[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_251":252,"_253":254},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":-7,"_18":19,"_17":-7,"_188":-5,"_20":189,"_22":190,"_191":192,"_193":194,"_26":195,"_24":196,"_197":-5,"_198":-5,"_199":55,"_200":201,"_202":46,"_203":-5,"_204":-5,"_205":206},"routes/_app.x.$handle.$name.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":25,"_26":27,"_28":-5,"_29":-5,"_30":-5,"_31":-5,"_32":-5},"handle","mansurkurtaran5","name","dsrupt-one-teardown","branchName","main","version","path","frontend/components","project",{"_34":134,"_13":14,"_47":135,"_136":-5,"_137":55,"_138":139,"_140":139,"_141":142,"_143":-5,"_144":145,"_146":73,"_147":46,"_148":-5,"_149":-5,"_150":62,"_151":152,"_153":-5,"_154":-5,"_155":-5,"_156":-5,"_157":158,"_159":158,"_160":161,"_162":161,"_163":161,"_164":158,"_165":158,"_166":167,"_168":169,"_170":171,"_172":55},"tree",[67,68,69,70],"file",{"_34":60,"_41":42,"_37":40,"_13":59,"_52":-5,"_50":61,"_17":62,"_39":63,"_47":64,"_43":65,"_56":-5,"_18":66},"contents",[33],"upstream","pull","ahead","behind","envVars",{"_34":35,"_13":36,"_37":38,"_39":40,"_41":42,"_43":44,"_45":46,"_47":48,"_17":49,"_50":51,"_52":53,"_54":55,"_56":-5,"_18":57},"id","ccf9e3be-c01e-4356-9a90-72aa1adc0371","App.tsx","fileId","01a0aa78-eba0-777d-9227-77e79913929b","parentId","01a0aa78-eba0-777d-9227-701221398c1e","branchId","6dc53565-823d-4cce-8170-4eae74e13964","branchVersion",10,"latest",true,"createdAt",["D",1789566551333],1,"fileType","script","content","/** @jsxImportSource https://esm.sh/react@18.2.0 */\nimport { useEffect, useMemo, useState } from \"react\";\n\ntype Endpoint = { path: string; methods: string[]; chunks: string[] };\ntype Host = { host: string; count: number };\ntype Leak = { label: string; found: string[] };\ntype FileEntry = { path: string; bytes: number; status: number };\n\ntype Manifest = {\n origin: string;\n backend: string;\n siteName: string;\n harvestedAt: string;\n shell: { htmlBytes: number; mainChunk: string };\n assets: { count: number; totalBytes: number };\n api: { count: number };\n routes: { count: number };\n baseLogic: string | null;\n leaks: Leak[];\n hosts: Host[];\n files: FileEntry[];\n failures: string[];\n};\n\ntype Probe = { status?: number; contentType?: string; body?: unknown; error?: string };\n\nconst TABS = [\n [\"overview\", \"概览\"],\n [\"api\", \"接口地图\"],\n [\"routes\", \"前端路由\"],\n [\"content\", \"公开内容\"],\n [\"config\", \"泄露配置\"],\n [\"files\", \"归档文件\"],\n] as const;\n\nconst fmtBytes = (n: number) => (n / 1024 / 1024).toFixed(2) + \" MB\";\nconst METHOD_COLORS: Record = {\n GET: \"bg-emerald-100 text-emerald-800\",\n POST: \"bg-blue-100 text-blue-800\",\n PUT: \"bg-amber-100 text-amber-800\",\n PATCH: \"bg-violet-100 text-violet-800\",\n DELETE: \"bg-rose-100 text-rose-800\",\n};\n\nfunction MethodBadge({ m }: { m: string }) {\n return (\n \n {m}\n \n );\n}\n\nfunction Card({ label, value, sub }: { label: string; value: string; sub?: string }) {\n return (\n

{label}

{value}

\n {sub &&

{sub}

}\n

\n );\n}\n\nexport function App() {\n const [tab, setTab] = useState(\"overview\");\n const [summary, setSummary] = useState<{ manifest: Manifest; publicData: Record } | null>(null);\n const [endpoints, setEndpoints] = useState([]);\n const [routes, setRoutes] = useState([]);\n const [config, setConfig] = useState<{ config: { baseLogic: string | null; backend: string; leaks: Leak[] }; hosts: Host[] } | null>(null);\n const [content, setContent] = useState | null>(null);\n const [q, setQ] = useState(\"\");\n const [methodFilter, setMethodFilter] = useState(\"ALL\");\n const [openArticle, setOpenArticle] = useState(null);\n\n useEffect(() => {\n fetch(\"/api/summary\").then((r) => r.json()).then(setSummary).catch(() => {});\n fetch(\"/api/endpoints\").then((r) => r.json()).then(setEndpoints).catch(() => {});\n fetch(\"/api/routes\").then((r) => r.json()).then(setRoutes).catch(() => {});\n fetch(\"/api/config\").then((r) => r.json()).then(setConfig).catch(() => {});\n fetch(\"/api/content\").then((r) => r.json()).then(setContent).catch(() => {});\n }, []);\n\n const manifest = summary?.manifest;\n const publicData = summary?.publicData ?? {};\n\n const filtered = useMemo(() => {\n const needle = q.trim().toLowerCase();\n return endpoints.filter((e) => {\n if (methodFilter !== \"ALL\" && !e.methods.includes(methodFilter)) return false;\n if (needle && !e.path.toLowerCase().includes(needle)) return false;\n return true;\n });\n }, [endpoints, q, methodFilter]);\n\n const articles = (content?.articles ?? {}) as Record>;\n const articleKeys = Object.keys(articles).sort();\n const guides = ((content?.[\"/ui_api/guides\"] as { json?: { modules?: unknown[] } })?.json?.modules ?? []) as Record[];\n const oauth = (content?.[\"/.well-known/oauth-authorization-server\"] as { json?: unknown })?.json;\n\n return (\n

