✨ feat(bookSource): 重写聚合书源，支持小说/听书/漫画/短剧与段评

- 朴素相对 URL 模式：searchUrl/bookUrl/tocUrl/chapterUrl 全链路，跨规则状态 java.put 传递，弃用 data:;base64 链（真实阅读端解码语义不符） - 四模式分流：小说/听书/漫画/短剧；搜索支持 x:/t:/m:/d: 前缀；听书优先视频原声回退 TTS，短剧走 CENC 解密代理直链自动播放，空正文回退漫画图片（兼容 data 与 data.images 两种响应结构） - 段评气泡：对接 /content?review=keep 注入的 <comment> 标记，纯 JS base64（规避部分版本 API 差异），点击打开 /review_html 评论页 - 发现页：设置选择按钮两两一行、男频/女频频道切换（分类减半）、搜索框按类型自动加前缀、分类一行 3 个统一排版 - 短剧搜索 video_data 字段归一化（series_id→book_id、title→book_name、cover→thumb_url、演员→author） - 兼容性：设置存取走 cache（全规则环境可用），BaseUrl 三级兜底（source→book.origin→baseUrl），段评正则兼容 <p idx> 属性，无登录页依赖
🔧 fix(deploy): nginx 模板自带 443 配置，防止 --sync-nginx 覆盖证书段
2026-10-10 02:09:29 +08:00 · 2026-10-10 02:09:29 +08:00 · 2026-10-09 23:56:32 +08:00 · 2026-10-09 23:04:59 +08:00
14 changed files with 1117 additions and 80 deletions
@@ -47,6 +47,7 @@ __pycache__
 /build/

