` 只写 `XHSX`）。不是工具导航站，是一整套**多租户 AI 内容创作 SaaS**：AI 对话、绘图、口型同步、小说、短剧分镜、数字人、课程/学校、积分商城、市场分成、支付充值、平台管理后台，一应俱全。\n\n| 维度 | 情况 |\n| --- | --- |\n| 前端 | Vite + React 18 SPA，Tailwind 系样式，axios（`baseURL: \"/api\"`），285 个懒加载分包 |\n| 服务端 | nginx 反代，响应统一为 `{code, message, data, timestamp}`（典型 Java/Spring 风格） |\n| 鉴权 | 短信验证码 + 微信登录（`emailPassword`/`emailCode`/`schoolLogin` 均为 `false`），JWT + refresh token |\n| 商业模式 | `commerceEnabled: true`，有会员套餐、充值、订单、提现、对账、卡密兑换 |\n| 多租户 | 有 `tenants`（租户）、`teams`（团队）、`school`（学校/班级/院系）三套组织体系 |\n\n## 扒到了什么\n\n| 项目 | 数量 | 说明 |\n| --- | --- | --- |\n| 前端文件 | **287** | HTML 壳 + 285 个 JS 分包 + 1 个 CSS，共 4.38 MB，全部存进本 val 的 blob（键前缀 `mirror/`） |\n| 接口 | **634** | 带 HTTP 方法：GET 287 / POST 288 / DELETE 76 / PUT 74 / PATCH 42 |\n| 公开接口 | **4** | 无需登录，见下 |\n| 其余接口 | 630 | 一律 `401 Unauthorized` |\n\n> 那 634 条不是靠猜路径试出来的，是从每个分包的 axios 调用点里正则提取的，所以每条都带**出处分包**（报告页每条下面都标了）。\n\n## 公开的 4 个接口\n\n| 接口 | 返回 |\n| --- | --- |\n| `/api/public/site-info` | 站名、图标、`commerceEnabled`、`homeEnabled`、模板名 |\n| `/api/auth/methods` | 开启的登录方式：短信验证码 ✅、微信 ✅，其余 ❌ |\n| `/api/auth/register/info` | `isFirstUser`、`needCode` |\n| `/api/drama/art-styles` | **15 条画风预设**，每条带完整提示词（`prompt`）和缩略图 |\n\n`/api/drama/art-styles` 是唯一漏出来的业务数据，含 15 条完整画风提示词（古装真人、赛博朋克、国风水墨、迪士尼、韩漫唯美…），报告页「公开数据」标签页里有全文。\n\n## 配置监控（每天自动跑）\n\n`monitor.ts` 是个 interval 任务，每天 **09:00（北京时间）** 跑一次：只读那 4 个公开接口，存一份当前快照，和上一次比对，有变化就记进历史。\n\n盯的是这几项：\n\n| 项目 | 为什么值得盯 |\n| --- | --- |\n| 登录方式开关 | 邮箱 / 短信 / 微信什么时候被关掉或打开 |\n| 注册是否需要邀请码 | `needCode` 变化说明在收紧还是放开注册 |\n| 站点名 / 模板 / 商城开关 | `commerceEnabled` 变 false 说明停售 |\n| 画风预设 | 新增、删除，或某条画风的提示词被改写 |\n\n数据落在 blob：\n\n```\nmonitor/latest.json ← 当前快照\nmonitor/history.json ← 变更历史（只在有变化时追加，最多 500 条）\nmonitor/status.json ← 每次运行的状态，用来确认 cron 还活着\n```\n\n报告页「配置监控」标签页有可视化：当前登录方式开关、累计运行次数、变更时间线。\n\n抓取失败时**不会覆盖** `latest.json`，只记错误 —— 避免一次网络抖动把好数据冲掉。\n\n## 接口地图（按模块）\n\n| 模块 | 前缀 | 内容 |\n| --- | --- | --- |\n| 登录注册 | `/auth/*` | 邮箱/短信/微信/学校登录、注册、改密、refresh |\n| 用户 | `/user/*`、`/member/*`、`/points/*` | 资料、会员、积分、签到、等级 |\n| 短剧（最重） | `/drama/*` | 项目、剧集、画布节点、**Seedance 2 分镜映射**、音频槽位、合成导出 |\n| 小说 | `/novel/*` | 项目、章节、续写 |\n| 陪练/教练 | `/coach-sessions/*`、`/coach-templates/*` | 会话、流式对话、记忆、模板短语/片段 |\n| 课程 | `/courses/*` | 课程、章节、课时、进度、看板、异常 |\n| 市场 | `/market/*` | 作品包上架、审核、举报、分成 |\n| 卡密 | `/cards/*` | 批次、兑换、导出 |\n| 管理后台 | `/admin/*` | 用户、订单、会员、租户、团队、学校、积分、提现、日志、错误中心、内容同步 |\n| 控制台 | `/console/*` | 站点配置、菜单、套餐、支付、对账、登录方式、功能开关、模型厂商 |\n| 其他 | `/gallery/*`、`/blog/*`、`/ai-models/*`、`/asset/*`、`/knowledge/*`、`/memory/*`、`/canvas/*`、`/user-robots/*` | 画廊、博客、模型、素材、知识库、记忆、画布、机器人 |\n\n完整 634 条见报告页「接口地图」标签页，支持按方法筛选和路径搜索。\n\n## 前端路由（从 bundle 的路由表提取）\n\n```\nc/:slug c/:slug/:id chat embed/:id image lipsync assets knowledge\ndrama drama/:projectId drama/:projectId/canvas novel novel/:projectId\nmember blog blog/:id courses course/:id course/:id/dashboard\npoint-rank profile profile/robots/:robotId/workbench profile/orders\nprofile/points profile/training memories robots robots/new\nrobots/:id robots/:id/edit skill-store market market/:id\nprofile/market profile/market/publish teams/join/:inviteCode teacher\nchange-password login wechat-callback home school-site gallery\ncanvas-templates version-logs coach-lab market-review console site\nlogin-methods home-config payment plans models features recharge\nreconciliation audit-logs menus liveness/callback admin users orders\nmembers tenants school points teams ai-models withdrawals content\nsystem system-monitor error-center logs\n```\n\n## 没扒到的，和为什么\n\n除上面 4 个接口外，**全部返回 401**。也就是说：博客文章、课程内容、画廊作品、市场作品包、模型列表、套餐价格、用户数据、短剧项目 —— 这些**都在登录墙后面**，没有账号拿不到。