@ikenxuan/amagi 7.0.0-beta.7 → 7.0.0-beta.8

package/dist/exports/compat.mjs

@@ -1,4 +1,5 @@
-import { $ as unwrap, A as douyinFetcher, B as xiaohongshuSign, C as ValidationError, Ct as parseDmSegMobileReply, D as createBoundKuaishouFetcher, E as xiaohongshuFetcher, F as bilibiliFetcher, G as createDouyinRoutes, H as createKuaishouRoutes, I as createBoundBilibiliFetcher, J as bilibiliUtils, K as passport_exports, L as createClient, M as requestPassportQrcode, N as sendPassportVerifyCode, O as kuaishouFetcher, P as validatePassportVerifyCode, Q as isSuccess, R as xiaohongshuUtils, S as ApiError, St as emitNetworkRetry, T as createBoundXiaohongshuFetcher, Tt as bv2av, U as kuaishouSign, V as kuaishouUtils, W as douyinUtils, X as AmagiThrownError, Y as createBilibiliRoutes, Z as isFailure, _ as validateBilibiliParams, _t as emitLogError, a as AdditionalType, at as wbi_sign, b as validateXiaohongshuParams, bt as emitLogWarn, c as createAmagiClient, ct as fetchResponse, d as assertValidBilibiliParams, dt as emitApiError, et as AMAGI_BUS_EVENT_NAMES, f as assertValidDouyinParams, ft as emitApiSuccess, g as createSuccessResponse, gt as emitLogDebug, h as createErrorResponse, ht as emitLog, i as DynamicType, it as qtparam, j as checkPassportQrcode, k as createBoundDouyinFetcher, l as kuaishouApiUrls, lt as isNetworkErrorResult, m as assertValidXiaohongshuParams, mt as emitHttpResponse, n as CreateApp, nt as KUAISHOU_PC_CAPTCHA_RESULT, o as MajorType, ot as bilibiliApiUrls, p as assertValidKuaishouParams, pt as emitHttpRequest, q as douyinSign, r as amagi, rt as parseKuaishouCaptcha, s as CommentType, st as fetchData, tt as KUAISHOU_H5_CAPTCHA_RESULT, u as douyinApiUrls, ut as amagiEvents, v as validateDouyinParams, vt as emitLogInfo, w as handleError, wt as av2bv, x as xiaohongshuApiUrls, xt as emitNetworkError, y as validateKuaishouParams, yt as emitLogMark, z as createXiaohongshuRoutes } from "../src-BM1fZuVp.mjs";
+import { $ as unwrap, A as douyinFetcher, B as xiaohongshuSign, C as ValidationError, Ct as parseDmSegMobileReply, D as createBoundKuaishouFetcher, E as xiaohongshuFetcher, F as bilibiliFetcher, G as createDouyinRoutes, H as createKuaishouRoutes, I as createBoundBilibiliFetcher, J as bilibiliUtils, K as passport_exports, L as createClient, M as requestPassportQrcode, N as sendPassportVerifyCode, O as kuaishouFetcher, P as validatePassportVerifyCode, Q as isSuccess, R as xiaohongshuUtils, S as ApiError, St as emitNetworkRetry, T as createBoundXiaohongshuFetcher, U as kuaishouSign, V as kuaishouUtils, W as douyinUtils, X as AmagiThrownError, Y as createBilibiliRoutes, Z as isFailure, _ as validateBilibiliParams, _t as emitLogError, a as AdditionalType, at as wbi_sign, b as validateXiaohongshuParams, bt as emitLogWarn, c as createAmagiClient, ct as fetchResponse, d as assertValidBilibiliParams, dt as emitApiError, et as AMAGI_BUS_EVENT_NAMES, f as assertValidDouyinParams, ft as emitApiSuccess, g as createSuccessResponse, gt as emitLogDebug, h as createErrorResponse, ht as emitLog, i as DynamicType, it as qtparam, j as checkPassportQrcode, k as