 cache.db
+video_cache/

 # Build output
 fanqie-*
@@ -0,0 +1,61 @@
+[
+  {
+    "bookSourceComment": "fanqie-go 聚合书源：一个源覆盖 小说/听书/漫画/短剧。\n\n【设置入口】发现页顶部选择按钮：模式/音色/清晰度/段评/图片/频道，点选即生效；",
+    "bookSourceGroup": "🍅 番茄",
+    "bookSourceName": "🍅 番茄聚合",
+    "bookSourceType": 0,
+    "bookSourceUrl": "https://fq.20010117.xyz",
+    "customOrder": 0,
+    "enabled": true,
+    "enabledCookieJar": false,
+    "enabledExplore": true,
+    "header": "{\"User-Agent\": \"Mozilla/5.0 (Linux; Android 13; 2210132C Build/TP1A.220624.014; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/116.0.5845.92 Mobile Safari/537.36\"}",
+    "jsLib": "// ============ 源变量配置（照光遇模式：defaultConfig 兜底，全 try-catch） ============\nconst defaultConfig = {\n    模式: \"小说\",\n    音色: \"0\",\n    清晰度: \"max\",\n    段评: \"开\",\n    图片: \"保留\"\n};\n\nconst fqVarsKey = 'fq_vars';\n\nfunction getVariable(k) {\n    if (k == undefined) k = \"\";\n    var parsed = {};\n    try {\n        var raw = String(cache.get(fqVarsKey) || '');\n        if (raw) parsed = JSON.parse(raw);\n    } catch (e) {}\n    if (k == \"\") return parsed;\n    var value = parsed[k];\n    if (value == undefined) value = defaultConfig[k];\n    return value != undefined ? value : \"\";\n}\n\nfunction setVariable(k, v, t) {\n    if (t == undefined) t = true;\n    var parsed = {};\n    try {\n        var raw = String(cache.get(fqVarsKey) || '');\n        if (raw) parsed = JSON.parse(raw);\n    } catch (e) {}\n    parsed[k] = v;\n    try { cache.put(fqVarsKey, JSON.stringify(parsed)); } catch (e) {}\n    if (t) java.toast('\\n设置 ' + k + ' 为 ' + v);\n}\n\n// 发现页筛选按钮回调：存变量并刷新发现页\nfunction show(m, t) {\n    setVariable(t, m, false);\n    java.toast('\\n已设置' + t + '：' + m + '\\n已在书架的书切换模式后需刷新目录');\n    try { java.refreshExplore(); } catch (e) {}\n}\n\nfunction createFilter(title, chars, defaultVal, paramKey, size, viewName) {\n    if (viewName == undefined) viewName = \"'请选择类型'\";\n    return {\n        title: title,\n        type: \"select\",\n        chars: chars,\n        default: defaultVal,\n        \"viewName\": viewName,\n        action: `show(infoMap['${title}'],'${paramKey}')`,\n        style: {\n            layout_flexGrow: 1,\n            layout_flexBasisPercent: size\n        }\n    };\n}\n\n// ============ 基础工具 ============\nfunction BaseUrl() {\n    var u = '';\n    try {\n        if (typeof source != 'undefined' && source && source.getKey) u = String(source.getKey());\n    } catch (e) {}\n    if (!u) {\n        try {\n            if (typeof book != 'undefined' && book && book.origin) u = String(book.origin);\n        } catch (e) {}\n    }\n    if (!u) {\n        try {\n            if (typeof baseUrl != 'undefined') {\n                var m = String(baseUrl).match(/^https?:\\/\\/[^\\/]+/);\n                if (m) u = m[0];\n            }\n        } catch (e) {}\n    }\n    return u.replace(/\\/+$/, '');\n}\n\nfunction request(url) {\n    let urla = url;\n    if (!url.includes('http')) urla = this.BaseUrl() + url;\n    return java.ajax(urla);\n}\n\nfunction parseJsonSafely(str, defaultValue) {\n    if (defaultValue == null) defaultValue = null;\n    try {\n        return JSON.parse(str);\n    } catch (e) {\n        return defaultValue;\n    }\n}\n\nfunction isIOS() {\n    try {\n        java.deviceID();\n        return true;\n    } catch (e) {\n        return false;\n    }\n}\n\nfunction isMod() {\n    try {\n        if (typeof java.reLoginView == 'function') return true;\n        new Packages.io.legato.kazusa.utils.TimeoutCancellationException('');\n        return true;\n    } catch (e) {\n        return false;\n    }\n}\n\n// 纯 JS base64（UTF-8），规避部分阅读版本 base64 编码 API 不可用\nfunction b64encode(str) {\n    var chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';\n    var bytes = [];\n    str = String(str);\n    for (var i = 0; i < str.length; i++) {\n        var c = str.charCodeAt(i);\n        if (c < 0x80) {\n            bytes.push(c);\n        } else if (c < 0x800) {\n            bytes.push(0xC0 | (c >> 6), 0x80 | (c & 63));\n        } else {\n            bytes.push(0xE0 | (c >> 12), 0x80 | ((c >> 6) & 63), 0x80 | (c & 63));\n        }\n    }\n    var out = '';\n    for (var j = 0; j < bytes.length; j += 3) {\n        var b1 = bytes[j];\n        var b2 = j + 1 < bytes.length ? bytes[j + 1] : undefined;\n        var b3 = j + 2 < bytes.length ? bytes[j + 2] : undefined;\n        out += chars[b1 >> 2];\n        out += chars[((b1 & 3) << 4) | (b2 == undefined ? 0 : b2 >> 4)];\n        out += b2 == undefined ? '=' : chars[((b2 & 15) << 2) | (b3 == undefined ? 0 : b3 >> 6)];\n        out += b3 == undefined ? '=' : chars[b3 & 63];\n    }\n    return out;\n}\n\n// ============ 段评气泡（/content?review=keep 注入 <comment> 标记，点击打开 /review_html 页面） ============\nfunction createSvg(number, url) {\n    var t = number > 99 ? '99+' : String(number);\n    var svg = `<svg xmlns='http://www.w3.org/2000/svg' width='100' height='90' viewBox='0 0 25 17' fill='none'><path stroke='currentColor' stroke-width='1.00' stroke-linecap='round' stroke-linejoin='round' stroke-miterlimit='4.00' style='stroke:#A7A7A7;stroke-opacity:0.5;stroke-width:1px;stroke-linejoin:round;fill:transparent;fill-opacity:0.5;' d='M 7.5 0.5 L 16.5 0.5 A 7 7 0 0 1 23.5 7.5 L 23.5 7.5 A 7 7 0 0 1 16.5 14.5 L 8.5 14.5 L 5.192 16.5 L 5.5 14.5 A 7 7 30 0 1 0.5 7.5 L 0.5 7.5 A 7 7 0 0 1 7.5 0Line truncated
+    "lastUpdateTime": 1791569184668,
+    "respondTime": 180000,
+    "exploreUrl": "<js>\nvar groups = {\"🔥 男频精选\": [{\"title\": \"玄幻\", \"url\": \"/category-landing?category_id=7&offset={{(page-1)*20}}\"}, {\"title\": \"都市\", \"url\": \"/category-landing?category_id=1&offset={{(page-1)*20}}\"}, {\"title\": \"历史\", \"url\": \"/category-landing?category_id=12&offset={{(page-1)*20}}\"}, {\"title\": \"悬疑\", \"url\": \"/category-landing?category_id=10&offset={{(page-1)*20}}\"}, {\"title\": \"衍生\", \"url\": \"/category-landing?category_id=1079&offset={{(page-1)*20}}\"}, {\"title\": \"同人\", \"url\": \"/category-landing?category_id=538&offset={{(page-1)*20}}\"}, {\"title\": \"科幻末世\", \"url\": \"/category-landing?category_id=8&offset={{(page-1)*20}}\"}, {\"title\": \"奇幻仙侠\", \"url\": \"/category-landing?category_id=259&offset={{(page-1)*20}}\"}, {\"title\": \"种田\", \"url\": \"/category-landing?category_id=23&offset={{(page-1)*20}}\"}, {\"title\": \"游戏体育\", \"url\": \"/category-landing?category_id=746&offset={{(page-1)*20}}\"}, {\"title\": \"系统\", \"url\": \"/category-landing?category_id=19&offset={{(page-1)*20}}\"}, {\"title\": \"重生\", \"url\": \"/category-landing?category_id=36&offset={{(page-1)*20}}\"}, {\"title\": \"穿越\", \"url\": \"/category-landing?category_id=37&offset={{(page-1)*20}}\"}, {\"title\": \"多女主\", \"url\": \"/category-landing?category_id=91&offset={{(page-1)*20}}\"}, {\"title\": \"修仙\", \"url\": \"/category-landing?category_id=517&offset={{(page-1)*20}}\"}, {\"title\": \"二次元\", \"url\": \"/category-landing?category_id=39&offset={{(page-1)*20}}\"}, {\"title\": \"搞笑轻松\", \"url\": \"/category-landing?category_id=778&offset={{(page-1)*20}}\"}, {\"title\": \"单女主\", \"url\": \"/category-landing?category_id=389&offset={{(page-1)*20}}\"}, {\"title\": \"悬疑灵异\", \"url\": \"/category-landing?category_id=751&offset={{(page-1)*20}}\"}, {\"title\": \"末日求生\", \"url\": \"/category-landing?category_id=515&offset={{(page-1)*20}}\"}, {\"title\": \"娱乐圈\", \"url\": \"/category-landing?category_id=43&offset={{(page-1)*20}}\"}, {\"title\": \"末世\", \"url\": \"/category-landing?category_id=68&offset={{(page-1)*20}}\"}], \"🌸 女频精选\": [{\"title\": \"现代言情\", \"url\": \"/category-landing?category_id=3&offset={{(page-1)*20}}\"}, {\"title\": \"古代言情\", \"url\": \"/category-landing?category_id=5&offset={{(page-1)*20}}\"}, {\"title\": \"纯爱\", \"url\": \"/category-landing?category_id=1012&offset={{(page-1)*20}}\"}, {\"title\": \"甜宠\", \"url\": \"/category-landing?category_id=96&offset={{(page-1)*20}}\"}, {\"title\": \"总裁\", \"url\": \"/category-landing?category_id=29&offset={{(page-1)*20}}\"}, {\"title\": \"幻想言情\", \"url\": \"/category-landing?category_id=32&offset={{(page-1)*20}}\"}, {\"title\": \"双男主\", \"url\": \"/category-landing?category_id=275&offset={{(page-1)*20}}\"}, {\"title\": \"双女主\", \"url\": \"/category-landing?category_id=704&offset={{(page-1)*20}}\"}, {\"title\": \"年代\", \"url\": \"/category-landing?category_id=79&offset={{(page-1)*20}}\"}, {\"title\": \"快穿\", \"url\": \"/category-landing?category_id=24&offset={{(page-1)*20}}\"}, {\"title\": \"豪门总裁\", \"url\": \"/category-landing?category_id=748&offset={{(page-1)*20}}\"}, {\"title\": \"追妻火葬场\", \"url\": \"/category-landing?category_id=616&offset={{(page-1)*20}}\"}, {\"title\": \"无CP\", \"url\": \"/category-landing?category_id=392&offset={{(page-1)*20}}\"}, {\"title\": \"大女主\", \"url\": \"/category-landing?category_id=760&offset={{(page-1)*20}}\"}, {\"title\": \"女强\", \"url\": \"/category-landing?category_id=86&offset={{(page-1)*20}}\"}], \"🏷️ 男频标签\": [{\"title\": \"古代\", \"url\": \"/category-landing?category_id=758&offset={{(page-1)*20}}\"}, {\"title\": \"历史古代\", \"url\": \"/category-landing?category_id=273&offset={{(page-1)*20}}\"}, {\"title\": \"轻小说\", \"url\": \"/category-landing?category_id=858&offset={{(page-1)*20}}\"}, {\"title\": \"都市生活\", \"url\": \"/category-landing?category_id=2&offset={{(page-1)*20}}\"}, {\"title\": \"都市高武\", \"url\": \"/category-landing?category_id=1014&offset={{(page-1)*20}}\"}, {\"title\": \"游戏动漫\", \"url\": \"/category-landing?category_id=57&offset={{(page-1)*20}}\"}, {\"title\": \"抗战谍战\", \"url\": \"/category-landing?category_id=504&offset={{(page-1)*20}}\"}, {\"title\": \"体育\", \"url\": \"/category-landing?category_id=15&offset={{(page-1)*20}}\"}, {\"title\": \"都市异能\", \"url\": \"/category-landing?category_id=516&offset={{(page-1)*20}}\"}, {\"title\": \"武侠\", \"url\": \"/category-landing?category_id=16&offset={{(page-1)*20}}\"}, {\"title\": \"东方仙侠\", \"url\": \"/category-landing?category_id=1140&offset={{(page-1)*20}}\"}, {\"title\": \"东方玄幻\", \"url\": \"/category-landing?category_id=511&offset={{(page-1)*20}}\"}, {\"title\": \"男频衍生\", \"url\": \"/category-landing?categorLine truncated
+    "searchUrl": "<js>\nvar tab = getVariable('模式');\nvar m = String(key).match(/^([xtmdXTMD])[::：]/);\nvar q = String(key);\nif (m) {\n    tab = {x: '小说', t: '听书', m: '漫画', d: '短剧'}[m[1].toLowerCase()];\n    q = q.slice(2);\n}\njava.put('fq_search_tab', tab);\nvar typeMap = {'小说': 3, '听书': 2, '漫画': 8, '短剧': 11};\n`/search?query=${encodeURIComponent(q)}&tab_type=${typeMap[tab] || 3}&offset=${(page - 1) * 10}`;\n</js>",
+    "ruleSearch": {
+      "author": "author",
+      "bookList": "<js>\nvar tab = java.get('fq_search_tab') || getVariable('模式');\nvar d = parseJsonSafely(result, {});\nvar list = [];\n(d.data || []).forEach(function (b) {\n    if (b.book_data) {\n        b.book_data.forEach(function (x) {\n            x.fq_tab = tab;\n            list.push(x);\n        });\n    } else if (b.video_data) {\n        // 短剧字段与书籍不同，归一化为 book_data 结构（book_id 用 series_id 走通 detail/catalog）\n        b.video_data.forEach(function (v) {\n            list.push({\n                book_id: v.series_id || v.vid,\n                book_name: v.title || v.raw_book_name,\n                author: (v.video_detail && v.video_detail.actor) || '',\n                thumb_url: v.cover || '',\n                abstract: v.sub_title || '',\n                category: v.sub_title || '',\n                fq_tab: tab\n            });\n        });\n    }\n});\nJSON.stringify({data: list});\n</js>$.data",
+      "bookUrl": "<js>\n'/detail?book_id=' + result.book_id + '&tab=' + (result.fq_tab || getVariable('模式'));\n</js>",
+      "checkKeyWord": "十日终焉",
+      "coverUrl": "thumb_url",
+      "intro": "abstract",
+      "kind": "category",
+      "name": "book_name",
+      "wordCount": "word_number"
+    },
+    "ruleExplore": {
+      "author": "author",
+      "bookList": "$.data.book_info[*]",
+      "bookUrl": "<js>\n'/detail?book_id=' + result.book_id + '&tab=' + (result.fq_tab || getVariable('模式'));\n</js>",
+      "coverUrl": "thumb_url",
+      "intro": "abstract",
+      "kind": "category",
+      "name": "book_name",
+      "wordCount": "word_number"
+    },
+    "ruleBookInfo": {
+      "author": "$.data.author",
+      "canReName": "1",
+      "coverUrl": "$.data.thumb_url",
+      "init": "<js>\njava.put('fq_tab', (String(baseUrl).match(/[?&]tab=([^&]+)/) || [])[1] || getVariable('模式'));\nresult;\n</js>",
+      "intro": "<js>\nvar tab = java.get('fq_tab') || getVariable('模式');\nvar x = (parseJsonSafely(result, {}) || {}).data || {};\nfunction v(t) { return (t != undefined && t != null && String(t).length > 0 && String(t) != 'null') ? String(t) : ''; }\nfunction cats() {\n    if (x.category) return x.category;\n    if (Array.isArray(x.category_v2)) return x.category_v2.map(function (c) { return c.Name || c.name || ''; }).filter(String).join('/');\n    return '';\n}\nvar statusMap = {'0': '连载中', '1': '连载中', '2': '已完结', 'creation_status_end': '已完结', 'creation_status_loading': '连载中'};\nvar st = statusMap[v(x.creation_status)] || v(x.creation_status);\nvar lines = ['📡 来源：番茄  |  🔄 模式：' + tab];\n[['🌈 分类', cats()],\n ['📚 最新章节', v(x.last_chapter_title)],\n ['📝 字数', v(x.word_number)],\n ['🚩 状态', st],\n ['⭐ 评分', v(x.score)],\n ['👀 阅读人数', v(x.read_count)]\n].forEach(function (p) { if (p[1]) lines.push('    ' + p[0] + '：' + p[1]); });\nif (v(x.abstract)) lines.push('❇️─────────\\n📖 简介：\\n' + String(x.abstract).split('\\n').map(function (l) { return '    ' + l; }).join('\\n'));\nlines.join('\\n');\n</js>",
+      "kind": "$.data.category_v2[*].Name",
+      "lastChapter": "$.data.last_chapter_title",
+      "name": "$.data.book_name",
+      "tocUrl": "/catalog?book_id={{$.data.book_id}}",
+      "wordCount": "$.data.word_number"
+    },
+    "ruleToc": {
+      "chapterList": "<js>\njava.put('fq_book_id', (String(baseUrl).match(/book_id=(\\d+)/) || [])[1] || '');\n// 书籍类型按模式动态设置：安卓 8文本/32音频/64图片，iOS 0/1/2\nvar tab = java.get('fq_tab') || getVariable('模式');\nvar tMap = {'小说': 8, '听书': 32, '漫画': 64, '短剧': 8};\nvar t = tMap[tab] || 8;\nif (isIOS()) t = {'小说': 0, '听书': 1, '漫画': 2, '短剧': 0}[tab] || 0;\ntry { book.type = t; } catch (e) {}\nresult;\n</js>$.data.item_data_list[*]",
+      "chapterName": "$.title",
+      "chapterUrl": "<js>\nvar tab = java.get('fq_tab') || getVariable('模式');\nvar id = result.item_id;\nvar url;\nif (tab == '听书') {\n    url = '/audio?item_ids=' + id + '&tone_id=' + getVariable('音色') + '&output=url';\n} else if (tab == '短剧') {\n    url = '/video?item_ids=' + id + '&output=proxy&quality=' + getVariable('清晰度');\n} else {\n    var review = getVariable('段评') != '关' ? 'keep' : 'remove';\n    var img = getVariable('图片') == '移除' ? 'remove' : 'keep';\n    url = '/content?item_id=' + id + '&text_mode=' + (review == 'keep' ? 'html' : 'plain') + '&review=' + review + '&image_mode=' + img;\n}\nurl;\n</js>"
+    },
+    "ruleContent": {
+      "content": "<js>\nvar base = BaseUrl();\nvar u = String(baseUrl);\nvar item = (u.match(/item_ids?=(\\d+)/) || [])[1] || '';\nvar tab = java.get('fq_tab') || getVariable('模式');\nfunction absUrl(s) { return (s && String(s).indexOf('http') != 0) ? base + s : s; }\nfunction videoUrl() {\n    var v = parseJsonSafely(request('/video?item_ids=' + item + '&output=proxy&quality=' + getVariable('清晰度')), null);\n    var vl = v && v.data && v.data.video_list;\n    if (vl) { var ks = Object.keys(vl); if (ks.length) return absUrl(vl[ks[0]].main_url); }\n    return '';\n}\nvar out = '';\nif (u.indexOf('/video') > -1) {\n    // 短剧：解密代理直链，当前章节自动打开播放\n    var d = parseJsonSafely(result, {});\n    var vl = d.data && d.data.video_list;\n    var vu = '';\n    if (vl) { var ks = Object.keys(vl); if (ks.length) vu = absUrl(vl[ks[0]].main_url); }\n    if (vu && book.durChapterIndex == chapter.index) {\n        try { java.startBrowser(vu, title || ''); } catch (e) {}\n    }\n    out = vu ? `▶️ 正在加载视频…\\n若未自动播放，请复制以下直链到播放器打开：\\n${vu}` : '❌ 视频获取失败，请刷新重试';\n} else if (u.indexOf('/audio') > -1) {\n    // 听书：短剧视频章优先原声音轨，其余回退 TTS 音色\n    out = videoUrl();\n    if (!out) {\n        var a = parseJsonSafely(result, {});\n        if (a.data && a.data[0] && a.data[0].main_url) out = absUrl(a.data[0].main_url);\n    }\n} else {\n    // 小说/漫画：段评气泡 + 空正文回退图片列表\n    var review = getVariable('段评') != '关';\n    var c = '';\n    var d = parseJsonSafely(result, {});\n    c = (d.data && d.data.content) || '';\n    if (c && review) {\n        // 段评 ident 域名由服务端按请求 Host 拼接，强制替换为书源地址\n        c = c.replace(/(<comment ident=\")[^\"]*?\\/review_html\\?/g, '$1' + base + '/review_html?');\n        c = isIOS() ? paraForiOS(c) : paraForAndroid(c);\n    }\n    if (c) {\n        out = c;\n    } else {\n        var m = parseJsonSafely(request('/manga?item_ids=' + item + '&output=proxy'), {});\n        // 兼容两种响应：data 为图片数组，或 data.images 为图片数组\n        var imgs = (m && m.data && Array.isArray(m.data.images)) ? m.data.images : (m && Array.isArray(m.data) ? m.data : null);\n        out = imgs ? imgs.map(function (i) { return `<img src=\"${absUrl(i.data)}\">`; }).join('\\n') : ((m && m.data && m.data.content) || '❌ 内容获取失败，请刷新重试');\n    }\n}\nout;\n</js>"
+    },
+    "weight": 0
+  }
+]
@@ -172,6 +172,7 @@ func setupRoutes() {
 	http.HandleFunc("/audio", wrap(handlers.HandleAudio))
 	http.HandleFunc("/audio/proxy/", wrap(handlers.HandleAudioProxy))
 	http.HandleFunc("/video", wrap(handlers.HandleVideo))
+	http.HandleFunc("/video/proxy/", wrap(handlers.HandleVideoProxy))
 	http.HandleFunc("/manga", wrap(handlers.HandleManga))
 	http.HandleFunc("/manga/image/", wrap(handlers.HandleMangaImageProxy))