\n\n想继续往下扒，两条路：\n\n1. **给我一个已登录的 token。** 在浏览器登录后打开 DevTools → Network，随便点一个请求，把 `Authorization: Bearer eyJ...` 的值发我（或者直接给 `access_token` 的 localStorage 值）。有它我就能把 `/api/blog/posts`、`/api/courses`、`/api/market/packs`、`/api/ai-models`、`/api/console/plans` 这些全量拉下来归档。\n2. **自己跑。** `harvest.ts` 里 `get()` 加一个 `Authorization` 头，把 `publicPaths` 换成想拉的路径，重跑即可。\n\n> ⚠️ token 等同于账号密码，只在你自己信任的环境里用；我不会把它写进代码或存进 val。\n\n## 架构\n\n```mermaid\ngraph LR\n Browser -->|\"GET /\"| Hono[\"index.ts (Hono server)\"]\n Hono -->|serves| HTML[\"frontend/root.tsx\"]\n HTML -->|loads| Entry[\"frontend/index.tsx\"]\n Entry -->|renders| App[\"components/App.tsx\"]\n Hono -->|\"/api/summary\"| Blob[(\"blob 存储 manifest.json public-data.json\")]\n Hono -->|\"/api/endpoints\"| ApiMap[(\"api-map.json 634 条\")]\n Hono -->|\"/api/file\"| Mirror[(\"mirror/* 287 个前端文件\")]\n Harvest[\"harvest.ts (抓取脚本)\"] -->|写入| Blob\n Harvest -->|写入| ApiMap\n Harvest -->|写入| Mirror\n Harvest -->|\"fetch\"| Target[\"ai.xinhuoshixiao.com\"]\n Monitor[\"monitor.ts (每日 09:00 CST)\"] -->|\"fetch 4 个公开接口\"| Target\n Monitor -->|写入| Mon[(\"monitor/latest.json history.json status.json\")]\n Hono -->|\"/api/monitor\"| Mon\n```\n\n## 文件结构\n\n```\nindex.ts ← Hono 后端：报告页 + 4 个数据接口\nharvest.ts ← 抓取脚本（可重跑，会覆盖）\nmonitor.ts ← 定时监控（interval，每天 09:00 CST）\nfrontend/\n root.tsx ← HTML 壳\n index.tsx ← React 入口\n components/\n App.tsx ← 报告 UI（概览 / 接口地图 / 归档文件 / 配置监控 / 公开数据）\n```\n\nblob 存储（本 val 私有）：\n\n```\nmanifest.json ← 归档清单：287 个文件的路径与体积\napi-map.json ← 634 条接口：路径 + 方法 + 出处分包\npublic-data.json ← 4 个公开接口的完整原始 JSON\nmirror/index.html ← 原站 HTML 壳\nmirror/assets/* ← 285 个 JS 分包 + 1 个 CSS\nmonitor/latest.json ← 当前配置快照\nmonitor/history.json ← 配置变更历史\nmonitor/status.json ← 监控运行状态\n```\n\n## 重跑\n\n直接 Run `harvest.ts`。它会重新拉一遍原站、覆盖归档和接口地图。原站前端文件名带哈希，**发版后哈希会变**，重跑就能跟上。\n\n## 合规提醒\n\n这份归档是**公开可访问的前端静态资源**（任何人打开浏览器都能拿到）和**接口路径清单**，不含任何用户数据或密钥。但整站复制他人前端代码用于公开发布，涉及对方著作权；接口地图用于对自己账号下的数据做备份没问题，用来批量抓取他人数据则可能违反对方条款。自己评估用途。",[],[84],"6e7eb539-4cd6-416b-b4e6-db4a6a2b18b6","frontend","01a0aa5a-affc-75b2-9998-9d64f2480573",1,["D",1789564465090],"directory",[100,101,102,103],[93],{"_33":126,"_13":127,"_35":128,"_37":94,"_38":39,"_40":95,"_42":43,"_44":129,"_17":66,"_47":97,"_49":-5,"_51":52,"_53":-5,"_69":130,"_18":131},{"_33":119,"_13":120,"_35":121,"_37":94,"_38":39,"_40":95,"_42":43,"_44":122,"_17":66,"_47":24,"_49":123,"_51":52,"_53":-5,"_69":124,"_18":125},{"_33":112,"_13":113,"_35":114,"_37":94,"_38":39,"_40":95,"_42":43,"_44":115,"_17":66,"_47":79,"_49":116,"_51":52,"_53":-5,"_69":117,"_18":118},{"_33":104,"_13":105,"_35":106,"_37":94,"_38":39,"_40":107,"_42":43,"_44":108,"_17":95,"_47":79,"_49":109,"_51":52,"_53":-5,"_69":110,"_18":111},"3b104498-dac6-4be5-814a-2c8011f01ffd","root.tsx","01a0aa5a-affc-75b2-9998-9a31bcbf93da",4,["D",1789564512255],"/** @jsxImportSource npm:hono@4/jsx */\nimport { raw } from \"npm:hono@4/html\";\nimport { immutableFileUrl } from \"https://esm.town/v/std/utils/index.ts\";\n\n// The HTML shell for the app. It is never cached, so immutableFileUrl can stamp\n// the current val version into each asset URL — the browser caches those\n// immutably, and publishing the val changes the URLs, refetching exactly once.\nexport function Root() {\n return (\n <>\n {raw(\"<!DOCTYPE html>\")}\n <html lang=\"en\">\n <head>\n <meta charSet=\"UTF-8\" />\n <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\" />\n <title>薪火AI创作平台

