Dsrupt One · 扒站报告

[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_271":272,"_273":274},"routes/_app.x.$handle.$name",{"_103":102,"_38":51,"_111":93,"_33":105,"_13":14,"_112":-5,"_11":113,"_114":115,"_116":117,"_118":119,"_120":121,"_26":-5,"_122":-5,"_123":-5,"_124":31,"_125":126,"_127":65,"_128":-5,"_129":-5,"_130":131},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":18,"_19":-5},"project",{"_49":50,"_38":51,"_44":52,"_53":-5,"_54":31,"_55":56,"_57":56,"_58":59,"_60":-5,"_19":61,"_62":63,"_64":65,"_66":-5,"_67":-5,"_68":69,"_70":71,"_72":-5,"_73":-5,"_74":-5,"_75":-5,"_76":77,"_78":77,"_79":80,"_81":80,"_82":80,"_83":77,"_84":77,"_85":86,"_87":88,"_89":90,"_91":31},"version",12,"changes",[25],"aiChatInfo",{"_20":21,"_22":-5,"_23":-5,"_24":-5},"userId","aiChatMessageId","b11d26b1-1d16-4048-b4e0-3fb4f6a9c151","aiChatThreadId","aiChatThreadUserId","aiChatThreadTitle",{"_26":27,"_28":29,"_30":31,"_32":31,"_33":34,"_35":34},"file",{"_36":37,"_38":34,"_39":40,"_41":43,"_44":45,"_46":14,"_47":48,"_30":31},"previous",{"_36":37,"_38":34,"_39":40,"_41":42},"deleted",false,"deletedHere","path","harvest.ts","latestPath","fileId","2dd33518-b1d5-11f1-a6e9-1607ee4eb77e","name","fileType","script","content","/**\n * Dsrupt One（one.dsrupt.ai）扒站脚本\n *\n * 关键情报（已从 bundle 里确认）：\n * - 后端是 Rails：https://backend.dsrupt.ai，接口前缀 /ui_api/\n * - 所有请求走一个包装函数 he(path, opts) → fetch(`${API_BASE_URL}${path}`)\n * - 生产 host 判断：window.location.hostname === \"one.dsrupt.ai\" ? 生产 : staging\n *\n * 干六件事：\n * 1. 归档整站前端（HTML 壳 + JS 分包 + CSS）到 blob\n * 2. 提取全量 /ui_api/ 接口地图（路径 + HTTP 方法 + 出处）\n * 3. 提取前端路由表\n * 4. 挖出 bundle 里硬编码的配置/密钥\n * 5. 列出 bundle 里出现的所有第三方 host\n * 6. 探测无需登录的公开接口\n *\n * 跑法：直接 Run。可重复跑，会覆盖。\n */\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\n\nconst UA =\n \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\";\nconst ORIGIN = \"https://one.dsrupt.ai\";\nconst BACKEND = \"https://backend.dsrupt.ai\";\n\nconst uniq = (a: string[]) => [...new Set(a)];\n\nasync function get(path: string, accept = \"*/*\", base = ORIGIN) {\n const res = await fetch(base + path, {\n headers: {\n \"user-agent\": UA,\n accept,\n \"accept-language\": \"en-US,en;q=0.9\",\n referer: ORIGIN + \"/\",\n },\n redirect: \"follow\",\n });\n return { status: res.status, text: await res.text(), ct: res.headers.get(\"content-type\") ?? \"\" };\n}\n\nasync function pool(items: T[], limit: number, fn: (item: T) => Promise): Promise {\n const out: R[] = new Array(items.length);\n let cursor = 0;\n await Promise.all(\n Array.from({ length: Math.min(limit, items.length) }, async () => {\n while (true) {\n const i = cursor++;\n if (i >= items.length) return;\n out[i] = await fn(items[i]);\n }\n }),\n );\n return out;\n}\n\n// ── 1. 收集所有前端资源 ─────────────────────────────────────────\nconst html = (await get(\"/\", \"text/html\")).text;\nconst shellAssets = uniq([...html.matchAll(/(?:src|href)=\"(\\/assets\\/[^\"]+)\"/g)].map((m) => m[1]));\nconst mainChunk = shellAssets.find((p) => /\\/index-[^/]+\\.js$/.test(p)) ?? shellAssets.find((p) => p.endsWith(\".js\"))!;\nconst main = (await get(mainChunk)).text;\nconst lazyChunks = uniq([...main.matchAll(/assets\\/[A-Za-z0-9_.\\-]+\\.(?:js|css)/g)].map((m) => \"/\" + m[0]));\nconst allAssets = uniq([...shellAssets, ...lazyChunks]);\nconsole.log(\"HTML 壳:\", html.length, \"B 主 bundle:\", mainChunk, main.length, \"B 资源:\", allAssets.length, \"个\");\n\n// ── 2. 提取接口 + 路由 + host ───────────────────────────────────\ntype Hit = { path: string; methods: Set; chunks: Set };\nconst apiMap = new Map();\nconst routes = new Set();\nconst hostCount = new Map();\n\nconst norm = (p: string) =>\n p.replace(/\\$\\{[^}]*\\}/g, \":param\")\n .replace(/\\?.*$/, \"\")\n .replace(/[`\"'\\\\;,)]+$/, \"\")\n .replace(/\\/+$/, \"\") || \"/\";\n\nfunction mine(chunkName: string, code: string) {\n // 所有 /ui_api/... 出现点\n for (const m of code.matchAll(/\\/ui_api\\/[A-Za-z0-9_\\-\\/.${}?&=:]{0,160}/g)) {\n const raw = m[0];\n const path = norm(raw);\n if (path.length < 8) continue;\n // 往后 400 字符找 method:\"XXX\"\n const after = code.slice(m.index! + raw.length, m.index! + raw.length + 400);\n const mm = after.match(/method:\\s*\"([A-Z]+)\"/);\n const hit = apiMap.get(path) ?? { path, methods: new Set(), chunks: new Set() };\n hit.methods.add(mm ? mm[1] : \"GET\");\n hit.chunks.add(chunkName);\n apiMap.set(path, hit);\n }\n // 非 /ui_api 前缀的后端接口（如 /users/password）\n for (const m of code.matchAll(/fetch\\(`\\$\\{[a-zA-Z_$]+\\}(\\/[a-z_]+(?:\\/[A-Za-z0-9_\\-\\/.