@streamapp/stream 0.0.1

package/resources/packages/xhs/xhs-like.recipe.json

@@ -0,0 +1,96 @@
+{
+  "version": 1,
+  "kind": "browser",
+  "sourceId": "xhs-like",
+  "cookieDomain": "xiaohongshu.com",
+  "entryUrl": "https://www.xiaohongshu.com/explore",
+  "entryWait": "domcontentloaded",
+  "rideCurrentPage": true,
+  "loginCheck": {
+    "loggedIn": ".main-container .user",
+    "wall": ".login-modal.reds-modal-open"
+  },
+  "session": {
+    "facility": "xhs",
+    "lifecycle": "persistent",
+    "visibility": "unattended"
+  },
+  "_why": "互动写入（点赞/收藏），不是采集。这是 knowingly 放宽『recipe 只读』边界（Gap C，见 docs/superpowers/specs/2026-07-18-xhs-like-collect-design.md §2）——若日后收紧信任模型，这份 recipe 是回补清单第一条。复用 evaluate step：targetCount:1 + 无 cursorField => 只发一次 in-page eval。call 在登录页里揪出站点自身的签名请求 fn（按语义名 postApiSnsWebV1Note{Like,Dislike,Collect,Uncollect} 扫模块，不硬编模块 id/导出字母），按 action 发对应端点。body key 各 action 不同（实测：like/unlike=note_oid、collect=note_id、uncollect=note_ids 逗号串），context-free（无需打开笔记）。业务/参数/风控错都会 reject => EvaluateDriftError => 端点失败 => 前端回滚。响应形状不统一，故只回 {noteId, action, ok}，计数前端乐观。",
+  "steps": [
+    {
+      "kind": "evaluate",
+      "itemsAt": "items",
+      "pageSize": 1,
+      "maxPages": 1,
+      "call": "async (cursor, num, params) => { const g='webpackChunkxhs_pc_web'; let req; window[g].push([[Math.random()],{},r=>req=r]); let m; for (const id of Object.keys(req.m)) { try { if (req.m[id].toString().includes('postApiSnsWebV1NoteLike(')) { m=req(id); break; } } catch(e){} } if(!m) throw new Error('xhs interaction module not found'); const pick=(needle)=>{ for (const k of Object.keys(m)) { try { if (typeof m[k]==='function' && m[k].toString().includes(needle+'(')) return m[k]; } catch(e){} } return null; }; const id=params.noteId; const action=params.action; const table={ like:{fn:'postApiSnsWebV1NoteLike',body:{note_oid:id}}, unlike:{fn:'postApiSnsWebV1NoteDislike',body:{note_oid:id}}, collect:{fn:'postApiSnsWebV1NoteCollect',body:{note_id:id}}, uncollect:{fn:'postApiSnsWebV1NoteUncollect',body:{note_ids:id}} }; const spec=table[action]; if(!spec) throw new Error('unknown xhs interaction action: '+action); const fn=pick(spec.fn); if(!fn) throw new Error('xhs interaction fn not found: '+spec.fn); await fn(spec.body); return { items: [ { noteId:id, action:action, ok:true } ] }; }"
+    }
+  ],
+  "observers": [],
+  "output": {
+    "itemsAt": "items",
+    "dedupeBy": "noteId",
+    "targetCount": 1,
+    "mapping": {
+      "noteId": "noteId",
+      "action": "action",
+      "ok": "ok"
+    }
+  },
+  "policy": {
+    "maxTaskMs": 20000
+  },
+  "meta": {
+    "auth": {
+      "type": "session",
+      "facility": "xhs",
+      "login": "qr",
+      "loginUrl": "https://www.xiaohongshu.com/explore",
+      "qrSelector": ".login-container img.qrcode-img, .qrcode img",
+      "cookieDomain": "xiaohongshu.com",
+      "sessionCookies": [
+        "web_session"
+      ]
+    },
+    "effects": [
+      "write"
+    ],
+    "action": true,
+    "_why_action": "写用户账户（点赞/收藏），meta.action:true 让它落进 ActionRecipeBlockedError 那道闸——模型经 stream_read/定时调度不能碰它。它仍能被前端『点赞』按钮正常调用：那条路（POST /api/discover/interact → harvest.xhsInteract → config.readSource('xhs-like', ..., { userInitiated: true })）显式声明了 userInitiated，闸认的是这个标记，不是 kind。",
+    "normalizer": "xhs",
+    "type": "post",
+    "title": "互动（点赞/收藏）",
+    "description": "小红书笔记点赞/收藏/取消 · 登录态 tab 内调站点签名接口写入",
+    "topics": [
+      "xhs",
+      "xiaohongshu",
+      "social"
+    ],
+    "categories": [
+      "social-media"
+    ],
+    "facility": {
+      "key": "xhs",
+      "label": "小红书"
+    },
+    "capabilities": [
+      "anchor"
+    ],
+    "cadence_hint_seconds": 1800,
+    "discoverable": false,
+    "_why_pick_in": "两个选择面都不出现——点赞/收藏的写操作，由前端动作直调",
+    "pick_in": [],
+    "homepage": "xiaohongshu.com",
+    "params_schema": {
+      "noteId": {
+        "type": "string",
+        "required": true,
+        "description": "笔记 id"
+      },
+      "action": {
+        "type": "string",
+        "required": true,
+        "description": "like | unlike | collect | uncollect"
+      }
+    }
+  }
+}