[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_263":264,"_265":266},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":-7,"_18":19,"_17":-7,"_199":-5,"_20":200,"_22":201,"_202":203,"_204":205,"_26":206,"_24":207,"_208":-5,"_209":-5,"_210":52,"_211":212,"_213":43,"_214":-5,"_215":-5,"_216":217},"routes/_app.x.$handle.$name.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":25,"_26":27,"_28":-5,"_29":-5,"_30":-5,"_31":-5,"_32":-5},"handle","mansurkurtaran5","name","xinhuo-ai-teardown","branchName","main","version","path","index.ts","project",{"_33":141,"_13":14,"_44":142,"_143":-5,"_144":52,"_145":146,"_147":146,"_148":149,"_150":-5,"_151":152,"_153":36,"_154":43,"_155":-5,"_156":-5,"_157":66,"_158":159,"_160":161,"_162":163,"_164":165,"_166":-5,"_167":168,"_169":168,"_170":171,"_172":171,"_173":171,"_174":168,"_175":168,"_176":177,"_178":179,"_180":181,"_182":52},"tree",[56,57,58,59,60],"file",{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":45,"_17":46,"_47":48,"_49":50,"_51":52,"_53":54,"_18":55},"contents",[],"upstream","pull","ahead","behind","envVars","id","113859ad-aaaf-46d6-b66b-7b00d3cc19d2","fileId","01a0aa5a-affc-75b2-9998-a813c1f93d91","parentId","branchId","3635e064-a2de-4886-baeb-77992b7b1eca","branchVersion",10,"latest",true,"createdAt",["D",1789565214580],2,"fileType","http","content","import { parseVal, serveImmutableFile } from \"https://esm.town/v/std/utils/index.ts\";\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\nimport { Hono } from \"npm:hono\";\nimport { Root } from \"./frontend/root.tsx\";\n\nconst app = new Hono();\n\n// Serve the (never-cached) HTML shell at the root /\napp.get(\"/\", (c) => c.html(Root()));\n\n// Serve frontend files at the version-addressed URLs Root() stamps, cached immutably\napp.get(\"/__immutable/*\", (c) => serveImmutableFile(c.req.path));\n\n// View source redirect\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\n\n// ── 报告接口 ─────────────────────────────────────────────────────\n\n/** 概览：归档清单 + 公开接口数据 */\napp.get(\"/api/summary\", async (c) => {\n const [manifest, publicData] = await Promise.all([\n blob.getJSON(\"manifest.json\"),\n blob.getJSON(\"public-data.json\"),\n ]);\n return c.json({ manifest, publicData });\n});\n\n/** 完整接口地图（634 条，含 HTTP 方法与出处分包） */\napp.get(\"/api/endpoints\", async (c) => {\n const list = (await blob.getJSON(\"api-map.json\")) ?? [];\n return c.json(list);\n});\n\n/** 读归档的原始前端文件 */\napp.get(\"/api/file\", async (c) => {\n const path = c.req.query(\"path\");\n if (!path) return c.json({ error: \"缺少 path 参数\" }, 400);\n const content = await blob.get(\"mirror\" + path);\n if (content === null) return c.json({ error: \"未归档该文件\" }, 404);\n return c.text(content);\n});\n\n/** 公开接口监控：当前快照 + 变更历史 + 运行状态 */\napp.get(\"/api/monitor\", async (c) => {\n const [latest, history, status] = await Promise.all([\n blob.getJSON(\"monitor/latest.json\"),\n blob.getJSON(\"monitor/history.json\"),\n blob.getJSON(\"monitor/status.json\"),\n ]);\n return c.json({ latest, history: history ?? [], status });\n});\n\n// Unwrap and rethrow Hono errors as the original error\napp.onError((err) => Promise.reject(err));\n\nexport default app.fetch;","deleted",false,"label","xinhuo-teardown",[19],{"_33":92,"_13":93,"_35":94,"_37":-5,"_38":39,"_40":95,"_42":43,"_44":96,"_17":66,"_47":97,"_49":-5,"_51":52,"_53":-5,"_69":98,"_18":99},{"_33":83,"_13":84,"_35":85,"_37":-5,"_38":39,"_40":86,"_42":43,"_44":87,"_17":88,"_47":24,"_49":89,"_51":52,"_53":-5,"_69":90,"_18":91},{"_33":75,"_13":76,"_35":77,"_37":-5,"_38":39,"_40":46,"_42":43,"_44":78,"_17":66,"_47":79,"_49":80,"_51":52,"_53":-5,"_69":81,"_18":82},{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":72,"_17":46,"_47":48,"_49":50,"_51":52,"_53":54,"_69":73,"_18":74},{"_33":61,"_13":62,"_35":63,"_37":-5,"_38":39,"_40":64,"_42":43,"_44":65,"_17":66,"_47":67,"_49":68,"_51":52,"_53":-5,"_69":70,"_18":71},"53a2c1d6-efda-41a5-a8c5-18e65cdbe290","monitor.ts","3612b710-b1d2-11f1-a92a-1607ee4eb77e",9,["D",1789565183348],0,"interval","/**\n * 公开接口监控 —— 每天跑一次，记录「薪火AI创作平台」对外配置的变化。