@swimmingliu/autovpn 2.0.3 → 2.1.0

package/dist/pipeline/credential-source.js

@@ -1,10 +1,14 @@
 import { createHash } from 'node:crypto';
-import { fetch as upstreamFetch, ProxyAgent } from 'undici';
 import { androidChunkUrls, apkDiscoveryFromBytes, inlineDownloadSpec, candidateApkUrls, cdnConfigUrls, parseCdnConfig, apkSlot } from './apk-discovery.js';
 import { buildUrl, commonParams, flattenRouteGroups, isPlaceholderNode, LOGIN_SALT, pathAndQuery, selectApiDomain, selectForeignRoutes } from './brand-protocol.js';
 import { decryptPayload, extractLinksFromPlaintext, linkDigest, linkFingerprint } from './extract.js';
-import { AccountStore } from '../pool/account-store.js';
-import { brandFromSite, normalizeBrand } from '../pool/brands.js';
+import { mapWithConcurrency, resolveConcurrency } from './concurrency.js';
+import { EgressSession, defaultCurlFetch, resolveEgressPolicy } from './egress.js';
+import { AccountStore, maskAccount } from '../pool/account-store.js';
+import { BRANDS, brandFromSite, brandSite, normalizeBrand } from '../pool/brands.js';
+import { FingerprintStore, resolveFingerprintCacheDir } from './brand-cache.js';
+import { resolveUserRuntimeRoot } from '../runtime/paths.js';
+import { redactText } from '../runtime/redaction.js';
 /**
  * Each brand concatenates `getCommParams()` in its own order with its own
  * literal block. The layout can be overridden from the profile, and is picked
@@ -135,21 +139,83 @@ function numberOrDefault(value, fallback) {
     const parsed = Number(value);
     return Number.isFinite(parsed) ? parsed : fallback;
 }
-function today(now) {
-    const pad = (value) => String(value).padStart(2, '0');
-    return `${now.getFullYear()}-${pad(now.getMonth() + 1)}-${pad(now.getDate())}`;
-}
 export function resolveRoundPolicy(source) {
-    const maxIterations = Math.max(1, Math.trunc(numberOrDefault(source.max_iterations, 1)));
+    const maxIterations = Math.max(1, Math.trunc(numberOrDefault(source.max_iterations, DEFAULT_MAX_ITERATIONS)));
     const configuredMin = Math.max(0, Math.trunc(numberOrDefault(source.min_iterations, 0)));
     return {
         max_iterations: maxIterations,
         // A minimum above the maximum would otherwise make the cap unreachable.
         min_iterations: Math.min(configuredMin, maxIterations),
-        plateau_limit: Math.max(1, Math.trunc(numberOrDefault(source.plateau_limit, 2))),
+        plateau_limit: Math.max(1, Math.trunc(numberOrDefault(source.plateau_limit, DEFAULT_PLATEAU_LIMIT))),
         max_runtime_seconds: Math.max(0, numberOrDefault(source.max_runtime_seconds, 0))
     };
 }
+/**
+ * A round is one cursor step over the fixed area list, not a full sweep, so
+ * the shipped budget is sized in rounds of one area each. 200 rounds × the
+ * default 1 area is roughly the work the old 4 full sweeps performed.
+ */
+export const DEFAULT_MAX_ITERATIONS = 200;
+export const DEFAULT_PLATEAU_LIMIT = 50;
+export const DEFAULT_AREAS_PER_ROUND = 8;
+export const DEFAULT_AREA_CONCURRENCY = 4;
+/**
+ * Consecutive rounds where every candidate host failed before the channel
+ * gives up. `getCommStr` already walks the whole domain list, so one empty
+ * round is a real outage; five in a row is not a transient blip.
+ */
+export const MAX_EMPTY_ROUNDS = 5;
+/**
+ * Consecutive rounds that answered with the placeholder template and nothing
+ * else, after which the channel is treated as downgraded and stopped.
+ *
+ * 黑洞's Android channel answers `1.1.1.1:443` for every area on every account
+ * (verified against the decompiled client's exact parameters, with and without
+ * `kbox`). Left alone it burns the whole round budget and half the run's
+ * concurrency producing nothing, so a channel that has never produced a real
+ * node is stopped explicitly and reported.
+ */
+export const PLACEHOLDER_ONLY_ROUNDS = 8;
+/** How many areas one round takes from the immutable list. */
+export function resolveAreasPerRound(value, areaCount) {
+    const parsed = Math.trunc(Number(value));
+    const requested = Number.isFinite(parsed) && parsed >= 1 ? parsed : DEFAULT_AREAS_PER_ROUND;
+    // Asking for more areas than exist would repeat the same id inside one round.
+    return Math.max(1, Math.min(requested, Math.max(1, areaCount)));
+}
+/**
+ * A cursor over a frozen area list.
+ *
+ * The list and its order are decided once per run; the cursor only moves. That
+ * is what keeps later-listed regions reachable when a run is cut short by the
+ * round cap, the runtime budget or an early stop — the old loop re-asked the
+ * same full list in vendor order every round, so the tail was starved.