package/resources/packages/xhs/xhs-search.recipe.json

@@ -0,0 +1,138 @@
+{
+  "version": 4,
+  "kind": "browser",
+  "sourceId": "xhs-search",
+  "cookieDomain": "xiaohongshu.com",
+  "entryUrl": "https://www.xiaohongshu.com/search_result?keyword={keyword}",
+  "entryWait": "load",
+  "loginCheck": {
+    "loggedIn": ".main-container .user",
+    "wall": ".login-modal.reds-modal-open"
+  },
+  "_why_one_shot": "搜索没有常驻的必要（用户拍板 2026-08-24）:搜完 tab 留着只是占用户浏览器。one-shot = 跑完 release 即关。代价看 _why_ledger——账本随标签走,关了就丢,xhs-detail 落到它自己的 fallbackUrl(直达笔记页,xsec_token 随搜索条目带着),慢一点但功能不缺。",
+  "session": {
+    "facility": "xhs",
+    "lifecycle": "one-shot",
+    "visibility": "unattended"
+  },
+  "_why_unattended": "后台档（unattended）：**不抢屏**。用户在 Stream 里点一下，屏幕就该留在 Stream —— 浏览器蹦到面前再缩回去，比它省下的那点时间烦得多。\n\n「前台」和「能不能跑」本来就不是一回事。可信输入不是靠占前台换来的，是靠 `Emulation.setFocusEmulationEnabled`（在 `browser-ext.ts` 的 launch 一处开启，那里有对照数字）——**它给的是「页面被当成有焦点」，不是帧**，别把两件事说成一件。开了之后，隐藏标签一次可信点击 **162–185ms**，比它当活动标签时的 204–257ms 还快；不开则是 **39.8–41.6s**。\n\n本条另有一层：它是用户按下搜索才跑的，跑完结果要回到 Stream 里看——全程没有任何一刻需要用户盯着浏览器。",
+  "_why_ledger": "搜索结果这一批就是 xhs 的账本：搜出来的顺序 = 页面上卡片的铺排顺序,idField 与 xhs-detail locate 的 identityParam(noteId) 同字段。**one-shot 之下账本随标签一起关**——所以 detail 的常态就是它自己的 fallbackUrl(直达笔记页);这份 ledger 声明保留,是给「同一次运行内」的 step 用坐标系,不再承诺跨运行存活。",
+  "ledger": {
+    "idField": "noteId"
+  },
+  "steps": [
+    {
+      "kind": "scroll",
+      "dwell_s": [
+        0.7,
+        1
+      ],
+      "maxTimes": 20,
+      "noProgressStop": 3
+    }
+  ],
+  "observers": [
+    {
+      "_why": "搜索结果走站点自己的 XHR /api/sns/web/v1/search/notes(真实抓包见 src/replay/fixtures/xhs-feed.ts)——像 homefeed 一样拦接口读,不再 type/submit + 滚 40 屏抠 DOM。runner 因为存在 network observer 会在 observer 挂好之后强制重新 goto entryUrl(recipe-runner capturesLoad),所以带 keyword 的首屏那次 search/notes 请求也被这个 observer 看到。响应是 snake_case,与 homefeed network 分支同 note_card 形状,沿用其已验证映射。搜索 token 配 pc_search 源。",
+      "kind": "network",
+      "urlPattern": "*/api/sns/web/v2/search/notes*",
+      "windowMs": 300000,
+      "maxBodyBytes": 8000000,
+      "input": {
+        "itemsAt": "data.items",
+        "dedupeBy": "id",
+        "targetCount": 400,
+        "mapping": {
+          "noteId": "id",
+          "guid": "id",
+          "title": "note_card.display_title",
+          "author": "note_card.user.nick_name",
+          "author_avatar": "note_card.user.avatar",