createBoundDouyinFetcher, l as kuaishouApiUrls, lt as isNetworkErrorResult, m as assertValidXiaohongshuParams, mt as emitHttpResponse, n as CreateApp, nt as KUAISHOU_PC_CAPTCHA_RESULT, o as MajorType, ot as bilibiliApiUrls, p as assertValidKuaishouParams, pt as emitHttpRequest, q as douyinSign, r as amagi, rt as parseKuaishouCaptcha, s as CommentType, st as fetchData, tt as KUAISHOU_H5_CAPTCHA_RESULT, u as douyinApiUrls, ut as amagiEvents, v as validateDouyinParams, vt as emitLogInfo, w as handleError, x as xiaohongshuApiUrls, xt as emitNetworkError, y as validateKuaishouParams, yt as emitLogMark, z as createXiaohongshuRoutes } from "../src-ZHFzJ9Lf.mjs";
+import { n as bv2av, t as av2bv } from "../bv2av-DUm4x7as.mjs";
 //#region src/exports/compat.ts
 /** 模块级只执行一次的迁移提示（不刷屏） */
 emitLogWarn("[@ikenxuan/amagi/compat] 你正在使用 v6 兼容入口；v7 迁移说明见 https://github.com/ikenxuan/amagi （v8 将移除 compat）");

package/dist/exports/sign-steps.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_steps = require("../steps-BO8NYQHx.cjs");
+const require_steps = require("../steps-CpeOWLPf.cjs");
 //#region src/exports/sign-steps.ts
 /**
 * 反爬参数的**原子 step 工厂**：给 `client.<平台>.request` 做精细签名控制用。

package/dist/exports/sign-steps.d.ts

@@ -1,4 +1,5 @@
-import { _ as SignDecl, a as KuaishouLiveApiRequest, b as SignStep, v as SignFn, y as SignPhase } from "../api-BWAjDuTS.js";
+import { c as SignDecl, d as SignStep, l as SignFn, u as SignPhase } from "../endpoint-QPR2Pp-S.js";
+import { a as KuaishouLiveApiRequest } from "../api-BENpfNA1.js";
 //#region src/platforms/bilibili/sign/steps.d.ts
 /** `wbi`：URL 追加 `&wts=&w_rid=`（comments / userDynamicList / userSpaceInfo） */
 declare const wbi: () => SignStep;

package/dist/exports/sign-steps.mjs

@@ -1,4 +1,4 @@
-import { C as wbi, S as qtparam, d as douyinBogus, f as douyinXBogus, h as xBogus, m as secsdk, n as traceId, p as msToken, r as xs, s as hxfalcon, t as rap, u as aBogus } from "../steps-DQlwODdh.mjs";
+import { d as douyinXBogus, f as msToken, l as aBogus, m as xBogus, n as traceId, p as secsdk, r as xs, s as hxfalcon, t as rap, u as douyinBogus, v as qtparam, y as wbi } from "../steps-bZrsb4W6.mjs";
 //#region src/exports/sign-steps.ts
 /**
 * 反爬参数的**原子 step 工厂**：给 `client.<平台>.request` 做精细签名控制用。

package/dist/exports/signing.cjs

@@ -1,437 +1,138 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_tokens = require("../tokens-DHKAuPVW.cjs");
-//#region src/platforms/douyin/sign/decode.ts
-/**
-* 把签名参数读回明文 —— 验证工具的解码层。
-*
-* 移植自 Douyin_TikTok_Download_API 的 `signing/native/decoding.py`（Apache-2.0）。
-* 存在的理由只有一个：**证明签名实现还是对的**。
-*
-* ## 为什么需要它
-*
-* 抖音对签名是抽样校验的，所以「请求成功」证明不了任何事。唯一能证伪一个常量的办法，
-* 是把真实签名拆开看。旧实现用错盐值（`cus`）活了两年没被发现，就是因为整套测试都是
-* 自证的——自生成快照、和被测量对象比自身、以及没有任何一条断言能证伪一个常量。
-*
-* 这个模块提供外部锚点：给它一份浏览器产出的签名，它会告诉你签名里封住的到底是什么，
-* 以及你手上的候选输入是不是它封的那一个。
-*
-* ## 「解码」在这里诚实地指三件不同的事
-*
-* 把它们混为一谈，就是这类工具开始撒谎的方式：
-*
-* - **可还原**：值就在载荷里，能原样取回。时钟、`aid`、`page_id`、屏幕几何串、
-*   版本串、调用计数。没有任何推断。
-* - **被绑定但不可还原**：载荷里带着某个东西的摘要——a_bogus 里是 query / body / UA
-*   各三个 SM3 字节。输入无法从摘要倒推出来，所以这个模块**从不假装能**。它做的是
-*   **校验**：给它一个候选值，它回答这个候选是不是签名封住的那一个，以及有多少位证据