${}]{0,80})?)`/g)) {\n const path = norm(m[1]);\n if (path.startsWith(\"/ui_api\")) continue;\n const after = code.slice(m.index! + m[0].length, m.index! + m[0].length + 400);\n const mm = after.match(/method:\\s*\"([A-Z]+)\"/);\n const hit = apiMap.get(path) ?? { path, methods: new Set(), chunks: new Set() };\n hit.methods.add(mm ? mm[1] : \"GET\");\n hit.chunks.add(chunkName);\n apiMap.set(path, hit);\n }\n // 前端路由：React Router 的 path:\"/xxx\"\n for (const m of code.matchAll(/path:\\s*\"(\\/[A-Za-z0-9_\\-\\/:${}.]{0,80})\"/g)) {\n routes.add(norm(m[1]));\n }\n // 第三方 host\n for (const m of code.matchAll(/https?:\\/\\/([a-zA-Z0-9.\\-]+\\.[a-zA-Z]{2,})/g)) {\n hostCount.set(m[1], (hostCount.get(m[1]) ?? 0) + 1);\n }\n}\n\nconst files: { path: string; bytes: number; status: number }[] = [];\nconst failures: string[] = [];\n\nawait pool(allAssets, 8, async (path) => {\n try {\n const r = await get(path);\n if (r.status !== 200) return void failures.push(`${path} -> ${r.status}`);\n await blob.set(\"mirror\" + path, r.text);\n mine(path, r.text);\n files.push({ path, bytes: r.text.length, status: r.status });\n } catch (e) {\n failures.push(`${path} -> ${(e as Error).message}`);\n }\n});\nawait blob.set(\"mirror/index.html\", html);\n\nconst totalBytes = files.reduce((s, f) => s + f.bytes, 0);\nconsole.log(\"归档:\", files.length, \"/\", allAssets.length, \" 共\", (totalBytes / 1024 / 1024).toFixed(2), \"MB\");\n\n// ── 3. 挖配置 / 密钥 ────────────────────────────────────────────\nconst grab = (label: string, re: RegExp, src: string) => {\n const found = uniq([...src.matchAll(re)].map((m) => m[0]));\n return { label, found: found.slice(0, 8) };\n};\nconst config = [\n grab(\"PostHog 项目 key\", /phc_[A-Za-z0-9]{20,}/g, main),\n grab(\"Stripe publishable key\", /pk_(?:live|test)_[A-Za-z0-9]{20,}/g, main),\n grab(\"Sentry DSN\", /https:\\/\\/[a-z0-9]+@[a-z0-9.]+\\.ingest\\.[a-z0-9.]+\\.sentry\\.io\\/[0-9]+/g, main),\n grab(\"Sentry ingest host\", /o[0-9]+\\.ingest\\.[a-z0-9.]+\\.sentry\\.io/g, main),\n grab(\"Cloudflare Turnstile sitekey\", /0x4[A-Za-z0-9_-]{20,}/g, main),\n grab(\"Supabase / JWT 串\", /eyJhbGciOiJ[A-Za-z0-9_.-]{40,}/g, main),\n grab(\"CloudFront CDN\", /https:\\/\\/[a-z0-9]+\\.cloudfront\\.net/g, main),\n grab(\"Google OAuth client id\", /[0-9]{10,}-[a-z0-9]{20,}\\.apps\\.googleusercontent\\.com/g, main),\n grab(\"ngrok 头\", /ngrok-skip-browser-warning/g, main),\n].filter((c) => c.found.length);\n\nconsole.log(\"\\n=== 挖到的配置 ===\");\nfor (const c of config) console.log(\" \", c.label, \"→\", c.found.join(\" | \").slice(0, 160));\n\n// 后端 base 判定逻辑原文\nconst baseLogic = main.match(/[a-zA-Z_$]+=window\\.location\\.hostname===\"one\\.dsrupt\\.ai\"\\?\"[^\"]+\":\"[^\"]+\"/)?.[0] ?? null;\n\nconst hosts = [...hostCount.entries()].sort((a, b) => b[1] - a[1]).map(([host, count]) => ({ host, count }));\nawait blob.set(\"hosts.json\", JSON.stringify(hosts, null, 2));\nawait blob.set(\"config.json\", JSON.stringify({ baseLogic, backend: BACKEND, leaks: config }, null, 2));\n\n// ── 4. 公开接口探测（只读 GET，不创建任何状态）──────────────────\nconst probePaths = [\n \"/.well-known/oauth-authorization-server\",\n \"/ui_api/help\",\n \"/ui_api/guides\",\n \"/ui_api/voice_consent/probe\",\n \"/ui_api/direct_access/?event_code=x&user_code=y\",\n \"/ui_api/demo/view/probe?demo_type=x\",\n \"/ui_api/organisation_invitations/probe\",\n \"/ui_api/guest\",\n \"/mcp\",\n \"/ui_api/predictions?page=1\",\n \"/ui_api/themes\",\n \"/ui_api/events\",\n \"/ui_api/credits/transactions\",\n \"/ui_api/admin/voice_consent_reviews\",\n];\nconst publicData: Record = {};\nfor (const p of probePaths) {\n try {\n const r = await get(p, \"application/json\", BACKEND);\n let body: unknown = r.text.slice(0, 400);\n try {\n body = JSON.parse(r.text);\n } catch { /* 保留原文 */ }\n publicData[p] = { status: r.status, contentType: r.ct, body };\n } catch (e) {\n publicData[p] = { error: (e as Error).message };\n }\n}\nawait blob.set(\"public-data.json\", JSON.stringify(publicData, null, 2));\n\nconsole.log(\"\\n=== 公开接口探测 ===\");\nfor (const [p, v] of Object.entries(publicData)) {\n const o = v as { status?: number };\n console.log(\" \", String(o.status ?? \"ERR\").padEnd(4), p);\n}\n\n// ── 5. 