@@ -51,6 +51,21 @@ fanqie:
    # 是否启用段评功能（默认true，启用段评）
    enable_review: true

+  # 视频处理配置
+  video:
+    # 输出模式：proxy / url
+    # proxy: 返回本地解密代理URL /video/proxy/{key}（已解密，可直接播放，推荐）
+    # url: 返回原始CDN链接（内容为 CENC 加密，需自行解密）
+    output_mode: "proxy"
+
+    # 默认清晰度：max（最高档）/ 360p/480p/540p/720p / 档位 key（video_1..N）
+    # 留空返回全部清晰度；/video 接口的 quality 参数优先于此配置
+    quality: "max"
+
+    # 解密后视频的磁盘缓存（同一视频重复播放直接读本地文件，无需重新下载解密）
+    cache_enabled: true
+    cache_path: "./video_cache"
+
  # 漫画处理配置
  manga:
    # 输出模式：proxy / data_uri / url
@@ -11,6 +11,7 @@
 #   ./deploy.sh --rollback            # 交互式回滚到指定版本
 #   ./deploy.sh --rollback v1.0.0     # 直接回滚到指定版本
 #   ./deploy.sh --list                # 列出所有已部署版本
+#   ./deploy.sh --sync-nginx          # 更新线上 nginx 配置（备份+校验+失败回滚）
 #   ./deploy.sh --help                # 显示帮助
 # ============================================================

@@ -61,6 +62,7 @@ ROLLBACK=false
 ROLLBACK_VERSION=""
 LIST=false
 FORCE=false
+SYNC_NGINX=false

 print_help() {
  cat <<EOF
@@ -73,6 +75,7 @@ print_help() {
  --force, -f           允许覆盖已存在的同名版本（默认报错退出）
  --rollback [版本]     回滚到指定版本（不带版本号则交互式选择）
  --list                列出所有已部署的版本
+  --sync-nginx          只更新 nginx 配置（备份旧配置，校验失败自动回滚）
  --help, -h            显示此帮助

 示例:
@@ -103,6 +106,7 @@ while [ $i -lt ${#ARGS[@]} ]; do
      fi
      ;;
    --list)        LIST=true ;;
+    --sync-nginx)  SYNC_NGINX=true ;;
    --force|-f)    FORCE=true ;;
    --help|-h)     print_help; exit 0 ;;
    v*)            VERSION="$arg" ;;
@@ -206,12 +210,138 @@ restart_and_verify() {
  $SUDO journalctl -u "${APP_NAME}" -n 15 --no-pager || true
 }

+
+# 写入 nginx 配置（--init 与 --sync-nginx 共用的唯一模板来源）
+# 模板自带完整 443/证书配置（证书存在时启用），不依赖 certbot --nginx 注入——
+# 这样 --sync-nginx 覆盖配置时不会丢失 HTTPS 段（certbot 注入式配置会被覆盖回 80-only）
+write_nginx_conf() {
+  # 反代 location（80 无证书时与 443 共用）
+  local proxy_locations
+  proxy_locations=$(cat <<LOC_EOF
+
+    # 视频解密代理：关闭缓冲，分片（Range/206）直通，避免 nginx 对大文件二次落盘
+    location /video/proxy/ {
+        proxy_pass http://127.0.0.1:${APP_PORT};
+        proxy_http_version 1.1;
+        proxy_set_header Host \$host;
+        proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto \$scheme;
+        proxy_buffering off;
+        proxy_read_timeout 300s;
+        proxy_send_timeout 300s;
+    }
+
+    location / {
+        proxy_pass http://127.0.0.1:${APP_PORT};
+        proxy_http_version 1.1;
+        proxy_set_header Host \$host;
+        proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto \$scheme;
+        proxy_set_header Upgrade \$http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_read_timeout 300s;
+        proxy_send_timeout 300s;
+    }
+LOC_EOF
+)
+
+  local ssl_block=""
+  if [ -f "/etc/letsencrypt/live/${DOMAIN}/fullchain.pem" ]; then
+    log "检测到 ${DOMAIN} 证书，配置启用 443"
+    ssl_block=$(cat <<SSL_EOF
+
+server {
+    listen 443 ssl http2;
+    server_name ${DOMAIN};
+
+    ssl_certificate     /etc/letsencrypt/live/${DOMAIN}/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/${DOMAIN}/privkey.pem;
+    ssl_protocols TLSv1.2 TLSv1.3;
+
+    access_log /var/log/nginx/${APP_NAME}.access.log;
+    error_log  /var/log/nginx/${APP_NAME}.error.log;
+${proxy_locations}
+}
+SSL_EOF
+)
+  else
+    warn "未找到 /etc/letsencrypt/live/${DOMAIN}/ 证书，本次仅写 80 配置（不跳转 HTTPS）；证书签发后重跑: $0 --sync-nginx"
+  fi
+
+  # 80 端口：有证书时仅 ACME 验证 + 301 跳转；无证书时直接反代
+  local root_location
+  if [ -n "${ssl_block}" ]; then
+    root_location='    location / {
+        return 301 https://$host$request_uri;
+    }'
+  else
+    root_location="${proxy_locations}"
+  fi
+
+  $SUDO tee "${NGINX_CONF}" >/dev/null <<NGINX_EOF
+server {
+    listen 80;
+    server_name ${DOMAIN};
+
+    access_log /var/log/nginx/${APP_NAME}.access.log;
+    error_log  /var/log/nginx/${APP_NAME}.error.log;
+
+    # ACME http-01 验证（certbot webroot 模式依赖）
+    location /.well-known/acme-challenge/ {
+        root /var/www/html;
+    }
+
+${root_location}
+}${ssl_block}
+NGINX_EOF
+}
+
+# 更新已部署服务器的 nginx 配置：备份 → 重写 → 校验 → 失败回滚
+sync_nginx_conf() {
+  local backup=""
+  if [ -f "${NGINX_CONF}" ]; then
+    backup="${NGINX_CONF}.bak.$(date +%Y%m%d%H%M%S)"
+    $SUDO cp "${NGINX_CONF}" "${backup}"
+    log "已备份原配置: ${backup}"
+  else
+    warn "nginx 配置不存在，将写入全新配置: ${NGINX_CONF}"
+  fi
+
+  write_nginx_conf
+  log "已写入新配置: ${NGINX_CONF}"
+
+  if $SUDO nginx -t; then
+    $SUDO systemctl reload nginx 2>/dev/null || $SUDO nginx -s reload 2>/dev/null || true
+    log "nginx 配置已更新并重载"
+  else
+    err "nginx -t 校验失败"
+    if [ -n "${backup}" ] && [ -f "${backup}" ]; then
+      $SUDO cp "${backup}" "${NGINX_CONF}"
+      if $SUDO nginx -t >/dev/null 2>&1; then
+        $SUDO systemctl reload nginx 2>/dev/null || $SUDO nginx -s reload 2>/dev/null || true
+        warn "已回滚到备份配置: ${backup}"
+      fi
+    fi
+    exit 1
+  fi
+}
+
 # ==================== --list ====================
 if [ "$LIST" = true ]; then
  list_versions
  exit 0
 fi

