mslxdff 0.1.203 → 0.1.208

package/src/providers/raccoon/models.js

@@ -1,160 +1,160 @@
-// raccoon 模型目录：上游 `model_catalog` 解析 + 兜底目录 + 积分倍率展示名 + allowlist 补齐。
-// 倍率是这家供应商的**成本唯一载体**（积分制，不是免费额度），所以它在模型名与列表里都必须出现：
-// 0 → 「免费」；1 → 也显示 `x1`（省略会让用户以为「没倍率＝不扣分」）；促销 → `x0.2→x0.1`。
-import {
-  RACCOON_FALLBACK_MODELS,
-  RACCOON_REQUEST_TIMEOUT_MS,
-  raccoonModelCatalogUrl,
-} from "./const.js";
-import { raccoonAuthHeaders } from "./headers.js";
-import { parseRaccoonEnvelope } from "./envelope.js";
-import { loadProviderAllowedModels, saveProviderAllowedModels } from "../../state/schemas/allowlist.js";
-import { joinModelId } from "../model-id.js";
-
-const pickString = (src, keys) => {
-  for (const k of keys) {
-    const v = src?.[k];
-    if (typeof v === "string" && v.trim().length > 0) return v.trim();
-  }
-  return "";
-};
-
-const pickNumber = (src, keys) => {
-  for (const k of keys) {
-    const v = src?.[k];
-    if (typeof v === "number" && Number.isFinite(v)) return v;
-    if (typeof v === "string" && /^-?\d+(\.\d+)?$/.test(v.trim())) return Number(v.trim());
-  }
-  return undefined;
-};
-
-const pickBool = (src, keys) => {
-  for (const k of keys) {
-    const v = src?.[k];
-    if (typeof v === "boolean") return v;
-  }
-  return undefined;
-};
-
-/** 兜底目录（const.js 的静态表，字段名已归一）。 */
-export function raccoonFallbackModels() {
-  return RACCOON_FALLBACK_MODELS.map((m) => ({ ...m }));
-}
-
-/** 单条目录条目：字段名容错（缺字段即省略，不猜、不填假值）。 */
-function parseRaccoonModelEntry(raw) {
-  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return null;
-  const id = pickString(raw, ["id", "modelId", "model_id", "modelName", "name"]);
-  if (!id) return null;
-  const model = { id };
-  const name = pickString(raw, ["modelName", "name", "displayName", "description"]);
-  if (name) model.name = name;
-  const ctx = pickNumber(raw, ["contextWindow", "context_window", "contextLength", "context_length"]);
-  if (ctx !== undefined && ctx > 0) model.contextWindow = ctx;
-  const maxTokens = pickNumber(raw, ["maxTokens", "max_tokens", "maxCompletionTokens"]);
-  if (maxTokens !== undefined && maxTokens > 0) model.maxTokens = maxTokens;
-  const img = pickBool(raw, ["supportsImage", "supports_image", "supportsVision"]);
-  if (img !== undefined) model.supportsImage = img;
-  const eff = pickNumber(raw, ["effectiveMultiplier", "effective_multiplier", "multiplier", "costMultiplier"]);
-  if (eff !== undefined && eff >= 0) model.multiplier = eff;
-  const base = pickNumber(raw, ["baseMultiplier", "base_multiplier"]);
-  if (base !== undefined && base > 0) model.baseMultiplier = base;
-  return model;
-}
-
-/** 目录信封 → 条目数组。兼容 `data` 为数组、`data.models`、`data.list`、`data.items` 四种形状。 */
-export function parseRaccoonCatalog(data) {
-  const list = Array.isArray(data)
-    ? data
-    : Array.isArray(data?.models)
-      ? data.models
-      : Array.isArray(data?.list)
-        ? data.list
-        : Array.isArray(data?.items)
-          ? data.items
-          : [];
-  const out = [];
-  const seen = new Set();
-  for (const raw of list) {
-    const m = parseRaccoonModelEntry(raw);
-    if (!m || seen.has(m.id)) continue;
-    seen.add(m.id);
-    out.push(m);
-  }
-  return out;
-}
-
-/** 倍率文案：0 → 免费；促销 → `x基→x实`；其余 → `x实`（含 x1）。 */
-export function raccoonMultiplierLabel(model) {
