specific-ai-cli 0.0.0-stage → 0.1.1

package/dist/platforms/jd/web/aks.js

@@ -0,0 +1,115 @@
+import { createCipheriv, createDecipheriv, createHash } from 'node:crypto';
+import * as rand from '../../../core/rand.js';
+/**
+ * passport 的 AKS 加密（上游 utils/aks.py，与登录页 aks.js / summer-cryptico 一致）：
+ * `base64(公钥头 || SM2(C1C3C2, sm4Key) || iv || SM4-CBC(query))`。
+ * SM2 的实现照 gmssl（随机数 k 用 64 个十六进制字符），SM3 / SM4 用 node 自带的 OpenSSL。
+ */
+const P = BigInt('0xFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000000FFFFFFFFFFFFFFFF');
+const A = BigInt('0xFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000000FFFFFFFFFFFFFFFC');
+const G = [
+    BigInt('0x32c4ae2c1f1981195f9904466a39c9948fe30bbff2660be1715a4589334c74c7'),
+    BigInt('0xbc3736a2f4f6779c59bdcee36b692153d0a9877cc62a474002df32e52139f0a0'),
+];
+const mod = (x) => ((x % P) + P) % P;
+function inv(x) {
+    let [a, b, u, v] = [mod(x), P, 1n, 0n];
+    while (a !== 0n) {
+        const q = b / a;
+        [a, b] = [b - q * a, a];
+        [u, v] = [v - q * u, u];
+    }
+    return mod(v);
+}
+function add(p, q) {
+    if (!p)
+        return q;
+    if (!q)
+        return p;
+    if (p[0] === q[0]) {
+        if (mod(p[1] + q[1]) === 0n)
+            return null;
+        const l = mod((3n * p[0] * p[0] + A) * inv(2n * p[1]));
+        const x = mod(l * l - 2n * p[0]);
+        return [x, mod(l * (p[0] - x) - p[1])];
+    }
+    const l = mod((q[1] - p[1]) * inv(q[0] - p[0]));
+    const x = mod(l * l - p[0] - q[0]);
+    return [x, mod(l * (p[0] - x) - p[1])];
+}
+function mul(k, p) {
+    let r = null;
+    let q = p;
+    while (k > 0n) {
+        if (k & 1n)
+            r = add(r, q);
+        q = add(q, q);
+        k >>= 1n;
+    }
+    return r;
+}
+const hex64 = (n) => n.toString(16).padStart(64, '0');
+const sm3 = (data) => createHash('sm3').update(data).digest();
+function kdf(z, klen) {
+    const out = [];
+    for (let ct = 1; out.length * 32 < klen; ct++) {
+        const c = Buffer.alloc(4);
+        c.writeUInt32BE(ct);
+        out.push(sm3(Buffer.concat([z, c])));
+    }
+    return Buffer.concat(out).subarray(0, klen);
+}
+/** gmssl `CryptSM2(public_key=pubHex, mode=1).encrypt(data)`：C1(64) || C3(32) || C2。 */
+export function sm2Encrypt(publicHex, data) {
+    const pub = [BigInt('0x' + publicHex.slice(0, 64)), BigInt('0x' + publicHex.slice(64, 128))];
+    const k = BigInt('0x' + rand.string(64, '0123456789abcdef'));
+    const c1 = mul(k, G);
+    const s = mul(k, pub);
+    const x2 = Buffer.from(hex64(s[0]), 'hex');
+    const y2 = Buffer.from(hex64(s[1]), 'hex');
+    const t = kdf(Buffer.concat([x2, y2]), data.length);
+    const c2 = Buffer.from(data.map((b, i) => b ^ t[i]));
+    const c3 = sm3(Buffer.concat([x2, Buffer.from(data), y2]));
+    return Buffer.concat([Buffer.from(hex64(c1[0]) + hex64(c1[1]), 'hex'), c3, c2]);
+}
+export function sm4Encrypt(data, key, iv) {
+    const c = createCipheriv('sm4-cbc', key, iv);
+    return Buffer.concat([c.update(data), c.final()]);
+}
+export function sm4Decrypt(data, key, iv) {
+    const d = createDecipheriv('sm4-cbc', key, iv);
+    return Buffer.concat([d.update(data), d.final()]);
+}
+const STORAGE_KEY = Buffer.from('6c3d6878252e641b');
+const STORAGE_IV = Buffer.from('5f5e5a247f544d771255134517043757', 'hex');
