@ikenxuan/amagi 7.0.0-beta.7 → 7.0.0-beta.8

package/dist/{src-BM1fZuVp.mjs → src-ZHFzJ9Lf.mjs}

@@ -1,12 +1,14 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
-import { C as wbi, S as qtparam$1, _ as douyinSign$1, a as createXiaohongshuGuestCookie$1, b as getCookieValue, c as sharedKuaishouSigner, d as douyinBogus, f as douyinXBogus, g as applySecsdkWebSign, h as xBogus, i as getSearchId, l as deriveKuaishouPureSignature, m as secsdk, n as traceId, o as createXiaohongshuCryptoConfig, p as msToken, r as xs, s as hxfalcon, t as rap, u as aBogus$1, v as XBogus, x as AmagiHeaders, y as observeDouyinWebid } from "./steps-DQlwODdh.mjs";
-import { A as a_bogus_default, M as buildBrowserInfo, d as genVerifyFp, m as ABogus, o as TTWID_REGISTER_URL, r as DOUYIN_TTWID } from "./tokens-BFqSOfhx.mjs";
+import { n as bv2av, t as av2bv } from "./bv2av-DUm4x7as.mjs";
+import { _ as AmagiHeaders, a as createXiaohongshuGuestCookie$1, c as sharedKuaishouSigner, d as douyinXBogus, f as msToken, g as observeDouyinWebid, h as douyinSign$1, i as getSearchId, l as aBogus$1, m as xBogus, n as traceId, o as createXiaohongshuCryptoConfig, p as secsdk, r as xs, s as hxfalcon, t as rap, u as douyinBogus, v as qtparam$1, y as wbi } from "./steps-bZrsb4W6.mjs";
+import { A as genVerifyFp, Ct as getCookieValue, N as ABogus, Y as a_bogus_default, Z as buildBrowserInfo, _t as applySecsdkWebSign, i as deriveKuaishouPureSignature, o as XBogus, w as TTWID_REGISTER_URL, x as DOUYIN_TTWID, yt as extractUifidFromCookie } from "./he-q7589Kp7.mjs";
 import express, { Router } from "express";
 import zod from "zod";
-import crypto, { createCipheriv, createHash, randomBytes, randomUUID } from "node:crypto";
 import protobuf from "protobufjs";
 import axios, { AxiosError, AxiosHeaders, mergeConfig } from "axios";
 import { EventEmitter } from "node:events";
+import crypto, { createCipheriv, createHash, randomBytes, randomUUID } from "node:crypto";
+import vm from "node:vm";
 import { FingerprintGenerator, Xhshow } from "@ikenxuan/xhshow-ts";
 //#region src/platforms/bilibili/api.ts
 /**
@@ -408,57 +410,6 @@ const articleListInfo = defineBilibiliEndpoint({
 	response: type()
 });
 //#endregion
-//#region src/platforms/bilibili/sign/bv2av.ts
-const XOR_CODE = 23442827791579n;
-const MASK_CODE = 2251799813685247n;
-const MAX_AID = 1n << 51n;
-const BASE = 58n;
-const data = "FcwAPNKTMug3GV5Lj7EJnHpWsx4tb8haYeviqBz6rkCy12mUSDQX9RdoZf";
-/**
-* av号转bv号
-* @param aid av号
-* @returns
-*/
-const av2bv = (aid) => {
-	const bytes = [
-		"B",
-		"V",
-		"1",
-		"0",
-		"0",
-		"0",
-		"0",
-		"0",
-		"0",
-		"0",
-		"0",
-		"0"
-	];
-	let bvIndex = bytes.length - 1;
-	let tmp = (MAX_AID | BigInt(aid)) ^ XOR_CODE;
-	while (tmp > 0) {
-		bytes[bvIndex] = data[Number(tmp % BigInt(BASE))];
-		tmp = tmp / BASE;
-		bvIndex -= 1;
-	}
-	[bytes[3], bytes[9]] = [bytes[9], bytes[3]];
-	[bytes[4], bytes[7]] = [bytes[7], bytes[4]];
-	return bytes.join("");
-};
-/**
-* bv号转av号
-* @param bvid bv号
-* @returns
-*/
-const bv2av = (bvid) => {
-	const bvidArr = Array.from(bvid);
-	[bvidArr[3], bvidArr[9]] = [bvidArr[9], bvidArr[3]];
-	[bvidArr[4], bvidArr[7]] = [bvidArr[7], bvidArr[4]];
-	bvidArr.splice(0, 3);