Dsrupt One · 扒站报告

\n one.dsrupt.ai\n {\" 的整站拆解：前端归档 + 全量接口地图 + 泄露配置 + 公开内容全文。\"}\n

\n {manifest && (\n

\n 抓取时间 {new Date(manifest.harvestedAt).toLocaleString()} · 后端 {manifest.backend}\n

\n )}\n

\n\n \n\n {!manifest &&

加载中…

}\n\n {manifest && tab === \"overview\" && (\n

\n \n \n \n p.status === 200).length)} sub=\"无需登录\" />\n

\n\n

这个站是什么

\n Dsrupt One 是 Dsrupt.ai 的多品牌 AI 创作工作台，面向代理商和创意团队：把各家 AI 图像/视频模型收进一个工作区，\n 并把每个客户品牌（brand）的规范内建进去。核心卖点是「品牌一致性」—— 上传 CI、logo、网站，平台自动生成品牌指南，\n 之后每次生成都自动套用；同时通过 MCP 把能力接进 ChatGPT / Claude / Cursor 等工具。\n 产品线里还有 AI Activations（线下活动的品牌化 AI 体验）和 events（活动）模块。\n

前端

Vite + React 18 SPA，TanStack Query + zustand，单包 {fmtBytes(manifest.assets.totalBytes)}

后端

Rails（user[email] 参数风格、/ui_api/ 命名空间、{\"{status,error}\"} 错误体）

鉴权

JWT（Bearer）+ 游客 token（/ui_api/guest）+ Google 登录 + Cloudflare Turnstile

集成

Stripe 支付、PostHog 埋点、Sentry、CloudFront CDN、MCP / OAuth 2.1

\n\n {manifest.baseLogic && (\n

后端地址是前端硬编码的

{manifest.baseLogic}

\n 也就是说：在 one.dsrupt.ai 上打开时打生产后端；在任何其他域名（含本地开发）打开时，\n 前端会直接把请求打到 staging 后端 dsrupt-backend-staging-5c326933ece6.herokuapp.com。\n

\n )}\n\n

公开接口探测结果

\n \n \n \n \n \n {Object.entries(publicData).map(([p, v]) => (\n \n \n \n \n \n ))}\n \n

路径	状态	返回
{p}	\n \n {v.status ?? \"ERR\"}\n \n	\n {v.status === 200 ? \"✅ 无需登录\" : v.status === 401 ? \"需登录\" : v.status === 404 ? \"不存在\" : v.status === 400 ? \"存在（参数不对）\" : \"—\"}\n

\n )}\n\n {tab === \"api\" && (\n

\n setQ(e.target.value)}\n placeholder=\"搜索路径…\"\n className=\"w-64 rounded-md border border-gray-300 px-3 py-1.5 text-sm\"\n />\n

\n {[\"ALL\", \"GET\", \"POST\", \"PUT\", \"PATCH\", \"DELETE\"].map((m) => (\n setMethodFilter(m)}\n className={`rounded px-2 py-1 text-xs font-semibold ${methodFilter === m ? \"bg-gray-900 text-white\" : \"bg-gray-100 text-gray-700\"}`}\n >\n {m}\n \n ))}\n

\n {filtered.length} / {endpoints.length} 条\n

\n {filtered.map((e) => (\n

\n {e.methods.map((m) => )}\n

{e.path}

出处 {e.chunks.join(\", \")}

\n ))}\n

\n )}\n\n {tab === \"routes\" && (\n

前端路由表（{routes.length} 条）

\n {routes.map((r) => (\n

{r}

\n ))}\n

\n )}\n\n {tab === \"content\" && (\n

OAuth 2.1 元数据（MCP 接入用）

{JSON.stringify(oauth, null, 2)}

\n\n

官方指南模块（{guides.length} 个）

\n {guides.map((m, i) => (\n

{String(m.title ?? m.key)}

{String(m.summary ?? \"\")}

\n {typeof m.video_url === \"string\" && (\n \n {m.video_url}\n \n )}\n

\n ))}\n

\n\n

帮助文档全文（{articleKeys.length} 篇）

\n {articleKeys.map((k) => {\n const a = articles[k];\n const body = String(a?.body ?? a?.content ?? a?.markdown ?? \"\");\n return (\n

\n setOpenArticle(openArticle === k ? null : k)}\n className=\"flex w-full items-center justify-between px-3 py-2 text-left text-sm hover:bg-gray-50\"\n >\n {String(a?.title ?? k)}\n {k} {openArticle === k ? \"▲\" : \"▼\"}\n \n {openArticle === k && (\n

