mslxdff 0.1.197 → 0.1.199

package/src/providers/qwenwork/stream.js

@@ -1,130 +1,130 @@
-// vendor 自 _shared/sse.js 的 transform（真流式：上游 SSE → OpenAI chunk，边收边吐）。
-// 唯一一处**有意偏离**原作者实现：把 chunk 里的 `model` 回写成客户端请求的模型名。
-// 上游实际返回的是池名（实测 `qwork-openai-chat-mode-pool`），直接透传会让客户端按模型名匹配失败，
-// 违反本仓契约 1「model 原样透传」。原作者的非流式路径同样做了 `completion.model = wantModel`。
-import { handleLine } from "./sse.js";
-
-function rewriteModel(frameText, model) {
-  if (!model) return frameText;
-  const body = frameText.slice(6, -2);
-  let obj;
-  try {
-    obj = JSON.parse(body);
-  } catch {
-    return frameText;
-  }
-  if (!obj || typeof obj !== "object") return frameText;
-  obj.model = model;
-  return `data: ${JSON.stringify(obj)}\n\n`;
-}
-
-export function transformStream(upstreamBody, model, onUsage, { heartbeatMs = 15000 } = {}) {
-  const reader = upstreamBody.getReader();
-  const decoder = new TextDecoder();
-  const encoder = new TextEncoder();
-  let buffer = "";
-  let notified = false;
-  let heartbeat = null;
-  const state = { usage: null, error: null };
-
-  const notify = () => {
-    if (notified) return;
-    notified = true;
-    if (onUsage) onUsage(state.usage);
-  };
-
-  const emitError = (controller, message) => {
-    try {
-      controller.enqueue(encoder.encode(`data: ${JSON.stringify({ error: { message, type: "upstream_error" } })}\n\n`));
-      controller.enqueue(encoder.encode("data: [DONE]\n\n"));
-      controller.close();
-    } catch {
-      /* 客户端已断开 */
-    }
-  };
-
-  const stopHeartbeat = () => {
-    if (heartbeat) {
-      clearInterval(heartbeat);
-      heartbeat = null;
-    }
-  };
-
-  const finish = () => {
-    stopHeartbeat();
-    notify();
-  };
-
-  return new ReadableStream({
-    start(controller) {
-      if (heartbeatMs > 0) {
-        heartbeat = setInterval(() => {
-          try {
-            controller.enqueue(encoder.encode(": ping\n\n"));
-          } catch {
-            /* 已关闭 */
-          }
-        }, heartbeatMs);
-        if (heartbeat.unref) heartbeat.unref();
-      }
-    },
-    async pull(controller) {
-      try {
-        for (;;) {
-          let read;
-          try {
-            read = await reader.read();
-          } catch (err) {
-            const message = `upstream stream read error: ${err && err.message ? err.message : err}`;
-            stopHeartbeat();
-            emitError(controller, message);
-            notify();
-            return;
-          }
-          if (read.done) {
-            stopHeartbeat();
-            if (buffer) {
-              const out = handleLine(buffer, state);
-              if (out) controller.enqueue(encoder.encode(rewriteModel(out, model)));
-              buffer = "";
-            }
-            if (state.error) emitError(controller, state.error);
-            else {
-              try {
-                controller.enqueue(encoder.encode("data: [DONE]\n\n"));
-                controller.close();
-              } catch {
-                /* 客户端已断开 */
-              }
-            }
-            finish();
-            return;
-          }
-          buffer += decoder.decode(read.value, { stream: true });
-          const lines = buffer.split("\n");
