                ? pinTvVariant(providerBody, variantIdx)
+                : providerBody;
+            return rewriteTvPlaylist(pinned, baseUrl, refererStr, providerStr);
+        };
         const safeCheck = isSafeExternalUrl(urlStr);
         if (!safeCheck.safe) {
             return c.text(safeCheck.error || 'Invalid URL', 400);

package/server/dist/providers/remote-loader.js

@@ -9,7 +9,6 @@ import logger from '../logger.js';
 import { CONFIG } from '../config.js';
 import { requestContext } from '../utils/request-context.js';
 import { sanitizeCfClearance, buildCfClearanceCookie } from '../utils/cookie.utils.js';
-import { base64UrlEncode } from '../utils/megaplay.utils.js';
 import { decodeMaybeGzip, parseJsonBody } from '../utils/http.utils.js';
 import { buildQueryVariants, pickBestMatch } from './title-matching.js';
 import { anilistRequest, parseMalId, searchAnilistByTitle } from '../lib/anilist.js';
@@ -226,7 +225,7 @@ function createCtx(cache) {
         },
         crypto: {
             aes256CbcDecryptJson,
-            hmacSha256Base64Url: (key, message) => base64UrlEncode(crypto.createHmac('sha256', key).update(message).digest()),
+            hmacSha256Base64Url: (key, message) => crypto.createHmac('sha256', key).update(message).digest('base64url'),
         },
         scraping: {
             fetch: async (urlOrOptions, maybeOptions) => {
@@ -441,7 +440,13 @@ async function loadCachedFallback(item, prev, cacheDir, ctx) {
 }
 export async function loadRemoteProviders(opts) {
     const registryUrl = (opts.registryUrl ?? CONFIG.PROVIDER_REPO_URL ?? '').trim();
-    const out = { providers: {}, mangaProviders: {}, tvProviders: {}, catalog: [] };
+    const out = {
+        providers: {},
+        mangaProviders: {},
+        tvProviders: {},
+        catalog: [],
+        proxyRules: [],
+    };
     if (!registryUrl)
         return out;
     const cacheDir = path.join(CONFIG.ROOT, 'remote-providers');
@@ -510,6 +515,8 @@ export async function loadRemoteProviders(opts) {
                 continue;
             }
             out.catalog.push(withFacets(facets, withServers(item, provider, toCatalog(item, true))));
+            if (item.proxy)
+                out.proxyRules.push(item.proxy);
             logger.info({ provider: item.id, version: item.version }, 'remote provider loaded');
         }
         else {
@@ -537,6 +544,8 @@ export async function loadRemoteProviders(opts) {
                         ...withFacets(fb.facets, withServers(item, fb.provider, toCatalog({ ...item, version: prev.version }, true))),
                         error: `serving cached ${prev.version}: ${error}`,
                     });
+                    if (item.proxy)
+                        out.proxyRules.push(item.proxy);
                     logger.warn({ provider: item.id, error, fallback: prev.version }, 'remote provider update failed, serving cached version');
                     continue;
                 }

package/server/dist/providers/remote-types.js

@@ -94,10 +94,45 @@ function parseEntry(raw, index) {
         tier: p.tier,
         modes,
         browse: parseBrowseCaps(p.browse, index),
+        proxy: parseProxyRule(p.proxy, index),
         auth: p.auth === 'cookie' ? 'cookie' : undefined,
         enabledByDefault: p.enabledByDefault === false ? false : true,
     };
 }
+function parseProxyRule(raw, index) {
+    if (raw === undefined)
+        return undefined;
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw)) {
+        throw new Error(`registry.providers[${index}].proxy must be an object`);
+    }
+    const p = raw;
+    const rule = {};
+    for (const key of ['hosts', 'suffixes', 'mirrors']) {
+        if (p[key] === undefined)
+            continue;
+        if (!Array.isArray(p[key]) || !p[key].every((v) => typeof v === 'string' && v)) {
+            throw new Error(`registry.providers[${index}].proxy.${key} must be a non-empty string array`);
+        }
+        rule[key] = p[key].map((v) => v.trim().toLowerCase());
+    }
+    for (const key of ['referer', 'origin']) {
+        if (p[key] === undefined)
+            continue;
+        if (typeof p[key] !== 'string' || !/^https:\/\//i.test(p[key].trim())) {
+            throw new Error(`registry.providers[${index}].proxy.${key} must be an https URL`);
+        }
+        rule[key] = p[key].trim();
+    }
+    for (const key of ['originFromReferer', 'scrape', 'cfCookie', 'embedPatch']) {
+        if (p[key] === undefined)
+            continue;
+        if (typeof p[key] !== 'boolean') {
+            throw new Error(`registry.providers[${index}].proxy.${key} must be boolean`);
+        }
+        rule[key] = p[key];
+    }
+    return rule;
+}
 function parseBrowseCaps(raw, index) {
     if (raw === undefined)
         return undefined;