\n                        {body || JSON.stringify(a, null, 2)}\n

\n )}\n

\n );\n })}\n

\n )}\n\n {tab === \"config\" && (\n

bundle 里硬编码的配置

\n 这些值任何人都能在浏览器里拿到。publishable / 项目 key 本身设计为公开，但暴露它们等于暴露了可被滥用的入口。\n

\n {(config?.config?.leaks ?? manifest.leaks).map((l) => (\n

{l.label}

\n {l.found.map((f) => (\n

{f}

\n ))}\n

\n\n

第三方 host（bundle 里出现的）

\n {(config?.hosts ?? manifest.hosts).slice(0, 60).map((h) => (\n

\n {h.host}\n ×{h.count}\n

\n ))}\n

\n )}\n\n {tab === \"files\" && (\n

归档的前端文件（{manifest.files.length} 个）

\n \n \n \n \n \n {manifest.files.map((f) => (\n \n \n \n \n \n ))}\n \n

路径	体积	查看
{f.path}	{(f.bytes / 1024).toFixed(0)} KB	\n 原始内容\n

\n )}\n

\n );\n}","deleted",false,"label",[58,59,36],"frontend","components","3b962afe-549d-45a9-8e63-7b61c57ca002","directory",0,"01a0aa78-eba0-777d-9227-6cdff2944f17",["D",1789566446495],2,[58,59],{"_34":97,"_13":58,"_37":63,"_39":-5,"_41":42,"_43":65,"_45":46,"_47":98,"_17":62,"_50":61,"_52":-5,"_54":55,"_56":-5,"_78":99,"_18":100},{"_34":89,"_13":90,"_37":91,"_39":-5,"_41":42,"_43":92,"_45":46,"_47":93,"_17":49,"_50":24,"_52":94,"_54":55,"_56":-5,"_78":95,"_18":96},{"_34":81,"_13":82,"_37":83,"_39":-5,"_41":42,"_43":84,"_45":46,"_47":85,"_17":65,"_50":51,"_52":86,"_54":55,"_56":-5,"_78":87,"_18":88},{"_34":71,"_13":72,"_37":73,"_39":-5,"_41":42,"_43":74,"_45":46,"_47":75,"_17":49,"_50":76,"_52":77,"_54":55,"_56":14,"_78":79,"_18":80},"752c26ce-bfad-4ae4-b38f-7023118418cb","index.ts","01a0aa78-eba0-777d-9227-6a25429d5e00",9,["D",1789566524841],"http","import { parseVal, serveImmutableFile } from \"https://esm.town/v/std/utils/index.ts\";\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\nimport { Hono } from \"npm:hono\";\nimport { Root } from \"./frontend/root.tsx\";\n\nconst app = new Hono();\n\n// Serve the (never-cached) HTML shell at the root /\napp.get(\"/\", (c) => c.html(Root()));\n\n// Serve frontend files at the version-addressed URLs Root() stamps, cached immutably\napp.get(\"/__immutable/*\", (c) => serveImmutableFile(c.req.path));\n\n// View source redirect\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\n\n// ── 报告接口 ─────────────────────────────────────────────────────\n\n/** 概览：归档清单 + 公开接口探测结果 */\napp.get(\"/api/summary\", async (c) => {\n const [manifest, publicData] = await Promise.all([\n blob.getJSON(\"manifest.json\"),\n blob.getJSON(\"public-data.json\"),\n ]);\n return c.json({ manifest, publicData });\n});\n\n/** 全量接口地图（207 条 /ui_api/*，含 HTTP 方法与出处分包） */\napp.get(\"/api/endpoints\", async (c) => {\n const list = (await blob.getJSON(\"api-map.json\")) ?? [];\n return c.json(list);\n});\n\n/** 前端路由表（从 React Router 提取） */\napp.get(\"/api/routes\", async (c) => {\n const list = (await blob.getJSON(\"routes.json\")) ?? [];\n return c.json(list);\n});\n\n/** 泄露的配置 / 密钥 + 第三方 host */\napp.get(\"/api/config\", async (c) => {\n const [config, hosts] = await Promise.all([\n blob.getJSON(\"config.json\"),\n blob.getJSON(\"hosts.json\"),\n ]);\n return c.json({ config, hosts: hosts ?? [] });\n});\n\n/** 公开内容全文：帮助文档、指南、OAuth 元数据 */\napp.get(\"/api/content\", async (c) => {\n const data = (await blob.getJSON(\"public-content.json\")) ?? {};\n return c.json(data);\n});\n\n/** 读归档的原始前端文件 */\napp.get(\"/api/file\", async (c) => {\n const path = c.req.query(\"path\");\n if (!path) return c.json({ error: \"缺少 path 参数\" }, 400);\n const content = await blob.get(\"mirror\" + path);\n if (content === null) return c.json({ error: \"未归档该文件\" }, 404);\n const text = typeof content === \"string\" ? content : await (content as Blob).text();\n return c.text(text);\n});\n\n// Unwrap and rethrow Hono errors as the original error\napp.onError((err) => Promise.reject(err));\n\nexport default app.fetch;","children",[],[72],"5ae97019-ef9c-4224-9521-4bc51a5f5291","harvest.ts","2dd33518-b1d5-11f1-a6e9-1607ee4eb77e",12,["D",1789566559098],"/**\n * Dsrupt One（one.dsrupt.ai）扒站脚本\n *\n * 关键情报（已从 bundle 里确认）：\n * - 后端是 Rails：https://backend.dsrupt.ai，接口前缀 /ui_api/\n * - 所有请求走一个包装函数 he(path, opts) → fetch(`${API_BASE_URL}${path}`)\n * - 生产 host 判断：window.location.hostname === \"one.dsrupt.ai\" ? 