+# ==================== --sync-nginx ====================
+# 只更新 nginx 配置（给已部署服务器同步模板变更用），不动二进制与服务
+if [ "$SYNC_NGINX" = true ]; then
+  command -v nginx >/dev/null 2>&1 || { err "未找到 nginx"; exit 1; }
+  sync_nginx_conf
+  exit 0
+fi
+
 # ==================== --rollback ====================
 if [ "$ROLLBACK" = true ]; then
  if [ ! -d "${BIN_DIR}" ]; then
@@ -326,28 +456,7 @@ WantedBy=multi-user.target
 EOF

  log "初始化 Nginx 配置: ${NGINX_CONF}"
-  $SUDO tee "${NGINX_CONF}" >/dev/null <<EOF
-server {
-    listen 80;
-    server_name ${DOMAIN};
-
-    access_log /var/log/nginx/${APP_NAME}.access.log;
-    error_log  /var/log/nginx/${APP_NAME}.error.log;
-
-    location / {
-        proxy_pass http://127.0.0.1:${APP_PORT};
-        proxy_http_version 1.1;
-        proxy_set_header Host \$host;
-        proxy_set_header X-Real-IP \$remote_addr;
-        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto \$scheme;
-        proxy_set_header Upgrade \$http_upgrade;
-        proxy_set_header Connection "upgrade";
-        proxy_read_timeout 300s;
-        proxy_send_timeout 300s;
-    }
-}
-EOF
+  write_nginx_conf


  # ---- Certbot 续期后自动重载 Nginx（deploy-hook 只在续期成功时执行）----
@@ -368,8 +477,13 @@ HOOK
  if [ ! -d "/etc/letsencrypt/live/${DOMAIN}" ]; then
    if command -v certbot >/dev/null 2>&1; then
      log "未检测到证书，尝试自动申请: ${DOMAIN}"
-      $SUDO certbot --nginx -d "${DOMAIN}" --non-interactive --agree-tos -m "${CERT_EMAIL}" --redirect \
-        || warn "证书申请失败，请检查域名解析与 80 端口；可稍后手动执行 certbot --nginx -d ${DOMAIN}"
+      $SUDO mkdir -p /var/www/html
+      if $SUDO certbot certonly --webroot -w /var/www/html -d "${DOMAIN}" --non-interactive --agree-tos -m "${CERT_EMAIL}"; then
+        log "证书申请成功，写入 443 配置..."
+        write_nginx_conf
+      else
+        warn "证书申请失败，请检查域名解析与 80 端口；成功后重跑: $0 --sync-nginx"
+      fi
    else
      warn "未安装 certbot，跳过证书申请。可手动执行: dnf install certbot python3-certbot-nginx"
    fi
@@ -41,6 +41,7 @@ type FanqieConfig struct {
 	Signature string        `mapstructure:"signature"` // 签名方法: sign2 / sign4
 	Content   ContentConfig `mapstructure:"content"`
 	Manga     MangaConfig   `mapstructure:"manga"`
+	Video     VideoConfig   `mapstructure:"video"`
 }

 // ContentConfig 内容处理配置
@@ -60,6 +61,14 @@ type MangaConfig struct {
 	OutputMode string `mapstructure:"output_mode"` // 输出模式: data_uri / base64 / url
 }

+// VideoConfig 视频处理配置
+type VideoConfig struct {
+	OutputMode   string `mapstructure:"output_mode"`  // 输出模式: url（原始CDN链接，内容加密）/ proxy（本地解密代理，可直接播放）
+	Quality      string `mapstructure:"quality"`      // 默认清晰度: max（最高档）/ 360p/480p/... 或档位 key（video_1..N），留空返回全部
+	CacheEnabled bool   `mapstructure:"cache_enabled"` // 解密后视频的磁盘缓存
+	CachePath    string `mapstructure:"cache_path"`    // 缓存目录
+}
+
 // CacheConfig 缓存配置
 type CacheConfig struct {
 	Enabled        bool           `mapstructure:"enabled"`
@@ -197,6 +206,12 @@ func setDefaults() {
 	// 漫画处理配置
 	viper.SetDefault("fanqie.manga.output_mode", "url")

+	// 视频处理配置
+	viper.SetDefault("fanqie.video.output_mode", "proxy")
+	viper.SetDefault("fanqie.video.quality", "max")
+	viper.SetDefault("fanqie.video.cache_enabled", true)
+	viper.SetDefault("fanqie.video.cache_path", "./video_cache")
+
 	// 缓存配置
 	viper.SetDefault("cache.enabled", true)
 	viper.SetDefault("cache.backend", "sqlite")
@@ -0,0 +1,46 @@
+package config
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/spf13/viper"
+)
+
+// video 段配置读取：显式值生效、缺省回落 viper 默认值
+func TestVideoConfig(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "config.yaml")
+	os.WriteFile(path, []byte(`
+fanqie:
+  video:
+    output_mode: "proxy"
+    quality: "720p"
+`), 0644)
+
+	v := viper.New()
+	v.SetConfigFile(path)
+	if err := v.ReadInConfig(); err != nil {
+		t.Fatal(err)
+	}
+	var c Config
+	if err := v.Unmarshal(&c); err != nil {
+		t.Fatal(err)
+	}
+	if c.Fanqie.Video.OutputMode != "proxy" || c.Fanqie.Video.Quality != "720p" {
+		t.Fatalf("显式配置未生效: %+v", c.Fanqie.Video)
+	}
+
+	// 缺省回落
+	v2 := viper.New()
+	v2.SetDefault("fanqie.video.output_mode", "url")
+	v2.SetDefault("fanqie.video.quality", "")
+	var c2 Config
+	if err := v2.Unmarshal(&c2); err != nil {
+		t.Fatal(err)
+	}
+	if c2.Fanqie.Video.OutputMode != "url" || c2.Fanqie.Video.Quality != "" {
+		t.Fatalf("默认值不符: %+v", c2.Fanqie.Video)
+	}
+}
@@ -52,54 +52,61 @@ func GenerateAudioProxyURL(originalURL, deviceID string, headers map[string]stri
 	return fmt.Sprintf("/audio/proxy/%s", key)
 }

-// HandleAudioProxy 处理音频代理请求（流式返回，调用方负责 Close）
-func HandleAudioProxy(key string) (io.ReadCloser, string, error) {
-	var originalURL, deviceID string
-	var headers map[string]string
+// loadMediaProxyEntry 读取媒体代理映射（audio/video 共用；Redis 优先，回退 SQL）
+type mediaProxyEntry struct {
+	OriginalURL string
+	DeviceID    string
+	Headers     map[string]string
+}

+func loadMediaProxyEntry(key string) (*mediaProxyEntry, error) {
 	if redisCache != nil {
 		entry, err := loadAudioProxyEntry(key)
 		if err != nil {
-			return nil, "", err
+			return nil, err
 		}
-		originalURL, deviceID, headers = entry.OriginalURL, entry.DeviceID, entry.Headers
-	} else {
-		if cacheDB == nil {
-			return nil, "", fmt.Errorf("数据库未初始化")
-		}
-
-		// 从数据库获取音频信息
-		var headersJSON string
-		var createdAt int64
-
-		err := cacheDB.QueryRow(q(`
-			SELECT original_url, device_id, headers, created_at
-			FROM audio_cache WHERE key = ?
-		`), key).Scan(&originalURL, &deviceID, &headersJSON, &createdAt)
-
-		if err == sql.ErrNoRows {
-			return nil, "", fmt.Errorf("音频信息不存在，请先调用 /audio 接口")
-		}
-		if err != nil {
-			return nil, "", fmt.Errorf("查询音频缓存失败: %w", err)
-		}
-
-		// 检查缓存是否过期（2小时，匹配CDN链接有效期）
-		if time.Now().Unix()-createdAt > 7200 { // 2小时 = 7200秒
-			// 清理过期缓存
-			cacheDB.Exec(q("DELETE FROM audio_cache WHERE key = ?"), key)
-			return nil, "", fmt.Errorf("音频信息已过期，请重新调用 /audio 接口")
-		}
-
-		// 解析headers
-		json.Unmarshal([]byte(headersJSON), &headers)
+		return &mediaProxyEntry{OriginalURL: entry.OriginalURL, DeviceID: entry.DeviceID, Headers: entry.Headers}, nil
 	}
+	if cacheDB == nil {
+		return nil, fmt.Errorf("数据库未初始化")
+	}
+
+	var originalURL, deviceID, headersJSON string
+	var createdAt int64
+	err := cacheDB.QueryRow(q(`
+		SELECT original_url, device_id, headers, created_at
+		FROM audio_cache WHERE key = ?
+	`), key).Scan(&originalURL, &deviceID, &headersJSON, &createdAt)
+
+	if err == sql.ErrNoRows {
+		return nil, fmt.Errorf("媒体信息不存在，请先调用 /audio 或 /video 接口")
+	}
+	if err != nil {
+		return nil, fmt.Errorf("查询媒体缓存失败: %w", err)
+	}
+	// 过期清理（2小时，匹配CDN链接有效期）
+	if time.Now().Unix()-createdAt > 7200 {
+		cacheDB.Exec(q("DELETE FROM audio_cache WHERE key = ?"), key)
+		return nil, fmt.Errorf("媒体信息已过期，请重新调用接口")
+	}
+
+	var headers map[string]string
+	json.Unmarshal([]byte(headersJSON), &headers)
 	if headers == nil {
 		headers = make(map[string]string)
 	}
+	return &mediaProxyEntry{OriginalURL: originalURL, DeviceID: deviceID, Headers: headers}, nil
+}
+
+// HandleAudioProxy 处理音频代理请求（流式返回，调用方负责 Close）
+func HandleAudioProxy(key string) (io.ReadCloser, string, error) {
+	entry, err := loadMediaProxyEntry(key)
+	if err != nil {
+		return nil, "", err
+	}

 	// 下载音频内容（流式），使用关联的设备信息
-	body, contentType, err := downloadMediaWithRetry(originalURL, deviceID, headers, 3)
+	body, contentType, err := downloadMediaWithRetry(entry.OriginalURL, entry.DeviceID, entry.Headers, 3)
 	if err != nil {
 		return nil, "", fmt.Errorf("下载音频失败: %w", err)
 	}
@@ -483,6 +483,9 @@ func CleanupExpiredCache() error {
 		cacheLogger.Info(fmt.Sprintf("已清理 %d 条过期缓存（创建时间早于 %d 秒前）", rowsAffected, cfg.Cache.CleanupSeconds))
 	}

+	// 顺带清理磁盘视频缓存（7 天未访问的解密文件）
+	CleanupVideoCache()
+
 	return nil
 }

@@ -77,7 +77,7 @@ func loadAudioProxyEntry(key string) (*audioProxyEntry, error) {

 	val, err := redisCache.Get(ctx, redisAudioKeyPrefix+key).Result()
 	if err != nil {
-		return nil, fmt.Errorf("音频信息不存在或已过期，请重新调用 /audio 接口")
+		return nil, fmt.Errorf("媒体信息不存在或已过期，请重新调用 /audio 或 /video 接口")
 	}

 	var entry audioProxyEntry
@@ -1,17 +1,27 @@
 package fqapi

 import (
+	"bytes"
 	"encoding/base64"
 	"encoding/json"
 	"fanqie/internal/common"
+	"fanqie/internal/config"
 	"fmt"
+	"io"
 	"math"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
 )

 var videoLogger = common.NewLogger("video", "INFO", "")