+ */
+export class AreaCursor {
+    items;
+    index = 0;
+    constructor(items) {
+        this.items = Object.freeze([...items]);
+    }
+    get length() {
+        return this.items.length;
+    }
+    get position() {
+        return this.index;
+    }
+    /** Take the next `count` entries, wrapping. Never mutates the list. */
+    take(count) {
+        if (this.items.length === 0)
+            return [];
+        const width = Math.max(1, Math.min(Math.trunc(count) || 1, this.items.length));
+        const out = [];
+        for (let step = 0; step < width; step += 1) {
+            out.push(this.items[this.index]);
+            this.index = (this.index + 1) % this.items.length;
+        }
+        return out;
+    }
+}
 /** The floor always runs; past it, the runtime budget can stop the loop. */
 export function shouldStartRound(round, policy, elapsedSeconds) {
     if (round > policy.max_iterations) {
@@ -168,35 +234,32 @@ export function shouldStopOnPlateau(round, plateau, policy) {
 export function loginSignature(account, password) {
     return createHash('md5').update(`${account}${password}${LOGIN_SALT}`, 'utf8').digest('hex');
 }
-function isEnabled(value) {
-    return ['1', 'true', 'yes', 'on'].includes(String(value ?? '').trim().toLowerCase());
-}
-function upstreamProxyUrl(env) {
-    if (!env || !isEnabled(env.VPN_AUTOMATION_USE_UPSTREAM_PROXY)) {
-        return '';
-    }
-    const value = String(env.VPN_AUTOMATION_UPSTREAM_PROXY ?? 'http://127.0.0.1:7897').trim();
-    return ['', 'off', 'none', 'false', '0'].includes(value.toLowerCase()) ? '' : value;
-}
 async function fetchText(fetchImpl, url, timeoutMs, egress) {
+    // The session is the single egress authority: transport choice, block
+    // detection, body cancellation and the curl TLS fallback all live there.
+    if (egress?.session) {
+        const result = await egress.session.text(url, timeoutMs);
+        return { text: result.text, url: result.url, ok: result.ok };
+    }
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), timeoutMs);
+    let response = null;
     try {
-        const response = await fetchImpl(url, { signal: controller.signal, redirect: 'follow' });
-        if (!response.ok) {
+        response = await fetchImpl(url, { signal: controller.signal, redirect: 'follow' });
+        if (response.ok === false) {
+            // An unread body pins its keep-alive socket until GC.
+            await cancelBody(response);
             return { text: '', url, ok: false };
         }
         return { text: await response.text(), url, ok: true };
     }
     catch {
-        // Same fallback the url mode applies: curl handles a proxy or a
-        // self-signed/intercepted TLS chain that Node's fetch rejects.
-        const proxyUrl = upstreamProxyUrl(egress?.env);
+        await cancelBody(response);
         if (!egress?.curlFetch) {
             return { text: '', url, ok: false };
         }
         try {
-            const text = await egress.curlFetch(url, proxyUrl);
+            const text = await egress.curlFetch(url, '');
             return text.trim() ? { text, url, ok: true } : { text: '', url, ok: false };
         }
         catch {
@@ -207,6 +270,14 @@ async function fetchText(fetchImpl, url, timeoutMs, egress) {
         clearTimeout(timer);
     }
 }
+async function cancelBody(response) {
+    try {
+        await response?.body?.cancel?.();
+    }
+    catch {
+        // Already consumed or already closed.
+    }
+}
 /** Control-plane responses are AES-CBC with key == IV. */
 export function decodeControlPlane(cipherText, key) {
     if (!cipherText.trim() || !key) {
@@ -429,15 +500,22 @@ async function defaultLoadApk(source, fetchImpl, timeoutMs, now, log, brandName
             return null;
         }
     }
+    // The binary download must use the same transport as the text calls, or a
+    // configured proxy serves the homepage but the APK bytes go direct.
+    const binaryFetch = egress?.session
+        ? egress.session.rawFetch()
+        : fetchImpl;
     if (source.apk_url) {
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), Math.max(timeoutMs, 120_000));
         try {
-            const response = await fetchImpl(source.apk_url, { signal: controller.signal });
+            const response = await binaryFetch(source.apk_url, { signal: controller.signal });
             if (!response.ok || typeof response.arrayBuffer !== 'function') {
+                await cancelBody(response);
                 return null;
             }
             if (declaredSizeTooLarge(response)) {
+                await cancelBody(response);
                 log(`[extract] apk at ${source.apk_url} exceeds ${MAX_APK_BYTES} bytes; refusing`);
                 return null;
             }
@@ -563,11 +641,13 @@ async function defaultLoadApk(source, fetchImpl, timeoutMs, now, log, brandName
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), Math.max(timeoutMs, 120_000));
         try {
-            const response = await fetchImpl(candidate, { signal: controller.signal });
+            const response = await binaryFetch(candidate, { signal: controller.signal });
             if (!response.ok || typeof response.arrayBuffer !== 'function') {
+                await cancelBody(response);
                 continue;
             }
             if (declaredSizeTooLarge(response)) {
+                await cancelBody(response);
                 continue;
             }
             const bytes = Buffer.from(await response.arrayBuffer());
@@ -621,11 +701,23 @@ export function isCredentialLoginRejection(message) {
         return false;
     return /密码错误|密碼錯誤|密码不正确|密碼不正確|账号不存在|帳號不存在|账户不存在|账户或密码|账号或密码|账号已被|帳號已被|密码已|被封禁|已被禁用|登录失败|登錄失敗|does\s*not\s*exist|not\s*(found|exist)|invalid\s*(password|account|credential|user)|incorrect\s*password|wrong\s*password|unauthorized/i.test(text);
 }
+/**
+ * Local calendar day, matching the account store's `isoDay`.
+ *
+ * `toISOString().slice(0, 10)` is the UTC day: under Asia/Shanghai a vendor
+ * date of `2027-01-01 00:00:00` became `2026-12-31`, and the pool's local-day
+ * comparison then retired the account a day early. One formatter for both the
+ * "today" comparisons and the dates learned from the vendor.