+/** summer-cryptico 的 randomUnit8Array(1, 127, n)。 */
+const randomUnits = (n) => Uint8Array.from({ length: n }, () => Math.floor(rand.random() * 127) + 1);
+function loadSm4Key(state) {
+    try {
+        if (state.aksKey) {
+            const plain = sm4Decrypt(Buffer.from(state.aksKey, 'hex'), STORAGE_KEY, STORAGE_IV).toString('utf8');
+            if (/^[0-9a-f]{16}$/.test(plain))
+                return plain;
+        }
+    }
+    catch { }
+    const key = Buffer.from(randomUnits(8)).toString('hex');
+    state.aksKey = sm4Encrypt(Buffer.from(key, 'utf8'), STORAGE_KEY, STORAGE_IV).toString('hex');
+    return key;
+}
+/** 把 jQuery 编码后的 query 串加密成 aksParamsU / aksParamsB（encrypt_query）。 */
+export function encryptQuery(query, publicKeyB64, state) {
+    if (!query)
+        throw new Error('AKS query cannot be empty');
+    const raw = Buffer.from(publicKeyB64, 'base64');
+    if (raw.length < 65)
+        throw new Error('passport publicKey/init 返回值长度不足');
+    const header = raw.subarray(0, raw.length - 65);
+    const pub = raw.subarray(raw.length - 65);
+    const publicHex = pub[0] === 4 ? pub.subarray(1).toString('hex') : pub.toString('hex');
+    const sm4Key = loadSm4Key(state);
+    const iv = randomUnits(16);
+    const sm2 = sm2Encrypt(publicHex, Buffer.from(sm4Key, 'utf8'));
+    const sm4 = sm4Encrypt(Buffer.from(query, 'utf8'), Buffer.from(sm4Key, 'utf8'), iv);
+    return Buffer.concat([header, sm2, iv, sm4]).toString('base64');
+}

package/dist/platforms/jd/web/api.js

@@ -0,0 +1,549 @@
+import { parseJsonp } from '../../../core/http.js';
+import { unescapeHtml } from '../../../core/normalize.js';
+import { jsonLoads, quote, urlencode } from '../../../core/py.js';
+import * as rand from '../../../core/rand.js';
+import { searchReferer } from './client.js';
+import { solveCaptcha } from './jcap.js';
+import { API_URL, APPID_DONGDONG, APPID_PC_ITEM, APPID_PC_SEARCH, basic, CHAT_ORIGIN, CHAT_REFERER, CLIENT_IMH5, CLIENT_PC_ITEM, CLIENT_PC_ITEM_V3, CLIENT_PC_SEARCH, CLIENT_WH5, ITEM_ORIGIN, ITEM_REFERER, ORDER_DD_NO_TIME, ORDER_DD_WITH_TIME, ORDER_PC_API, ORDER_PC_ITEM, ORDER_PC_ITEM_RELWORDS, ORDER_PC_SEARCH, ORDER_PC_SEARCH_PLAIN, ORDER_PC_SEARCH_RELWORDS, ORDER_URL, orderDoc, RP_CLIENT_CHAT, RP_CLIENT_ITEM, RP_CLIENT_SEARCH, SEARCH_ORIGIN, xhr, } from './profile.js';
+import { areaOf, ITEM_URL_SKU, searchUuidOf, stripTags } from './util.js';
+import { buildSearchPayload } from './webm.js';
+/**
+ * 上游 jd_apis/jd_api.py 的 JdAPI，一个函数对应一个上游方法，字段与顺序照抄（对拍测试逐字节比较）。
+ * 返回平台原始 JSON。
+ */
+/** 免签名的纯查询接口在浏览器里不带这两个参数。 */
+const UNSIGNED_DROP = ['loginType', 'x-api-eid-token'];
+const itemPage = (sku) => (sku ? `https://item.jd.com/${sku}.html` : ITEM_REFERER);
+// ================================================================ 会话活性
+/** passport 的免签名探测（check_session）：返回 [alive, 昵称或说明]，以及原始响应。 */
+export async function checkSession(jd) {
+    const h = basic('JSONP').referer('https://www.jd.com/');
+    const res = await jd.send({
+        url: 'https://passport.jd.com/loginservice.aspx',
+        query: [
+            ['method', 'Login'],
+            ['callback', 'jsonpLogin'],
+        ],
+        headers: h.get(),
+        timeout: 15,
+    });
+    const data = parseJsonp(await res.text()) ?? {};
+    const identity = data.Identity && typeof data.Identity === 'object' ? data.Identity : null;