生产 : staging\n *\n * 干六件事：\n * 1. 归档整站前端（HTML 壳 + JS 分包 + CSS）到 blob\n * 2. 提取全量 /ui_api/ 接口地图（路径 + HTTP 方法 + 出处）\n * 3. 提取前端路由表\n * 4. 挖出 bundle 里硬编码的配置/密钥\n * 5. 列出 bundle 里出现的所有第三方 host\n * 6. 探测无需登录的公开接口\n *\n * 跑法：直接 Run。可重复跑，会覆盖。\n */\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\n\nconst UA =\n \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\";\nconst ORIGIN = \"https://one.dsrupt.ai\";\nconst BACKEND = \"https://backend.dsrupt.ai\";\n\nconst uniq = (a: string[]) => [...new Set(a)];\n\nasync function get(path: string, accept = \"*/*\", base = ORIGIN) {\n const res = await fetch(base + path, {\n headers: {\n \"user-agent\": UA,\n accept,\n \"accept-language\": \"en-US,en;q=0.9\",\n referer: ORIGIN + \"/\",\n },\n redirect: \"follow\",\n });\n return { status: res.status, text: await res.text(), ct: res.headers.get(\"content-type\") ?? \"\" };\n}\n\nasync function pool(items: T[], limit: number, fn: (item: T) => Promise): Promise {\n const out: R[] = new Array(items.length);\n let cursor = 0;\n await Promise.all(\n Array.from({ length: Math.min(limit, items.length) }, async () => {\n while (true) {\n const i = cursor++;\n if (i >= items.length) return;\n out[i] = await fn(items[i]);\n }\n }),\n );\n return out;\n}\n\n// ── 1. 收集所有前端资源 ─────────────────────────────────────────\nconst html = (await get(\"/\", \"text/html\")).text;\nconst shellAssets = uniq([...html.matchAll(/(?:src|href)=\"(\\/assets\\/[^\"]+)\"/g)].map((m) => m[1]));\nconst mainChunk = shellAssets.find((p) => /\\/index-[^/]+\\.js$/.test(p)) ?? shellAssets.find((p) => p.endsWith(\".js\"))!;\nconst main = (await get(mainChunk)).text;\nconst lazyChunks = uniq([...main.matchAll(/assets\\/[A-Za-z0-9_.\\-]+\\.(?:js|css)/g)].map((m) => \"/\" + m[0]));\nconst allAssets = uniq([...shellAssets, ...lazyChunks]);\nconsole.log(\"HTML 壳:\", html.length, \"B 主 bundle:\", mainChunk, main.length, \"B 资源:\", allAssets.length, \"个\");\n\n// ── 2. 提取接口 + 路由 + host ───────────────────────────────────\ntype Hit = { path: string; methods: Set; chunks: Set };\nconst apiMap = new Map();\nconst routes = new Set();\nconst hostCount = new Map();\n\nconst norm = (p: string) =>\n p.replace(/\\$\\{[^}]*\\}/g, \":param\")\n .replace(/\\?.*$/, \"\")\n .replace(/[`\"'\\\\;,)]+$/, \"\")\n .replace(/\\/+$/, \"\") || \"/\";\n\nfunction mine(chunkName: string, code: string) {\n // 所有 /ui_api/... 出现点\n for (const m of code.matchAll(/\\/ui_api\\/[A-Za-z0-9_\\-\\/.${}?&=:]{0,160}/g)) {\n const raw = m[0];\n const path = norm(raw);\n if (path.length < 8) continue;\n // 往后 400 字符找 method:\"XXX\"\n const after = code.slice(m.index! + raw.length, m.index! + raw.length + 400);\n const mm = after.match(/method:\\s*\"([A-Z]+)\"/);\n const hit = apiMap.get(path) ?? { path, methods: new Set(), chunks: new Set() };\n hit.methods.add(mm ? mm[1] : \"GET\");\n hit.chunks.add(chunkName);\n apiMap.set(path, hit);\n }\n // 非 /ui_api 前缀的后端接口（如 /users/password）\n for (const m of code.matchAll(/fetch\\(`\\$\\{[a-zA-Z_$]+\\}(\\/[a-z_]+(?:\\/[A-Za-z0-9_\\-\\/.${}]{0,80})?)`/g)) {\n const path = norm(m[1]);\n if (path.startsWith(\"/ui_api\")) continue;\n const after = code.slice(m.index! + m[0].length, m.index! + m[0].length + 400);\n const mm = after.match(/method:\\s*\"([A-Z]+)\"/);\n const hit = apiMap.get(path) ?? { path, methods: new Set(), chunks: new Set() };\n hit.methods.add(mm ? mm[1] : \"GET\");\n hit.chunks.add(chunkName);\n apiMap.set(path, hit);\n }\n // 前端路由：React Router 的 path:\"/xxx\"\n for (const m of code.matchAll(/path:\\s*\"(\\/[A-Za-z0-9_\\-\\/:${}.]{0,80})\"/g)) {\n routes.add(norm(m[1]));\n }\n // 第三方 host\n for (const m of code.matchAll(/https?:\\/\\/([a-zA-Z0-9.