import { connect } from 'cloudflare:sockets';

const DEFAULT_UUID = 'd3b07384-d113-424a-a726-a667d6489318';

// ── VLESS WebSocket Proxy Engine ──────────────────────────────────────────

function stringifyUUID(buf, offset = 0) {
  const bytes = Array.from(new Uint8Array(buf, offset, 16));
  const hex = bytes.map(b => b.toString(16).padStart(2, '0')).join('');
  return `${hex.substring(0, 8)}-${hex.substring(8, 12)}-${hex.substring(12, 16)}-${hex.substring(16, 20)}-${hex.substring(20, 32)}`;
}

function parseVlessHeader(buffer, userID) {
  if (buffer.byteLength < 24) {
    return { hasError: true, message: 'Header too short' };
  }
  const view = new DataView(buffer);
  const version = view.getUint8(0);
  const clientUUID = stringifyUUID(buffer, 1);
  
  const expectedUUID = (userID || DEFAULT_UUID).toLowerCase();
  if (clientUUID.toLowerCase() !== expectedUUID) {
    return { hasError: true, message: `Invalid UUID: ${clientUUID}` };
  }

  const addonLen = view.getUint8(17);
  let offset = 18 + addonLen;

  const command = view.getUint8(offset); // 1 = TCP, 2 = UDP
  offset += 1;

  const port = view.getUint16(offset, false);
  offset += 2;

  const addrType = view.getUint8(offset);
  offset += 1;

  let address = '';
  if (addrType === 1) { // IPv4
    address = Array.from(new Uint8Array(buffer, offset, 4)).join('.');
    offset += 4;
  } else if (addrType === 2) { // Domain Name
    const domainLen = view.getUint8(offset);
    offset += 1;
    const domainBytes = new Uint8Array(buffer, offset, domainLen);
    address = new TextDecoder().decode(domainBytes);
    offset += domainLen;
  } else if (addrType === 3) { // IPv6
    const ipv6 = [];
    for (let i = 0; i < 8; i++) {
      ipv6.push(view.getUint16(offset + i * 2, false).toString(16));
    }
    address = ipv6.join(':');
    offset += 16;
  } else {
    return { hasError: true, message: `Unsupported address type: ${addrType}` };
  }

  const rawData = buffer.slice(offset);

  return {
    hasError: false,
    version,
    clientUUID,
    command,
    port,
    address,
    rawData
  };
}

function getProxyIpList(env) {
  const list = [];
  if (env && env.PROXYIP) {
    list.push(...env.PROXYIP.split(',').map(s => s.trim()).filter(Boolean));
  }
  list.push(
    'proxyip.hk.fxxk.dedyn.io',
    'proxyip.oracle.fxxk.dedyn.io',
    'proxyip.aliyun.fxxk.dedyn.io',
    'proxyip.fxxk.dedyn.io',
    'proxyip.jp.fxxk.dedyn.io',
    'proxyip.us.fxxk.dedyn.io',
    'proxyip.digitalocean.fxxk.dedyn.io',
    'proxyip.fhs.tw',
    'proxyip.aliyun.fhs.tw'
  );
  return Array.from(new Set(list));
}

async function connectToTarget(addressRemote, portRemote, initialData, env, webSocket, wrapper) {
  const proxyIps = getProxyIpList(env);
  const targetsToTry = [addressRemote, ...proxyIps];
  let currentTargetIdx = 0;

  // Save any payload bundled with the initial VLESS frame into our handshake buffer
  if (initialData && initialData.byteLength > 0) {
    wrapper.buffer.push(new Uint8Array(initialData));
  }

  async function tryConnect() {
    if (currentTargetIdx >= targetsToTry.length) {
      try { webSocket.close(1011, 'All connection candidates failed'); } catch (_) {}
      return;
    }

    const targetHost = targetsToTry[currentTargetIdx];
    currentTargetIdx++;

    let tcpSocket = null;
    try {
      tcpSocket = connect({ hostname: targetHost, port: portRemote });
      wrapper.testingSocket = tcpSocket;

      const writer = tcpSocket.writable.getWriter();
      
      // RE-PLAY all buffered handshake chunks (e.g. initialData + TLS ClientHello) to the new candidate
      for (const chunk of wrapper.buffer) {
        if (chunk && chunk.byteLength > 0) {
          await writer.write(chunk);
        }
      }
      writer.releaseLock();

      let hasReceivedData = false;
      try {
        const reader = tcpSocket.readable.getReader();
        while (true) {
          const { value, done } = await reader.read();
          if (done) break;
          if (value && value.byteLength > 0) {
            if (!hasReceivedData) {
              hasReceivedData = true;
              wrapper.isConnected = true;
              wrapper.value = tcpSocket; // Confirm socket as active and working
              wrapper.buffer = [];       // Clear the handshake buffer
            }
            if (webSocket.readyState === 1) {
              webSocket.send(value);
            }
          }
        }
      } catch (err) {
        // Socket readable stream error or disconnection
      }

      // If candidate closed/errored without returning ANY bytes (e.g. direct Cloudflare CDN rejection), fallback instantly
      if (!hasReceivedData) {
        try { tcpSocket.close(); } catch (_) {}
        if (wrapper.testingSocket === tcpSocket) wrapper.testingSocket = null;
        if (currentTargetIdx < targetsToTry.length) {
          await tryConnect();
        } else {
          try { webSocket.close(1011, 'Connection closed without response from any candidate'); } catch (_) {}
        }
      } else {
        try { webSocket.close(); } catch (_) {}
      }
    } catch (err) {
      if (tcpSocket) {
        try { tcpSocket.close(); } catch (_) {}
      }
      if (wrapper.testingSocket === tcpSocket) wrapper.testingSocket = null;
      if (currentTargetIdx < targetsToTry.length) {
        await tryConnect();
      } else {
        try { webSocket.close(1011, err.message); } catch (_) {}
      }
    }
  }

  await tryConnect();
}

function base64ToArrayBuffer(base64Str) {
  if (!base64Str) return null;
  try {
    const cleanStr = base64Str.replace(/-/g, '+').replace(/_/g, '/');
    const binary = atob(cleanStr);
    const bytes = new Uint8Array(binary.length);
    for (let i = 0; i < binary.length; i++) {
      bytes[i] = binary.charCodeAt(i);
    }
    return bytes.buffer;
  } catch (e) {
    return null;
  }
}

function makeReadableWebSocketStream(webSocket, earlyDataHeader) {
  return new ReadableStream({
    start(controller) {
      if (earlyDataHeader) {
        const earlyData = base64ToArrayBuffer(earlyDataHeader);
        if (earlyData && earlyData.byteLength > 0) {
          controller.enqueue(earlyData);
        }
      }
      webSocket.addEventListener('message', (event) => {
        const data = event.data;
        if (typeof data === 'string') return;
        const buffer = data instanceof ArrayBuffer ? data : data.buffer;
        controller.enqueue(buffer);
      });
      webSocket.addEventListener('close', () => {
        try { controller.close(); } catch (_) {}
      });
      webSocket.addEventListener('error', () => {
        try { controller.error(); } catch (_) {}
      });
    }
  });
}

async function handleDnsPacket(rawData, webSocket) {
  try {
    if (!rawData || rawData.byteLength < 2) return;
    const view = new DataView(rawData instanceof ArrayBuffer ? rawData : rawData.buffer);
    let dnsQuery = rawData;
    const len = view.getUint16(0, false);
    if (len + 2 <= rawData.byteLength) {
      dnsQuery = rawData.slice(2, 2 + len);
    }
    const dohRes = await fetch('https://1.1.1.1/dns-query', {
      method: 'POST',
      headers: {
        'content-type': 'application/dns-message',
        'accept': 'application/dns-message'
      },
      body: dnsQuery
    });
    if (dohRes.ok) {
      const dnsResponse = await dohRes.arrayBuffer();
      const respLen = dnsResponse.byteLength;
      const frame = new Uint8Array(2 + respLen);
      frame[0] = (respLen >> 8) & 0xff;
      frame[1] = respLen & 0xff;
      frame.set(new Uint8Array(dnsResponse), 2);
      if (webSocket.readyState === 1) {
        webSocket.send(frame);
      }
    }
  } catch (e) {
    console.error('DNS DoH error:', e);
  }
}

async function handleVlessWebsocket(request, targetUUID, env) {
  const webSocketPair = new WebSocketPair();
  const [client, server] = Object.values(webSocketPair);
  server.accept();

  const earlyDataHeader = request.headers.get('sec-websocket-protocol') || '';
  const readableStream = makeReadableWebSocketStream(server, earlyDataHeader);

  const remoteSocketWrapper = {
    value: null,
    testingSocket: null,
    buffer: [],
    isConnected: false
  };
  let isVlessHeaderParsed = false;
  let isDnsMode = false;

  readableStream.pipeTo(new WritableStream({
    async write(chunk, controller) {
      if (isDnsMode) {
        await handleDnsPacket(chunk, server);
        return;
      }

      if (isVlessHeaderParsed) {
        const payload = new Uint8Array(chunk);
        if (remoteSocketWrapper.isConnected && remoteSocketWrapper.value) {
          // Connection confirmed! Write directly to active socket.
          try {
            const writer = remoteSocketWrapper.value.writable.getWriter();
            await writer.write(payload);
            writer.releaseLock();
          } catch (err) {
            console.error('Socket write error:', err);
          }
        } else {
          // Connection is still setting up / testing candidates!
          // Save chunk in buffer so it gets re-played on failover!
          remoteSocketWrapper.buffer.push(payload);
          if (remoteSocketWrapper.testingSocket) {
            try {
              const writer = remoteSocketWrapper.testingSocket.writable.getWriter();
              await writer.write(payload);
              writer.releaseLock();
            } catch (_) {}
          }
        }
        return;
      }

      if (!isVlessHeaderParsed) {
        isVlessHeaderParsed = true;
        const parsed = parseVlessHeader(chunk, targetUUID);
        if (parsed.hasError) {
          try { server.close(1008, parsed.message); } catch (_) {}
          return;
        }

        // Send VLESS Response Header
        server.send(new Uint8Array([parsed.version, 0]));

        // Command 2 is VLESS UDP; Port 53 is DNS
        if (parsed.command === 2 || (parsed.command === 1 && parsed.port === 53)) {
          isDnsMode = true;
          await handleDnsPacket(parsed.rawData, server);
          return;
        }

        // Command 1 is TCP Proxy
        if (parsed.command === 1) {
          connectToTarget(parsed.address, parsed.port, parsed.rawData, env, server, remoteSocketWrapper);
        } else {
          try { server.close(1003, 'Unsupported VLESS command'); } catch (_) {}
        }
      }
    },
    close() {
      if (remoteSocketWrapper.value) {
        try { remoteSocketWrapper.value.close(); } catch (_) {}
      }
      if (remoteSocketWrapper.testingSocket) {
        try { remoteSocketWrapper.testingSocket.close(); } catch (_) {}
      }
    },
    abort() {
      if (remoteSocketWrapper.value) {
        try { remoteSocketWrapper.value.close(); } catch (_) {}
      }
      if (remoteSocketWrapper.testingSocket) {
        try { remoteSocketWrapper.testingSocket.close(); } catch (_) {}
      }
    }
  })).catch((e) => {
    console.error('Stream pipe error:', e);
  });

  const responseHeaders = new Headers();
  if (earlyDataHeader) {
    responseHeaders.set('Sec-WebSocket-Protocol', earlyDataHeader);
  }

  return new Response(null, {
    status: 101,
    webSocket: client,
    headers: responseHeaders
  });
}

// ── gRPC VLESS Transport Engine (HTTP/2 Bidirectional Streaming) ──────────

function wrapGrpcFrame(payload) {
  const len = payload.byteLength;
  const frame = new Uint8Array(5 + len);
  frame[0] = 0; // Uncompressed
  frame[1] = (len >> 24) & 0xff;
  frame[2] = (len >> 16) & 0xff;
  frame[3] = (len >> 8) & 0xff;
  frame[4] = len & 0xff;
  frame.set(new Uint8Array(payload), 5);
  return frame;
}

function unwrapGrpcFrame(data) {
  if (!data || data.byteLength < 5) return data;
  const view = new DataView(data.buffer || data, data.byteOffset || 0, data.byteLength);
  const len = view.getUint32(1, false);
  if (data.byteLength >= 5 + len) {
    return new Uint8Array(data.buffer || data, (data.byteOffset || 0) + 5, len);
  }
  return data;
}

async function handleDnsPacketGrpc(rawData, grpcWriter) {
  try {
    if (!rawData || rawData.byteLength < 2) return;
    const view = new DataView(rawData instanceof ArrayBuffer ? rawData : rawData.buffer);
    let dnsQuery = rawData;
    const len = view.getUint16(0, false);
    if (len + 2 <= rawData.byteLength) {
      dnsQuery = rawData.slice(2, 2 + len);
    }
    const dohRes = await fetch('https://1.1.1.1/dns-query', {
      method: 'POST',
      headers: {
        'content-type': 'application/dns-message',
        'accept': 'application/dns-message'
      },
      body: dnsQuery
    });
    if (dohRes.ok) {
      const dnsResponse = await dohRes.arrayBuffer();
      const respLen = dnsResponse.byteLength;
      const frame = new Uint8Array(2 + respLen);
      frame[0] = (respLen >> 8) & 0xff;
      frame[1] = respLen & 0xff;
      frame.set(new Uint8Array(dnsResponse), 2);
      await grpcWriter.write(wrapGrpcFrame(frame));
    }
  } catch (e) {
    console.error('gRPC DNS error:', e);
  }
}

async function connectToTargetGrpc(addressRemote, portRemote, initialData, env, grpcWriter, wrapper) {
  const proxyIps = getProxyIpList(env);
  const targetsToTry = [addressRemote, ...proxyIps];
  let currentTargetIdx = 0;

  if (initialData && initialData.byteLength > 0) {
    wrapper.buffer.push(new Uint8Array(initialData));
  }

  async function tryConnect() {
    if (currentTargetIdx >= targetsToTry.length) return;

    const targetHost = targetsToTry[currentTargetIdx];
    currentTargetIdx++;

    let tcpSocket = null;
    try {
      tcpSocket = connect({ hostname: targetHost, port: portRemote });
      wrapper.testingSocket = tcpSocket;

      const writer = tcpSocket.writable.getWriter();
      for (const chunk of wrapper.buffer) {
        if (chunk && chunk.byteLength > 0) {
          await writer.write(chunk);
        }
      }
      writer.releaseLock();

      let hasReceivedData = false;
      try {
        const reader = tcpSocket.readable.getReader();
        while (true) {
          const { value, done } = await reader.read();
          if (done) break;
          if (value && value.byteLength > 0) {
            if (!hasReceivedData) {
              hasReceivedData = true;
              wrapper.isConnected = true;
              wrapper.value = tcpSocket;
              wrapper.buffer = [];
            }
            await grpcWriter.write(wrapGrpcFrame(value));
          }
        }
      } catch (err) {}

      if (!hasReceivedData) {
        try { tcpSocket.close(); } catch (_) {}
        if (wrapper.testingSocket === tcpSocket) wrapper.testingSocket = null;
        if (currentTargetIdx < targetsToTry.length) {
          await tryConnect();
        }
      } else {
        try { tcpSocket.close(); } catch (_) {}
      }
    } catch (err) {
      if (tcpSocket) try { tcpSocket.close(); } catch (_) {}
      if (wrapper.testingSocket === tcpSocket) wrapper.testingSocket = null;
      if (currentTargetIdx < targetsToTry.length) {
        await tryConnect();
      }
    }
  }

  await tryConnect();
}

async function handleVlessGrpc(request, targetUUID, env) {
  if (!request.body) {
    return new Response('gRPC body required', { status: 400 });
  }

  const { readable, writable } = new TransformStream();
  const grpcWriter = writable.getWriter();

  const remoteSocketWrapper = {
    value: null,
    testingSocket: null,
    buffer: [],
    isConnected: false
  };

  let isVlessHeaderParsed = false;
  let isDnsMode = false;

  const reader = request.body.getReader();

  (async () => {
    try {
      while (true) {
        const { value, done } = await reader.read();
        if (done) break;
        if (!value || value.byteLength === 0) continue;

        const payload = unwrapGrpcFrame(value);

        if (isDnsMode) {
          await handleDnsPacketGrpc(payload, grpcWriter);
          continue;
        }

        if (isVlessHeaderParsed) {
          if (remoteSocketWrapper.isConnected && remoteSocketWrapper.value) {
            try {
              const sockWriter = remoteSocketWrapper.value.writable.getWriter();
              await sockWriter.write(payload);
              sockWriter.releaseLock();
            } catch (e) {}
          } else {
            remoteSocketWrapper.buffer.push(payload);
            if (remoteSocketWrapper.testingSocket) {
              try {
                const sockWriter = remoteSocketWrapper.testingSocket.writable.getWriter();
                await sockWriter.write(payload);
                sockWriter.releaseLock();
              } catch (e) {}
            }
          }
          continue;
        }

        isVlessHeaderParsed = true;
        const parsed = parseVlessHeader(payload.buffer || payload, targetUUID);
        if (parsed.hasError) return;

        // Write VLESS Response Header in gRPC frame
        await grpcWriter.write(wrapGrpcFrame(new Uint8Array([parsed.version, 0])));

        if (parsed.command === 2 || (parsed.command === 1 && parsed.port === 53)) {
          isDnsMode = true;
          await handleDnsPacketGrpc(parsed.rawData, grpcWriter);
          continue;
        }

        if (parsed.command === 1) {
          connectToTargetGrpc(parsed.address, parsed.port, parsed.rawData, env, grpcWriter, remoteSocketWrapper);
        }
      }
    } catch (err) {
      console.error('gRPC stream error:', err);
    }
  })();

  return new Response(readable, {
    status: 200,
    headers: {
      'content-type': 'application/grpc',
      'grpc-status': '0',
      'grpc-message': ''
    }
  });
}

async function handleTestProxyIp(request, env) {
  const url = new URL(request.url);
  const targetDomain = url.searchParams.get('domain') || 'nachotoy.com';
  
  const candidates = [
    targetDomain,
    'icook.hk',
    'icook.tw',
    'cdn.anycast.eu.org',
    'www.visa.com',
    'www.wipac.wisc.edu',
    'csgowrite.com',
    'www.gov.se',
    'www.shufersal.co.il',
    'www.macadamias.org',
    '104.16.1.1',
    '104.17.147.22',
    '162.159.138.7',
    '188.114.96.1',
    '188.114.97.7'
  ];

  if (env && env.PROXYIP) {
    const fromEnv = env.PROXYIP.split(',').map(s => s.trim()).filter(Boolean);
    for (const ip of fromEnv) {
      if (!candidates.includes(ip)) candidates.push(ip);
    }
  }

  const results = [];

  for (const candidate of candidates) {
    const res = { candidate, status: 'testing', timeMs: 0, error: null, preview: '' };
    const start = Date.now();
    try {
      const socket = connect({ hostname: candidate, port: 80 });
      const writer = socket.writable.getWriter();
      const reqStr = `GET / HTTP/1.1\r\nHost: ${targetDomain}\r\nConnection: close\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)\r\n\r\n`;
      const encoded = new TextEncoder().encode(reqStr);
      await writer.write(encoded);
      writer.releaseLock();

      const reader = socket.readable.getReader();
      const readRes = await reader.read();
      res.timeMs = Date.now() - start;
      if (readRes.done || !readRes.value || readRes.value.byteLength === 0) {
        res.status = 'closed_no_data';
      } else {
        res.status = 'SUCCESS';
        const txt = new TextDecoder().decode(readRes.value);
        res.preview = txt.substring(0, 100).replace(/\r/g, '\\r').replace(/\n/g, '\\n');
      }
      try { socket.close(); } catch (_) {}
    } catch (e) {
      res.timeMs = Date.now() - start;
      res.status = 'ERROR';
      res.error = e.message;
    }
    results.push(res);
  }

  return new Response(JSON.stringify({ targetDomain, testedCount: results.length, results }, null, 2), {
    headers: { 'content-type': 'application/json; charset=utf-8' }
  });
}

function renderDashboard(request, env, uuid) {
  const url = new URL(request.url);
  const host = url.host;
  const vlessLink = `vless://${uuid}@${host}:443?encryption=none&security=tls&sni=${host}&fp=chrome&type=ws&host=${host}&path=%2F#Cloudflare-VLESS-Tunnel-WS`;

  const html = `<!DOCTYPE html>
<html lang="he" dir="rtl">
<head>
  <meta charset="UTF-8">
  <meta name="viewport" content="width=device-width, initial-scale=1.0">
  <title>שרת מנהור מוצפן VLESS - לוח בקרה</title>
  <link href="https://fonts.googleapis.com/css2?family=Heebo:wght@300;400;600;700;800&family=JetBrains+Mono:wght@400;600&display=swap" rel="stylesheet">
  <style>
    :root {
      --bg: #0b0f19;
      --card-bg: #151c2c;
      --accent: #3b82f6;
      --accent-glow: rgba(59, 130, 246, 0.35);
      --success: #10b981;
      --text: #f3f4f6;
      --text-muted: #9ca3af;
      --border: #232d42;
    }
    * { box-sizing: border-box; margin: 0; padding: 0; }
    body {
      font-family: 'Heebo', sans-serif;
      background: var(--bg);
      color: var(--text);
      min-height: 100vh;
      display: flex;
      justify-content: center;
      align-items: center;
      padding: 24px;
    }
    .container {
      max-width: 780px;
      width: 100%;
      background: var(--card-bg);
      border: 1px solid var(--border);
      border-radius: 20px;
      padding: 32px;
      box-shadow: 0 20px 40px rgba(0,0,0,0.5);
    }
    .header {
      display: flex;
      align-items: center;
      justify-content: space-between;
      border-bottom: 1px solid var(--border);
      padding-bottom: 20px;
      margin-bottom: 24px;
    }
    .title {
      font-size: 24px;
      font-weight: 800;
      background: linear-gradient(135deg, #60a5fa, #a78bfa);
      -webkit-background-clip: text;
      -webkit-text-fill-color: transparent;
    }
    .status-badge {
      display: inline-flex;
      align-items: center;
      gap: 8px;
      background: rgba(16, 185, 129, 0.12);
      border: 1px solid rgba(16, 185, 129, 0.3);
      color: var(--success);
      padding: 6px 14px;
      border-radius: 20px;
      font-size: 14px;
      font-weight: 600;
    }
    .pulse {
      width: 8px;
      height: 8px;
      background: var(--success);
      border-radius: 50%;
      box-shadow: 0 0 10px var(--success);
      animation: pulse 1.5s infinite;
    }
    @keyframes pulse { 0%, 100% { opacity: 1; } 50% { opacity: 0.4; } }
    .section-title {
      font-size: 16px;
      font-weight: 700;
      color: var(--text-muted);
      margin-bottom: 12px;
      text-transform: uppercase;
      letter-spacing: 0.5px;
    }
    .uri-box {
      background: #090d16;
      border: 1px solid var(--border);
      border-radius: 12px;
      padding: 14px 18px;
      font-family: 'JetBrains Mono', monospace;
      font-size: 13px;
      word-break: break-all;
      color: #93c5fd;
      margin-bottom: 16px;
      position: relative;
    }
    .btn {
      background: linear-gradient(135deg, #2563eb, #3b82f6);
      color: white;
      border: none;
      padding: 12px 24px;
      border-radius: 10px;
      font-size: 15px;
      font-weight: 700;
      cursor: pointer;
      display: inline-flex;
      align-items: center;
      gap: 8px;
      transition: all 0.2s ease;
      box-shadow: 0 4px 14px var(--accent-glow);
    }
    .btn:hover { transform: translateY(-2px); filter: brightness(1.1); }
    .grid {
      display: grid;
      grid-template-columns: 1fr 220px;
      gap: 24px;
      margin-top: 24px;
    }
    @media (max-width: 640px) { .grid { grid-template-columns: 1fr; } }
    .qr-card {
      background: white;
      padding: 16px;
      border-radius: 14px;
      display: flex;
      flex-direction: column;
      align-items: center;
      justify-content: center;
    }
    .qr-card img { width: 100%; height: auto; border-radius: 8px; }
    .qr-label {
      margin-top: 10px;
      font-size: 13px;
      color: #333;
      font-weight: 600;
    }
    .guide-box {
      background: #0d1322;
      border: 1px solid var(--border);
      border-radius: 14px;
      padding: 20px;
      margin-top: 24px;
    }
    .guide-box h4 { margin-bottom: 12px; font-size: 16px; color: #60a5fa; }
    .guide-list { list-style: none; padding-right: 0; }
    .guide-list li {
      margin-bottom: 10px;
      line-height: 1.6;
      font-size: 14px;
      display: flex;
      align-items: flex-start;
      gap: 10px;
    }
    .icon { font-size: 18px; }
    .code {
      background: #1e293b;
      padding: 2px 6px;
      border-radius: 4px;
      font-family: monospace;
      color: #cbd5e1;
    }
  </style>
</head>
<body>
  <div class="container">
    <div class="header">
      <div>
        <div class="title">מנהור מוצפן VLESS Proxy</div>
        <div style="font-size: 13px; color: var(--text-muted); margin-top: 4px;">Cloudflare Worker Server</div>
      </div>
      <div class="status-badge">
        <span class="pulse"></span>
        שרת מנהור פעיל
      </div>
    </div>

    <div class="grid">
      <div>
        <div class="section-title">קישור חיבור מהיר (VLESS URI)</div>
        <div class="uri-box" id="vlessUri">${vlessLink}</div>
        <button class="btn" onclick="copyLink()">
          📋 העתק קישור VLESS ללוח
        </button>

        <div style="margin-top: 24px;">
          <div class="section-title">פרטי שרת חיבור</div>
          <div style="font-size: 14px; line-height: 2;">
            <div><strong>כתובת השרת (Host / SNI):</strong> <span class="code">${host}</span></div>
            <div><strong>פורט (Port):</strong> <span class="code">443 (TLS)</span></div>
            <div><strong>פרוטוקול:</strong> <span class="code">VLESS + WebSocket</span></div>
            <div><strong>מזהה UUID:</strong> <span class="code">${uuid}</span></div>
          </div>
        </div>
      </div>

      <div class="qr-card">
        <div id="qrcode" style="display:flex;justify-content:center;align-items:center;min-height:180px;min-width:180px;"></div>
        <div class="qr-label">סריקה מהירה באפליקציה</div>
      </div>
    </div>

    <div class="guide-box">
      <h4>🚀 הוראות חיבור בתוכנות פרוקסי</h4>
      <ul class="guide-list">
        <li>
          <span class="icon">💻</span>
          <div><strong>v2rayN / Xray (Windows):</strong> העתק את הקישור שלמעלה, פתח את v2rayN ולחץ על <span class="code">Ctrl + V</span> (או לחצן ימני -> Import from clipboard). באפליקציה בחר בשרת ולחץ על <span class="code">Enter</span> לחיבור.</div>
        </li>
        <li>
          <span class="icon">📱</span>
          <div><strong>Nekobox / Sing-box (Android / Windows):</strong> לחץ על כפתור פלוס <span class="code">+</span> -> <span class="code">Import from Clipboard</span>.</div>
        </li>
        <li>
          <span class="icon">🍎</span>
          <div><strong>Shadowrocket / Streisand (iOS / Mac):</strong> פתח את האפליקציה, לחץ על סורק ה-QR בפינה וסרוק את קוד ה-QR המופיע במסך.</div>
        </li>
        <li>
          <span class="icon">🛡️</span>
          <div><strong>במקרה של צנזורה חמורה (Clean IP):</strong> בתוכנת הפרוקסי, ניתן לשנות את ה-Address לכתובת IP נקייה של Cloudflare (Clean IP) תוך שמירה על ה-Host / SNI כ-<span class="code">${host}</span>.</div>
        </li>
      </ul>
    </div>
  </div>

  <script src="https://cdnjs.cloudflare.com/ajax/libs/qrcodejs/1.0.0/qrcode.min.js"></script>
  <script>
    function copyLink() {
      const text = document.getElementById('vlessUri').innerText;
      navigator.clipboard.writeText(text).then(() => {
        alert('קישור VLESS הועתק בהצלחה ללוח! תוכל להדביק אותו בתוכנת הפרוקסי.');
      }).catch(err => {
        prompt('העתק את הקישור ידנית:', text);
      });
    }

    (function renderQR() {
      const container = document.getElementById('qrcode');
      const vlessText = document.getElementById('vlessUri').innerText.trim();
      
      try {
        if (typeof QRCode !== 'undefined') {
          new QRCode(container, {
            text: vlessText,
            width: 180,
            height: 180,
            colorDark : "#000000",
            colorLight : "#ffffff",
            correctLevel : QRCode.CorrectLevel.M
          });
          return;
        }
      } catch (e) {
        console.log('QRCode JS fallback...');
      }

      const img = document.createElement('img');
      img.src = 'https://quickchart.io/qr?size=200&text=' + encodeURIComponent(vlessText);
      img.alt = 'VLESS QR Code';
      img.style.width = '180px';
      img.style.height = '180px';
      img.style.borderRadius = '8px';
      
      img.onerror = function() {
        this.src = 'https://api.qrserver.com/v1/create-qr-code/?size=200x200&data=' + encodeURIComponent(vlessText);
      };
      
      container.appendChild(img);
    })();
  </script>
</body>
</html>`;

  return new Response(html, {
    headers: { 'content-type': 'text/html; charset=utf-8' }
  });
}

function renderPrivacyPolicy(request) {
  const html = `<!DOCTYPE html>
<html lang="he" dir="rtl">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>מדיניות פרטיות - SmartBlock PRO</title>
    <style>
        :root {
            --primary-color: #1a73e8;
            --primary-dark: #1557b0;
            --secondary-color: #f8f9fa;
            --text-color: #202124;
            --text-secondary: #5f6368;
            --border-color: #e0e0e0;
            --accent-green: #34a853;
            --card-shadow: 0 4px 12px rgba(0,0,0,0.08);
        }
        * { box-sizing: border-box; margin: 0; padding: 0; }
        body { font-family: system-ui, -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; background-color: #f4f6f9; color: var(--text-color); line-height: 1.6; padding: 40px 20px; }
        .container { max-width: 800px; margin: 0 auto; background: #ffffff; border-radius: 12px; box-shadow: var(--card-shadow); overflow: hidden; border: 1px solid var(--border-color); }
        .header { background: linear-gradient(135deg, #1a73e8, #0d47a1); color: white; padding: 40px 30px; text-align: center; }
        .header h1 { font-size: 28px; font-weight: 700; margin-bottom: 10px; }
        .header p { font-size: 16px; opacity: 0.9; }
        .content { padding: 30px; }
        .section { margin-bottom: 30px; }
        .section h2 { font-size: 20px; color: var(--primary-color); margin-bottom: 12px; border-bottom: 2px solid var(--secondary-color); padding-bottom: 6px; }
        .section ul { list-style: none; padding-right: 0; }
        .section ul li { position: relative; padding-right: 24px; margin-bottom: 10px; }
        .section ul li::before { content: "✓"; position: absolute; right: 0; color: var(--accent-green); font-weight: bold; }
        .highlight-box { background-color: #e8f0fe; border-right: 4px solid var(--primary-color); padding: 16px; border-radius: 6px; margin: 20px 0; }
        .highlight-box h3 { font-size: 16px; color: var(--primary-dark); margin-bottom: 6px; }
        .site-list { display: grid; grid-template-columns: repeat(auto-fit, minmax(180px, 1fr)); gap: 12px; margin-top: 12px; }
        .site-card { background: var(--secondary-color); border: 1px solid var(--border-color); padding: 12px; border-radius: 8px; font-weight: 600; text-align: center; }
        .cta-container { text-align: center; margin-top: 30px; padding-top: 20px; border-top: 1px solid var(--border-color); }
        .btn-install { display: inline-block; background-color: var(--primary-color); color: white; text-decoration: none; padding: 14px 28px; font-size: 16px; font-weight: bold; border-radius: 30px; box-shadow: 0 4px 8px rgba(26, 115, 232, 0.3); }
        .footer { background-color: var(--secondary-color); text-align: center; padding: 15px; font-size: 13px; color: var(--text-secondary); border-top: 1px solid var(--border-color); }
    </style>
</head>
<body>
<div class="container">
    <div class="header">
        <h1>מדיניות פרטיות – SmartBlock PRO</h1>
        <p>שקופות, אבטחה ופרטיות מוחלטת בשימוש בתוסף</p>
    </div>
    <div class="content">
        <div class="section">
            <h2>אודות התוסף ומטרתו</h2>
            <p><strong>SmartBlock PRO</strong> הינו תוסף המיועד לחסימת פרסומות מתקדמת באתרי חדשות ותוכן. התוסף כולל ממשק שליטה נוח ומאפשר חוויית גלישה נקייה, מהירה וחלקה ללא הטרדות חזותיות.</p>
        </div>
        <div class="highlight-box">
            <h3>התחייבות לפרטיות ולאיסוף נתונים</h3>
            <p>התוסף מיועד <strong>לחסימת פרסומות בלבד</strong>. התוסף <strong>אינו אוסף, אינו שומר ואינו משתף</strong> כל מזהה IP, היסטוריית גלישה או מידע אישי מכל סוג שהוא.</p>
        </div>
        <div class="section">
            <h2>הרשאות נדרשות וסיבת השימוש בהן</h2>
            <p>על מנת לבצע את תפקידו, התוסף נזקק להרשאות גישה לתוכן האתרים (Content Scripts):</p>
            <ul>
                <li><strong>גישה לתוכן הדף:</strong> נדרשת אך ורק כדי לזהות ולהסיר אלמנטים של פרסומות בזמן אמת.</li>
                <li><strong>חסימת בקשות רשת:</strong> נדרשת לעצירת טעינת פרסומות ווידאו לפני הצגתם.</li>
            </ul>
        </div>
        <div class="section">
            <h2>אתרים נתמכים ויכולות החסימה</h2>
            <p>התוסף מותאם וממקסם את החסימה באתרים הבאים:</p>
            <div class="site-list">
                <div class="site-card">כל רגע</div>
                <div class="site-card">MS - אמס</div>
                <div class="site-card">קול חי</div>
                <div class="site-card">JDN</div>
                <div class="site-card">פרוג</div>
                <div class="site-card">מוביט (Moovit)</div>
            </div>
            <div style="margin-top: 15px;">
                <p><strong>פירוט החסימה:</strong></p>
                <ul>
                    <li><strong>באתר פרוג:</strong> חסימת כל הפרסומות הקופצות (Pop-ups), פרסומות עליונות, תחתונות וצידיות, וכן הסרת הודעות מ"פרוגבוט".</li>
                    <li><strong>באתרים כל רגע, אמס, JDN וקול חי:</strong> חסימה מלאה של כלל הפרסומות באתר, כולל פרסומות ווידאו לפני צפייה.</li>
                </ul>
            </div>
        </div>
        <div class="cta-container">
            <a href="https://chromewebstore.google.com/detail/smartblock-pro/ncljggploahhaifgkemmehcbhbjojljl" class="btn-install" target="_blank">להתקנת התוסף בחנות Chrome</a>
        </div>
    </div>
    <div class="footer">
        SmartBlock PRO &copy; כל הזכויות שמורות
    </div>
</div>
</body>
</html>`;

  return new Response(html, {
    headers: { 'content-type': 'text/html; charset=utf-8' }
  });
}

// ── End VLESS Engine ──────────────────────────────────────────────────────

// ============================================================================
// Ma'akaf (׳ž׳¢׳§׳£) ג€” Censorship-Resistant Web Proxy ֲ· Cloudflare Worker
// Single-file architecture with XOR obfuscation, Service Worker, HTMLRewriter
// ============================================================================

// ג”€ג”€ג”€ Section 1: Constants & Core Crypto ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€

const PROXY_PATH = '/cdn/';
const KEY = [97, 110, 116, 105, 103, 114, 97, 118, 105, 116, 121]; // "antigravity"
const SW_VERSION = 111;

// ── Access gate (password) ──────────────────────────────────────────────────
// The password and signing secret are read from env first (Cloudflare secrets) so the
// owner can change them WITHOUT editing code, and rotate GATE_SECRET to instantly
// invalidate every issued session. The literals below are only zero-config fallbacks.
const GATE_PASSWORD_DEFAULT = 'מוישי';       // override with secret: GATE_PASSWORD
const GATE_COOKIE = '__proxy_gate';
const GATE_SECRET_DEFAULT = 'etrog-gate-v1-antigravity'; // override with secret: GATE_SECRET
const GATE_TTL_MS = 30 * 24 * 60 * 60 * 1000; // signed sessions expire after 30 days
// Built-in YouTube cookie slot. Leave EMPTY: fresh auth comes from the Home Relay
// (Firefox session) via YT_RELAY_URL. Do NOT paste a personal Google session here.
const BUILTIN_YOUTUBE_COOKIE = "SAPISID=UL6Vh_S22fpeIdM8/AD6Qb4wlcTslni3Dk; __Secure-3PAPISID=UL6Vh_S22fpeIdM8/AD6Qb4wlcTslni3Dk; VISITOR_INFO1_LIVE=CdhV9Fm2uW0; CONSENT=YES+cb.20210328-17-p0.en+FX+667";

// ── Home Relay Helpers ───────────────────────────────────────────────────────
function relayConfigured(env) {
  return !!(env && env.YT_RELAY_URL && env.YT_RELAY_SECRET);
}
function relayBase(env) {
  // Strip a leading BOM / zero-width / whitespace: PowerShell piping the tunnel URL
  // into `wrangler secret put` can prepend U+FEFF, which makes new URL() throw
  // "Invalid URL" and silently kills every relay call.
  return String(env.YT_RELAY_URL || '')
    .replace(/[​  ]/g, '')
    .trim()
    .replace(/\/+$/, '');
}
// Same BOM/whitespace hazard as relayBase: a stray U+FEFF in the secret makes the
// Bearer <secret> header mismatch the relay RELAY_SECRET -> every call gets 401.
function relaySecret(env) {
  return String((env && env.YT_RELAY_SECRET) || '').replace(/[​  ]/g, '').trim();
}
async function relayPlayer(env, videoId, cookie, workerOrigin = null) {
  let r, j, relayErr = null;
  try {
    r = await fetch(relayBase(env) + '/v1/yt/player', {
      method: 'POST',
      headers: {
        authorization: 'Bearer ' + relaySecret(env),
        'content-type': 'application/json',
        'Bypass-Tunnel-Reminder': 'true',
        // Intentionally NOT sending X-Worker-Url: it makes the relay call back to
        // the Worker's /api/resolve-helper (Cloudflare IP) for every client, which
        // re-triggers the exact LOGIN_REQUIRED block the relay exists to avoid — and
        // the round-trip loop times the tunnel out into a 502. The relay must resolve
        // directly from its own residential IP.
      },
      body: JSON.stringify({ videoId, cookie: cookie || '' }),
      signal: AbortSignal.timeout(20000),
    });
    j = await r.json().catch((e) => { relayErr = 'json-parse:' + e.message; return null; });
  } catch (e) {
    return { ok: false, playability: null, attemptsLog: [], source: 'home-relay', relayErr: 'fetch-fail:' + e.message };
  }
  if (!j || !j.ok || !j.formats || !j.formats.length) {
    return { ok: false, playability: j?.playability, attemptsLog: j?.attempts || [], source: 'home-relay', relayErr: relayErr || ('relay-http:' + (r?.status || '?')) };
  }
  return {
    ok: true,
    formats: j.formats.map((f) => ({
      itag: f.itag,
      url: f.url,
      mime: (f.mimeType || '').split(';')[0],
      mimeType: f.mimeType || '', // full type WITH codecs — required for MSE addSourceBuffer
      progressive: !!f.progressive,
      hasAudio: !!f.hasAudio,
      hasVideo: !!f.hasVideo,
      bitrate: f.bitrate || 0,
      width: f.width || 0,
      height: f.height || 0,
    })),
    playability: j.playability,
    client: j.client,
    hasCookies: !!cookie,
    hasAuth: !!cookie,
    attemptsLog: j.attempts || [],
    via: 'home-relay',
  };
}

async function relayFetch(env, targetUrl, init = {}) {
  const u = new URL(relayBase(env) + '/v1/fetch');
  u.searchParams.set('url', targetUrl);
  const headers = {
    authorization: 'Bearer ' + relaySecret(env),
    'Bypass-Tunnel-Reminder': 'true',
  };
  if (init.range) headers.range = init.range;
  if (init.userAgent) headers['x-upstream-ua'] = init.userAgent;
  return fetch(u.toString(), { headers, signal: init.signal });
}

// Audio download as real MP3. YouTube never serves MP3 and this Worker can't transcode, so
// the job is delegated to the Home Relay (residential IP + the user's local ffmpeg): it pulls
// the full audio track and streams back audio/mpeg. We just pipe that body to the browser.
async function handleAudioMp3(request, url, env) {
  if (!relayConfigured(env)) {
    return new Response(
      JSON.stringify({
        error: 'relay_not_configured',
        hint: 'הורדת MP3 דורשת את ה-Home Relay (ffmpeg מקומי). הפעילו start-relay.ps1 והגדירו YT_RELAY_URL / YT_RELAY_SECRET.',
      }),
      { status: 502, headers: { 'content-type': 'application/json', 'cache-control': 'no-store' } }
    );
  }
  const v = String(url.searchParams.get('v') || '').replace(/[^\w-]/g, '');
  if (!v) {
    return new Response(JSON.stringify({ error: 'missing v' }),
      { status: 400, headers: { 'content-type': 'application/json' } });
  }
  const name = url.searchParams.get('name') || '';
  const relayUrl = new URL(relayBase(env) + '/v1/yt/audio-mp3');
  relayUrl.searchParams.set('v', v);
  if (name) relayUrl.searchParams.set('name', name);

  let r;
  try {
    r = await fetch(relayUrl.toString(), {
      headers: { authorization: 'Bearer ' + relaySecret(env), 'Bypass-Tunnel-Reminder': 'true' },
      // Download + transcode of a full track can take a while; give it generous headroom.
      signal: AbortSignal.timeout(180000),
    });
  } catch (e) {
    return new Response(
      JSON.stringify({ error: 'relay_fetch_failed', detail: String((e && e.message) || e) }),
      { status: 502, headers: { 'content-type': 'application/json', 'cache-control': 'no-store' } }
    );
  }

  const h = new Headers();
  applyCorsHeaders(h, request);
  const ct = r.headers.get('content-type') || 'audio/mpeg';
  h.set('content-type', ct);
  h.set('cache-control', 'no-store');
  h.set('X-Etrog-Mode', 'stream-unsealed');
  const cd = r.headers.get('content-disposition');
  if (cd) h.set('content-disposition', cd);
  h.set('Access-Control-Expose-Headers',
    'Content-Type, Content-Disposition, X-Etrog-Mode');
  return new Response(r.body, { status: r.status, headers: h });
}

function cleanSecret(s) {
  // Strip invisible copy/paste artifacts (BOM, zero-width, nbsp) and trim edges, but keep
  // internal spaces so a passphrase-style GATE_PASSWORD survives intact.
  return String(s || '').replace(/[​‌‍ ]/g, '').trim();
}
function gatePassword(env) {
  const fromEnv = cleanSecret(env && env.GATE_PASSWORD);
  return fromEnv || GATE_PASSWORD_DEFAULT;
}
function gateSecret(env) {
  const fromEnv = cleanSecret(env && env.GATE_SECRET);
  return fromEnv || GATE_SECRET_DEFAULT;
}

async function gateHmac(secret, message) {
  const key = await crypto.subtle.importKey(
    'raw',
    new TextEncoder().encode(secret),
    { name: 'HMAC', hash: 'SHA-256' },
    false,
    ['sign']
  );
  const sig = await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(message));
  const bytes = new Uint8Array(sig);
  let b64 = '';
  for (let i = 0; i < bytes.length; i++) b64 += String.fromCharCode(bytes[i]);
  return btoa(b64).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/g, '');
}

// Constant-time compare of two ASCII/base64url strings (avoids token-timing leak).
function timingSafeEqualStr(a, b) {
  a = String(a || ''); b = String(b || '');
  if (a.length !== b.length) return false;
  let diff = 0;
  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
  return diff === 0;
}

// Session token format: `v2.<expMs>.<sig>` where sig = HMAC(gateSecret, password|expMs).
// Non-constant (varies with exp), expires after GATE_TTL_MS, and revocable by rotating
// GATE_SECRET — unlike the old fixed HMAC that was one permanent value for everyone.
async function mintGateToken(env) {
  const exp = Date.now() + GATE_TTL_MS;
  const sig = await gateHmac(gateSecret(env), gatePassword(env) + '|' + exp);
  return 'v2.' + exp + '.' + sig;
}
async function verifyGateToken(token, env) {
  const t = String(token || '');
  const parts = t.split('.');
  if (parts.length !== 3 || parts[0] !== 'v2') return false;
  const exp = parseInt(parts[1], 10);
  if (!Number.isFinite(exp) || exp < Date.now()) return false;
  const expect = await gateHmac(gateSecret(env), gatePassword(env) + '|' + exp);
  return timingSafeEqualStr(parts[2], expect);
}

function getCookieValue(cookieHeader, name) {
  if (!cookieHeader) return '';
  const parts = cookieHeader.split(';');
  for (const p of parts) {
    const eq = p.indexOf('=');
    if (eq === -1) continue;
    if (p.slice(0, eq).trim() === name) return p.slice(eq + 1).trim();
  }
  return '';
}

async function isGateOpen(request, env) {
  const auth = request.headers.get('authorization');
  if (auth && env && env.YT_RELAY_SECRET && auth === 'Bearer ' + relaySecret(env)) {
    return true;
  }
  const got = getCookieValue(request.headers.get('cookie') || '', GATE_COOKIE);
  if (!got) return false;
  return await verifyGateToken(got, env);
}

function gateLoginPage(opts = {}) {
  const err = opts.error
    ? '<div class="err">סיסמה שגויה. נסו שוב.</div>'
    : '';
  const next = String(opts.next || '/').replace(/[<>"']/g, '');
  const html = `<!DOCTYPE html>
<html lang="he" dir="rtl">
<head>
  <meta charset="utf-8"/>
  <meta name="viewport" content="width=device-width,initial-scale=1"/>
  <meta name="robots" content="noindex,nofollow"/>
  <title>כניסה · מעקף פרוקסי</title>
  <style>
    :root{--bg:#0b0f19;--card:rgba(255,255,255,.04);--border:rgba(255,255,255,.1);--text:#f1f5f9;--muted:#94a3b8;--primary:#6366f1;--danger:#f87171}
    *{box-sizing:border-box}
    body{margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;font-family:Assistant,Segoe UI,system-ui,sans-serif;background:radial-gradient(1200px 600px at 10% -10%,#312e81 0%,transparent 50%),radial-gradient(900px 500px at 100% 100%,#064e3b 0%,transparent 45%),var(--bg);color:var(--text);padding:1.25rem}
    .card{width:100%;max-width:400px;background:var(--card);border:1px solid var(--border);border-radius:16px;padding:1.75rem 1.5rem 1.5rem;backdrop-filter:blur(12px);box-shadow:0 20px 50px rgba(0,0,0,.35)}
    h1{margin:0 0 .35rem;font-size:1.35rem;font-weight:700}
    p{margin:0 0 1.25rem;color:var(--muted);font-size:.95rem;line-height:1.5}
    label{display:block;font-size:.85rem;color:var(--muted);margin-bottom:.4rem}
    input[type=password]{width:100%;padding:.75rem .9rem;border-radius:10px;border:1px solid var(--border);background:rgba(0,0,0,.25);color:var(--text);font-size:1rem;outline:none}
    input[type=password]:focus{border-color:var(--primary);box-shadow:0 0 0 3px rgba(99,102,241,.25)}
    button{width:100%;margin-top:1rem;padding:.8rem 1rem;border:0;border-radius:10px;background:var(--primary);color:#fff;font-weight:600;font-size:1rem;cursor:pointer}
    button:hover{filter:brightness(1.08)}
    .err{background:rgba(248,113,113,.12);color:var(--danger);border:1px solid rgba(248,113,113,.35);border-radius:10px;padding:.65rem .8rem;margin-bottom:1rem;font-size:.9rem}
    .hint{margin-top:1rem;font-size:.78rem;color:var(--muted);text-align:center}
  </style>
</head>
<body>
  <div class="card">
    <h1>🔒 כניסה </h1>
    <p>הזינו את הסיסמה כדי להמשיך. הגישה נשמרת עד סגירת הדפדפן.</p>
    ${err}
    <form method="POST" action="/__gate" autocomplete="current-password">
      <input type="hidden" name="next" value="${next}"/>
      <label for="pw">סיסמה</label>
      <input id="pw" name="password" type="password" required autofocus placeholder="••••••" autocomplete="current-password"/>
      <button type="submit">כניסה</button>
    </form>
    <div class="hint">     </div>
  </div>
  <script>try{document.getElementById('pw').focus();}catch(e){}</script>
</body>
</html>`;
  return new Response(html, {
    status: opts.error ? 401 : 200,
    headers: {
      'content-type': 'text/html; charset=utf-8',
      'cache-control': 'no-store',
      'x-frame-options': 'DENY',
    },
  });
}

async function handleGatePost(request, url, env) {
  let password = '';
  let next = '/';
  const ct = (request.headers.get('content-type') || '').toLowerCase();
  try {
    if (ct.includes('application/json')) {
      const j = await request.json();
      password = String(j.password || j.pass || '');
      next = String(j.next || '/');
    } else {
      const form = await request.formData();
      password = String(form.get('password') || form.get('pass') || '');
      next = String(form.get('next') || '/');
    }
  } catch {
    password = '';
  }
  // Only allow relative next paths on this host
  try {
    if (!next.startsWith('/') || next.startsWith('//')) next = '/';
  } catch {
    next = '/';
  }
  if (!timingSafeEqualStr(password, gatePassword(env))) {
    return gateLoginPage({ error: true, next });
  }
  const token = await mintGateToken(env);
  // Session cookie: no Max-Age / Expires → deleted when browser closes
  const cookie =
    GATE_COOKIE +
    '=' +
    token +
    '; Path=/; Secure; HttpOnly; SameSite=Lax';
  return new Response(null, {
    status: 302,
    headers: {
      location: next || '/',
      'set-cookie': cookie,
      'cache-control': 'no-store',
    },
  });
}

async function requireGate(request, url, env) {
  // Login endpoint always reachable
  if (url.pathname === '/__gate') {
    if (request.method === 'POST') return handleGatePost(request, url, env);
    return gateLoginPage({ next: url.searchParams.get('next') || '/' });
  }
  // Logout (optional)
  if (url.pathname === '/__logout') {
    return new Response(null, {
      status: 302,
      headers: {
        location: '/__gate',
        'set-cookie': GATE_COOKIE + '=; Path=/; Secure; HttpOnly; SameSite=Lax; Max-Age=0',
        'cache-control': 'no-store',
      },
    });
  }
  // Stealth media, thumbnails, and Service Worker are public so <video> and <img> tags load without 401 errors
  if (
    url.pathname === '/x/s' ||
    url.pathname.startsWith('/x/s/') ||
    url.pathname === '/x/t' ||
    url.pathname.startsWith('/x/t/') ||
    url.pathname === '/x/p' ||
    url.pathname.startsWith('/x/p/') ||
    url.pathname === '/x/i/player' ||
    url.pathname === '/x/test-innertube' ||
    url.pathname === '/sw.js' ||
    url.pathname === '/favicon.ico'
  ) {
    return null;
  }
  if (await isGateOpen(request, env)) return null; // allowed

  // API / media / XHR: 401 JSON so clients don't get HTML as media
  const dest = (request.headers.get('sec-fetch-dest') || '').toLowerCase();
  const accept = (request.headers.get('accept') || '').toLowerCase();
  const isNav =
    dest === 'document' ||
    request.headers.get('sec-fetch-mode') === 'navigate' ||
    accept.includes('text/html');
  // Sub-resource (script/style/image/font/…) with an expired session: degrade to an empty
  // valid asset instead of the login HTML / a JSON 401 (both break a script/style loader).
  if (!isNav && isAssetRequest(dest, url.pathname)) {
    return assetFallback(request, null);
  }
  const isApi =
    url.pathname.startsWith('/api/') ||
    url.pathname.startsWith('/cdn/') ||
    url.pathname.startsWith('/proxy/') ||
    url.pathname.startsWith('/x/') ||
    dest === 'video' ||
    dest === 'audio' ||
    dest === 'image' ||
    dest === 'empty' ||
    dest === 'font' ||
    request.headers.has('range');

  if (!isNav && isApi) {
    return new Response(JSON.stringify({ error: 'auth_required', login: '/__gate' }), {
      status: 401,
      headers: {
        'content-type': 'application/json; charset=utf-8',
        'cache-control': 'no-store',
        'www-authenticate': 'Session realm="proxy"',
      },
    });
  }

  const next = url.pathname + url.search;
  return gateLoginPage({ next: next || '/' });
}

// In-memory format cache (same isolate) — avoids re-scraping YouTube on every Range seek / download
const FORMAT_CACHE = new Map(); // videoId -> { pack, exp }
const FORMAT_CACHE_TTL_MS = 8 * 60 * 1000;
// videoId -> { exp, byItag: { [itag]: { url, mime, exp } } }
const MEDIA_URL_CACHE = new Map();

function cacheGetFormats(videoId) {
  const hit = FORMAT_CACHE.get(String(videoId));
  if (!hit) return null;
  if (hit.exp < Date.now()) {
    FORMAT_CACHE.delete(String(videoId));
    return null;
  }
  return hit.pack;
}
function cacheSetFormats(videoId, pack) {
  if (!pack || !pack.ok || !pack.formats || !pack.formats.length) return;
  FORMAT_CACHE.set(String(videoId), { pack, exp: Date.now() + FORMAT_CACHE_TTL_MS });
  // Cap map size
  if (FORMAT_CACHE.size > 80) {
    const first = FORMAT_CACHE.keys().next().value;
    FORMAT_CACHE.delete(first);
  }
}
async function getPlayerFormatsCached(videoId, request, env) {
  const cached = cacheGetFormats(videoId);
  if (cached) return { ...cached, fromCache: true };
  const pack = await fetchPlayerFormats(videoId, request, env);
  if (pack && pack.ok) cacheSetFormats(videoId, pack);
  return pack;
}

const BLOCKED_DOMAINS = [
  'doubleclick.net', 'googlesyndication.com', 'googleadservices.com',
  'tpc.googlesyndication.com', 'googletagservices.com', 'google-analytics.com',
  'googletagmanager.com'
];
const SOFT_BLOCKED = ['accounts.google.com'];
const FILTER_DOMAINS = [
  'rum.rimon.net.il', 'safepage.etrog.net.il', 'etrog.net.il', 'rimon.net.il',
  'netspark.com', 'netsparkmobile.com', 'ispark.net', 'blockpage', 'nanny'
];

function encodeUrl(url) {
  if (!url) return '';
  const data = new TextEncoder().encode(url);
  for (let i = 0; i < data.length; i++) data[i] ^= KEY[i % KEY.length];
  let binary = '';
  for (let i = 0; i < data.length; i += 8192) {
    binary += String.fromCharCode.apply(null, data.subarray(i, Math.min(i + 8192, data.length)));
  }
  return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
}

function decodeUrl(str) {
  if (!str) return null;
  try {
    let b64 = str.replace(/-/g, '+').replace(/_/g, '/');
    while (b64.length % 4) b64 += '=';
    const bin = atob(b64);
    const arr = new Uint8Array(bin.length);
    for (let i = 0; i < bin.length; i++) arr[i] = bin.charCodeAt(i);
    for (let i = 0; i < arr.length; i++) arr[i] ^= KEY[i % KEY.length];
    return new TextDecoder().decode(arr);
  } catch { return null; }
}

function xorBytes(input) {
  let bytes;
  if (typeof input === 'string') bytes = new TextEncoder().encode(input);
  else if (input instanceof ArrayBuffer) bytes = new Uint8Array(input);
  else if (input instanceof Uint8Array) bytes = input;
  else bytes = new Uint8Array(input);
  const out = new Uint8Array(bytes.length);
  for (let i = 0; i < bytes.length; i++) out[i] = bytes[i] ^ KEY[i % KEY.length];
  return out;
}

// ג”€ג”€ג”€ Section 2: URL & Domain Helpers ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€

// Trust-critical host match: TRUE only when `hostname` IS one of `suffixes` or a real
// subdomain of it. Prevents `youtube.com.evil.com` / `notgooglevideo.com` from being
// treated as trusted (which would leak YT cookies, skip IP-forward rules, or misroute
// other sites to YouTube). Use this — not `.includes()` — for any routing/trust decision.
function hostnameMatches(hostname, suffixes) {
  const h = String(hostname || '').toLowerCase().replace(/\.$/, '');
  if (!h) return false;
  return suffixes.some((s) => h === s || h.endsWith('.' + s));
}

const GOOGLEVIDEO_HOSTS = ['googlevideo.com', 'gvt1.com', 'gvt2.com'];

function isGoogleVideoUrl(s) {
  const str = String(s || '');
  try {
    const u = new URL(str);
    if (hostnameMatches(u.hostname, GOOGLEVIDEO_HOSTS)) return true;
    // A /videoplayback path only counts as googlevideo when hosted on a Google video/YT
    // host — matching it on arbitrary sites (e.g. `?mime=video`) mis-routed them to yt-stream.
    if (/\/videoplayback/i.test(u.pathname) &&
        hostnameMatches(u.hostname, [...GOOGLEVIDEO_HOSTS, 'youtube.com', 'youtube-nocookie.com'])) return true;
    return false;
  } catch {
    // Not a parseable URL — fall back to a conservative host-anchored check.
    return /(?:^|\/\/|\.)googlevideo\.com|(?:^|\/\/|\.)gvt1\.com/i.test(str);
  }
}

function isYouTubeDomain(hostname) {
  return hostnameMatches(hostname, ['youtube.com', 'youtu.be', 'ytimg.com', 'youtube-nocookie.com']);
}

function isBlocked(urlStr) { return BLOCKED_DOMAINS.some(d => urlStr.includes(d)); }
function isSoftBlocked(urlStr) { return SOFT_BLOCKED.some(d => urlStr.includes(d)); }
function isFilterDomain(urlStr) { return FILTER_DOMAINS.some(d => urlStr.includes(d)); }

// ─── SSRF guard ──────────────────────────────────────────────────────────────
// The generic /cdn/ path fetches ANY host the (gated) client asks for. Without this,
// a request could point the Worker at loopback / RFC1918 / link-local / cloud-metadata
// addresses (169.254.169.254) or use it as an open relay to attack third parties.
// Returns TRUE only for http(s) URLs whose host is a public name/IP.
function normalizeNumericIpv4(h) {
  let num = NaN;
  if (/^\d+$/.test(h)) num = parseInt(h, 10);
  else if (/^0x[0-9a-f]+$/i.test(h)) num = parseInt(h, 16);
  if (!isNaN(num) && num >= 0 && num <= 0xffffffff) {
    return [(num >>> 24) & 255, (num >>> 16) & 255, (num >>> 8) & 255, num & 255].join('.');
  }
  if (/^\d{1,3}(\.\d{1,3}){1,2}$/.test(h)) {
    const p = h.split('.').map(Number);
    if (p.length === 2) return `${p[0]}.0.0.${p[1]}`;
    if (p.length === 3) return `${p[0]}.${p[1]}.0.${p[2]}`;
  }
  return h;
}
function ipv4InPrivateRange(ip) {
  const m = ip.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
  if (!m) return false;
  const o = m.slice(1).map(Number);
  if (o.some((n) => n > 255)) return false; // not a valid v4 literal
  const [a, b] = o;
  if (a === 10) return true;                       // 10.0.0.0/8
  if (a === 127) return true;                      // loopback
  if (a === 0) return true;                        // 0.0.0.0/8
  if (a === 169 && b === 254) return true;         // link-local + cloud metadata
  if (a === 172 && b >= 16 && b <= 31) return true;// 172.16.0.0/12
  if (a === 192 && b === 168) return true;         // 192.168.0.0/16
  if (a === 100 && b >= 64 && b <= 127) return true;// CGNAT 100.64.0.0/10
  if (a >= 224) return true;                       // multicast/reserved
  return false;
}
function isPrivateOrLocalHost(hostname) {
  let raw = String(hostname || '').toLowerCase().replace(/\.$/, '');
  if (!raw) return true;
  const v6 = raw.startsWith('[') && raw.endsWith(']') ? raw.slice(1, -1) : raw;
  let h = normalizeNumericIpv4(v6);
  // Bare hostnames that always resolve internally
  if (h === 'localhost' || h.endsWith('.localhost')) return true;
  if (h.endsWith('.internal') || h.endsWith('.local')) return true;
  // IPv4 literal (also handles IPv4-mapped IPv6 ::ffff:a.b.c.d)
  const mapped = v6.match(/(?:^|:)((?:\d{1,3}\.){3}\d{1,3})$/);
  if (mapped && ipv4InPrivateRange(normalizeNumericIpv4(mapped[1]))) return true;
  if (ipv4InPrivateRange(h)) return true;
  // IPv6 special ranges
  if (v6 === '::1' || v6 === '::' ) return true;                 // loopback / unspecified
  if (/^fe[89ab][0-9a-f]:/i.test(v6)) return true;              // fe80::/10 link-local
  if (/^f[cd][0-9a-f]{2}:/i.test(v6)) return true;              // fc00::/7 unique-local (incl fd00:ec2::254)
  return false;
}
function isSafePublicUrl(u) {
  let x;
  try { x = typeof u === 'string' ? new URL(u) : u; } catch { return false; }
  if (x.protocol !== 'https:' && x.protocol !== 'http:') return false;
  if (isPrivateOrLocalHost(x.hostname)) return false;
  return true;
}

function rewriteM3u8(text, targetUrl, proxyOrigin) {
  const lines = text.split('\n');
  const result = [];
  for (let line of lines) {
    const trimmed = line.trim();
    if (!trimmed) {
      result.push(line);
      continue;
    }
    if (trimmed.startsWith('#')) {
      let rewrittenLine = trimmed.replace(/URI=(["'])([^"'\s]+)\1/g, (match, quote, relUrl) => {
        try {
          const absUrl = new URL(relUrl, targetUrl).toString();
          return `URI=${quote}${proxyOrigin}${PROXY_PATH}${encodeUrl(absUrl)}${quote}`;
        } catch (e) {
          return match;
        }
      });
      result.push(rewrittenLine);
    } else {
      try {
        const absUrl = new URL(trimmed, targetUrl).toString();
        result.push(proxyOrigin + PROXY_PATH + encodeUrl(absUrl));
      } catch (e) {
        result.push(line);
      }
    }
  }
  return result.join('\n');
}

function normalizeYouTubeHost(targetUrl) {
  if (targetUrl.hostname === 'youtube.com') {
    return new URL(targetUrl.toString().replace('://youtube.com', '://www.youtube.com'));
  }
  return targetUrl;
}

// ג”€ג”€ג”€ Section 3: CORS & Header Utilities ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€

function applyCorsHeaders(headers, request) {
  const reqOrigin = request.headers.get('origin');
  const referer = request.headers.get('referer');
  let allowOrigin = '*';
  if (reqOrigin) allowOrigin = reqOrigin;
  else if (referer) { try { allowOrigin = new URL(referer).origin; } catch {} }

  headers.set('access-control-allow-origin', allowOrigin);
  if (allowOrigin !== '*') headers.set('access-control-allow-credentials', 'true');
  headers.set('access-control-allow-methods', 'GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD');
  const reqH = request.headers.get('access-control-request-headers');
  const defaults = 'Range, Content-Type, Authorization, X-Requested-With, X-Goog-Visitor-Id, X-Youtube-Client-Name, X-Youtube-Client-Version, X-Origin, Sec-Fetch-Mode, Sec-Fetch-Dest';
  headers.set('access-control-allow-headers', reqH ? reqH + ', ' + defaults : defaults);
  headers.set('access-control-expose-headers', 'Content-Length, Content-Range, Accept-Ranges, Content-Type');
  headers.append('vary', 'Origin');
}

function stripSecurityHeaders(headers) {
  for (const h of ['content-security-policy', 'content-security-policy-report-only',
    'cross-origin-embedder-policy', 'cross-origin-opener-policy', 'x-frame-options',
    'report-to', 'nel', 'link', 'alt-svc', 'server', 'x-powered-by']) {
    headers.delete(h);
  }
  headers.delete('cross-origin-resource-policy');
  headers.set('cross-origin-resource-policy', 'cross-origin');
}

function cleanTransferHeaders(headers) {
  headers.delete('content-encoding');
  headers.delete('content-length');
  headers.delete('transfer-encoding');
}

// ── Asset-safe fallback ──────────────────────────────────────────────────────
// When a sub-resource request (script/style/image/font/xhr/media) fails or the origin
// returns the wrong type (HTML/text/JSON error), returning that body breaks the consumer:
// a script gets "Uncaught SyntaxError: Unexpected token '<'", a stylesheet is dropped, an
// <img> is broken. Instead return a MINIMAL VALID asset of the right kind with status 200
// (non-2xx also fires onerror), chosen from sec-fetch-dest with the path extension as fallback.
const GIF_1x1_B64 = 'R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7';
function isAssetRequest(dest, pathLow) {
  dest = String(dest || '').toLowerCase();
  pathLow = String(pathLow || '').toLowerCase();
  if (dest === 'script' || dest === 'style' || dest === 'worker' || dest === 'image' ||
      dest === 'font' || dest === 'audio' || dest === 'video' || dest === 'track' ||
      dest === 'manifest') return true;
  return /\.(js|mjs|css|png|jpe?g|gif|webp|svg|ico|bmp|avif|woff2?|ttf|otf|eot|mp4|webm|m4s|ts|mp3|m4a|wasm)(?:$|\?)/.test(pathLow);
}
function assetFallback(request, targetUrl) {
  const dest = (request.headers.get('sec-fetch-dest') || '').toLowerCase();
  let pathLow = '';
  try { pathLow = ((targetUrl && targetUrl.pathname) || new URL(request.url).pathname).toLowerCase(); } catch (_) {}
  const h = new Headers({ 'cache-control': 'no-store', 'x-etrog-asset-guard': 'fallback' });
  applyCorsHeaders(h, request);
  if (dest === 'script' || dest === 'worker' || /\.(js|mjs)(?:$|\?)/.test(pathLow)) {
    h.set('content-type', 'application/javascript; charset=utf-8');
    return new Response('/* proxy: upstream unavailable */', { status: 200, headers: h });
  }
  if (dest === 'style' || /\.css(?:$|\?)/.test(pathLow)) {
    h.set('content-type', 'text/css; charset=utf-8');
    return new Response('/* proxy: upstream unavailable */', { status: 200, headers: h });
  }
  if (dest === 'image' || /\.(png|jpe?g|gif|webp|svg|ico|bmp|avif)(?:$|\?)/.test(pathLow)) {
    h.set('content-type', 'image/gif');
    return new Response(Uint8Array.from(atob(GIF_1x1_B64), (c) => c.charCodeAt(0)), { status: 200, headers: h });
  }
  // font / audio / video / manifest / xhr(empty) / anything else → empty, no parse error.
  return new Response(null, { status: 204, headers: h });
}

