- Added GET /api/embed/:anilistId/:episode — embed URLs for all providers
- Added GET /api/embed/:anilistId/:episode/:provider — specific provider embed
- Added GET /api/embed-providers — list all available embed providers
- Embed providers return iframe-ready URLs, no scraping required
- Supports sub/dub language selection and optional malId param
- Updated OpenAPI spec with new embed endpoints
- Updated health/stats to show 49 endpoints and embed providers
- Added embed provider tests to test.js
Cloudflare-protected pipe endpoints now have working alternatives:
use /api/embed to get direct video URLs from megavid.buzz and anixo.buzz
- README.md: streaming status section restored to original
- README.md: Worker deployment marked as experimental, untested
- CHANGELOG.md: edge-to-edge bypass marked as theoretical/untested
- Honest about what's verified vs unverified
pipe.js now tries 3 methods in order with automatic fallback:
1. Direct — mirror rotation (.ru → .to → .bz → .tv) with browser headers
2. ScraperAPI — free proxy (1K req/mo, no CC required)
3. FlareSolverr — self-hosted browser proxy (solves Cloudflare Turnstile)
When one method fails (403/timeout), the next is tried automatically.
Zero-config: works without any env vars. Add SCRAPER_API_KEY or
FLARESOLVERR_URL for Cloudflare bypass.
New endpoint: /api/pipe-health — tests all configured methods,
reports latency and working/failed status, recommends preferred method.
Files changed:
- src/helpers/pipe.js — methodDirect(), methodScraperAPI(), methodFlareSolverr(), pipeHealthCheck()
- src/routes/apiRoutes.js — added /api/pipe-health endpoint
- .env.example — documented SCRAPER_API_KEY, FLARESOLVERR_URL
Version bumped to 2.3.0 across package.json, server.js, /api/health,
/api/openapi, public/openapi.json. CHANGELOG updated.
The streaming endpoints (/episodes, /sources, /stream, /watch, /download)
returned 500 because the upstream Miruro pipe changed and www.miruro.tv is
now hard-blocked by Cloudflare.
Reverse-engineered the current Miruro frontend contract:
- Request is plain base64url of the JSON payload (no XOR).
- Response obfuscation is now signalled by the x-obfuscated header:
absent = plain JSON, 1 = base64+gzip, 2 = base64+XOR(PIPE_OBF_KEY)+gzip.
pipe.js now:
- rotates across mirrors (miruro.ru > .to > .bz > .tv), one per retry;
- decodes based on the x-obfuscated header instead of always XOR+gunzip;
- sends full browser sec-fetch/sec-ch-ua headers to pass Cloudflare checks;
- raises maxRetries to 4 and rotates on 403/444.
proxy.js default referer/Origin -> https://www.miruro.to (miruro.tv is dead).
AniList-backed endpoints were already healthy and are unaffected.
Version bumped to 2.2.0 across package.json, server.js, /api/health,
/api/openapi, public/openapi.json. CHANGELOG updated.
- Move XOR keys to env vars (PRU_PROXY_KEY, PIPE_OBF_KEY)
- Fix multi-search to combine query + filters
- Fix deepTranslate to return clone instead of mutating
- Improve getBestStream quality matching and fallback
- Add input sanitization for all route params
- CORS blocks unknown origins in production
- Security headers in vercel.json at CDN level
- stats/genre uses Promise.allSettled for parallel execution
- Delete dead server.py, fix version strings
- Character: removed dateOfDeath (not in AniList schema), changed role→characterRole
- Staff: removed dateOfDeath, removed invalid role field from staffMedia edges
- Fixes 400 errors on /api/character/:id and /api/staff/:id
- Handle raw pipe IDs (animedao:witch-hat-atelier:1) with colon separator
- Handle slugged IDs (watch/bonk/147105/sub/animedao-1) with slash separator
- Use rawPipeId for decoded ID recovery in both cases
- Match slug against last segment of ep.id (after injectSourceSlugs)
- Use rawPipeId + translateId to recover original decoded ID
- Fixes 'Episode slug not found' error for all providers
- decodePipeResponse now XOR-decodes with obfuscation key before gzip
- Updated pipe version to 0.2.0 to match miruro.tv
- Added /api/proxy endpoint for CORS-safe M3U8/VTT streaming
- Proxied stream/subtitle URLs through /api/proxy for browser playback
- M3U8 content rewritten to proxy variant playlists and segments
Shinei Nouzen