merge: 同步 main（neapi 支持、v9.6.13 接口、cookie 解析修复）并解决冲突

feat: 新增 v9.6.13 客户端逆向接口（7 个模块，均经官方实测）

.codegraph/.gitignore

@@ -0,0 +1,5 @@
+# CodeGraph data files — local to each machine, not for committing.
+# Ignore everything in .codegraph/ except this file itself, so transient
+# files (the database, daemon.pid, sockets, logs) never show up in git.
+*
+!.gitignore

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -14,15 +14,16 @@ body:
     id: terms
     attributes:
       label: 确认事项
-      description: 在提交功能请求前，请确认以下事项
+      description: |
+        在提交功能请求前，请确认以下事项
+
+        - 我已经搜索了现有的issues，确认这不是重复请求
+        - 我已经查看了项目文档
+        - 该项目符合该项目的目标和范围
+        - 我确认我提供的接口请求是合理且有意义的
+
       options:
-        - label: 我已经搜索了现有的issues，确认这不是重复请求
-          required: true
-        - label: 我已经查看了项目文档
-          required: true
-        - label: 该项目符合该项目的目标和范围
-          required: true
-        - label: 我确认我提供的接口请求是合理且有意义的
+        - label: 我已确认以上事项
           required: true
 
 

.github/workflows/build-dev.yml

@@ -34,10 +34,11 @@ jobs:
         with:
           node-version: '18'
 
+      - name: Setup pnpm
+        run: npm install -g pnpm@9
+
       - name: Install dependencies
-        run: |
-          npm install -g pnpm
-          pnpm install
+        run: pnpm install --frozen-lockfile
 
       - name: Build for ${{ matrix.platform }}
         run: |

.github/workflows/ci-check.yml

@@ -0,0 +1,67 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check:
+    name: Lint / Unit / Docs
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node-version: [18, 22, 24]
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: pnpm/action-setup@v6
+        with:
+          version: 9
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: pnpm
+
+      # frozen-lockfile: 顺带校验 package.json 与 pnpm-lock.yaml 是否一致
+      - name: Install dependencies (frozen lockfile)
+        run: pnpm install --frozen-lockfile
+
+      - name: Lint
+        run: pnpm lint
+
+      # 纯单测，不需要网络，稳定必过
+      - name: Unit tests
+        run: pnpm exec mocha -r intelli-espower-loader -t 60000 main.test.js --exit
+
+      - name: Docs format check
+        run: pnpm docs:check
+
+  integration:
+    # server.test.js 会启动真实服务器并请求真实网易云 API，
+    # 可能因上游风控/限流偶发失败，因此不阻塞合并
+    name: Integration tests (real NetEase API)
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: pnpm/action-setup@v6
+        with:
+          version: 9
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - name: Install dependencies (frozen lockfile)
+        run: pnpm install --frozen-lockfile
+
+      - name: Run full test suite
+        run: pnpm test

.github/workflows/issue-manage.yml

@@ -6,8 +6,6 @@ permissions:
 on:
   issues:
     types: [opened, labeled]
-  issue_comment:
-    types: [created]
 
 jobs:
   welcome-new-issues:
@@ -19,44 +17,21 @@ jobs:
         with:
           issue-number: ${{ github.event.issue.number }}
           body: |
-            ## 快速链接
+            感谢您在该仓库提出问题！我们非常重视您的反馈，并希望尽快为您提供帮助。
 
-            在我们处理您的问题之前，您可以先查看以下资源：
+            如果您在一周左右的时间里没有收到我们的回复，请在下方留言，以便我们注意到。我们的大部分审核都是志愿者，有时难免会有疏漏。
 
+            你可能会想要尝试以下方法来获得更快的帮助：
             - 📖 查看[项目文档](https://neteasecloudmusicapienhanced.js.org)
             - 💬 加入[QQ交流群](https://qm.qq.com/q/TpeP9Uv2yk) 
             - 🔍 搜索[现有issues](https://github.com/neteasecloudmusicapienhanced/api-enhanced/issues) 看是否有类似问题
 
-  handle-help-wanted:
-    if: contains(github.event.issue.labels.*.name, 'question')
-    runs-on: ubuntu-latest
-    steps:
-      - name: Add help resources
-        uses: peter-evans/create-or-update-comment@v5
-        with:
-          issue-number: ${{ github.event.issue.number }}
-          body: |
-            🆘 需要帮助？
-
-            这里有一些可能对您有用的资源：
-
-            📚 **文档资源**
-            - [项目文档](https://neteasecloudmusicapienhanced.js.org)
-
-            🔍 **常见问题**
-            - 搜索[已关闭的issues](https://github.com/neteasecloudmusicapienhanced/api-enhanced/issues?q=is%3Aissue+is%3Aclosed) 看看是否有类似的问题已经被解答。
-
-            💬 **即时帮助**
-            - 加入QQ群：https://qm.qq.com/q/TpeP9Uv2yk
-
-            如果以上资源无法解决您的问题，请提供更多详细信息，我们会尽快为您解答！
-
   stale-issues:
     if: github.event.action == 'opened'
     runs-on: ubuntu-latest
     steps:
       - name: Mark stale issues
-        uses: actions/stale@v10
+        uses: actions/stale@v11
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           stale-issue-message: |

.github/workflows/opencode.yml

@@ -0,0 +1,71 @@
+name: opencode
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
+
+jobs:
+  bot:
+    if: |
+      (contains(github.event.comment.body, ' /oc') ||
+       startsWith(github.event.comment.body, '/oc') ||
+       contains(github.event.comment.body, ' /opencode') ||
+       startsWith(github.event.comment.body, '/opencode')) &&
+      github.actor != 'opencode-agent[bot]' &&
+      github.actor != 'yukka-agent[bot]' &&
+      github.actor != 'github-actions[bot]'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+    steps:
+      - name: Fetch config from CF Worker
+        id: cfg
+        uses: MoeFurina/pull-oc-config@v1
+        with:
+          url: https://bot-storage.interface.focalors.ltd/config
+
+      - name: Generate bot token
+        id: token
+        uses: actions/create-github-app-token@v3
+        with:
+          client-id: ${{ steps.cfg.outputs.app_id }}
+          private-key: ${{ steps.cfg.outputs.app_private_key }}
+          owner: ${{ github.repository_owner }}
+
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          # 需要持久化凭证: opencode action 内部会 git fetch origin <分支> 拉取 PR 代码
+          persist-credentials: true
+          token: ${{ steps.token.outputs.token }}
+
+      - name: Configure git identity
+        run: |
+          git config --global user.name "yukka-agent[bot]"
+          git config --global user.email "yukka-agent[bot]@users.noreply.github.com"
+
+      - name: Run opencode
+        uses: anomalyco/opencode/github@latest
+        env:
+          OPENCODE_API_KEY: ${{ steps.cfg.outputs.opencode_api_key }}
+          GITHUB_TOKEN: ${{ steps.token.outputs.token }}
+          OPENCODE_PERMISSION: '{"permission":{"*":"allow","question":"deny"}}'
+        with:
+          model: opencode/glm-5.3-flash-free
+          use_github_token: true
+          prompt: |
+            ${{ steps.cfg.outputs.opencode_prompt }}
+
+            ## 用户指令（来自触发评论，请严格按此执行）
+            ${{ github.event.comment.body }}
+
+            ## 用户要求Review时, 严格执行下面指令
+            ${{ steps.cfg.outputs.pr_review_prompt }}

.github/workflows/release-on-version-change.yml

@@ -260,13 +260,13 @@ jobs:
         uses: docker/setup-buildx-action@v3
 
       - name: Log in to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

.github/workflows/sync.yml

@@ -22,7 +22,7 @@ jobs:
       # Step 2: run the sync action
       - name: Sync upstream changes
         id: sync
-        uses: aormsby/[email protected].2
+        uses: aormsby/[email protected].3
         with:
           upstream_sync_repo: NeteaseCloudMusicApiEnhanced/api-enhanced
           upstream_sync_branch: main

.gitignore

@@ -6,7 +6,7 @@ node_modules
 .history
 examples/moddef.json
 bin
-anonymous_token
 .vercel
 .env
 IFLOW.md
+precompiled

AGENTS.md

@@ -0,0 +1,52 @@
+# NeteaseCloudMusicApiEnhanced Agent 说明
+
+## 快速开始
+- **包管理器**：开发与 CI 使用 `pnpm`，`Dockerfile` 也用 pnpm（`pnpm@9 --frozen-lockfile`，匹配 `pnpm-lock.yaml`）。仓库没有 `yarn.lock`，不要引入 yarn。
+- **Node 版本**：README 推荐 Node 22+；`package.json` 的 `engines` 声明 `>=12`；CI/打包在 Node 18–24 上运行。现代 Node 均可。
+- **环境变量**：`server.js` 调用了 `dotenv.config()`，本地 `.env` 会被自动加载；所有支持的变量见 `.env.prod.example`。
+
+## 常用命令
+- 安装依赖：`pnpm i`
+- 启动服务：`pnpm start`（等价 `node app.js`）；热重载开发：`pnpm dev`（nodemon）
+- 跑测试：`pnpm test`（Mocha，超时 60s）
+- Lint：`pnpm lint`；自动修复：`pnpm lint-fix`
+- 文档格式化检查/修复：`pnpm docs:check` / `pnpm docs:format`
+- 打包独立二进制：`pnpm pkgwin` / `pkglinux` / `pkgmacos`
+
+## 目录内非路由文件
+- `plugins/`——内部上传辅助（`upload.js`、`songUpload.js`），被 `module/*` require，本身不是路由。
+- `module_example/`——接口模板与 `main.js` 库调用示例（含 `test.js` 演示 `login_cellphone`→`song_url` 链路），不是运行时代码。
+- `examples/get_static_moddef.js`——用 `getModulesDefinitions(..., false)`（`doRequire=false`）把全部路由导出为 `moddef.json`。改路由注册逻辑时可跑它核对。
+- `module_types/` 为空目录；类型声明在根目录 `interface.d.ts`（`types` 字段）。
+
+## 架构
+- `app.js`（也是 `bin`）——服务入口。执行 `generateConfig()` 预热运行时凭证（匿名令牌与 xeapi 公钥，存于内存），再调用 `server.serveNcmApi()`。不依赖 `/tmp` 等可写文件系统。
+- `server.js`——Express 工厂。`constructServer()` 自动扫描 `module/*.js`，每个文件注册一条路由（文件名 `_` 转 `/`，如 `album_new.js` → `/album/new`；特例 `daily_signin`/`fm_trash`/`personal_fm` 硬编码在 `server.js` 的 `special` 对象里）。`serveNcmApi()` 监听 `PORT`（默认 3000）/`HOST`。
+- `main.js`——作为依赖被引入时的入口（`main` 字段）。把每个 `module/*` 导出为同名函数 `name(data)`，另导出 `server`、`serveNcmApi`、`getModulesDefinitions`、`generateConfig`（库用户可 `await main.generateConfig()` 预热/续期凭证；不调用也行，首个请求会在凭证缺失时自动引导）。
+- `module/*.js`——每个接口一个文件，标准写法：`module.exports = (query, request) => request(path, data, createOption(query))`。`createOption` 在 `util/option.js`，负责 crypto、cookie（回退到 `NETEASE_COOKIE`）、proxy、realIP/randomCNIP、headers、timeout。
+- `util/request.js`——唯一的对外 HTTP 层（axios）。按 `crypto`（`api`/`eapi`/`weapi`/`linuxapi`/`xeapi`/`neapi`）加密并设置 IP 头；匿名令牌与 xeapi 公钥每次请求实时读取 `util/runtimeState.js`，缺失时按需引导（并发共享同一刷新任务，刷新自身的请求带 `skipTokenEnsure` 防自等待死锁）。neapi 配置过期（`X-USER-STATUS` 为 777/999）时自动轮换重试一次。另导出 `refreshAnonymousToken` / `refreshXeapiPublicKey` 供 `generateConfig` 复用。
+- `util/runtimeState.js`——统一的进程内运行时动态状态（`anonymousToken` / `xeapiPublicKey`）。纯内存、零文件 I/O；`register_anonimous` / `register_xeapikey` 成功后写入，`util/request.js` 读取，`ensure()` 提供缺失时按需刷新。以后新增动态配置放这里，不要再往 `os.tmpdir()` 写文件。
+- `util/neapiKey.js` / `util/neapiConfig.js` / `module/register_neapikey.js`——neapi 容器加解密支持（chacha20-poly1305 + zstd，见 `util/crypto.js` 与 `util/zstd.js`）；密钥配置由 `register_neapikey` 拉取并经 `saveNeapiKey` 缓存（暂写 `os.tmpdir()/neapi_key`）。
+- `util/config.json`——运行时配置：网易域名 + `APP_CONF.encrypt: true`（默认走 eapi 加密）。已被 git 跟踪，改动会改变全局默认行为。
+- `index.js` / `index.mjs`——`require('./app.js')` 的薄包装，供 Vercel（`vercel.json`）和 ESM 导入使用。
+- `server.js` 里有一段非显而易见的逻辑：环境变量 `ENABLE_GENERAL_UNBLOCK=true` 时，`/song/url/v1` 的响应会被自动解灰（走 `@neteasecloudmusicapienhanced/unblockmusic-utils`）；另外 `query.noCookie` 为真时不向响应写 `Set-Cookie`。
+
+## 新增/修改接口
+- 新建 `module/xxx.js` 会自动挂载路由，无需注册；**文件名即路由**。
+- 照抄同目录模块的写法（选对 `crypto`），用 `createOption(query)` 生成请求选项。
+- 改文件名/路由会破坏已有客户端，尽量保持旧路径兼容。
+
+## 测试
+- `pnpm test` 跑 `server.test.js` + `main.test.js`。`server.test.js` 在 `before()` 里启动真实服务器，`test/*.test.js` 全部请求**真实网易云 API**——必须联网，且可能因上游风控/限流偶发失败。`main.test.js` 是纯单测，不需要网络。
+- **CI 门禁只看稳定项**：`ci-check.yml` 在 Node 18/22/24 上跑 `pnpm lint` + `main.test.js` + `pnpm docs:check`；完整集成测试（`server.test.js`）是 `continue-on-error`，不阻塞合并。本地跑全量测试失败先怀疑上游风控。
+- 测试使用 `power-assert`（经 `intelli-espower-loader`），普通 `assert` 写法也会输出详细 diff。
+- 只跑单个用例：`pnpm exec mocha -r intelli-espower-loader -t 60000 --grep "<describe/it 名字>" server.test.js main.test.js --exit`
+- 只跑离线单测：`pnpm exec mocha -r intelli-espower-loader -t 60000 main.test.js --exit`
+
+## 坑与注意
+- **改 `package.json` 的 `version` 会触发自动发布**：`release-on-version-change.yml` 按 paths 过滤——只要 push 到 `main` 时 `package.json` 有改动且 version 变了，就自动打 tag + GitHub Release（`pkg` 三平台二进制）、推送 Docker 镜像（Docker Hub + GHCR 多架构）、`pnpm publish` 到 npm；tag 已存在则跳过。别顺手改版本号，也别往 `package.json` 里写无关改动凑提交。
+- **没有实际 git hooks**：`package.json` 里配了 `lint-staged` 和 husky，但 `.husky/` 下只有 `_` 脚手架目录、没有真正的 hook 文件，commit 时不会自动跑任何检查，自己记得 `pnpm lint-fix`。
+- **代理环境变量已失效**：README 里关于 `http_proxy`/`https_proxy` 的警告来自旧 `request` 库时代；现在 `util/request.js` 用 axios + 自定义 keep-alive agent，且显式 `proxy: false`，环境变量代理不会生效。按请求走 `query.proxy` 参数（支持 PAC 和 http 隧道）。
+- **运行时凭证在内存（runtimeState）**：`anonymous_token` 与 `xeapi_public_key` 存于 `util/runtimeState.js`，不做任何文件 I/O（历史上曾以文件形式放 `os.tmpdir()`，为可移植性已移除——只读 FS / Android / iOS / serverless 均可运行）。启动时 `generateConfig()` 先取 xeapi 公钥、再注册匿名令牌（顺序不能反，后者依赖前者）、最后注册 neapi 配置；运行中过期可再调 `generateConfig()` 或对应 `register_*` 接口，立即生效、无需重启。例外：neapi 配置（`util/neapiKey.js`，自 main 引入）暂仍缓存于 `os.tmpdir()/neapi_key`，行为与 main 保持一致。
+- **`docs:check` 校验的是 `public/docs/home.md`（docsify 站点）**，不是 README；脚本默认只处理该文件，换行会被统一为 `\n`、连续空行压缩到 2 行，PR 改动它后记得跑 `pnpm docs:format`。
+- **ESLint 9 flat config**：`eslint.config.js`，风格由 `eslint-plugin-prettier` 强制（2 空格缩进、单引号、分号、`endOfLine: auto`），并 `globalIgnores(['**/public/'])`——`public/` 下的前端页面不参与 lint。