\\-]+\\.[a-zA-Z]{2,})/g)) {\n hostCount.set(m[1], (hostCount.get(m[1]) ?? 0) + 1);\n }\n}\n\nconst files: { path: string; bytes: number; status: number }[] = [];\nconst failures: string[] = [];\n\nawait pool(allAssets, 8, async (path) => {\n try {\n const r = await get(path);\n if (r.status !== 200) return void failures.push(`${path} -> ${r.status}`);\n await blob.set(\"mirror\" + path, r.text);\n mine(path, r.text);\n files.push({ path, bytes: r.text.length, status: r.status });\n } catch (e) {\n failures.push(`${path} -> ${(e as Error).message}`);\n }\n});\nawait blob.set(\"mirror/index.html\", html);\n\nconst totalBytes = files.reduce((s, f) => s + f.bytes, 0);\nconsole.log(\"归档:\", files.length, \"/\", allAssets.length, \" 共\", (totalBytes / 1024 / 1024).toFixed(2), \"MB\");\n\n// ── 3. 挖配置 / 密钥 ────────────────────────────────────────────\nconst grab = (label: string, re: RegExp, src: string) => {\n const found = uniq([...src.matchAll(re)].map((m) => m[0]));\n return { label, found: found.slice(0, 8) };\n};\nconst config = [\n grab(\"PostHog 项目 key\", /phc_[A-Za-z0-9]{20,}/g, main),\n grab(\"Stripe publishable key\", /pk_(?:live|test)_[A-Za-z0-9]{20,}/g, main),\n grab(\"Sentry DSN\", /https:\\/\\/[a-z0-9]+@[a-z0-9.]+\\.ingest\\.[a-z0-9.]+\\.sentry\\.io\\/[0-9]+/g, main),\n grab(\"Sentry ingest host\", /o[0-9]+\\.ingest\\.[a-z0-9.]+\\.sentry\\.io/g, main),\n grab(\"Cloudflare Turnstile sitekey\", /0x4[A-Za-z0-9_-]{20,}/g, main),\n grab(\"Supabase / JWT 串\", /eyJhbGciOiJ[A-Za-z0-9_.-]{40,}/g, main),\n grab(\"CloudFront CDN\", /https:\\/\\/[a-z0-9]+\\.cloudfront\\.net/g, main),\n grab(\"Google OAuth client id\", /[0-9]{10,}-[a-z0-9]{20,}\\.apps\\.googleusercontent\\.com/g, main),\n grab(\"ngrok 头\", /ngrok-skip-browser-warning/g, main),\n].filter((c) => c.found.length);\n\nconsole.log(\"\\n=== 挖到的配置 ===\");\nfor (const c of config) console.log(\" \", c.label, \"→\", c.found.join(\" | \").slice(0, 160));\n\n// 后端 base 判定逻辑原文\nconst baseLogic = main.match(/[a-zA-Z_$]+=window\\.location\\.hostname===\"one\\.dsrupt\\.ai\"\\?\"[^\"]+\":\"[^\"]+\"/)?.[0] ?? null;\n\nconst hosts = [...hostCount.entries()].sort((a, b) => b[1] - a[1]).map(([host, count]) => ({ host, count }));\nawait blob.set(\"hosts.json\", JSON.stringify(hosts, null, 2));\nawait blob.set(\"config.json\", JSON.stringify({ baseLogic, backend: BACKEND, leaks: config }, null, 2));\n\n// ── 4. 公开接口探测（只读 GET，不创建任何状态）──────────────────\nconst probePaths = [\n \"/.well-known/oauth-authorization-server\",\n \"/ui_api/help\",\n \"/ui_api/guides\",\n \"/ui_api/voice_consent/probe\",\n \"/ui_api/direct_access/?event_code=x&user_code=y\",\n \"/ui_api/demo/view/probe?demo_type=x\",\n \"/ui_api/organisation_invitations/probe\",\n \"/ui_api/guest\",\n \"/mcp\",\n \"/ui_api/predictions?page=1\",\n \"/ui_api/themes\",\n \"/ui_api/events\",\n \"/ui_api/credits/transactions\",\n \"/ui_api/admin/voice_consent_reviews\",\n];\nconst publicData: Record = {};\nfor (const p of probePaths) {\n try {\n const r = await get(p, \"application/json\", BACKEND);\n let body: unknown = r.text.slice(0, 400);\n try {\n body = JSON.parse(r.text);\n } catch { /* 保留原文 */ }\n publicData[p] = { status: r.status, contentType: r.ct, body };\n } catch (e) {\n publicData[p] = { error: (e as Error).message };\n }\n}\nawait blob.set(\"public-data.json\", JSON.stringify(publicData, null, 2));\n\nconsole.log(\"\\n=== 公开接口探测 ===\");\nfor (const [p, v] of Object.entries(publicData)) {\n const o = v as { status?: number };\n console.log(\" \", String(o.status ?? \"ERR\").padEnd(4), p);\n}\n\n// ── 5. 