- Move XOR keys to env vars (PRU_PROXY_KEY, PIPE_OBF_KEY)
- Fix multi-search to combine query + filters
- Fix deepTranslate to return clone instead of mutating
- Improve getBestStream quality matching and fallback
- Add input sanitization for all route params
- CORS blocks unknown origins in production
- Security headers in vercel.json at CDN level
- stats/genre uses Promise.allSettled for parallel execution
- Delete dead server.py, fix version strings
- Handle raw pipe IDs (animedao:witch-hat-atelier:1) with colon separator
- Handle slugged IDs (watch/bonk/147105/sub/animedao-1) with slash separator
- Use rawPipeId for decoded ID recovery in both cases
- Match slug against last segment of ep.id (after injectSourceSlugs)
- Use rawPipeId + translateId to recover original decoded ID
- Fixes 'Episode slug not found' error for all providers
- decodePipeResponse now XOR-decodes with obfuscation key before gzip
- Updated pipe version to 0.2.0 to match miruro.tv
- Added /api/proxy endpoint for CORS-safe M3U8/VTT streaming
- Proxied stream/subtitle URLs through /api/proxy for browser playback
- M3U8 content rewritten to proxy variant playlists and segments
- Swagger UI interactive docs at /docs
- OpenAPI 3.0 spec at /openapi.json
- mappings field in episodes response (anilistId, malId, kitsuId)
- Docker support (Dockerfile + .dockerignore)
- Premium landing page with try-it buttons (Walter-style)
- Health endpoint with providers list and endpoint count
- 16 API endpoints powered by AniList GraphQL
- Miruro pipe integration for streaming sources
- 12 streaming providers (kiwi, pewe, bee, bonk, etc.)
- M3U8 streaming URLs with subtitles and skip timestamps
- In-memory caching with TTL
- CORS support and health endpoint