-	const tmp = bvidArr.reduce((pre, bvidChar) => pre * BASE + BigInt(data.indexOf(bvidChar)), 0n);
-	return Number(tmp & MASK_CODE ^ XOR_CODE);
-};
-//#endregion
 //#region src/platforms/bilibili/endpoints/avToBv.ts
 /**
 * AV 号转 BV 号（纯本地计算，不发请求）。
@@ -2208,6 +2159,7 @@ const DEFAULT_ERROR_MESSAGES = {
 	RATE_LIMITED: "请求过于频繁，请稍后再试",
 	RISK_CONTROL: "触发平台风控",
 	CAPTCHA_REQUIRED: "需要完成验证码",
+	SIGNATURE_REFUSED: "平台拒绝了本次请求的签名（amagi 侧的签名问题，换 cookie 无用）",
 	NOT_FOUND: "资源不存在",
 	DELETED: "资源已删除或已下架",
 	PRIVATE: "资源为私密状态",
@@ -2449,6 +2401,61 @@ const DOUYIN_ANDROID_UA = "Mozilla/5.0 (Linux; Android 13; SM-S908E) AppleWebKit
 */
 const isDouyinArgusBody = (raw) => typeof raw === "string" && /ArgusSecurityPlugin|Blocked by/i.test(raw);
 /**
+* Argus 拦截文本里点名「签名不对」的片段。
+*
+* 命中这些的 403 是 **amagi 自己的问题，不是这个账号的问题** —— 平台在说
+* 「你这个签名我不认」，而不是「你这个号被风控了」。两者处置方式完全相反：
+* 前者换 cookie 一万次也没用（得修签名），后者换个号就好了。
+*
+* 片段清单来自线上实测，全部是 `Blocked by ArgusSecurityPlugin <reason>` 形态。
+* 403 若一律判风控，「签名器少算了一个参数」就会表现成账号被风控，排查方向
+* 整个跑偏。
+*
+* `uifid not found` 这一条在本仓库有具体成因：`/aweme/v1/web/music/detail/` 这类
+* 受 secsdk 保护的端点要求访客 id，而扫码登录拿回的 cookie 里**没有** `UIFID`
+* （它由 secsdk 在真实浏览器里铸造，passport 链路不经过那一步）。见
+* `sign/secsdkWebSign.ts` 的 `applySecsdkWebSign`。
+*/
+const SIGNATURE_REFUSAL_MARKERS = [
+	"uifid not found",
+	"signature not found",
+	"sign invalid",
+	"sign expired"
+];
+/**
+* 从 Argus 拦截文本里认出「签名被拒」。
+*
+* 只在**已经确定是 Argus 文本**之后调用（`isDouyinArgusBody` 为真），所以这里
+* 直接按子串找，不必担心把正常响应里恰好出现的字眼当成拦截。
+* @param raw - decode 之后的响应体
+* @returns 命中的片段；不是签名类拒绝时返回 `undefined`
+*/
+const douyinSignatureRefusal = (raw) => {
+	if (typeof raw !== "string") return void 0;
+	const text = raw.toLowerCase();
+	return SIGNATURE_REFUSAL_MARKERS.find((marker) => text.includes(marker));
+};
+/**
+* 抖音风控页（verify_center）的判据字段。
+*
+* 实物形状（`status_code: 10000` + 这个字段，字段本身是**字符串形式的 JSON**）：
+*
+* ```jsonc
+* { "status_code": 10000, "status_msg": "",
+*   "verify_center_decision_conf": "{\"verify_center_decision\":\"verify_hit\",\"decision_conf\":{\"subtype\":\"slide\"}}" }
+* ```
+*
+* **按字段名判，不扫全文**。扫 `captcha` 这类子串会把「简介里恰好提到验证码」
+* 的正常作品判成风控，而每一次误判都会冤枉一个健康账号；字段名不会出现在用户
+* 文案里。
+*
+* 这一条只负责**定性**到「需要人机验证」。它不产出验证页地址 —— 目前掌握的
+* 这份响应里确实没有可跳转的 URL，`verify_center_decision_conf` 里只有
+* `verify_hit` 与 `subtype: slide` 这类决策信息。所以 amagi 不装
+* `ChallengeExtractor`（`error.challenge` 仍为空），不编造一个地址出来。
+*/
+const VERIFY_CENTER_KEY = "verify_center_decision_conf";
+/**
 * 抖音平台默认响应判定。
 *
 * 判定规则：
@@ -2474,10 +2481,22 @@ const douyinJudge = (raw, http) => {
 		code: "EMPTY_RESPONSE",
 		retryable: false
 	};
+	if (douyinSignatureRefusal(raw)) return {
+		ok: false,
+		kind: "risk",
+		code: "SIGNATURE_REFUSED",
+		retryable: false
+	};
 	const nonJson = verdictFromNonJsonBody(raw);
 	if (nonJson) return nonJson;
 	if (typeof raw !== "object" || raw === null) return verdictFromHttpStatus(http.status) ?? { ok: true };
 	const body = raw;
+	if (body[VERIFY_CENTER_KEY] !== void 0 && body[VERIFY_CENTER_KEY] !== null && body[VERIFY_CENTER_KEY] !== "") return {
+		ok: false,
+		kind: "risk",
+		code: "CAPTCHA_REQUIRED",
+		retryable: false
+	};
 	const filterDetail = body.filter_detail;
