nekostream 2026.2.7 → 2026.2.8

package/dist/discord.js

@@ -9,8 +9,12 @@ exports.setWatchingPresence = setWatchingPresence;
 exports.clearDiscordPresence = clearDiscordPresence;
 exports.toggleDiscordPresence = toggleDiscordPresence;
 const discord_rpc_1 = __importDefault(require("discord-rpc"));
+const anilist_1 = require("./scrapers/anilist");
 const storage_1 = require("./storage");
-const CLIENT_ID = '1490936797541437440'; // NekoStream Discord App
+const CLIENT_ID = '1490936797541437440';
+const DEFAULT_LARGE_IMAGE = process.env.NEKOSTREAM_RPC_IMAGE_KEY || 'nekostream';
+const DEFAULT_SMALL_IMAGE = process.env.NEKOSTREAM_RPC_SMALL_IMAGE_KEY;
+const DISCORD_TEXT_LIMIT = 120;
 let rpcClient = null;
 let startTimestamp = null;
 let currentDetails;
@@ -19,57 +23,110 @@ let currentFeature;
 let currentAnime;
 let currentEpisode;
 let isWatching = false;
+let activityRevision = 0;
 const COMMON_BUTTONS = [
     { label: 'NekoStream', url: 'https://www.npmjs.com/package/nekostream' },
-    { label: 'Tham gia Discord', url: 'https://discord.gg/Y2kq2y26pZ' }
+    { label: 'Discord', url: 'https://discord.gg/Y2kq2y26pZ' },
 ];
-const imageCache = {};
-async function fetchAnimeImage(title) {
-    const cleanTitle = title.replace(/(vietsub|thuyết minh|tập.*|phần.*)/gi, '').trim();
-    if (imageCache[cleanTitle])
-        return imageCache[cleanTitle];
+const imageCache = new Map();
+function cleanTitleForSearch(title) {
+    return title
+        .replace(/\s+-\s*Tập\s*\d+.*$/iu, '')
+        .replace(/\s+-\s*Episode\s*\d+.*$/iu, '')
+        .replace(/\b(VietSub|Thuyết Minh|Lồng Tiếng|Full HD|HD)\b/giu, '')
+        .replace(/\s+/g, ' ')
+        .trim();
+}
+function cleanPresenceText(text, fallback) {
+    const value = (text || fallback)
+        .replace(/\s+/g, ' ')
+        .trim();
+    if (value.length <= DISCORD_TEXT_LIMIT)
+        return value;
+    return `${value.slice(0, DISCORD_TEXT_LIMIT - 1).trimEnd()}…`;
+}
+function formatProvider(provider) {
+    return provider ? provider.toUpperCase() : 'NEKOSTREAM';
+}
+function buildBrowsingState(provider, feature, animeTitle) {
+    if (animeTitle)
+        return `${cleanPresenceText(animeTitle, 'Anime')} - ${formatProvider(provider)}`;
+    if (provider && feature)
+        return `${formatProvider(provider)} - ${feature}`;
+    if (provider)
+        return formatProvider(provider);
+    return feature || 'CLI';
+}
+async function fetchJikanImage(title) {
     try {
-        const res = await fetch(`https://api.jikan.moe/v4/anime?q=${encodeURIComponent(cleanTitle)}&limit=1`, { signal: AbortSignal.timeout(3000) });
-        if (res.ok) {
-            const data = await res.json();
-            if (data.data && data.data.length > 0) {
-                const imageUrl = data.data[0].images?.jpg?.large_image_url || data.data[0].images?.jpg?.image_url;
-                if (imageUrl) {
-                    imageCache[cleanTitle] = imageUrl;
-                    return imageUrl;
-                }
-            }
-        }
+        const response = await fetch(`https://api.jikan.moe/v4/anime?q=${encodeURIComponent(title)}&limit=1`, { signal: AbortSignal.timeout(3000) });
+        if (!response.ok)
+            return undefined;
+        const data = await response.json();
+        return data.data?.[0]?.images?.webp?.large_image_url ||
+            data.data?.[0]?.images?.jpg?.large_image_url ||
+            data.data?.[0]?.images?.webp?.image_url ||
+            data.data?.[0]?.images?.jpg?.image_url;
+    }
+    catch {
+        return undefined;
+    }
+}
+async function fetchAnimeImage(title) {
+    const cleanTitle = cleanTitleForSearch(title);
+    if (!cleanTitle)
+        return undefined;
+    if (imageCache.has(cleanTitle))
+        return imageCache.get(cleanTitle);
+    const anilist = await (0, anilist_1.enrichWithAniList)(cleanTitle, 3500);
+    const imageUrl = anilist.banner || anilist.cover || await fetchJikanImage(cleanTitle);
+    imageCache.set(cleanTitle, imageUrl);
+    return imageUrl;
+}
+async function resolveLargeImage(animeTitle) {
+    if (!animeTitle) {
+        return { key: DEFAULT_LARGE_IMAGE, text: 'NekoStream' };
     }
-    catch (e) { }
-    return undefined;
+    const cleanTitle = cleanTitleForSearch(animeTitle);
+    const imageUrl = await fetchAnimeImage(cleanTitle);
+    return {
+        key: imageUrl || DEFAULT_LARGE_IMAGE,
+        text: cleanPresenceText(cleanTitle, 'Anime'),
+    };
+}
+function buildBaseActivity(largeImage) {
+    return {
+        largeImageKey: largeImage.key,
+        largeImageText: largeImage.text,
+        ...(DEFAULT_SMALL_IMAGE ? { smallImageKey: DEFAULT_SMALL_IMAGE, smallImageText: 'NekoStream' } : {}),
