Merge pull request #237 from NeteaseCloudMusicApiEnhanced/fix/yidun

refactor: 重写checkToken V2模块
2026-08-12 08:50:38 +00:00 · 2026-08-09 11:21:39 +08:00 · 2026-08-09 11:21:39 +08:00 · c1d14a86d9
commit c1d14a86d9
parent 7753b5de41 a2a2a40d71
8 changed files with 591 additions and 67 deletions
--- a/.gitignore
+++ b/.gitignore
@ -9,4 +9,5 @@ bin
 anonymous_token
 .vercel
 .env
-IFLOW.md
+IFLOW.md
+precompiled
--- a/module/ad_listening_rights_gain.js
+++ b/module/ad_listening_rights_gain.js
@ -239,7 +239,7 @@ module.exports = async (query, request) => {
  const res = await request(
    `/api/ad/listening/rights/gain`,
    data,
-    createOption(query, 'xeapi', 'v2'),
+    createOption(query, 'xeapi', 'v3'),
  )

  return {
--- a/module/middle_play_do_lottery.js
+++ b/module/middle_play_do_lottery.js
@ -19,6 +19,6 @@ module.exports = (query, request) => {
  return request(
    `/api/middle/play/do/lottery`,
    data,
-    createOption(query, 'eapi', 'v3'),
+    createOption(query, 'eapi', 'v2'),
  )
 }
--- a/module/register_checktoken_v2.js
+++ b/module/register_checktoken_v2.js
@ -1,33 +1,145 @@
 // 易盾反作弊 Token 注册端点
-// 调用后获取实时 token 并存入共享存储，供后续带 checkToken 的请求使用
+// 通过易盾官方 Watchman SDK（Web 版，跑在 jsdom 模拟的浏览器环境里）
+// 实时调用 getToken(businessId) 获取反作弊 token，供后续带 checkToken 的请求使用
 //
-// GET  /register/checktoken        → 实时获取新 token（不缓存）
-// POST /register/checktoken        → 实时获取新 token
+// GET  /register/checktoken/v2        → 实时获取新 token（不缓存）
+// POST /register/checktoken/v2        → 实时获取新 token
 //
 // 注意：每次获取都不缓存，模拟真实客户端每次请求使用新鲜 token，
 // 避免反作弊 token 复用触发风控。
 //
+// 注：jsdom 固定用 v24（engines >=18），其依赖链为纯 CJS，可被 pkg 静态
+// 分析自动打包；v30+ 引入纯 ESM 依赖且要求 Node >=22，无法在 CI(18-24) 与
+// pkg(node18) 目标下运行。
+//
+const { JSDOM, VirtualConsole } = require('jsdom')
 const { default: axios } = require('axios')
 const { APP_CONF } = require('../util/config.json')
+const logger = require('../util/logger')

-const URL = APP_CONF.dunDomainV2 + '/v2/config/js?pn=YD00000558929251'
+// 网易云音乐在易盾的 productNumber 与 businessId
+const PRODUCT_NUMBER = 'YD00000558929251'
+const BUSINESS_ID = 'bd5d2f973ef74cd2a61325a412ae54d9'
+const TOOL_JS_URL = `${APP_CONF.dunStaticDomain}/tool.min.js`

-async function fetch() {
-  const res = await axios.get(URL, { timeout: 10000 })
-  const data = res.data
-  if (data && data.code === 200 && data.result && data.result.conf) {
-    return data.result.conf
+// 最小 HTML 外壳，模拟网页环境
+const HTML =
+  '<!doctype html><html><head><meta charset="UTF-8"></head><body></body></html>'
+
+let toolJs = ''
+let wm = null // Watchman 实例（进程内复用，可反复 getToken）
+let dom = null // jsdom 实例（失败时 close 释放活动句柄，避免泄漏）
+let initPromise = null
+
+// 获取 tool.min.js（内存缓存，避免每次初始化重复下载）
+async function getToolJs() {
+  if (toolJs) return toolJs
+  const res = await axios.get(TOOL_JS_URL, { timeout: 10000 })
+  toolJs = String(res.data)
+  return toolJs
+}
+
+// 初始化 Watchman（进程内只初始化一次，实例可反复 getToken）
+async function ensureWatchman() {
+  if (wm) return wm
+  if (initPromise) return initPromise
+
+  initPromise = (async () => {
+    const js = await getToolJs()
+    const virtualConsole = new VirtualConsole()
+    virtualConsole.on('jsdomError', () => {})
+    dom = new JSDOM(HTML, {
+      url: 'https://music.163.com/',
+      referrer: 'https://music.163.com/',
+      contentType: 'text/html',
+      runScripts: 'dangerously',
+      resources: 'usable', // 允许动态加载 watchman.min.js / JSONP
+      pretendToBeVisual: true,
+      virtualConsole,
+      beforeParse(window) {
+        // 抹掉 headless 特征，避免易盾风控误判
+        Object.defineProperty(window.navigator, 'webdriver', {
+          get: () => undefined,
+        })
+        window.chrome = { runtime: {} }
+        window.navigator.languages = ['zh-CN', 'zh']
+        window.navigator.plugins = [1, 2, 3, 4, 5]
+      },
+    })
+    const script = dom.window.document.createElement('script')
+    script.textContent = js
+    dom.window.document.body.appendChild(script)
+
+    return new Promise((resolve, reject) => {
+      let settled = false
+      const timer = setTimeout(() => {
+        if (settled) return
+        settled = true
+        reject(new Error('watchman 初始化超时'))
+      }, 15000)
+      dom.window.initWatchman({
+        auto: true,
+        productNumber: PRODUCT_NUMBER,
+        onload(instance) {
+          if (settled) return
+          settled = true
+          clearTimeout(timer)
+          wm = instance
+          resolve(instance)
+        },
+        onerror(...args) {
+          if (settled) return
+          settled = true
+          clearTimeout(timer)
+          reject(new Error('watchman 初始化失败'))
+        },
+      })
+    })
+  })()
+
+  try {
+    return await initPromise
+  } catch (e) {
+    // 失败路径：关闭 jsdom 释放 rAF/子资源/定时器等活动句柄，防止每次失败泄漏约 30MB
+    if (dom) {
+      dom.window.close()
+      dom = null
+    }
+    initPromise = null
+    wm = null
+    throw e
  }
-  throw new Error('易盾返回异常: ' + JSON.stringify(data).substring(0, 200))
+}
+
+// 获取新 token
+async function fetchToken() {
+  const instance = await ensureWatchman()
+  const raw = instance.getInstance()
+
+  await new Promise((resolve) => {
+    const timer = setTimeout(() => resolve(), 15000)
+    raw.I(() => {
+      clearTimeout(timer)
+      resolve()
+    })
+  })
+
+  return new Promise((resolve) => {
+    const timer = setTimeout(() => resolve(''), 15000)
+    instance.getToken(BUSINESS_ID, (tk) => {
+      clearTimeout(timer)
+      resolve(typeof tk === 'string' ? tk : '')
+    })
+  })
 }