+          "likes": "note_card.interact_info.liked_count",
+          "cover": "note_card.cover.url_default",
+          "note_type": "note_card.type",
+          "xsec_token": "xsec_token",
+          "link": "https://www.xiaohongshu.com/explore/{id}?xsec_token={xsec_token}&xsec_source=pc_search"
+        },
+        "assert": [
+          {
+            "path": "data.items",
+            "desc": "xhs search/notes items"
+          }
+        ]
+      }
+    }
+  ],
+  "output": {
+    "itemsAt": "items",
+    "dedupeBy": "guid",
+    "_why_targetCount": "**这个数才是停止条件**，不是上面 observer 的 400（那只是累积上限）。实测：60 时滚 2-3 次、9.3s 出 63 条，scroll 阶段 7025ms 里绝大部分是 dwell。降到 30 少滚一轮，是省时间最便宜的一刀——比砍 dwell 零风险（dwell 是拟人化的承重件）。",
+    "targetCount": 30,
+    "mapping": {
+      "noteId": "noteId",
+      "guid": "guid",
+      "title": "title",
+      "author": "author",
+      "author_avatar": "author_avatar",
+      "likes": "likes",
+      "cover": "cover",
+      "note_type": "note_type",
+      "xsec_token": "xsec_token",
+      "link": "link"
+    }
+  },
+  "policy": {
+    "minActionIntervalMs": 900,
+    "maxTaskMs": 300000
+  },
+  "meta": {
+    "_why_uses": "同 xhs-home：搜索结果里的每一条，点开取正文/图集/评论走的是共用的 xhs-detail（src/content/enrich/index.ts）。detail 漂了，本源采集照常成功、每一条却都点不开——不申报就没有任何一处会把它算进受影响的源。",
+    "uses": [
+      "xhs-detail"
+    ],
+    "auth": {
+      "type": "session",
+      "facility": "xhs",
+      "login": "qr",
+      "loginUrl": "https://www.xiaohongshu.com/explore",
+      "qrSelector": ".login-container img.qrcode-img, .qrcode img",
+      "cookieDomain": "xiaohongshu.com",
+      "sessionCookies": [
+        "web_session"
+      ]
+    },
+    "normalizer": "xhs",
+    "type": "post",
+    "description": "小红书 — 关键词搜索（登录态浏览器采集，模拟人工输入+滚动）",
+    "topics": [
+      "xhs",
+      "xiaohongshu",
+      "social"
+    ],
+    "categories": [
+      "social-media"
+    ],
+    "facility": {
+      "key": "xhs",
+      "label": "小红书"
+    },
+    "capabilities": [
+      "search"
+    ],
+    "provides": [
+      "search-content"
+    ],
+    "key_param": "keyword",
+    "priority": 80,
+    "discoverable": true,
+    "cadence_hint_seconds": 1800,
+    "homepage": "xiaohongshu.com",
+    "params_schema": {
+      "keyword": {
+        "type": "string",
+        "required": true,
+        "description": "搜索关键词"
+      }
+    }
+  }
+}