-          buffer = lines.pop() || "";
-          let out = "";
-          for (const line of lines) {
-            const frame = handleLine(line, state);
-            if (frame) out += rewriteModel(frame, model);
-          }
-          if (out) {
-            controller.enqueue(encoder.encode(out));
-            return;
-          }
-        }
-      } catch (err) {
-        finish();
-        try {
-          emitError(controller, `stream error: ${err && err.message ? err.message : err}`);
-        } catch {
-          /* 已关闭 */
-        }
-      }
-    },
-    cancel(reason) {
-      finish();
-      if (reader.cancel) reader.cancel(reason);
-    },
-  });
-}
+// vendor 自 _shared/sse.js 的 transform（真流式：上游 SSE → OpenAI chunk，边收边吐）。
+// 唯一一处**有意偏离**原作者实现：把 chunk 里的 `model` 回写成客户端请求的模型名。
+// 上游实际返回的是池名（实测 `qwork-openai-chat-mode-pool`），直接透传会让客户端按模型名匹配失败，
+// 违反本仓契约 1「model 原样透传」。原作者的非流式路径同样做了 `completion.model = wantModel`。
+import { handleLine } from "./sse.js";
+
+function rewriteModel(frameText, model) {
+  if (!model) return frameText;
+  const body = frameText.slice(6, -2);
+  let obj;
+  try {
+    obj = JSON.parse(body);
+  } catch {
+    return frameText;
+  }
+  if (!obj || typeof obj !== "object") return frameText;
+  obj.model = model;
+  return `data: ${JSON.stringify(obj)}\n\n`;
+}
+
+export function transformStream(upstreamBody, model, onUsage, { heartbeatMs = 15000 } = {}) {
+  const reader = upstreamBody.getReader();
+  const decoder = new TextDecoder();
+  const encoder = new TextEncoder();
+  let buffer = "";
+  let notified = false;
+  let heartbeat = null;
+  const state = { usage: null, error: null };
+
+  const notify = () => {
+    if (notified) return;
+    notified = true;
+    if (onUsage) onUsage(state.usage);
+  };
+
+  const emitError = (controller, message) => {
+    try {
+      controller.enqueue(encoder.encode(`data: ${JSON.stringify({ error: { message, type: "upstream_error" } })}\n\n`));
+      controller.enqueue(encoder.encode("data: [DONE]\n\n"));
+      controller.close();
+    } catch {
+      /* 客户端已断开 */
+    }
+  };
+
+  const stopHeartbeat = () => {
+    if (heartbeat) {
+      clearInterval(heartbeat);
+      heartbeat = null;
+    }
+  };
+
+  const finish = () => {
+    stopHeartbeat();
+    notify();
+  };
+
+  return new ReadableStream({
+    start(controller) {
+      if (heartbeatMs > 0) {
+        heartbeat = setInterval(() => {
+          try {
+            controller.enqueue(encoder.encode(": ping\n\n"));
+          } catch {
+            /* 已关闭 */
+          }
+        }, heartbeatMs);
+        if (heartbeat.unref) heartbeat.unref();
+      }
+    },
+    async pull(controller) {
+      try {
+        for (;;) {
+          let read;
+          try {
+            read = await reader.read();
+          } catch (err) {
+            const message = `upstream stream read error: ${err && err.message ? err.message : err}`;
+            stopHeartbeat();
+            emitError(controller, message);
+            notify();
+            return;
+          }
+          if (read.done) {
+            stopHeartbeat();
+            if (buffer) {
+              const out = handleLine(buffer, state);
+              if (out) controller.enqueue(encoder.encode(rewriteModel(out, model)));