-// HandleVideo 处理获取视频（支持批量和单个接口）
-func HandleVideo(itemIDs interface{}) (string, error) {
+// HandleVideo 处理获取视频（支持批量和单个接口）。
+// output: url（默认，返回原始CDN链接，内容为 CENC 加密）/ proxy（返回本地解密代理链接，可直接播放）
+// quality: 清晰度过滤，支持 max（最高档，默认）、definition（360p/480p/...）或档位 key（video_1..N），空为全部；
+// 未传时回退 config fanqie.video.quality，output 为空时回退 fanqie.video.output_mode
+func HandleVideo(itemIDs, output, quality interface{}) (string, error) {
 	if itemIDs == nil || itemIDs == "" {
 		return BuildSuccessResponse([]interface{}{}), nil
 	}
@@ -44,6 +54,26 @@ func HandleVideo(itemIDs interface{}) (string, error) {
 	requestBody := fmt.Sprintf(`{"biz_param":{"device_level":3,"need_all_video_definition":true,"need_mp4_align":false,"use_os_player":false,"video_platform":1024},"video_id":"%s"}`,
 		itemIDStr)

+	outputMode := ParseStringParam(output, "")
+	qualityFilter := ParseStringParam(quality, "")
+	if cfg := config.GetAppConfig(); cfg != nil {
+		if outputMode == "" {
+			outputMode = cfg.Fanqie.Video.OutputMode
+		}
+		if qualityFilter == "" {
+			qualityFilter = cfg.Fanqie.Video.Quality
+		}
+	}
+	if outputMode == "" {
+		outputMode = "url"
+	}
+	deviceID := ""
+	if outputMode == "proxy" {
+		if dev := GetCurrentDevice(); dev != nil {
+			deviceID = dev.DeviceHeader
+		}
+	}
+
 	// 使用 GorgonRequest 添加签名和设备信息
 	resp, err := GorgonRequest(url, map[string]interface{}{
 		"method": "POST",
@@ -86,7 +116,14 @@ func HandleVideo(itemIDs interface{}) (string, error) {

 		if data != nil {
 			if videoModelStr, ok := data["video_model"].(string); ok && isSingle {
-				decodedModel := decodeVideoModelAsJSON(videoModelStr)
+				decodedModel := decodeVideoModelAsJSON(videoModelStr, outputMode, deviceID, qualityFilter)
+
+				// 清晰度过滤无匹配时报错（调用方能立即发现参数写错）
+				if qualityFilter != "" {
+					if vl, ok := decodedModel.(map[string]interface{})["video_list"].(map[string]interface{}); ok && len(vl) == 0 {
+						return BuildErrorResponse(fmt.Sprintf("无匹配清晰度: %s（可用档位见 video_list）", qualityFilter)), nil
+					}
+				}

 				// 单个接口直接返回 video_model
 				response := map[string]interface{}{
@@ -103,7 +140,7 @@ func HandleVideo(itemIDs interface{}) (string, error) {
 				for itemID, itemData := range data {
 					if itemMap, ok := itemData.(map[string]interface{}); ok {
 						if videoModelStr, ok := itemMap["video_model"].(string); ok {
-							decodedModel := decodeVideoModelAsJSON(videoModelStr)
+							decodedModel := decodeVideoModelAsJSON(videoModelStr, outputMode, deviceID, qualityFilter)
 							result[itemID] = map[string]interface{}{
 								"video_model": decodedModel,
 							}
@@ -134,8 +171,10 @@ func HandleVideo(itemIDs interface{}) (string, error) {
 	return BuildErrorResponse(errMsg), nil
 }

-// decodeVideoModelAsJSON 解析并解码 video_model，返回关键字段的 JSON 对象
-func decodeVideoModelAsJSON(videoModelStr string) interface{} {
+// decodeVideoModelAsJSON 解析并解码 video_model，返回关键字段的 JSON 对象。
+// outputMode=proxy 时把 CDN 链接替换为本地解密代理链接（/video/proxy/{key}）
+// qualityFilter 非空时只保留匹配的清晰度（definition 或档位 key，大小写不敏感）
+func decodeVideoModelAsJSON(videoModelStr, outputMode, deviceID, qualityFilter string) interface{} {
 	// 解析 video_model JSON 字符串
 	var videoModel map[string]interface{}
 	if err := json.Unmarshal([]byte(videoModelStr), &videoModel); err != nil {
@@ -151,8 +190,10 @@ func decodeVideoModelAsJSON(videoModelStr string) interface{} {
 	result := make(map[string]interface{})

 	// 提取关键字段
-	if videoID, ok := videoModel["video_id"].(string); ok {
-		result["video_id"] = videoID
+	videoID := ""
+	if v, ok := videoModel["video_id"].(string); ok {
+		result["video_id"] = v
+		videoID = v
 	}
 	if duration, ok := videoModel["video_duration"].(float64); ok {
 		result["video_duration"] = formatDuration(duration)
@@ -167,10 +208,37 @@ func decodeVideoModelAsJSON(videoModelStr string) interface{} {

 	// 处理 video_list
 	if videoList, ok := videoModel["video_list"].(map[string]interface{}); ok {
+		// max/best：解析为实际最高档位 key（不同视频可用档位不同，按 vheight/definition 取最大）
+		if strings.EqualFold(qualityFilter, "max") || strings.EqualFold(qualityFilter, "best") {
+			bestKey, bestH := "", 0
+			for q, qd := range videoList {
+				qm, ok := qd.(map[string]interface{})
+				if !ok {
+					continue
+				}
+				if h := qualityHeight(qm); h > bestH {
+					bestH, bestKey = h, q
+				}
+			}
+			qualityFilter = bestKey
+		}
+
 		processedVideoList := make(map[string]interface{})

 		for quality, qualityData := range videoList {
 			if qualityMap, ok := qualityData.(map[string]interface{}); ok {
+				// 清晰度过滤：匹配档位 key（video_1）或 definition（720p）
+				if qualityFilter != "" {
+					def, _ := qualityMap["definition"].(string)
+					if !strings.EqualFold(quality, qualityFilter) && !strings.EqualFold(def, qualityFilter) {
+						continue
+					}
+				}
+				// spade_a（PlayAuth）：解出 CENC 内容密钥的种子，proxy 模式随代理下发
+				spadeA := ""
+				if v, ok := qualityMap["spade_a"].(string); ok {
+					spadeA = v
+				}
 				// 只保留关键字段
 				qualityInfo := make(map[string]interface{})

@@ -205,18 +273,23 @@ func decodeVideoModelAsJSON(videoModelStr string) interface{} {
 					}
 				}

-				// 解码 main_url
-				if mainURL, ok := qualityMap["main_url"].(string); ok {
-					if decoded, err := base64.StdEncoding.DecodeString(mainURL); err == nil {
-						qualityInfo["main_url"] = string(decoded)
+				// 解码 main_url / backup_url_1（base64 的CDN链接），proxy 模式替换为解密代理。
+				// 代理 key 用 videoID+档位（稳定），同一视频重复调用复用磁盘缓存
+				processURL := func(b64 string) interface{} {
+					decoded, err := base64.StdEncoding.DecodeString(b64)
+					if err != nil {
+						return b64
 					}
+					if outputMode == "proxy" && spadeA != "" && videoID != "" {
+						return GenerateVideoProxyURL(videoID+"_"+quality, string(decoded), deviceID, spadeA)
+					}
+					return string(decoded)
+				}
+				if mainURL, ok := qualityMap["main_url"].(string); ok {
+					qualityInfo["main_url"] = processURL(mainURL)
 				}
-
-				// 解码 backup_url_1
 				if backupURL, ok := qualityMap["backup_url_1"].(string); ok {
-					if decoded, err := base64.StdEncoding.DecodeString(backupURL); err == nil {
-						qualityInfo["backup_url_1"] = string(decoded)
-					}
+					qualityInfo["backup_url_1"] = processURL(backupURL)
 				}

 				processedVideoList[quality] = qualityInfo
@@ -229,6 +302,22 @@ func decodeVideoModelAsJSON(videoModelStr string) interface{} {
 	return result
 }