package/resources/packages/xueqiu/README.md

@@ -0,0 +1,9 @@
+
+## 说明（迁自 manifests.yaml 注释）
+
+雪球 用户动态 (user_timeline) — replay source（跑在用户自己的 Chrome 上）。
+
+xueqiu-detail（单条状态详情，enrich）——雪球 user_timeline 把被转发/被回复原帖的 description
+服务端截断（"..."：实测 statuses/show.json 与详情页裸 HTML 都被 WAF 拦成挑战页，哪怕带着有效
+登录 cookie 裸 fetch 也过不去——只有真实浏览器跑一遍它的混淆 JS 才能过，故 kind:browser，不是
+kind:http）。on-open 懒加载，不进推荐/时间线，故 discoverable:false。

package/resources/packages/xueqiu/package.json

@@ -0,0 +1,16 @@
+{
+  "name": "@streamapp/xueqiu",
+  "version": "1.0.0",
+  "author": "stream",
+  "keywords": [
+    "stream-recipe"
+  ],
+  "stream": {
+    "type": "recipe",
+    "name": "雪球",
+    "tagline": "某个用户的动态时间线",
+    "facility": "xueqiu",
+    "schemaVersion": 1,
+    "cookieDomain": "xueqiu.com"
+  }
+}

package/resources/packages/xueqiu/xueqiu-detail.recipe.json

@@ -0,0 +1,92 @@
+{
+  "version": 2,
+  "kind": "browser",
+  "sourceId": "xueqiu-detail",
+  "_why_browser": "statuses/show.json 和状态详情页的裸 HTML 都被雪球的 Aliyun WAF 拦成挑战页——即便带着 broker 发的有效登录 cookie 也过不去（实测：user_timeline.json 同一份 cookie 裸 fetch 能过，这两个不能）。WAF 要求真的跑一遍它的混淆 JS，只有真实浏览器能过，所以这条只能走 kind:browser，在用户自己的 Chrome 里读渲染完的 DOM。",
+  "entryUrl": "{permalink}",
+  "entryWait": "domcontentloaded",
+  "loginCheck": {
+    "loggedIn": ".avatar",
+    "_why_wall": "雪球把登录弹窗的 DOM 壳子(.modal__login)常驻页面、inline style=\"display: none\" 隐藏,不是打开时才插入——exists() 只查 querySelector 存在性不看可见性,裸类名一律假阳性(实测已登录页面上照样命中 4 个)。:not([style*='display: none']) 排除隐藏态那份壳子,只在它真被打开(inline style 改掉 none)时才算 WALLED。",
+    "wall": ".modal__login:not([style*='display: none'])"
+  },
+  "session": {
+    "facility": "xueqiu",
+    "lifecycle": "one-shot",
+    "visibility": "unattended"
+  },
+  "steps": [],
+  "observers": [
+    {
+      "kind": "dom",
+      "itemSelector": "#app",
+      "trigger": "entry",
+      "fields": {
+        "id": {
+          "selector": "a.time",
+          "attr": "href",
+          "extract": "(\\d+)$"
+        },
+        "text": {
+          "selector": ".article__bd__detail"
+        }
+      }
+    }
+  ],
+  "output": {
+    "itemsAt": "items",
+    "dedupeBy": "id",
+    "targetCount": 1,
+    "mapping": {
+      "id": "id",
+      "text": "text"
+    },
+    "assert": [
+      {
+        "path": "items.0.text",
+        "desc": "xueqiu status detail page rendered its body text"
+      }
+    ]
+  },
+  "policy": {
+    "maxTaskMs": 20000
+  },
+  "meta": {
+    "type": "post",
+    "title": "状态详情（enrich）",
+    "description": "雪球单条状态详情 · 补全被截断的原帖正文",
+    "topics": [
+      "xueqiu",
+      "finance"
+    ],
+    "categories": [
+      "finance"
+    ],
+    "facility": {
+      "key": "xueqiu",
+      "label": "雪球"
+    },
+    "capabilities": [
+      "anchor"
+    ],
+    "priority": 80,
+    "discoverable": false,
+    "_why_pick_in": "两个选择面都不出现——打开一条状态时由 enrich 直调",
+    "pick_in": [],
+    "cadence_hint_seconds": 1800,
+    "auth": {
+      "type": "session",
+      "facility": "xueqiu",
+      "login": "cookie",
+      "cookieDomain": "xueqiu.com"
+    },
+    "homepage": "xueqiu.com",
+    "params_schema": {
+      "permalink": {
+        "type": "string",
+        "required": true,
+        "description": "状态详情页完整 URL（quoted.permalink，https://xueqiu.com/<uid>/<statusId>）"
+      }
+    }
+  }
+}

