dsh-plugins-jizuo-creator-video 0.3.29 → 0.3.30

package/README.md

@@ -12,7 +12,7 @@ dsh-plugins-jizuo-creator-video
 dsh plugin --profile desktop add dsh-plugins-jizuo-creator-video
 ```
 
-这是已验证 v0.3.29 插件包的 npm 安装入口，内含原始插件及共享核心，无需额外安装依赖。
+这是已验证 v0.3.30 插件包的 npm 安装入口，内含原始插件及共享核心，无需额外安装依赖。
 
 已有 GitHub 安装版本时，请先卸载对应的旧安装项，再安装此 npm 包，完成后重启 DSH；卸载插件不会删除作品或对话。不要同时安装同一功能的 GitHub 包与 npm 包。
 

package/node_modules/@jizuo/video-plugin/README.md

@@ -7,7 +7,7 @@
 支持 **DeepSeek Harness Desktop 0.2.0-rc.2**。在左侧「插件」→「添加插件」粘贴下面这一行，确认来源后安装：
 
 ```text
-https://github.com/ShikangPang/jizuo-creator-video/releases/download/v0.3.29/jizuo-video-plugin-0.3.29.tgz
+https://github.com/ShikangPang/jizuo-creator-video/releases/download/v0.3.30/jizuo-video-plugin-0.3.30.tgz
 ```
 
 只填安装包地址，不要填整个安装命令。安装完成后「已安装」中显示「即作视频」，可分别启用、关闭、配置或卸载。共享核心已包含在安装包中，自动加载，不需要另装即作桌面端或手动安装核心插件。保留 Harness 原有新会话、插件与工作区入口；创作项目统一显示在工作区区域，小说和视频以前置图标区分，不再提供独立的创作面板。
@@ -17,7 +17,7 @@ https://github.com/ShikangPang/jizuo-creator-video/releases/download/v0.3.29/jiz
 也可使用 Desktop 菜单安装的 dsh 命令：
 
 ```sh
-dsh plugin --profile desktop add https://github.com/ShikangPang/jizuo-creator-video/releases/download/v0.3.29/jizuo-video-plugin-0.3.29.tgz
+dsh plugin --profile desktop add https://github.com/ShikangPang/jizuo-creator-video/releases/download/v0.3.30/jizuo-video-plugin-0.3.30.tgz
 ```
 
 源码克隆后运行 `node scripts/install.mjs --all` 一次安装五个插件，默认 desktop；Web 用户显式传 `--profile web`。脚本严格检查宿主版本。不要用旧版全局 dsh 命令安装到新版 Desktop，也不要绕过兼容检查。
@@ -26,7 +26,7 @@ dsh plugin --profile desktop add https://github.com/ShikangPang/jizuo-creator-vi
 
 启用即作写作插件后，点击工作区列表顶部的“导入小说”。支持 TXT、Markdown 和 DOCX，单文件最大 10 MB。选择文件后预览章节、修改作品名称，确认后创建新的小说项目，展开“正文”即可编辑。取消预览不会创建作品；首章前的内容保留为前言。TXT 支持 UTF-8 和 GB18030 编码。
 
-已安装多个即作插件时，请将它们一并更新到 0.3.29，并重启 Harness，使共享核心版本一致。
+已安装多个即作插件时，请将它们一并更新到 0.3.30，并重启 Harness，使共享核心版本一致。
 
 ## 项目与数据
 

package/node_modules/@jizuo/video-plugin/lib/client.js

@@ -9742,6 +9742,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			"image/jpeg",
 			"image/webp"
 		]);
+		const ASSETS_PER_PAGE = 60;
 		function VideoAssetsPanel({ project, episode: suppliedEpisode, remote }) {
 			const [selectedEpisodeId, setSelectedEpisodeId] = (0, react.useState)("");
 			const episode = suppliedEpisode ?? project.episodes.find((item) => !item.deletedAt && item.id === selectedEpisodeId);
@@ -9757,7 +9758,20 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			const [targetShotId, setTargetShotId] = (0, react.useState)("");
 			const [search, setSearch] = (0, react.useState)("");
 			const [kind, setKind] = (0, react.useState)("all");
-			const visibleAssets = project.assets.filter((asset) => (kind === "all" || asset.kind === kind) && asset.label.toLocaleLowerCase().includes(search.trim().toLocaleLowerCase()));
+			const query = search.trim().toLocaleLowerCase();
+			const visibleAssets = project.assets.filter((asset) => (kind === "all" || asset.kind === kind) && asset.label.toLocaleLowerCase().includes(query));
+			const pageKey = JSON.stringify([
+				project.workId,
+				kind,
+				query
+			]);
+			const [pagination, setPagination] = (0, react.useState)({
+				key: "",
+				page: 0
+			});
+			const pageCount = Math.max(1, Math.ceil(visibleAssets.length / ASSETS_PER_PAGE));
+			const page = Math.min(pagination.key === pageKey ? pagination.page : 0, pageCount - 1);
+			const pageAssets = visibleAssets.slice(page * ASSETS_PER_PAGE, (page + 1) * ASSETS_PER_PAGE);
 			const images = project.assets.filter((asset) => asset.kind === "image");
 			const shots = episode?.shots.filter((shot) => !shot.archived) ?? [];
 			const targetShot = shots.find((shot) => shot.id === targetShotId);