+              buffer = "";
+            }
+            if (state.error) emitError(controller, state.error);
+            else {
+              try {
+                controller.enqueue(encoder.encode("data: [DONE]\n\n"));
+                controller.close();
+              } catch {
+                /* 客户端已断开 */
+              }
+            }
+            finish();
+            return;
+          }
+          buffer += decoder.decode(read.value, { stream: true });
+          const lines = buffer.split("\n");
+          buffer = lines.pop() || "";
+          let out = "";
+          for (const line of lines) {
+            const frame = handleLine(line, state);
+            if (frame) out += rewriteModel(frame, model);
+          }
+          if (out) {
+            controller.enqueue(encoder.encode(out));
+            return;
+          }
+        }
+      } catch (err) {
+        finish();
+        try {
+          emitError(controller, `stream error: ${err && err.message ? err.message : err}`);
+        } catch {
+          /* 已关闭 */
+        }
+      }
+    },
+    cancel(reason) {
+      finish();
+      if (reader.cancel) reader.cancel(reason);
+    },
+  });
+}

package/src/providers/qwenwork/upstream.js

@@ -1,120 +1,120 @@
-// vendor 自 _shared/upstream.js（签名请求装配 + OAuth 设备流），逐字搬；
-// 唯一改动：fetch 实现改为注入（默认本仓统一的 compatFetch，走 undici 连接池，勿混用 globalThis.fetch）。
-import { compatFetch } from "../../compat.js";
-import { uuid, b64url, utf8 } from "./crypto.js";
-import { signHeaders } from "./cosy.js";
-import {
-  UA, CLIENT_ID, REDIRECT_URI, DEVICE_AUTH_URL, CHAT_URL, MODELS_URL,
-  USERINFO_URL, ACCOUNT_CONTEXT_URL, POLL_URL, REFRESH_URL, MODEL_SLICE,
-} from "./constants.js";
-
-function plainHeaders() {
-  return {
-    accept: "application/json, text/plain, */*",
-    "content-type": "application/json",
-    "user-agent": UA,
-  };
-}
-
-export function chatRequest(account, modelKey, bodyStr, signal, fetchImpl = compatFetch) {
-  const headers = signHeaders(account, bodyStr, CHAT_URL, modelKey, "text/event-stream");
-  return fetchImpl(CHAT_URL, { method: "POST", headers, body: bodyStr, signal });
-}
-
-export async function modelList(account, fetchImpl = compatFetch) {
-  const headers = signHeaders(account, "", MODELS_URL, "", "application/json");
-  const res = await fetchImpl(MODELS_URL, { headers });
-  if (!res.ok) throw new Error(`models http ${res.status}`);
-  const data = await res.json();
-  // 实测 11 个根切片只有 `qwork` 非空（其余 n=0）；切片名见 constants.MODEL_SLICE
-  const list = Array.isArray(data && data[MODEL_SLICE]) ? data[MODEL_SLICE] : [];
-  return list
-    .filter((m) => m && m.enable !== false && m.key)
-    .map((m) => ({
-      key: m.key,
-      name: m.display_name || m.key,
-      isReasoning: !!m.is_reasoning,
-      isVL: !!m.is_vl,
-      maxInputTokens: m.max_input_tokens || 0,
-      maxOutputTokens: m.max_output_tokens || 0,
-      priceFactor: typeof m.price_factor === "number" ? m.price_factor : 0,
-      description: typeof m.description === "string" ? m.description : "",
-    }));
-}
-
-export async function userInfo(accessToken, fetchImpl = compatFetch) {
-  const res = await fetchImpl(USERINFO_URL, {