-*   支持这个结论。这才是哈希真正的逆运算，而且比猜一个值有用得多——它把
-*   「我的请求被拒了」变成「我发的这个签名是对着另一条 URL 算的」。
-* - **根本没被计算**：`msToken` 与访客令牌由平台签发或随机抽出来，底下没有明文可找。
-*   说出这一点就是答案，而不是「没能给出答案」。
-*
-* 每个字段都携带自己属于哪一类，读者不会被留在「标签旁边那个数字是读出来的还是推出来的」
-* 这种猜测里。
-*
-* 这里没有任何东西用于签名。它只跑在调用方已经持有的值上，不碰网络、不消耗身份。
-*/
-/** 字段是什么。控制台按它上色，调用方也可以对它分支 */
-const KIND = {
-	/** 从载荷里直接读出，就是签名者放进去的东西 */
-	PLAIN: "plain",
-	/** 一个时钟，同时给出原始数字与 ISO-8601 时刻 */
-	TIME: "time",
-	/** 哈希或哈希的一个字节。输入不可还原——见 checks */
-	DIGEST: "digest",
-	/** 内部冗余。在这里重算，这正是解码得以自证的依据 */
-	CHECKSUM: "checksum",
-	/** SDK 对它自认为身处其中的页面所做的回报 */
-	ENVIRONMENT: "environment",
-	/** 每次捕获里都有、但含义未被确认的东西。命名它，而不是编造它 */
-	OPAQUE: "opaque"
-};
-/** 一个参数底下为什么没有明文 */
-const REASON = {
-	MALFORMED: "malformed",
-	NOT_COMPUTED: "not_computed",
-	ONE_WAY: "one_way",
-	UNKNOWN_PARAMETER: "unknown_parameter"
-};
-/** 候选输入是不是签名封住的那一个 */
-const CHECK = {
-	MATCH: "match",
-	DIFFERS: "differs",
-	NOT_SUPPLIED: "not_supplied"
-};
-/** 每条摘要链钉住输入的位数 */
-const CHAIN_BITS = 24;
-const FORTNIGHT_MS = 12096e5;
-/** 毫秒时钟转 ISO-8601 UTC；数字荒诞到解析不了时退回原样，因为那通常正是它最有意思的地方 */
-const instant = (milliseconds) => {
-	const date = new Date(milliseconds);
-	return Number.isNaN(date.getTime()) ? String(milliseconds) : date.toISOString().replace(".000Z", "Z");
-};
-const clockField = (name, milliseconds, detail) => ({
-	name,
-	value: `${milliseconds} (${instant(milliseconds)})`,
-	kind: KIND.TIME,
-	detail
-});
-const check = (name, expected, actual, covered) => expected.join(",") === actual.join(",") ? {
-	name,
-	status: CHECK.MATCH,
-	bits: CHAIN_BITS,
-	covered
-} : {
-	name,
-	status: CHECK.DIFFERS,
-	bits: CHAIN_BITS
-};
-/**
-* 拆开一份 `a_bogus`，并就调用方给出的候选值做校验。
-* @param value - `a_bogus` 的值
-* @param candidates - 候选的 query / body / User-Agent，给哪个校验哪个
-* @returns 拆解结果；格式不合法时 `recovered` 为 `false` 并给出 `reason`
-*/
-const decodeABogus = (value, candidates = {}) => {
-	const problem = require_tokens.structureError(value);
-	if (problem !== null) return {
-		parameter: "a_bogus",
-		platform: "douyin",
-		algorithm: "a_bogus",
-		recovered: false,
-		reason: `${REASON.MALFORMED}:${problem}`,
-		fields: [],
-		checks: [],
-		notes: []
-	};
-	const raw = require_tokens.decode(value);
-	const scalars = raw.fields;
-	const fortnights = scalars.L26;
-	const fields = [
-		{
-			name: "header_magic",
-			value: `[${raw.headerMagic.join(", ")}]`,
-			kind: KIND.PLAIN
-		},
-		{
-			name: "sdk_version",
-			value: raw.sdkVersion.join("."),
-			kind: KIND.PLAIN
-		},
-		clockField("now_ms", raw.nowMs),
-		clockField("ink_ms", raw.inkMs, "now_ms - 1，SDK 对自己的存活检查"),
-		{
-			name: "aid",
-			value: String(raw.aid),
-			kind: KIND.PLAIN
-		},
-		{
-			name: "page_id",
-			value: String(raw.pageId),
-			kind: KIND.PLAIN
-		},
-		{
-			name: "fortnights",
-			value: `${fortnights} (${instant(require_tokens.FORTNIGHT_EPOCH_MS + fortnights * FORTNIGHT_MS)})`,
-			kind: KIND.PLAIN,
-			detail: "自 a_bogus 纪元起的「两周」数"
-		},
-		{
-			name: "browser_info",
-			value: raw.browserInfo,
-			kind: KIND.ENVIRONMENT,
-			detail: "屏幕|可视区|…"
-		},
-		{
-			name: "tail",
-			value: raw.tail,
-			kind: KIND.PLAIN,