+        instance: false,
+        buttons: COMMON_BUTTONS,
+    };
 }
 async function initDiscord() {
     const settings = (0, storage_1.loadSettings)();
     if (settings.discordRpcEnabled === false)
         return;
     if (rpcClient)
-        return; // Already initialized
+        return;
     try {
         discord_rpc_1.default.register(CLIENT_ID);
         rpcClient = new discord_rpc_1.default.Client({ transport: 'ipc' });
         rpcClient.on('ready', () => {
-            // Restore presence if it was set before ready
-            refreshPresence();
+            void refreshPresence();
         });
-        // Catch errors silently to avoid crashing CLI if Discord is closed
         rpcClient.login({ clientId: CLIENT_ID }).catch(() => { });
     }
-    catch (e) {
-        // Ignore RPC initialization errors
+    catch {
+        // Discord RPC should never block the CLI.
     }
 }
-function refreshPresence() {
+async function refreshPresence() {
     if (isWatching && currentAnime && currentEpisode && currentProvider) {
-        setWatchingPresence(currentAnime, currentEpisode, currentProvider);
+        await setWatchingPresence(currentAnime, currentEpisode, currentProvider);
     }
     else {
-        setBrowsingPresence(currentDetails, currentProvider, currentFeature, currentAnime);
+        await setBrowsingPresence(currentDetails, currentProvider, currentFeature, currentAnime);
     }
 }
 function safeSetActivity(activity) {
@@ -81,9 +138,12 @@ function safeSetActivity(activity) {
     try {
         rpcClient.setActivity(activity).catch(() => { });
     }
-    catch (e) { }
+    catch {
+        // Ignore transient Discord IPC failures.
+    }
 }
 async function setBrowsingPresence(details, provider, feature, animeTitle) {
+    const revision = ++activityRevision;
     isWatching = false;
     currentDetails = details;
     currentProvider = provider;
@@ -92,50 +152,49 @@ async function setBrowsingPresence(details, provider, feature, animeTitle) {
     currentEpisode = undefined;
     if (!startTimestamp)
         startTimestamp = new Date();
-    const stateStr = provider ? `${provider.toUpperCase()}${feature ? ` | ${feature}` : ''}` : (feature || 'NekoStream CLI');
-    const largeImageKey = animeTitle ? await fetchAnimeImage(animeTitle) : undefined;
-    const largeImageText = animeTitle || 'NekoStream';
+    const largeImage = await resolveLargeImage(animeTitle);
+    if (revision !== activityRevision)
+        return;
     safeSetActivity({
-        details: details || 'Đang lướt Menu Chính',
-        state: stateStr,
+        details: cleanPresenceText(details, animeTitle ? 'Đang xem thông tin phim' : 'Đang duyệt NekoStream'),
+        state: cleanPresenceText(buildBrowsingState(provider, feature, animeTitle), 'NekoStream CLI'),
         startTimestamp,
-        ...(largeImageKey ? { largeImageKey } : {}),
-        largeImageText,
-        instance: false,
-        buttons: COMMON_BUTTONS
+        ...buildBaseActivity(largeImage),
     });
 }
 async function setWatchingPresence(animeTitle, episodeName, provider) {
+    const revision = ++activityRevision;
     isWatching = true;
     currentAnime = animeTitle;
     currentEpisode = episodeName;
     currentProvider = provider;
-    startTimestamp = new Date(); // Reset timer for playback
-    const largeImageKey = await fetchAnimeImage(animeTitle);
+    startTimestamp = new Date();
+    const largeImage = await resolveLargeImage(animeTitle);
+    if (revision !== activityRevision)
+        return;
     safeSetActivity({
-        details: `Đang xem: ${animeTitle}`,
-        state: `${provider.toUpperCase()} | ${episodeName}`,
+        details: cleanPresenceText(animeTitle, 'Đang xem anime'),
+        state: cleanPresenceText(`${episodeName} - ${formatProvider(provider)}`, 'Đang phát'),
         startTimestamp,
-        ...(largeImageKey ? { largeImageKey } : {}),
-        largeImageText: animeTitle,
-        smallImageText: 'Playing',
-        instance: false,
-        buttons: COMMON_BUTTONS
+        ...buildBaseActivity(largeImage),
     });
 }
 function clearDiscordPresence() {
+    activityRevision++;
     if (rpcClient) {
         try {
             rpcClient.clearActivity().catch(() => { });
             rpcClient.destroy().catch(() => { });
         }
-        catch (e) { }
+        catch {
+            // Ignore Discord IPC cleanup failures.
+        }
         rpcClient = null;
     }
 }
 function toggleDiscordPresence(enabled) {
     if (enabled) {
-        initDiscord();
+        void initDiscord();
     }
     else {
         clearDiscordPresence();