-  const eff = typeof model?.multiplier === "number" ? model.multiplier : undefined;
-  if (eff === undefined) return "";
-  if (eff === 0) return "免费";
-  const fmt = (v) => String(Number(v.toFixed(4)));
-  const base = typeof model?.baseMultiplier === "number" ? model.baseMultiplier : undefined;
-  if (base !== undefined && base > eff) return `x${fmt(base)}→x${fmt(eff)}`;
-  return `x${fmt(eff)}`;
-}
-
-/** 列表/模型卡展示名：`<名字或 id> · <倍率>`（无倍率时省略后缀）。 */
-export function raccoonDisplayName(model) {
-  const base = model?.name || model?.id || "";
-  const label = raccoonMultiplierLabel(model);
-  return label ? `${base} · ${label}` : base;
-}
-
-/** 拉上游目录；失败/空目录返回 null（调用方回落兜底表）。 */
-export async function fetchRaccoonModelCatalog({
-  credential,
-  fetchImpl = fetch,
-  env = process.env,
-  timeoutMs = RACCOON_REQUEST_TIMEOUT_MS,
-} = {}) {
-  if (!credential?.access_token) return null;
-  try {
-    const res = await fetchImpl(raccoonModelCatalogUrl(), {
-      method: "GET",
-      headers: raccoonAuthHeaders(credential, { env }),
-      signal: AbortSignal.timeout(timeoutMs),
-    });
-    if (!res.ok) return null;
-    const envelope = parseRaccoonEnvelope(await res.json(), res.status);
-    if (envelope.code !== 0) return null;
-    const models = parseRaccoonCatalog(envelope.data);
-    return models.length > 0 ? models : null;
-  } catch {
-    return null;
-  }
-}
-
-/** 上游优先、兜底次之。返回 `{ models, source }`，source ∈ upstream|fallback。 */
-export async function listRaccoonModels({ credential, fetchImpl, env } = {}) {
-  const upstream = await fetchRaccoonModelCatalog({ credential, fetchImpl, env });
-  if (upstream) return { models: upstream, source: "upstream" };
-  return { models: raccoonFallbackModels(), source: "fallback" };
-}
-
-/** 登录后把兜底目录 id 只增不减并入 allowlist（避免「登录成功却处处 403」）。 */
-export function seedRaccoonAllowlist({ ids, file } = {}) {
-  const opts = file ? { file } : {};
-  const target = ids || RACCOON_FALLBACK_MODELS.map((m) => m.id);
-  const cur = loadProviderAllowedModels("raccoon", opts);
-  const added = target.filter((m) => !cur.includes(m));
-  if (added.length) saveProviderAllowedModels("raccoon", [...cur, ...added], opts);
-  return { allowed: [...cur, ...added], added };
-}
-
-/** 对外目录条目（`/v1/models` 与 CLI models 共用形状）。 */
-export function buildRaccoonModelList({ id = "raccoon", models } = {}) {
-  const list = models || raccoonFallbackModels();
-  return list.map((m) => ({
-    id: joinModelId(id, m.id),
-    object: "model",
-    owned_by: "raccoon",
-    name: raccoonDisplayName(m),
-    context_length: m.contextWindow,
-    max_tokens: m.maxTokens,
-    supports_image: m.supportsImage,
-    multiplier: m.multiplier,
-    mark: raccoonMultiplierLabel(m) || undefined,
-  }));
-}
+// raccoon 模型目录：上游 `model_catalog` 解析 + 兜底目录 + 积分倍率展示名 + allowlist 补齐。
+// 倍率是这家供应商的**成本唯一载体**（积分制，不是免费额度），所以它在模型名与列表里都必须出现：
+// 0 → 「免费」；1 → 也显示 `x1`（省略会让用户以为「没倍率＝不扣分」）；促销 → `x0.2→x0.1`。
+import {
+  RACCOON_FALLBACK_MODELS,
+  RACCOON_REQUEST_TIMEOUT_MS,
+  raccoonModelCatalogUrl,
+} from "./const.js";
+import { raccoonAuthHeaders } from "./headers.js";
+import { parseRaccoonEnvelope } from "./envelope.js";
+import { loadProviderAllowedModels, saveProviderAllowedModels } from "../../state/schemas/allowlist.js";