-    headers: { ...plainHeaders(), authorization: `Bearer ${accessToken}` },
-  });
-  if (!res.ok) throw new Error(`userinfo http ${res.status}`);
-  return res.json();
-}
-
-/** 额度/套餐：data.{user,plan,quota}；quota.remaining 即积分余量。 */
-export async function accountContext(accessToken, fetchImpl = compatFetch) {
-  const res = await fetchImpl(ACCOUNT_CONTEXT_URL, {
-    headers: { ...plainHeaders(), authorization: `Bearer ${accessToken}` },
-  });
-  if (!res.ok) throw new Error(`account-context http ${res.status}`);
-  const body = await res.json();
-  if (!body || (body.code && body.code !== "ok")) throw new Error(`account-context code=${body && body.code}`);
-  return (body && body.data) || {};
-}
-
-export async function refreshDeviceToken(refreshToken, fetchImpl = compatFetch) {
-  const res = await fetchImpl(REFRESH_URL, {
-    method: "POST",
-    headers: plainHeaders(),
-    body: JSON.stringify({ refresh_token: refreshToken }),
-  });
-  if (!res.ok) throw new Error(`refresh http ${res.status}`);
-  const data = await res.json();
-  const access = data && (data.token || data.device_token);
-  if (!access || !data.refresh_token) throw new Error("refresh: incomplete token pair");
-  return data;
-}
-
-export async function pollGrant(nonce, verifier, fetchImpl = compatFetch) {
-  const q = new URLSearchParams({ nonce, verifier, challenge_method: "S256" });
-  const res = await fetchImpl(`${POLL_URL}?${q.toString()}`, {
-    headers: { accept: "application/json", "user-agent": UA },
-  });
-  if (res.status === 404 || res.status === 202) return { pending: true };
-  if (!res.ok) throw new Error(`poll http ${res.status}`);
-  const data = await res.json();
-  if (!data || !(data.token || data.device_token)) return { pending: true };
-  return { pending: false, grant: data };
-}
-
-export async function newDeviceFlow() {
-  const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~";
-  const raw = new Uint8Array(64);
-  crypto.getRandomValues(raw);
-  let verifier = "";
-  for (let i = 0; i < raw.length; i++) verifier += alphabet[raw[i] % alphabet.length];
-  const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", utf8(verifier)));
-  const challenge = b64url(digest);
-  const nonce = uuid();
-  const machineID = uuid();
-  const q = new URLSearchParams({
-    challenge,
-    challenge_method: "S256",
-    nonce,
-    machine_id: machineID,
-    client_id: CLIENT_ID,
-    redirect_uri: REDIRECT_URI,
-  });
-  return { verifier, nonce, url: `${DEVICE_AUTH_URL}?${q.toString()}` };
-}
-
-export function expiryUnix(grant) {
-  if (grant && grant.expires_at) {
-    const t = Date.parse(grant.expires_at);
-    if (!Number.isNaN(t)) return Math.floor(t / 1000);
-  }
-  if (grant && grant.expires_in > 0) {
-    const ms = grant.expires_in > 10000000 ? grant.expires_in : grant.expires_in * 1000;
-    return Math.floor((Date.now() + ms) / 1000);
-  }
-  return Math.floor((Date.now() + 30 * 24 * 3600 * 1000) / 1000);
-}
+// vendor 自 _shared/upstream.js（签名请求装配 + OAuth 设备流），逐字搬；
+// 唯一改动：fetch 实现改为注入（默认本仓统一的 compatFetch，走 undici 连接池，勿混用 globalThis.fetch）。
+import { compatFetch } from "../../compat.js";
+import { uuid, b64url, utf8 } from "./crypto.js";