package/dist/index.js

@@ -235,7 +235,7 @@ async function showAnimeList(providerName, title, list) {
     }
 }
 async function openAnimeMenu(providerName, animeId) {
-    (0, discord_1.setBrowsingPresence)(`Đang tải dữ liệu: ${animeId}...`, providerName, 'Tải dữ liệu');
+    (0, discord_1.setBrowsingPresence)('Đang tải thông tin phim', providerName, 'Tải dữ liệu');
     const provider = (0, providers_1.getProvider)(providerName);
     // Fetch details & episodes
     const epsSpinner = (0, ora_1.default)('Đang tải thông tin phim và danh sách tập...').start();
@@ -275,7 +275,7 @@ async function openAnimeMenu(providerName, animeId) {
         };
     }
     while (true) {
-        (0, discord_1.setBrowsingPresence)(`Đang xem thông tin: ${selectedAnime ? selectedAnime.title : animeId}`, providerName, 'Thông tin Phim');
+        (0, discord_1.setBrowsingPresence)('Đang xem thông tin phim', providerName, 'Thông tin Phim', selectedAnime ? selectedAnime.title : animeId);
         (0, ui_1.clearScreen)();
         (0, ui_1.printBanner)(`Provider: ${providerName.toUpperCase()}`, selectedAnime ? selectedAnime.title : animeId);
         if (selectedAnime)
@@ -371,7 +371,7 @@ async function openAnimeMenu(providerName, animeId) {
             try {
                 (0, discord_1.setWatchingPresence)(selectedAnime.title, episode.title || `Episode ${episode.number}`, providerName);
                 await (0, player_1.launchPlayer)(streamInfo);
-                (0, discord_1.setBrowsingPresence)(`Đang xem thông tin: ${selectedAnime.title}`, providerName, 'Thông tin Phim');
+                (0, discord_1.setBrowsingPresence)('Đang xem thông tin phim', providerName, 'Thông tin Phim', selectedAnime.title);
                 (0, ui_1.printSuccess)('\nTrình phát đã đóng.');
                 await sleep(500);
             }

package/dist/server/app.js

@@ -0,0 +1,53 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildServer = buildServer;
+const fastify_1 = __importDefault(require("fastify"));
+const cors_1 = __importDefault(require("@fastify/cors"));
+const rate_limit_1 = __importDefault(require("@fastify/rate-limit"));
+const swagger_1 = __importDefault(require("@fastify/swagger"));
+const swagger_ui_1 = __importDefault(require("@fastify/swagger-ui"));
+const http_1 = require("./http");
+const cache_1 = require("./services/cache");
+const server_token_1 = require("./services/server-token");
+const provider_service_1 = require("./services/provider-service");
+const token_store_1 = require("./services/token-store");
+const session_store_1 = require("./services/session-store");
+const health_1 = require("./routes/health");
+const providers_1 = require("./routes/providers");
+const me_1 = require("./routes/me");
+const admin_1 = require("./routes/admin");
+async function buildServer(config) {
+    const app = (0, fastify_1.default)({ logger: true });
+    const tokenStore = new token_store_1.TokenStore(config.dataDir);
+    const sessions = new session_store_1.CoreSessionStore(config.dataDir);
+    const auth = (0, http_1.createAuthHooks)(config, tokenStore);
+    const cache = new cache_1.TtlCache();
+    const serverTokens = new server_token_1.ServerTokenService(config.signingSecret, config.serverTokenTtlMs);
+    const providerService = new provider_service_1.ProviderService(cache, serverTokens);
+    (0, http_1.registerErrorHandler)(app);
+    await app.register(cors_1.default, {
+        origin: config.corsOrigins.length > 0 ? config.corsOrigins : false
+    });
+    await app.register(rate_limit_1.default, {
+        max: config.rateLimitMax,
+        timeWindow: config.rateLimitWindow,
+        keyGenerator: (request) => request.headers.authorization || request.ip
+    });
+    await app.register(swagger_1.default, {
+        openapi: {
+            info: {
+                title: 'NekoStream Core API',
+                version: '1.0.0'
+            }
+        }
+    });
+    await app.register(swagger_ui_1.default, { routePrefix: '/docs' });
+    await (0, health_1.registerHealthRoutes)(app);
+    await (0, providers_1.registerProviderRoutes)(app, providerService, auth.requireAuth);
+    await (0, me_1.registerMeRoutes)(app, sessions, auth.requireAuth);
+    await (0, admin_1.registerAdminRoutes)(app, tokenStore, auth.requireAdmin);
+    return app;
+}