 	if (filterDetail && typeof filterDetail.filter_reason === "string" && filterDetail.filter_reason.length > 0) return {
 		ok: false,
@@ -2495,6 +2514,282 @@ const douyinJudge = (raw, http) => {
 	return verdictFromHttpStatus(http.status) ?? { ok: true };
 };
 //#endregion
+//#region src/platforms/douyin/mint.ts
+/**
+* 抖音访客 id（`UIFID_TEMP`）的铸造与 cookie 审计。
+*
+* 受 secsdk 保护的端点（`/aweme/v1/web/music/detail/` 等）要求 cookie 里带访客 id，
+* 而它不由登录颁发——passport 扫码链路只发身份 cookie。缺了它，受保护端点稳定回
+* `403 Uifid Not Found`（见 `judge.ts` 的 `SIGNATURE_REFUSED` 归因）。
+*
+* 铸造是纯 HTTP 的，三步：
+*
+* 1. `GET www.douyin.com` → 服务端发 `__ac_nonce`，响应体是一份挑战页（内联
+*    byted_acrawler 本体 + 引导脚本 `init({aid: 99999999, dfp: 0})` 与
+*    `sign("", nonce)`）；
+* 2. 在 Node `vm` 里执行本体，离线算出 `__ac_signature`；
+* 3. 带 `__ac_nonce + __ac_signature` 再 GET 一次 → 服务端一次性 Set-Cookie：
+*    `ttwid` + `web_sign_token` + `UIFID_TEMP`。
+*
+* acrawler 本体不进仓库——每次铸造从挑战页现取现执行，抖音更新算法时自动跟随。
+* 同一客户端上下文（IP + UA）重复铸造返回同一个 `UIFID_TEMP`（有效期约 500 天），
+* 进程内缓存一次即可。
+*
+* 接线：`PLATFORM_RUNTIME.douyin.ensureCookie` 在每次请求 prepare 之后审计
+* （prepare 可能整串换 cookie，审计要对最终生效的那份负责）；`session/qrcode.ts`
+* 在登录完成时审计，让扫码登录直接产出带访客 id 的凭证。
+*
+* 铸造尽力而为：网络失败、挑战页形状变化、签名被拒——一律返回原 cookie，归因
+* 交给 `SIGNATURE_REFUSED`。不抛错：自愈失败不该把调用变成 `internal`。
+*
+* @module platform/douyin/mint
+*/
+/** 无调用方 UA 时铸造请求的兜底 UA。与 amagi 默认基线同代 */
+const DEFAULT_MINT_UA = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36";
+/** 挑战页引导脚本里的 aid。实测固定为 99999999，从引导块里解析，解析不到用它兜底 */
+const AID_FALLBACK = 99999999;
+/** acrawler 本体的最小长度。挑战页里最大的内联块（实测 ~71KB），低于此视为形状变化 */
+const ACGRAWLER_MIN_LENGTH = 1e4;
+/**
+* 从挑战页 HTML 里解析 acrawler 本体与引导 aid。
+*
+* 规则刻意保守：取**最大的无 `src` 内联 script 块**当本体（实测 ~71KB，远大于页面
+* 上任何其它内联块），引导块按「提到 `byted_acrawler` 且含 `sign(`」认——两者都不
+* 合格就返回 `undefined`，宁可放弃铸造也不把来路不明的脚本执行一遍。
+* @param html - 挑战页 HTML（首次请求的响应体）
+* @returns 解析结果；形状不对时 `undefined`
+*/
+const extractChallengeParts = (html) => {
+	const blocks = [...html.matchAll(/<script>([\s\S]*?)<\/script>/g)].map((m) => m[1]);
+	if (blocks.length === 0) return void 0;
+	const acrawlerSource = blocks.reduce((a, b) => b.length > a.length ? b : a);
+	if (acrawlerSource.length < ACGRAWLER_MIN_LENGTH) return void 0;
+	const bootstrap = blocks.find((b) => b !== acrawlerSource && b.includes("byted_acrawler") && b.includes("sign("));
+	if (!bootstrap) return void 0;
+	const aidMatch = bootstrap.match(/aid:(\d+)/);
+	return {
+		acrawlerSource,
+		aid: aidMatch ? Number(aidMatch[1]) : AID_FALLBACK
+	};
+};
+/**
+* 执行 acrawler 本体，返回对任意 nonce 的离线签名函数。
+*
+* shim 只需要 SDK 引用到的环境面：`document.cookie`（nonce 从这里读回，给空串让
+* 签名只依赖入参）、location / navigator / screen / history 与基础内置对象。环境
+* 数据不参与服务端校验（实测假数据可通过），所以 shim 不追求逼真。
+* @param source - acrawler 本体源码
+* @param aid - 引导 aid
+* @param userAgent - 参与签名的 UA（与后续 API 请求保持一致）
+* @returns `sign('', nonce)` 的等价函数
+*/
+const createAcrawlerSigner = (source, aid, userAgent) => {
+	const doc = {};
+	Object.defineProperty(doc, "cookie", {
+		get: () => "",
+		set: () => {}
+	});
+	const windowShim = {
+		document: doc,
+		location: {
+			href: "https://www.douyin.com/",
+			protocol: "https:",
+			host: "www.douyin.com",
+			hostname: "www.douyin.com",
+			pathname: "/",
+			search: "",
+			hash: "",