@@ -9972,7 +9986,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 						})] }),
 						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 							className: "jz-video-asset-grid",
-							children: visibleAssets.map((asset) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("figure", { children: [
+							children: pageAssets.map((asset) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("figure", { children: [
 								asset.kind === "image" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(VideoAssetPreview, {
 									remote,
 									workId: project.workId,
@@ -10016,6 +10030,44 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 									}
 								})
 							] }, asset.id))
+						}),
+						pageCount > 1 && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("nav", {
+							className: "jz-video-tools",
+							"aria-label": "素材分页",
+							children: [
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+									type: "button",
+									"aria-label": "上一页素材",
+									disabled: page === 0,
+									onClick: () => setPagination({
+										key: pageKey,
+										page: page - 1
+									}),
+									children: "上一页"
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+									"aria-live": "polite",
+									children: [
+										"第 ",
+										page + 1,
+										" / ",
+										pageCount,
+										" 页，共 ",
+										visibleAssets.length,
+										" 项"
+									]
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+									type: "button",
+									"aria-label": "下一页素材",
+									disabled: page + 1 >= pageCount,
+									onClick: () => setPagination({
+										key: pageKey,
+										page: page + 1
+									}),
+									children: "下一页"
+								})
+							]
 						})
 					] }),
 					!visibleAssets.length && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {

package/node_modules/@jizuo/video-plugin/node_modules/@jizuo/plugin/README.md

@@ -7,7 +7,7 @@
 支持 **DeepSeek Harness Desktop 0.2.0-rc.2**。在左侧「插件」→「添加插件」粘贴下面这一行，确认来源后安装：
 
 ```text
-https://github.com/ShikangPang/jizuo-creator-writing/releases/download/v0.3.29/jizuo-writing-plugin-0.3.29.tgz
+https://github.com/ShikangPang/jizuo-creator-writing/releases/download/v0.3.30/jizuo-writing-plugin-0.3.30.tgz
 ```
 
 只填安装包地址，不要填整个安装命令。安装完成后「已安装」中显示「即作写作」，可分别启用、关闭、配置或卸载。共享核心已包含在安装包中，自动加载，不需要另装即作桌面端或手动安装核心插件。保留 Harness 原有新会话、插件与工作区入口；创作项目统一显示在工作区区域，小说和视频以前置图标区分，不再提供独立的创作面板。
@@ -17,7 +17,7 @@ https://github.com/ShikangPang/jizuo-creator-writing/releases/download/v0.3.29/j
 也可使用 Desktop 菜单安装的 dsh 命令：
 
 ```sh
-dsh plugin --profile desktop add https://github.com/ShikangPang/jizuo-creator-writing/releases/download/v0.3.29/jizuo-writing-plugin-0.3.29.tgz
+dsh plugin --profile desktop add https://github.com/ShikangPang/jizuo-creator-writing/releases/download/v0.3.30/jizuo-writing-plugin-0.3.30.tgz
 ```
 
 源码克隆后运行 `node scripts/install.mjs --all` 一次安装五个插件，默认 desktop；Web 用户显式传 `--profile web`。脚本严格检查宿主版本。不要用旧版全局 dsh 命令安装到新版 Desktop，也不要绕过兼容检查。
@@ -26,7 +26,7 @@ dsh plugin --profile desktop add https://github.com/ShikangPang/jizuo-creator-wr
 
 启用即作写作插件后，点击工作区列表顶部的“导入小说”。支持 TXT、Markdown 和 DOCX，单文件最大 10 MB。选择文件后预览章节、修改作品名称，确认后创建新的小说项目，展开“正文”即可编辑。取消预览不会创建作品；首章前的内容保留为前言。TXT 支持 UTF-8 和 GB18030 编码。
 
-已安装多个即作插件时，请将它们一并更新到 0.3.29，并重启 Harness，使共享核心版本一致。
+已安装多个即作插件时，请将它们一并更新到 0.3.30，并重启 Harness，使共享核心版本一致。
 
 ## 项目与数据
 

package/node_modules/@jizuo/video-plugin/node_modules/@jizuo/plugin/lib/client.js

@@ -10522,12 +10522,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					}
 				};
 				refresh();
-				const timer = window.setInterval(() => {
-					refresh();