 // 端点处理：每次实时获取新 token
 module.exports = async () => {
  let token = ''
  try {
-    token = await fetch()
+    token = await fetchToken()
  } catch (e) {
-    // token 获取失败时返回空，由调用方决定是否重试
+    logger.warn('[checkToken v2]', e.message)
  }
  return {
    status: 200,
@ -38,8 +150,9 @@ module.exports = async () => {
 // 给 request.js 读取用：每次调用实时获取新 token，不缓存
 module.exports.getToken = async () => {
  try {
-    return await fetch()
+    return await fetchToken()
  } catch (e) {
+    logger.warn('[checkToken v2]', e.message)
    return ''
  }
 }
--- a/package.json
+++ b/package.json
@ -1,6 +1,6 @@
 {
  "name": "@neteasecloudmusicapienhanced/api",
-  "version": "4.39.0",
+  "version": "4.40.0",
  "description": "全网最全的网易云音乐API接口 || A revival project for NeteaseCloudMusicApi Node.js Services (Half Refactor & Enhanced) || 网易云音乐 API 备份 + 增强 || 本项目自原版v4.28.0版本后开始自行维护",
  "scripts": {
    "dev": "nodemon app.js",
@ -82,6 +82,7 @@
    "express": "^5.2.1",
    "express-fileupload": "^1.5.2",
    "gzip": "^0.1.0",
+    "jsdom": "^24.1.3",
    "music-metadata": "^11.14.0",
    "node-forge": "^1.4.0",
    "pac-proxy-agent": "^7.2.0",
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@ -29,6 +29,9 @@ importers:
      gzip:
        specifier: ^0.1.0
        version: 0.1.0
+      jsdom:
+        specifier: ^24.1.3
+        version: 24.1.3
      music-metadata:
        specifier: ^11.14.0
        version: 11.14.0
@ -123,6 +126,9 @@ importers:

 packages:

+  '@asamuzakjp/css-color@3.2.0':
+    resolution: {integrity: sha512-K1A6z8tS3XsmCMM86xoWdn7Fkdn9m6RSVtocUrJYIwZnFVkng/PvkEoWtOWmP+Scc6saYWHWZYbndEEXxl24jw==}
+
  '@babel/generator@7.18.2':
    resolution: {integrity: sha512-W1lG5vUwFvfMd8HVXqdfbuG7RuaSrTCCD8cl8fP8wOivdbtbIg2Db3IWUcgvfxKbbn6ZBGYRW/Zk1MIwK49mgw==}
    engines: {node: '>=6.9.0'}
@ -147,6 +153,34 @@ packages:
  '@borewit/text-codec@0.2.2':
    resolution: {integrity: sha512-DDaRehssg1aNrH4+2hnj1B7vnUGEjU6OIlyRdkMd0aUdIUvKXrJfXsy8LVtXAy7DRvYVluWbMspsRhz2lcW0mQ==}

+  '@csstools/color-helpers@5.1.0':
+    resolution: {integrity: sha512-S11EXWJyy0Mz5SYvRmY8nJYTFFd1LCNV+7cXyAgQtOOuzb4EsgfqDufL+9esx72/eLhsRdGZwaldu/h+E4t4BA==}
+    engines: {node: '>=18'}
+
+  '@csstools/css-calc@2.1.4':
+    resolution: {integrity: sha512-3N8oaj+0juUw/1H3YwmDDJXCgTB1gKU6Hc/bB502u9zR0q2vd786XJH9QfrKIEgFlZmhZiq6epXl4rHqhzsIgQ==}
+    engines: {node: '>=18'}
+    peerDependencies:
+      '@csstools/css-parser-algorithms': ^3.0.5
+      '@csstools/css-tokenizer': ^3.0.4
+
+  '@csstools/css-color-parser@3.1.0':
+    resolution: {integrity: sha512-nbtKwh3a6xNVIp/VRuXV64yTKnb1IjTAEEh3irzS+HkKjAOYLTGNb9pmVNntZ8iVBHcWDA2Dof0QtPgFI1BaTA==}
+    engines: {node: '>=18'}
+    peerDependencies:
+      '@csstools/css-parser-algorithms': ^3.0.5
+      '@csstools/css-tokenizer': ^3.0.4
+
+  '@csstools/css-parser-algorithms@3.0.5':
+    resolution: {integrity: sha512-DaDeUkXZKjdGhgYaHNJTV9pV7Y9B3b644jCLs9Upc3VeNGg6LWARAT6O+Q+/COo+2gg/bM5rhpMAtf70WqfBdQ==}
+    engines: {node: '>=18'}
+    peerDependencies:
+      '@csstools/css-tokenizer': ^3.0.4
+
+  '@csstools/css-tokenizer@3.0.4':
+    resolution: {integrity: sha512-Vd/9EVDiu6PPJt9yAh6roZP6El1xHrdvIVGjyBsHR0RYwNHgL7FJPyIIW4fANJNG6FtyZfvlRPpFI4ZM/lubvw==}
+    engines: {node: '>=18'}
+
  '@eslint-community/eslint-utils@4.10.1':
    resolution: {integrity: sha512-cuadcxVFE8sDK6iWJbs8Sn0av2Nrh2QSGQhVlBW9AaAHqHwjWsZHT8LJ4hFGPh7ASBV2deFdM7H/DPjulmh8rg==}
    engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
@ -692,6 +726,10 @@ packages:
  crypto-js@4.2.0:
    resolution: {integrity: sha512-KALDyEYgpY+Rlob/iriUtjV6d5Eq+Y191A5g4UqLAi8CyGP9N1+FdVbkc1SxKc2r4YAYqG8JzO2KGL+AizD70Q==}

+  cssstyle@4.6.0:
+    resolution: {integrity: sha512-2z+rWdzbbSZv6/rhtvzvqeZQHrBaqgogqt85sqFNbabZOuFbCVFb8kPeEtZjiKkbrm395irpNKiYeFeLiQnFPg==}
+    engines: {node: '>=18'}
+
  d@1.0.2:
    resolution: {integrity: sha512-MOqHvMWF9/9MX6nza0KgvFH4HpMU0EF5uUDXqX/BtxtU8NfB0QzRtJ8Oe/6SuS4kbhyzVJwjd97EA4PKrzJ8bw==}
    engines: {node: '>=0.12'}
@ -700,6 +738,10 @@ packages:
    resolution: {integrity: sha512-7hvf7/GW8e86rW0ptuwS3OcBGDjIi6SZva7hCyWC0yYry2cOPmLIjXAUHI6DK2HsnwJd9ifmt57i8eV2n4YNpw==}
    engines: {node: '>= 14'}