\n *\n * 只碰那 4 个不需要登录的接口，不涉及任何账号或用户数据：\n * /public/site-info 站点名、模板、商城开关\n * /auth/methods 开启了哪些登录方式（邮箱/短信/微信）\n * /auth/register/info 注册是否需要邀请码\n * /drama/art-styles 画风预设（数量、名称、提示词）\n *\n * 写入 blob：\n * monitor/latest.json 当前快照\n * monitor/history.json 变更历史（只在有变化时追加，最多留 500 条）\n * monitor/status.json 每次运行的状态（用来确认 cron 还活着）\n */\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\n\nconst UA =\n \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\";\nconst ORIGIN = \"https://ai.xinhuoshixiao.com\";\n\ntype Change = { field: string; from: unknown; to: unknown };\n\nasync function getData(path: string) {\n const res = await fetch(ORIGIN + \"/api\" + path, {\n headers: {\n \"user-agent\": UA,\n accept: \"application/json, text/plain, */*\",\n referer: ORIGIN + \"/\",\n },\n });\n if (!res.ok) throw new Error(`${path} -> HTTP ${res.status}`);\n const json = await res.json() as { data?: unknown };\n return json?.data ?? json;\n}\n\n/** 把 4 个接口拉成一份可比较的快照 */\nasync function takeSnapshot() {\n const [siteInfo, authMethods, registerInfo, artStyles] = await Promise.all([\n getData(\"/public/site-info\") as Promise>,\n getData(\"/auth/methods\") as Promise>,\n getData(\"/auth/register/info\") as Promise>,\n getData(\"/drama/art-styles\") as Promise[]>,\n ]);\n\n const styles = Array.isArray(artStyles) ? artStyles : [];\n return {\n site: {\n siteName: siteInfo.siteName ?? null,\n siteTemplate: siteInfo.siteTemplate ?? null,\n commerceEnabled: siteInfo.commerceEnabled ?? null,\n homeEnabled: siteInfo.homeEnabled ?? null,\n siteIcon: siteInfo.siteIcon ?? null,\n siteFavicon: siteInfo.siteFavicon ?? null,\n },\n auth: authMethods,\n register: registerInfo,\n artStyles: {\n count: styles.length,\n names: styles.map((s) => String(s.name)).sort(),\n prompts: Object.fromEntries(\n styles.map((s) => [String(s.name), String(s.prompt ?? \"\")]),\n ),\n },\n };\n}\n\ntype Snapshot = Awaited>;\n\n/** 递归比较两份快照，输出人类可读的变更列表 */\nfunction diff(prev: unknown, next: unknown, path = \"\"): Change[] {\n const out: Change[] = [];\n\n // 字符串数组：细分成「新增 / 移除」，比整串对比可读得多\n if (Array.isArray(prev) && Array.isArray(next)) {\n const a = prev.map(String), b = next.map(String);\n for (const item of b) {\n if (!a.includes(item)) out.push({ field: path, from: null, to: `新增：${item}` });\n }\n for (const item of a) {\n if (!b.includes(item)) out.push({ field: path, from: `移除：${item}`, to: null });\n }\n return out;\n }\n\n const isObj = (v: unknown) =>\n v !== null && typeof v === \"object\" && !Array.isArray(v);\n\n if (isObj(prev) && isObj(next)) {\n const keys = new Set([\n ...Object.keys(prev as object),\n ...Object.keys(next as object),\n ]);\n for (const k of keys) {\n const p = path ? `${path}.${k}` : k;\n out.push(\n ...diff(\n (prev as Record)[k],\n (next as Record)[k],\n p,\n ),\n );\n }\n return out;\n }\n\n if (JSON.stringify(prev) !== JSON.stringify(next)) {\n out.push({ field: path, from: prev ?? null, to: next ?? null });\n }\n return out;\n}\n\nexport default async function () {\n const at = new Date().toISOString();\n const prevStatus = (await blob.getJSON(\"monitor/status.json\") ??