+    const alive = Boolean(identity?.IsAuthenticated);
+    return { alive, name: alive ? (identity?.Name ?? jd.pin) : null, data };
+}
+// ================================================================ 商品
+/** 商品详情（pc_detailpage_wareBusiness）。 */
+export function productDetail(jd, sku, area, num = '1', retry = 2) {
+    const body = { skuId: String(sku), area: area || areaOf(jd.cookies), num: String(num), clientSource: 'PC', userAgent: 'Windows', sfTime: '1,0,0' };
+    return jd.call('pc_detailpage_wareBusiness', {
+        body,
+        path: '/',
+        client: CLIENT_PC_ITEM,
+        appId: APPID_PC_ITEM,
+        extra: [['scval', String(sku)]],
+        referer: ITEM_REFERER,
+        refererPage: itemPage(sku),
+        rpClient: RP_CLIENT_ITEM,
+        origin: ITEM_ORIGIN,
+        method: 'GET',
+        contentType: 'application/x-www-form-urlencoded',
+        order: ORDER_PC_ITEM,
+        retry,
+    });
+}
+/** 商品评价（getLegoWareDetailComment）。 */
+export function productComments(jd, sku, count = 5) {
+    const body = { shopType: '0', sku: Number(sku), commentNum: count, source: 'pc' };
+    return jd.call('getLegoWareDetailComment', {
+        body,
+        path: '/',
+        client: CLIENT_PC_ITEM_V3,
+        appId: APPID_PC_ITEM,
+        extra: [['build', '100000']],
+        referer: ITEM_REFERER,
+        refererPage: itemPage(sku),
+        rpClient: RP_CLIENT_ITEM,
+        origin: ITEM_ORIGIN,
+        method: 'GET',
+        order: ORDER_PC_ITEM,
+    });
+}
+/** 商品页推荐优惠券（getRecommendCoupon）。 */
+export function recommendCoupon(jd, sku, area) {
+    return jd.call('getRecommendCoupon', {
+        body: { client: 'pc' },
+        path: '/',
+        client: CLIENT_PC_ITEM_V3,
+        appId: APPID_PC_ITEM,
+        extra: [['area', area || areaOf(jd.cookies)]],
+        referer: ITEM_REFERER,
+        refererPage: itemPage(sku),
+        rpClient: RP_CLIENT_ITEM,
+        origin: ITEM_ORIGIN,
+        method: 'GET',
+        order: ORDER_PC_ITEM,
+    });
+}
+/** 商品相关搜索词（relsearch）：不签 h5st，也不带 t。 */
+export function relatedSearch(jd, sku, num = 6) {
+    return jd.call('relsearch', {
+        body: {},
+        path: '/api',
+        client: CLIENT_PC_ITEM_V3,
+        sign: false,
+        withTime: false,
+        extra: [
+            ['skuid', String(sku)],
+            ['num', num],
+            ['rettype', 'json'],
+            ['type_name', 'relsearch'],
+        ],
+        referer: ITEM_REFERER,
+        refererPage: itemPage(sku),
+        rpClient: RP_CLIENT_ITEM,
+        origin: ITEM_ORIGIN,
+        method: 'GET',
+        withUuid: true,
+        drop: UNSIGNED_DROP,
+        contentType: 'application/x-www-form-urlencoded',
+        order: ORDER_PC_ITEM_RELWORDS,
+    });
+}
+// ================================================================ 搜索
+function searchCall(jd, keyword, body, retry) {
+    return jd.call('pc_search_searchWare', {
+        body,
+        path: '/api',
+        client: CLIENT_PC_SEARCH,
+        appId: APPID_PC_SEARCH,
+        extra: [
+            ['cthr', '1'],
+            ['keyword', keyword],
+        ],
+        referer: searchReferer(jd, keyword),
+        origin: SEARCH_ORIGIN,
+        method: 'GET',
+        retry,
+        appendTime: true,
+        order: ORDER_PC_SEARCH,