+  data-urls@5.0.0:
+    resolution: {integrity: sha512-ZYP5VBHshaDAiVZxjbRVcFJpc+4xGgT0bK3vzy1HLN8jTO975HEbuYzZJcHoQEY5K1a0z8YayJkyVETa08eNTg==}
+    engines: {node: '>=18'}
+
  data-view-buffer@1.0.2:
    resolution: {integrity: sha512-EmKO5V3OLXh1rtK2wgXRansaK1/mtVdTUEiEI0W8RkvgT05kfxaH29PliLnpLP73yYO6142Q72QNa8Wx/A5CqQ==}
    engines: {node: '>= 0.4'}
@ -740,6 +782,9 @@ packages:
    resolution: {integrity: sha512-9iE1PgSik9HeIIw2JO94IidnE3eBoQrFJ3w7sFuzSX4DpmZ3v5sZpUiV5Swcf6mQEF+Y0ru8Neo+p+nyh2J+hQ==}
    engines: {node: '>=10'}

+  decimal.js@10.6.0:
+    resolution: {integrity: sha512-YpgQiITW3JXGntzdUmyUR1V812Hn8T1YVXhCu+wO3OpS4eU9l4YdD3qjyiKdV6mvV29zapkMeD390UVEf2lkUg==}
+
  decompress-response@6.0.0:
    resolution: {integrity: sha512-aW35yZM6Bb/4oJlZncMH2LCoZtJXTRxES17vE3hoRiowU2kWHaJKFkSBDnDR+cm9J+9QhXmREyIfv0pji9ejCQ==}
    engines: {node: '>=10'}
@ -856,6 +901,10 @@ packages:
    resolution: {integrity: sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw==}
    engines: {node: '>=0.12'}

+  entities@6.0.1:
+    resolution: {integrity: sha512-aN97NXWF6AWBTahfVOIrB/NShkzi5H7F9r1s9mD3cDj4Ko5f2qhhVoYMibXF7GlLveb/D2ioWay8lxI97Ven3g==}
+    engines: {node: '>=0.12'}
+
  entities@7.0.1:
    resolution: {integrity: sha512-TWrgLOFUQTH994YUyl1yT4uyavY5nNB5muff+RtWaqNVCAK408b5ZnnbNAUEWLTCpum9w6arT70i1XdQ4UeOPA==}
    engines: {node: '>=0.12'}
@ -1323,6 +1372,10 @@ packages:
    resolution: {integrity: sha512-F/1DnUGPopORZi0ni+CvrCgHQ5FyEAHRLSApuYWMmrbSwoN2Mn/7k+Gl38gJnR7yyDZk6WLXwiGod1JOWNDKGw==}
    hasBin: true

+  html-encoding-sniffer@4.0.0:
+    resolution: {integrity: sha512-Y22oTqIU4uuPgEemfz7NDJz6OeKf12Lsu+QC+s3BVpda64lTiMYCyGwg5ki4vFxkMwQdeZDl2adZoqUgdFuTgQ==}
+    engines: {node: '>=18'}
+
  htmlparser2@10.1.0:
    resolution: {integrity: sha512-VTZkM9GWRAtEpveh7MSF6SjjrpNVNNVJfFup7xTY3UpFtm67foy9HDVXneLtFVt4pMz5kZtgNcvCniNFb1hlEQ==}

@ -1354,6 +1407,10 @@ packages:
    resolution: {integrity: sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA==}
    engines: {node: '>=0.10.0'}

+  iconv-lite@0.6.3:
+    resolution: {integrity: sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==}
+    engines: {node: '>=0.10.0'}
+
  iconv-lite@0.7.3:
    resolution: {integrity: sha512-IKXpvIzjnC9XTAUbVBcMfGS0EPaIXtW6v+zr+RRp+hqULEpo0owZax6wyRwPOJbWbzjYspQwusTsfVr0ifh4uQ==}
    engines: {node: '>=0.10.0'}
@ -1503,6 +1560,9 @@ packages:
    resolution: {integrity: sha512-YWnfyRwxL/+SsrWYfOpUtz5b3YD+nyfkHvjbcanzk8zgyO4ASD67uVMRt8k5bM4lLMDnXfriRhOpemw+NfT1eA==}
    engines: {node: '>=8'}

+  is-potential-custom-element-name@1.0.1:
+    resolution: {integrity: sha512-bCYeRA2rVibKZd+s2625gGnGF/t7DSqDs4dP7CrLA1m7jKWz6pps0LpYLJN8Q64HtmPKJ1hrN3nzPNKFEKOUiQ==}
+
  is-promise@4.0.0:
    resolution: {integrity: sha512-hvpoI6korhJMnej285dSg6nu1+e6uxs7zG3BYAm5byqDsgJNWwxzM6z6iZiAgQR4TJ30JmBTOwqZUw3WlyH3AQ==}

@ -1569,6 +1629,15 @@ packages:
    resolution: {integrity: sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==}
    hasBin: true

+  jsdom@24.1.3:
+    resolution: {integrity: sha512-MyL55p3Ut3cXbeBEG7Hcv0mVM8pp8PBNWxRqchZnSfAiES1v1mRnMeFfaHWIPULpwsYfvO+ZmMZz5tGCnjzDUQ==}
+    engines: {node: '>=18'}
+    peerDependencies:
+      canvas: ^2.11.2
+    peerDependenciesMeta:
+      canvas:
+        optional: true
+
  jsesc@2.5.2:
    resolution: {integrity: sha512-OYu7XEzjkCQ3C5Ps3QIZsQfNpqoJyZZA99wd9aWd05NCtC5pWOkShK2mkL6HXQR6/Cy2lbNdPlZBpuQHXE63gA==}
    engines: {node: '>=4'}
@ -1795,6 +1864,9 @@ packages:
    resolution: {integrity: sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA==}
    engines: {node: '>=0.10.0'}

+  nwsapi@2.2.24:
+    resolution: {integrity: sha512-7YRhZ3jS45LwmSCT4b2sVFHt/WuovaktDU07QrtOBY2PXskss5a9jfmR9jptyumwXST+rFjrmppMY1KT/yn35A==}
+
  object-inspect@1.13.4:
    resolution: {integrity: sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==}
    engines: {node: '>= 0.4'}
@ -1876,6 +1948,9 @@ packages:
    resolution: {integrity: sha512-GQ2EWRpQV8/o+Aw8YqtfZZPfNRWZYkbidE9k5rpl/hC3vtHHBfGm2Ifi6qWV+coDGkrUKZAxE3Lot5kcsRlh+g==}
    engines: {node: '>=6'}

+  parse5@7.3.0:
+    resolution: {integrity: sha512-IInvU7fabl34qmi9gY8XOVxhYyMyuH2xUNpb2q8/Y+7552KlejkRvqvD19nMoUW/uQGGbqNpA6Tufu5FL5BZgw==}
+
  parseurl@1.3.3:
    resolution: {integrity: sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==}
    engines: {node: '>= 0.8'}
@ -2029,6 +2104,9 @@ packages:
    resolution: {integrity: sha512-cJ+oHTW1VAEa8cJslgmUZrc+sjRKgAKl3Zyse6+PV38hZe/V6Z14TbCuXcan9F9ghlz4QrFr2c92TNF82UkYHA==}
    engines: {node: '>=10'}