+ */
+export function localDay(date) {
+    const pad = (value) => String(value).padStart(2, '0');
+    return `${date.getFullYear()}-${pad(date.getMonth() + 1)}-${pad(date.getDate())}`;
+}
 export function membershipDate(value) {
     if (typeof value === 'number' && Number.isFinite(value) && value > 0) {
         const ms = value > 10_000_000_000 ? value : value * 1000;
         const date = new Date(ms);
-        return Number.isNaN(date.getTime()) ? '' : date.toISOString().slice(0, 10);
+        return Number.isNaN(date.getTime()) ? '' : localDay(date);
     }
     const text = String(value ?? '').trim();
     if (!text)
@@ -636,7 +728,31 @@ export function membershipDate(value) {
         return /^\d{10,13}$/.test(text) ? membershipDate(Number(text)) : '';
     }
     const parsed = new Date(text);
-    return Number.isNaN(parsed.getTime()) ? '' : parsed.toISOString().slice(0, 10);
+    return Number.isNaN(parsed.getTime()) ? '' : localDay(parsed);
+}
+/** Pick the first field that actually parses to a date; `0` is not a date. */
+function firstMembershipDate(...values) {
+    for (const value of values) {
+        const parsed = membershipDate(value);
+        if (parsed)
+            return parsed;
+    }
+    return '';
+}
+/**
+ * A rejection that means the membership lapsed, not that the password is wrong.
+ *
+ * Checked before `isCredentialLoginRejection`: filing an expired membership as
+ * "invalid" hides the one fact the operator needs, and the row would otherwise
+ * stay active forever because neither classifier matched the wording.
+ */
+export function isMembershipExpiredMessage(message) {
+    const text = String(message ?? '');
+    if (!text.trim())
+        return false;
+    if (TRANSIENT_LOGIN_PATTERN.test(text))
+        return false;
+    return /会员.*?(过期|到期|已到期)|會員.*?(過期|到期)|账号.*?(到期|过期)|帳號.*?(到期|過期)|账户.*?(到期|过期)|vip.*?(expired|expired)|membership.*?(expired|lapsed)|subscription.*?expired|已过期|已過期|expired/i.test(text);
 }
 function credentialRejectionMessage(payload) {
     return String(payload.msg ?? payload.message ?? '');
@@ -647,32 +763,45 @@ function credentialRejectionMessage(payload) {
  * the pipeline already consumes.
  */
 export async function fetchCredentialSourceLinks(input, options = {}) {
-    const proxyUrl = upstreamProxyUrl(options.env);
-    if (!proxyUrl) {
-        return fetchCredentialSourceLinksWithTransport(input, options);
+    const policy = resolveEgressPolicy(options.env ?? {});
+    if (policy.proxyUrl) {
+        let proxy;
+        try {
+            proxy = new URL(policy.proxyUrl);
+        }
+        catch {
+            throw new Error('The configured upstream proxy URL is invalid');
+        }
+        if (proxy.protocol !== 'http:' && proxy.protocol !== 'https:') {
+            throw new Error('Credential sources require an HTTP or HTTPS upstream proxy');
+        }
     }
-    let proxy;
-    try {
-        proxy = new URL(proxyUrl);
+    // One session per source: it owns the proxy dispatcher, decides the
+    // transport, and switches direct -> proxy when the vendor starts blocking.
+    // Both platforms share it, so the choice is made once and closed once.
+    const session = options.egressSession ?? await EgressSession.open(options.env, {
+        fetchImpl: options.fetchImpl,
+        curlFetch: options.curlFetch ?? ((url, proxyUrl) => defaultCurlFetch(url, proxyUrl)),
+        onSwitch: (switched) => event(options, 'log', {
+            message: `[extract][${input.source_name}] egress ${switched.from} -> ${switched.to} (${switched.reason})`
+        })
+    });
+    const ownsSession = !options.egressSession;
+    if (session.policy.mode === 'proxy' && session.transport === 'direct' && !session.proxyReachable) {
+        event(options, 'log', {
+            message: `[extract][${input.source_name}] upstream proxy ${session.policy.proxyUrl} is not reachable; crawling direct`
+        });
     }
-    catch {
-        throw new Error('The configured upstream proxy URL is invalid');
-    }
-    if (proxy.protocol !== 'http:' && proxy.protocol !== 'https:') {
-        throw new Error('Credential sources require an HTTP or HTTPS upstream proxy');
-    }
-    // The proxy previously reached only a text fallback: native site and APK
-    // requests still went direct. Keep one source-scoped dispatcher for both
-    // response types, without changing the per-node measurement transports.
-    const dispatcher = new ProxyAgent({ uri: proxy.href, proxyTunnel: false });
-    const fetchImpl = (url, init) => options.fetchImpl
-        ? options.fetchImpl(url, { ...init, dispatcher })
-        : upstreamFetch(url, { ...init, dispatcher });
     try {
-        return await fetchCredentialSourceLinksWithTransport(input, { ...options, fetchImpl });
+        return await fetchCredentialSourceLinksWithTransport(input, {
+            ...options,
+            egressSession: session,
+            curlFetch: options.curlFetch ?? ((url, proxyUrl) => defaultCurlFetch(url, proxyUrl))
+        });
     }
     finally {
-        await dispatcher.destroy();
+        if (ownsSession)
+            await session.close();
     }
 }
 async function fetchCredentialSourceLinksWithTransport(input, options) {
@@ -771,13 +900,24 @@ async function fetchCredentialSourceLinksWithTransport(input, options) {
         for (let attempt = 1; attempt <= attempts; attempt += 1) {
             liveLinkIds.clear();
             liveFingerprints.clear();
+            // Both channels judge "a genuinely new node" against this one union, so
+            // a node iOS already produced cannot reset Android's early-stop counter.