落盘 ─────────────────────────────────────────────────────\nconst apiList = [...apiMap.values()]\n .map((h) => ({ path: h.path, methods: [...h.methods].sort(), chunks: [...h.chunks].sort() }))\n .sort((a, b) => a.path.localeCompare(b.path));\nawait blob.set(\"api-map.json\", JSON.stringify(apiList, null, 2));\n\nconst routeList = [...routes].sort();\nawait blob.set(\"routes.json\", JSON.stringify(routeList, null, 2));\n\nconst manifest = {\n origin: ORIGIN,\n backend: BACKEND,\n siteName: \"Dsrupt One\",\n harvestedAt: new Date().toISOString(),\n shell: { htmlBytes: html.length, mainChunk },\n assets: { count: files.length, totalBytes },\n api: { count: apiList.length },\n routes: { count: routeList.length },\n baseLogic,\n leaks: config,\n hosts: hosts.slice(0, 40),\n files: files.sort((a, b) => a.path.localeCompare(b.path)),\n failures,\n};\nawait blob.set(\"manifest.json\", JSON.stringify(manifest, null, 2));\n\nconsole.log(\"\\n=== 接口地图 ===\");\nconsole.log(\"接口:\", apiList.length, \"条前端路由:\", routeList.length, \"条\");\nconst byMethod = new Map();\nfor (const a of apiList) for (const m of a.methods) byMethod.set(m, (byMethod.get(m) ?? 0) + 1);\nconsole.log([...byMethod.entries()].map(([m, n]) => `${m}:${n}`).join(\" \"));\nconsole.log(\"\\n前 50 条:\");\nfor (const a of apiList.slice(0, 50)) console.log(\" \", a.methods.join(\"/\"), a.path);\nconsole.log(\"\\n已写入 blob: mirror/*, api-map.json, routes.json, hosts.json, config.json, public-data.json, manifest.json\");// ── 6. 公开内容全文（帮助文档 / 指南 / OAuth 元数据）─────────────\nconst content: Record = {};\nfor (const p of [\"/.well-known/oauth-authorization-server\", \"/ui_api/help\", \"/ui_api/guides\"]) {\n const r = await get(p, \"application/json\", BACKEND);\n let json: unknown = r.text.slice(0, 500);\n try {\n json = JSON.parse(r.text);\n } catch { /* 保留原文 */ }\n content[p] = { status: r.status, json };\n}\n\nconst keysOf = (v: unknown): string[] =>\n Array.isArray(v)\n ? v.map((x) => (x && typeof x === \"object\" ? (x as Record).key : null))\n .filter((k): k is string => typeof k === \"string\")\n : [];\n\nconst articles: Record = {};\nfor (const k of keysOf((content[\"/ui_api/help\"] as { json: unknown }).json)) {\n const r = await get(`/ui_api/help/${encodeURIComponent(k)}`, \"application/json\", BACKEND);\n try {\n articles[`help/${k}`] = JSON.parse(r.text);\n } catch { /* 跳过 */ }\n}\ncontent[\"articles\"] = articles;\nawait blob.set(\"public-content.json\", JSON.stringify(content, null, 2));\nconsole.log(\"\\n公开内容: 帮助文档\", Object.keys(articles).length, \"篇已归档 → public-content.json\");",[],[82],"20f77780-0de0-4fcf-8ac9-981c26b150cf","README.md","16ba47fe-b1d5-11f1-bb34-1607ee4eb77e",16,["D",1789566590584],"# Dsrupt One · 扒站报告\n\n对的完整拆解：**整站前端已归档**（2 个文件 / 3.62 MB），**207 个后端接口**已枚举出路径和 HTTP 方法，**69 条前端路由**、**5 组硬编码密钥**、**53 篇帮助文档全文**全部拿到。\n\n- 报告页：[打开](url:index.ts)\n- 归档清单 + 公开接口探测：[`/api/summary`](url:index.ts/api/summary)\n- 完整接口地图：[`/api/endpoints`](url:index.ts/api/endpoints)\n- 前端路由表：[`/api/routes`](url:index.ts/api/routes)\n- 泄露配置 + 第三方 host：[`/api/config`](url:index.ts/api/config)\n- 公开内容全文：[`/api/content`](url:index.ts/api/content)\n- 读归档的原始前端文件：[`/api/file?path=/assets/index-DPXPu-4s.js`](url:index.ts/api/file)\n\n## 这个站是什么\n\n**Dsrupt One** 是 [Dsrupt.ai](https://dsrupt.ai/) 的**多品牌 AI 创作工作台**，面向代理商和创意团队。\n\n核心卖点不是「又一个 AI 生图站」，而是**品牌一致性**：你把客户品牌的 CI、logo、网站地址喂进去，平台自动生成品牌指南（颜色、语气、规则、字体），之后**每一次生成都自动套用**这套规范。配合 **MCP**，它把能力接进 ChatGPT / Claude / Manus / Cursor —— 你在聊天框里说一句话，出来的图就是你的品牌。\n\n产品线有两条：\n\n| 产品 | 说明 |\n| --- | --- |\n| **Dsrupt One** | 多品牌 AI 工作台（本站，`one.dsrupt.ai`），自助注册、已上线 |\n| **AI Activations** | 线下活动/战役的品牌化 AI 体验，把参会者变成一方数据 |\n\n| 维度 | 情况 |\n| --- | --- |\n| 前端 | Vite + React 18 SPA，**单包 3.57 MB**（无懒加载分包），TanStack Query + zustand，Tailwind/Radix |\n| 后端 | **Rails** —— `user[email]` 参数风格、`/ui_api/` 命名空间、`{status, error}` 错误体 |\n| 鉴权 | JWT（`Authorization: Bearer`）+ 游客 token（`/ui_api/guest`）+ Google 登录 + Cloudflare Turnstile |\n| 支付 | Stripe（前端硬编码 publishable key、`js.stripe.com`） |\n| 可观测 | PostHog（埋点）+ Sentry |\n| CDN | CloudFront（`d2s57ng2ndjfn.cloudfront.net`，存指南视频和素材） |\n| 多租户 | organisations（组织）+ brands（品牌）+ campaigns（战役）+ workspaces（工作区） |\n\n## 扒到了什么\n\n| 项目 | 数量 | 说明 |\n| --- | --- | --- |\n| 前端文件 | **2** | HTML 壳 + 1 个 JS 单包 + 1 个 CSS，共 3.62 MB，存进本 val 的 blob（键前缀 `mirror/`） |\n| 后端接口 | **207** | 全部 `/ui_api/*`，带 HTTP 方法：POST 127 / GET 55 / DELETE 37 / PATCH 28 / PUT 3 |\n| 前端路由 | **69** | 从 React Router 的 `path:\"…\"` 提取 |\n| 硬编码密钥 | **5 组** | 见下 |\n| 帮助文档 | **53 篇** | `/ui_api/help` 全文，含标题、分类、标签、正文 |\n| 指南模块 | **9 个** | `/ui_api/guides`，含视频地址与章节正文 |\n\n> 那 207 条不是猜路径试出来的：先定位到前端唯一的请求包装函数 `he(path, opts)` → `fetch(\\`${API_BASE_URL}${path}\\`)`，再从单包里正则提取所有 `/ui_api/` 出现点，并往后扫 400 字符抓 `method:\"…\"`。