diff --git a/CHANGELOG.txt b/CHANGELOG.txt
index 59315539..498f2e00 100644
--- a/CHANGELOG.txt
+++ b/CHANGELOG.txt
@@ -4,10 +4,11 @@ New features:
 
  * Support for images stored within SVG tags (#268)
  * Option to allow rules to be run under archive.org's Wayback Machine (disabled by default)
+ * Option to bypass CSP restrictions when loading 3rd-party libraries from the userscript (disabled by default)
 
 Improvements:
 
- * Various improvements/fixes to existing rules (including Flickr, Instagram, Shopify, TikTok, Twitch)
+ * Various improvements/fixes to existing rules (including Flickr, Instagram, Shopify, Snapchat, TikTok, Twitch)
 
 Special thanks to Flame, TheOne, fyhtma, Tenome, Freso, IZeeLikeEyeZee, TristanWasTaken, sn3akyb3ar, remlap for their contributions and reports for this release
 
diff --git a/src/userscript.ts b/src/userscript.ts
index 23070bd0..9296b6b6 100644
--- a/src/userscript.ts
+++ b/src/userscript.ts
@@ -13359,6 +13359,7 @@ var $$IMU_EXPORT$$;
 		allow_apicalls: true,
 		allow_thirdparty_libs: is_userscript ? false : true,
 		custom_xhr_for_lib: is_extension ? true : false,
+		bypass_csp_for_lib: false,
 		use_webarchive_for_lib: false,
 		lib_integrity_check: true,
 		allow_thirdparty_code: false,
@@ -16257,6 +16258,23 @@ var $$IMU_EXPORT$$;
 			},
 			needrefresh: true // todo: clear the library cache (or only for xhr ones)
 		},
+		bypass_csp_for_lib: {
+			name: "Bypass CSP for libraries",
+			description: "Tries loading the 3rd-party libraries using a `<script>` tag if a page's CSP prevents it from being loaded normally.\nThis option currently carries an increased security risk when combined with \"Custom XHR for libraries\", and should only be enabled if absolutely necessary.",
+			category: "general",
+			subcategory: "libraries",
+			userscript_only: true,
+			requires: {
+				allow_thirdparty_libs: true
+			},
+			example_websites: [
+				"Snapchat"
+			],
+			warning: {
+				"true": "This can potentially be extremely insecure if \"Custom XHR for libraries\" is also enabled.\nA malicious website could gain extension-level permissions and perform arbitrary requests (your online accounts could get hacked).\nIf you need to use this option, please disable it as soon as possible."
+			},
+			needrefresh: true // todo: clear the library cache (or only for xhr ones)
+		},
 		use_webarchive_for_lib: {
 			name: "Use Web Archive for libraries",
 			description: "Uses archive.org's web archive instead of github for libraries and other script internals (such as the options page).\nDon't enable this unless you need to.",
@@ -18995,11 +19013,12 @@ var $$IMU_EXPORT$$;
 		return (crc ^ (-1)) >>> 0;
 	};
 
-	var custom_xhr = function() {
+	var custom_xhr = function(orig_xhr) {
 		this._headers = {};
 		this._response_headers = {};
 		this._reqobj = null;
 		this._last_readyState = null;
+		this._realxhr = null;
 
 		this.open = function(method, url, synchronous) {
 			this._method = method;
@@ -19011,10 +19030,17 @@ var $$IMU_EXPORT$$;
 		};
 
 		this.getResponseHeader = function(headername) {
+			if (this._realxhr)
+				return this._realxhr.getResponseHeader(headername);
+
 			return headerobj_get(this._response_headers, headername);
 		};
 
 		this.getAllResponseHeaders = function() {
+			if (this._realxhr) {
+				return this._realxhr.getAllResponseHeaders();
+			}
+
 			return this._response_headers_raw;
 		};
 
@@ -19076,7 +19102,47 @@ var $$IMU_EXPORT$$;
 			}
 		};
 
+		var _send_orig = function(_this, data) {
+			var xhr = new orig_xhr();
+			this._realxhr = xhr;
+			xhr.open(this._method, this._url, true);
+
+			xhr.responseType = _this.responseType;
+			xhr.withCredentials = _this.withCredentials;
+			xhr.timeout = _this.timeout;
+
+			for (var headername in this._headers) {
+				xhr.setRequestHeader(headername, this._headers[headername]);
+			}
+
+			var allevents = ["load", "loadend", "error", "abort", "progress", "timeout", "readystatechange"];
+			for (var i = 0; i < allevents.length; i++) {
+				var onevent = "on" + allevents[i];
+				(function(onevent) {
+					if (onevent in _this) {
+						xhr[onevent] = function(e) {
+							var copyprops = ["status", "statusText", "response", "readyState", "responseText", "responseType", "responseURL"];
+							for (var i = 0; i < copyprops.length; i++) {
+								var prop = copyprops[i];
+								try {
+									_this[prop] = xhr[prop];
+								} catch (e) {} // this is expected for earlier props
+							}
+
+							_this[onevent].bind(_this)(e);
+						};
+					}
+				})(onevent);
+			}
+
+			xhr.send(data);
+		};
+
 		this.send = function(_this, data, do_request) {
+			if (this._url && orig_xhr && /^blob:/.test(this._url)) {
+				return _send_orig.bind(this)(_this, data);
+			}
+
 			var reqobj = {
 				method: this._method,
 				url: this._url,
@@ -19095,11 +19161,10 @@ var $$IMU_EXPORT$$;
 				};
 			};
 