Dockerfile

@@ -2,14 +2,19 @@ FROM node:lts-alpine
 
 RUN apk add --no-cache tini
 
-ENV NODE_ENV production
+ENV NODE_ENV=production
+
+RUN npm install -g pnpm@9
+
 USER node
 
 WORKDIR /app
 
 COPY --chown=node:node . ./
 
-RUN yarn --network-timeout=100000
+# --prod 模式下 husky 不会被安装，prepare 脚本会因找不到 husky 而失败，
+# 故显式跳过生命周期脚本；本项目生产运行也不依赖任何 postinstall 步骤。
+RUN pnpm install --frozen-lockfile --prod --ignore-scripts
 
 EXPOSE 3000
 

README.MD

@@ -30,7 +30,7 @@
 
 ## 项目简介
 
-网易云音乐第三方 Node.js API, 支持丰富的音乐相关接口，适合自建服务、二次开发和多平台部署(如果原版诈尸, 我会及时同步 or 归档)。
+网易云音乐第三方 Node.js API, 支持丰富的音乐相关接口，适合自建服务、二次开发和多平台部署
 
 > [!IMPORTANT]
 >
@@ -45,14 +45,14 @@
 
 ### 环境要求
 
-- Node.js 18 及以上
+- Node.js 22 及以上
 - 推荐使用 pnpm 进行依赖管理
 
 ### 安装
 
 ```bash
 git clone https://github.com/neteasecloudmusicapienhanced/api-enhanced.git
-cd api
+cd api-enhanced
 pnpm i
 ```
 
@@ -215,7 +215,7 @@ pnpm test
 
 原作者 [Binaryify/NeteaseCloudMusicApi](https://github.com/binaryify/NeteaseCloudMusicApi) 项目为本项目基础 (该项目在`npmjs`网站上仍持续维护, 但 github 仓库已不再更新)
 
-感谢大佬们为逆向eapi, weapi等加密算法所做的贡献
+感谢大佬们为逆向eapi, weapi, xeapi等加密算法所做的贡献
 
 项目参考:
 
@@ -225,6 +225,8 @@ pnpm test
 
 [chaunsin/netease-cloud-music](https://github.com/chaunsin/netease-cloud-music)
 
+[folltoshe/netease-report-listen-song](https://github.com/folltoshe/netease-report-listen-song)
+
 ### SDK 生态
 
 | 语言     | 作者                                          | 地址                                                                                       | 类型  |
@@ -244,6 +246,8 @@ pnpm test
 
 - [Yueby/music-together](https://github.com/Yueby/music-together)
 
+- [chthollyphlie/folia-major](https://github.com/chthollyphile/folia-major)
+
 ## License
 
 [MIT License](https://github.com/MoeFurina/NeteaseCloudMusicApiEnhanced/blob/main/LICENSE)

app.js

@@ -1,14 +1,7 @@
 #!/usr/bin/env node
-const fs = require('fs')
-const path = require('path')
-const tmpPath = require('os').tmpdir()
 
 async function start() {
-  // 检测是否存在 anonymous_token 文件,没有则生成
-  if (!fs.existsSync(path.resolve(tmpPath, 'anonymous_token'))) {
-    fs.writeFileSync(path.resolve(tmpPath, 'anonymous_token'), '', 'utf-8')
-  }
-  // 启动时更新anonymous_token
+  // 启动时预热运行时凭证（匿名令牌 / xeapi 公钥，均存于内存中的 runtimeState）
   const generateConfig = require('./generateConfig')
   await generateConfig()
   require('./server').serveNcmApi({

generateConfig.js

@@ -1,41 +1,44 @@
-const fs = require('fs')
-const path = require('path')
-const { register_anonimous } = require('./main')
-const { cookieToJson, generateRandomChineseIP } = require('./util/index')
-const { getXeapiPublicKey } = require('./util/xeapiKey')
-const tmpPath = require('os').tmpdir()
+const request = require('./util/request')
+const { generateRandomChineseIP, generateDeviceId } = require('./util/index')
+const { loadNeapiKey } = require('./util/neapiKey')
+const registerNeapikey = require('./module/register_neapikey')
 
+/**
+ * 启动 / 手动刷新运行时动态配置。
+ *
+ * 凭证均存于内存（util/runtimeState.js），不做任何文件 I/O：
+ * - 设备 ID 先行 —— xeapi 公钥注册需携带 deviceId（服务端对无
+ *   deviceId 的请求不下发 sk），匿名注册也复用同一设备身份；
+ * - xeapi 公钥其次 —— 注册匿名令牌走 xeapi 加密，依赖该公钥；
+ * - 匿名令牌最后注册，三者就绪后冷启动一次即可完成引导。
+ */
 async function generateConfig() {
   global.cnIp = generateRandomChineseIP()
-  try {
-    const res = await register_anonimous()
-    const cookie = res.body.cookie
-    if (cookie) {
-      const cookieObj = cookieToJson(cookie)
-      fs.writeFileSync(
-        path.resolve(tmpPath, 'anonymous_token'),
-        cookieObj.MUSIC_A,
-        'utf-8',
-      )
+  if (!global.deviceId) {
+    global.deviceId = generateDeviceId()
   }
+  try {
+    await request.refreshXeapiPublicKey()
   } catch (error) {
     console.log(error)
   }
   try {
-    let currentPublicKey = {}
+    await request.refreshAnonymousToken()
+  } catch (error) {
+    console.log(error)
+  }
   try {
-      currentPublicKey = JSON.parse(
-        fs.readFileSync(path.resolve(tmpPath, 'xeapi_public_key'), 'utf-8'),
-      )
-    } catch (_) {}
-    const publicKey = await getXeapiPublicKey(currentPublicKey, global.deviceId)
-    fs.writeFileSync(
-      path.resolve(tmpPath, 'xeapi_public_key'),
-      JSON.stringify(publicKey),
-      'utf-8',
+    const current = loadNeapiKey()
+    await registerNeapikey(
+      {
+        version: current ? current.version : 0,
+        behavior: current ? 'update' : 'open',
+      },
+      null,
     )
   } catch (error) {
     console.log(error)
   }
 }
+
 module.exports = generateConfig

interface.d.ts

@@ -1,5 +1,6 @@
 export interface RequestBaseConfig {
   cookie?: string
+  headers?: Record<string, string | string[]>
   realIP?: string // IPv4/IPv6 filled in X-Real-IP
   proxy?: string // HTTP proxy
   randomCNIP?: boolean // Whether to use a random Chinese IP address filled in X-Real-IP
@@ -37,6 +38,41 @@ export const enum SubAction {
   unsub = 0,
 }
 
+export function ad_get(
+  params: { type_ids?: string } & RequestBaseConfig,
+): Promise<Response>
+
+export function ad_listening_rights(
+  params: RequestBaseConfig,
+): Promise<Response>
+
+export function ad_listening_rights_gain(
+  params: {
+    reqUid?: string
+    uid?: string | number
+    exposureTime?: string | number
+    clickTime?: string | number
+    extraRightsType?: string | number
+    playContinuously?: boolean | string
+    source?: string | number
+    creativeType?: string | number
+    rightsGainMethod?: string | number
+    extraRightsGainMethod?: string | number
+    extraRightsGainDuration?: string | number
+    nextRightsGainDuration?: string | number
+    rightsGainType?: string | number
+    rightsGainDuration?: string | number
+    gainMethodStep?: string | number
+    generalRightsInfo?: string
+    rightsExtJson?: string
+    appInfo?: string
+    contextInfo?: string
+    installed?: string | number
+    sniffTime?: string | number
+    type_ids?: string
+  } & RequestBaseConfig,
+): Promise<Response>
+
 export function activate_init_profile(
   params: { nickname: string } & RequestBaseConfig,
 ): Promise<Response>
@@ -119,6 +155,14 @@ export function album_sublist(
   params: MultiPageConfig & RequestBaseConfig,
 ): Promise<Response>
 
+export function api(
+  params: {
+    uri: string
+    data?: string | Record<string, unknown>
+    crypto?: string
+  } & RequestBaseConfig,
+): Promise<Response>
+
 export function artist_album(
   params: { id: string | number } & MultiPageConfig & RequestBaseConfig,
 ): Promise<Response>
@@ -271,10 +315,21 @@ export function batch(
   params: { [index: string]: unknown } & RequestBaseConfig,
 ): Promise<Response>
 
+export function captcha_safe_sent(
+  params: { ctcode?: number | string } & RequestBaseConfig,
+): Promise<Response>
+
 export function captcha_sent(
   params: { phone: string; ctcode?: number | string } & RequestBaseConfig,
 ): Promise<Response>
 
+export function captcha_sent_v1(
+  params: {
+    phone: number | string
+    ctcode?: number | string
+  } & RequestBaseConfig,
+): Promise<Response>
+
 export function captcha_verify(
   params: {
     ctcode?: number | string
@@ -387,6 +442,14 @@ export function comment(
   } & RequestBaseConfig,
 ): Promise<Response>
 
+export function comment_add(
+  params: {
+    id: string | number
+    type: CommentType
+    content: string
+  } & RequestBaseConfig,
+): Promise<Response>
+
 export function comment_album(
   params: {
     id: string | number
@@ -395,6 +458,14 @@ export function comment_album(
     RequestBaseConfig,
 ): Promise<Response>
 
+export function comment_delete(
+  params: {
+    id: string | number
+    type: CommentType
+    cid: string | number
+  } & RequestBaseConfig,
+): Promise<Response>
+
 export function comment_dj(
   params: {
     id: string | number
@@ -469,6 +540,15 @@ export function comment_playlist(
     RequestBaseConfig,
 ): Promise<Response>
 
+export function comment_reply(
+  params: {
+    id: string | number
+    type: CommentType
+    cid: string | number
+    content: string
+  } & RequestBaseConfig,
+): Promise<Response>
+
 export function comment_video(
   params: {
     id: string | number
@@ -490,6 +570,25 @@ export function daily_signin(
   params: { type?: DailySigninType } & RequestBaseConfig,
 ): Promise<Response>
 
+export function decrypt(
+  params: {
+    crypto?: string
+    data?: string
+    hexString?: string
+    isReq?: boolean | string
+  } & RequestBaseConfig,
+): Promise<Response>
+
+export function device_kickoff(
+  params: { deviceKey: string | number; captcha?: string } & RequestBaseConfig,
+): Promise<Response>
+
+export function device_list(params: RequestBaseConfig): Promise<Response>
+
+export function deviceinfo_center_upload(
+  params: { deviceName: string; name?: string } & RequestBaseConfig,
+): Promise<Response>
+
 export function digitalAlbum_ordering(
   params: {
     payment: string
@@ -618,6 +717,10 @@ export function dj_toplist_popular(
   params: { limit?: string | number } & RequestBaseConfig,
 ): Promise<Response>
 
+export function eapi_decrypt(
+  params: { hexString: string; isReq?: boolean | string } & RequestBaseConfig,
+): Promise<Response>
+
 export function event(
   params: { pagesize?: number; lasttime?: number } & RequestBaseConfig,
 ): Promise<Response>
@@ -626,6 +729,20 @@ export function event_del(
   params: { evId: string | number } & RequestBaseConfig,
 ): Promise<Response>
 
+export const enum EventPrivacy {
+  everyone = 0,
+  following = 1,
+  onlyMe = 2,
+  mutualFollowing = 6,
+}
+
+export function event_privacy(
+  params: {
+    evId: string | number
+    privacy: EventPrivacy
+  } & RequestBaseConfig,
+): Promise<Response>
+
 export function event_forward(
   params: {
     forwords: string
@@ -665,6 +782,8 @@ export function hot_topic(
   params: MultiPageConfig & RequestBaseConfig,
 ): Promise<Response>
 
+export function inner_version(params: RequestBaseConfig): Promise<Response>
+
 export function like(
   params: {
     like?: 'true' | 'false' | boolean
@@ -678,6 +797,10 @@ export function likelist(
   params: { uid: string | number } & RequestBaseConfig,
 ): Promise<Response>
 
+export function listentogether_status(
+  params: RequestBaseConfig,
+): Promise<Response>
+
 export function login(
   params: { email: string; password: string } & RequestBaseConfig,
 ): Promise<Response>
@@ -724,6 +847,17 @@ export function lyric_new(
   params: { id: string | number } & RequestBaseConfig,
 ): Promise<Response>
 
+export function middle_play_do_lottery(
+  params: {
+    activityId?: string | number
+    drawCount?: string | number
+  } & RequestBaseConfig,
+): Promise<Response>
+
+export function middle_play_lottery_remain_chance(
+  params: { activityId?: string | number } & RequestBaseConfig,
+): Promise<Response>
+
 export function msg_comments(
   params: {
     uid: string | number
@@ -946,6 +1080,22 @@ export function register_cellphone(
   } & RequestBaseConfig,
 ): Promise<Response>
 
+export function register_checktoken_v2(
+  params: { refresh?: boolean | string } & RequestBaseConfig,
+): Promise<Response>
+
+export function register_checktoken_v3(
+  params: { refresh?: boolean | string } & RequestBaseConfig,
+): Promise<Response>
+
+export function register_neapikey(
+  params: { version?: string | number; behavior?: string } & RequestBaseConfig,
+): Promise<Response>
+
+export function register_xeapikey(
+  params: { deviceId?: string; currentKeyVersion?: string } & RequestBaseConfig,
+): Promise<Response>
+
 export function related_allvideo(
   params: { id: string | number } & RequestBaseConfig,
 ): Promise<Response>
@@ -954,6 +1104,67 @@ export function related_playlist(
   params: { id: string | number } & RequestBaseConfig,
 ): Promise<Response>
 
+export function relay_play_state_submit(
+  params: {
+    id: string | number
+    sessionId?: string
+    progress?: string | number
+    playMode?: string
+    type?: string
+  } & RequestBaseConfig,
+): Promise<Response>
+
+export function rep_ugc_activity_collect(
+  params: { activityId?: string | number } & RequestBaseConfig,
+): Promise<Response>
+
+export function rep_ugc_activity_get(
+  params: RequestBaseConfig,
+): Promise<Response>
+
+export function rep_ugc_exam_info_get(
+  params: { examType: string | number } & RequestBaseConfig,
+): Promise<Response>
+
+export function rep_ugc_exam_question_single_get(
+  params: {
+    examType: string | number
+    taskId: string | number
+  } & RequestBaseConfig,
+): Promise<Response>
+
+export function rep_ugc_exam_result_get(
+  params: {
+    examType: string | number
+    taskId: string | number
+  } & RequestBaseConfig,
+): Promise<Response>
+
+export function rep_ugc_exam_start(
+  params: { examType: string | number } & RequestBaseConfig,
+): Promise<Response>
+
+export function rep_ugc_exam_submit(
+  params: {
+    examType: string | number
+    taskId: string | number
+    questionId: string | number
+    answer: string
+  } & RequestBaseConfig,
+): Promise<Response>
+
+declare const rep_ugc_user_collect_vip: (
+  params: { activityId?: string | number } & RequestBaseConfig,
+) => Promise<Response>
+
+export { rep_ugc_user_collect_vip as 'rep_ugc_user_collect-vip' }
+
+export function rep_ugc_user_get(params: RequestBaseConfig): Promise<Response>
+
+export function rep_ugc_user_sign(params: RequestBaseConfig): Promise<Response>
+
+export function rep_ugc_user_vip(params: RequestBaseConfig): Promise<Response>
+
 export const enum ResourceType {
   mv = 1,
   dj = 4,
@@ -979,6 +1190,22 @@ export function scrobble(
   } & RequestBaseConfig,
 ): Promise<Response>
 
+export function scrobble_v1(
+  params: {
+    id: string | number
+    time: string | number
+    total?: string | number
+    sourceid?: string | number
+    sourceId?: string | number
+    source?: string
+    name?: string
+    artist?: string
+    bitrate?: string | number
+    level?: string
+    vip?: boolean | string
+  } & RequestBaseConfig,
+): Promise<Response>
+
 export function search(
   params: {
     keywords: string
@@ -1160,6 +1387,7 @@ export const enum SoundQualityType {
   jyeffect = 'jyeffect',
   jymaster = 'jymaster',
   sky = 'sky',
+  vivid = 'vivid',
 }
 
 export function song_url_v1(
@@ -1267,6 +1495,25 @@ export function user_event(
   } & RequestBaseConfig,
 ): Promise<Response>
 