落盘 ─────────────────────────────────────────────────────\nconst apiList = [...apiMap.values()]\n .map((h) => ({ path: h.path, methods: [...h.methods].sort(), chunks: [...h.chunks].sort() }))\n .sort((a, b) => a.path.localeCompare(b.path));\nawait blob.set(\"api-map.json\", JSON.stringify(apiList, null, 2));\n\nconst routeList = [...routes].sort();\nawait blob.set(\"routes.json\", JSON.stringify(routeList, null, 2));\n\nconst manifest = {\n origin: ORIGIN,\n backend: BACKEND,\n siteName: \"Dsrupt One\",\n harvestedAt: new Date().toISOString(),\n shell: { htmlBytes: html.length, mainChunk },\n assets: { count: files.length, totalBytes },\n api: { count: apiList.length },\n routes: { count: routeList.length },\n baseLogic,\n leaks: config,\n hosts: hosts.slice(0, 40),\n files: files.sort((a, b) => a.path.localeCompare(b.path)),\n failures,\n};\nawait blob.set(\"manifest.json\", JSON.stringify(manifest, null, 2));\n\nconsole.log(\"\\n=== 接口地图 ===\");\nconsole.log(\"接口:\", apiList.length, \"条前端路由:\", routeList.length, \"条\");\nconst byMethod = new Map();\nfor (const a of apiList) for (const m of a.methods) byMethod.set(m, (byMethod.get(m) ?? 0) + 1);\nconsole.log([...byMethod.entries()].map(([m, n]) => `${m}:${n}`).join(\" \"));\nconsole.log(\"\\n前 50 条:\");\nfor (const a of apiList.slice(0, 50)) console.log(\" \", a.methods.join(\"/\"), a.path);\nconsole.log(\"\\n已写入 blob: mirror/*, api-map.json, routes.json, hosts.json, config.json, public-data.json, manifest.json\");","/**\n * Dsrupt One（one.dsrupt.ai）扒站脚本\n *\n * 关键情报（已从 bundle 里确认）：\n * - 后端是 Rails：https://backend.dsrupt.ai，接口前缀 /ui_api/\n * - 所有请求走一个包装函数 he(path, opts) → fetch(`${API_BASE_URL}${path}`)\n * - 生产 host 判断：window.location.hostname === \"one.dsrupt.ai\" ? 生产 : staging\n *\n * 干六件事：\n * 1. 归档整站前端（HTML 壳 + JS 分包 + CSS）到 blob\n * 2. 提取全量 /ui_api/ 接口地图（路径 + HTTP 方法 + 出处）\n * 3. 提取前端路由表\n * 4. 挖出 bundle 里硬编码的配置/密钥\n * 5. 列出 bundle 里出现的所有第三方 host\n * 6. 探测无需登录的公开接口\n *\n * 跑法：直接 Run。可重复跑，会覆盖。\n */\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\n\nconst UA =\n \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\";\nconst ORIGIN = \"https://one.dsrupt.ai\";\nconst BACKEND = \"https://backend.dsrupt.ai\";\n\nconst uniq = (a: string[]) => [...new Set(a)];\n\nasync function get(path: string, accept = \"*/*\", base = ORIGIN) {\n const res = await fetch(base + path, {\n headers: {\n \"user-agent\": UA,\n accept,\n \"accept-language\": \"en-US,en;q=0.9\",\n referer: ORIGIN + \"/\",\n },\n redirect: \"follow\",\n });\n return { status: res.status, text: await res.text(), ct: res.headers.get(\"content-type\") ?? \"\" };\n}\n\nasync function pool(items: T[], limit: number, fn: (item: T) => Promise): Promise {\n const out: R[] = new Array(items.length);\n let cursor = 0;\n await Promise.all(\n Array.from({ length: Math.min(limit, items.length) }, async () => {\n while (true) {\n const i = cursor++;\n if (i >= items.length) return;\n out[i] = await fn(items[i]);\n }\n }),\n );\n return out;\n}\n\n// ── 1. 收集所有前端资源 ─────────────────────────────────────────\nconst html = (await get(\"/\", \"text/html\")).text;\nconst shellAssets = uniq([...html.matchAll(/(?:src|href)=\"(\\/assets\\/[^\"]+)\"/g)].map((m) => m[1]));\nconst mainChunk = shellAssets.find((p) => /\\/index-[^/]+\\.js$/.test(p)) ?? shellAssets.find((p) => p.endsWith(\".js\"))!;\nconst main = (await get(mainChunk)).text;\nconst lazyChunks = uniq([...main.matchAll(/assets\\/[A-Za-z0-9_.\\-]+\\.(?:js|css)/g)].map((m) => \"/\" + m[0]));\nconst allAssets = uniq([...shellAssets, ...lazyChunks]);\nconsole.log(\"HTML 壳:\", html.length, \"B 主 bundle:\", mainChunk, main.length, \"B 资源:\", allAssets.length, \"个\");\n\n// ── 2. 提取接口 + 路由 + host ───────────────────────────────────\ntype Hit = { path: string; methods: Set; chunks: Set };\nconst apiMap = new Map();\nconst routes = new Set();\nconst hostCount = new Map();\n\nconst norm = (p: string) =>\n p.replace(/\\$\\{[^}]*\\}/g, \":param\")\n .replace(/\\?.*$/, \"\")\n .replace(/[`\"'\\\\;,)]+$/, \"\")\n .replace(/\\/+$/, \"\") || \"/\";\n\nfunction mine(chunkName: string, code: string) {\n // 所有 /ui_api/... 出现点\n for (const m of code.matchAll(/\\/ui_api\\/[A-Za-z0-9_\\-\\/.