+            const sharedFingerprints = new Set();
             results = await Promise.all(platforms.map((platform) => {
                 const scoped = {
                     ...options,
                     memo,
+                    sharedFingerprints,
                     eventCallback: (type, payload) => {
                         if (type === 'extract_source_started') {
-                            event(options, 'extract_platform_started', { ...payload, platform });
+                            // The per-platform start used to hardcode 0; the budget is the
+                            // same full policy on each channel, never a split of it.
+                            event(options, 'extract_platform_started', {
+                                ...payload,
+                                platform,
+                                requested_iterations: policy.max_iterations,
+                                min_iterations: policy.min_iterations
+                            });
                             return;
                         }
                         if (type === 'extract_source_completed') {
@@ -797,13 +937,21 @@ async function fetchCredentialSourceLinksWithTransport(input, options) {
                                 liveLinkIds.add(id);
                             event(options, 'extract_iteration', {
                                 source_name: input.source_name,
+                                // Two channels emit the same round number; without the tag the
+                                // log shows two identical `#N` lines and reads like one shared
+                                // counter.
+                                platform,
                                 iteration: Number(payload.iteration ?? 0),
                                 requested_iterations: policy.max_iterations,
                                 new_items: Number(payload.new_items ?? 0),
+                                new_meaningful_items: Number(payload.new_meaningful_items ?? 0),
                                 extracted_links: Number(payload.extracted_links ?? 0),
                                 total_links: liveLinkIds.size,
                                 deduped_links: liveFingerprints.size,
-                                new_item_fingerprints: fingerprints
+                                new_item_fingerprints: fingerprints,
+                                new_item_link_ids: Array.isArray(payload.new_item_link_ids)
+                                    ? payload.new_item_link_ids.map((value) => String(value)).filter(Boolean)
+                                    : []
                             });
                             return;
                         }
@@ -849,19 +997,33 @@ async function fetchCredentialSourceLinksWithTransport(input, options) {
                     const expires = results.map((result) => result.diagnostics.membership_expires_at ?? '').find(Boolean);
                     if (expires)
                         store.setExpiry(leased.brand, leased.account, expires);
+                    // A login can succeed while the membership it reports has already
+                    // lapsed. File that as expired, not as "no paid membership": the
+                    // reason is different and the operator acts on it differently.
+                    const lapsed = Boolean(expires) && (expires ?? '') < localDay((options.now ?? (() => new Date()))());
                     const level = results.map((result) => result.diagnostics.membership_level).find((value) => value !== undefined);
                     const linked = results.some((result) => result.links.length > 0);
-                    // A free-tier account (level 0/1) only ever produces placeholders.
-                    // Retire it, but only when it actually produced nothing: a paid
-                    // account misreported as level 1 must not lose its row.
-                    if (level !== undefined && level < 2 && !linked)
+                    if (lapsed) {
+                        store.markExpired(leased.id, 'membership expired');
+                    }
+                    else if (level !== undefined && level < 2 && !linked) {
+                        // A free-tier account (level 0/1) only ever produces placeholders.
+                        // Retire it, but only when it actually produced nothing: a paid
+                        // account misreported as level 1 must not lose its row.
                         store.markInvalid(leased.id, 'no paid membership');
+                    }
                 }
                 break;
             }
+            const membershipExpired = results.length > 0
+                && results.every((result) => result.diagnostics.login_rejected)
+                && results.some((result) => result.diagnostics.membership_expired);
             const credentialRejected = results.length > 0 && results.every((result) => result.diagnostics.credential_rejected);
-            if (store && leased && credentialRejected) {
-                store.markInvalid(leased.id, 'login rejected');
+            if (store && leased && (membershipExpired || credentialRejected)) {
+                if (membershipExpired)
+                    store.markExpired(leased.id, 'membership expired');
+                else
+                    store.markInvalid(leased.id, 'login rejected');
                 if (attempt < attempts && brand) {
                     leased = store.lease(brand);
                     if (leased) {
@@ -899,13 +1061,38 @@ async function fetchCredentialSourceLinksWithTransport(input, options) {
         diagnostics.version_name = first.version_name;
         diagnostics.seed_domains = first.seed_domains;
         diagnostics.api_domain = first.api_domain;
+        // The session facts are per-account, not per-platform: both channels log
+        // the same pooled credential in. Without this copy the merged result looked
+        // like a run that never logged in, and `accounts refresh-expiry` (which
+        // reads the merged diagnostics) reported every account as failed.