package/resources/packages/xueqiu/xueqiu-user.recipe.json

@@ -0,0 +1,75 @@
+{
+  "version": 2,
+  "kind": "fetch",
+  "sourceId": "xueqiu-user",
+  "cookieDomain": "xueqiu.com",
+  "entryUrl": "https://xueqiu.com/u/{id}",
+  "entryWait": "load",
+  "_history_transport": "考古结论（2026-07-28）：42e1c9fb 当初把它 opt-out 回 cloak，**不是技术原因**——那天用户正在把 xhs 迁 cloak，原话是「行，把 xueqiu 那个也改了，我一起测，雪球还是 cdp，改 cloak」，纯粹为了一次测两条 cloak 路径。同一会话里唯一的实际抱怨（「cdp 一直新开页面」）是当年采集标签落在用户当前窗口的毛病，background 档出现后不成立。cloak 整体退役（42f707d0）后 transport 字段已不存在——只有一个浏览器：用户自己的 Chrome。留这段是防止将来有人再想给它「换个浏览器」。",
+  "request": {
+    "url": "https://xueqiu.com/v4/statuses/user_timeline.json?user_id={id}&page={page}",
+    "method": "GET"
+  },
+  "pagination": {
+    "mode": "increment",
+    "param": "page",
+    "start": 1,
+    "step": 1,
+    "itemsAt": "statuses",
+    "maxPages": 2
+  },
+  "assert": [
+    {
+      "path": "statuses",
+      "desc": "user_timeline returned a statuses[] array"
+    }
+  ],
+  "mapping": {
+    "guid": "id",
+    "title": "title",
+    "description": "description",
+    "link": "target",
+    "author": "user.screen_name",
+    "pubDate": "created_at",
+    "quoteText": "retweeted_status.description",
+    "quoteAuthor": "retweeted_status.user.screen_name",
+    "quotePermalink": "retweeted_status.target"
+  },
+  "meta": {
+    "normalizer": "xueqiu",
+    "type": "post",
+    "description": "雪球 — 用户动态",
+    "topics": [
+      "xueqiu",
+      "finance"
+    ],
+    "categories": [
+      "finance"
+    ],
+    "facility": {
+      "key": "xueqiu",
+      "label": "雪球"
+    },
+    "capabilities": [
+      "timeline"
+    ],
+    "key_param": "id",
+    "priority": 90,
+    "discoverable": true,
+    "cadence_hint_seconds": 1800,
+    "auth": {
+      "type": "none"
+    },
+    "homepage": "xueqiu.com",
+    "params_schema": {
+      "id": {
+        "type": "string",
+        "required": true,
+        "description": "用户 id（雪球用户主页 URL xueqiu.com/u/<id> 中的数字）"
+      }
+    },
+    "radar": [
+      "xueqiu.com/u/:id"
+    ]
+  }
+}