+  psl@1.15.0:
+    resolution: {integrity: sha512-JZd3gMVBAVQkSs6HdNZo9Sdo0LNcQeMNP3CozBJb3JYC/QUYZTnKxP+f8oWRX4rHP5EurWxqAHTSwUCjlNKa1w==}
+
  pstree.remy@1.1.8:
    resolution: {integrity: sha512-77DZwxQmxKnu3aR542U+X8FypNzbfJ+C5XQDk3uWjWxn6151aIMGthWYRXTqT1E5oJvg+ljaa2OJi+VfvCOQ8w==}

@ -2048,6 +2126,9 @@ packages:
    resolution: {integrity: sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==}
    engines: {node: '>=0.6'}

+  querystringify@2.2.0:
+    resolution: {integrity: sha512-FIqgj2EUvTa7R50u0rGsyTftzjYmv/a3hO345bZNrqabNqjtgiDMgmo4mkUjd+nzU5oF3dClKqFIPUKybUyqoQ==}
+
  queue-microtask@1.2.3:
    resolution: {integrity: sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==}

@ -2107,6 +2188,9 @@ packages:
  require-main-filename@2.0.0:
    resolution: {integrity: sha512-NKN5kMDylKuldxYLSUfrbo5Tuzh4hd+2E8NPPX02mZtn1VuREQToYe/ZdlJy+J3uCpfaiGF05e7B8W0iXbQHmg==}

+  requires-port@1.0.0:
+    resolution: {integrity: sha512-KigOCHcocU3XODJxsu8i/j8T9tzT4adHiecwORRQ0ZZFcp7ahwXuRU1m+yuO90C5ZUyGeGfocHDI14M3L3yDAQ==}
+
  resolve-from@4.0.0:
    resolution: {integrity: sha512-pb/MYmXstAkysRFx8piNI1tGFNQIFA3vkE3Gq4EuA1dF6gHp/+vgZqsCGJapvy8N3Q+4o7FwvquPJcnZ7RYy4g==}
    engines: {node: '>=4'}
@ -2131,6 +2215,12 @@ packages:
    resolution: {integrity: sha512-nLTrUKm2UyiL7rlhapu/Zl45FwNgkZGaCpZbIHajDYgwlJCOzLSk+cIPAnsEqV955GjILJnKbdQC1nVPz+gAYQ==}
    engines: {node: '>= 18'}

+  rrweb-cssom@0.7.1:
+    resolution: {integrity: sha512-TrEMa7JGdVm0UThDJSx7ddw5nVm3UJS9o9CCIZ72B1vSyEZoziDqBYP3XIoi/12lKrJR8rE3jeFHMok2F/Mnsg==}
+
+  rrweb-cssom@0.8.0:
+    resolution: {integrity: sha512-guoltQEx+9aMf2gDZ0s62EcV8lsXR+0w8915TC3ITdn2YueuNjdAYh/levpU9nFaoChh9RUS5ZdQMrKfVEN9tw==}
+
  run-parallel@1.2.0:
    resolution: {integrity: sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA==}

@ -2162,6 +2252,10 @@ packages:
    resolution: {integrity: sha512-42tBVwLWnaQvW5zc4HbZrTuWccECCZfBi92FDuwtqxasH+JbPB3/FOKb1m222K42R4WxuxzzMsTswfzgtSu64Q==}
    engines: {node: '>=11.0.0'}

+  saxes@6.0.0:
+    resolution: {integrity: sha512-xAg7SOnEhrm5zI3puOOKyy1OMcMlIJZYNJY7xLBwSze0UjhPLnWfj2GF2EpT0jmzaJKIWKHLsaSSajf35bcYnA==}
+    engines: {node: '>=v12.22.7'}
+
  secure-json-parse@2.7.0:
    resolution: {integrity: sha512-6aU+Rwsezw7VR8/nyvKTx8QpWH9FrcYiXXlqC4z5d5XQBDRqtbfsRjnwGyqbi3gddNtWHuEk9OANUotL26qKUw==}

@ -2389,6 +2483,9 @@ packages:
    resolution: {integrity: sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w==}
    engines: {node: '>= 0.4'}

+  symbol-tree@3.2.4:
+    resolution: {integrity: sha512-9QNk5KwDF+Bvz+PyObkmSYjI5ksVUYtjW7AU22r2NKcfLJcXp96hkDWU3+XndOsUb+AQ9QhfzfCT2O+CNWT5Tw==}
+
  synckit@0.11.13:
    resolution: {integrity: sha512-eNRKgb3z66Yp3D2CixVujOUvXLFUTij/zVnV8KRyvFdQwpz7I5DS8UfRkTeLzb64u+dkzDSdelE24izu+zSSUg==}
    engines: {node: ^14.18.0 || >=16.0.0}
@ -2428,9 +2525,17 @@ packages:
    resolution: {integrity: sha512-r0eojU4bI8MnHr8c5bNo7lJDdI2qXlWWJk6a9EAFG7vbhTjElYhBVS3/miuE0uOuoLdb8Mc/rVfsmm6eo5o9GA==}
    hasBin: true

+  tough-cookie@4.1.4:
+    resolution: {integrity: sha512-Loo5UUvLD9ScZ6jh8beX1T6sO1w2/MpCRpEP7V280GKMVUQ0Jzar2U3UJPsrdbziLEMMhu3Ujnq//rhiFuIeag==}
+    engines: {node: '>=6'}
+
  tr46@0.0.3:
    resolution: {integrity: sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw==}

+  tr46@5.1.1:
+    resolution: {integrity: sha512-hdF5ZgjTqgAntKkklYw0R03MG2x/bSzTtkxmIRw/sTNV8YXsCJ1tfLAX23lhxhHJlEf3CRCOCGGWw3vI3GaSPw==}
+    engines: {node: '>=18'}
+
  traverse@0.6.11:
    resolution: {integrity: sha512-vxXDZg8/+p3gblxB6BhhG5yWVn1kGRlaL8O78UDXc3wRnPizB5g83dcvWV1jpDMIPnjZjOFuxlMmE82XJ4407w==}
    engines: {node: '>= 0.4'}
@ -2515,6 +2620,10 @@ packages:
  universal-deep-strict-equal@1.2.2:
    resolution: {integrity: sha512-UpnFi3/IF3jZHIHTdQXTHLCqpBP3805OFFRPHgvCS7k0oob2YVXxMTjS0U0g9qJTzqFRMwEnFFSlFLqt6zwjTQ==}