+			origin: "https://www.douyin.com",
+			reload: () => {}
+		},
+		navigator: {
+			userAgent,
+			language: "zh-CN",
+			platform: "Win32"
+		},
+		screen: {
+			width: 2560,
+			height: 1440
+		},
+		history: { length: 2 },
+		setTimeout: () => 0,
+		setInterval: () => 0,
+		clearTimeout: () => {},
+		clearInterval: () => {},
+		console: {
+			log: () => {},
+			warn: () => {},
+			error: () => {}
+		},
+		Object,
+		Array,
+		Symbol,
+		Error,
+		TypeError,
+		JSON,
+		Math,
+		Date,
+		Promise,
+		Reflect,
+		Map,
+		Set,
+		Number,
+		String,
+		Boolean,
+		RegExp,
+		Function,
+		parseInt,
+		parseFloat,
+		isNaN,
+		encodeURIComponent,
+		decodeURIComponent,
+		TextEncoder,
+		URL,
+		URLSearchParams,
+		performance
+	};
+	windowShim.window = windowShim;
+	windowShim.self = windowShim;
+	windowShim.top = windowShim;
+	windowShim.parent = windowShim;
+	windowShim.globalThis = windowShim;
+	const context = vm.createContext(windowShim);
+	vm.runInContext(source, context, { timeout: 2e4 });
+	const ac = windowShim.byted_acrawler;
+	if (!ac?.sign) throw new Error("acrawler 本体未注册 byted_acrawler.sign");
+	ac.init({
+		aid,
+		dfp: 0
+	});
+	return (nonce) => ac.sign("", nonce);
+};
+/**
+* 测试环境守卫：vitest 进程内默认出口**不做真实出网请求**（审计在测试里保持透明，
+* 断言 Cookie 透传的用例不该被一次真网铸造改写）。通过 {@link MintDeps.getHome}
+* 注入出口的用例不受影响——守卫只管默认出口。
+*/
+const testEnvGuard = async () => {
+	throw new Error("douyin visitor mint is disabled under vitest (inject MintDeps.getHome to test it)");
+};
+/**
+* 运营开关：`AMAGI_DISABLE_DOUYIN_MINT=1` 关闭自动铸造。
+*
+* 铸造是 amagi **自主发起**的出网请求（用户没有显式调用任何端点），出口受限、
+* 安全审计、或「cookie 由我自己全权管理」的环境需要一个明确的选择权。关闭后
+* cookie 保持原样，受保护端点按 `SIGNATURE_REFUSED` 的既有归因失败。注入
+* {@link MintDeps.getHome} 的用例不受影响——开关只管默认出口。
+*/
+const mintDisabledByEnv = () => process.env.AMAGI_DISABLE_DOUYIN_MINT === "1";
+const defaultGetHome = async (cookie, userAgent) => {
+	if (process.env.VITEST) return testEnvGuard();
+	if (mintDisabledByEnv()) return testEnvGuard();
+	const response = await axios.get("https://www.douyin.com/", {
+		headers: {
+			"User-Agent": userAgent,
+			Accept: "text/html",
+			...cookie ? { Cookie: cookie } : {}
+		},
+		timeout: 15e3,
+		maxRedirects: 5,
+		responseType: "text"
+	});
+	const setCookies = response.headers["set-cookie"] ?? [];
+	return {
+		setCookies: Array.isArray(setCookies) ? setCookies : [setCookies],
+		body: String(response.data ?? "")
+	};
+};
+/** 从 Set-Cookie 行数组里取某个 cookie 的值 */
+const setCookieValue = (cookies, name) => {
+	const line = cookies.find((c) => c.startsWith(name + "="));
+	return line ? line.split(";")[0].split("=").slice(1).join("=") : void 0;
+};
+/**
+* 铸造一次访客 id（两次 GET + 离线签名）。不做缓存、不去重——那是
+* {@link ensureDouyinVisitorCookie} 的职责。
+* @param userAgent - 铸造请求的 UA（与后续 API 请求保持一致）
+* @param deps - 可注入的 HTTP 出口（测试用）
+* @returns 铸造结果；挑战页形状变化 / 签名被拒 / 网络失败时 `undefined`
+*/
+const mintDouyinVisitorCookie = async (userAgent, deps) => {
+	const ua = userAgent || DEFAULT_MINT_UA;
+	const getHome = deps?.getHome ?? defaultGetHome;
+	try {
+		const first = await getHome(void 0, ua);
+		const nonce = setCookieValue(first.setCookies, "__ac_nonce");
+		if (!nonce) return void 0;
+		const parts = extractChallengeParts(first.body);