+        diagnostics.login_ok = results.some((result) => result.diagnostics.login_ok);
+        diagnostics.login_rejected = results.length > 0 && results.every((result) => result.diagnostics.login_rejected);
+        diagnostics.credential_rejected = results.length > 0 && results.every((result) => result.diagnostics.credential_rejected);
+        diagnostics.membership_expired = results.some((result) => result.diagnostics.membership_expired);
+        diagnostics.membership_expires_at = results
+            .map((result) => result.diagnostics.membership_expires_at ?? '')
+            .find(Boolean);
+        diagnostics.membership_level = results
+            .map((result) => result.diagnostics.membership_level)
+            .find((value) => value !== undefined);
     }
     diagnostics.route_count = Math.max(0, ...results.map((result) => result.diagnostics.route_count));
     diagnostics.route_tables = Math.max(0, ...results.map((result) => result.diagnostics.route_tables ?? 0));
     diagnostics.node_count = links.length;
     diagnostics.placeholder_count = results.reduce((total, result) => total + result.diagnostics.placeholder_count, 0);
+    // Each platform runs the full budget on its own. `rounds` stays the
+    // per-platform figure (the cap semantics), `rounds_total` is the work done
+    // across channels, and platform_results carries the breakdown.
     diagnostics.rounds = Math.max(0, ...results.map((result) => result.diagnostics.rounds));
+    diagnostics.rounds_total = results.reduce((total, result) => total + result.diagnostics.rounds, 0);
     diagnostics.requests = results.reduce((total, result) => total + result.diagnostics.requests, 0);
+    diagnostics.areas_per_round = results[0]?.diagnostics.areas_per_round;
+    diagnostics.area_concurrency = results[0]?.diagnostics.area_concurrency;
+    if (options.egressSession) {
+        diagnostics.request_attempts = options.egressSession.attempts;
+        diagnostics.egress_transport = options.egressSession.transport;
+        diagnostics.egress_switches = [...options.egressSession.switches];
+    }
     diagnostics.platform_results = results.map((result) => ({
         platform: result.diagnostics.platform,
         links: result.links.length,
@@ -913,8 +1100,8 @@ async function fetchCredentialSourceLinksWithTransport(input, options) {
         requests: result.diagnostics.requests,
         errors: result.diagnostics.errors
     }));
-    const successful = Math.max(0, ...results.map((result) => result.successful_iterations));
-    const failed = results.length === 0 ? 1 : Math.max(0, ...results.map((result) => result.failed_iterations));
+    const successful = results.reduce((total, result) => total + result.successful_iterations, 0);
+    const failed = results.length === 0 ? 1 : results.reduce((total, result) => total + result.failed_iterations, 0);
     if (callbackFailure) {
         // Surfaced rather than logged: the orchestrator treats a thrown extract as
         // a failed source, which is the truth — its downstream already died.
@@ -937,8 +1124,28 @@ async function fetchCredentialSourceLinksWithTransport(input, options) {
         diagnostics
     };
 }
-/** One client channel. The public wrapper runs both and merges the results. */
+/**
+ * One client channel. The public wrapper runs both and merges the results.
+ *
+ * The session is opened here so every early return path still closes it; the
+ * inner worker assumes a live session and never owns one.
+ */
 export async function fetchCredentialPlatformLinks(input, options = {}) {
+    if (options.egressSession) {
+        return runCredentialPlatform(input, options);
+    }
+    const session = await EgressSession.open(options.env, {
+        fetchImpl: (options.fetchImpl ?? globalThis.fetch?.bind(globalThis)),
+        curlFetch: options.curlFetch ?? ((url, proxyUrl) => defaultCurlFetch(url, proxyUrl))
+    });
+    try {
+        return await runCredentialPlatform(input, { ...options, egressSession: session });
+    }
+    finally {
+        await session.close();
+    }
+}
+async function runCredentialPlatform(input, options) {
     const source = input.source;
     const fetchImpl = options.fetchImpl ?? globalThis.fetch?.bind(globalThis);
     const now = (options.now ?? (() => new Date()))();
@@ -946,7 +1153,7 @@ export async function fetchCredentialPlatformLinks(input, options = {}) {
     const platform = source.platform === 'ios' ? 'ios' : 'android';
     const device = {
         device_id: source.device_id ?? DEFAULT_DEVICE_ID,
-        install_date: source.install_date ?? today(now)
+        install_date: source.install_date ?? localDay(now)
     };
     const errors = [];
     const log = (message) => event(options, 'log', { message });
@@ -983,11 +1190,13 @@ export async function fetchCredentialPlatformLinks(input, options = {}) {
         errors.push('account and password are required');
         return empty;
     }
+    const startPolicy = resolveRoundPolicy(source);
     event(options, 'extract_source_started', {
         source_name: input.source_name,
-        requested_iterations: 0,
-        min_iterations: 0,
-        resume_from_iteration: 1
+        requested_iterations: startPolicy.max_iterations,
+        min_iterations: startPolicy.min_iterations,
+        resume_from_iteration: 1,
+        platform
     });
     // 1) Brand fingerprint: package, version, certificate and seed domains.
     //
@@ -1005,7 +1214,11 @@ export async function fetchCredentialPlatformLinks(input, options = {}) {
     const storedEntry = store?.read(brandKey) ?? null;
     const staleButUsable = Boolean(storedEntry) && !fresh;
     const cached = staleButUsable ? storedEntry : memo.get();
-    const egress = { env: options.env, curlFetch: options.curlFetch };
+    const session = options.egressSession;
+    const egress = {
+        session,
+        curlFetch: options.curlFetch ?? ((url, proxyUrl) => defaultCurlFetch(url, proxyUrl))
+    };
     // Report real extraction work instead of making the UI infer APK/domain
     // activity from text logs. Cache reuse remains distinct from executed work.
     const substage = (name, status) => event(options, 'extract_substage', { source_name: input.source_name, platform, substage: name, status });
@@ -1135,7 +1348,7 @@ export async function fetchCredentialPlatformLinks(input, options = {}) {
             platform,
             timestampMs: ts,
             code: ''
-        }, resolveBrandLayout({ ...source, brand: input.source_name })), keys, timeoutMs);
+        }, resolveBrandLayout({ ...source, brand: input.source_name })), keys, timeoutMs, egress);
         substage('domain_discovery', resolved ? 'success' : 'failed');
         return resolved;
     }
@@ -1154,7 +1367,10 @@ export async function fetchCredentialPlatformLinks(input, options = {}) {
         lastActiveDomain: eversion.domain,
         key: eversion.key,
         fetchImpl,
-        timeoutMs
+        timeoutMs,
+        // Without this the curl/TLS fallback never reached login, apinodelist or
+        // evmess: every control-plane call saw `ctx.egress === undefined`.
