qqmusic-api-enhanced 1.0.9 → 1.0.10

package/module/login_qr_check.d.ts

@@ -29,14 +29,21 @@ export declare function classifyLoginCode(code: number | undefined): {
     reason: LoginFailureReason;
     message: string;
 };
-/** 简易 Cookie 罐：处理空值/过期即删除，避免把已清除的 Cookie 当成有效值回传。 */
+/**
+ * 按域名隔离的 Cookie 罐，行为对齐浏览器。
+ *
+ * 登录网关会在同一次响应里给 `graph.qq.com` 下发 p_skey，再把 `qq.com` 的同名项清掉；
+ * 不分域名合并时，清除指令会连真票据一起删掉，后面的 OAuth 就没有 g_tk 可算。
+ */
 export declare class CookieJar {
-    private readonly values;
+    private readonly entries;
     constructor(initial?: Record<string, string>);
-    apply(setCookies: string[]): void;
-    get(key: string): string;
-    toObject(): Record<string, string>;
-    header(): string;
+    apply(setCookies: string[], requestHost?: string): void;
+    /** 目标主机能看到的 Cookie；同名时取域最具体的一项。 */
+    private visible;
+    get(name: string, host?: string): string;
+    toObject(host?: string): Record<string, string>;
+    header(host?: string): string;
 }
 /** 解析 ptqrlogin 的 `ptuiCB('码','…','URL','…','提示','昵称')` 回调。 */
 export declare function parsePtqrloginText(text: string): {

