New endpoints:
- GET /api/stream/resolve — Resolves actual m3u8/mp4 URLs from embed player URLs
Follows chain: vidtube.site → megaplay API → m3u8 playlist
Returns url, type, qualities, subtitles, skipData
- GET /api/stream/qualities — Parses M3U8 playlists for available quality options
Returns sorted quality list with resolution, bandwidth, URLs
New extractors:
- streamResolver.extractor.js — Full stream resolution pipeline
- resolveStreamUrl(): Resolves embed → actual video URL
- parseM3u8Qualities(): Parses master playlists for qualities
- normalizeServerName(): Maps VidPlay-1 → vidplay, HD-1 → hd
- extractSubtitles(): Extracts subtitle tracks from API responses
Enhancements:
- streamInfo.extractor.js: Added session establishment before AJAX calls
- Server list now includes normalizedName field for each server
- Stream info now includes type (hls/mp4) and backup URL
- Server list includes typeLabel (SUB/HSUB/DUB)
- Session cookies properly maintained for AJAX stream endpoints
Architecture:
- Embed API domain mapping (vidtube.site → megaplay-1.buzz)
- M3U8 parser supports master and media playlists
- Subtitle extraction from multiple API response formats
- 36 total endpoints (was 34)
New Endpoints (4 new routes):
- GET /api/upcoming — upcoming anime releases from homepage
- GET /api/top-rankings?sort=top|newest — ranked anime with sort modes
- GET /api/recently-updated?tab=all|dub|sub — filtered recent updates
- GET /api/completed — finished anime series from homepage
Enhanced Filter (/api/filter):
- Added source parameter (18 source material types)
- Added epMin/epMax for episode range filtering
- Added excludeWatchlist parameter for logged-in users
- Added season parameter (spring/summer/fall/winter)
New Config IDs:
- SOURCE_IDS: 18 source material type mappings
- SEASON_IDS: 4 broadcast season mappings
- EXTENDED_TYPE_IDS: Added tv-short and tv-special types
Total endpoints: 34 (was 30)
OpenAPI spec updated with new endpoints
CHANGELOG.md updated with comprehensive change history
Major Changes:
- Add shared parseListItem.helper.js for unified list parsing (DRY)
- Migrate all 22 extractors to use fetchWithMirror() for consistent mirror fallback
- Remove unused cors dependency (custom CORS middleware handles it)
- Fix middleware ordering: timeout now registered before routes
- Fix CORS to allow POST for /api/mirrors/reset endpoint
- Remove redundant cache check in homeInfo extractor
New Features:
- Request ID tracking (X-Request-Id header) for debugging
- Graceful shutdown handling (SIGTERM/SIGINT) with 10s timeout
- CSP and HSTS security headers
- Rate limiter cleanup interval (every 5 min) to prevent memory leak
- Request body size limits (10kb) via express.json()
Security:
- Content-Security-Policy header for XSS protection
- Strict-Transport-Security for HTTPS enforcement
- X-Permitted-Cross-Domain-Policies: none
- Body size limits to prevent large payload attacks
Code Quality:
- All files follow strict documentation style (box headers, section separators,
feature markers, JSDoc params/returns, inline notes, module footers)
- Eliminated ~200 lines of duplicated code across 8+ extractors
- Updated CHANGELOG.md with comprehensive change history
- Add pagination.helper.js with addPaginationMeta function
- Add pagination info to: most-popular, search, new-release, newly-added, latest-updated, az-list, filter, category, status
- Pagination includes: currentPage, totalPages, totalItems, itemsPerPage, hasNext, hasPrev
- Fix creatorInfo middleware to include message field
- Fix bug where full URLs were passed to fetchWithMirror causing doubled URLs
- Extract path from full URL before passing to mirror fallback
- Fixes search, most-popular, new-release, newly-added, and az-list endpoints
- Update endpoint count from 30 to 33 in badge, stats, and descriptions
- Update caching description from 5-min TTL to LRU with configurable TTL
- Update timeout description from 15s to configurable
- Update mermaid diagram labels
Browser blocks cross-origin requests from AniKotoWeb because
Access-Control-Allow-Origin was never set when ALLOWED_ORIGINS
was undefined on Vercel. Changed condition to allow all origins
when env var is not configured.
- apiRoutes.js: Moved imports outside comment block (caused 500 on all endpoints)
- test.js: Deleted orphaned duplicate code after function close
- random.controller.js: Removed stray closing brace breaking try/catch
- cache.helper.js: Added missing MAX_CACHE_SIZE constant
These bugs were introduced by sed insert commands placing code in wrong positions.
The API was returning 500 FUNCTION_INVOCATION_FAILED on all endpoints.
- favicon-origin.png — Original favicon from anikototv.to
- share.jpg — OG/Social sharing image (1MB)
- logo.png — Site logo
- Updated index.html to use share.jpg for OG/Twitter cards
- Updated manifest.json with new icons
- Updated favicon link to use original PNG
- All examples now use real responses from live API
- Streaming flow tested end-to-end (episodeList -> servers -> stream)
- All code examples verified working
- Real titles: Wistoria, Witch Hat Atelier, Road of Naruto, etc.
- Real stream URLs from megaplay.buzz
- Real CDN URLs from anipixcdn.co
- Fixed streaming endpoints: proper JSON/HTML parsing
- episodeList: Parse AJAX JSON response, extract server_ids/timestamp/mal_id
- streamInfo: Parse server list HTML into structured server objects
- streamInfo: Parse stream URL from JSON response properly
- Added cheerio import to streamInfo extractor
- Servers now return: type, link_id, cmid, sv_id, ep_id, name
- Changed publicDir to use process.cwd() for Vercel compatibility
- Simplified vercel.json routes: API -> server.js, everything else -> server.js
- Express.static will serve files from public/ directory
- API routes (/api/*) still go to server.js
- All other routes serve from /public/ directory
- Fixes privacy.html, tos.html, manifest.json, robots.txt, sitemap.xml, og-image.svg
Shinei Nouzen