package/dist/server/config.js

@@ -0,0 +1,52 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadCoreConfig = loadCoreConfig;
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const crypto_1 = __importDefault(require("crypto"));
+function splitList(value) {
+    return (value || '')
+        .split(',')
+        .map((item) => item.trim())
+        .filter(Boolean);
+}
+function readPort() {
+    const raw = process.env.NEKOSTREAM_CORE_PORT || process.env.PORT || '7331';
+    const port = Number(raw);
+    if (!Number.isInteger(port) || port < 1 || port > 65535) {
+        throw new Error(`Invalid NEKOSTREAM_CORE_PORT: ${raw}`);
+    }
+    return port;
+}
+function requireProductionSecret(name, fallback) {
+    const value = process.env[name];
+    if (value && value.trim())
+        return value.trim();
+    if (process.env.NODE_ENV === 'production') {
+        throw new Error(`${name} is required in production`);
+    }
+    return fallback;
+}
+function loadCoreConfig() {
+    const devSeed = crypto_1.default.createHash('sha256').update(`${os_1.default.hostname()}:${os_1.default.userInfo().username}:nekostream-core`).digest('hex');
+    const apiTokens = splitList(process.env.NEKOSTREAM_CORE_TOKEN || process.env.NEKOSTREAM_CORE_TOKENS);
+    const devApiToken = `dev-${devSeed.slice(0, 24)}`;
+    const effectiveApiTokens = apiTokens.length > 0
+        ? apiTokens
+        : [requireProductionSecret('NEKOSTREAM_CORE_TOKEN', devApiToken)];
+    return {
+        host: process.env.NEKOSTREAM_CORE_HOST || '0.0.0.0',
+        port: readPort(),
+        dataDir: process.env.NEKOSTREAM_CORE_DATA_DIR || path_1.default.join(os_1.default.homedir(), '.nekostream-core'),
+        apiTokens: effectiveApiTokens,
+        adminToken: requireProductionSecret('NEKOSTREAM_CORE_ADMIN_TOKEN', `admin-${devSeed.slice(24, 48)}`),
+        signingSecret: requireProductionSecret('NEKOSTREAM_CORE_SECRET', devSeed),
+        corsOrigins: splitList(process.env.NEKOSTREAM_CORE_CORS_ORIGINS),
+        rateLimitMax: Number(process.env.NEKOSTREAM_CORE_RATE_LIMIT_MAX || '120'),
+        rateLimitWindow: process.env.NEKOSTREAM_CORE_RATE_LIMIT_WINDOW || '1 minute',
+        serverTokenTtlMs: Number(process.env.NEKOSTREAM_CORE_SERVER_TOKEN_TTL_MS || 10 * 60 * 1000)
+    };
+}

package/dist/server/http.js

@@ -0,0 +1,78 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApiError = void 0;
+exports.ok = ok;
+exports.fail = fail;
+exports.createAuthHooks = createAuthHooks;
+exports.registerErrorHandler = registerErrorHandler;
+const crypto_1 = __importDefault(require("crypto"));
+class ApiError extends Error {
+    statusCode;
+    code;
+    constructor(statusCode, code, message) {
+        super(message);
+        this.statusCode = statusCode;
+        this.code = code;
+    }
+}
+exports.ApiError = ApiError;
+function ok(data, meta = {}) {
+    return { ok: true, data, meta, error: null };
+}
+function fail(error) {
+    return {
+        ok: false,
+        data: null,
+        meta: {},
+        error: {
+            code: error.code,
+            message: error.message
+        }
+    };
+}
+function tokenFromRequest(request) {
+    const header = request.headers.authorization;
+    if (!header)
+        return null;
+    const match = header.match(/^Bearer\s+(.+)$/i);
+    return match ? match[1].trim() : null;
+}
+function safeEqual(a, b) {
+    const left = Buffer.from(a);
+    const right = Buffer.from(b);
+    if (left.length !== right.length)
+        return false;
+    return crypto_1.default.timingSafeEqual(left, right);
+}
+function createAuthHooks(config, tokenStore) {
+    async function requireAuth(request) {
+        const token = tokenFromRequest(request);
+        if (!token)
+            throw new ApiError(401, 'UNAUTHORIZED', 'Missing bearer token');
+        const validEnvToken = config.apiTokens.some((candidate) => safeEqual(candidate, token));
+        if (validEnvToken || tokenStore.verifyToken(token))
+            return;
+        throw new ApiError(401, 'UNAUTHORIZED', 'Invalid bearer token');
+    }
+    async function requireAdmin(request) {
+        const token = tokenFromRequest(request);
+        if (!token || !safeEqual(config.adminToken, token)) {
+            throw new ApiError(403, 'FORBIDDEN', 'Admin token required');
+        }
+    }
+    return { requireAuth, requireAdmin };
+}
+function registerErrorHandler(app) {
+    app.setErrorHandler((error, _request, reply) => {
+        if (error instanceof ApiError) {
+            reply.status(error.statusCode).send(fail(error));
+            return;
+        }
+        const statusCode = typeof error.statusCode === 'number' ? error.statusCode : 500;
+        const message = error instanceof Error ? error.message : 'Internal error';
+        reply.status(statusCode).send(fail(new ApiError(statusCode, 'INTERNAL_ERROR', message)));
+    });
+}