package/module/login_qr_check.js

@@ -7,6 +7,9 @@ const HTTP_TIMEOUT_MS = 12_000;
 /** 微信 lp 长轮询最长约 25s；留一点余量，超时按“还在等待”处理。 */
 const WX_LONG_POLL_TIMEOUT_MS = 30_000;
 const MAX_REDIRECT_HOPS = 4;
+const LOGIN_HOST = "ssl.ptlogin2.qq.com";
+const OAUTH_HOST = "graph.qq.com";
+const MUSIC_HOST = "u.y.qq.com";
 /** 业务码 → 失败原因。码表来自各登录入口的公开实现与实测（无效授权码返回 104400）。 */
 export function classifyLoginCode(code) {
     switch (code) {
@@ -37,41 +40,64 @@ const failure = (stage, message, extra = {}) => ({
         detail: extra.detail,
     },
 });
-/** 简易 Cookie 罐：处理空值/过期即删除，避免把已清除的 Cookie 当成有效值回传。 */
+/** Cookie 域是否覆盖目标主机：空域是构造时给的初始值，对所有主机生效。 */
+const domainCovers = (domain, host) => !domain || !host || host === domain || host.endsWith(`.${domain}`);
+/**
+ * 按域名隔离的 Cookie 罐，行为对齐浏览器。
+ *
+ * 登录网关会在同一次响应里给 `graph.qq.com` 下发 p_skey，再把 `qq.com` 的同名项清掉；
+ * 不分域名合并时，清除指令会连真票据一起删掉，后面的 OAuth 就没有 g_tk 可算。
+ */
 export class CookieJar {
-    values = new Map();
+    entries = new Map();
     constructor(initial = {}) {
-        for (const [key, value] of Object.entries(initial))
-            this.values.set(key, value);
+        for (const [name, value] of Object.entries(initial)) {
+            this.entries.set(`${name}\0`, { name, value, domain: "" });
+        }
     }
-    apply(setCookies) {
+    apply(setCookies, requestHost = "") {
         for (const line of setCookies) {
             const segments = line.split(";").map((part) => part.trim());
             const pair = segments[0] ?? "";
             const idx = pair.indexOf("=");
             if (idx <= 0)
                 continue;
-            const key = pair.slice(0, idx).trim();
+            const name = pair.slice(0, idx).trim();
             const value = pair.slice(idx + 1).trim();
             const attrs = segments.slice(1).map((part) => part.toLowerCase());
             const maxAge = attrs.find((part) => part.startsWith("max-age="));
             const expires = attrs.find((part) => part.startsWith("expires="));
+            const declared = attrs.find((part) => part.startsWith("domain="));
+            const domain = (declared?.slice(7) ?? requestHost).replace(/^\./, "");
+            const key = `${name}\0${domain}`;
             const expired = (maxAge !== undefined && Number(maxAge.slice(8)) <= 0) ||
                 (expires !== undefined && Date.parse(expires.slice(8)) < Date.now());
             if (!value || expired)
-                this.values.delete(key);
+                this.entries.delete(key);
             else
-                this.values.set(key, value);
+                this.entries.set(key, { name, value, domain });
         }
     }
-    get(key) {
-        return this.values.get(key) ?? "";
+    /** 目标主机能看到的 Cookie；同名时取域最具体的一项。 */
+    visible(host) {
+        const out = new Map();
+        for (const entry of this.entries.values()) {
+            if (!domainCovers(entry.domain, host))
+                continue;
+            const current = out.get(entry.name);
+            if (!current || entry.domain.length >= current.domain.length)
+                out.set(entry.name, entry);
+        }
+        return out;
+    }
+    get(name, host = "") {
+        return this.visible(host).get(name)?.value ?? "";
     }
-    toObject() {
-        return Object.fromEntries(this.values);
+    toObject(host = "") {
+        return Object.fromEntries([...this.visible(host)].map(([name, entry]) => [name, entry.value]));
     }
-    header() {
-        return cookieToString(this.toObject());
+    header(host = "") {
+        return cookieToString(this.toObject(host));
     }
 }
 const withTimeout = (ms) => AbortSignal.timeout(ms);
@@ -174,12 +200,12 @@ async function checkQq(query, fetchImpl, cgi) {
         const checkRes = await fetchImpl(checkUrl, {
             headers: {
                 Referer: "https://xui.ptlogin2.qq.com/",
-                Cookie: jar.header(),
+                Cookie: jar.header(LOGIN_HOST),
                 "User-Agent": BROWSER_UA,
             },
             signal: withTimeout(HTTP_TIMEOUT_MS),
         });
-        jar.apply(checkRes.headers.getSetCookie?.() || []);
+        jar.apply(checkRes.headers.getSetCookie?.() || [], LOGIN_HOST);
         text = await checkRes.text();
         if (checkRes.status >= 400) {
             return failure("ptqrlogin", `QQ 登录网关返回 HTTP ${checkRes.status}`, {
@@ -216,12 +242,13 @@ async function checkQq(query, fetchImpl, cgi) {
     let hops = 0;
     try {
         while (hopUrl && hops < MAX_REDIRECT_HOPS) {
+            const hopHost = new URL(hopUrl).hostname;
             const sigRes = await fetchImpl(hopUrl, {
                 redirect: "manual",
-                headers: { Cookie: jar.header(), "User-Agent": BROWSER_UA },
+                headers: { Cookie: jar.header(hopHost), "User-Agent": BROWSER_UA },
                 signal: withTimeout(HTTP_TIMEOUT_MS),
             });
-            jar.apply(sigRes.headers.getSetCookie?.() || []);
+            jar.apply(sigRes.headers.getSetCookie?.() || [], hopHost);
             const next = sigRes.headers.get("Location");
             hopUrl =
                 next && sigRes.status >= 300 && sigRes.status < 400 ? new URL(next, hopUrl).href : undefined;
@@ -231,7 +258,7 @@ async function checkQq(query, fetchImpl, cgi) {
     catch (error) {
         return failure("check_sig", `换取 QQ 登录票据失败: ${String(error)}`);
     }
-    const pSkey = jar.get("p_skey");
+    const pSkey = jar.get("p_skey", OAUTH_HOST);
     if (!pSkey) {
         return failure("check_sig", "QQ 登录票据缺少 p_skey，登录态未建立", {
             detail: { cookieNames: Object.keys(jar.toObject()).sort().join(",") },
@@ -261,7 +288,7 @@ async function checkQq(query, fetchImpl, cgi) {
             method: "POST",
             headers: {
                 "Content-Type": "application/x-www-form-urlencoded",
-                Cookie: jar.header(),
+                Cookie: jar.header(OAUTH_HOST),
                 "User-Agent": BROWSER_UA,
                 // 授权接口按浏览器表单提交校验来源：带上与官方页面一致的 Referer / Origin。
                 Referer: "https://graph.qq.com/oauth2.0/show",
@@ -287,8 +314,8 @@ async function checkQq(query, fetchImpl, cgi) {
     }
     // 3. 将 OAuth code 换取 QQ 音乐正式凭据（只保留音乐侧凭证，不带 ptlogin 的一堆 Cookie）。
     const loginCgiRes = await cgi("QQConnectLogin.LoginServer", "QQLogin", { code }, {
-        cookie: jar.toObject(),
-        headers: { Cookie: jar.header() },
+        cookie: jar.toObject(MUSIC_HOST),
+        headers: { Cookie: jar.header(MUSIC_HOST) },
     });
     return finishCgiLogin(loginCgiRes, guid, "qqlogin", "登录成功");
 }

