The streaming endpoints (/episodes, /sources, /stream, /watch, /download)
returned 500 because the upstream Miruro pipe changed and www.miruro.tv is
now hard-blocked by Cloudflare.
Reverse-engineered the current Miruro frontend contract:
- Request is plain base64url of the JSON payload (no XOR).
- Response obfuscation is now signalled by the x-obfuscated header:
absent = plain JSON, 1 = base64+gzip, 2 = base64+XOR(PIPE_OBF_KEY)+gzip.
pipe.js now:
- rotates across mirrors (miruro.ru > .to > .bz > .tv), one per retry;
- decodes based on the x-obfuscated header instead of always XOR+gunzip;
- sends full browser sec-fetch/sec-ch-ua headers to pass Cloudflare checks;
- raises maxRetries to 4 and rotates on 403/444.
proxy.js default referer/Origin -> https://www.miruro.to (miruro.tv is dead).
AniList-backed endpoints were already healthy and are unaffected.
Version bumped to 2.2.0 across package.json, server.js, /api/health,
/api/openapi, public/openapi.json. CHANGELOG updated.
Replaced placeholder SVGs with actual scraped assets:
- favicon.svg → icon-dark.svg (real Miruro dark mode SVG)
- share.svg → og-image.png (real maskable icon for OG/Twitter)
- Added: icon-light.svg, icon-512x512.png, favicon.ico, apple-touch-icon
- Nav logos now use real Miruro icon image instead of text div
- OG meta tags updated: SVG→PNG for proper social previews
- Both index.html and docs.html updated
- Version badge: v1.1.0 → v1.2.0
- Swagger UI interactive docs at /docs
- OpenAPI 3.0 spec at /openapi.json
- mappings field in episodes response (anilistId, malId, kitsuId)
- Docker support (Dockerfile + .dockerignore)
- Premium landing page with try-it buttons (Walter-style)
- Health endpoint with providers list and endpoint count
- 16 API endpoints powered by AniList GraphQL
- Miruro pipe integration for streaming sources
- 12 streaming providers (kiwi, pewe, bee, bonk, etc.)
- M3U8 streaming URLs with subtitles and skip timestamps
- In-memory caching with TTL
- CORS support and health endpoint
Shinei Nouzen