+export interface UserEventAllResponse {
+  code: number
+  events: Record<string, unknown>[]
+  /** Upstream account statistic; it can include events no longer returned. */
+  size: number | null
+  /** Number of unique events in `events`. */
+  retrievedCount: number
+  /** Positive difference between `size` and `retrievedCount`. */
+  unavailableCount: number | null
+  sizeMismatch: boolean | null
+  pageCount: number
+  more: false
+  lasttime: string | number | null
+}
+
+export function user_event_all(
+  params: RequestBaseConfig,
+): Promise<Response<UserEventAllResponse>>
+
 export function user_followeds(
   params: {
     uid: string | number
@@ -1433,6 +1680,23 @@ export function yunbei_task_finish(
   } & RequestBaseConfig,
 ): Promise<Response>
 
+export function yunbei_ad_task_list(
+  params: RequestBaseConfig,
+): Promise<Response>
+
+export function yunbei_ad_task_recommend_song(
+  params: {
+    offset?: number | string
+    limit?: number | string
+  } & RequestBaseConfig,
+): Promise<Response>
+
+export function yunbei_ad_task_finish(
+  params: {
+    yunbeiAmount?: number | string
+  } & RequestBaseConfig,
+): Promise<Response>
+
 export function msg_recentcontact(params: RequestBaseConfig): Promise<Response>
 
 export function hug_comment(
@@ -1474,6 +1738,20 @@ export function artist_new_song(
   } & RequestBaseConfig,
 ): Promise<Response>
 
+export function artist_new_song_playall(
+  params: RequestBaseConfig,
+): Promise<Response>
+
+export function artist_new_song_mv_list_v2(
+  params: {
+    startTimestamp?: number | string
+    before?: number | string
+    sourceType?: number | string
+    limit?: number | string
+    firstRequest?: boolean | string
+  } & RequestBaseConfig,
+): Promise<Response>
+
 export function artist_detail(
   params: {
     id: number | string
@@ -1594,6 +1872,10 @@ export function vip_growthpoint_get(
   } & RequestBaseConfig,
 ): Promise<Response>
 
+export function vip_growthpoint_getall(
+  params: RequestBaseConfig,
+): Promise<Response>
+
 export function artist_fans(
   params: { id: number | string } & MultiPageConfig & RequestBaseConfig,
 ): Promise<Response>
@@ -2049,13 +2331,18 @@ export function listen_data_report(
   } & RequestBaseConfig,
 ): Promise<Response>
 
+export function listen_data_song_play_rank(
+  params: {
+    type?: string
+    endTime?: string | number
+  } & RequestBaseConfig,
+): Promise<Response>
+
 export function listen_data_today_song(
   params: RequestBaseConfig,
 ): Promise<Response>
 
-export function listen_data_total(
-  params: RequestBaseConfig,
-): Promise<Response>
+export function listen_data_total(params: RequestBaseConfig): Promise<Response>
 
 export function listen_data_year_report(
   params: RequestBaseConfig,
@@ -2192,9 +2479,7 @@ export function radio_sport_get(
   } & RequestBaseConfig,
 ): Promise<Response>
 
-export function recent_listen_list(
-  params: RequestBaseConfig,
-): Promise<Response>
+export function recent_listen_list(params: RequestBaseConfig): Promise<Response>
 
 export function recommend_songs_dislike(
   params: {
@@ -2202,9 +2487,7 @@ export function recommend_songs_dislike(
   } & RequestBaseConfig,
 ): Promise<Response>
 
-export function register_anonimous(
-  params: RequestBaseConfig,
-): Promise<Response>
+export function register_anonimous(params: RequestBaseConfig): Promise<Response>
 
 export function sati_resource_list(
   params: {
@@ -2229,9 +2512,7 @@ export function sati_resource_sub_list(
   params: RequestBaseConfig,
 ): Promise<Response>
 
-export function sati_tag_list(
-  params: RequestBaseConfig,
-): Promise<Response>
+export function sati_tag_list(params: RequestBaseConfig): Promise<Response>
 
 export function sati_timescene_resources_get(
   params: RequestBaseConfig,
@@ -2275,6 +2556,10 @@ export function song_chorus(
   } & RequestBaseConfig,
 ): Promise<Response>
 
+export function song_cloud_download(
+  params: { id: string | number } & RequestBaseConfig,
+): Promise<Response>
+
 export function song_creators(
   params: {
     id: string | number
@@ -2363,9 +2648,7 @@ export function song_url_match(
   } & RequestBaseConfig,
 ): Promise<Response>
 
-export function song_url_ncmget(
-  params: RequestBaseConfig,
-): Promise<Response>
+export function song_url_ncmget(params: RequestBaseConfig): Promise<Response>
 
 export function song_url_v1_302(
   params: {
@@ -2388,10 +2671,20 @@ export function threshold_detail_get(
   params: RequestBaseConfig,
 ): Promise<Response>
 
-export function toplist_detail_v2(
-  params: RequestBaseConfig,
+export function thinktank_audit_resource_detail(
+  params: { type?: string | number } & RequestBaseConfig,
 ): Promise<Response>
 
+export function thinktank_audit_resource_update(
+  params: {
+    type?: string | number
+    taskId: string | number
+    judgement: string | number
+  } & RequestBaseConfig,
+): Promise<Response>
+
+export function toplist_detail_v2(params: RequestBaseConfig): Promise<Response>
+
 export function ugc_album_get(
   params: {
     id: string | number
@@ -2433,9 +2726,7 @@ export function ugc_song_get(
   } & RequestBaseConfig,
 ): Promise<Response>
 
-export function ugc_user_devote(
-  params: RequestBaseConfig,
-): Promise<Response>
+export function ugc_user_devote(params: RequestBaseConfig): Promise<Response>
 
 export function user_detail_new(
   params: {
@@ -2516,14 +2807,18 @@ export function verify_qrcodestatus(
   } & RequestBaseConfig,
 ): Promise<Response>
 
-export function vip_sign(
-  params: RequestBaseConfig,
+export function vip_sign(params: RequestBaseConfig): Promise<Response>
+
+export function vip_sign_detail(
+  params: { timestamp: string | number } & RequestBaseConfig,
 ): Promise<Response>
 
-export function vip_sign_info(
-  params: RequestBaseConfig,
+export function vip_sign_history(
+  params: { type?: string | number } & RequestBaseConfig,
 ): Promise<Response>
 
+export function vip_sign_info(params: RequestBaseConfig): Promise<Response>
+
 export function vip_tasks_v1(
   params: {
     id?: string | number
@@ -2542,6 +2837,22 @@ export function voice_upload(
       name: string
       data: string | Buffer
     }
+    imgFile?: {
+      name: string
+      data: string | Buffer
+    }
+    voiceListId: string | number
+    coverImgId?: string | number
+    categoryId: string | number
+    secondCategoryId: string | number
+    description: string
+    songName?: string
+    privacy?: string | number
+    publishTime?: string | number
+    autoPublish?: string | number
+    autoPublishText?: string
+    orderNo?: string | number
+    composedSongs?: string
   } & RequestBaseConfig,
 ): Promise<Response>
 
@@ -2580,3 +2891,28 @@ export function voicelist_trans(
   } & MultiPageConfig &
     RequestBaseConfig,
 ): Promise<Response>
+
+export function fans_group_detail(
+  params: {
+    groupId: string
+    scene?: string
+  } & RequestBaseConfig,
+): Promise<Response>
+
+export function fans_group_feed_recommend(
+  params: {
+    fansGroupId: string
+    cursor?: string
+    size?: string | number
+  } & RequestBaseConfig,
+): Promise<Response>
+
+export function fans_group_user_groups(
+  params?: RequestBaseConfig,
+): Promise<Response>
+
+export function fans_group_user_group_detail(
+  params: {
+    groupId: string | number
+  } & RequestBaseConfig,
+): Promise<Response>

main.js

@@ -1,13 +1,7 @@
 const fs = require('fs')
 const path = require('path')
-const tmpPath = require('os').tmpdir()
 const { cookieToJson } = require('./util')
 
-const anonymousTokenPath = path.resolve(tmpPath, 'anonymous_token')
-if (!fs.existsSync(anonymousTokenPath)) {
-  fs.writeFileSync(anonymousTokenPath, '', 'utf-8')
-}
-
 /** @type {Record<string, any>} */
 let obj = {}
 
@@ -25,9 +19,7 @@ moduleFiles.forEach((file) => {
 
   obj[fn] = function (data = {}) {
     const cookie =
-      typeof data.cookie === 'string'
-        ? cookieToJson(data.cookie)
-        : data.cookie || {}
+      typeof data.cookie === 'string' ? cookieToJson(data.cookie) : data.cookie
 
     return fileModule(
       {
@@ -46,6 +38,7 @@ moduleFiles.forEach((file) => {
 })
 
 let serverModule = null
+let generateConfigModule = null
 
 /**
  * @type {Record<string, any> & import("./server")}
@@ -57,6 +50,17 @@ module.exports = {
     }
     return serverModule
   },
+  /**
+   * 刷新运行时动态配置（匿名令牌 / xeapi 公钥，存于内存 runtimeState）。
+   * 作为依赖使用时可以不调用——首个请求会在凭证缺失时自动引导；
+   * 需要预热或手动续期时再 `await main.generateConfig()`。
+   */
+  get generateConfig() {
+    if (!generateConfigModule) {
+      generateConfigModule = require('./generateConfig')
+    }
+    return generateConfigModule
+  },
   ...obj,
 }
 

main.test.js

@@ -16,3 +16,63 @@ describe('methods in module', () => {
     assert.strictEqual(typeof main.activate_init_profile, 'function')
   })
 })
+
+describe('runtimeState', () => {
+  const runtimeState = require('./util/runtimeState')
+
+  it('has generateConfig for bootstrapping in-memory credentials', () => {
+    assert.strictEqual(typeof main.generateConfig, 'function')
+  })
+
+  it('exposes anonymousToken / xeapiPublicKey in memory', () => {
+    assert.ok('anonymousToken' in runtimeState)
+    assert.ok('xeapiPublicKey' in runtimeState)
+  })
+
+  describe('ensure()', () => {
+    it('returns existing value without refreshing', async () => {
+      runtimeState.ensureProbe = 'ready'
+      let called = 0
+      const value = await runtimeState.ensure('ensureProbe', async () => {
+        called++
+      })
+      assert.strictEqual(value, 'ready')
+      assert.strictEqual(called, 0)
+      delete runtimeState.ensureProbe
+    })
+
+    it('refreshes when missing and shares one task among concurrent calls', async () => {
+      let refreshes = 0
+      const refresh = () =>
+        new Promise((resolve) =>
+          setTimeout(() => {
+            refreshes++
+            runtimeState.ensureProbe = 'fresh'
+            resolve()
+          }, 20),
+        )
+      const results = await Promise.all([
+        runtimeState.ensure('ensureProbe', refresh),
+        runtimeState.ensure('ensureProbe', refresh),
+        runtimeState.ensure('ensureProbe', refresh),
+      ])
+      assert.deepStrictEqual(results, ['fresh', 'fresh', 'fresh'])
+      assert.strictEqual(refreshes, 1)
+      delete runtimeState.ensureProbe
+    })
+
+    it('propagates refresh failure and allows retry', async () => {
+      let attempts = 0
+      const fail = async () => {
+        attempts++
+        throw new Error('boom')
+      }
+      await assert.rejects(runtimeState.ensure('ensureProbe', fail), /boom/)
+      assert.strictEqual(attempts, 1)
+      // 失败后任务被清理，下一次调用会重试
+      await assert.rejects(runtimeState.ensure('ensureProbe', fail), /boom/)
+      assert.strictEqual(attempts, 2)
+      delete runtimeState.ensureProbe
+    })
+  })
+})

module/ad_get.js

@@ -0,0 +1,51 @@
+// 获取广告
+
+const createOption = require('../util/option.js')
+
+module.exports = async (query, request) => {
+  const data = {
+    type_ids: query.type_ids || '["400002_0"]',
+  }
+
+  const option = createOption(query, 'xeapi', 'v3')
+
+  const res = await request(`/api/ad/get`, data, option)
+  const raw = res.body
+
+  // 提取广告中的 req_id
+  let reqId = ''
+  try {
+    if (raw?.ads) {
+      const ad = Object.values(raw.ads)[0]
+      // 逆向 v9.5.61：客户端从 ad.adExtMap["req_id"] 取 reqUid
+      if (ad?.adExtMap) {
+        if (typeof ad.adExtMap === 'string') {
+          try {
+            reqId = JSON.parse(ad.adExtMap).req_id || ''
+          } catch (_) {}
+        } else {
+          reqId = ad.adExtMap.req_id || ''
+        }
+      }
+      // 兜底：adLogId.requestId / ad.reqId / extJson.contextInfo.req_id
+      if (!reqId && ad?.adLogId?.requestId) reqId = ad.adLogId.requestId
+      if (!reqId && ad?.reqId) reqId = ad.reqId
+      if (!reqId && ad?.extJson) {
+        try {
+          const ext = JSON.parse(ad.extJson)
+          reqId = ext?.contextInfo?.req_id || ''
+        } catch (_) {}
+      }
+    }
+  } catch (_) {}
+
+  return {
+    status: 200,
+    body: {
+      code: 200,
+      ads: raw?.ads || null,
+      message: raw?.message || null,
+      extra: { reqId },
+    },
+  }
+}

module/ad_listening_rights.js

@@ -0,0 +1,13 @@
+// 获取免费听时长状态
+
+const createOption = require('../util/option.js')
+module.exports = (query, request) => {
+  const data = {
+    entrance: 'FREE_LISTEN_RN',
+  }
+  return request(
+    `/api/ad/homepage/free/tab/extend/v2`,
+    data,
+    createOption(query, 'xeapi'),
+  )
+}