+import { signHeaders } from "./cosy.js";
+import {
+  UA, CLIENT_ID, REDIRECT_URI, DEVICE_AUTH_URL, CHAT_URL, MODELS_URL,
+  USERINFO_URL, ACCOUNT_CONTEXT_URL, POLL_URL, REFRESH_URL, MODEL_SLICE,
+} from "./constants.js";
+
+function plainHeaders() {
+  return {
+    accept: "application/json, text/plain, */*",
+    "content-type": "application/json",
+    "user-agent": UA,
+  };
+}
+
+export function chatRequest(account, modelKey, bodyStr, signal, fetchImpl = compatFetch) {
+  const headers = signHeaders(account, bodyStr, CHAT_URL, modelKey, "text/event-stream");
+  return fetchImpl(CHAT_URL, { method: "POST", headers, body: bodyStr, signal });
+}
+
+export async function modelList(account, fetchImpl = compatFetch) {
+  const headers = signHeaders(account, "", MODELS_URL, "", "application/json");
+  const res = await fetchImpl(MODELS_URL, { headers });
+  if (!res.ok) throw new Error(`models http ${res.status}`);
+  const data = await res.json();
+  // 实测 11 个根切片只有 `qwork` 非空（其余 n=0）；切片名见 constants.MODEL_SLICE
+  const list = Array.isArray(data && data[MODEL_SLICE]) ? data[MODEL_SLICE] : [];
+  return list
+    .filter((m) => m && m.enable !== false && m.key)
+    .map((m) => ({
+      key: m.key,
+      name: m.display_name || m.key,
+      isReasoning: !!m.is_reasoning,
+      isVL: !!m.is_vl,
+      maxInputTokens: m.max_input_tokens || 0,
+      maxOutputTokens: m.max_output_tokens || 0,
+      priceFactor: typeof m.price_factor === "number" ? m.price_factor : 0,
+      description: typeof m.description === "string" ? m.description : "",
+    }));
+}
+
+export async function userInfo(accessToken, fetchImpl = compatFetch) {
+  const res = await fetchImpl(USERINFO_URL, {
+    headers: { ...plainHeaders(), authorization: `Bearer ${accessToken}` },
+  });
+  if (!res.ok) throw new Error(`userinfo http ${res.status}`);
+  return res.json();
+}
+
+/** 额度/套餐：data.{user,plan,quota}；quota.remaining 即积分余量。 */
+export async function accountContext(accessToken, fetchImpl = compatFetch) {
+  const res = await fetchImpl(ACCOUNT_CONTEXT_URL, {
+    headers: { ...plainHeaders(), authorization: `Bearer ${accessToken}` },
+  });
+  if (!res.ok) throw new Error(`account-context http ${res.status}`);
+  const body = await res.json();
+  if (!body || (body.code && body.code !== "ok")) throw new Error(`account-context code=${body && body.code}`);
+  return (body && body.data) || {};
+}
+
+export async function refreshDeviceToken(refreshToken, fetchImpl = compatFetch) {
+  const res = await fetchImpl(REFRESH_URL, {
+    method: "POST",
+    headers: plainHeaders(),
+    body: JSON.stringify({ refresh_token: refreshToken }),
+  });
+  if (!res.ok) throw new Error(`refresh http ${res.status}`);
+  const data = await res.json();
+  const access = data && (data.token || data.device_token);
+  if (!access || !data.refresh_token) throw new Error("refresh: incomplete token pair");
+  return data;
+}
+
+export async function pollGrant(nonce, verifier, fetchImpl = compatFetch) {
+  const q = new URLSearchParams({ nonce, verifier, challenge_method: "S256" });
+  const res = await fetchImpl(`${POLL_URL}?${q.toString()}`, {
+    headers: { accept: "application/json", "user-agent": UA },
+  });