+        uuid: searchUuidOf(jd.cookies),
+        axios: true,
+        contentType: 'application/x-www-form-urlencoded',
+    });
+}
+/**
+ * 商品搜索（pc_search_searchWare）：先跑 WebM 指纹；命中 605 时纯程序完成 JCAP、保存 x-rp-evtoken 后重试一次。
+ * sort 为上游取值：空=综合、sort_totalsales15_desc、sort_price_asc、sort_price_desc、sort_commentcount_desc。
+ */
+export async function search(jd, keyword, page = 1, options = {}) {
+    await ensureWebmToken(jd, keyword);
+    const body = {
+        enc: 'utf-8',
+        area: options.area || areaOf(jd.cookies),
+        page,
+        mode: '',
+        concise: false,
+        hoverPictures: false,
+        newAdvRepeat: false,
+        mixerParam: false,
+        new_interval: true,
+        s: (page - 1) * 30 + 1,
+        pageSize: 30,
+    };
+    if (options.sort)
+        body.sort = options.sort;
+    jd.searchKeyword = keyword;
+    const retry = options.retry ?? 2;
+    const result = await searchCall(jd, keyword, body, retry);
+    if ((options.autoVerify ?? true) && result && typeof result === 'object' && result.disposal) {
+        const verified = await solveSearchRisk(jd, result, keyword);
+        if (verified.code === 0) {
+            const retried = await searchCall(jd, keyword, body, retry);
+            if (retried && typeof retried === 'object')
+                retried._verification = verified;
+            return retried;
+        }
+        result._verification = verified;
+    }
+    return result;
+}
+/** 搜索热词（pc_search_hotwords）：不签 h5st。 */
+export function searchHotwords(jd) {
+    return jd.call('pc_search_hotwords', {
+        path: '/api',
+        client: CLIENT_PC_SEARCH,
+        sign: false,
+        referer: searchReferer(jd),
+        origin: SEARCH_ORIGIN,
+        refererPage: 'https://search.jd.com/Search',
+        rpClient: RP_CLIENT_SEARCH,
+        method: 'GET',
+        contentType: 'application/x-www-form-urlencoded',
+        order: ORDER_PC_SEARCH_PLAIN,
+        drop: UNSIGNED_DROP,
+    });
+}
+/** 搜索页相关搜索词（pc_search_relwords）。 */
+export function searchRelwords(jd, keyword = '', num = 10) {
+    return jd.call('pc_search_relwords', {
+        body: { keyword },
+        path: '/api',
+        client: CLIENT_PC_SEARCH,
+        sign: false,
+        extra: [
+            ['keyword', keyword],
+            ['num', num],
+            ['rettype', 'json'],
+            ['type_name', 'relsearch'],
+        ],
+        referer: searchReferer(jd, keyword),
+        origin: SEARCH_ORIGIN,
+        refererPage: 'https://search.jd.com/Search',
+        rpClient: RP_CLIENT_SEARCH,
+        method: 'GET',
+        contentType: 'application/x-www-form-urlencoded',
+        order: ORDER_PC_SEARCH_RELWORDS,
+        drop: UNSIGNED_DROP,
+    });
+}
+// ================================================================ 账号
+/** 购物车数量（pcCart_jc_getCartNum）：POST，body 留在 query。 */
+export function cartNum(jd, area) {
+    const body = { serInfo: { area: area || areaOf(jd.cookies, true), 'user-key': '' }, cartExt: { specialId: 1 } };
+    return jd.call('pcCart_jc_getCartNum', {
+        body,
+        path: '/api',
+        client: CLIENT_PC_SEARCH,
+        appId: APPID_PC_ITEM,
+        referer: searchReferer(jd),
+        origin: SEARCH_ORIGIN,
+        refererPage: 'https://search.jd.com/Search',
+        rpClient: RP_CLIENT_SEARCH,
+        withUuid: false,