${}?&=:]{0,160}/g)) {\n const raw = m[0];\n const path = norm(raw);\n if (path.length < 8) continue;\n // 往后 400 字符找 method:\"XXX\"\n const after = code.slice(m.index! + raw.length, m.index! + raw.length + 400);\n const mm = after.match(/method:\\s*\"([A-Z]+)\"/);\n const hit = apiMap.get(path) ?? { path, methods: new Set(), chunks: new Set() };\n hit.methods.add(mm ? mm[1] : \"GET\");\n hit.chunks.add(chunkName);\n apiMap.set(path, hit);\n }\n // 非 /ui_api 前缀的后端接口（如 /users/password）\n for (const m of code.matchAll(/fetch\\(`\\$\\{[a-zA-Z_$]+\\}(\\/[a-z_]+(?:\\/[A-Za-z0-9_\\-\\/.${}]{0,80})?)`/g)) {\n const path = norm(m[1]);\n if (path.startsWith(\"/ui_api\")) continue;\n const after = code.slice(m.index! + m[0].length, m.index! + m[0].length + 400);\n const mm = after.match(/method:\\s*\"([A-Z]+)\"/);\n const hit = apiMap.get(path) ?? { path, methods: new Set(), chunks: new Set() };\n hit.methods.add(mm ? mm[1] : \"GET\");\n hit.chunks.add(chunkName);\n apiMap.set(path, hit);\n }\n // 前端路由：React Router 的 path:\"/xxx\"\n for (const m of code.matchAll(/path:\\s*\"(\\/[A-Za-z0-9_\\-\\/:${}.]{0,80})\"/g)) {\n routes.add(norm(m[1]));\n }\n // 第三方 host\n for (const m of code.matchAll(/https?:\\/\\/([a-zA-Z0-9.\\-]+\\.[a-zA-Z]{2,})/g)) {\n hostCount.set(m[1], (hostCount.get(m[1]) ?? 0) + 1);\n }\n}\n\nconst files: { path: string; bytes: number; status: number }[] = [];\nconst failures: string[] = [];\n\nawait pool(allAssets, 8, async (path) => {\n try {\n const r = await get(path);\n if (r.status !== 200) return void failures.push(`${path} -> ${r.status}`);\n await blob.set(\"mirror\" + path, r.text);\n mine(path, r.text);\n files.push({ path, bytes: r.text.length, status: r.status });\n } catch (e) {\n failures.push(`${path} -> ${(e as Error).message}`);\n }\n});\nawait blob.set(\"mirror/index.html\", html);\n\nconst totalBytes = files.reduce((s, f) => s + f.bytes, 0);\nconsole.log(\"归档:\", files.length, \"/\", allAssets.length, \" 共\", (totalBytes / 1024 / 1024).toFixed(2), \"MB\");\n\n// ── 3. 挖配置 / 密钥 ────────────────────────────────────────────\nconst grab = (label: string, re: RegExp, src: string) => {\n const found = uniq([...src.matchAll(re)].map((m) => m[0]));\n return { label, found: found.slice(0, 8) };\n};\nconst config = [\n grab(\"PostHog 项目 key\", /phc_[A-Za-z0-9]{20,}/g, main),\n grab(\"Stripe publishable key\", /pk_(?:live|test)_[A-Za-z0-9]{20,}/g, main),\n grab(\"Sentry DSN\", /https:\\/\\/[a-z0-9]+@[a-z0-9.]+\\.ingest\\.[a-z0-9.]+\\.sentry\\.io\\/[0-9]+/g, main),\n grab(\"Sentry ingest host\", /o[0-9]+\\.ingest\\.[a-z0-9.]+\\.sentry\\.io/g, main),\n grab(\"Cloudflare Turnstile sitekey\", /0x4[A-Za-z0-9_-]{20,}/g, main),\n grab(\"Supabase / JWT 串\", /eyJhbGciOiJ[A-Za-z0-9_.-]{40,}/g, main),\n grab(\"CloudFront CDN\", /https:\\/\\/[a-z0-9]+\\.cloudfront\\.net/g, main),\n grab(\"Google OAuth client id\", /[0-9]{10,}-[a-z0-9]{20,}\\.apps\\.googleusercontent\\.com/g, main),\n grab(\"ngrok 头\", /ngrok-skip-browser-warning/g, main),\n].filter((c) => c.found.length);\n\nconsole.log(\"\\n=== 挖到的配置 ===\");\nfor (const c of config) console.log(\" \", c.label, \"→\", c.found.join(\" | \").slice(0, 160));\n\n// 后端 base 判定逻辑原文\nconst baseLogic = main.match(/[a-zA-Z_$]+=window\\.location\\.hostname===\"one\\.dsrupt\\.ai\"\\?\"[^\"]+\":\"[^\"]+\"/)?.[0] ?? null;\n\nconst hosts = [...hostCount.entries()].sort((a, b) => b[1] - a[1]).map(([host, count]) => ({ host, count }));\nawait blob.set(\"hosts.json\", JSON.stringify(hosts, null, 2));\nawait blob.set(\"config.json\", JSON.stringify({ baseLogic, backend: BACKEND, leaks: config }, null, 2));\n\n// ── 4. 公开接口探测（只读 GET，不创建任何状态）──────────────────\nconst probePaths = [\n \"/.well-known/oauth-authorization-server\",\n \"/ui_api/help\",\n \"/ui_api/guides\",\n \"/ui_api/voice_consent/probe\",\n \"/ui_api/direct_access/?event_code=x&user_code=y\",\n \"/ui_api/demo/view/probe?demo_type=x\",\n \"/ui_api/organisation_invitations/probe\",\n \"/ui_api/guest\",\n \"/mcp\",\n \"/ui_api/predictions?page=1\",\n \"/ui_api/themes\",\n \"/ui_api/events\",\n \"/ui_api/credits/transactions\",\n \"/ui_api/admin/voice_consent_reviews\",\n];\nconst publicData: Record = {};\nfor (const p of probePaths) {\n try {\n const r = await get(p, \"application/json\", BACKEND);\n let body: unknown = r.text.slice(0, 400);\n try {\n body = JSON.parse(r.text);\n } catch { /* 保留原文 */ }\n publicData[p] = { status: r.status, contentType: r.ct, body };\n } catch (e) {\n publicData[p] = { error: (e as Error).message };\n }\n}\nawait blob.set(\"public-data.json\", JSON.stringify(publicData, null, 2));\n\nconsole.log(\"\\n=== 公开接口探测 ===\");\nfor (const [p, v] of Object.entries(publicData)) {\n const o = v as { status?: number };\n console.log(\" \", String(o.status ?? \"ERR\").padEnd(4), p);\n}\n\n// ── 5. 