+  if (res.status === 404 || res.status === 202) return { pending: true };
+  if (!res.ok) throw new Error(`poll http ${res.status}`);
+  const data = await res.json();
+  if (!data || !(data.token || data.device_token)) return { pending: true };
+  return { pending: false, grant: data };
+}
+
+export async function newDeviceFlow() {
+  const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~";
+  const raw = new Uint8Array(64);
+  crypto.getRandomValues(raw);
+  let verifier = "";
+  for (let i = 0; i < raw.length; i++) verifier += alphabet[raw[i] % alphabet.length];
+  const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", utf8(verifier)));
+  const challenge = b64url(digest);
+  const nonce = uuid();
+  const machineID = uuid();
+  const q = new URLSearchParams({
+    challenge,
+    challenge_method: "S256",
+    nonce,
+    machine_id: machineID,
+    client_id: CLIENT_ID,
+    redirect_uri: REDIRECT_URI,
+  });
+  return { verifier, nonce, url: `${DEVICE_AUTH_URL}?${q.toString()}` };
+}
+
+export function expiryUnix(grant) {
+  if (grant && grant.expires_at) {
+    const t = Date.parse(grant.expires_at);
+    if (!Number.isNaN(t)) return Math.floor(t / 1000);
+  }
+  if (grant && grant.expires_in > 0) {
+    const ms = grant.expires_in > 10000000 ? grant.expires_in : grant.expires_in * 1000;
+    return Math.floor((Date.now() + ms) / 1000);
+  }
+  return Math.floor((Date.now() + 30 * 24 * 3600 * 1000) / 1000);
+}

package/src/providers/qwenwork.js

@@ -1 +1 @@
-export * from "./qwenwork/index.js";
+export * from "./qwenwork/index.js";

package/src/providers/raccoon/const.js

@@ -44,6 +44,31 @@ export const raccoonQrPollUrl = () => `${RACCOON_ORIGIN}${RACCOON_IAM_PREFIX}/au
 /** 取消二维码（PUT，body `{ qrcode_code, status: "canceled" }`）——过期/离开页面时礼貌回收。 */
 export const raccoonQrCancelUrl = () => `${RACCOON_ORIGIN}${RACCOON_IAM_PREFIX}/auth/mp/qrcode`;
 
+/**
+ * 密码登录（手机号 + 密码）。**同一 IAM 族的明文端点**。
+ * ⚠ 官方前端（app.asar module 726xx → `loginWithPassword`）打的是旧 web 通道
+ *   `POST /api/web/auth/v1/login_with_password`，但那条**要求手机号加密**：
+ *   明文发送回 `400 100003 params_encryted_error: param phone encrypted error`。
+ *   本机实测 IAM 同族端点收**明文**三字段并直通业务校验（错密码回
+ *   `401 AUTH_ACCOUNT_OR_PASSWORD_INVALID`），故走这条 —— 不需要复刻官方加密公钥。
+ * body 契约（实测逐条确认）：`{ nation_code: "86", phone, password }`
+ *   · nation_code 必须是**字符串**（数字 86 与 `+86` 中的数字形式被判 body invalid；`"+86"` 字符串可用）
+ *   · 缺 nation_code / 空 phone / 空 password → `400 COMMON_INVALID_ARGUMENT`
+ * ⚠ 密码只在此处作为请求体出现，**绝不落盘、绝不进日志**。
+ */
+export const raccoonPasswordLoginUrl = () => `${RACCOON_ORIGIN}${RACCOON_IAM_PREFIX}/auth/login/password/phone`;
+
+/**
+ * 密码登录失败码 → 人话。命中即抛「可操作」的错误，未命中一律透出上游 message。
+ * 表里只放**实测见过**的码，不臆造（上游加了新码就走 default 兜底）。
+ */
+export const RACCOON_PASSWORD_ERRORS = {
+  AUTH_ACCOUNT_OR_PASSWORD_INVALID: "手机号或密码不正确",
+  AUTH_ACCOUNT_NOT_FOUND: "该手机号未注册过小浣熊（先去官网注册，或改用扫码登录）",
+  AUTH_ACCOUNT_LOCKED: "账号已被锁定，请到官网处理后再试",
+  COMMON_INVALID_ARGUMENT: "登录参数不完整（需要 国家码 + 手机号 + 密码）",
+};
+
 /**
  * 扫码登录深链接：终端编成二维码，**必须用微信「扫一扫」**打开确认。
  * code 与 scan_path 都由 `POST /auth/mp/qrcode` 下发（scan_path 实测为 `/login/mp`），

package/src/providers/raccoon/password-login.js

@@ -0,0 +1,87 @@
+// raccoon 密码登录（手机号 + 密码）—— 多账号自动化添加的捷径（免扫码）。