package/module/login_qr_check.ts

@@ -48,6 +48,9 @@ const HTTP_TIMEOUT_MS = 12_000;
 /** 微信 lp 长轮询最长约 25s；留一点余量，超时按“还在等待”处理。 */
 const WX_LONG_POLL_TIMEOUT_MS = 30_000;
 const MAX_REDIRECT_HOPS = 4;
+const LOGIN_HOST = "ssl.ptlogin2.qq.com";
+const OAUTH_HOST = "graph.qq.com";
+const MUSIC_HOST = "u.y.qq.com";
 
 /** 业务码 → 失败原因。码表来自各登录入口的公开实现与实测（无效授权码返回 104400）。 */
 export function classifyLoginCode(code: number | undefined): {
@@ -88,43 +91,68 @@ const failure = (
   },
 });
 
-/** 简易 Cookie 罐：处理空值/过期即删除，避免把已清除的 Cookie 当成有效值回传。 */
+/** Cookie 域是否覆盖目标主机：空域是构造时给的初始值，对所有主机生效。 */
+const domainCovers = (domain: string, host: string): boolean =>
+  !domain || !host || host === domain || host.endsWith(`.${domain}`);
+
+/**
+ * 按域名隔离的 Cookie 罐，行为对齐浏览器。
+ *
+ * 登录网关会在同一次响应里给 `graph.qq.com` 下发 p_skey，再把 `qq.com` 的同名项清掉；
+ * 不分域名合并时，清除指令会连真票据一起删掉，后面的 OAuth 就没有 g_tk 可算。
+ */
 export class CookieJar {
-  private readonly values = new Map<string, string>();
+  private readonly entries = new Map<string, { name: string; value: string; domain: string }>();
 
   constructor(initial: Record<string, string> = {}) {
-    for (const [key, value] of Object.entries(initial)) this.values.set(key, value);
+    for (const [name, value] of Object.entries(initial)) {
+      this.entries.set(`${name}\0`, { name, value, domain: "" });
+    }
   }
 
-  apply(setCookies: string[]): void {
+  apply(setCookies: string[], requestHost = ""): void {
     for (const line of setCookies) {
       const segments = line.split(";").map((part) => part.trim());
       const pair = segments[0] ?? "";
       const idx = pair.indexOf("=");
       if (idx <= 0) continue;
-      const key = pair.slice(0, idx).trim();
+      const name = pair.slice(0, idx).trim();
       const value = pair.slice(idx + 1).trim();
       const attrs = segments.slice(1).map((part) => part.toLowerCase());
       const maxAge = attrs.find((part) => part.startsWith("max-age="));
       const expires = attrs.find((part) => part.startsWith("expires="));
+      const declared = attrs.find((part) => part.startsWith("domain="));
+      const domain = (declared?.slice(7) ?? requestHost).replace(/^\./, "");
+      const key = `${name}\0${domain}`;
       const expired =
         (maxAge !== undefined && Number(maxAge.slice(8)) <= 0) ||
         (expires !== undefined && Date.parse(expires.slice(8)) < Date.now());
-      if (!value || expired) this.values.delete(key);
-      else this.values.set(key, value);
+      if (!value || expired) this.entries.delete(key);
+      else this.entries.set(key, { name, value, domain });
     }
   }
 
