- Move XOR keys to env vars (PRU_PROXY_KEY, PIPE_OBF_KEY)
- Fix multi-search to combine query + filters
- Fix deepTranslate to return clone instead of mutating
- Improve getBestStream quality matching and fallback
- Add input sanitization for all route params
- CORS blocks unknown origins in production
- Security headers in vercel.json at CDN level
- stats/genre uses Promise.allSettled for parallel execution
- Delete dead server.py, fix version strings
Root cause: createApiRoutes() parameter shift
- Function signature was (app, jsonResponse, jsonError)
- Called from server.js as apiRoutes(jsonResponse, jsonError)
- All params shifted: jsonResponse→jsonError, jsonError→undefined
- Every success response returned {success: false, message: data}
- Health worked because it used res.json() directly
Fix: Removed unused 'app' parameter from createApiRoutes()
All 18 endpoints now return {success: true, results: data}
- 16 API endpoints powered by AniList GraphQL
- Miruro pipe integration for streaming sources
- 12 streaming providers (kiwi, pewe, bee, bonk, etc.)
- M3U8 streaming URLs with subtitles and skip timestamps
- In-memory caching with TTL
- CORS support and health endpoint
Sʜɪɴᴇɪ Nᴏᴜᴢᴇɴ