+  universalify@0.2.0:
+    resolution: {integrity: sha512-CJ1QgKmNg3CwvAv/kOFmtnEN05f0D/cn9QntgNOQlQF9dgvVTHj3t+8JPdjqawCHk7V/KA+fbUqzZ9XWhcqPUg==}
+    engines: {node: '>= 4.0.0'}
+
  universalify@2.0.1:
    resolution: {integrity: sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw==}
    engines: {node: '>= 10.0.0'}
@ -2526,6 +2635,9 @@ packages:
  uri-js@4.4.1:
    resolution: {integrity: sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==}

+  url-parse@1.5.10:
+    resolution: {integrity: sha512-WypcfiRhfeUP9vvF0j6rw0J3hrWrw6iZv3+22h6iRMJ/8z1Tj6XfLP4DsUix5MhMPnXpiHDoKyoZ/bdCkwBCiQ==}
+
  util-deprecate@1.0.2:
    resolution: {integrity: sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==}

@ -2537,9 +2649,30 @@ packages:
    resolution: {integrity: sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==}
    engines: {node: '>= 0.8'}

+  w3c-xmlserializer@5.0.0:
+    resolution: {integrity: sha512-o8qghlI8NZHU1lLPrpi2+Uq7abh4GGPpYANlalzWxyWteJOCsr/P+oPBA49TOLu5FTZO4d3F9MnWJfiMo4BkmA==}
+    engines: {node: '>=18'}
+
  webidl-conversions@3.0.1:
    resolution: {integrity: sha512-2JAn3z8AR6rjK8Sm8orRC0h/bcl/DqL7tRPdGZ4I1CjdF+EaMLmYxBHyXuKL849eucPFhvBoxMsflfOb8kxaeQ==}

+  webidl-conversions@7.0.0:
+    resolution: {integrity: sha512-VwddBukDzu71offAQR975unBIGqfKZpM+8ZX6ySk8nYhVoo5CYaZyzt3YBvYtRtO+aoGlqxPg/B87NGVZ/fu6g==}
+    engines: {node: '>=12'}
+
+  whatwg-encoding@3.1.1:
+    resolution: {integrity: sha512-6qN4hJdMwfYBtE3YBTTHhoeuUrDBPZmbQaxWAqSALV/MeEnR5z1xd8UKud2RAkFoPkmB+hli1TZSnyi84xz1vQ==}
+    engines: {node: '>=18'}
+    deprecated: Use @exodus/bytes instead for a more spec-conformant and faster implementation
+
+  whatwg-mimetype@4.0.0:
+    resolution: {integrity: sha512-QaKxh0eNIi2mE9p2vEdzfagOKHCcj1pJ56EEHGQOVxp8r9/iszLUUV7v89x9O1p/T+NlTM5W7jW6+cz4Fq1YVg==}
+    engines: {node: '>=18'}
+
+  whatwg-url@14.2.0:
+    resolution: {integrity: sha512-De72GdQZzNTUBBChsXueQUnPKDkg/5A5zp7pFDuQAj5UFoENpiACU0wlCvzpAGnTkj++ihpKwKyYewn/XNUbKw==}
+    engines: {node: '>=18'}
+
  whatwg-url@5.0.0:
    resolution: {integrity: sha512-saE57nupxk6v3HY35+jzBwYa0rKSy0XR8JSxZPwgLr7ys0IBzhGviA1/TUGJLmSVqs8pb9AnvICXEuOHLprYTw==}

@ -2596,6 +2729,22 @@ packages:
  wrappy@1.0.2:
    resolution: {integrity: sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==}

+  ws@8.21.2:
+    resolution: {integrity: sha512-54dMVAo4WIe6SKy3vBgN+9bJZqqQ8IMRevAkOLQALhi49qkkQDQfWdAZ8KQlXiEabw88ARXXdUrlvtbKQX+aKw==}
+    engines: {node: '>=10.0.0'}
+    peerDependencies:
+      bufferutil: ^4.0.1
+      utf-8-validate: '>=5.0.2'
+    peerDependenciesMeta:
+      bufferutil:
+        optional: true
+      utf-8-validate:
+        optional: true
+
+  xml-name-validator@5.0.0:
+    resolution: {integrity: sha512-EvGK8EJ3DhaHfbRlETOWAS5pO9MZITeauHKJyb8wyajUfQUenkIg2MvLDTZ4T/TgIcm3HU0TFBgWWboAZ30UHg==}
+    engines: {node: '>=18'}
+
  xml2js@0.6.2:
    resolution: {integrity: sha512-T4rieHaC1EXcES0Kxxj4JWgaUQHDk+qwHcYOCFHfiwKz7tOVPLq7Hjq9dM1WCMhylqMEfP7hMcOIChvotiZegA==}
    engines: {node: '>=4.0.0'}
@ -2607,6 +2756,9 @@ packages:
    resolution: {integrity: sha512-fDlsI/kFEx7gLvbecc0/ohLG50fugQp8ryHzMTuW9vSa1GJ0XYWKnhsUx7oie3G98+r56aTQIUB4kht42R3JvA==}
    engines: {node: '>=4.0'}

+  xmlchars@2.2.0:
+    resolution: {integrity: sha512-JZnDKK8B0RCDw84FNdDAIpZK+JuJw+s7Lz8nksI7SIuU3UXJJslUthsi+uWBUYOwPFwW7W7PRLRfUKpxjtjFCw==}
+
  xtend@4.0.2:
    resolution: {integrity: sha512-LKYU1iAXJXUgAXn9URjiu+MWhyUXHsvfp7mcuYm9dSUKK0/CjtrUwFAxD82/mCWbtLsGjFIad0wIsod4zrTAEQ==}
    engines: {node: '>=0.4'}
@ -2665,6 +2817,14 @@ packages:

 snapshots:

+  '@asamuzakjp/css-color@3.2.0':
+    dependencies:
+      '@csstools/css-calc': 2.1.4(@csstools/css-parser-algorithms@3.0.5(@csstools/css-tokenizer@3.0.4))(@csstools/css-tokenizer@3.0.4)
+      '@csstools/css-color-parser': 3.1.0(@csstools/css-parser-algorithms@3.0.5(@csstools/css-tokenizer@3.0.4))(@csstools/css-tokenizer@3.0.4)
+      '@csstools/css-parser-algorithms': 3.0.5(@csstools/css-tokenizer@3.0.4)
+      '@csstools/css-tokenizer': 3.0.4
+      lru-cache: 10.4.3
+
  '@babel/generator@7.18.2':
    dependencies:
      '@babel/types': 7.19.0
@ -2687,6 +2847,26 @@ snapshots:

  '@borewit/text-codec@0.2.2': {}

+  '@csstools/color-helpers@5.1.0': {}
+
+  '@csstools/css-calc@2.1.4(@csstools/css-parser-algorithms@3.0.5(@csstools/css-tokenizer@3.0.4))(@csstools/css-tokenizer@3.0.4)':
+    dependencies:
+      '@csstools/css-parser-algorithms': 3.0.5(@csstools/css-tokenizer@3.0.4)
+      '@csstools/css-tokenizer': 3.0.4
+
+  '@csstools/css-color-parser@3.1.0(@csstools/css-parser-algorithms@3.0.5(@csstools/css-tokenizer@3.0.4))(@csstools/css-tokenizer@3.0.4)':
+    dependencies:
+      '@csstools/color-helpers': 5.1.0
+      '@csstools/css-calc': 2.1.4(@csstools/css-parser-algorithms@3.0.5(@csstools/css-tokenizer@3.0.4))(@csstools/css-tokenizer@3.0.4)
+      '@csstools/css-parser-algorithms': 3.0.5(@csstools/css-tokenizer@3.0.4)
+      '@csstools/css-tokenizer': 3.0.4
+
+  '@csstools/css-parser-algorithms@3.0.5(@csstools/css-tokenizer@3.0.4)':
+    dependencies:
+      '@csstools/css-tokenizer': 3.0.4
+
+  '@csstools/css-tokenizer@3.0.4': {}
+
  '@eslint-community/eslint-utils@4.10.1(eslint@9.39.5)':
    dependencies:
      eslint: 9.39.5
@ -3307,6 +3487,11 @@ snapshots:

  crypto-js@4.2.0: {}

+  cssstyle@4.6.0:
+    dependencies:
+      '@asamuzakjp/css-color': 3.2.0
+      rrweb-cssom: 0.8.0
+
  d@1.0.2:
    dependencies:
      es5-ext: 0.10.64
@ -3314,6 +3499,11 @@ snapshots:

  data-uri-to-buffer@6.0.2: {}

+  data-urls@5.0.0:
+    dependencies:
+      whatwg-mimetype: 4.0.0
+      whatwg-url: 14.2.0
+
  data-view-buffer@1.0.2:
    dependencies:
      call-bound: 1.0.4
@ -3358,6 +3548,8 @@ snapshots:

  decamelize@4.0.0: {}

+  decimal.js@10.6.0: {}
+
  decompress-response@6.0.0:
    dependencies:
      mimic-response: 3.1.0
@ -3476,6 +3668,8 @@ snapshots:

  entities@4.5.0: {}

+  entities@6.0.1: {}
+
  entities@7.0.1: {}

  environment@1.1.0: {}
@ -4135,6 +4329,10 @@ snapshots:

  he@1.2.0: {}

+  html-encoding-sniffer@4.0.0:
+    dependencies:
+      whatwg-encoding: 3.1.1
+
  htmlparser2@10.1.0:
    dependencies:
      domelementtype: 2.3.0
@ -4179,6 +4377,10 @@ snapshots:
    dependencies:
      safer-buffer: 2.1.2

+  iconv-lite@0.6.3:
+    dependencies:
+      safer-buffer: 2.1.2
+
  iconv-lite@0.7.3:
    dependencies:
      safer-buffer: 2.1.2
@ -4319,6 +4521,8 @@ snapshots:

  is-plain-obj@2.1.0: {}

+  is-potential-custom-element-name@1.0.1: {}
+
  is-promise@4.0.0: {}

  is-regex@1.2.1:
@ -4382,6 +4586,34 @@ snapshots:
    dependencies:
      argparse: 2.0.1

+  jsdom@24.1.3:
+    dependencies:
+      cssstyle: 4.6.0
+      data-urls: 5.0.0
+      decimal.js: 10.6.0
+      form-data: 4.0.6
+      html-encoding-sniffer: 4.0.0
+      http-proxy-agent: 7.0.2
+      https-proxy-agent: 7.0.6
+      is-potential-custom-element-name: 1.0.1
+      nwsapi: 2.2.24
+      parse5: 7.3.0
+      rrweb-cssom: 0.7.1
+      saxes: 6.0.0
+      symbol-tree: 3.2.4
+      tough-cookie: 4.1.4
+      w3c-xmlserializer: 5.0.0
+      webidl-conversions: 7.0.0
+      whatwg-encoding: 3.1.1
+      whatwg-mimetype: 4.0.0
+      whatwg-url: 14.2.0
+      ws: 8.21.2
+      xml-name-validator: 5.0.0
+    transitivePeerDependencies:
+      - bufferutil
+      - supports-color
+      - utf-8-validate
+
  jsesc@2.5.2: {}

  json-buffer@3.0.1: {}
@ -4612,6 +4844,8 @@ snapshots:

  normalize-path@3.0.0: {}

+  nwsapi@2.2.24: {}
+
  object-inspect@1.13.4: {}

  object-is@1.1.6:
@ -4713,6 +4947,10 @@ snapshots:
    dependencies:
      callsites: 3.1.0

+  parse5@7.3.0:
+    dependencies:
+      entities: 6.0.1
+
  parseurl@1.3.3: {}

  path-exists@4.0.0: {}
@ -4915,6 +5153,10 @@ snapshots:

  proxy-from-env@2.1.0: {}

+  psl@1.15.0:
+    dependencies:
+      punycode: 2.3.1
+
  pstree.remy@1.1.8: {}

  pump@3.0.4:
@ -4935,6 +5177,8 @@ snapshots:
      es-define-property: 1.0.1
      side-channel: 1.1.1

+  querystringify@2.2.0: {}
+
  queue-microtask@1.2.3: {}

  quick-format-unescaped@4.0.4: {}
@ -5014,6 +5258,8 @@ snapshots:

  require-main-filename@2.0.0: {}

+  requires-port@1.0.0: {}
+
  resolve-from@4.0.0: {}

  resolve@1.22.12:
@ -5042,6 +5288,10 @@ snapshots:
    transitivePeerDependencies:
      - supports-color

+  rrweb-cssom@0.7.1: {}
+
+  rrweb-cssom@0.8.0: {}
+
  run-parallel@1.2.0:
    dependencies:
      queue-microtask: 1.2.3
@ -5075,6 +5325,10 @@ snapshots:

  sax@1.6.1: {}

+  saxes@6.0.0:
+    dependencies:
+      xmlchars: 2.2.0
+
  secure-json-parse@2.7.0: {}

  semver@7.8.5: {}
@ -5368,6 +5622,8 @@ snapshots:

  supports-preserve-symlinks-flag@1.0.0: {}

+  symbol-tree@3.2.4: {}
+
  synckit@0.11.13:
    dependencies:
      '@pkgr/core': 0.3.6
@ -5410,8 +5666,19 @@ snapshots:

  touch@3.1.1: {}

+  tough-cookie@4.1.4:
+    dependencies:
+      psl: 1.15.0
+      punycode: 2.3.1
+      universalify: 0.2.0
+      url-parse: 1.5.10
+
  tr46@0.0.3: {}

+  tr46@5.1.1:
+    dependencies:
+      punycode: 2.3.1
+
  traverse@0.6.11:
    dependencies:
      gopd: 1.2.0
@ -5518,6 +5785,8 @@ snapshots:
      indexof: 0.0.1
      object-keys: 1.1.1