/** XOR-seal body so on-path filters cannot swap/inject recognizable media/HTML. */
function sealBody(input, startOffset = 0) {
  let bytes;
  if (typeof input === 'string') bytes = new TextEncoder().encode(input);
  else if (input instanceof ArrayBuffer) bytes = new Uint8Array(input);
  else if (input instanceof Uint8Array) bytes = input;
  else bytes = new Uint8Array(input);
  const out = new Uint8Array(bytes.length);
  for (let i = 0; i < bytes.length; i++) out[i] = bytes[i] ^ KEY[(startOffset + i) % KEY.length];
  return out;
}

function sealedResponse(body, status, origCt, extraHeaders = {}, rangeStart = 0) {
  const sealed = sealBody(body, rangeStart);
  const h = new Headers(extraHeaders || {});
  applyCorsHeaders(h, new Request('https://local'));
  h.set('X-Proxy-Obfuscated', '1');
  h.set('X-Original-Content-Type', origCt || 'application/octet-stream');
  h.set('Content-Type', 'application/octet-stream');
  h.set('X-Seal-Offset', String(rangeStart));
  h.set('Cache-Control', extraHeaders['Cache-Control'] || extraHeaders['cache-control'] || 'no-store');
  cleanTransferHeaders(h);
  h.set('Content-Length', String(sealed.length));
  // expose seal headers to browser JS
  h.set('Access-Control-Expose-Headers', 'Content-Length, Content-Range, Accept-Ranges, Content-Type, X-Proxy-Obfuscated, X-Original-Content-Type, X-Seal-Offset, X-Etrog-Itag, X-Etrog-Bytes, X-Etrog-Thumb');
  return new Response(sealed, { status: status || 200, headers: h });
}

/** Detect Etrog/Rimon/NetSpark block pages or HTML injected instead of media */
function looksLikeBlockOrHtml(bytes) {
  // Tiny first Range chunk is normal — never treat as block
  if (!bytes || bytes.length < 10) return false;
  // Real media magic (check before HTML heuristics)
  if (bytes.length >= 8 && bytes[4] === 0x66 && bytes[5] === 0x74 && bytes[6] === 0x79 && bytes[7] === 0x70) return false; // ftyp
  if (bytes[0] === 0x1a && bytes[1] === 0x45) return false; // webm/mkv
  if (bytes[0] === 0xff && bytes[1] === 0xd8) return false; // jpeg
  if (bytes[0] === 0x89 && bytes[1] === 0x50) return false; // png
  if (bytes[0] === 0x52 && bytes[1] === 0x49) return false; // RIFF/webp
  if (bytes[0] === 0x00 && bytes[1] === 0x00 && (bytes[2] === 0x00 || bytes[2] === 0x01)) return false; // mp4/ts start
  if (bytes[0] === 0xff && (bytes[1] & 0xe0) === 0xe0) return false; // aac/mp3
  // Sample as text
  let s = '';
  const n = Math.min(bytes.length, 400);
  for (let i = 0; i < n; i++) {
    const c = bytes[i];
    s += c >= 32 && c < 127 ? String.fromCharCode(c) : (c === 9 || c === 10 || c === 13 ? ' ' : '');
  }
  s = s.toLowerCase();
  if (s.includes('<!doctype') || s.includes('<html') || s.includes('<head')) return true;
  if (s.includes('safepage') || s.includes('etrog') || s.includes('rimon') || s.includes('netspark')) return true;
  if (s.includes('access denied') || s.includes('blocked') || s.includes('filter')) return true;
  if (s.trimStart().startsWith('{') && (s.includes('"error"') || s.includes('auth_required') || s.includes('login_required'))) return true;
  return false;
}

/** Stream-XOR so on-path filters (Rimon RWC_BLOCK) cannot swap recognizable MP4 */
function sealTransformStream(readable, startOffset = 0) {
  let i = startOffset | 0;
  return readable.pipeThrough(
    new TransformStream({
      transform(chunk, controller) {
        const src = chunk instanceof Uint8Array ? chunk : new Uint8Array(chunk);
        const out = new Uint8Array(src.length);
        for (let j = 0; j < src.length; j++) out[j] = src[j] ^ KEY[(i + j) % KEY.length];
        i += src.length;
        controller.enqueue(out);
      },
    })
  );
}

function sealedStreamResponse(readable, status, origCt, extraHeaders = {}, rangeStart = 0, contentLength = null) {
  const h = new Headers(extraHeaders || {});
  applyCorsHeaders(h, new Request('https://local'));
  h.set('X-Proxy-Obfuscated', '1');
  h.set('X-Original-Content-Type', origCt || 'video/mp4');
  h.set('Content-Type', 'application/octet-stream');
  h.set('X-Seal-Offset', String(rangeStart || 0));
  h.set('X-Etrog-Mode', 'stream-sealed');
  h.set('accept-ranges', 'bytes');
  // Tell nginx-style reverse proxies (HF Spaces ingress) NOT to buffer the body: a buffered
  // stream delays the first byte until the whole response is ready and can kill video playback.
  h.set('X-Accel-Buffering', 'no');
  h.set('cache-control', 'no-store');
  h.set(
    'Access-Control-Expose-Headers',
    'Content-Length, Content-Range, Accept-Ranges, Content-Type, Content-Disposition, X-Proxy-Obfuscated, X-Original-Content-Type, X-Seal-Offset, X-Etrog-Mode, X-Etrog-Itag, X-Etrog-Bytes, X-Etrog-Len, X-Etrog-Cache, X-Etrog-Client, X-Etrog-Resolved-Url'
  );
  if (contentLength != null && contentLength !== '') h.set('content-length', String(contentLength));
  const sealed = sealTransformStream(readable, rangeStart || 0);
  return new Response(sealed, { status: status || 200, headers: h });
}

/** Parse Range: bytes=START- or bytes=START-END → start offset for XOR */
function parseRangeStart(rangeHdr) {
  if (!rangeHdr) return 0;
  const m = String(rangeHdr).match(/bytes=(\d+)/i);
  return m ? parseInt(m[1], 10) || 0 : 0;
}

function rewriteAllHttpUrls(text, origin) {
  if (!text) return text;
  text = text.replace(/https?:\/\/[^\s"'<>\\]+/g, (match) => {
    let urlStr = match;
    let trailing = '';
    while (/[),.;]/.test(urlStr.slice(-1))) {
      trailing = urlStr.slice(-1) + trailing;
      urlStr = urlStr.slice(0, -1);
    }
    try {
      if (urlStr.startsWith(origin)) return match;
      if (urlStr.includes('/cdn/')) return match;
      if (urlStr.startsWith('data:') || urlStr.startsWith('blob:')) return match;
      const u = new URL(urlStr.replace(/&amp;/g, '&'));
      if (!/^https?:$/i.test(u.protocol)) return match;
      return origin + PROXY_PATH + encodeUrl(u.href) + trailing;
    } catch {
      return match;
    }
  });
  text = text.replace(/https?:\\\/\\\/[^"'\\]+/g, (match) => {
    const unescaped = match.replace(/\\\//g, '/');
    try {
      const u = new URL(unescaped);
      if (u.href.startsWith(origin)) return match;
      return (origin + PROXY_PATH + encodeUrl(u.href)).replace(/\//g, '\\/');
    } catch {
      return match;
    }
  });
  return text;
}

// Same as rewriteAllHttpUrls but NEVER touches <script>/<style> contents. Rewriting URLs
// inside JS (regex literals, template strings, escaped "https:\/\/") corrupts the code and
// throws a cascade of SyntaxErrors — which left sites stuck on a spinner. Runtime requests
// are proxied by the Service Worker anyway, so inline JS does not need URL rewriting.
function rewriteHtmlTextUrls(html, origin) {
  if (!html) return html;
  const parts = html.split(/(<script\b[\s\S]*?<\/script>|<style\b[\s\S]*?<\/style>)/gi);
  for (let i = 0; i < parts.length; i += 2) {
    // Even indices are the text BETWEEN script/style blocks; odd indices are the blocks (kept).
    parts[i] = rewriteAllHttpUrls(parts[i], origin);
  }
  return parts.join('');
}

// ג”€ג”€ג”€ Section 4: Cookie Utilities ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€

function parseCookies(cookieHeader) {
  const map = {};
  if (!cookieHeader) return map;
  for (const str of cookieHeader.split(';')) {
    const eq = str.indexOf('=');
    if (eq !== -1) map[str.slice(0, eq).trim()] = str.slice(eq + 1).trim();
  }
  return map;
}

function hexEncode(domain) {
  let h = '';
  for (let i = 0; i < domain.length; i++) h += domain.charCodeAt(i).toString(16).padStart(2, '0');
  return h;
}

function hexDecode(hex) {
  let s = '';
  for (let i = 0; i < hex.length; i += 2) s += String.fromCharCode(parseInt(hex.substr(i, 2), 16));
  return s;
}

// Nachotoy VIP session. This is a PERSONAL credential — it must NOT live in source/git.
// Provide it as a Cloudflare secret (NACHOTOY_SID) and rotate the leaked one. If unset,
// the site simply isn't force-logged-in (safe fallback) instead of shipping a live session.
function nachotoySid(env) {
  return cleanSecret(env && env.NACHOTOY_SID);
}

function buildTargetCookies(cookieHeader, targetUrl, isYT, env) {
  const result = [];
  const sid = nachotoySid(env);
  if (!cookieHeader) {
    if (isYT) { result.push('CONSENT=YES+cb.20210328-17-p0.en+FX+667', 'SOCS=CAE='); }
    const isNachotoy = hostnameMatches(targetUrl.hostname, ['nachotoy.com']);
    if (isNachotoy && sid) {
      result.push('connect.sid=' + sid);
    }
    return result;
  }
  for (const str of cookieHeader.split(';')) {
    const cookie = str.trim();
    const eq = cookie.indexOf('=');
    if (eq === -1) continue;
    const name = cookie.slice(0, eq).trim();
    const val = cookie.slice(eq + 1).trim();
    if (name.startsWith('__proxy_cookie_')) {
      const m = name.match(/^__proxy_cookie_([a-f0-9]+)_(.+)$/);
      if (m) {
        const domain = hexDecode(m[1]);
        if (targetUrl.hostname === domain || targetUrl.hostname.endsWith('.' + domain)) {
          result.push(m[2] + '=' + val);
        }
      }
    } else if (!name.startsWith('__proxy_')) {
      // Forward non-proxy cookies as-is
      result.push(name + '=' + val);
    }
  }
  if (isYT) {
    if (!result.some(c => c.startsWith('CONSENT='))) result.push('CONSENT=YES+cb.20210328-17-p0.en+FX+667');
    if (!result.some(c => c.startsWith('SOCS='))) result.push('SOCS=CAE=');
  }
  const isNachotoy = hostnameMatches(targetUrl.hostname, ['nachotoy.com']);
  if (isNachotoy && sid) {
    // Force the configured VIP session cookie so the user stays logged in.
    for (let i = result.length - 1; i >= 0; i--) {
      if (result[i].trim().startsWith("connect.sid=")) {
        result.splice(i, 1);
      }
    }
    result.push('connect.sid=' + sid);
  }
  return result;
}

function virtualizeSetCookies(setCookies, targetHostname) {
  const result = [];
  for (const cookieStr of setCookies) {
    const parts = cookieStr.split(';');
    const first = parts[0].trim();
    const eq = first.indexOf('=');
    if (eq === -1) continue;
    const name = first.slice(0, eq).trim();
    const val = first.slice(eq + 1).trim();
    let domain = targetHostname;
    for (let i = 1; i < parts.length; i++) {
      const p = parts[i].trim();
      if (p.toLowerCase().startsWith('domain=')) domain = p.slice(7).trim().replace(/^\./, '');
    }
    let newCookie = '__proxy_cookie_' + hexEncode(domain) + '_' + name + '=' + val;
    let hasSameSite = false;
    for (let i = 1; i < parts.length; i++) {
      const p = parts[i].trim();
      if (p.toLowerCase().startsWith('domain=')) continue;
      if (p.toLowerCase().startsWith('samesite=')) { newCookie += '; SameSite=None; Secure'; hasSameSite = true; }
      else newCookie += '; ' + p;
    }
    if (!hasSameSite) newCookie += '; SameSite=None; Secure';
    result.push(newCookie);
  }
  return result;
}

function rewriteJsonUrls(jsonText, origin) {
  if (!jsonText) return jsonText;
  return jsonText.replace(/(["']|\\")((?:https?:\\?\/\\?)[^"'\s>]+)\1/g, (urlMatch, quote, urlOnly) => {
    const cleanUrl = urlOnly.replace(/\\/g, '');
    if (cleanUrl.includes('googlevideo.com') || cleanUrl.includes('youtube.com') || cleanUrl.includes('ytimg.com')) {
      const encoded = encodeUrl(cleanUrl);
      const hasEscapes = urlOnly.includes('\\');
      let proxyUrl = origin + PROXY_PATH + encoded;
      if (hasEscapes) proxyUrl = proxyUrl.replace(/\//g, '\\/');
      return quote + proxyUrl + quote;
    }
    return urlMatch;
  });
}

async function saveCookiesToCache(domain, cookieStr) {
  try {
    const cache = caches.default;
    const cacheKey = new Request(`https://cookie-store.local/cookies/${domain}`, {
      method: 'GET',
      headers: { 'Content-Type': 'text/plain' }
    });
    const response = new Response(cookieStr, {
      headers: { 'Cache-Control': 'max-age=31536000' } // Cache for 1 year
    });
    await cache.put(cacheKey, response);
  } catch (e) {}
}

async function getCookiesFromCache(domain) {
  try {
    const cache = caches.default;
    const domainsToCheck = [domain];
    const parts = domain.split('.');
    if (parts.length > 2) {
      domainsToCheck.push(parts.slice(-2).join('.'));
    }
    
    for (const d of domainsToCheck) {
      const cacheKey = new Request(`https://cookie-store.local/cookies/${d}`);
      const response = await cache.match(cacheKey);
      if (response) {
        return await response.text();
      }
    }
  } catch (e) {}
  return '';
}

// ג”€ג”€ג”€ Section 5: Service Worker Script ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€

const SW_JS = `
var KEY = [97, 110, 116, 105, 103, 114, 97, 118, 105, 116, 121];
var BLOCK = ['doubleclick.net','googlesyndication.com','googleadservices.com','tpc.googlesyndication.com','googletagservices.com','google-analytics.com','googletagmanager.com','accounts.google.com','safepage.etrog.net.il','etrog.net.il','rum.rimon.net.il','rimon.net.il','netspark.com'];

function encodeUrl(url) {
  if (!url) return '';
  var encoder = new TextEncoder();
  var data = encoder.encode(url);
  for (var i = 0; i < data.length; i++) data[i] = data[i] ^ KEY[i % KEY.length];
  var binary = '';
  for (var i = 0; i < data.length; i += 8192) {
    binary += String.fromCharCode.apply(null, data.subarray(i, Math.min(i + 8192, data.length)));
  }
  return btoa(binary).replace(/[+]/g, '-').replace(/[/]/g, '_').replace(/=+$/, '');
}

function decodeUrl(str) {
  if (!str) return null;
  try {
    var b64 = str.replace(/-/g, '+').replace(/_/g, '/');
    while (b64.length % 4) b64 += '=';
    var bin = atob(b64);
    var arr = new Uint8Array(bin.length);
    for (var i = 0; i < bin.length; i++) arr[i] = bin.charCodeAt(i);
    for (var i = 0; i < arr.length; i++) arr[i] ^= KEY[i % KEY.length];
    return new TextDecoder().decode(arr);
  } catch(e) { return null; }
}

function isGV(u) {
  var s = String(u || '');
  return s.indexOf('googlevideo.com') !== -1 || s.indexOf('gvt1.com') !== -1 ||
    s.indexOf('videoplayback') !== -1 || s.indexOf('mime=video') !== -1 || s.indexOf('mime%3Dvideo') !== -1;
}

function shouldBlock(urlStr) {
  for (var i = 0; i < BLOCK.length; i++) {
    if (urlStr.indexOf(BLOCK[i]) !== -1) return true;
  }
  return false;
}

function isSoftBlock(urlStr) {
  return urlStr.indexOf('accounts.google.com') !== -1;
}

// When a proxied sub-resource fails at the SW level, return a MINIMAL VALID asset of the right
// kind (never a 'SW Error' text body, which breaks a <script>/<link>/<img> consumer).
function swAsset(req) {
  var d = (req && req.destination) || '';
  var p = '';
  try { p = new URL(req.url).pathname.toLowerCase(); } catch (e) {}
  var H = { 'cache-control': 'no-store', 'access-control-allow-origin': '*' };
  if (d === 'script' || d === 'worker' || /\\.(js|mjs)(\\?|$)/.test(p)) {
    return new Response('/* */', { status: 200, headers: Object.assign({ 'content-type': 'application/javascript; charset=utf-8' }, H) });
  }
  if (d === 'style' || /\\.css(\\?|$)/.test(p)) {
    return new Response('/* */', { status: 200, headers: Object.assign({ 'content-type': 'text/css; charset=utf-8' }, H) });
  }
  if (d === 'image' || /\\.(png|jpe?g|gif|webp|svg|ico|bmp|avif)(\\?|$)/.test(p)) {
    var g = atob('R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7');
    var b = new Uint8Array(g.length); for (var i = 0; i < g.length; i++) b[i] = g.charCodeAt(i);
    return new Response(b, { status: 200, headers: Object.assign({ 'content-type': 'image/gif' }, H) });
  }
  return new Response(null, { status: 204, headers: H });
}

self.addEventListener('install', function(e) { self.skipWaiting(); });
self.addEventListener('activate', function(e) { e.waitUntil(self.clients.claim()); });
self.addEventListener('message', function(e) { if (e.data === 'skipWaiting') { try { self.skipWaiting(); } catch (x) {} } });

function decryptResponse(res) {
  if (res.status === 204 || res.status === 205 || res.status === 304) {
    return Promise.resolve(new Response(null, { status: res.status, headers: res.headers }));
  }
  if (res.headers.get('X-Etrog-Mode') === 'stream-unsealed') return Promise.resolve(res);
  if (res.headers.get('X-Proxy-Obfuscated') !== '1') return Promise.resolve(res);
  var off = parseInt(res.headers.get('X-Seal-Offset') || '0', 10) || 0;
  var origCT = res.headers.get('X-Original-Content-Type') || '';
  var mode = res.headers.get('X-Etrog-Mode') || '';
  var h = new Headers(res.headers);
  h.delete('X-Proxy-Obfuscated');
  h.delete('X-Seal-Offset');
  if (origCT) { h.set('content-type', origCT); h.delete('X-Original-Content-Type'); }
  // Streaming unseal for large media (avoids buffering entire long videos in SW)
  if (mode === 'stream-sealed' && res.body) {
    var i = off;
    var reader = res.body.getReader();
    var stream = new ReadableStream({
      pull: function(controller) {
        return reader.read().then(function(r) {
          if (r.done) { controller.close(); return; }
          var src = r.value;
          var out = new Uint8Array(src.length);
          for (var j = 0; j < src.length; j++) out[j] = src[j] ^ KEY[(i + j) % KEY.length];
          i += src.length;
          controller.enqueue(out);
        });
      },
      cancel: function() { try { reader.cancel(); } catch (e) {} }
    });
    h.set('X-Etrog-Mode', 'stream-unsealed');
    return Promise.resolve(new Response(stream, { status: res.status, statusText: res.statusText, headers: h }));
  }
  // Buffer-unseal for small sealed payloads (thumbs, short blobs)
  return res.arrayBuffer().then(function(buffer) {
    var bytes = new Uint8Array(buffer);
    for (var i = 0; i < bytes.length; i++) bytes[i] = bytes[i] ^ KEY[(off + i) % KEY.length];
    h.delete('content-length');
    var ct = h.get('content-type') || '';
    if (res.url.indexOf('.js') !== -1 || ct.indexOf('javascript') !== -1) {
      h.set('content-type', 'application/javascript; charset=utf-8');
    }
    if (res.url.indexOf('/api/i') !== -1 || res.url.indexOf('/x/t') !== -1 || ct.indexOf('image/') === 0) {
      h.set('content-type', origCT || 'image/jpeg');
    }
    if (ct.indexOf('video/') === 0 || (origCT && String(origCT).indexOf('video/') === 0)) {
      h.set('content-type', origCT || ct || 'video/mp4');
    }
    h.set('Content-Length', String(bytes.length));
    return new Response(bytes, { status: res.status, statusText: res.statusText, headers: h });
  });
}

self.addEventListener('fetch', function(e) {
  var requestUrl = new URL(e.request.url);
  var pathname = requestUrl.pathname;
  if (pathname.indexOf('/chunks/') === 0) {
    var cdnUrl = 'https://cdn.search.brave.com/serp/v1/static' + pathname + requestUrl.search;
    e.respondWith(fetch(cdnUrl));
    return;
  }
  var hrefLow = requestUrl.href.toLowerCase();
  // Always block Etrog/Rimon safepages (including navigations)
  if (hrefLow.indexOf('safepage.etrog') !== -1 || hrefLow.indexOf('etrog.net.il') !== -1 ||
      hrefLow.indexOf('rimon.net.il') !== -1 || hrefLow.indexOf('netspark') !== -1) {
    e.respondWith(new Response('<!DOCTYPE html><html><body dir="rtl" style="font-family:system-ui;background:#0b0f19;color:#e2e8f0;padding:2rem"><h1>החסימה נחסמה</h1><p><a style="color:#7dd3fc" href="/?home=1">חזרה לדף הבית</a></p></body></html>', {
      status: 200, headers: { 'content-type': 'text/html; charset=utf-8' }
    }));
    return;
  }
  // Legacy /proxy/ → /cdn/ (Etrog flags /proxy/)
  if (requestUrl.pathname.indexOf('/proxy/') === 0) {
    var rewritten = self.location.origin + '/cdn/' + requestUrl.pathname.slice(7) + requestUrl.search;
    e.respondWith(Response.redirect(rewritten, 302));
    return;
  }
  // Top-level navigation into a proxied page. The SW MUST handle this rather than let it go
  // straight to the network: a plain navigation puts the target site's HTML on the wire in
  // cleartext, and the on-path filter classifies by body — ynet/mako came back as a block page
  // (rimon: RWC_BLOCK, server: lighttpd). Asking the Worker for a sealed document means the
  // filter only ever sees opaque bytes, and we unseal here before the renderer sees it.
  if (e.request.mode === 'navigate') {
    var navProxied = pathname.indexOf('/cdn/') === 0 || pathname.indexOf('/proxy/') === 0;
    if (navProxied && e.request.method === 'GET') {
      e.respondWith((function() {
        var h = new Headers(e.request.headers);
        h.set('X-Proxy-Obfuscate', '1');
        // A SW-issued fetch reports sec-fetch-dest: empty, so the Worker cannot tell a
        // top-level page from a framed one on its own — say which it is, because only a
        // top-level navigation may move the session's __proxy_target.
        h.set('X-Proxy-Navigation', e.request.destination === 'iframe' ? 'frame' : 'top');
        return fetch(new Request(e.request.url, {
          method: 'GET', headers: h, credentials: 'same-origin', redirect: 'follow'
        })).then(function(res) {
          return decryptResponse(res);
        }).catch(function() {
          // Never leave a dead tab: fall back to the ordinary (unsealed) navigation.
          return fetch(e.request);
        });
      })());
      return;
    }
    return;
  }

  // 2. Block ad/tracking domains
  if (shouldBlock(requestUrl.href)) {
    if (isSoftBlock(requestUrl.href)) {
      e.respondWith(new Response('{}', { status: 200, headers: { 'content-type': 'application/json', 'access-control-allow-origin': self.location.origin } }));
    } else {
      e.respondWith(new Response(null, { status: 204 }));
    }
    return;
  }

  // 3. Cross-origin requests: proxy through worker
  if (requestUrl.origin !== self.location.origin) {
    var PASSTHROUGH = ['cdn.search.brave.com'];
    if (PASSTHROUGH.indexOf(requestUrl.hostname) !== -1 || requestUrl.searchParams.has('etrog_direct') || requestUrl.href.indexOf('etrog_direct') !== -1) {
      return;
    }
    if (shouldBlock(requestUrl.href)) {
      e.respondWith(new Response(null, { status: 204 }));
      return;
    }
    var dest = requestUrl.href;
    var proxiedUrl = self.location.origin + '/cdn/' + encodeUrl(dest);
    e.respondWith((function() {
      var headers = new Headers(e.request.headers);
      if (e.request.mode === 'navigate') headers.set('X-Proxy-Navigation', '1');
      var isYT = dest.indexOf('youtube.com') !== -1 || dest.indexOf('ytimg.com') !== -1 || dest.indexOf('googlevideo.com') !== -1 || dest.indexOf('gvt1.com') !== -1;
      var isScania = dest.indexOf('amerii.ca') !== -1 || dest.indexOf('/content/') !== -1 || dest.indexOf('/pl/') !== -1 ||
        dest.indexOf('.ts') !== -1 || dest.indexOf('.m4s') !== -1 || /page-\d+\.html/i.test(dest);
      var isMedia = e.request.destination === 'video' || e.request.destination === 'audio' ||
        e.request.headers.has('range') || isScania || isGV(dest);
      // Never XOR-request media/YouTube — sealing breaks progressive playback
      if (!isMedia && !isYT) headers.set('X-Proxy-Obfuscate', '1');
      var body = null;
      var method = e.request.method;
      var p = Promise.resolve();
      if (method !== 'GET' && method !== 'HEAD') {
        p = e.request.clone().arrayBuffer().then(function(b) {
          body = b;
          headers.set('content-type', e.request.headers.get('content-type') || 'application/json');
          headers.delete('content-length');
        }).catch(function() {});
      }
      return p.then(function() {
        return fetch(proxiedUrl, {
          method: method, headers: headers, body: body,
          credentials: 'same-origin',
          redirect: e.request.mode === 'navigate' ? 'manual' : 'follow'
        });
      }).then(function(res) {
        if (res.type === 'opaqueredirect') {
          return Response.redirect(res.headers.get('Location') || '/', 302);
        }
        // Unseal when server sealed (X-Proxy-Obfuscated), even for media/206
        return decryptResponse(res);
      }).catch(function(err) {
        return swAsset(e.request);
      });
    })());
    return;
  }

  // 4a. Search-image proxy — tell the Worker a Service Worker is driving this request, so it
  // XOR-seals the bytes (an unrecognisable JPEG is one the on-path filter cannot pixelate).
  // Without a SW the same URL returns a plain image, so uncontrolled first loads still work.
  if (requestUrl.pathname === '/x/p') {
    e.respondWith(
      (function() {
        var h = new Headers(e.request.headers);
        h.set('X-Etrog-SW', '1');
        return fetch(new Request(e.request.url, { method: 'GET', headers: h, credentials: 'same-origin' }))
          .then(function(res) {
            if (!res.ok) return res;
            if (res.headers.get('X-Proxy-Obfuscated') !== '1') return res;
            return decryptResponse(res);
          })
          .catch(function() { return swAsset(e.request); });
      })()
    );
    return;
  }

  // 4. Media/thumbs — pass through to Worker. Never parse /x/s token as googlevideo URL.
  if (requestUrl.pathname === '/api/yt-stream' ||
      requestUrl.pathname === '/api/m' ||
      requestUrl.pathname === '/api/media' ||
      requestUrl.pathname === '/api/i' ||
      requestUrl.pathname === '/x/s' ||
      requestUrl.pathname === '/x/t' ||
      requestUrl.pathname.indexOf('/x/s/') === 0 ||
      requestUrl.pathname === '/assets/chunk' ||
      requestUrl.pathname.indexOf('/assets/chunk-') === 0) {
    e.respondWith(
      fetch(e.request).then(function(res) {
        // Error JSON (502/4xx) — never XOR-decrypt
        if (!res.ok && res.status !== 206) return res;
        var rimon = (res.headers.get('Rimon') || res.headers.get('rimon') || '').toUpperCase();
        var srv = (res.headers.get('server') || '').toLowerCase();
        var mode = res.headers.get('X-Etrog-Mode') || '';
        var sealed = res.headers.get('X-Proxy-Obfuscated') === '1' || mode === 'stream-sealed';
        var ct = (res.headers.get('content-type') || '').toLowerCase();
        // Block Rimon MITM only when response is NOT from our worker markers
        if (!mode && !sealed && (rimon.indexOf('BLOCK') !== -1 || srv.indexOf('lighttpd') !== -1)) {
          console.error('[SW Filter Block] URL:', e.request.url, 'Rimon:', rimon, 'Server:', srv);
          return new Response(JSON.stringify({ error: 'filter_block', hint: 'Etrog/Rimon intercepted stream: ' + e.request.url }), {
            status: 502,
            headers: { 'content-type': 'application/json', 'cache-control': 'no-store' }
          });
        }
        // Plain unsealed video / JSON meta — do not touch body
        if (mode === 'stream-unsealed' || ct.indexOf('video/') === 0 || ct.indexOf('audio/') === 0 || ct.indexOf('json') !== -1) {
          return res;
        }
        if (!sealed) return res;
        return decryptResponse(res);
      }).catch(function() { return new Response(null, { status: 502 }); })
    );
    return;
  }
  // Skip SW re-wrap for static player pages / health / SW script
  if (requestUrl.pathname === '/sw.js') return;
  if (requestUrl.pathname === '/api/yt-search' ||
      requestUrl.pathname === '/api/yt-meta' ||
      requestUrl.pathname === '/api/yt-channel' ||
      requestUrl.pathname === '/api/health' ||
      requestUrl.pathname === '/api/audio-mp3' ||
      requestUrl.pathname === '/ytp' ||
      requestUrl.pathname === '/player' ||
      requestUrl.pathname === '/yt-player') {
    return;
  }

  // 4b. Bypass YouTube-specific paths from Service Worker interception
  var path = requestUrl.pathname;
  if (path.indexOf('/watch') === 0 ||
      path.indexOf('/youtubei/') === 0 ||
      path.indexOf('/s/') === 0 ||
      path.indexOf('/yts/') === 0 ||
      path.indexOf('/results') === 0 ||
      path.indexOf('/playlist') === 0 ||
      path.indexOf('/channel') === 0 ||
      path.indexOf('/c/') === 0 ||
      path.indexOf('/user') === 0 ||
      path.indexOf('/embed') === 0 ||
      path.indexOf('/live') === 0 ||
      path.indexOf('/shorts') === 0 ||
      path.indexOf('/generate_204') === 0 ||
      path.indexOf('/gen_204') === 0) {
    return; // Bypasses SW fetch entirely, falls through to browser network fetch!
  }

  // 5. Same-origin /cdn/ (and sealed media handling)
  // CRITICAL: always unseal when X-Proxy-Obfuscated=1 — never skip because "isMedia".
  // Sealed media (handleYtStream) MUST be decrypted before the browser media pipeline.
  var rawTarget = null;
  if (requestUrl.pathname.indexOf('/cdn/') === 0) {
    // '/cdn/'.length === 5 (NOT 7 — that was a token-corruption bug)
    rawTarget = decodeUrl(requestUrl.pathname.slice(5).split('/')[0]);
    if (rawTarget && rawTarget.indexOf('//') === 0) rawTarget = 'https:' + rawTarget;
    if (rawTarget && isGV(rawTarget)) {
      e.respondWith((function() {
        function resolveVid() {
          var vid = null;
          try {
            var ref = e.request.headers.get('referer') || e.request.referrer || '';
            var ru = new URL(ref, self.location.origin);
            vid = ru.searchParams.get('v') || null;
            if (!vid) {
              var mm = ru.pathname.match(/\\/(?:embed|shorts|live|v|ytp)\\/([^/?#]+)/);
              if (mm) vid = mm[1];
            }
            if (!vid && (ru.pathname === '/ytp' || ru.pathname.indexOf('/ytp') === 0)) {
              vid = ru.searchParams.get('v');
              if (!vid && ru.searchParams.get('d')) {
                try {
                  var raw = decodeUrl(ru.searchParams.get('d'));
                  var j = JSON.parse(raw);
                  if (j && j.v) vid = j.v;
                } catch (e0) {}
              }
            }
          } catch (err3) {}
          var qVid = requestUrl.searchParams.get('v') || requestUrl.searchParams.get('__yt_vid');
          if (qVid) vid = qVid;
          return vid;
        }
        try {
          var gu = new URL(rawTarget);
          var itag = gu.searchParams.get('itag') || '22';
          var vid = resolveVid();
          function fetchSealedStream(v) {
            var dest = self.location.origin + '/api/m?v=' + encodeURIComponent(v) + '&i=' + encodeURIComponent(itag);
            return fetch(dest, { method: 'GET', credentials: 'same-origin' }).then(function(res) {
              // Always unseal sealed media (friend's bug report: isMedia skip left XOR bytes)
              return decryptResponse(res);
            });
          }
          if (vid) return fetchSealedStream(vid);
          return self.clients.matchAll({ type: 'window' }).then(function(list) {
            for (var i = 0; i < list.length; i++) {
              try {
                var cu = new URL(list[i].url);
                var cv = cu.searchParams.get('v');
                if (!cv) {
                  var cm = cu.pathname.match(/\\/(?:embed|shorts|live|ytp)\\/([^/?#]+)/);
                  if (cm) cv = cm[1];
                }
                if (!cv && cu.searchParams.get('d')) {
                  try {
                    var raw2 = decodeUrl(cu.searchParams.get('d'));
                    var j2 = JSON.parse(raw2);
                    if (j2 && j2.v) cv = j2.v;
                  } catch (e5) {}
                }
                if (cv) { vid = cv; break; }
              } catch (e4) {}
            }
            if (!vid) return new Response(null, { status: 204 });
            return fetchSealedStream(vid);
          });
        } catch (err5) {
          return new Response(null, { status: 204 });
        }
      })());
      return;
    }
  }

  e.respondWith((function() {
    if (rawTarget && shouldBlock(rawTarget)) {
      if (isSoftBlock(rawTarget)) {
        return Promise.resolve(new Response('{}', { status: 200, headers: { 'content-type': 'application/json' } }));
      }
      return Promise.resolve(new Response(null, { status: 204 }));
    }

    var headers = new Headers(e.request.headers);
    if (e.request.mode === 'navigate') {
      headers.set('X-Proxy-Navigation', e.request.destination === 'iframe' ? 'frame' : 'top');
    }
    // Images: ask the worker to XOR-seal them so the on-path filter (Etrog/Rimon) cannot see
    // the real JPEG/PNG and blur it. The SW unseals below via decryptResponse. Fonts are NOT
    // sealed — a font request that misses SW control would receive opaque bytes and fail to
    // decode (OTS errors). Media/HTML/JS/CSS also stay unsealed.
    // Once a page has been rewritten, ALL of its sub-resources are same-origin /cdn/ URLs, so
    // this branch — not the cross-origin one above — decides what the filter gets to read.
    // Sealing only images left every XHR/JSON payload and every iframe document in cleartext,
    // which is what the filter classifies (and injects its ntsp_block_page marker into).
    //
    // Exclusions are deliberate, each for a failure we have actually seen:
    //   font   — a font fetched without SW control receives opaque bytes and OTS rejects it
    //   script — sealing JS produced SyntaxError cascades across YouTube's modules
    //   style  — same class of risk, and CSS is not what gets classified
    //   media  — sealing breaks progressive/range playback
    var dst = e.request.destination;
    var neverSeal =
      dst === 'font' || dst === 'script' || dst === 'style' ||
      dst === 'audio' || dst === 'video' || dst === 'track' ||
      e.request.headers.has('range') || isGV(rawTarget || e.request.url);
    if (!neverSeal) {
      headers.set('X-Proxy-Obfuscate', '1');
    } else {
      headers.delete('X-Proxy-Obfuscate');
    }

    var body = null;
    var method = e.request.method;
    var p = Promise.resolve();
    if (method !== 'GET' && method !== 'HEAD') {
      p = e.request.clone().arrayBuffer().then(function(b) {
        body = b;
        headers.set('content-type', e.request.headers.get('content-type') || 'application/json');
        headers.delete('content-length');
      }).catch(function() {});
    }

    return p.then(function() {
      return fetch(new Request(e.request.url, {
        method: method, headers: headers, body: body,
        credentials: e.request.credentials, cache: e.request.cache,
        redirect: e.request.mode === 'navigate' ? e.request.redirect : 'follow'
      }));
    }).then(function(res) {
      if (res.type === 'opaqueredirect') {
        return Response.redirect(res.headers.get('Location') || '/', 302);
      }
      // ALWAYS unseal if server marked sealed — ignore isMedia shortcuts
      return decryptResponse(res);
    }).catch(function(err) {
      return swAsset(e.request);
    });
  })());
});
`;

// ג”€ג”€ג”€ Section 6: Injected Client-Side Script ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€

const INJECTED_JS = `<script>
(function() {
  if (window.__PROXIED__) return;
  window.__PROXIED__ = true;

  if ('serviceWorker' in navigator) {
    navigator.serviceWorker.addEventListener('controllerchange', function() {
      window.location.reload();
    });
  }

  var KEY = [97, 110, 116, 105, 103, 114, 97, 118, 105, 116, 121];

  function encodeUrl(url) {
    if (!url) return '';
    var encoder = new TextEncoder();
    var data = encoder.encode(url);
    for (var i = 0; i < data.length; i++) data[i] = data[i] ^ KEY[i % KEY.length];
    var binary = '';
    for (var i = 0; i < data.length; i += 8192) {
      binary += String.fromCharCode.apply(null, data.subarray(i, Math.min(i + 8192, data.length)));
    }
    return btoa(binary).replace(/[+]/g, '-').replace(/[/]/g, '_').replace(/=+$/, '');
  }

  function decodeUrl(str) {
    if (!str) return null;
    try {
      var b64 = String(str).replace(/-/g, '+').replace(/_/g, '/');
      while (b64.length % 4) b64 += '=';
      var bin = atob(b64);
      var arr = new Uint8Array(bin.length);
      for (var i = 0; i < bin.length; i++) arr[i] = bin.charCodeAt(i) ^ KEY[i % KEY.length];
      return new TextDecoder().decode(arr);
    } catch (e) { return null; }
  }

  function isGV(s) {
    s = String(s || '');
    return s.indexOf('googlevideo.com') !== -1 || s.indexOf('gvt1.com') !== -1 ||
      s.indexOf('videoplayback') !== -1 || s.indexOf('mime=video') !== -1;
  }

  function isCrossOrigin(url) {
    try { return new URL(url, location.href).origin !== location.origin; } catch(e) { return false; }
  }

  function proxyUrl(url) {
    return location.origin + '/cdn/' + encodeUrl(url);
  }

  function getYtVideoId() {
    try {
      var u = new URL(location.href);
      if (u.searchParams.get('v')) return u.searchParams.get('v');
      var m = u.pathname.match(/\\/(?:embed|shorts|live|v|watch)\\/([^/?#]+)/);
      if (m) return m[1];
      if (window.ytplayer && window.ytplayer.config && window.ytplayer.config.args) {
        return window.ytplayer.config.args.video_id || window.ytplayer.config.args.videoId || null;
      }
    } catch (e) {}
    return null;
  }

  function ytStream(itag, vid) {
    vid = vid || getYtVideoId();
    if (!vid) return null;
    // Same-origin stealth path (avoid filter heuristics on "yt-stream"/itag names)
    return location.origin + '/api/m?v=' + encodeURIComponent(vid) + '&i=' + encodeURIComponent(itag || 18);
  }

  function rewritePlayerPayload(text) {
    try {
      var data = JSON.parse(text);
      var vid = (data.videoDetails && data.videoDetails.videoId) || getYtVideoId();
      if (!vid || !data.streamingData) return text;
      function fix(arr) {
        if (!arr) return;
        for (var i = 0; i < arr.length; i++) {
          var f = arr[i];
          if (!f || f.itag == null) continue;
          try { delete f.signatureCipher; } catch (e) {}
          try { delete f.cipher; } catch (e) {}
          f.url = location.origin + '/api/yt-stream?v=' + encodeURIComponent(vid) + '&itag=' + encodeURIComponent(f.itag);
        }
      }
      fix(data.streamingData.formats);
      fix(data.streamingData.adaptiveFormats);
      if (!data.streamingData.formats) data.streamingData.formats = [];
      var has18 = false;
      for (var j = 0; j < data.streamingData.formats.length; j++) {
        if (String(data.streamingData.formats[j].itag) === '18') has18 = true;
      }
      if (!has18) {
        data.streamingData.formats.unshift({
          itag: 18,
          url: location.origin + '/api/yt-stream?v=' + encodeURIComponent(vid) + '&itag=18',
          mimeType: 'video/mp4; codecs="avc1.42001E, mp4a.40.2"',
          qualityLabel: '360p'
        });
      }
      if (data.playabilityStatus) {
        data.playabilityStatus.status = 'OK';
        try { delete data.playabilityStatus.reason; } catch (e) {}
      }
      return JSON.stringify(data);
    } catch (e) { return text; }
  }

  function maybeRewritePlayerResponse(res, reqUrl) {
    var u = String(reqUrl || '');
    if (u.indexOf('/youtubei/') === -1 && u.indexOf('/player') === -1) return Promise.resolve(res);
    var ct = (res.headers.get('content-type') || '');
    if (ct.indexOf('json') === -1 && u.indexOf('player') === -1) return Promise.resolve(res);
    return res.text().then(function(t) {
      var out = rewritePlayerPayload(t);
      var h = new Headers(res.headers);
      h.delete('content-length');
      return new Response(out, { status: res.status, statusText: res.statusText, headers: h });
    }).catch(function() { return res; });
  }

  // Immutable fetch patch
  var _fetch = window.fetch.bind(window);
  var patchedFetch = function(input, init) {
    var url = (typeof input === 'string') ? input : (input instanceof Request ? input.url : String(input));
    // googlevideo ג†’ same-isolate stream when we know the video id
    if (isGV(url)) {
      var s = ytStream(18);
      if (s) {
        return _fetch(s, init || {});
      }
    }
    var finalUrl = url;
    var newInit = init;
    if (isCrossOrigin(url)) {
      finalUrl = proxyUrl(url);
      newInit = Object.assign({}, init || {});
      newInit.credentials = 'same-origin';
      newInit.mode = 'cors';
      if (input instanceof Request) {
        var ri = { method: input.method, headers: input.headers, mode: 'cors', credentials: 'same-origin' };
        if (input.method !== 'GET' && input.method !== 'HEAD') {
          return input.clone().arrayBuffer().then(function(buf) {
            ri.body = buf;
            return _fetch(finalUrl, ri).then(function(res) { return maybeRewritePlayerResponse(res, url); });
          });
        }
        return _fetch(finalUrl, ri).then(function(res) { return maybeRewritePlayerResponse(res, url); });
      }
      return _fetch(finalUrl, newInit).then(function(res) { return maybeRewritePlayerResponse(res, url); });
    }
    return _fetch(input, init).then(function(res) { return maybeRewritePlayerResponse(res, url); });
  };
  try {
    Object.defineProperty(window, 'fetch', { value: patchedFetch, writable: false, configurable: false });
  } catch(e) { window.fetch = patchedFetch; }

  // Immutable XHR patch
  var _xhrOpen = XMLHttpRequest.prototype.open;
  XMLHttpRequest.prototype.open = function(method, url) {
    if (typeof url === 'string' && isCrossOrigin(url)) {
      this._proxied = true;
      arguments[1] = proxyUrl(url);
    }
    return _xhrOpen.apply(this, arguments);
  };
  try { Object.defineProperty(XMLHttpRequest.prototype, 'open', { value: XMLHttpRequest.prototype.open, writable: false, configurable: false }); } catch(e) {}

  var _xhrSend = XMLHttpRequest.prototype.send;
  XMLHttpRequest.prototype.send = function() {
    if (this._proxied) { try { this.withCredentials = false; } catch(e) {} }
    return _xhrSend.apply(this, arguments);
  };
  try { Object.defineProperty(XMLHttpRequest.prototype, 'send', { value: XMLHttpRequest.prototype.send, writable: false, configurable: false }); } catch(e) {}

  // Media element src patches
  function patchSrc(proto) {
    var desc = Object.getOwnPropertyDescriptor(proto, 'src');
    if (desc && desc.set) {
      try {
        Object.defineProperty(proto, 'src', {
          get: desc.get,
          set: function(v) {
            if (typeof v === 'string') {
              if (isGV(v)) {
                var s = ytStream(18);
                if (s) v = s;
              } else if (isCrossOrigin(v)) {
                v = proxyUrl(v);
              }
            }
            return desc.set.call(this, v);
          }
        });
      } catch(e) {}
    }
  }
  if (typeof HTMLMediaElement !== 'undefined') patchSrc(HTMLMediaElement.prototype);
  if (typeof HTMLSourceElement !== 'undefined') patchSrc(HTMLSourceElement.prototype);

  // sendBeacon patch
  if (navigator.sendBeacon) {
    var _beacon = navigator.sendBeacon.bind(navigator);
    navigator.sendBeacon = function(url, data) {
      if (isCrossOrigin(url)) url = proxyUrl(url);
      return _beacon(url, data);
    };
  }

  // ג”€ג”€ YouTube SPA: force reliable player (native YT player always breaks on CF) ג”€ג”€
  function rememberVid(id) {
    if (!id) return;
    try { document.cookie = '__yt_vid=' + encodeURIComponent(id) + '; Path=/; Max-Age=86400; SameSite=Lax; Secure'; } catch (e) {}
    try { sessionStorage.setItem('__yt_vid', id); } catch (e) {}
  }

  function extractIdFromAny(href) {
    if (!href) return null;
    try {
      var u = new URL(href, location.href);
      var v = u.searchParams.get('v');
      if (v) return v;
      var m = u.pathname.match(/\\/(?:embed|shorts|live|v|ytp)\\/([^/?#&]+)/);
      if (m) return m[1];
      if (u.pathname.indexOf('/watch') === 0) return u.searchParams.get('v');
      // /proxy/<encoded> ג†’ decode real target and re-extract
      if (u.pathname.indexOf('/cdn/') === 0) {
        var enc = u.pathname.slice('/cdn/'.length).split('/')[0];
        var decoded = decodeUrl(enc);
        if (decoded) return extractIdFromAny(decoded);
      }
    } catch (e) {}
    return null;
  }

  function goNativePlayer(id, replace) {
    if (!id) return;
    rememberVid(id);
    // Avoid loop on native player page
    if (location.pathname === '/ytp' || location.pathname === '/player' || location.pathname === '/yt-player') return;
    var tok = encodeUrl(JSON.stringify({v:id,i:'18'}));
    var dest = location.origin + '/ytp?d=' + encodeURIComponent(tok);
    if (replace) location.replace(dest);
    else location.assign(dest);
  }

  function checkYtNav() {
    try {
      var id = getYtVideoId() || extractIdFromAny(location.href);
      if (!id) {
        try { id = sessionStorage.getItem('__yt_vid'); } catch (e) {}
      }
      var p = location.pathname || '';
      if (id && (p.indexOf('/watch') === 0 || p.indexOf('/embed/') === 0 || p.indexOf('/shorts/') === 0 || p.indexOf('/live/') === 0 || p.indexOf('/v/') === 0)) {
        goNativePlayer(id, true);
        return true;
      }
    } catch (e) {}
    return false;
  }

  // Immediate redirect if landed on watch via full navigation
  checkYtNav();

  // History API hijack (YouTube SPA)
  try {
    var _push = history.pushState.bind(history);
    var _replace = history.replaceState.bind(history);
    history.pushState = function(state, title, url) {
      var ret = _push(state, title, url);
      setTimeout(checkYtNav, 0);
      return ret;
    };
    history.replaceState = function(state, title, url) {
      var ret = _replace(state, title, url);
      setTimeout(checkYtNav, 0);
      return ret;
    };
  } catch (e) {}
  window.addEventListener('popstate', function() { setTimeout(checkYtNav, 0); });

  // YouTube polymer events
  ['yt-navigate-start', 'yt-navigate-finish', 'yt-page-data-updated', 'yt-navigate-cache'].forEach(function(ev) {
    window.addEventListener(ev, function() { setTimeout(checkYtNav, 0); }, true);
    document.addEventListener(ev, function() { setTimeout(checkYtNav, 0); }, true);
  });

  // Capture clicks on video cards / thumbnails
  document.addEventListener('click', function(e) {
    try {
      var t = e.target;
      if (!t || !t.closest) return;
      var a = t.closest('a[href]');
      if (!a) return;
      var id = extractIdFromAny(a.getAttribute('href') || a.href);
      if (!id) return;
      // Let channel/playlist through unless it's clearly a watch link
      var href = a.getAttribute('href') || '';
      if (href.indexOf('/watch') === -1 && href.indexOf('/shorts/') === -1 && href.indexOf('/embed/') === -1 && href.indexOf('v=') === -1) return;
      e.preventDefault();
      e.stopPropagation();
      e.stopImmediatePropagation();
      goNativePlayer(id, false);
    } catch (err) {}
  }, true);

  // Poll briefly ג€” SPA may mutate URL without history hooks in some builds
  var polls = 0;
  var pollTimer = setInterval(function() {
    polls++;
    if (checkYtNav() || polls > 40) clearInterval(pollTimer);
  }, 250);

  // If stuck on broken movie_player, hard-redirect
  function forceIfBroken() {
    var id = getYtVideoId();
    if (!id) return;
    if (document.querySelector('.ytp-error, .html5-error, .ytp-error-content, .ytp-error-icon')) {
      goNativePlayer(id, true);
    }
  }
  setTimeout(forceIfBroken, 1500);
  setTimeout(forceIfBroken, 4000);

  // Remember id whenever present
  try {
    var bootId = getYtVideoId();
    if (bootId) rememberVid(bootId);
  } catch (e) {}

  // Upgrade getYtVideoId with session fallback for googlevideo rewrites
  var _getYtVideoId = getYtVideoId;
  getYtVideoId = function() {
    var id = _getYtVideoId();
    if (id) { rememberVid(id); return id; }
    try { id = sessionStorage.getItem('__yt_vid'); } catch (e) {}
    if (id) return id;
    try {
      var m = document.cookie.match(/(?:^|;\\s*)__yt_vid=([^;]+)/);
      if (m) return decodeURIComponent(m[1]);
    } catch (e2) {}
    return null;
  };

  // Rewrite same-origin /proxy/* that decode to googlevideo ג†’ yt-stream
  var _patchedFetch = window.fetch;
  window.fetch = function(input, init) {
    try {
      var url = (typeof input === 'string') ? input : (input && input.url) || '';
      var abs = '';
      try { abs = new URL(url, location.href).href; } catch (e0) { abs = url; }
      var real = abs;
      var itag = '18';
      if (abs.indexOf('/cdn/') !== -1) {
        try {
          var pu = new URL(abs, location.href);
          var enc = pu.pathname.slice(pu.pathname.indexOf('/cdn/') + 5).split('/')[0];
          var dec = decodeUrl(enc);
          if (dec) real = dec;
        } catch (e1) {}
      }
      if (isGV(real) || isGV(url)) {
        var vid = getYtVideoId();
        try {
          var gu2 = new URL(real);
          itag = gu2.searchParams.get('itag') || '18';
        } catch (e2) {}
        if (vid) {
          return _patchedFetch(ytStream(itag, vid), init || {});
        }
      }
    } catch (e) {}
    return _patchedFetch(input, init);
  };

  // Register SW
  if ('serviceWorker' in navigator && !navigator.serviceWorker.controller) {
    navigator.serviceWorker.register('/sw.js?v=${SW_VERSION}', { scope: '/' }).then(function() {
      return navigator.serviceWorker.ready;
    }).then(function() {
      if (!sessionStorage.getItem('sw_ok_v${SW_VERSION}')) {
        sessionStorage.setItem('sw_ok_v${SW_VERSION}', '1');
        window.location.reload();
      }
    }).catch(function() {});
  } else if ('serviceWorker' in navigator) {
    // Ensure latest SW
    navigator.serviceWorker.getRegistration().then(function(reg) {
      if (reg) reg.update();
    }).catch(function() {});
  }
})();
</script>`;

// ג”€ג”€ג”€ Section 7: Home Page UI ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€

// ─── Shared design system ────────────────────────────────────────────────────
// One token set for every page we render ourselves (home, search, player shell), so the
// whole proxy looks like a single modern product instead of five different eras.
const UI_CSS = `
:root{
  --bg:#070b18; --bg-soft:#0b1122; --panel:rgba(255,255,255,.045); --panel-2:rgba(255,255,255,.075);
  --stroke:rgba(255,255,255,.09); --stroke-2:rgba(255,255,255,.16);
  --ink:#f2f5ff; --ink-2:#a8b3cf; --ink-3:#6b7695;
  --brand:#6d5efc; --brand-2:#a855f7; --mint:#2dd4bf; --rose:#fb7185; --amber:#fbbf24;
  --link:#c9d3ff; --host:#5eead4;
  --r-sm:10px; --r:14px; --r-lg:20px; --r-xl:28px;
  --shadow:0 18px 50px -22px rgba(0,0,0,.85);
  --ease:cubic-bezier(.22,1,.36,1);
}
html.light{
  --bg:#f6f7fc; --bg-soft:#eef1fa; --panel:rgba(255,255,255,.82); --panel-2:#ffffff;
  --stroke:rgba(15,23,42,.09); --stroke-2:rgba(15,23,42,.16);
  --ink:#0d1224; --ink-2:#4a5578; --ink-3:#8b95b2;
  --brand:#5b4bf0; --brand-2:#9333ea; --link:#2b3ba8; --host:#0d9488;
  --shadow:0 18px 45px -25px rgba(20,25,60,.45);
}
*{box-sizing:border-box}
html,body{margin:0;padding:0}
body{
  background:var(--bg); color:var(--ink); min-height:100vh;
  font-family:'Assistant','Rubik','Heebo',system-ui,'Segoe UI',Arial,sans-serif;
  line-height:1.6; -webkit-font-smoothing:antialiased;
  overflow-x:hidden;
}
/* Aurora mesh — pure CSS, no images, no external requests */
body::before{
  content:''; position:fixed; inset:0; z-index:-2; pointer-events:none;
  background:
    radial-gradient(60rem 34rem at 78% -8%, color-mix(in srgb, var(--brand) 40%, transparent) 0%, transparent 62%),
    radial-gradient(48rem 30rem at 8% 4%, color-mix(in srgb, var(--brand-2) 32%, transparent) 0%, transparent 60%),
    radial-gradient(46rem 30rem at 50% 108%, color-mix(in srgb, var(--mint) 22%, transparent) 0%, transparent 60%);
  opacity:.75;
}
body::after{
  content:''; position:fixed; inset:0; z-index:-1; pointer-events:none;
  background-image:radial-gradient(circle at 1px 1px, color-mix(in srgb, var(--ink) 9%, transparent) 1px, transparent 0);
  background-size:26px 26px; opacity:.5;
  -webkit-mask-image:radial-gradient(70% 55% at 50% 0%, #000 0%, transparent 100%);
  mask-image:radial-gradient(70% 55% at 50% 0%, #000 0%, transparent 100%);
}
a{color:inherit}
::selection{background:color-mix(in srgb, var(--brand) 45%, transparent)}
:focus-visible{outline:2px solid var(--brand); outline-offset:3px; border-radius:6px}

.glass{
  background:var(--panel); border:1px solid var(--stroke);
  backdrop-filter:blur(20px) saturate(170%); -webkit-backdrop-filter:blur(20px) saturate(170%);
}
.wordmark{
  display:inline-flex; align-items:center; gap:.5rem; text-decoration:none;
  font-weight:800; font-size:1.15rem; letter-spacing:-.5px; white-space:nowrap;
}
.wordmark .mark{
  width:32px; height:32px; border-radius:11px; flex:none;
  display:grid; place-items:center; font-size:1rem; color:#fff;
  background:linear-gradient(135deg,var(--brand),var(--brand-2));
  box-shadow:0 6px 18px -6px var(--brand);
}
.wordmark .txt{background:linear-gradient(120deg,var(--ink),var(--ink-2));-webkit-background-clip:text;background-clip:text;-webkit-text-fill-color:transparent}

/* ── Google-style search bar ────────────────────────────────────────────────
   Same form factor as Google's: a 24px-radius pill that drops its border and
   raises a shadow on hover/focus, with the suggestion list fused to the bottom
   of the box so the two read as one surface. */
.gwrap{position:relative; width:100%; max-width:584px; margin:0 auto}
.gwrap.wide{max-width:none; margin:0}
.gbar{
  display:flex; align-items:center; gap:.6rem;
  background:var(--panel-2); border:1px solid var(--stroke); border-radius:24px;
  padding:0 .95rem; height:46px; position:relative; z-index:2;
  transition:box-shadow .18s var(--ease), border-color .18s var(--ease), background .18s;
}
.gwrap:hover .gbar, .gbar:focus-within{
  border-color:transparent; background:var(--panel-2);
  box-shadow:0 1px 10px rgba(0,0,0,.42), 0 0 0 1px var(--stroke);
}
html.light .gwrap:hover .gbar, html.light .gbar:focus-within{box-shadow:0 1px 8px rgba(32,33,36,.28)}
.gwrap.open .gbar{border-radius:24px 24px 0 0; border-bottom-color:transparent; box-shadow:0 1px 10px rgba(0,0,0,.42)}
.gbar .gico{flex:none; width:20px; height:20px; color:var(--ink-3)}
.gbar input{
  flex:1; min-width:0; border:0; outline:0; background:transparent; color:var(--ink);
  font:inherit; font-size:1rem; height:100%; padding:0;
}
.gbar input::placeholder{color:var(--ink-3)}
.gbar input::-webkit-search-cancel-button{display:none}
.gbar .gclear{
  flex:none; width:28px; height:28px; border:0; border-radius:50%; cursor:pointer;
  background:transparent; color:var(--ink-3); font-size:1.15rem; line-height:1; display:none;
  align-items:center; justify-content:center;
}
.gbar .gclear:hover{background:var(--panel); color:var(--ink)}
.gwrap.filled .gbar .gclear{display:flex}
.gbar .gdiv{flex:none; width:1px; height:24px; background:var(--stroke)}
.gbar .gsubmit{
  flex:none; border:0; background:transparent; cursor:pointer; color:var(--brand);
  width:30px; height:30px; border-radius:50%; display:grid; place-items:center;
}
.gbar .gsubmit:hover{background:color-mix(in srgb, var(--brand) 16%, transparent)}
.gbar .gsubmit svg{width:20px; height:20px}

/* Suggestions */
.gsug{
  display:none; position:absolute; inset-inline:0; top:calc(46px - 1px); z-index:1;
  background:var(--panel-2); border:1px solid var(--stroke); border-top:0;
  border-radius:0 0 24px 24px; padding:.35rem 0 .6rem; overflow:hidden;
  box-shadow:0 4px 10px rgba(0,0,0,.42);
}
.gwrap.open .gsug{display:block}
.gsug b{font-weight:700}
.gsug .row{
  display:flex; align-items:center; gap:.7rem; padding:.42rem 1.05rem; cursor:pointer;
  color:var(--ink); font-size:.98rem; white-space:nowrap; overflow:hidden; text-overflow:ellipsis;
}
.gsug .row svg{flex:none; width:16px; height:16px; color:var(--ink-3)}
.gsug .row:hover, .gsug .row.sel{background:var(--panel)}
.gbtns{display:flex; gap:.7rem; justify-content:center; margin-top:1.6rem; flex-wrap:wrap}
.gbtn{
  border:1px solid transparent; background:var(--panel); color:var(--ink);
  border-radius:6px; padding:0 1.1rem; height:38px; font:inherit; font-size:.9rem;
  cursor:pointer; transition:border-color .15s, box-shadow .15s, background .15s;
}
.gbtn:hover{border-color:var(--stroke-2); box-shadow:0 1px 3px rgba(0,0,0,.25); background:var(--panel-2)}

/* Search field (compact, legacy) */
.field{display:flex; align-items:center; gap:.5rem; flex:1; min-width:0}
.field .box{
  position:relative; display:flex; align-items:center; flex:1; min-width:0;
  background:color-mix(in srgb, var(--bg-soft) 82%, transparent);
  border:1px solid var(--stroke); border-radius:999px;
  transition:border-color .2s var(--ease), box-shadow .2s var(--ease), transform .2s var(--ease);
}
.field .box:focus-within{
  border-color:color-mix(in srgb, var(--brand) 70%, transparent);
  box-shadow:0 0 0 4px color-mix(in srgb, var(--brand) 22%, transparent);
}
.field svg.mag{position:absolute; inset-inline-start:.95rem; width:19px; height:19px; opacity:.55; pointer-events:none}
.field input{
  flex:1; min-width:0; width:100%; border:0; outline:0; background:transparent; color:var(--ink);
  font:inherit; font-size:1.02rem; padding:.78rem 1rem .78rem 2.75rem;
}
.field input::placeholder{color:var(--ink-3)}
.btn{
  border:0; cursor:pointer; font:inherit; font-weight:700; color:#fff;
  background:linear-gradient(135deg,var(--brand),var(--brand-2));
  border-radius:999px; padding:.78rem 1.4rem; white-space:nowrap;
  box-shadow:0 8px 22px -10px var(--brand);
  transition:transform .2s var(--ease), box-shadow .2s var(--ease), filter .2s var(--ease);
}
.btn:hover{transform:translateY(-1px); filter:brightness(1.07); box-shadow:0 12px 28px -10px var(--brand)}
.btn:active{transform:translateY(0)}
.btn.ghost{background:var(--panel); color:var(--ink); border:1px solid var(--stroke); box-shadow:none}
.btn.ghost:hover{background:var(--panel-2); border-color:var(--stroke-2)}

.icon-btn{
  width:42px; height:42px; flex:none; border-radius:50%; cursor:pointer;
  display:grid; place-items:center; color:var(--ink);
  background:var(--panel); border:1px solid var(--stroke);
  transition:transform .25s var(--ease), background .2s, border-color .2s;
}
.icon-btn:hover{background:var(--panel-2); border-color:var(--stroke-2); transform:rotate(-12deg) scale(1.06)}
.icon-btn svg{width:20px; height:20px}
@media (prefers-reduced-motion:reduce){*{animation:none!important;transition:none!important}}
`;

// Markup for the Google-style bar. `wide` drops the 584px cap for the results header.
function searchBarHtml(query, opts = {}) {
  const ph = opts.placeholder || 'חפשו ברשת או הקלידו כתובת אתר…';
  return `<div class="gwrap${opts.wide ? ' wide' : ''}${query ? ' filled' : ''}" id="gwrap">
  <div class="gbar">
    <svg class="gico" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round"><circle cx="11" cy="11" r="7"/><path d="m21 21-4.3-4.3"/></svg>
    <input id="gq" type="text" value="${htmlEscape(query)}" placeholder="${htmlEscape(ph)}"
      autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false"
      role="combobox" aria-autocomplete="list" aria-expanded="false" aria-controls="gsug"${opts.autofocus ? ' autofocus' : ''}/>
    <button class="gclear" type="button" id="gclear" aria-label="נקה" title="נקה">✕</button>
    <span class="gdiv"></span>
    <button class="gsubmit" type="button" id="gsubmit" aria-label="חפש" title="חפש">
      <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round"><circle cx="11" cy="11" r="7"/><path d="m21 21-4.3-4.3"/></svg>
    </button>
  </div>
  <div class="gsug" id="gsug" role="listbox"></div>
</div>`;
}

// Autocomplete + keyboard behaviour, shared by the home page and the results header.
// The host page supplies submitQuery(text); this only owns the box itself.
const SEARCH_BAR_JS = `
(function(){
  var wrap=document.getElementById('gwrap'), input=document.getElementById('gq');
  var sug=document.getElementById('gsug'), clear=document.getElementById('gclear');
  var submit=document.getElementById('gsubmit');
  if(!wrap||!input) return;
  var items=[], sel=-1, timer=null, lastQ=null, seq=0;
  var MAG='<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round"><circle cx="11" cy="11" r="7"/><path d="m21 21-4.3-4.3"/></svg>';
  function esc(s){return String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;');}
  function setFilled(){ wrap.classList.toggle('filled', input.value.length>0); }
  function close(){ wrap.classList.remove('open'); input.setAttribute('aria-expanded','false'); sel=-1; }
  function open(){ if(items.length){ wrap.classList.add('open'); input.setAttribute('aria-expanded','true'); } else close(); }
  function paint(){
    var q=input.value.trim().toLowerCase();
    sug.innerHTML=items.map(function(s,i){
      var h=esc(s);
      if(q && s.toLowerCase().indexOf(q)===0) h='<span>'+esc(s.slice(0,q.length))+'</span><b>'+esc(s.slice(q.length))+'</b>';
      return '<div class="row'+(i===sel?' sel':'')+'" role="option" data-i="'+i+'">'+MAG+'<span>'+h+'</span></div>';
    }).join('');
  }
  function fetchSug(){
    var q=input.value.trim();
    if(q.length<1||q===lastQ){ if(!q){items=[];close();} return; }
    lastQ=q; var my=++seq;
    fetch('/api/suggest?q='+encodeURIComponent(q),{credentials:'same-origin'})
      .then(function(r){return r.ok?r.json():null})
      .then(function(j){
        if(my!==seq) return;
        items=(j&&j.suggestions)||[]; sel=-1; paint(); open();
      }).catch(function(){});
  }
  input.addEventListener('input',function(){ setFilled(); clearTimeout(timer); timer=setTimeout(fetchSug,120); });
  input.addEventListener('focus',function(){ if(items.length) open(); });
  input.addEventListener('keydown',function(e){
    if(e.key==='ArrowDown'||e.key==='ArrowUp'){
      if(!items.length) return;
      e.preventDefault(); open();
      sel = e.key==='ArrowDown' ? (sel+1)%items.length : (sel<=0?items.length-1:sel-1);
      paint(); input.value=items[sel]; setFilled();
    } else if(e.key==='Enter'){
      e.preventDefault(); close(); submitQuery(input.value);
    } else if(e.key==='Escape'){ close(); }
  });
  sug.addEventListener('mousedown',function(e){
    var row=e.target.closest && e.target.closest('.row'); if(!row) return;
    e.preventDefault(); input.value=items[parseInt(row.getAttribute('data-i'),10)]||input.value;
    close(); submitQuery(input.value);
  });
  document.addEventListener('click',function(e){ if(!wrap.contains(e.target)) close(); });
  if(clear) clear.addEventListener('click',function(){ input.value=''; items=[]; setFilled(); close(); input.focus(); });
  if(submit) submit.addEventListener('click',function(){ close(); submitQuery(input.value); });
  setFilled();
})();
`;

const UI_HTML = `<!DOCTYPE html>
<html lang="he" dir="rtl">
<head>
<meta charset="UTF-8"/>
<meta name="viewport" content="width=device-width, initial-scale=1.0"/>
<meta name="robots" content="noindex,nofollow"/>
<meta name="referrer" content="no-referrer"/>
<meta name="color-scheme" content="dark light"/>
<title>מעקף · דפדפן חופשי</title>
<script>(function(){var s=localStorage.getItem('theme');var l=window.matchMedia('(prefers-color-scheme: light)').matches;if(s==='light'||(!s&&l))document.documentElement.classList.add('light');})();</script>
<style>
${UI_CSS}
.shell{position:relative; z-index:1; max-width:900px; margin:0 auto; padding:1.25rem 1.25rem 3rem;
  min-height:100vh; display:flex; flex-direction:column}
.nav{display:flex; align-items:center; justify-content:space-between; gap:.75rem}
.nav-right{display:flex; align-items:center; gap:.5rem}
.pill{display:inline-flex; align-items:center; gap:.4rem; text-decoration:none; font-size:.83rem; font-weight:600;
  color:var(--ink-2); background:var(--panel); border:1px solid var(--stroke); border-radius:999px; padding:.42rem .85rem;
  transition:color .2s, border-color .2s, background .2s}
.pill:hover{color:var(--ink); border-color:var(--stroke-2); background:var(--panel-2)}