-  get(key: string): string {
-    return this.values.get(key) ?? "";
+  /** 目标主机能看到的 Cookie；同名时取域最具体的一项。 */
+  private visible(host: string): Map<string, { value: string; domain: string }> {
+    const out = new Map<string, { value: string; domain: string }>();
+    for (const entry of this.entries.values()) {
+      if (!domainCovers(entry.domain, host)) continue;
+      const current = out.get(entry.name);
+      if (!current || entry.domain.length >= current.domain.length) out.set(entry.name, entry);
+    }
+    return out;
+  }
+
+  get(name: string, host = ""): string {
+    return this.visible(host).get(name)?.value ?? "";
   }
 
-  toObject(): Record<string, string> {
-    return Object.fromEntries(this.values);
+  toObject(host = ""): Record<string, string> {
+    return Object.fromEntries([...this.visible(host)].map(([name, entry]) => [name, entry.value]));
   }
 
-  header(): string {
-    return cookieToString(this.toObject());
+  header(host = ""): string {
+    return cookieToString(this.toObject(host));
   }
 }
 
@@ -235,12 +263,12 @@ async function checkQq(
     const checkRes = await fetchImpl(checkUrl, {
       headers: {
         Referer: "https://xui.ptlogin2.qq.com/",
-        Cookie: jar.header(),
+        Cookie: jar.header(LOGIN_HOST),
         "User-Agent": BROWSER_UA,
       },
       signal: withTimeout(HTTP_TIMEOUT_MS),
     });
-    jar.apply(checkRes.headers.getSetCookie?.() || []);
+    jar.apply(checkRes.headers.getSetCookie?.() || [], LOGIN_HOST);
     text = await checkRes.text();
     if (checkRes.status >= 400) {
       return failure("ptqrlogin", `QQ 登录网关返回 HTTP ${checkRes.status}`, {
@@ -278,12 +306,13 @@ async function checkQq(
   let hops = 0;
   try {
     while (hopUrl && hops < MAX_REDIRECT_HOPS) {
+      const hopHost: string = new URL(hopUrl).hostname;
       const sigRes: Response = await fetchImpl(hopUrl, {
         redirect: "manual",
-        headers: { Cookie: jar.header(), "User-Agent": BROWSER_UA },
+        headers: { Cookie: jar.header(hopHost), "User-Agent": BROWSER_UA },
         signal: withTimeout(HTTP_TIMEOUT_MS),
       });
-      jar.apply(sigRes.headers.getSetCookie?.() || []);
+      jar.apply(sigRes.headers.getSetCookie?.() || [], hopHost);
       const next: string | null = sigRes.headers.get("Location");
       hopUrl =
         next && sigRes.status >= 300 && sigRes.status < 400 ? new URL(next, hopUrl).href : undefined;
@@ -292,7 +321,7 @@ async function checkQq(
   } catch (error) {
     return failure("check_sig", `换取 QQ 登录票据失败: ${String(error)}`);
   }
-  const pSkey = jar.get("p_skey");
+  const pSkey = jar.get("p_skey", OAUTH_HOST);
   if (!pSkey) {
     return failure("check_sig", "QQ 登录票据缺少 p_skey，登录态未建立", {
       detail: { cookieNames: Object.keys(jar.toObject()).sort().join(",") },
@@ -324,7 +353,7 @@ async function checkQq(
       method: "POST",
       headers: {
         "Content-Type": "application/x-www-form-urlencoded",
-        Cookie: jar.header(),
+        Cookie: jar.header(OAUTH_HOST),
         "User-Agent": BROWSER_UA,
         // 授权接口按浏览器表单提交校验来源：带上与官方页面一致的 Referer / Origin。
         Referer: "https://graph.qq.com/oauth2.0/show",
@@ -349,8 +378,8 @@ async function checkQq(
 