+// qualityHeight 取清晰度的比较高度：优先 vheight，缺失时从 definition（如 "720p"）解析
+func qualityHeight(qm map[string]interface{}) int {
+	if h, ok := qm["vheight"].(float64); ok && h > 0 {
+		return int(h)
+	}
+	def, _ := qm["definition"].(string)
+	n := 0
+	for _, c := range def {
+		if c < '0' || c > '9' {
+			break
+		}
+		n = n*10 + int(c-'0')
+	}
+	return n
+}
+
 // formatDuration 将秒数转换为可读的时间格式
 func formatDuration(seconds float64) string {
 	totalSeconds := int(math.Round(seconds))
@@ -278,3 +367,123 @@ func formatBitrate(bitrate float64) string {
 	mbps := kbps / unit
 	return fmt.Sprintf("%.2f Mbps", mbps)
 }
+
+// GenerateVideoProxyURL 生成视频解密代理URL。
+// cacheKey 需稳定（videoID+档位）：映射表覆盖式更新，磁盘缓存按 key 复用
+func GenerateVideoProxyURL(cacheKey, originalURL, deviceID, spadeA string) string {
+	headers := map[string]string{"x-spade-a": spadeA}
+	if redisCache != nil {
+		saveAudioProxyEntry(cacheKey, &audioProxyEntry{
+			OriginalURL: originalURL,
+			DeviceID:    deviceID,
+			Headers:     headers,
+		})
+		return "/video/proxy/" + cacheKey
+	}
+	headersJSON, _ := json.Marshal(headers)
+	if cacheDB != nil {
+		cacheDB.Exec(q(`
+			INSERT INTO audio_cache (key, original_url, device_id, headers, created_at, updated_at)
+			VALUES (?, ?, ?, ?, ?, ?)
+			ON CONFLICT(key) DO UPDATE SET original_url = excluded.original_url,
+				device_id = excluded.device_id, headers = excluded.headers, updated_at = excluded.updated_at
+		`), cacheKey, originalURL, deviceID, string(headersJSON), time.Now().Unix(), time.Now().Unix())
+	}
+	return "/video/proxy/" + cacheKey
+}
+
+// videoCachePath 解密后视频的磁盘缓存路径；缓存未启用返回空串
+func videoCachePath(key string) string {
+	cfg := config.GetAppConfig()
+	if cfg == nil || !cfg.Fanqie.Video.CacheEnabled || cfg.Fanqie.Video.CachePath == "" {
+		return ""
+	}
+	return filepath.Join(cfg.Fanqie.Video.CachePath, key+".mp4")
+}
+
+// HandleVideoProxy 处理视频代理请求：磁盘缓存命中直接返回；否则下载 CENC 加密 MP4 →
+// SpadeA 解 key → 解密 → 写入缓存。返回 ReadSeeker 供 http.ServeContent（支持 Range/seek）。
+func HandleVideoProxy(key string) (io.ReadSeeker, string, error) {
+	// 磁盘缓存命中：直接返回文件（映射记录即使过期也不影响已缓存的视频）
+	if p := videoCachePath(key); p != "" {
+		if f, err := os.Open(p); err == nil {
+			return f, "video/mp4", nil
+		}
+	}
+
+	entry, err := loadMediaProxyEntry(key)
+	if err != nil {
+		return nil, "", err
+	}
+	spadeA := entry.Headers["x-spade-a"]
+	if spadeA == "" {
+		return nil, "", fmt.Errorf("视频信息缺少 spade_a，请重新调用 /video 接口")
+	}
+
+	body, _, err := downloadMediaWithRetry(entry.OriginalURL, entry.DeviceID, entry.Headers, 3)
+	if err != nil {
+		return nil, "", fmt.Errorf("下载视频失败: %w", err)
+	}
+	defer body.Close()
+	data, err := io.ReadAll(body)
+	if err != nil {
+		return nil, "", fmt.Errorf("读取视频失败: %w", err)
+	}
+
+	contentKey, err := DecodeSpadeKey(spadeA)
+	if err != nil {
+		return nil, "", fmt.Errorf("解密视频失败: %w", err)
+	}
+	if err := DecryptCENCMP4(data, contentKey); err != nil {
+		return nil, "", fmt.Errorf("解密视频失败: %w", err)
+	}
+
+	// 写入磁盘缓存（临时文件 + rename 原子替换；失败不影响本次返回）
+	if p := videoCachePath(key); p != "" {
+		if err := os.MkdirAll(filepath.Dir(p), 0755); err == nil {
+			if tmp, err := os.CreateTemp(filepath.Dir(p), ".tmp-*"); err == nil {
+				if _, werr := tmp.Write(data); werr == nil {
+					tmp.Close()
+					if err := os.Rename(tmp.Name(), p); err != nil {
+						os.Remove(tmp.Name())
+					}
+				} else {
+					tmp.Close()
+					os.Remove(tmp.Name())
+				}
+			}
+		}
+	}
+	return bytes.NewReader(data), "video/mp4", nil
+}
+
+// CleanupVideoCache 清理磁盘视频缓存中 mtime 过早的文件，挂接在缓存定期清理任务中
+func CleanupVideoCache() {
+	cfg := config.GetAppConfig()
+	if cfg == nil || !cfg.Fanqie.Video.CacheEnabled {
+		return
+	}
+	dir := cfg.Fanqie.Video.CachePath
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		return // 目录不存在等：无缓存可清
+	}
+	const maxAge = 7 * 24 * time.Hour // ponytail: 固定 7 天，需要更长保留时改配置语义
+	cutoff := time.Now().Add(-maxAge)
+	removed := 0
+	for _, e := range entries {
+		info, err := e.Info()
+		if err != nil || info.IsDir() {
+			continue
+		}
+		if info.ModTime().Before(cutoff) {
+			if os.Remove(filepath.Join(dir, e.Name())) == nil {
+				removed++
+			}
+		}
+	}
+	if removed > 0 {
+		videoLogger.Info(fmt.Sprintf("已清理 %d 个过期视频缓存文件", removed))
+	}
+}
+
@@ -0,0 +1,360 @@
+package fqapi
+
+import (
+	"bytes"
+	"crypto/aes"
+	"crypto/cipher"
+	"encoding/base64"
+	"encoding/binary"
+	"fmt"
+)
+
+// ============ SpadeA（黑桃A）PlayAuth 解码 ============
+//
+// 番茄短剧/汽水音乐同源的本地 DRM：video_model 每个清晰度的 spade_a
+// （PlayAuth）经混淆变换直接还原 16 字节 AES-128 内容密钥（32 位 hex 字符串）。
+// 算法逆向自 SodaMusic v3.5.1（qishui-decrypt-tool），与番茄短剧样本实测一致。
+
+func bitCount32(v uint32) int {
+	c := v
+	c -= (c >> 1) & 0x55555555
+	c = (c & 0x33333333) + ((c >> 2) & 0x33333333)
+	return int(((c + (c>>4)) & 0x0f0f0f0f) * 0x01010101 >> 24)
+}
+
+func decodeBase36Byte(v byte) int {
+	switch {
+	case v >= '0' && v <= '9':
+		return int(v - '0')
+	case v >= 'a' && v <= 'z':
+		return int(v-'a') + 10
+	}
+	return 0xff
+}
+
+// decodeSpadeInner 逐字节去混淆：与前一字节异或后减去索引 popcount 与常数
+func decodeSpadeInner(data []byte) []byte {
+	result := make([]byte, len(data))
+	buff := append([]byte{0xfa, 0x55}, data...)
+	for i := 0; i < len(data); i++ {
+		raw := int(data[i]^buff[i]) - bitCount32(uint32(i)) - 21
+		if raw >= 0 {
+			result[i] = byte(raw)
+		} else {
+			result[i] = byte(((raw % 255) + 255) % 255)
+		}
+	}
+	return result
+}
+
+// DecodeSpadeKey 从 spade_a（PlayAuth base64）解出 16 字节 AES 内容密钥
+func DecodeSpadeKey(playAuthB64 string) ([]byte, error) {
+	raw, err := base64.StdEncoding.DecodeString(playAuthB64)
+	if err != nil {
+		return nil, fmt.Errorf("spade_a base64 解码失败: %w", err)
+	}
+	if len(raw) < 4 {
+		return nil, fmt.Errorf("spade_a 长度不足: %d", len(raw))
+	}
+	padding := int(raw[0]^raw[1]^raw[2]) - 48
+	if padding < 0 || padding >= len(raw)-3 {
+		return nil, fmt.Errorf("spade_a padding 非法: %d", padding)
+	}
+	body := raw[1 : len(raw)-padding]
+	tmp := decodeSpadeInner(body)
+	keyLen := decodeBase36Byte(tmp[0])
+	if keyLen == 0xff {
+		return nil, fmt.Errorf("spade_a key 长度字符非法: %q", tmp[0])
+	}
+	end := len(body) - keyLen
+	if end < 1 || end > len(tmp) {
+		return nil, fmt.Errorf("spade_a key 范围非法: end=%d len=%d", end, len(tmp))
+	}
+	keyHex := string(tmp[1:end])
+	if len(keyHex) != 32 {
+		return nil, fmt.Errorf("spade_a key 长度异常: %d", len(keyHex))
+	}
+	key := make([]byte, 16)
+	for i := 0; i < 16; i++ {
+		if _, err := fmt.Sscanf(keyHex[i*2:i*2+2], "%02x", &key[i]); err != nil {
+			return nil, fmt.Errorf("spade_a key hex 非法: %s", keyHex)
+		}
+	}
+	return key, nil
+}
+
+// ============ CENC (cenc-aes-ctr) MP4 解密 ============
+//
+// 容器为标准 CENC MP4：moov 明文；加密 sample entry（encv/enca）+ senc box
+// （version 0，每个 sample 8 字节 IV，整样本 AES-128-CTR，无 subsample）。
+// 解密后把 entry 类型改回原始 codec（sinf/frma 指示），得到可播放文件。
+
+type mp4Box struct {
+	typ         string
+	contentStar int
+	end         int
+}
+
+// walkBoxes 迭代 [start,end) 内的顶层 box，fn 返回 false 时停止迭代
+func walkBoxes(data []byte, start, end int, fn func(mp4Box) bool) error {
+	p := start
+	for p+8 <= end {
+		size := int(binary.BigEndian.Uint32(data[p : p+4]))
+		typ := string(data[p+4 : p+8])
+		if size == 1 { // largesize
+			if p+16 > end {
+				return fmt.Errorf("box %s largesize 越界", typ)
+			}
+			size = int(binary.BigEndian.Uint64(data[p+8 : p+16]))
+			// ponytail: >2GB 文件不支持，截断风险可接受
+			if size > len(data) {
+				return fmt.Errorf("box %s 过大", typ)
+			}
+		}
+		if size < 8 || p+size > end {
+			return fmt.Errorf("box %s 尺寸非法 size=%d at %d", typ, size, p)
+		}
+		if !fn(mp4Box{typ: typ, contentStar: p + 8, end: p + size}) {
+			return nil
+		}
+		p += size
+	}
+	return nil
+}
+
+// DecryptCENCMP4 原地解密 CENC 加密的 MP4 字节并修复 stsd entry 类型。
+// 仅支持 senc version 0 + 无 subsample 标志（番茄实测形态），其他形态返回错误。
+func DecryptCENCMP4(data []byte, key []byte) error {
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return fmt.Errorf("内容密钥非法: %w", err)
+	}
+
+	decryptStream := func(ct []byte, iv8 []byte) error {
+		if len(iv8) != 8 {
+			return fmt.Errorf("senc IV 长度异常: %d", len(iv8))
+		}
+		iv := make([]byte, 16)
+		copy(iv, iv8) // 8 字节 IV 置于高位，低 8 字节为块计数器（CENC 标准）
+		cipher.NewCTR(block, iv).XORKeyStream(ct, ct)
+		return nil
+	}
+
+	// 找 moov 并遍历其下所有 trak，逐 trak 解密
+	var trakErr error
+	foundMoov := false
+	if err := walkBoxes(data, 0, len(data), func(b mp4Box) bool {
+		if b.typ != "moov" {
+			return true
+		}
+		foundMoov = true
+		_ = walkBoxes(data, b.contentStar, b.end, func(trak mp4Box) bool {
+			if trak.typ != "trak" {
+				return true
+			}
+			if err := decryptTrak(data, trak, decryptStream); err != nil {
+				trakErr = err
+				return false
+			}
+			return true
+		})
+		return false
+	}); err != nil {
+		return err
+	}
+	if !foundMoov {
+		return fmt.Errorf("moov box 未找到")
+	}
+	return trakErr
+}
+
+// decryptTrak 处理单个 trak：解析 sample 表 + senc，逐样本解密，修补 stsd
+func decryptTrak(data []byte, trak mp4Box, decryptStream func([]byte, []byte) error) error {
+	// 定位 mdia→minf→stbl
+	stbl, err := findBox(data, trak, "mdia", "minf", "stbl")
+	if err != nil || stbl == nil {
+		return err // 无 stbl 的 trak 跳过
+	}
+
+	var (
+		sizes         []int
+		chunkOffsets  []int
+		stscEntries   [][2]int // {first_chunk, samples_per_chunk}
+		ivs           [][]byte
+		stsd          *mp4Box
+		haveSizes     bool
+		haveOffsets   bool
+		haveStsc      bool
+		parseErr      error
+	)
+
+	if err := walkBoxes(data, stbl.contentStar, stbl.end, func(b mp4Box) bool {
+		switch b.typ {
+		case "stsd":
+			stsd = &b
+		case "stsz":
+			constSize := int(binary.BigEndian.Uint32(data[b.contentStar+4 : b.contentStar+8]))
+			count := int(binary.BigEndian.Uint32(data[b.contentStar+8 : b.contentStar+12]))
+			if constSize != 0 {
+				for i := 0; i < count; i++ {
+					sizes = append(sizes, constSize)
+				}
+			} else {
+				sizes = make([]int, count)
+				for i := 0; i < count; i++ {
+					sizes[i] = int(binary.BigEndian.Uint32(data[b.contentStar+12+i*4 : b.contentStar+16+i*4]))
+				}
+			}
+			haveSizes = true
+		case "stco":
+			count := int(binary.BigEndian.Uint32(data[b.contentStar+4 : b.contentStar+8]))
+			for i := 0; i < count; i++ {
+				chunkOffsets = append(chunkOffsets, int(binary.BigEndian.Uint32(data[b.contentStar+8+i*4:b.contentStar+12+i*4])))
+			}
+			haveOffsets = true
+		case "co64":
+			count := int(binary.BigEndian.Uint32(data[b.contentStar+4 : b.contentStar+8]))
+			for i := 0; i < count; i++ {
+				v := binary.BigEndian.Uint64(data[b.contentStar+8+i*8 : b.contentStar+16+i*8])
+				if v > uint64(len(data)) {