-			add_listener(this, "load");
-			add_listener(this, "error");
-			add_listener(this, "abort");
-			add_listener(this, "progress");
-			add_listener(this, "timeout");
+			var allevents = ["load", "error", "abort", "progress", "timeout"];
+			for (var i = 0; i < allevents.length; i++) {
+				add_listener(this, allevents[i]);
+			}
 
 			this._reqobj = do_request(reqobj);
 		};
@@ -19114,8 +19179,9 @@ var $$IMU_EXPORT$$;
 
 	(custom_xhr as any).do_request = do_request;
 
+	var orig_XMLHttpRequest:any; // hack for typescript, custom_xhr_wrap is not executed in this scope
 	var custom_xhr_wrap = function() {
-		var real = new imu_xhr.custom_xhr();
+		var real = new imu_xhr.custom_xhr(orig_XMLHttpRequest);
 
 		var copy = ["open", "setRequestHeader", "getResponseHeader", "getAllResponseHeaders", "abort"];
 		for (var i = 0; i < copy.length; i++) {
@@ -19135,10 +19201,118 @@ var $$IMU_EXPORT$$;
 		}
 	};
 
-	var run_sandboxed_lib = function(fdata, xhr) {
+	var add_scripttag_function = function(body:string) {
+		// https://violentmonkey.github.io/posts/inject-scripts-with-blob-urls/
+		if (false) {
+			let script = document.createElement("script");
+			script.textContent = body;
+			document.documentElement.appendChild(script);
+			document.documentElement.removeChild(script);
+		} else {
+			let script = document.createElement("script");
+
+			new_blob([body], function(blob) {
+				let url = create_objecturl(blob);
+				script.src = url;
+
+				document.documentElement.appendChild(script);
+				revoke_objecturl(url); // revoking before removing the script so that websites monitoring elements removed won't be able to inspect the script
+				script.src = null;
+				document.documentElement.removeChild(script);
+			}, {type: 'text/javascript'});
+		}
+	};
+
+	type InjectedFunctionData = {
+		data: any,
+		varname: string
+	};
+
+	// FIXME: this is potentially insecure.
+	// A website could theoretically monitor script tags added, read the blob URL, figure out the password, and run the data function to access sensitive information (namely, custom_xhr)
+	// Since the data function can only be run once, this may render an attack harder.
+	// This function is gated behind bypass_csp_for_lib, which is disabled by default (with a scary warning to deter users from enabling it).
+	var new_scripttag_function = function(body:string, data:InjectedFunctionData, cb) {
+		let win = get_window();
+
+		let imu_export_varname = common_functions["gen_jquery_callback"](); // we want this to remain unobvious to deter detection
+		let script_preamble = "(function(){window['" + imu_export_varname + "']=(function(){";
+
+		let imu_cb_varname = common_functions["gen_jquery_callback"]();
+		// TODO: wrap in try/catch
+		let script_postfix = "})();" + imu_cb_varname + "();})();";
+
+		// TODO: minify
+		win[imu_cb_varname] = function() {
+			delete win[imu_cb_varname];
+			let exported = win[imu_export_varname];
+			delete win[imu_export_varname];
+
+			if (data) {
+				delete win[imu_data_varname];
+			}
+
+			cb(exported);
+		};
+
+		let imu_data_varname = null;
+		if (data) {
+			imu_data_varname = common_functions["gen_jquery_callback"]();
+			let imu_data_password = get_random_text(50);
+
+			(function() {
+				let b = imu_data_password;
+				let c = data.data;
+				let d = false;
+
+				// function is minified to reduce detection.
+				//
+				// unminified (pseudocode):
+				//
+				// function get_data_func(password:string) {
+				//   if (password !== imu_data_password || ran) {
+				//     return false;
+				//   }
+				//   ran = true;
+				//   return data.data;
+				// }
+				let get_data_func = function(a:string) {if (a!==b||d)return;d=!0;return c;};
+				win[imu_data_varname] = get_data_func;
+			})();
+
+			script_preamble += 'var ' + data.varname + '=' + imu_data_varname + "('" + imu_data_password + "');";
+		}
+
+		let scriptbody = script_preamble + body + script_postfix;
+
+		add_scripttag_function(scriptbody);
+	};
+
+	var new_function = function(scriptbody:string, data:InjectedFunctionData, cb):any {
+		try {
+			if (!data) {
+				let func = new Function(scriptbody)();
+				cb(func);
+			} else {
+				let func = new Function(data.varname, scriptbody)(data.data);
+				cb(func);
+			}
+		} catch (e) {
+			// blocked by csp?
+			if (is_userscript && settings.bypass_csp_for_lib) {
+				console_warn(e);
+				return new_scripttag_function(scriptbody, data, cb);
+			} else {
+				console_error(e);
+				return cb(null);
+			}
+		}
+	};
+
+	var run_sandboxed_lib = function(fdata, xhr, cb) {
 		if (true) {
 			if (!xhr) {
-				return new Function(fdata + ";return lib_export;")();
+				return new_function(fdata + ";return lib_export;", null, cb);
 			} else {
 				var overridden_xhr = true;
 				if (!settings.custom_xhr_for_lib)
@@ -19147,13 +19321,16 @@ var $$IMU_EXPORT$$;
 				var endshim = ";return {lib: lib_export, xhr: XMLHttpRequest, overridden_xhr: " + overridden_xhr + "};";
 				if (overridden_xhr) {
 					// inefficient, but it allows multiple overrides for do_request
-					var startshim = "var XMLHttpRequest=null;(function(imu_xhr){XMLHttpRequest=" + custom_xhr_wrap.toString() + ";XMLHttpRequest.do_request = imu_xhr.do_request;})(imu_xhr);imu_xhr = undefined;";
-					return new Function("imu_xhr", startshim + fdata + endshim)({
-						custom_xhr: custom_xhr,
-						do_request: do_request
-					});
+					var startshim = "var orig_XMLHttpRequest=null;try{orig_XMLHttpRequest=window.XMLHttpRequest}catch (e){console.error(e);};var XMLHttpRequest=null;(function(imu_xhr){XMLHttpRequest=" + custom_xhr_wrap.toString() + ";XMLHttpRequest.do_request = imu_xhr.do_request;})(imu_xhr);imu_xhr = undefined;";
+					return new_function(startshim + fdata + endshim, {
+						varname: "imu_xhr",
+						data: {
+							custom_xhr: custom_xhr,
+							do_request: do_request
+						}
+					}, cb);
 				} else {
-					return new Function(fdata + endshim)();
+					return new_function(fdata + endshim, null, cb);
 				}
 			}
 		} else {
@@ -19168,9 +19345,9 @@ var $$IMU_EXPORT$$;
 		}
 	};
 