-				}, BACKGROUND_REFRESH_INTERVAL_MS);
 				return () => {
 					active = false;
-					window.clearInterval(timer);
 				};
 			}, [
 				expandedVolumeId,

package/node_modules/@jizuo/video-plugin/node_modules/@jizuo/plugin/lib/dream-worker.js

@@ -4,6 +4,7 @@ import { access, link, lstat, mkdir, open, readFile, readdir, realpath, rename,
 import { closeSync, constants, fsyncSync, linkSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, unlinkSync, watch, writeFileSync } from "node:fs";
 import { basename, dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { homedir } from "node:os";
+import { inflateRawSync } from "node:zlib";
 import { isDeepStrictEqual } from "node:util";
 import { createServer } from "node:http";
 //#region \0rolldown/runtime.js
@@ -64627,7 +64628,7 @@ var require_underline = /* @__PURE__ */ __commonJSMin$1(((exports) => {
 	}
 }));
 //#endregion
-//#region ../work-domain/src/importer.ts
+//#region ../work-domain/src/docxLimits.ts
 var import_lib = /* @__PURE__ */ __toESM$1((/* @__PURE__ */ __commonJSMin$1(((exports) => {
 	var _ = (init_index_all(), __toCommonJS(index_all_exports));
 	var docxReader = require_docx_reader();
@@ -64679,6 +64680,64 @@ var import_lib = /* @__PURE__ */ __toESM$1((/* @__PURE__ */ __commonJSMin$1(((ex
 		});
 	}
 })))(), 1);
+const MAX_ENTRIES = 2048;
+const MAX_ENTRY_BYTES = 16777216;
+const MAX_TOTAL_BYTES = 33554432;
+const invalid$1 = () => new JizuoError("validation_error", "无法读取 Word 文档，请确认文件为有效的 DOCX 格式后重试");
+const oversized = () => new JizuoError("validation_error", "Word 文档解压内容超过安全限制，请拆分后再导入");
+/** Check both ZIP metadata and bounded actual inflation before handing bytes to Mammoth. */
+function validateDocxArchive(source) {
+	let end = -1;
+	for (let at = source.length - 22; at >= Math.max(0, source.length - 22 - 65535); at -= 1) if (source.readUInt32LE(at) === 101010256 && at + 22 + source.readUInt16LE(at + 20) === source.length) {
+		end = at;
+		break;
+	}
+	if (end < 0) throw invalid$1();
+	const count = source.readUInt16LE(end + 10);
+	if (count > MAX_ENTRIES) throw new JizuoError("validation_error", "Word 文档包含过多文件条目，请简化文档后再导入");
+	if (source.readUInt32LE(end + 4) !== 0 || count !== source.readUInt16LE(end + 8)) throw invalid$1();
+	const centralSize = source.readUInt32LE(end + 12);
+	const centralStart = source.readUInt32LE(end + 16);
+	if (centralStart + centralSize !== end) throw invalid$1();
+	let cursor = centralStart;
+	let total = 0;
+	const names = /* @__PURE__ */ new Set();
+	for (let index = 0; index < count; index += 1) {
+		if (cursor + 46 > end || source.readUInt32LE(cursor) !== 33639248) throw invalid$1();
+		const flags = source.readUInt16LE(cursor + 8);
+		const method = source.readUInt16LE(cursor + 10);
+		const compressedSize = source.readUInt32LE(cursor + 20);
+		const size = source.readUInt32LE(cursor + 24);
+		const nameSize = source.readUInt16LE(cursor + 28);
+		const next = cursor + 46 + nameSize + source.readUInt16LE(cursor + 30) + source.readUInt16LE(cursor + 32);
+		const local = source.readUInt32LE(cursor + 42);
+		if (next > end || flags & 1 || method !== 0 && method !== 8 || source.readUInt16LE(cursor + 34) !== 0) throw invalid$1();
+		if (size > MAX_ENTRY_BYTES || total + size > MAX_TOTAL_BYTES) throw oversized();
+		const name = source.subarray(cursor + 46, cursor + 46 + nameSize);
+		const key = name.toString("utf8");
+		if (names.has(key) || key.split("/").includes("..")) throw invalid$1();
+		names.add(key);
+		if (local + 30 > centralStart || source.readUInt32LE(local) !== 67324752 || source.readUInt16LE(local + 8) !== method || source.readUInt16LE(local + 6) !== flags) throw invalid$1();
