four-flap-meme-sdk 4.3.8 → 4.3.10

package/dist/core/clients/four-client-fallback.test.js

@@ -1,5 +1,6 @@
 import { afterEach, describe, expect, it, vi } from 'vitest';
 import { FourClient } from './four.js';
+import { FOUR_BNB_RAISED_TOKEN_FALLBACK } from '../../domains/four/raised-token.js';
 describe('FourClient private API rate-limit fallback', () => {
     afterEach(() => {
         vi.unstubAllGlobals();
@@ -9,7 +10,7 @@ describe('FourClient private API rate-limit fallback', () => {
         vi.stubGlobal('fetch', vi.fn(async (input) => {
             const url = String(input);
             calls.push(url);
-            if (url.includes('bscfourapi.emit.tools')) {
+            if (url.includes('bscfourapi.emit.tools') || url.includes('api.emit.tools')) {
                 return new Response(JSON.stringify({ code: -1013, msg: 'Too many requests, banned for 15 minutes' }), {
                     status: 429,
                 });
@@ -48,6 +49,25 @@ describe('FourClient private API rate-limit fallback', () => {
         expect(calls.some((url) => url.includes('example.com'))).toBe(true);
         expect(calls.some((url) => url.includes('bscfourapi.emit.tools'))).toBe(true);
     });
+    it('retries generateNonce on EC2 after Cloudflare proxies are banned', async () => {
+        const calls = [];
+        vi.stubGlobal('fetch', vi.fn(async (input) => {
+            const url = typeof input === 'string' ? input : input instanceof URL ? input.href : String(input);
+            calls.push(url);
+            if (url.includes('api.emit.tools')) {
+                return new Response(JSON.stringify({ code: 0, data: 'nonce-ec2' }));
+            }
+            return new Response(JSON.stringify({ code: -1013, msg: 'Too many requests, banned for 15 minutes' }), {
+                status: 429,
+            });
+        }));
+        await expect(new FourClient().generateNonce({
+            accountAddress: `0x${'11'.repeat(20)}`,
+            verifyType: 'LOGIN',
+            networkCode: 'BSC',
+        })).resolves.toBe('nonce-ec2');
+        expect(calls.some((url) => url.includes('api.emit.tools'))).toBe(true);
+    });
     it('retries generateNonce when the proxy returns HTML', async () => {
         vi.stubGlobal('fetch', vi.fn(async (input) => {
             const url = String(input);
@@ -57,6 +77,11 @@ describe('FourClient private API rate-limit fallback', () => {
                     headers: { 'Content-Type': 'text/html' },
                 });
             }
+            if (url.includes('api.emit.tools')) {
+                return new Response(JSON.stringify({ code: -1013, msg: 'Too many requests, banned for 15 minutes' }), {
+                    status: 429,
+                });
+            }
             return new Response(JSON.stringify({ code: 0, data: 'nonce-2' }));
         }));
         await expect(new FourClient().generateNonce({
@@ -65,4 +90,84 @@ describe('FourClient private API rate-limit fallback', () => {
             networkCode: 'BSC',
         })).resolves.toBe('nonce-2');
     });
+    it('browser hits official four.meme first so the request uses the user IP', async () => {
+        vi.stubGlobal('window', globalThis);
+        const calls = [];
+        vi.stubGlobal('fetch', vi.fn(async (input) => {
+            calls.push(String(input));
+            return new Response(JSON.stringify({ code: 0, data: 'nonce-user-ip' }));
+        }));
+        await expect(new FourClient({ baseUrl: 'https://bscfourapi.emit.tools' }).generateNonce({
+            accountAddress: `0x${'11'.repeat(20)}`,
+            verifyType: 'LOGIN',
+            networkCode: 'BSC',
+        })).resolves.toBe('nonce-user-ip');
+        expect(calls[0]).toContain('four.meme/meme-api');
+    });
+    it('browser createToken sends CORS-allowed Authorization to four.meme', async () => {
+        vi.stubGlobal('window', globalThis);
+        const headers = [];
+        vi.stubGlobal('fetch', vi.fn(async (input, init) => {
+            if (!String(input).includes('four.meme')) {
+                return new Response(JSON.stringify({ code: -1013, msg: 'Too many requests' }), { status: 429 });
+            }