.hero{text-align:center; margin:3.4rem 0 2.1rem}
.hero h1{font-size:clamp(2.6rem,8vw,4.2rem); font-weight:800; letter-spacing:-2px; line-height:1; margin:0 0 .7rem;
  background:linear-gradient(115deg,#c7d2fe 0%,var(--brand) 42%,var(--mint) 100%);
  -webkit-background-clip:text; background-clip:text; -webkit-text-fill-color:transparent;
  filter:drop-shadow(0 6px 26px color-mix(in srgb, var(--brand) 35%, transparent))}
html.light .hero h1{background:linear-gradient(115deg,#4338ca 0%,var(--brand) 45%,#0f766e 100%);
  -webkit-background-clip:text; background-clip:text; -webkit-text-fill-color:transparent}
.hero p{margin:0; color:var(--ink-2); font-size:1.06rem; font-weight:400}

.searchwrap{max-width:640px; margin:0 auto; width:100%}
.searchwrap .field .box{border-radius:var(--r-xl); padding:.22rem}
.searchwrap .field input{font-size:1.08rem; padding:.85rem 1rem .85rem 3rem}
.searchwrap .field svg.mag{inset-inline-start:1.1rem; width:20px; height:20px}
.modes{display:flex; gap:.4rem; justify-content:center; flex-wrap:wrap; margin-top:.95rem}
.mode{display:inline-flex; align-items:center; gap:.35rem; cursor:pointer; user-select:none;
  font-size:.85rem; font-weight:600; color:var(--ink-2); border-radius:999px; padding:.38rem .82rem;
  background:var(--panel); border:1px solid var(--stroke); transition:all .2s var(--ease)}
.mode:hover{color:var(--ink); border-color:var(--stroke-2)}
.mode.on{color:#fff; background:linear-gradient(135deg,var(--brand),var(--brand-2)); border-color:transparent;
  box-shadow:0 8px 20px -10px var(--brand)}
.hint{text-align:center; color:var(--ink-3); font-size:.82rem; margin-top:.85rem}
.hint kbd{background:var(--panel); border:1px solid var(--stroke); border-radius:6px; padding:.1rem .4rem; font:inherit; font-size:.75rem}

.sect{margin-top:3.2rem}
.sect h2{display:flex; align-items:center; gap:.75rem; font-size:.78rem; font-weight:800; letter-spacing:2px;
  text-transform:uppercase; color:var(--ink-3); margin:0 0 1.1rem}
.sect h2::after{content:''; flex:1; height:1px; background:var(--stroke)}
.tiles{display:grid; grid-template-columns:repeat(auto-fill,minmax(124px,1fr)); gap:.85rem}
.tile{display:flex; flex-direction:column; align-items:center; gap:.6rem; text-decoration:none; cursor:pointer;
  color:var(--ink-2); padding:1.15rem .7rem 1rem; border-radius:var(--r-lg);
  background:var(--panel); border:1px solid var(--stroke); position:relative; overflow:hidden;
  transition:transform .25s var(--ease), border-color .25s, box-shadow .25s, color .25s}
.tile::before{content:''; position:absolute; inset:0; opacity:0; transition:opacity .25s;
  background:radial-gradient(120% 80% at 50% 0%, var(--tint,transparent) 0%, transparent 70%)}
.tile:hover{transform:translateY(-5px); color:var(--ink); border-color:var(--stroke-2);
  box-shadow:0 16px 34px -18px var(--tint, rgba(109,94,252,.6))}
.tile:hover::before{opacity:1}
.tile .ic{width:46px; height:46px; border-radius:14px; display:grid; place-items:center; font-size:1.45rem;
  background:color-mix(in srgb, var(--ink) 7%, transparent); border:1px solid var(--stroke);
  transition:transform .25s var(--ease)}
.tile:hover .ic{transform:scale(1.09) rotate(-6deg)}
.tile span{font-size:.85rem; font-weight:700; text-align:center; position:relative}

.facts{display:flex; flex-wrap:wrap; gap:.6rem; justify-content:center; margin-top:auto; padding-top:2.6rem}
.fact{display:inline-flex; align-items:center; gap:.5rem; font-size:.82rem; font-weight:600; color:var(--ink-2);
  background:var(--panel); border:1px solid var(--stroke); border-radius:999px; padding:.45rem .9rem}
.fact i{width:7px; height:7px; border-radius:50%; display:block}
@media(max-width:560px){
  .tiles{grid-template-columns:repeat(3,1fr); gap:.6rem}
  .hero{margin:2rem 0 1.6rem}
  .shell{padding-top:.85rem}
}
</style>
</head>
<body>
<div class="shell">
  <nav class="nav">
    <a class="wordmark" href="/"><span class="mark">⚡</span><span class="txt">מעקף</span></a>
    <div class="nav-right">
      <a class="pill" href="/cdn/CRoAGRRITlkQAFQMHkdHCRcVWQ">📥 הורדת סרטונים</a>
      <a class="pill" href="/import-cookies">🍪 עוגיות</a>
      <a class="pill" href="/ytp">▶️ נגן</a>
      <button class="icon-btn" type="button" onclick="toggleTheme()" aria-label="החלף ערכת נושא">
        <svg class="i-sun" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round"><circle cx="12" cy="12" r="4.5"/><path d="M12 2v2M12 20v2M4.9 4.9l1.4 1.4M17.7 17.7l1.4 1.4M2 12h2M20 12h2M4.9 19.1l1.4-1.4M17.7 6.3l1.4-1.4"/></svg>
        <svg class="i-moon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round"><path d="M21 12.8A9 9 0 1 1 11.2 3a7 7 0 0 0 9.8 9.8z"/></svg>
      </button>
    </div>
  </nav>

  <header class="hero">
    <h1>מעקף</h1>
    <p>חיפוש אמיתי, וידאו ותמונות — בלי אימות "אני לא רובוט", בלי מעקב.</p>
  </header>

  <div class="searchwrap">
    ${searchBarHtml('', { autofocus: true })}
    <div class="gbtns">
      <button class="gbtn" type="button" onclick="submitQuery(document.getElementById('gq').value)">חיפוש במעקף</button>
      <button class="gbtn" type="button" onclick="lucky()">מרגיש בר מזל</button>
    </div>
    <div class="modes" id="modes">
      <label class="mode on" data-t="web">🔎 הכל</label>
      <label class="mode" data-t="images">🖼️ תמונות</label>
      <label class="mode" data-t="videos">🎬 וידאו</label>
      <label class="mode" data-t="news">📰 חדשות</label>
    </div>
    <div class="hint"><kbd>Enter</kbd> לחיפוש · כתובת מלאה נפתחת ישירות דרך המעקף</div>
  </div>

  <section class="sect">
    <h2>גישה מהירה</h2>
    <div class="tiles">
      <a class="tile" href="/cdn/CRoAGRRITlkQAFQMHkdHCRcVWQ" style="--tint:rgba(239,68,68,.35)"><span class="ic">📥</span><span>הורדת סרטוני YouTube</span></a>
      <a class="tile" href="/ytp" style="--tint:rgba(255,0,0,.28)"><span class="ic">▶️</span><span>נגן YouTube</span></a>
      <a class="tile" href="/websearch?t=images" style="--tint:rgba(168,85,247,.28)"><span class="ic">🖼️</span><span>תמונות</span></a>
      <a class="tile" href="/websearch?t=news" style="--tint:rgba(45,212,191,.28)"><span class="ic">📰</span><span>חדשות</span></a>
      <a class="tile" href="javascript:void(0)" onclick="goTo('https://he.wikipedia.org')" style="--tint:rgba(148,163,184,.28)"><span class="ic">📖</span><span>ויקיפדיה עברית</span></a>
      <a class="tile" href="javascript:void(0)" onclick="goTo('https://www.ynet.co.il')" style="--tint:rgba(239,68,68,.28)"><span class="ic">🗞️</span><span>Ynet</span></a>
      <a class="tile" href="javascript:void(0)" onclick="goTo('https://www.mako.co.il')" style="--tint:rgba(139,92,246,.28)"><span class="ic">📺</span><span>Mako</span></a>
      <a class="tile" href="javascript:void(0)" onclick="goTo('https://www.reddit.com')" style="--tint:rgba(255,69,0,.28)"><span class="ic">💬</span><span>Reddit</span></a>
      <a class="tile" href="javascript:void(0)" onclick="goTo('https://www.instagram.com')" style="--tint:rgba(236,72,153,.28)"><span class="ic">📸</span><span>Instagram</span></a>
      <a class="tile" href="javascript:void(0)" onclick="goTo('https://x.com')" style="--tint:rgba(59,130,246,.28)"><span class="ic">🐦</span><span>X</span></a>
      <a class="tile" href="javascript:void(0)" onclick="goTo('https://www.facebook.com')" style="--tint:rgba(37,99,235,.28)"><span class="ic">👥</span><span>Facebook</span></a>
      <a class="tile" href="javascript:void(0)" onclick="goTo('https://www.tiktok.com')" style="--tint:rgba(148,163,184,.3)"><span class="ic">🎵</span><span>TikTok</span></a>
      <a class="tile" href="/import-cookies" style="--tint:rgba(245,158,11,.28)"><span class="ic">🍪</span><span>ייבוא עוגיות</span></a>
    </div>
  </section>

  <div class="facts">
    <div class="fact"><i style="background:#818cf8"></i>ערפול XOR מלא</div>
    <div class="fact"><i style="background:#34d399"></i>חסין לסינון SSL</div>
    <div class="fact"><i style="background:#f472b6"></i>טעינה מקצה הרשת</div>
    <div class="fact"><i style="background:#fbbf24"></i>ללא מעקב והיסטוריה</div>
  </div>
</div>

<script>
if ('serviceWorker' in navigator) {
  navigator.serviceWorker.register('/sw.js?v=${SW_VERSION}', { scope: '/' }).then(function() {
    return navigator.serviceWorker.ready;
  }).then(function() {
    if (!sessionStorage.getItem('sw_ok_v${SW_VERSION}')) {
      sessionStorage.setItem('sw_ok_v${SW_VERSION}', '1');
      window.location.reload();
    }
  }).catch(function(){});
}

var KEY = [97, 110, 116, 105, 103, 114, 97, 118, 105, 116, 121];
function encodeUrl(url) {
  if (!url) return '';
  var data = new TextEncoder().encode(url);
  for (var i = 0; i < data.length; i++) data[i] = data[i] ^ KEY[i % KEY.length];
  var binary = '';
  for (var i = 0; i < data.length; i += 8192) {
    binary += String.fromCharCode.apply(null, data.subarray(i, Math.min(i + 8192, data.length)));
  }
  return btoa(binary).replace(/[+]/g, '-').replace(/[/]/g, '_').replace(/=+$/, '');
}

var mode = 'web';
document.getElementById('modes').addEventListener('click', function(e) {
  var el = e.target.closest('.mode');
  if (!el) return;
  mode = el.getAttribute('data-t');
  Array.prototype.forEach.call(document.querySelectorAll('.mode'), function(m) {
    m.classList.toggle('on', m === el);
  });
  document.getElementById('gq').focus();
});

function isUrl(s) {
  if (/^https?:\\/\\//i.test(s)) return true;
  if (s.indexOf(' ') !== -1) return false;
  return /^[a-zA-Z0-9\\-]+(\\.[a-zA-Z]{2,})+/.test(s);
}

function setTargetAndGo(url) {
  try {
    var u = new URL(url);
    var host = (u.hostname || '').toLowerCase();
    var vid = null;
    if (host.indexOf('youtu.be') !== -1) {
      vid = u.pathname.replace(/^\\//, '').split('/')[0] || null;
    } else if (u.searchParams.get('v')) {
      vid = u.searchParams.get('v');
    } else {
      var mm = u.pathname.match(/[/](?:embed|shorts|live|v)[/]([^/?#]+)/);
      if (mm) vid = mm[1];
    }
    // The full YouTube SPA is unreliable through the proxy — always use the sealed player.
    if (host.indexOf('youtube') !== -1 || host.indexOf('youtu.be') !== -1) {
      if (vid) { window.location.href = '/ytp?v=' + encodeURIComponent(vid); return; }
      var sq = u.searchParams.get('search_query') || u.searchParams.get('q') || '';
      window.location.href = sq ? ('/ytp?q=' + encodeURIComponent(sq)) : '/ytp';
      return;
    }
    document.cookie = '__proxy_target=' + encodeURIComponent(u.origin) + '; Path=/; max-age=31536000; SameSite=Lax; Secure';
    window.location.href = '/gate?to=' + encodeURIComponent(encodeUrl(u.href));
  } catch (e) {
    window.location.href = '/gate?to=' + encodeURIComponent(encodeUrl(url));
  }
}

function submitQuery(text) {
  var raw = String(text || '').trim();
  if (!raw) return false;
  if (isUrl(raw)) {
    setTargetAndGo(/^https?:[/][/]/i.test(raw) ? raw : 'https://' + raw);
  } else {
    // Never hand the query to a foreign engine UI — our own results page has no CAPTCHA.
    window.location.href = '/websearch?q=' + encodeURIComponent(raw) + '&t=' + mode;
  }
  return false;
}
function lucky() {
  var raw = (document.getElementById('gq').value || '').trim();
  if (!raw) return;
  if (isUrl(raw)) { submitQuery(raw); return; }
  window.location.href = '/websearch?q=' + encodeURIComponent(raw) + '&t=' + mode + '&lucky=1';
}
function goTo(url) { setTargetAndGo(url); }

function toggleTheme() {
  var light = document.documentElement.classList.toggle('light');
  try { localStorage.setItem('theme', light ? 'light' : 'dark'); } catch (e) {}
  paintTheme();
}
function paintTheme() {
  var light = document.documentElement.classList.contains('light');
  var s = document.querySelector('.i-sun'), m = document.querySelector('.i-moon');
  if (s) s.style.display = light ? 'block' : 'none';
  if (m) m.style.display = light ? 'none' : 'block';
}
paintTheme();
${SEARCH_BAR_JS}
</script>
</body>
</html>`;

// ─── Section 8: Import Cookies Page ──────────────────────────────────────────

function importCookiesForm() {
  return new Response(`<!DOCTYPE html>
<html lang="he" dir="rtl">
<head>
  <meta charset="UTF-8">
  <meta name="viewport" content="width=device-width, initial-scale=1.0">
  <title>ייבוא עוגיות – מעקף</title>
  <link href="https://fonts.googleapis.com/css2?family=Assistant:wght@300;400;600;700&family=Outfit:wght@400;600;800&display=swap" rel="stylesheet">
  <style>
    :root {
        --bg: #07070f;
        --surface: rgba(255, 255, 255, 0.03);
        --surface-hover: rgba(255, 255, 255, 0.07);
        --surface-glass: rgba(13, 13, 25, 0.6);
        --border: rgba(255, 255, 255, 0.08);
        --border-focus: rgba(99, 102, 241, 0.6);
        --primary: #6366f1;
        --primary-glow: rgba(99, 102, 241, 0.3);
        --accent: #10b981;
        --text: #f8fafc;
        --text-muted: #94a3b8;
        --text-dim: #475569;
        --input-bg: rgba(0, 0, 0, 0.3);
    }
    html.light {
        --bg: #f5f8fa;
        --surface: rgba(15, 23, 42, 0.03);
        --surface-hover: rgba(15, 23, 42, 0.06);
        --surface-glass: rgba(255, 255, 255, 0.7);
        --border: rgba(15, 23, 42, 0.08);
        --border-focus: rgba(79, 70, 229, 0.6);
        --primary: #4f46e5;
        --primary-glow: rgba(79, 70, 229, 0.2);
        --accent: #10b981;
        --text: #0f172a;
        --text-muted: #475569;
        --text-dim: #94a3b8;
        --input-bg: rgba(255, 255, 255, 0.8);
    }
    * { box-sizing: border-box; margin: 0; padding: 0; }
    body {
        font-family: 'Assistant', sans-serif; background: var(--bg); color: var(--text);
        display: flex; justify-content: center; align-items: center; min-height: 100vh;
        padding: 1.5rem; transition: background 0.3s, color 0.3s;
    }
    
    /* Background blobs */
    .blobs { position: fixed; top: 0; left: 0; width: 100%; height: 100%; z-index: 0; pointer-events: none; }
    .blob { position: absolute; border-radius: 50%; filter: blur(120px); opacity: 0.3; }
    .blob-1 { width: 400px; height: 400px; background: radial-gradient(circle, var(--primary) 0%, transparent 70%); top: 10%; left: 10%; }
    .blob-2 { width: 400px; height: 400px; background: radial-gradient(circle, var(--accent) 0%, transparent 70%); bottom: 10%; right: 10%; }

    .card {
        position: relative; z-index: 1; width: 100%; max-width: 620px;
        background: var(--surface-glass);
        backdrop-filter: blur(24px) saturate(180%);
        -webkit-backdrop-filter: blur(24px) saturate(180%);
        border: 1px solid var(--border);
        border-radius: 24px; padding: 2.5rem;
        box-shadow: 0 20px 50px -15px rgba(0, 0, 0, 0.3);
    }
    h1 {
        font-family: 'Outfit', sans-serif; font-size: 2rem; font-weight: 800;
        background: linear-gradient(135deg, #a5b4fc 0%, var(--primary) 60%, var(--accent) 100%);
        -webkit-background-clip: text; -webkit-text-fill-color: transparent;
        margin-bottom: 0.5rem;
    }
    p { color: var(--text-muted); font-size: 1rem; margin-bottom: 2rem; font-weight: 300; }
    h3 { color: var(--text-muted); font-size: 0.95rem; font-weight: 600; margin-bottom: 0.6rem; text-transform: uppercase; letter-spacing: 0.5px; }
    
    textarea, input[type="text"] {
        width: 100%; background: var(--input-bg); border: 1px solid var(--border);
        border-radius: 12px; color: var(--text); padding: 12px 16px;
        font-size: 0.95rem; box-sizing: border-box; margin-bottom: 1.5rem;
        outline: none; transition: all 0.3s;
    }
    textarea { height: 180px; font-family: monospace; resize: vertical; }
    textarea:focus, input[type="text"]:focus {
        border-color: var(--border-focus);
        box-shadow: 0 0 0 3px var(--primary-glow);
    }
    .back-btn {
        display: inline-flex; align-items: center; gap: 8px; color: var(--text-muted);
        text-decoration: none; font-size: 0.95rem; margin-bottom: 1.5rem;
        transition: color 0.2s; font-weight: 600;
    }
    .back-btn:hover { color: var(--primary); }
    button[type="submit"] {
        width: 100%; background: var(--primary); color: #fff; border: none;
        padding: 14px; border-radius: 12px; font-size: 1.05rem; font-weight: 700;
        cursor: pointer; transition: all 0.3s;
        box-shadow: 0 4px 15px var(--primary-glow);
        font-family: 'Assistant', sans-serif;
    }
    button[type="submit"]:hover {
        background: #4f46e5;
        transform: translateY(-2px);
        box-shadow: 0 6px 20px var(--primary-glow);
    }
    button[type="submit"]:active { transform: translateY(0); }
  </style>
  <script>
      (function() {
          var s = localStorage.getItem('theme');
          var l = window.matchMedia('(prefers-color-scheme: light)').matches;
          if (s === 'light' || (!s && l)) document.documentElement.classList.add('light');
      })();
  </script>
</head>
<body>
  <div class="blobs">
      <div class="blob blob-1"></div>
      <div class="blob blob-2"></div>
  </div>
  <div class="card">
    <a href="/" class="back-btn">
        <svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="19" y1="12" x2="5" y2="12"></line><polyline points="12 19 5 12 12 5"></polyline></svg>
        <span>חזרה לדף הבית</span>
    </a>
    <h1>ייבוא Session מלא לפרוקסי</h1>
    <p>הכנס את העוגיות כדי לקבל גישה מלאה לסרטונים חסומים ביוטיוב.</p>
    <form method="POST">
      <h3>0. דומיין יעד (למשל: youtube.com)</h3>
      <input type="text" name="target_domain" value="youtube.com" autocomplete="off" spellcheck="false" />
      
      <h3>1. עוגיות (Netscape Format או Raw Cookie Header)</h3>
      <textarea name="cookies" placeholder="# Netscape HTTP Cookie File..." autocomplete="off" spellcheck="false"></textarea>
      
      <h3>2. LocalStorage (JSON Format)</h3>
      <textarea name="localstorage" style="height: 100px;" placeholder='{"key": "value"}' autocomplete="off" spellcheck="false"></textarea>
      
      <button type="submit">ייבא נתונים והתחבר</button>
      <a href="/import-cookies?clear=1" style="display: block; text-align: center; margin-top: 1.25rem; color: #ef4444; text-decoration: none; font-weight: 600; font-size: 0.95rem; transition: color 0.2s;" onmouseover="this.style.color='#f87171'" onmouseout="this.style.color='#ef4444'">נקה עוגיות שמורות (איפוס מלא)</a>
    </form>
  </div>
</body>
</html>`, { headers: { 'Content-Type': 'text/html; charset=utf-8' } });
}

async function importCookiesPost(request) {
  try {
    const formData = await request.formData();
    const targetDomainInput = (formData.get('target_domain') || 'youtube.com').trim().replace(/^\./, '');
    const cookieText = formData.get('cookies') || '';
    const cookiesToSet = [];
    let detectedDomain = targetDomainInput;
    if (cookieText.includes('youtube.com') || cookieText.includes('__Secure-3PAPISID') || cookieText.includes('SAPISID')) {
      detectedDomain = 'youtube.com';
    }

    if (!cookieText.includes('\t') && cookieText.includes('=')) {
      // Raw Cookie header format
      for (let pair of cookieText.split(';')) {
        pair = pair.trim();
        const eq = pair.indexOf('=');
        if (eq !== -1) {
          const name = pair.slice(0, eq).trim();
          const val = pair.slice(eq + 1).trim();
          if (name && val) {
            cookiesToSet.push({ name: '__proxy_cookie_' + hexEncode(detectedDomain) + '_' + name, val, maxAge: 31536000 });
          }
        }
      }
    } else {
      // Netscape Cookie File format
      for (let line of cookieText.split('\n')) {
        line = line.trim();
        if (!line || line.startsWith('#')) continue;
        const parts = line.split('\t');
        if (parts.length >= 7) {
          const domain = parts[0].trim().replace(/^\./, '');
          detectedDomain = domain;
          const expiration = parseInt(parts[4].trim());
          const name = parts[5].trim();
          const val = parts[6].trim();
          let maxAge = 31536000;
          if (!isNaN(expiration)) {
            maxAge = Math.max(0, expiration - Math.floor(Date.now() / 1000));
            if (maxAge <= 0) continue;
          }
          cookiesToSet.push({ name: '__proxy_cookie_' + hexEncode(domain) + '_' + name, val, maxAge });
        }
      }
    }

    const lsData = formData.get('localstorage') || '{}';

    try {
      // Always store as Cookie header format (not Netscape) for player auth
      const normalized = normalizeCookieTextToHeader(cookieText) || cookieText;
      await saveCookiesToCache(detectedDomain, normalized);
      await saveCookiesToCache('default-target', detectedDomain);
      if (detectedDomain === 'youtube.com' || /SAPISID|youtube/i.test(cookieText)) {
        await saveCookiesToCache('youtube.com', normalized);
        await saveCookiesToCache('www.youtube.com', normalized);
        await saveCookiesToCache('google.com', normalized);
        await saveCookiesToCache('www.google.com', normalized);
        await saveCookiesToCache('accounts.google.com', normalized);
      }
    } catch (e) {}

    return new Response(`<!DOCTYPE html>
<html lang="he" dir="rtl">
<head>
  <meta charset="UTF-8"><title>מייבא עוגיות...</title>
  <link href="https://fonts.googleapis.com/css2?family=Assistant:wght@300;400;600;700&family=Outfit:wght@400;600;800&display=swap" rel="stylesheet">
  <style>
    :root {
        --bg: #07070f;
        --surface-glass: rgba(13, 13, 25, 0.6);
        --border: rgba(255, 255, 255, 0.08);
        --primary: #6366f1;
        --accent: #10b981;
        --text: #f8fafc;
        --text-muted: #94a3b8;
    }
    html.light {
        --bg: #f5f8fa;
        --surface-glass: rgba(255, 255, 255, 0.7);
        --border: rgba(15, 23, 42, 0.08);
        --primary: #4f46e5;
        --accent: #10b981;
        --text: #0f172a;
        --text-muted: #475569;
    }
    body {
        background: var(--bg); color: var(--text); font-family: 'Assistant', sans-serif;
        display: flex; justify-content: center; align-items: center; min-height: 100vh; margin: 0;
        transition: background 0.3s, color 0.3s;
    }
    .card {
        background: var(--surface-glass); backdrop-filter: blur(24px) saturate(180%);
        -webkit-backdrop-filter: blur(24px) saturate(180%); border: 1px solid var(--border);
        padding: 3rem 2rem; border-radius: 24px; text-align: center; max-width: 420px; width: 100%;
        box-shadow: 0 20px 50px -15px rgba(0, 0, 0, 0.3);
    }
    .progress { margin: 1.5rem 0; font-size: 1.3rem; font-weight: 700; color: var(--primary); }
    h1 { font-family: 'Outfit', sans-serif; font-size: 1.8rem; font-weight: 800; background: linear-gradient(135deg, #a5b4fc 0%, var(--primary) 60%, var(--accent) 100%); -webkit-background-clip: text; -webkit-text-fill-color: transparent; margin-bottom: 0.5rem; }
    p { color: var(--text-muted); font-size: 0.95rem; }
    .spinner {
        border: 3px solid rgba(99, 102, 241, 0.1); width: 44px; height: 44px;
        border-radius: 50%; border-left-color: var(--primary); animation: spin 1s linear infinite;
        margin: 0 auto 1.5rem;
    }
    @keyframes spin { 0% { transform: rotate(0deg); } 100% { transform: rotate(360deg); } }
  </style>
  <script>
      (function() {
          var s = localStorage.getItem('theme');
          var l = window.matchMedia('(prefers-color-scheme: light)').matches;
          if (s === 'light' || (!s && l)) document.documentElement.classList.add('light');
      })();
  </script>
</head>
<body>
<div class="card">
  <div class="spinner"></div>
  <h1>מייבא עוגיות לפרוקסי...</h1>
  <div class="progress" id="status">אנא המתן...</div>
  <p>שומר את העוגיות בדפדפן באופן מאובטח ומקומי.</p>
</div>
<script>
  var cookies = ${JSON.stringify(cookiesToSet)};
  var targetDomain = ${JSON.stringify(detectedDomain)};
  var statusEl = document.getElementById('status');
  if (targetDomain) {
    document.cookie = '__proxy_target=' + encodeURIComponent('https://' + targetDomain) + '; Path=/; max-age=31536000; SameSite=Lax; Secure';
  }
  var imported = 0;
  for (var i = 0; i < cookies.length; i++) {
    try { document.cookie = cookies[i].name + '=' + cookies[i].val + '; path=/; max-age=' + cookies[i].maxAge + '; SameSite=None; Secure'; imported++; } catch(e) {}
  }
  statusEl.style.color = 'var(--accent)';
  statusEl.textContent = '׳”׳™׳™׳‘׳•׳ ׳”׳•׳©׳œ׳! ׳™׳•׳‘׳׳• ' + imported + ' ׳¢׳•׳’׳™׳•׳×.';
  try {
    var lsData = ${JSON.stringify(lsData)};
    var parsed = JSON.parse(lsData);
    var lsCount = 0;
    for (var key in parsed) { window.localStorage.setItem(key, parsed[key]); lsCount++; }
    if (lsCount > 0) statusEl.textContent += ' ׳‘׳ ׳•׳¡׳£ ׳™׳•׳‘׳׳• ' + lsCount + ' ׳₪׳¨׳™׳˜׳™ localStorage.';
  } catch(e) {}
  setTimeout(function() { window.location.href = '/'; }, 2000);
</script>
</body></html>`, { headers: { 'Content-Type': 'text/html; charset=utf-8' } });
  } catch (e) {
    return new Response('\u05E9\u05D2\u05D9\u05D0\u05D4 \u05D1\u05D9\u05D9\u05D1\u05D5\u05D0: ' + e.message, { status: 500 });
  }
}

function makeGateResponse(toEncoded, origin) {
  const safeTo = String(toEncoded || '').replace(/[^A-Za-z0-9\-_]/g, '');
  return new Response(`<!DOCTYPE html>
<html lang="he" dir="rtl">
<head>
  <meta charset="UTF-8">
  <meta name="viewport" content="width=device-width,initial-scale=1"/>
  <title>מתחבר...</title>
  <style>
    body {
      background: #07070f; color: #f8fafc;
      font-family: Assistant, 'Segoe UI', system-ui, -apple-system, sans-serif;
      display: flex; flex-direction: column; justify-content: center; align-items: center; min-height: 100vh; margin: 0; padding: 1rem;
    }
    .spinner {
      border: 3px solid rgba(99, 102, 241, 0.15); width: 50px; height: 50px;
      border-radius: 50%; border-left-color: #6366f1; animation: spin 1s linear infinite;
      margin-bottom: 1.5rem;
    }
    h1 { font-size: 1.5rem; font-weight: 700; margin: 0; }
    p { color: #94a3b8; font-size: 0.95rem; margin: 0.5rem 0 0 0; }
    a.manual { margin-top: 1.25rem; color: #93c5fd; font-size: .9rem; }
    @keyframes spin { 0% { transform: rotate(0deg); } 100% { transform: rotate(360deg); } }
  </style>
</head>
<body>
  <div class="spinner"></div>
  <h1>מכין חיבור מאובטח...</h1>
  <p>אנא המתן רגע קט</p>
  <a class="manual" id="manual" href="/cdn/${safeTo}">אם לא נטען תוך כמה שניות — לחץ כאן</a>
  <script>
    var targetUrl = '/cdn/' + ${JSON.stringify(safeTo)};
    var went = false;
    function go() { if (went) return; went = true; window.location.replace(targetUrl); }
    // Guarantee we never hang on this screen: navigate on SW-ready, on controllerchange,
    // and unconditionally after a hard timeout — whichever fires first.
    setTimeout(go, 2500);
    try {
      if ('serviceWorker' in navigator) {
        navigator.serviceWorker.addEventListener('controllerchange', go);
        navigator.serviceWorker.register('/sw.js?v=${SW_VERSION}', { scope: '/' })
          .then(function(){ return Promise.race([
            navigator.serviceWorker.ready,
            new Promise(function(r){ setTimeout(r, 1500); })
          ]); })
          .then(go)
          .catch(go);
      } else {
        go();
      }
    } catch (e) { go(); }
  </script>
</body>
</html>`, { headers: { 'Content-Type': 'text/html; charset=utf-8', 'cache-control': 'no-store' } });
}

// ─── Section 9: Error / Sorry Page ───

function makeSorryResponse(origin, videoId, env) {
  if (videoId) return youtubeNativePlayerPage(videoId, origin, null, '', env);
  return makeSorryResponsePlain(origin);
}
function makeSorryResponsePlain(origin) {
  return new Response(`<!DOCTYPE html>
<html lang="he" dir="rtl">
<head>
  <meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0">
  <title>\u05D9\u05D5\u05D8\u05D9\u05D5\u05D1 \u05D7\u05E1\u05DD \u05D6\u05DE\u05E0\u05D9\u05EA \u05D0\u05EA \u05D4\u05D2\u05D9\u05E9\u05D4</title>
  <link href="https://fonts.googleapis.com/css2?family=Assistant:wght@300;400;600;700&display=swap" rel="stylesheet">
  <style>
    body { font-family:'Assistant',sans-serif; background:#0b0f19; color:#f3f4f6; display:flex; justify-content:center; align-items:center; min-height:100vh; margin:0; padding:1rem; }
    .card { background:rgba(255,255,255,0.03); border:1px solid rgba(255,255,255,0.08); border-radius:16px; padding:2.5rem; max-width:500px; width:100%; text-align:center; box-shadow:0 10px 30px rgba(0,0,0,0.5); backdrop-filter:blur(8px); }
    h1 { color:#ef4444; font-size:1.8rem; margin-bottom:1rem; }
    p { color:#9ca3af; line-height:1.6; margin-bottom:2rem; font-size:1.1rem; }
    .btn-group { display:flex; flex-direction:column; gap:0.75rem; }
    .btn { display:inline-block; padding:0.8rem 1.5rem; border-radius:8px; text-decoration:none; font-weight:600; transition:all 0.2s ease; font-size:1rem; border:none; cursor:pointer; }
    .btn-primary { background:#4f46e5; color:#fff; }
    .btn-primary:hover { background:#4338ca; transform:translateY(-2px); }
    .btn-secondary { background:rgba(255,255,255,0.08); color:#f3f4f6; border:1px solid rgba(255,255,255,0.15); }
    .btn-secondary:hover { background:rgba(255,255,255,0.15); transform:translateY(-2px); }
  </style>
</head>
<body>
  <div class="card">
    <h1>\u05D9\u05D5\u05D8\u05D9\u05D5\u05D1 \u05D7\u05E1\u05DD \u05D6\u05DE\u05E0\u05D9\u05EA \u05D0\u05EA \u05D4\u05D2\u05D9\u05E9\u05D4</h1>
    <p>\u05D9\u05D5\u05D8\u05D9\u05D5\u05D1 \u05D6\u05D9\u05D4\u05D4 \u05E9\u05D4\u05D1\u05E7\u05E9\u05D4 \u05DE\u05D2\u05D9\u05E2\u05D4 \u05DE\u05E9\u05E8\u05EA (IP \u05E9\u05DC Cloudflare). \u05E0\u05E1\u05D4 \u05DC\u05D9\u05D9\u05D1\u05D0 \u05E2\u05D5\u05D2\u05D9\u05D5\u05EA \u05D0\u05D5 \u05DC\u05D0\u05E4\u05E1 \u05D0\u05EA \u05D4\u05E4\u05E8\u05D5\u05E7\u05E1\u05D9.</p>
    <div class="btn-group">
      <a href="${origin}/import-cookies" class="btn btn-primary">\u05D9\u05D9\u05D1\u05D5\u05D0 \u05E2\u05D5\u05D2\u05D9\u05D5\u05EA (\u05E2\u05D5\u05E7\u05E3 \u05D4\u05D7\u05E1\u05D9\u05DE\u05D4)</a>
      <a href="${origin}/?__proxy_reset=1" class="btn btn-secondary">\u05D0\u05D9\u05E4\u05D5\u05E1 \u05D5\u05D7\u05D6\u05E8\u05D4 \u05DC\u05D3\u05E3 \u05D4\u05D1\u05D9\u05EA</a>
    </div>
  </div>
</body>
</html>`, { status: 200, headers: { 'Content-Type': 'text/html; charset=utf-8' } });
}

// ג”€ג”€ג”€ Section 10: HTML Rewriter ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€ג”€

function rewriteHtmlResponse(response, targetUrl, proxyOrigin, baseProxyTarget) {
  const rewriter = new HTMLRewriter();
  let styleBuf = '';

  function rewriteAttr(el, attr) {
    const val = el.getAttribute(attr);
    if (!val || val.trim().startsWith('javascript:') || val.trim().startsWith('mailto:') || val.trim().startsWith('data:') || val.trim().startsWith('#')) return;
    try {
      let absUrl = new URL(val, targetUrl.toString()).toString();
      // Bypass proxy for Brave Search CDN to avoid Cloudflare hosting IP block (403 Forbidden)
      if (absUrl.includes('cdn.search.brave.com')) {
        el.setAttribute(attr, absUrl);
        return;
      }
      // Normalize youtube.com → www.youtube.com
      try { const u = new URL(absUrl); if (u.hostname === 'youtube.com') { u.hostname = 'www.youtube.com'; absUrl = u.toString(); } } catch {}
      // Block filter/tracking domains
      if (isFilterDomain(absUrl)) { el.setAttribute(attr, 'data:text/plain,'); return; }
      if (absUrl.includes('recaptcha') || absUrl.includes('hcaptcha.com')) return;
      // ALWAYS absolute proxied URL — relative paths break when cookie is missing
      // (browser loads workers.dev/s/... and gets home HTML → "MIME type text/html")
      el.setAttribute(attr, proxyOrigin + PROXY_PATH + encodeUrl(absUrl));
    } catch {}
  }

  function rewriteSrcset(el, attr) {
    const val = el.getAttribute(attr);
    if (!val) return;
    try {
      const parts = val.split(',').map(part => {
        const trimmed = part.trim();
        const sp = trimmed.indexOf(' ');
        let urlPart = trimmed, desc = '';
        if (sp !== -1) { urlPart = trimmed.slice(0, sp); desc = trimmed.slice(sp); }
        const absUrl = new URL(urlPart, targetUrl.toString()).toString();
        if (absUrl.includes('cdn.search.brave.com')) {
          return absUrl + desc;
        }
        return proxyOrigin + PROXY_PATH + encodeUrl(absUrl) + desc;
      });
      el.setAttribute(attr, parts.join(', '));
    } catch {}
  }

  function rewriteCssUrls(cssText) {
    return cssText.replace(/url\(\s*['"]?([^'")\s]+)['"]?\s*\)/g, (match, relUrl) => {
      if (relUrl.startsWith('data:')) return match;
      try {
        const absUrl = new URL(relUrl, targetUrl.toString()).toString();
        if (absUrl.includes('cdn.search.brave.com')) {
          return "url('" + absUrl + "')";
        }
        return "url('" + proxyOrigin + PROXY_PATH + encodeUrl(absUrl) + "')";
      } catch { return match; }
    });
  }

  rewriter.on('a', { element(el) { rewriteAttr(el, 'href'); } });
  rewriter.on('link', { element(el) {
    const rel = (el.getAttribute('rel') || '').toLowerCase();
    if (!rel.includes('canonical') && !rel.includes('alternate')) rewriteAttr(el, 'href');
    el.removeAttribute('integrity');
  }});
  rewriter.on('img', { element(el) {
    rewriteAttr(el, 'src'); rewriteAttr(el, 'data-src'); rewriteAttr(el, 'data-original'); rewriteAttr(el, 'data-lazy-src');
    rewriteSrcset(el, 'srcset'); rewriteSrcset(el, 'data-srcset');
    if (el.getAttribute('loading') === 'lazy') el.removeAttribute('loading');
  }});
  rewriter.on('script', { element(el) { rewriteAttr(el, 'src'); el.removeAttribute('integrity'); } });
  rewriter.on('form', { element(el) { rewriteAttr(el, 'action'); } });
  rewriter.on('iframe', { element(el) { rewriteAttr(el, 'src'); } });
  rewriter.on('source', { element(el) {
    rewriteAttr(el, 'src'); rewriteAttr(el, 'data-src');
    rewriteSrcset(el, 'srcset'); rewriteSrcset(el, 'data-srcset');
  }});
  rewriter.on('video', { element(el) { rewriteAttr(el, 'src'); rewriteAttr(el, 'poster'); rewriteAttr(el, 'data-src'); } });
  rewriter.on('audio', { element(el) { rewriteAttr(el, 'src'); rewriteAttr(el, 'data-src'); } });
  rewriter.on('meta', { element(el) {
    if ((el.getAttribute('http-equiv') || '').toLowerCase() === 'refresh') {
      const content = el.getAttribute('content');
      if (content) {
        const m = content.match(/^(\d+;\s*url=)(.*)$/i);
        if (m) {
          const rawUrl = m[2].replace(/^['"]|['"]$/g, '');
          try {
            const absUrl = new URL(rawUrl, targetUrl.toString()).toString();
            el.setAttribute('content', m[1] + proxyOrigin + PROXY_PATH + encodeUrl(absUrl));
          } catch {}
        }
      }
    }
  }});
  rewriter.on('*', { element(el) {
    const style = el.getAttribute('style');
    if (style && style.includes('url(')) el.setAttribute('style', rewriteCssUrls(style));
  }});
  rewriter.on('style', {
    text(chunk) {
      if (chunk.text && chunk.text.includes('url(')) {
        chunk.replace(rewriteCssUrls(chunk.text), { html: true });
      }
    }
  });
  // Inject client-side proxy patches into <head> (or <html> fallback)
  const GUARD_JS = `<script>(function(){function bad(u){u=String(u||'').toLowerCase();return u.indexOf('etrog')!==-1||u.indexOf('safepage')!==-1||u.indexOf('rimon.net')!==-1||u.indexOf('netspark')!==-1;}try{var a=Location.prototype.assign,r=Location.prototype.replace;Location.prototype.assign=function(u){if(bad(u))return;return a.call(this,u);};Location.prototype.replace=function(u){if(bad(u))return;return r.call(this,u);};}catch(e){}var o=window.open;window.open=function(u){if(bad(u))return null;return o.apply(this,arguments);};})();</script>`;
  let injectedHead = false;
  rewriter.on('head', {
    element(el) {
      if (!injectedHead) {
        injectedHead = true;
        el.prepend(INJECTED_JS + GUARD_JS, { html: true });
      }
    }
  });
  rewriter.on('html', {
    element(el) {
      if (!injectedHead) {
        injectedHead = true;
        el.prepend(INJECTED_JS + GUARD_JS, { html: true });
      }
    }
  });

  const cleanHeaders = new Headers(response.headers);
  cleanTransferHeaders(cleanHeaders);
  stripSecurityHeaders(cleanHeaders);
  cleanHeaders.set('access-control-allow-origin', proxyOrigin);
  cleanHeaders.set('access-control-allow-credentials', 'true');

  return rewriter.transform(new Response(response.body, {
    status: response.status,
    statusText: response.statusText,
    headers: cleanHeaders
  }));
}


// ג”€ג”€ג”€ YouTube same-isolate stream + player JSON rewrite (CF multi-IP 403 fix) ג”€
function extractYoutubeVideoId(u) {
  try {
    const url = typeof u === 'string' ? new URL(u) : u;
    const host = (url.hostname || '').toLowerCase();
    if (host.includes('youtu.be')) return url.pathname.replace(/^\//, '').split('/')[0] || null;
    const v = url.searchParams.get('v');
    if (v) return v;
    const m = url.pathname.match(/\/(?:embed|shorts|live|v)\/([^/?#&]+)/);
    return m ? m[1] : null;
  } catch { return null; }
}

function rewritePlayerApiJson(jsonText, origin) {
  try {
    const data = JSON.parse(jsonText);
    const videoId =
      data?.videoDetails?.videoId ||
      data?.microformat?.playerMicroformatRenderer?.videoDetails?.videoId ||
      null;
    if (!data.streamingData) return rewriteJsonUrls(jsonText, origin);
    const vid = videoId;
    if (!vid) return rewriteJsonUrls(jsonText, origin);

    const streamUrl = (itag) =>
      origin + '/api/yt-stream?v=' + encodeURIComponent(vid) + '&itag=' + encodeURIComponent(itag);

    const rewriteList = (arr) => {
      if (!Array.isArray(arr)) return;
      for (const f of arr) {
        if (!f || f.itag == null) continue;
        // Drop cipher-only fields; force same-isolate stream endpoint
        try { delete f.signatureCipher; } catch (e) {}
        try { delete f.cipher; } catch (e) {}
        f.url = streamUrl(f.itag);
      }
    };
    rewriteList(data.streamingData.formats);
    rewriteList(data.streamingData.adaptiveFormats);

    // Ensure at least one progressive mp4 exists for HTML5 <video>
    if (!Array.isArray(data.streamingData.formats)) data.streamingData.formats = [];
    const has18 = data.streamingData.formats.some((f) => String(f.itag) === '18');
    if (!has18) {
      data.streamingData.formats.unshift({
        itag: 18,
        url: streamUrl(18),
        mimeType: 'video/mp4; codecs="avc1.42001E, mp4a.40.2"',
        quality: 'medium',
        qualityLabel: '360p',
        width: 640,
        height: 360,
        audioQuality: 'AUDIO_QUALITY_LOW',
        contentLength: '0'
      });
    }

    if (data.playabilityStatus) {
      data.playabilityStatus.status = 'OK';
      try { delete data.playabilityStatus.reason; } catch (e) {}
      try { delete data.playabilityStatus.errorScreen; } catch (e) {}
    }
    return JSON.stringify(data);
  } catch {
    return rewriteJsonUrls(jsonText, origin);
  }
}

/** Pack stream params into XOR+base64url blob (harder for URL filters to finger-print). */
function encodeMediaToken(videoId, itag) {
  const payload = JSON.stringify({ v: videoId, i: String(itag || '18'), t: Date.now() });
  return encodeUrl(payload);
}

function decodeMediaToken(token) {
  try {
    const raw = decodeUrl(token);
    if (!raw) return null;
    const j = JSON.parse(raw);
    if (!j || !j.v) return null;
    const out = { v: String(j.v), i: String(j.i || '18') };
    // Optional direct googlevideo URL resolved client-side (Origin:null / residential IP)
    if (j.u && typeof j.u === 'string' && /^https:\/\//i.test(j.u) && /googlevideo\.com|gvt1\.com|googleusercontent\.com/i.test(j.u)) {
      out.u = j.u;
    }
    if (j.s === 1 || j.s === '1') out.s = 1;
    if (j.d === 1 || j.d === '1') out.d = 1;
    return out;
  } catch {
    return null;
  }
}

function isAllowedMediaDirectUrl(u) {
  try {
    const x = new URL(String(u || ''));
    if (x.protocol !== 'https:') return false;
    // Strict host-suffix match only — no `.includes()` (which let `googlevideo.com.evil`
    // through). The worker fetches this URL server-side, so a loose match is an SSRF hole.
    return hostnameMatches(x.hostname, ['googlevideo.com', 'gvt1.com', 'gvt2.com', 'googleusercontent.com']);
  } catch {
    return false;
  }
}

function youtubeNativePlayerPage(videoId, origin, title, prefillQ, env) {
  const safeId = String(videoId || '').replace(/[^\w-]/g, '');
  const q0 = String(prefillQ || '').replace(/[<>&"]/g, '');
  const pageTitle = (title || 'YouTube') + (safeId ? (' — ' + safeId) : '');
  const css = [
    ':root{--yt-bg:#fff;--yt-elevated:#f2f2f2;--yt-hover:#e5e5e5;--yt-border:#ccc;--yt-text:#0f0f0f;--yt-muted:#606060;--yt-red:#f00;--yt-chip:#f2f2f2;--yt-search:#fff;--mast:56px;--desc-bg:#f2f2f2}',
    '*{box-sizing:border-box}',
    'html,body{margin:0;padding:0;background:var(--yt-bg);color:var(--yt-text);font-family:Roboto,"Segoe UI",Arial,Helvetica,sans-serif;min-height:100%}',
    'a{color:inherit;text-decoration:none}',
    'button,select,input{font:inherit;color:inherit}',
    'button{cursor:pointer;border:0;background:transparent}',
    '.mast{position:sticky;top:0;z-index:50;height:var(--mast);display:flex;align-items:center;gap:12px;padding:0 16px;background:#fff;border-bottom:1px solid #e5e5e5;box-shadow:0 1px 2px rgba(0,0,0,.05)}',
    '.mast-start,.mast-end{display:flex;align-items:center;gap:8px;flex-shrink:0}',
    '.mast-center{flex:1;display:flex;justify-content:center;max-width:720px;margin:0 auto}',
    '.logo{display:flex;align-items:center;gap:2px;padding:6px 8px;border-radius:8px;font-weight:700}',
    '.logo:hover{background:var(--yt-hover)}',
    '.logo-icon{width:32px;height:22px;background:var(--yt-red);border-radius:6px;display:inline-flex;align-items:center;justify-content:center;position:relative}',
    '.logo-icon:after{content:"";border-style:solid;border-width:5px 0 5px 9px;border-color:transparent transparent transparent #fff;margin-inline-start:2px}',
    '.logo-text{font-size:1.15rem;color:#0f0f0f}',
    '.logo-badge{font-size:.62rem;color:var(--yt-muted);font-weight:500;align-self:flex-start;margin-top:4px}',
    '.icon-btn{width:40px;height:40px;border-radius:50%;display:inline-flex;align-items:center;justify-content:center;color:var(--yt-text)}',
    '.icon-btn:hover{background:var(--yt-hover)}',
    '.icon-btn svg{width:24px;height:24px;fill:currentColor}',
    '.search-box{display:flex;width:100%;max-width:640px;height:40px}',
    '.search-box input{flex:1;background:var(--yt-search);border:1px solid var(--yt-border);border-inline-end:0;border-radius:40px 0 0 40px;padding:0 16px;outline:0;min-width:0}',
    '[dir=rtl] .search-box input{border-radius:0 40px 40px 0;border-inline-end:1px solid var(--yt-border);border-inline-start:0}',
    '.search-box input:focus{border-color:#1c62b9;box-shadow:inset 0 0 0 1px #1c62b9}',
    '.search-box .btn-search{width:64px;background:var(--yt-elevated);border:1px solid var(--yt-border);border-radius:0 40px 40px 0;display:flex;align-items:center;justify-content:center}',
    '[dir=rtl] .search-box .btn-search{border-radius:40px 0 0 40px}',
    '.search-box .btn-search:hover{background:var(--yt-hover)}',
    '.search-box .btn-search svg{width:20px;height:20px;fill:#0f0f0f}',
    '.chip-row{display:flex;gap:10px;padding:12px 24px 4px;overflow-x:auto;scrollbar-width:none}',
    '.chip{flex-shrink:0;padding:7px 12px;border-radius:8px;background:var(--yt-chip);font-size:.9rem;border:none}',
    '.chip:hover{background:#e5e5e5}',
    '.chip.active{background:#0f0f0f;color:#fff;font-weight:500}',
    '.page{padding:16px 24px 100px;max-width:1800px;margin:0 auto}',
    '.layout{display:grid;grid-template-columns:1fr;gap:24px}',
    '.layout.watch,.layout.channel{grid-template-columns:minmax(0,1fr) 402px;align-items:start}',
    '.layout.theater{grid-template-columns:1fr}',
    '.layout.theater .primary{grid-column:1/-1}',
    '.layout.theater .secondary{max-width:1280px;margin:0 auto;width:100%}',
    '.layout.browse .primary{display:none}',
    '.layout.browse .secondary{grid-column:1/-1}',
    '.layout.channel .primary-stage{display:none}',
    '.layout.channel .video-meta{display:none}',
    '.layout.channel .secondary{grid-column:1/-1}',
    '.layout.channel .results-grid{display:grid!important;grid-template-columns:repeat(auto-fill,minmax(260px,1fr))!important;flex-direction:unset!important;gap:16px!important}',
    '.layout.channel .vcard{flex-direction:column!important}',
    '.layout.channel .thumb{width:100%!important;border-radius:12px!important}',
    '.layout.mini .primary-stage{display:none}',
    '.layout.mini .video-meta,.layout.mini .desc-box{display:none}',
    '.layout.watch .results-grid,.layout.theater .results-grid,.layout.mini .results-grid,.layout.channel .results-grid{display:flex;flex-direction:column;gap:8px}',
    '.layout.watch .vcard,.layout.theater .vcard,.layout.mini .vcard,.layout.channel .vcard{flex-direction:row;gap:8px}',
    '.layout.watch .thumb,.layout.theater .thumb,.layout.mini .thumb,.layout.channel .thumb{width:168px;border-radius:8px}',
    '@media(max-width:1100px){.layout.watch,.layout.channel{grid-template-columns:1fr}.page{padding:12px 12px 100px}}',
    /* custom YT-like player — controls always LTR (play on visual LEFT, like Hebrew YouTube) */
    '.player-shell{position:relative;background:#000;border-radius:12px;overflow:hidden;aspect-ratio:16/9;max-height:calc(100vh - 140px);user-select:none;box-shadow:0 1px 6px rgba(0,0,0,.12)}',
    '.layout.theater .player-shell{border-radius:0;max-height:calc(100vh - var(--mast) - 24px);aspect-ratio:auto;height:min(78vh,calc(100vw * 9 / 16))}',
    '.player-shell video{width:100%;height:100%;display:block;background:#000;object-fit:contain}',
    // Shorts / vertical clips: switch the stage to 9:16 and centre it, instead of a 16:9 box
    // with huge black pillars. Applied automatically once the real dimensions are known.
    '.player-shell.portrait{aspect-ratio:9/16;max-height:calc(100vh - 150px);max-width:min(100%,calc((100vh - 150px) * 9 / 16));margin-inline:auto}',
    '.layout.theater .player-shell.portrait{aspect-ratio:9/16;height:min(82vh,calc(100vh - var(--mast) - 24px));width:auto;max-width:calc(82vh * 9 / 16)}',
    '.player-shell.loading .yt-load{display:flex}',
    '.yt-load{display:none;position:absolute;inset:0;align-items:center;justify-content:center;background:rgba(0,0,0,.35);color:#fff;font-size:.95rem;pointer-events:none;z-index:5;flex-direction:column;gap:12px}',
    '.yt-load .spin{width:40px;height:40px;border:3px solid rgba(255,255,255,.25);border-top-color:#fff;border-radius:50%;animation:ytspin .7s linear infinite}',
    '@keyframes ytspin{to{transform:rotate(360deg)}}',
    '.yt-bigplay{position:absolute;inset:0;display:flex;align-items:center;justify-content:center;z-index:4;cursor:pointer;background:transparent}',
    '.yt-bigplay.hide{display:none}',
    '.yt-bigplay .circle{width:68px;height:48px;border-radius:14px;background:rgba(0,0,0,.55);display:flex;align-items:center;justify-content:center;transition:background .15s,transform .15s;box-shadow:0 2px 10px rgba(0,0,0,.35)}',
    '.yt-bigplay:hover .circle{background:var(--yt-red);transform:scale(1.06)}',
    '.yt-bigplay .circle:after{content:"";border-style:solid;border-width:10px 0 10px 18px;border-color:transparent transparent transparent #fff;margin-left:3px}',
    '.yt-controls{position:absolute;left:0;right:0;bottom:0;z-index:6;padding:0 12px 8px;background:linear-gradient(180deg,transparent,rgba(0,0,0,.85));opacity:0;transition:opacity .15s;color:#fff;direction:ltr!important}',
    '.player-shell:hover .yt-controls,.player-shell.show-ui .yt-controls,.player-shell.paused .yt-controls,.player-shell.loading .yt-controls{opacity:1}',
    '.yt-progress{height:3px;background:rgba(255,255,255,.35);border-radius:1.5px;cursor:pointer;margin-bottom:8px;position:relative;direction:ltr}',
    '.yt-progress:hover,.yt-progress.drag{height:5px}',
    '.yt-buf{position:absolute;left:0;top:0;bottom:0;background:rgba(255,255,255,.45);border-radius:1.5px;width:0}',
    '.yt-bar{position:absolute;left:0;top:0;bottom:0;background:#f00;border-radius:1.5px;width:0}',
    '.yt-knob{position:absolute;top:50%;left:0;width:13px;height:13px;border-radius:50%;background:#f00;transform:translate(-50%,-50%);opacity:0;box-shadow:0 0 0 1px rgba(0,0,0,.15)}',
    '.yt-progress:hover .yt-knob,.yt-progress.drag .yt-knob{opacity:1}',
    '.yt-row{display:flex;align-items:center;gap:2px;direction:ltr!important;flex-direction:row!important}',
    '.yt-row .spacer{flex:1}',
    '.yt-cbtn{width:40px;height:40px;border-radius:50%;display:inline-flex;align-items:center;justify-content:center;color:#fff;flex-shrink:0}',
    '.yt-cbtn:hover{background:rgba(255,255,255,.12)}',
    '.yt-cbtn svg{width:24px;height:24px;fill:currentColor}',
    '.yt-time{font-size:.8125rem;color:#fff;padding:0 8px;font-variant-numeric:tabular-nums;direction:ltr;white-space:nowrap;opacity:.95}',
    '.yt-vol{display:flex;align-items:center;gap:0;direction:ltr}',
    '.yt-vol input[type=range]{width:0;opacity:0;transition:width .15s,opacity .15s;accent-color:#fff;height:4px}',
    '.yt-vol:hover input[type=range],.yt-vol:focus-within input[type=range]{width:60px;opacity:1;margin-inline-end:4px}',
    '.yt-end-right{display:flex;align-items:center;gap:0;margin-left:auto;direction:ltr}',
    '.player-toolbar{display:flex;flex-wrap:wrap;gap:8px;align-items:center;padding:10px 0 0;color:var(--yt-muted);font-size:.85rem}',
    '.tool-btn{display:inline-flex;align-items:center;gap:6px;padding:8px 14px;border-radius:18px;background:var(--yt-elevated);color:var(--yt-text);font-size:.9rem;font-weight:500}',
    '.tool-btn:hover{background:var(--yt-hover)}',
    '.tool-btn.primary{background:#0f0f0f;color:#fff}',
    '.tool-btn.primary:hover{background:#272727}',
    '.tool-btn svg{width:18px;height:18px;fill:currentColor}',
    '.video-meta{padding-top:14px}',
    '#vtitle{font-size:1.25rem;font-weight:700;line-height:1.4;margin:0 0 12px;word-break:break-word}',
    '.meta-row{display:flex;flex-wrap:wrap;gap:12px;align-items:center;justify-content:space-between}',
    '.channel-block{display:flex;align-items:center;gap:12px;min-width:0;cursor:pointer;padding:4px;border-radius:8px}',
    '.channel-block:hover{background:var(--yt-elevated)}',
    '.avatar{width:40px;height:40px;border-radius:50%;background:linear-gradient(135deg,#ff4e50,#f9d423);display:flex;align-items:center;justify-content:center;font-weight:700;color:#111;flex-shrink:0;overflow:hidden}',
    '.avatar img{width:100%;height:100%;object-fit:cover}',
    '.ch-name{font-weight:500;font-size:1rem;white-space:nowrap;overflow:hidden;text-overflow:ellipsis;color:#0f0f0f}',
    '.ch-name:hover{color:#065fd4}',
    '.ch-sub{color:var(--yt-muted);font-size:.8rem}',
    '.actions{display:flex;flex-wrap:wrap;gap:8px}',
    '#status{color:var(--yt-muted);font-size:.85rem}',
    '#err{display:none;margin-top:10px;padding:10px 12px;border-radius:8px;background:#fde8e8;color:#b91c1c;white-space:pre-wrap;font-size:.9rem}',
    /* description box like YouTube */
    '.desc-box{margin-top:14px;background:var(--desc-bg);border-radius:12px;padding:12px 14px;cursor:pointer}',
    '.desc-box:hover{background:#e5e5e5}',
    '.desc-stats{font-size:.9rem;font-weight:600;margin-bottom:6px;color:#0f0f0f}',
    '.desc-text{font-size:.9rem;line-height:1.5;color:#0f0f0f;white-space:pre-wrap;word-break:break-word;max-height:4.5em;overflow:hidden}',
    '.desc-box.open .desc-text{max-height:none}',
    '.desc-more{color:var(--yt-muted);font-size:.85rem;font-weight:600;margin-top:6px}',
    '.sec-head{display:flex;align-items:center;justify-content:space-between;margin-bottom:12px;gap:8px}',
    '.sec-head h2{margin:0;font-size:1rem;font-weight:600}',
    '.results-grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(280px,1fr));gap:16px}',
    '.layout.watch .results-grid,.layout.theater .results-grid,.layout.mini .results-grid{display:flex;flex-direction:column;gap:8px}',
    '.vcard{display:flex;flex-direction:column;cursor:pointer;border-radius:12px}',
    '.layout.watch .vcard,.layout.theater .vcard,.layout.mini .vcard{flex-direction:row;gap:8px;border-radius:0}',
    '.thumb{position:relative;aspect-ratio:16/9;background:#e5e5e5;border-radius:12px;overflow:hidden;flex-shrink:0}',
    '.layout.watch .thumb,.layout.theater .thumb,.layout.mini .thumb{width:168px;border-radius:8px}',
    '.thumb img{width:100%;height:100%;object-fit:cover;display:block;background:#ddd}',
    '.thumb .dur{position:absolute;inset-inline-end:4px;bottom:4px;background:rgba(0,0,0,.8);color:#fff;font-size:.75rem;padding:1px 4px;border-radius:4px;font-weight:500;direction:ltr}',
    '.vmeta{padding:10px 0 0;min-width:0}',
    '.layout.watch .vmeta,.layout.theater .vmeta,.layout.mini .vmeta{padding:0}',
    '.vtitle{font-size:1rem;font-weight:500;line-height:1.35;display:-webkit-box;-webkit-line-clamp:2;-webkit-box-orient:vertical;overflow:hidden;margin:0 0 4px}',
    '.layout.watch .vtitle,.layout.theater .vtitle,.layout.mini .vtitle{font-size:.9rem}',
    '.vch,.vstat{color:var(--yt-muted);font-size:.85rem;line-height:1.3}',
    '.vcard.active .vtitle{color:#065fd4}',
    '.empty{color:var(--yt-muted);padding:48px 16px;text-align:center;font-size:1rem}',
    '.empty strong{display:block;color:var(--yt-text);font-size:1.2rem;margin-bottom:8px}',
    '.mini-dock{position:fixed;inset-inline-end:16px;bottom:16px;z-index:80;width:min(400px,calc(100vw - 24px));background:#000;border-radius:12px;overflow:hidden;box-shadow:0 8px 28px rgba(0,0,0,.35);border:1px solid #ddd;display:none;flex-direction:column}',
    '.mini-dock.show{display:flex}',
    '.mini-stage{position:relative;aspect-ratio:16/9;background:#000}',
    '.mini-stage video{width:100%;height:100%;object-fit:contain;display:block}',
    '.mini-bar{display:flex;align-items:center;gap:8px;padding:8px 10px;background:#fff;color:#0f0f0f;border-top:1px solid #eee}',
    '.mini-bar .mt{flex:1;min-width:0;font-size:.85rem;font-weight:500;white-space:nowrap;overflow:hidden;text-overflow:ellipsis}',
    '.mini-bar .icon-btn{width:32px;height:32px}',
    '.mini-bar .icon-btn svg{width:20px;height:20px}',
    '.sr-only{position:absolute;width:1px;height:1px;padding:0;margin:-1px;overflow:hidden;clip:rect(0,0,0,0);border:0}',
    '#vid{display:none}',
    '.hint-foot{color:var(--yt-muted);font-size:.8rem;margin-top:24px;line-height:1.5;text-align:center}',
    /* diagnostics panel */
    '.diag-overlay{position:fixed;inset:0;z-index:300;background:rgba(0,0,0,.45);display:flex;align-items:center;justify-content:center;animation:diagIn .2s ease}',
    '@keyframes diagIn{from{opacity:0;transform:scale(.96)}to{opacity:1;transform:scale(1)}}',
    '.diag-panel{background:#0f0f19;color:#e2e8f0;border:1px solid rgba(255,255,255,.12);border-radius:16px;padding:24px;max-width:520px;width:92vw;max-height:80vh;overflow-y:auto;font-family:"SF Mono","Cascadia Code","JetBrains Mono",Consolas,monospace;font-size:.8rem;line-height:1.6;box-shadow:0 20px 60px rgba(0,0,0,.5)}',
    '.diag-panel h2{margin:0 0 14px;font-size:1.1rem;font-weight:700;color:#f1f5f9;display:flex;align-items:center;gap:10px}',
    '.diag-panel h2 .badge{font-size:.65rem;background:rgba(99,102,241,.2);color:#818cf8;padding:2px 8px;border-radius:6px;font-weight:500}',
    '.diag-section{margin-bottom:12px;border:1px solid rgba(255,255,255,.06);border-radius:10px;padding:10px 14px;background:rgba(255,255,255,.02)}',
    '.diag-section h3{margin:0 0 6px;font-size:.75rem;text-transform:uppercase;letter-spacing:.05em;color:#94a3b8;font-weight:600}',
    '.diag-row{display:flex;justify-content:space-between;align-items:center;padding:2px 0;gap:12px}',
    '.diag-row .label{color:#94a3b8;white-space:nowrap}',
    '.diag-row .value{text-align:right;font-weight:500;color:#e2e8f0;word-break:break-all;max-width:60%}',
    '.diag-row .value.good{color:#4ade80}',
    '.diag-row .value.warn{color:#facc15}',
    '.diag-row .value.bad{color:#f87171}',
    '.diag-close{display:flex;justify-content:flex-end;gap:8px;margin-top:14px}',
    '.diag-close button{padding:8px 20px;border-radius:8px;border:0;font-size:.85rem;font-weight:600;cursor:pointer;background:rgba(255,255,255,.08);color:#e2e8f0;transition:background .15s}',
    '.diag-close button:hover{background:rgba(255,255,255,.16)}',
    '.diag-close button.primary{background:#6366f1;color:#fff}',
    '.diag-close button.primary:hover{background:#4f46e5}',
    '.btn-shorts{display:inline-flex;align-items:center;gap:6px;padding:6px 14px;border-radius:20px;background:rgba(255,0,0,.08);color:var(--yt-red);font-weight:700;font-size:.9rem;cursor:pointer;transition:all .15s}',
    '.btn-shorts:hover{background:rgba(255,0,0,.16);transform:scale(1.03)}',
    '.btn-shorts svg{width:20px;height:20px;fill:currentColor}',
    '.shorts-modal{position:fixed;inset:0;z-index:200;background:#f8fafc;display:none;flex-direction:column;align-items:center;justify-content:center;backdrop-filter:blur(12px)}',
    '.shorts-modal.show{display:flex}',
    '.shorts-header{position:absolute;top:16px;left:24px;right:24px;display:flex;align-items:center;justify-content:space-between;z-index:10;color:#0f0f0f}',
    '.shorts-title{display:flex;align-items:center;gap:8px;font-size:1.3rem;font-weight:700;color:#0f0f0f}',
    '.shorts-title svg{width:28px;height:28px;fill:var(--yt-red)}',
    '.shorts-close{font-size:1.8rem;color:#0f0f0f;cursor:pointer;line-height:1;width:40px;height:40px;display:flex;align-items:center;justify-content:center;border-radius:50%;background:#e2e8f0;border:none}',
    '.shorts-close:hover{background:#cbd5e1}',
    '.shorts-stage-wrap{display:flex;align-items:center;gap:20px;max-width:100%;height:calc(100vh - 100px)}',
    '.shorts-card{position:relative;width:min(400px,85vw);height:min(700px,82vh);aspect-ratio:9/16;background:#000;border-radius:20px;overflow:hidden;box-shadow:0 20px 50px rgba(0,0,0,.22);display:flex;flex-direction:column;border:2px solid #e2e8f0}',
    '.shorts-card video{width:100%;height:100%;object-fit:cover;display:block}',
    '.shorts-overlay-info{position:absolute;left:16px;right:16px;bottom:20px;z-index:8;color:#fff;text-shadow:0 1px 4px rgba(0,0,0,.9);pointer-events:none}',
    '.shorts-ch{font-weight:700;font-size:1rem;margin-bottom:6px}',
    '.shorts-vtitle{font-size:.95rem;line-height:1.35;max-height:2.7em;overflow:hidden;text-overflow:ellipsis;display:-webkit-box;-webkit-line-clamp:2;-webkit-box-orient:vertical}',
    '.shorts-actions{display:flex;flex-direction:column;gap:16px;color:#0f0f0f}',
    '.shorts-btn{display:flex;flex-direction:column;align-items:center;gap:4px;color:#0f0f0f;cursor:pointer;font-size:.8rem;font-weight:600}',
    '.shorts-btn-ic{width:48px;height:48px;border-radius:50%;background:#ffffff;display:flex;align-items:center;justify-content:center;box-shadow:0 4px 12px rgba(0,0,0,.1);border:1px solid #e2e8f0;transition:background .2s,transform .15s}',
    '.shorts-btn:hover .shorts-btn-ic{background:#f1f5f9;transform:scale(1.08)}',
    '.shorts-btn svg{width:26px;height:26px;fill:#0f0f0f}',
  ].join('');