package/resources/packages/zhipu/package.json

@@ -0,0 +1,16 @@
+{
+  "name": "@streamapp/zhipu",
+  "version": "1.0.0",
+  "author": "stream",
+  "keywords": [
+    "stream-recipe"
+  ],
+  "stream": {
+    "type": "recipe",
+    "name": "智谱 BigModel",
+    "tagline": "在 bigmodel.cn 自助建 API key",
+    "facility": "zhipu",
+    "schemaVersion": 1,
+    "cookieDomain": "bigmodel.cn"
+  }
+}

package/resources/packages/zhipu/zhipu-create-key.recipe.json

@@ -0,0 +1,74 @@
+{
+  "version": 1,
+  "kind": "browser",
+  "sourceId": "zhipu-create-key",
+  "cookieDomain": "bigmodel.cn",
+  "entryUrl": "https://bigmodel.cn/apikey/platform",
+  "entryWait": "load",
+  "loginCheck": {
+    "loggedIn": ".api-keys .header-right button",
+    "wall": "a[href*='/login']"
+  },
+  "session": {
+    "facility": "zhipu",
+    "lifecycle": "one-shot",
+    "visibility": "interactive"
+  },
+  "_selectors_verified": "2026-07-30 活体重定于 bigmodel.cn/apikey/platform（Element-UI，全站无 data-testid，只能靠语义祖先收敛）。这一页有两处「第一个命中就是错的」：(1) button.el-button--primary 命中 2 个，第一个是页面预渲染、不可见的「确 定」——所以开弹窗必须走 .api-keys .header-right 这个祖先；(2) 弹窗里 .el-message-box .el-button--default 命中 2 个，第一个是「取消」——确定键靠 --primary 区分。别用 data-v-* 属性做选择器：那是 Vue scoped-style 的构建哈希，站方重新发布就变。",
+  "_why_last_child": "新建的 key **追加在表尾**（列表按创建时间升序，实测两行：默认项目 2026-06-18 在前，新建的在后）。所以复制图标定位在 tr:last-child——不是第一行。",
+  "steps": [
+    {
+      "kind": "click",
+      "selector": ".api-keys .header-right button",
+      "expect": { "selector": ".el-message-box input.el-input__inner", "timeout": 10000 }
+    },
+    { "kind": "type", "selector": ".el-message-box input.el-input__inner", "text": "{name}" },
+    {
+      "_why_countIncreases": "这一步的判据只能是「表格多了一行」。第一版写的是「最后一行有复制图标」——**恒真**：列表里本来就有旧 key，那图标一直都在。于是「确定」根本没建成也照样判过，下一步点到旧那行的复制按钮上，失败最后以两步之外的「抽取命中 0 处」露面。四步全绿、结果全错。",
+      "kind": "click",
+      "selector": ".el-message-box__btns button.el-button--primary",
+      "expect": { "selector": ".el-table__body tr", "countIncreases": true, "errorSurface": ".el-message, .el-notification", "timeout": 15000 }
+    },
+    {
+      "_why": "明文只有这一下能拿到：列表接口返回的是**服务端掩码**（页面上永远是 be11...dE4X），点复制才会打 /api_keys/copy/<id> 单独取一次明文塞进剪贴板。实测点击前后 performance 资源记录只多出这一条请求——所以观察口就钉在它上面。",
+      "kind": "click",
+      "selector": ".el-table__body tr:last-child i.icon-wdapp_copy"
+    }
+  ],
+  "_why_no_observers": "本 recipe 一条 item 都不产，全部产出就是那把 key。凭证的捕获**不用**在这里声明 observer——引擎按 extract.from.network 的 glob 自己挂一份只捕获不累积的。曾经在这里挂过一个，结果它进了 items 管线、抓到的响应被空 output 判成 malformed → drift，drift 又盖住了 extract 的真实结论。",
+  "observers": [],
+  "output": { "itemsAt": "", "dedupeBy": "", "targetCount": 0, "mapping": {} },
+  "allowEmpty": true,
+  "extract": {
+    "field": "apiKey",
+    "pattern": "[0-9a-f]{32}\\.[A-Za-z0-9]{16}",
+    "from": { "network": "*/api_keys/copy/*" },
+    "timeout": 20000
+  },
+  "meta": {
+    "description": "在 bigmodel.cn 自助建一把 API key，并把只经剪贴板露面的明文落进 runtime_config（不产 item）",
+    "discoverable": false,
+    "_why_pick_in": "两个选择面都不出现——配置流程：用户在场自助建 key",
+    "pick_in": [],
+    "capabilities": ["anchor"],
+    "facility": { "key": "zhipu", "label": "智谱 BigModel" },
+    "params_schema": {
+      "name": {
+        "type": "string",
+        "required": true,
+        "description": "key 名。带一段随机后缀（如 stream-auto-7f3a）——建 key 不幂等，重跑会堆出一排看不出区别的同名 key"
+      }
+    },
+    "runtime_config": {
+      "ref": "zhipu",
+      "fields": {
+        "apiKey": {
+          "type": "secret",
+          "label": "智谱 API Key",
+          "description": "总结梯子与 OCR 梯子的智谱成员用它（GLM-4.7-Flash / GLM-4V-Flash 永久免费档）。可以手填，也可以让本 recipe 自己去建一把填进来。",
+          "helpUrl": "https://bigmodel.cn/apikey/platform"
+        }
+      }
+    }
+  }
+}