module/ad_listening_rights_gain.js

@@ -0,0 +1,252 @@
+// 看广告免费听歌 - 领取免费听权益
+// 请求流程（基于逆向网易云音乐 v9.5.61 原生 Kotlin 源码，classes5/18/19.dex）：
+// 1. 从广告平台拉广告 → 用户看完/点击广告 → 获取 ad 对象的 extJson.contextInfo.req_id 作为 reqUid
+// 2. 调用本接口传入 reqUid 及相关权益参数，领取权益
+// 3. 服务器返回 gainFlag 等标识，用于展示领取结果
+//
+// 调用链（逆向还原）：
+//   AdDSLIncentiveVideoRightsHelper.requestRightsGainInner
+//     → AdDSLUtils.requestRightGain(ad, exposeTime, clickTime, creativeType, cb)
+//     → 构造 ListeningRightRequestParams（21 字段）→ JSON.stringify
+//     → body = { "reqParam": "..." } → POST /api/ad/listening/rights/gain
+//   （注意：客户端 AdDSLIncentiveVideoRightsHelper 写死 creativeType=36）
+//
+// 接口不只领取听歌时长，还包含"看视频得云贝"等权益：
+//   rightsGainMethod=6 (LAXIN_EXPOSE_OR_DOWNLOAD 拉新曝光/下载分段权益) 时，
+//   弹窗 AdLaxinSegmentedGuideDialog 展示 "获得X云贝"（2000 云贝等），
+//   权益数值由广告下发的 AdLaxinSegmentedRightsGuidePopup.rightsValue 决定，
+//   extraRightsType 作为权益类型随本接口上传。
+//
+// rightsGainMethod 枚举（h80/a）：
+//   1=EXPOSE 曝光, 2=EXPOSE_CLICK 曝光+点击, 3=EXPOSE_DOWNLOAD 曝光+下载,
+//   4=CLICK_STAY 点击+停留, 5=EXPOSURE_OR_CLICK_STAY 曝光或点击停留,
+//   6=LAXIN_EXPOSE_OR_DOWNLOAD 拉新曝光/下载分段权益
+
+const createOption = require('../util/option.js')
+const adGet = require('./ad_get.js')
+
+// 安全 JSON 解析（字符串字段可能是 JSON 文本）
+function safeParse(str, fallback) {
+  if (typeof str !== 'string') return fallback
+  try {
+    return JSON.parse(str)
+  } catch (_) {
+    return fallback
+  }
+}
+
+module.exports = async (query, request) => {
+  const time = Date.now()
+
+  // 从广告对象自动补齐请求字段。
+  // 实测 v9.5.61 真实 API 返回（/ad/get）确认的字段路径：
+  //   reqUid        = ad.extJson.contextInfo.req_id（真实响应中唯一存在）
+  //   contextInfo   = ad.extJson.contextInfo（完整对象序列化）
+  //   generalRightsInfo = ad.generalRightsInfo（字符串 JSON）
+  //   creativeType  = ad.creativeType
+  //   rightsGainMethod / extraRightsType / rightsGainDuration / rightsGainType /
+  //   extraRightsGainMethod / extraRightsGainDuration / nextRightsGainDuration /
+  //   rightsExtJson / source / rightsUpperLimit / qualified
+  //                 = ad.generalRightsInfo（字符串）解析后取值
+  //   （逆向类字段 adExtMap/adLogId/listeningRightHintInfo 真实响应中不存在，仅兜底）
+  //   sniffTime     = method==3 或 6 时 currentTimeMillis
+  let reqUid = query.reqUid || ''
+  let contextInfo = query.contextInfo
+  let creativeType = query.creativeType
+  let generalRightsInfo = query.generalRightsInfo
+
+  // 广告 hint 配置：仅当调用方未显式传参时用广告下发值兜底
+  const hint = {}
+
+  if (!reqUid || contextInfo === undefined || creativeType === undefined) {
+    try {
+      const adRes = await adGet(
+        { ...query, type_ids: query.type_ids || '["400002_0"]' },
+        request,
+      )
+      const ad = Object.values(adRes?.body?.ads || {})[0]
+      if (!ad) throw new Error('ads 为空（未登录或广告位无广告）')
+
+      // reqUid：真实 API 返回中 req_id 在 ad.extJson.contextInfo.req_id（实测 v9.5.61）
+      //   （逆向类字段 adExtMap/adLogId 在真实响应中不存在，仅作兜底）
+      if (!reqUid) {
+        const ext =
+          typeof ad?.extJson === 'string'
+            ? safeParse(ad.extJson, {})
+            : ad?.extJson || {}
+        const extMap =
+          typeof ad?.adExtMap === 'string'
+            ? safeParse(ad.adExtMap, {})
+            : ad?.adExtMap
+        reqUid =
+          ext?.contextInfo?.req_id ||
+          extMap?.req_id ||
+          ad?.adLogId?.requestId ||
+          ad?.reqId ||
+          adRes?.body?.extra?.reqId ||
+          ''
+      }
+      // contextInfo：真实 API 返回中在 ad.extJson.contextInfo（实测 v9.5.61）
+      if (contextInfo === undefined) {
+        const ext =
+          typeof ad?.extJson === 'string'
+            ? safeParse(ad.extJson, {})
+            : ad?.extJson || {}
+        const ci =
+          ext?.contextInfo || ad?.adLogId?.contextInfo || ad?.showContext
+        if (ci) {
+          contextInfo = typeof ci === 'string' ? ci : JSON.stringify(ci)
+        }
+      }
+      if (creativeType === undefined && ad?.creativeType !== undefined) {
+        creativeType = ad.creativeType
+      }
+      if (generalRightsInfo === undefined && ad?.generalRightsInfo) {
+        generalRightsInfo =
+          typeof ad.generalRightsInfo === 'string'
+            ? ad.generalRightsInfo
+            : JSON.stringify(ad.generalRightsInfo)
+      }
+      // 缓存广告下发的领取配置（后续用于兜底）
+      // 实测 v9.5.61：rightsGainMethod/rightsUpperLimit/qualified 等在
+      //   ad.generalRightsInfo（字符串）里，ad.listeningRightHintInfo 真实响应中不存在
+      const hintCfg =
+        typeof ad?.listeningRightHintInfo === 'string'
+          ? safeParse(ad.listeningRightHintInfo, {})
+          : ad?.listeningRightHintInfo || {}
+      const gri =
+        typeof ad?.generalRightsInfo === 'string'
+          ? safeParse(ad.generalRightsInfo, {})
+          : ad?.generalRightsInfo || {}
+      Object.assign(hint, hintCfg, gri)
+      console.log(`自动获取 reqUid: ${reqUid}`)
+    } catch (e) {
+      // 获取广告失败，后续请求会因缺少 reqUid 被拒绝
+    }
+  }
+
+  const rightsGainMethod = query.rightsGainMethod
+    ? parseInt(query.rightsGainMethod)
+    : hint.rightsGainMethod || 2
+
+  const rightsParam = {
+    // 必填: 广告请求 ID，自动从 ad_get 获取
+    reqUid,
+
+    // 曝光时间戳
+    exposureTime: query.exposureTime ? parseInt(query.exposureTime) : time,
+
+    // 当前登录用户 ID（原版客户端从 Profile.getUserId() 获取）
+    userId: query.uid ? parseInt(query.uid) : undefined,
+
+    // 点击时间戳
+    clickTime: query.clickTime ? parseInt(query.clickTime) : time,
+
+    // 额外权益类型（拉新分段权益等，决定发放云贝/时长/下载，来自广告配置）
+    extraRightsType: query.extraRightsType
+      ? parseInt(query.extraRightsType)
+      : hint.extraRightsType !== undefined
+        ? parseInt(hint.extraRightsType)
+        : undefined,
+
+    // 是否连续播放（默认 false）
+    playContinuously: query.playContinuously ? true : false,
+
+    // 来源标识（原版从 ad.listeningRightHintInfo.source 读取）
+    source: query.source
+      ? parseInt(query.source)
+      : hint.source !== undefined
+        ? parseInt(hint.source)
+        : undefined,
+
+    // 广告创意类型（激励视频场景=36，优先取 query / 广告对象）
+    creativeType: creativeType !== undefined ? parseInt(creativeType) : 36,
+
+    // 权益领取方式（1~6 枚举，见文件头注释）
+    rightsGainMethod,
+
+    // 权益扩展方式与时长
+    extraRightsGainMethod: query.extraRightsGainMethod
+      ? parseInt(query.extraRightsGainMethod)
+      : hint.extraRightsGainMethod !== undefined
+        ? parseInt(hint.extraRightsGainMethod)
+        : undefined,
+    extraRightsGainDuration: query.extraRightsGainDuration
+      ? parseInt(query.extraRightsGainDuration)
+      : hint.extraRightsGainDuration !== undefined
+        ? parseInt(hint.extraRightsGainDuration)
+        : undefined,
+    nextRightsGainDuration: query.nextRightsGainDuration
+      ? parseInt(query.nextRightsGainDuration)
+      : hint.nextRightsGainDuration !== undefined
+        ? parseInt(hint.nextRightsGainDuration)
+        : undefined,
+
+    // 权益类型（含 RIGHTS_GAIN_TYPE_CURRENT_DAY 等取值）
+    rightsGainType: query.rightsGainType
+      ? parseInt(query.rightsGainType)
+      : hint.rightsGainType !== undefined
+        ? parseInt(hint.rightsGainType)
+        : undefined,
+
+    // 权益时长
+    rightsGainDuration: query.rightsGainDuration
+      ? parseInt(query.rightsGainDuration)
+      : hint.rightsGainDuration !== undefined
+        ? parseInt(hint.rightsGainDuration)
+        : undefined,
+
+    // 领取步骤（UNGAIN/GAINING/GAIN_FINISHED 对应的值）
+    gainMethodStep: query.gainMethodStep
+      ? parseInt(query.gainMethodStep)
+      : undefined,
+
+    // 通用权益信息（ad.generalRightsInfo 序列化 JSON）
+    generalRightsInfo,
+
+    // 权益扩展信息
+    rightsExtJson: query.rightsExtJson || hint.rightsExtJson || undefined,
+
+    // 应用信息（下载类广告）
+    appInfo: query.appInfo ? JSON.parse(query.appInfo) : undefined,
+
+    // 广告上下文（ad.adLogId.contextInfo，客户端真实来源）
+    contextInfo,
+
+    // 应用是否已安装（下载类广告）
+    installed: query.installed ? parseInt(query.installed) : undefined,
+
+    // 嗅探时间：逆向确认（classes5.dex AdDSLUtils.requestRightGain）：
+    //   rightsGainMethod==3(曝光+下载) 或 6(LAXIN) 时传 currentTimeMillis
+    sniffTime:
+      rightsGainMethod === 3 || rightsGainMethod === 6
+        ? query.sniffTime
+          ? parseInt(query.sniffTime)
+          : time
+        : undefined,
+  }
+
+  // 清理 undefined 字段
+  Object.keys(rightsParam).forEach((key) => {
+    if (rightsParam[key] === undefined) delete rightsParam[key]
+  })
+
+  // 将参数序列化为 reqParam 字符串 (与原生源码一致)
+  const data = {
+    reqParam: JSON.stringify(rightsParam),
+  }
+
+  const res = await request(
+    `/api/ad/listening/rights/gain`,
+    data,
+    createOption(query, 'xeapi', 'v3'),
+  )
+
+  return {
+    status: 200,
+    body: {
+      code: 200,
+      data: res.body,
+    },
+  }
+}

module/artist_new_song_mv_list_v2.js

@@ -0,0 +1,16 @@
+// 获取关注歌手的新歌曲和 MV
+
+const createOption = require('../util/option.js')
+module.exports = (query, request) => {
+  const data = {
+    startTimestamp: query.startTimestamp || query.before || Date.now(),
+    sourceType: query.sourceType || 1,
+    limit: query.limit || 10,
+    firstRequest: query.firstRequest ?? true,
+  }
+  return request(
+    `/api/sub/artist/new/works/song-mv/list/v2`,
+    data,
+    createOption(query, 'eapi'),
+  )
+}

module/artist_new_song_playall.js

@@ -0,0 +1,10 @@
+// 获取所有关注歌手最近的 50 首新歌
+
+const createOption = require('../util/option.js')
+module.exports = (query, request) => {
+  return request(
+    `/api/sub/artist/new/works/song/playall`,
+    {},
+    createOption(query, 'eapi'),
+  )
+}

module/banner_v3.js

@@ -0,0 +1,9 @@
+// 首页轮播（v3）
+
+const createOption = require('../util/option.js')
+module.exports = (query, request) => {
+  const data = {
+    clientType: query.clientType || 'android',
+  }
+  return request(`/api/banner/get/v3`, data, createOption(query, 'weapi'))
+}

module/captcha_safe_sent.js

@@ -0,0 +1,13 @@
+// 发送安全验证码
+
+const createOption = require('../util/option.js')
+module.exports = (query, request) => {
+  const data = {
+    ctcode: query.ctcode || '86',
+  }
+  return request(
+    `/api/sms/captcha/safe/sent`,
+    data,
+    createOption(query, 'eapi'),
+  )
+}

module/captcha_sent_v1.js

@@ -0,0 +1,16 @@
+// 发送验证码
+
+const createOption = require('../util/option.js')
+module.exports = (query, request) => {
+  const data = {
+    ctcode: query.ctcode || '86',
+    secrete: 'music_middleuser_pclogin',
+    cellphone: query.phone,
+    scene: '0',
+  }
+  return request(
+    `/api/middle/captcha/sent/v1`,
+    data,
+    createOption(query, 'eapi'),
+  )
+}

module/cellphone_existence_check.js

@@ -6,5 +6,9 @@ module.exports = (query, request) => {
     cellphone: query.phone,
     countrycode: query.countrycode,
   }
-  return request(`/api/cellphone/existence/check`, data, createOption(query))
+  return request(
+    `/api/cellphone/existence/check`,
+    data,
+    createOption(query, 'eapi'),
+  )
 }

module/comment.js

@@ -25,6 +25,6 @@ module.exports = (query, request) => {
   return request(
     `/api/resource/comments/${query.t}`,
     data,
-    createOption(query, 'weapi'),
+    createOption(query, 'eapi', 'v2'),
   )
 }

module/comment_add.js

@@ -0,0 +1,18 @@
+const { resourceTypeMap } = require('../util/config.json')
+// 发送评论
+
+const createOption = require('../util/option.js')
+module.exports = (query, request) => {
+  const data = {
+    threadId: resourceTypeMap[query.type] + query.id,
+    content: query.content,
+    resourceType: '0',
+    expressionPicId: '-1',
+    bubbleId: '-1',
+  }
+  return request(
+    `/api/resource/comments/add`,
+    data,
+    createOption(query, 'xeapi', 'v3'),
+  )
+}

module/comment_default_text.js

@@ -0,0 +1,13 @@
+// 评论默认文案
+
+const createOption = require('../util/option.js')
+module.exports = (query, request) => {
+  const data = {
+    threadId: query.threadId,
+  }
+  return request(
+    `/api/comment/default/text`,
+    data,
+    createOption(query, 'weapi'),
+  )
+}

module/comment_delete.js

@@ -0,0 +1,15 @@
+const { resourceTypeMap } = require('../util/config.json')
+// 删除评论
+
+const createOption = require('../util/option.js')
+module.exports = (query, request) => {
+  const data = {
+    commentId: query.cid,
+    threadId: resourceTypeMap[query.type] + query.id,
+  }
+  return request(
+    `/api/resource/comments/delete`,
+    data,
+    createOption(query, 'xeapi'),
+  )
+}

module/comment_hotwall_square_info.js

@@ -0,0 +1,11 @@
+// 热评墙广场信息
+
+const createOption = require('../util/option.js')
+module.exports = (query, request) => {
+  const data = {}
+  return request(
+    `/api/comment/hotwall/today/squareinfo/get`,
+    data,
+    createOption(query, 'weapi'),
+  )
+}

module/comment_reply.js

@@ -0,0 +1,17 @@
+const { resourceTypeMap } = require('../util/config.json')
+// 发送评论
+
+const createOption = require('../util/option.js')
+module.exports = (query, request) => {
+  const data = {
+    threadId: resourceTypeMap[query.type] + query.id,
+    commentId: query.cid,
+    content: query.content,
+    resourceType: '0',
+  }
+  return request(
+    `/api/v1/resource/comments/reply`,
+    data,
+    createOption(query, 'xeapi', 'v3'),
+  )
+}

module/decrypt.js

@@ -48,7 +48,7 @@ module.exports = async (query, request) => {
       case 'linuxapi': {
         if (isReq) {
           const pureHex = data.replace(/\s/g, '')
-          const decrypted = aesDecrypt(pureHex, linuxapiKey, '', 'hex')
+          const decrypted = aesDecrypt(pureHex, 'ecb', linuxapiKey, '', 'hex')
           result = JSON.parse(decrypted.toString(CryptoJS.enc.Utf8))
         } else {
           result = typeof data === 'string' ? JSON.parse(data) : data

module/device_kickoff.js

@@ -0,0 +1,14 @@
+// 强制下线设备
+
+const createOption = require('../util/option.js')
+module.exports = (query, request) => {
+  const data = {
+    key: query.deviceKey,
+    captcha: query.captcha || '',
+  }
+  return request(
+    `/api/middle/user/security/device/kickoff`,
+    data,
+    createOption(query, 'eapi'),
+  )
+}

module/device_list.js

@@ -0,0 +1,13 @@
+// 登录设备列表
+
+const createOption = require('../util/option.js')
+module.exports = (query, request) => {
+  const data = {
+    excStatus: '9',
+  }
+  return request(
+    `/api/middle/user/device/list`,
+    data,
+    createOption(query, 'eapi'),
+  )
+}

module/deviceinfo_center_upload.js

@@ -0,0 +1,28 @@
+// 上报设备中心设备名称
+// 官方 PC 端在登录成功后调用此接口，将当前登录设备在“登录设备管理”中的名称设置为自定义名称
+
+const createOption = require('../util/option.js')
+
+module.exports = async (query, request) => {
+  const deviceName = String(query.deviceName || query.name || '').trim()
+
+  if (!deviceName) {
+    return Promise.reject({
+      status: 400,
+      body: {
+        code: 400,
+        msg: '缺少必要参数: deviceName',
+      },
+    })
+  }
+
+  const data = {
+    deviceName,
+  }
+
+  return request(
+    `/api/deviceinfo/center/upload`,
+    data,
+    createOption(query, 'eapi'),
+  )
+}

module/event_privacy.js

@@ -0,0 +1,34 @@
+// 修改本人动态的可见权限
+
+const createOption = require('../util/option.js')
+
+const PRIVACY_VALUES = new Set([0, 1, 2, 6])
+
+module.exports = (query, request) => {
+  const eventId = String(query.evId ?? '').trim()
+  const rawPrivacy = String(query.privacy ?? '').trim()
+  const privacy = Number(rawPrivacy)
+
+  if (
+    !eventId ||
+    !rawPrivacy ||
+    !Number.isInteger(privacy) ||
+    !PRIVACY_VALUES.has(privacy)
+  ) {
+    return Promise.resolve({
+      status: 400,
+      body: {
+        code: 400,
+        message: 'evId is required and privacy must be one of 0, 1, 2, 6',
+      },
+      cookie: [],
+    })
+  }
+
+  const data = {
+    eventId,
+    privacy,
+  }
+
+  return request(`/api/event/privacy/op`, data, createOption(query))
+}

module/event_search.js

@@ -0,0 +1,15 @@
+// 动态搜索
+
+const createOption = require('../util/option.js')
+module.exports = (query, request) => {
+  const data = {
+    keyword: query.keyword || query.keywords || '',
+    limit: query.limit || 30,
+    offset: query.offset || 0,
+  }
+  return request(
+    `/api/event/search/list/get/v1`,
+    data,
+    createOption(query, 'weapi'),
+  )
+}