  const html =
    '<!DOCTYPE html><html lang="he" dir="rtl"><head><meta charset="utf-8"/>' +
    '<meta name="viewport" content="width=device-width,initial-scale=1"/>' +
    '<meta name="referrer" content="no-referrer"/>' +
    '<meta name="color-scheme" content="light"/>' +
    '<title>' + pageTitle.replace(/[<>&]/g, '') + '</title>' +
    '<style>' + css + '</style></head>' +
    '<body data-prefill-q="' + q0 + '" data-initial-id="' + safeId.replace(/"/g, '') + '">' +
    '<header class="mast">' +
      '<div class="mast-start">' +
        '<a class="logo" href="/ytp" title="YouTube">' +
          '<span class="logo-icon" aria-hidden="true"></span>' +
          '<span class="logo-text">YouTube</span>' +
          '<span class="logo-badge">IL</span>' +
        '</a>' +
        '<button type="button" class="btn-shorts" id="btnShorts" title="Shorts" aria-label="Shorts">' +
          '<svg viewBox="0 0 24 24"><path d="M17.77 10.32l-1.2-.5L18 9.06c1.84-.96 2.53-3.23 1.56-5.06s-3.24-2.53-5.07-1.56L6 6.94c-1.29.68-2.07 2.04-2 3.49.07 1.42.93 2.67 2.22 3.25.03.01 1.2.5 1.2.5L6 14.93c-1.83.96-2.53 3.23-1.56 5.06 1 1.83 3.23 2.53 5.07 1.56l8.47-4.5c1.29-.68 2.07-2.04 2-3.49-.07-1.42-.93-2.67-2.21-3.24zM10 14.65V9.35L15 12l-5 2.65z"/></svg>' +
          '<span>Shorts</span>' +
        '</button>' +
      '</div>' +
      '<div class="mast-center">' +
        '<div class="search-box">' +
          '<input id="qsearch" type="search" placeholder="חיפוש" autocomplete="off" enterkeyhint="search"/>' +
          '<button type="button" class="btn-search" id="btn-search" title="חיפוש" aria-label="חיפוש">' +
            '<svg viewBox="0 0 24 24"><path d="M20.87 20.17l-5.59-5.59C16.35 13.35 17 11.75 17 10c0-3.87-3.13-7-7-7s-7 3.13-7 7 3.13 7 7 7c1.75 0 3.35-.65 4.58-1.71l5.59 5.59.7-.71zM10 16c-3.31 0-6-2.69-6-6s2.69-6 6-6 6 2.69 6 6-2.69 6-6 6z"/></svg>' +
          '</button>' +
        '</div>' +
      '</div>' +
      '<div class="mast-end">' +
        '<select id="q" class="sr-only" aria-label="איכות" tabindex="-1">' +
          '<option value="18" selected>360p</option><option value="22">720p</option><option value="37">1080p</option><option value="auto">auto</option>' +
        '</select>' +
        '<a class="icon-btn" href="/?home=1" title="דף הבית" aria-label="דף הבית">' +
          '<svg viewBox="0 0 24 24"><path d="M10 20v-6h4v6h5v-8h3L12 3 2 12h3v8z"/></svg>' +
        '</a>' +
        '<a href="/import-cookies" class="icon-btn" title="ייבוא עוגיות (אופציונלי)" aria-label="עוגיות" style="font-size:.75rem;width:auto;padding:0 10px;border-radius:18px">עוגיות</a>' +
      '</div>' +
    '</header>' +
    '<div class="chip-row" id="chips"></div>' +
    '<main class="page">' +
      '<div class="layout browse" id="layout">' +
        '<section class="primary" id="primary">' +
          '<div class="primary-stage" id="primaryStage">' +
            '<div class="player-shell paused" id="playerShell">' +
              '<video id="v" playsinline preload="metadata" controlslist="nodownload"></video>' +
              '<div class="yt-load"><div class="spin"></div><span>טוען סרטון…</span></div>' +
              '<div class="yt-bigplay" id="bigPlay"><div class="circle"></div></div>' +
              '<div class="yt-controls" id="ytControls" dir="ltr">' +
                '<div class="yt-progress" id="ytProg" title="התקדמות" dir="ltr">' +
                  '<div class="yt-buf" id="ytBuf"></div>' +
                  '<div class="yt-bar" id="ytBar"></div>' +
                  '<div class="yt-knob" id="ytKnob"></div>' +
                '</div>' +
                '<div class="yt-row" dir="ltr">' +
                  '<button type="button" class="yt-cbtn" id="cPlay" title="הפעלה / השהיה" aria-label="נגן">' +
                    '<svg id="iconPlay" viewBox="0 0 24 24"><path d="M8 5v14l11-7z"/></svg>' +
                    '<svg id="iconPause" viewBox="0 0 24 24" style="display:none"><path d="M6 19h4V5H6v14zm8-14v14h4V5h-4z"/></svg>' +
                  '</button>' +
                  '<div class="yt-vol">' +
                    '<button type="button" class="yt-cbtn" id="cMute" title="השתק" aria-label="עוצמה">' +
                      '<svg viewBox="0 0 24 24"><path d="M3 9v6h4l5 5V4L7 9H3zm13.5 3c0-1.77-1.02-3.29-2.5-4.03v8.05c1.48-.73 2.5-2.25 2.5-4.02zM14 3.23v2.06c2.89.86 5 3.54 5 6.71s-2.11 5.85-5 6.71v2.06c4.01-.91 7-4.49 7-8.77s-2.99-7.86-7-8.77z"/></svg>' +
                    '</button>' +
                    '<input id="cVol" type="range" min="0" max="1" step="0.05" value="1" aria-label="עוצמת קול"/>' +
                  '</div>' +
                  '<span class="yt-time" id="ytTime">0:00 / 0:00</span>' +
                  '<span class="spacer"></span>' +
                  '<div class="yt-end-right">' +
                    '<button type="button" class="yt-cbtn" id="cAuto" title="הפעלה אוטומטית" aria-label="אוטו">' +
                      '<svg viewBox="0 0 24 24"><path d="M12 4V1L8 5l4 4V6c3.31 0 6 2.69 6 6 0 1.01-.25 1.97-.7 2.8l1.46 1.46C19.54 15.03 20 13.57 20 12c0-4.42-3.58-8-8-8zm0 14c-3.31 0-6-2.69-6-6 0-1.01.25-1.97.7-2.8L5.24 7.74C4.46 8.97 4 10.43 4 12c0 4.42 3.58 8 8 8v3l4-4-4-4v3z"/></svg>' +
                    '</button>' +
                    '<button type="button" class="yt-cbtn" id="cCc" title="כתוביות" aria-label="כתוביות">' +
                      '<svg viewBox="0 0 24 24"><path d="M19 4H5a2 2 0 00-2 2v12a2 2 0 002 2h14a2 2 0 002-2V6a2 2 0 00-2-2zm-8 7H9.5v-.5h-2v3h2V13H11v1a1 1 0 01-1 1H7a1 1 0 01-1-1v-4a1 1 0 011-1h3a1 1 0 011 1v1zm7 0h-1.5v-.5h-2v3h2V13H18v1a1 1 0 01-1 1h-3a1 1 0 01-1-1v-4a1 1 0 011-1h3a1 1 0 011 1v1z"/></svg>' +
                    '</button>' +
                    '<button type="button" class="yt-cbtn" id="btn-quality" title="איכות" aria-label="הגדרות" style="font-size:.7rem;font-weight:700">HD</button>' +
                    '<button type="button" class="yt-cbtn" id="cTheater" title="מצב תיאטרון">' +
                      '<svg viewBox="0 0 24 24"><path d="M19 6H5c-1.1 0-2 .9-2 2v8c0 1.1.9 2 2 2h14c1.1 0 2-.9 2-2V8c0-1.1-.9-2-2-2zm0 10H5V8h14v8z"/></svg>' +
                    '</button>' +
                    '<button type="button" class="yt-cbtn" id="cMini" title="נגן מזערי">' +
                      '<svg viewBox="0 0 24 24"><path d="M19 7h-8v6h8V7zm2-4H3c-1.1 0-2 .9-2 2v14c0 1.1.9 2 2 2h18c1.1 0 2-.9 2-2V5c0-1.1-.9-2-2-2zm0 16H3V5h18v14z"/></svg>' +
                    '</button>' +
                    '<button type="button" class="yt-cbtn" id="cFs" title="מסך מלא">' +
                      '<svg viewBox="0 0 24 24"><path d="M7 14H5v5h5v-2H7v-3zm-2-4h2V7h3V5H5v5zm12 7h-3v2h5v-5h-2v3zM14 5v2h3v3h2V5h-5z"/></svg>' +
                    '</button>' +
                  '</div>' +
                '</div>' +
              '</div>' +
            '</div>' +
            '<div class="player-toolbar" style="display:none">' +
              '<button type="button" class="tool-btn primary" id="play">נגן</button>' +
              '<button type="button" class="tool-btn" id="retry">נסה שוב</button>' +
              '<button type="button" class="tool-btn" id="btn-theater">תיאטרון</button>' +
              '<button type="button" class="tool-btn" id="btn-mini">מזער</button>' +
              '<button type="button" class="tool-btn" id="btn-expand">הרחב</button>' +
            '</div>' +
          '</div>' +
          '<div class="video-meta">' +
            '<h1 id="vtitle">בחרו סרטון מהרשימה</h1>' +
            '<div class="meta-row" style="display:flex;flex-wrap:wrap;gap:12px;align-items:center;justify-content:space-between">' +
              '<div style="display:flex;align-items:center;gap:10px;flex-wrap:wrap">' +
                '<div class="channel-block" id="channelBlock" title="עבור לערוץ" style="cursor:pointer">' +
                  '<div class="avatar" id="avatar">▶</div>' +
                  '<div><div class="ch-name" id="vchannel">—</div><div class="ch-sub" id="vsub">לחצו למעבר לערוץ</div></div>' +
                '</div>' +
                '<button type="button" class="tool-btn primary" id="btn-channel" style="border-radius:18px">לערוץ</button>' +
              '</div>' +
              '<div class="actions" style="display:flex;flex-wrap:wrap;gap:8px;align-items:center">' +
                '<div style="display:inline-flex;border-radius:18px;overflow:hidden;background:var(--yt-elevated)">' +
                  '<button type="button" class="tool-btn" id="btn-like" title="אהבתי" style="border-radius:0;background:transparent">👍 אהבתי</button>' +
                  '<button type="button" class="tool-btn" id="btn-dislike" title="לא אהבתי" style="border-radius:0;background:transparent;border-inline-start:1px solid var(--yt-border)">👎</button>' +
                '</div>' +
                '<button type="button" class="tool-btn" id="btn-share">↗ שיתוף</button>' +
                '<button type="button" class="tool-btn" id="btn-copy">העתק קישור</button>' +
                '<button type="button" class="tool-btn primary" id="btn-download">⬇ הורדה</button>' +
                '<button type="button" class="tool-btn" id="btn-audio" title="הורדת פסקול כ-MP3 (ממיר דרך ffmpeg מקומי; מתנגן בכל נגן וטלפון)">🎵 אודיו MP3</button>' +
                '<button type="button" class="tool-btn" id="btn-diagnostics" title="אבחון נגן">🔍 אבחון</button>' +
                '<span id="status">מוכן</span>' +
              '</div>' +
            '</div>' +
            '<div id="err"></div>' +
            '<div class="desc-box" id="descBox">' +
              '<div class="desc-stats" id="descStats">פרטי הסרטון</div>' +
              '<div class="desc-text" id="descText">בחרו סרטון כדי לראות תיאור, צפיות ותאריך.</div>' +
              '<div class="desc-more" id="descMore">הצג עוד</div>' +
            '</div>' +
          '</div>' +
        '</section>' +
        '<aside class="secondary" id="secondary">' +
          '<div id="chBanner" style="display:none;margin-bottom:16px">' +
            '<div id="chBannerImg" style="height:120px;border-radius:12px;background:linear-gradient(90deg,#e5e5e5,#f2f2f2);background-size:cover;background-position:center;margin-bottom:14px"></div>' +
            '<div style="display:flex;gap:16px;align-items:flex-start;flex-wrap:wrap">' +
              '<div class="avatar" id="chAvatarBig" style="width:80px;height:80px;font-size:1.8rem;border-radius:50%">▶</div>' +
              '<div style="flex:1;min-width:200px">' +
                '<div style="font-weight:700;font-size:1.5rem;line-height:1.3" id="chTitle">ערוץ</div>' +
                '<div style="color:#606060;font-size:.92rem;margin-top:4px" id="chInfo"></div>' +
                '<div style="color:#0f0f0f;font-size:.92rem;margin-top:10px;line-height:1.45;white-space:pre-wrap;max-height:4.5em;overflow:hidden" id="chDesc"></div>' +
                '<button type="button" class="tool-btn primary" id="btn-ch-back" style="margin-top:12px;border-radius:18px">← חזרה לנגן</button>' +
              '</div>' +
            '</div>' +
          '</div>' +
          '<div class="sec-head"><h2 id="secTitle">סרטונים</h2><span id="secCount" style="color:var(--yt-muted);font-size:.85rem"></span></div>' +
          '<div id="results" class="results-grid"></div>' +
          '<div class="empty" id="emptyHint"><strong>חפשו ביוטיוב</strong>הקלידו בשורת החיפוש למעלה — התוצאות יופיעו כאן.</div>' +
        '</aside>' +
      '</div>' +
      '<div id="diagPanel" class="diag-overlay" style="display:none">' +
        '<div class="diag-panel" onclick="event.stopPropagation()">' +
          '<h2>🔍 אבחון נגן <span class="badge">live</span></h2>' +
          '<div id="diagContent"><div class="diag-section"><h3>טוען…</h3></div></div>' +
          '<div class="diag-close">' +
            '<button class="primary" onclick="showDiagnostics()">🔄 רענן</button>' +
            '<button onclick="closeDiagnostics()">סגור</button>' +
          '</div>' +
        '</div>' +
      '</div>' +
      '<p class="hint-foot">ממשק בהיר בהשראת YouTube · תמונות מוגנות מפיקסול · ניגון בזרימה · הורדה אמיתית</p>' +
    '</main>' +
    '<div class="mini-dock" id="miniDock">' +
      '<div class="mini-stage" id="miniStage"></div>' +
      '<div class="mini-bar">' +
        '<div class="mt" id="miniTitle">—</div>' +
        '<button type="button" class="icon-btn" id="mini-expand" title="הרחב" aria-label="הרחב"><svg viewBox="0 0 24 24"><path d="M7 14H5v5h5v-2H7v-3zm-2-4h2V7h3V5H5v5zm12 7h-3v2h5v-5h-2v3zM14 5v2h3v3h2V5h-5z"/></svg></button>' +
        '<button type="button" class="icon-btn" id="mini-close" title="סגור" aria-label="סגור"><svg viewBox="0 0 24 24"><path d="M19 6.41L17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg></button>' +
      '</div>' +
    '</div>' +
    '<div class="shorts-modal" id="shortsModal">' +
      '<div class="shorts-header">' +
        '<div class="shorts-title">' +
          '<svg viewBox="0 0 24 24"><path d="M17.77 10.32l-1.2-.5L18 9.06c1.84-.96 2.53-3.23 1.56-5.06s-3.24-2.53-5.07-1.56L6 6.94c-1.29.68-2.07 2.04-2 3.49.07 1.42.93 2.67 2.22 3.25.03.01 1.2.5 1.2.5L6 14.93c-1.83.96-2.53 3.23-1.56 5.06 1 1.83 3.23 2.53 5.07 1.56l8.47-4.5c1.29-.68 2.07-2.04 2-3.49-.07-1.42-.93-2.67-2.21-3.24zM10 14.65V9.35L15 12l-5 2.65z"/></svg>' +
          '<span>Shorts</span>' +
        '</div>' +
        '<button type="button" class="shorts-close" id="shortsClose" title="סגירה (Esc)">&times;</button>' +
      '</div>' +
      '<div class="shorts-stage-wrap">' +
        '<div class="shorts-card">' +
          '<div class="player-shell portrait loading" id="shortsShell">' +
            '<video id="shortsVideo" playsinline preload="metadata" controlslist="nodownload"></video>' +
            '<div class="yt-load"><div class="spin"></div><span>טוען Shorts…</span></div>' +
            '<div class="yt-bigplay" id="shortsBigPlay"><div class="circle"></div></div>' +
          '</div>' +
          '<div class="shorts-overlay-info">' +
            '<div class="shorts-ch" id="shortsCh">@channel</div>' +
            '<div class="shorts-vtitle" id="shortsTitle">Shorts Title</div>' +
          '</div>' +
        '</div>' +
        '<div class="shorts-actions">' +
          '<div class="shorts-btn" id="shortsPrev" title="הקודם">' +
            '<div class="shorts-btn-ic"><svg viewBox="0 0 24 24"><path d="M7.41 15.41L12 10.83l4.59 4.58L18 14l-6-6-6 6z"/></svg></div>' +
            '<span>הקודם</span>' +
          '</div>' +
          '<div class="shorts-btn" id="shortsNext" title="הבא">' +
            '<div class="shorts-btn-ic"><svg viewBox="0 0 24 24"><path d="M7.41 8.59L12 13.17l4.59-4.58L18 10l-6 6-6-6z"/></svg></div>' +
            '<span>הבא</span>' +
          '</div>' +
          '<div class="shorts-btn" id="shortsMute" title="השתק/הפעל שמע">' +
            '<div class="shorts-btn-ic"><svg viewBox="0 0 24 24"><path d="M3 9v6h4l5 5V4L7 9H3zm13.5 3c0-1.77-1.02-3.29-2.5-4.03v8.05c1.48-.73 2.5-2.25 2.5-4.02z"/></svg></div>' +
            '<span>שמע</span>' +
          '</div>' +
        '</div>' +
      '</div>' +
    '</div>' +
    '<input id="vid" value="' + safeId.replace(/"/g, '') + '" tabindex="-1"/>' +
    '<script>\nwindow.YT_RELAY_ACTIVE = ' + JSON.stringify(relayConfigured(env)) + ';\nwindow.SW_VERSION = ' + SW_VERSION + ';\n' + PLAYER_CLIENT_JS + '\n</script></body></html>';

  return new Response(html, {
    status: 200,
    headers: {
      'content-type': 'text/html; charset=utf-8',
      'cache-control': 'no-store',
      'referrer-policy': 'no-referrer',
      'x-etrog-player': 'sealed-blob-yt-ui',
      'set-cookie': safeId
        ? '__yt_vid=' + encodeURIComponent(safeId) + '; Path=/; Max-Age=86400; SameSite=Lax; Secure'
        : ''
    }
  });
}

const PLAYER_CLIENT_JS = [
"(function(){",
"  var KEY=[97,110,116,105,103,114,97,118,105,116,121];",
"  var video=document.getElementById('v');",
"  var statusEl=document.getElementById('status');",
"  var errBox=document.getElementById('err');",
"  var q=document.getElementById('q');",
"  var vidInput=document.getElementById('vid');",
"  var results=document.getElementById('results');",
"  var qsearch=document.getElementById('qsearch');",
"  var layout=document.getElementById('layout');",
"  var playerShell=document.getElementById('playerShell');",
"  var miniDock=document.getElementById('miniDock');",
"  var miniStage=document.getElementById('miniStage');",
"  var miniTitle=document.getElementById('miniTitle');",
"  var emptyHint=document.getElementById('emptyHint');",
"  var vtitle=document.getElementById('vtitle');",
"  var vchannel=document.getElementById('vchannel');",
"  var avatar=document.getElementById('avatar');",
"  var secTitle=document.getElementById('secTitle');",
"  var secCount=document.getElementById('secCount');",
"  var chips=document.getElementById('chips');",
"  var descBox=document.getElementById('descBox');",
"  var descStats=document.getElementById('descStats');",
"  var descText=document.getElementById('descText');",
"  var descMore=document.getElementById('descMore');",
"  var channelBlock=document.getElementById('channelBlock');",
"  var bigPlay=document.getElementById('bigPlay');",
"  var ytBar=document.getElementById('ytBar');",
"  var ytBuf=document.getElementById('ytBuf');",
"  var ytKnob=document.getElementById('ytKnob');",
"  var ytProg=document.getElementById('ytProg');",
"  var ytTime=document.getElementById('ytTime');",
"  var iconPlay=document.getElementById('iconPlay');",
"  var iconPause=document.getElementById('iconPause');",
"  var blobUrl=null;",
"  var mode='browse';",
"  var currentMeta={id:'',title:'',channel:'',channelId:'',thumb:'',description:'',views:'',published:'',duration:''};",
"  var lastItems=[];",
"  var FALLBACK=['18','22','36','17'];",
"  var currentItag='18';",
"  var CHIP_LABELS=['הכל','מוזיקה','חדשות','לייב','משחקים','ספורט','סרטים','לימודים'];",
"  var searching=false;",
"  var playStartTs=0;",
"  var qualityStrict=false;",
"",
"  function setStatus(m){ if(statusEl) statusEl.textContent=m||''; }",
"  function showErr(m){ if(!errBox) return; errBox.style.display=m?'block':'none'; errBox.textContent=m||''; }",
"  function fmtTime(s){",
"    s=Math.max(0,Math.floor(s||0));",
"    var h=Math.floor(s/3600), m=Math.floor((s%3600)/60), sec=s%60;",
"    if(h>0) return h+':'+String(m).padStart(2,'0')+':'+String(sec).padStart(2,'0');",
"    return m+':'+String(sec).padStart(2,'0');",
"  }",
"  function extractId(s){",
"    s=(s||'').trim();",
"    if(/^[\\w-]{6,}$/.test(s)) return s;",
"    try{",
"      var u=new URL(s);",
"      if(u.hostname.indexOf('youtu.be')!==-1) return u.pathname.slice(1).split('/')[0];",
"      if(u.searchParams.get('v')) return u.searchParams.get('v');",
"      var m=u.pathname.match(/\\/(?:embed|shorts|live|v)\\/([^/?#]+)/);",
"      if(m) return m[1];",
"    }catch(e){}",
"    return s;",
"  }",
"  function encodeTok(obj){",
"    var data=new TextEncoder().encode(JSON.stringify(obj));",
"    for(var i=0;i<data.length;i++) data[i]=data[i]^KEY[i%KEY.length];",
"    var binary='';",
"    for(var i=0;i<data.length;i++) binary+=String.fromCharCode(data[i]);",
"    return btoa(binary).replace(/\\+/g,'-').replace(/\\//g,'_').replace(/=+$/g,'');",
"  }",
"  function mediaUrl(id,itag,dl,strict,directUrl){",
"    // Stealth path + XOR token only (no clear video id — harder for Etrog URL filters)",
"    var it=String(itag||currentItag||'18');",
"    // itag, strict, dl are encoded inside payload (inside tok) — NOT exposed as URL params",
"    var payload={v:id,i:it,t:Date.now(),s:strict?1:0,d:dl?1:0};",
"    if(directUrl) payload.u=String(directUrl);",
"    var tok=encodeTok(payload);",
"    // Short generic path — no YouTube-specific params visible to network filters",
"    var u='/x/s/'+tok.slice(0,12)+'.bin?d='+encodeURIComponent(tok)+'&i='+encodeURIComponent(it);",
"    return u;",
"  }",
"  // Client-side Innertube via sandboxed iframe (Origin:null). CF Worker IPs get LOGIN_REQUIRED;",
"  // browser residential IP + Origin:null is allowed by YouTube and returns streamingData.",
"  var clientFmtCache={};",
"  // Remembers whether THIS network lets the browser reach googlevideo directly, so we probe",
"  // once instead of paying fallback latency on every video. Re-probes after a day.",
"  function parseDurationSec(s){",
"    s=String(s||'').trim(); if(!s) return 0;",
"    var p=s.split(':').map(function(x){ return parseInt(x,10)||0; });",
"    if(p.length===3) return p[0]*3600+p[1]*60+p[2];",
"    if(p.length===2) return p[0]*60+p[1];",
"    return p[0]||0;",
"  }",
"  function directPref(){ try{ var t=parseInt(localStorage.getItem('etrog_direct_ts')||'0',10)||0; if(Date.now()-t>864e5) return null; return localStorage.getItem('etrog_direct'); }catch(e){ return null; } }",
"  function setDirectPref(ok){ try{ localStorage.setItem('etrog_direct', ok?'1':'0'); localStorage.setItem('etrog_direct_ts', String(Date.now())); }catch(e){} }",
"  function resolveFormatsClient(videoId, timeoutMs){",
"    videoId=String(videoId||'');",
"    if(!videoId) return Promise.reject(new Error('missing id'));",
"    if(clientFmtCache[videoId] && clientFmtCache[videoId].exp>Date.now()){",
"      return Promise.resolve(clientFmtCache[videoId].formats);",
"    }",
"    return fetch('/x/i/player?v='+encodeURIComponent(videoId))",
"      .then(function(r){ return r.json(); })",
"      .then(function(d){",
"        if(d && d.ok && d.formats && d.formats.length){",
"          clientFmtCache[videoId]={formats:d.formats,exp:Date.now()+5*60*1000};",
"          return d.formats;",
"        }",
"        throw new Error((d && d.error) || 'no formats');",
"      });",
"  }",
"  function pickClientFormat(formats, prefer){",
"    prefer=String(prefer||'18');",
"    var by={};",
"    (formats||[]).forEach(function(f){ if(f&&f.itag!=null&&f.url) by[String(f.itag)]=f; });",
"    var order=[prefer,'22','18','37','38','36','17','136','137','135','134','133','160','251','140','139'];",
"    for(var i=0;i<order.length;i++){ if(by[order[i]]&&(by[order[i]].progressive||(by[order[i]].hasAudio&&by[order[i]].hasVideo)||by[order[i]].url)) return by[order[i]]; }",
"    for(var j=0;j<(formats||[]).length;j++){ var f=formats[j]; if(f&&f.url&&(f.progressive||(f.hasAudio&&f.hasVideo))) return f; }",
"    for(var k=0;k<(formats||[]).length;k++){ if(formats[k]&&formats[k].url) return formats[k]; }",
"    return null;",
"  }",
"  function updateQualityBtn(){",
"    var bq=document.getElementById('btn-quality');",
"    var itagH={'18':360,'22':720,'37':1080,'36':240,'17':144};",
"    var h=itagH[String(currentItag)]||currentHeight||360;",
"    var label=(h>=1080?'1080':h>=720?'720':h>=480?'480':h>=360?'360':h>=240?'240':'144');",
"    if(!bq) return;",
"    if(q && q.value==='auto'){ bq.textContent='AUTO'; bq.title='איכות: אוטומטי ('+label+'p)'; return; }",
"    bq.textContent=label;",
"    bq.title='איכות: '+label+'p (לחצו להחלפה)';",
"  }",
"  // Make the Service Worker actually CONTROL this page. A hard-reload (Ctrl+Shift+R) starts",
"  // the page uncontrolled (controller===null) even when the SW is installed; the SW's",
"  // clients.claim() takes over a moment later. We wait for that (up to ~9s) and poll, because",
"  // without a controller the sealed media stream cannot be unsealed and playback fails.",
"  function ensureSw(){",
"    if(!('serviceWorker' in navigator)) return Promise.resolve();",
"    if(navigator.serviceWorker.controller) return Promise.resolve();",
"    return navigator.serviceWorker.register('/sw.js?v=' + (window.SW_VERSION || '98'),{scope:'/'}).then(function(reg){",
"      try{ if(reg && reg.waiting) reg.waiting.postMessage&&reg.waiting.postMessage('skipWaiting'); }catch(e){}",
"      return navigator.serviceWorker.ready.catch(function(){});",
"    }).then(function(){",
"      if(navigator.serviceWorker.controller) return;",
"      return new Promise(function(resolve){",
"        var done=false; function fin(){ if(done) return; done=true; clearInterval(iv); clearTimeout(to); try{ navigator.serviceWorker.removeEventListener('controllerchange',onc); }catch(e){} resolve(); }",
"        function onc(){ fin(); }",
"        navigator.serviceWorker.addEventListener('controllerchange',onc);",
"        var iv=setInterval(function(){ if(navigator.serviceWorker.controller) fin(); },250);",
"        var to=setTimeout(fin,9000);",
"      });",
"    }).catch(function(){});",
"  }",
"  function thumbFor(id,q){",
"    var tok=encodeTok({v:id,q:q||'hq720'});",
"    return '/x/t?d='+encodeURIComponent(tok);",
"  }",
"  function unsealBuf(buf,offset){",
"    offset=offset||0; var out=new Uint8Array(buf.length);",
"    for(var i=0;i<buf.length;i++) out[i]=buf[i]^KEY[(offset+i)%KEY.length];",
"    return out;",
"  }",
"  // ── Adaptive (MSE) playback: video-only itag + audio itag, muxed via MediaSource ──",
"  // Needed because many videos have NO progressive stream (itag 18/22 absent) and to",
"  // deliver real 720p/1080p, which YouTube only serves as separate adaptive tracks.",
"  var currentHeight = 360;",
"  var adaptiveFmtCache = {};",
"  async function getServerFormats(id){",
"    if(adaptiveFmtCache[id] && adaptiveFmtCache[id].exp>Date.now()) return adaptiveFmtCache[id].list;",
"    var r = await fetch('/api/yt-formats?v='+encodeURIComponent(id), {credentials:'same-origin', cache:'no-store'});",
"    var j = await r.json().catch(function(){ return null; });",
"    if(!j || !j.ok || !j.formats || !j.formats.length) return null;",
"    adaptiveFmtCache[id] = { list:j.formats, exp:Date.now()+5*60*1000 };",
"    return j.formats;",
"  }",
"  function heightsAvailable(formats){",
"    var hs = {};",
"    (formats||[]).forEach(function(f){ if(f.hasVideo && f.height) hs[f.height]=1; });",
"    return Object.keys(hs).map(Number).sort(function(a,b){ return b-a; });",
"  }",
"  // Pick video+audio pair for MSE, with multi-codec fallback.",
"  // Priority: avc1/mp4 first, then vp9/webm, then vp8/webm, then any video codec.",
"  function pickAdaptivePair(formats, targetHeight){",
"    if(!formats) return null;",
"    // Video selection: prefer avc1/mp4, fall back to vp9/webm, then vp8/webm, then any",
"    function vidScore(f){",
"      if(!f||!f.hasVideo||f.hasAudio) return -1;",
"      var m=String(f.mime||f.mimeType||'');",
"      if(m.indexOf('mp4')>=0 && /avc1/i.test(m)) return 4;",
"      if(m.indexOf('webm')>=0 && /vp9/i.test(m)) return 3;",
"      if(m.indexOf('webm')>=0 && /vp8/i.test(m)) return 2;",
"      if(m.indexOf('mp4')>=0) return 1;",
"      return 0;",
"    }",
"    var vids = formats.filter(function(f){ return vidScore(f)>=0; });",
"    vids.sort(function(a,b){ var s=vidScore(b)-vidScore(a); if(s!==0) return s; return (b.height||0)-(a.height||0); });",
"    if(!vids.length) return null;",
"    // Audio selection: prefer mp4/m4a first, then opus/webm, then any",
"    function audScore(f){",
"      if(!f||!f.hasAudio||f.hasVideo) return -1;",
"      var m=String(f.mime||f.mimeType||'');",
"      if(m.indexOf('mp4')>=0) return 2;",
"      if(m.indexOf('webm')>=0) return 1;",
"      return 0;",
"    }",
"    var auds = formats.filter(function(f){ return audScore(f)>=0; });",
"    auds.sort(function(a,b){ return audScore(b)-audScore(a); });",
"    if(!auds.length) return null;",
"    var th = targetHeight || 360;",
"    // Pick video track at or below target height with best codec",
"    var chosen = null;",
"    for(var v=0;v<vids.length;v++){ if((vids[v].height||9999) <= th){ chosen = vids[v]; break; } }",
"    if(!chosen) chosen = vids[vids.length-1];",
"    // Pick audio with matching container (prefer mp4 for mp4 video, webm for webm video)",
"    var isWebmVideo = String(chosen.mime||chosen.mimeType||'').indexOf('webm')>=0;",
"    var matchingAud = null;",
"    // Match audio container to video container (mp4 for mp4 video, webm for webm video)",
"    for(var a=0;a<auds.length;a++){",
"      var aMime=String(auds[a].mime||auds[a].mimeType||'');",
"      if(isWebmVideo && aMime.indexOf('webm')>=0){ matchingAud=auds[a]; break; }",
"      if(!isWebmVideo && aMime.indexOf('mp4')>=0){ matchingAud=auds[a]; break; }",
"    }",
"    if(!matchingAud) matchingAud = auds[0]; // last resort — any container",
"    return { video:chosen, audio:matchingAud };",
"  }",
"  function makeAppender(){",
"    var q = Promise.resolve();",
"    return function(sb, data, tag){",
"      q = q.then(function(){",
"        return new Promise(function(res){",
"          function done(){ try{ sb.removeEventListener('updateend',ok); sb.removeEventListener('error',er); }catch(e){} res(); }",
"          function ok(){ done(); }",
"          function er(e){ done(); }",
"          function doAppend(){",
"            try{",
"              sb.addEventListener('updateend', ok, {once:true});",
"              sb.addEventListener('error', er, {once:true});",
"              sb.appendBuffer(data);",
"            }catch(e){",
"              if((e.name==='QuotaExceededError'||e.code===22) && video.currentTime>15){",
"                try{",
"                  var ct = video.currentTime;",
"                  if(sb.buffered.length && sb.buffered.start(0)<ct-10){",
"                    sb.remove(0, ct-10);",
"                    sb.addEventListener('updateend', function(){",
"                      try{ sb.appendBuffer(data); }catch(e2){} done();",
"                    }, {once:true});",
"                    return;",
"                  }",
"                }catch(ex){}",
"              }",
"              done();",
"            }",
"          }",
"          doAppend();",
"        });",
"      });",
"      return q;",
"    };",
"  }",
"  // Safe append boundary for fragmented MP4. MSE rejects a buffer that ends inside a box",
"  // (mid-mdat) OR on a 'moof' whose paired 'mdat' has not arrived yet — an orphan moof",
"  // fails the whole append. So we only advance the boundary past init boxes and past a",
"  // COMPLETE mdat, never leaving a trailing lone moof. The remainder is carried forward.",
"  // Safe append boundary for fragmented MP4/WebM. MSE rejects a buffer that ends inside a box",
"  // (mid-mdat) OR on a 'moof' whose paired 'mdat' has not arrived yet — an orphan moof",
"  // fails the whole append. We only advance the boundary past init boxes and past a",
"  // COMPLETE mdat, never leaving a trailing lone moof. The remainder is carried forward.",
"  function completeBoxLen(buf){",
"    var p=0, safe=0; var dv=new DataView(buf.buffer, buf.byteOffset, buf.byteLength);",
"    var maxIter = 2000; // safety: never loop indefinitely on corrupt data",
"    while(p+8<=buf.length && maxIter-->0){",
"      var sz=dv.getUint32(p);",
"      if(sz===0){ /* box extends to end of file/stream — commit everything */ safe=buf.length; break; }",
"      if(sz===1){ if(p+16>buf.length) break; sz=Number(dv.getBigUint64(p+8)); }",
"      if(sz<8) break;",
"      if(p+sz>buf.length) break;",
"      var type=String.fromCharCode(buf[p+4],buf[p+5],buf[p+6],buf[p+7]);",
"      p+=sz;",
"      if(type!=='moof') safe=p;", // commit boundary after everything except a lone moof
"    }",
"    return safe;",
"  }",
"  function concatBufs(a,b){ if(!a||!a.length) return b; if(!b||!b.length) return a; var o=new Uint8Array(a.length+b.length); o.set(a,0); o.set(b,a.length); return o; }",
"  async function pumpItag(id, itag, sb, append, gen, onChunk){",
"    // 1MB chunks: some googlevideo audio URLs (esp. from the IOS client) REJECT a Range",
"    // larger than ~1MB with an error, which surfaced as a 502 and killed the whole track.",
"    // On failure we halve the chunk (down to 256KB) and retry, adapting to any per-URL cap.",
"    var pos = 0, total = Infinity, CH = 1<<20, MIN_CH = 1<<18;",
"    var leftover = new Uint8Array(0);",
"    var pumpStart = Date.now();",
"    while(pos < total){",
"      if(gen!==playGen) return;",
"      // Safety timeout — abort if stuck for 3+ minutes (network hang / bad stream)",
"      if(Date.now() - pumpStart > 180000) throw new Error('adaptive pump timeout itag '+itag);",
"      try{",
"        var curT = video.currentTime||0;",
"        var bEnd = 0;",
"        if(sb.buffered && sb.buffered.length){",
"          for(var bi=0; bi<sb.buffered.length; bi++){",
"            if(sb.buffered.start(bi)<=curT+2 && sb.buffered.end(bi)>=curT){ bEnd = sb.buffered.end(bi); break; }",
"          }",
"        }",
"        // Pause fetching when we have more than 60s of buffered data ahead",
"        if(bEnd>0 && (bEnd-curT)>60){",
"          await new Promise(function(rs){ setTimeout(rs, 800); });",
"          continue;",
"        }",
"      }catch(e){}",
"      // strict=true: the worker must return THIS exact itag or fail (never substitute a wrong",
"      // track). Retry transient failures; shrink the chunk when the URL rejects large ranges.",
"      var r = null;",
"      var gotLen = 0;",
"      for(var attempt=0; attempt<6; attempt++){",
"        if(gen!==playGen) return;",
"        try{ r = await fetch(mediaUrl(id, itag, false, true, ''), { headers:{ 'Range':'bytes='+pos+'-'+(pos+CH-1) }, credentials:'same-origin', cache:'no-store' }); }catch(e){ r = null; }",
"        if(r && (r.ok || r.status===206)){",
"          // Check actual content length — if server returns less than requested,",
"          // adapt chunk size to avoid repeated short responses",
"          var clH = r.headers.get('Content-Length') || r.headers.get('content-length');",
"          if(clH) gotLen = parseInt(clH,10) || 0;",
"          if(gotLen>0 && gotLen<CH && CH>MIN_CH){",
"            CH = Math.max(MIN_CH, Math.min(CH, Math.max(MIN_CH, gotLen*2)));",
"          }",
"          break;",
"        }",
"        r = null;",
"        if(CH > MIN_CH){ CH = Math.max(MIN_CH, CH>>1); }",
"        else { await new Promise(function(rs){ setTimeout(rs, 400*(attempt+1)); }); }",
"      }",
"      if(!r) throw new Error('adaptive fetch failed itag '+itag+' @'+pos);",
"      var servedItag = r.headers.get('X-Etrog-Itag');",
"      if(servedItag && String(servedItag)!==String(itag)) throw new Error('itag mismatch: asked '+itag+' got '+servedItag);",
"      var cr = r.headers.get('Content-Range');",
"      if(cr){ var mt = cr.match(/\\/(\\d+)\\s*$/); if(mt) total = parseInt(mt[1],10); }",
"      var sealedFlag = r.headers.get('X-Proxy-Obfuscated')==='1';",
"      var off = parseInt(r.headers.get('X-Seal-Offset')||String(pos), 10); if(isNaN(off)) off = pos;",
"      var ab = new Uint8Array(await r.arrayBuffer());",
"      if(!ab.length) break;",
"      if(sealedFlag) ab = unsealBuf(ab, off);",
"      pos += ab.length;",
"      if(onChunk) try{ onChunk(pos); }catch(e){}",
"      if(gen!==playGen) return;",
"      // Append only whole boxes; carry the partial tail into the next fetch.",
"      var buf = concatBufs(leftover, ab);",
"      var take = (pos>=total) ? buf.length : completeBoxLen(buf);",
"      if(take>0){ leftover = buf.slice(take); if(gen!==playGen) return; await append(sb, buf.subarray(0, take), itag); }",
"      else { leftover = buf; }",
"      if(!cr) break; // origin ignored Range: one shot",
"    }",
"    if(leftover.length){ if(gen!==playGen) return; await append(sb, leftover, itag); }",
"  }",
"  async function playAdaptive(id, pair, gen){",
"    if(!('MediaSource' in window)) throw new Error('MSE unsupported');",
"    function tryCodec(m, fallbacks){",
"      if(MediaSource.isTypeSupported(m)) return m;",
"      for(var fi=0;fi<fallbacks.length;fi++){ if(MediaSource.isTypeSupported(fallbacks[fi])) return fallbacks[fi]; }",
"      return m; // last resort — let MSE throw its own error",
"    }",
"    var vMime = tryCodec(pair.video.mimeType || pair.video.mime || 'video/mp4; codecs=\"avc1.4d401f\"', [pair.video.mime || 'video/mp4', 'video/webm; codecs=\"vp9\"', 'video/webm; codecs=\"vp8\"', 'video/mp4']);",
"    var aMime = tryCodec(pair.audio.mimeType || pair.audio.mime || 'audio/mp4; codecs=\"mp4a.40.2\"', [pair.audio.mime || 'audio/mp4', 'audio/webm; codecs=\"opus\"', 'audio/mp4']);",
"    var ms = new MediaSource();",
"    if(blobUrl){ try{ URL.revokeObjectURL(blobUrl); }catch(e){} }",
"    blobUrl = URL.createObjectURL(ms);",
"    video.src = blobUrl;",
"    video.load();",
"    await new Promise(function(res, rej){",
"      var to = setTimeout(function(){ rej(new Error('sourceopen timeout')); }, 8000);",
"      ms.addEventListener('sourceopen', function(){ clearTimeout(to); res(); }, {once:true});",
"    });",
"    if(gen!==playGen) return;",
"    var vSB = ms.addSourceBuffer(vMime);",
"    var aSB = ms.addSourceBuffer(aMime);",
"    var append = makeAppender();",
"    var vErr = null, aErr = null, vPos = 0, aPos = 0, vDone = false, aDone = false;",
"    var pV = pumpItag(id, pair.video.itag, vSB, append, gen, function(p){ vPos = p; }).then(function(){ vDone = true; }).catch(function(e){ vErr = e; });",
"    var pA = pumpItag(id, pair.audio.itag, aSB, append, gen, function(p){ aPos = p; }).then(function(){ aDone = true; }).catch(function(e){ aErr = e; });",
"    var started = false;",
"    // Autoplay MUTED first (unmuted autoplay is blocked without a gesture — the reason 720p",
"    // 'wouldn't start' before), then unmute once it is actually playing (allowed on a playing",
"    // element). Mirrors the progressive path, which is why that one always started.",
"    var kick = setInterval(function(){ if(!started && video.readyState>=2){ started = true; try{ video.muted=true; var pp=video.play(); if(pp&&pp.then) pp.then(function(){ try{ video.muted=false; video.volume=1; }catch(e){} }).catch(function(){}); }catch(e){} } }, 250);",
"    // Keep pumping in the BACKGROUND and finish the stream when both tracks complete —",
"    // do NOT block success on the full download, or the spinner stays up and long/HD videos",
"    // buffer their whole length before the player even leaves 'loading'.",
"    Promise.all([pV, pA]).then(function(){ clearInterval(kick); if(gen===playGen){ try{ if(ms.readyState==='open') ms.endOfStream(); }catch(e){} } });",
"    // Resolve as soon as there is enough buffered to start playback.",
"    await new Promise(function(resolve, reject){",
"      var t0=Date.now();",
"      var COLD_V = 800000; var COLD_A = 150000;",
"      var iv=setInterval(function(){",
"        if(gen!==playGen){ clearInterval(iv); resolve(); return; }",
"        var haveBuf = video.buffered && video.buffered.length && video.buffered.end(video.buffered.length-1) > 0.5;",
"        var pastCold = (vDone||vPos>=COLD_V) && (aDone||aPos>=COLD_A);",
"        if(haveBuf && pastCold){ clearInterval(iv); resolve(); return; }",
"        if(vErr||aErr){ clearInterval(iv); reject(vErr||aErr||new Error('adaptive track failed')); return; }",
"        if(Date.now()-t0 > 12000){ clearInterval(iv); if(haveBuf) resolve(); else reject(new Error('adaptive start timeout')); return; }",
"      }, 150);",
"    });",
"    if(gen!==playGen) return;",
"    currentItag = String(pair.video.itag);",
"    currentHeight = pair.video.height || 360;",
"  }",
"  // Map the quality dropdown value to a target height. 'auto' = best available.",
"  function targetHeightFor(qval, formats){",
"    var hs = heightsAvailable(formats);",
"    if(qval==='auto') return hs.length ? hs[0] : 720;",
"    if(qval==='37') return 1080;",
"    if(qval==='22') return 720;",
"    if(qval==='18') return 360;",
"    var n = parseInt(qval,10); return isNaN(n) ? 360 : n;",
"  }",
"  async function tryAdaptive(id, qval, gen){",
"    var formats = await getServerFormats(id);",
"    if(gen!==playGen) return true;",
"    if(!formats) return false;",
"    var th = targetHeightFor(qval, formats);",
"    var pair = pickAdaptivePair(formats, th);",
"    if(!pair || !pair.video || !pair.audio) return false;",
"    setStatus('טוען · '+(pair.video.height||'')+'p…');",
"    try{",
"      await playAdaptive(id, pair, gen);",
"    }catch(e){",
"      return false;",
"    }",
"    if(gen!==playGen) return true;",
"    updateQualityBtn();",
"    playerShell.classList.remove('loading');",
"    var ms2 = Date.now()-(playStartTs||Date.now());",
"    setStatus('מתנגן · '+(pair.video.height||'')+'p'+(ms2>0?(' · '+(ms2/1000).toFixed(1)+'s'):''));",
"    try{ video.muted=false; video.volume=1; }catch(e){}",
"    syncPlayUi();",
"    renderResults(lastItems);",
"    return true;",
"  }",
"  function loadThumbInto(img, id, qualities){",
"    var qs=qualities||['hq720','maxresdefault','sddefault','hqdefault','mqdefault'];",
"    var qi=0;",
"    function tryNext(){",
"      if(qi>=qs.length){ img.style.background='#e5e5e5'; return; }",
"      var qn=qs[qi++];",
"      fetch(thumbFor(id,qn),{credentials:'same-origin',cache:'force-cache'}).then(function(r){",
"        if(!r.ok) throw new Error('bad');",
"        return r.arrayBuffer().then(function(ab){",
"          var bytes=new Uint8Array(ab);",
"          if(r.headers.get('X-Proxy-Obfuscated')==='1'){",
"            var off=parseInt(r.headers.get('X-Seal-Offset')||'0',10)||0;",
"            bytes=unsealBuf(bytes, off);",
"          }",
"          if(bytes.length<800 || !(bytes[0]===0xff&&bytes[1]===0xd8) && !(bytes[0]===0x52&&bytes[1]===0x49&&bytes[2]===0x46&&bytes[3]===0x46)) throw new Error('notimg');",
"          var ct=r.headers.get('X-Original-Content-Type')||'image/jpeg';",
"          if(img._blob){ try{URL.revokeObjectURL(img._blob);}catch(e){} }",
"          img._blob=URL.createObjectURL(new Blob([bytes],{type:ct.split(';')[0]}));",
"          img.src=img._blob;",
"        });",
"      }).catch(function(){ tryNext(); });",
"    }",
"    tryNext();",
"  }",
"  var playGen=0;",
"  function setMode(m){",
"    mode=m;",
"    layout.className='layout '+m;",
"    if(m==='mini'){",
"      if(video.parentElement!==miniStage) miniStage.appendChild(video);",
"      miniDock.classList.add('show');",
"      miniTitle.textContent=currentMeta.title||currentMeta.id||'מתנגן';",
"    } else {",
"      miniDock.classList.remove('show');",
"      if(video.parentElement!==playerShell) playerShell.insertBefore(video, playerShell.firstChild);",
"    }",
"    try{ history.replaceState(null,'', buildUrl()); }catch(e){}",
"  }",
"  function buildUrl(){",
"    var u=new URL(location.href);",
"    u.pathname='/ytp'; u.search='';",
"    if(currentMeta.id) u.searchParams.set('v', currentMeta.id);",
"    var qq=(qsearch.value||'').trim();",
"    if(qq) u.searchParams.set('q', qq);",
"    return u.pathname+u.search;",
"  }",
"  function updateMetaUI(){",
"    vtitle.textContent=currentMeta.title||currentMeta.id||'סרטון';",
"    vchannel.textContent=currentMeta.channel||'ערוץ YouTube';",
"    avatar.textContent=((currentMeta.channel||'Y').trim().charAt(0)||'Y').toUpperCase();",
"    miniTitle.textContent=currentMeta.title||currentMeta.id||'מתנגן';",
"    document.title=(currentMeta.title||'YouTube')+' - YouTube';",
"    var stats=[];",
"    if(currentMeta.views) stats.push(currentMeta.views);",
"    if(currentMeta.published) stats.push(currentMeta.published);",
"    if(currentMeta.duration) stats.push(currentMeta.duration);",
"    descStats.textContent=stats.length?stats.join(' · '):'פרטי הסרטון';",
"    descText.textContent=currentMeta.description||'אין תיאור זמין.';",
"    descBox.classList.remove('open');",
"    descMore.textContent='הצג עוד';",
"  }",
"  function renderChips(){",
"    chips.innerHTML='';",
"    CHIP_LABELS.forEach(function(label,i){",
"      var b=document.createElement('button');",
"      b.type='button'; b.className='chip'+(i===0?' active':'');",
"      b.textContent=label;",
"      b.onclick=function(){",
"        Array.prototype.forEach.call(chips.children,function(c){c.classList.remove('active');});",
"        b.classList.add('active');",
"        if(label==='הכל'){ if((qsearch.value||'').trim()) doSearch(); return; }",
"        qsearch.value=label; doSearch();",
"      };",
"      chips.appendChild(b);",
"    });",
"  }",
"  function renderResults(items){",
"    lastItems=items||[];",
"    results.innerHTML='';",
"    emptyHint.style.display=lastItems.length?'none':'block';",
"    secCount.textContent=lastItems.length? (lastItems.length+' תוצאות') : '';",
"    if(mode==='channel') secTitle.textContent='סרטונים בערוץ';",
"    else secTitle.textContent=mode==='browse'?'תוצאות חיפוש':'סרטונים נוספים';",
"    lastItems.forEach(function(it){",
"      var card=document.createElement('article');",
"      card.className='vcard'+(it.id===currentMeta.id?' active':'');",
"      card.setAttribute('role','button'); card.tabIndex=0;",
"      var thumb=document.createElement('div'); thumb.className='thumb';",
"      var img=document.createElement('img'); img.loading='lazy'; img.decoding='async'; img.alt=''; img.referrerPolicy='no-referrer';",
"      // Unseal thumbs in JS so Etrog cannot pixelate clear JPEG on the wire",
"      loadThumbInto(img, it.id);",
"      thumb.appendChild(img);",
"      if(it.duration){ var d=document.createElement('span'); d.className='dur'; d.textContent=it.duration; thumb.appendChild(d); }",
"      var meta=document.createElement('div'); meta.className='vmeta';",
"      var t=document.createElement('h3'); t.className='vtitle'; t.textContent=it.title||it.id;",
"      var ch=document.createElement('div'); ch.className='vch'; ch.textContent=it.channel||'';",
"      var st=document.createElement('div'); st.className='vstat';",
"      st.textContent=[it.views,it.published].filter(Boolean).join(' · ')||'YouTube';",
"      meta.appendChild(t); meta.appendChild(ch); meta.appendChild(st);",
"      card.appendChild(thumb); card.appendChild(meta);",
"      function open(){ playItem(it); }",
"      card.onclick=open;",
"      card.onkeydown=function(e){ if(e.key==='Enter'||e.key===' '){ e.preventDefault(); open(); } };",
"      results.appendChild(card);",
"    });",
"  }",
"  async function fetchAndPlay(id, itag, gen, strict, directUrl){",
"    if(gen!==playGen) return;",
"    var url=mediaUrl(id, itag, false, !!strict, directUrl||'');",
"    if(blobUrl){ try{URL.revokeObjectURL(blobUrl);}catch(e){} blobUrl=null; }",
"    var actualItag=String(itag);",
"    var r=null;",
"    var workerErr=null;",
"    try{",
"      r=await fetch(url,{credentials:'same-origin',cache:'no-store'});",
"    }catch(e){ workerErr=e; }",
"    if(gen!==playGen) return;",
"    if(!r){ throw workerErr||new Error('fetch failed'); }",
"    var gotItag=r.headers.get('X-Etrog-Itag');",
"    if(gotItag) actualItag=String(gotItag);",
"    if(!r.ok && r.status!==206){",
"      var t=await r.text();",
"      throw new Error(parsePlayError(t)||('HTTP '+r.status));",
"    }",
"    var sealed=r.headers.get('X-Proxy-Obfuscated')==='1';",
"    var mode=r.headers.get('X-Etrog-Mode')||'';",
"    // Hide previous embed fallback if any",
"    try{ var emb0=document.getElementById('ytEmbedFallback'); if(emb0){ emb0.style.display='none'; emb0.src='about:blank'; } video.style.visibility=''; }catch(e){} try{ var ov0=document.getElementById('ytErrorOverlay'); if(ov0) ov0.style.display='none'; }catch(e){}",
"    var resolvedUrl=r.headers.get('X-Etrog-Resolved-Url');",
"    var ct=(r.headers.get('X-Original-Content-Type')||r.headers.get('content-type')||'video/mp4').split(';')[0];",
"    var playUrl=mediaUrl(id, actualItag, false, !!strict, '');",
"    await startVideoFromSrc(playUrl, gen);",
"    if(gen!==playGen) return;",
"    currentItag=String(actualItag||itag);",
"    updateQualityBtn();",
"    var ms=Date.now()-(playStartTs||Date.now());",
"    var ql=currentItag==='22'?'720p':(currentItag==='18'?'360p':('itag '+currentItag));",
"    var srcTag=r.headers.get('X-Etrog-Source')==='client-direct-url'?' · client':'';",
"    setStatus('מתנגן · '+ql+srcTag+(ms>0?(' · '+(ms/1000).toFixed(1)+'s'):''));",
"    playerShell.classList.remove('loading');",
"    syncPlayUi();",
"    // ensure audible after click-to-select",
"    try{ video.muted=false; video.volume=1; }catch(e){}",
"  }",
"  function parsePlayError(text){",
"    try{",
"      var j=JSON.parse(text);",
"      var msg=j.error||j.hint||'';",
"      if(j.playability&&j.playability.reason) msg=(msg?msg+': ':'')+j.playability.reason;",
"      if(j.filter_block||msg.indexOf('filter')!==-1) msg='סונן על ידי אתרוג/Rimon — נסו שוב';",
"      if(j.available) msg+=(msg?'. ':'')+'זמין: '+j.available;",
"      return msg||text.slice(0,160);",
"    }catch(e){ return (text||'').slice(0,160); }",
"  }",
"  function parseStreamErrorPayload(text){",
"    try{ return JSON.parse(text); }catch(e){ return null; }",
"  }",
"  function isMediaMagic(bytes){",
"    if(!bytes||bytes.length<8) return false;",
"    if(bytes[4]===0x66&&bytes[5]===0x74&&bytes[6]===0x79&&bytes[7]===0x70) return 'mp4';",
"    if(bytes[0]===0x1a&&bytes[1]===0x45) return 'webm';",
"    return false;",
"  }",
"  function startVideoFromSrc(src, gen, timeoutMs){",
"    return new Promise(function(resolve, reject){",
"      if(gen!==playGen){ resolve(); return; }",
"      var settled=false;",
"      // 'plays a bit in the background, resets to the spinner, loops' bug. A real failure",
"      // still fires the 'error' event and rejects immediately, so this never slows those.",
"      var to=setTimeout(function(){",
"        if(settled) return;",
"        if(video.readyState>=1||(video.buffered&&video.buffered.length)||video.currentTime>0){ doneOk(); return; }",
"        doneFail('timeout');",
"      }, timeoutMs||9000);",
"      function cleanup(){",
"        clearTimeout(to);",
"        video.removeEventListener('loadeddata', onOk);",
"        video.removeEventListener('canplay', onOk);",
"        video.removeEventListener('playing', onOk);",
"        video.removeEventListener('error', onFail);",
"      }",
"      function doneOk(){",
"        if(settled||gen!==playGen) return;",
"        settled=true; cleanup();",
"        resolve();",
"      }",
"      function doneFail(msg){",
"        if(settled||gen!==playGen) return;",
"        settled=true; cleanup();",
"        reject(new Error(msg||'play failed'));",
"      }",
"      function onOk(){ if(video.readyState>=1||video.currentTime>0) doneOk(); }",
"      function onFail(){",
"        var c=video.error&&video.error.code;",
"        var msgs={1:'ההורדה בוטלה',2:'שגיאת רשת בטעינת מדיה',3:'שגיאת פענוח מדיה',4:'שגיאת משאבי מדיה (פורמט לא נתמך)'};",
"        doneFail(msgs[c]||('video error '+(c||'?')));",
"      }",
"      video.addEventListener('loadeddata', onOk);",
"      video.addEventListener('canplay', onOk);",
"      video.addEventListener('playing', onOk);",
"      video.addEventListener('error', onFail);",
"      video.playsInline=true;",
"      video.preload='auto';",
"      // muted first so autoplay works right after clicking a search result",
"      video.muted=true;",
"      try{ video.pause(); }catch(e){}",
"      video.src=src;",
"      try{ video.load(); }catch(e){}",
"      var p=video.play();",
"      if(p&&p.then){",
"        p.then(function(){",
"          // unmute after successful start (user already clicked the card)",
"          try{ video.muted=false; }catch(e){}",
"          onOk();",
"        }).catch(function(){",
"          // still loading / gesture — wait for events",
"          try{ video.muted=false; }catch(e){}",
"        });",
"      }",
"    });",
"  }",
"  async function playDirectAndFinish(directUrl, itag, gen, label, timeoutMs){",
"    setStatus(label||'ניגון ישיר…');",
"    await startVideoFromSrc(directUrl, gen, timeoutMs);",
"    if(gen!==playGen) return;",
"    // The filter can answer a direct googlevideo request with its OWN short block clip, which",
"    // loads perfectly and would otherwise count as success (the user then watches an Etrog",
"    // block video instead of the real one). Reject an obvious duration mismatch.",
"    var expSec=parseDurationSec(currentMeta.duration);",
"    var gotSec=(video.duration&&isFinite(video.duration))?video.duration:0;",
"    if(expSec>60&&gotSec>0&&gotSec<Math.min(60,expSec*0.5)){",
"      try{ video.pause(); }catch(e){}",
"      throw new Error('filter block clip ('+Math.round(gotSec)+'s instead of '+expSec+'s)');",
"    }",
"    currentItag=String(itag||'18');",
"    updateQualityBtn();",
"    var msD=Date.now()-(playStartTs||Date.now());",
"    setStatus('מתנגן · ישיר'+(msD>0?(' · '+(msD/1000).toFixed(1)+'s'):''));",
"    playerShell.classList.remove('loading');",
"    syncPlayUi();",
"    try{ video.muted=false; video.volume=1; }catch(e){}",
"  }",
"      }",
"    }",
"    var url=mediaUrl(id, itag, false, !!strict, directUrl||'');",
"    if(blobUrl){ try{URL.revokeObjectURL(blobUrl);}catch(e){} blobUrl=null; }",
"    var actualItag=String(itag);",
"    var r=null;",
"    var workerErr=null;",
"    try{",
"      r=await fetch(url,{credentials:'same-origin',cache:'no-store'});",
"    }catch(e){ workerErr=e; }",
"    if(gen!==playGen) return;",
"    // If worker cannot relay IP-bound googlevideo, play direct URL from browser (same IP that resolved it)",
"    if((!r || (!r.ok && r.status!==206)) && directUrl){",
"      await playDirectAndFinish(directUrl, itag, gen, 'ניגון ישיר…');",
"      return;",
"    }",
"    if(!r){ throw workerErr||new Error('fetch failed'); }",
"    var gotItag=r.headers.get('X-Etrog-Itag');",
"    if(gotItag) actualItag=String(gotItag);",
"    if(!r.ok && r.status!==206){",
"      var t=await r.text();",
"      var payload=parseStreamErrorPayload(t);",
"      // Worker found formats but CF cannot fetch googlevideo — try URLs in browser",
"      if(payload&&payload.directUrls&&payload.directUrls.length){",
"        for(var di=0;di<payload.directUrls.length;di++){",
"          var du=payload.directUrls[di];",
"          if(!du||!du.url) continue;",
"          try{",
"            // Prefer re-proxy with u= first (Etrog bypass), then pure direct",
"            try{",
"              await fetchAndPlay(id, String(du.itag||itag), gen, false, du.url);",
"              return;",
"            }catch(e1){",
"              await playDirectAndFinish(du.url, du.itag||itag, gen, 'ניגון ישיר…');",
"              return;",
"            }",
"          }catch(e2){}",
"        }",
"      }",
"      if(directUrl){",
"        await playDirectAndFinish(directUrl, itag, gen, 'ניגון ישיר…');",
"        return;",
"      }",
"      throw new Error(parsePlayError(t)||('HTTP '+r.status));",
"    }",
"    var sealed=r.headers.get('X-Proxy-Obfuscated')==='1';",
"    var mode=r.headers.get('X-Etrog-Mode')||'';",
"    // Hide previous embed fallback if any",
"    try{ var emb0=document.getElementById('ytEmbedFallback'); if(emb0){ emb0.style.display='none'; emb0.src='about:blank'; } video.style.visibility=''; }catch(e){} try{ var ov0=document.getElementById('ytErrorOverlay'); if(ov0) ov0.style.display='none'; }catch(e){}",
"    var resolvedUrl=r.headers.get('X-Etrog-Resolved-Url');",
"    var ct=(r.headers.get('X-Original-Content-Type')||r.headers.get('content-type')||'video/mp4').split(';')[0];",
"    // Sealed media: when the Service Worker is controlling it unseals each Range request",
"    // on the fly, so we stream via <video src> — native seeking + no full-file download.",
"    // Downloading the whole file into a blob (the old path) broke seeking on long videos:",
"    // the relay stream is cut by its timeout, so the blob is a partial file that reports",
"    // full duration but has no data past the first minutes → seeks jump to the end/freeze.",
"    // Only when there is truly no SW do we fall back to buffering+unsealing into a blob.",
"    if(sealed||mode==='stream-sealed'){",
"      var swActive = ('serviceWorker' in navigator) && !!navigator.serviceWorker.controller;",
"      if(!swActive){ try{ await ensureSw(); }catch(e){} swActive = ('serviceWorker' in navigator) && !!navigator.serviceWorker.controller; }",
"      try{ if(r.body) await r.body.cancel(); }catch(e){}",
"      if(swActive){",
"        // Stream through the SW (unseals per Range). Native seeking, nothing buffered to RAM.",
"        await startVideoFromSrc(mediaUrl(id, actualItag, false, !!strict, ''), gen);",
"      } else {",
"        // No Service Worker → we cannot unseal a live stream, and buffering a whole long",
"        // video into RAM (the old path) froze the tab. Fail loudly instead of hanging.",
"        throw new Error('sw-missing');",
"      }",
"    } else {",
"      // Progressive stream — browser handles Range seeks; no full download to RAM.",
"      try{ if(r.body) await r.body.cancel(); }catch(e){}",
"      // Plain token URL (no embedded resolvedUrl): ranged seeks go through the relay itag",
"      // path (bounded per request) instead of the direct-url path (IP-bound 403 / no cap).",
"      var playUrl=mediaUrl(id, actualItag, false, !!strict, '');",
"      await startVideoFromSrc(playUrl, gen);",
"    }",
"    if(gen!==playGen) return;",
"    currentItag=String(actualItag||itag);",
"    updateQualityBtn();",
"    var ms=Date.now()-(playStartTs||Date.now());",
"    var ql=currentItag==='22'?'720p':(currentItag==='18'?'360p':('itag '+currentItag));",
"    var srcTag=r.headers.get('X-Etrog-Source')==='client-direct-url'?' · client':'';",
"    setStatus('מתנגן · '+ql+srcTag+(ms>0?(' · '+(ms/1000).toFixed(1)+'s'):''));",
"    playerShell.classList.remove('loading');",
"    syncPlayUi();",
"    // ensure audible after click-to-select",
"    try{ video.muted=false; video.volume=1; }catch(e){}",
"  }",
"  async function loadMeta(id){",
"    try{",
"      var r=await fetch('/api/yt-meta?v='+encodeURIComponent(id),{credentials:'same-origin'});",
"      var text=await r.text();",
"      var j={}; try{ j=JSON.parse(text); }catch(e){ return; }",
"      if(!r.ok) return;",
"      if(j.title && j.title!==id) currentMeta.title=j.title;",
"      if(j.channel) currentMeta.channel=j.channel;",
"      if(j.channelId) currentMeta.channelId=j.channelId;",
"      if(j.description) currentMeta.description=j.description;",
"      if(j.views) currentMeta.views=j.views;",
"      if(j.published) currentMeta.published=j.published;",
"      updateMetaUI();",
"    }catch(e){}",
"  }",
"  async function loadId(id, meta){",
"    id=extractId(id);",
"    if(!id){ setStatus('חסר מזהה'); return; }",
"    var gen=++playGen;",
"    // Ensure the SW controls this page BEFORE any media fetch. If a <video> gets its src",
"    // while the SW is not yet controlling, its requests bypass the SW and receive the",
"    // XOR-sealed bytes it cannot decode → error → the flow retries → the 'plays a bit,",
"    // resets to the spinner, loops until Ctrl+F5' bug. The SW is registered early at boot,",
"    // so on a normal click this resolves instantly; only a cold first load waits briefly.",
"    try{ if(!(('serviceWorker' in navigator) && navigator.serviceWorker.controller)) await ensureSw(); }catch(e){}",
"    if(gen!==playGen) return;",
"    vidInput.value=id;",
"    currentMeta={",
"      id:id,",
"      title:(meta&&meta.title)||currentMeta.title||id,",
"      channel:(meta&&meta.channel)||currentMeta.channel||'',",
"      channelId:(meta&&meta.channelId)||currentMeta.channelId||'',",
"      thumb:(meta&&meta.thumb)||thumbFor(id),",
"      description:(meta&&meta.description)||'',",
"      views:(meta&&meta.views)||'',",
"      published:(meta&&meta.published)||'',",
"      duration:(meta&&meta.duration)||''",
"    };",
"    updateMetaUI();",
"    loadMeta(id);",
"    if(mode==='browse'||mode==='channel') setMode('watch');",
"    else if(mode==='mini') setMode('mini');",
"    else if(mode!=='theater') setMode('watch');",
"    try{document.cookie='__yt_vid='+encodeURIComponent(id)+'; Path=/; Max-Age=86400; SameSite=Lax; Secure';}catch(e){}",
"    playerShell.classList.add('loading'); showErr('');",
"    // Hide previous embed fallback if any",
"    try{ var emb0=document.getElementById('ytEmbedFallback'); if(emb0){ emb0.style.display='none'; emb0.src='about:blank'; } video.style.visibility=''; }catch(e){}",
"    // Prepare for immediate autoplay after card click",
"    try{ video.muted=true; video.playsInline=true; }catch(e){}",
"    playStartTs=Date.now();",
"    var preferred=(q&&q.value)?q.value:'18';",
"    if(preferred==='auto') preferred='18';",
"    qualityStrict=(preferred==='22'||preferred==='18'||preferred==='36'||preferred==='17');",
"    var list=[];",
"    list=[preferred];",
"    FALLBACK.forEach(function(x){ if(list.indexOf(x)===-1) list.push(x); });",
"    var last=null;",
"    var qval=(q&&q.value)?q.value:'18';",
"    // 0) Adaptive MSE runs first ONLY when the user explicitly asked for HD (>360p / auto).",
"    //    360p is served reliably as progressive, so we never risk MSE there. Adaptive-only",
"    //    videos still reach MSE via the last-resort fallback after progressive fails.",
"    var wantHD=(qval==='auto'||qval==='22'||qval==='37'||(parseInt(qval,10)||0)>360);",
"    if(wantHD){ try{ if(await tryAdaptive(id, qval, gen)) return; if(gen!==playGen) return; }catch(e){ last=e; } }",
"    if(qval==='22'||qval==='37'){",
"      playerShell.classList.remove('loading');",
"      setStatus('איכות 720p אינה זמינה לסרטון זה');",
"      showErr('סרטון זה אינו תומך ב-720p (או שהגישה לרצועת ה-HD חסומה ביוטיוב). נסו 360p.');",
"      return;",
"    }",
"    // 1) Client-side format resolve (Origin:null iframe) — bypasses CF LOGIN_REQUIRED",
"    try{",
"      // When the home relay is active, ALWAYS use it — do not try the browser/direct route.",
"      // The filter answers a direct googlevideo request with its own block clip, which loads",
"      // like a normal video, so 'direct' silently played an Etrog block video instead of the",
"      // real content. The relay path is the reliable one; keep it as the only path here.",
"      if(window.YT_RELAY_ACTIVE) throw new Error('relay active');",
"      setStatus('מאתר זרם מהדפדפן…');",
"      var cFormats=await resolveFormatsClient(id, 20000);",
"      if(gen!==playGen) return;",
"      if(cFormats&&cFormats.length){",
"        for(var n=0;n<list.length;n++){",
"          if(gen!==playGen) return;",
"          var fmt=pickClientFormat(cFormats, list[n]);",
"          if(!fmt||!fmt.url) continue;",
"          var lab=String(fmt.itag)==='22'?'720p':(String(fmt.itag)==='18'?'360p':('itag '+fmt.itag));",
"          // 1) Worker proxy of same URL (Etrog bypass for googlevideo domain)",
"          try{",
"            setStatus('טוען · '+lab+'…');",
"            await fetchAndPlay(id, String(fmt.itag||list[n]), gen, false, fmt.url);",
"            if(gen!==playGen) return;",
"            currentItag=String(fmt.itag||list[n]);",
"            updateQualityBtn();",
"            playerShell.classList.remove('loading');",
"            setStatus('מתנגן · '+lab+' · שרת');",
"            try{ video.muted=false; video.volume=1; }catch(e){}",
"            syncPlayUi();",
"            renderResults(lastItems);",
"            return;",
"          }catch(e){ last=e; }",
"        }",
"      }",
"    }catch(e){ last=e; setStatus('שרת…'); }",
"    // 2) Legacy worker-side resolve (may fail LOGIN_REQUIRED on Cloudflare IPs)",
"    for(var n2=0;n2<list.length;n2++){",
"      if(gen!==playGen) return;",
"      try{",
"        var lab2=list[n2]==='22'?'720p':(list[n2]==='18'?'360p':list[n2]);",
"        setStatus('טוען · '+lab2+'…');",
"        var strictTry = qualityStrict && n2===0 && preferred!=='18';",
"        await fetchAndPlay(id, list[n2], gen, strictTry, '');",
"        if(gen!==playGen) return;",
"        playerShell.classList.remove('loading');",
"        try{ video.muted=false; }catch(e){}",
"        syncPlayUi();",
"        renderResults(lastItems);",
"        return;",
"      }catch(e){",
"        last=e;",
"        setStatus('מנסה איכות אחרת…');",
"      }",
"    }",
"    // 3) Adaptive MSE fallback - many videos have NO progressive stream at all.",
"    try{ if(await tryAdaptive(id, qval, gen)) return; if(gen!==playGen) return; }catch(e){ last=e; }",
"    playerShell.classList.remove('loading');",
"    setStatus('נכשל');",
"    var errMsg = String(last && last.message || last || 'failed');",
"    if (errMsg.indexOf('sw-missing')>-1) {",
"      errMsg = 'הנגן עדיין מתאתחל (Service Worker). המתינו כמה שניות ולחצו שוב על ניגון — או רעננו רגיל (F5, לא Ctrl+Shift+R).';",
"    }",
"    if (errMsg.indexOf('error 4')>-1 || errMsg.indexOf('לא נתמך')>-1 || errMsg.indexOf('משאבי מדיה')>-1) {",
"      errMsg += ' — לחצו F5. ';",
"    }",
"    if (errMsg.indexOf('LOGIN')>-1 || errMsg.indexOf('no format')>-1 || errMsg.indexOf('502')>-1 || errMsg.indexOf('client-resolve')>-1) {",
"      errMsg += ' | השרת נחסם על ידי יוטיוב. נדרש ייבוא עוגיות.';",
"    }",
"    showErr(errMsg);",
"    showPlayerError(id, errMsg);",
"  }",