+		const localNameSize = source.readUInt16LE(local + 26);
+		const start = local + 30 + localNameSize + source.readUInt16LE(local + 28);
+		if (start + compressedSize > centralStart || !source.subarray(local + 30, local + 30 + localNameSize).equals(name)) throw invalid$1();
+		const compressed = source.subarray(start, start + compressedSize);
+		let expandedSize = compressedSize;
+		if (method === 8) try {
+			expandedSize = inflateRawSync(compressed, { maxOutputLength: Math.min(MAX_ENTRY_BYTES, MAX_TOTAL_BYTES - total) || 1 }).length;
+		} catch (error) {
+			if (error.code === "ERR_BUFFER_TOO_LARGE") throw oversized();
+			throw invalid$1();
+		}
+		if (expandedSize > MAX_ENTRY_BYTES || total + expandedSize > MAX_TOTAL_BYTES) throw oversized();
+		if (expandedSize !== size) throw invalid$1();
+		total += expandedSize;
+		cursor = next;
+	}
+	if (cursor !== end) throw invalid$1();
+}
+//#endregion
+//#region ../work-domain/src/importer.ts
 function isChapterTitle(title) {
 	return /^第[\d零〇一二三四五六七八九十百千万两]+章(?:$|[\s:：、.．—-])/u.test(title.trim());
 }
@@ -64697,7 +64756,8 @@ function splitMarkdown(markdown, fallbackTitle) {
 		const plainChapters = splitText(markdown, fallbackTitle);
 		if (plainChapters.some((chapter) => isChapterTitle(chapter.title))) return plainChapters;
 	}
-	const selected = chapterHeadings.length > 0 ? chapterHeadings : headings.filter((heading) => heading.level === Math.max(...headings.map(({ level }) => level)));
+	const deepestLevel = headings.reduce((level, heading) => Math.max(level, heading.level), 0);
+	const selected = chapterHeadings.length > 0 ? chapterHeadings : headings.filter((heading) => heading.level === deepestLevel);
 	if (selected.length === 0) return [{
 		title: fallbackTitle,
 		content: markdown.trim()
@@ -64751,18 +64811,42 @@ function decodeHtml(value) {
 function htmlToMarkdown(html) {
 	return html.replace(/<h([1-6])[^>]*>([\s\S]*?)<\/h\1>/giu, (_match, level, content) => `\n${"#".repeat(Number(level))} ${decodeHtml(content).trim()}\n`).replace(/<p[^>]*>([\s\S]*?)<\/p>/giu, (_match, content) => `\n${decodeHtml(content)}\n`).replace(/<li[^>]*>([\s\S]*?)<\/li>/giu, (_match, content) => `\n- ${decodeHtml(content)}\n`).replace(/<[^>]+>/gu, "").replace(/\n{3,}/gu, "\n\n").trim();
 }
+function checkSourceSize(size) {
+	if (size > 10485760) throw new JizuoError("validation_error", "文件超过 10 MB，请拆分后再导入");
+}
+async function readLocalSource(path) {
+	const file = await open(path, "r");
+	try {
+		const stat = await file.stat();
+		if (!stat.isFile()) throw new JizuoError("validation_error", "请选择有效的小说文件");
+		checkSourceSize(stat.size);
+		const chunks = [];
+		let size = 0;
+		while (true) {
+			const chunk = Buffer.alloc(Math.min(65536, 10485761 - size));
+			const { bytesRead } = await file.read(chunk);
+			if (bytesRead === 0) return Buffer.concat(chunks, size);
+			size += bytesRead;
+			checkSourceSize(size);
+			chunks.push(chunk.subarray(0, bytesRead));
+		}
+	} finally {
+		await file.close();
+	}
+}
 async function previewImport(rawInput) {
 	const input = PreviewImportInput.parse(rawInput);
-	const source = input.sourceBase64 === void 0 ? await readFile(input.sourcePath) : Buffer.from(input.sourceBase64, "base64");
+	const source = input.sourceBase64 === void 0 ? await readLocalSource(input.sourcePath) : Buffer.from(input.sourceBase64, "base64");
 	if (input.sourceBase64 !== void 0) {
 		if (source.toString("base64") !== input.sourceBase64) throw new JizuoError("validation_error", "文件内容无效，请重新选择小说文件");
-		if (source.length > 10485760) throw new JizuoError("validation_error", "文件超过 10 MB，请拆分后再导入");
 	}
+	checkSourceSize(source.length);