所以每条都带**真实 HTTP 方法**和**出处分包**。\n\n## 后端地址是前端硬编码的\n\n单包里有这么一行：\n\n```js\nzs = window.location.hostname === \"one.dsrupt.ai\"\n ? \"https://backend.dsrupt.ai\"\n : \"https://dsrupt-backend-staging-5c326933ece6.herokuapp.com\"\n```\n\n含义：**在 `one.dsrupt.ai` 上打开时打生产后端；在任何其他域名（含本地开发）打开时，前端会把请求直接打到 staging 后端。**\n\n也就是说那个 Heroku staging 地址是公开可发现的，而且前端还专门写了迁移逻辑把 localStorage 里旧的 `herokuapp.com` 地址改回生产地址：\n\n```js\nmigrate: e => { if (e?.API_BASE_URL?.includes(\"herokuapp.com\")) e.API_BASE_URL = zs; return e }\n```\n\n## 泄露的配置\n\n全部来自前端单包，任何人都能在浏览器里看到：\n\n| 项目 | 值 |\n| --- | --- |\n| PostHog 项目 key | `phc_mv3vnxXt5BF6iUmoSXKDSMz45JVjv9g5qdBYs3DgG3hu` |\n| Cloudflare Turnstile sitekey | `0x4AAAAAAE1m9aEjG1lSegJx` |\n| CloudFront CDN | `https://d2s57ng2ndjfn.cloudfront.net` |\n| Google OAuth client id | `83826095488-vcpkjj8ovmj13n70bkbgkld1079ofe0l.apps.googleusercontent.com` |\n| staging 后端 | `https://dsrupt-backend-staging-5c326933ece6.herokuapp.com` |\n\n> publishable key / sitekey / 项目 key 本身**设计为公开**（必须发给浏览器），不算漏洞。但它们是可被滥用的入口：PostHog key 能往你的项目里灌假事件，Turnstile sitekey 能被拿去刷你的验证配额，Google client id 能用来伪造 OAuth 流程的起点。staging 后端地址则是攻击面本身。\n\n## 无需登录就能拿到的\n\n| 接口 | 返回 |\n| --- | --- |\n| `/.well-known/oauth-authorization-server` | 完整 OAuth 2.1 元数据（MCP 接入用，含 register/revoke 端点） |\n| `/ui_api/help` | 53 篇帮助文档的索引（key / 标题 / 分类 / 标签） |\n| `/ui_api/help/:key` | 单篇帮助文档**全文** |\n| `/ui_api/guides` | 9 个指南模块 + 章节正文 + 视频地址 |\n| `/ui_api/demo/view/:id` | 存在（返回 400，参数不对） |\n| `/mcp` | 存在（返回 401，需 OAuth） |\n\n其余 200 条一律 `401 Unauthorized`。\n\n## 接口地图（按模块）\n\n| 模块 | 前缀 | 内容 |\n| --- | --- | --- |\n| 管理后台 | `/ui_api/admin/*` | 用户、组织、邀请、定价（plans/packages/scenarios/workflows）、声音、语音同意审核、发布战役 |\n| 品牌 | `/ui_api/brands/*` | 品牌 CRUD、核心（core）、指南生成/改写、资产、战役 |\n| 素材 | `/ui_api/assets/*` | 素材 CRUD、自动分类建议 |\n| 生成 | `/ui_api/predictions/*`、`/ui_api/video_predictions/*`、`/ui_api/audio_predictions/*` | 图像/视频/音频生成、分类、公开、下载、放大、品牌绑定 |\n| 活动 | `/ui_api/events/*` | 活动 CRUD、统计、二维码、定制、群发、配额分配、激活报价、Stripe PaymentIntent |\n| 工具 | `/ui_api/tools/*` | 工具运行、HTML、升级、公开工具开关 |\n| 主题 | `/ui_api/themes/*` | 主题 CRUD、参考图、生成预览 |\n| 直通访问 | `/ui_api/direct_access/*`、`/ui_api/direct_access_v2/*` | 活动码换内容、生成、HTML |\n| 积分 | `/ui_api/credits/*` | 交易流水、用量分析 |\n| 声音 | `/ui_api/voices/*`、`/ui_api/toolbar/voices/*` | 声音库、同意书 |\n| 组织 | `/ui_api/organisations/*`、`/ui_api/organisation_invitations/*` | 组织、邀请（含 claim link / 邮件投递） |\n| 账号 | `/ui_api/guest`、`/ui_api/login`、`/ui_api/signup`、`/users/password` | 游客、登录、注册、找回密码 |\n| 其他 | `/ui_api/help`、`/ui_api/guides`、`/ui_api/voice_consent/*` | 帮助、指南、语音同意 |\n\n完整 207 条见报告页「接口地图」标签页，支持按方法筛选和路径搜索。\n\n## 前端路由（从单包的路由表提取）\n\n```\n/ /account /activation /activation-info /ad-multiplier /admin /admin/invitations\n/audio_gallery /blockout /branded-demos /branded_demos /brands /brands/:id\n/cast /cast/e/:elementId /chat /create /create/examples /create/m/:mediaId\n/direct-access-v2/:codes /direct-access/:codes /director /events /events/:eventId/stats\n/events/:id /flow /guides /guides/:key /help /help/:key /invite/:token /login\n/mcp-access /mcp/ad-multiplier /mcp/blockout /mcp/director /mcp/music-video /music-video\n/oauth/authorize /org-admin /org-admin/quote /organisations/:id /reset-password\n/reset-password/:token /signup /simple_video_gallery /stats /studio /studio/m/:mediaId\n/templates /themes/:id /tools /tools/:id /tools/build /tools/enhance /tools/filter\n/tools/instagram_splitter /tools/public /tools/remove-background /tools/theme-builder\n/tools/upscale /tools/vectorize /tools/video-upscale /users/password/edit\n/voice-consent/:token /voice-consent/revoke/:token /voices /whats-new /workspace\n```\n\n`/mcp/*` 那几条很有意思：ad-multiplier、blockout、director、music-video —— 说明 MCP 侧暴露的是**具体创作工作流**，不是通用接口。\n\n## 架构\n\n```mermaid\ngraph LR\n Browser -->|\"GET /\"| Hono[\"index.ts