\n {}) as Record;\n\n try {\n const next = await takeSnapshot();\n const prev = (await blob.getJSON(\"monitor/latest.json\")) as Snapshot | null;\n const changes = prev ? diff(prev, next) : [];\n\n const history = ((await blob.getJSON(\"monitor/history.json\")) ??\n []) as Record[];\n\n if (!prev) {\n history.unshift({\n at,\n note: \"首次快照（基线）\",\n changes: [],\n });\n console.log(\"首次快照，已建立基线。\");\n } else if (changes.length) {\n history.unshift({ at, changes });\n console.log(`检测到 ${changes.length} 处变化：`);\n for (const c of changes) {\n console.log(` ${c.field}: ${JSON.stringify(c.from)} → ${JSON.stringify(c.to)}`);\n }\n } else {\n console.log(\"无变化。\");\n }\n\n await blob.set(\"monitor/history.json\", JSON.stringify(history.slice(0, 500), null, 2));\n await blob.set(\"monitor/latest.json\", JSON.stringify(next, null, 2));\n await blob.set(\n \"monitor/status.json\",\n JSON.stringify({\n lastRun: at,\n ok: true,\n changeCount: changes.length,\n totalRuns: Number(prevStatus.totalRuns ?? 0) + 1,\n lastError: null,\n }, null, 2),\n );\n\n console.log(\"登录方式:\", JSON.stringify(next.auth));\n console.log(\"画风预设:\", next.artStyles.count, \"条\");\n } catch (e) {\n const message = (e as Error).message;\n console.error(\"抓取失败:\", message);\n // 失败不动 latest，避免把好数据覆盖成空\n await blob.set(\n \"monitor/status.json\",\n JSON.stringify({\n lastRun: at,\n ok: false,\n changeCount: 0,\n totalRuns: Number(prevStatus.totalRuns ?? 0) + 1,\n lastError: message,\n }, null, 2),\n );\n throw e;\n }\n}","children",[],[62],["D",1789565214580],[],[19],"3fc4c068-6f70-43fc-bc8b-2889a3a4410f","harvest.ts","9078270a-b1d0-11f1-bd39-1607ee4eb77e",["D",1789564476010],"script","/**\n * 薪火AI创作平台（ai.xinhuoshixiao.com）扒站脚本\n *\n * 干三件事：\n * 1. 把整站前端（HTML + 全部 JS 分包 + CSS）下载下来，存进本 val 的 blob 存储\n * 2. 从所有分包里提取完整的接口地图（路径 + HTTP 方法 + 出处）\n * 3. 拉取 4 个无需登录的公开接口数据\n *\n * 跑法：直接 Run。可重复跑，会覆盖。\n */\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\n\nconst UA =\n \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\";\nconst ORIGIN = \"https://ai.xinhuoshixiao.com\";\n\nconst uniq = (a: string[]) => [...new Set(a)];\n\nasync function get(path: string) {\n const res = await fetch(ORIGIN + path, {\n headers: {\n \"user-agent\": UA,\n accept: \"*/*\",\n referer: ORIGIN + \"/\",\n \"accept-language\": \"zh-CN,zh;q=0.9\",\n },\n redirect: \"follow\",\n });\n return { status: res.status, text: await res.text() };\n}\n\n/** 带并发上限的 map，避免一次打太多请求 */\nasync function pool(\n items: T[],\n limit: number,\n fn: (item: T) => Promise,\n): Promise {\n const out: R[] = new Array(items.length);\n let cursor = 0;\n await Promise.all(\n Array.from({ length: Math.min(limit, items.length) }, async () => {\n while (true) {\n const i = cursor++;\n if (i >= items.length) return;\n out[i] = await fn(items[i]);\n }\n }),\n );\n return out;\n}\n\n// ── 1. 收集所有前端资源 ─────────────────────────────────────────\nconst html = (await get(\"/\")).text;\nconst shellAssets = uniq(\n [...html.matchAll(/(?:src|href)=\"(\\/assets\\/[^\"]+)\"/g)].map((m) => m[1]),\n);\n\nconst mainChunk = shellAssets.find((p) => /\\/index-[^/]+\\.js$/.test(p)) ??\n shellAssets.find((p) => p.endsWith(\".js\"))!;\nconst main = (await get(mainChunk)).text;\n\n// 主 bundle 里登记了全部懒加载分包\nconst lazyChunks = uniq(\n [...main.matchAll(/assets\\/[A-Za-z0-9_.\\-]+\\.js/g)].map((m) => \"/\" + m[0]),\n);\n\nconst allAssets = uniq([...shellAssets, ...lazyChunks]);\nconsole.log(\"HTML shell:\", html.length, \"B\");\nconsole.log(\"主 bundle:\", mainChunk, main.length, \"B\");\nconsole.log(\"待归档资源:\", allAssets.length, \"个\");\n\n// ── 2. 