+					parseErr = fmt.Errorf("co64 偏移越界")
+					return false
+				}
+				chunkOffsets = append(chunkOffsets, int(v))
+			}
+			haveOffsets = true
+		case "stsc":
+			count := int(binary.BigEndian.Uint32(data[b.contentStar+4 : b.contentStar+8]))
+			for i := 0; i < count; i++ {
+				first := int(binary.BigEndian.Uint32(data[b.contentStar+8+i*12 : b.contentStar+12+i*12]))
+				spc := int(binary.BigEndian.Uint32(data[b.contentStar+12+i*12 : b.contentStar+16+i*12]))
+				stscEntries = append(stscEntries, [2]int{first, spc})
+			}
+			haveStsc = true
+		case "senc":
+			verFlags := binary.BigEndian.Uint32(data[b.contentStar : b.contentStar+4])
+			if verFlags>>24 != 0 {
+				parseErr = fmt.Errorf("senc version %d 不支持", verFlags>>24)
+				return false
+			}
+			if verFlags&0b10 != 0 {
+				parseErr = fmt.Errorf("senc subsample 加密模式不支持")
+				return false
+			}
+			count := int(binary.BigEndian.Uint32(data[b.contentStar+4 : b.contentStar+8]))
+			p := b.contentStar + 8
+			if p+8*count > b.end {
+				parseErr = fmt.Errorf("senc IV 表越界")
+				return false
+			}
+			for i := 0; i < count; i++ {
+				ivs = append(ivs, data[p+8*i:p+8*i+8])
+			}
+		}
+		return true
+	}); err != nil {
+		return fmt.Errorf("stbl 解析失败: %w", err)
+	}
+	if parseErr != nil {
+		return parseErr
+	}
+
+	if len(ivs) == 0 {
+		return nil // 本 trak 未加密
+	}
+	if !haveSizes || !haveOffsets || !haveStsc {
+		return fmt.Errorf("sample 表不完整（stsz=%v stco=%v stsc=%v）", haveSizes, haveOffsets, haveStsc)
+	}
+
+	// stsc+stco+stsz 重建每样本绝对偏移（标准 sample table 遍历）
+	sampleIdx := 0
+	for ci, off := range chunkOffsets {
+		spc := stscEntries[len(stscEntries)-1][1]
+		for _, e := range stscEntries {
+			if e[0] <= ci+1 {
+				spc = e[1]
+			} else {
+				break
+			}
+		}
+		pos := off
+		for s := 0; s < spc && sampleIdx < len(sizes); s++ {
+			size := sizes[sampleIdx]
+			if sampleIdx >= len(ivs) {
+				break
+			}
+			if pos+size > len(data) {
+				return fmt.Errorf("sample %d 越界 pos=%d size=%d", sampleIdx, pos, size)
+			}
+			if err := decryptStream(data[pos:pos+size], ivs[sampleIdx]); err != nil {
+				return err
+			}
+			pos += size
+			sampleIdx++
+		}
+	}
+
+	if stsd != nil {
+		patchStsdEntry(data, *stsd)
+	}
+	return nil
+}
+
+// findBox 沿 path 逐层查找唯一子 box；任意一层缺失返回 (nil, nil)
+func findBox(data []byte, parent mp4Box, path ...string) (*mp4Box, error) {
+	cur := parent
+	for _, name := range path {
+		var next *mp4Box
+		if err := walkBoxes(data, cur.contentStar, cur.end, func(b mp4Box) bool {
+			if b.typ == name {
+				next = &b
+				return false
+			}
+			return true
+		}); err != nil {
+			return nil, err
+		}
+		if next == nil {
+			return nil, nil
+		}
+		cur = *next
+	}
+	return &cur, nil
+}
+
+// patchStsdEntry 把加密 sample entry（encv/enca）的类型改回 sinf/frma 指示的原始 codec。
+// 番茄实测单 entry；entry 头部长度因音/视频而异，直接在 entry 字节里定位 "sinf"。
+func patchStsdEntry(data []byte, stsd mp4Box) {
+	entryCount := int(binary.BigEndian.Uint32(data[stsd.contentStar+4 : stsd.contentStar+8]))
+	if entryCount != 1 {
+		return // ponytail: 多 entry 形态按需扩展
+	}
+	entryStart := stsd.contentStar + 8
+	entryEnd := stsd.end
+
+	// 在 entry 内定位 "sinf"（box 类型魔数），再验证其 box 头合法性
+	sinfOff := bytes.Index(data[entryStart:entryEnd], []byte("sinf"))
+	for sinfOff >= 0 {
+		boxStart := entryStart + sinfOff - 4 // size 字段起点
+		if boxStart >= entryStart+8 {
+			size := int(binary.BigEndian.Uint32(data[boxStart : boxStart+4]))
+			if size >= 12 && boxStart+size <= entryEnd {
+				sinfContent, sinfEnd := boxStart+8, boxStart+size
+				frmaOff := bytes.Index(data[sinfContent:sinfEnd], []byte("frma"))
+				if frmaOff >= 0 {
+					frmaContent := sinfContent + frmaOff + 4
+					if frmaContent+4 <= sinfEnd {
+						// entry 类型字段在 box 头的 type 位置（entryStart+4）
+						copy(data[entryStart+4:entryStart+8], data[frmaContent:frmaContent+4])
+						return
+					}
+				}
+			}
+		}
+		next := bytes.Index(data[entryStart+sinfOff+1:entryEnd], []byte("sinf"))
+		if next < 0 {
+			return
+		}
+		sinfOff = sinfOff + 1 + next
+	}
+}
@@ -0,0 +1,178 @@
+package fqapi
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"encoding/binary"
+	"bytes"
+	"encoding/base64"
+	"encoding/hex"
+	"io"
+	"os"
+	"strings"
+	"testing"
+)
+
+// 番茄短剧真实样本（video_model video_1..4 共用同一 spade_a）
+const testSpadeA = "kbwfwFiKI8RuvCnHV4ss9lK6HMFmvS/2f7wv7H+mAfRRvxmXlw=="
+
+func TestDecodeSpadeKey(t *testing.T) {
+	key, err := DecodeSpadeKey(testSpadeA)
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := "4f04d75b0df5cee67dbe13738872e965"
+	if got := hex.EncodeToString(key); got != want {
+		t.Fatalf("key mismatch: got %s want %s", got, want)
+	}
+}
+
+// 端到端：下载真实 360p 视频 → DecryptCENCMP4 → 输出文件（ffprobe 验证）
+func TestDecryptRealVideo(t *testing.T) {
+	mainURLB64 := os.Getenv("FQ_VIDEO_URL")
+	spadeA := strings.TrimSpace(os.Getenv("FQ_VIDEO_SPADE"))
+	if mainURLB64 == "" || spadeA == "" {
+		t.Skip("need FQ_VIDEO_URL (main_url base64) and FQ_VIDEO_SPADE")
+	}
+	url, err := base64.StdEncoding.DecodeString(mainURLB64)
+	if err != nil {
+		t.Fatal(err)
+	}
+	body, _, err := downloadMedia(string(bytes.TrimSpace(url)), "", map[string]string{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer body.Close()
+	data, err := io.ReadAll(body)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Logf("downloaded %d bytes", len(data))
+
+	key, err := DecodeSpadeKey(spadeA)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Logf("key=%x", key)
+	if err := DecryptCENCMP4(data, key); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile("/tmp/video_decrypted.mp4", data, 0644); err != nil {
+		t.Fatal(err)
+	}
+	t.Log("written /tmp/video_decrypted.mp4")
+}
+
+// ---- 合成 CENC MP4 单元测试：加密 → 解密 → 比对明文 ----
+
+func box(typ string, payload ...[]byte) []byte {
+	var body []byte
+	for _, p := range payload {
+		body = append(body, p...)
+	}
+	b := make([]byte, 8+len(body))
+	binary.BigEndian.PutUint32(b[:4], uint32(len(b)))
+	copy(b[4:8], typ)
+	copy(b[8:], body)
+	return b
+}
+
+func u32(v uint32) []byte { b := make([]byte, 4); binary.BigEndian.PutUint32(b, v); return b }
+
+func TestDecryptCENCMP4Synthetic(t *testing.T) {
+	key := []byte("0123456789abcdef")
+	plain1 := []byte("HELLO_CENC_SAMPLE_1_PADPADP")
+	plain2 := []byte("SECOND_SAMPLE")
+	plain3 := []byte("THIRD")
+
+	enc := func(pt []byte, iv8 []byte) []byte {
+		iv := make([]byte, 16)
+		copy(iv, iv8)
+		block, _ := aes.NewCipher(key)
+		ct := make([]byte, len(pt))
+		cipher.NewCTR(block, iv).XORKeyStream(ct, pt)
+		return ct
+	}
+	iv1 := []byte{1, 2, 3, 4, 5, 6, 7, 8}
+	iv2 := []byte{8, 7, 6, 5, 4, 3, 2, 1}
+	iv3 := []byte{0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF, 0x11, 0x22}
+	ct1, ct2, ct3 := enc(plain1, iv1), enc(plain2, iv2), enc(plain3, iv3)
+
+	// buildFile(off1, off2)：chunk 绝对偏移写入 stco；偏移依赖 moov 长度，先占位测长再重建
+	buildFile := func(off1, off2 uint32) []byte {
+		entry := box("enca", make([]byte, 8), box("sinf", box("frma", []byte("mp4a"))))
+		stsd := box("stsd", u32(0), u32(1), entry)
+		stsz := box("stsz", u32(0), u32(0), u32(3), u32(uint32(len(plain1))), u32(uint32(len(plain2))), u32(uint32(len(plain3))))
+		stsc := box("stsc", u32(0), u32(2),
+			u32(1), u32(2), u32(1), // entry1: chunk1 起，每 chunk 2 样本
+			u32(2), u32(1), u32(1)) // entry2: chunk2 起，每 chunk 1 样本
+		stco := box("stco", u32(0), u32(2), u32(off1), u32(off2))
+		sencBody := append(append(append(append(u32(0), u32(3)...), iv1...), iv2...), iv3...)
+		senc := box("senc", sencBody)
+		moov := box("moov", box("trak", box("mdia", box("minf", box("stbl", stsd, stsz, stsc, stco, senc)))))
+		ftyp := box("ftyp", []byte("isom"))
+		return append(append(ftyp, moov...), box("mdat", ct1, ct2, ct3)...)
+	}
+
+	// 占位构造测 moov 总长，得到真实 chunk 偏移后重建
+	probe := buildFile(0, 0)
+	chunk1Off := uint32(len(probe) - len(ct1) - len(ct2) - len(ct3))
+	chunk2Off := chunk1Off + uint32(len(ct1)+len(ct2))
+	data := buildFile(chunk1Off, chunk2Off)
+
+	if err := DecryptCENCMP4(data, key); err != nil {
+		t.Fatal(err)
+	}
+	if got := data[chunk1Off : chunk1Off+uint32(len(plain1))]; string(got) != string(plain1) {
+		t.Errorf("sample1 解密不符: %q", got)
+	}
+	s2 := chunk1Off + uint32(len(plain1))
+	if got := data[s2 : s2+uint32(len(plain2))]; string(got) != string(plain2) {
+		t.Errorf("sample2 解密不符: %q", got)
+	}
+	if got := data[chunk2Off : chunk2Off+uint32(len(plain3))]; string(got) != string(plain3) {
+		t.Errorf("sample3 解密不符: %q", got)
+	}
+	// stsd entry 类型应被 patch 为 frma 指示的 mp4a（原 enca 四字已不存在）
+	if bytes.Index(data, []byte("enca")) >= 0 || bytes.Index(data, []byte("mp4a")) < 0 {
+		t.Error("stsd entry 类型未修复为 mp4a")
+	}
+}
+
+// 清晰度过滤：按 definition 与档位 key 均可命中；无匹配返回空列表由上层报错
+func TestDecodeVideoModelQualityFilter(t *testing.T) {
+	vm := `{"video_id":"v123","video_duration":1.5,"video_list":{
+		"video_1":{"definition":"360p","vtype":"mp4","main_url":"` + base64.StdEncoding.EncodeToString([]byte("https://a/360")) + `"},
+		"video_4":{"definition":"720p","vtype":"mp4","main_url":"` + base64.StdEncoding.EncodeToString([]byte("https://a/720")) + `"}}}`
+	got := decodeVideoModelAsJSON(vm, "url", "", "720p").(map[string]interface{})
+	vl := got["video_list"].(map[string]interface{})
+	if len(vl) != 1 || vl["video_4"] == nil {
+		t.Fatalf("definition 过滤失败: %v", vl)
+	}
+	got = decodeVideoModelAsJSON(vm, "url", "", "VIDEO_1").(map[string]interface{})
+	vl = got["video_list"].(map[string]interface{})
+	if len(vl) != 1 || vl["video_1"] == nil {
+		t.Fatalf("档位key过滤失败: %v", vl)
+	}
+	if u := vl["video_1"].(map[string]interface{})["main_url"].(string); u != "https://a/360" {
+		t.Fatalf("main_url 未解码: %s", u)
+	}
+	got = decodeVideoModelAsJSON(vm, "url", "", "1080p").(map[string]interface{})
+	if len(got["video_list"].(map[string]interface{})) != 0 {
+		t.Fatal("无匹配应返回空列表")
+	}
+	// max 取最高档（vheight 缺失时按 definition 数字比较）
+	got = decodeVideoModelAsJSON(vm, "url", "", "max").(map[string]interface{})
+	vl = got["video_list"].(map[string]interface{})
+	if len(vl) != 1 || vl["video_4"] == nil {
+		t.Fatalf("max 应只保留最高档: %v", vl)
+	}
+	// vheight 存在时优先按 vheight
+	vm2 := `{"video_list":{
+		"video_1":{"definition":"360p","vwidth":360,"vheight":640},
+		"video_2":{"definition":"540p","vwidth":540,"vheight":960}}}`
+	got = decodeVideoModelAsJSON(vm2, "url", "", "max").(map[string]interface{})
+	if len(got["video_list"].(map[string]interface{})) != 1 || got["video_list"].(map[string]interface{})["video_2"] == nil {
+		t.Fatal("max 应按 vheight 取 video_2")
+	}
+}
@@ -7,6 +7,7 @@ import (
 	"io"
 	"net/http"
 	"strings"
+	"time"
 )