(Hono server)\"]\n Hono -->|serves| HTML[\"frontend/root.tsx\"]\n HTML -->|loads| Entry[\"frontend/index.tsx\"]\n Entry -->|renders| App[\"components/App.tsx\"]\n Hono -->|\"/api/summary\"| Blob[(\"blob 存储
manifest.json
public-data.json\")]\n Hono -->|\"/api/endpoints\"| ApiMap[(\"api-map.json
207 条\")]\n Hono -->|\"/api/routes\"| Routes[(\"routes.json
69 条\")]\n Hono -->|\"/api/config\"| Cfg[(\"config.json
hosts.json\")]\n Hono -->|\"/api/content\"| Content[(\"public-content.json
53 篇文档\")]\n Hono -->|\"/api/file\"| Mirror[(\"mirror/*
前端归档\")]\n Harvest[\"harvest.ts
(抓取脚本)\"] -->|写入| Blob\n Harvest -->|写入| ApiMap\n Harvest -->|写入| Routes\n Harvest -->|写入| Cfg\n Harvest -->|写入| Content\n Harvest -->|写入| Mirror\n Harvest -->|\"fetch 前端\"| Target[\"one.dsrupt.ai\"]\n Harvest -->|\"fetch /ui_api/*\"| Backend[\"backend.dsrupt.ai\"]\n```\n\n## 文件结构\n\n```\nindex.ts ← Hono 后端：报告页 + 6 个数据接口\nharvest.ts ← 抓取脚本（可重跑，会覆盖）\nfrontend/\n root.tsx ← HTML 壳\n index.tsx ← React 入口\n components/\n App.tsx ← 报告 UI（概览 / 接口地图 / 前端路由 / 公开内容 / 泄露配置 / 归档文件）\n```\n\nblob 存储（本 val 私有）：\n\n```\nmanifest.json ← 归档清单：文件、接口数、路由数、泄露项、host 统计\napi-map.json ← 207 条接口：路径 + 方法 + 出处分包\nroutes.json ← 69 条前端路由\nhosts.json ← 单包里出现的所有第三方 host\nconfig.json ← 硬编码配置 + 后端 base 判定逻辑原文\npublic-data.json ← 公开接口探测结果\npublic-content.json ← 53 篇帮助文档 + 指南 + OAuth 元数据全文\nmirror/index.html ← 原站 HTML 壳\nmirror/assets/* ← 单包 JS + CSS\n```\n\n## 重跑\n\n直接 Run `harvest.ts`。它会重新拉一遍原站、覆盖归档和接口地图。原站前端文件名带哈希（当前 `index-DPXPu-4s.js`），**发版后哈希会变**，重跑就能跟上。\n\n## 没扒到的，和为什么\n\n除上面 6 个公开接口外，**其余 200 条全部返回 401**。也就是说：品牌数据、生成记录、活动数据、积分流水、用户与组织、定价方案 —— 这些**都在登录墙后面**，没有账号拿不到。\n\n想继续往下扒，两条路：\n\n1. **给我一个已登录的 token。** 在浏览器登录后打开 DevTools → Application → Local Storage → `auth-storage`，把 `user.token` 的值发我。有它我就能把 `/ui_api/brands`、`/ui_api/predictions`、`/ui_api/admin/*` 这些全量拉下来归档。\n2. **自己跑。** `harvest.ts` 里 `get()` 加一个 `Authorization` 头，把 `probePaths` 换成想拉的路径，重跑即可。\n\n> ⚠️ token 等同于账号密码，只在你自己信任的环境里用；我不会把它写进代码或存进 val。\n\n## 合规提醒\n\n这份归档是**公开可访问的前端静态资源**（任何人打开浏览器都能拿到）、**接口路径清单**和**无需登录即可访问的公开文档**，不含任何用户数据、私有内容或密钥。\n\n但要注意：\n\n- 整站复制他人前端代码用于公开发布，涉及对方著作权。\n- 接口地图用于对自己账号下的数据做备份没问题；用来批量抓取他人数据则可能违反对方服务条款（见）。\n- 泄露的 key 虽设计为公开，但**不要拿去刷别人的配额**。\n\n自己评估用途。",[],[90],"56014d1c-3ea9-4709-8e5a-ad3d871fb228",["D",1789566446495],[101,102,103,104],[58],{"_34":60,"_13":59,"_37":40,"_39":63,"_41":42,"_43":65,"_45":46,"_47":127,"_17":62,"_50":61,"_52":-5,"_54":55,"_56":-5,"_78":128,"_18":129},{"_34":120,"_13":121,"_37":122,"_39":63,"_41":42,"_43":65,"_45":46,"_47":123,"_17":62,"_50":24,"_52":124,"_54":55,"_56":-5,"_78":125,"_18":126},{"_34":113,"_13":114,"_37":115,"_39":63,"_41":42,"_43":65,"_45":46,"_47":116,"_17":62,"_50":51,"_52":117,"_54":55,"_56":-5,"_78":118,"_18":119},{"_34":105,"_13":106,"_37":107,"_39":63,"_41":42,"_43":108,"_45":46,"_47":109,"_17":49,"_50":51,"_52":110,"_54":55,"_56":-5,"_78":111,"_18":112},"5872a41d-b427-4a99-b026-4a998713330c","root.tsx","01a0aa78-eba0-777d-9227-83b582ea6412",11,["D",1789566554737],"/** @jsxImportSource npm:hono@4/jsx */\nimport { raw } from \"npm:hono@4/html\";\nimport { immutableFileUrl } from \"https://esm.town/v/std/utils/index.ts\";\n\n// The HTML shell for the app. It is never cached, so immutableFileUrl can stamp\n// the current val version into each asset URL — the browser caches those\n// immutably, and publishing the val changes the URLs, refetching exactly once.\nexport function Root() {\n return (\n <>\n {raw(\"\")}\n \n \n \n \n Dsrupt One · 扒站报告\n