+		if (!parts) return void 0;
+		const second = await getHome(`__ac_nonce=${nonce}; __ac_signature=${createAcrawlerSigner(parts.acrawlerSource, parts.aid, ua)(nonce)}`, ua);
+		const ttwid = setCookieValue(second.setCookies, "ttwid");
+		const uifidTemp = setCookieValue(second.setCookies, "UIFID_TEMP");
+		if (!ttwid || !uifidTemp) return void 0;
+		return {
+			ttwid,
+			uifidTemp
+		};
+	} catch {
+		return;
+	}
+};
+/**
+* 把铸造结果合并进现有 cookie。**只补缺失的名字**：`ttwid` 已有则不动（那是调用方
+* 的设备标识，铸造顺带产的那份与它会话无关），访客 id 已有任何拼写则原样返回。
+* @param cookie - 现有 cookie 串，可为空
+* @param minted - 铸造结果
+* @returns 合并后的 cookie 串；无可合并项时原样返回
+*/
+const mergeVisitorCookie = (cookie, minted) => {
+	const base = cookie?.trim() ? cookie.trim().replace(/;\s*$/, "") : "";
+	const names = new Set(base.split(";").map((p) => p.split("=")[0].trim()).filter(Boolean));
+	if (names.has("UIFID_TEMP") || names.has("UIFID") || names.has("uifid") || names.has("uifid_temp")) return base;
+	const parts = [];
+	if (!names.has("ttwid") && minted.ttwid) parts.push(`ttwid=${minted.ttwid}`);
+	if (minted.uifidTemp) parts.push(`UIFID_TEMP=${minted.uifidTemp}`);
+	if (parts.length === 0) return base;
+	return base ? `${base}; ${parts.join("; ")}` : parts.join("; ");
+};
+/** 审计缓存：原始 cookie（+UA）→ 合并后 cookie。进程级，`UIFID_TEMP` 有效期约 500 天 */
+const cache = /* @__PURE__ */ new Map();
+/** in-flight 去重：并发调用共享同一次铸造（合并是按各自 cookie 进行的，结果正确） */
+let inflight;
+const CACHE_MAX_ENTRIES = 64;
+/**
+* cookie 审计：缺访客 id 时铸造并合并，其余原样返回。进程内缓存，同一 cookie 只铸一次。
+*
+* **永不为调用增加失败**：任何异常都吞掉并返回原 cookie，请求按原路径走——自愈失败
+* 的归因交给受保护端点自己的 `SIGNATURE_REFUSED`。
+* @param cookie - 本次调用的 cookie，可为空（全新部署连 cookie 都没配的场景）
+* @param userAgent - 本次调用的 UA（铸造请求用它，保证与后续 API 请求同源）
+* @param deps - 可注入的 HTTP 出口（测试用）
+* @returns 升级后的 cookie；无需升级或铸造失败时原样返回
+*/
+const ensureDouyinVisitorCookie = async (cookie, userAgent, deps) => {
+	if (cookie && extractUifidFromCookie(cookie)) return cookie;
+	const cacheKey = `${cookie ?? ""} ${userAgent ?? ""}`;
+	const hit = cache.get(cacheKey);
+	if (hit !== void 0) return hit;
+	if (inflight !== void 0) return inflight;
+	inflight = (async () => {
+		try {
+			const minted = await mintDouyinVisitorCookie(userAgent, deps);
+			if (!minted) return cookie;
+			const merged = mergeVisitorCookie(cookie, minted);
+			cache.set(cacheKey, merged);
+			if (cache.size > CACHE_MAX_ENTRIES) {
+				const oldest = cache.keys().next().value;
+				if (oldest !== void 0) cache.delete(oldest);
+			}
+			return merged;
+		} catch {
+			return cookie;
+		} finally {
+			inflight = void 0;
+		}
+	})();
+	return inflight;
+};
+//#endregion
 //#region src/platforms/douyin/sign/signers.ts
 /**
 * 抖音签名器表：**只做「注册名 → `SignStep` 清单」的映射，不含算法**。
@@ -2686,7 +2981,7 @@ const parseKuaishouCaptcha = (raw) => {
 /** 默认超时，与抖音 / B站 / 小红书一致 */
 const KUAISHOU_DEFAULT_TIMEOUT = 1e4;
 /** 从请求配置里取 UA：大小写不敏感，取不到用集中维护的默认值 */
-const userAgentOf$1 = (requestConfig) => {
+const userAgentOf$2 = (requestConfig) => {
 	return new AmagiHeaders(requestConfig?.headers).get("user-agent") ?? "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36";
 };
 /**
@@ -2698,7 +2993,7 @@ const userAgentOf$1 = (requestConfig) => {