+import { joinModelId } from "../model-id.js";
+
+const pickString = (src, keys) => {
+  for (const k of keys) {
+    const v = src?.[k];
+    if (typeof v === "string" && v.trim().length > 0) return v.trim();
+  }
+  return "";
+};
+
+const pickNumber = (src, keys) => {
+  for (const k of keys) {
+    const v = src?.[k];
+    if (typeof v === "number" && Number.isFinite(v)) return v;
+    if (typeof v === "string" && /^-?\d+(\.\d+)?$/.test(v.trim())) return Number(v.trim());
+  }
+  return undefined;
+};
+
+const pickBool = (src, keys) => {
+  for (const k of keys) {
+    const v = src?.[k];
+    if (typeof v === "boolean") return v;
+  }
+  return undefined;
+};
+
+/** 兜底目录（const.js 的静态表，字段名已归一）。 */
+export function raccoonFallbackModels() {
+  return RACCOON_FALLBACK_MODELS.map((m) => ({ ...m }));
+}
+
+/** 单条目录条目：字段名容错（缺字段即省略，不猜、不填假值）。 */
+function parseRaccoonModelEntry(raw) {
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return null;
+  const id = pickString(raw, ["id", "modelId", "model_id", "modelName", "name"]);
+  if (!id) return null;
+  const model = { id };
+  const name = pickString(raw, ["modelName", "name", "displayName", "description"]);
+  if (name) model.name = name;
+  const ctx = pickNumber(raw, ["contextWindow", "context_window", "contextLength", "context_length"]);
+  if (ctx !== undefined && ctx > 0) model.contextWindow = ctx;
+  const maxTokens = pickNumber(raw, ["maxTokens", "max_tokens", "maxCompletionTokens"]);
+  if (maxTokens !== undefined && maxTokens > 0) model.maxTokens = maxTokens;
+  const img = pickBool(raw, ["supportsImage", "supports_image", "supportsVision"]);
+  if (img !== undefined) model.supportsImage = img;
+  const eff = pickNumber(raw, ["effectiveMultiplier", "effective_multiplier", "multiplier", "costMultiplier"]);
+  if (eff !== undefined && eff >= 0) model.multiplier = eff;
+  const base = pickNumber(raw, ["baseMultiplier", "base_multiplier"]);
+  if (base !== undefined && base > 0) model.baseMultiplier = base;
+  return model;
+}
+
+/** 目录信封 → 条目数组。兼容 `data` 为数组、`data.models`、`data.list`、`data.items` 四种形状。 */
+export function parseRaccoonCatalog(data) {
+  const list = Array.isArray(data)
+    ? data
+    : Array.isArray(data?.models)
+      ? data.models
+      : Array.isArray(data?.list)
+        ? data.list
+        : Array.isArray(data?.items)
+          ? data.items
+          : [];
+  const out = [];
+  const seen = new Set();
+  for (const raw of list) {
+    const m = parseRaccoonModelEntry(raw);
+    if (!m || seen.has(m.id)) continue;
+    seen.add(m.id);
+    out.push(m);
+  }
+  return out;
+}
+
+/** 倍率文案：0 → 免费；促销 → `x基→x实`；其余 → `x实`（含 x1）。 */
+export function raccoonMultiplierLabel(model) {
+  const eff = typeof model?.multiplier === "number" ? model.multiplier : undefined;
+  if (eff === undefined) return "";
+  if (eff === 0) return "免费";
+  const fmt = (v) => String(Number(v.toFixed(4)));
+  const base = typeof model?.baseMultiplier === "number" ? model.baseMultiplier : undefined;
+  if (base !== undefined && base > eff) return `x${fmt(base)}→x${fmt(eff)}`;
+  return `x${fmt(eff)}`;
+}
+
+/** 列表/模型卡展示名：`<名字或 id> · <倍率>`（无倍率时省略后缀）。 */
+export function raccoonDisplayName(model) {
+  const base = model?.name || model?.id || "";
+  const label = raccoonMultiplierLabel(model);