+            headers.push((init?.headers || {}));
+            return new Response(JSON.stringify({ code: 0, data: { createArg: '0x1', signature: '0x2' } }));
+        }));
+        await expect(new FourClient({ baseUrl: 'https://bscfourapi.emit.tools' }).createToken('access-token', createReq())).resolves.toEqual({ createArg: '0x1', signature: '0x2' });
+        expect(headers[0]?.Authorization).toBe('access-token');
+        expect(headers[0]?.['meme-web-access']).toBeUndefined();
+    });
+    it('retries proxy with meme-web-access if official Authorization is treated as not login', async () => {
+        vi.stubGlobal('window', globalThis);
+        const seen = [];
+        vi.stubGlobal('fetch', vi.fn(async (input, init) => {
+            const url = String(input);
+            const hdrs = (init?.headers || {});
+            seen.push({ url, access: hdrs['meme-web-access'], authorization: hdrs.Authorization });
+            if (url.includes('four.meme')) {
+                return new Response(JSON.stringify({ code: -1004, msg: 'User not login' }));
+            }
+            return new Response(JSON.stringify({ code: 0, data: { createArg: '0x9', signature: '0xa' } }));
+        }));
+        await expect(new FourClient({ baseUrl: 'https://bscfourapi.emit.tools' }).createToken('access-token', createReq())).resolves.toEqual({ createArg: '0x9', signature: '0xa' });
+        expect(seen[0]?.url).toContain('four.meme');
+        expect(seen[0]?.authorization).toBe('access-token');
+        expect(seen.some((item) => item.url.includes('bscfourapi') && item.access === 'access-token')).toBe(true);
+    });
+    it('keeps proxy -1013 instead of Failed to fetch when browser CORS-upload to four.meme still fails', async () => {
+        vi.stubGlobal('window', globalThis);
+        const calls = [];
+        vi.stubGlobal('fetch', vi.fn(async (input) => {
+            const url = String(input);
+            calls.push(url);
+            if (url.includes('four.meme')) {
+                throw new TypeError('Failed to fetch');
+            }
+            return new Response(JSON.stringify({ code: -1013, msg: 'Too many requests, banned for 15 minutes, remain 120s' }), { status: 429 });
+        }));
+        await expect(new FourClient({ baseUrl: 'https://bscfourapi.emit.tools' }).createToken('access', createReq())).rejects.toThrow(/-1013|Too many requests/);
+        expect(calls.some((url) => url.includes('four.meme'))).toBe(true);
+    });
 });
+function createReq() {
+    return {
+        name: 't',
+        shortName: 't',
+        desc: '',
+        imgUrl: 'https://example.com/a.png',
+        launchTime: 1,
+        label: 'Meme',
+        preSale: '0',
+        onlyMPC: false,
+        lpTradingFee: 0.0025,
+        symbol: 'BNB',
+        totalSupply: 1_000_000_000,
+        raisedAmount: 18,
+        saleRate: 0.8,
+        reserveRate: 0,
+        funGroup: false,
+        clickFun: false,
+        raisedToken: FOUR_BNB_RAISED_TOKEN_FALLBACK,
+    };
+}

package/dist/core/clients/four.d.ts

@@ -112,6 +112,13 @@ export declare class FourClient {
     private uploadUrls;
     constructor(cfg?: FourConfig);
     private attachApiCode;
+    private isBrowserEnv;
+    private extractAccessToken;
+    /** 浏览器直连官网只用 CORS 放行的 Authorization，避免 meme-web-access 被预检拦成 Failed to fetch。 */
+    private requestHeaders;
+    /** 浏览器直连 four.meme 若仍被 CORS 拦成 Failed to fetch，回退到更早的限流错误。 */
+    private preferRateLimitError;
+    private shouldRetryPrivateApi;
     private postPrivateJson;
     generateNonce(req: GenerateNonceReq): Promise<string>;
     loginDex(body: LoginReq): Promise<string>;
@@ -134,6 +141,7 @@ export declare class FourClient {
      */
     private isCorsOrNetworkError;
     private isInvalidJsonError;
+    private isNotLoginError;
     private getFilenameFromBlob;
     createToken(accessToken: string, req: CreateTokenReq): Promise<CreateTokenResp>;
     getPublicConfig(): Promise<FourPublicConfig>;

package/dist/core/clients/four.js

@@ -109,23 +109,31 @@ async function hashBlob(blob) {
 }
 /** Four.meme 限流：-1038 每日上传配额，-1013 15 分钟封禁 */
 const RATE_LIMIT_CODES = new Set([-1038, -1013]);
-/** Cloudflare Worker 代理（独立出口 IP，主线路被封时换这条） */