+        bodyInQuery: true,
+        order: ORDER_PC_API,
+        contentType: 'application/json',
+    });
+}
+/** 浏览历史（pc_myjd_getBrowseHistory）。 */
+export function browseHistory(jd, page = 1, pageSize = 20, area, retry = 2, sku = '') {
+    return jd.call('pc_myjd_getBrowseHistory', {
+        body: { pageNo: page, pageSize, tag: 1, source: 'pc_sx_history' },
+        path: '/',
+        client: CLIENT_PC_ITEM_V3,
+        appId: APPID_PC_ITEM,
+        extra: [['area', area || areaOf(jd.cookies)]],
+        referer: ITEM_REFERER,
+        refererPage: itemPage(sku),
+        rpClient: RP_CLIENT_ITEM,
+        origin: ITEM_ORIGIN,
+        method: 'GET',
+        order: ORDER_PC_ITEM,
+        retry,
+    });
+}
+/** 关注的商品（pc_follow_product_new）。 */
+export function followProducts(jd, page = 1, pageSize = 1, area, retry = 2, sku = '') {
+    return jd.call('pc_follow_product_new', {
+        body: { pageNo: page, pageSize, tag: 1, source: 'pc_sx_follow_product' },
+        path: '/',
+        client: CLIENT_PC_ITEM_V3,
+        appId: APPID_PC_ITEM,
+        extra: [['area', area || areaOf(jd.cookies)]],
+        referer: ITEM_REFERER,
+        refererPage: itemPage(sku),
+        rpClient: RP_CLIENT_ITEM,
+        origin: ITEM_ORIGIN,
+        method: 'GET',
+        order: ORDER_PC_ITEM,
+        retry,
+    });
+}
+/** 订单列表（get_order_list）：订单中心是 HTML 页面，逐个 `<tbody id="tb-<订单号>">` 解析。 */
+export async function orderList(jd, page = 1, dateRange = '1') {
+    const res = await jd.send({
+        url: ORDER_URL,
+        headers: orderDoc().get(),
+        query: [
+            ['search', '0'],
+            ['d', dateRange],
+            ['s', '4096'],
+            ['page', page],
+        ],
+    });
+    const html = (await res.text()) ?? '';
+    const head = html.slice(0, 2000);
+    if (head.includes('passport.jd.com') && head.includes('login')) {
+        return { orders: [], count: 0, page, _error: '被跳到登录页，登录态失效了' };
+    }
+    const orders = parseOrders(html);
+    return { orders, count: orders.length, page };
+}
+export function parseOrders(html) {
+    const clean = (s) => (s ? unescapeHtml(stripTags(s)).trim() : '');
+    const orders = [];
+    for (const match of html.matchAll(/<tbody id="tb-(\d+)"[^>]*>([\s\S]*?)<\/tbody>/g)) {
+        const [, orderId, chunk] = match;
+        const pick = (re) => clean(re.exec(chunk)?.[1]);
+        // 商品名与 SKU 从同一个 <a> 里取，空名的链接连同它的 SKU 一起去掉，两者不会错位
+        let links = [...chunk.matchAll(/<div class="p-name">\s*<a([^>]*)>([\s\S]*?)<\/a>/g)];
+        if (!links.length)
+            links = [...chunk.matchAll(/class="p-name"[^>]*>\s*<a([^>]*)>([\s\S]*?)<\/a>/g)];
+        const products = links
+            .map((m) => ({ name: clean(m[2]), sku: ITEM_URL_SKU.exec(/href="([^"]*)"/.exec(m[1])?.[1] ?? '')?.[1] ?? null }))
+            .filter((p) => p.name)
+            .slice(0, 10);
+        const amountRaw = pick(/<div class="amount"[^>]*>([\s\S]*?)<\/div>/);
+        const lines = amountRaw.split(/\r?\n|\r/).map((l) => l.trim()).filter(Boolean);
+        const order = {
+            orderId,
+            time: pick(/<span class="dealtime"[^>]*>([\s\S]*?)<\/span>/),
+            consignee: pick(/<div class="consignee[^"]*"[^>]*>\s*<span class="txt">([\s\S]*?)<\/span>/),
+            amount: lines[0] ?? amountRaw,