package/dist/server/index.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadCoreConfig = exports.buildServer = void 0;
+const config_1 = require("./config");
+Object.defineProperty(exports, "loadCoreConfig", { enumerable: true, get: function () { return config_1.loadCoreConfig; } });
+const app_1 = require("./app");
+Object.defineProperty(exports, "buildServer", { enumerable: true, get: function () { return app_1.buildServer; } });
+async function main() {
+    const config = (0, config_1.loadCoreConfig)();
+    const app = await (0, app_1.buildServer)(config);
+    await app.listen({ host: config.host, port: config.port });
+    app.log.info(`NekoStream Core listening on http://${config.host}:${config.port}`);
+    if (process.env.NODE_ENV !== 'production' && !process.env.NEKOSTREAM_CORE_TOKEN) {
+        app.log.warn('Using generated development API token. Set NEKOSTREAM_CORE_TOKEN for stable access.');
+    }
+}
+if (require.main === module) {
+    main().catch((error) => {
+        console.error(error);
+        process.exit(1);
+    });
+}

package/dist/server/routes/admin.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerAdminRoutes = registerAdminRoutes;
+const http_1 = require("../http");
+const providers_1 = require("../../providers");
+async function registerAdminRoutes(app, tokenStore, requireAdmin) {
+    app.get('/v1/admin/tokens', { onRequest: requireAdmin }, async () => {
+        return (0, http_1.ok)(tokenStore.list());
+    });
+    app.post('/v1/admin/tokens', { onRequest: requireAdmin }, async () => {
+        return (0, http_1.ok)(tokenStore.create());
+    });
+    app.delete('/v1/admin/tokens/:tokenId', { onRequest: requireAdmin }, async (request) => {
+        const deleted = tokenStore.delete(request.params.tokenId);
+        if (!deleted)
+            throw new http_1.ApiError(404, 'TOKEN_NOT_FOUND', 'Token not found');
+        return (0, http_1.ok)({ deleted });
+    });
+    app.get('/v1/admin/metrics', { onRequest: requireAdmin }, async () => {
+        const memory = process.memoryUsage();
+        return (0, http_1.ok)({
+            uptime: process.uptime(),
+            memory,
+            timestamp: new Date().toISOString()
+        });
+    });
+    app.post('/v1/admin/providers/:provider/domain', { onRequest: requireAdmin }, async (request) => {
+        const providerName = request.params.provider.toLowerCase();
+        if (!providers_1.providers[providerName])
+            throw new http_1.ApiError(404, 'PROVIDER_NOT_FOUND', 'Provider not found');
+        const raw = request.body?.domain?.trim();
+        if (!raw)
+            throw new http_1.ApiError(400, 'BAD_DOMAIN', 'domain is required');
+        const url = (raw.startsWith('http') ? raw : `https://${raw}`).replace(/\/$/, '');
+        const provider = (0, providers_1.getProvider)(providerName);
+        provider.baseUrl = url;
+        return (0, http_1.ok)({ provider: providerName, baseUrl: provider.baseUrl });
+    });
+}

package/dist/server/routes/health.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerHealthRoutes = registerHealthRoutes;
+const http_1 = require("../http");
+async function registerHealthRoutes(app) {
+    app.get('/v1/health', async () => {
+        return (0, http_1.ok)({
+            status: 'ok',
+            service: 'nekostream-core',
+            uptime: process.uptime(),
+            timestamp: new Date().toISOString()
+        });
+    });
+}

package/dist/server/routes/me.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerMeRoutes = registerMeRoutes;
+const http_1 = require("../http");
+function bearer(request) {
+    const header = request.headers.authorization || '';
+    const match = header.match(/^Bearer\s+(.+)$/i);
+    if (!match)
+        throw new http_1.ApiError(401, 'UNAUTHORIZED', 'Missing bearer token');
+    return match[1].trim();
+}
+async function registerMeRoutes(app, sessions, requireAuth) {
+    app.get('/v1/me/providers/:provider/status', { onRequest: requireAuth }, async (request) => {
+        const session = sessions.get(bearer(request), request.params.provider);
+        return (0, http_1.ok)({
+            provider: request.params.provider,
+            loggedIn: Boolean(session),
+            cookieCount: session?.cookies?.length || 0,
+            capturedAt: session?.capturedAt,
+            userDisplayName: session?.userDisplayName
+        });
+    });
+    app.post('/v1/me/providers/:provider/session', { onRequest: requireAuth }, async (request) => {
+        const body = request.body || {};
+        const session = {
+            provider: request.params.provider,
+            cookies: Array.isArray(body.cookies) ? body.cookies : [],
+            capturedAt: body.capturedAt || new Date().toISOString(),
+            source: body.source || 'manual',
+            authConfirmed: body.authConfirmed,
+            userDisplayName: body.userDisplayName,
+            userAvatarUrl: body.userAvatarUrl,
+            userId: body.userId,
+            accessToken: body.accessToken,
+            localStorageState: body.localStorageState
+        };
+        sessions.set(bearer(request), request.params.provider, session);
+        return (0, http_1.ok)({ provider: request.params.provider, saved: true });
+    });
+    app.delete('/v1/me/providers/:provider/session', { onRequest: requireAuth }, async (request) => {
+        const deleted = sessions.delete(bearer(request), request.params.provider);
+        return (0, http_1.ok)({ provider: request.params.provider, deleted });
+    });
+    app.get('/v1/me/providers/:provider/lists/:type', { onRequest: requireAuth }, async () => {
+        throw new http_1.ApiError(501, 'NOT_IMPLEMENTED', 'Server-scoped provider list fetching is not implemented yet');
+    });
+    app.get('/v1/me/providers/:provider/notifications', { onRequest: requireAuth }, async () => {
+        throw new http_1.ApiError(501, 'NOT_IMPLEMENTED', 'Server-scoped notifications are not implemented yet');
+    });
+}

