Replace the plain /youtubei/v1/player request (made through the proxy,
and therefore bound to the proxy's egress IP) with an encrypted Onesie
request using the WEB client. Onesie is proxied by YouTube's "trusted
bandaid", so the returned player response - and the server_abr_streaming_url
inside it - is not tied to our egress IP. Media is still pulled over SABR
(sabr_scheme_plugin.js); only how the player response is obtained changes.
- sabr_onesie.js: new module, window.fetchOnesiePlayerResponse(). Builds the
WEB player request, encrypts it (OnesieInnertubeRequest + OnesieRequest),
POSTs to the onesie endpoint through /proxy, parses ONESIE_HEADER/ONESIE_DATA
UMP parts, gunzips/decrypts, returns the raw player response JSON. Adapted
from googlevideo/examples/onesie-request and invidious-secret-companion's
WEB-client variant.
- sabr_helpers.js: add decryptResponse() (AES-CTR + HMAC verify), companion to
the existing encryptRequest().
- sabr_loader.js: expose window.YT so a VideoInfo can be built from the raw
onesie player response.
- sabr_player.js: in loadVideo(), fetch the player response via Onesie and wrap
it in new YT.VideoInfo(...); fall back to innertube.getInfo() on failure.
- player.ecr: load sabr_onesie.js before sabr_player.js.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