+            payType: lines[1] ?? '',
+            status: pick(/<span class="order-status[^"]*"[^>]*>([\s\S]*?)<\/span>/),
+            products: products.map((p) => p.name),
+            url: `https://details.jd.com/normal/item.action?orderid=${orderId}`,
+        };
+        Object.defineProperty(order, 'skus', { value: products.map((p) => p.sku), enumerable: false });
+        orders.push(order);
+    }
+    return orders;
+}
+// ================================================================ 咚咚
+const CHAT = { referer: CHAT_REFERER, origin: CHAT_ORIGIN, refererPage: CHAT_REFERER, rpClient: RP_CLIENT_CHAT, withUuid: false };
+/** 咚咚 aid（getAidInfo），拿到后记进会话。 */
+export async function aidInfo(jd) {
+    const body = {
+        aidClientType: 'comet',
+        aidClientVersion: 'comet -v1.0.0',
+        appId: 'im.customer',
+        os: 'comet',
+        entry: '',
+        reqSrc: 's_comet',
+        siteId: -1,
+        customerAppId: 'im.customer',
+    };
+    const res = await jd.call('getAidInfo', { body, client: CLIENT_IMH5, appId: APPID_DONGDONG, ...CHAT, withTime: true, order: ORDER_DD_WITH_TIME });
+    if (res && typeof res === 'object' && res.aid)
+        jd.setChatInfo({ aid: res.aid, app_id: 'im.customer', client_type: 'comet' });
+    else
+        jd.ctx.log.debug('getAidInfo 未返回 aid');
+    return res;
+}
+/** 咚咚会话初始化（getChatInfo）：商家信息、会话类型、客服身份。 */
+export function chatInfo(jd, venderId = '1', pid = '', orderId = '', shopId = '', groupId = '', entry = '') {
+    const body = {
+        lang: 'zh_CN',
+        venderId: String(venderId),
+        groupId,
+        pid,
+        ppid: '',
+        shopId,
+        siteId: -1,
+        entry,
+        orderId,
+        reqSrc: 's_comet',
+        cAppId: '',
+        bbtf: '',
+        uniformBizInfo: {},
+        customerAppId: 'im.customer',
+    };
+    return jd.call('getChatInfo', { body, client: CLIENT_WH5, appId: APPID_DONGDONG, ...CHAT, withTime: false, order: ORDER_DD_NO_TIME });
+}
+/** 历史会话（getChatSessionLog）。 */
+export function chatSessionLog(jd) {
+    const body = { reqSrc: 's_comet', appId: 'im.customer', showMsg: 1, lastMsg: 1, uniformBizInfo: {}, siteId: -1, customerAppId: 'im.customer' };
+    return jd.call('getChatSessionLog', { body, client: CLIENT_IMH5, appId: APPID_DONGDONG, ...CHAT, withTime: true, order: ORDER_DD_WITH_TIME });
+}
+/** 咚咚历史消息（queryLastLogs）。 */
+export function queryLastLogs(jd, venderId = '1', num = 10, startTimestamp = 0, reverse = true) {
+    const pin = jd.pin ?? '';
+    const chat = jd.chat;
+    const body = {
+        terminal: { version: 'wh5', pullType: 1 },
+        aid: chat.aid ?? '',
+        uid: { app: 'im.customer', pin, clientType: chat.client_type || 'comet', art: '' },
+        customer: pin,
+        venderId: String(venderId),
+        startTimeStamp: startTimestamp,
+        reverse: Boolean(reverse),
+        num,
+        siteId: -1,
+        customerAppId: 'im.customer',
+    };
+    return jd.call('queryLastLogs', { body, path: '/api', client: CLIENT_IMH5, appId: APPID_DONGDONG, ...CHAT, withTime: true, order: ORDER_DD_WITH_TIME });
+}
+// ================================================================ WebM 指纹与搜索风控（605）
+const WEBM_VERSION = '6.0.0-exact-1';
+/**
+ * 跑官方 jdwebm.js 生成 `shshshfpb`（ensure_webm_token）：先取加密的采集配置，再把采集结果交给 wsgw_getinfo。