下载 + 归档 + 顺手提取接口 ───────────────────────────────\ntype ApiHit = { path: string; methods: Set; chunks: Set };\nconst apiMap = new Map();\n\nfunction mine(chunkName: string, code: string) {\n // axios 调用：.get(\"/xxx\") / .post(`/xxx`) ...\n for (\n const m of code.matchAll(\n /\\.(get|post|put|patch|delete)\\(\\s*[`\"'](\\/[^`\"'\\s]{2,140})[`\"']/g,\n )\n ) {\n const [, method, path] = m;\n const hit = apiMap.get(path) ?? {\n path,\n methods: new Set(),\n chunks: new Set(),\n };\n hit.methods.add(method.toUpperCase());\n hit.chunks.add(chunkName);\n apiMap.set(path, hit);\n }\n}\n\nconst files: { path: string; bytes: number; status: number }[] = [];\nconst failures: string[] = [];\n\nconst results = await pool(allAssets, 8, async (path) => {\n try {\n const r = await get(path);\n if (r.status !== 200) {\n failures.push(`${path} -> ${r.status}`);\n return;\n }\n await blob.set(\"mirror\" + path, r.text);\n mine(path, r.text);\n files.push({ path, bytes: r.text.length, status: r.status });\n } catch (e) {\n failures.push(`${path} -> ${(e as Error).message}`);\n }\n});\nvoid results;\n\n// HTML 壳也归档\nawait blob.set(\"mirror/index.html\", html);\n\nconst totalBytes = files.reduce((s, f) => s + f.bytes, 0);\nconsole.log(\"\\n=== 归档结果 ===\");\nconsole.log(\"成功:\", files.length, \"/\", allAssets.length);\nconsole.log(\"总体积:\", (totalBytes / 1024 / 1024).toFixed(2), \"MB\");\nif (failures.length) {\n console.log(\"失败:\", failures.length);\n console.log(failures.slice(0, 10).join(\"\\n\"));\n}\n\n// ── 3. 公开接口数据 ─────────────────────────────────────────────\nconst publicPaths = [\n \"/public/site-info\",\n \"/auth/methods\",\n \"/auth/register/info\",\n \"/drama/art-styles\",\n];\nconst publicData: Record = {};\nfor (const p of publicPaths) {\n try {\n const r = await get(\"/api\" + p);\n publicData[p] = JSON.parse(r.text);\n } catch (e) {\n publicData[p] = { error: (e as Error).message };\n }\n}\nawait blob.set(\"public-data.json\", JSON.stringify(publicData, null, 2));\n\n// ── 4. 接口地图落盘 ─────────────────────────────────────────────\nconst apiList = [...apiMap.values()]\n .map((h) => ({\n path: h.path,\n methods: [...h.methods].sort(),\n chunks: [...h.chunks].sort(),\n }))\n .sort((a, b) => a.path.localeCompare(b.path));\n\nawait blob.set(\"api-map.json\", JSON.stringify(apiList, null, 2));\n\nconst manifest = {\n origin: ORIGIN,\n siteName: (publicData[\"/public/site-info\"] as { data?: { siteName?: string } })\n ?.data?.siteName,\n harvestedAt: new Date().toISOString(),\n shell: { htmlBytes: html.length, mainChunk },\n assets: { count: files.length, totalBytes },\n api: { count: apiList.length },\n files: files.sort((a, b) => a.path.localeCompare(b.path)),\n failures,\n};\nawait blob.set(\"manifest.json\", JSON.stringify(manifest, null, 2));\n\nconsole.log(\"\\n=== 接口地图 ===\");\nconsole.log(\"带 HTTP 方法的接口:\", apiList.length, \"个\");\nconst byMethod = new Map();\nfor (const a of apiList) {\n for (const m of a.methods) byMethod.set(m, (byMethod.get(m) ?? 0) + 1);\n}\nconsole.log(\n [...byMethod.entries()].map(([m, n]) => `${m}:${n}`).join(\" \"),\n);\n\nconsole.log(\"\\n前 30 条示例:\");\nfor (const a of apiList.slice(0, 30)) {\n console.log(\" \", a.methods.join(\"/\"), a.path);\n}\n\nconsole.log(\"\\n已写入 blob: mirror/*, api-map.json, public-data.json, manifest.json\");",[],[76],"a0412340-a7f5-4124-849d-663aa9ba7d10","README.md","01a0aa5a-affc-75b2-9998-a406b6f49392",13,["D",1789565233898],3,"# 薪火AI创作平台 · 扒站报告\n\n对的完整拆解：**整站前端已归档**（287 个文件 / 4.38 MB），**634 个接口**已枚举出路径和 HTTP 方法，其中**只有 4 个不需要登录**。