+        egress
     };
     const apiDomain = selectApiDomain(discovery.seed_domains, device.device_id);
     diagnostics.api_domain = apiDomain;
@@ -1172,7 +1388,8 @@ export async function fetchCredentialPlatformLinks(input, options = {}) {
         if (Number(payload.code) !== 0) {
             const message = credentialRejectionMessage(payload);
             diagnostics.login_rejected = true;
-            diagnostics.credential_rejected = isCredentialLoginRejection(message);
+            diagnostics.membership_expired = isMembershipExpiredMessage(message);
+            diagnostics.credential_rejected = !diagnostics.membership_expired && isCredentialLoginRejection(message);
             errors.push(`login rejected: code=${String(payload.code)}`);
             // A cached fingerprint whose seeds answer eversion but whose signing
             // cert the vendor rotated keeps failing here on every run. Drop the
@@ -1183,7 +1400,9 @@ export async function fetchCredentialPlatformLinks(input, options = {}) {
             return { ...empty, failed_iterations: 1 };
         }
         token = String(payload.token ?? '');
-        diagnostics.membership_expires_at = membershipDate(payload.endtime ?? payload.expire_time);
+        // `endtime ?? expire_time` does not fall through on 0, so a valid
+        // expire_time was silently dropped and the row never got a date.
+        diagnostics.membership_expires_at = firstMembershipDate(payload.endtime, payload.expire_time);
         diagnostics.membership_level = Number.isFinite(Number(payload.level)) ? Number(payload.level) : undefined;
     }
     catch {
@@ -1223,7 +1442,7 @@ export async function fetchCredentialPlatformLinks(input, options = {}) {
             }
             if (unlimit)
                 ctx.isUnlimited = unlimit === '1';
-            const expires = membershipDate(detail.endtime ?? detail.expire_time ?? info.endtime ?? info.expire_time);
+            const expires = firstMembershipDate(detail.endtime, detail.expire_time, info.endtime, info.expire_time);
             if (expires)
                 diagnostics.membership_expires_at = expires;
         }
@@ -1269,47 +1488,76 @@ export async function fetchCredentialPlatformLinks(input, options = {}) {
         ` disabled=${selection.dropped_disabled} dup=${selection.dropped_duplicate})`);
     // 5) `/api/evmess?area=ID`, repeated.
     //
-    // The server picks a landing host per request, so asking the same `area` again
-    // usually returns a different machine: the route id chooses the region, not
-    // the host. A single pass therefore sees only one host per route, and the
-    // rounds below are what turn a handful of routes into a full node pool.
+    // The server picks a landing host per request, so asking the same `area`
+    // again usually returns a different machine: the route id chooses the
+    // region, not the host.
+    //
+    // The area list is the one built above: every region the node list
+    // advertised, China and free rows removed, duplicates collapsed, vendor
+    // order preserved. It is frozen for the whole run. A cursor walks it and
+    // takes `areas_per_round` entries each round, wrapping at the end — so a run
+    // cut short by the round cap or an early stop still reaches the tail of the
+    // list instead of re-asking the same head forever.
     //
-    // Round control mirrors the URL mode's iteration semantics:
-    //   max_iterations   upper bound on rounds (default 1)
+    // Round control:
+    //   max_iterations   rounds PER PLATFORM. Android and iOS each run the full
+    //                    budget concurrently; it is never split or summed.
     //   min_iterations   rounds that always run before early stopping is allowed
-    //   plateau_limit    consecutive rounds with no new link that stop the run
+    //   plateau_limit    consecutive rounds with no genuinely new node. Novelty
+    //                    is the canonical fingerprint, deduped across platforms.
     const links = [];
     const seen = new Set();
     let placeholders = 0;
     let requests = 0;
     const activeRoutes = routes.filter((route) => route.enabled);
-    // The dashboard's dedupe card counts distinct fingerprints, not raw links: a
-    // link repeated across two platforms has to collapse there or the number
-    // only ever grows.
+    // The dashboard's dedupe card counts distinct fingerprints, not raw links.
     const fingerprints = new Set();
+    // Meaningful novelty is judged against the union both platforms share, so a
+    // node the other channel already produced cannot reset this one's plateau.
+    const novelty = options.sharedFingerprints ?? new Set();
     // Raw totals use the exact-string identity the pipeline dedupes with, so the
     // live number and `extract_source_completed.raw_links` agree.