+ * 有效期内直接复用。
+ */
+export async function ensureWebmToken(jd, keyword = '', force = false) {
+    let fpa = String(jd.cookie('shshshfpa') ?? '');
+    const fpx = String(jd.cookie('shshshfpx') ?? '');
+    if (!fpa) {
+        const raw = rand.hex(16);
+        fpa = `${raw.slice(0, 8)}-${raw.slice(8, 12)}-${raw.slice(12, 16)}-${raw.slice(16, 20)}-${raw.slice(20)}-${rand.nowSeconds()}`;
+        jd.update([['shshshfpa', fpa]]);
+    }
+    if (!fpx)
+        jd.update([['shshshfpx', fpa]]);
+    const pageUrl = searchReferer(jd, keyword);
+    const storage = jd.localStorageFor(pageUrl);
+    const validUntil = Number.parseInt(storage.hf_time ?? '0', 10) || 0;
+    const current = String(jd.cookie('shshshfpb') ?? '');
+    if (current && !force && storage.__jdapis_webm_runtime__ === WEBM_VERSION && validUntil > rand.now()) {
+        return { code: 0, cached: true, token_length: current.length };
+    }
+    const now = rand.now();
+    let configData = '';
+    try {
+        const h = xhr({ accept: 'application/json' }).referer(pageUrl).origin(SEARCH_ORIGIN);
+        const res = await jd.send({
+            url: `${API_URL}/`,
+            headers: h.get(),
+            query: [
+                ['appid', 'risk_h5_info'],
+                ['functionId', 'getCustomCtrl'],
+                ['t', String(now)],
+                ['body', '{"domain":".jd.com"}'],
+            ],
+        });
+        const r = (await res.json());
+        if (r?.code === 0)
+            configData = String(r.data ?? '');
+    }
+    catch (err) {
+        jd.ctx.log.warn(`WebM 控制配置获取失败：${err.name}`);
+    }
+    let result;
+    try {
+        const runtimeStorage = { ...storage };
+        if (force) {
+            delete runtimeStorage.hf_time;
+            delete runtimeStorage.__jdapis_webm_runtime__;
+        }
+        const payload = await buildSearchPayload(jd, pageUrl, configData, runtimeStorage);
+        const h = xhr({ form: true, accept: 'application/json' }).referer(pageUrl).origin(SEARCH_ORIGIN);
+        const res = await jd.send({
+            method: 'POST',
+            url: `${API_URL}/`,
+            headers: h.get(),
+            form: [
+                ['appid', 'risk_h5'],
+                ['functionId', 'wsgw_getinfo'],
+                ['t', String(rand.now())],
+                ['body', JSON.stringify(payload)],
+            ],
+        });
+        result = await res.json();
+    }
+    catch (err) {
+        jd.ctx.log.warn(`WebM 指纹初始化失败：${err.message}`);
+        return { code: -1, error: err.name };
+    }
+    const token = String(result?.whwswswws ?? '');
+    if (result?.code === 0 && token) {
+        jd.update([['shshshfpb', token]]);
+        const runtimeStorage = jd.localStorageFor(pageUrl);
+        runtimeStorage.__jdapis_webm_runtime__ = WEBM_VERSION;
+        let interval = Number.parseInt(String(result.interval ?? ''), 10);
+        interval = Number.isFinite(interval) && interval ? Math.max(1, interval) : 24 * 60;
+        runtimeStorage.hf_time = String(rand.now() + interval * 60_000);
+        jd.replaceLocalStorage(pageUrl, runtimeStorage);
+        return { code: 0, cached: false, token_length: token.length };
+    }
+    jd.ctx.log.warn(`WebM 指纹初始化未返回令牌：code=${result?.code}`);
+    return { code: result?.code ?? null, cached: false, token_length: 0 };