 // HandleAudio 音频处理
@@ -75,7 +76,9 @@ func HandleVideo(w http.ResponseWriter, r *http.Request) {
 		return
 	}

-	result, err := fqapi.HandleVideo(params["item_ids"])
+	output := r.URL.Query().Get("output")
+	quality := r.URL.Query().Get("quality")
+	result, err := fqapi.HandleVideo(params["item_ids"], output, quality)
 	if err != nil {
 		respondError(w, "获取视频失败: "+err.Error(), false)
 		return
@@ -84,6 +87,30 @@ func HandleVideo(w http.ResponseWriter, r *http.Request) {
 	fmt.Fprint(w, result)
 }

+// HandleVideoProxy 视频解密代理处理（磁盘缓存优先；http.ServeContent 支持 Range/seek/HEAD，
+// 播放器拖动进度条时按需分片返回）
+func HandleVideoProxy(w http.ResponseWriter, r *http.Request) {
+	incrementStat("total", "video")
+
+	path := r.URL.Path
+	key := strings.TrimPrefix(path, "/video/proxy/")
+	if key == "" || key == path {
+		http.Error(w, "缺少视频key", http.StatusBadRequest)
+		return
+	}
+
+	content, contentType, err := fqapi.HandleVideoProxy(key)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
+	if closer, ok := content.(io.Closer); ok {
+		defer closer.Close()
+	}
+	w.Header().Set("Content-Type", contentType)
+	http.ServeContent(w, r, key+".mp4", time.Time{}, content)
+}
+
 // HandleManga 漫画处理
 func HandleManga(w http.ResponseWriter, r *http.Request) {
 	incrementStat("total", "manga")
Author	SHA1	Message	Date
chenxin	089ce55d22	✨ feat(bookSource): 重写聚合书源，支持小说/听书/漫画/短剧与段评 - 朴素相对 URL 模式：searchUrl/bookUrl/tocUrl/chapterUrl 全链路，跨规则状态 java.put 传递，弃用 data:;base64 链（真实阅读端解码语义不符） - 四模式分流：小说/听书/漫画/短剧；搜索支持 x:/t:/m:/d: 前缀；听书优先视频原声回退 TTS，短剧走 CENC 解密代理直链自动播放，空正文回退漫画图片（兼容 data 与 data.images 两种响应结构） - 段评气泡：对接 /content?review=keep 注入的 <comment> 标记，纯 JS base64（规避部分版本 API 差异），点击打开 /review_html 评论页 - 发现页：设置选择按钮两两一行、男频/女频频道切换（分类减半）、搜索框按类型自动加前缀、分类一行 3 个统一排版 - 短剧搜索 video_data 字段归一化（series_id→book_id、title→book_name、cover→thumb_url、演员→author） - 兼容性：设置存取走 cache（全规则环境可用），BaseUrl 三级兜底（source→book.origin→baseUrl），段评正则兼容 <p idx> 属性，无登录页依赖	2026-10-10 02:09:29 +08:00
chenxin	a652049ba4	🔧 fix(deploy): nginx 模板自带 443 配置，防止 --sync-nginx 覆盖证书段 - 原模板仅 80，443 依赖 certbot --nginx 注入，--sync-nginx 整文件覆盖会抹掉注入配置导致证书回退 - 检测 /etc/letsencrypt/live/<域名>/ 证书存在时自动启用 443，80 仅留 ACME 验证与 301 跳转 - certbot 改用 certonly --webroot，不再改写 nginx 配置；反代 location 抽取为 80/443 共享段	2026-10-10 02:09:29 +08:00
chenxin	0aed60713a	✨ feat(video): 新增视频 CENC 解密与流式代理播放 - 逆向 SpadeA(黑桃A) PlayAuth 混淆，从 spade_a 还原 AES-128 内容密钥 - 实现 cenc-aes-ctr MP4 解密（senc 逐样本 CTR + stsd entry 修复），实测可播放 - 新增 /video/proxy/{key} 代理：稳定 key + 磁盘缓存（二次命中提速 130x）+ http.ServeContent 支持 Range/206/seek 流式播放 - /video 接口新增 output(url/proxy，默认 proxy) 与 quality(max/720p/档位key) 参数，可由 config fanqie.video.* 配置默认值；无匹配清晰度时明确报错 - 代理映射复用 audio_cache 存储，抽取 loadMediaProxyEntry 共用；挂接 7 天缓存清理 - deploy.sh 新增 --sync-nginx：备份→重写→校验→失败自动回滚，同步视频代理段配置	2026-10-09 23:56:32 +08:00
chenxin	162dde9222	✨ feat(bookSource): 新增番茄小说书源配置文件	2026-10-09 23:04:59 +08:00