"  function showPlayerError(id, msg) {",
"    playerShell.classList.remove('loading');",
"    video.style.visibility = 'hidden';",
"    var overlay = document.getElementById('ytErrorOverlay');",
"    if (!overlay) {",
"      overlay = document.createElement('div');",
"      overlay.id = 'ytErrorOverlay';",
"      overlay.style.cssText = 'position:absolute;inset:0;display:flex;flex-direction:column;align-items:center;justify-content:center;background:#000;color:#fff;padding:24px;text-align:center;z-index:7;direction:rtl';",
"      playerShell.appendChild(overlay);",
"    }",
"    overlay.style.display = 'flex';",
"    var title = 'שגיאה בטעינת הסרטון';",
"    var desc = 'יוטיוב חסם את השרת של Cloudflare (LOGIN_REQUIRED / 502).';",
"    if (msg.indexOf('LOGIN') !== -1 || msg.indexOf('format') !== -1 || msg.indexOf('502') !== -1 || msg.indexOf('נחסם') !== -1) {",
"      desc = 'שרת Cloudflare נחסם על ידי יוטיוב. כדי לפתור זאת, יש לייבא עוגיות מחשבון יוטיוב פעיל ותקין שעובד אצלך בדפדפן.';",
"    }",
"    overlay.innerHTML =",
"      '<div style=\"max-width:440px;background:#14141b;padding:28px;border-radius:16px;border:1px solid #2e2e3d;box-shadow:0 15px 35px rgba(0,0,0,0.6);font-family:system-ui,-apple-system,sans-serif\">' +",
"        '<h3 style=\"margin-bottom:12px;color:#ef4444;font-size:1.3rem;font-weight:700\">' + title + '</h3>' +",
"        '<p style=\"font-size:0.95rem;color:#cbd5e1;line-height:1.5;margin-bottom:24px\">' + desc + '</p>' +",
"        '<div style=\"font-size:0.8rem;color:#64748b;margin-bottom:24px;font-family:monospace;word-break:break-all;background:#0f172a;padding:8px 12px;border-radius:8px;border:1px solid #1e293b\">' + msg + '</div>' +",
"        '<div style=\"display:flex;gap:12px;justify-content:center;flex-wrap:wrap\">' +",
"          '<a href=\"/import-cookies\" style=\"background:#4f46e5;color:#fff;border:none;border-radius:20px;padding:10px 20px;font-size:0.9rem;font-weight:700;text-decoration:none;cursor:pointer;box-shadow:0 4px 12px rgba(79,70,229,0.3)\">🔑 ייבוא עוגיות (לפתרון מוחלט)</a>' +",
"          '<button type=\"button\" style=\"background:#334155;color:#f1f5f9;border:none;border-radius:20px;padding:10px 20px;font-size:0.9rem;font-weight:600;cursor:pointer\" onclick=\"window.tryEmbedFallback(\\'' + id + '\\')\">נסה נגן מוטמע</button>' +",
"        '</div>' +",
"      '</div>';",
"  }",
"  window.tryEmbedFallback = function(id) {",
"    try{",
"      var ov0=document.getElementById('ytErrorOverlay'); if(ov0) ov0.style.display='none';",
"      setStatus('מנסה נגן מוטמע…');",
"      var emb=document.getElementById('ytEmbedFallback');",
"      if(!emb){",
"        emb=document.createElement('iframe');",
"        emb.id='ytEmbedFallback';",
"        emb.allow='accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share';",
"        emb.allowFullscreen=true;",
"        emb.style.cssText='position:absolute;inset:0;width:100%;height:100%;border:0;z-index:6;background:#000';",
"        playerShell.style.position=playerShell.style.position||'relative';",
"        playerShell.appendChild(emb);",
"      }",
"      emb.style.display='block';",
"      emb.src='https://www.youtube-nocookie.com/embed/'+encodeURIComponent(id)+'?autoplay=1&rel=0&modestbranding=1&playsinline=1';",
"      try{ video.style.visibility='hidden'; }catch(e){}",
"      playerShell.classList.remove('loading');",
"      setStatus('נגן מוטמע · אם אין תמונה — YouTube חסום ברשת');",
"      showErr('');",
"    }catch(e){}",
"  };",
"  function playItem(it){",
"    // Immediate UI feedback + autoplay path",
"    try{ video.muted=true; }catch(e){}",
"    try{ window.scrollTo({top:0,behavior:'smooth'}); }catch(e){}",
"    loadId(it.id, it);",
"  }",
"  async function doSearch(){",
"    var qq=(qsearch.value||'').trim();",
"    if(!qq || searching) return;",
"    searching=true;",
"    var t0=Date.now();",
"    setStatus('מחפש…'); showErr('');",
"    var ban=document.getElementById('chBanner'); if(ban) ban.style.display='none';",
"    if(mode!=='watch'&&mode!=='theater'&&mode!=='mini') setMode('browse');",
"    try{",
"      var r=await fetch('/api/yt-search?q='+encodeURIComponent(qq),{credentials:'same-origin'});",
"      var text=await r.text();",
"      var j={};",
"      try{ j=JSON.parse(text); }catch(e){ throw new Error('תשובת שרת לא תקינה'); }",
"      if(!r.ok) throw new Error(j.error||('HTTP '+r.status));",
"      var items=j.results||[];",
"      if(!items.length){",
"        setStatus('אין תוצאות');",
"        renderResults([]);",
"        emptyHint.innerHTML='<strong>אין תוצאות</strong>נסו מילות חיפוש אחרות';",
"        emptyHint.style.display='block';",
"        return;",
"      }",
"      setStatus(items.length+' תוצאות · '+(Date.now()-t0)+'ms');",
"      renderResults(items);",
"      try{ history.replaceState(null,'', buildUrl()); }catch(e){}",
"    }catch(e){ showErr('חיפוש נכשל: '+(e&&e.message?e.message:e)); setStatus('שגיאת חיפוש'); }",
"    finally{ searching=false; }",
"  }",
"  async function openChannel(){",
"    var id=currentMeta.channelId||'';",
"    var name=currentMeta.channel||'';",
"    if(!id && !name){ setStatus('אין פרטי ערוץ'); showErr('אין מזהה ערוץ לסרטון זה'); return; }",
"    setStatus('טוען ערוץ…'); showErr('');",
"    setMode('channel');",
"    var ban=document.getElementById('chBanner');",
"    if(ban){",
"      ban.style.display='block';",
"      document.getElementById('chTitle').textContent=name||id||'ערוץ';",
"      document.getElementById('chInfo').textContent='טוען פרטי ערוץ…';",
"      document.getElementById('chDesc').textContent='';",
"      var av=document.getElementById('chAvatarBig');",
"      if(av){ av.textContent=((name||'Y').charAt(0)||'Y').toUpperCase(); av.style.backgroundImage=''; }",
"    }",
"    try{",
"      var url='/api/yt-channel?'+(id?('id='+encodeURIComponent(id)):'')+(name?((id?'&':'')+'name='+encodeURIComponent(name)):'');",
"      var r=await fetch(url,{credentials:'same-origin'});",
"      var text=await r.text();",
"      var j={}; try{ j=JSON.parse(text); }catch(e){ throw new Error('תשובת שרת לא תקינה'); }",
"      if(!r.ok) throw new Error(j.error||('HTTP '+r.status));",
"      var items=j.results||[];",
"      var m=j.meta||{};",
"      var title=m.title||j.name||name||id;",
"      var subs=m.subscribers||'';",
"      var vcount=m.videoCount||(items.length? (items.length+'+ סרטונים') : '');",
"      var desc=m.description||'';",
"      if(ban){",
"        document.getElementById('chTitle').textContent=title;",
"        document.getElementById('chInfo').textContent=[subs,vcount,m.channelId||id].filter(Boolean).join(' · ');",
"        document.getElementById('chDesc').textContent=desc||'אין תיאור ערוץ.';",
"        var av2=document.getElementById('chAvatarBig');",
"        if(av2){",
"          if(m.avatar){ av2.textContent=''; av2.style.backgroundImage='url('+JSON.stringify(m.avatar).slice(1,-1)+')'; av2.style.backgroundSize='cover'; }",
"          else { av2.textContent=((title||'Y').charAt(0)||'Y').toUpperCase(); }",
"        }",
"        var bi=document.getElementById('chBannerImg');",
"        if(bi && m.banner){ bi.style.backgroundImage='url('+JSON.stringify(m.banner).slice(1,-1)+')'; }",
"      }",
"      if(m.channelId) currentMeta.channelId=m.channelId;",
"      if(title) currentMeta.channel=title;",
"      secTitle.textContent='סרטונים בערוץ';",
"      renderResults(items);",
"      setStatus(items.length?('ערוץ · '+items.length+' סרטונים'):'לא נמצאו סרטונים');",
"      try{ history.replaceState(null,'','/ytp?channel='+encodeURIComponent(m.channelId||id||'')+(name?('&cname='+encodeURIComponent(title)):'') ); }catch(e){}",
"      try{ window.scrollTo({top:0,behavior:'smooth'}); }catch(e){}",
"    }catch(e){",
"      showErr('טעינת ערוץ נכשלה: '+(e&&e.message?e.message:e));",
"      setStatus('שגיאת ערוץ');",
"      if(name){ qsearch.value=name; }",
"    }",
"  }",
"  // Audio-only download. YouTube never serves MP3, and a Worker cannot transcode, so we hand",
"  // over the original audio track: itag 140 = M4A/AAC 128k (plays in every phone/car/player),",
"  // 251 = WebM/Opus as a fallback. Direct-from-Google first, sealed proxy second.",
"  async function downloadAudio(){",
"    if(!currentMeta.id){ setStatus('אין סרטון'); return; }",
"    setStatus('מוריד אודיו…'); showErr('');",
"    var base=(currentMeta.title||currentMeta.id).replace(/[^\\w\\u0590-\\u05FF \\-]+/g,'_').trim().slice(0,90)||'audio';",
"    var order=[{i:'140',ext:'m4a',mime:'audio/mp4'},{i:'251',ext:'webm',mime:'audio/webm'},{i:'139',ext:'m4a',mime:'audio/mp4'},{i:'250',ext:'webm',mime:'audio/webm'}];",
"    function saveBlob(bytes, mime, ext){",
"      var a=document.createElement('a');",
"      a.href=URL.createObjectURL(new Blob([bytes],{type:mime}));",
"      a.download=base+'.'+ext;",
"      document.body.appendChild(a); a.click();",
"      setTimeout(function(){ try{ URL.revokeObjectURL(a.href); }catch(e){} a.remove(); }, 4000);",
"    }",
"    // Preferred path: real MP3 from the Home Relay (residential download + local ffmpeg).",
"    // Full track, no browser 1MB-chunking, no mid-song truncation, plays in every player.",
"    if(window.YT_RELAY_ACTIVE){",
"      try{",
"        setStatus('ממיר ל-MP3…');",
"        var mp3Url=location.origin+'/api/audio-mp3?v='+encodeURIComponent(currentMeta.id)+'&name='+encodeURIComponent(base);",
"        var rm=await fetch(mp3Url,{credentials:'same-origin',cache:'no-store'});",
"        var ctm=(rm.headers.get('content-type')||'').toLowerCase();",
"        if(rm.ok && ctm.indexOf('audio/mpeg')!==-1){",
"          var abm=new Uint8Array(await rm.arrayBuffer());",
"          var looksMp3=abm.length>2000&&((abm[0]===0x49&&abm[1]===0x44&&abm[2]===0x33)||(abm[0]===0xff&&(abm[1]&0xe0)===0xe0));",
"          if(looksMp3){",
"            saveBlob(abm,'audio/mpeg','mp3');",
"            setStatus('ההורדה הושלמה · MP3 · '+(Math.round(abm.length/1048576*10)/10)+'MB');",
"            return;",
"          }",
"        }",
"      }catch(e){}",
"    }",
"    // Fallback: Fetch the audio track through the proxy in bounded Range chunks.",
"    async function grabProxy(itag){",
"      var CH=1<<20, MIN_CH=1<<18, pos=0, total=Infinity, parts=[], got=0;",
"      while(pos<total){",
"        var r=null, attempt=0;",
"        for(attempt=0;attempt<6;attempt++){",
"          try{ r=await fetch(mediaUrl(currentMeta.id,itag,true,false,''),{credentials:'same-origin',cache:'no-store',headers:{'Range':'bytes='+pos+'-'+(pos+CH-1)}}); }catch(e){ r=null; }",
"          if(r&&(r.ok||r.status===206)) break;",
"          r=null;",
"          if(CH>MIN_CH){ CH=Math.max(MIN_CH,CH>>1); }",
"          else { await new Promise(function(rs){ setTimeout(rs,400*(attempt+1)); }); }",
"        }",
"        // A mid-download failure MUST NOT save a partial file — that was the 'stops in the",
"        // middle / tiny file' bug. Throw so we retry the next format instead of truncating.",
"        if(!r){ throw new Error('proxy '+itag+' @'+pos+' failed ('+got+'B of '+(total<Infinity?total:'?')+')'); }",
"        var cr=r.headers.get('Content-Range'); if(cr){ var mt=cr.match(/\\/(\\d+)\\s*$/); if(mt) total=parseInt(mt[1],10); }",
"        var ab=new Uint8Array(await r.arrayBuffer());",
"        if(r.headers.get('X-Proxy-Obfuscated')==='1'){ var off=parseInt(r.headers.get('X-Seal-Offset')||String(pos),10); if(isNaN(off))off=pos; ab=unsealBuf(ab,off); }",
"        if(!ab.length) break;",
"        parts.push(ab); got+=ab.length; pos+=ab.length;",
"        setStatus('מוריד אודיו · '+(total<Infinity?Math.round(got/total*100)+'%':(Math.round(got/1e6)+'MB')));",
"        if(!cr) break;",
"      }",
"      if(got<1024) throw new Error('empty');",
"      // Guard against silent truncation: if the server told us the full size, insist we got it.",
"      if(total<Infinity && got<total) throw new Error('truncated '+got+'/'+total);",
"      var out=new Uint8Array(got), p=0; for(var k=0;k<parts.length;k++){ out.set(parts[k],p); p+=parts[k].length; }",
"      return out;",
"    }",
"    var lastErr='';",
"    for(var i=0;i<order.length;i++){",
"      var o=order[i];",
"      try{",
"        var bytes=await grabProxy(o.i);",
"        saveBlob(bytes,o.mime,o.ext);",
"        setStatus('ההורדה הושלמה · '+o.ext.toUpperCase());",
"        return;",
"      }catch(e){ lastErr=(e&&e.message)||String(e); }",
"    }",
"    setStatus(''); showErr('הורדת האודיו נכשלה ('+lastErr+') — נסו שוב או בחרו סרטון אחר');",
"  }",
"  async function downloadVideo(){",
"    if(!currentMeta.id){ setStatus('אין סרטון'); return; }",
"    setStatus('מוריד…'); showErr('');",
"    try{ await ensureSw(); }catch(e){}",
"    var itag=currentItag||(q.value==='auto'?'18':q.value)||'18';",
"    var list=[itag].concat(FALLBACK.filter(function(x){return x!==itag;}));",
"    var last=null;",
"    var name=(currentMeta.title||currentMeta.id).replace(/[^\\w\\u0590-\\u05FF \\-]+/g,'_').trim().slice(0,90)||'video';",
"    // Prefer client-resolved progressive URLs (same as play) — worker alone often LOGIN_REQUIRED",
"    var cFormats=null;",
"    try{ cFormats=await resolveFormatsClient(currentMeta.id); }catch(e){}",
"    for(var i=0;i<list.length;i++){",
"      try{",
"        setStatus('מוריד · '+(list[i]==='22'?'720p':list[i]==='18'?'360p':list[i])+'…');",
"        var direct='';",
"        if(cFormats&&cFormats.length){",
"          var pf=pickClientFormat(cFormats, list[i]);",
"          if(pf&&pf.url) direct=pf.url;",
"        }",
"        var CH=4<<20, pos=0, total=Infinity, parts=[], got=0;",
"        var fetchFailed=false;",
"        while(pos<total){",
"          var r=null, attempt=0;",
"          for(attempt=0;attempt<5;attempt++){",
"            try{",
"              var url=mediaUrl(currentMeta.id, list[i], true, false, direct);",
"              r=await fetch(url,{credentials:'same-origin',cache:'no-store',headers:{'Range':'bytes='+pos+'-'+(pos+CH-1)}});",
"            }catch(e){ r=null; }",
"            if(r&&(r.ok||r.status===206)) break;",
"            r=null;",
"            if(attempt>=4) break;",
"            await new Promise(function(rs){ setTimeout(rs,400*(attempt+1)); });",
"          }",
"          if(!r){ fetchFailed=true; break; }",
"          var cr=r.headers.get('Content-Range');",
"          if(cr){ var mt=cr.match(/\\/(\\d+)\\s*$/); if(mt) total=parseInt(mt[1],10); }",
"          var ab=new Uint8Array(await r.arrayBuffer());",
"          if(r.headers.get('X-Proxy-Obfuscated')==='1'){",
"            var off=parseInt(r.headers.get('X-Seal-Offset')||String(pos),10);",
"            if(isNaN(off)) off=pos;",
"            ab=unsealBuf(ab,off);",
"          }",
"          if(!ab.length) break;",
"          parts.push(ab); got+=ab.length; pos+=ab.length;",
"          var pct=total<Infinity?(Math.round(got/total*100)+'%'):(Math.round(got/1048576*10)/10+'MB');",
"          setStatus('מוריד וידאו · '+(list[i]==='22'?'720p':list[i]==='18'?'360p':list[i])+' · '+pct);",
"          if(!cr) break;",
"        }",
"        if(fetchFailed||got<20000) throw new Error('הורדת הקובץ נכשלה או קטנה מדי');",
"        var fullBuf=new Uint8Array(got), p=0;",
"        for(var k=0;k<parts.length;k++){ fullBuf.set(parts[k],p); p+=parts[k].length; }",
"        var isMp4=fullBuf.length>12&&fullBuf[4]===0x66&&fullBuf[5]===0x74&&fullBuf[6]===0x79&&fullBuf[7]===0x70;",
"        var isWebm=fullBuf.length>4&&fullBuf[0]===0x1a&&fullBuf[1]===0x45;",
"        if(!isMp4&&!isWebm) throw new Error('קובץ לא תקין אחרי הורדה');",
"        var ct=isWebm?'video/webm':'video/mp4';",
"        saveBlob(fullBuf, ct, isWebm?'webm':'mp4', name);",
"        setStatus('ההורדה הושלמה · '+(Math.round(fullBuf.length/1048576*10)/10)+'MB');",
"        return;",
"      }catch(e){ last=e; }",
"    }",
"    showErr('הורדה נכשלה: '+String(last&&last.message||last||'')+' — נסו Ctrl+F5 או ניגון ואז הורדה');",
"    setStatus('הורדה נכשלה');",
"  }",
"  function syncPlayUi(){",
"    var playing=!video.paused && !video.ended;",
"    iconPlay.style.display=playing?'none':'block';",
"    iconPause.style.display=playing?'block':'none';",
"    bigPlay.classList.toggle('hide', playing);",
"    playerShell.classList.toggle('paused', !playing);",
"  }",
"  function updateProgress(){",
"    var d=video.duration||0, c=video.currentTime||0;",
"    var pct=d? (c/d*100) : 0;",
"    ytBar.style.width=pct+'%';",
"    ytKnob.style.left=pct+'%';",
"    try{",
"      if(video.buffered && video.buffered.length){",
"        var end=video.buffered.end(video.buffered.length-1);",
"        ytBuf.style.width=(d? (end/d*100):0)+'%';",
"      }",
"    }catch(e){}",
"    ytTime.textContent=fmtTime(c)+' / '+fmtTime(d);",
"  }",
"  function seekFromEvent(e){",
"    var rect=ytProg.getBoundingClientRect();",
"    var x=(e.clientX!=null?e.clientX:(e.touches&&e.touches[0]?e.touches[0].clientX:0))-rect.left;",
"    // Always LTR progress (YouTube style) even on RTL page",
"    var ratio=Math.min(1,Math.max(0,x/rect.width));",
"    if(video.duration) video.currentTime=ratio*video.duration;",
"  }",
"  function togglePlay(){ if(video.paused) video.play().catch(function(){}); else video.pause(); }",
"  function cycleQuality(){",
"    var opts=['18','22','37','auto'];",
"    var cur=q.value||'18';",
"    var i=opts.indexOf(cur);",
"    if(i<0) i=0;",
"    q.value=opts[(i+1)%opts.length];",
"    currentItag=q.value==='auto'?'18':q.value;",
"    updateQualityBtn();",
"    setStatus('מחליף ל-'+(q.value==='37'?'1080p':q.value==='22'?'720p':q.value==='18'?'360p':'אוטו')+'…');",
"        if(currentMeta.id) loadId(currentMeta.id, currentMeta);",
"  }",
"",
"  document.getElementById('play').onclick=function(){ loadId(vidInput.value||currentMeta.id, currentMeta); };",
"  document.getElementById('retry').onclick=function(){ loadId(currentMeta.id||vidInput.value, currentMeta); };",
"  document.getElementById('btn-search').onclick=doSearch;",
"  // ── Shorts Feature ──",
"  var shortsModal=document.getElementById('shortsModal');",
"  var btnShorts=document.getElementById('btnShorts');",
"  var shortsClose=document.getElementById('shortsClose');",
"  var shortsVideo=document.getElementById('shortsVideo');",
"  var shortsShell=document.getElementById('shortsShell');",
"  var shortsTitle=document.getElementById('shortsTitle');",
"  var shortsCh=document.getElementById('shortsCh');",
"  var shortsNext=document.getElementById('shortsNext');",
"  var shortsPrev=document.getElementById('shortsPrev');",
"  var shortsMute=document.getElementById('shortsMute');",
"  var shortsList=[];",
"  var shortsIndex=0;",
"",
"  async function fetchShortsList(){",
"    try{",
"      var r=await fetch('/api/yt-search?q='+encodeURIComponent('shorts ישראל'),{credentials:'same-origin'});",
"      var j=await r.json();",
"      if(j&&j.results&&j.results.length){",
"        shortsList=j.results.filter(function(it){ return it&&it.id; });",
"      }",
"    }catch(e){}",
"    if(!shortsList.length&&lastItems.length){",
"      shortsList=lastItems.slice();",
"    }",
"  }",
"",
"  async function openShorts(initialVid){",
"    if(!shortsModal) return;",
"    shortsModal.classList.add('show');",
"    try{ video.pause(); }catch(e){}",
"    if(!shortsList.length) await fetchShortsList();",
"    if(initialVid){",
"      var fIdx=-1;",
"      for(var i=0;i<shortsList.length;i++){",
"        if(shortsList[i].id===initialVid){ fIdx=i; break; }",
"      }",
"      shortsIndex=fIdx!==-1?fIdx:0;",
"    }else{",
"      shortsIndex=0;",
"    }",
"    playShortAtIndex(shortsIndex);",
"  }",
"",
"  function closeShorts(){",
"    if(!shortsModal) return;",
"    shortsModal.classList.remove('show');",
"    try{ shortsVideo.pause(); shortsVideo.src=''; }catch(e){}",
"  }",
"",
"  async function playShortAtIndex(idx){",
"    if(idx<0) idx=0;",
"    if(idx>=shortsList.length){",
"      await fetchShortsList();",
"      if(idx>=shortsList.length) idx=shortsList.length-1;",
"    }",
"    shortsIndex=idx;",
"    var item=shortsList[shortsIndex];",
"    if(!item) return;",
"",
"    if(shortsTitle) shortsTitle.textContent=item.title||item.id;",
"    if(shortsCh) shortsCh.textContent=item.channel?('@'+item.channel):'YouTube Shorts';",
"",
"    if(shortsShell) shortsShell.classList.add('loading');",
"    try{",
"      var streamUrl=mediaUrl(item.id,'18',false,false,'');",
"      shortsVideo.playsInline=true;",
"      shortsVideo.muted=true;",
"      try{ shortsVideo.pause(); }catch(e){}",
"      shortsVideo.src=streamUrl;",
"      try{ shortsVideo.load(); }catch(e){}",
"      await shortsVideo.play();",
"      try{ shortsVideo.muted=false; shortsVideo.volume=1; }catch(e){}",
"      if(shortsShell) shortsShell.classList.remove('loading');",
"    }catch(e){",
"      try{",
"        shortsVideo.muted=true;",
"        await shortsVideo.play();",
"        try{ shortsVideo.muted=false; }catch(e3){}",
"        if(shortsShell) shortsShell.classList.remove('loading');",
"      }catch(e2){",
"        if(shortsShell) shortsShell.classList.remove('loading');",
"      }",
"    }",
"  }",
"",
"  if(btnShorts) btnShorts.onclick=function(){ openShorts(); };",
"  if(shortsClose) shortsClose.onclick=closeShorts;",
"  if(shortsNext) shortsNext.onclick=function(){ playShortAtIndex(shortsIndex+1); };",
"  if(shortsPrev) shortsPrev.onclick=function(){ playShortAtIndex(shortsIndex-1); };",
"  if(shortsMute) shortsMute.onclick=function(){ if(shortsVideo) shortsVideo.muted=!shortsVideo.muted; };",
"  if(shortsVideo){",
"    shortsVideo.onended=function(){ playShortAtIndex(shortsIndex+1); };",
"    shortsVideo.onclick=function(){",
"      if(shortsVideo.paused) shortsVideo.play();",
"      else shortsVideo.pause();",
"    };",
"  }",
"",
"  window.addEventListener('keydown',function(e){",
"    if(!shortsModal||!shortsModal.classList.contains('show')) return;",
"    if(e.key==='ArrowDown'||e.key==='PageDown'){ e.preventDefault(); playShortAtIndex(shortsIndex+1); }",
"    else if(e.key==='ArrowUp'||e.key==='PageUp'){ e.preventDefault(); playShortAtIndex(shortsIndex-1); }",
"    else if(e.key==='Escape'){ e.preventDefault(); closeShorts(); }",
"    else if(e.key===' '){ e.preventDefault(); if(shortsVideo.paused) shortsVideo.play(); else shortsVideo.pause(); }",
"  });",
"",
"  var wheelLock=false;",
"  if(shortsModal){",
"    shortsModal.addEventListener('wheel',function(e){",
"      if(wheelLock) return;",
"      wheelLock=true;",
"      setTimeout(function(){ wheelLock=false; }, 400);",
"      if(e.deltaY>0) playShortAtIndex(shortsIndex+1);",
"      else if(e.deltaY<0) playShortAtIndex(shortsIndex-1);",
"    },{passive:true});",
"  }",
"",
"  var bqEl=document.getElementById('btn-quality'); if(bqEl) bqEl.onclick=cycleQuality;",
"  var cCc=document.getElementById('cCc'); if(cCc) cCc.onclick=function(){ setStatus('כתוביות אינן זמינות במצב זה'); };",
"  var cAuto=document.getElementById('cAuto'); if(cAuto) cAuto.onclick=function(){ setStatus('הפעלה אוטומטית פעילה'); };",
"  document.getElementById('btn-theater').onclick=function(){ if(mode==='theater') setMode('watch'); else setMode('theater'); };",
"  document.getElementById('cTheater').onclick=function(){ if(mode==='theater') setMode('watch'); else setMode('theater'); };",
"  document.getElementById('btn-mini').onclick=function(){ if(currentMeta.id||video.src) setMode('mini'); };",
"  document.getElementById('cMini').onclick=function(){ if(currentMeta.id||video.src) setMode('mini'); };",
"  document.getElementById('btn-expand').onclick=function(){",
"    if(mode==='mini') setMode('watch');",
"    try{ if(document.fullscreenElement) document.exitFullscreen(); else playerShell.requestFullscreen(); }catch(e){}",
"  };",
"  document.getElementById('cFs').onclick=function(){",
"    try{ if(document.fullscreenElement) document.exitFullscreen(); else playerShell.requestFullscreen(); }catch(e){}",
"  };",
"  document.getElementById('mini-expand').onclick=function(){ setMode('watch'); try{window.scrollTo({top:0,behavior:'smooth'});}catch(e){} };",
"  document.getElementById('mini-close').onclick=function(){ try{video.pause();}catch(e){} setMode('browse'); };",
"  document.getElementById('btn-copy').onclick=function(){",
"    var link=location.origin+'/ytp?v='+encodeURIComponent(currentMeta.id||'');",
"    if(navigator.clipboard&&navigator.clipboard.writeText) navigator.clipboard.writeText(link);",
"    setStatus('הקישור הועתק');",
"  };",
"  // Diagnostics button",
"  function closeDiagnostics(){",
"    var dp=document.getElementById('diagPanel'); if(dp) dp.style.display='none';",
"  }",
"  function showDiagnostics(){",
"    var dp=document.getElementById('diagPanel'); if(!dp) return;",
"    var dc=document.getElementById('diagContent'); if(!dc) return;",
"    dp.style.display='flex';",
"    var lines=[];",
"    function addSec(title){ lines.push('<div class=\"diag-section\"><h3>'+title+'</h3>'); }",
"    function addRow(l,v,cls){ lines.push('<div class=\"diag-row\"><span class=\"label\">'+l+'</span><span class=\"value\"'+(cls?' class=\"'+cls+'\"':'')+'>'+String(v||'—')+'</span></div>'); }",
"    function endSec(){ lines.push('</div>'); }",
"    addSec('\u05E0\u05D2\u05DF');", // Player
"    addRow('\u05DE\u05E6\u05D1', video.paused ? '\u05D4\u05E9\u05D4\u05D4' : '\u05DE\u05E0\u05D2\u05DF', video.paused ? '' : 'good');",
"    addRow('\u05D0\u05D9\u05DB\u05D5\u05EA (itag)', currentItag || '—');",
"    addRow('\u05E8\u05D6\u05D5\u05DC\u05D5\u05E6\u05D9\u05D4', (video.videoWidth||'—')+'x'+(video.videoHeight||'—'));",
"    addRow('\u05D4\u05D6\u05E8\u05DD (bitrate)', currentMeta.duration ? '\u05D4\u05D5\u05E8\u05D3\u05EA \u05D1\u05E8\u05E7\u05E2' : '—');",
"    addRow('\u05D6\u05DE\u05DF \u05E0\u05D5\u05DB\u05D7\u05D9', fmtTime(video.currentTime));",
"    addRow('\u05DE\u05E9\u05DA \u05E1\u05E8\u05D8\u05D5\u05DF', fmtTime(video.duration));",
"    addRow('ReadyState', String(video.readyState)+'/'+4, video.readyState>=3?'good':(video.readyState>=2?'warn':'bad'));",
"    var errMsg='\u05DC\u05DC\u05D0 \u05E9\u05D2\u05D9\u05D0\u05D4';",
"    if(video.error){",
"      var codes={1:'\u05D1\u05D9\u05D8\u05D5\u05DC \u05D4\u05D5\u05E8\u05D3\u05D4',2:'\u05E9\u05D2\u05D9\u05D0\u05EA \u05E8\u05E9\u05EA',3:'\u05E9\u05D2\u05D9\u05D0\u05EA \u05E4\u05E2\u05E0\u05D5\u05D7',4:'\u05E4\u05D5\u05E8\u05DE\u05D8 \u05DC\u05D0 \u05E0\u05EA\u05DE\u05DA'};",
"      errMsg=codes[video.error.code]||'\u05E7\u05D5\u05D3 '+video.error.code;",
"    }",
"    addRow('\u05E9\u05D2\u05D9\u05D0\u05EA \u05E0\u05D2\u05DF', errMsg, video.error?'bad':'');",
"    var bufferInfo='—';",
"    try{ if(video.buffered&&video.buffered.length){ var be=video.buffered.end(video.buffered.length-1); bufferInfo=fmtTime(be)+' ('+Math.round(be/video.duration*100)+'%)'; } }catch(e){}",
"    addRow('Buffer', bufferInfo);",
"    endSec();",
"    addSec('\u05E7\u05D5\u05D3\u05E7');", // Codec
"    var codecInfo='—';",
"    var vMime='—', aMime='—';",
"    try{ if(adaptiveFmtCache&&currentMeta.id){ var fmts=adaptiveFmtCache[currentMeta.id]; if(fmts&&fmts.list&&fmts.list.length){ var p=pickAdaptivePair(fmts.list,360); if(p&&p.video){ vMime=p.video.mimeType||p.video.mime||'—'; aMime=p.audio?((p.audio.mimeType||p.audio.mime||'—')):'—'; } } } }catch(e){}",
"    addRow('\u05D5\u05D9\u05D3\u05D0\u05D5', String(vMime).slice(0,50));",
"    addRow('\u05D0\u05D5\u05D3\u05D9\u05D5', String(aMime).slice(0,50));",
"    var src=video.currentSrc||video.src||'';",
"    var isMse=(src.indexOf('blob:')===0);",
"    addRow('\u05DE\u05E7\u05D5\u05E8 \u05D4\u05D6\u05E8\u05DE\u05D4', isMse?'MSE (blob)':(src.length>40?src.slice(0,40)+'…':(src||'—')));",
"    endSec();",
"    addSec('\u05E8\u05E9\u05EA');", // Network
"    var swActive=('serviceWorker' in navigator) && !!navigator.serviceWorker.controller;",
"    addRow('Service Worker', swActive?'\u05E4\u05E2\u05D9\u05DC':'\u05DC\u05D0 \u05E4\u05E2\u05D9\u05DC', swActive?'good':'bad');",
"    addRow('YT Relay', window.YT_RELAY_ACTIVE?'\u05DE\u05D5\u05D2\u05D3\u05E8':'\u05DC\u05D0 \u05DE\u05D5\u05D2\u05D3\u05E8');",
"    var online=typeof navigator.onLine==='undefined'?'—':(navigator.onLine?'\u05DE\u05D7\u05D5\u05D1\u05E8':'\u05DE\u05E0\u05D5\u05EA\u05E7');",
"    addRow('\u05E8\u05E9\u05EA', online, navigator.onLine?'good':'bad');",
"    endSec();",
"    addSec('\u05DE\u05E2\u05E8\u05DB\u05EA');", // System
"    addRow('User Agent', navigator.userAgent.slice(0,60));",
"    addRow('MSE', ('MediaSource' in window)?'\u05E0\u05EA\u05DE\u05DA':'\u05DC\u05D0 \u05E0\u05EA\u05DE\u05DA', ('MediaSource' in window)?'good':'bad');",
"    addRow('\u05DE\u05E6\u05D1 \u05E0\u05D2\u05DF', mode||'—');",
"    addRow('\u05E1\u05E8\u05D8\u05D5\u05DF \u05E0\u05D5\u05DB\u05D7\u05D9', currentMeta.id||'—');",
"    endSec();",
"    dc.innerHTML=lines.join('');",
"  }",
"  var bdiag=document.getElementById('btn-diagnostics'); if(bdiag) bdiag.onclick=showDiagnostics;",
"  window.closeDiagnostics=closeDiagnostics;",
"  window.showDiagnostics=showDiagnostics;",
"",
"  var bd=document.getElementById('btn-download'); if(bd) bd.onclick=downloadVideo;",
"  var ba=document.getElementById('btn-audio'); if(ba) ba.onclick=downloadAudio;",
"  var bch=document.getElementById('btn-channel'); if(bch) bch.onclick=function(e){ e.preventDefault(); openChannel(); };",
"  var bback=document.getElementById('btn-ch-back'); if(bback) bback.onclick=function(){ var ban=document.getElementById('chBanner'); if(ban) ban.style.display='none'; setMode(currentMeta.id?'watch':'browse'); };",
"  var bsh=document.getElementById('btn-share'); if(bsh) bsh.onclick=function(){ var link=location.origin+'/ytp?v='+encodeURIComponent(currentMeta.id||''); if(navigator.clipboard&&navigator.clipboard.writeText) navigator.clipboard.writeText(link); setStatus('שותף · הקישור הועתק'); };",
"  var bl=document.getElementById('btn-like'); if(bl) bl.onclick=function(){ setStatus('אהבתי ✓'); };",
"  var bdl=document.getElementById('btn-dislike'); if(bdl) bdl.onclick=function(){ setStatus('לא אהבתי'); };",
"  document.getElementById('cPlay').onclick=togglePlay;",
"  bigPlay.onclick=togglePlay;",
"  video.addEventListener('click', function(e){ if(e.target===video) togglePlay(); });",
"  video.addEventListener('play', syncPlayUi);",
"  video.addEventListener('pause', syncPlayUi);",
"  video.addEventListener('timeupdate', updateProgress);",
"  video.addEventListener('loadedmetadata', updateProgress);",
"  // Shorts / vertical clips: once real dimensions are known, flip the stage to 9:16 so the",
"  // clip fills the frame instead of sitting between two huge black pillars.",
"  function syncOrientation(){",
"    try{",
"      var w=video.videoWidth||0, h=video.videoHeight||0;",
"      if(!w||!h) return;",
"      playerShell.classList.toggle('portrait', h>w);",
"    }catch(e){}",
"  }",
"  video.addEventListener('loadedmetadata', syncOrientation);",
"  video.addEventListener('resize', syncOrientation);",
"  video.addEventListener('progress', updateProgress);",
"  document.getElementById('cMute').onclick=function(){ video.muted=!video.muted; };",
"  document.getElementById('cVol').oninput=function(e){ video.volume=parseFloat(e.target.value); video.muted=video.volume===0; };",
"  ytProg.addEventListener('click', seekFromEvent);",
"  channelBlock.onclick=function(e){ e.preventDefault(); openChannel(); };",
"  descBox.onclick=function(){",
"    descBox.classList.toggle('open');",
"    descMore.textContent=descBox.classList.contains('open')?'הצג פחות':'הצג עוד';",
"  };",
"  qsearch.addEventListener('keydown',function(e){ if(e.key==='Enter') doSearch(); });",
"  q.onchange=function(){ if(currentMeta.id) loadId(currentMeta.id, currentMeta); };",
"  document.addEventListener('keydown',function(e){",
"    if(e.target && (e.target.tagName==='INPUT'||e.target.tagName==='TEXTAREA')) return;",
"    if(e.key===' ' || e.key==='k' || e.key==='K'){ e.preventDefault(); togglePlay(); }",
"    if(e.key==='f' || e.key==='F'){ try{ if(document.fullscreenElement) document.exitFullscreen(); else playerShell.requestFullscreen(); }catch(err){} }",
"    if(e.key==='Escape' && mode==='theater') setMode('watch');",
"    if(e.key==='Escape' && mode==='mini') setMode('watch');",
"    if(e.key==='m' || e.key==='M') video.muted=!video.muted;",
"    if(e.key==='ArrowRight' && video.duration) video.currentTime=Math.min(video.duration, video.currentTime+5);",
"    if(e.key==='ArrowLeft' && video.duration) video.currentTime=Math.max(0, video.currentTime-5);",
"  });",
"  var uiTimer=null;",
"  playerShell.addEventListener('mousemove',function(){",
"    playerShell.classList.add('show-ui');",
"    clearTimeout(uiTimer);",
"    uiTimer=setTimeout(function(){ playerShell.classList.remove('show-ui'); }, 2500);",
"  });",
"",
"  renderChips();",
"  syncPlayUi();",
"  updateQualityBtn();",
"  // Register + activate the SW as early as possible so it is controlling the page by the",
"  // time the user clicks a video (prevents the first-play reset loop).",
"  try{ ensureSw(); }catch(e){}",
"  var initial=(document.body.getAttribute('data-initial-id')||'').trim();",
"  var pre=document.body.getAttribute('data-prefill-q')||'';",
"  if(initial){ setMode('watch'); loadId(initial, {id:initial,title:initial,channel:''}); }",
"  if(pre){ qsearch.value=pre; doSearch(); }",
"  else if(!initial){ emptyHint.style.display='block'; setStatus('מוכן לחיפוש'); }",
"})();",
].join('\n');


function runsText(node) {
  if (!node) return '';
  if (typeof node === 'string') return node;
  if (node.simpleText) return node.simpleText;
  if (Array.isArray(node.runs)) return node.runs.map((r) => r.text || '').join('');
  return '';
}

function extractChannelId(vr) {
  try {
    const nav =
      (vr.ownerText && vr.ownerText.runs && vr.ownerText.runs[0] && vr.ownerText.runs[0].navigationEndpoint) ||
      (vr.longBylineText && vr.longBylineText.runs && vr.longBylineText.runs[0] && vr.longBylineText.runs[0].navigationEndpoint) ||
      (vr.shortBylineText && vr.shortBylineText.runs && vr.shortBylineText.runs[0] && vr.shortBylineText.runs[0].navigationEndpoint) ||
      (vr.ownerEndpoint) ||
      null;
    if (!nav) return '';
    return (
      (nav.browseEndpoint && (nav.browseEndpoint.browseId || '')) ||
      (nav.canonicalBaseUrl ? String(nav.canonicalBaseUrl).replace(/^\//, '') : '') ||
      ''
    );
  } catch {
    return '';
  }
}

function parseSearchResults(data, origin) {
  const results = [];
  const seen = new Set();
  function walk(node) {
    if (!node || results.length >= 40) return;
    if (Array.isArray(node)) {
      node.forEach(walk);
      return;
    }
    if (typeof node !== 'object') return;
    const vr = node.videoRenderer || node.playlistVideoRenderer || node.gridVideoRenderer;
    if (vr && vr.videoId && !seen.has(vr.videoId)) {
      seen.add(vr.videoId);
      const title = runsText(vr.title) || vr.videoId;
      const channel =
        runsText(vr.ownerText) ||
        runsText(vr.longBylineText) ||
        runsText(vr.shortBylineText) ||
        '';
      const channelId = extractChannelId(vr);
      const views = runsText(vr.viewCountText) || runsText(vr.shortViewCountText) || '';
      const published = runsText(vr.publishedTimeText) || '';
      const duration =
        runsText(vr.lengthText) ||
        (vr.thumbnailOverlays || [])
          .map((o) => runsText(o && o.thumbnailOverlayTimeStatusRenderer && o.thumbnailOverlayTimeStatusRenderer.text))
          .filter(Boolean)[0] ||
        '';
      const desc =
        runsText(vr.descriptionSnippet) ||
        runsText(vr.detailedMetadataSnippets && vr.detailedMetadataSnippets[0] && vr.detailedMetadataSnippets[0].snippetText) ||
        '';
      results.push({
        id: vr.videoId,
        title,
        channel,
        channelId,
        views,
        published,
        duration,
        description: desc,
        thumb: origin + '/x/t?d=' + encodeUrl(JSON.stringify({ v: vr.videoId, q: 'hq720' })),
      });
    }
    for (const k of Object.keys(node)) walk(node[k]);
  }
  walk(data);
  return results;
}

async function youtubeSearchQuery(q, origin) {
  // WEB first (usually fastest on CF). Short timeout per client so search never "hangs".
  const clients = [
    {
      clientName: 'WEB',
      clientVersion: '2.20250620.00.00',
      clientNameHeader: '1',
      ua: 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36',
      extra: {},
      timeoutMs: 4500,
      apiKey: INNERTUBE_KEYS.WEB,
    },
    {
      clientName: 'ANDROID',
      clientVersion: '20.50.37',
      clientNameHeader: '3',
      ua: 'com.google.android.youtube/20.50.37 (Linux; U; Android 14) gzip',
      extra: { androidSdkVersion: 34 },
      timeoutMs: 4000,
      apiKey: INNERTUBE_KEYS.ANDROID,
    },
  ];

  for (const cl of clients) {
    try {
      const ac = new AbortController();
      const timer = setTimeout(() => ac.abort(), cl.timeoutMs);
      const searchUrl =
        'https://www.youtube.com/youtubei/v1/search?prettyPrint=false&key=' +
        encodeURIComponent(cl.apiKey || INNERTUBE_KEYS.WEB);
      const pr = await fetch(searchUrl, {
        method: 'POST',
        signal: ac.signal,
        headers: {
          'content-type': 'application/json',
          'user-agent': cl.ua,
          'x-youtube-client-name': cl.clientNameHeader,
          'x-youtube-client-version': cl.clientVersion,
          'x-goog-api-key': cl.apiKey || INNERTUBE_KEYS.WEB,
          origin: 'https://www.youtube.com',
          referer: 'https://www.youtube.com/',
          'accept-language': 'he-IL,he;q=0.9,en-US;q=0.8',
        },
        body: JSON.stringify({
          context: {
            client: {
              clientName: cl.clientName,
              clientVersion: cl.clientVersion,
              hl: 'he',
              gl: 'IL',
              ...cl.extra,
            },
          },
          query: q,
        }),
      });
      clearTimeout(timer);
      const text = await pr.text();
      if (!text || text.trimStart()[0] === '<') continue;
      let data;
      try {
        data = JSON.parse(text);
      } catch {
        continue;
      }
      const results = parseSearchResults(data, origin);
      if (results.length) return { results, source: cl.clientName };
    } catch {
      /* next client */
    }
  }

  // Fast HTML scrape fallback (timeout 5s)
  try {
    const ac = new AbortController();
    const timer = setTimeout(() => ac.abort(), 5000);
    const hr = await fetch(
      'https://www.youtube.com/results?search_query=' + encodeURIComponent(q) + '&hl=he&gl=IL',
      {
        signal: ac.signal,
        headers: {
          'user-agent':
            'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36',
          'accept-language': 'he-IL,he;q=0.9,en-US;q=0.8',
          accept: 'text/html,application/xhtml+xml',
        },
      }
    );
    clearTimeout(timer);
    const html = await hr.text();
    if (html && html.indexOf('ytInitialData') !== -1) {
      let jsonStr = null;
      const m1 = html.match(/var ytInitialData\s*=\s*(\{[\s\S]*?\});\s*<\/script>/);
      const m2 = html.match(/ytInitialData\s*=\s*(\{[\s\S]*?\});/);
      if (m1) jsonStr = m1[1];
      else if (m2) jsonStr = m2[1];
      if (jsonStr) {
        const data = JSON.parse(jsonStr);
        const results = parseSearchResults(data, origin);
        if (results.length) return { results, source: 'html' };
      }
    }
  } catch {
    /* ignore */
  }

  return { results: [], source: 'none' };
}

// ─── Web search (general) ────────────────────────────────────────────────────
// Search engines block Cloudflare/datacenter IPs (DuckDuckGo/Mojeek/Ecosia → 403),
// so we route the query through the residential home-relay to DuckDuckGo and render our
// OWN results page — reliable, and its search box actually works (no proxied SPA).
function htmlEscape(s) {
  return String(s == null ? '' : s)
    .replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
    .replace(/"/g, '&quot;').replace(/'/g, '&#39;');
}
const NAMED_ENTITIES = {
  nbsp: ' ', amp: '&', lt: '<', gt: '>', quot: '"', apos: "'",
  hellip: '…', ndash: '–', mdash: '—', lsquo: '‘', rsquo: '’', ldquo: '“', rdquo: '”',
  laquo: '«', raquo: '»', middot: '·', bull: '•', trade: '™', copy: '©', reg: '®',
  deg: '°', times: '×', divide: '÷', euro: '€', pound: '£', yen: '¥', cent: '¢',
  sect: '§', para: '¶', dagger: '†', permil: '‰', prime: '′', Prime: '″',
  lrm: '', rlm: '', zwj: '', zwnj: '', shy: '', ensp: ' ', emsp: ' ', thinsp: ' ',
  clubs: '♣', hearts: '♥', diams: '♦', spades: '♠', larr: '←', rarr: '→', harr: '↔',
};
// Search engines emit titles with numeric entities for every non-ASCII character — Hebrew
// especially — so a named-entity-only decoder leaves the UI full of &#1506; noise.
function decodeEntities(s) {
  return String(s || '')
    .replace(/&#x([0-9a-f]+);/gi, (_, h) => {
      const n = parseInt(h, 16);
      return Number.isFinite(n) && n > 0 && n <= 0x10ffff ? String.fromCodePoint(n) : _;
    })
    .replace(/&#(\d+);/g, (_, d) => {
      const n = parseInt(d, 10);
      return Number.isFinite(n) && n > 0 && n <= 0x10ffff ? String.fromCodePoint(n) : _;
    })
    .replace(/&([a-zA-Z][a-zA-Z0-9]{1,9});/g, (m0, name) =>
      Object.prototype.hasOwnProperty.call(NAMED_ENTITIES, name) ? NAMED_ENTITIES[name] : m0
    );
}
// For JSON that lives inside an HTML attribute (Bing's m=/mmeta=): unescape ONLY the five
// markup entities. Full entity decoding would turn a &#34; inside a title into a bare quote
// and break JSON.parse.
function decodeJsonAttr(s) {
  return String(s || '')
    .replace(/&quot;/g, '"').replace(/&#39;|&apos;/g, "'")
    .replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&amp;/g, '&');
}
function stripTags(s) {
  return decodeEntities(String(s || '').replace(/<[^>]*>/g, '')).replace(/\s+/g, ' ').trim();
}
function decodeDdgHref(href) {
  try {
    let h = decodeEntities(String(href || '').trim());
    if (!h) return '';
    if (h.startsWith('//')) h = 'https:' + h;
    if (/(?:^|\/\/|\.)duckduckgo\.com\/l\//i.test(h) || h.indexOf('uddg=') !== -1) {
      const u = new URL(h, 'https://duckduckgo.com');
      const uddg = u.searchParams.get('uddg');
      if (uddg) return decodeURIComponent(uddg);
    }
    if (h.startsWith('/')) return '';           // relative DDG UI link — skip
    if (!/^https?:\/\//i.test(h)) return '';
    return h;
  } catch { return ''; }
}
function parseDuckDuckGoResults(html) {
  const out = [];
  if (!html) return out;
  let m;
  // html.duckduckgo.com layout: <a class="result__a" href>title</a> + <a class="result__snippet">
  const reA = /<a\b[^>]*class="[^"]*\bresult__a\b[^"]*"[^>]*href="([^"]+)"[^>]*>([\s\S]*?)<\/a>/gi;
  while ((m = reA.exec(html)) && out.length < 25) {
    const url = decodeDdgHref(m[1]);
    const title = stripTags(m[2]);
    if (url && title && !isSearchAdUrl(url)) out.push({ url, title, snippet: '' });
  }
  if (out.length) {
    const snips = [];
    const reS = /<a\b[^>]*class="[^"]*\bresult__snippet\b[^"]*"[^>]*>([\s\S]*?)<\/a>/gi;
    while ((m = reS.exec(html))) snips.push(stripTags(m[1]));
    for (let i = 0; i < out.length && i < snips.length; i++) out[i].snippet = snips[i];
    return out;
  }
  // lite.duckduckgo.com layout: <a class="result-link"> + <td class="result-snippet">
  const reL = /<a\b[^>]*class="[^"]*\bresult-link\b[^"]*"[^>]*href="([^"]+)"[^>]*>([\s\S]*?)<\/a>/gi;
  while ((m = reL.exec(html)) && out.length < 25) {
    const url = decodeDdgHref(m[1]);
    const title = stripTags(m[2]);
    if (url && title) out.push({ url, title, snippet: '' });
  }
  const lsnips = [];
  const reLS = /<td\b[^>]*class="[^"]*\bresult-snippet\b[^"]*"[^>]*>([\s\S]*?)<\/td>/gi;
  while ((m = reLS.exec(html))) lsnips.push(stripTags(m[1]));
  for (let i = 0; i < out.length && i < lsnips.length; i++) out[i].snippet = lsnips[i];
  return out;
}
// Bing wraps some result URLs as bing.com/ck/a?...&u=a1<base64url>. Unwrap to the real URL.
function decodeBingHref(href) {
  try {
    const h = decodeEntities(String(href || '').trim());
    if (/(?:^|\/\/|\.)bing\.com\/ck\/a/i.test(h)) {
      const u = new URL(h, 'https://www.bing.com').searchParams.get('u');
      if (u && /^a1/.test(u)) {
        let b = u.slice(2).replace(/-/g, '+').replace(/_/g, '/');
        while (b.length % 4) b += '=';
        const dec = atob(b);
        if (/^https?:\/\//i.test(dec)) return dec;
      }
    }
    return h;
  } catch { return String(href || ''); }
}
function parseBingResults(html) {
  const out = [];
  if (!html) return out;
  const blocks = html.split(/<li class="b_algo"/i).slice(1);
  for (const raw of blocks) {
    if (out.length >= 25) break;
    const blk = raw.slice(0, 6000);
    // Title link is <h2>…<a href>…</a> or an <a class="tilk" href>. Try both.
    const a =
      blk.match(/<h2[^>]*>[\s\S]*?<a\b[^>]*\shref="([^"]+)"[^>]*>([\s\S]*?)<\/a>/i) ||
      blk.match(/<a\b[^>]*class="[^"]*tilk[^"]*"[^>]*\shref="([^"]+)"[^>]*>([\s\S]*?)<\/a>/i);
    if (!a) continue;
    const url = decodeBingHref(a[1]);
    const title = stripTags(a[2]);
    if (!/^https?:\/\//i.test(url) || !title || isSearchAdUrl(url)) continue;
    let snippet = '';
    const p =
      blk.match(/<p\b[^>]*class="[^"]*b_lineclamp[^"]*"[^>]*>([\s\S]*?)<\/p>/i) ||
      blk.match(/<div[^>]*class="[^"]*b_caption[^"]*"[^>]*>[\s\S]*?<p\b[^>]*>([\s\S]*?)<\/p>/i) ||
      blk.match(/<p\b[^>]*>([\s\S]*?)<\/p>/i);
    if (p) snippet = stripTags(p[1]);
    out.push({ url, title, snippet });
  }
  return out;
}

// ─── Universal search engine (web / images / video / news) ───────────────────
// Engine choice is driven by ONE rule: never send the user to a page that can show a
// CAPTCHA. Google / Brave / Mojeek / Startpage / SearX all challenge datacenter IPs, so
// they are not used at all. Bing and Yahoo answer Cloudflare IPs with real organic HTML,
// and Bing's news RSS + images JSON are stable, tiny and unauthenticated. Everything is
// parsed here and re-rendered as our OWN page, so the user never sees a foreign UI.
const SEARCH_TABS = [
  { id: 'web', label: 'הכל', icon: '🔎' },
  { id: 'images', label: 'תמונות', icon: '🖼️' },
  { id: 'videos', label: 'וידאו', icon: '🎬' },
  { id: 'news', label: 'חדשות', icon: '📰' },
];
const SEARCH_UA =
  'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36';
// A first-visit Bing cookie: skips the consent interstitial and pins the market, which is
// what makes the organic (b_algo) list render server-side instead of a JS-only shell.
const BING_COOKIE = 'SRCHHPGUSR=SRCHLANG=he; _EDGE_S=mkt=he-il; _EDGE_V=1; SRCHD=AF=NOFORM';

function searchHeaders(referer, accept) {
  return {
    'user-agent': SEARCH_UA,
    accept: accept || 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
    'accept-language': 'he-IL,he;q=0.9,en-US;q=0.8,en;q=0.7',
    'sec-fetch-dest': 'document',
    'sec-fetch-mode': 'navigate',
    'sec-fetch-site': 'same-origin',
    'upgrade-insecure-requests': '1',
    referer: referer || 'https://www.bing.com/',
    cookie: BING_COOKIE,
  };
}

// Fetch a search page: straight from the edge first, then through the home relay (which
// has a residential IP) if the direct hit fails. Returns text, or null.
async function searchGet(url, env, opts = {}) {
  const accept = opts.accept || null;
  const referer = opts.referer || null;
  const direct = async () => {
    const ac = new AbortController();
    const t = setTimeout(() => ac.abort(), opts.timeoutMs || 2500);
    try {
      const r = await fetch(url, { headers: searchHeaders(referer, accept), redirect: 'follow', signal: ac.signal });
      clearTimeout(t);
      return r.ok ? await r.text() : null;
    } catch { clearTimeout(t); return null; }
  };
  const viaRelay = async () => {
    if (!relayConfigured(env)) return null;
    const ac = new AbortController();
    const t = setTimeout(() => ac.abort(), opts.relayTimeoutMs || 13000);
    try {
      const r = await relayFetch(env, url, { userAgent: SEARCH_UA, signal: ac.signal });
      clearTimeout(t);
      return r && r.ok ? await r.text() : null;
    } catch { clearTimeout(t); return null; }
  };
  if (opts.relayFirst) return (await viaRelay()) || (await direct());
  return (await direct()) || (await viaRelay());
}

// ── Parsers ──────────────────────────────────────────────────────────────────

// Yahoo (Bing-backed index, but a completely separate front-end — so when Bing serves us a
// JS-only shell for a deep page, Yahoo usually still has the real list).
function decodeYahooHref(href) {
  try {
    const h = decodeEntities(String(href || '').trim());
    const m = h.match(/\/RU=([^/]+)\/R[KO]=/);
    if (m) return decodeURIComponent(m[1]);
    return h;
  } catch { return String(href || ''); }
}
// Yahoo renames its result-container classes constantly, so anchoring on the container is
// fragile. What never changes is the shape `<a href=…> … <h3 class="title…">TITLE</h3></a>`,
// so we match that pair directly. Works for both the direct hrefs and the r.search.yahoo.com
// redirector form.
function parseYahooResults(html) {
  const out = [];
  if (!html) return out;
  const seen = new Set();
  const re = /<a\b[^>]*\shref="([^"]+)"[^>]*>[\s\S]{0,4000}?<h3[^>]*\bclass="[^"]*\btitle\b[^"]*"[^>]*>([\s\S]*?)<\/h3>/gi;
  let m;
  while ((m = re.exec(html)) && out.length < 30) {
    const url = decodeYahooHref(m[1]);
    if (!/^https?:\/\//i.test(url) || isSearchAdUrl(url)) continue;
    if (seen.has(url)) continue;
    const title = stripTags(m[2]);
    if (!title) continue;
    seen.add(url);
    const tail = html.slice(m.index + m[0].length, m.index + m[0].length + 2500);
    const p = tail.match(/<p\b[^>]*class="[^"]*fc-dustygray[^"]*"[^>]*>([\s\S]*?)<\/p>/i) ||
      tail.match(/<p\b[^>]*>([\s\S]*?)<\/p>/i);
    out.push({ url, title, snippet: p ? stripTags(p[1]) : '' });
  }
  return out;
}