 	if (source.length === 0) throw new JizuoError("validation_error", "文件为空，请选择有正文的小说文件");
 	const suggestedTitle = basename(input.sourcePath, extname(input.sourcePath));
 	let chapters;
 	const warnings = [];
 	if (input.format === "docx") {
+		validateDocxArchive(source);
 		let converted;
 		try {
 			converted = await import_lib.convertToHtml({ buffer: source });
@@ -70434,6 +70518,12 @@ const DEFAULT_MAX_RESPONSE_BYTES = 262144;
 const CALLBACK_MAX_BODY_BYTES = 65536;
 const LOGIN_TTL_MS = 18e4;
 const SESSION_TTL_MS = 6048e5;
+const vaultOperations = /* @__PURE__ */ new WeakMap();
+function withVault(vault, action) {
+	const pending = (vaultOperations.get(vault) ?? Promise.resolve()).then(action);
+	vaultOperations.set(vault, pending.catch(() => {}));
+	return pending;
+}
 const NspoxUser = object$1({
 	id: string().trim().min(1).max(160),
 	name: string().trim().min(1).max(160),
@@ -70521,6 +70611,7 @@ var AccountGateway = class {
 	now;
 	randomBytes;
 	maxResponseBytes;
+	requestTimeoutMs;
 	vault;
 	pendingLogin;
 	constructor(options = {}) {
@@ -70528,8 +70619,10 @@ var AccountGateway = class {
 		this.now = options.now ?? Date.now;
 		this.randomBytes = options.randomBytes ?? (() => globalThis.crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32)));
 		this.maxResponseBytes = options.maxResponseBytes ?? DEFAULT_MAX_RESPONSE_BYTES;
+		this.requestTimeoutMs = options.requestTimeoutMs ?? 15e3;
 		this.vault = options.vault ?? new MemoryTokenVault();
 		if (!Number.isSafeInteger(this.maxResponseBytes) || this.maxResponseBytes < 128) throw new JizuoError("validation_error", "平台响应大小上限无效");
+		if (!Number.isSafeInteger(this.requestTimeoutMs) || this.requestTimeoutMs < 1 || this.requestTimeoutMs > 12e4) throw new JizuoError("validation_error", "平台请求超时时间无效");
 	}
 	async beginBrowserLogin() {
 		this.closePendingLogin();
@@ -70630,7 +70723,7 @@ var AccountGateway = class {
 	}
 	async logout() {
 		this.closePendingLogin();
-		await this.vault.clear();
+		await withVault(this.vault, () => this.vault.clear());
 	}
 	async handleCallback(server, request, response) {
 		const pending = this.pendingLogin;
@@ -70672,7 +70765,7 @@ var AccountGateway = class {
 			...refreshToken === "" ? {} : { refreshToken }
 		};
 		try {
-			await this.vault.set(tokens);
+			await withVault(this.vault, () => this.vault.set(tokens));
 		} catch {
 			pending.consumed = false;
 			sendHtml(response, 500, callbackPage(false));
@@ -70694,14 +70787,31 @@ var AccountGateway = class {
 		pending.server.close();
 	}
 	async requireAccessToken() {
-		const tokens = await this.vault.get();
-		if (tokens === void 0 || tokens.expiresAt <= this.now()) {
-			await this.vault.clear();
-			throw new JizuoError("credential_required", "请先通过浏览器登录 NSPOX 账号");
-		}
-		return tokens.accessToken;
+		return withVault(this.vault, async () => {
+			const tokens = await this.vault.get();
+			if (tokens === void 0 || tokens.expiresAt <= this.now()) {
+				await this.vault.clear();
+				throw new JizuoError("credential_required", "请先通过浏览器登录 NSPOX 账号");
+			}
+			return tokens.accessToken;
+		});
 	}
 	async requestJson(path, options) {
+		const controller = new AbortController();
+		let timeout;
+		const deadline = new Promise((_resolve, reject) => {
+			timeout = setTimeout(() => {
+				reject(new JizuoError("runtime_unavailable", "NSPOX 账号服务响应超时，请稍后重试"));
+				controller.abort();
+			}, this.requestTimeoutMs);
+		});
+		try {
+			return await Promise.race([this.readResponse(path, options, controller.signal), deadline]);
+		} finally {
+			clearTimeout(timeout);
+		}
+	}
+	async readResponse(path, options, signal) {