+  universalify@0.2.0: {}
+
  universalify@2.0.1: {}

  unpipe@1.0.0: {}
@ -5526,14 +5795,36 @@ snapshots:
    dependencies:
      punycode: 2.3.1

+  url-parse@1.5.10:
+    dependencies:
+      querystringify: 2.2.0
+      requires-port: 1.0.0
+
  util-deprecate@1.0.2: {}

  utils-merge@1.0.1: {}

  vary@1.1.2: {}

+  w3c-xmlserializer@5.0.0:
+    dependencies:
+      xml-name-validator: 5.0.0
+
  webidl-conversions@3.0.1: {}

+  webidl-conversions@7.0.0: {}
+
+  whatwg-encoding@3.1.1:
+    dependencies:
+      iconv-lite: 0.6.3
+
+  whatwg-mimetype@4.0.0: {}
+
+  whatwg-url@14.2.0:
+    dependencies:
+      tr46: 5.1.1
+      webidl-conversions: 7.0.0
+
  whatwg-url@5.0.0:
    dependencies:
      tr46: 0.0.3
@ -5618,6 +5909,10 @@ snapshots:

  wrappy@1.0.2: {}

+  ws@8.21.2: {}
+
+  xml-name-validator@5.0.0: {}
+
  xml2js@0.6.2:
    dependencies:
      sax: 1.6.1
@ -5627,6 +5922,8 @@ snapshots:

  xmlbuilder@11.0.1: {}

+  xmlchars@2.2.0: {}
+
  xtend@4.0.2: {}

  y18n@4.0.3: {}
--- a/public/yidun.html
+++ b/public/yidun.html
@ -4,7 +4,7 @@
  <meta charset="UTF-8">
  <meta name="viewport" content="width=device-width, initial-scale=1.0">
  <meta http-equiv="X-UA-Compatible" content="IE=edge">
-  <title>Token 注册器 — 网易云音乐 API Enhanced</title>
+  <title>易盾 Watchman 调试器 — 网易云音乐 API Enhanced</title>
  <style>
    :root {
      --fg: #333;
@ -17,7 +17,7 @@
    * { box-sizing: border-box; }
    html, body { height: 100%; }
    body { margin: 0; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; color: var(--fg); background: var(--bg); line-height: 1.6; }
-    .container { max-width: 720px; margin: 40px auto; padding: 0 20px; }
+    .container { max-width: 760px; margin: 40px auto; padding: 0 20px; }
    @media (max-width: 480px) {
      .container { margin: 20px auto; padding: 0 16px; }
      header.site-header h1 { font-size: 22px; }
@ -28,8 +28,12 @@
    .sub { margin-top: 4px; color: var(--muted); font-size: 14px; }
    .block { background: var(--panel); border: 1px solid var(--border); border-radius: 12px; padding: 20px; margin-bottom: 16px; box-shadow: 0 2px 8px rgba(0, 0, 0, 0.05); }
    .block h3 { margin: 0 0 12px; font-size: 15px; font-weight: 600; }
-    pre { margin: 0; background: #f9f9f9; border: 1px solid var(--border); border-radius: 6px; padding: 12px; overflow-x: auto; white-space: pre-wrap; word-break: break-all; font-family: 'Courier New', monospace; font-size: 13px; max-height: 160px; overflow: auto; }
-    .row { display: flex; gap: 8px; margin-top: 14px; flex-wrap: wrap; }
+    .field { margin-bottom: 10px; }
+    .field label { display: block; font-size: 13px; color: var(--muted); margin-bottom: 4px; }
+    input[type="text"] { width: 100%; padding: 8px 12px; border: 1px solid var(--border); border-radius: 8px; font-size: 13px; font-family: 'Courier New', monospace; color: var(--fg); background: #fafafa; }
+    input[type="text"]:focus { outline: none; border-color: #888; background: #fff; }
+    pre { margin: 0; background: #f9f9f9; border: 1px solid var(--border); border-radius: 6px; padding: 12px; overflow-x: auto; white-space: pre-wrap; word-break: break-all; font-family: 'Courier New', monospace; font-size: 13px; max-height: 220px; overflow: auto; }
+    .row { display: flex; gap: 8px; margin-top: 14px; flex-wrap: wrap; align-items: center; }
    button { padding: 8px 18px; border-radius: 8px; border: 1px solid var(--border); font-size: 14px; font-weight: 500; cursor: pointer; background: var(--panel); color: var(--fg); transition: all .15s; }
    button:hover { background: #eee; }
    button.primary { background: var(--fg); color: var(--panel); border-color: var(--fg); }
@ -41,32 +45,65 @@
    .tag.busy { background: #fff3cd; color: #856404; border-color: #ffeeba; }
    .flex { display: flex; align-items: center; gap: 10px; }
    .flex.sb { justify-content: space-between; }
-    .mt-2 { margin-top: 14px; }
+    .hint { font-size: 12px; color: var(--muted); margin-top: 8px; }
    footer.site-footer { margin-top: 24px; padding-top: 12px; border-top: 1px solid var(--border); color: var(--muted); text-align: center; font-size: 13px; }
  </style>
 </head>
 <body>
  <main class="container">
    <header class="site-header">
-      <h1>🔑 Token 注册器</h1>
-      <p class="sub">从易盾获取反作弊 token 并注册到服务器，供广告等需要 checkToken 的接口使用</p>
+      <h1>🛡️ 易盾 Watchman 调试器</h1>
+      <p class="sub">
+        直接调用易盾官方 Web SDK（tool.min.js）获取反作弊 token。
+        与 <code>module/register_checktoken_v2.js</code> 内部（jsdom 模拟同一套 SDK）逻辑一致，可用于对照验证。
+      </p>
    </header>

+    <!-- Watchman 初始化 -->
    <div class="block">
      <div class="flex sb">
-        <h3>当前 Token</h3>
-        <span id="statusTag" class="tag no">未注册</span>
+        <h3>① 初始化 Watchman</h3>
+        <span id="initTag" class="tag no">未初始化</span>
+      </div>
+      <div class="field">
+        <label for="pnInput">productNumber（易盾产品号）</label>
+        <input type="text" id="pnInput" value="YD00000558929251" spellcheck="false">
      </div>
-      <pre id="tokenDisplay">（空）</pre>
      <div class="row">
-        <button id="btnGet" class="primary">获取 Token</button>
-        <button id="btnRefresh">强制刷新</button>
+        <button id="btnInit" class="primary">初始化</button>
+        <button id="btnReset">重置</button>
      </div>
    </div>