     const linkIds = new Set();
     const policy = resolveRoundPolicy(source);
     const maxIterations = policy.max_iterations;
-    const minIterations = policy.min_iterations;
-    const plateauLimit = policy.plateau_limit;
+    const areasPerRound = resolveAreasPerRound(source.areas_per_round, activeRoutes.length);
+    const areaConcurrency = resolveConcurrency(source.area_concurrency, DEFAULT_AREA_CONCURRENCY);
+    const cursor = new AreaCursor(activeRoutes);
     const startedAt = Date.now();
     let plateau = 0;
     let rounds = 0;
     let successfulRounds = 0;
     let failedRounds = 0;
+    let emptySweep = 0;
+    let placeholderStreak = 0;
+    diagnostics.route_count = activeRoutes.length;
+    diagnostics.areas_per_round = areasPerRound;
+    diagnostics.area_concurrency = areaConcurrency;
+    log(`[extract] area list frozen: ${activeRoutes.length} areas,` +
+        ` ${areasPerRound}/round, concurrency ${areaConcurrency}, egress ${session.transport}`);
     for (let round = 1; round <= maxIterations; round += 1) {
         if (!shouldStartRound(round, policy, (Date.now() - startedAt) / 1000)) {
             break;
         }
-        let newInRound = 0;
+        const batch = cursor.take(areasPerRound);
+        requests += batch.length;
+        // Fan the round out. `getCommStr` builds its own candidate list before the
+        // first await, so workers share no iteration state; `lastActiveDomain` is
+        // only a routing hint and last-writer-wins is safe.
+        const answers = await mapWithConcurrency(batch, areaConcurrency, async (route) => ({
+            route,
+            plain: await getCommStr(ctx, eversionFields.apiLinks, apiDomain, '/api/evmess', `&area=${route.area}`, discovery.seed_domains)
+        }));
+        // Delivery and early stop are deliberately separate counters. Every new
+        // raw link is still delivered downstream; only a new node identity resets
+        // the plateau, so a relabelled duplicate cannot keep the run alive.
+        let appendedInRound = 0;
+        let meaningfulInRound = 0;
         let answeredInRound = 0;
+        let placeholderInRound = 0;
         const newFingerprints = [];
         const newLinkIds = [];
-        for (const route of activeRoutes) {
-            const plain = await getCommStr(ctx, eversionFields.apiLinks, apiDomain, '/api/evmess', `&area=${route.area}`, discovery.seed_domains);
-            requests += 1;
+        for (const { route, plain } of answers) {
             if (!plain) {
                 continue;
             }
@@ -1327,15 +1575,20 @@ export async function fetchCredentialPlatformLinks(input, options = {}) {
             for (const link of decoded) {
                 if (isPlaceholderLink(link)) {
                     placeholders += 1;
+                    placeholderInRound += 1;
                     continue;
                 }
+                const fingerprint = linkFingerprint(link);
+                if (!novelty.has(fingerprint)) {
+                    novelty.add(fingerprint);
+                    meaningfulInRound += 1;
+                    newFingerprints.push(fingerprint);
+                }
+                fingerprints.add(fingerprint);
                 if (!seen.has(link)) {
                     seen.add(link);
                     links.push(link);
-                    newInRound += 1;
-                    const fingerprint = linkFingerprint(link);
-                    fingerprints.add(fingerprint);
-                    newFingerprints.push(fingerprint);
+                    appendedInRound += 1;
                     const digest = linkDigest(link);
                     linkIds.add(digest);
                     newLinkIds.push(digest);
@@ -1345,31 +1598,64 @@ export async function fetchCredentialPlatformLinks(input, options = {}) {
         rounds = round;
         if (answeredInRound > 0) {
             successfulRounds += 1;
+            emptySweep = 0;
+            plateau = meaningfulInRound === 0 ? plateau + 1 : 0;
+            // A whole round of placeholders and not one real node is a downgraded
+            // channel, not an exhausted pool: it would otherwise spend the entire
+            // budget (and half the run's concurrency) producing nothing.
+            if (placeholderInRound > 0 && appendedInRound === 0 && links.length === 0) {
+                placeholderStreak += 1;
+            }
+            else {
+                placeholderStreak = 0;
+            }
         }
         else {
             failedRounds += 1;
+            emptySweep += 1;
+            // A round where every candidate failed is a network problem, not "the
+            // pool is exhausted", so it must not advance the plateau. Escalate to
+            // the proxy (a banned IP often gets an empty body rather than a 403)
+            // and stop after a short run of them instead of burning the budget.
+            if (session.reportEmptySweep()) {
+                log('[extract] no route answered; switching to the upstream proxy');
+            }
+            if (emptySweep >= MAX_EMPTY_ROUNDS) {
+                errors.push(`no route answered for ${emptySweep} consecutive rounds`);
+                break;
+            }
         }
-        if (newInRound > 0) {
-            await options.linksCallback?.(links.slice(-newInRound));
+        if (appendedInRound > 0) {
+            await options.linksCallback?.(links.slice(-appendedInRound));
         }
         // The dashboard's raw/dedupe cards read these numbers while the run is in
         // flight. Without a per-round event a credential source stays at 0 until
-        // it finishes, which reads as a stalled run: the URL mode already emits
-        // `extract_iteration` for exactly this reason.
+        // it finishes, which reads as a stalled run.