落盘 ─────────────────────────────────────────────────────\nconst apiList = [...apiMap.values()]\n .map((h) => ({ path: h.path, methods: [...h.methods].sort(), chunks: [...h.chunks].sort() }))\n .sort((a, b) => a.path.localeCompare(b.path));\nawait blob.set(\"api-map.json\", JSON.stringify(apiList, null, 2));\n\nconst routeList = [...routes].sort();\nawait blob.set(\"routes.json\", JSON.stringify(routeList, null, 2));\n\nconst manifest = {\n origin: ORIGIN,\n backend: BACKEND,\n siteName: \"Dsrupt One\",\n harvestedAt: new Date().toISOString(),\n shell: { htmlBytes: html.length, mainChunk },\n assets: { count: files.length, totalBytes },\n api: { count: apiList.length },\n routes: { count: routeList.length },\n baseLogic,\n leaks: config,\n hosts: hosts.slice(0, 40),\n files: files.sort((a, b) => a.path.localeCompare(b.path)),\n failures,\n};\nawait blob.set(\"manifest.json\", JSON.stringify(manifest, null, 2));\n\nconsole.log(\"\\n=== 接口地图 ===\");\nconsole.log(\"接口:\", apiList.length, \"条前端路由:\", routeList.length, \"条\");\nconst byMethod = new Map();\nfor (const a of apiList) for (const m of a.methods) byMethod.set(m, (byMethod.get(m) ?? 0) + 1);\nconsole.log([...byMethod.entries()].map(([m, n]) => `${m}:${n}`).join(\" \"));\nconsole.log(\"\\n前 50 条:\");\nfor (const a of apiList.slice(0, 50)) console.log(\" \", a.methods.join(\"/\"), a.path);\nconsole.log(\"\\n已写入 blob: mirror/*, api-map.json, routes.json, hosts.json, config.json, public-data.json, manifest.json\");// ── 6. 公开内容全文（帮助文档 / 指南 / OAuth 元数据）─────────────\nconst content: Record = {};\nfor (const p of [\"/.well-known/oauth-authorization-server\", \"/ui_api/help\", \"/ui_api/guides\"]) {\n const r = await get(p, \"application/json\", BACKEND);\n let json: unknown = r.text.slice(0, 500);\n try {\n json = JSON.parse(r.text);\n } catch { /* 保留原文 */ }\n content[p] = { status: r.status, json };\n}\n\nconst keysOf = (v: unknown): string[] =>\n Array.isArray(v)\n ? v.map((x) => (x && typeof x === \"object\" ? (x as Record).key : null))\n .filter((k): k is string => typeof k === \"string\")\n : [];\n\nconst articles: Record = {};\nfor (const k of keysOf((content[\"/ui_api/help\"] as { json: unknown }).json)) {\n const r = await get(`/ui_api/help/${encodeURIComponent(k)}`, \"application/json\", BACKEND);\n try {\n articles[`help/${k}`] = JSON.parse(r.text);\n } catch { /* 跳过 */ }\n}\ncontent[\"articles\"] = articles;\nawait blob.set(\"public-content.json\", JSON.stringify(content, null, 2));\nconsole.log(\"\\n公开内容: 帮助文档\", Object.keys(articles).length, \"篇已归档 → public-content.json\");","createdAt",["D",1789566559098],"branchVersion","branchId","6dc53565-823d-4cce-8170-4eae74e13964","id","290d781d-96cf-4733-9a64-7fd395fe3989","dsrupt-one-teardown",["D",1789566419180],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","one.dsrupt.ai 扒站报告：前端归档 + 接口地图","imageUrl","441195a2-40c8-4b2d-bbd3-461800634937","pinnedFileId","01a0aa78-eba0-777d-9227-6a25429d5e00","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a0a8c0-e0ca-77ad-a65f-0374979823c7","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_103":102,"_110":105},"org",{"_103":102,"_104":105,"_106":105,"_19":61,"_107":108,"_109":31},"branch",{"_13":92,"_38":93,"_49":48,"_94":50,"_95":-5,"_96":-5,"_97":-5,"_98":-5,"_99":-5,"_100":51,"_101":102},"isOwned",16,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","mansurkurtaran5","handle","displayName","","avatar","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_49":50,"_38":51,"_44":267,"_53":-5,"_54":31,"_55":56,"_57":56,"_58":59,"_60":-5,"_19":61,"_62":63,"_64":65,"_66":-5,"_67":-5,"_68":69,"_70":71,"_72":-5,"_73":-5,"_74":-5,"_75":-5,"_76":77,"_78":77,"_79":80,"_81":80,"_82":80,"_83":77,"_84":77,"_85":268,"_87":269,"_89":270,"_91":31},"tree",[197,203,204,205,206,207,208],"files",[197,198,199,200