-			detail: "(now_ms + 3) & 0xFF"
-		},
-		{
-			name: "env_flags",
-			value: String(raw.envFlags),
-			kind: KIND.ENVIRONMENT
-		},
-		{
-			name: "detect_flags",
-			value: String(raw.detectFlags),
-			kind: KIND.ENVIRONMENT
-		},
-		{
-			name: "call_bucket",
-			value: String(raw.callBucket),
-			kind: KIND.ENVIRONMENT
-		},
-		{
-			name: "tripwire",
-			value: String(raw.tripwire),
-			kind: KIND.ENVIRONMENT
-		}
-	];
-	const inputByChain = {
-		query: candidates.query,
-		body: candidates.body,
-		user_agent: candidates.userAgent
-	};
-	const emptyBody = require_tokens.chainBytes(require_tokens.DIGEST_CHAINS.body, require_tokens.digestWith("", require_tokens.SALT));
-	const checks = [];
-	for (const [name, chain] of Object.entries(require_tokens.DIGEST_CHAINS)) {
-		const carried = chain.slots.map((slot) => scalars[slot]);
-		let detail = `${name} 链的 3 个字节，落在 ${chain.slots.join(", ")}`;
-		if (name === "body" && carried.join(",") === emptyBody.join(",")) detail = `${detail}；与空 body 一致，GET 就是这种情况`;
-		fields.push({
-			name: `${name}_digest`,
-			value: carried.join(" "),
-			kind: KIND.DIGEST,
-			detail
-		});
-		const candidate = inputByChain[name];
-		if (candidate === void 0) {
-			checks.push({
-				name,
-				status: CHECK.NOT_SUPPLIED,
-				bits: CHAIN_BITS
-			});
-			continue;
-		}
-		const digest = name === "user_agent" ? require_tokens.userAgentDigest(candidate, {
-			envFlags: raw.envFlags,
-			detectFlags: raw.detectFlags
-		}) : require_tokens.digestWith(candidate, require_tokens.SALT);
-		checks.push(check(name, require_tokens.chainBytes(chain, digest), carried, candidate));
+const require_bv2av = require("../bv2av-Dw0qrO9g.cjs");
+const require_he = require("../he-CuCIF0C7.cjs");
+//#region src/platforms/xiaohongshu/sign/shape.ts
+/** x-s 之外的头部按什么规则查 */
+const CHECKS = {
+	"x-t": {
+		label: "13 位毫秒时间戳",
+		test: (value) => /^1[0-9]{12}$/.test(value),
+		why: "generateXT 返回 Date.now()，13 位毫秒"
+	},
+	"x-b3-traceid": {
+		label: "16 位十六进制",
+		test: (value) => /^[0-9a-f]{16}$/.test(value),
+		why: "generateXB3Traceid 的输出形状"
+	},
+	"x-xray-traceid": {
+		label: "32 位十六进制",
+		test: (value) => /^[0-9a-f]{32}$/.test(value),
+		why: "generateXrayTraceid 的输出形状"
+	},
+	"x-s-common": {
+		label: "非空",
+		test: (value) => value.length > 0,
+		why: "压缩+编码的不透明串，底下没有明文可找"
 	}
-	return {
-		parameter: "a_bogus",
-		platform: "douyin",
-		algorithm: "a_bogus",
-		recovered: true,
-		fields,
-		checks,
-		notes: ["checksum_verified", "noise_not_recoverable"]
-	};
 };
 /**
-* 反推一份签名用的是哪个盐值 —— **这个工具存在的核心理由**。
-*
-* 做法与当初发现 `cus` 过期时完全一样：签名里封着 query 链的三个字节，把候选盐值逐个
-* 代进去重算摘要，能重现那三个字节的就是当前盐值。整件事不需要网络、不需要身份、
-* 也不依赖抖音是否接受了你的请求——这正是它能发现「请求照样成功但常量已经过期」的原因。
-*
-* ## 只有 query 链参与判定
-*
-* body 链在 GET 上与空串一致，而 UA 链**根本不吃盐值**（它走 RC4 加单次 SM3），
-* 两条对判定都没有贡献，所以这里的候选盐值只对 query 生效。证据量是 24 位，
-* 实战足够——但要说明，而不是藏起来。
-* @param value - 一份真实的 `a_bogus`
-* @param query - 该签名所覆盖的那条 query（不含 `a_bogus` 自身）
-* @param salts - 待测的盐值候选
-* @returns 判定结果
+* 检查一个签名头部的形状。
+* @param name - 头名（`x-s` / `x-s-common` / `x-t` / `x-xray-traceid` / `x-b3-traceid`）
+* @param value - 头部的值