module/fans_group_detail.js

@@ -0,0 +1,15 @@
+// 乐迷团详情
+
+const createOption = require('../util/option.js')
+
+module.exports = (query, request) => {
+  const data = {
+    groupId: query.groupId || query.id || '',
+    scene: query.scene || '',
+  }
+  return request(
+    '/api/social/fansgroup/bff/detail/get',
+    data,
+    createOption(query, 'eapi'),
+  )
+}

module/fans_group_feed_recommend.js

@@ -0,0 +1,17 @@
+// 乐迷团推荐笔记
+
+const createOption = require('../util/option.js')
+
+module.exports = (query, request) => {
+  const data = {
+    artistSelf: query.artistSelf || '0',
+    fansGroupId: query.fansGroupId || query.groupId || '',
+    cursor: query.cursor || '0',
+    size: String(query.size || 10),
+  }
+  return request(
+    '/api/fans/group/feed/recommend/get',
+    data,
+    createOption(query, 'eapi'),
+  )
+}

module/fans_group_user_group_detail.js

@@ -0,0 +1,14 @@
+// 用户所处乐迷团详情
+
+const createOption = require('../util/option.js')
+
+module.exports = (query, request) => {
+  const data = {
+    groupId: query.groupId || query.id || '',
+  }
+  return request(
+    '/api/social/fansgroup/bff/user/group/detail/get',
+    data,
+    createOption(query, 'eapi'),
+  )
+}

module/fans_group_user_groups.js

@@ -0,0 +1,11 @@
+// 获取当前登录用户加入的全部歌手乐迷团列表
+
+const createOption = require('../util/option.js')
+
+module.exports = (query, request) => {
+  return request(
+    '/api/social/fansgroup/bff/user/groups/get',
+    {},
+    createOption(query, 'eapi'),
+  )
+}

module/like_v1.js

@@ -0,0 +1,13 @@
+// 红心与取消红心歌曲- v1
+
+const createOption = require('../util/option.js')
+module.exports = (query, request) => {
+  query.like = query.like == 'false' ? false : true
+  const data = {
+    alg: 'itembased',
+    trackId: query.id,
+    like: query.like,
+    time: '3',
+  }
+  return request(`/api/v1/radio/like`, data, createOption(query, 'xeapi', 'v3'))
+}

module/listen_data_song_play_rank.js

@@ -0,0 +1,12 @@
+// 听歌足迹 - 歌曲播放排行 (Top20)
+const createOption = require('../util/option.js')
+module.exports = (query, request) => {
+  return request(
+    `/api/content/activity/listen/data/song/play/rank`,
+    {
+      type: query.type || 'month', //周 week 月 month
+      endTime: query.endTime, // 不填就是本周/月的
+    },
+    createOption(query),
+  )
+}

module/login_cellphone.js

@@ -14,6 +14,7 @@ module.exports = async (query, request) => {
       ? query.captcha
       : query.md5_password || CryptoJS.MD5(query.password).toString(),
     remember: 'true',
+    secureCaptcha: query.sca || '',
   }
   let result = await request(
     `/api/w/login/cellphone`,

module/login_qr_create.js

@@ -1,10 +1,15 @@
 const QRCode = require('qrcode')
-const { generateChainId } = require('../util/index')
+const { generateChainId, getCookieHeader, hasCookie } = require('../util/index')
 
 module.exports = (query) => {
   return new Promise(async (resolve) => {
     const platform = query.platform || 'pc'
-    const cookie = query.cookie || ''
+    const headerCookie = getCookieHeader(query.headers)
+    const cookie = hasCookie(query.cookie)
+      ? query.cookie
+      : hasCookie(headerCookie)
+        ? headerCookie
+        : ''
 
     // 构建基础URL
     let url = `https://music.163.com/login?codekey=${query.key}`

module/middle_play_do_lottery.js

@@ -0,0 +1,24 @@
+// 云小编每日抽奖
+//
+// activityId:
+// 默认 6501202
+//
+// drawCount:
+// 默认 1
+//
+// checkToken:
+// 易盾反作弊 Token
+
+const createOption = require('../util/option.js')
+
+module.exports = (query, request) => {
+  const data = {
+    activityId: query.activityId || '6501202',
+    drawCount: query.drawCount || '1',
+  }
+  return request(
+    `/api/middle/play/do/lottery`,
+    data,
+    createOption(query, 'eapi', 'v2'),
+  )
+}

module/middle_play_lottery_remain_chance.js

@@ -0,0 +1,17 @@
+// 云小编抽奖剩余次数查询
+//
+// activityId:
+// 默认 6501202
+
+const createOption = require('../util/option.js')
+
+module.exports = (query, request) => {
+  const data = {
+    activityId: query.activityId || '6501202',
+  }
+  return request(
+    `/api/middle/play/lottery/remain/chance`,
+    data,
+    createOption(query, 'eapi'),
+  )
+}

module/personal_fm_mode.js

@@ -1,8 +1,5 @@
 // 私人FM - 模式选择
 
-// aidj, DEFAULT, FAMILIAR, EXPLORE, SCENE_RCMD ( EXERCISE, FOCUS, NIGHT_EMO  )
-// 来不及解释这几个了
-
 const createOption = require('../util/option.js')
 module.exports = (query, request) => {
   const data = {

module/pl_count.js

@@ -1,4 +1,5 @@
 // 私信和通知接口
+
 const createOption = require('../util/option.js')
 module.exports = (query, request) => {
   const data = {}

module/playlist_subscribe.js

@@ -9,6 +9,6 @@ module.exports = (query, request) => {
       ? { checkToken: query.checkToken || APP_CONF.checkToken }
       : {}),
   }
-  query.checkToken = true // 强制开启checkToken
+  query.checkToken = 'v2' // 强制开启checkToken
   return request(`/api/playlist/${path}`, data, createOption(query, 'eapi'))
 }

module/recommend_category_configs.js

@@ -0,0 +1,11 @@
+// 每日风格推荐场景配置列表获取
+
+const createOption = require('../util/option.js')
+module.exports = (query, request) => {
+  const data = {}
+  return request(
+    `/api/homepage/daily/song/config/get`,
+    data,
+    createOption(query, 'xeapi'),
+  )
+}

module/recommend_category_set.js

@@ -0,0 +1,17 @@
+// 每日风格推荐场景配置设置
+
+const createOption = require('../util/option.js')
+module.exports = (query, request) => {
+  const data = {
+    tags: JSON.stringify({
+      tagIds: String(query.tags).split(',').map(Number),
+      categoryId: Number(query.category),
+    }),
+  }
+  console.log(data)
+  return request(
+    `/api/homepage/daily/song/tag/save`,
+    data,
+    createOption(query, 'xeapi'),
+  )
+}

module/recommend_category_songs.js

@@ -0,0 +1,11 @@
+// 每日推荐风格歌曲
+
+const createOption = require('../util/option.js')
+module.exports = (query, request) => {
+  const data = {}
+  return request(
+    `/api/homepage/category/daily/song/list`,
+    data,
+    createOption(query, 'xeapi'),
+  )
+}

module/recommend_songs_v1.js

@@ -0,0 +1,13 @@
+// 每日推荐歌曲 - v1
+
+const createOption = require('../util/option.js')
+module.exports = (query, request) => {
+  const data = {
+    ispush: query.ispush || false,
+  }
+  return request(
+    `/api/v3/discovery/recommend/songs`,
+    data,
+    createOption(query, 'xeapi'),
+  )
+}

module/register_anonimous.js

@@ -1,3 +1,5 @@
+// 获取游客cookie
+
 const CryptoJS = require('crypto-js')
 const path = require('path')
 const fs = require('fs')
@@ -5,7 +7,8 @@ const ID_XOR_KEY_1 = '3go8&$8*3*3h0k(2)2'
 const logger = require('../util/logger.js')
 
 const createOption = require('../util/option.js')
-const { generateDeviceId } = require('../util/index')
+const { generateDeviceId, cookieToJson } = require('../util/index')
+const runtimeState = require('../util/runtimeState')
 
 // function getRandomFromList(list) {
 //   return list[Math.floor(Math.random() * list.length)]
@@ -23,7 +26,9 @@ function cloudmusic_dll_encode_id(some_id) {
 }
 
 module.exports = async (query, request) => {
-  const deviceId = generateDeviceId()
+  // 复用进程内已有的设备身份（真实客户端的设备 ID 是稳定的）；
+  // xeapi 公钥注册同样依赖该 deviceId
+  const deviceId = global.deviceId || generateDeviceId()
   logger.info(`Successfully registered anonimous token, deviceId: ${deviceId}`)
   global.deviceId = deviceId
   const encodedId = CryptoJS.enc.Base64.stringify(
@@ -37,9 +42,14 @@ module.exports = async (query, request) => {
   let result = await request(
     `/api/register/anonimous`,
     data,
-    createOption(query, 'weapi'),
+    createOption(query, 'xeapi'),
   )
   if (result.body.code === 200) {
+    // 注册成功后立即写入运行时状态，后续请求直接使用新令牌（无需重启）
+    const cookieObj = cookieToJson(result.cookie.join(';'))
+    if (cookieObj.MUSIC_A) {
+      runtimeState.anonymousToken = cookieObj.MUSIC_A
+    }
     result = {
       status: 200,
       body: {

module/register_checktoken_v2.js

@@ -0,0 +1,158 @@
+// 易盾反作弊 Token 注册端点
+// 通过易盾官方 Watchman SDK（Web 版，跑在 jsdom 模拟的浏览器环境里）
+// 实时调用 getToken(businessId) 获取反作弊 token，供后续带 checkToken 的请求使用
+//
+// GET  /register/checktoken/v2        → 实时获取新 token（不缓存）
+// POST /register/checktoken/v2        → 实时获取新 token
+//
+// 注意：每次获取都不缓存，模拟真实客户端每次请求使用新鲜 token，
+// 避免反作弊 token 复用触发风控。
+//
+// 注：jsdom 固定用 v24（engines >=18），其依赖链为纯 CJS，可被 pkg 静态
+// 分析自动打包；v30+ 引入纯 ESM 依赖且要求 Node >=22，无法在 CI(18-24) 与
+// pkg(node18) 目标下运行。
+//
+const { JSDOM, VirtualConsole } = require('jsdom')
+const { default: axios } = require('axios')
+const { APP_CONF } = require('../util/config.json')
+const logger = require('../util/logger')
+
+// 网易云音乐在易盾的 productNumber 与 businessId
+const PRODUCT_NUMBER = 'YD00000558929251'
+const BUSINESS_ID = 'bd5d2f973ef74cd2a61325a412ae54d9'
+const TOOL_JS_URL = `${APP_CONF.dunStaticDomain}/tool.min.js`
+
+// 最小 HTML 外壳，模拟网页环境
+const HTML =
+  '<!doctype html><html><head><meta charset="UTF-8"></head><body></body></html>'
+
+let toolJs = ''
+let wm = null // Watchman 实例（进程内复用，可反复 getToken）
+let dom = null // jsdom 实例（失败时 close 释放活动句柄，避免泄漏）
+let initPromise = null
+
+// 获取 tool.min.js（内存缓存，避免每次初始化重复下载）
+async function getToolJs() {
+  if (toolJs) return toolJs
+  const res = await axios.get(TOOL_JS_URL, { timeout: 10000 })
+  toolJs = String(res.data)
+  return toolJs
+}
+
+// 初始化 Watchman（进程内只初始化一次，实例可反复 getToken）
+async function ensureWatchman() {
+  if (wm) return wm
+  if (initPromise) return initPromise
+
+  initPromise = (async () => {
+    const js = await getToolJs()
+    const virtualConsole = new VirtualConsole()
+    virtualConsole.on('jsdomError', () => {})
+    dom = new JSDOM(HTML, {
+      url: 'https://music.163.com/',
+      referrer: 'https://music.163.com/',
+      contentType: 'text/html',
+      runScripts: 'dangerously',
+      resources: 'usable', // 允许动态加载 watchman.min.js / JSONP
+      pretendToBeVisual: true,
+      virtualConsole,
+      beforeParse(window) {
+        // 抹掉 headless 特征，避免易盾风控误判
+        Object.defineProperty(window.navigator, 'webdriver', {
+          get: () => undefined,
+        })
+        window.chrome = { runtime: {} }
+        window.navigator.languages = ['zh-CN', 'zh']
+        window.navigator.plugins = [1, 2, 3, 4, 5]
+      },
+    })
+    const script = dom.window.document.createElement('script')
+    script.textContent = js
+    dom.window.document.body.appendChild(script)
+
+    return new Promise((resolve, reject) => {
+      let settled = false
+      const timer = setTimeout(() => {
+        if (settled) return
+        settled = true
+        reject(new Error('watchman 初始化超时'))
+      }, 15000)
+      dom.window.initWatchman({
+        auto: true,
+        productNumber: PRODUCT_NUMBER,
+        onload(instance) {
+          if (settled) return
+          settled = true
+          clearTimeout(timer)
+          wm = instance
+          resolve(instance)
+        },
+        onerror(...args) {
+          if (settled) return
+          settled = true
+          clearTimeout(timer)
+          reject(new Error('watchman 初始化失败'))
+        },
+      })
+    })
+  })()
+
+  try {
+    return await initPromise
+  } catch (e) {
+    // 失败路径：关闭 jsdom 释放 rAF/子资源/定时器等活动句柄，防止每次失败泄漏约 30MB
+    if (dom) {
+      dom.window.close()
+      dom = null
+    }
+    initPromise = null
+    wm = null
+    throw e
+  }
+}
+
+// 获取新 token
+async function fetchToken() {
+  const instance = await ensureWatchman()
+  const raw = instance.getInstance()
+
+  await new Promise((resolve) => {
+    const timer = setTimeout(() => resolve(), 15000)
+    raw.I(() => {
+      clearTimeout(timer)
+      resolve()
+    })
+  })
+
+  return new Promise((resolve) => {
+    const timer = setTimeout(() => resolve(''), 15000)
+    instance.getToken(BUSINESS_ID, (tk) => {
+      clearTimeout(timer)
+      resolve(typeof tk === 'string' ? tk : '')
+    })
+  })
+}
+
+// 端点处理：每次实时获取新 token
+module.exports = async () => {
+  let token = ''
+  try {
+    token = await fetchToken()
+  } catch (e) {
+    logger.warn('[checkToken v2]', e.message)
+  }
+  return {
+    status: 200,
+    body: { code: 200, token, registered: !!token },
+  }
+}
+
+// 给 request.js 读取用：每次调用实时获取新 token，不缓存
+module.exports.getToken = async () => {
+  try {
+    return await fetchToken()
+  } catch (e) {
+    logger.warn('[checkToken v2]', e.message)
+    return ''
+  }
+}

module/register_checktoken_v3.js

@@ -0,0 +1,44 @@
+// 易盾反作弊 Token 注册端点
+// 调用后获取实时 token 并存入共享存储，供后续带 checkToken 的请求使用
+//
+// GET  /register/checktoken/v3        → 实时获取新 token（不缓存）
+// POST /register/checktoken/v3        → 实时获取新 token
+//
+// 注意：每次获取都不缓存，模拟真实客户端每次请求使用新鲜 token，
+// 避免反作弊 token 复用触发风控。
+//
+const { default: axios } = require('axios')
+const { APP_CONF } = require('../util/config.json')
+
+const URL = APP_CONF.dunDomainV3 + '/v3/b?pn=YD00000558929251'
+
+async function fetch() {
+  const res = await axios.get(URL, { timeout: 10000 })
+  const body = String(res.data)
+  const m = body.match(/null\(\[(\d+),\d+,\"([^\"]+)\"\]\)/)
+  if (m && m[1] === '200') return m[2]
+  throw new Error('易盾返回异常: ' + body.substring(0, 100))
+}
+
+// 端点处理：每次实时获取新 token
+module.exports = async () => {
+  let token = ''
+  try {
+    token = await fetch()
+  } catch (e) {
+    // token 获取失败时返回空，由调用方决定是否重试
+  }
+  return {
+    status: 200,
+    body: { code: 200, token, registered: !!token },
+  }
+}
+
+// 给 request.js 读取用：每次调用实时获取新 token，不缓存
+module.exports.getToken = async () => {
+  try {
+    return await fetch()
+  } catch (e) {
+    return ''
+  }
+}

module/register_neapikey.js

@@ -0,0 +1,48 @@
+const { default: axios } = require('axios')
+const { APP_CONF } = require('../util/config.json')
+const { saveNeapiKey } = require('../util/neapiKey')
+const { decodeConfig } = require('../util/neapiConfig')
+
+const USER_AGENT =
+  'NeteaseMusic/9.5.61.260802021928(9005061);Dalvik/2.1.0 (Linux; U; Android 12; HBN-AL00 Build/cd737a2.0)'
+
+module.exports = async (query, request) => {
+  const version = Number(query.version) || 0
+  const behavior = query.behavior === 'update' ? 'update' : 'open'
+
+  const res = await axios({
+    method: 'GET',
+    url: APP_CONF.apiDomain + '/api/gorilla/algorithm/record',
+    params: { version, behavior },
+    headers: { 'User-Agent': USER_AGENT },
+    proxy: false,
+  })
+
+  if (!res.data || res.data.code !== 200 || !res.data.data) {
+    throw new Error('neapi config request failed')
+  }
+
+  // file 为空表示本地已是最新，无需更新
+  const { file, circleTime } = res.data.data
+  const config = file
+    ? saveNeapiKey(decodeConfig(Buffer.from(file, 'base64')), circleTime)
+    : null
+
+  // 只回版本与密钥偏移，密钥本身留在本地缓存
+  const keyOffsets = {}
+  if (config) {
+    keyOffsets.encrypt = config.keyBlob.indexOf(config.encryptKey)
+    keyOffsets.decrypt = config.keyBlob.indexOf(config.decryptKey)
+  }
+
+  return {
+    status: 200,
+    body: {
+      version: config ? config.version : res.data.data.version,
+      updated: Boolean(config),
+      circleTime,
+      keyOffsets,
+    },
+    cookie: [],
+  }
+}

module/register_xeapikey.js

@@ -1,6 +1,7 @@
 const { default: axios } = require('axios')
-const encrypt = require('./crypto')
-const { APP_CONF } = require('./config.json')
+const encrypt = require('../util/crypto')
+const { APP_CONF } = require('../util/config.json')
+const runtimeState = require('../util/runtimeState')
 
 const generateNonce = () => {
   let nonce = ''
@@ -10,12 +11,15 @@ const generateNonce = () => {
   return nonce
 }
 