+/** Cloudflare Worker 代理（与 Pages 同源反代同属 CF 出口，可能连坐） */
 const FOUR_MEME_PROXY_API = 'https://bscfourapi.emit.tools';
+/** emit-api EC2 反代（新加坡出口，CF 被 -1013 后换这条） */
+const FOUR_MEME_EC2_PROXY_API = 'https://api.emit.tools/v1/four-meme-api';
 /**
- * Four.meme 官方 API。nonce/login 浏览器可直连；create/upload 需 `meme-web-access`，
- * 官方 CORS 不放行该头，浏览器应走自有代理。
+ * Four.meme 官方 API。浏览器走这条才是用户自己的 IP，不会被共用代理连坐封禁。
+ * 官网 CORS 允许 Authorization，不允许 meme-web-access；浏览器直连时改用前者。
  */
 const FOUR_MEME_OFFICIAL_API = 'https://four.meme/meme-api';
 export class FourClient {
     baseUrl;
     uploadUrls;
     constructor(cfg) {
-        // 默认使用 Cloudflare Workers 代理，已配置 CORS，浏览器可直接使用
         this.baseUrl = cfg?.baseUrl || FOUR_MEME_PROXY_API;
-        // 主 URL → 自定义备用 → emit 代理（换 IP）→ 官方直连（Node 无 CORS）
-        this.uploadUrls = [
-            ...new Set([this.baseUrl, ...(cfg?.uploadFallbackUrls || []), FOUR_MEME_PROXY_API, FOUR_MEME_OFFICIAL_API]),
+        const urls = [
+            this.baseUrl,
+            ...(cfg?.uploadFallbackUrls || []),
+            FOUR_MEME_PROXY_API,
+            FOUR_MEME_EC2_PROXY_API,
+            FOUR_MEME_OFFICIAL_API,
         ];
+        // 浏览器先打官网（用户 IP）；Node 仍先走调用方传入的代理
+        this.uploadUrls = this.isBrowserEnv()
+            ? [...new Set([FOUR_MEME_OFFICIAL_API, ...urls])]
+            : [...new Set(urls)];
     }
     attachApiCode(err, code) {
         const n = Number(code);
@@ -133,14 +141,61 @@ export class FourClient {
             err.apiCode = n;
         return err;
     }
+    isBrowserEnv() {
+        return typeof window !== 'undefined';
+    }
+    extractAccessToken(headers) {
+        if (!headers)
+            return undefined;
+        for (const [key, value] of Object.entries(headers)) {
+            const k = key.toLowerCase();
+            if (k === 'meme-web-access' || k === 'authorization')
+                return value;
+        }
+        return undefined;
+    }
+    /** 浏览器直连官网只用 CORS 放行的 Authorization，避免 meme-web-access 被预检拦成 Failed to fetch。 */
+    requestHeaders(baseUrl, headers) {
+        const next = { ...(headers || {}) };
+        const token = this.extractAccessToken(next);
+        for (const key of Object.keys(next)) {
+            if (key.toLowerCase() === 'meme-web-access')
+                delete next[key];
+        }
+        if (!token)
+            return next;
+        const raw = token.replace(/^Bearer\s+/i, '');
+        if (this.isBrowserEnv() && baseUrl === FOUR_MEME_OFFICIAL_API) {
+            next.Authorization = raw;
+            return next;
+        }
+        next['meme-web-access'] = raw;
+        delete next.Authorization;
+        return next;
+    }
+    /** 浏览器直连 four.meme 若仍被 CORS 拦成 Failed to fetch，回退到更早的限流错误。 */
+    preferRateLimitError(lastError, rateLimitError, fallback) {
+        if (rateLimitError && (!lastError || this.isCorsOrNetworkError(lastError)))
+            return rateLimitError;
+        return lastError ?? rateLimitError ?? new Error(fallback);
+    }
+    shouldRetryPrivateApi(err, baseUrl, canRetry) {
+        if (!canRetry)
+            return false;
+        return (this.isRateLimitError(err) ||
+            this.isCorsOrNetworkError(err) ||
+            this.isInvalidJsonError(err) ||
+            (this.isNotLoginError(err) && baseUrl === FOUR_MEME_OFFICIAL_API));
+    }
     async postPrivateJson(path, failLabel, init) {
         let lastError = null;
+        let rateLimitError = null;
         for (let i = 0; i < this.uploadUrls.length; i++) {
             const baseUrl = this.uploadUrls[i];
             try {
                 const r = await fetch(`${baseUrl}${path}`, {
                     method: 'POST',
-                    headers: { 'Content-Type': 'application/json', ...(init.headers || {}) },
+                    headers: { 'Content-Type': 'application/json', ...this.requestHeaders(baseUrl, init.headers) },
                     body: init.body,
                 });
                 const j = (await r.json());
@@ -152,14 +207,14 @@ export class FourClient {
             catch (e) {
                 const err = e instanceof Error ? e : new Error(getErrorMessageFromUnknown(e));
                 lastError = err;