package/resources/packages/zuna/README.md

@@ -0,0 +1,31 @@
+## 说明
+
+music.znnu.com — 一个第三方网易云解析站。它的 API 对请求签名（HMAC-SHA256）、对响应加密
+（AES-256-GCM），recipe 把这两段作为 PURE compute 片段带着，在零能力的 isolated-vm 堆里跑。
+它**不是平台**，所以不碰红线（碰红线的是 iqiyi）。
+
+## 四份 recipe
+
+四份都是 `kind:'http'` + compute 钩子（沙箱里签名 + 解密），一次请求拿一份结果：
+
+| recipe | 干什么 | 谁在用 |
+|---|---|---|
+| `zuna-search` | 关键词 → 歌曲 | `music-search` 行的并发成员（与 `toubiec-search` 并列） |
+| `zuna-download` | song id → 可播放/可下载地址 | `netease-track` 梯子（radar `music.163.com/song`，排在 toubiec 之后） |
+| `zuna-playlist` | 歌单 id → 整份曲目名单 | radar `music.163.com/playlist` |
+| `zuna-album` | 专辑 id → 整张曲目名单 | radar `music.163.com/album` |
+
+除 `zuna-download` 外，结果 item 的 link 都回到 `music.163.com/song?id=`——每首歌的真实文件
+地址在播放/下载那一刻由 `netease-track` 现解，名单本身不预解析。
+
+## 上游现状：整站 500
+
+2026-08-25 实测：`/api/song`、`/api/search`、`/api/playlist` 一律 `500 服务器内部错误`，每发
+约 15s，**在 music.znnu.com 自己的页面上点「开始解析」拿到的也是同一个 500**。
+
+**别去改我们这一侧。** 逐项核过：前端 bundle 里的 HMAC 密钥就是 recipe 里那把
+（`a09d0f37…`），签名算法、参数集、请求头一字不差，签名是**过的**——过不了才回 401。
+这是上游自己的故障，等它修。同一条梯子上 toubiec 是健康的那一档。
+
+`zuna-album` 是照 `zuna-playlist` 的形状对称写出来的（参数取自它前端 `/api/album` 的调用点），
+**在上游恢复之前没能跑通过一次**——它是这四份里唯一没有活体证据的。