 * @returns 默认 header 基线 + 请求配置
 */
 const createKuaishouConfig = (cookie, requestConfig) => {
-	const userAgent = userAgentOf$1(requestConfig);
+	const userAgent = userAgentOf$2(requestConfig);
 	const secChUa = generateSecChUa(userAgent);
 	return {
 		headers: new AmagiHeaders().set("accept", "application/json, text/plain, */*").set("accept-encoding", "gzip, deflate, br, zstd").set("accept-language", "zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6").set("content-type", "application/json").set("priority", "u=0, i").set("origin", "https://www.kuaishou.com").set("referer", "https://www.kuaishou.com/new-reco").set("sec-ch-ua", secChUa).set("sec-ch-ua-mobile", "?0").set("sec-ch-ua-platform", "\"Windows\"").set("sec-fetch-dest", "empty").set("sec-fetch-mode", "cors").set("sec-fetch-site", "same-site").set("user-agent", userAgent).merge(requestConfig?.headers),
@@ -2936,7 +3231,7 @@ const createKuaishouSigners = (signer = sharedKuaishouSigner) => ({ hxfalcon: st
 /** 默认超时，与抖音 / B站 / 快手一致 */
 const XIAOHONGSHU_DEFAULT_TIMEOUT = 1e4;
 /** 从请求配置里取 UA：大小写不敏感，取不到用集中维护的默认值 */
-const userAgentOf = (requestConfig) => {
+const userAgentOf$1 = (requestConfig) => {
 	return new AmagiHeaders(requestConfig?.headers).get("user-agent") ?? "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36";
 };
 /**
@@ -2946,7 +3241,7 @@ const userAgentOf = (requestConfig) => {
 * @returns 默认 header 基线 + 请求配置
 */
 const createXiaohongshuConfig = (cookie, requestConfig) => {
-	const userAgent = userAgentOf(requestConfig);
+	const userAgent = userAgentOf$1(requestConfig);
 	const secChUa = generateSecChUa(userAgent);
 	return {
 		headers: new AmagiHeaders().set("accept", "application/json, text/plain, */*").set("accept-language", "zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6").set("cache-control", "no-cache").set("content-type", "application/json;charset=UTF-8").set("pragma", "no-cache").set("priority", "u=1, i").set("referer", "https://www.xiaohongshu.com/").set("sec-ch-ua", secChUa).set("sec-ch-ua-mobile", "?0").set("sec-ch-ua-platform", "\"Windows\"").set("sec-fetch-dest", "empty").set("sec-fetch-mode", "cors").set("sec-fetch-site", "same-site").set("user-agent", userAgent).set("cookie", cookie?.trim() ?? "").merge(requestConfig?.headers),
@@ -3651,7 +3946,7 @@ var HttpClient = class {
 //#endregion
 //#region src/client/runtime.ts
 /**
-* 平台运行期依赖表：签名器表 + 默认 judge + 可选的风控挑战提取器 / 响应旁观者。
+* 平台运行期依赖表：签名器表 + 默认 judge + 可选的风控挑战提取器 / 响应旁观者 / cookie 审计。
 *
 * 四个平台都必须 `signers` / `judge` 齐全 —— 少一项不会报编译错误，请求会
 * 不签名、或业务失败被判成成功。
@@ -3663,6 +3958,11 @@ var HttpClient = class {
 * `observe` 是**可选的第四项**：只有「服务端把状态写在响应头里」的平台才装
 * （目前只有抖音，用它回收 `webid`）。每次 send 之后调用一次，只读、不影响判定。
 *
+* `ensureCookie` 是**可选的第五项**：只有「cookie 里有平台自己才认得的必填身份」的
+* 平台才装（目前只有抖音，缺访客 id 时自动铸造并合并）。每次调用在 prepare 之后、
+* build/sign 之前执行一次，返回升级后的 cookie；失败/无需升级原样返回——审计
+* **永不为调用增加失败**。
+*
 * createClient 的 fetcher、四个 `createXxxRoutes` 与静态 fetcher 共用这张表，
 * 保证同一平台在任何入口下的签名 / 判定 / 风控行为一致。
 */
@@ -3679,7 +3979,8 @@ const PLATFORM_RUNTIME = {
 	douyin: {
 		signers: createDouyinSigners(),
 		judge: douyinJudge,
-		observe: observeDouyinWebid
+		observe: observeDouyinWebid,
+		ensureCookie: ensureDouyinVisitorCookie