,201,202,203,204,205,206,207,208],"counts",{"_187":69,"_188":153,"_189":69,"_190":191,"_192":193},"contents",[132,133,134,135,136,137,138],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_49":181,"_38":182,"_36":183,"_142":-5,"_47":48,"_46":159,"_144":65,"_44":184,"_13":69,"_39":185,"_41":-5,"_30":31,"_147":-5,"_33":186},{"_49":175,"_38":176,"_36":177,"_142":-5,"_47":48,"_46":153,"_144":31,"_44":178,"_13":69,"_39":26,"_41":179,"_30":31,"_147":-5,"_33":180},{"_49":168,"_38":169,"_36":170,"_142":-5,"_47":48,"_46":171,"_144":31,"_44":172,"_13":153,"_39":40,"_41":173,"_30":31,"_147":-5,"_33":174},{"_49":161,"_38":162,"_36":163,"_142":-5,"_47":48,"_46":164,"_144":31,"_44":165,"_13":69,"_39":40,"_41":166,"_30":31,"_147":-5,"_33":167},{"_49":157,"_38":34,"_36":37,"_142":-5,"_47":48,"_46":14,"_144":65,"_44":158,"_13":159,"_39":40,"_41":43,"_30":31,"_147":-5,"_33":160},{"_49":149,"_38":150,"_36":63,"_142":-5,"_47":48,"_46":151,"_144":65,"_44":152,"_13":153,"_39":154,"_41":155,"_30":31,"_147":51,"_33":156},{"_49":139,"_38":140,"_36":141,"_142":-5,"_47":48,"_46":143,"_144":31,"_44":145,"_13":69,"_39":40,"_41":146,"_30":31,"_147":-5,"_33":148},"ee270707-a019-4e72-a0e9-0498d8f8a675","public-content.ts","4e3348f2-b1d5-11f1-b5d2-1607ee4eb77e","parentId",8,"latest",["D",1789566512299],"/**\n * 拉取 backend.dsrupt.ai 上无需登录的公开内容全文。\n */\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\n\nconst BACKEND = \"https://backend.dsrupt.ai\";\nconst UA =\n \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\";\n\nasync function j(path: string) {\n const res = await fetch(BACKEND + path, {\n headers: { \"user-agent\": UA, accept: \"application/json\", origin: \"https://one.dsrupt.ai\" },\n redirect: \"follow\",\n });\n const text = await res.text();\n try {\n return { status: res.status, json: JSON.parse(text) as unknown };\n } catch {\n return { status: res.status, json: text.slice(0, 500) };\n }\n}\n\nconst out: Record = {};\n\nfor (const p of [\"/.well-known/oauth-authorization-server\", \"/ui_api/help\", \"/ui_api/guides\"]) {\n const r = await j(p);\n out[p] = r;\n console.log(`\\n===== ${p} [${r.status}] =====`);\n console.log(JSON.stringify(r.json, null, 2).slice(0, 2500));\n}\n\n// 从 help / guides 里抽 key，逐条拉全文\nconst keysOf = (v: unknown): string[] => {\n if (Array.isArray(v)) {\n return v.map((x) => (x && typeof x === \"object\" ? (x as Record).key : null))\n .filter((k): k is string => typeof k === \"string\");\n }\n return [];\n};\n\nconst helpKeys = keysOf((out[\"/ui_api/help\"] as { json: unknown }).json);\nconst guideKeys = keysOf((out[\"/ui_api/guides\"] as { json: unknown }).json);\nconsole.log(\"\\nhelp keys:\", helpKeys.length, guideKeys.length ? \"\" : \"\", JSON.stringify(helpKeys));\nconsole.log(\"guide keys:\", guideKeys.length, JSON.stringify(guideKeys));\n\nconst articles: Record = {};\nfor (const k of helpKeys) articles[`help/${k}`] = (await j(`/ui_api/help/${encodeURIComponent(k)}`)).json;\nfor (const k of guideKeys) articles[`guides/${k}`] = (await j(`/ui_api/guides/${encodeURIComponent(k)}`)).json;\n\nout[\"articles\"] = articles;\nawait blob.set(\"public-content.json\", JSON.stringify(out, null, 2));\nconsole.log(\"\\n文章数:\", Object.keys(articles).length);\nconsole.log(\"已写入 public-content.json\");","label",[140],"752c26ce-bfad-4ae4-b38f-7023118418cb","index.ts",9,["D",1789566524841],1,"http","import { parseVal, serveImmutableFile } from \"https://esm.town/v/std/utils/index.ts\";\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\nimport { Hono } from \"npm:hono\";\nimport { Root } from \"./frontend/root.tsx\";\n\nconst app = new Hono();\n\n// Serve the (never-cached) HTML shell at the root /\napp.get(\"/\", (c) => c.html(Root()));\n\n// Serve frontend files at the version-addressed URLs Root() stamps, cached immutably\napp.get(\"/__immutable/*\", (c) => serveImmutableFile(c.req.path));\n\n// View source redirect\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\n\n// ── 报告接口 ─────────────────────────────────────────────────────\n\n/** 概览：归档清单 + 公开接口探测结果 */\napp.get(\"/api/summary\", async (c) => {\n const [manifest, publicData] = await Promise.all([\n blob.getJSON(\"manifest.json\"),\n blob.getJSON(\"public-data.json\"),\n ]);\n return c.json({ manifest, publicData });\n});\n\n/** 全量接口地图（207 条 /ui_api/*，含 HTTP 