+  return label ? `${base} · ${label}` : base;
+}
+
+/** 拉上游目录；失败/空目录返回 null（调用方回落兜底表）。 */
+export async function fetchRaccoonModelCatalog({
+  credential,
+  fetchImpl = fetch,
+  env = process.env,
+  timeoutMs = RACCOON_REQUEST_TIMEOUT_MS,
+} = {}) {
+  if (!credential?.access_token) return null;
+  try {
+    const res = await fetchImpl(raccoonModelCatalogUrl(), {
+      method: "GET",
+      headers: raccoonAuthHeaders(credential, { env }),
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+    if (!res.ok) return null;
+    const envelope = parseRaccoonEnvelope(await res.json(), res.status);
+    if (envelope.code !== 0) return null;
+    const models = parseRaccoonCatalog(envelope.data);
+    return models.length > 0 ? models : null;
+  } catch {
+    return null;
+  }
+}
+
+/** 上游优先、兜底次之。返回 `{ models, source }`，source ∈ upstream|fallback。 */
+export async function listRaccoonModels({ credential, fetchImpl, env } = {}) {
+  const upstream = await fetchRaccoonModelCatalog({ credential, fetchImpl, env });
+  if (upstream) return { models: upstream, source: "upstream" };
+  return { models: raccoonFallbackModels(), source: "fallback" };
+}
+
+/** 登录后把兜底目录 id 只增不减并入 allowlist（避免「登录成功却处处 403」）。 */
+export function seedRaccoonAllowlist({ ids, file } = {}) {
+  const opts = file ? { file } : {};
+  const target = ids || RACCOON_FALLBACK_MODELS.map((m) => m.id);
+  const cur = loadProviderAllowedModels("raccoon", opts);
+  const added = target.filter((m) => !cur.includes(m));
+  if (added.length) saveProviderAllowedModels("raccoon", [...cur, ...added], opts);
+  return { allowed: [...cur, ...added], added };
+}
+
+/** 对外目录条目（`/v1/models` 与 CLI models 共用形状）。 */
+export function buildRaccoonModelList({ id = "raccoon", models } = {}) {
+  const list = models || raccoonFallbackModels();
+  return list.map((m) => ({
+    id: joinModelId(id, m.id),
+    object: "model",
+    owned_by: "raccoon",
+    name: raccoonDisplayName(m),
+    context_length: m.contextWindow,
+    max_tokens: m.maxTokens,
+    supports_image: m.supportsImage,
+    multiplier: m.multiplier,
+    mark: raccoonMultiplierLabel(m) || undefined,
+  }));
+}

package/src/providers/raccoon/password-login.js

@@ -1,102 +1,102 @@
-// raccoon 密码登录（手机号 + 密码）—— 多账号自动化添加的捷径（免扫码）。
-// 契约、端点选择理由与「为什么必须加密」见 const.js 的 raccoonPasswordLoginUrl 注释；
-// 加密算法与 key 见 crypto.js（单一源）。
-//
-// ⚠ 安全红线：密码**只作为请求体出现一次**（且出站前已被加密）。本模块不落盘、不打印、不记日志；
-//   抛出的错误里也绝不带上请求体原文（上游 message 是它自己的文案，安全）。
-import {
-  RACCOON_PASSWORD_ERRORS,
-  RACCOON_REQUEST_TIMEOUT_MS,
-  raccoonPasswordLoginUrl,
-} from "./const.js";
-import { raccoonAnonymousHeaders } from "./headers.js";
-import { isRaccoonOk, parseRaccoonEnvelope, raccoonEnvelopeText } from "./envelope.js";
-import { decodeJwtExpMs } from "./auth.js";
-import { raccoonEncryptField } from "./crypto.js";
-
-/** nation_code 归一：接受 `"86"` / `"+86"` / `86`，统一成不带加号的数字串。 */
-export function normalizeNationCode(raw) {
-  const s = String(raw ?? "").trim().replace(/^\+/, "");
-  return /^\d{1,4}$/.test(s) ? s : "";
-}
-
-/** 手机号归一：只留数字（去空格、连字符、括号）。空结果由调用方判错。 */
-export function normalizePhone(raw) {
-  return String(raw ?? "").replace(/[^\d]/g, "");
-}
-
-/** 上游登录失败 → 人话 Error。命中码表用它，否则透出上游 message（绝不带请求体）。 */
-function passwordLoginError(envelope, status) {