         event(options, 'extract_iteration', {
             source_name: input.source_name,
+            platform,
             iteration: round,
             requested_iterations: maxIterations,
-            new_items: newInRound,
-            extracted_links: newInRound,
+            new_items: appendedInRound,
+            new_meaningful_items: meaningfulInRound,
+            extracted_links: appendedInRound,
             total_links: links.length,
             deduped_links: fingerprints.size,
             new_item_fingerprints: newFingerprints,
             new_item_link_ids: newLinkIds
         });
-        log(`[extract] round ${round}/${maxIterations} +${newInRound} new (total ${links.length})`);
-        plateau = newInRound === 0 ? plateau + 1 : 0;
+        log(`[extract] round ${round}/${maxIterations} area=${batch.map((route) => route.area).join(',')}` +
+            ` +${appendedInRound} new (+${meaningfulInRound} meaningful, total ${links.length},` +
+            ` plateau ${plateau}/${policy.plateau_limit})`);
         if (shouldStopOnPlateau(round, plateau, policy)) {
+            log(`[extract] early stop: ${plateau} consecutive rounds without a meaningful new node`);
+            break;
+        }
+        if (placeholderStreak >= PLACEHOLDER_ONLY_ROUNDS) {
+            errors.push(`channel produced only placeholder nodes for ${placeholderStreak} rounds; stopping it` +
+                ' (this brand does not serve real nodes on this platform)');
+            log(`[extract] ${platform} channel stopped: ${placeholderStreak} rounds of placeholder nodes only.` +
+                ' The other channel still runs; this platform is not serving real nodes for this brand.');
             break;
         }
     }
@@ -1377,6 +1663,8 @@ export async function fetchCredentialPlatformLinks(input, options = {}) {
     diagnostics.node_count = links.length;
     diagnostics.rounds = rounds;
     diagnostics.requests = requests;
+    diagnostics.egress_transport = session.transport;
+    diagnostics.egress_switches = [...session.switches];
     event(options, 'extract_source_completed', {
         source_name: input.source_name,
         requested_iterations: maxIterations,
@@ -1393,6 +1681,109 @@ export async function fetchCredentialPlatformLinks(input, options = {}) {
         diagnostics
     };
 }
+/**
+ * Learn every pooled account's real membership expiry by logging in.
+ *
+ * The date is only written by a successful pooled login, and LRU leasing means
+ * one account per brand per run — so a freshly imported pool stays blank
+ * indefinitely and the UI shows an em dash for almost every row. This walks the
+ * active rows deliberately, reusing the normal credential flow (cached
+ * fingerprint, one node request) so the login path is the same one a run uses.
+ */
+export async function refreshAccountExpiry(input = {}) {
+    const env = input.env ?? process.env;
+    const now = input.now ?? (() => new Date());
+    const store = input.store ?? new AccountStore({ env, now });
+    const ownsStore = !input.store;
+    const concurrency = resolveConcurrency(input.concurrency, 3, 8);
+    const limit = Math.max(0, Math.trunc(Number(input.limit ?? 0)) || 0);
+    const fingerprintStore = new FingerprintStore({
+        cacheDir: resolveFingerprintCacheDir(resolveUserRuntimeRoot(env)),
+        now
+    });
+    const outcome = { checked: 0, updated: 0, expired: 0, failed: 0, results: [] };
+    const todayText = localDay(now());
+    const requested = input.brand ? normalizeBrand(input.brand) : null;
+    // Every brand the pool knows, from the registry rather than a second list.
+    const brands = requested ? [requested] : BRANDS.map((brand) => brand.key);
+    try {
+        for (const brand of brands) {
+            let accounts = store.leaseAll(brand);
+            if (limit > 0)
+                accounts = accounts.slice(0, limit);
+            if (accounts.length === 0)
+                continue;
+            // One memo per brand: the APK is inspected at most once for the whole
+            // sweep, not once per account. The cache key is the short brand key the
+            // normal run writes (`mf`, not `mifeng`); using the long name missed the
+            // cache on every sweep and re-downloaded the APK per account.
+            const brandKey = credentialBrandKey(brand, { official_site: brandSite(brand) });
+            const memo = createFingerprintMemo(fingerprintStore, brandKey);
+            await mapWithConcurrency(accounts, concurrency, async (leased) => {
+                const entry = {
+                    brand,
+                    account_masked: maskAccount(leased.account),
+                    expires_at: '',
+                    status: 'failed'
+                };
+                outcome.checked += 1;
+                try {
+                    const result = await fetchCredentialSourceLinks({
+                        source_name: brand,
+                        source: {
+                            mode: 'credential',
+                            official_site: brandSite(brand),
+                            account: leased.account,
+                            password: leased.password,
+                            platforms: ['android'],
+                            max_iterations: 1,
+                            areas_per_round: 1,
+                            plateau_limit: 1
+                        }
+                    }, { env, now, memo, fingerprintStore });
+                    const expires = result.diagnostics.membership_expires_at ?? '';
+                    entry.expires_at = expires;
+                    if (result.diagnostics.login_ok && expires) {
+                        store.setExpiry(brand, leased.account, expires);
+                        if (expires < todayText) {
+                            store.markExpired(leased.id, 'membership expired');
+                            entry.status = 'expired';
+                            outcome.expired += 1;
+                        }
+                        else {
+                            entry.status = 'updated';
+                            outcome.updated += 1;
+                        }
+                    }
+                    else if (result.diagnostics.membership_expired) {
+                        store.markExpired(leased.id, 'membership expired');
+                        entry.status = 'expired';
+                        outcome.expired += 1;
+                    }
+                    else {
+                        entry.status = 'failed';
+                        // The CLI prints this line, so nothing that can carry a credential
+                        // or a request URL may reach it.
+                        entry.error = redactText(result.diagnostics.errors.join('; ')) || 'login did not report an expiry';
+                        outcome.failed += 1;
+                    }
+                }
+                catch (error) {
+                    entry.status = 'failed';
+                    entry.error = redactText(error instanceof Error ? error.message : String(error));
+                    outcome.failed += 1;
+                }
+                outcome.results.push(entry);
+                input.onProgress?.(entry);
+            });
+        }
+    }
+    finally {
+        if (ownsStore)
+            store.close();
+    }
+    return outcome;
+}
 function isPlaceholderLink(link) {
     try {
         const encoded = link.replace(/^vmess:\/\//, '');