// Sponsored placements every engine mixes into the organic list. They are useless here (and
// the click-tracker URLs do not survive proxying), so they never reach the results page.
function isSearchAdUrl(u) {
  const s = String(u || '');
  return (
    /(?:^|\/\/|\.)(?:duckduckgo\.com\/y\.js|bing\.com\/aclick|r\.search\.yahoo\.com)/i.test(s) ||
    /[?&](?:ad_provider|ad_domain|ad_type)=/i.test(s) ||
    /(?:^|\.)(?:yahoo|duckduckgo|bing)\.com$/i.test((() => { try { return new URL(s).hostname; } catch { return ''; } })())
  );
}

// Bing images. Every tile carries an `m="{…}"` JSON blob with the thumbnail (turl), the
// full-size original (murl) and the hosting page (purl) — no scraping of <img> needed.
function parseBingImages(html) {
  const out = [];
  if (!html) return out;
  const seen = new Set();
  const re = /<a\b([^>]*\bclass="[^"]*\biusc\b[^"]*"[^>]*)>/gi;
  let m;
  while ((m = re.exec(html)) && out.length < 90) {
    const tag = m[1];
    const mj = tag.match(/\sm="([^"]*)"/i);
    if (!mj) continue;
    let j;
    try { j = JSON.parse(decodeJsonAttr(mj[1])); } catch { continue; }
    const thumb = String(j.turl || '');
    const full = String(j.murl || '');
    if (!/^https?:\/\//i.test(thumb)) continue;
    if (seen.has(thumb)) continue;
    seen.add(thumb);
    const dim = tag.match(/style="height:(\d+)px;width:(\d+)px"/i);
    out.push({
      thumb,
      full: /^https?:\/\//i.test(full) ? full : thumb,
      page: /^https?:\/\//i.test(j.purl || '') ? j.purl : '',
      title: stripTags(j.t || j.desc || ''),
      h: dim ? parseInt(dim[1], 10) : 0,
      w: dim ? parseInt(dim[2], 10) : 0,
    });
  }
  return out;
}

// Bing videos: `mmeta="{…}"` gives the watch page + thumb; title/duration live in the
// markup right after it.
function parseBingVideos(html) {
  const out = [];
  if (!html) return out;
  const seen = new Set();
  const re = /\smmeta="([^"]*)"/gi;
  let m;
  while ((m = re.exec(html)) && out.length < 40) {
    let j;
    try { j = JSON.parse(decodeJsonAttr(m[1])); } catch { continue; }
    const page = String(j.pgurl || j.murl || '');
    if (!/^https?:\/\//i.test(page) || seen.has(page)) continue;
    seen.add(page);
    const near = html.slice(m.index, m.index + 7000);
    const tm =
      near.match(/class="mc_vtvc_title[^"]*"[^>]*\stitle="([^"]*)"/i) ||
      near.match(/class="mc_vtvc_title[^"]*"[^>]*>\s*<strong>([\s\S]*?)<\/strong>/i);
    const dur = near.match(/class="mc_bc_rc items"[^>]*>([^<]{2,12})</i);
    const chan = near.match(/class="mc_vtvc_meta_row_channel"[^>]*>([\s\S]*?)<\/div>/i);
    const views = near.match(/([\d.,]+[^<]{0,10})\s*(?:views|צפיות)/i);
    const title = stripTags(tm ? tm[1] : '');
    if (!title) continue;
    out.push({
      page,
      videoId: extractYoutubeVideoId(page) || '',
      thumb: /^https?:\/\//i.test(j.turl || '') ? j.turl : '',
      title,
      duration: stripTags(dur ? dur[1] : ''),
      channel: stripTags(chan ? chan[1] : ''),
      views: views ? stripTags(views[0]) : '',
    });
  }
  return out;
}

// Bing news RSS — 5 KB of clean XML instead of a 300 KB JS-driven page.
function parseNewsRss(xml) {
  const out = [];
  if (!xml) return out;
  const un = (s) => decodeEntities(stripTags(String(s || '').replace(/<!\[CDATA\[([\s\S]*?)\]\]>/g, '$1')));
  const items = xml.split(/<item>/i).slice(1);
  for (const raw of items) {
    if (out.length >= 40) break;
    const it = raw.split(/<\/item>/i)[0];
    const pick = (re) => { const m = it.match(re); return m ? un(m[1]) : ''; };
    let url = pick(/<link>([\s\S]*?)<\/link>/i);
    // Bing wraps every link in news/apiclick.aspx?…&url=<real>
    try {
      const u = new URL(url);
      const real = u.searchParams.get('url');
      if (real) url = real;
    } catch { /* keep as-is */ }
    const title = pick(/<title>([\s\S]*?)<\/title>/i);
    if (!/^https?:\/\//i.test(url) || !title) continue;
    let image = pick(/<News:Image>([\s\S]*?)<\/News:Image>/i);
    if (image && !/[?&](w|h)=/.test(image)) image += '&w=400&h=225&c=14';
    out.push({
      url,
      title,
      snippet: pick(/<description>([\s\S]*?)<\/description>/i),
      source: pick(/<News:Source>([\s\S]*?)<\/News:Source>/i),
      date: pick(/<pubDate>([\s\S]*?)<\/pubDate>/i),
      image: /^https?:\/\//i.test(image) ? image : '',
    });
  }
  return out;
}

// ── Instant answer (Wikipedia + DuckDuckGo abstract) ─────────────────────────
// Both are plain public APIs that answer datacenter IPs without any challenge.
async function instantAnswer(q) {
  const query = String(q || '').trim();
  if (!query || query.length > 120) return null;
  const get = async (u, ms) => {
    const ac = new AbortController();
    const t = setTimeout(() => ac.abort(), ms);
    try {
      const r = await fetch(u, {
        headers: { 'user-agent': SEARCH_UA, accept: 'application/json' },
        signal: ac.signal,
        cf: { cacheTtl: 3600, cacheEverything: true },
      });
      clearTimeout(t);
      return r.ok ? await r.json() : null;
    } catch { clearTimeout(t); return null; }
  };
  const langs = /[֐-׿]/.test(query) ? ['he', 'en'] : ['en', 'he'];
  for (const lang of langs) {
    const j = await get(
      'https://' + lang + '.wikipedia.org/api/rest_v1/page/summary/' + encodeURIComponent(query.replace(/\s+/g, '_')),
      4000
    );
    if (j && j.extract && (j.type === 'standard' || !j.type)) {
      return {
        kind: 'wikipedia',
        title: j.title || query,
        text: String(j.extract).slice(0, 700),
        image: (j.thumbnail && j.thumbnail.source) || '',
        url: (j.content_urls && j.content_urls.desktop && j.content_urls.desktop.page) || '',
        source: lang === 'he' ? 'ויקיפדיה' : 'Wikipedia',
      };
    }
  }
  const d = await get('https://api.duckduckgo.com/?format=json&no_html=1&skip_disambig=1&q=' + encodeURIComponent(query), 4000);
  if (d && d.AbstractText) {
    return {
      kind: 'ddg',
      title: d.Heading || query,
      text: String(d.AbstractText).slice(0, 700),
      image: d.Image ? (String(d.Image).startsWith('http') ? d.Image : 'https://duckduckgo.com' + d.Image) : '',
      url: d.AbstractURL || '',
      source: d.AbstractSource || 'DuckDuckGo',
    };
  }
  return null;
}

// ── Query autocomplete ───────────────────────────────────────────────────────
// Both endpoints answer datacenter IPs and speak the OpenSearch suggestions format
// (["query",["s1","s2",…]]). Bing's is richer; DuckDuckGo's is the backup.
const SUGGEST_CACHE = new Map(); // q -> { exp, list }
const SUGGEST_TTL_MS = 10 * 60 * 1000;

async function fetchSuggestions(q) {
  const query = String(q || '').trim();
  if (!query || query.length > 80) return [];
  const key = query.toLowerCase();
  const hit = SUGGEST_CACHE.get(key);
  if (hit && hit.exp > Date.now()) return hit.list;

  const enc = encodeURIComponent(query);
  const sources = [
    'https://api.bing.com/osjson.aspx?query=' + enc,
    'https://ac.duckduckgo.com/ac/?q=' + enc + '&type=list',
  ];
  for (const u of sources) {
    try {
      const ac = new AbortController();
      const t = setTimeout(() => ac.abort(), 3500);
      const r = await fetch(u, {
        headers: { 'user-agent': SEARCH_UA, accept: 'application/json, text/javascript, */*', 'accept-language': 'he-IL,he;q=0.9,en;q=0.8' },
        signal: ac.signal,
        cf: { cacheTtl: 600, cacheEverything: true },
      });
      clearTimeout(t);
      if (!r.ok) continue;
      const j = JSON.parse(await r.text());
      const list = (Array.isArray(j) && Array.isArray(j[1]) ? j[1] : [])
        .map((s) => String(s || '').trim())
        .filter((s) => s && s.toLowerCase() !== key)
        .slice(0, 8);
      if (list.length) {
        if (SUGGEST_CACHE.size > 300) SUGGEST_CACHE.clear();
        SUGGEST_CACHE.set(key, { exp: Date.now() + SUGGEST_TTL_MS, list });
        return list;
      }
    } catch { /* next source */ }
  }
  return [];
}

// ── Relevance guard ──────────────────────────────────────────────────────────
// Bing (and to a lesser degree the others) will happily answer a query it has decided not to
// serve with a correctly-titled page full of *completely unrelated* results — French forum
// threads for a Hebrew query, teddy bears for "ירושלים". It never signals this with an error
// code, so the only defence is to check that the results mention the query at all. A set that
// fails is discarded and the next engine gets a turn; if they all fail we show an honest
// "no results" instead of nonsense.
function queryTokens(q) {
  return String(q || '')
    .toLowerCase()
    .split(/[^\p{L}\p{N}]+/u)
    .filter((t) => t.length >= 2)
    .slice(0, 8);
}

function resultText(r) {
  const parts = [r.title, r.snippet, r.url, r.page, r.channel, r.source, r.full, r.thumb];
  let t = parts.filter(Boolean).map(String).join(' ').toLowerCase();
  // Hebrew in a URL arrives percent-encoded; decode so it can match a query token.
  if (t.indexOf('%') !== -1) {
    try { t += ' ' + decodeURIComponent(t); } catch { /* malformed escape — ignore */ }
  }
  return t;
}

function resultsLookRelevant(q, results) {
  const toks = queryTokens(q);
  if (!toks.length || !results || !results.length) return true;
  let hits = 0;
  for (const r of results) {
    const t = resultText(r);
    if (toks.some((tok) => t.indexOf(tok) !== -1)) hits++;
  }
  // One in seven mentioning the query is a very low bar — real result sets clear it easily,
  // and a hijacked set scores zero.
  return hits >= Math.max(1, Math.ceil(results.length * 0.15));
}

// ── Verticals ────────────────────────────────────────────────────────────────

// Bing gives the best first page but silently ignores &first=, replaying page 1 forever.
// Yahoo's &b= offset genuinely advances, so deep pages are served from Yahoo instead.
async function searchWeb(q, page, env) {
  const query = String(q || '').trim();
  if (!query) return { results: [], source: 'empty' };
  const first = Math.max(0, (page - 1) * 10) + 1;
  const enc = encodeURIComponent(query);
  const bing = 'https://www.bing.com/search?q=' + enc + '&mkt=he-IL&setlang=he';
  const yahoo = 'https://search.yahoo.com/search?p=' + enc + (first > 1 ? '&b=' + first : '');
  const ddg = 'https://html.duckduckgo.com/html/?q=' + enc + '&kl=wt-wt' + (first > 1 ? '&s=' + (first - 1) : '');
  const lite = 'https://lite.duckduckgo.com/lite/?q=' + enc + (first > 1 ? '&s=' + (first - 1) : '');
  const A = {
    bing: { name: 'Bing', get: () => searchGet(bing, env, { referer: 'https://www.bing.com/' }), parse: parseBingResults },
    yahoo: { name: 'Yahoo', get: () => searchGet(yahoo, env, { referer: 'https://search.yahoo.com/' }), parse: parseYahooResults },
    // Yahoo intermittently answers with a JS-only shell; a second try usually lands the real
    // page, and it is the only engine whose deep-page offset we can trust.
    yahoo2: { name: 'Yahoo', get: () => searchGet(yahoo + '&pz=10&fr=yfp-t', env, { referer: 'https://search.yahoo.com/' }), parse: parseYahooResults },
    ddg: { name: 'DuckDuckGo', get: () => searchGet(ddg, env, { referer: 'https://duckduckgo.com/' }), parse: parseDuckDuckGoResults },
    lite: { name: 'DuckDuckGo', get: () => searchGet(lite, env, { referer: 'https://lite.duckduckgo.com/' }), parse: parseDuckDuckGoResults },
  };
  if (page === 1) {
    const [bHtml, yHtml] = await Promise.all([
      A.bing.get().catch(() => null),
      A.yahoo.get().catch(() => null),
    ]);
    if (bHtml) {
      const bRes = A.bing.parse(bHtml);
      if (bRes.length && resultsLookRelevant(query, bRes)) return { results: bRes, source: A.bing.name };
    }
    if (yHtml) {
      const yRes = A.yahoo.parse(yHtml);
      if (yRes.length && resultsLookRelevant(query, yRes)) return { results: yRes, source: A.yahoo.name };
    }
  }
  const attempts = page === 1 ? [A.ddg, A.lite] : [A.yahoo, A.ddg, A.yahoo2, A.lite];
  for (const at of attempts) {
    const html = await at.get();
    if (!html) continue;
    const results = at.parse(html);
    if (results.length && resultsLookRelevant(query, results)) return { results, source: at.name };
  }
  return { results: [], source: 'none' };
}

// True when the query uses a script Bing's image index mishandles from here: it echoes the
// query in the page title but fills the grid with unrelated tiles. Latin (incl. accents) is
// fine, Hebrew / Arabic / Cyrillic / CJK is not — those go to DuckDuckGo instead.
function needsNonLatinImageEngine(q) {
  return /[֐-׿؀-ۿЀ-ӿ぀-ヿ一-鿿฀-๿]/.test(String(q || ''));
}

async function searchImagesBing(q, page, env) {
  const count = 35;
  const first = Math.max(0, (page - 1) * count) + 1;
  const enc = encodeURIComponent(q);
  // The async endpoint returns just the tile markup — a third of the payload — and it
  // paginates reliably via &first=, which the full images page does not.
  const asyncUrl =
    'https://www.bing.com/images/async?q=' + enc + '&first=' + first + '&count=' + count +
    '&mmasync=1&layout=RowBased_Landscape&adlt=moderate&mkt=he-IL';
  const pageUrl = 'https://www.bing.com/images/search?q=' + enc + '&first=' + first + '&adlt=moderate&mkt=he-IL';
  for (const u of [asyncUrl, pageUrl]) {
    const html = await searchGet(u, env, { referer: 'https://www.bing.com/images/search?q=' + enc });
    const results = parseBingImages(html);
    if (results.length) return results;
  }
  return [];
}

// DuckDuckGo's image JSON needs a `vqd` token minted by the SERP shell, replayed with the
// cookies from that same response — hence the deliberate two-step handshake. DDG throttles
// aggressively, so a throttled attempt retries once through the residential relay before we
// give up and let the caller fall through to the next engine.
async function ddgImagesOnce(q, page, useRelay, env) {
  const enc = encodeURIComponent(q);
  const base = { 'user-agent': SEARCH_UA, 'accept-language': 'he-IL,he;q=0.9,en-US;q=0.8,en;q=0.7' };
  const shellUrl = 'https://duckduckgo.com/?q=' + enc + '&iar=images&iax=images&ia=images';
  const ac = new AbortController();
  const timer = setTimeout(() => ac.abort(), useRelay ? 14000 : 10000);
  try {
    let html = '';
    let jar = '';
    if (useRelay) {
      if (!relayConfigured(env)) { clearTimeout(timer); return []; }
      const s = await relayFetch(env, shellUrl, { userAgent: SEARCH_UA, signal: ac.signal });
      if (!s || !s.ok) { clearTimeout(timer); return []; }
      html = await s.text();
    } else {
      const s = await fetch(shellUrl, {
        headers: { ...base, accept: 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' },
        redirect: 'follow',
        signal: ac.signal,
      });
      if (!s.ok) { clearTimeout(timer); return []; }
      html = await s.text();
      jar = (s.headers.getSetCookie ? s.headers.getSetCookie() : [s.headers.get('set-cookie')])
        .filter(Boolean).map((x) => String(x).split(';')[0]).join('; ');
    }
    const vqd = (html.match(/vqd=["']?(\d+-\d+(?:-\d+)?)/) || html.match(/vqd["']?\s*[:=]\s*["'](\d[\d-]+)["']/) || [])[1];
    if (!vqd) { clearTimeout(timer); return []; }
    const offset = Math.max(0, (page - 1) * 100);
    const api =
      'https://duckduckgo.com/i.js?l=wt-wt&o=json&q=' + enc + '&vqd=' + encodeURIComponent(vqd) +
      '&f=,,,,,&p=1&s=' + offset;
    let text = '';
    if (useRelay) {
      const r = await relayFetch(env, api, { userAgent: SEARCH_UA, signal: ac.signal });
      if (!r || !r.ok) { clearTimeout(timer); return []; }
      text = await r.text();
    } else {
      const r = await fetch(api, {
        headers: {
          ...base,
          accept: 'application/json, text/javascript, */*; q=0.01',
          referer: shellUrl,
          'x-requested-with': 'XMLHttpRequest',
          'sec-fetch-dest': 'empty',
          'sec-fetch-mode': 'cors',
          'sec-fetch-site': 'same-origin',
          ...(jar ? { cookie: jar } : {}),
        },
        signal: ac.signal,
      });
      if (!r.ok) { clearTimeout(timer); return []; }
      text = await r.text();
    }
    clearTimeout(timer);
    let j;
    try { j = JSON.parse(text); } catch { return []; }
    return (j.results || []).slice(0, 90).map((x) => ({
      thumb: String(x.thumbnail || ''),
      full: String(x.image || x.thumbnail || ''),
      page: String(x.url || ''),
      title: stripTags(x.title || ''),
      w: parseInt(x.width, 10) || 0,
      h: parseInt(x.height, 10) || 0,
    })).filter((x) => /^https?:\/\//i.test(x.thumb));
  } catch {
    clearTimeout(timer);
    return [];
  }
}

async function searchImagesDdg(q, page, env) {
  const direct = await ddgImagesOnce(q, page, false, env);
  if (direct.length) return direct;
  return ddgImagesOnce(q, page, true, env);
}

// Wikimedia Commons: a plain, unauthenticated API that answers every IP and indexes titles
// in every language. Fewer and more encyclopedic hits than a web crawler, but it is the one
// image source that never rate-limits us — so it backstops the non-Latin path.
async function searchImagesCommons(q, page, env) {
  const per = 40;
  const api =
    'https://commons.wikimedia.org/w/api.php?action=query&format=json&formatversion=2' +
    '&generator=search&gsrnamespace=6&gsrlimit=' + per + '&gsroffset=' + ((page - 1) * per) +
    '&gsrsearch=' + encodeURIComponent(q) +
    '&prop=imageinfo&iiprop=url|size&iiurlwidth=420';
  const ac = new AbortController();
  const timer = setTimeout(() => ac.abort(), 9000);
  try {
    const r = await fetch(api, {
      headers: { 'user-agent': SEARCH_UA, accept: 'application/json' },
      signal: ac.signal,
      cf: { cacheTtl: 1800, cacheEverything: true },
    });
    clearTimeout(timer);
    if (!r.ok) return [];
    const j = await r.json();
    const pages = (j && j.query && j.query.pages) || [];
    return pages.map((p) => {
      const ii = (p.imageinfo && p.imageinfo[0]) || {};
      const thumb = ii.thumburl || ii.url || '';
      if (!/^https?:\/\//i.test(thumb)) return null;
      // Skip non-raster media that would render as a broken tile.
      if (/\.(?:ogv|webm|ogg|mid|pdf|djvu|stl|tif|tiff)$/i.test(String(ii.url || ''))) return null;
      return {
        thumb,
        full: ii.url || thumb,
        page: ii.descriptionurl || '',
        title: String(p.title || '').replace(/^File:/, '').replace(/\.[a-z0-9]+$/i, ''),
        w: ii.thumbwidth || ii.width || 0,
        h: ii.thumbheight || ii.height || 0,
      };
    }).filter(Boolean);
  } catch {
    clearTimeout(timer);
    return [];
  }
}

async function searchImages(q, page, env) {
  const query = String(q || '').trim();
  if (!query) return { results: [], source: 'empty' };
  // Bing is demoted (not removed) for non-Latin queries: it answers those with a correctly
  // titled page full of unrelated tiles. The relevance guard catches that, so Bing can still
  // serve as a last resort when it does behave.
  //
  // `guard: false` marks the structured APIs. Those are query-scoped server-side and cannot
  // be hijacked, and their captions are often in a different language than the query
  // (Commons labels everything in English), so guarding them only causes false rejections.
  const commons = { label: 'Wikimedia', fn: searchImagesCommons, guard: false };
  const bing = { label: 'Bing תמונות', fn: searchImagesBing, guard: false };
  const ddg = { label: 'DuckDuckGo תמונות', fn: searchImagesDdg, guard: false };
  const order = [commons, bing, ddg];
  for (const eng of order) {
    try {
      const results = await eng.fn(query, page, env);
      if (results && results.length) {
        return { results, source: eng.label };
      }
    } catch (_) {}
  }
  return { results: [], source: 'none' };
}

async function searchVideos(q, page, env, origin) {
  const query = String(q || '').trim();
  if (!query) return { results: [], source: 'empty' };
  const out = [];
  const seen = new Set();
  // YouTube first: those play inside our own sealed player, no foreign UI at all.
  if (page === 1) {
    try {
      const yt = await youtubeSearchQuery(query, origin);
      for (const r of yt.results || []) {
        if (seen.has(r.id)) continue;
        seen.add(r.id);
        out.push({
          videoId: r.id,
          page: 'https://www.youtube.com/watch?v=' + r.id,
          // Deliberately NOT r.thumb (/x/t): that helper always XOR-seals, so it only
          // renders once the Service Worker is controlling the page. /x/p seals on demand,
          // so these thumbnails also work on a first, uncontrolled load.
          thumb: '/x/t?v=' + r.id,
          title: r.title,
          duration: r.duration,
          channel: r.channel,
          views: r.views,
          published: r.published,
        });
      }
    } catch { /* fall through to Bing */ }
  }
  if (out.length < 12) {
    const first = Math.max(0, (page - 1) * 28) + 1;
    const bv =
      'https://www.bing.com/videos/search?q=' + encodeURIComponent(query) +
      (first > 1 ? '&first=' + first : '') + '&mkt=he-IL';
    const html = await searchGet(bv, env, { referer: 'https://www.bing.com/' });
    const bingVids = parseBingVideos(html);
    if (bingVids.length && resultsLookRelevant(query, bingVids)) {
      for (const v of bingVids) {
        const key = v.videoId || v.page;
        if (seen.has(key)) continue;
        seen.add(key);
        out.push(v);
      }
    }
  }
  return { results: out, source: out.length ? 'YouTube + Bing' : 'none' };
}

async function searchNews(q, page, env) {
  const query = String(q || '').trim();
  if (!query) return { results: [], source: 'empty' };
  const enc = encodeURIComponent(query);
  const rss = 'https://www.bing.com/news/search?q=' + enc + '&format=rss&mkt=he-IL&setlang=he';
  const xml = await searchGet(rss, env, { accept: 'application/rss+xml,application/xml;q=0.9,*/*;q=0.8', referer: 'https://www.bing.com/news' });
  // No relevance guard here: the RSS feed is query-scoped server-side, and headlines about a
  // Hebrew subject are frequently in English (and vice versa).
  const results = parseNewsRss(xml);
  if (results.length) {
    const per = 20;
    const slice = results.slice((page - 1) * per, page * per);
    return { results: slice, source: 'Bing חדשות', total: results.length };
  }
  return { results: [], source: 'none' };
}

// One entry point for every vertical.
// Short in-isolate cache. Users flip between tabs and pages constantly; without this every
// flip is a fresh upstream hit, which is both slow and the fastest way to get throttled by
// DuckDuckGo. Small and time-boxed — search results should still feel live.
const SEARCH_CACHE = new Map(); // key -> { exp, pack }
const SEARCH_CACHE_TTL_MS = 5 * 60 * 1000;
const SEARCH_CACHE_MAX = 120;

function searchCacheGet(key) {
  const hit = SEARCH_CACHE.get(key);
  if (!hit) return null;
  if (hit.exp < Date.now()) { SEARCH_CACHE.delete(key); return null; }
  SEARCH_CACHE.delete(key);
  SEARCH_CACHE.set(key, hit);
  return hit.pack;
}
function searchCacheSet(key, pack) {
  if (SEARCH_CACHE.size >= SEARCH_CACHE_MAX) {
    const oldest = SEARCH_CACHE.keys().next().value;
    if (oldest !== undefined) SEARCH_CACHE.delete(oldest);
  }
  SEARCH_CACHE.set(key, { exp: Date.now() + SEARCH_CACHE_TTL_MS, pack });
}

async function universalSearch(q, tab, page, env, origin) {
  const t = SEARCH_TABS.some((x) => x.id === tab) ? tab : 'web';
  const p = Math.max(1, Math.min(20, parseInt(page, 10) || 1));
  const key = t + ' ' + p + ' ' + String(q || '').trim().toLowerCase();
  const cached = searchCacheGet(key);
  if (cached) return cached;

  let pack;
  if (t === 'images') pack = { tab: t, page: p, ...(await searchImages(q, p, env)) };
  else if (t === 'videos') pack = { tab: t, page: p, ...(await searchVideos(q, p, env, origin)) };
  else if (t === 'news') pack = { tab: t, page: p, ...(await searchNews(q, p, env)) };
  else {
    // Web tab also fetches the instant answer, in parallel — it must never delay results.
    const [webPack, answer] = await Promise.all([
      searchWeb(q, p, env),
      p === 1 ? instantAnswer(q).catch(() => null) : Promise.resolve(null),
    ]);
    pack = { tab: t, page: p, answer, ...webPack };
  }
  // Never cache an empty/failed page — the next try should get a real chance.
  if (pack.results && pack.results.length) searchCacheSet(key, pack);
  return pack;
}

// ─── Search results page ─────────────────────────────────────────────────────

// Relative on purpose: the page is always served from the same origin as /x/p, and a
// relative URL keeps working behind a custom domain or a renamed workers.dev subdomain.
function imgProxy(origin, url) {
  if (!url) return '';
  if (!/^https?:\/\//i.test(url)) return url;
  return '/x/p?d=' + encodeUrl(url);
}
function hostOf(u) {
  try { return new URL(u).hostname.replace(/^www\./, ''); } catch { return ''; }
}
function hueOf(s) {
  let h = 0;
  const str = String(s || '');
  for (let i = 0; i < str.length; i++) h = (h * 31 + str.charCodeAt(i)) % 360;
  return h;
}
function initialOf(s) {
  const c = String(s || '').replace(/[^\p{L}\p{N}]/gu, '').charAt(0);
  return c ? c.toUpperCase() : '•';
}
// Every outbound link goes through the proxy gate, never straight to the open internet.
function outLink(url) {
  return '/gate?to=' + encodeUrl(String(url || ''));
}
function relTime(dateStr) {
  const t = Date.parse(dateStr || '');
  if (!Number.isFinite(t)) return '';
  const diff = Date.now() - t;
  const mins = Math.round(diff / 60000);
  if (mins < 1) return 'עכשיו';
  if (mins < 60) return 'לפני ' + mins + ' דק׳';
  const hrs = Math.round(mins / 60);
  if (hrs < 24) return 'לפני ' + hrs + ' שע׳';
  const days = Math.round(hrs / 24);
  if (days < 30) return 'לפני ' + days + ' ימים';
  return new Date(t).toLocaleDateString('he-IL');
}

function renderWebResults(pack, origin) {
  const rows = (pack.results || []).map((r) => {
    const host = hostOf(r.url);
    return `<a class="rcard" href="${htmlEscape(outLink(r.url))}">
      <span class="fav" style="--h:${hueOf(host || r.title)}">${htmlEscape(initialOf(host || r.title))}</span>
      <span class="rbody">
        <span class="rhost">${htmlEscape(host)}</span>
        <span class="rtitle">${htmlEscape(r.title)}</span>
        ${r.snippet ? `<span class="rsnip">${htmlEscape(r.snippet)}</span>` : ''}
      </span>
    </a>`;
  }).join('');
  const a = pack.answer;
  const answer = a ? `<section class="answer glass">
      ${a.image ? `<img class="ans-img" src="${htmlEscape(imgProxy(origin, a.image))}" alt="" loading="lazy" decoding="async"/>` : ''}
      <div class="ans-body">
        <div class="ans-kicker">${htmlEscape(a.source)}</div>
        <h2 class="ans-title">${htmlEscape(a.title)}</h2>
        <p class="ans-text">${htmlEscape(a.text)}</p>
        ${a.url ? `<a class="ans-more" href="${htmlEscape(outLink(a.url))}">קרא עוד ←</a>` : ''}
      </div>
    </section>` : '';
  return answer + `<div class="rlist">${rows}</div>`;
}

function renderImageResults(pack, origin) {
  const cells = (pack.results || []).map((r, i) => {
    const ratio = r.w && r.h ? (r.h / r.w) : 0.72;
    return `<button class="icell" type="button" data-full="${htmlEscape(imgProxy(origin, r.full))}"
        data-page="${htmlEscape(r.page ? outLink(r.page) : '')}" data-title="${htmlEscape(r.title)}"
        style="--ar:${ratio.toFixed(3)}">
      <img src="${htmlEscape(imgProxy(origin, r.thumb))}" alt="${htmlEscape(r.title)}" loading="${i < 8 ? 'eager' : 'lazy'}" decoding="async"/>
      <span class="icap">${htmlEscape(hostOf(r.page) || r.title)}</span>
    </button>`;
  }).join('');
  return `<div class="igrid">${cells}</div>`;
}

function renderVideoResults(pack, origin) {
  const cards = (pack.results || []).map((r, i) => {
    // A YouTube hit opens in our own sealed player; anything else goes through the gate.
    const href = r.videoId ? '/ytp?v=' + encodeURIComponent(r.videoId) : outLink(r.page);
    const thumb = imgProxy(origin, r.thumb);
    const meta = [r.channel, r.views, r.published].filter(Boolean).join(' · ');
    return `<a class="vcard" href="${htmlEscape(href)}">
      <span class="vthumb">
        ${thumb ? `<img src="${htmlEscape(thumb)}" alt="" loading="${i < 6 ? 'eager' : 'lazy'}" decoding="async"/>` : ''}
        <span class="vplay" aria-hidden="true">▶</span>
        ${r.duration ? `<span class="vdur">${htmlEscape(r.duration)}</span>` : ''}
        ${r.videoId ? '<span class="vsrc">YouTube</span>' : ''}
      </span>
      <span class="vmeta">
        <span class="vtitle">${htmlEscape(r.title)}</span>
        ${meta ? `<span class="vsub">${htmlEscape(meta)}</span>` : ''}
      </span>
    </a>`;
  }).join('');
  return `<div class="vgrid">${cards}</div>`;
}

function renderNewsResults(pack, origin) {
  const cards = (pack.results || []).map((r, i) => {
    const host = r.source || hostOf(r.url);
    const when = relTime(r.date);
    return `<a class="ncard" href="${htmlEscape(outLink(r.url))}">
      ${r.image ? `<span class="nthumb"><img src="${htmlEscape(imgProxy(origin, r.image))}" alt="" loading="${i < 6 ? 'eager' : 'lazy'}" decoding="async"/></span>`
        : `<span class="nthumb nofoto" style="--h:${hueOf(host)}">${htmlEscape(initialOf(host))}</span>`}
      <span class="nbody">
        <span class="nmeta">${htmlEscape(host)}${when ? ' · ' + htmlEscape(when) : ''}</span>
        <span class="ntitle">${htmlEscape(r.title)}</span>
        ${r.snippet ? `<span class="nsnip">${htmlEscape(r.snippet)}</span>` : ''}
      </span>
    </a>`;
  }).join('');
  return `<div class="nlist">${cards}</div>`;
}

function searchResultsPage(q, pack, origin) {
  const query = String(q || '');
  const tab = pack.tab || 'web';
  const page = pack.page || 1;
  const results = pack.results || [];
  const count = results.length;
  const tabs = SEARCH_TABS.map((t) => {
    const href = '/websearch?q=' + encodeURIComponent(query) + '&t=' + t.id;
    return `<a class="tab${t.id === tab ? ' on' : ''}" href="${htmlEscape(href)}"><span class="ti">${t.icon}</span>${t.label}</a>`;
  }).join('');

  let body = '';
  if (count) {
    if (tab === 'images') body = renderImageResults(pack, origin);
    else if (tab === 'videos') body = renderVideoResults(pack, origin);
    else if (tab === 'news') body = renderNewsResults(pack, origin);
    else body = renderWebResults(pack, origin);
  } else if (query) {
    // No dead-ends into a CAPTCHA: every suggestion stays inside the proxy.
    const others = SEARCH_TABS.filter((t) => t.id !== tab)
      .map((t) => `<a class="btn ghost" href="/websearch?q=${encodeURIComponent(query)}&t=${t.id}">${t.icon} ${t.label}</a>`)
      .join('');
    body = `<div class="empty glass">
      <div class="eicon">🛰️</div>
      <h2>לא חזרו תוצאות</h2>
      <p>${page > 1 ? 'נגמרו התוצאות בעמוד הזה — נסו לחזור אחורה.' : 'מנוע החיפוש לא החזיר כלום עבור החיפוש הזה. נסו ניסוח אחר או לשונית אחרת.'}</p>
      <div class="erow">
        ${page > 1 ? `<a class="btn" href="/websearch?q=${encodeURIComponent(query)}&t=${tab}&p=${page - 1}">← לעמוד הקודם</a>` : ''}
        ${others}
      </div>
    </div>`;
  } else {
    body = `<div class="empty glass">
      <div class="eicon">🔎</div>
      <h2>מה לחפש?</h2>
      <p>הקלידו למעלה — תוצאות אמיתיות, בלי אימות "אני לא רובוט", בלי לצאת מהמעקף.</p>
    </div>`;
  }

  const showPager = count > 0 && tab !== 'news';
  const pager = showPager ? `<nav class="pager">
      ${page > 1 ? `<a class="btn ghost" href="/websearch?q=${encodeURIComponent(query)}&t=${tab}&p=${page - 1}">← הקודם</a>` : '<span></span>'}
      <span class="pnum">עמוד ${page}</span>
      <a class="btn ghost" href="/websearch?q=${encodeURIComponent(query)}&t=${tab}&p=${page + 1}">הבא →</a>
    </nav>` : '';

  return `<!DOCTYPE html>
<html lang="he" dir="rtl"><head>
<meta charset="utf-8"/>
<meta name="viewport" content="width=device-width,initial-scale=1"/>
<meta name="robots" content="noindex,nofollow"/>
<meta name="referrer" content="no-referrer"/>
<meta name="color-scheme" content="dark light"/>
<title>${htmlEscape(query || 'חיפוש')} · מעקף</title>
<script>(function(){var s=localStorage.getItem('theme');var l=window.matchMedia('(prefers-color-scheme: light)').matches;if(s==='light'||(!s&&l))document.documentElement.classList.add('light');})();</script>
<style>
${UI_CSS}
.top{position:sticky; top:0; z-index:40; background:color-mix(in srgb, var(--bg) 82%, transparent);
  backdrop-filter:blur(18px) saturate(160%); -webkit-backdrop-filter:blur(18px) saturate(160%);
  border-bottom:1px solid var(--stroke)}
.topin{max-width:960px; margin:0 auto; padding:.7rem 1rem .1rem}
.row1{display:flex; align-items:center; gap:.7rem}
.hbar{flex:1; min-width:0; max-width:600px}
.tabs{display:flex; gap:.25rem; overflow-x:auto; scrollbar-width:none; margin-top:.55rem; padding-bottom:.1rem}
.tabs::-webkit-scrollbar{display:none}
.tab{position:relative; display:inline-flex; align-items:center; gap:.35rem; text-decoration:none;
  color:var(--ink-2); font-weight:600; font-size:.93rem; padding:.55rem .9rem; border-radius:10px 10px 0 0;
  white-space:nowrap; transition:color .2s, background .2s}
.tab .ti{font-size:.95rem}
.tab:hover{color:var(--ink); background:var(--panel)}
.tab.on{color:var(--ink)}
.tab.on::after{content:''; position:absolute; inset-inline:.5rem; bottom:0; height:3px; border-radius:3px 3px 0 0;
  background:linear-gradient(90deg,var(--brand),var(--brand-2))}
.wrap{max-width:960px; margin:0 auto; padding:1.1rem 1rem 4rem}
.meta{display:flex; align-items:center; gap:.5rem; flex-wrap:wrap; color:var(--ink-3); font-size:.83rem; margin:0 .15rem 1.1rem}
.chip{border-radius:999px; padding:.15rem .6rem; font-size:.75rem; font-weight:700;
  background:color-mix(in srgb, var(--brand) 18%, transparent); color:var(--link);
  border:1px solid color-mix(in srgb, var(--brand) 32%, transparent)}

/* Instant answer */
.answer{display:flex; gap:1.1rem; align-items:flex-start; border-radius:var(--r-lg); padding:1.1rem 1.2rem;
  margin-bottom:1.4rem; box-shadow:var(--shadow)}
.ans-img{width:104px; height:104px; object-fit:cover; border-radius:var(--r); flex:none; background:var(--panel-2)}
.ans-kicker{font-size:.74rem; font-weight:800; letter-spacing:1.2px; text-transform:uppercase; color:var(--mint)}
.ans-title{margin:.15rem 0 .4rem; font-size:1.28rem; font-weight:800; line-height:1.25}
.ans-text{margin:0; color:var(--ink-2); font-size:.96rem}
.ans-more{display:inline-block; margin-top:.6rem; color:var(--link); font-weight:700; text-decoration:none; font-size:.92rem}
.ans-more:hover{text-decoration:underline}
@media(max-width:560px){.answer{flex-direction:column}.ans-img{width:100%;height:150px}}

/* Web results */
.rlist{display:flex; flex-direction:column; gap:.55rem}
.rcard{display:flex; gap:.85rem; align-items:flex-start; text-decoration:none; color:inherit;
  padding:.9rem 1rem; border-radius:var(--r-lg); border:1px solid transparent;
  transition:background .2s var(--ease), border-color .2s var(--ease), transform .2s var(--ease)}
.rcard:hover{background:var(--panel); border-color:var(--stroke); transform:translateY(-2px)}
.fav{flex:none; width:38px; height:38px; border-radius:12px; display:grid; place-items:center;
  font-weight:800; color:#fff; background:hsl(var(--h) 62% 46%); box-shadow:inset 0 0 0 1px rgba(255,255,255,.14)}
.rbody{display:flex; flex-direction:column; min-width:0}
.rhost{color:var(--host); font-size:.79rem; font-weight:700; letter-spacing:.2px}
.rtitle{color:var(--link); font-size:1.11rem; font-weight:700; margin:.05rem 0 .25rem; line-height:1.35}
.rcard:hover .rtitle{text-decoration:underline}
.rsnip{color:var(--ink-2); font-size:.93rem; display:-webkit-box; -webkit-line-clamp:2; -webkit-box-orient:vertical; overflow:hidden}

/* Images — CSS masonry, no layout shift (aspect ratio comes from Bing) */
.igrid{columns:4 190px; column-gap:.7rem}
.icell{display:block; width:100%; break-inside:avoid; margin:0 0 .7rem; padding:0; cursor:zoom-in;
  border:1px solid var(--stroke); border-radius:var(--r); overflow:hidden; position:relative;
  background:var(--panel); transition:transform .2s var(--ease), border-color .2s, box-shadow .2s}
.icell:hover{transform:translateY(-3px) scale(1.012); border-color:var(--stroke-2); box-shadow:var(--shadow); z-index:2}
.icell img{display:block; width:100%; height:auto; aspect-ratio:1/var(--ar,.72); object-fit:cover; background:var(--bg-soft)}
.icap{position:absolute; inset-inline:0; bottom:0; padding:.4rem .55rem; font-size:.72rem; color:#fff; text-align:start;
  background:linear-gradient(0deg,rgba(0,0,0,.78),transparent); opacity:0; transition:opacity .2s;
  white-space:nowrap; overflow:hidden; text-overflow:ellipsis}
.icell:hover .icap{opacity:1}
@media(max-width:520px){.igrid{columns:2 130px}}

/* Videos */
.vgrid{display:grid; grid-template-columns:repeat(auto-fill,minmax(240px,1fr)); gap:1.1rem}
.vcard{text-decoration:none; color:inherit; display:flex; flex-direction:column; gap:.6rem;
  border-radius:var(--r-lg); transition:transform .2s var(--ease)}
.vcard:hover{transform:translateY(-4px)}
.vthumb{position:relative; display:block; aspect-ratio:16/9; border-radius:var(--r); overflow:hidden;
  background:var(--bg-soft); border:1px solid var(--stroke)}
.vthumb img{width:100%; height:100%; object-fit:cover; display:block; transition:transform .35s var(--ease)}
.vcard:hover .vthumb img{transform:scale(1.06)}
.vplay{position:absolute; inset:0; display:grid; place-items:center; font-size:1.6rem; color:#fff;
  background:radial-gradient(circle at center, rgba(0,0,0,.45) 0%, rgba(0,0,0,.12) 55%, transparent 75%);
  opacity:0; transition:opacity .2s}
.vcard:hover .vplay{opacity:1}
.vdur{position:absolute; inset-inline-end:.45rem; bottom:.45rem; background:rgba(0,0,0,.82); color:#fff;
  font-size:.74rem; font-weight:700; padding:.1rem .4rem; border-radius:6px}
.vsrc{position:absolute; inset-inline-start:.45rem; top:.45rem; background:rgba(255,0,0,.9); color:#fff;
  font-size:.68rem; font-weight:800; padding:.1rem .4rem; border-radius:6px; letter-spacing:.3px}
.vmeta{display:flex; flex-direction:column; gap:.15rem; min-width:0}
.vtitle{font-weight:700; font-size:.98rem; line-height:1.35; display:-webkit-box; -webkit-line-clamp:2; -webkit-box-orient:vertical; overflow:hidden}
.vsub{color:var(--ink-3); font-size:.82rem; white-space:nowrap; overflow:hidden; text-overflow:ellipsis}

/* News */
.nlist{display:grid; grid-template-columns:repeat(auto-fill,minmax(330px,1fr)); gap:.9rem}
.ncard{display:flex; gap:.9rem; text-decoration:none; color:inherit; padding:.75rem; border-radius:var(--r-lg);
  border:1px solid var(--stroke); background:var(--panel);
  transition:transform .2s var(--ease), border-color .2s, box-shadow .2s}
.ncard:hover{transform:translateY(-3px); border-color:var(--stroke-2); box-shadow:var(--shadow)}
.nthumb{flex:none; width:110px; height:82px; border-radius:var(--r-sm); overflow:hidden; background:var(--bg-soft)}
.nthumb img{width:100%; height:100%; object-fit:cover; display:block}
.nthumb.nofoto{display:grid; place-items:center; font-size:1.6rem; font-weight:800; color:#fff; background:hsl(var(--h) 60% 45%)}
.nbody{display:flex; flex-direction:column; min-width:0}
.nmeta{color:var(--mint); font-size:.76rem; font-weight:700}
.ntitle{font-weight:700; font-size:.98rem; line-height:1.35; margin:.1rem 0 .2rem;
  display:-webkit-box; -webkit-line-clamp:2; -webkit-box-orient:vertical; overflow:hidden}
.nsnip{color:var(--ink-2); font-size:.86rem; display:-webkit-box; -webkit-line-clamp:2; -webkit-box-orient:vertical; overflow:hidden}

/* Empty + pager */
.empty{text-align:center; padding:3.2rem 1.4rem; border-radius:var(--r-xl); box-shadow:var(--shadow)}
.empty .eicon{font-size:2.6rem}
.empty h2{margin:.7rem 0 .35rem; font-size:1.3rem}
.empty p{margin:0 auto; max-width:44ch; color:var(--ink-2)}
.erow{display:flex; gap:.5rem; justify-content:center; flex-wrap:wrap; margin-top:1.3rem}
.erow .btn{text-decoration:none; display:inline-flex; align-items:center}
.pager{display:flex; align-items:center; justify-content:space-between; gap:1rem; margin-top:2.2rem}
.pager .btn{text-decoration:none}
.pnum{color:var(--ink-3); font-size:.85rem}

/* Lightbox */
.lb{position:fixed; inset:0; z-index:90; display:none; place-items:center; padding:1.5rem;
  background:rgba(4,6,14,.92); backdrop-filter:blur(8px)}
.lb.on{display:grid}
.lb img{max-width:100%; max-height:78vh; border-radius:var(--r); box-shadow:0 30px 80px -20px #000}
.lb .lbbar{position:absolute; inset-inline:0; bottom:0; display:flex; gap:.6rem; justify-content:center;
  align-items:center; padding:1.1rem; flex-wrap:wrap}
.lb .lbx{position:absolute; top:1rem; inset-inline-end:1rem; width:44px; height:44px; border-radius:50%;
  background:rgba(255,255,255,.12); color:#fff; border:0; font-size:1.4rem; cursor:pointer; line-height:1}
.lb .lbt{color:#e8ecff; font-size:.9rem; max-width:60ch; text-align:center}

/* On a phone the logo + field + theme button on one row squeezes the input to nothing,
   so the field gets a row of its own. */
@media(max-width:640px){
  .row1{flex-wrap:wrap}
  .wordmark{flex:1}
  .wordmark .txt{font-size:1rem}
  .hbar{order:5; flex-basis:100%; min-width:100%; max-width:none; margin-top:.5rem}
  .topin{padding:.6rem .75rem .1rem}
  .wrap{padding:.9rem .75rem 3rem}
  .answer{padding:.9rem}
  .nlist{grid-template-columns:1fr}
  .vgrid{grid-template-columns:repeat(auto-fill,minmax(160px,1fr)); gap:.8rem}
}
</style></head>
<body>
  <header class="top"><div class="topin">
    <div class="row1">
      <a class="wordmark" href="/"><span class="mark">⚡</span><span class="txt">מעקף</span></a>
      <div class="hbar">${searchBarHtml(query, { wide: true, placeholder: 'חפשו כל דבר…' })}</div>
      <button class="icon-btn" type="button" onclick="toggleTheme()" aria-label="החלף ערכת נושא">
        <svg class="i-sun" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round"><circle cx="12" cy="12" r="4.5"/><path d="M12 2v2M12 20v2M4.9 4.9l1.4 1.4M17.7 17.7l1.4 1.4M2 12h2M20 12h2M4.9 19.1l1.4-1.4M17.7 6.3l1.4-1.4"/></svg>
        <svg class="i-moon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round"><path d="M21 12.8A9 9 0 1 1 11.2 3a7 7 0 0 0 9.8 9.8z"/></svg>
      </button>
    </div>
    <nav class="tabs">${tabs}</nav>
  </div></header>

  <main class="wrap">
    ${query && count ? `<div class="meta"><span>${count} תוצאות עבור “${htmlEscape(query)}”</span>${pack.source && pack.source !== 'none' ? `<span class="chip">${htmlEscape(pack.source)}</span>` : ''}${page > 1 ? `<span class="chip">עמוד ${page}</span>` : ''}</div>` : ''}
    ${body}
    ${pager}
  </main>

  <div class="lb" id="lb" role="dialog" aria-modal="true">
    <button class="lbx" type="button" aria-label="סגור">✕</button>
    <img id="lbimg" alt=""/>
    <div class="lbbar">
      <span class="lbt" id="lbt"></span>
      <a class="btn ghost" id="lbpage" href="#" style="text-decoration:none">פתח את הדף המקורי ↗</a>
    </div>
  </div>

<script>
var CUR_TAB = ${JSON.stringify(tab)};
// A full URL typed into the results bar should browse there, not search for it.
function submitQuery(text){
  var raw = String(text||'').trim();
  if(!raw) return false;
  var isUrl = /^https?:\\/\\//i.test(raw) || (raw.indexOf(' ')===-1 && /^[a-zA-Z0-9-]+(\\.[a-zA-Z]{2,})+/.test(raw));
  if(isUrl){
    var full = /^https?:\\/\\//i.test(raw) ? raw : 'https://' + raw;
    window.location.href = '/gate?to=' + encodeURIComponent(xorEncode(full));
  } else {
    window.location.href = '/websearch?q=' + encodeURIComponent(raw) + '&t=' + CUR_TAB;
  }
  return false;
}
var XKEY=[97,110,116,105,103,114,97,118,105,116,121];
function xorEncode(u){
  var d=new TextEncoder().encode(u);
  for(var i=0;i<d.length;i++) d[i]=d[i]^XKEY[i%XKEY.length];
  var s=''; for(var j=0;j<d.length;j+=8192) s+=String.fromCharCode.apply(null,d.subarray(j,Math.min(j+8192,d.length)));
  return btoa(s).replace(/[+]/g,'-').replace(/[/]/g,'_').replace(/=+$/,'');
}
function toggleTheme(){
  var light = document.documentElement.classList.toggle('light');
  try{ localStorage.setItem('theme', light ? 'light' : 'dark'); }catch(e){}
  paintTheme();
}
function paintTheme(){
  var light = document.documentElement.classList.contains('light');
  var s = document.querySelector('.i-sun'), m = document.querySelector('.i-moon');
  if (s) s.style.display = light ? 'block' : 'none';
  if (m) m.style.display = light ? 'none' : 'block';
}
paintTheme();

// Register the Service Worker so /x/p images come back XOR-sealed (the on-path filter
// cannot pixelate what it cannot recognise as a JPEG).
if ('serviceWorker' in navigator) {
  navigator.serviceWorker.register('/sw.js?v=${SW_VERSION}', { scope: '/' }).catch(function(){});
}

// A broken thumbnail should collapse, not leave a grey hole in the grid.
document.addEventListener('error', function(e){
  var el = e.target;
  if (!el || el.tagName !== 'IMG') return;
  var cell = el.closest('.icell');
  if (cell) { cell.remove(); return; }
  var nt = el.closest('.nthumb');
  if (nt) nt.remove();
}, true);

// Lightbox
(function(){
  var lb = document.getElementById('lb'), img = document.getElementById('lbimg');
  var cap = document.getElementById('lbt'), pageLink = document.getElementById('lbpage');
  function open(cell){
    img.src = cell.getAttribute('data-full') || '';
    cap.textContent = cell.getAttribute('data-title') || '';
    var p = cell.getAttribute('data-page');
    if (p) { pageLink.href = p; pageLink.style.display = ''; } else { pageLink.style.display = 'none'; }
    lb.classList.add('on');
    document.body.style.overflow = 'hidden';
  }
  function close(){ lb.classList.remove('on'); img.src = ''; document.body.style.overflow = ''; }
  document.addEventListener('click', function(e){
    var cell = e.target.closest ? e.target.closest('.icell') : null;
    if (cell) { e.preventDefault(); open(cell); return; }
    if (e.target.closest && e.target.closest('.lbx')) { close(); return; }
    if (e.target === lb) close();
  });
  document.addEventListener('keydown', function(e){ if (e.key === 'Escape') close(); });
})();
${SEARCH_BAR_JS}
</script>
</body></html>`;
}

// ─── Generic image proxy (/x/p) ──────────────────────────────────────────────
// Search thumbnails come from dozens of hosts, so they cannot go through the YouTube-only
// /x/t helper. This fetches any public image, verifies it really IS an image (magic bytes),
// and — when the Service Worker is driving the request (X-Etrog-SW) — XOR-seals it so the
// on-path filter cannot recognise and pixelate it. Without the SW it is served plainly, so
// the page still works on a first, uncontrolled load.
const IMG_1PX = Uint8Array.from(
  atob('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg=='),
  (c) => c.charCodeAt(0)
);

function imageMagicType(buf) {
  if (buf.length < 12) return '';
  if (buf[0] === 0xff && buf[1] === 0xd8) return 'image/jpeg';
  if (buf[0] === 0x89 && buf[1] === 0x50 && buf[2] === 0x4e && buf[3] === 0x47) return 'image/png';
  if (buf[0] === 0x47 && buf[1] === 0x49 && buf[2] === 0x46) return 'image/gif';
  if (buf[0] === 0x52 && buf[1] === 0x49 && buf[2] === 0x46 && buf[3] === 0x46 &&
      buf[8] === 0x57 && buf[9] === 0x45 && buf[10] === 0x42 && buf[11] === 0x50) return 'image/webp';
  if (buf[4] === 0x66 && buf[5] === 0x74 && buf[6] === 0x79 && buf[7] === 0x70) return 'image/avif'; // ftyp box
  if (buf[0] === 0x42 && buf[1] === 0x4d) return 'image/bmp';
  return '';
}

async function serveProxiedImage(request, url) {
  const d = url.searchParams.get('d') || '';
  let target = d ? decodeUrl(d) : url.searchParams.get('u') || '';
  if (target && target.startsWith('//')) target = 'https:' + target;
  const sealed = request.headers.get('X-Etrog-SW') === '1';
  const fail = (status) => {
    const h = { 'Cache-Control': 'public, max-age=60', 'X-Etrog-Img': 'fallback' };
    return sealed
      ? sealedResponse(IMG_1PX, 200, 'image/png', h, 0)
      : new Response(IMG_1PX, { status: 200, headers: { ...h, 'content-type': 'image/png' } });
  };
  if (!target || !/^https?:\/\//i.test(target)) return fail(400);
  // Same SSRF guard the /cdn/ route uses — no loopback / RFC1918 / metadata endpoints.
  if (!isSafePublicUrl(target)) return fail(403);

  let origin = '';
  try { origin = new URL(target).origin; } catch { return fail(400); }

  const ac = new AbortController();
  const timer = setTimeout(() => ac.abort(), 12000);
  let res = null;
  try {
    res = await fetch(target, {
      signal: ac.signal,
      redirect: 'follow',
      headers: {
        'user-agent': SEARCH_UA,
        accept: 'image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8',
        'accept-language': 'he-IL,he;q=0.9,en;q=0.8',
        // Many CDNs hotlink-protect; a same-origin referer is the widely accepted value.
        referer: origin + '/',
      },
      cf: { cacheTtl: 604800, cacheEverything: true },
    });
  } catch {
    clearTimeout(timer);
    return fail(502);
  }
  clearTimeout(timer);
  if (!res || !res.ok) return fail(502);

  const buf = new Uint8Array(await res.arrayBuffer());
  if (buf.length < 64) return fail(502);
  // A filter block-page dressed as image/jpeg must never reach the grid.
  if (looksLikeBlockOrHtml(buf)) return fail(502);
  let ct = imageMagicType(buf);
  if (!ct) {
    const declared = (res.headers.get('content-type') || '').split(';')[0].trim().toLowerCase();
    if (declared === 'image/svg+xml') ct = declared; // SVG has no magic bytes
    else return fail(415);
  }
  const extra = {
    'Cache-Control': 'public, max-age=604800, immutable',
    'X-Etrog-Img': String(buf.length),
  };
  return sealedResponse(buf, 200, ct, extra, 0);
}

async function youtubeVideoMeta(videoId, origin) {
  const empty = {
    id: videoId,
    title: '',
    channel: '',
    channelId: '',
    description: '',
    views: '',
    published: '',
    likes: '',
    thumb: origin + '/x/t?d=' + encodeUrl(JSON.stringify({ v: videoId, q: 'hq720' })),
  };

  const clients = [
    {
      clientName: 'ANDROID',
      clientVersion: '20.50.37',
      clientNameHeader: '3',
      ua: 'com.google.android.youtube/20.50.37 (Linux; U; Android 14) gzip',
      extra: { androidSdkVersion: 34 },
      apiKey: INNERTUBE_KEYS.ANDROID,
    },
    {
      clientName: 'WEB',
      clientVersion: '2.20250620.00.00',
      clientNameHeader: '1',
      ua: 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36',
      extra: {},
      apiKey: INNERTUBE_KEYS.WEB,
    },
  ];

  for (const cl of clients) {
    try {
      const key = cl.apiKey || INNERTUBE_KEYS.WEB;
      const pr = await fetch(
        'https://www.youtube.com/youtubei/v1/player?prettyPrint=false&key=' + encodeURIComponent(key),
        {
        method: 'POST',
        headers: {
          'content-type': 'application/json',
          'user-agent': cl.ua,
          'x-youtube-client-name': cl.clientNameHeader,
          'x-youtube-client-version': cl.clientVersion,
          'x-goog-api-key': key,
          origin: 'https://www.youtube.com',
          referer: 'https://www.youtube.com/watch?v=' + videoId,
        },
        body: JSON.stringify({
          context: {
            client: {
              clientName: cl.clientName,
              clientVersion: cl.clientVersion,
              hl: 'he',
              gl: 'IL',
              ...cl.extra,
            },
          },
          videoId,
          contentCheckOk: true,
          racyCheckOk: true,
        }),
        }
      );
      const text = await pr.text();
      if (!text || text.trimStart()[0] === '<') continue;
      let data;
      try {
        data = JSON.parse(text);
      } catch {
        continue;
      }
      const d = data.videoDetails || {};
      if (!d.title && !d.videoId) continue;
      const micro = (data.microformat && data.microformat.playerMicroformatRenderer) || {};
      return {
        id: videoId,
        title: d.title || '',
        channel: d.author || runsText(micro.ownerChannelName) || '',
        channelId: d.channelId || micro.externalChannelId || '',
        description: d.shortDescription || '',
        views: d.viewCount
          ? Number(d.viewCount).toLocaleString('he-IL') + ' צפיות'
          : runsText(micro.viewCount) || '',
        published: micro.publishDate || micro.uploadDate || '',
        likes: '',
        lengthSeconds: d.lengthSeconds || '',
        thumb: origin + '/x/t?d=' + encodeUrl(JSON.stringify({ v: videoId, q: 'hq720' })),
        keywords: d.keywords || [],
      };
    } catch {
      /* next */
    }
  }

  // next endpoint fallback for description / channel
  try {
    const pr = await fetch(
      'https://www.youtube.com/youtubei/v1/next?prettyPrint=false&key=' +
        encodeURIComponent(INNERTUBE_KEYS.WEB),
      {
      method: 'POST',
      headers: {
        'content-type': 'application/json',
        'user-agent':
          'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36',
        'x-youtube-client-name': '1',
        'x-youtube-client-version': '2.20250620.00.00',
        'x-goog-api-key': INNERTUBE_KEYS.WEB,
        origin: 'https://www.youtube.com',
        referer: 'https://www.youtube.com/watch?v=' + videoId,
      },
      body: JSON.stringify({
        context: {
          client: {
            clientName: 'WEB',
            clientVersion: '2.20250620.00.00',
            hl: 'he',
            gl: 'IL',
          },
        },
        videoId,
      }),
    }
    );
    const text = await pr.text();
    if (text && text.trimStart()[0] !== '<') {
      const data = JSON.parse(text);
      let title = '',
        channel = '',
        channelId = '',
        description = '',
        views = '',
        published = '';
      function walk(node) {
        if (!node || (title && channel && description)) return;
        if (Array.isArray(node)) {
          node.forEach(walk);
          return;
        }
        if (typeof node !== 'object') return;
        if (node.videoPrimaryInfoRenderer) {
          title = title || runsText(node.videoPrimaryInfoRenderer.title);
          views = views || runsText(node.videoPrimaryInfoRenderer.viewCount && node.videoPrimaryInfoRenderer.viewCount.videoViewCountRenderer && node.videoPrimaryInfoRenderer.viewCount.videoViewCountRenderer.viewCount);
          published = published || runsText(node.videoPrimaryInfoRenderer.dateText);
        }
        if (node.videoSecondaryInfoRenderer) {
          const own = node.videoSecondaryInfoRenderer.owner && node.videoSecondaryInfoRenderer.owner.videoOwnerRenderer;
          if (own) {
            channel = channel || runsText(own.title);
            try {
              channelId =
                channelId ||
                (own.navigationEndpoint &&
                  own.navigationEndpoint.browseEndpoint &&
                  own.navigationEndpoint.browseEndpoint.browseId) ||
                '';
            } catch {}
          }
          const atr =
            node.videoSecondaryInfoRenderer.attributedDescription ||
            node.videoSecondaryInfoRenderer.description;
          description = description || runsText(atr) || (atr && atr.content) || '';
        }
        for (const k of Object.keys(node)) walk(node[k]);
      }
      walk(data);
      if (title || channel || description) {
        return {
          ...empty,
          title,
          channel,
          channelId,
          description,
          views,
          published,
        };
      }
    }
  } catch {
    /* ignore */
  }

  return empty;
}

function extractChannelHeader(data, origin) {
  const info = {
    title: '',
    description: '',
    subscribers: '',
    videoCount: '',
    avatar: '',
    banner: '',
    channelId: '',
  };
  function walk(node) {
    if (!node || (info.title && info.subscribers && info.avatar)) return;
    if (Array.isArray(node)) {
      node.forEach(walk);
      return;
    }
    if (typeof node !== 'object') return;
    const h =
      node.c4TabbedHeaderRenderer ||
      node.pageHeaderRenderer ||
      node.channelMetadataRenderer ||
      null;
    if (node.channelMetadataRenderer) {
      const m = node.channelMetadataRenderer;
      info.title = info.title || m.title || '';
      info.description = info.description || m.description || '';
      info.channelId = info.channelId || m.externalId || m.channelId || '';
      try {
        const th = m.avatar && m.avatar.thumbnails;
        if (th && th.length) {
          const u = th[th.length - 1].url;
          info.avatar = origin + PROXY_PATH + encodeUrl(u);
        }
      } catch {}
    }
    if (node.c4TabbedHeaderRenderer) {
      const c = node.c4TabbedHeaderRenderer;
      info.title = info.title || runsText(c.title) || c.title || '';
      info.subscribers = info.subscribers || runsText(c.subscriberCountText) || '';
      info.channelId = info.channelId || c.channelId || '';
      try {
        const th = c.avatar && c.avatar.thumbnails;
        if (th && th.length) info.avatar = origin + PROXY_PATH + encodeUrl(th[th.length - 1].url);
      } catch {}
      try {
        const bn = c.banner && c.banner.thumbnails;
        if (bn && bn.length) info.banner = origin + PROXY_PATH + encodeUrl(bn[bn.length - 1].url);
      } catch {}
    }
    if (node.pageHeaderViewModel || node.pageHeaderRenderer) {
      try {
        const p = node.pageHeaderViewModel || (node.pageHeaderRenderer && node.pageHeaderRenderer.content && node.pageHeaderRenderer.content.pageHeaderViewModel);
        if (p && p.title) info.title = info.title || runsText(p.title) || (p.title.content || '');
      } catch {}
    }
    for (const k of Object.keys(node)) walk(node[k]);
  }
  walk(data);
  return info;
}

async function youtubeChannelPage(channelId, name, origin) {
  const browseId = (channelId || '').startsWith('UC') ? channelId : channelId || '';
  let results = [];
  let meta = {
    title: name || '',
    description: '',
    subscribers: '',
    videoCount: '',
    avatar: '',
    banner: '',
    channelId: browseId || '',
  };

  const attempts = [
    { clientName: 'WEB', clientVersion: '2.20250620.00.00', clientNameHeader: '1', ua: 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36', params: 'EgZ2aWRlb3PyBgQKAjoA', apiKey: INNERTUBE_KEYS.WEB },
    { clientName: 'WEB', clientVersion: '2.20250620.00.00', clientNameHeader: '1', ua: 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36', params: null, apiKey: INNERTUBE_KEYS.WEB },
    { clientName: 'ANDROID', clientVersion: '20.50.37', clientNameHeader: '3', ua: 'com.google.android.youtube/20.50.37 (Linux; U; Android 14) gzip', params: 'EgZ2aWRlb3PyBgQKAjoA', apiKey: INNERTUBE_KEYS.ANDROID },
  ];

  if (browseId) {
    for (const cl of attempts) {
      try {
        const body = {
          context: {
            client: {
              clientName: cl.clientName,
              clientVersion: cl.clientVersion,
              hl: 'he',
              gl: 'IL',
              ...(cl.clientName === 'ANDROID' ? { androidSdkVersion: 34 } : {}),
            },
          },
          browseId,
        };
        if (cl.params) body.params = cl.params;
        const key = cl.apiKey || INNERTUBE_KEYS.WEB;
        const pr = await fetch(
          'https://www.youtube.com/youtubei/v1/browse?prettyPrint=false&key=' + encodeURIComponent(key),
          {
          method: 'POST',
          headers: {
            'content-type': 'application/json',
            'user-agent': cl.ua,
            'x-youtube-client-name': cl.clientNameHeader,
            'x-youtube-client-version': cl.clientVersion,
            'x-goog-api-key': key,
            origin: 'https://www.youtube.com',
            referer: 'https://www.youtube.com/channel/' + browseId + '/videos',
          },
          body: JSON.stringify(body),
        }
        );
        const text = await pr.text();
        if (!text || text.trimStart()[0] === '<') continue;
        const data = JSON.parse(text);
        const hdr = extractChannelHeader(data, origin);
        if (hdr.title) meta = { ...meta, ...hdr, channelId: hdr.channelId || browseId };
        const vids = parseSearchResults(data, origin);
        if (vids.length) {
          results = vids;
          break;
        }
      } catch {
        /* next */
      }
    }
  }