+* @returns 检查结果；不认识的头名按「非空」处理
 */
-const diagnoseSalt = (value, query, salts = [require_tokens.SALT, "cus"]) => {
-	if (require_tokens.structureError(value) !== null) return {
-		salt: null,
-		observed: [],
-		results: []
-	};
-	const chain = require_tokens.DIGEST_CHAINS.query;
-	const scalars = require_tokens.decode(value).fields;
-	const observed = chain.slots.map((slot) => scalars[slot]);
-	const results = salts.map((salt) => {
-		const predicted = require_tokens.chainBytes(chain, require_tokens.digestWith(query, salt));
-		return {
-			salt,
-			predicted,
-			matched: predicted.join(",") === observed.join(",")
+const inspectXhsHeader = (name, value) => {
+	if (name === "x-s") {
+		const inspection = {
+			name,
+			problems: []
 		};
-	});
+		if (value.startsWith("XYW_")) {
+			inspection.format = "XYW";
+			if (value.length <= 4) inspection.problems.push("XYW_ 之后是空的");
+		} else if (value.startsWith("XYS_")) {
+			inspection.format = "XYS";
+			if (value.length <= 4) inspection.problems.push("XYS_ 之后是空的");
+		} else inspection.problems.push("既不是 XYS_ 也不是 XYW_ 开头 —— 2026-03 之后数据接口会以 406 拒收");
+		return inspection;
+	}
+	const check = CHECKS[name];
+	if (!check) return {
+		name,
+		problems: value.length > 0 ? [] : ["是空的"]
+	};
 	return {
-		salt: results.find((row) => row.matched)?.salt ?? null,
-		observed,
-		results
+		name,
+		problems: check.test(value) ? [] : [`不符合 ${check.label}（${check.why}）`]
 	};
 };
-/**
-* 只按形状猜一个值是什么参数。用于调用方不知道自己在看什么的时候。
-*
-* 只做形状判断，不做任何密码学断言——猜错时返回 `null` 比返回一个错答案好。
-* @param value - 待识别的值
-* @returns 参数名或 `null`
-*/
-const identify = (value) => {
-	if (!value) return null;
-	if (require_tokens.structureError(value) === null) return "a_bogus";
-	if (/^verify_[0-9a-z]+_/.test(value)) return "verifyFp";
-	if (value.length === 28 && /^[A-Za-z0-9_=+/-]+$/.test(value)) return "X-Bogus";
-	if (value.length >= 100 && /^[A-Za-z0-9+-]+=*$/.test(value)) return "msToken";
-	if (/^[0-9a-f]{32}$/i.test(value)) return "x-secsdk-web-signature";
-	return null;
-};
-/**
-* 签名**一定**不覆盖的参数。
-*
-* `a_bogus` 是签名自身；`timestamp` 与 `x-secsdk-web-signature` 由 secsdk 在签名
-* **之后**追加 —— 这一点在真实捕获与 amagi 自己的管线里一致。
-*/
-const NEVER_SIGNED = [
-	"a_bogus",
-	"timestamp",
-	"x-secsdk-web-signature"
-];
-/**
-* 是否被签名覆盖**随管线而异**的参数。
-*
-* 不要猜。真实浏览器捕获里 `uifid` 在 `a_bogus` **之前**（因而被签名覆盖），
-* 而 amagi 的管线是 `webid → a_bogus → secsdk`，`uifid` 由 secsdk 在之后补上
-* （因而没被覆盖）。同一个参数名，两边结论相反 —— 所以这里把四种参数做成
-* 2⁴ 种组合逐个试，命中的那一种就是答案。
-*/
-const SIGNING_AMBIGUOUS = [
-	"uifid",
-	"msToken",
-	"verifyFp",
-	"fp"
-];
-/**
-* 反推一份签名**当时覆盖的那条 query**，以及用的是哪个盐值。
-*
-* 这是 {@link diagnoseSalt} 的加强版：那份要求调用方已经知道签名覆盖了哪些参数，
-* 而线上抓来的 URL 里，`uifid` / `msToken` / `verifyFp` / `fp` 到底在签名前还是
-* 签名后，取决于页面当时挂的是哪条管线 —— 同一份代码在浏览器里和在 amagi 里顺序
-* 就是不一样的。与其让调用方去猜，这里把 2⁴ 种组合全试一遍，报出命中的那一种。
-*
-* 命中意味着**两件事同时成立**：这是一份结构良好的 a_bogus，且它的 query 链在给定
-* 盐值下重现了这条 query。所以它是「验证」而不只是「解码」。
-* @param signature - `a_bogus` 的值（未做 URL 编码）
-* @param url - 已签名的完整 URL
-* @param salts - 待搜的盐值候选
-* @returns 命中结果；没有任何组合命中时返回 `null`
-*/
-const recoverSignedQuery = (signature, url, salts = [require_tokens.SALT]) => {
