# Cloudflare Worker Setup (Dashboard — no Wrangler)

## 1. Deploy code

1. [Cloudflare Dashboard](https://dash.cloudflare.com) → **Workers & Pages** → your worker (or **Create**)
2. **Edit code** → paste entire `workers-deploy.js` → **Deploy**
3. Verify: `curl https://kikasports.com/health` → `"version":10.1`, `"provider":"vidnest-proxy"`

**v10.1 (critical):** Fixes Sigma stutter — PNG segments on `/v/m/` were treated as MP4 and never stripped. Purge Cloudflare cache for `/v/m/*` after deploy.

**v10.0:** Strips Sigma PNG-wrapped MPEG-TS at the edge (`video/mp2t`), caches stripped segments. API prefers Alfa over Sigma (`format`, `heavy`, `provider` fields).

**v9.3:** Fixes `ALLOWED_ORIGINS` for HLS/MP4 playback — hostname matching, `Referer` fallback, per-request CORS on cache hits. Set the **same** value on worker + cPanel.

**v9.2:** MP4 byte-range streaming (206), no full-file worker cache, strips `Content-Disposition: attachment` for inline video. **Required** for Catflix MP4.

**v9.1:** Proxies `#EXT-X-MAP` init segments (fMP4 HLS). **Required** for Alfa/Ophim HLS.

## 2. Custom domain

1. Worker → **Settings** → **Domains & Routes** → **Add** → **Custom Domain**
2. Enter e.g. `kikasports.com`
3. Set cPanel `.env`:
   ```
   WORKER_URL=https://kikasports.com
   ```

## 3. Config (pick one method)

### Method A — Edit file (top of `workers-deploy.js`)

```javascript
const INLINE_CONFIG = {
  ALLOWED_ORIGINS: 'moviebite.cc,localhost',
};
```

Use **hostnames only** (no `https://`, no port). For local dev add `localhost`.

- `moviebite.cc` → allows `https://moviebite.cc` and `https://www.moviebite.cc`
- `localhost` → allows `http://localhost:5002`, `http://127.0.0.1:3000`, etc.

Set the **same** `ALLOWED_ORIGINS` on cPanel `.env` and the worker.

Leave `ALLOWED_ORIGINS: ''` for **open access** (no blocking, CORS `*`).

### Method B — Worker Variables (dashboard)

| Name | Value | Notes |
|------|-------|-------|
| `ALLOWED_ORIGINS` | `moviebite.cc,localhost` | Hostnames only. Leave empty = open access |

## 4. Cache rules (Cloudflare zone)

**Rule 1 — Video segments (30 days)**
```
URI Path starts with /v/m/
Edge TTL: 30 days
```

**Rule 2 — HLS playlists (5 min)**
```
URI Path starts with /v/h/
Edge TTL: 5 minutes
```

**Rule 3 — Subtitles (7 days)**
```
URI Path starts with /v/t/
Edge TTL: 7 days
```

## 5. Verify

```bash
curl https://kikasports.com/health
curl https://movie.sportsbite.xyz/api/health
curl https://movie.sportsbite.xyz/api/movie/550
```