+}
+/** 605 处置里的风险页上下文 URL（verification_url）。 */
+export function verificationUrl(res, referer) {
+    const disposal = res?.disposal ?? {};
+    let ev;
+    try {
+        ev = jsonLoads(disposal.evContent || '{}');
+    }
+    catch {
+        return '';
+    }
+    if (!ev.evUrl)
+        return '';
+    return (ev.evUrl +
+        '?' +
+        urlencode([
+            ['returnurl', referer],
+            ['rqhost', API_URL],
+            ['rpid', disposal.rpId ?? ''],
+            ['evtype', ev.evType ?? '2'],
+            ['evapi', ev.evApi ?? ''],
+            ['source', '1'],
+            ['forceCurrentView', '1'],
+            ['evsid', ev.evSid || ''],
+        ]));
+}
+/** 风险页 eid 取自 unionwsws（_risk_page_eid）。 */
+function riskPageEid(jd) {
+    const value = String(jd.cookie('unionwsws') ?? '');
+    if (!value)
+        return '';
+    try {
+        const parsed = jsonLoads(decodeURIComponent(value));
+        return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? String(parsed.devicefinger ?? '') : '';
+    }
+    catch {
+        return '';
+    }
+}
+const JS_SAFE = "~()*!.'-";
+/** 搜索 605：createSid → JCAP → checkToken，成功后保存 x-rp-evtoken（solve_search_risk）。 */
+export async function solveSearchRisk(jd, response, keyword = '', attempts = 3) {
+    const disposal = response?.disposal;
+    if (!disposal || typeof disposal !== 'object')
+        return { code: -1, stage: 'disposal' };
+    let event;
+    try {
+        event = jsonLoads(disposal.evContent || '{}');
+    }
+    catch {
+        return { code: -1, stage: 'disposal' };
+    }
+    const pageUrl = verificationUrl(response, searchReferer(jd, keyword));
+    if (!pageUrl || !disposal.rpId)
+        return { code: -1, stage: 'disposal' };
+    await ensureWebmToken(jd, keyword);
+    const common = {
+        requestId: disposal.rpId || '',
+        evApi: quote(String(event.evApi ?? ''), JS_SAFE),
+        evType: String(event.evType || '2'),
+        shshshfpx: jd.cookie('shshshfpx') || '',
+        eid: riskPageEid(jd),
+        evSid: event.evSid || '',
+    };
+    try {
+        const created = await jd.riskPost(pageUrl, 'createSid', common);
+        const sid = String(created?.data ?? '');
+        if (created?.code !== 0 || !sid)
+            return { code: created?.code ?? null, stage: 'createSid' };
+        const token = await solveCaptcha(jd, { sessionId: sid, account: '', pageUrl, attempts });
+        let pin = jd.cookie('pwdt_id') || jd.cookie('pin') || jd.cookie('pt_pin') || '';
+        if (pin.includes('*'))
+            pin = '';
+        const checked = await jd.riskPost(pageUrl, 'checkToken', { sid, token: quote(token, JS_SAFE), ...common, pin });
+        const evToken = String(checked?.data ?? '');
+        if (checked?.code !== 0 || !evToken)
+            return { code: checked?.code ?? null, stage: 'checkToken' };
+        jd.update([['x-rp-evtoken', evToken]]);
+        return { code: 0, stage: 'complete', token_length: evToken.length };
+    }
+    catch (err) {
+        const out = { code: -1, stage: 'jcap', error: err.name, message: err.message };
+        const m = /"sCode":(\d+)/.exec(String(err.message));
+        if (m)
+            out.service_subcode = Number(m[1]);
+        jd.ctx.log.warn(`纯程序搜索验证未通过：${err.message}`);
+        return out;
+    }
+}