 	},
 	bilibili: {
 		signers: (() => {
@@ -3744,6 +4045,7 @@ const makeClientCtx = (platform, cookie, requestConfig = {}, clientId = "shared"
 		judge: runtime.judge,
 		...runtime.challenge === void 0 ? {} : { challenge: runtime.challenge },
 		...runtime.observe === void 0 ? {} : { observe: runtime.observe },
+		...runtime.ensureCookie === void 0 ? {} : { ensureCookie: runtime.ensureCookie },
 		...bus === void 0 ? {} : { bus },
 		...debug === void 0 ? {} : { debug },
 		send: (spec, reason, perCall) => http.send(spec, reason, perCall),
@@ -4278,6 +4580,10 @@ const execute = async (def, input, options) => {
 			...baseCtx,
 			send: boundSend
 		};
+		if (options.ensureCookie) {
+			const upgraded = await options.ensureCookie(ctx.cookie, ctx.userAgent);
+			if (upgraded !== void 0 && upgraded !== ctx.cookie) ctx.cookie = upgraded;
+		}
 		stage = "build";
 		if (!def.build) throw new Error(`端点 ${def.name} 既没有 build 也没有 compute`);
 		stage = "sign";
@@ -4601,6 +4907,7 @@ const callEndpoint = (def, ctx, options, requestConfig) => {
 		judge: ctx.judge,
 		challenge: ctx.challenge,
 		observe: ctx.observe,
+		ensureCookie: ctx.ensureCookie,
 		bus: ctx.bus,
 		trace: tracer,
 		debug: ctx.debug,
@@ -7449,6 +7756,11 @@ const buildVerifyBody = (verify, verifyWay, tail) => ({
 });
 //#endregion
 //#region src/platforms/douyin/session/qrcode.ts
+/** 从请求配置的 headers 里尽量取出 UA（大小写不敏感；取不到返回 `undefined`，铸造用兜底 UA） */
+const userAgentOf = (headers) => {
+	if (!headers || typeof headers !== "object") return void 0;
+	for (const [key, value] of Object.entries(headers)) if (key.toLowerCase() === "user-agent" && typeof value === "string") return value;
+};
 /**
 * 抖音扫码登录策略。
 *
@@ -7574,7 +7886,7 @@ const douyinQrcodeStrategy = {
 			};
 			case "confirmed": {
 				if (result.redirectUrl) await client.followSsoRedirect(result.redirectUrl);
-				const cookie = client.cookies.toString();
+				const cookie = await ensureDouyinVisitorCookie(client.cookies.toString(), userAgentOf(ctx.requestConfig?.headers)) ?? client.cookies.toString();
 				return {
 					ok: true,
 					state: {
@@ -51623,7 +51935,7 @@ const buildOpenApiSpec = (options = {}) => {
 		openapi: "3.1.0",
 		info: {
 			title: "amagi HTTP API",
-			version: options.version ?? "7.0.0-beta.7",
+			version: options.version ?? "7.0.0-beta.8",
 			description: [
 				"由端点注册表派生的规范 —— 手写的那份已经漂移，这份不会（`gen-openapi --check` 进 CI）。",
 				"",
@@ -54393,7 +54705,7 @@ let DynamicType = /* @__PURE__ */ function(DynamicType) {
 * 构建后使用 __VERSION__，开发环境从 package.json 读取
 */
 const getVersion = () => {
-	return "7.0.0-beta.7";
+	return "7.0.0-beta.8";
 };
 const VERSION = getVersion();
 /**
@@ -54444,4 +54756,4 @@ const amagi = Client;
 * GPL-3.0 Licensed
 */
 //#endregion