-	if (require_tokens.structureError(signature) !== null) return null;
-	const chain = require_tokens.DIGEST_CHAINS.query;
-	const scalars = require_tokens.decode(signature).fields;
-	const observed = chain.slots.map((slot) => scalars[slot]).join(",");
-	let tried = 0;
-	for (let mask = 0; mask < 1 << SIGNING_AMBIGUOUS.length; mask++) {
-		const kept = SIGNING_AMBIGUOUS.filter((_, index) => (mask & 1 << index) !== 0);
-		const parsed = new URL(url);
-		for (const name of NEVER_SIGNED) parsed.searchParams.delete(name);
-		for (const name of SIGNING_AMBIGUOUS) if (!kept.includes(name)) parsed.searchParams.delete(name);
-		const query = parsed.searchParams.toString();
-		for (const salt of salts) {
-			tried++;
-			if (require_tokens.chainBytes(chain, require_tokens.digestWith(query, salt)).join(",") === observed) return {
-				query,
-				kept,
-				salt,
-				tried
-			};
-		}
-	}
-	return null;
-};
-/**
-* 从一条已签名的 URL 里重建出签名覆盖的那条 query（不再搜索，按固定规则摘参数）。
-*
-* **只在已知管线顺序时使用。** 面对来源不明的 URL 请用 {@link recoverSignedQuery}，
-* 它会搜索并告诉你哪条重建成立。保留这个函数是为了让「摘掉签名参数」这件事在
-* 需要确定行为的地方仍然可用。
-* @param url - 已签名的完整 URL
-* @returns 摘掉 `a_bogus` / `timestamp` / `x-secsdk-web-signature` 之后的 query
-*/
-const signedQueryOf = (url) => {
-	const parsed = new URL(url);
-	for (const name of NEVER_SIGNED) parsed.searchParams.delete(name);
-	return parsed.searchParams.toString();
-};
-/**
-* 拆开一条 URL 上所有认得出的签名参数。
-*
-* 会先尝试 {@link recoverSignedQuery} 找出签名真正覆盖的那条 query；找不到时退回
-* {@link signedQueryOf} 的结果，并把这个不确定性体现在 `notes` 里。
-* @param url - 已签名的完整 URL
-* @param options - 可选的 User-Agent、显式 query 与盐值候选
-* @returns 每个参数一条拆解结果
-*/
-const decodeUrl = (url, options = {}) => {
-	const aBogus = new URL(url).searchParams.get("a_bogus");
-	if (aBogus === null) return [];
-	const signature = decodeURIComponent(aBogus);
-	const recovery = options.query ? null : recoverSignedQuery(signature, url, options.salts ?? ["dhzx"]);
-	const query = options.query ?? recovery?.query ?? signedQueryOf(url);
-	const decoded = decodeABogus(signature, {
-		query,
-		body: options.body,
-		userAgent: options.userAgent
-	});
-	if (recovery) {
-		decoded.notes.push(`query_recovered:kept=${recovery.kept.join("+") || "(none)"}`);
-		decoded.fields.push({
-			name: "signed_query",
-			value: recovery.query,
-			kind: KIND.PLAIN,
-			detail: `从 ${recovery.tried} 种组合中命中：保留了 ${recovery.kept.join("、") || "（不保留任何可选参数）"}`
-		});
-	} else if (!options.query) decoded.notes.push("query_reconstructed_by_rule:no_combination_matched");
-	return [decoded];
-};
 //#endregion
-exports.ABogus = require_tokens.ABogus;
-exports.AID = require_tokens.AID;
-exports.ALPHABETS = require_tokens.ALPHABETS;
-exports.CALL_BUCKET = require_tokens.CALL_BUCKET;
-exports.CHECK = CHECK;
-exports.DEFAULT_BROWSER_INFO = require_tokens.DEFAULT_BROWSER_INFO;
-exports.DETECT_FLAGS = require_tokens.DETECT_FLAGS;
-exports.DIGEST_CHAINS = require_tokens.DIGEST_CHAINS;
-exports.DOUYIN_MS_TOKEN_LENGTH = require_tokens.DOUYIN_MS_TOKEN_LENGTH;
-exports.DOUYIN_MS_TOKEN_SIZES = require_tokens.DOUYIN_MS_TOKEN_SIZES;
-exports.DOUYIN_TTWID = require_tokens.DOUYIN_TTWID;