-	var run_sandboxed_lib_safe = function(fdata, xhr) {
+	var run_sandboxed_lib_safe = function(fdata, xhr, cb) {
 		try {
-			var result = run_sandboxed_lib(fdata, xhr);
+			var result = run_sandboxed_lib(fdata, xhr, cb);
 			return result;
 		} catch (e) {
 			console_error(e);
@@ -19281,7 +19458,9 @@ var $$IMU_EXPORT$$;
 							return done(null, 0); // 0 instead of false because it will never be available
 
 						//done(new Function(response.data.text + ";return lib_export;")(), 0);
-						done(run_sandboxed_lib(response.data.text, lib_obj.xhr), 0);
+						run_sandboxed_lib(response.data.text, lib_obj.xhr, function(exported) {
+							done(exported, 0);
+						});
 					});
 				} else {
 					// For the userscript, we have no other choice than to query and run arbitrary JS.
@@ -19380,7 +19559,10 @@ var $$IMU_EXPORT$$;
 								if (is_dev) console_log("Check time:", Date.now() - start_time);
 							}
 
-							done(run_sandboxed_lib_safe(libcontents, lib_obj.xhr), 0);
+							run_sandboxed_lib_safe(libcontents, lib_obj.xhr, function(exported) {
+								done(exported, 0);
+							});
+							//done(run_sandboxed_lib_safe(libcontents, lib_obj.xhr), 0);
 							//done(new Function(libcontents + ";return lib_export;")(), 0);
 						}
 					});
@@ -26130,7 +26312,9 @@ var $$IMU_EXPORT$$;
 			// https://img1.daumcdn.net/kakaotv/2016/player/web/pc/bg_box.png -- thanks to ambler on discord for reporting
 			// https://t1.daumcdn.net/kakaotv/2016/pw/img_backlogo.png
 			// https://t1.daumcdn.net/kakaotv/2016/pw/img_backcover.jpg
+			// https://t1.daumcdn.net/tistory_admin/lib/lightbox/images/next.png
 			if (/\/cafe_image\/+fancafe\/+[0-9]+\/+fancafe-cheer-color-bg\./.test(src) ||
+				/\/tistory_admin\/+lib\/+lightbox\//.test(src) ||
 				/\/kakaotv\/+[0-9]+\/+(?:pw|player\/+web)\/+(?:(?:new|pc)\/+)?(?:slider_mask|bg_box|img_back(?:logo|cover))/.test(src)) {
 				return {
 					url: src,
@@ -31437,7 +31621,7 @@ var $$IMU_EXPORT$$;
 			// https://vcdn.polarismedia.no/a6d4c603-c9e5-4899-8fa2-1b122271c9b8?fit=crop&h=600&q=80&tight=false&w=1000
 			domain === "vcdn.polarismedia.no" ||
 			// https://assistant.gloria.tv/1z94gyaCTBei3D8MsGrYwjE6j/9kguycj0c4267ea2fyoe3xqkq5vnxzhnybwzynt.webp?crop=1080.1080.677.0&still=on&scale=128&format=webp
-			domain === "assistant.gloria.tv" ||
+			//domain === "assistant.gloria.tv" ||
 			// thanks to jonestly on discord:
 			// https://thumbnails.cbc.ca/maven_legacy/thumbnails/270/427/1-nn-renner-accident-020123.jpg?crop=1.777xh:h;*,*&downsize=1130px:*
 			domain === "thumbnails.cbc.ca" ||
@@ -89914,6 +90098,14 @@ var $$IMU_EXPORT$$;
 			return obj;
 		}
 
+		if (domain === "cf-st.sc-cdn.net") {
+			// https://cf-st.sc-cdn.net/aps/bolt_web/aHR0cHM6Ly9j[...]._RS48,72_FMwebp
+			match = src.match(/\/(aHR0cHM[^/.?#]+)/);
+			if (match) {
+				return base64_decode(match[1]);
+			}
+		}
+
 		if (host_domain_nosub === "snapchat.com" && options.do_request && options.cb && options.element) {
 			// https://www.snapchat.com/add/jordynjones11
 			// https://story.snapchat.com/s/jordynjones11
@@ -89926,6 +90118,22 @@ var $$IMU_EXPORT$$;
 				};
 			}
 
+			if (!src && options.element.tagName === "VIDEO") {
+				let source_els = options.element.querySelectorAll("source");
+				let sources = [];
+				for (let source of source_els) {
+					array_upush(sources, source.getAttribute("src"));
+				}
+				if (sources[0]) {
+					let is_hls = /\.m3u8/.test(sources[0]);
+					return {
+						url: sources[0],
+						video: is_hls ? "hls" : true,
+						need_blob: !is_hls
+					};
+				}
+			}
+
 			if (src && /\.mp4/.test(src)) {
 				return {
 					url: src,
@@ -104563,7 +104771,109 @@ var $$IMU_EXPORT$$;
 				return newsrc.replace(/:\/\/img\./, "://c1.");
 		}
 