-export { unwrap as $, douyinFetcher as A, xiaohongshuSign as B, ValidationError as C, parseDmSegMobileReply as Ct, createBoundKuaishouFetcher as D, xiaohongshuFetcher as E, bilibiliFetcher as F, createDouyinRoutes as G, createKuaishouRoutes as H, createBoundBilibiliFetcher as I, bilibiliUtils as J, passport_exports as K, createClient as L, requestPassportQrcode as M, sendPassportVerifyCode as N, kuaishouFetcher as O, validatePassportVerifyCode as P, isSuccess as Q, xiaohongshuUtils as R, ApiError as S, emitNetworkRetry as St, createBoundXiaohongshuFetcher as T, bv2av as Tt, kuaishouSign as U, kuaishouUtils as V, douyinUtils as W, AmagiThrownError as X, createBilibiliRoutes as Y, isFailure as Z, validateBilibiliParams as _, emitLogError as _t, AdditionalType as a, wbi_sign as at, validateXiaohongshuParams as b, emitLogWarn as bt, createAmagiClient as c, fetchResponse as ct, assertValidBilibiliParams as d, emitApiError as dt, AMAGI_BUS_EVENT_NAMES as et, assertValidDouyinParams as f, emitApiSuccess as ft, createSuccessResponse as g, emitLogDebug as gt, createErrorResponse as h, emitLog as ht, DynamicType as i, qtparam as it, checkPassportQrcode as j, createBoundDouyinFetcher as k, kuaishouApiUrls as l, isNetworkErrorResult as lt, assertValidXiaohongshuParams as m, emitHttpResponse as mt, CreateApp as n, KUAISHOU_PC_CAPTCHA_RESULT as nt, MajorType as o, bilibiliApiUrls as ot, assertValidKuaishouParams as p, emitHttpRequest as pt, douyinSign as q, amagi as r, parseKuaishouCaptcha as rt, CommentType as s, fetchData as st, Client as t, KUAISHOU_H5_CAPTCHA_RESULT as tt, douyinApiUrls as u, amagiEvents as ut, validateDouyinParams as v, emitLogInfo as vt, handleError as w, av2bv as wt, xiaohongshuApiUrls as x, emitNetworkError as xt, validateKuaishouParams as y, emitLogMark as yt, createXiaohongshuRoutes as z };
+export { unwrap as $, douyinFetcher as A, xiaohongshuSign as B, ValidationError as C, parseDmSegMobileReply as Ct, createBoundKuaishouFetcher as D, xiaohongshuFetcher as E, bilibiliFetcher as F, createDouyinRoutes as G, createKuaishouRoutes as H, createBoundBilibiliFetcher as I, bilibiliUtils as J, passport_exports as K, createClient as L, requestPassportQrcode as M, sendPassportVerifyCode as N, kuaishouFetcher as O, validatePassportVerifyCode as P, isSuccess as Q, xiaohongshuUtils as R, ApiError as S, emitNetworkRetry as St, createBoundXiaohongshuFetcher as T, kuaishouSign as U, kuaishouUtils as V, douyinUtils as W, AmagiThrownError as X, createBilibiliRoutes as Y, isFailure as Z, validateBilibiliParams as _, emitLogError as _t, AdditionalType as a, wbi_sign as at, validateXiaohongshuParams as b, emitLogWarn as bt, createAmagiClient as c, fetchResponse as ct, assertValidBilibiliParams as d, emitApiError as dt, AMAGI_BUS_EVENT_NAMES as et, assertValidDouyinParams as f, emitApiSuccess as ft, createSuccessResponse as g, emitLogDebug as gt, createErrorResponse as h, emitLog as ht, DynamicType as i, qtparam as it, checkPassportQrcode as j, createBoundDouyinFetcher as k, kuaishouApiUrls as l, isNetworkErrorResult as lt, assertValidXiaohongshuParams as m, emitHttpResponse as mt, CreateApp as n, KUAISHOU_PC_CAPTCHA_RESULT as nt, MajorType as o, bilibiliApiUrls as ot, assertValidKuaishouParams as p, emitHttpRequest as pt, douyinSign as q, amagi as r, parseKuaishouCaptcha as rt, CommentType as s, fetchData as st, Client as t, KUAISHOU_H5_CAPTCHA_RESULT as tt, douyinApiUrls as u, amagiEvents as ut, validateDouyinParams as v, emitLogInfo as vt, handleError as w, xiaohongshuApiUrls as x, emitNetworkError as xt, validateKuaishouParams as y, emitLogMark as yt, createXiaohongshuRoutes as z };