\n\n- 报告页：[打开](url:index.ts)\n- 归档清单 + 公开数据：[`/api/summary`](url:index.ts/api/summary)\n- 完整接口地图：[`/api/endpoints`](url:index.ts/api/endpoints)\n- 读归档的原始前端文件：[`/api/file?path=/assets/index-cz1CwIkA.js`](url:index.ts/api/file)\n\n## 这个站是什么\n\n站点真名 **薪火AI创作平台**（域名 `ai.xinhuoshixiao.com`，页面 `` 只写 `XHSX`）。不是工具导航站，是一整套**多租户 AI 内容创作 SaaS**：AI 对话、绘图、口型同步、小说、短剧分镜、数字人、课程/学校、积分商城、市场分成、支付充值、平台管理后台，一应俱全。\n\n| 维度 | 情况 |\n| --- | --- |\n| 前端 | Vite + React 18 SPA，Tailwind 系样式，axios（`baseURL: \"/api\"`），285 个懒加载分包 |\n| 服务端 | nginx 反代，响应统一为 `{code, message, data, timestamp}`（典型 Java/Spring 风格） |\n| 鉴权 | 短信验证码 + 微信登录（`emailPassword`/`emailCode`/`schoolLogin` 均为 `false`），JWT + refresh token |\n| 商业模式 | `commerceEnabled: true`，有会员套餐、充值、订单、提现、对账、卡密兑换 |\n| 多租户 | 有 `tenants`（租户）、`teams`（团队）、`school`（学校/班级/院系）三套组织体系 |\n\n## 扒到了什么\n\n| 项目 | 数量 | 说明 |\n| --- | --- | --- |\n| 前端文件 | **287** | HTML 壳 + 285 个 JS 分包 + 1 个 CSS，共 4.38 MB，全部存进本 val 的 blob（键前缀 `mirror/`） |\n| 接口 | **634** | 带 HTTP 方法：GET 287 / POST 288 / DELETE 76 / PUT 74 / PATCH 42 |\n| 公开接口 | **4** | 无需登录，见下 |\n| 其余接口 | 630 | 一律 `401 Unauthorized` |\n\n> 那 634 条不是靠猜路径试出来的，是从每个分包的 axios 调用点里正则提取的，所以每条都带**出处分包**（报告页每条下面都标了）。\n\n## 公开的 4 个接口\n\n| 接口 | 返回 |\n| --- | --- |\n| `/api/public/site-info` | 站名、图标、`commerceEnabled`、`homeEnabled`、模板名 |\n| `/api/auth/methods` | 开启的登录方式：短信验证码 ✅、微信 ✅，其余 ❌ |\n| `/api/auth/register/info` | `isFirstUser`、`needCode` |\n| `/api/drama/art-styles` | **15 条画风预设**，每条带完整提示词（`prompt`）和缩略图 |\n\n`/api/drama/art-styles` 是唯一漏出来的业务数据，含 15 条完整画风提示词（古装真人、赛博朋克、国风水墨、迪士尼、韩漫唯美…），报告页「公开数据」标签页里有全文。\n\n## 配置监控（每天自动跑）\n\n`monitor.ts` 是个 interval 任务，每天 **09:00（北京时间）** 跑一次：只读那 4 个公开接口，存一份当前快照，和上一次比对，有变化就记进历史。\n\n盯的是这几项：\n\n| 项目 | 为什么值得盯 |\n| --- | --- |\n| 登录方式开关 | 邮箱 / 短信 / 微信什么时候被关掉或打开 |\n| 注册是否需要邀请码 | `needCode` 变化说明在收紧还是放开注册 |\n| 站点名 / 模板 / 商城开关 | `commerceEnabled` 变 false 说明停售 |\n| 画风预设 | 新增、删除，或某条画风的提示词被改写 |\n\n数据落在 blob：\n\n```\nmonitor/latest.json ← 当前快照\nmonitor/history.json ← 变更历史（只在有变化时追加，最多 500 条）\nmonitor/status.json ← 每次运行的状态，用来确认 cron 还活着\n```\n\n报告页「配置监控」标签页有可视化：当前登录方式开关、累计运行次数、变更时间线。\n\n抓取失败时**不会覆盖** `latest.json`，只记错误 —— 避免一次网络抖动把好数据冲掉。\n\n## 接口地图（按模块）\n\n| 模块 | 前缀 | 内容 |\n| --- | --- | --- |\n| 登录注册 | `/auth/*` | 邮箱/短信/微信/学校登录、注册、改密、refresh |\n| 用户 | `/user/*`、`/member/*`、`/points/*` | 资料、会员、积分、签到、等级 |\n| 短剧（最重） | `/drama/*` | 项目、剧集、画布节点、**Seedance 2 分镜映射**、音频槽位、合成导出 |\n| 小说 | `/novel/*` | 项目、章节、续写 |\n| 陪练/教练 | `/coach-sessions/*`、`/coach-templates/*` | 会话、流式对话、记忆、模板短语/片段 |\n| 课程 | `/courses/*` | 课程、章节、课时、进度、看板、异常 |\n| 市场 | `/market/*` | 作品包上架、审核、举报、分成 |\n| 卡密 | `/cards/*` | 批次、兑换、导出 |\n| 管理后台 | `/admin/*` | 用户、订单、会员、租户、团队、学校、积分、提现、日志、错误中心、内容同步 |\n| 控制台 | `/console/*` | 站点配置、菜单、套餐、支付、对账、登录方式、功能开关、模型厂商 |\n| 其他 | `/gallery/*`、`/blog/*`、`/ai-models/*`、`/asset/*`、`/knowledge/*`、`/memory/*`、`/canvas/*`、`/user-robots/*` | 画廊、博客、模型、素材、知识库、记忆、画布、机器人 |\n\n完整 634 条见报告页「接口地图」标签页，支持按方法筛选和路径搜索。\n\n## 前端路由（从 bundle 的路由表提取）\n\n```\nc/:slug c/:slug/:id chat embed/:id image lipsync assets knowledge\ndrama drama/:projectId drama/:projectId/canvas novel novel/:projectId\nmember blog blog/:id courses course/:id course/:id/dashboard\npoint-rank profile profile/robots/:robotId/workbench profile/orders\nprofile/points profile/training memories robots robots/new\nrobots/:id robots/:id/edit skill-store market market/:id\nprofile/market profile/market/publish teams/join/:inviteCode teacher\nchange-password login wechat-callback home school-site gallery\ncanvas-templates version-logs coach-lab market-review console site\nlogin-methods home-config payment plans models features recharge\nreconciliation audit-logs menus liveness/callback admin users orders\nmembers tenants school points teams ai-models withdrawals content\nsystem system-monitor error-center logs\n```\n\n## 没扒到的，和为什么\n\n除上面 4 个接口外，**全部返回 401**。