方法与出处分包） */\napp.get(\"/api/endpoints\", async (c) => {\n const list = (await blob.getJSON(\"api-map.json\")) ?? [];\n return c.json(list);\n});\n\n/** 前端路由表（从 React Router 提取） */\napp.get(\"/api/routes\", async (c) => {\n const list = (await blob.getJSON(\"routes.json\")) ?? [];\n return c.json(list);\n});\n\n/** 泄露的配置 / 密钥 + 第三方 host */\napp.get(\"/api/config\", async (c) => {\n const [config, hosts] = await Promise.all([\n blob.getJSON(\"config.json\"),\n blob.getJSON(\"hosts.json\"),\n ]);\n return c.json({ config, hosts: hosts ?? [] });\n});\n\n/** 公开内容全文：帮助文档、指南、OAuth 元数据 */\napp.get(\"/api/content\", async (c) => {\n const data = (await blob.getJSON(\"public-content.json\")) ?? {};\n return c.json(data);\n});\n\n/** 读归档的原始前端文件 */\napp.get(\"/api/file\", async (c) => {\n const path = c.req.query(\"path\");\n if (!path) return c.json({ error: \"缺少 path 参数\" }, 400);\n const content = await blob.get(\"mirror\" + path);\n if (content === null) return c.json({ error: \"未归档该文件\" }, 404);\n const text = typeof content === \"string\" ? content : await (content as Blob).text();\n return c.text(text);\n});\n\n// Unwrap and rethrow Hono errors as the original error\napp.onError((err) => Promise.reject(err));\n\nexport default app.fetch;",[150],"5ae97019-ef9c-4224-9521-4bc51a5f5291",["D",1789566559098],2,[34],"0f564a67-597b-4b30-9441-27fff7845645","analyze2.ts","3dcab77a-b1d5-11f1-97df-1607ee4eb77e",6,["D",1789566484793],"/**\n * 第二轮分析：找 API 路径是怎么拼出来的 + 探 backend.dsrupt.ai\n */\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\n\nconst raw = await blob.get(\"mirror/assets/index-DPXPu-4s.js\");\nconst code: string = typeof raw === \"string\" ? raw : await (raw as Blob).text();\n\nconst show = (label: string, re: RegExp, ctx = 200, max = 25) => {\n const hits: string[] = [];\n for (const m of code.matchAll(re)) {\n const i = m.index ?? 0;\n hits.push(code.slice(Math.max(0, i - ctx), i + ctx).replace(/\\s+/g, \" \"));\n if (hits.length >= max) break;\n }\n console.log(`\\n===== ${label} (${hits.length} 条) =====`);\n for (const h of hits) console.log(\" …\" + h + \"…\");\n};\n\nshow(\"fetch( 上下文\", /fetch\\(/g, 160, 20);\nshow(\"${zs} 上下文\", /\\$\\{zs\\}/g, 200, 15);\nshow(\"API_BASE_URL 上下文\", /API_BASE_URL/g, 160, 12);\nshow(\"zs+ 上下文\", /zs\\+/g, 160, 10);\nshow(\"zs 单独出现\", /\\bzs\\b/g, 120, 15);\n\n// 找出所有反引号模板里带变量的路径片段\nconst tmpl = new Set();\nfor (const m of code.matchAll(/`([^`]{0,120}\\$\\{[^`]{0,80})`/g)) {\n const s = m[1];\n if (/\\/[a-z]/i.test(s) && s.length < 140) tmpl.add(s.replace(/\\s+/g, \" \"));\n}\nconsole.log(`\\n===== 带变量的模板字符串 (${tmpl.size} 条，前 60) =====`);\nconsole.log([...tmpl].slice(0, 60).join(\"\\n\"));\n\n// ── 探 backend.dsrupt.ai ────────────────────────────────────────\nconst BACKEND = \"https://backend.dsrupt.ai\";\nconst probe = async (p: string) => {\n try {\n const res = await fetch(BACKEND + p, {\n headers: { accept: \"application/json\", origin: \"https://one.dsrupt.ai\" },\n redirect: \"follow\",\n });\n const t = await res.text();\n console.log(` ${p} -> ${res.status} ${res.headers.get(\"content-type\")} ${t.length}B ${JSON.stringify(t.slice(0, 160))}`);\n } catch (e) {\n console.log(` ${p} -> ERR ${(e as Error).message}`);\n }\n};\n\nconsole.log(\"\\n===== backend.dsrupt.ai 探测 =====\");\nfor (\n const p of [\n \"/\",\n \"/health\",\n \"/api/health\",\n \"/api/config\",\n \"/api/version\",\n \"/docs\",\n \"/openapi.json\",\n \"/api/docs\",\n \"/api-docs\",\n \"/api/models\",\n \"/api/plans\",\n \"/api/public/config\",\n \"/.well-known/oauth-authorization-server\",\n \"/mcp\",\n \"/api/mcp\",\n ]\n) await probe(p);",[162],"24da68f0-3cb2-4e73-acce-4de158d485fc","analyze.ts","33b7af54-b1d5-11f1-abab-1607ee4eb77e",5,["D",1789566476081],"/**\n * 分析已归档的 bundle，搞清楚 API 调用到底怎么写的。\n */\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\n\nconst raw = await blob.get(\"mirror/assets/index-DPXPu-4s.js\");\nif (!raw) throw new Error(\"bundle 未归档\");\nconsole.log(\"blob.get 返回类型:\", Object.prototype.toString.call(raw), typeof raw);\nconst code: string = typeof raw === \"string\" ? raw : await (raw as Blob).text();\nconsole.log(\"bundle 长度:\", code.length);\n\nconst show = (label: string, re: RegExp, ctx = 120, max = 20) => {\n const hits: string[] = [];\n for (const m of code.matchAll(re)) {\n const i = m.index ?? 