+		if (domain === "assistant.gloria.tv") {
+			// https://assistant.gloria.tv/1z94gyaCTBei3D8MsGrYwjE6j/0mjj3brlc4t0hkd7ahx704m0o8sih0ewktgkect.webp?secure=[...]&expires=[...]&scale=256&webp=on -- 256x178
+			//   https://assistant.gloria.tv/1z94gyaCTBei3D8MsGrYwjE6j/0mjj3brlc4t0hkd7ahx704m0o8sih0ewktgkect.webp?secure=[...]&expires=[...] -- 1739x1209
+			newsrc = keep_queries(src, ["secure", "expires"]);
+			if (newsrc !== src)
+				return newsrc;
+		}
+
+		if (domain_nowww === "gloria.tv") {
+			newsrc = website_query({
+				website_regex: /^[a-z]+:\/\/[^/]+\/+post\/+([a-zA-Z0-9]{10,})(?:\/.*)?(?:[?#].*)?$/,
+				query_for_id: "https://gloria.tv/post/${id}",
+				process: function(done, resp, cache_key) {
+					var sources = common_functions["get_videotag_sources"](resp.responseText);
+					if (!sources || !sources.video) {
+						console_error(cache_key, "Unable to find sources in", resp);
+						return done(null, false);
+					}
+
+					sources.video.sort((a, b) => {
+						if (a.args.type === "application/x-mpegurl")
+							return -1;
+						if (b.args.type === "application/x-mpegurl")
+							return 1;
+
+						var a_quality_str = a.args["data-quality"];
+						var b_quality_str = b.args["data-quality"];
+
+						if (!a_quality_str || !b_quality_str) {
+							console_warn(cache_key, "Unable to find data-quality in", a, b);
+							return 0;
+						}
+
+						var a_quality = JSON_parse(a_quality_str);
+						var b_quality = JSON_parse(b_quality_str);
+
+						return b_quality.bitrate - a_quality.bitrate;
+					});
+
+					var extra = {};
+
+					var datetime_match = resp.responseText.match(/<a href="[^"]+\/replies".*<time datetime="([^"]+)"/);
+					if (datetime_match)
+						extra.created_date = new Date(datetime_match[1]).getTime();
+
+					var title = get_meta(resp.responseText, "og:title");
+					if (title)
+						extra.caption = title;
+					extra.page = resp.finalUrl;
+
+					var urls = [];
+					array_extend(urls, array_map(sources.video, value => {
+						var url = value.url;
+						var video:VideoProp = true;
+						var can_head = true;
+						if (value.args.type === "application/x-mpegurl") {
+							video = "hls";
+							can_head = false; // 405
+						}
+
+						return {
+							url: urljoin(resp.finalUrl, url, true),
+							headers: {
+								Referer: resp.finalUrl
+							},
+							can_head,
+							video
+						};
+					}));
+					array_extend(urls, sources.image);
+
+					return done(fillobj_urls(urls, {extra}), 6*60*60);
+				}
+			});
+			if (newsrc) return newsrc;
+		}
+
 		if (host_domain_nowww === "gloria.tv") {
+			if (options.element && options.do_request && options.cb) {
+				let element = common_functions["get_parent_el_matching"](options.element, function(x) {
+					return x.hasAttribute("data-notify");
+				});
+
+				if (element) {
+					try {
+						let media = JSON_parse(element.getAttribute("data-notify"));
+						if (media.id) {
+							return {
+								url: "https://gloria.tv/post/" + media.id,
+								is_pagelink: true
+							};
+						}
+					} catch (e) {
+						console_error(e);
+					}
+				} else if (options.host_url && options.element.tagName === "VIDEO" && options.element.matches("div.leading > header > figure.video > video")) {
+					return {
+						url: options.host_url,
+						is_pagelink: true
+					};
+				}
+			}
+
 			if (!src && origsrc && options.element && options.element.classList.contains("play")) {
 				return {
 					url: origsrc,
@@ -107146,6 +107456,15 @@ var $$IMU_EXPORT$$;
 			}
 		}
 
+		if (domain_nosub === "loyalfans.com" && /^public-cdn[0-9]*\./.test(domain)) {
+			// thanks to anonymous for reporting:
+			// https://public-cdn2.loyalfans.com/images/MhtnF2T4zrcXbOnfa3Z0TWwYtjEY3Yt9xcY6WgMUNDw/timeline/0_16631100_1691533391_20230808222311_680__pmd.jpg
+			//   https://public-cdn2.loyalfans.com/images/MhtnF2T4zrcXbOnfa3Z0TWwYtjEY3Yt9xcY6WgMUNDw/timeline/0_16631100_1691533391_20230808222311.jpg
+			// https://public-cdn2.loyalfans.com/images/MhtnF2T4zrcXbOnfa3Z0TWwYtjEY3Yt9xcY6WgMUNDw/profile/0_89135100_1693412111_20230830161511_475_475_sq.jpg
+			//   https://public-cdn2.loyalfans.com/images/MhtnF2T4zrcXbOnfa3Z0TWwYtjEY3Yt9xcY6WgMUNDw/profile/0_89135100_1693412111_20230830161511.jpg
+			return src.replace(/(\/images\/+[^/]+\/+(?:timeline|profile)\/+[0-9]+_[0-9]+_[0-9]+_[0-9]+)_[^/.?#]+(\.[^/.]+)(?:[?#].*)?$/, "$1$2");
+		}
+
 