  // Search fallback (always merge for more videos)
  const q = name || browseId;
  if (q) {
    try {
      const pack = await youtubeSearchQuery(q, origin);
      let filtered = (pack.results || []).filter((it) => {
        if (browseId && it.channelId && it.channelId === browseId) return true;
        if (name && it.channel && (it.channel === name || it.channel.includes(name))) return true;
        return false;
      });
      if (!filtered.length) filtered = pack.results || [];
      if (filtered.length > results.length) results = filtered;
      if (!meta.title && name) meta.title = name;
      if (!meta.channelId && filtered[0] && filtered[0].channelId) meta.channelId = filtered[0].channelId;
      if (!meta.title && filtered[0]) meta.title = filtered[0].channel || meta.title;
    } catch {
      /* ignore */
    }
  }

  meta.videoCount = results.length ? results.length + '+ סרטונים' : '';
  // Avatar fallback: first video thumb letter only — keep empty if none
  return { meta, results };
}

function extractFormatsFromPlayerJson(playerJson) {
  if (!playerJson || !playerJson.streamingData) return [];
  const progressive = playerJson.streamingData.formats || [];
  const adaptive = playerJson.streamingData.adaptiveFormats || [];
  const out = [];

  const pushFmt = (f, isProgressive) => {
    if (!f) return;
    let url = f.url || '';
    // signatureCipher needs player JS n/s-sig decrypt — raw "s" as sig → googlevideo 403/500.
    // Only accept plain direct URLs (ANDROID/IOS clients). Skip cipher-only WEB formats.
    if (!url && (f.signatureCipher || f.cipher)) {
      try {
        const sp = new URLSearchParams(f.signatureCipher || f.cipher);
        const u = sp.get('url') || '';
        const s = sp.get('s');
        const sig = sp.get('sig');
        // Already-decrypted cipher (has sig, not encrypted s) is rare but usable
        if (u && sig && !s) {
          url = u + (u.includes('?') ? '&' : '?') + (sp.get('sp') || 'sig') + '=' + encodeURIComponent(sig);
        } else {
          return; // skip undecrypted
        }
      } catch {
        return;
      }
    }
    if (!url || !/^https?:\/\//i.test(url)) return;
    // Reject obviously broken reconstructed URLs
    if (!/googlevideo\.com|gvt1\.com|googleusercontent\.com|youtube\.com/i.test(url)) return;

    const mime = f.mimeType || f.mime || 'video/mp4';
    // Progressive formats from streamingData.formats are always muxed (A+V).
    // Adaptive: only audio/* has audio; video/* alone is silent — do NOT mark hasAudio for all mp4.
    const hasAudio = isProgressive
      ? true
      : /^audio\//i.test(mime) || (!!f.audioQuality && !/^video\//i.test(mime));
    const hasVideo = isProgressive || /^video\//i.test(mime) || !!(f.width || f.height);
    out.push({
      itag: f.itag,
      url,
      mimeType: mime,
      bitrate: f.bitrate || 0,
      width: f.width || 0,
      height: f.height || 0,
      contentLength: f.contentLength || f.content_length || 0,
      hasAudio,
      hasVideo,
      progressive: !!isProgressive,
      quality: f.qualityLabel || f.quality || '',
    });
  };

  for (const f of progressive) pushFmt(f, true);
  for (const f of adaptive) pushFmt(f, false);
  return out;
}

function extractBalancedJson(html, startKey) {
  if (!html) return null;
  const idx = html.indexOf(startKey);
  if (idx === -1) return null;
  const braceStart = html.indexOf('{', idx);
  if (braceStart === -1) return null;
  let depth = 0;
  for (let i = braceStart; i < html.length; i++) {
    const ch = html.charAt(i);
    if (ch === '{') depth++;
    else if (ch === '}') {
      depth--;
      if (depth === 0) {
        const jsonStr = html.substring(braceStart, i + 1);
        try {
          return JSON.parse(jsonStr);
        } catch (e) {
          return null;
        }
      }
    }
  }
  return null;
}

function normalizeCookieTextToHeader(text) {
  if (!text) return '';
  const t = String(text).trim();
  if (!t) return '';
  // Netscape cookie file
  if (t.includes('\t') || /^# Netscape/i.test(t) || t.split('\n').some((l) => l.split('\t').length >= 7)) {
    const parts = [];
    for (const line of t.split('\n')) {
      const lineT = line.trim();
      if (!lineT || lineT.startsWith('#')) continue;
      const p = lineT.split('\t');
      if (p.length >= 7) {
        const name = p[5].trim();
        const val = p[6].trim();
        if (name) parts.push(name + '=' + val);
      }
    }
    return parts.join('; ');
  }
  // One cookie per line name=value
  if (t.includes('\n') && !t.includes(';')) {
    return t
      .split('\n')
      .map((l) => l.trim())
      .filter((l) => l.includes('='))
      .join('; ');
  }
  // Already Cookie header style
  return t.replace(/\r?\n/g, ' ').replace(/\s*;\s*/g, '; ').trim();
}

// Only these cookies matter for Innertube auth; huge headers break some mobile clients
const YT_ESSENTIAL_COOKIE_NAMES = new Set([
  'LOGIN_INFO', 'SAPISID', '__Secure-1PAPISID', '__Secure-3PAPISID',
  'SID', '__Secure-1PSID', '__Secure-3PSID',
  'HSID', 'SSID', 'APISID',
  '__Secure-1PSIDTS', '__Secure-3PSIDTS',
  '__Secure-1PSIDCC', '__Secure-3PSIDCC', 'SIDCC',
  'PREF', 'CONSENT', 'SOCS', 'VISITOR_INFO1_LIVE', 'VISITOR_PRIVACY_METADATA', 'YSC',
]);

function slimYoutubeCookieHeader(header) {
  if (!header) return '';
  const map = new Map();
  for (const piece of String(header).split(';')) {
    const t = piece.trim();
    const eq = t.indexOf('=');
    if (eq === -1) continue;
    const name = t.slice(0, eq).trim();
    const val = t.slice(eq + 1).trim();
    if (!name || !val) continue;
    if (!YT_ESSENTIAL_COOKIE_NAMES.has(name)) continue;
    map.set(name, val);
  }
  if (!map.has('CONSENT')) map.set('CONSENT', 'YES+cb.20210328-17-p0.en+FX+667');
  if (!map.has('SOCS')) map.set('SOCS', 'CAE=');
  return [...map.entries()].map(([k, v]) => k + '=' + v).join('; ');
}

async function getYoutubeCookieHeader(request) {
  const parts = [];
  const pushHdr = (hdr) => {
    if (!hdr) return;
    for (const piece of String(hdr).split(';')) {
      const t = piece.trim();
      if (t && t.includes('=')) parts.push(t);
    }
  };
  // 1) Built-in cookies first (always on — no manual import needed)
  if (typeof BUILTIN_YOUTUBE_COOKIE === 'string' && BUILTIN_YOUTUBE_COOKIE.length > 20) {
    pushHdr(BUILTIN_YOUTUBE_COOKIE);
  }
  // 2) Cache imports (optional override)
  for (const d of ['www.youtube.com', 'youtube.com', '.youtube.com']) {
    try {
      const c = await getCookiesFromCache(d);
      const hdr = normalizeCookieTextToHeader(c);
      if (hdr && hdr.length > 20) pushHdr(hdr);
    } catch {}
  }
  // 3) Request virtualized cookies (optional override)
  try {
    const raw = (request && request.headers.get('cookie')) || '';
    if (raw) {
      const built = buildTargetCookies(raw, new URL('https://www.youtube.com/'), true);
      pushHdr(built.join('; '));
    }
  } catch {}
  // Dedupe by cookie name (later overrides earlier)
  const map = new Map();
  for (const p of parts) {
    const eq = p.indexOf('=');
    if (eq === -1) continue;
    map.set(p.slice(0, eq).trim(), p.slice(eq + 1).trim());
  }
  if (!map.has('CONSENT')) map.set('CONSENT', 'YES+cb.20210328-17-p0.en+FX+667');
  if (!map.has('SOCS')) map.set('SOCS', 'CAE=');
  const full = [...map.entries()].map(([k, v]) => k + '=' + v).join('; ');
  const cleanFull = full.replace(/(?:^|;\s*)LOGIN_INFO=[^;]*/gi, '').replace(/^;\s*/, '').trim();
  return slimYoutubeCookieHeader(cleanFull) || cleanFull;
}

async function computeSapisidHash(cookieStr) {
  try {
    const m = String(cookieStr || '').match(/(?:^|;\s*)(?:__Secure-3PAPISID|SAPISID)=([^;]+)/);
    if (!m) return null;
    const ts = Math.floor(Date.now() / 1000).toString();
    const toHash = ts + ' ' + m[1] + ' https://www.youtube.com';
    const hashBuf = await crypto.subtle.digest('SHA-1', new TextEncoder().encode(toHash));
    const hashHex = Array.from(new Uint8Array(hashBuf))
      .map((b) => b.toString(16).padStart(2, '0'))
      .join('');
    return 'SAPISIDHASH ' + ts + '_' + hashHex;
  } catch {
    return null;
  }
}

// Known public InnerTube keys (yt-dlp / official clients — July 2026)
const INNERTUBE_KEYS = {
  WEB: 'AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8',
  ANDROID: 'AIzaSyA8eiZmM1FaDVjRy-df2KTyQ_vz_yYM39w',
  IOS: 'AIzaSyB-63vPrdThhKuerbB2N_l7Kwwcxj6yUAc',
  TVHTML5_SIMPLY_EMBEDDED_PLAYER: 'AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8',
  MWEB: 'AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8',
  ANDROID_VR: 'AIzaSyA8eiZmM1FaDVjRy-df2KTyQ_vz_yYM39w',
  WEB_EMBEDDED_PLAYER: 'AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8',
};

async function tryInnertubeClient(videoId, cl, cookieHeader) {
  const ac = new AbortController();
  const timer = setTimeout(() => ac.abort(), cl.timeoutMs || 8000);
  const tag = cl.clientName + (cookieHeader ? '+ck' : '') + (cl.noKey ? '/nokey' : '/key');
  try {
    const isAndroid = /ANDROID/i.test(cl.clientName);
    const isIos = /IOS/i.test(cl.clientName);
    const apiKey = cl.apiKey || INNERTUBE_KEYS[cl.clientName] || INNERTUBE_KEYS.WEB;
    const clientCtx = {
      clientName: cl.clientName,
      clientVersion: cl.clientVersion,
      hl: 'he',
      gl: 'IL',
      ...(cl.androidSdkVersion != null ? { androidSdkVersion: cl.androidSdkVersion } : {}),
      ...(cl.deviceModel ? { deviceModel: cl.deviceModel } : {}),
      ...(isAndroid
        ? { osName: 'Android', osVersion: cl.osVersion || '14', userAgent: cl.ua }
        : {}),
      ...(isIos
        ? {
            osName: 'iPhone',
            osVersion: cl.osVersion || '18.0',
            deviceMake: 'Apple',
            deviceModel: cl.deviceModel || 'iPhone16,2',
            userAgent: cl.ua,
          }
        : {}),
    };
    // visitorData: required on Datacenter IPs to avoid bot detection (LOGIN_REQUIRED)
    const vd = cl.visitorData || (await getVisitorData());
    if (vd) clientCtx.visitorData = vd;

    const playerBody = {
      context: {
        client: clientCtx,
        user: { lockedSafetyMode: false },
        ...(cl.embedded ? { thirdParty: { embedUrl: 'https://www.youtube.com/' } } : {}),
      },
      videoId,
      contentCheckOk: true,
      racyCheckOk: true,
    };

    // Send playbackContext / STS for all clients to ensure format resolution on DC IPs
    playerBody.playbackContext = {
      contentPlaybackContext: {
        signatureTimestamp: cl.sts || 19800,
      },
    };

    let endpoint = cl.useGoogleApisHost
      ? 'https://youtubei.googleapis.com/youtubei/v1/player?prettyPrint=false'
      : 'https://www.youtube.com/youtubei/v1/player?prettyPrint=false';
    // V96: always send API key (query + header) unless explicitly noKey
    if (apiKey && cl.noKey !== true) {
      endpoint += '&key=' + encodeURIComponent(apiKey);
    }

    const headers = {
      'content-type': 'application/json',
      'user-agent': cl.ua,
      'x-youtube-client-name': String(cl.clientNameHeader || ''),
      'x-youtube-client-version': cl.clientVersion,
      origin: 'https://www.youtube.com',
      referer: cl.embedded
        ? 'https://www.youtube.com/embed/' + videoId
        : 'https://www.youtube.com/watch?v=' + videoId,
      'accept-language': 'en-US,en;q=0.9',
    };
    if (apiKey && cl.noKey !== true) {
      headers['x-goog-api-key'] = apiKey;
    }
    if (cookieHeader) {
      const cleanCookie = isAndroid || isIos
        ? String(cookieHeader).replace(/(?:^|;\s*)LOGIN_INFO=[^;]*/gi, '').replace(/^;\s*/, '').trim()
        : cookieHeader;
      if (cleanCookie) headers.cookie = cleanCookie;
      const auth = await computeSapisidHash(cookieHeader);
      if (auth) {
        headers.authorization = auth;
        headers['x-origin'] = 'https://www.youtube.com';
        headers['x-goog-authuser'] = '0';
      }
    }
    if (cl.visitorData) headers['x-goog-visitor-id'] = cl.visitorData;

    const playerRes = await fetch(endpoint, {
      method: 'POST',
      signal: ac.signal,
      headers,
      body: JSON.stringify(playerBody),
    });
    clearTimeout(timer);
    if (!playerRes.ok) {
      return { ok: false, status: playerRes.status, source: tag };
    }
    const text = await playerRes.text();
    if (!text || text.trimStart()[0] === '<') {
      return { ok: false, status: playerRes.status, source: tag };
    }
    const playerJson = JSON.parse(text);
    let formats = extractFormatsFromPlayerJson(playerJson);
    const status = playerJson?.playabilityStatus?.status || '';
    // Some responses put streams only under streamingData with empty formats but hls
    if (!formats.length && playerJson?.streamingData?.hlsManifestUrl) {
      formats = [
        {
          itag: 'hls',
          url: playerJson.streamingData.hlsManifestUrl,
          mimeType: 'application/x-mpegURL',
          hasAudio: true,
          hasVideo: true,
          progressive: true,
        },
      ];
    }
    return {
      ok: formats.length > 0,
      formats,
      playability: playerJson.playabilityStatus,
      status: playerRes.status,
      source: tag + (status && status !== 'OK' ? '/' + status : ''),
      rawPlayability: status,
    };
  } catch (e) {
    clearTimeout(timer);
    const err = String(e && e.message ? e.message : e).slice(0, 80);
    return { ok: false, status: 0, source: tag + '/err:' + err.replace(/[:\s]+/g, '_'), error: String(e) };
  }
}

async function tryCobalt(videoId) {
  // Public Cobalt instances (some require no auth; official api.cobalt.tools now needs JWT)
  const hosts = [
    'https://cobalt-api.kwiatekmiki.com/',
    'https://api.cobalt.tools/',
  ];
  for (const host of hosts) {
    const ac = new AbortController();
    const timer = setTimeout(() => ac.abort(), 12000);
    try {
      const r = await fetch(host, {
        method: 'POST',
        signal: ac.signal,
        headers: {
          'content-type': 'application/json',
          accept: 'application/json',
        },
        body: JSON.stringify({
          url: 'https://www.youtube.com/watch?v=' + videoId,
          videoQuality: '720',
          downloadMode: 'auto',
          filenameStyle: 'basic',
          disableMetadata: true,
        }),
      });
      clearTimeout(timer);
      const text = await r.text();
      if (!text || text.trimStart()[0] === '<') continue;
      let data;
      try {
        data = JSON.parse(text);
      } catch {
        continue;
      }
      if (data.status === 'error' || data.error) continue;
      // Cobalt v7/v10/v11: tunnel | redirect | picker
      let mediaUrl = data.url || data.tunnel || '';
      if (!mediaUrl && Array.isArray(data.picker) && data.picker[0]) {
        mediaUrl = data.picker[0].url || data.picker[0].tunnel || '';
      }
      if (!mediaUrl) continue;
      return {
        ok: true,
        formats: [
          {
            itag: 22,
            url: mediaUrl,
            mimeType: 'video/mp4',
            bitrate: 0,
            width: 0,
            height: 720,
            quality: '720p',
            hasAudio: true,
            hasVideo: true,
            progressive: true,
          },
        ],
        playability: { status: 'OK' },
        status: r.status,
        source: 'cobalt:' + host,
      };
    } catch {
      clearTimeout(timer);
    }
  }
  return { ok: false, status: 0, source: 'cobalt' };
}

/** Parse ytInitialPlayerResponse even when nested in ytcfg / escaped JSON strings */
function parsePlayerJsonFromHtml(html) {
  if (!html) return null;
  let p = extractBalancedJson(html, 'ytInitialPlayerResponse');
  if (p && (p.streamingData || p.videoDetails)) return p;

  // Embedded player / modern pages
  const keys = ['ytInitialPlayerResponse', 'playerResponse', 'PLAYER_VARS'];
  for (const key of keys) {
    p = extractBalancedJson(html, key);
    if (p && (p.streamingData || p.videoDetails)) return p;
    if (p && p.args && p.args.player_response) {
      try {
        const pr = typeof p.args.player_response === 'string' ? JSON.parse(p.args.player_response) : p.args.player_response;
        if (pr && (pr.streamingData || pr.videoDetails)) return pr;
      } catch {
        /* next */
      }
    }
  }

  const ytcfgIdx = html.indexOf('ytcfg.set(');
  if (ytcfgIdx !== -1) {
    const slice = html.slice(ytcfgIdx, ytcfgIdx + 800000);
    try {
      const m = slice.match(/"player_response"\s*:\s*"((?:\\.|[^"\\])*)"/);
      if (m) {
        const unescaped = JSON.parse('"' + m[1] + '"');
        const parsed = JSON.parse(unescaped);
        if (parsed && (parsed.streamingData || parsed.videoDetails)) return parsed;
      }
    } catch {
      /* ignore */
    }
    // playerResponse as object inside ytcfg
    p = extractBalancedJson(slice, '"playerResponse"');
    if (p && (p.streamingData || p.videoDetails)) return p;
  }

  // Script JSON blobs
  try {
    const re = /ytInitialPlayerResponse\s*=\s*(\{)/g;
    let m;
    while ((m = re.exec(html))) {
      const start = m.index + m[0].length - 1;
      let depth = 0;
      for (let i = start; i < html.length && i < start + 2_000_000; i++) {
        const ch = html[i];
        if (ch === '{') depth++;
        else if (ch === '}') {
          depth--;
          if (depth === 0) {
            try {
              p = JSON.parse(html.slice(start, i + 1));
              if (p && (p.streamingData || p.videoDetails)) return p;
            } catch {
              /* next match */
            }
            break;
          }
        }
      }
    }
  } catch {
    /* ignore */
  }

  p = extractBalancedJson(html, 'ytInitialData');
  if (p) {
    const pr = p.playerResponse || (p.contents && p.contents.playerResponse);
    if (pr && (pr.streamingData || pr.videoDetails)) return pr;
  }
  return null;
}

async function tryPiped(videoId, host) {
  const ac = new AbortController();
  const timer = setTimeout(() => ac.abort(), 10000);
  try {
    const pr = await fetch(host + '/streams/' + encodeURIComponent(videoId), {
      signal: ac.signal,
      headers: { accept: 'application/json', 'user-agent': 'Mozilla/5.0' },
    });
    clearTimeout(timer);
    if (!pr.ok) return { ok: false, status: pr.status, source: 'piped:' + host };
    const text = await pr.text();
    if (!text || text.trimStart()[0] === '<') return { ok: false, status: pr.status, source: 'piped:' + host };
    const data = JSON.parse(text);
    const formats = [];
    for (const s of data.videoStreams || []) {
      if (!s || !s.url) continue;
      formats.push({
        itag: s.itag || (String(s.quality).includes('720') ? 22 : 18),
        url: s.url,
        mimeType: s.mimeType || s.format || 'video/mp4',
        bitrate: s.bitrate || 0,
        width: s.width || 0,
        height: s.height || 0,
        quality: s.quality || '',
        hasAudio: s.videoOnly === false || s.videoOnly === undefined,
      });
    }
    // Also progressive from videoStreams where !videoOnly
    formats.sort((a, b) => {
      const am = a.hasAudio === false ? 0 : 1;
      const bm = b.hasAudio === false ? 0 : 1;
      if (am !== bm) return bm - am;
      return (b.height || 0) - (a.height || 0);
    });
    return {
      ok: formats.length > 0,
      formats,
      playability: { status: 'OK' },
      status: pr.status,
      source: 'piped:' + host,
    };
  } catch (e) {
    clearTimeout(timer);
    return { ok: false, status: 0, source: 'piped:' + host, error: String(e) };
  }
}

async function tryInvidious(videoId, host) {
  const ac = new AbortController();
  const timer = setTimeout(() => ac.abort(), 10000);
  try {
    const pr = await fetch(host + '/api/v1/videos/' + encodeURIComponent(videoId), {
      signal: ac.signal,
      headers: { accept: 'application/json', 'user-agent': 'Mozilla/5.0' },
    });
    clearTimeout(timer);
    if (!pr.ok) return { ok: false, status: pr.status, source: 'inv:' + host };
    const text = await pr.text();
    if (!text || text.trimStart()[0] === '<') return { ok: false, status: pr.status, source: 'inv:' + host };
    const data = JSON.parse(text);
    const formats = [];
    for (const f of data.formatStreams || []) {
      if (!f || !f.url) continue;
      formats.push({
        itag: f.itag || 18,
        url: f.url,
        mimeType: f.type || 'video/mp4',
        bitrate: 0,
        width: 0,
        height: parseInt(String(f.qualityLabel || '').replace(/\D/g, ''), 10) || 0,
        quality: f.qualityLabel || '',
        hasAudio: true,
      });
    }
    // adaptive as last resort (video-only may not play alone)
    for (const f of data.adaptiveFormats || []) {
      if (!f || !f.url) continue;
      if (f.type && f.type.indexOf('video') === -1) continue;
      formats.push({
        itag: f.itag || 136,
        url: f.url,
        mimeType: f.type || 'video/mp4',
        bitrate: 0,
        width: 0,
        height: parseInt(String(f.qualityLabel || '').replace(/\D/g, ''), 10) || 0,
        quality: f.qualityLabel || '',
        hasAudio: false,
      });
    }
    return {
      ok: formats.length > 0,
      formats,
      playability: { status: 'OK' },
      status: pr.status,
      source: 'inv:' + host,
    };
  } catch (e) {
    clearTimeout(timer);
    return { ok: false, status: 0, source: 'inv:' + host, error: String(e) };
  }
}

async function tryGetVideoInfo(videoId, cookieHeader) {
  const ac = new AbortController();
  const timer = setTimeout(() => ac.abort(), 6000);
  try {
    const url = `https://www.youtube.com/get_video_info?video_id=${videoId}&el=detailpage&ps=default&eurl=&gl=US&hl=en&html5=1`;
    const r = await fetch(url, {
      signal: ac.signal,
      headers: {
        'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36',
        'cookie': cookieHeader || '',
        'accept-language': 'en-US,en;q=0.9',
      },
    });
    clearTimeout(timer);
    if (!r.ok) return { ok: false, status: r.status, source: 'get_video_info' };
    const text = await r.text();
    const params = new URLSearchParams(text);
    let playerResponse = params.get('player_response');
    if (!playerResponse) playerResponse = params.get('playerResponse');
    if (!playerResponse) return { ok: false, status: r.status, source: 'get_video_info' };
    const playerJson = JSON.parse(playerResponse);
    const formats = extractFormatsFromPlayerJson(playerJson);
    return {
      ok: formats.length > 0,
      formats,
      playability: playerJson.playabilityStatus,
      status: r.status,
      source: 'get_video_info',
    };
  } catch (e) {
    clearTimeout(timer);
    return { ok: false, status: 0, source: 'get_video_info', error: String(e) };
  }
}

async function tryHtmlPlayer(videoId, pageUrl, cookieHeader) {
  const ac = new AbortController();
  const timer = setTimeout(() => ac.abort(), 6000);
  try {
    const headers = {
      'user-agent':
        'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36',
      'accept-language': 'he-IL,he;q=0.9,en-US;q=0.8',
      accept: 'text/html,application/xhtml+xml',
    };
    if (cookieHeader) headers.cookie = cookieHeader;
    const hr = await fetch(pageUrl, { signal: ac.signal, headers });
    clearTimeout(timer);
    const html = await hr.text();
    const playerJson = parsePlayerJsonFromHtml(html);
    if (!playerJson) return { ok: false, status: hr.status, source: 'html' };
    const formats = extractFormatsFromPlayerJson(playerJson);
    return {
      ok: formats.length > 0,
      formats,
      playability: playerJson.playabilityStatus,
      status: hr.status,
      source: 'html' + (cookieHeader ? '+ck' : ''),
    };
  } catch (e) {
    clearTimeout(timer);
    return { ok: false, status: 0, source: 'html', error: String(e) };
  }
}

let cachedVisitorData = { data: '', exp: 0 };
async function getVisitorData() {
  if (cachedVisitorData.data && cachedVisitorData.exp > Date.now()) {
    return cachedVisitorData.data;
  }
  try {
    const r = await fetch('https://www.youtube.com/youtubei/v1/visitor_id?key=' + INNERTUBE_KEYS.ANDROID, {
      method: 'POST',
      headers: {
        'content-type': 'application/json',
        'x-youtube-client-name': '3',
        'x-youtube-client-version': '20.50.37'
      },
      body: JSON.stringify({ context: { client: { clientName: 'ANDROID', clientVersion: '20.50.37' } } })
    });
    const j = await r.json();
    const vd = j.responseContext?.visitorData || '';
    if (vd) {
      cachedVisitorData = { data: vd, exp: Date.now() + 10 * 60 * 1000 };
      return vd;
    }
  } catch {}
  return '';
}

async function fetchPlayerFormats(videoId, request, env) {
  const relayIsConfigured = relayConfigured(env);
  let relayErr = null;
  if (relayIsConfigured) {
    const ytCookies0 = await getYoutubeCookieHeader(request);
    let workerOrigin = '';
    try { workerOrigin = new URL(request.url).origin; } catch (_) {}
    const relayPack = await relayPlayer(env, videoId, ytCookies0 || '', workerOrigin);
    if (relayPack.ok) return relayPack;
    relayErr =
      relayPack.relayErr ||
      (relayPack.playability && relayPack.playability.status) ||
      'relay-no-formats';
  }

  let lastPlayability = null;
  let lastStatus = 0;
  let lastSource = '';
  const attemptsLog = [];
  attemptsLog.push(
    relayIsConfigured
      ? 'home-relay:' + (relayErr ? 'fail/' + relayErr : 'ok')
      : 'home-relay:not-configured'
  );

  const record = (r) => {
    attemptsLog.push(
      (r.source || '?') +
        ':' +
        (r.ok ? 'ok' : 'fail') +
        (r.status ? '@' + r.status : '') +
        (r.playability && r.playability.status ? '/' + r.playability.status : '')
    );
    if (r.playability) {
      const st = String(r.playability.status || '');
      const prev = String(lastPlayability?.status || '');
      const reason = String(r.playability.reason || '');
      const isNoise = /no longer supported/i.test(reason) && st === 'ERROR';
      if (!isNoise || !lastPlayability || prev === 'ERROR') {
        if (!isNoise || st === 'LOGIN_REQUIRED' || st === 'OK') {
          lastPlayability = r.playability;
        } else if (!lastPlayability) {
          lastPlayability = r.playability;
        }
      }
      if (st === 'LOGIN_REQUIRED') lastPlayability = r.playability;
    }
    if (r.status) lastStatus = r.status;
    if (r.source) lastSource = r.source;
  };

  const ytCookies = await getYoutubeCookieHeader(request);
  const hasAuth =
    /(?:^|;\s*)(?:SAPISID|__Secure-3PAPISID)=/.test(ytCookies) ||
    /(?:^|;\s*)LOGIN_INFO=/.test(ytCookies);

  let visitorData = await getVisitorData();

  // V96: ALL clients send API key (noKey removed — YouTube rejects keyless mobile with "no longer supported")
  const androidCl = {
    clientName: 'ANDROID',
    clientVersion: '20.50.37',
    androidSdkVersion: 34,
    osVersion: '14',
    ua: 'com.google.android.youtube/20.50.37 (Linux; U; Android 14) gzip',
    clientNameHeader: '3',
    timeoutMs: 4500,
    visitorData,
    hl: 'en',
    gl: 'US',
    apiKey: INNERTUBE_KEYS.ANDROID,
  };
  const androidCl2 = {
    clientName: 'ANDROID',
    clientVersion: '20.42.10',
    androidSdkVersion: 34,
    osVersion: '14',
    ua: 'com.google.android.youtube/20.42.10 (Linux; U; Android 14) gzip',
    clientNameHeader: '3',
    timeoutMs: 4000,
    visitorData,
    hl: 'en',
    gl: 'US',
    apiKey: INNERTUBE_KEYS.ANDROID,
  };
  const androidCl3 = {
    clientName: 'ANDROID',
    clientVersion: '20.35.30',
    androidSdkVersion: 34,
    osVersion: '14',
    ua: 'com.google.android.youtube/20.35.30 (Linux; U; Android 14) gzip',
    clientNameHeader: '3',
    timeoutMs: 3500,
    visitorData,
    hl: 'en',
    gl: 'US',
    apiKey: INNERTUBE_KEYS.ANDROID,
  };
  const iosCl = {
    clientName: 'IOS',
    clientVersion: '20.12.4',
    deviceModel: 'iPhone16,2',
    osVersion: '18.0',
    ua: 'com.google.ios.youtube/20.12.4 (iPhone16,2; U; CPU iOS 18_0 like Mac OS X;)',
    clientNameHeader: '5',
    timeoutMs: 4500,
    visitorData,
    hl: 'en',
    gl: 'US',
    apiKey: INNERTUBE_KEYS.IOS,
  };
  const tvCl = {
    clientName: 'TVHTML5_SIMPLY_EMBEDDED_PLAYER',
    clientVersion: '2.0',
    ua: 'Mozilla/5.0 (ChromiumStylePlatform) Cobalt/Version',
    clientNameHeader: '85',
    embedded: true,
    timeoutMs: 4000,
    visitorData,
    hl: 'en',
    gl: 'US',
    apiKey: INNERTUBE_KEYS.TVHTML5_SIMPLY_EMBEDDED_PLAYER,
  };
  const webCl = {
    clientName: 'WEB',
    clientVersion: '2.20250620.00.00',
    ua: 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36',
    clientNameHeader: '1',
    timeoutMs: 4500,
    visitorData,
    hl: 'en',
    gl: 'US',
    apiKey: INNERTUBE_KEYS.WEB,
    sts: 20468,
  };
  const webEmbedCl = {
    clientName: 'WEB_EMBEDDED_PLAYER',
    clientVersion: '1.20250620.00.00',
    ua: 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36',
    clientNameHeader: '56',
    embedded: true,
    timeoutMs: 4000,
    visitorData,
    hl: 'en',
    gl: 'US',
    apiKey: INNERTUBE_KEYS.WEB_EMBEDDED_PLAYER,
  };

  const androidTestSuiteCl = {
    clientName: 'ANDROID_TESTSUITE',
    clientVersion: '1.22.1',
    ua: 'com.google.android.youtube.testsuite/1.22.1 (Linux; U; Android 14) gzip',
    timeoutMs: 5000,
    visitorData,
    hl: 'en',
    gl: 'US',
    apiKey: INNERTUBE_KEYS.ANDROID,
  };
  const androidMusicCl = {
    clientName: 'ANDROID_MUSIC',
    clientVersion: '6.02.51',
    ua: 'com.google.android.apps.youtube.music/6.02.51 (Linux; U; Android 14) gzip',
    timeoutMs: 5000,
    visitorData,
    hl: 'en',
    gl: 'US',
    apiKey: INNERTUBE_KEYS.ANDROID,
  };
  const androidEmbeddedCl = {
    clientName: 'ANDROID_EMBEDDED_PLAYER',
    clientVersion: '19.30.36',
    ua: 'com.google.android.youtube/19.30.36 (Linux; U; Android 14) gzip',
    timeoutMs: 5000,
    visitorData,
    hl: 'en',
    gl: 'US',
    apiKey: INNERTUBE_KEYS.WEB,
    embedded: true,
  };
  const iosEmbeddedCl = {
    clientName: 'IOS_EMBEDDED_PLAYER',
    clientVersion: '19.30.36',
    ua: 'com.google.ios.youtube/19.30.36 (iPhone16,2; U; CPU iOS 18_0 like Mac OS X;)',
    timeoutMs: 5000,
    visitorData,
    hl: 'en',
    gl: 'US',
    apiKey: INNERTUBE_KEYS.WEB,
    embedded: true,
  };

  const androidVrCl = {
    clientName: 'ANDROID_VR',
    clientVersion: '1.50.19',
    ua: 'Mozilla/5.0 (Linux; Android 10; Quest 2) AppleWebKit/537.36 (KHTML, like Gecko) OculusBrowser/15.0.0.0.22 Safari/537.36',
    timeoutMs: 5000,
    visitorData,
    hl: 'en',
    gl: 'US',
    apiKey: INNERTUBE_KEYS.ANDROID,
  };
  const webRemixCl = {
    clientName: 'WEB_REMIX',
    clientVersion: '1.20250620.00.00',
    ua: 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36',
    timeoutMs: 5000,
    visitorData,
    hl: 'en',
    gl: 'US',
    apiKey: INNERTUBE_KEYS.WEB,
  };
  const tvHtml5Cl = {
    clientName: 'TVHTML5',
    clientVersion: '7.20250620.00.00',
    ua: 'Mozilla/5.0 (ChromiumStylePlatform) Cobalt/25.Lts.1.503302-stable (unlike Gecko) v8/8.8.278.8-typed gles3',
    timeoutMs: 5000,
    visitorData,
    hl: 'en',
    gl: 'US',
    apiKey: INNERTUBE_KEYS.WEB,
  };
  const mwebCl = {
    clientName: 'MWEB',
    clientVersion: '20.19.35',
    clientNameHeader: '2',
    ua: 'Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Mobile Safari/537.36',
    timeoutMs: 5000,
    visitorData,
    hl: 'en',
    gl: 'US',
    apiKey: INNERTUBE_KEYS.WEB,
  };



  // 1) HOT PATH — modern ANDROID/IOS/WEB with keys always
  const race1 = await Promise.all([
    tryInnertubeClient(videoId, androidCl, ytCookies),
    tryInnertubeClient(videoId, iosCl, ytCookies),
    tryInnertubeClient(videoId, androidCl2, ytCookies),
    tryInnertubeClient(videoId, tvHtml5Cl, ytCookies),
    tryInnertubeClient(videoId, mwebCl, ytCookies),
    tryInnertubeClient(videoId, androidVrCl, ytCookies),
    tryInnertubeClient(videoId, webRemixCl, ytCookies),
    tryInnertubeClient(videoId, androidTestSuiteCl, ytCookies),
    tryInnertubeClient(videoId, androidMusicCl, ytCookies),
    tryInnertubeClient(videoId, androidEmbeddedCl, ytCookies),
    tryInnertubeClient(videoId, iosEmbeddedCl, ytCookies),
  ]);

  // Prefer clients that returned real formats; skip "no longer supported" dead ends
  const unsupportedHits = [];
  for (const r of race1) {
    record(r);
    const reason = String(r.playability?.reason || r.source || '');
    if (/no longer supported/i.test(reason)) unsupportedHits.push(r);
    if (r.ok && r.formats && r.formats.length) {
      return { ok: true, formats: r.formats, playability: r.playability, client: r.source, attemptsLog, hasCookies: !!ytCookies, hasAuth };
    }
  }
  if (unsupportedHits.length) {
    attemptsLog.push('deprecated-client:' + unsupportedHits.length);
  }

  // 1b) Immediate WEB fallback when mobile clients are deprecated / empty
  {
    const webRace = await Promise.all([
      tryInnertubeClient(videoId, webCl, ''),
      tryInnertubeClient(videoId, webCl, ytCookies || ''),
    ]);
    for (const r of webRace) {
      record(r);
      if (r.ok && r.formats && r.formats.length) {
        return { ok: true, formats: r.formats, playability: r.playability, client: r.source, attemptsLog, hasCookies: !!ytCookies, hasAuth };
      }
    }
  }

  // Prefer lastPlayability that is useful (not generic TV "unsupported")
  const loginHits = race1.filter(
    (r) =>
      /LOGIN_REQUIRED/i.test(String(r.playability?.status || r.source || r.rawPlayability || '')) ||
      r.rawPlayability === 'LOGIN_REQUIRED'
  ).length;
  const loginLocked = loginHits >= 2;
  // Re-pick playability from ANDROID/IOS if TV left a misleading "no longer supported"
  for (const r of race1) {
    if (r.playability && /ANDROID|IOS/i.test(String(r.source || '')) && r.playability.status) {
      lastPlayability = r.playability;
      break;
    }
  }

  // 2) With cookies — always try (even after LOGIN_REQUIRED without cookies)
  if (ytCookies) {
    const androidAuth = { ...androidCl, forceAuth: true };
    const race2 = await Promise.all([
      tryInnertubeClient(videoId, tvHtml5Cl, ytCookies),
      tryInnertubeClient(videoId, mwebCl, ytCookies),
      tryInnertubeClient(videoId, androidVrCl, ytCookies),
      tryInnertubeClient(videoId, webRemixCl, ytCookies),
      tryInnertubeClient(videoId, androidTestSuiteCl, ytCookies),
      tryInnertubeClient(videoId, androidMusicCl, ytCookies),
      tryInnertubeClient(videoId, androidEmbeddedCl, ytCookies),
      tryInnertubeClient(videoId, iosEmbeddedCl, ytCookies),
      tryInnertubeClient(videoId, androidCl, ytCookies),
      tryInnertubeClient(videoId, androidCl2, ytCookies),
      tryInnertubeClient(videoId, androidAuth, ytCookies),
      tryInnertubeClient(videoId, iosCl, ytCookies),
      tryInnertubeClient(videoId, webCl, ytCookies),
      tryInnertubeClient(videoId, webEmbedCl, ytCookies),
      tryInnertubeClient(videoId, tvCl, ytCookies),
    ]);
    const sorted = race2.slice().sort((a, b) => {
      const score = (r) => {
        if (!r || !r.ok || !r.formats || !r.formats.length) return -1;
        const src = String(r.source || '');
        if (/ANDROID|IOS/i.test(src)) return 100 + r.formats.length;
        if (/WEB/i.test(src)) return 10 + r.formats.length;
        return r.formats.length;
      };
      return score(b) - score(a);
    });
    for (const r of sorted) {
      record(r);
      if (r.ok && r.formats && r.formats.length) {
        return { ok: true, formats: r.formats, playability: r.playability, client: r.source, attemptsLog, hasCookies: true, hasAuth };
      }
    }
  }

  // 3) External extractors — ALWAYS try (even when LOGIN_REQUIRED on CF; Piped may still work)
  {
    const extPromise = Promise.all([
      tryCobalt(videoId),
      tryPiped(videoId, 'https://pipedapi.adminforge.de'),
      tryPiped(videoId, 'https://pipedapi.colby.la'),
      tryPiped(videoId, 'https://piped-api.garudalinux.org'),
      tryPiped(videoId, 'https://pipedapi.kavin.rocks'),
      tryInvidious(videoId, 'https://invidious.projectsegfaut.im'),
      tryInvidious(videoId, 'https://invidious.flokinet.to'),
      tryInvidious(videoId, 'https://yewtu.be'),
      tryInvidious(videoId, 'https://invidious.backing.dev'),
      tryInvidious(videoId, 'https://invidious.perennialte.ch'),
      tryInvidious(videoId, 'https://invidious.lunar.icu'),
      tryInvidious(videoId, 'https://inv.tux.im'),
    ]);
    const timed = await Promise.race([
      extPromise,
      new Promise((resolve) => setTimeout(() => resolve(null), 12000)),
    ]);
    if (Array.isArray(timed)) {
      for (const r of timed) {
        if (!r) continue;
        record(r);
        if (r.ok && r.formats && r.formats.length) {
          return { ok: true, formats: r.formats, playability: r.playability, client: r.source, attemptsLog, hasCookies: !!ytCookies, hasAuth };
        }
      }
    } else {
      attemptsLog.push('external:timeout12s');
    }
  }

  return {
    ok: false,
    formats: [],
    playability: lastPlayability,
    lastStatus,
    lastSource,
    attemptsLog,
    hasCookies: !!ytCookies,
    hasAuth,
    relayConfigured: relayIsConfigured,
    relayErr,
  };
}

async function serveYoutubeThumb(v, quality, request) {
  v = String(v || '').replace(/[^\w-]/g, '');
  if (!v) {
    return new Response('missing v', { status: 400 });
  }
  const allowed = new Set(['hqdefault', 'mqdefault', 'sddefault', 'maxresdefault', 'default', 'hq720', '0', '1', '2', '3']);
  let q0 = String(quality || 'hq720');
  if (!allowed.has(q0)) q0 = 'hq720';
  // Prefer large clear thumbs. Try webp + multi-host (avoids some filters / bad CDN nodes)
  const order = [q0, 'hq720', 'maxresdefault', 'sddefault', 'hqdefault', 'mqdefault', 'default'];
  const hosts = ['i.ytimg.com', 'i1.ytimg.com', 'i2.ytimg.com', 'i3.ytimg.com', 'i4.ytimg.com'];
  const seen = new Set();
  for (const qq of order) {
    if (seen.has(qq)) continue;
    seen.add(qq);
    for (const host of hosts) {
      const urls = [
        'https://' + host + '/vi/' + v + '/' + qq + '.jpg',
        'https://' + host + '/vi_webp/' + v + '/' + qq + '.webp',
      ];
      for (const imgUrl of urls) {
        try {
          const ir = await fetch(imgUrl, {
            headers: {
              'user-agent':
                'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36',
              accept: 'image/avif,image/webp,image/apng,image/*,*/*;q=0.8',
              referer: 'https://www.youtube.com/',
            },
            cf: { cacheTtl: 86400, cacheEverything: true },
          });
          if (!ir.ok) continue;
          const buf = new Uint8Array(await ir.arrayBuffer());
          if (buf.length < 2000) continue;
          // Reject HTML/block pages disguised as images
          if (looksLikeBlockOrHtml(buf)) continue;
          const isJpeg = buf[0] === 0xff && buf[1] === 0xd8;
          const isWebp = buf[0] === 0x52 && buf[1] === 0x49 && buf[2] === 0x46 && buf[3] === 0x46;
          const isPng = buf[0] === 0x89 && buf[1] === 0x50;
          if (!isJpeg && !isWebp && !isPng) continue;
          const ct = isWebp ? 'image/webp' : isPng ? 'image/png' : 'image/jpeg';
          return sealedResponse(buf, 200, ct, {
            'Cache-Control': 'public, max-age=86400',
            'X-Etrog-Thumb': qq,
            'X-Etrog-Bytes': String(buf.length),
            'X-Etrog-Host': host,
          }, 0);
        } catch {
          /* next */
        }
      }
    }
  }
  // Tiny neutral JPEG (not gif) so UI still shows a box
  const tiny = Uint8Array.from(
    atob(
      '/9j/4AAQSkZJRgABAQAAAQABAAD/2wBDAAgGBgcGBQgHBwcJCQgKDBQNDAsLDBkSEw8UHRofHh0aHBwgJC4nICIsIxwcKDcpLDAxNDQ0Hyc5PTgyPC4zNDL/2wBDAQkJCQwLDBgNDRgyIRwhMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjL/wAARCAABAAEDASIAAhEBAxEB/8QAFQABAQAAAAAAAAAAAAAAAAAAAAn/xAAUEAEAAAAAAAAAAAAAAAAAAAAA/8QAFQEBAQAAAAAAAAAAAAAAAAAAAAX/xAAUEQEAAAAAAAAAAAAAAAAAAAAA/9oADAMBAAIQAxAAAAGcP//EABQQAQAAAAAAAAAAAAAAAAAAAAD/2gAIAQEAAQUCf//EABQRAQAAAAAAAAAAAAAAAAAAAAD/2gAIAQMBAT8Bf//EABQRAQAAAAAAAAAAAAAAAAAAAAD/2gAIAQIBAT8Bf//EABQQAQAAAAAAAAAAAAAAAAAAAAD/2gAIAQEABj8Cf//EABQQAQAAAAAAAAAAAAAAAAAAAAD/2gAIAQEAAT8hf//Z'
    ),
    (c) => c.charCodeAt(0)
  );
  return sealedResponse(tiny, 200, 'image/jpeg', { 'Cache-Control': 'public, max-age=120', 'X-Etrog-Thumb': 'fallback' }, 0);
}

async function handleYtStream(request, url, env) {
  let videoId = url.searchParams.get('v') || url.searchParams.get('id');
  let itag = url.searchParams.get('i') || url.searchParams.get('itag') || '18';
  let directMediaUrl = '';
  const token = url.searchParams.get('hash') || url.searchParams.get('d');
  if (token) {
    const decoded = decodeMediaToken(token);
    if (decoded) {
      videoId = decoded.v;
      itag = decoded.i || itag;
      if (decoded.u) directMediaUrl = decoded.u;
    }
  }
  // Optional explicit direct URL (also accepted as query for debugging)
  if (!directMediaUrl && url.searchParams.get('u')) {
    try {
      directMediaUrl = decodeURIComponent(url.searchParams.get('u'));
    } catch {
      directMediaUrl = url.searchParams.get('u') || '';
    }
  }
  if (!videoId) {
    return new Response(JSON.stringify({ error: 'missing v' }), { status: 400, headers: { 'content-type': 'application/json' } });
  }

  try {
    let wantDownload = url.searchParams.get('dl') === '1' || url.searchParams.get('download') === '1';
    let prefer = String(itag || '18');
    // Token may carry strict flag
    let strict =
      url.searchParams.get('strict') === '1' ||
      url.searchParams.get('s') === '1';
    if (token) {
      try {
        const raw = decodeUrl(token);
        const j = JSON.parse(raw);
        if (j && (j.s === 1 || j.s === '1')) strict = true;
        if (j && (j.d === 1 || j.d === '1')) wantDownload = true;
      } catch (_) {}
    }

    // ── Direct media URL path (client-resolved googlevideo via Origin:null) ──
    // Browser resolves formats from residential IP; worker only relays bytes (Etrog bypass).
    if (directMediaUrl && isAllowedMediaDirectUrl(directMediaUrl)) {
      const ytAuthForMedia = await getYoutubeCookieHeader(request);
      const rawRange0 = request.headers.get('range');
      // Same range cap as the main path: never let one request try to pull a whole large file.
      // When the client sent NO Range header at all (some ingress proxies — e.g. HuggingFace
      // Spaces — strip it, and the player's first probe fetch sends none), default to the first
      // bounded chunk. Pulling the whole file in one fetch hits the relay/direct 8s timeout and
      // the stream dies before the browser sees any bytes → "video doesn't play at all".
      let clientRange = rawRange0;
      if (rawRange0) {
        const rm0 = String(rawRange0).match(/bytes=(\d+)-(\d*)/i);
        if (rm0) {
          const rs0 = parseInt(rm0[1], 10) || 0;
          const re0 = rm0[2] ? parseInt(rm0[2], 10) : -1;
          if (re0 < 0 || re0 - rs0 > 4 * 1024 * 1024) clientRange = 'bytes=' + rs0 + '-' + (rs0 + 4 * 1024 * 1024 - 1);
        }
      } else if (!wantDownload) {
        // Playback only: a no-Range client gets the first bounded chunk as a 206 so the
        // stream starts immediately. Downloads always send explicit Range chunks (browser
        // loops bytes=N-) — never truncate a full download request here.
        clientRange = 'bytes=0-' + (4 * 1024 * 1024 - 1);
      }
      const mediaUAs = [
        'com.google.android.youtube/20.50.37 (Linux; U; Android 14) gzip',
        'com.google.android.youtube/19.28.35 (Linux; U; Android 13) gzip',
        'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36',
      ];
      let lastSt = 0;
      for (const ua of mediaUAs) {
        for (const useCk of ytAuthForMedia ? [false, true] : [false]) {
          try {
            const fetchHeaders = {
              'user-agent': ua,
              referer: 'https://www.youtube.com/',
              accept: '*/*',
              ...(useCk && ytAuthForMedia ? { cookie: ytAuthForMedia } : {}),
              ...(clientRange ? { range: clientRange } : {}),
            };
            const mediaRes = await fetch(directMediaUrl, {
              headers: fetchHeaders,
              redirect: 'follow',
              signal: AbortSignal.timeout(8000),
            });
            lastSt = mediaRes.status;
            if (!(mediaRes.ok || mediaRes.status === 206)) {
              try { await mediaRes.arrayBuffer(); } catch (_) {}
              continue;
            }
            const origCt = (mediaRes.headers.get('content-type') || 'video/mp4').split(';')[0].trim();
            if (/html|json|text\/plain/i.test(origCt)) {
              try { await mediaRes.arrayBuffer(); } catch (_) {}
              continue;
            }
            const reader = mediaRes.body.getReader();
            const { value: firstChunk, done } = await reader.read();
            if (done || !firstChunk || firstChunk.length < 8) {
              try { reader.releaseLock(); } catch (_) {}
              continue;
            }
            if (looksLikeBlockOrHtml(firstChunk)) {
              try { reader.cancel(); } catch (_) {}
              try { reader.releaseLock(); } catch (_) {}
              continue;
            }
            const looksMedia =
              (firstChunk[4] === 0x66 && firstChunk[5] === 0x74 && firstChunk[6] === 0x79 && firstChunk[7] === 0x70) ||
              (firstChunk[0] === 0x1a && firstChunk[1] === 0x45) ||
              (firstChunk[0] === 0xff && (firstChunk[1] & 0xe0) === 0xe0) ||
              (firstChunk[0] === 0x49 && firstChunk[1] === 0x44 && firstChunk[2] === 0x33);
            if (!looksMedia) {
              // still allow if content-type is video/* and size looks real
              const clH = mediaRes.headers.get('content-length');
              const cln = clH ? parseInt(clH, 10) : 0;
              if (!(origCt.startsWith('video/') || origCt.startsWith('audio/')) || (cln > 0 && cln < 2000)) {
                try { reader.cancel(); } catch (_) {}
                try { reader.releaseLock(); } catch (_) {}
                continue;
              }
            }
            const plainBody = new ReadableStream({
              start(controller) {
                controller.enqueue(firstChunk);
                const pump = () =>
                  reader.read().then(({ done: d, value }) => {
                    if (d) {
                      controller.close();
                      try { reader.releaseLock(); } catch (_) {}
                      return;
                    }
                    controller.enqueue(value);
                    return pump();
                  }).catch((err) => {
                    try { controller.error(err); } catch (_) {}
                    try { reader.releaseLock(); } catch (_) {}
                  });
                return pump();
              },
              cancel() {
                try { reader.cancel(); } catch (_) {}
                try { reader.releaseLock(); } catch (_) {}
              },
            });
            const h = new Headers();
            const ctOut = origCt.startsWith('video/') || origCt.startsWith('audio/') ? origCt : 'video/mp4';
            h.set('X-Etrog-Itag', String(prefer));
            h.set('X-Etrog-Source', 'client-direct-url');
            if (directMediaUrl) h.set('X-Etrog-Resolved-Url', directMediaUrl);
            const cr = mediaRes.headers.get('content-range');
            const cl = mediaRes.headers.get('content-length');
            if (cr) h.set('content-range', cr);
            if (wantDownload) {
              h.set('content-disposition', 'attachment; filename="' + String(videoId).replace(/[^\w-]+/g, '_') + '.mp4"');
            }
            // Cache this direct URL for the itag briefly
            try {
              const vid = String(videoId);
              let entry = MEDIA_URL_CACHE.get(vid);
              if (!entry) {
                entry = { exp: Date.now() + 6 * 60 * 1000, byItag: {} };
                MEDIA_URL_CACHE.set(vid, entry);
                // Cap map size so a long-lived isolate does not leak memory (mirrors FORMAT_CACHE).
                if (MEDIA_URL_CACHE.size > 80) {
                  MEDIA_URL_CACHE.delete(MEDIA_URL_CACHE.keys().next().value);
                }
              }
              entry.exp = Date.now() + 6 * 60 * 1000;
              entry.byItag[String(prefer)] = {
                url: directMediaUrl,
                mime: ctOut,
                exp: Date.now() + 6 * 60 * 1000,
              };
            } catch (_) {}
            return sealedStreamResponse(plainBody, mediaRes.status === 206 ? 206 : 200, ctOut, h, parseRangeStart(clientRange), cl);
          } catch (_) {}
        }
      }
      // Direct URL failed (often IP-bound googlevideo). Fall through to server resolve,
      // and if that fails the client can play the URL itself.
      if (!videoId) {
        return new Response(
          JSON.stringify({
            error: 'direct media fetch failed',
            lastMediaStatus: lastSt,
            hint: 'URL חתום ל-IP של הדפדפן — נסו ניגון ישיר או רענון',
          }),
          { status: 502, headers: { 'content-type': 'application/json' } }
        );
      }
    }

    // Prefer exact requested quality first; never silently serve 18 when 22 was asked (unless fallback after fail)
    const preferOrder = [prefer, '22', '18', '37', '38', '36', '17', '136', '137', '135', '134', '133', '160', '251', '140', '139'];
    // V96: do NOT early-return 502 when client direct URL fails on CF IP.
    // Fall through to getPlayerFormatsCached so we may get a fresh server-side format
    // that streams through /x/s/*.bin (avoids 8× 502 cascade + Etrog blocking googlevideo).
    // Keep client URL as last-resort directUrls only after all server formats also fail.
    const clientDirectFallback = directMediaUrl && isAllowedMediaDirectUrl(directMediaUrl)
      ? [{ itag: String(prefer), url: directMediaUrl, mime: 'video/mp4', progressive: true }]
      : [];

    let pack = await getPlayerFormatsCached(videoId, request, env);
    // Only one retry if cache was stale empty (not LOGIN_REQUIRED)
    if (!pack?.ok || !pack.formats.length) {
      const st0 = pack?.playability?.status || '';
      if (st0 !== 'LOGIN_REQUIRED' && !/LOGIN_REQUIRED/i.test(String(pack?.attemptsLog || ''))) {
        FORMAT_CACHE.delete(String(videoId));
        pack = await getPlayerFormatsCached(videoId, request, env);
      }
    }
    if (!pack?.ok || !pack.formats.length) {
      const playStat = pack?.playability?.status || '';
      const playReason = pack?.playability?.reason || '';
      const loginBlocked =
        playStat === 'LOGIN_REQUIRED' || /LOGIN_REQUIRED/i.test(String(pack?.attemptsLog || ''));
      let hint = 'לא נמצאו פורמטי וידאו';
      // Relay state comes first: LOGIN_REQUIRED from Cloudflare IPs is EXPECTED —
      // the Home Relay (residential IP) is what makes playback work. If it is off
      // or unconfigured, say so instead of blaming YouTube/Cloudflare.
      if (pack?.relayConfigured === false) {
        hint =
          'ה-Home Relay לא מוגדר ב-Worker (חסרים YT_RELAY_URL / YT_RELAY_SECRET). ' +
          'בלי relay ביתי (IP ביתי) YouTube חוסם את Cloudflare עם LOGIN_REQUIRED. ' +
          'הפעילו start-relay.ps1 והגדירו את הסודות ב-Worker.';
      } else if (pack?.relayErr) {
        hint =
          'ה-Home Relay מוגדר אך נכשל (' + pack.relayErr + '). ' +
          'ודאו שהשרת רץ (start-relay.ps1 → /health), וש-YT_RELAY_URL מצביע על מנהרת cloudflared הפעילה הנוכחית.';
      } else if (loginBlocked) {
        hint =
          'YouTube חוסם Cloudflare (LOGIN_REQUIRED) — הנגן ינסה פתרון מהדפדפן. Ctrl+F5 אם נכשל.';
      } else if (/no longer supported|152|unavailable/i.test(playReason + playStat)) {
        hint =
          'YouTube דחה לקוח (no longer supported) — SW96. Ctrl+F5; אם ממשיך הנגן מנסה מהדפדפן.';
      } else if (!pack?.hasAuth) {
        hint = 'חסרות עוגיות — /import-cookies (אופציונלי; הנגן מנסה גם בלי)';
      }
      return new Response(
        JSON.stringify({
          error: 'no format',
          videoId,
          playability: pack?.playability,
          lastStatus: pack?.lastStatus,
          lastSource: pack?.lastSource || '',
          attempts: pack?.attemptsLog || [],
          relayConfigured: pack?.relayConfigured !== false,
          relayErr: pack?.relayErr || null,
          hasCookies: !!pack?.hasCookies,
          hasAuth: !!pack?.hasAuth,
          // Only now hand client the residential googlevideo URL (after server resolve failed)
          directUrls: clientDirectFallback,
          clientResolve: true,
          hint,
        }),
        {
          status: 502,
          headers: { 'content-type': 'application/json' },
        }
      );
    }

    const byItag = new Map(pack.formats.map((f) => [String(f.itag), f]));
    const available = pack.formats.map((f) => String(f.itag)).filter(Boolean);
    const ordered = [];
    const seen = new Set();
    const pushUnique = (f) => {
      if (!f || seen.has(f)) return;
      seen.add(f);
      ordered.push(f);
    };

    // Serve ONLY a format of the requested media class. The old fallback would hand a
    // bare audio track (e.g. itag 139/140) to a request for a video/progressive itag when
    // the video had no progressive stream — the player then got audio bytes for a video
    // element (or a video track for an audio SourceBuffer in MSE) and failed to decode.
    const AUDIO_ITAGS = new Set(['139','140','141','171','249','250','251','256','258','325','328','599','600']);
    const isAudioFmt = (f) => (!!f.hasAudio && !f.hasVideo) || AUDIO_ITAGS.has(String(f.itag));
    const reqIsAudio = AUDIO_ITAGS.has(String(prefer));
    if (strict) {
      // Exact itag only — never substitute a different track. Missing → 502 (client falls back / MSE).
      if (byItag.has(prefer) && byItag.get(prefer).url) pushUnique(byItag.get(prefer));
    } else if (reqIsAudio) {
      if (byItag.has(prefer) && isAudioFmt(byItag.get(prefer))) pushUnique(byItag.get(prefer));
      for (const f of pack.formats) if (isAudioFmt(f) && f.url) pushUnique(f);
    } else {
      // Video/progressive request: exact muxed first, then any muxed by quality. Never audio-only.
      if (byItag.has(prefer) && !isAudioFmt(byItag.get(prefer))) pushUnique(byItag.get(prefer));
      for (const id of preferOrder) {
        const f = byItag.get(id);
        if (f && f.url && (f.progressive || (f.hasAudio && f.hasVideo))) pushUnique(f);
      }
      for (const f of pack.formats) {
        if (f.url && (f.progressive || (f.hasAudio && f.hasVideo))) pushUnique(f);
      }
    }

    if (!ordered.length) {
      // Nothing of the requested class exists (e.g. adaptive-only video asked as progressive).
      // 502 so the client's MSE path takes over instead of receiving the wrong track.
      return new Response(
        JSON.stringify({
          error: 'quality_unavailable',
          videoId,
          requested: prefer,
          available: available.slice(0, 20),
          adaptiveOnly: !reqIsAudio && !pack.formats.some((f) => f.progressive || (f.hasAudio && f.hasVideo)),
          hint: prefer === '22' ? '720p לא זמין לסרטון זה — נסו 360p' : 'האיכות המבוקשת לא זמינה כזרם ישיר',
        }),
        { status: 502, headers: { 'content-type': 'application/json' } }
      );
    }

    const mediaHeadersBase = (origCt, fmt, extra = {}) => {
      const h = new Headers();
      applyCorsHeaders(h, request);
      h.set('content-type', origCt);
      h.set('accept-ranges', 'bytes');
      h.set('X-Accel-Buffering', 'no');
      h.set('X-Etrog-Mode', 'stream-unsealed');
      h.set('X-Etrog-Itag', String(fmt.itag));
      if (fmt.url) h.set('X-Etrog-Resolved-Url', fmt.url);
      // Allow short browser/CDN cache of media bytes after first resolve
      h.set('cache-control', wantDownload ? 'no-store' : 'private, max-age=120');
      if (wantDownload) {
        const safeName = String(videoId).replace(/[^\w-]+/g, '_') + '.mp4';
        h.set('content-disposition', 'attachment; filename="' + safeName + '"');
      }
      h.set('Access-Control-Expose-Headers',
        'Content-Length, Content-Range, Accept-Ranges, Content-Type, Content-Disposition, X-Etrog-Mode, X-Etrog-Itag, X-Etrog-Bytes, X-Proxy-Obfuscated, X-Original-Content-Type, X-Seal-Offset, X-Etrog-Resolved-Url');
      for (const [k, v] of Object.entries(extra)) h.set(k, v);
      return h;
    };

    // Smart streaming with Range support for progressive video
    let lastMediaStatus = 0;
    // Per-attempt trace, returned inside the 502 body. Without it a media failure is blind:
    // the format loop swallows exceptions, so "502" was all anyone ever saw.
    const dbgLog = [];
    const ytAuthForMedia = await getYoutubeCookieHeader(request);
    const rawRange = request.headers.get('range');
    // Cap open-ended / huge ranges to one chunk. An open `bytes=N-` would make the worker
    // try to stream the whole (possibly 100 MB+) file in a single upstream fetch; the relay
    // cuts that at its timeout, and the <video> element reads the short stream as broken and
    // retries from byte 0 forever — so long videos never play past the start and can't seek.
    // Returning a bounded 206 per request is exactly how normal HTTP video streaming works:
    // the browser just asks for the next chunk (and for the seek target on a seek).
    const RANGE_CHUNK = 4 * 1024 * 1024;
    let clientRange = rawRange;
    if (rawRange) {
      const rm = String(rawRange).match(/bytes=(\d+)-(\d*)/i);
      if (rm) {
        const rs = parseInt(rm[1], 10) || 0;
        const re = rm[2] ? parseInt(rm[2], 10) : -1;
        if (re < 0 || re - rs > RANGE_CHUNK) clientRange = 'bytes=' + rs + '-' + (rs + RANGE_CHUNK - 1);
      }
    } else if (!wantDownload) {
      // No Range header from the client (player's probe fetch, or an ingress like HF Spaces
      // that strips it). Never pull the whole file in a single upstream fetch — the relay /
      // direct fetch has a short timeout and the cut stream makes playback fail immediately.
      // Downloads always send explicit Range chunks, so wantDownload requests are untouched.
      clientRange = 'bytes=0-' + (RANGE_CHUNK - 1);
    }
    const rememberMediaUrl = (fmt, mime) => {
      try {
        const vid = String(videoId);
        let entry = MEDIA_URL_CACHE.get(vid);
        if (!entry) {
          entry = { exp: Date.now() + 6 * 60 * 1000, byItag: {} };
          MEDIA_URL_CACHE.set(vid, entry);
        }
        entry.exp = Date.now() + 6 * 60 * 1000;
        entry.byItag[String(fmt.itag)] = {
          url: fmt.url,
          mime: mime || fmt.mimeType || 'video/mp4',
          exp: Date.now() + 6 * 60 * 1000,
        };
        if (MEDIA_URL_CACHE.size > 80) {
          MEDIA_URL_CACHE.delete(MEDIA_URL_CACHE.keys().next().value);
        }
      } catch {
        /* ignore */
      }
    };

    // Reuse per-video itag map (Range/seek must not re-run fetchPlayerFormats)
    const vidCache = MEDIA_URL_CACHE.get(String(videoId));
    // EXACT itag only. The old 18/22 fallback served a different track than requested
    // while still labelling it as `prefer` — fatal for adaptive MSE, where an audio
    // request that returns video bytes silently corrupts the audio SourceBuffer.
    const mediaHit =
      vidCache && vidCache.exp > Date.now() && vidCache.byItag
        ? vidCache.byItag[String(prefer)]
        : null;
    if (mediaHit && mediaHit.exp > Date.now() && mediaHit.url) {
      try {
        // Reuse the SAME egress as the resolve step. Relay-signed googlevideo URLs are
        // IP-bound, so a direct Worker fetch here returns 403 on every Range/seek after
        // the first chunk - the video plays a few seconds then errors, and each miss
        // triggers a slow re-resolve. tryFetchMedia routes through the relay when set.
        const mediaRes = await tryFetchMedia(mediaHit.url);
        if (mediaRes && (mediaRes.ok || mediaRes.status === 206)) {
          const origCt = (mediaRes.headers.get('content-type') || mediaHit.mime || 'video/mp4').split(';')[0].trim();
          if (/html|json|text\/plain/i.test(origCt)) {
            if (vidCache?.byItag) delete vidCache.byItag[String(prefer)];
          } else {
            const cr = mediaRes.headers.get('content-range');
            const cl = mediaRes.headers.get('content-length');
            const h = new Headers();
            h.set('X-Etrog-Itag', prefer);
            h.set('X-Etrog-Cache', 'media-url');
            h.set('X-Etrog-Resolved-Url', mediaHit.url);
            if (cr) h.set('content-range', cr);
            return sealedStreamResponse(mediaRes.body, mediaRes.status, origCt.startsWith('video/') ? origCt : 'video/mp4', h, parseRangeStart(clientRange), cl);
          }
        } else if (vidCache?.byItag) {
          delete vidCache.byItag[String(prefer)];
        }
      } catch {
        if (vidCache?.byItag) delete vidCache.byItag[String(prefer)];
      }
    }

    const mediaUAs = [
      'com.google.android.youtube/20.50.37 (Linux; U; Android 14) gzip',
      'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36',
    ];