-                const canRetry = i < this.uploadUrls.length - 1;
-                if (canRetry && (this.isRateLimitError(err) || this.isCorsOrNetworkError(err) || this.isInvalidJsonError(err))) {
+                if (this.isRateLimitError(err))
+                    rateLimitError = err;
+                if (this.shouldRetryPrivateApi(err, baseUrl, i < this.uploadUrls.length - 1))
                     continue;
-                }
                 break;
             }
         }
-        throw lastError ?? new Error(failLabel);
+        throw this.preferRateLimitError(lastError, rateLimitError, failLabel);
     }
     async generateNonce(req) {
         return this.postPrivateJson('/v1/private/user/nonce/generate', 'generateNonce failed', {
@@ -188,40 +243,30 @@ export class FourClient {
         const finalFilename = filename || this.getFilenameFromBlob(file);
         let lastError = null;
         // ✅ 依次尝试所有上传端点（代理 → 自定义备用 → 官方直连兜底）
+        let rateLimitError = null;
         for (let i = 0; i < this.uploadUrls.length; i++) {
             const baseUrl = this.uploadUrls[i];
-            const isOfficial = baseUrl === FOUR_MEME_OFFICIAL_API;
             try {
                 const imgUrl = await this.doUpload(baseUrl, accessToken, file, finalFilename);
-                // 上传成功，写入持久化缓存（localStorage）
                 setCachedUrl(hash, imgUrl);
                 return imgUrl;
             }
             catch (e) {
                 const err = e instanceof Error ? e : new Error(getErrorMessageFromUnknown(e));
                 lastError = err;
-                const canRetry = i < this.uploadUrls.length - 1;
-                if (this.isRateLimitError(err) && canRetry) {
-                    continue;
-                }
-                if (this.isCorsOrNetworkError(err) && canRetry) {
-                    // CORS/网络错误（常见于浏览器直连官方 API）→ 跳过，继续尝试下一个
-                    console.warn(`[FourClient] 端点 ${baseUrl} 请求失败(${isOfficial ? 'CORS限制' : '网络错误'})，跳过`);
+                if (this.isRateLimitError(err))
+                    rateLimitError = err;
+                if (this.shouldRetryPrivateApi(err, baseUrl, i < this.uploadUrls.length - 1))
                     continue;
-                }
-                // 无法重试，跳出
                 break;
             }
         }
-        // 所有端点都失败
-        const isRateLimit = lastError && this.isRateLimitError(lastError);
-        if (isRateLimit) {
+        const chosen = this.preferRateLimitError(lastError, rateLimitError, 'upload failed: all endpoints exhausted');
+        if (this.isRateLimitError(chosen)) {
             throw new Error(`图片上传失败：Four.meme 限流（每日配额或 15 分钟封禁）。请稍后再试。` +
-                `\n原始错误: ${getErrorMessageFromUnknown(lastError)}`);
+                `\n原始错误: ${getErrorMessageFromUnknown(chosen)}`);
         }
-        if (lastError !== null && lastError !== undefined)
-            throw lastError;
-        throw new Error('upload failed: all endpoints exhausted');
+        throw chosen;
     }
     /**
      * 执行单次上传请求
@@ -231,7 +276,7 @@ export class FourClient {
         form.append('file', file, filename);
         const r = await fetch(`${baseUrl}/v1/private/token/upload`, {
             method: 'POST',
-            headers: { 'meme-web-access': accessToken },
+            headers: this.requestHeaders(baseUrl, { 'meme-web-access': accessToken }),
             body: form,
         });
         const j = await r.json();
@@ -262,6 +307,12 @@ export class FourClient {
     isInvalidJsonError(e) {
         return e instanceof SyntaxError || /unexpected token|not valid json/i.test(getErrorMessageFromUnknown(e));
     }
+    isNotLoginError(e) {
+        const code = Number(e.apiCode);
+        if (code === -1004)
+            return true;
+        return /user not login/i.test(getErrorMessageFromUnknown(e));
+    }
     getFilenameFromBlob(blob) {
         const mimeToExt = {
             'image/jpeg': 'jpg',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "four-flap-meme-sdk",
-  "version": "4.3.8",
+  "version": "4.3.10",
   "description": "SDK for Flap bonding curve and four.meme TokenManager",
   "type": "module",
   "main": "dist/index.js",