package/resources/packages/zuna/package.json

@@ -0,0 +1,15 @@
+{
+  "name": "@streamapp/zuna",
+  "version": "1.0.0",
+  "author": "stream",
+  "keywords": [
+    "stream-recipe"
+  ],
+  "stream": {
+    "type": "recipe",
+    "name": "Zuna",
+    "tagline": "聚合搜索网易云歌曲",
+    "facility": "zuna",
+    "schemaVersion": 1
+  }
+}

package/resources/packages/zuna/zuna-album.recipe.json

@@ -0,0 +1,46 @@
+{
+  "version": 1,
+  "kind": "http",
+  "sourceId": "zuna-album",
+  "request": { "url": "https://music.znnu.com/api/album", "method": "POST" },
+  "compute": {
+    "capabilities": ["hmacSha256", "aesGcmDecrypt"],
+    "prefetch": [
+      { "as": "keyResp", "request": { "url": "https://music.znnu.com/api/key", "method": "GET", "headers": { "X-Referer": "musicParser" } } },
+      { "as": "ipResp", "request": { "url": "https://music.znnu.com/api/ip", "method": "GET" } }
+    ],
+    "sign": "(() => { const p = { act: 'album', id: input.params.id, rawInput: input.params.id, ip: input.pre.ipResp.ip || '' }; let s = input.now + 'music.znnu.com'; for (const k of Object.keys(p).sort()) s += k + '=' + p[k]; const signature = hmacSha256('a09d0f3700a279584e1515354fbe08a7ee1c617f919543142fa625b82f1b5ad0', s); const enc = (o) => Object.keys(o).map(k => encodeURIComponent(k) + '=' + encodeURIComponent(o[k])).join('&'); return { body: enc(Object.assign({}, p, { signature, timestamp: String(input.now), domain: 'music.znnu.com' })), headers: { 'content-type': 'application/x-www-form-urlencoded', 'X-Referer': 'musicParser', 'X-Key-Token': input.pre.keyResp.data.keyToken } }; })()",
+    "decode": "(() => { const d = input.body && input.body.data; if (!d || d.enc !== 1) return input.body; return JSON.parse(aesGcmDecrypt({ key: input.pre.keyResp.data.key, iv: d.iv, ciphertext: d.ciphertext, tag: d.tag })); })()"
+  },
+  "pagination": { "mode": "increment", "param": "page", "start": 1, "step": 1, "itemsAt": "songs", "maxPages": 1 },
+  "assert": [{ "path": "songs", "desc": "decrypted zuna album has songs[] (one request, full tracklist)" }],
+  "mapping": {
+    "guid": "id",
+    "title": "name",
+    "author": "artists",
+    "link": "https://music.163.com/song?id={id}",
+    "description": "album",
+    "image": "picUrl"
+  },
+  "meta": {
+    "normalizer": "rsshub",
+    "type": "post",
+    "title": "专辑曲目",
+    "description": "Zuna 网易云解析 — 专辑曲目（整张一次取回；每首歌的文件地址在播放/下载时由 netease-track 现解）",
+    "topics": ["zuna", "网易云", "音乐", "专辑", "music", "netease"],
+    "categories": ["music"],
+    "facility": { "key": "zuna", "label": "Zuna" },
+    "capabilities": ["timeline"],
+    "mode": "collection",
+    "key_param": "id",
+    "priority": 90,
+    "discoverable": true,
+    "cadence_hint_seconds": 86400,
+    "auth": { "type": "none" },
+    "homepage": "music.znnu.com",
+    "params_schema": {
+      "id": { "type": "string", "required": true, "description": "网易云专辑 ID（取自 music.163.com/album?id=…）" }
+    },
+    "radar": ["music.163.com/album"]
+  }
+}