 
 
diff --git a/userscript.user.js b/userscript.user.js
index bc8aec11..d06c0319 100644
--- a/userscript.user.js
+++ b/userscript.user.js
@@ -12635,6 +12635,7 @@ var $$IMU_EXPORT$$;
 		allow_apicalls: true,
 		allow_thirdparty_libs: is_userscript ? false : true,
 		custom_xhr_for_lib: is_extension ? true : false,
+		bypass_csp_for_lib: false,
 		use_webarchive_for_lib: false,
 		lib_integrity_check: true,
 		allow_thirdparty_code: false,
@@ -15494,6 +15495,23 @@ var $$IMU_EXPORT$$;
 			},
 			needrefresh: true // todo: clear the library cache (or only for xhr ones)
 		},
+		bypass_csp_for_lib: {
+			name: "Bypass CSP for libraries",
+			description: "Tries loading the 3rd-party libraries using a `<script>` tag if a page's CSP prevents it from being loaded normally.\nThis option currently carries an increased security risk when combined with \"Custom XHR for libraries\", and should only be enabled if absolutely necessary.",
+			category: "general",
+			subcategory: "libraries",
+			userscript_only: true,
+			requires: {
+				allow_thirdparty_libs: true
+			},
+			example_websites: [
+				"Snapchat"
+			],
+			warning: {
+				"true": "This can potentially be extremely insecure if \"Custom XHR for libraries\" is also enabled.\nA malicious website could gain extension-level permissions and perform arbitrary requests (your online accounts could get hacked).\nIf you need to use this option, please disable it as soon as possible."
+			},
+			needrefresh: true // todo: clear the library cache (or only for xhr ones)
+		},
 		use_webarchive_for_lib: {
 			name: "Use Web Archive for libraries",
 			description: "Uses archive.org's web archive instead of github for libraries and other script internals (such as the options page).\nDon't enable this unless you need to.",
@@ -17820,11 +17838,12 @@ var $$IMU_EXPORT$$;
 		}
 		return (crc ^ (-1)) >>> 0;
 	};
-	var custom_xhr = function() {
+	var custom_xhr = function(orig_xhr) {
 		this._headers = {};
 		this._response_headers = {};
 		this._reqobj = null;
 		this._last_readyState = null;
+		this._realxhr = null;
 		this.open = function(method, url, synchronous) {
 			this._method = method;
 			this._url = url;
@@ -17833,9 +17852,14 @@ var $$IMU_EXPORT$$;
 			headerobj_set(this._headers, headername, headervalue);
 		};
 		this.getResponseHeader = function(headername) {
+			if (this._realxhr)
+				return this._realxhr.getResponseHeader(headername);
 			return headerobj_get(this._response_headers, headername);
 		};
 		this.getAllResponseHeaders = function() {
+			if (this._realxhr) {
+				return this._realxhr.getAllResponseHeaders();
+			}
 			return this._response_headers_raw;
 		};
 		var _handle_event = function(_this, name, data) {
@@ -17894,7 +17918,40 @@ var $$IMU_EXPORT$$;
 					_this.ontimeout.bind(_this)(event);
 			}
 		};
+		var _send_orig = function(_this, data) {
+			var xhr = new orig_xhr();
+			this._realxhr = xhr;
+			xhr.open(this._method, this._url, true);
+			xhr.responseType = _this.responseType;
+			xhr.withCredentials = _this.withCredentials;
+			xhr.timeout = _this.timeout;
+			for (var headername in this._headers) {
+				xhr.setRequestHeader(headername, this._headers[headername]);
+			}
+			var allevents = ["load", "loadend", "error", "abort", "progress", "timeout", "readystatechange"];
+			for (var i = 0; i < allevents.length; i++) {
+				var onevent = "on" + allevents[i];
+				(function(onevent) {
+					if (onevent in _this) {
+						xhr[onevent] = function(e) {
+							var copyprops = ["status", "statusText", "response", "readyState", "responseText", "responseType", "responseURL"];
+							for (var i = 0; i < copyprops.length; i++) {
+								var prop = copyprops[i];
+								try {
+									_this[prop] = xhr[prop];
+								} catch (e) { } // this is expected for earlier props
+							}
+							_this[onevent].bind(_this)(e);
+						};
+					}
+				})(onevent);
+			}
+			xhr.send(data);
+		};
 		this.send = function(_this, data, do_request) {
+			if (this._url && orig_xhr && /^blob:/.test(this._url)) {
+				return _send_orig.bind(this)(_this, data);
+			}
 			var reqobj = {
 				method: this._method,
 				url: this._url,
@@ -17910,11 +17967,10 @@ var $$IMU_EXPORT$$;
 					_handle_event.bind(our_this)(_this, event, resp);
 				};
 			};
-			add_listener(this, "load");
-			add_listener(this, "error");
-			add_listener(this, "abort");
-			add_listener(this, "progress");
-			add_listener(this, "timeout");
+			var allevents = ["load", "error", "abort", "progress", "timeout"];
+			for (var i = 0; i < allevents.length; i++) {
+				add_listener(this, allevents[i]);
+			}
 			this._reqobj = do_request(reqobj);
 		};
 		this.abort = function() {
@@ -17924,8 +17980,9 @@ var $$IMU_EXPORT$$;
 		};
 	};
 	custom_xhr.do_request = do_request;