-  const key = String(envelope?.code ?? "");
-  const friendly = RACCOON_PASSWORD_ERRORS[key];
-  const err = new Error(`raccoon: 密码登录失败：${friendly || raccoonEnvelopeText(envelope, `HTTP ${status}`)}`);
-  err.code = envelope?.code;
-  err.status = status;
-  return err;
-}
-
-/**
- * 手机号 + 密码 → credential（与扫码登录**同一形状**，可直接喂 saveRaccoonAccount）。
- *
- * 返回 `{ access_token, refresh_token, expires_at?, office_identity? }`；
- * 失败抛「可操作」的错误（码表命中给人话，未命中透出上游文案）。
- * 本地校验先于出网：手机号/密码为空当场报错，不白跑一次请求。
- *
- * ⚠ 出站前 phone/password 都经 `raccoonEncryptField` 加密（上游契约，见 const.js）——
- *   发明文只会换来一句「手机号或密码不正确」，把格式错误伪装成密码错误。
- */
-export async function loginRaccoonWithPassword({ phone, password, nationCode = "86" } = {}, {
-  fetchImpl = fetch,
-  env = process.env,
-  timeoutMs = RACCOON_REQUEST_TIMEOUT_MS,
-} = {}) {
-  const nc = normalizeNationCode(nationCode);
-  const ph = normalizePhone(phone);
-  if (!nc) throw new Error("raccoon: 国家码不合法（用 86 这类数字，或 +86）");
-  if (!ph) throw new Error("raccoon: 手机号不能为空");
-  if (String(password ?? "").length === 0) throw new Error("raccoon: 密码不能为空");
-
-  // 未知错误码时透出上游 message 而非裸码 —— 上游新旧通道对同一错误的形态不同：
-  // 新 IAM 把 message 放顶层（AUTH_ACCOUNT_OR_PASSWORD_INVALID），旧 web 只有 message/details。
-  const body = {
-    nation_code: nc,
-    phone: raccoonEncryptField(ph),
-    password: raccoonEncryptField(String(password)),
-  };
-
-  let res;
-  try {
-    res = await fetchImpl(raccoonPasswordLoginUrl(), {
-      method: "POST",
-      headers: raccoonAnonymousHeaders({ env }),
-      body: JSON.stringify(body),
-      signal: AbortSignal.timeout(timeoutMs),
-    });
-  } catch (error) {
-    throw new Error(`raccoon: 密码登录请求失败：${error?.message ?? error}`);
-  }
-
-  let parsed;
-  try {
-    parsed = await res.json();
-  } catch {
-    throw new Error(`raccoon: 密码登录响应不是 JSON（HTTP ${res.status}）`);
-  }
-  const envelope = parseRaccoonEnvelope(parsed, res.status);
-  // 上游把错误码同时塞在 `code` 与 `message`：web 通道 `{code:"AUTH_...",message:"AUTH_..."}`
-  // 时 message 是裸码，不能当人话用 —— 故这里把 code 也纳入，让码表能命中。
-  if (!isRaccoonOk(envelope)) throw passwordLoginError(envelope, res.status);
-
-  const data = envelope.data ?? {};
-  const accessToken = typeof data.access_token === "string" ? data.access_token : "";
-  if (!accessToken) throw new Error("raccoon: 密码登录响应缺少 access_token");
-  const refreshToken = typeof data.refresh_token === "string" ? data.refresh_token : "";
-  const officeIdentity = typeof data.office_identity === "string" ? data.office_identity : "";
-  const expMs = decodeJwtExpMs(accessToken);
-  return {
-    access_token: accessToken,
-    refresh_token: refreshToken,
-    ...(expMs === undefined ? {} : { expires_at: String(expMs) }),
-    ...(officeIdentity ? { office_identity: officeIdentity } : {}),
-  };
-}
+// raccoon 密码登录（手机号 + 密码）—— 多账号自动化添加的捷径（免扫码）。
+// 契约、端点选择理由与「为什么必须加密」见 const.js 的 raccoonPasswordLoginUrl 注释；
+// 加密算法与 key 见 crypto.js（单一源）。
+//
+// ⚠ 安全红线：密码**只作为请求体出现一次**（且出站前已被加密）。本模块不落盘、不打印、不记日志；
+//   抛出的错误里也绝不带上请求体原文（上游 message 是它自己的文案，安全）。
+import {
+  RACCOON_PASSWORD_ERRORS,
+  RACCOON_REQUEST_TIMEOUT_MS,
+  raccoonPasswordLoginUrl,
+} from "./const.js";
+import { raccoonAnonymousHeaders } from "./headers.js";
+import { isRaccoonOk, parseRaccoonEnvelope, raccoonEnvelopeText } from "./envelope.js";
+import { decodeJwtExpMs } from "./auth.js";