package/dist/server/routes/providers.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerProviderRoutes = registerProviderRoutes;
+const http_1 = require("../http");
+function numberQuery(value, fallback, max) {
+    const parsed = Number(value);
+    if (!Number.isFinite(parsed))
+        return fallback;
+    return Math.max(1, Math.min(max, Math.floor(parsed)));
+}
+async function registerProviderRoutes(app, providerService, requireAuth) {
+    app.get('/v1/providers', { onRequest: requireAuth }, async () => {
+        return (0, http_1.ok)(providerService.listProviders());
+    });
+    app.get('/v1/providers/:provider/home', { onRequest: requireAuth }, async (request) => {
+        const section = request.query.section || 'trending';
+        if (section !== 'trending' && section !== 'latest') {
+            throw new http_1.ApiError(400, 'BAD_SECTION', 'section must be trending or latest');
+        }
+        const result = await providerService.home(request.params.provider, section);
+        return (0, http_1.ok)(result.value, { provider: request.params.provider, section, cached: result.cached });
+    });
+    app.get('/v1/providers/:provider/search', { onRequest: requireAuth }, async (request) => {
+        const page = numberQuery(request.query.page, 1, 999);
+        const pageSize = numberQuery(request.query.pageSize, 20, 100);
+        const result = await providerService.search(request.params.provider, request.query.q || '', page, pageSize);
+        return (0, http_1.ok)(result.items, {
+            provider: request.params.provider,
+            page: result.currentPage,
+            totalPages: result.totalPages,
+            totalItems: result.totalItems,
+            cached: result.cached
+        });
+    });
+    app.get('/v1/providers/:provider/anime/:animeId', { onRequest: requireAuth }, async (request) => {
+        const result = await providerService.detail(request.params.provider, request.params.animeId);
+        return (0, http_1.ok)(result.value, { provider: request.params.provider, cached: result.cached });
+    });
+    app.get('/v1/providers/:provider/anime/:animeId/episodes', { onRequest: requireAuth }, async (request) => {
+        const result = await providerService.episodes(request.params.provider, request.params.animeId);
+        return (0, http_1.ok)(result.value, { provider: request.params.provider, cached: result.cached });
+    });
+    app.get('/v1/providers/:provider/episodes/:episodeId/servers', { onRequest: requireAuth }, async (request) => {
+        const result = await providerService.servers(request.params.provider, request.params.episodeId);
+        return (0, http_1.ok)(result.items, { provider: request.params.provider, cached: result.cached });
+    });
+    app.post('/v1/providers/:provider/streams/resolve', { onRequest: requireAuth }, async (request) => {
+        if (!request.body?.serverId)
+            throw new http_1.ApiError(400, 'BAD_SERVER_ID', 'serverId is required');
+        const stream = await providerService.resolveStream(request.params.provider, request.body.serverId);
+        return (0, http_1.ok)(stream, { provider: request.params.provider, cached: false });
+    });
+}

package/dist/server/services/cache.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.cacheTtl = exports.TtlCache = void 0;
+class TtlCache {
+    entries = new Map();
+    get(key) {
+        const entry = this.entries.get(key);
+        if (!entry)
+            return null;
+        if (entry.expiresAt <= Date.now()) {
+            this.entries.delete(key);
+            return null;
+        }
+        return entry.value;
+    }
+    set(key, value, ttlMs) {
+        this.entries.set(key, { value, expiresAt: Date.now() + ttlMs });
+        return value;
+    }
+    async getOrSet(key, ttlMs, loader) {
+        const cached = this.get(key);
+        if (cached !== null)
+            return { value: cached, cached: true };
+        const value = await loader();
+        this.set(key, value, ttlMs);
+        return { value, cached: false };
+    }
+}
+exports.TtlCache = TtlCache;
+exports.cacheTtl = {
+    home: 5 * 60 * 1000,
+    search: 5 * 60 * 1000,
+    detail: 30 * 60 * 1000,
+    episodes: 10 * 60 * 1000,
+    servers: 2 * 60 * 1000
+};