-const getXeapiPublicKey = async (currentPublicKey = {}, deviceId = '') => {
+module.exports = async (query, request) => {
   const nonce = generateNonce()
   const timestamp = String(Date.now())
+  const deviceId = query.deviceId || global.deviceId || ''
+  const currentKeyVersion = query.currentKeyVersion || ''
+
   const data = {
-    appVersion: '9.1.65',
-    currentKeyVersion: currentPublicKey.version || '',
+    appVersion: '9.5.61',
+    currentKeyVersion,
     deviceId,
     nonce,
     os: 'android',
@@ -26,17 +30,19 @@ const getXeapiPublicKey = async (currentPublicKey = {}, deviceId = '') => {
     timestamp,
     uid: '',
   }
+
   const res = await axios({
     method: 'POST',
-    url: APP_CONF.apiDomain + '/api/gorilla/anti/crawler/security/key/get',
+    url: APP_CONF.apiDomain + '/api/bsr/sk/get',
     headers: {
       'User-Agent':
-        'NeteaseMusic/9.1.65.240927161425(9001065);Dalvik/2.1.0 (Linux; U; Android 14; 23013RK75C Build/UKQ1.230804.001)',
+        'NeteaseMusic/9.5.61.260802021928(9005061);Dalvik/2.1.0 (Linux; U; Android 12; HBN-AL00 Build/cd737a2.0)',
       Cookie: deviceId ? `deviceId=${encodeURIComponent(deviceId)}` : '',
     },
     data: new URLSearchParams(data).toString(),
     proxy: false,
   })
+
   if (
     !res.data ||
     res.data.code !== 200 ||
@@ -54,15 +60,19 @@ const getXeapiPublicKey = async (currentPublicKey = {}, deviceId = '') => {
   }
 
   const publicKey = encrypt.xeapiDecryptPublicKey(res.data.data.encryptedData)
-  if (!publicKey.sk && currentPublicKey.sk) {
-    publicKey.sk = currentPublicKey.sk
-  }
   if (!publicKey.sk) {
     throw new Error('xeapi public key response missing sk')
   }
-  return publicKey
-}
 
-module.exports = {
-  getXeapiPublicKey,
+  // 获取成功后立即写入运行时状态，供 util/request.js 的 xeapi 请求使用
+  runtimeState.xeapiPublicKey = { ...publicKey, deviceId }
+
+  return {
+    status: 200,
+    body: {
+      ...publicKey,
+      deviceId,
+    },
+    cookie: [],
+  }
 }

module/relay_play_state_submit.js

@@ -0,0 +1,49 @@
+// 提交歌曲播放状态
+
+const createOption = require('../util/option.js')
+const generateSessionId = () =>
+  Array.from(
+    { length: 12 },
+    () =>
+      'ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789'[Math.floor(Math.random() * 36)],
+  ).join('')
+
+module.exports = (query, request) => {
+  const {
+    id,
+    sessionId,
+    progress = 0,
+    playMode = 'list_loop',
+    type = 'song',
+  } = query
+
+  if (!id) {
+    return Promise.reject({
+      status: 400,
+      body: {
+        code: 400,
+        msg: '缺少必要参数：id',
+      },
+    })
+  }
+
+  const playStateSubmitReq = JSON.stringify({
+    resource: {
+      id: String(id),
+      type: type,
+    },
+    progress: Number(progress) || 0,
+    sessionId: sessionId || generateSessionId(),
+    playMode: playMode,
+  })
+
+  const data = {
+    playStateSubmitReq: playStateSubmitReq,
+  }
+
+  return request(
+    '/api/relay/play/state/submit',
+    data,
+    createOption(query, 'weapi'),
+  )
+}

module/rep_ugc_activity_collect.js

@@ -0,0 +1,17 @@
+// 云小编领取任务积分
+//
+// activityId:
+// 调用 rep/ugc/activity/get 获取
+
+const createOption = require('../util/option.js')
+
+module.exports = (query, request) => {
+  const data = {
+    activityId: query.activityId || '5001',
+  }
+  return request(
+    `/api/rep/ugc/activity/collect`,
+    data,
+    createOption(query, 'eapi'),
+  )
+}

module/rep_ugc_activity_get.js

@@ -0,0 +1,7 @@
+// 云小编活动信息
+
+const createOption = require('../util/option.js')
+
+module.exports = (query, request) => {
+  return request(`/api/rep/ugc/activity/get`, {}, createOption(query, 'eapi'))
+}

module/rep_ugc_exam_info_get.js

@@ -0,0 +1,28 @@
+// 云小编考试状态
+//
+// examType:
+// 1. 歌曲曲风审核: musicalStyleEnter
+// 2. 歌曲语种审核: languageEnter
+// 3. 歌曲原唱审核: oriSingerEnter
+// 4. 情绪标签审核: emotionEnter
+
+const createOption = require('../util/option.js')
+
+module.exports = (query, request) => {
+  if (!query.examType)
+    return Promise.reject({
+      status: 400,
+      body: {
+        code: 400,
+        message: '参数不足',
+      },
+    })
+  const data = {
+    examType: query.examType,
+  }
+  return request(
+    '/api/rep/ugc/exam/info/get',
+    data,
+    createOption(query, 'eapi'),
+  )
+}

module/rep_ugc_exam_question_single_get.js

@@ -0,0 +1,32 @@
+// 云小编考试取题
+//
+// examType:
+// 1. 歌曲曲风审核: musicalStyleEnter
+// 2. 歌曲语种审核: languageEnter
+// 3. 歌曲原唱审核: oriSingerEnter
+// 4. 情绪标签审核: emotionEnter
+//
+// taskId:
+// 首次调用 rep/ugc/exam/start 获取，之后调用 rep/ugc/exam/info/get 获取
+
+const createOption = require('../util/option.js')
+
+module.exports = (query, request) => {
+  if (!query.examType || !query.taskId)
+    return Promise.reject({
+      status: 400,
+      body: {
+        code: 400,
+        message: '参数不足',
+      },
+    })
+  const data = {
+    examType: query.examType,
+    taskId: query.taskId,
+  }
+  return request(
+    '/api/rep/ugc/exam/question/single/get',
+    data,
+    createOption(query, 'eapi'),
+  )
+}

module/rep_ugc_exam_result_get.js

@@ -0,0 +1,32 @@
+// 云小编考试结果
+//
+// examType:
+// 1. 歌曲曲风审核: musicalStyleEnter
+// 2. 歌曲语种审核: languageEnter
+// 3. 歌曲原唱审核: oriSingerEnter
+// 4. 情绪标签审核: emotionEnter
+//
+// taskId:
+// 首次调用 rep/ugc/exam/start 获取，之后调用 rep/ugc/exam/info/get 获取
+
+const createOption = require('../util/option.js')
+
+module.exports = (query, request) => {
+  if (!query.examType || !query.taskId)
+    return Promise.reject({
+      status: 400,
+      body: {
+        code: 400,
+        message: '参数不足',
+      },
+    })
+  const data = {
+    examType: query.examType,
+    taskId: query.taskId,
+  }
+  return request(
+    '/api/rep/ugc/exam/result/get',
+    data,
+    createOption(query, 'eapi'),
+  )
+}

module/rep_ugc_exam_start.js

@@ -0,0 +1,24 @@
+// 云小编考试开始
+//
+// examType:
+// 1. 歌曲曲风审核: musicalStyleEnter
+// 2. 歌曲语种审核: languageEnter
+// 3. 歌曲原唱审核: oriSingerEnter
+// 4. 情绪标签审核: emotionEnter
+
+const createOption = require('../util/option.js')
+
+module.exports = (query, request) => {
+  if (!query.examType)
+    return Promise.reject({
+      status: 400,
+      body: {
+        code: 400,
+        message: '参数不足',
+      },
+    })
+  const data = {
+    examType: query.examType,
+  }
+  return request('/api/rep/ugc/exam/start', data, createOption(query, 'eapi'))
+}

module/rep_ugc_exam_submit.js

@@ -0,0 +1,36 @@
+// 云小编考试提交
+//
+// examType:
+// 1. 歌曲曲风审核: musicalStyleEnter
+// 2. 歌曲语种审核: languageEnter
+// 3. 歌曲原唱审核: oriSingerEnter
+// 4. 情绪标签审核: emotionEnter
+//
+// taskId:
+// 首次调用 rep/ugc/exam/start 获取，之后调用 rep/ugc/exam/info/get 获取
+//
+// questionId:
+// 调用 rep/ugc/exam/question/single/get 获取
+//
+// answer:
+// A 对, B 错
+
+const createOption = require('../util/option.js')
+
+module.exports = (query, request) => {
+  if (!query.examType || !query.taskId || !query.questionId || !query.answer)
+    return Promise.reject({
+      status: 400,
+      body: {
+        code: 400,
+        message: '参数不足',
+      },
+    })
+  const data = {
+    examType: query.examType,
+    taskId: query.taskId,
+    questionId: query.questionId,
+    answer: query.answer,
+  }
+  return request('/api/rep/ugc/exam/submit', data, createOption(query, 'eapi'))
+}

module/rep_ugc_user_collect-vip.js

@@ -0,0 +1,16 @@
+// 云小编领取一日会员
+//
+// 注：前提条件见 rep/ugc/user/vip
+
+const createOption = require('../util/option.js')
+
+module.exports = (query, request) => {
+  const data = {
+    activityId: query.activityId || '5001',
+  }
+  return request(
+    `/api/rep/ugc/user/collect-vip`,
+    data,
+    createOption(query, 'eapi'),
+  )
+}

module/rep_ugc_user_get.js

@@ -0,0 +1,7 @@
+// 云小编获取用户详情
+
+const createOption = require('../util/option.js')
+
+module.exports = (query, request) => {
+  return request(`/api/rep/ugc/user/get`, {}, createOption(query, 'eapi'))
+}

module/rep_ugc_user_sign.js

@@ -0,0 +1,7 @@
+// 云小编每日签到
+
+const createOption = require('../util/option.js')
+
+module.exports = (query, request) => {
+  return request(`/api/rep/ugc/user/sign`, {}, createOption(query, 'eapi'))
+}

module/rep_ugc_user_vip.js

@@ -0,0 +1,12 @@
+// 云小编查询会员任务状态
+//
+// 状态 (data.status)
+// 10: 用户积分达50，可免费领取1日黑胶会员
+// 20: 用户积分已达50，可免费领取1日黑胶会员
+// 30: 已领取1日黑胶会员，明天再来吧~
+
+const createOption = require('../util/option.js')
+
+module.exports = (query, request) => {
+  return request(`/api/rep/ugc/user/vip`, {}, createOption(query, 'eapi'))
+}

module/scrobble.js

@@ -1,8 +1,50 @@
 // 听歌打卡
 
 const createOption = require('../util/option.js')
-module.exports = (query, request) => {
-  const data = {
+const { getCookieHeader, hasCookie } = require('../util/index')
+const { APP_CONF } = require('../util/config.json')
+const DOMAIN = APP_CONF.clDomian
+module.exports = async (query, request) => {
+  // 注入 os=osx 的 cookie
+  const headerCookie = getCookieHeader(query.headers)
+  let cookie = hasCookie(query.cookie)
+    ? query.cookie
+    : hasCookie(headerCookie)
+      ? headerCookie
+      : process.env.NETEASE_COOKIE || ''
+  if (typeof cookie === 'object') {
+    cookie = Object.assign({ os: 'osx' }, cookie)
+  } else if (typeof cookie === 'string') {
+    if (cookie.indexOf('os=') > -1) {
+      cookie = cookie.replace(/os=[^;]+/g, 'os=osx')
+    } else if (cookie) {
+      cookie = cookie + '; os=osx'
+    } else {
+      cookie = 'os=osx'
+    }
+  } else {
+    cookie = 'os=osx'
+  }
+  query.cookie = cookie
+
+  // 1) startplay → 进「最近播放」
+  const startplayData = {
+    logs: JSON.stringify([
+      {
+        action: 'startplay',
+        json: {
+          id: query.id,
+          type: 'song',
+          mainsite: '1',
+          mainsiteWeb: '1',
+          content: `id=${query.sourceid}`,
+        },
+      },
+    ]),
+  }
+
+  // 2) play → 涨「听歌排行」计数
+  const playData = {
     logs: JSON.stringify([
       {
         action: 'play',
@@ -15,12 +57,30 @@ module.exports = (query, request) => {
           type: 'song',
           wifi: 0,
           source: 'list',
-          mainsite: 1,
-          content: '',
+          mainsite: '1',
+          mainsiteWeb: '1',
+          content: `id=${query.sourceid}`,
         },
       },
     ]),
   }
 