   // 3. 将 OAuth code 换取 QQ 音乐正式凭据（只保留音乐侧凭证，不带 ptlogin 的一堆 Cookie）。
   const loginCgiRes = await cgi("QQConnectLogin.LoginServer", "QQLogin", { code }, {
-    cookie: jar.toObject(),
-    headers: { Cookie: jar.header() },
+    cookie: jar.toObject(MUSIC_HOST),
+    headers: { Cookie: jar.header(MUSIC_HOST) },
   });
   return finishCgiLogin(loginCgiRes, guid, "qqlogin", "登录成功");
 }

package/module/login_refresh.js

@@ -59,8 +59,8 @@ export default async function login_refresh(query = {}, req = request) {
         return true;
     };
     // 1. QQ 互联网页扫码：用旧 musickey 直接换新 key。签名与非签名各试一次，
-    //    不同部署/线路对 musics.fcg 的签名要求不一致。
-    for (const sign of [true, false]) {
+    //    不同部署/线路对 musics.fcg 的签名要求不一致。微信账号不走这条线。
+    for (const sign of loginType === "1" ? [] : [true, false]) {
         try {
             const refreshed = await tryRefresh("QQConnectLogin.LoginServer", "QQLogin", { expired_in: 7_776_000, musicid: uin, musickey }, { platform: "android", sign });
             if (refreshed) {
@@ -88,7 +88,8 @@ export default async function login_refresh(query = {}, req = request) {
             refresh_token: query.refresh_token || cookieObj.refresh_token || "",
             refresh_key: query.refresh_key || cookieObj.refresh_key || "",
             access_token: cookieObj.access_token || "",
-            musicid: Number(uin) || 0,
+            // 微信账号号超过安全整数：number 字段会被四舍五入，只传字符串字段。
+            musicid: Number.isSafeInteger(Number(uin)) ? Number(uin) : 0,
             str_musicid: uin,
             musickey,
             loginMode: 2,

package/module/login_refresh.ts

@@ -93,8 +93,8 @@ export default async function login_refresh(
   };
 
   // 1. QQ 互联网页扫码：用旧 musickey 直接换新 key。签名与非签名各试一次，
-  //    不同部署/线路对 musics.fcg 的签名要求不一致。
-  for (const sign of [true, false]) {
+  //    不同部署/线路对 musics.fcg 的签名要求不一致。微信账号不走这条线。
+  for (const sign of loginType === "1" ? [] : [true, false]) {
     try {
       const refreshed = await tryRefresh(
         "QQConnectLogin.LoginServer",
@@ -130,7 +130,8 @@ export default async function login_refresh(
         refresh_token: query.refresh_token || cookieObj.refresh_token || "",
         refresh_key: query.refresh_key || cookieObj.refresh_key || "",
         access_token: cookieObj.access_token || "",
-        musicid: Number(uin) || 0,
+        // 微信账号号超过安全整数：number 字段会被四舍五入，只传字符串字段。
+        musicid: Number.isSafeInteger(Number(uin)) ? Number(uin) : 0,
         str_musicid: uin,
         musickey,
         loginMode: 2,