-exports.DOUYIN_TTWID_PAYLOAD = require_tokens.DOUYIN_TTWID_PAYLOAD;
-exports.ENV_FLAGS = require_tokens.ENV_FLAGS;
-exports.FIELD_ORDER = require_tokens.FIELD_ORDER;
-exports.FORTNIGHT_EPOCH_MS = require_tokens.FORTNIGHT_EPOCH_MS;
-exports.HEADER_MAGIC = require_tokens.HEADER_MAGIC;
-exports.KIND = KIND;
-exports.MS_TOKEN_ALPHABET = require_tokens.MS_TOKEN_ALPHABET;
-exports.PAGE_ID = require_tokens.PAGE_ID;
-exports.PAYLOAD_KEY = require_tokens.PAYLOAD_KEY;
-exports.REASON = REASON;
-exports.SALT = require_tokens.SALT;
-exports.SDK_VERSION = require_tokens.SDK_VERSION;
-exports.SM3_IV = require_tokens.SM3_IV;
-exports.TRIPWIRE_LOCKED = require_tokens.TRIPWIRE_LOCKED;
-exports.TTWID_REGISTER_URL = require_tokens.TTWID_REGISTER_URL;
-exports.VERIFY_FP_ALPHABET = require_tokens.VERIFY_FP_ALPHABET;
-exports.VERIFY_FP_LENGTH = require_tokens.VERIFY_FP_LENGTH;
-exports.browserInfoFromScreen = require_tokens.browserInfoFromScreen;
-exports.buildBrowserInfo = require_tokens.buildBrowserInfo;
-exports.canary = require_tokens.canary;
-exports.chainBytes = require_tokens.chainBytes;
-exports.decode = require_tokens.decode;
-exports.decodeABogus = decodeABogus;
-exports.decodeBase64 = require_tokens.decodeBase64;
-exports.decodeUrl = decodeUrl;
-exports.diagnoseSalt = diagnoseSalt;
-exports.digestOf = require_tokens.digestOf;
-exports.digestWith = require_tokens.digestWith;
-exports.encodeBase64 = require_tokens.encodeBase64;
-exports.genFalseMsToken = require_tokens.genFalseMsToken;
-exports.genSVWebId = require_tokens.genSVWebId;
-exports.genVerifyFp = require_tokens.genVerifyFp;
-exports.identify = identify;
-exports.isDecodeProblem = require_tokens.isDecodeProblem;
-exports.jsBytes = require_tokens.jsBytes;
-exports.msTokenPayload = require_tokens.msTokenPayload;
-exports.rc4 = require_tokens.rc4;
-exports.recoverSignedQuery = recoverSignedQuery;
-exports.signedQueryOf = signedQueryOf;
-exports.sm3Hash = require_tokens.sm3Hash;
-exports.sm3Hexdigest = require_tokens.sm3Hexdigest;
-exports.sm3ToArray = require_tokens.sm3ToArray;
-exports.structureError = require_tokens.structureError;
-exports.toBase36 = require_tokens.toBase36;
-exports.unmaskPair = require_tokens.unmaskPair;
-exports.userAgentDigest = require_tokens.userAgentDigest;
+exports.ABogus = require_he.ABogus;
+exports.AID = require_he.AID;
+exports.ALPHABETS = require_he.ALPHABETS;
+exports.CALL_BUCKET = require_he.CALL_BUCKET;
+exports.CANVAS_CONSTANT = require_he.CANVAS_CONSTANT;
+exports.CHECK = require_he.CHECK;
+exports.DEFAULT_BROWSER_INFO = require_he.DEFAULT_BROWSER_INFO;
+exports.DETECT_FLAGS = require_he.DETECT_FLAGS;
+exports.DIGEST_CHAINS = require_he.DIGEST_CHAINS;
+exports.DOUYIN_MS_TOKEN_LENGTH = require_he.DOUYIN_MS_TOKEN_LENGTH;
+exports.DOUYIN_MS_TOKEN_SIZES = require_he.DOUYIN_MS_TOKEN_SIZES;
+exports.DOUYIN_TTWID = require_he.DOUYIN_TTWID;
+exports.DOUYIN_TTWID_PAYLOAD = require_he.DOUYIN_TTWID_PAYLOAD;
+exports.ENV_FLAGS = require_he.ENV_FLAGS;
+exports.FIELD_ORDER = require_he.FIELD_ORDER;
+exports.FORTNIGHT_EPOCH_MS = require_he.FORTNIGHT_EPOCH_MS;
+exports.HEADER_MAGIC = require_he.HEADER_MAGIC;