+    <!-- 获取 Token -->
    <div class="block">
-      <h3>服务器响应</h3>
-      <pre id="respDisplay">{}</pre>
+      <div class="flex sb">
+        <h3>② 获取 Token</h3>
+        <span id="getTag" class="tag no">—</span>
+      </div>
+      <div class="field">
+        <label for="bidInput">businessId（业务 ID，来自网易 clientcfg 下发）</label>
+        <input type="text" id="bidInput" value="bd5d2f973ef74cd2a61325a412ae54d9" spellcheck="false">
+      </div>
+      <div class="row">
+        <button id="btnGet" class="primary" disabled>获取 Token</button>
+        <button id="btnCopy" disabled>复制</button>
+        <span class="hint">覆盖 /api/playlist/subscribe、/api/song/like、/api/user/follow 等接口</span>
+      </div>
+      <pre id="tokenDisplay">（尚未获取）</pre>
+    </div>
+
+    <!-- 服务器端对照 -->
+    <div class="block">
+      <div class="flex sb">
+        <h3>③ 服务器端对照（/register/checktoken/v2）</h3>
+        <span id="srvTag" class="tag no">—</span>
+      </div>
+      <div class="row">
+        <button id="btnSrv">获取服务器端 Token</button>
+        <span class="hint">node + jsdom 模拟同一套 SDK 的实时结果</span>
+      </div>
+      <pre id="srvDisplay">（尚未获取）</pre>
    </div>

    <footer class="site-footer">
@ -74,46 +111,121 @@
    </footer>
  </main>

+  <script src="https://acstatic-dun.126.net/tool.min.js"></script>
  <script>
    const $ = (id) => document.getElementById(id)
-    const base = location.origin

-    async function call(refresh) {
-      const btn = $('btnGet')
-      const btnR = $('btnRefresh')
-      btn.disabled = btnR.disabled = true
-
-      const tag = $('statusTag')
-      tag.className = 'tag busy'
-      tag.textContent = '获取中…'
-
-      try {
-        const url = base + '/register/checktoken/v2' + (refresh ? '?refresh=1' : '')
-        const res = await fetch(url)
-        const data = await res.json()
-        $('respDisplay').textContent = JSON.stringify(data, null, 2)
-
-        if (data.token) {
-          $('tokenDisplay').textContent = data.token
-          tag.className = 'tag ok'
-          tag.textContent = '已注册'
-        } else {
-          $('tokenDisplay').textContent = '（获取失败）'
-          tag.className = 'tag no'
-          tag.textContent = '失败'
-        }
-      } catch (e) {
-        $('respDisplay').textContent = JSON.stringify({ error: e.message }, null, 2)
-        tag.className = 'tag no'
-        tag.textContent = e.message
-      }
-
-      btn.disabled = btnR.disabled = false
+    const DEFAULTS = {
+      pn: 'YD00000558929251',
+      bid: 'bd5d2f973ef74cd2a61325a412ae54d9',
    }

-    $('btnGet').onclick = () => call(false)
-    $('btnRefresh').onclick = () => call(true)
-    call(false)
+    let wm = null // Watchman 实例
+
+    const setTag = (id, text, state) => {
+      const tag = $(id)
+      tag.textContent = text
+      tag.className = 'tag ' + state // ok / no / busy
+    }
+
+    // ① 初始化
+    function initShield() {
+      if (typeof window.initWatchman !== 'function') {
+        alert('未找到 initWatchman：请确认 tool.min.js 已加载（CDN 是否可访问）')
+        return
+      }
+      const pn = $('pnInput').value.trim() || DEFAULTS.pn
+      setTag('initTag', '初始化中…', 'busy')
+      $('btnInit').disabled = true
+      window.initWatchman({
+        auto: true,
+        productNumber: pn,
+        onload(instance) {
+          wm = instance
+          setTag('initTag', '已就绪', 'ok')
+          $('btnInit').disabled = false
+          $('btnGet').disabled = false
+        },
+        onerror() {
+          wm = null
+          setTag('initTag', '初始化失败', 'no')
+          $('btnInit').disabled = false
+          $('btnGet').disabled = true
+        },
+      })
+    }
+
+    function resetShield() {
+      wm = null
+      setTag('initTag', '未初始化', 'no')
+      setTag('getTag', '—', 'no')
+      $('btnGet').disabled = true
+      $('btnCopy').disabled = true
+      $('tokenDisplay').textContent = '（尚未获取）'
+    }
+
+    // ② 获取 token
+    function getToken() {
+      if (!wm) {
+        alert('请先完成初始化')
+        return
+      }
+      const bid = $('bidInput').value.trim() || DEFAULTS.bid
+      setTag('getTag', '获取中…', 'busy')
+      $('btnGet').disabled = true
+      wm.getToken(bid, (tk) => {
+        if (typeof tk === 'string' && tk) {
+          $('tokenDisplay').textContent = tk
+          setTag('getTag', 'OK', 'ok')
+          $('btnCopy').disabled = false
+        } else {
+          $('tokenDisplay').textContent = '（获取失败）'
+          setTag('getTag', '失败', 'no')
+          $('btnCopy').disabled = true
+        }
+        $('btnGet').disabled = false
+      })
+    }
+
+    // ③ 服务器端对照
+    async function fetchServerToken() {
+      setTag('srvTag', '获取中…', 'busy')
+      $('btnSrv').disabled = true
+      try {
+        const res = await fetch(
+          location.origin + '/register/checktoken/v2?t=' + Date.now(),
+        )
+        const data = await res.json()
+        $('srvDisplay').textContent = data.token
+          ? data.token
+          : JSON.stringify(data, null, 2)
+        setTag('srvTag', data.token ? 'OK' : '失败', data.token ? 'ok' : 'no')
+      } catch (e) {
+        $('srvDisplay').textContent = JSON.stringify({ error: e.message }, null, 2)
+        setTag('srvTag', e.message, 'no')
+      }
+      $('btnSrv').disabled = false
+    }
+
+    // 复制
+    async function copyToken() {
+      const txt = $('tokenDisplay').textContent
+      try {
+        await navigator.clipboard.writeText(txt)
+        setTag('getTag', '已复制', 'ok')
+      } catch (e) {
+        setTag('getTag', '复制失败', 'no')
+      }
+    }
+
+    $('btnInit').onclick = initShield
+    $('btnReset').onclick = resetShield
+    $('btnGet').onclick = getToken
+    $('btnCopy').onclick = copyToken
+    $('btnSrv').onclick = fetchServerToken
+
+    // 自动初始化
+    initShield()
  </script>
 </body>
 </html>
--- a/util/config.json
+++ b/util/config.json
@ -17,7 +17,7 @@
    "clDomian": "https://clientlog.music.163.com",
    "clDomian3": "https://clientlog3.music.163.com",
    "dunDomainV3": "https://ac.dun.163yun.com",
-    "dunDomainV2": "https://ac.dun.163.com",
+    "dunStaticDomain": "https://acstatic-dun.126.net",
    "encrypt": true,
    "encryptResponse": false,
    "clientSign": "18:C0:4D:B9:8F:FE@@@453832335F384641365F424635335F303030315F303031425F343434415F343643365F333638332@@@@@@6ff673ef74955b38bce2fa8562d95c976ed4758b1227c4e9ee345987cee17bc9",