package/module/login_status.js

@@ -24,7 +24,10 @@ export default async function login_status(query = {}, req = request) {
     const mergedCookies = { ...cookieObj, ...parseSetCookie(cgiRes.cookie || []) };
     const merged = mergeLoginPayloadCookies(mergedCookies, cgiRes.body);
     const userData = data.user || data.userInfo || data;
-    const isLogin = Boolean(data.code === 0 && (userData.uin || userData.encryptUin)) ||
+    // 现行响应把资料放在 `info`、顶层没有 uin；凭证失效时是不带资料的 `{ code: 1000 }`。
+    // 账号号已由登录写进 Cookie，这里只需要确认上游认可这份凭证并给出了资料。
+    const profile = (data.info || {});
+    const isLogin = Boolean(data.code === 0 && (userData.uin || userData.encryptUin || profile.nick || profile.logo)) ||
         Boolean(data.code === undefined && userData.uin);
     if (userData.uin) {
         uin = String(userData.uin).trim();
@@ -32,8 +35,8 @@ export default async function login_status(query = {}, req = request) {
     else if (!uin && userData.encryptUin) {
         uin = String(userData.encryptUin).trim();
     }
-    let nickname = userData.nick || userData.nickname || "";
-    let avatarUrl = userData.headurl || userData.avatar;
+    let nickname = userData.nick || userData.nickname || profile.nick || "";
+    let avatarUrl = userData.headurl || userData.avatar || profile.logo || undefined;
     // 并行获取用户主页资料与 VIP 信息（避免串行多次公网 RPC 导致进房等待过久）
     const needDetail = Boolean(uin && (!nickname || !avatarUrl));
     const needVip = Boolean(isLogin);

package/module/login_status.ts

@@ -65,8 +65,11 @@ export default async function login_status(
   const mergedCookies = { ...cookieObj, ...parseSetCookie(cgiRes.cookie || []) };
   const merged = mergeLoginPayloadCookies(mergedCookies, cgiRes.body);
   const userData = data.user || data.userInfo || data;
+  // 现行响应把资料放在 `info`、顶层没有 uin；凭证失效时是不带资料的 `{ code: 1000 }`。
+  // 账号号已由登录写进 Cookie，这里只需要确认上游认可这份凭证并给出了资料。
+  const profile = (data.info || {}) as any;
   const isLogin =
-    Boolean(data.code === 0 && (userData.uin || userData.encryptUin)) ||
+    Boolean(data.code === 0 && (userData.uin || userData.encryptUin || profile.nick || profile.logo)) ||
     Boolean(data.code === undefined && userData.uin);
 
   if (userData.uin) {
@@ -75,8 +78,8 @@ export default async function login_status(
     uin = String(userData.encryptUin).trim();
   }
 
-  let nickname = userData.nick || userData.nickname || "";
-  let avatarUrl: string | undefined = userData.headurl || userData.avatar;
+  let nickname = userData.nick || userData.nickname || profile.nick || "";
+  let avatarUrl: string | undefined = userData.headurl || userData.avatar || profile.logo || undefined;
 
   // 并行获取用户主页资料与 VIP 信息（避免串行多次公网 RPC 导致进房等待过久）
   const needDetail = Boolean(uin && (!nickname || !avatarUrl));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "qqmusic-api-enhanced",
-  "version": "1.0.9",
+  "version": "1.0.10",
   "description": "QQ音乐增强版API，支持扫码登录/凭证刷新/直链提取/歌词解密/歌单歌手检索 || QQ Music Enhanced API for Node.js & Bun",
   "type": "module",
   "main": "main.js",

package/util/cookie.js

@@ -49,6 +49,19 @@ const readText = (value) => {
         return String(value);
     return "";
 };
+/**
+ * 读账号号：微信账号是 19 位数字，超过 2^53，JSON 里的 number 已经丢了精度，
+ * 只有字符串字段才可信。写回被四舍五入的号，会让后续校验与续期都对不上账号。
+ */
+const readAccountId = (...values) => {
+    for (const value of values) {
+        if (typeof value === "string" && value.trim() && value.trim() !== "0")
+            return value.trim();
+        if (typeof value === "number" && Number.isSafeInteger(value) && value > 0)
+            return String(value);
+    }
+    return "";
+};
 /**
  * 把登录/续期响应里的凭证字段并入 Cookie。
  *
@@ -65,7 +78,7 @@ export function mergeLoginPayloadCookies(cookieObj, payload) {
         cookieObj.qqmusic_key = musickey;
         cookieObj.musickey = musickey;
     }
-    const musicid = readText(source.musicid ?? source.uin ?? source.str_musicid);
+    const musicid = readAccountId(source.str_musicid, source.musicid, source.uin);
     if (musicid) {
         cookieObj.uin = musicid;
         cookieObj.qqmusic_uin = musicid;

package/util/cookie.ts

@@ -55,6 +55,18 @@ const readText = (value: unknown): string => {
   return "";
 };
 