+exports.KIND = require_he.KIND;
+exports.MS_TOKEN_ALPHABET = require_he.MS_TOKEN_ALPHABET;
+exports.PAGE_ID = require_he.PAGE_ID;
+exports.PAYLOAD_KEY = require_he.PAYLOAD_KEY;
+exports.REASON = require_he.REASON;
+exports.SALT = require_he.SALT;
+exports.SDK_VERSION = require_he.SDK_VERSION;
+exports.SECSDK_SIG_KEY = require_he.SECSDK_SIG_KEY;
+exports.SM3_IV = require_he.SM3_IV;
+exports.TRIPWIRE_LOCKED = require_he.TRIPWIRE_LOCKED;
+exports.TTWID_REGISTER_URL = require_he.TTWID_REGISTER_URL;
+exports.VERIFY_FP_ALPHABET = require_he.VERIFY_FP_ALPHABET;
+exports.VERIFY_FP_LENGTH = require_he.VERIFY_FP_LENGTH;
+exports.WEBSIGN_CONST = require_he.WEBSIGN_CONST;
+exports.XBogus = require_he.XBogus;
+exports.av2bv = require_bv2av.av2bv;
+exports.browserInfoFromScreen = require_he.browserInfoFromScreen;
+exports.buildBrowserInfo = require_he.buildBrowserInfo;
+exports.bv2av = require_bv2av.bv2av;
+exports.canary = require_he.canary;
+exports.chainBytes = require_he.chainBytes;
+exports.computeWbiSignature = require_he.computeWbiSignature;
+exports.decode = require_he.decode;
+exports.decodeABogus = require_he.decodeABogus;
+exports.decodeBase64 = require_he.decodeBase64;
+exports.decodeKuaishouHe = require_he.decodeKuaishouHe;
+exports.decodeUrl = require_he.decodeUrl;
+exports.decodeVerifyFp = require_he.decodeVerifyFp;
+exports.decodeXBogus = require_he.decodeXBogus;
+exports.deriveKuaishouHeHashFieldHex = require_he.deriveKuaishouHeHashFieldHex;
+exports.deriveKuaishouHeHex = require_he.deriveKuaishouHeHex;
+exports.deriveKuaishouPureSignature = require_he.deriveKuaishouPureSignature;
+exports.diagnoseSalt = require_he.diagnoseSalt;
+exports.digestOf = require_he.digestOf;
+exports.digestWith = require_he.digestWith;
+exports.encodeBase64 = require_he.encodeBase64;
+exports.extractUifidFromCookie = require_he.extractUifidFromCookie;
+exports.extractWbiKey = require_he.extractKey;
+exports.genFalseMsToken = require_he.genFalseMsToken;
+exports.genSVWebId = require_he.genSVWebId;
+exports.genVerifyFp = require_he.genVerifyFp;
+exports.identify = require_he.identify;
+exports.inspectXhsHeader = inspectXhsHeader;
+exports.isDecodeProblem = require_he.isDecodeProblem;
+exports.isSecsdkProtected = require_he.isSecsdkProtected;
+exports.jsBytes = require_he.jsBytes;
+exports.msTokenPayload = require_he.msTokenPayload;
+exports.rc4 = require_he.rc4;
+exports.recoverSignedQuery = require_he.recoverSignedQuery;
+exports.secsdkCanonicalQuery = require_he.canonicalQuery;
+exports.signSecsdkWebQuery = require_he.signSecsdkWebQuery;
+exports.signSecsdkWebUrl = require_he.signSecsdkWebUrl;
+exports.signXBogus = require_he.signXBogus;
+exports.signedQueryOf = require_he.signedQueryOf;
+exports.sm3Hash = require_he.sm3Hash;
+exports.sm3Hexdigest = require_he.sm3Hexdigest;
+exports.sm3ToArray = require_he.sm3ToArray;
+exports.structureError = require_he.structureError;
+exports.toBase36 = require_he.toBase36;
+exports.unmaskPair = require_he.unmaskPair;
+exports.userAgentDigest = require_he.userAgentDigest;
+exports.xBogusStructureError = require_he.xBogusStructureError;