    // googlevideo signs every URL to the IP that resolved it, so the fetch has to come back
    // from that same place: formats resolved on the Worker are Cloudflare-signed and must be
    // fetched from Cloudflare, formats resolved through the home relay are residential-signed
    // and must go back out through the relay.
    //
    // This used to take the relay EXCLUSIVELY whenever one was configured, and returned null
    // the moment it failed — never attempting the direct path. So a dropped tunnel killed
    // playback outright even when the URLs were Cloudflare-signed and directly fetchable
    // (the player then showed "error playing" with a wall of 502s). Both routes are now
    // tried, ordered by where the URLs actually came from.
    async function tryRelayMedia(fmtUrl) {
      if (!relayConfigured(env)) return null;
      try {
        const r = await relayFetch(env, fmtUrl, {
          range: clientRange || undefined,
          userAgent: mediaUAs[1],
          signal: AbortSignal.timeout(8000),
        });
        if (!r) { dbgLog.push({ at: 'relay', st: 'null' }); return null; }
        lastMediaStatus = r.status;
        dbgLog.push({ at: 'relay', st: r.status, ct: r.headers.get('content-type'), cr: r.headers.get('content-range') });
        if (r.ok || r.status === 206) return r;
        try { await r.arrayBuffer(); } catch (_) {}
      } catch (e1) {
        dbgLog.push({ at: 'relay-throw', err: String((e1 && e1.message) || e1).slice(0, 120) });
      }
      return null;
    }

    async function tryDirectMedia(fmtUrl) {
      // 2 UAs × cookies-off first — hard 5s timeout so the Worker never hangs → 502
      for (const ua of mediaUAs) {
        for (const useCk of ytAuthForMedia ? [false, true] : [false]) {
          try {
            const fetchHeaders = {
              'user-agent': ua,
              origin: 'https://www.youtube.com',
              referer: 'https://www.youtube.com/watch?v=' + videoId,
              accept: '*/*',
              ...(useCk && ytAuthForMedia ? { cookie: ytAuthForMedia } : {}),
              ...(clientRange ? { range: clientRange } : {}),
            };
            const mediaRes = await fetch(fmtUrl, {
              headers: fetchHeaders,
              redirect: 'follow',
              signal: AbortSignal.timeout(5000),
            });
            lastMediaStatus = mediaRes.status;
            dbgLog.push({ at: 'direct', st: mediaRes.status, ct: mediaRes.headers.get('content-type'), cl: mediaRes.headers.get('content-length'), cr: mediaRes.headers.get('content-range'), ck: !!(useCk && ytAuthForMedia) });
            if (mediaRes.ok || mediaRes.status === 206) return mediaRes;
            try { await mediaRes.arrayBuffer(); } catch (_) {}
          } catch (e0) { dbgLog.push({ at: 'direct-throw', err: String((e0 && e0.message) || e0).slice(0, 120), ck: !!(useCk && ytAuthForMedia) }); }
        }
      }
      return null;
    }

    async function tryFetchMedia(fmtUrl) {
      const relayFirst = !!(pack && pack.via === 'home-relay');
      const first = relayFirst ? tryRelayMedia : tryDirectMedia;
      const second = relayFirst ? tryDirectMedia : tryRelayMedia;
      return (await first(fmtUrl)) || (await second(fmtUrl));
    }

    async function deliverMedia(mediaRes, fmt) {
      const origCt = (mediaRes.headers.get('content-type') || fmt.mimeType || 'video/mp4').split(';')[0].trim();
      rememberMediaUrl(fmt, origCt);

      const clHeader = mediaRes.headers.get('content-length');
      const contentLength = clHeader ? parseInt(clHeader, 10) : 0;
      const ctLow = (origCt || '').toLowerCase();
      if (ctLow.includes('text/html') || ctLow.includes('application/json') || ctLow.includes('text/plain')) {
        try { await mediaRes.arrayBuffer(); } catch (_) {}
        return null;
      }

      const reader = mediaRes.body.getReader();
      let firstChunk, done;
      try {
        const rd = await reader.read();
        firstChunk = rd.value; done = rd.done;
      } catch (eRead) {
        dbgLog.push({ at: 'first-read-throw', err: String(eRead && eRead.message || eRead).slice(0, 140) });
        try { reader.releaseLock(); } catch (_) {}
        return null;
      }
      if (done || !firstChunk || firstChunk.length < 8) {
        dbgLog.push({ at: 'first-read-empty', done: !!done, len: firstChunk ? firstChunk.length : 0 });
        try { reader.releaseLock(); } catch (_) {}
        return null;
      }
      if (looksLikeBlockOrHtml(firstChunk)) {
        try { reader.cancel(); } catch (_) {}
        try { reader.releaseLock(); } catch (_) {}
        lastMediaStatus = 451;
        return null;
      }

      const looksMedia =
        (firstChunk[4] === 0x66 && firstChunk[5] === 0x74 && firstChunk[6] === 0x79 && firstChunk[7] === 0x70) ||
        (firstChunk[0] === 0x1a && firstChunk[1] === 0x45) ||
        (firstChunk[0] === 0xff && (firstChunk[1] & 0xe0) === 0xe0) ||
        (firstChunk[0] === 0x49 && firstChunk[1] === 0x44 && firstChunk[2] === 0x33) ||
        (firstChunk[0] === 0x00 && firstChunk[1] === 0x00);

      // Only reject tiny non-media bodies (error pages). Short videos under 90KB are valid.
      if (!looksMedia && contentLength > 0 && contentLength < 2000) {
        try { reader.cancel(); } catch (_) {}
        try { reader.releaseLock(); } catch (_) {}
        return null;
      }

      const cr = mediaRes.headers.get('content-range');
      const statusOut = mediaRes.status === 206 ? 206 : 200;
      const plainBody = new ReadableStream({
        start(controller) {
          controller.enqueue(firstChunk);
          const pump = () =>
            reader.read().then(({ done: d, value }) => {
              if (d) {
                controller.close();
                try { reader.releaseLock(); } catch (_) {}
                return;
              }
              controller.enqueue(value);
              return pump();
            }).catch((err) => {
              try { controller.error(err); } catch (_) {}
              try { reader.releaseLock(); } catch (_) {}
            });
          return pump();
        },
        cancel() {
          try { reader.cancel(); } catch (_) {}
          try { reader.releaseLock(); } catch (_) {}
        }
      });

      // Playback + download: plain video/* (stealth /x/s path avoids most filters).
      // XOR-seal broke <video> when Service Worker was missing/outdated → error 4.
      // Thumbs remain sealed via /x/t.
      const h = new Headers();
      const ctOut = origCt.startsWith('video/') || origCt.startsWith('audio/') ? origCt : 'video/mp4';
      h.set('X-Etrog-Itag', String(fmt.itag));
      if (fmt.url) h.set('X-Etrog-Resolved-Url', fmt.url);
      h.set('X-Etrog-Client', pack.client || '');
      h.set('X-Etrog-Len', contentLength ? String(contentLength) : 'unknown');
      if (wantDownload) {
        h.set(
          'content-disposition',
          'attachment; filename="' + String(videoId).replace(/[^\w-]+/g, '_') + '.mp4"'
        );
      }
      if (cr) h.set('content-range', cr);
      return sealedStreamResponse(plainBody, statusOut, ctOut, h, parseRangeStart(clientRange), clHeader);
    }

    // Pass 1: try ordered formats
    for (const fmt of ordered.slice(0, 12)) {
      try {
        if (!fmt || !fmt.url) continue;
        const mediaRes = await tryFetchMedia(fmt.url);
        if (!mediaRes) continue;
        const out = await deliverMedia(mediaRes, fmt);
        if (out) return out;
      } catch (ePass) { dbgLog.push({ at: 'pass1-throw', itag: fmt && fmt.itag, err: String(ePass && ePass.message || ePass).slice(0, 140) }); }
    }

    // Pass 2: kids/restricted often need fresh formats with cookies (403 on stale/wrong-client URLs)
    if (lastMediaStatus === 403 || lastMediaStatus === 0 || lastMediaStatus === 451) {
      try {
        FORMAT_CACHE.delete(String(videoId));
        const pack2 = await getPlayerFormatsCached(videoId, request, env);
        if (pack2?.ok && pack2.formats?.length) {
          pack = pack2;
          const by2 = new Map(pack2.formats.map((f) => [String(f.itag), f]));
          const retryList = [];
          if (strict) {
            // MSE / exact-quality: retry ONLY the requested itag with fresh URLs. Never
            // substitute a different track (that fed audio bytes to a video buffer before).
            if (by2.has(prefer) && by2.get(prefer).url) retryList.push(by2.get(prefer));
          } else {
            for (const id of [prefer, '18', '22', '36', '17', '136', '134', '133', '140', '251']) {
              if (by2.has(id)) retryList.push(by2.get(id));
            }
            for (const f of pack2.formats) {
              if (!retryList.includes(f) && f.url) retryList.push(f);
            }
          }
          for (const fmt of retryList.slice(0, 12)) {
            try {
              const mediaRes = await tryFetchMedia(fmt.url);
              if (!mediaRes) continue;
              const out = await deliverMedia(mediaRes, fmt);
              if (out) return out;
            } catch { /* next */ }
          }
        }
      } catch { /* ignore */ }
    }

    // Pass 3: public Invidious "latest_version" proxy (helps kids/403 when googlevideo rejects CF IP).
    // Skipped for strict/adaptive requests — Invidious returns progressive muxed, which would
    // be the wrong track for an exact video-only or audio-only itag (breaks MSE).
    if (!strict && !reqIsAudio) {
      const invHosts = [
        'https://invidious.projectsegfaut.im',
        'https://invidious.flokinet.to',
        'https://yewtu.be',
        'https://invidious.nerdvpn.de',
        'https://vid.puffyan.us',
      ];
      const itagsTry = [prefer, '18', '22', '36', '17', '134', '133', '160'].filter(
        (v, i, a) => v && a.indexOf(v) === i
      );
      for (const host of invHosts) {
        for (const it of itagsTry) {
          try {
            const invUrl =
              host.replace(/\/$/, '') +
              '/latest_version?id=' +
              encodeURIComponent(videoId) +
              '&itag=' +
              encodeURIComponent(it) +
              '&local=true';
            const headers = {
              'user-agent':
                'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36',
              accept: '*/*',
              ...(clientRange ? { range: clientRange } : {}),
            };
            const mediaRes = await fetch(invUrl, {
              headers,
              redirect: 'follow',
              signal: AbortSignal.timeout(12000),
            });
            lastMediaStatus = mediaRes.status;
            if (!(mediaRes.ok || mediaRes.status === 206)) {
              try { await mediaRes.arrayBuffer(); } catch (_) {}
              continue;
            }
            const out = await deliverMedia(mediaRes, {
              itag: it,
              url: invUrl,
              mimeType: 'video/mp4',
              progressive: true,
              hasAudio: true,
              hasVideo: true,
            });
            if (out) return out;
          } catch {
            /* next host/itag */
          }
        }
      }
    }

    // Give client plain googlevideo URLs so browser (residential IP) can play if CF cannot fetch
    const directUrls = ordered
      .filter((f) => f && f.url && isAllowedMediaDirectUrl(f.url))
      .slice(0, 6)
      .map((f) => ({
        itag: String(f.itag),
        url: f.url,
        mime: String(f.mimeType || 'video/mp4').split(';')[0],
        progressive: !!f.progressive,
      }));
    // Append client-resolved URL last (residential IP) if server media fetch failed
    for (const c of clientDirectFallback || []) {
      if (c && c.url && !directUrls.some((d) => d.url === c.url)) directUrls.push(c);
    }
    return new Response(
      JSON.stringify({
        error: 'media fetch failed',
        videoId,
        lastMediaStatus,
        formatsTried: ordered.length,
        hasCookies: !!ytAuthForMedia,
        client: pack.client || '',
        directUrls,
        formatSummary: (pack.formats || []).slice(0, 12).map((f) => ({
          itag: f.itag,
          hasUrl: !!f.url,
          progressive: !!f.progressive,
          hasAudio: !!f.hasAudio,
          mime: String(f.mimeType || '').split(';')[0].slice(0, 32),
        })),
        dbg: dbgLog,
        hint:
          lastMediaStatus === 403 || lastMediaStatus === 500
            ? 'שרת Cloudflare נחסם מול googlevideo — הנגן ינסה ניגון ישיר מהדפדפן'
            : 'לא התקבל זרם מדיה תקין',
      }),
      {
        status: 502,
        headers: { 'content-type': 'application/json' },
      }
    );
  } catch (e) {
    return new Response(JSON.stringify({ error: 'yt-stream error', detail: String(e) }), {
      status: 502,
      headers: { 'content-type': 'application/json' }
    });
  }
}

async function handleInnertubePlayerApi(request, url, env) {
  const v = url.searchParams.get('v') || url.searchParams.get('videoId') || '';
  if (!v) return new Response(JSON.stringify({ error: 'missing video id' }), { status: 400, headers: { 'content-type': 'application/json' } });

  const res = await fetchPlayerFormats(v, request, env);
  if (!res || !res.ok || !res.formats || !res.formats.length) {
    return new Response(JSON.stringify({
      ok: false,
      videoId: v,
      status: res?.playability?.status || 'LOGIN_REQUIRED',
      reason: res?.playability?.reason || '',
      attempts: res?.attemptsLog || [],
      formats: []
    }), {
      status: 502,
      headers: { 'content-type': 'application/json', 'access-control-allow-origin': '*' }
    });
  }

  const formats = res.formats.map((f) => {
    const rawUrl = f.url || '';
    const mt = String(f.mimeType || f.mime || '');
    const hasA = !!(f.hasAudio || mt.includes('audio'));
    const hasV = !!(f.hasVideo || mt.includes('video'));
    const proxyUrl = '/x/s/' + (f.itag || '18') + '.bin?d=' + encodeURIComponent(encodeUrl(rawUrl)) + '&v=' + encodeURIComponent(v);
    return {
      itag: f.itag || 18,
      url: proxyUrl,
      mimeType: mt,
      bitrate: f.bitrate || 0,
      width: f.width || 0,
      height: f.height || 0,
      hasAudio: hasA,
      hasVideo: hasV,
      progressive: !!(hasA && hasV)
    };
  });

  return new Response(JSON.stringify({
    ok: formats.length > 0,
    videoId: v,
    status: 'OK',
    client: res.client,
    formats
  }), {
    status: 200,
    headers: { 'content-type': 'application/json', 'access-control-allow-origin': '*' }
  });
}


export default {
  async fetch(request, env, ctx) {
    const url = new URL(request.url);
    const configuredUUID = (env.UUID || DEFAULT_UUID).trim().toLowerCase();

    // 1. WebSocket VLESS Request handling
    if (request.headers.get('Upgrade')?.toLowerCase() === 'websocket') {
      const pathUuid = url.pathname.replace(/^\/+|\/+$/g, '').toLowerCase();
      const wsProtocol = request.headers.get('sec-websocket-protocol') || '';
      if (pathUuid === configuredUUID || pathUuid === 'vless' || pathUuid === '' || wsProtocol.includes(configuredUUID)) {
        return handleVlessWebsocket(request, configuredUUID, env);
      }
    }

    // 1.5 gRPC VLESS Request handling (HTTP/2 Bidirectional Streaming)
    const contentType = request.headers.get('content-type') || '';
    if (contentType.includes('application/grpc') || url.pathname.includes('grpc') || url.pathname.includes('Tun')) {
      return handleVlessGrpc(request, configuredUUID, env);
    }

    // 2. HTTP GET /<UUID> -> VLESS Configuration & Connection Dashboard
    const cleanPath = url.pathname.replace(/^\/+|\/+$/g, '').toLowerCase();
    if (cleanPath === 'test-proxyip') {
      return handleTestProxyIp(request, env);
    }
    if (cleanPath === configuredUUID) {
      return renderDashboard(request, env, configuredUUID);
    }

    // 3. Regular HTTP access -> Chrome Extension Privacy Policy page (Camouflage)
    return renderPrivacyPolicy(request);

    // ── Password gate: blocks ALL routes (/, /ytp, /cdn/, /api/*, /sw.js, …) ──
    // Session cookie only — re-prompt after browser close. Direct links need same session.
    {
      const gateRes = await requireGate(request, url, env);
      if (gateRes) return gateRes;
    }

    if (url.pathname === '/x/test-innertube') {
      const videoId = url.searchParams.get('v') || 'r32iWVO_9rE';
      const results = {};

      // Test 1: HTML page extraction (watch page)
      try {
        const watchUrl = 'https://www.youtube.com/watch?v=' + encodeURIComponent(videoId) + '&bpctr=9999999999&has_verified=1';
        const htmlRes = await tryHtmlPlayer(videoId, watchUrl, '');
        results.html_watch = {
          ok: htmlRes.ok,
          formatsCount: htmlRes.formats ? htmlRes.formats.length : 0,
          status: htmlRes.playability?.status || 'N/A',
          source: htmlRes.source
        };
      } catch (e) { results.html_watch = { error: String(e) }; }

      // Test 2: Embed page extraction
      try {
        const embedUrl = 'https://www.youtube.com/embed/' + encodeURIComponent(videoId);
        const embedRes = await tryHtmlPlayer(videoId, embedUrl, '');
        results.html_embed = {
          ok: embedRes.ok,
          formatsCount: embedRes.formats ? embedRes.formats.length : 0,
          status: embedRes.playability?.status || 'N/A',
          source: embedRes.source
        };
      } catch (e) { results.html_embed = { error: String(e) }; }

      // Test Piped API instances
      const pipedInstances = [
        'https://api.piped.privacydev.net/streams/',
        'https://pipedapi.kavin.rocks/streams/',
        'https://pipedapi.lunar.icu/streams/',
        'https://pipedapi.mha.fi/streams/',
        'https://pipedapi.adminforge.de/streams/'
      ];

      for (const host of pipedInstances) {
        try {
          const r = await fetch(host + videoId, { headers: { 'user-agent': 'Mozilla/5.0' }, signal: AbortSignal.timeout(4000) });
          if (r.ok) {
            const j = await r.json();
            const streams = (j.audioStreams || []).concat(j.videoStreams || []);
            if (streams.length > 0) {
              results.piped = {
                ok: true,
                host,
                title: j.title,
                formatsCount: streams.length,
                sampleUrl: streams[0].url ? (streams[0].url.substring(0, 40) + '...') : ''
              };
              break;
            }
          }
        } catch(e) { results['piped_err_' + host] = e.message; }
      }

      // Test Invidious API instances
      const invidiousInstances = [
        'https://invidious.nerdvpn.de/api/v1/videos/',
        'https://inv.tux.pizza/api/v1/videos/',
        'https://invidious.drg.cat/api/v1/videos/',
        'https://yt.drgnz.club/api/v1/videos/'
      ];

      for (const host of invidiousInstances) {
        try {
          const r = await fetch(host + videoId, { headers: { 'user-agent': 'Mozilla/5.0' }, signal: AbortSignal.timeout(4000) });
          if (r.ok) {
            const j = await r.json();
            const streams = (j.formatStreams || []).concat(j.adaptiveFormats || []);
            if (streams.length > 0) {
              results.invidious = {
                ok: true,
                host,
                title: j.title,
                formatsCount: streams.length,
                sampleUrl: streams[0].url ? (streams[0].url.substring(0, 40) + '...') : ''
              };
              break;
            }
          }
        } catch(e) { results['invidious_err_' + host] = e.message; }
      }

      return new Response(JSON.stringify(results, null, 2), { headers: { 'content-type': 'application/json', 'access-control-allow-origin': '*' } });
    }

    // ── Dedicated InnerTube player format resolver endpoint (/x/i/player) ──
    if (url.pathname === '/x/i/player') {
      return handleInnertubePlayerApi(request, url, env);
    }

    // ── Audio download as real MP3 (relay + local ffmpeg) ──
    if (url.pathname === '/api/audio-mp3') {
      return handleAudioMp3(request, url, env);
    }

    // ── Stealth media aliases (/x/s and /x/s/*.bin) ──
    if (
      url.pathname === '/api/yt-stream' ||
      url.pathname === '/api/m' ||
      url.pathname === '/api/media' ||
      url.pathname === '/x/s' ||
      url.pathname.startsWith('/x/s/') ||
      url.pathname === '/assets/chunk' ||
      url.pathname.startsWith('/assets/chunk-')
    ) {
      return handleYtStream(request, url, env);
    }

    // ── Generic image proxy for search results (/x/p) ──
    if (url.pathname === '/x/p') {
      return serveProxiedImage(request, url);
    }

    // ── Stealth thumbs /x/t (token) + legacy /api/i ──
    if (url.pathname === '/x/t') {
      // decode d= token {v,q}
      let v = '';
      let quality = 'hq720';
      const d = url.searchParams.get('d');
      if (d) {
        try {
          const raw = decodeUrl(d);
          const j = JSON.parse(raw);
          if (j && j.v) v = String(j.v).replace(/[^\w-]/g, '');
          if (j && j.q) quality = String(j.q);
        } catch (_) {}
      }
      if (!v) v = String(url.searchParams.get('v') || '').replace(/[^\w-]/g, '');
      if (url.searchParams.get('q')) quality = String(url.searchParams.get('q'));
      return serveYoutubeThumb(v, quality, request);
    }

    // ג”€ג”€ Route: /ytp native player (always works) ג”€ג”€
    if (url.pathname === '/ytp' || url.pathname === '/player' || url.pathname === '/yt-player') {
      let v = url.searchParams.get('v') || url.searchParams.get('id') || '';
      const d = url.searchParams.get('d');
      const prefillQ = url.searchParams.get('q') || url.searchParams.get('search_query') || '';
      if (d) {
        try {
          const tok = decodeMediaToken(d);
          if (tok?.v) v = tok.v;
        } catch {}
      }
      // Allow empty v — player opens search UI (no forced sample video)
      return youtubeNativePlayerPage(v, url.origin, null, prefillQ, env);
    }

    // ── Route: /api/health ──
    if (url.pathname === '/api/health') {
      return new Response(JSON.stringify({
        ok: true,
        name: 'maakaf-full-proxy',
        sw: SW_VERSION,
        time: new Date().toISOString()
      }), {
        headers: { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' }
      });
    }

    // ── Route: /api/i  (legacy) → sealed thumb helper ──
    if (url.pathname === '/api/i') {
      const v = String(url.searchParams.get('v') || '').replace(/[^\w-]/g, '');
      let quality = String(url.searchParams.get('q') || 'hq720');
      return serveYoutubeThumb(v, quality, request);
    }

    // ── Route: /api/yt-formats — adaptive+progressive list for the MSE player ──
    if (url.pathname === '/api/yt-formats') {
      const v = String(url.searchParams.get('v') || '').replace(/[^\w-]/g, '');
      if (!v) {
        return new Response(JSON.stringify({ ok: false, error: 'missing v' }), {
          status: 400, headers: { 'content-type': 'application/json; charset=utf-8' },
        });
      }
      const pack = await getPlayerFormatsCached(v, request, env);
      if (!pack || !pack.ok || !pack.formats || !pack.formats.length) {
        return new Response(JSON.stringify({
          ok: false, videoId: v,
          relayConfigured: pack?.relayConfigured !== false,
          relayErr: pack?.relayErr || null,
          playability: pack?.playability || null,
        }), { status: 502, headers: { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' } });
      }
      const fmts = pack.formats.map((f) => ({
        itag: f.itag,
        mime: String(f.mimeType || f.mime || '').trim(),
        width: f.width || 0,
        height: f.height || 0,
        bitrate: f.bitrate || 0,
        hasAudio: !!f.hasAudio,
        hasVideo: !!f.hasVideo,
        progressive: !!(f.progressive || (f.hasAudio && f.hasVideo)),
      })).filter((f) => f.itag != null);
      return new Response(JSON.stringify({ ok: true, videoId: v, client: pack.client || '', formats: fmts }), {
        headers: { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' },
      });
    }

    // ── Route: /api/yt-meta ──
    if (url.pathname === '/api/yt-meta') {
      const v = String(url.searchParams.get('v') || '').replace(/[^\w-]/g, '');
      if (!v) {
        return new Response(JSON.stringify({ error: 'missing v' }), {
          status: 400,
          headers: { 'content-type': 'application/json; charset=utf-8' },
        });
      }
      const meta = await youtubeVideoMeta(v, url.origin);
      return new Response(JSON.stringify({ ok: true, ...meta }), {
        headers: { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' },
      });
    }

    // ── Route: /api/yt-channel ──
    if (url.pathname === '/api/yt-channel') {
      const id = String(url.searchParams.get('id') || '').trim();
      const name = String(url.searchParams.get('name') || '').trim();
      try {
        const page = await youtubeChannelPage(id, name, url.origin);
        return new Response(
          JSON.stringify({
            ok: true,
            id: page.meta.channelId || id,
            name: page.meta.title || name,
            meta: page.meta,
            results: page.results,
          }),
          {
            headers: { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' },
          }
        );
      } catch (e) {
        return new Response(JSON.stringify({ error: String(e), results: [], meta: {} }), {
          status: 502,
          headers: { 'content-type': 'application/json; charset=utf-8' },
        });
      }
    }

    // ── Route: /api/yt-search ──
    if (url.pathname === '/api/yt-search') {
      const q = (url.searchParams.get('q') || '').trim();
      if (!q) {
        return new Response(JSON.stringify({ error: 'missing q' }), {
          status: 400,
          headers: { 'content-type': 'application/json; charset=utf-8' },
        });
      }
      try {
        const pack = await youtubeSearchQuery(q, url.origin);
        return new Response(
          JSON.stringify({ ok: true, q, results: pack.results, source: pack.source }),
          {
            headers: { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' },
          }
        );
      } catch (e) {
        return new Response(JSON.stringify({ error: String(e), results: [] }), {
          status: 502,
          headers: { 'content-type': 'application/json; charset=utf-8' },
        });
      }
    }

    // ── Route: /websearch — our own results page (web / images / videos / news) ──
    // Everything is rendered here, so the user never lands on an engine that can
    // challenge a datacenter IP with an "I am not a robot" page.
    if (url.pathname === '/websearch') {
      const q = (url.searchParams.get('q') || '').trim();
      const tab = (url.searchParams.get('t') || 'web').trim();
      const page = url.searchParams.get('p');
      let pack = { tab: SEARCH_TABS.some((t) => t.id === tab) ? tab : 'web', page: 1, results: [], source: 'empty' };
      if (q) {
        try { pack = await universalSearch(q, tab, page, env, url.origin); }
        catch (e) { pack = { ...pack, results: [], source: 'error' }; }
      }
      // "מרגיש בר מזל" — jump straight to the top hit (through the gate, never direct).
      if (url.searchParams.get('lucky') === '1' && pack.results && pack.results.length) {
        const top = pack.results[0];
        const dest = top.videoId ? '/ytp?v=' + encodeURIComponent(top.videoId)
          : (top.url || top.page) ? '/gate?to=' + encodeUrl(top.url || top.page)
          : null;
        if (dest) return Response.redirect(url.origin + dest, 302);
      }
      return new Response(searchResultsPage(q, pack, url.origin), {
        headers: { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store', 'referrer-policy': 'no-referrer' },
      });
    }

    // ── Route: /api/suggest — query autocomplete for the search bar ──
    if (url.pathname === '/api/suggest') {
      const q = (url.searchParams.get('q') || '').trim();
      const suggestions = q ? await fetchSuggestions(q) : [];
      return new Response(JSON.stringify({ ok: true, q, suggestions }), {
        headers: { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'public, max-age=300' },
      });
    }

    // ── Route: /api/websearch — JSON results (same verticals) ──
    if (url.pathname === '/api/websearch') {
      const q = (url.searchParams.get('q') || '').trim();
      if (!q) {
        return new Response(JSON.stringify({ ok: false, error: 'missing q', results: [] }), {
          status: 400, headers: { 'content-type': 'application/json; charset=utf-8' },
        });
      }
      try {
        const pack = await universalSearch(q, url.searchParams.get('t') || 'web', url.searchParams.get('p'), env, url.origin);
        return new Response(JSON.stringify({
          ok: true, q, tab: pack.tab, page: pack.page,
          source: pack.source, answer: pack.answer || null, results: pack.results,
        }), {
          headers: { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' },
        });
      } catch (e) {
        return new Response(JSON.stringify({ ok: false, error: String(e), results: [] }), {
          status: 502, headers: { 'content-type': 'application/json; charset=utf-8' },
        });
      }
    }

    // ── Route: /api/resolve-helper ──
    if (url.pathname === '/api/resolve-helper') {
      if (request.method !== 'POST') {
        return new Response('method not allowed', { status: 405 });
      }
      const auth = request.headers.get('authorization');
      if (auth !== 'Bearer ' + relaySecret(env)) {
        return new Response('unauthorized', { status: 401 });
      }
      try {
        const body = await request.json();
        const videoId = body.videoId;
        const client = body.client;
        const cookie = body.cookie || '';
        const res = await tryInnertubeClient(videoId, client, cookie);
        return new Response(JSON.stringify(res), {
          headers: { 'content-type': 'application/json; charset=utf-8' }
        });
      } catch (e) {
        return new Response(JSON.stringify({ ok: false, error: e.message }), {
          status: 500,
          headers: { 'content-type': 'application/json' }
        });
      }
    }

    // ── Route: /sw.js ──
    if (url.pathname === '/sw.js') {
      return new Response(SW_JS, {
        headers: { 'Content-Type': 'application/javascript; charset=utf-8', 'Cache-Control': 'no-cache, no-store', 'Service-Worker-Allowed': '/' }
      });
    }

    // ג”€ג”€ Route: /import-cookies ג”€ג”€
    if (url.pathname === '/import-cookies') {
      if (url.searchParams.get('clear') === '1') {
        try {
          const cache = caches.default;
          for (const d of ['youtube.com', 'www.youtube.com', 'google.com', 'www.google.com', 'accounts.google.com', 'nachotoy.com', 'default-target']) {
            await cache.delete(new Request('https://cookie-store.local/cookies/' + d));
          }
        } catch (e) {}
        return new Response(null, {
          status: 302,
          headers: {
            'Location': '/import-cookies',
            'Set-Cookie': '__proxy_target=; Path=/; Expires=Thu, 01 Jan 1970 00:00:00 GMT'
          }
        });
      }
      return request.method === 'POST' ? importCookiesPost(request) : importCookiesForm();
    }

    // ── Route: /gate (Pre-SW gate for SPAs) ──
    if (url.pathname === '/gate') {
      const to = url.searchParams.get('to') || '';
      return makeGateResponse(to, url.origin);
    }

    // ג”€ג”€ Parse cookies ג”€ג”€
    const cookieHeader = request.headers.get('cookie') || '';
    const cookies = parseCookies(cookieHeader);
    let baseProxyTarget = null;
    if (cookies.__proxy_target) {
      try { baseProxyTarget = decodeURIComponent(cookies.__proxy_target); } catch {}
    }
    // Referer-based target resolution (solves iframe/multi-domain conflicts)
    const refererHeader = request.headers.get('referer');
    if (refererHeader) {
      try {
        const refUrl = new URL(refererHeader);
        if (refUrl.origin === url.origin) {
          if (refUrl.pathname.startsWith(PROXY_PATH) || refUrl.pathname.startsWith('/proxy/')) {
            const enc = refUrl.pathname.startsWith(PROXY_PATH)
              ? refUrl.pathname.slice(PROXY_PATH.length)
              : refUrl.pathname.slice('/proxy/'.length);
            const decodedRef = decodeUrl(enc.split('/')[0]);
            if (decodedRef) baseProxyTarget = new URL(decodedRef).origin;
          }
        }
      } catch (e) {}
    }
    // Bare SPA paths → force youtube.com, but ONLY in a YouTube context.
    // The old code forced YouTube unconditionally for many GENERIC paths (/feed, /live,
    // /watch, /channel, /playlist, …). That broke any OTHER proxied site that uses those
    // same path names: its /feed or /live request was hijacked to youtube.com. We now only
    // hijack when we are actually browsing YouTube (or have no active site yet), which still
    // covers the YT SPA and YT embeds (their referer/target already resolve to youtube).
    const p0 = url.pathname || '';
    const refLow = (request.headers.get('referer') || '').toLowerCase();
    const ytContext =
      !baseProxyTarget ||                       // fresh/direct load → app defaults to YouTube
      /youtube\.com/i.test(baseProxyTarget) ||  // already browsing YouTube
      refLow.includes('youtube');               // referred from a (proxied) YouTube page
    // Namespaces that are unambiguously YouTube's own API/assets — safe to force always.
    const ytExclusivePath =
      p0.startsWith('/youtubei/') ||
      p0.startsWith('/yts/') ||
      p0.startsWith('/get_video_info');
    // Path names that OTHER sites also use — only force YouTube when we are in a YT context.
    const ytAmbiguousPath =
      p0.startsWith('/s/') ||
      p0.startsWith('/results') ||
      p0.startsWith('/watch') ||
      p0.startsWith('/embed') ||
      p0.startsWith('/shorts') ||
      p0.startsWith('/live') ||
      p0.startsWith('/playlist') ||
      p0.startsWith('/channel') ||
      p0.startsWith('/c/') ||
      p0.startsWith('/user/') ||
      p0.startsWith('/@') ||
      p0.startsWith('/feed') ||
      p0.startsWith('/api/stats') ||
      p0.startsWith('/generate_204') ||
      p0.startsWith('/ptracking') ||
      p0.startsWith('/pagead') ||
      p0.startsWith('/youtube/') ||
      (p0.startsWith('/img/') && refLow.includes('youtube'));
    if (ytExclusivePath || (ytAmbiguousPath && ytContext)) {
      baseProxyTarget = 'https://www.youtube.com';
    }
    // Full YouTube search UI is broken via SPA; redirect to sealed player search —
    // but only in a YT context, so a different site's /results page is not hijacked.
    if ((p0 === '/results' || p0.startsWith('/results')) && ytContext) {
      const q = url.searchParams.get('search_query') || url.searchParams.get('q') || '';
      const dest = q ? `/ytp?q=${encodeURIComponent(q)}` : '/ytp';
      return Response.redirect(url.origin + dest, 302);
    }
    // NOTE: do NOT use shared Cache API default-target here — Workers cache is
    // shared across visitors and would leak browsing sessions between users.

    // ── Route: / (home or proxy-through-cookie) ──
    if (url.pathname === '/' || url.pathname === '/index.html') {
      if (url.searchParams.get('__proxy_reset') === '1' || url.searchParams.get('home') === '1') {
        try { await caches.default.delete(new Request('https://cookie-store.local/cookies/default-target')); } catch (e) {}
        return new Response(UI_HTML, {
          status: 200,
          headers: {
            'Content-Type': 'text/html; charset=utf-8',
            'Cache-Control': 'no-cache, no-store, must-revalidate',
            'Set-Cookie': '__proxy_target=; Path=/; Expires=Thu, 01 Jan 1970 00:00:00 GMT'
          }
        });
      }
      // No active browsing session → portal UI
      if (!baseProxyTarget) {
        return new Response(UI_HTML, {
          headers: { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-cache, no-store, must-revalidate' }
        });
      }
      // Background/non-document hits on "/" must not get silent 204 — show portal
      const accept = (request.headers.get('accept') || '').toLowerCase();
      const fetchDest0 = request.headers.get('sec-fetch-dest') || '';
      const fetchMode0 = request.headers.get('sec-fetch-mode') || '';
      const looksLikeDocument =
        fetchDest0 === 'document' ||
        fetchMode0 === 'navigate' ||
        (request.method === 'GET' && accept.includes('text/html'));
      if (!looksLikeDocument) {
        return new Response(UI_HTML, {
          headers: { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-cache, no-store, must-revalidate' }
        });
      }
      // YouTube SPA home is unreliable — send to sealed player (unless ?yt_ui=1)
      if (
        /youtube\.com/i.test(baseProxyTarget) &&
        url.searchParams.get('yt_ui') !== '1'
      ) {
        return Response.redirect(url.origin + '/ytp', 302);
      }
    }

    // ג”€ג”€ Resolve target URL ג”€ג”€
    let targetUrl = null;
    let resolvedFromBarePath = false;
    if (url.pathname.startsWith(PROXY_PATH) || url.pathname.startsWith('/proxy/')) {
      const encoded = url.pathname.startsWith(PROXY_PATH)
        ? url.pathname.slice(PROXY_PATH.length)
        : url.pathname.slice('/proxy/'.length);
      const parts = encoded.split('/');
      let decoded = decodeUrl(parts[0]);
      if (decoded) {
        if (decoded.startsWith('//')) decoded = 'https:' + decoded;
        let decodedUrlObj = null;
        try {
          decodedUrlObj = new URL(decoded);
        } catch {
          try { decodedUrlObj = new URL('https://' + decoded.replace(/^https?:\/\//, '')); } catch {}
        }
        if (decodedUrlObj) {
          targetUrl = decodedUrlObj;
          if (parts.length > 1) {
            const restPath = '/' + parts.slice(1).join('/');
            targetUrl.pathname = targetUrl.pathname.replace(/\/$/, '') + restPath;
            for (const [k, v] of url.searchParams.entries()) {
              targetUrl.searchParams.set(k, v);
            }
          }
        }
      }
    } else if (baseProxyTarget) {
      try { targetUrl = new URL(url.pathname + url.search, baseProxyTarget); } catch {}
      // A path the rewriter never produced: SPA routing, a JS-built link, or a reload of one.
      // It carries no target of its own and is only as good as whatever __proxy_target/Referer
      // happen to say — which is exactly how a session ends up pointed at the wrong origin.
      resolvedFromBarePath = !!targetUrl;
    }

    // ג”€ג”€ Load cached cookies for target domain ג”€ג”€
    let mergedCookieHeader = cookieHeader;
    if (targetUrl) {
      try {
        const cachedCookies = await getCookiesFromCache(targetUrl.hostname);
        if (cachedCookies) {
          const clientMap = parseCookies(cookieHeader);
          const cachedMap = parseCookies(cachedCookies);
          const mergedMap = Object.assign({}, cachedMap, clientMap);
          mergedCookieHeader = Object.entries(mergedMap).map(([k, v]) => `${k}=${v}`).join('; ');
        }
      } catch (e) {}
    }

    if (!targetUrl) return Response.redirect(url.origin + '/', 302);

    // ── SSRF guard: refuse to proxy loopback / private / link-local / metadata targets ──
    // The proxy exists for public sites; a private target here can only be an attempt to
    // reach the Worker's internal network, cloud metadata (169.254.169.254), or the relay.
    if (!isSafePublicUrl(targetUrl)) {
      if (isAssetRequest((request.headers.get('sec-fetch-dest') || ''), targetUrl.pathname)) {
        return assetFallback(request, targetUrl);
      }
      return new Response(JSON.stringify({ error: 'blocked_target', reason: 'private or non-http(s) address' }), {
        status: 400,
        headers: { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' },
      });
    }

    // Send a bare-path PAGE load to its canonical /cdn/<token> address. After this the URL
    // says which site it belongs to, so a reload, a bookmark or a Back no longer depend on
    // session state that a third-party iframe could have moved. Only top-level documents are
    // redirected — sub-resources and XHR must be answered in place.
    if (resolvedFromBarePath && request.method === 'GET') {
      const navHint0 = request.headers.get('X-Proxy-Navigation') || '';
      const dest0 = (request.headers.get('sec-fetch-dest') || '').toLowerCase();
      const mode0 = (request.headers.get('sec-fetch-mode') || '').toLowerCase();
      const topLevel = navHint0 === 'top' || (dest0 === 'document' && navHint0 !== 'frame') ||
        (dest0 !== 'iframe' && navHint0 !== 'frame' && mode0 === 'navigate');
      if (topLevel) {
        return Response.redirect(url.origin + PROXY_PATH + encodeUrl(targetUrl.toString()), 302);
      }
    }

    // Brave Search CDN chunk redirect
    if (targetUrl.hostname.toLowerCase() === 'search.brave.com' && targetUrl.pathname.startsWith('/chunks/')) {
      targetUrl = new URL('https://cdn.search.brave.com/serp/v1/static' + targetUrl.pathname + targetUrl.search);
    }

    // ג”€ג”€ Normalize domains ג”€ג”€
    targetUrl = normalizeYouTubeHost(targetUrl);
    const targetStr = targetUrl.toString();
    const isYT = isYouTubeDomain(targetUrl.hostname);

    // ג”€ג”€ googlevideo direct ג†’ yt-stream (prevents 403 IP mismatch) ג”€ג”€
    if (isGoogleVideoUrl(targetStr) || /googlevideo\.com|gvt1\.com|gvt2\.com/i.test(targetUrl.hostname)) {
      const rawCookie = request.headers.get('cookie') || '';
      const cookieVidMatch = rawCookie.match(/(?:^|;\s*)__yt_vid=([^;]+)/);
      let vid =
        cookies.__yt_vid ||
        (cookieVidMatch ? cookieVidMatch[1] : '') ||
        url.searchParams.get('v') ||
        url.searchParams.get('__yt_vid') ||
        '';
      try {
        const ref = request.headers.get('referer') || '';
        const ru = new URL(ref);
        if (!vid) vid = ru.searchParams.get('v') || extractYoutubeVideoId(ru) || '';
        if (!vid && ru.searchParams.get('d')) {
          const tok = decodeMediaToken(ru.searchParams.get('d'));
          if (tok && tok.v) vid = tok.v;
        }
      } catch (e) {}
      try {
        vid = decodeURIComponent(String(vid || ''));
      } catch (e) {}
      const itag = targetUrl.searchParams.get('itag') || '18';
      if (vid) {
        const streamUrl = new URL(url.origin + '/api/m');
        streamUrl.searchParams.set('v', vid);
        streamUrl.searchParams.set('i', itag);
        return handleYtStream(request, streamUrl, env);
      }
      return new Response(null, {
        status: 204,
        headers: { 'access-control-allow-origin': '*', 'cache-control': 'no-store' }
      });
    }

    // ג”€ג”€ YouTube video pages ג†’ native reliable player (Google blocks /watch on CF IPs) ג”€ג”€
    {
      const fetchDestNav = request.headers.get('sec-fetch-dest') || '';
      const fetchModeNav = request.headers.get('sec-fetch-mode') || '';
      const acceptNav = (request.headers.get('accept') || '').toLowerCase();
      const isHtmlNav =
        request.method === 'GET' &&
        (fetchDestNav === 'document' ||
          fetchDestNav === 'iframe' ||
          fetchModeNav === 'navigate' ||
          request.headers.get('X-Proxy-Navigation') === '1' ||
          acceptNav.includes('text/html'));
      if (isYT && isHtmlNav) {
        const p = targetUrl.pathname || '';
        const isVideoPath =
          p.startsWith('/watch') ||
          p.startsWith('/shorts/') ||
          p.startsWith('/embed/') ||
          p.startsWith('/live/') ||
          p.startsWith('/v/');
        const vid = extractYoutubeVideoId(targetUrl);
        // Allow ?yt_ui=1 to force original YouTube shell (often broken)
        const forceUi = targetUrl.searchParams.get('yt_ui') === '1' || url.searchParams.get('yt_ui') === '1';
        if (!forceUi) {
          // Search / browse SPA → sealed player
          if (p.startsWith('/results')) {
            const q = targetUrl.searchParams.get('search_query') || targetUrl.searchParams.get('q') || '';
            return Response.redirect(url.origin + (q ? `/ytp?q=${encodeURIComponent(q)}` : '/ytp'), 302);
          }
          if (p === '/' || p.startsWith('/feed')) {
            return Response.redirect(url.origin + '/ytp', 302);
          }
        }
        if (vid && isVideoPath && !forceUi) {
          const headers = new Headers({
            'content-type': 'text/html; charset=utf-8',
            'cache-control': 'no-store',
            'x-etrog-player': 'native-yt-stream',
            'set-cookie': `__yt_vid=${encodeURIComponent(vid)}; Path=/; Max-Age=86400; SameSite=Lax; Secure`
          });
          const page = youtubeNativePlayerPage(vid, url.origin, null, '', env);
          // Rebuild with set-cookie
          const body = await page.text();
          return new Response(body, { status: 200, headers });
        }
      }
    }

    // ג”€ג”€ TMDB API proxy (Nachotoy) ג”€ג”€
    if (targetUrl.pathname === '/api/tmdb') {
      let urlParam = targetUrl.searchParams.get('url');
      if (urlParam) {
        const spacesMatch = urlParam.match(/^(\s+)(.*)$/);
        if (spacesMatch) {
          const len = spacesMatch[1].length;
          const rest = spacesMatch[2];
          if (len === 32) urlParam = 'https://api.themoviedb.org/3/tv/' + rest;
          else if (len === 35) urlParam = 'https://api.themoviedb.org/3/movie/' + rest;
        } else { urlParam = urlParam.trim(); }
        targetUrl.searchParams.set('url', urlParam);
      }
    }

    // (Bypassed redirect so googlevideo.com streams are proxied with CORS via the worker)

    // ג”€ג”€ consent.youtube.com / consent.google.com ג†’ set virtualized cookies + redirect ג”€ג”€
    if (targetUrl.hostname.startsWith('consent.')) {
      const continueUrl = targetUrl.searchParams.get('continue') || targetUrl.searchParams.get('next') || baseProxyTarget || ('https://www.' + targetUrl.hostname.replace(/^consent\./, '') + '/');
      const h = new Headers();
      h.set('location', url.origin + PROXY_PATH + encodeUrl(continueUrl));
      const mainDomain = targetUrl.hostname.replace(/^consent\./, '');
      const hex = hexEncode(mainDomain);
      h.append('set-cookie', `__proxy_cookie_${hex}_CONSENT=YES+cb.20210328-17-p0.en+FX+667; Path=/; Max-Age=31536000; Secure; SameSite=None`);
      h.append('set-cookie', `__proxy_cookie_${hex}_SOCS=CAE=; Path=/; Max-Age=31536000; Secure; SameSite=None`);
      applyCorsHeaders(h, request);
      return new Response(null, { status: 302, headers: h });
    }

    // ג”€ג”€ Blocked / filtered domains ג”€ג”€
    if (isFilterDomain(targetStr)) {
      const fh = new Headers({ 'Content-Type': 'application/json' });
      applyCorsHeaders(fh, request);
      return new Response(request.method === 'OPTIONS' ? null : '{}', { status: request.method === 'OPTIONS' ? 204 : 200, headers: fh });
    }
    if (isBlocked(targetStr)) {
      const bh = new Headers();
      applyCorsHeaders(bh, request);
      if (isSoftBlocked(targetStr)) {
        bh.set('content-type', 'application/json');
        return new Response('{}', { status: 200, headers: bh });
      }
      return new Response(null, { status: 204, headers: bh });
    }

    // ג”€ג”€ OPTIONS preflight ג”€ג”€
    if (request.method === 'OPTIONS') {
      const oh = new Headers({ 'Access-Control-Max-Age': '86400' });
      applyCorsHeaders(oh, request);
      return new Response(null, { status: 204, headers: oh });
    }

    // ג”€ג”€ Block noisy telemetry ג”€ג”€
    if (targetUrl.pathname.includes('/log_event') || targetUrl.pathname.includes('/log_interaction')) {
      const th = new Headers({ 'content-type': 'application/json' });
      applyCorsHeaders(th, request);
      return new Response('{}', { status: 200, headers: th });
    }

    // ג”€ג”€ Build outbound request headers ג”€ג”€
    const outHeaders = new Headers();
    for (const [key, val] of request.headers.entries()) {
      const lk = key.toLowerCase();
      if (!lk.startsWith('cf-') && lk !== 'host' && lk !== 'x-real-ip' && lk !== 'x-forwarded-for' && lk !== 'referer' && lk !== 'accept-encoding') {
        outHeaders.set(key, val);
      }
    }
    outHeaders.set('host', targetUrl.host);
    if (request.headers.has('origin')) outHeaders.set('origin', targetUrl.origin);
    if (!outHeaders.has('user-agent')) {
      outHeaders.set('user-agent', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36');
    }
    outHeaders.set('referer', (baseProxyTarget || targetUrl.origin) + '/');
    outHeaders.set('accept-language', 'he-IL,he;q=0.9,en-US;q=0.8,en;q=0.7');

    // NEVER forward client IP to signed-CDN hosts (YouTube/Netflix/etc) ג€” causes 403 IP mismatch
    const clientIP = request.headers.get('cf-connecting-ip') || '';
    const noForwardIp = isYT || isGoogleVideoUrl(targetStr) ||
      /netflix|nflx|tiktok|byteoversea|bytedance|akamaihd|cloudfront|fastly|cdninstagram|fbcdn|twimg/i.test(targetUrl.hostname);
    if (clientIP && !noForwardIp) {
      outHeaders.set('x-forwarded-for', clientIP);
    } else {
      outHeaders.delete('x-forwarded-for');
      outHeaders.delete('x-real-ip');
      outHeaders.delete('forwarded');
    }

    // Remove sec- headers for YouTube to reduce fingerprint
    for (const k of ['sec-fetch-dest', 'sec-fetch-mode', 'sec-fetch-site', 'sec-ch-ua', 'sec-ch-ua-mobile', 'sec-ch-ua-platform']) {
      if (request.headers.has(k) && !(isYT && k.startsWith('sec-ch-ua'))) outHeaders.set(k, request.headers.get(k));
      else outHeaders.delete(k);
    }

    // ג”€ג”€ Build cookies for target ג”€ג”€
    const targetCookies = buildTargetCookies(mergedCookieHeader, targetUrl, isYT, env);
    if (targetCookies.length > 0) outHeaders.set('cookie', targetCookies.join('; '));
    else outHeaders.delete('cookie');

    // ג”€ג”€ WebSocket ג”€ג”€
    if (request.headers.get('Upgrade') === 'websocket') {
      try {
        const wsResp = await fetch(targetStr, { headers: outHeaders });
        return new Response(null, { status: 101, webSocket: wsResp.webSocket });
      } catch { return new Response('WebSocket error', { status: 502 }); }
    }

    // ג”€ג”€ Request body ג”€ג”€
    let reqBody = null;
    if (request.method !== 'GET' && request.method !== 'HEAD' && request.body) {
      reqBody = await request.arrayBuffer();
      if (!outHeaders.has('content-type') && request.headers.has('content-type')) {
        outHeaders.set('content-type', request.headers.get('content-type'));
      }
      outHeaders.delete('content-length');
    }

    // ג”€ג”€ YouTube InnerTube API ג”€ג”€
    const isApi = targetUrl.pathname.includes('/youtubei/') || targetUrl.pathname.includes('/v1/player') || targetUrl.pathname.includes('/next');
    if (isApi) {
      if (!outHeaders.has('x-youtube-client-name')) outHeaders.set('x-youtube-client-name', '1');
      if (!outHeaders.has('x-youtube-client-version')) outHeaders.set('x-youtube-client-version', '2.20240726.00.00');
      outHeaders.set('origin', 'https://www.youtube.com');
      outHeaders.set('referer', 'https://www.youtube.com/');
      // SAPISIDHASH computation
      try {
        const cStr = outHeaders.get('cookie') || '';
        const m = cStr.match(/(?:^|;\s*)__Secure-3PAPISID=([^;]+)/);
        if (m) {
          const ts = Math.floor(Date.now() / 1000).toString();
          const toHash = ts + ' ' + m[1] + ' https://www.youtube.com';
          const hashBuf = await crypto.subtle.digest('SHA-1', new TextEncoder().encode(toHash));
          const hashHex = Array.from(new Uint8Array(hashBuf)).map(b => b.toString(16).padStart(2, '0')).join('');
          outHeaders.set('authorization', 'SAPISIDHASH ' + ts + '_' + hashHex);
          outHeaders.set('x-goog-authuser', '0');
        }
      } catch {}
    }

    // ג”€ג”€ Fetch from origin ג”€ג”€
    try {
      const response = await fetch(targetStr, {
        method: request.method,
        headers: outHeaders,
        body: reqBody,
        redirect: isApi ? 'follow' : 'manual',
        cf: { cacheTtl: 0, cacheEverything: false }
      });

      // ג”€ג”€ YouTube API response ג”€ג”€
      if (isApi) {
        const apiH = new Headers(response.headers);
        applyCorsHeaders(apiH, request);
        stripSecurityHeaders(apiH);
        if (response.status === 403) {
          apiH.set('content-type', 'application/json');
          return new Response(JSON.stringify({ error: 'forbidden', proxied: true }), { status: 200, headers: apiH });
        }
        let apiText = await response.text();
        apiText = rewritePlayerApiJson(apiText, url.origin);
        apiText = rewriteJsonUrls(apiText, url.origin);
        try { apiText = rewriteAllHttpUrls(apiText, url.origin); } catch (e) {}
        apiH.set('content-type', 'application/json; charset=utf-8');
        cleanTransferHeaders(apiH);
        return new Response(apiText, { status: response.status, statusText: response.statusText, headers: apiH });
      }

      // ג”€ג”€ Redirects ג”€ג”€
      if ([301, 302, 303, 307, 308].includes(response.status)) {
        const location = response.headers.get('location');
        if (location) {
          const absLoc = new URL(location, targetStr).toString();
          if (absLoc.includes('google.com/sorry/')) {
            return makeSorryResponse(url.origin, extractYoutubeVideoId(targetUrl) || extractYoutubeVideoId(absLoc), env);
          }
          const rh = new Headers(response.headers);
          rh.set('location', url.origin + PROXY_PATH + encodeUrl(absLoc));
          return new Response(null, { status: response.status, statusText: response.statusText, headers: rh });
        }
      }

      const contentType = response.headers.get('content-type') || '';
      const fetchDest = request.headers.get('sec-fetch-dest') || '';
      const fetchMode = request.headers.get('sec-fetch-mode') || '';
      const isNavigation = fetchDest === 'document' || fetchDest === 'iframe' || fetchMode === 'navigate' || request.headers.get('X-Proxy-Navigation') === '1';
      const isXhrObfuscate = request.headers.get('X-Proxy-Obfuscate') === '1'; // do NOT seal JS/CSS by default

      // ג”€ג”€ generate_204 / ytimg.com image endpoints ג”€ג”€
      if (targetUrl.pathname.includes('generate_204') || targetUrl.pathname === '/gen_204') {
        if (fetchDest === 'image' || (request.headers.get('accept') || '').includes('image/')) {
          const gifBytes = new Uint8Array(atob('R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7').split('').map(c => c.charCodeAt(0)));
          const gh = new Headers({ 'content-type': 'image/gif' });
          applyCorsHeaders(gh, request);
          return new Response(gifBytes, { status: 200, headers: gh });
        }
        const h204 = new Headers();
        applyCorsHeaders(h204, request);
        return new Response(null, { status: 204, headers: h204 });
      }

      // ג”€ג”€ ytimg.com images ג”€ג”€
      if (targetUrl.hostname === 'i.ytimg.com' && fetchDest === 'image') {
        const imgH = new Headers(response.headers);
        applyCorsHeaders(imgH, request);
        stripSecurityHeaders(imgH);
        imgH.set('Cache-Control', 'public, max-age=3600');
        return new Response(response.body, { status: response.status, headers: imgH });
      }

      // ג”€ג”€ YouTube root non-navigation (background pings only) ג”€ג”€
      const acceptHdr = (request.headers.get('accept') || '').toLowerCase();
      if (isYT && targetUrl.pathname === '/' && !isNavigation && !acceptHdr.includes('text/html')) {
        const h204 = new Headers();
        applyCorsHeaders(h204, request);
        return new Response(null, { status: 204, headers: h204 });
      }

      // ── Media / Range responses (NEVER run HTMLRewriter on binary) ──
      // Scania & similar CDNs disguise MPEG-TS segments as text/html (e.g. page-0.html)
      const pathLowMedia = (targetUrl.pathname || '').toLowerCase();
      const hostLowMedia = (targetUrl.hostname || '').toLowerCase();
      const isScania =
        hostLowMedia.includes('amerii.ca') ||
        hostLowMedia.includes('scania') ||
        pathLowMedia.includes('/content/') ||
        pathLowMedia.includes('/pl/') ||
        pathLowMedia.includes('/hls/') ||
        pathLowMedia.includes('/dash/') ||
        /\.ts(?:$|\?)/i.test(targetUrl.href) ||
        /\.m4s(?:$|\?)/i.test(targetUrl.href) ||
        /\.mp4(?:$|\?)/i.test(targetUrl.href) ||
        /\.webm(?:$|\?)/i.test(targetUrl.href) ||
        /page-\d+\.html/i.test(pathLowMedia) ||
        /seg(?:ment)?[-_]?\d+/i.test(pathLowMedia);
      // NOTE: do NOT treat m3u8/mpegurl as binary media here — playlists need rewriteM3u8 below
      const isPlaylist =
        contentType.includes('mpegurl') ||
        contentType.includes('m3u8') ||
        pathLowMedia.endsWith('.m3u8') ||
        pathLowMedia.endsWith('.mpd');
      const isMedia =
        !isPlaylist &&
        (request.headers.has('range') ||
          response.status === 206 ||
          contentType.includes('video/') ||
          contentType.includes('audio/') ||
          contentType.includes('mp2t') ||
          hostLowMedia.includes('googlevideo.com') ||
          hostLowMedia.includes('gvt1.com') ||
          pathLowMedia.includes('videoplayback') ||
          isScania ||
          request.headers.get('sec-fetch-dest') === 'video' ||
          request.headers.get('sec-fetch-dest') === 'audio');
      if (isMedia) {
        const mh = new Headers(response.headers);
        applyCorsHeaders(mh, request);
        // Keep content-length / content-range for progressive media — only strip encoding
        mh.delete('content-encoding');
        mh.delete('transfer-encoding');
        stripSecurityHeaders(mh);
        mh.set('accept-ranges', 'bytes');
        // Force a media content-type when upstream lies with text/html
        if (isScania && (contentType.includes('text/html') || !contentType)) {
          if (/\.m3u8/i.test(pathLowMedia)) mh.set('content-type', 'application/vnd.apple.mpegurl');
          else if (/\.mp4|\.m4s/i.test(pathLowMedia)) mh.set('content-type', 'video/mp4');
          else mh.set('content-type', 'video/mp2t');
        }
        return new Response(response.body, { status: response.status, statusText: response.statusText, headers: mh });
      }

      // ג”€ג”€ JSON / API Responses ג”€ג”€
      const isJson = contentType.includes('application/json') || isApi;
      if (isJson) {
        let jsonText = await response.text();
        if (isYT || /youtube|googlevideo|ytimg/i.test(jsonText.slice(0, 3000))) {
          jsonText = rewritePlayerApiJson(jsonText, url.origin);
          jsonText = rewriteJsonUrls(jsonText, url.origin);
        }
        try { jsonText = rewriteAllHttpUrls(jsonText, url.origin); } catch (e) {}
        // News/SPA sites deliver their article text as JSON over XHR, so this payload is just
        // as classifiable as the HTML document — seal it too when the SW asks.
        if (isXhrObfuscate) {
          return sealedResponse(new TextEncoder().encode(jsonText), response.status,
            'application/json; charset=utf-8', { 'cache-control': 'no-store' }, 0);
        }
        const jhJson = new Headers(response.headers);
        applyCorsHeaders(jhJson, request);
        cleanTransferHeaders(jhJson);
        stripSecurityHeaders(jhJson);
        jhJson.set('content-type', 'application/json; charset=utf-8');
        return new Response(jsonText, { status: response.status, headers: jhJson });
      }

      // ── HTML ──
      if (contentType.includes('text/html')) {
        const destExpect = (request.headers.get('sec-fetch-dest') || '').toLowerCase();
        const pathLow = (targetUrl.pathname || '').toLowerCase();
        // A script/style/image/etc. request that got HTML → return a valid empty asset, never
        // the HTML (which caused "Unexpected token '<'"). navigations/documents fall through.
        if (isAssetRequest(destExpect, pathLow)) {
          return assetFallback(request, targetUrl);
        }
        if (targetUrl.hostname.includes('google.com') && targetUrl.pathname.includes('/sorry/')) {
          return makeSorryResponse(url.origin, null, env);
        }
        // STREAM the rewritten HTML. HTMLRewriter injects our scripts + the anti-filter guard
        // and rewrites URLs/CSS as bytes flow through — no buffering, no XOR/base64, no
        // document.write. The old buffer+seal+inline-base64+document.write did ~10 full passes
        // over the page and blew the Worker CPU budget on big sites (Ynet ~600KB → CF 1102/1104
        // + long spinner) and then re-parsed the whole page client-side.
        const rewritten = rewriteHtmlResponse(response, targetUrl, url.origin, baseProxyTarget);
        // __proxy_target is what a BARE path (one the rewriter never saw — SPA routing, a
        // JS-built link, a reload) resolves against, so it must track only the page the user
        // is actually on. Setting it for every HTML response let any cross-origin <iframe> or
        // HTML-returning XHR silently repoint the whole session at a CDN/S3 bucket; the next
        // bare path then resolved to <bucket>/path and S3 answered AccessDenied.
        const navHint = request.headers.get('X-Proxy-Navigation') || '';
        const isTopLevelDoc =
          navHint === 'top' ||
          (fetchDest === 'document' && navHint !== 'frame') ||
          (!fetchDest && navHint === '1') ||
          (fetchDest !== 'iframe' && navHint !== 'frame' && fetchMode === 'navigate');
        const targetCookie = isTopLevelDoc
          ? `__proxy_target=${encodeURIComponent(targetUrl.origin)}; Path=/; Max-Age=31536000; SameSite=Lax; Secure`
          : '';
        // The on-path filter (Rimon/Etrog) classifies pages by BODY, not URL: cleartext HTML
        // for ynet/mako comes back replaced by a block page (`rimon: RWC_BLOCK`). When the
        // Service Worker asks for a sealed document we XOR the stream, so the filter only sees
        // opaque bytes; the SW unseals it before the renderer ever gets it. Still streaming —
        // buffering a 600 KB page here used to blow the Worker CPU budget.
        // same-origin, NOT no-referrer: every proxied sub-request is same-origin (a /cdn/ URL
        // on this Worker), and its Referer is how a bare path is resolved back to the right
        // site. no-referrer blinded that and left the pollutable cookie as the only signal.
        // Cross-origin requests still send nothing, so no target site learns where we came from.
        const refPolicy = 'same-origin';
        if (isXhrObfuscate && !isTopLevelDoc) {
          const sealHeaders = { 'referrer-policy': refPolicy };
          if (targetCookie) sealHeaders['set-cookie'] = targetCookie;
          return sealedStreamResponse(rewritten.body, response.status, 'text/html; charset=utf-8', sealHeaders, 0, null);
        }
        const oh = new Headers(rewritten.headers);
        applyCorsHeaders(oh, request);
        cleanTransferHeaders(oh);
        stripSecurityHeaders(oh);
        oh.set('content-type', 'text/html; charset=utf-8');
        oh.set('cache-control', 'no-store');
        oh.set('referrer-policy', refPolicy);
        if (targetCookie) oh.set('set-cookie', targetCookie);
        else oh.delete('set-cookie');
        return new Response(rewritten.body, { status: response.status, headers: oh });
      }

      // CSS
      if (contentType.includes('text/css')) {
        let cssText = await response.text();
        cssText = cssText.replace(/url\(\s*['"]?([^'")\s]+)['"]?\s*\)/g, (match, relUrl) => {
          if (relUrl.startsWith('data:')) return match;
          try {
            const absUrl = new URL(relUrl, targetStr).toString();
            return "url('" + url.origin + PROXY_PATH + encodeUrl(absUrl) + "')";
          } catch { return match; }
        });
        const ch = new Headers(response.headers);
        applyCorsHeaders(ch, request);
        cleanTransferHeaders(ch);
        stripSecurityHeaders(ch);
        ch.set('Cache-Control', 'public, max-age=3600');
        ch.set('content-type', 'text/css; charset=utf-8');
        return new Response(cssText, { status: response.status, headers: ch });
      }

      // ── JavaScript (MUST stay unsealed — sealing breaks YT modules with SyntaxError ~) ──
      if (contentType.includes('javascript') || fetchDest === 'script' || targetUrl.pathname.endsWith('.js')) {
        const jsBuffer = await response.arrayBuffer();
        // Do NOT rewrite URLs inside JS: it corrupts regex literals / escaped "https:\/\/" and
        // throws SyntaxErrors that break the whole page. The Service Worker proxies the runtime
        // fetch/XHR/import requests these scripts make, so source rewriting is unnecessary.
        let jsText = new TextDecoder().decode(jsBuffer);
        // If the origin returned an HTML/error page for a script request (a block page, a
        // consent wall, a 4xx/5xx), never serve it as JS — that is the "Unexpected token '<'".
        if (!response.ok || /^\s*<(?:!doctype|html|head|body|\?xml)/i.test(jsText.slice(0, 200))) {
          return assetFallback(request, targetUrl);
        }
        const jh = new Headers(response.headers);
        applyCorsHeaders(jh, request);
        cleanTransferHeaders(jh);
        stripSecurityHeaders(jh);
        jh.set('content-type', 'application/javascript; charset=utf-8');
        jh.set('Cache-Control', 'public, max-age=3600');
        return new Response(jsText, { status: response.status, headers: jh });
      }

      // ג”€ג”€ M3U8 Playlist ג”€ג”€
      const isM3u8 = contentType.includes('mpegurl') || contentType.includes('m3u8') || targetUrl.pathname.endsWith('.m3u8');
      if (isM3u8) {
        const m3u8Text = await response.text();
        const rewritten = rewriteM3u8(m3u8Text, targetStr, url.origin);
        const mh = new Headers(response.headers);
        applyCorsHeaders(mh, request);
        cleanTransferHeaders(mh);
        stripSecurityHeaders(mh);
        mh.set('content-type', 'application/x-mpegURL');
        return new Response(rewritten, { status: response.status, headers: mh });
      }

      // ג”€ג”€ All other content types ג”€ג”€
      const rh = new Headers(response.headers);
      applyCorsHeaders(rh, request);
      cleanTransferHeaders(rh);
      stripSecurityHeaders(rh);

      // Cache static YouTube assets
      if (targetUrl.hostname.includes('ytimg.com') || targetUrl.hostname.includes('ggpht.com') || targetUrl.pathname.startsWith('/s/')) {
        rh.set('Cache-Control', 'public, max-age=3600');
      }

      // Rewrite Refresh header
      const refresh = rh.get('refresh');
      if (refresh) {
        const rm = refresh.match(/^(\d+;\s*url=)(.*)$/i);
        if (rm) {
          const rawUrl = rm[2].replace(/^['"]|['"]$/g, '');
          try { rh.set('refresh', rm[1] + url.origin + PROXY_PATH + encodeUrl(new URL(rawUrl, targetStr).toString())); } catch {}
        }
      }

      // Virtualize Set-Cookie headers
      let setCookies = [];
      try { setCookies = response.headers.getSetCookie(); } catch {}
      rh.delete('set-cookie');
      for (const vc of virtualizeSetCookies(setCookies, targetUrl.hostname)) {
        rh.append('set-cookie', vc);
      }

      // XOR obfuscation for non-standard content
      if (isXhrObfuscate && response.body) {
        const buffer = await response.arrayBuffer();
        rh.set('X-Original-Content-Type', rh.get('content-type') || 'application/octet-stream');
        rh.set('content-type', 'application/octet-stream');
        rh.set('X-Proxy-Obfuscated', '1');
        return new Response(xorBytes(new Uint8Array(buffer)), { status: response.status, headers: rh });
      }

      return new Response(response.body, { status: response.status, statusText: response.statusText, headers: rh });

    } catch (e) {
      // Retry once
      try {
        const retryResp = await fetch(targetStr, {
          method: request.method,
          headers: outHeaders,
          body: request.method !== 'GET' && request.method !== 'HEAD' ? reqBody : null,
          redirect: 'manual'
        });
        const retryH = new Headers(retryResp.headers);
        applyCorsHeaders(retryH, request);
        cleanTransferHeaders(retryH);
        stripSecurityHeaders(retryH);
        return new Response(retryResp.body, { status: retryResp.status, headers: retryH });
      } catch (retryErr) {
        // Asset request \u2192 empty valid asset (never a Hebrew text/plain body that a <script>
        // would choke on with "Unexpected token"). Navigations get the readable error page.
        if (isAssetRequest((request.headers.get('sec-fetch-dest') || ''), (targetUrl && targetUrl.pathname) || '')) {
          return assetFallback(request, targetUrl);
        }
        const eh = new Headers({ 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store' });
        applyCorsHeaders(eh, request);
        return new Response('<!doctype html><meta charset="utf-8"><body dir="rtl" style="font-family:system-ui;background:#fff;color:#0f172a;padding:2rem"><h1>\u05E9\u05D2\u05D9\u05D0\u05D4 \u05D1\u05D7\u05D9\u05D1\u05D5\u05E8 \u05DC\u05D0\u05EA\u05E8</h1><p>' + String(retryErr && retryErr.message || '').replace(/[<>&]/g, '') + '</p><p><a href="/?home=1" style="color:#2563eb">\u05D7\u05D6\u05E8\u05D4 \u05DC\u05D3\u05E3 \u05D4\u05D1\u05D9\u05EA</a></p></body>', { status: 502, headers: eh });
      }
    }
  }
};