+/**
+ * 读账号号：微信账号是 19 位数字，超过 2^53，JSON 里的 number 已经丢了精度，
+ * 只有字符串字段才可信。写回被四舍五入的号，会让后续校验与续期都对不上账号。
+ */
+const readAccountId = (...values: unknown[]): string => {
+  for (const value of values) {
+    if (typeof value === "string" && value.trim() && value.trim() !== "0") return value.trim();
+    if (typeof value === "number" && Number.isSafeInteger(value) && value > 0) return String(value);
+  }
+  return "";
+};
+
 export interface LoginPayloadMergeResult {
   /** 本次响应是否给出了新的 musickey（决定续期成功与否）。 */
   obtainedMusickey: boolean;
@@ -83,7 +95,7 @@ export function mergeLoginPayloadCookies(
     cookieObj.musickey = musickey;
   }
 
-  const musicid = readText(source.musicid ?? source.uin ?? source.str_musicid);
+  const musicid = readAccountId(source.str_musicid, source.musicid, source.uin);
   if (musicid) {
     cookieObj.uin = musicid;
     cookieObj.qqmusic_uin = musicid;

package/util/option.js

@@ -55,6 +55,13 @@ export function createOption(query = {}, defaultPlatform = "web") {
         comm: query.comm,
     };
 }
+/** comm 里的 uin：超过安全整数的账号号（微信）只能按字符串传，转 number 会被四舍五入。 */
+const commUin = (uin) => {
+    const numeric = Number(uin);
+    if (!numeric)
+        return 0;
+    return Number.isSafeInteger(numeric) ? numeric : uin;
+};
 /**
  * 构建 CGI 请求所需的通用 comm 参数对象.
  */
@@ -78,7 +85,7 @@ export function buildComm(options) {
             ct: 19,
             cv: 2201,
             guid: options.guid,
-            uin: Number(options.uin) || 0,
+            uin: commUin(options.uin),
         };
     }
     else {
@@ -88,7 +95,7 @@ export function buildComm(options) {
             cv: 4747474,
             platform: "yqq.json",
             chid: "0",
-            uin: Number(options.uin) || 0,
+            uin: commUin(options.uin),
             g_tk: gTk,
             g_tk_new_20200303: gTk,
             format: "json",

package/util/option.ts

@@ -100,6 +100,13 @@ export function createOption(
   };
 }
 
+/** comm 里的 uin：超过安全整数的账号号（微信）只能按字符串传，转 number 会被四舍五入。 */
+const commUin = (uin: string): number | string => {
+  const numeric = Number(uin);
+  if (!numeric) return 0;
+  return Number.isSafeInteger(numeric) ? numeric : uin;
+};
+
 /**
  * 构建 CGI 请求所需的通用 comm 参数对象.
  */
@@ -123,7 +130,7 @@ export function buildComm(options: NormalizedOptions): Record<string, any> {
       ct: 19,
       cv: 2201,
       guid: options.guid,
-      uin: Number(options.uin) || 0,
+      uin: commUin(options.uin),
     };
   } else {
     // Web 平台
@@ -132,7 +139,7 @@ export function buildComm(options: NormalizedOptions): Record<string, any> {
       cv: 4747474,
       platform: "yqq.json",
       chid: "0",
-      uin: Number(options.uin) || 0,
+      uin: commUin(options.uin),
       g_tk: gTk,
       g_tk_new_20200303: gTk,
       format: "json",