 		const url = validateProductionUrl(new URL(path, PRODUCTION_ORIGIN).href);
 		const headers = new Headers({
 			accept: "application/json",
@@ -70712,30 +70822,65 @@ var AccountGateway = class {
 			response = await this.fetchImpl(url, {
 				method: "GET",
 				headers,
-				redirect: "manual"
+				redirect: "manual",
+				signal
 			});
 		} catch {
 			throw new JizuoError("runtime_unavailable", "无法连接 NSPOX 账号服务");
 		}
-		if (response.url !== "") validateProductionUrl(response.url);
-		if (response.status >= 300 && response.status < 400) {
-			const location = response.headers.get("location");
-			if (location !== null) validateProductionUrl(new URL(location, url).href);
-			throw new JizuoError("denied", "平台响应发生了未允许的重定向");
-		}
-		if (response.status === 401) {
-			await this.vault.clear();
-			throw new JizuoError("credential_required", "NSPOX 登录状态已失效");
-		}
-		if (!response.ok) throw new JizuoError("runtime_unavailable", "NSPOX 账号服务暂时不可用", { status: response.status });
-		const declaredSize = Number(response.headers.get("content-length"));
-		if (Number.isFinite(declaredSize) && declaredSize > this.maxResponseBytes) throw new JizuoError("validation_error", "平台响应超过安全大小限制");
-		const text = await response.text();
-		if (new TextEncoder().encode(text).byteLength > this.maxResponseBytes) throw new JizuoError("validation_error", "平台响应超过安全大小限制");
 		try {
-			return JSON.parse(text);
-		} catch {
-			throw new JizuoError("validation_error", "平台响应不是有效 JSON");
+			signal.throwIfAborted();
+			if (response.url !== "") validateProductionUrl(response.url);
+			if (response.status >= 300 && response.status < 400) {
+				const location = response.headers.get("location");
+				if (location !== null) validateProductionUrl(new URL(location, url).href);
+				throw new JizuoError("denied", "平台响应发生了未允许的重定向");
+			}
+			if (response.status === 401) {
+				await withVault(this.vault, async () => {
+					if ((await this.vault.get())?.accessToken === options.accessToken) await this.vault.clear();
+				});
+				throw new JizuoError("credential_required", "NSPOX 登录状态已失效");
+			}
+			if (!response.ok) throw new JizuoError("runtime_unavailable", "NSPOX 账号服务暂时不可用", { status: response.status });
+			const declaredSize = Number(response.headers.get("content-length"));
+			if (Number.isFinite(declaredSize) && declaredSize > this.maxResponseBytes) throw new JizuoError("validation_error", "平台响应超过安全大小限制");
+			const text = await this.readBoundedBody(response, signal);
+			try {
+				return JSON.parse(text);
+			} catch {
+				throw new JizuoError("validation_error", "平台响应不是有效 JSON");
+			}
+		} finally {
+			if (response.body !== null && !response.body.locked) response.body.cancel().catch(() => {});
+		}
+	}
+	async readBoundedBody(response, signal) {
+		if (response.body === null) return "";
+		const reader = response.body.getReader();
+		const cancel = () => {
+			reader.cancel().catch(() => {});
+		};
+		signal.addEventListener("abort", cancel, { once: true });
+		const chunks = [];
+		let size = 0;
+		try {
+			while (true) {
+				signal.throwIfAborted();
+				const { done, value } = await reader.read();
+				signal.throwIfAborted();
+				if (done) return new TextDecoder().decode(Buffer.concat(chunks, size));
+				size += value.byteLength;
+				if (size > this.maxResponseBytes) throw new JizuoError("validation_error", "平台响应超过安全大小限制");
+				chunks.push(value);
+			}
+		} catch (error) {
+			if (error instanceof JizuoError) throw error;
+			throw new JizuoError("runtime_unavailable", "读取 NSPOX 账号响应失败，请稍后重试");
+		} finally {
+			signal.removeEventListener("abort", cancel);
+			cancel();
+			reader.releaseLock();
 		}
 	}
 };