0;\n hits.push(code.slice(Math.max(0, i - ctx), i + ctx).replace(/\\s+/g, \" \"));\n if (hits.length >= max) break;\n }\n console.log(`\\n===== ${label} (${hits.length} 条) =====`);\n for (const h of hits) console.log(\" …\" + h + \"…\");\n};\n\nshow(\"backend.dsrupt.ai 上下文\", /backend\\.dsrupt\\.ai/g, 200, 5);\nshow(\"herokuapp 上下文\", /herokuapp\\.com/g, 250, 3);\nshow(\"baseURL\", /baseURL/g, 150, 10);\nshow(\"字符串字面量里的 /api/\", /[\"'`](\\/api\\/[^\"'`\\s]{0,100})[\"'`]/g, 60, 30);\n\n// 所有 /api/ 开头、出现在任意位置的片段\nconst apiFrag = new Set();\nfor (const m of code.matchAll(/\\/api\\/[A-Za-z0-9_\\-/.${}:[\\]*]{0,120}/g)) {\n apiFrag.add(m[0]);\n}\nconsole.log(`\\n===== 所有含 /api/ 的片段 (${apiFrag.size} 条) =====`);\nconsole.log([...apiFrag].sort().slice(0, 80).join(\"\\n\"));\n\n// 所有看起来像 REST 路径的字符串字面量\nconst paths = new Set();\nfor (const m of code.matchAll(/[\"'`](\\/[a-z0-9][a-z0-9\\-/_${}.:]{2,100})[\"'`]/gi)) {\n paths.add(m[1]);\n}\nconsole.log(`\\n===== 所有以 / 开头的字符串字面量 (${paths.size} 条) =====`);\nconsole.log([...paths].sort().slice(0, 120).join(\"\\n\"));\n\nconsole.log(\"\\nfetch( 出现次数:\", (code.match(/fetch\\(/g) ?? []).length);\nconsole.log(\"axios 出现次数:\", (code.match(/axios/g) ?? []).length);\nconsole.log(\".get( 出现次数:\", (code.match(/\\.get\\(/g) ?? []).length);",[169],"ee1b795c-39a1-4f4e-9f2a-5b3b652aab36","README.md","16ba47fe-b1d5-11f1-bb34-1607ee4eb77e",["D",1789566419249],"# Dsrupt One · 扒站报告\n\n对的拆解。\n\n抓取脚本跑完后这里会更新。\n",[176],"56014d1c-3ea9-4709-8e5a-ad3d871fb228","frontend","01a0aa78-eba0-777d-9227-6cdff2944f17",["D",1789566446495],"directory",[182],"pulls","branches","forks","envVars",{"_194":69,"_196":69},"connections",{"_194":69,"_195":69},"count","unfilledCount","emptyCount",{"_49":181,"_38":182,"_36":183,"_142":-5,"_47":48,"_46":159,"_144":65,"_44":264,"_13":69,"_39":185,"_41":-5,"_30":31,"_147":-5,"_210":265,"_33":266},{"_49":260,"_38":259,"_36":253,"_142":183,"_47":48,"_46":159,"_144":65,"_44":261,"_13":69,"_39":185,"_41":-5,"_30":31,"_147":-5,"_210":262,"_33":263},{"_49":250,"_38":251,"_36":252,"_142":253,"_47":48,"_46":254,"_144":65,"_44":255,"_13":153,"_39":40,"_41":256,"_30":31,"_147":-5,"_210":257,"_33":258},{"_49":243,"_38":244,"_36":245,"_142":183,"_47":48,"_46":159,"_144":65,"_44":246,"_13":69,"_39":26,"_41":247,"_30":31,"_147":-5,"_210":248,"_33":249},{"_49":236,"_38":237,"_36":238,"_142":183,"_47":48,"_46":159,"_144":65,"_44":239,"_13":69,"_39":40,"_41":240,"_30":31,"_147":-5,"_210":241,"_33":242},{"_49":228,"_38":229,"_36":230,"_142":183,"_47":48,"_46":231,"_144":65,"_44":232,"_13":153,"_39":40,"_41":233,"_30":31,"_147":-5,"_210":234,"_33":235},{"_49":175,"_38":176,"_36":177,"_142":-5,"_47":48,"_46":153,"_144":31,"_44":225,"_13":69,"_39":26,"_41":179,"_30":31,"_147":-5,"_210":226,"_33":227},{"_49":168,"_38":169,"_36":170,"_142":-5,"_47":48,"_46":171,"_144":31,"_44":222,"_13":153,"_39":40,"_41":173,"_30":31,"_147":-5,"_210":223,"_33":224},{"_49":161,"_38":162,"_36":163,"_142":-5,"_47":48,"_46":164,"_144":31,"_44":219,"_13":69,"_39":40,"_41":166,"_30":31,"_147":-5,"_210":220,"_33":221},{"_49":157,"_38":34,"_36":37,"_142":-5,"_47":48,"_46":14,"_144":65,"_44":216,"_13":159,"_39":40,"_41":43,"_30":31,"_147":-5,"_210":217,"_33":218},{"_49":149,"_38":150,"_36":63,"_142":-5,"_47":48,"_46":151,"_144":65,"_44":213,"_13":153,"_39":154,"_41":155,"_30":31,"_147":51,"_210":214,"_33":215},{"_49":139,"_38":140,"_36":141,"_142":-5,"_47":48,"_46":143,"_144":31,"_44":209,"_13":69,"_39":40,"_41":146,"_30":31,"_147":-5,"_210":211,"_33":212},["D",1789566512299],"children",[],[140],["D",1789566524841],[],[150],["D",1789566559098],[],[34],["D",1789566484793],[],[162],["D",1789566476081],[],[169],["D",1789566419249],[],[176],"5872a41d-b427-4a99-b026-4a998713330c","root.tsx","01a0aa78-eba0-777d-9227-83b582ea6412",11,["D",1789566554737],"/** @jsxImportSource npm:hono@4/jsx */\nimport { raw } from \"npm:hono@4/html\";\nimport { immutableFileUrl } from \"https://esm.town/v/std/utils/index.ts\";\n\n// The HTML shell for the app. It is never cached, so immutableFileUrl can stamp\n// the current val version into each asset URL — the browser caches those\n// immutably, and publishing the val changes the URLs, refetching exactly once.\nexport function Root() {\n return (\n <>\n {raw(\"\")}\n \n \n \n \n Dsrupt One · 扒站报告\n

Diff · v12