+	var orig_XMLHttpRequest; // hack for typescript, custom_xhr_wrap is not executed in this scope
 	var custom_xhr_wrap = function() {
-		var real = new imu_xhr.custom_xhr();
+		var real = new imu_xhr.custom_xhr(orig_XMLHttpRequest);
 		var copy = ["open", "setRequestHeader", "getResponseHeader", "getAllResponseHeaders", "abort"];
 		for (var i = 0; i < copy.length; i++) {
 			var item = copy[i];
@@ -17942,10 +17999,98 @@ var $$IMU_EXPORT$$;
 			return real.send(this, data, XMLHttpRequest.do_request);
 		};
 	};
-	var run_sandboxed_lib = function(fdata, xhr) {
+	var add_scripttag_function = function(body) {
+		// https://violentmonkey.github.io/posts/inject-scripts-with-blob-urls/
+		if (false) {
+			var script = document.createElement("script");
+			script.textContent = body;
+			document.documentElement.appendChild(script);
+			document.documentElement.removeChild(script);
+		} else {
+			var script_1 = document.createElement("script");
+			new_blob([body], function(blob) {
+				var url = create_objecturl(blob);
+				script_1.src = url;
+				document.documentElement.appendChild(script_1);
+				revoke_objecturl(url); // revoking before removing the script so that websites monitoring elements removed won't be able to inspect the script
+				script_1.src = null;
+				document.documentElement.removeChild(script_1);
+			}, { type: 'text/javascript' });
+		}
+	};
+	// FIXME: this is potentially insecure.
+	// A website could theoretically monitor script tags added, read the blob URL, figure out the password, and run the data function to access sensitive information (namely, custom_xhr)
+	// Since the data function can only be run once, this may render an attack harder.
+	// This function is gated behind bypass_csp_for_lib, which is disabled by default (with a scary warning to deter users from enabling it).
+	var new_scripttag_function = function(body, data, cb) {
+		var win = get_window();
+		var imu_export_varname = common_functions["gen_jquery_callback"](); // we want this to remain unobvious to deter detection
+		var script_preamble = "(function(){window['" + imu_export_varname + "']=(function(){";
+		var imu_cb_varname = common_functions["gen_jquery_callback"]();
+		// TODO: wrap in try/catch
+		var script_postfix = "})();" + imu_cb_varname + "();})();";
+		// TODO: minify
+		win[imu_cb_varname] = function() {
+			delete win[imu_cb_varname];
+			var exported = win[imu_export_varname];
+			delete win[imu_export_varname];
+			if (data) {
+				delete win[imu_data_varname];
+			}
+			cb(exported);
+		};
+		var imu_data_varname = null;
+		if (data) {
+			imu_data_varname = common_functions["gen_jquery_callback"]();
+			var imu_data_password_1 = get_random_text(50);
+			(function() {
+				var b = imu_data_password_1;
+				var c = data.data;
+				var d = false;
+				// function is minified to reduce detection.
+				//
+				// unminified (pseudocode):
+				//
+				// function get_data_func(password:string) {
+				//   if (password !== imu_data_password || ran) {
+				//     return false;
+				//   }
+				//   ran = true;
+				//   return data.data;
+				// }
+				var get_data_func = function(a) { if (a !== b || d)
+					return; d = !0; return c; };
+				win[imu_data_varname] = get_data_func;
+			})();
+			script_preamble += 'var ' + data.varname + '=' + imu_data_varname + "('" + imu_data_password_1 + "');";
+		}
+		var scriptbody = script_preamble + body + script_postfix;
+		add_scripttag_function(scriptbody);
+	};
+	var new_function = function(scriptbody, data, cb) {
+		try {
+			if (!data) {
+				var func = new Function(scriptbody)();
+				cb(func);
+			} else {
+				var func = new Function(data.varname, scriptbody)(data.data);
+				cb(func);
+			}
+		} catch (e) {
+			// blocked by csp?
+			if (is_userscript && settings.bypass_csp_for_lib) {
+				console_warn(e);
+				return new_scripttag_function(scriptbody, data, cb);
+			} else {
+				console_error(e);
+				return cb(null);
+			}
+		}
+	};
+	var run_sandboxed_lib = function(fdata, xhr, cb) {
 		if (true) {
 			if (!xhr) {
-				return new Function(fdata + ";return lib_export;")();
+				return new_function(fdata + ";return lib_export;", null, cb);
 			} else {
 				var overridden_xhr = true;
 				if (!settings.custom_xhr_for_lib)
@@ -17953,13 +18098,16 @@ var $$IMU_EXPORT$$;
 				var endshim = ";return {lib: lib_export, xhr: XMLHttpRequest, overridden_xhr: " + overridden_xhr + "};";
 				if (overridden_xhr) {
 					// inefficient, but it allows multiple overrides for do_request
-					var startshim = "var XMLHttpRequest=null;(function(imu_xhr){XMLHttpRequest=" + custom_xhr_wrap.toString() + ";XMLHttpRequest.do_request = imu_xhr.do_request;})(imu_xhr);imu_xhr = undefined;";
-					return new Function("imu_xhr", startshim + fdata + endshim)({
-						custom_xhr: custom_xhr,
-						do_request: do_request
-					});