+// 契约与「为什么不用官方前端那条加密端点」见 const.js 的 raccoonPasswordLoginUrl 注释。
+//
+// ⚠ 安全红线：密码**只作为请求体出现一次**。本模块不落盘、不打印、不记日志；
+//   抛出的错误里也绝不带上请求体原文（上游 message 是它自己的文案，安全）。
+import {
+  RACCOON_PASSWORD_ERRORS,
+  RACCOON_REQUEST_TIMEOUT_MS,
+  raccoonPasswordLoginUrl,
+} from "./const.js";
+import { raccoonAnonymousHeaders } from "./headers.js";
+import { isRaccoonOk, parseRaccoonEnvelope, raccoonEnvelopeText } from "./envelope.js";
+import { decodeJwtExpMs } from "./auth.js";
+
+/** nation_code 归一：接受 `"86"` / `"+86"` / `86`，统一成不带加号的数字串。 */
+export function normalizeNationCode(raw) {
+  const s = String(raw ?? "").trim().replace(/^\+/, "");
+  return /^\d{1,4}$/.test(s) ? s : "";
+}
+
+/** 手机号归一：只留数字（去空格、连字符、括号）。空结果由调用方判错。 */
+export function normalizePhone(raw) {
+  return String(raw ?? "").replace(/[^\d]/g, "");
+}
+
+/** 上游登录失败 → 人话 Error。命中码表用它，否则透出上游 message（绝不带请求体）。 */
+function passwordLoginError(envelope, status) {
+  const key = String(envelope?.code ?? "");
+  const friendly = RACCOON_PASSWORD_ERRORS[key];
+  const err = new Error(`raccoon: 密码登录失败：${friendly || raccoonEnvelopeText(envelope, `HTTP ${status}`)}`);
+  err.code = envelope?.code;
+  err.status = status;
+  return err;
+}
+
+/**
+ * 手机号 + 密码 → credential（与扫码登录**同一形状**，可直接喂 saveRaccoonAccount）。
+ *
+ * 返回 `{ access_token, refresh_token, expires_at?, office_identity? }`；
+ * 失败抛「可操作」的错误（码表命中给人话，未命中透出上游文案）。
+ * 本地校验先于出网：手机号/密码为空当场报错，不白跑一次请求。
+ */
+export async function loginRaccoonWithPassword({ phone, password, nationCode = "86" } = {}, {
+  fetchImpl = fetch,
+  env = process.env,
+  timeoutMs = RACCOON_REQUEST_TIMEOUT_MS,
+} = {}) {
+  const nc = normalizeNationCode(nationCode);
+  const ph = normalizePhone(phone);
+  if (!nc) throw new Error("raccoon: 国家码不合法（用 86 这类数字，或 +86）");
+  if (!ph) throw new Error("raccoon: 手机号不能为空");
+  if (String(password ?? "").length === 0) throw new Error("raccoon: 密码不能为空");
+
+  let res;
+  try {
+    res = await fetchImpl(raccoonPasswordLoginUrl(), {
+      method: "POST",
+      headers: raccoonAnonymousHeaders({ env }),
+      body: JSON.stringify({ nation_code: nc, phone: ph, password: String(password) }),
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+  } catch (error) {
+    throw new Error(`raccoon: 密码登录请求失败：${error?.message ?? error}`);
+  }
+
+  let parsed;
+  try {
+    parsed = await res.json();
+  } catch {
+    throw new Error(`raccoon: 密码登录响应不是 JSON（HTTP ${res.status}）`);
+  }
+  const envelope = parseRaccoonEnvelope(parsed, res.status);
+  if (!isRaccoonOk(envelope)) throw passwordLoginError(envelope, res.status);
+
+  const data = envelope.data ?? {};
+  const accessToken = typeof data.access_token === "string" ? data.access_token : "";
+  if (!accessToken) throw new Error("raccoon: 密码登录响应缺少 access_token");
+  const refreshToken = typeof data.refresh_token === "string" ? data.refresh_token : "";
+  const officeIdentity = typeof data.office_identity === "string" ? data.office_identity : "";
+  const expMs = decodeJwtExpMs(accessToken);
+  return {
+    access_token: accessToken,
+    refresh_token: refreshToken,
+    ...(expMs === undefined ? {} : { expires_at: String(expMs) }),
+    ...(officeIdentity ? { office_identity: officeIdentity } : {}),
+  };
+}