package/dist/server/services/provider-service.js

@@ -0,0 +1,90 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProviderService = void 0;
+const providers_1 = require("../../providers");
+const http_1 = require("../http");
+const cache_1 = require("./cache");
+function normalizeProvider(name) {
+    return String(name || '').toLowerCase();
+}
+function providerOrThrow(name) {
+    const providerName = normalizeProvider(name);
+    if (!providers_1.providers[providerName])
+        throw new http_1.ApiError(404, 'PROVIDER_NOT_FOUND', `Provider not found: ${name}`);
+    return { providerName, provider: (0, providers_1.getProvider)(providerName) };
+}
+function filterSearch(results, page, pageSize) {
+    const safePage = Math.max(1, page || 1);
+    const start = (safePage - 1) * pageSize;
+    return {
+        items: results.slice(start, start + pageSize),
+        currentPage: safePage,
+        totalPages: Math.max(1, Math.ceil(results.length / pageSize)),
+        totalItems: results.length
+    };
+}
+class ProviderService {
+    cache;
+    serverTokens;
+    constructor(cache, serverTokens) {
+        this.cache = cache;
+        this.serverTokens = serverTokens;
+    }
+    listProviders() {
+        return Object.entries(providers_1.providers).map(([id, provider]) => ({
+            id,
+            name: provider.name,
+            baseUrl: provider.baseUrl
+        }));
+    }
+    async home(providerNameRaw, section) {
+        const { providerName, provider } = providerOrThrow(providerNameRaw);
+        return await this.cache.getOrSet(`${providerName}:home:${section}`, cache_1.cacheTtl.home, () => provider.getHomeCards(section));
+    }
+    async search(providerNameRaw, query, page, pageSize) {
+        const { providerName, provider } = providerOrThrow(providerNameRaw);
+        const q = String(query || '').trim();
+        if (!q)
+            throw new http_1.ApiError(400, 'BAD_QUERY', 'q is required');
+        const results = await this.cache.getOrSet(`${providerName}:search:${q}`, cache_1.cacheTtl.search, () => provider.search(q));
+        return { ...filterSearch(results.value, page, pageSize), cached: results.cached };
+    }
+    async detail(providerNameRaw, animeId) {
+        const { providerName, provider } = providerOrThrow(providerNameRaw);
+        return await this.cache.getOrSet(`${providerName}:detail:${animeId}`, cache_1.cacheTtl.detail, async () => {
+            const detail = await provider.getAnimeDetail(animeId);
+            if (!detail)
+                throw new http_1.ApiError(404, 'ANIME_NOT_FOUND', 'Anime not found');
+            return detail;
+        });
+    }
+    async episodes(providerNameRaw, animeId) {
+        const { providerName, provider } = providerOrThrow(providerNameRaw);
+        return await this.cache.getOrSet(`${providerName}:episodes:${animeId}`, cache_1.cacheTtl.episodes, () => provider.getEpisodes(animeId));
+    }
+    async servers(providerNameRaw, episodeId) {
+        const { providerName, provider } = providerOrThrow(providerNameRaw);
+        const result = await this.cache.getOrSet(`${providerName}:servers:${episodeId}`, cache_1.cacheTtl.servers, () => provider.getVideoServers(episodeId));
+        const items = result.value.map((server) => {
+            const signed = this.serverTokens.sign(providerName, server);
+            return {
+                serverId: signed.serverId,
+                expiresAt: signed.expiresAt,
+                name: server.name,
+                quality: server.quality,
+                type: server.type,
+                source: server.source
+            };
+        });
+        return { items, cached: result.cached };
+    }
+    async resolveStream(providerNameRaw, serverId) {
+        const { providerName, provider } = providerOrThrow(providerNameRaw);
+        const payload = this.serverTokens.verify(serverId, providerName);
+        const stream = await provider.extractStreamUrl(payload.server);
+        if (!stream?.url)
+            throw new http_1.ApiError(502, 'STREAM_RESOLVE_FAILED', 'Could not resolve stream');
+        return stream;
+    }
+}
+exports.ProviderService = ProviderService;

package/dist/server/services/server-token.js

@@ -0,0 +1,51 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ServerTokenService = void 0;
+const crypto_1 = __importDefault(require("crypto"));
+const http_1 = require("../http");
+function encode(value) {
+    return Buffer.from(JSON.stringify(value)).toString('base64url');
+}
+function decode(value) {
+    return JSON.parse(Buffer.from(value, 'base64url').toString('utf8'));
+}
+class ServerTokenService {
+    secret;
+    ttlMs;
+    constructor(secret, ttlMs) {
+        this.secret = secret;
+        this.ttlMs = ttlMs;
+    }
+    sign(provider, server) {
+        const payload = {
+            provider,
+            server,
+            exp: Date.now() + this.ttlMs
+        };
+        const body = encode(payload);
+        const sig = crypto_1.default.createHmac('sha256', this.secret).update(body).digest('base64url');
+        return { serverId: `${body}.${sig}`, expiresAt: payload.exp };
+    }
+    verify(serverId, expectedProvider) {
+        const [body, sig] = String(serverId || '').split('.');
+        if (!body || !sig)
+            throw new http_1.ApiError(401, 'INVALID_SERVER_TOKEN', 'Invalid serverId');
+        const expectedSig = crypto_1.default.createHmac('sha256', this.secret).update(body).digest('base64url');
+        const left = Buffer.from(sig);
+        const right = Buffer.from(expectedSig);
+        if (left.length !== right.length || !crypto_1.default.timingSafeEqual(left, right)) {
+            throw new http_1.ApiError(401, 'INVALID_SERVER_TOKEN', 'Invalid serverId signature');
+        }
+        const payload = decode(body);
+        if (payload.exp <= Date.now())
+            throw new http_1.ApiError(410, 'SERVER_TOKEN_EXPIRED', 'serverId expired');
+        if (expectedProvider && payload.provider !== expectedProvider) {
+            throw new http_1.ApiError(401, 'INVALID_SERVER_TOKEN', 'serverId provider mismatch');
+        }
+        return payload;
+    }
+}
+exports.ServerTokenService = ServerTokenService;