+					var startshim = "var orig_XMLHttpRequest=null;try{orig_XMLHttpRequest=window.XMLHttpRequest}catch (e){console.error(e);};var XMLHttpRequest=null;(function(imu_xhr){XMLHttpRequest=" + custom_xhr_wrap.toString() + ";XMLHttpRequest.do_request = imu_xhr.do_request;})(imu_xhr);imu_xhr = undefined;";
+					return new_function(startshim + fdata + endshim, {
+						varname: "imu_xhr",
+						data: {
+							custom_xhr: custom_xhr,
+							do_request: do_request
+						}
+					}, cb);
 				} else {
-					return new Function(fdata + endshim)();
+					return new_function(fdata + endshim, null, cb);
 				}
 			}
 		} else {
@@ -17972,9 +18120,9 @@ var $$IMU_EXPORT$$;
 			return result;
 		}
 	};
-	var run_sandboxed_lib_safe = function(fdata, xhr) {
+	var run_sandboxed_lib_safe = function(fdata, xhr, cb) {
 		try {
-			var result = run_sandboxed_lib(fdata, xhr);
+			var result = run_sandboxed_lib(fdata, xhr, cb);
 			return result;
 		} catch (e) {
 			console_error(e);
@@ -18078,7 +18226,9 @@ var $$IMU_EXPORT$$;
 						if (!response || !response.data || !response.data.text)
 							return done(null, 0); // 0 instead of false because it will never be available
 						//done(new Function(response.data.text + ";return lib_export;")(), 0);
-						done(run_sandboxed_lib(response.data.text, lib_obj.xhr), 0);
+						run_sandboxed_lib(response.data.text, lib_obj.xhr, function(exported) {
+							done(exported, 0);
+						});
 					});
 				} else {
 					// For the userscript, we have no other choice than to query and run arbitrary JS.
@@ -18163,7 +18313,10 @@ var $$IMU_EXPORT$$;
 								if (is_dev)
 									console_log("Check time:", Date.now() - start_time);
 							}
-							done(run_sandboxed_lib_safe(libcontents, lib_obj.xhr), 0);
+							run_sandboxed_lib_safe(libcontents, lib_obj.xhr, function(exported) {
+								done(exported, 0);
+							});
+							//done(run_sandboxed_lib_safe(libcontents, lib_obj.xhr), 0);
 							//done(new Function(libcontents + ";return lib_export;")(), 0);
 						}
 					});
@@ -23825,7 +23978,9 @@ var $$IMU_EXPORT$$;
 			// https://img1.daumcdn.net/kakaotv/2016/player/web/pc/bg_box.png -- thanks to ambler on discord for reporting
 			// https://t1.daumcdn.net/kakaotv/2016/pw/img_backlogo.png
 			// https://t1.daumcdn.net/kakaotv/2016/pw/img_backcover.jpg
+			// https://t1.daumcdn.net/tistory_admin/lib/lightbox/images/next.png
 			if (/\/cafe_image\/+fancafe\/+[0-9]+\/+fancafe-cheer-color-bg\./.test(src) ||
+				/\/tistory_admin\/+lib\/+lightbox\//.test(src) ||
 				/\/kakaotv\/+[0-9]+\/+(?:pw|player\/+web)\/+(?:(?:new|pc)\/+)?(?:slider_mask|bg_box|img_back(?:logo|cover))/.test(src)) {
 				return {
 					url: src,
@@ -28707,7 +28862,7 @@ var $$IMU_EXPORT$$;
 			// https://vcdn.polarismedia.no/a6d4c603-c9e5-4899-8fa2-1b122271c9b8?fit=crop&h=600&q=80&tight=false&w=1000
 			domain === "vcdn.polarismedia.no" ||
 			// https://assistant.gloria.tv/1z94gyaCTBei3D8MsGrYwjE6j/9kguycj0c4267ea2fyoe3xqkq5vnxzhnybwzynt.webp?crop=1080.1080.677.0&still=on&scale=128&format=webp
-			domain === "assistant.gloria.tv" ||
+			//domain === "assistant.gloria.tv" ||
 			// thanks to jonestly on discord:
 			// https://thumbnails.cbc.ca/maven_legacy/thumbnails/270/427/1-nn-renner-accident-020123.jpg?crop=1.777xh:h;*,*&downsize=1130px:*
 			domain === "thumbnails.cbc.ca" ||
@@ -80755,6 +80910,13 @@ var $$IMU_EXPORT$$;
 			}
 			return obj;
 		}
+		if (domain === "cf-st.sc-cdn.net") {
+			// https://cf-st.sc-cdn.net/aps/bolt_web/aHR0cHM6Ly9j[...]._RS48,72_FMwebp
+			match = src.match(/\/(aHR0cHM[^/.?#]+)/);
+			if (match) {
+				return base64_decode(match[1]);
+			}
+		}
 		if (host_domain_nosub === "snapchat.com" && options.do_request && options.cb && options.element) {
 			// https://www.snapchat.com/add/jordynjones11
 			// https://story.snapchat.com/s/jordynjones11
@@ -80765,6 +80927,22 @@ var $$IMU_EXPORT$$;
 					waiting: true
 				};
 			}
+			if (!src && options.element.tagName === "VIDEO") {
+				var source_els = options.element.querySelectorAll("source");
+				var sources = [];
+				for (var _a = 0, source_els_1 = source_els; _a < source_els_1.length; _a++) {
+					var source = source_els_1[_a];
+					array_upush(sources, source.getAttribute("src"));
+				}
+				if (sources[0]) {
+					var is_hls = /\.m3u8/.test(sources[0]);
+					return {
+						url: sources[0],
+						video: is_hls ? "hls" : true,
+						need_blob: !is_hls
+					};
+				}
+			}
 			if (src && /\.mp4/.test(src)) {
 				return {
 					url: src,
@@ -93772,7 +93950,95 @@ var $$IMU_EXPORT$$;
 			if (newsrc !== src)
 				return newsrc.replace(/:\/\/img\./, "://c1.");
 		}
+		if (domain === "assistant.gloria.tv") {
+			// https://assistant.gloria.tv/1z94gyaCTBei3D8MsGrYwjE6j/0mjj3brlc4t0hkd7ahx704m0o8sih0ewktgkect.webp?secure=[...]&expires=[...]&scale=256&webp=on -- 256x178