-  return request(`/api/feedback/weblog`, data, createOption(query, 'weapi'))
+  const option = createOption(query, 'eapi')
+  option.domain = DOMAIN
+
+  // 发送两次请求
+  const res1 = await request(`/api/feedback/weblog`, startplayData, option)
+  const res2 = await request(`/api/feedback/weblog`, playData, option)
+
+  return {
+    status: 200,
+    body: {
+      code: 200,
+      data: 'success',
+      details: {
+        startplay: res1.body,
+        play: res2.body,
+      },
+    },
+  }
 }

module/scrobble_v1.js

@@ -0,0 +1,134 @@
+// 听歌打卡 - NCBL 加密版 (仿桌面客户端 PLV/PLD 上报)
+// 复制自 https://github.com/folltoshe/netease-report-listen-song 的 PC 端日志上报方式
+//
+// PLV 和 PLD 分两次独立上传
+
+const {
+  buildPlv,
+  buildPld,
+  buildRecords,
+  extractContext,
+  parseCookie,
+  buildCookieStr,
+  buildMetaJson,
+  doUpload,
+} = require('../util/ncbl')
+const { getCookieHeader, hasCookie } = require('../util/index')
+
+module.exports = async (query, request) => {
+  // --- 参数校验 ---
+  const songId = Number(query.id)
+  if (!songId || isNaN(songId)) {
+    return { status: 400, body: { code: 400, msg: '缺少有效的 id (歌曲ID)' } }
+  }
+  const playTime = Number(query.time)
+  if (isNaN(playTime) || playTime <= 0) {
+    return {
+      status: 400,
+      body: { code: 400, msg: '缺少有效的 time (播放时长)' },
+    }
+  }
+  const totalTime = Number(query.total) || playTime
+  const sourceId = String(query.sourceid || query.sourceId || '')
+  const sourceName = query.source || 'list'
+
+  // --- 解析认证上下文 ---
+  const headerCookie = getCookieHeader(query.headers)
+  const rawCookie = hasCookie(query.cookie)
+    ? query.cookie
+    : hasCookie(headerCookie)
+      ? headerCookie
+      : process.env.NETEASE_COOKIE || ''
+  const cookieObj = parseCookie(rawCookie)
+  cookieObj.os = 'pc'
+  const ctx = extractContext(cookieObj)
+
+  // 兜底取 token
+  if (!ctx.auth.token && rawCookie) {
+    const parsed =
+      typeof rawCookie === 'string' ? parseCookie(rawCookie) : rawCookie
+    ctx.auth.token = parsed.MUSIC_U || ''
+  }
+
+  if (!ctx.auth.token) {
+    return { status: 401, body: { code: 401, msg: '缺少 MUSIC_U 鉴权令牌' } }
+  }
+
+  // --- 构建歌曲和来源 ---
+  const song = {
+    id: songId,
+    name: query.name || '',
+    artist: query.artist || '',
+    bitrate: Number(query.bitrate) || 320,
+    level: query.level || 'exhigh',
+    vip: query.vip === 'true' || query.vip === true,
+    time: totalTime,
+  }
+  const source = {
+    id: sourceId || String(songId),
+    type: 'track',
+    name: sourceName,
+  }
+
+  const metaJson = buildMetaJson(ctx)
+  const cookieStr = buildCookieStr(ctx)
+
+  const ts = Math.floor(Date.now() / 1000)
+  const played = Math.min(playTime, totalTime)
+
+  const plvBody = buildRecords([
+    { time: ts, action: '_plv', data: buildPlv(ctx, song, source) },
+  ])
+  const pldBody = buildRecords([
+    { time: ts, action: '_pld', data: buildPld(ctx, song, source, played) },
+  ])
+
+  try {
+    // 1) 上传 PLV
+    const plv = await doUpload(ctx, metaJson, plvBody, cookieStr, 'PLV')
+    if (!plv.success) {
+      const rateMsg =
+        plv.respBody?.data?.rate != null
+          ? ` (rate=${plv.respBody.data.rate})`
+          : ''
+      return {
+        status: 200,
+        body: {
+          code: plv.respBody?.code || -1,
+          msg: `PLV 上报失败${rateMsg}`,
+          details: plv.respBody,
+        },
+      }
+    }
+
+    // 2) 上传 PLD
+    const pld = await doUpload(ctx, metaJson, pldBody, cookieStr, 'PLD')
+    if (!pld.success) {
+      return {
+        status: 200,
+        body: {
+          code: pld.respBody?.code || -1,
+          msg: 'PLV 成功但 PLD 失败',
+          details: { plv: plv.respBody, pld: pld.respBody },
+        },
+      }
+    }
+
+    return {
+      status: 200,
+      body: {
+        code: 200,
+        data: 'scrobble_v1 上报成功',
+        details: {
+          plv: { fileName: plv.fileName, payloadSize: plv.payload.length },
+          pld: { fileName: pld.fileName, payloadSize: pld.payload.length },
+        },
+      },
+    }
+  } catch (err) {
+    return {
+      status: 502,
+      body: { code: 502, msg: `请求异常: ${err.message || err}` },
+    }
+  }
+}

module/search_lyric.js

@@ -0,0 +1,15 @@
+// 按歌词搜索
+
+const createOption = require('../util/option.js')
+module.exports = (query, request) => {
+  const data = {
+    keyword: query.keyword || query.keywords || '',
+    limit: query.limit || 30,
+    offset: query.offset || 0,
+  }
+  return request(
+    `/api/search/resource/lyric`,
+    data,
+    createOption(query, 'weapi'),
+  )
+}

module/search_song_list_page.js

@@ -0,0 +1,16 @@
+// 新版单曲搜索（分页）
+
+const createOption = require('../util/option.js')
+module.exports = (query, request) => {
+  const data = {
+    keyword: query.keyword || query.keywords || '',
+    limit: query.limit || 30,
+    offset: query.offset || 0,
+    scene: query.scene || 'normal',
+  }
+  return request(
+    `/api/search/song/list/page`,
+    data,
+    createOption(query, 'weapi'),
+  )
+}

module/search_suggest_mobile.js

@@ -0,0 +1,15 @@
+// 搜索联想（App 移动端版：直hit歌曲卡 + 联想词 + 热搜/原唱标签）
+// 注意：参数名为 keyword（传 s 会返回 HTTP 400 空体），
+// 与 search_suggest 的旧版 /api/search/suggest/keyword 不同。
+
+const createOption = require('../util/option.js')
+module.exports = (query, request) => {
+  const data = {
+    keyword: query.keyword || query.keywords || '',
+  }
+  return request(
+    `/api/search/suggest/keyword/get`,
+    data,
+    createOption(query, 'weapi'),
+  )
+}

module/share_resource.js

@@ -7,5 +7,9 @@ module.exports = (query, request) => {
     msg: query.msg || '',
     id: query.id || '',
   }
-  return request(`/api/share/friends/resource`, data, createOption(query))
+  return request(
+    `/api/share/friends/resource`,
+    data,
+    createOption(query, 'xeapi', 'v3'),
+  )
 }

module/song_cloud_download.js

@@ -0,0 +1,9 @@
+// 从云盘获取歌曲下载链接
+
+const createOption = require('../util/option.js')
+module.exports = (query, request) => {
+  const data = {
+    songId: query.id,
+  }
+  return request(`/api/cloud/dowonload`, data, createOption(query, 'eapi'))
+}

module/song_download_url_v1.js

@@ -1,13 +1,23 @@
 // 获取客户端歌曲下载链接 - v1
 // 此版本不再采用 br 作为音质区分的标准
-// 而是采用 standard, exhigh, lossless, hires, jyeffect(高清环绕声), sky(沉浸环绕声), jymaster(超清母带) 进行音质判断
+// 而是采用 standard, exhigh, lossless, hires, jyeffect(高清臻音), vivid(臻音全景声), jymaster(超清母带), sky(沉浸环绕声) 进行音质判断
 
 const createOption = require('../util/option.js')
+const { cookieToJson } = require('../util/index.js')
 module.exports = (query, request) => {
   const data = {
     id: query.id,
     immerseType: 'c51',
     level: query.level,
   }
-  return request(`/api/song/enhance/download/url/v1`, data, createOption(query))
+  const options = createOption(query)
+  if (query.level === 'vivid') {
+    const cookie = options.cookie
+    options.cookie = {
+      ...(typeof cookie === 'string' ? cookieToJson(cookie) : cookie),
+      os: 'android',
+      appver: '9.5.61',
+    }
+  }
+  return request(`/api/song/enhance/download/url/v1`, data, options)
 }

module/song_simi_get.js

@@ -0,0 +1,15 @@
+// 插播相似歌曲
+
+const createOption = require('../util/option.js')
+module.exports = (query, request) => {
+  const data = {
+    positionCode: 'toolBarRcmdSong',
+    resourceId: query.id,
+    resourceType: 'song',
+  }
+  return request(
+    `/api/link/position/show/resource`,
+    data,
+    createOption(query, 'eapi'),
+  )
+}

module/song_url_v1.js

@@ -1,10 +1,12 @@
 // 歌曲链接 - v1
 // 此版本不再采用 br 作为音质区分的标准
-// 而是采用 standard, exhigh, lossless, hires, jyeffect(高清环绕声), sky(沉浸环绕声), jymaster(超清母带) 进行音质判断
+// 而是采用 standard, exhigh, lossless, hires, jyeffect(高清臻音), vivid(臻音全景声), jymaster(超清母带), sky(沉浸环绕声) 进行音质判断
 // 当unblock为true时, 会尝试使用unblockmusic-utils进行解锁, 同时音质设置不会生效, 但仍然为必须传入参数
+// 当level为sky时, 可通过 immerseType 选择沉浸声类型, 支持 c512(新版c51类型)、ste2(新版环绕立体声类型)、aac2(新版aac类型)、c51(c51类型)、ste(环绕立体声类型)、aac(aac类型), 默认为 c51
 
 const logger = require('../util/logger.js')
 const createOption = require('../util/option.js')
+const { cookieToJson } = require('../util/index.js')
 module.exports = async (query, request) => {
   const {
     matchID,
@@ -15,6 +17,7 @@ module.exports = async (query, request) => {
     level: query.level,
     encodeType: 'flac',
   }
+  const options = createOption(query, 'xeapi')
   if (query.unblock === 'true') {
     try {
       const result = await matchID(query.id, query.source)
@@ -51,11 +54,16 @@ module.exports = async (query, request) => {
     }
   }
   if (data.level == 'sky') {
-    data.immerseType = 'c51'
+    data.immerseType = query.immerseType || 'c51'
   }
-  return request(
-    `/api/song/enhance/player/url/v1`,
-    data,
-    createOption(query, 'xeapi'),
-  )
+  if (data.level == 'vivid') {
+    data.encodeType = 'mp3'
+    const cookie = options.cookie
+    options.cookie = {
+      ...(typeof cookie === 'string' ? cookieToJson(cookie) : cookie),
+      os: 'android',
+      appver: '9.5.61',
+    }
+  }
+  return request(`/api/song/enhance/player/url/v1`, data, options)
 }

module/song_url_v1_302.js

@@ -1,20 +1,30 @@
 // 获取客户端歌曲下载链接 - v1
 // 此版本不再采用 br 作为音质区分的标准
-// 而是采用 standard, exhigh, lossless, hires, jyeffect(高清环绕声), sky(沉浸环绕声), jymaster(超清母带) 进行音质判断
+// 而是采用 standard, exhigh, lossless, hires, jyeffect(高清臻音), vivid(臻音全景声), jymaster(超清母带), sky(沉浸环绕声) 进行音质判断
 
 const createOption = require('../util/option.js')
+const { cookieToJson } = require('../util/index.js')
 module.exports = async (query, request) => {
   const data = {
     id: query.id,
     immerseType: 'c51',
     level: query.level,
   }
+  const options = createOption(query)
+  if (query.level === 'vivid') {
+    const cookie = options.cookie
+    options.cookie = {
+      ...(typeof cookie === 'string' ? cookieToJson(cookie) : cookie),
+      os: 'android',
+      appver: '9.5.61',
+    }
+  }
   const response = await request(
     `/api/song/enhance/download/url/v1`,
     data,
-    createOption(query),
+    options,
   )
-  let url = response?.body?.data?.[0]?.url
+  let url = response?.body?.data?.url || response?.body?.data?.[0]?.url
 
   if (!url) {
     const fallbackData = {
@@ -25,10 +35,13 @@ module.exports = async (query, request) => {
     if (query.level === 'sky') {
       fallbackData.immerseType = 'c51'
     }
+    if (query.level === 'vivid') {
+      fallbackData.encodeType = 'mp3'
+    }
     const fallback = await request(
       `/api/song/enhance/player/url/v1`,
       fallbackData,
-      createOption(query),
+      options,
     )
     url = fallback?.body?.data?.[0]?.url
 

module/song_wiki_info.js

@@ -0,0 +1,22 @@
+// 歌曲百科
+
+const createOption = require('../util/option.js')
+module.exports = (query, request) => {
+  const extJson = {
+    states: {
+      playingResource: {
+        current: query.id,
+        scene: 'songWiki',
+      },
+    },
+  }
+  const data = {
+    extJson: JSON.stringify(extJson),
+    positionCode: 'songWikiMainPosition',
+  }
+  return request(
+    `/api/link/page/parent/relation/construct/info`,
+    data,
+    createOption(query, 'eapi'),
+  )
+}

module/thinktank_audit_resource_detail.js

@@ -0,0 +1,20 @@
+// 云小编获取任务
+//
+// type:
+// 1: 歌曲曲风审核 musicalStyleEnter
+// 2: 歌曲语种审核 languageEnter
+// 3: 歌曲原唱审核 oriSingerEnter
+// 4: 情绪标签审核 emotionEnter
+
+const createOption = require('../util/option.js')
+
+module.exports = (query, request) => {
+  const data = {
+    type: query.type || '4',
+  }
+  return request(
+    `/api/thinktank/audit/resource/detail`,
+    data,
+    createOption(query, 'eapi'),
+  )
+}

module/thinktank_audit_resource_update.js

@@ -0,0 +1,36 @@
+// 云小编提交任务
+//
+// type:
+// 1: 歌曲曲风审核 musicalStyleEnter
+// 2: 歌曲语种审核 languageEnter
+// 3: 歌曲原唱审核 oriSingerEnter
+// 4: 情绪标签审核 emotionEnter
+//
+// taskId:
+// 调用 thinktank/audit/resource/detail 获取
+//
+// judgement:
+// 1: 同意, 2: 否决, 3: 跳过 (不算次数)
+
+const createOption = require('../util/option.js')
+
+module.exports = (query, request) => {
+  if (!query.taskId || !query.judgement)
+    return Promise.reject({
+      status: 400,
+      body: {
+        code: 400,
+        message: '参数不足',
+      },
+    })
+  const data = {
+    type: query.type || '4',
+    taskId: query.taskId,
+    judgement: query.judgement,
+  }
+  return request(
+    `/api/thinktank/audit/resource/update`,
+    data,
+    createOption(query, 'eapi'),
+  )
+}

module/user_event.js

@@ -4,9 +4,10 @@ const createOption = require('../util/option.js')
 module.exports = (query, request) => {
   const data = {
     getcounts: true,
-    time: query.lasttime || -1,
-    limit: query.limit || 30,
+    time: query.lasttime ?? -1,
+    limit: query.limit ?? 30,
     total: false,
+    fromRN: 'true',
   }
   return request(`/api/event/get/${query.uid}`, data, createOption(query))
 }

module/user_event_all.js

@@ -0,0 +1,135 @@
+// 获取当前登录用户可被上游枚举的全部动态
+
+const userAccount = require('./user_account.js')
+const userEvent = require('./user_event.js')
+
+const PAGE_SIZE = 100
+const MAX_PAGES = 1000
+
+const errorResponse = (message, cookie = []) => ({
+  status: 502,
+  body: {
+    code: 502,
+    message,
+  },
+  cookie,
+})
+
+module.exports = async (query, request) => {
+  const accountResult = await userAccount(query, request)
+  const uid =
+    accountResult.body?.account?.id || accountResult.body?.profile?.userId
+
+  if (!uid) {
+    if (
+      accountResult.status !== 200 ||
+      (accountResult.body?.code && accountResult.body.code !== 200)
+    ) {
+      return accountResult
+    }
+
+    return {
+      status: 401,
+      body: {
+        code: 401,
+        message: 'A valid login cookie is required',
+      },
+      cookie: accountResult.cookie || [],
+    }
+  }
+
+  const cookies = [...(accountResult.cookie || [])]
+  const events = []
+  const eventIds = new Set()
+  const cursors = new Set()
+  let lasttime = -1
+  let more = true
+  let pageCount = 0
+  let size = null
+
+  while (more) {
+    pageCount += 1
+
+    const pageResult = await userEvent(
+      {
+        ...query,
+        uid,
+        lasttime,
+        limit: PAGE_SIZE,
+      },
+      request,
+    )
+
+    cookies.push(...(pageResult.cookie || []))
+
+    if (pageResult.status !== 200 || pageResult.body?.code !== 200) {
+      return {
+        ...pageResult,
+        cookie: cookies,
+      }
+    }
+
+    if (pageCount === 1) {
+      const reportedSize = pageResult.body.size
+      const numericSize = Number(reportedSize)
+      size =
+        reportedSize != null && Number.isFinite(numericSize)
+          ? numericSize
+          : null
+    }
+
+    for (const event of pageResult.body.events || []) {
+      if (event?.id == null) {
+        events.push(event)
+        continue
+      }
+
+      const eventId = String(event.id)
+      if (!eventIds.has(eventId)) {
+        eventIds.add(eventId)
+        events.push(event)
+      }
+    }
+
+    more = Boolean(pageResult.body.more)
+    lasttime = pageResult.body.lasttime
+
+    if (more) {
+      const cursor = String(lasttime ?? '')
+      if (!cursor || cursors.has(cursor)) {
+        return errorResponse(
+          'Upstream event pagination cursor stalled',
+          cookies,
+        )
+      }
+      cursors.add(cursor)
+    }
+
+    if (more && pageCount >= MAX_PAGES) {
+      return errorResponse(
+        `Upstream event pagination exceeded ${MAX_PAGES} pages`,
+        cookies,
+      )
+    }
+  }
+
+  const retrievedCount = events.length
+  const unavailableCount =
+    size == null ? null : Math.max(size - retrievedCount, 0)
+
+  return {
+    status: 200,
+    body: {
+      code: 200,
+      events,
+      size,
+      retrievedCount,
+      unavailableCount,
+      sizeMismatch: size == null ? null : size !== retrievedCount,
+      pageCount,
+      more: false,
+      lasttime: lasttime ?? null,
+    },
+    cookie: cookies,
+  }
+}

module/vip_growthpoint_getall.js

@@ -0,0 +1,11 @@
+// 一键领取所有会员成长值
+
+const createOption = require('../util/option.js')
+module.exports = (query, request) => {
+  const data = {}
+  return request(
+    `/api/vipnewcenter/app/level/task/reward/getall`,
+    data,
+    createOption(query, 'xeapi'),
+  )
+}

module/vip_sign.js

@@ -1,11 +1,40 @@
 // 黑胶乐签打卡
 
 const createOption = require('../util/option.js')
-module.exports = (query, request) => {
-  const data = {}
-  return request(
-    `/api/vip-center-bff/task/sign`,
-    data,
+
+module.exports = async (query, request) => {
+  const results = {}
+
+  const taskSign = await request(
+    '/api/vip-center-bff/task/sign',
+    {},
     createOption(query, 'weapi'),
   )
+  results.taskSign = taskSign.body
+
+  const checkinDetail = await request(
+    '/api/vipnewcenter/app/level/user/checkin/history/detail',
+    {
+      signDayTime: Date.now(),
+      type: 1,
+    },
+    createOption(query, 'eapi'),
+  )
+  results.checkinDetail = checkinDetail.body
+
+  // 两个接口都返回 code=200 即视为打卡成功
+  const signed =
+    Number(results.taskSign?.code) === 200 &&
+    Number(results.checkinDetail?.code) === 200
+
+  return {
+    body: {
+      code: 200,
+      ...results,
+      signed,
+      message: signed ? '黑胶乐签打卡成功' : '黑胶乐签打卡失败',
+    },
+    cookie: taskSign.cookie,
+    status: 200,
+  }
 }

module/vip_sign_history.js

@@ -1,13 +1,14 @@
-// 黑胶乐签打卡历史
+// 黑胶乐签打卡历史 / 状态查询
+// 支持传入 type=0（用户信息栏）或 type=1（黑胶乐签）
 
 const createOption = require('../util/option.js')
 module.exports = (query, request) => {
   const data = {
-    type: '0',
+    type: query.type || '0',
   }
   return request(
     `/api/vipnewcenter/app/minidesk/music/sign/pc`,
     data,
-    createOption(query, 'xeapi'),
+    createOption(query, 'eapi'),
   )
 }

module/voice_upload.js

@@ -2,6 +2,7 @@ const { default: axios } = require('axios')
 const fs = require('fs')
 var xml2js = require('xml2js')
 