+import { raccoonEncryptField } from "./crypto.js";
+
+/** nation_code 归一：接受 `"86"` / `"+86"` / `86`，统一成不带加号的数字串。 */
+export function normalizeNationCode(raw) {
+  const s = String(raw ?? "").trim().replace(/^\+/, "");
+  return /^\d{1,4}$/.test(s) ? s : "";
+}
+
+/** 手机号归一：只留数字（去空格、连字符、括号）。空结果由调用方判错。 */
+export function normalizePhone(raw) {
+  return String(raw ?? "").replace(/[^\d]/g, "");
+}
+
+/** 上游登录失败 → 人话 Error。命中码表用它，否则透出上游 message（绝不带请求体）。 */
+function passwordLoginError(envelope, status) {
+  const key = String(envelope?.code ?? "");
+  const friendly = RACCOON_PASSWORD_ERRORS[key];
+  const err = new Error(`raccoon: 密码登录失败：${friendly || raccoonEnvelopeText(envelope, `HTTP ${status}`)}`);
+  err.code = envelope?.code;
+  err.status = status;
+  return err;
+}
+
+/**
+ * 手机号 + 密码 → credential（与扫码登录**同一形状**，可直接喂 saveRaccoonAccount）。
+ *
+ * 返回 `{ access_token, refresh_token, expires_at?, office_identity? }`；
+ * 失败抛「可操作」的错误（码表命中给人话，未命中透出上游文案）。
+ * 本地校验先于出网：手机号/密码为空当场报错，不白跑一次请求。
+ *
+ * ⚠ 出站前 phone/password 都经 `raccoonEncryptField` 加密（上游契约，见 const.js）——
+ *   发明文只会换来一句「手机号或密码不正确」，把格式错误伪装成密码错误。
+ */
+export async function loginRaccoonWithPassword({ phone, password, nationCode = "86" } = {}, {
+  fetchImpl = fetch,
+  env = process.env,
+  timeoutMs = RACCOON_REQUEST_TIMEOUT_MS,
+} = {}) {
+  const nc = normalizeNationCode(nationCode);
+  const ph = normalizePhone(phone);
+  if (!nc) throw new Error("raccoon: 国家码不合法（用 86 这类数字，或 +86）");
+  if (!ph) throw new Error("raccoon: 手机号不能为空");
+  if (String(password ?? "").length === 0) throw new Error("raccoon: 密码不能为空");
+
+  // 未知错误码时透出上游 message 而非裸码 —— 上游新旧通道对同一错误的形态不同：
+  // 新 IAM 把 message 放顶层（AUTH_ACCOUNT_OR_PASSWORD_INVALID），旧 web 只有 message/details。
+  const body = {
+    nation_code: nc,
+    phone: raccoonEncryptField(ph),
+    password: raccoonEncryptField(String(password)),
+  };
+
+  let res;
+  try {
+    res = await fetchImpl(raccoonPasswordLoginUrl(), {
+      method: "POST",
+      headers: raccoonAnonymousHeaders({ env }),
+      body: JSON.stringify(body),
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+  } catch (error) {
+    throw new Error(`raccoon: 密码登录请求失败：${error?.message ?? error}`);
+  }
+
+  let parsed;
+  try {
+    parsed = await res.json();
+  } catch {
+    throw new Error(`raccoon: 密码登录响应不是 JSON（HTTP ${res.status}）`);
+  }
+  const envelope = parseRaccoonEnvelope(parsed, res.status);
+  // 上游把错误码同时塞在 `code` 与 `message`：web 通道 `{code:"AUTH_...",message:"AUTH_..."}`
+  // 时 message 是裸码，不能当人话用 —— 故这里把 code 也纳入，让码表能命中。
+  if (!isRaccoonOk(envelope)) throw passwordLoginError(envelope, res.status);
+
+  const data = envelope.data ?? {};
+  const accessToken = typeof data.access_token === "string" ? data.access_token : "";
+  if (!accessToken) throw new Error("raccoon: 密码登录响应缺少 access_token");
+  const refreshToken = typeof data.refresh_token === "string" ? data.refresh_token : "";
+  const officeIdentity = typeof data.office_identity === "string" ? data.office_identity : "";
+  const expMs = decodeJwtExpMs(accessToken);
+  return {
+    access_token: accessToken,
+    refresh_token: refreshToken,
+    ...(expMs === undefined ? {} : { expires_at: String(expMs) }),
+    ...(officeIdentity ? { office_identity: officeIdentity } : {}),
+  };
+}