package/dist/server/services/session-store.js

@@ -0,0 +1,52 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CoreSessionStore = void 0;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const crypto_1 = __importDefault(require("crypto"));
+class CoreSessionStore {
+    filePath;
+    constructor(dataDir) {
+        fs_1.default.mkdirSync(dataDir, { recursive: true });
+        this.filePath = path_1.default.join(dataDir, 'provider-sessions.json');
+    }
+    ownerKey(apiToken) {
+        return crypto_1.default.createHash('sha256').update(apiToken).digest('hex');
+    }
+    load() {
+        try {
+            if (!fs_1.default.existsSync(this.filePath))
+                return {};
+            return JSON.parse(fs_1.default.readFileSync(this.filePath, 'utf8'));
+        }
+        catch {
+            return {};
+        }
+    }
+    save(data) {
+        fs_1.default.writeFileSync(this.filePath, JSON.stringify(data, null, 2), 'utf8');
+    }
+    get(apiToken, provider) {
+        return this.load()[this.ownerKey(apiToken)]?.[provider] ?? null;
+    }
+    set(apiToken, provider, session) {
+        const data = this.load();
+        const owner = this.ownerKey(apiToken);
+        data[owner] = data[owner] || {};
+        data[owner][provider] = { ...session, provider };
+        this.save(data);
+    }
+    delete(apiToken, provider) {
+        const data = this.load();
+        const owner = this.ownerKey(apiToken);
+        if (!data[owner]?.[provider])
+            return false;
+        delete data[owner][provider];
+        this.save(data);
+        return true;
+    }
+}
+exports.CoreSessionStore = CoreSessionStore;

package/dist/server/services/token-store.js

@@ -0,0 +1,58 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenStore = void 0;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const crypto_1 = __importDefault(require("crypto"));
+class TokenStore {
+    filePath;
+    constructor(dataDir) {
+        fs_1.default.mkdirSync(dataDir, { recursive: true });
+        this.filePath = path_1.default.join(dataDir, 'tokens.json');
+    }
+    load() {
+        try {
+            if (!fs_1.default.existsSync(this.filePath))
+                return [];
+            return JSON.parse(fs_1.default.readFileSync(this.filePath, 'utf8'));
+        }
+        catch {
+            return [];
+        }
+    }
+    save(tokens) {
+        fs_1.default.writeFileSync(this.filePath, JSON.stringify(tokens, null, 2), 'utf8');
+    }
+    hash(token) {
+        return crypto_1.default.createHash('sha256').update(token).digest('hex');
+    }
+    verifyToken(token) {
+        const hash = this.hash(token);
+        return this.load().some((entry) => entry.hash === hash);
+    }
+    list() {
+        return this.load().map(({ id, createdAt }) => ({ id, createdAt }));
+    }
+    create() {
+        const raw = `nks_${crypto_1.default.randomBytes(32).toString('base64url')}`;
+        const entry = {
+            id: crypto_1.default.randomUUID(),
+            hash: this.hash(raw),
+            createdAt: new Date().toISOString()
+        };
+        const tokens = this.load();
+        tokens.push(entry);
+        this.save(tokens);
+        return { id: entry.id, token: raw, createdAt: entry.createdAt };
+    }
+    delete(id) {
+        const tokens = this.load();
+        const next = tokens.filter((entry) => entry.id !== id);
+        this.save(next);
+        return next.length !== tokens.length;
+    }
+}
+exports.TokenStore = TokenStore;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nekostream",
-  "version": "2026.2.7",
+  "version": "2026.2.8",
   "description": "Bettter version of NekoStream ",
   "keywords": [
     "anime",
@@ -17,7 +17,7 @@
   ],
   "main": "dist/index.js",
   "bin": {
-    "nekostream": "./bin/nekostream.js"
+    "nekostream": "bin/nekostream.js"
   },
   "scripts": {
     "start": "tsx index.ts",
@@ -43,6 +43,7 @@
     "cross-fetch": "^4.1.0",
     "discord-rpc": "^4.0.1",
     "electron": "^34.0.0",
+    "fastify": "^5.9.0",
     "hls.js": "^1.6.0",
     "ora": "^5.4.1",
     "playwright": "^1.60.0",