+const uploadPlugin = require('../plugins/upload')
 const createOption = require('../util/option.js')
 const { getFileExtension, readFileChunk } = require('../util/fileHelper')
 
@@ -19,15 +20,7 @@ function createDupkey() {
   return s.join('')
 }
 
-module.exports = async (query, request) => {
-  const ext = getFileExtension(query.songFile.name)
-  const filename =
-    query.songName ||
-    query.songFile.name
-      .replace('.' + ext, '')
-      .replace(/\s/g, '')
-      .replace(/\./g, '_')
-
+module.exports = async (query, request, dependencies = {}) => {
   if (!query.songFile) {
     return Promise.reject({
       status: 500,
@@ -38,6 +31,19 @@ module.exports = async (query, request) => {
     })
   }
 
+  const axiosRequest = dependencies.axios || axios
+  const uploadImage = dependencies.uploadPlugin || uploadPlugin
+  const ext = getFileExtension(query.songFile.name)
+  const filename =
+    query.songName ||
+    query.songFile.name
+      .replace('.' + ext, '')
+      .replace(/\s/g, '')
+      .replace(/\./g, '_')
+  const coverImgId = query.imgFile
+    ? (await uploadImage(query, request)).imgId
+    : query.coverImgId
+
   const tokenRes = await request(
     `/api/nos/token/alloc`,
     {
@@ -53,7 +59,7 @@ module.exports = async (query, request) => {
 
   const objectKey = tokenRes.body.result.objectKey.replace(/\//g, '%2F')
   const docId = tokenRes.body.result.docId
-  const res = await axios({
+  const res = await axiosRequest({
     method: 'post',
     url: `https://ymusic.nos-hz.163yun.com/${objectKey}?uploads`,
     headers: {
@@ -94,7 +100,7 @@ module.exports = async (query, request) => {
       )
     }
 
-    const res3 = await axios({
+    const res3 = await axiosRequest({
       method: 'put',
       url: `https://ymusic.nos-hz.163yun.com/${objectKey}?partNumber=${blockIndex}&uploadId=${res2.InitiateMultipartUploadResult.UploadId[0]}`,
       headers: {
@@ -117,7 +123,7 @@ module.exports = async (query, request) => {
   }
   completeStr += '</CompleteMultipartUpload>'
 
-  await axios({
+  await axiosRequest({
     method: 'post',
     url: `https://ymusic.nos-hz.163yun.com/${objectKey}?uploadId=${res2.InitiateMultipartUploadResult.UploadId[0]}`,
     headers: {
@@ -128,29 +134,29 @@ module.exports = async (query, request) => {
     data: completeStr,
   })
 
-  await request(
-    `/api/voice/workbench/voice/batch/upload/preCheck`,
-    {
-      dupkey: createDupkey(),
-      voiceData: JSON.stringify([
+  const voiceData = JSON.stringify([
     {
       name: filename,
       autoPublish: query.autoPublish == 1 ? true : false,
       autoPublishText: query.autoPublishText || '',
       description: query.description,
       voiceListId: query.voiceListId,
-          coverImgId: query.coverImgId,
+      coverImgId,
       dfsId: docId,
       categoryId: query.categoryId,
       secondCategoryId: query.secondCategoryId,
-          composedSongs: query.composedSongs
-            ? query.composedSongs.split(',')
-            : [],
+      composedSongs: query.composedSongs ? query.composedSongs.split(',') : [],
       privacy: query.privacy == 1 ? true : false,
       publishTime: query.publishTime || 0,
       orderNo: query.orderNo || 1,
     },
-      ]),
+  ])
+
+  await request(
+    `/api/voice/workbench/voice/batch/upload/preCheck`,
+    {
+      dupkey: createDupkey(),
+      voiceData,
     },
     {
       ...createOption(query),
@@ -163,25 +169,7 @@ module.exports = async (query, request) => {
     `/api/voice/workbench/voice/batch/upload/v2`,
     {
       dupkey: createDupkey(),
-      voiceData: JSON.stringify([
-        {
-          name: filename,
-          autoPublish: query.autoPublish == 1 ? true : false,
-          autoPublishText: query.autoPublishText || '',
-          description: query.description,
-          voiceListId: query.voiceListId,
-          coverImgId: query.coverImgId,
-          dfsId: docId,
-          categoryId: query.categoryId,
-          secondCategoryId: query.secondCategoryId,
-          composedSongs: query.composedSongs
-            ? query.composedSongs.split(',')
-            : [],
-          privacy: query.privacy == 1 ? true : false,
-          publishTime: query.publishTime || 0,
-          orderNo: query.orderNo || 1,
-        },
-      ]),
+      voiceData,
     },
     {
       ...createOption(query),

module/yunbei_sign.js

@@ -1,5 +1,9 @@
 const createOption = require('../util/option.js')
 module.exports = (query, request) => {
   const data = {}
-  return request(`/api/pointmall/user/sign`, data, createOption(query, 'weapi'))
+  return request(
+    `/api/pointmall/user/sign`,
+    data,
+    createOption(query, 'xeapi', 'v3'),
+  )
 }

module/yunbei_task_finish_v1.js

@@ -0,0 +1,26 @@
+// 云贝广告任务 - 完成任务领取云贝
+// 逆向来源: 云贝任务中心 H5 (st.music.163.com/yunbei-listen) main.js
+// POST /api/ad/power/yunbei/distribution/create
+// 参数: yunbeiAmount (单次可得云贝, 客户端从 list 接口的 singleAmount 取值, 当前为 150)
+// 返回: true (领取成功)
+//
+// 实测验证 (2026-08-05):
+//   - 仅传 yunbeiAmount 即可成功领取, 无需真实听歌/看视频
+//   - 单日上限 10 次 × 150 云贝 = 1500 云贝/天
+//   - 超限返回 code:400 "单日完成任务数已达上限"
+//   - 无频率限制, 800ms 间隔连续调用均成功
+//
+// 建议: 领取前先调 yunbei_ad_task_list 查询 times, 达到 10 次即停止
+
+const createOption = require('../util/option.js')
+
+module.exports = (query, request) => {
+  const data = {
+    yunbeiAmount: query.yunbeiAmount || 150,
+  }
+  return request(
+    `/api/ad/power/yunbei/distribution/create`,
+    data,
+    createOption(query, 'weapi'),
+  )
+}

module/yunbei_task_list_v1.js

@@ -0,0 +1,16 @@
+// 云贝广告任务 - 查询今日任务状态
+// 逆向来源: 云贝任务中心 H5 (st.music.163.com/yunbei-listen) main.js
+// GET /api/ad/power/yunbei/distribution/list
+// 返回: { times: 今日已完成次数, amount: 今日累计云贝, singleAmount: 单次可得云贝 }
+// 注意: 单日上限 10 次, 单次 150 云贝 (每天最多 1500)
+
+const createOption = require('../util/option.js')
+
+module.exports = (query, request) => {
+  const data = {}
+  return request(
+    `/api/ad/power/yunbei/distribution/list`,
+    data,
+    createOption(query, 'weapi'),
+  )
+}

module/yunbei_task_recommend_song.js

@@ -0,0 +1,20 @@
+// 云贝广告任务 - 获取推荐歌曲
+// 逆向来源: 云贝任务中心 H5 (st.music.163.com/yunbei-listen) main.js
+// POST /api/ad/power/yunbei/distribution/recommend/song
+// 参数: offset (默认 0), limit (默认 10, 客户端一次 10 首)
+// 返回: 推荐歌曲数组 [{ songId, songName, artistName, albumUrl, songChorusStartTime, likeFlag, alg }]
+// 注意: alg 均为 alg_payrec_yunBei_*, 为"听歌得云贝"任务专属推荐
+
+const createOption = require('../util/option.js')
+
+module.exports = (query, request) => {
+  const data = {
+    offset: query.offset || 0,
+    limit: query.limit || 10,
+  }
+  return request(
+    `/api/ad/power/yunbei/distribution/recommend/song`,
+    data,
+    createOption(query, 'weapi'),
+  )
+}

module_example/test.ts

@@ -1,10 +1,11 @@
 import { banner, lyric } from '@neteasecloudmusicapienhanced/api'
-import { logger } from '../util/logger.js'
-banner({ type: 0 }).then((res) => {
+import type { Response } from '@neteasecloudmusicapienhanced/api'
+import logger from '../util/logger.js'
+banner({ type: 0 }).then((res: Response) => {
   logger.info(res)
 })
 lyric({
   id: '33894312',
-}).then((res) => {
+}).then((res: Response) => {
   logger.info(res)
 })

module_example/yunbei_ad_task.js

@@ -0,0 +1,48 @@
+const {
+  login_cellphone,
+  yunbei_ad_task_list,
+  yunbei_ad_task_recommend_song,
+  yunbei_ad_task_finish,
+} = require('../main')
+
+// 云贝广告任务(听歌/看视频得云贝)完整流程示例
+// 1. list    - 查询今日任务状态(次数/云贝)
+// 2. finish  - 领取云贝, 仅需传 yunbeiAmount(单次 150), 无需真实听歌/看视频
+// 3. recommend/song - 可选, 获取推荐歌曲列表
+// 注意: 单日上限 10 次 x 150 = 1500 云贝/天
+
+async function main() {
+  const login = await login_cellphone({
+    phone: '手机号',
+    password: '密码',
+  })
+  const cookie = login.body.cookie
+
+  // 1. 查询今日任务状态
+  const list = await yunbei_ad_task_list({ cookie })
+  const { times, amount, singleAmount } = list.body
+  console.log(
+    `今日已完成 ${times} 次, 累计 ${amount} 云贝, 单次可得 ${singleAmount} 云贝`,
+  )
+  if (times >= 10) {
+    console.log('已达单日上限, 明天再来吧')
+    return
+  }
+
+  // 2. 领取云贝(单次 150)
+  const finish = await yunbei_ad_task_finish({
+    yunbeiAmount: singleAmount,
+    cookie,
+  })
+  console.log('领取结果:', finish.body)
+
+  // 3. 获取推荐歌曲(听歌任务专属推荐, 可选)
+  const rcmd = await yunbei_ad_task_recommend_song({
+    offset: 0,
+    limit: 10,
+    cookie,
+  })
+  console.log('推荐歌曲:', rcmd.body.map((s) => s.songName).join(', '))
+}
+
+main()

package.json

@@ -1,7 +1,7 @@
 {
   "name": "@neteasecloudmusicapienhanced/api",
-  "version": "4.34.3",
-  "description": "全网最全的网易云音乐API接口 || A revival project for NeteaseCloudMusicApi Node.js Services (Half Refactor & Enhanced) || 网易云音乐 API 备份 + 增强 || 本项目自原版v4.28.0版本后开始自行维护",
+  "version": "4.41.1",
+  "description": "全网最全的网易云音乐API接口 || A revival project for NeteaseCloudMusicApi Node.js Services (Half Refactor & Enhanced)",
   "scripts": {
     "dev": "nodemon app.js",
     "start": "node app.js",
@@ -9,9 +9,11 @@
     "lint": "eslint \"**/*.{js,ts}\"",
     "lint-fix": "eslint --fix \"**/*.{js,ts}\"",
     "prepare": "husky install",
-    "pkgwin": "pkg . -t node18-win-x64 -C GZip -o precompiled/app",
-    "pkglinux": "pkg . -t node18-linux-x64 -C GZip -o precompiled/app",
-    "pkgmacos": "pkg . -t node18-macos-x64 -C GZip -o precompiled/app"
+    "docs:format": "node scripts/format-docs.js",
+    "docs:check": "node scripts/format-docs.js --check",
+    "pkgwin": "node scripts/build-pkg.js . -t node18-win-x64 -C GZip -o precompiled/app",
+    "pkglinux": "node scripts/build-pkg.js . -t node18-linux-x64 -C GZip -o precompiled/app",
+    "pkgmacos": "node scripts/build-pkg.js . -t node18-macos-x64 -C GZip -o precompiled/app"
   },
   "bin": "./app.js",
   "pkg": {
@@ -73,44 +75,46 @@
     "data"
   ],
   "dependencies": {
-    "@neteasecloudmusicapienhanced/unblockmusic-utils": "^0.3.2",
-    "axios": "^1.16.1",
+    "@neteasecloudmusicapienhanced/unblockmusic-utils": "^0.4.5",
+    "axios": "^1.20.0",
     "crypto-js": "^4.2.0",
     "dotenv": "^17.4.2",
-    "express": "^5.2.1",
+    "express": "^5.3.0",
     "express-fileupload": "^1.5.2",
+    "fzstd": "^0.1.1",
     "gzip": "^0.1.0",
-    "music-metadata": "^11.12.3",
+    "jsdom": "^24.1.3",
+    "music-metadata": "^11.16.1",
     "node-forge": "^1.4.0",
     "pac-proxy-agent": "^7.2.0",
     "qrcode": "^1.5.4",
     "safe-decode-uri-component": "^1.2.1",
     "tunnel": "^0.0.6",
     "xml2js": "^0.6.2",
-    "yargs": "^18.0.0"
+    "yargs": "^18.2.0"
   },
   "devDependencies": {
-    "@eslint/eslintrc": "^3.3.5",
-    "@eslint/js": "^9.39.4",
+    "@eslint/eslintrc": "^3.3.7",
+    "@eslint/js": "^9.39.5",
     "@types/express": "^5.0.6",
     "@types/express-fileupload": "^1.5.1",
     "@types/mocha": "^10.0.10",
-    "@types/node": "25.5.0",
-    "@typescript-eslint/eslint-plugin": "^8.60.0",
-    "@typescript-eslint/parser": "^8.60.0",
-    "eslint": "^9.39.4",
+    "@types/node": "25.9.2",
+    "@typescript-eslint/eslint-plugin": "^8.72.0",
+    "@typescript-eslint/parser": "^8.72.0",
+    "eslint": "^9.39.5",
     "eslint-config-prettier": "^10.1.8",
-    "eslint-plugin-html": "^8.1.4",
-    "eslint-plugin-prettier": "^5.5.6",
-    "globals": "^17.6.0",
+    "eslint-plugin-html": "^8.2.1",
+    "eslint-plugin-prettier": "^5.5.7",
+    "globals": "^17.13.0",
     "husky": "^9.1.7",
     "intelli-espower-loader": "^1.1.0",
     "lint-staged": "^16.4.0",
-    "mocha": "^11.7.6",
+    "mocha": "^11.8.0",
     "nodemon": "^3.1.14",
     "pkg": "^5.8.1",
     "power-assert": "^1.6.1",
-    "prettier": "^3.8.3",
+    "prettier": "^3.9.10",
     "typescript": "^5.9.3"
   },
   "publishConfig": {