+			//   https://assistant.gloria.tv/1z94gyaCTBei3D8MsGrYwjE6j/0mjj3brlc4t0hkd7ahx704m0o8sih0ewktgkect.webp?secure=[...]&expires=[...] -- 1739x1209
+			newsrc = keep_queries(src, ["secure", "expires"]);
+			if (newsrc !== src)
+				return newsrc;
+		}
+		if (domain_nowww === "gloria.tv") {
+			newsrc = website_query({
+				website_regex: /^[a-z]+:\/\/[^/]+\/+post\/+([a-zA-Z0-9]{10,})(?:\/.*)?(?:[?#].*)?$/,
+				query_for_id: "https://gloria.tv/post/${id}",
+				process: function(done, resp, cache_key) {
+					var sources = common_functions["get_videotag_sources"](resp.responseText);
+					if (!sources || !sources.video) {
+						console_error(cache_key, "Unable to find sources in", resp);
+						return done(null, false);
+					}
+					sources.video.sort(function(a, b) {
+						if (a.args.type === "application/x-mpegurl")
+							return -1;
+						if (b.args.type === "application/x-mpegurl")
+							return 1;
+						var a_quality_str = a.args["data-quality"];
+						var b_quality_str = b.args["data-quality"];
+						if (!a_quality_str || !b_quality_str) {
+							console_warn(cache_key, "Unable to find data-quality in", a, b);
+							return 0;
+						}
+						var a_quality = JSON_parse(a_quality_str);
+						var b_quality = JSON_parse(b_quality_str);
+						return b_quality.bitrate - a_quality.bitrate;
+					});
+					var extra = {};
+					var datetime_match = resp.responseText.match(/<a href="[^"]+\/replies".*<time datetime="([^"]+)"/);
+					if (datetime_match)
+						extra.created_date = new Date(datetime_match[1]).getTime();
+					var title = get_meta(resp.responseText, "og:title");
+					if (title)
+						extra.caption = title;
+					extra.page = resp.finalUrl;
+					var urls = [];
+					array_extend(urls, array_map(sources.video, function(value) {
+						var url = value.url;
+						var video = true;
+						var can_head = true;
+						if (value.args.type === "application/x-mpegurl") {
+							video = "hls";
+							can_head = false; // 405
+						}
+						return {
+							url: urljoin(resp.finalUrl, url, true),
+							headers: {
+								Referer: resp.finalUrl
+							},
+							can_head: can_head,
+							video: video
+						};
+					}));
+					array_extend(urls, sources.image);
+					return done(fillobj_urls(urls, { extra: extra }), 6 * 60 * 60);
+				}
+			});
+			if (newsrc)
+				return newsrc;
+		}
 		if (host_domain_nowww === "gloria.tv") {
+			if (options.element && options.do_request && options.cb) {
+				var element_1 = common_functions["get_parent_el_matching"](options.element, function(x) {
+					return x.hasAttribute("data-notify");
+				});
+				if (element_1) {
+					try {
+						var media = JSON_parse(element_1.getAttribute("data-notify"));
+						if (media.id) {
+							return {
+								url: "https://gloria.tv/post/" + media.id,
+								is_pagelink: true
+							};
+						}
+					} catch (e) {
+						console_error(e);
+					}
+				} else if (options.host_url && options.element.tagName === "VIDEO" && options.element.matches("div.leading > header > figure.video > video")) {
+					return {
+						url: options.host_url,
+						is_pagelink: true
+					};
+				}
+			}
 			if (!src && origsrc && options.element && options.element.classList.contains("play")) {
 				return {
 					url: origsrc,
@@ -95600,8 +95866,8 @@ var $$IMU_EXPORT$$;
 			if (newsrc !== src) {
 				var splitted_3 = newsrc.split("/");
 				var decoded_4 = [];
-				for (var _a = 0, splitted_1 = splitted_3; _a < splitted_1.length; _a++) {
-					var s = splitted_1[_a];
+				for (var _b = 0, splitted_1 = splitted_3; _b < splitted_1.length; _b++) {
+					var s = splitted_1[_b];
 					decoded_4.push(base64_decode(s));
 				}
 				return decoded_4.join("");
@@ -96094,6 +96360,14 @@ var $$IMU_EXPORT$$;
 				};
 			}
 		}
+		if (domain_nosub === "loyalfans.com" && /^public-cdn[0-9]*\./.test(domain)) {
+			// thanks to anonymous for reporting:
+			// https://public-cdn2.loyalfans.com/images/MhtnF2T4zrcXbOnfa3Z0TWwYtjEY3Yt9xcY6WgMUNDw/timeline/0_16631100_1691533391_20230808222311_680__pmd.jpg
+			//   https://public-cdn2.loyalfans.com/images/MhtnF2T4zrcXbOnfa3Z0TWwYtjEY3Yt9xcY6WgMUNDw/timeline/0_16631100_1691533391_20230808222311.jpg
+			// https://public-cdn2.loyalfans.com/images/MhtnF2T4zrcXbOnfa3Z0TWwYtjEY3Yt9xcY6WgMUNDw/profile/0_89135100_1693412111_20230830161511_475_475_sq.jpg
+			//   https://public-cdn2.loyalfans.com/images/MhtnF2T4zrcXbOnfa3Z0TWwYtjEY3Yt9xcY6WgMUNDw/profile/0_89135100_1693412111_20230830161511.jpg
+			return src.replace(/(\/images\/+[^/]+\/+(?:timeline|profile)\/+[0-9]+_[0-9]+_[0-9]+_[0-9]+)_[^/.?#]+(\.[^/.]+)(?:[?#].*)?$/, "$1$2");
+		}
 		// -- general rules --
 		if (src.match(/\/ImageGen\.ashx\?/)) {
 			// http://www.lookalikes.info/umbraco/ImageGen.ashx?image=/media/97522/nick%20hewer%20-%20mark%20brown.jpeg&width=250&constrain=true