也就是说：博客文章、课程内容、画廊作品、市场作品包、模型列表、套餐价格、用户数据、短剧项目 —— 这些**都在登录墙后面**，没有账号拿不到。\n\n想继续往下扒，两条路：\n\n1. **给我一个已登录的 token。** 在浏览器登录后打开 DevTools → Network，随便点一个请求，把 `Authorization: Bearer eyJ...` 的值发我（或者直接给 `access_token` 的 localStorage 值）。有它我就能把 `/api/blog/posts`、`/api/courses`、`/api/market/packs`、`/api/ai-models`、`/api/console/plans` 这些全量拉下来归档。\n2. **自己跑。** `harvest.ts` 里 `get()` 加一个 `Authorization` 头，把 `publicPaths` 换成想拉的路径，重跑即可。\n\n> ⚠️ token 等同于账号密码，只在你自己信任的环境里用；我不会把它写进代码或存进 val。\n\n## 架构\n\n```mermaid\ngraph LR\n Browser -->|\"GET /\"| Hono[\"index.ts (Hono server)\"]\n Hono -->|serves| HTML[\"frontend/root.tsx\"]\n HTML -->|loads| Entry[\"frontend/index.tsx\"]\n Entry -->|renders| App[\"components/App.tsx\"]\n Hono -->|\"/api/summary\"| Blob[(\"blob 存储 manifest.json public-data.json\")]\n Hono -->|\"/api/endpoints\"| ApiMap[(\"api-map.json 634 条\")]\n Hono -->|\"/api/file\"| Mirror[(\"mirror/* 287 个前端文件\")]\n Harvest[\"harvest.ts (抓取脚本)\"] -->|写入| Blob\n Harvest -->|写入| ApiMap\n Harvest -->|写入| Mirror\n Harvest -->|\"fetch\"| Target[\"ai.xinhuoshixiao.com\"]\n Monitor[\"monitor.ts (每日 09:00 CST)\"] -->|\"fetch 4 个公开接口\"| Target\n Monitor -->|写入| Mon[(\"monitor/latest.json history.json status.json\")]\n Hono -->|\"/api/monitor\"| Mon\n```\n\n## 文件结构\n\n```\nindex.ts ← Hono 后端：报告页 + 4 个数据接口\nharvest.ts ← 抓取脚本（可重跑，会覆盖）\nmonitor.ts ← 定时监控（interval，每天 09:00 CST）\nfrontend/\n root.tsx ← HTML 壳\n index.tsx ← React 入口\n components/\n App.tsx ← 报告 UI（概览 / 接口地图 / 归档文件 / 配置监控 / 公开数据）\n```\n\nblob 存储（本 val 私有）：\n\n```\nmanifest.json ← 归档清单：287 个文件的路径与体积\napi-map.json ← 634 条接口：路径 + 方法 + 出处分包\npublic-data.json ← 4 个公开接口的完整原始 JSON\nmirror/index.html ← 原站 HTML 壳\nmirror/assets/* ← 285 个 JS 分包 + 1 个 CSS\nmonitor/latest.json ← 当前配置快照\nmonitor/history.json ← 配置变更历史\nmonitor/status.json ← 监控运行状态\n```\n\n## 重跑\n\n直接 Run `harvest.ts`。它会重新拉一遍原站、覆盖归档和接口地图。原站前端文件名带哈希，**发版后哈希会变**，重跑就能跟上。\n\n## 合规提醒\n\n这份归档是**公开可访问的前端静态资源**（任何人打开浏览器都能拿到）和**接口路径清单**，不含任何用户数据或密钥。但整站复制他人前端代码用于公开发布，涉及对方著作权；接口地图用于对自己账号下的数据做备份没问题，用来批量抓取他人数据则可能违反对方条款。自己评估用途。",[],[84],"6e7eb539-4cd6-416b-b4e6-db4a6a2b18b6","frontend","01a0aa5a-affc-75b2-9998-9d64f2480573",1,["D",1789564465090],"directory",[100,101,102,103],[93],{"_33":126,"_13":127,"_35":128,"_37":94,"_38":39,"_40":95,"_42":43,"_44":129,"_17":66,"_47":97,"_49":-5,"_51":52,"_53":-5,"_69":130,"_18":131},{"_33":119,"_13":120,"_35":121,"_37":94,"_38":39,"_40":95,"_42":43,"_44":122,"_17":66,"_47":24,"_49":123,"_51":52,"_53":-5,"_69":124,"_18":125},{"_33":112,"_13":113,"_35":114,"_37":94,"_38":39,"_40":95,"_42":43,"_44":115,"_17":66,"_47":79,"_49":116,"_51":52,"_53":-5,"_69":117,"_18":118},{"_33":104,"_13":105,"_35":106,"_37":94,"_38":39,"_40":107,"_42":43,"_44":108,"_17":95,"_47":79,"_49":109,"_51":52,"_53":-5,"_69":110,"_18":111},"3b104498-dac6-4be5-814a-2c8011f01ffd","root.tsx","01a0aa5a-affc-75b2-9998-9a31bcbf93da",4,["D",1789564512255],"/** @jsxImportSource npm:hono@4/jsx */\nimport { raw } from \"npm:hono@4/html\";\nimport { immutableFileUrl } from \"https://esm.town/v/std/utils/index.ts\";\n\n// The HTML shell for the app. It is never cached, so immutableFileUrl can stamp\n// the current val version into each asset URL — the browser caches those\n// immutably, and publishing the val changes the URLs, refetching exactly once.\nexport function Root() {\n return (\n <>\n {raw(\"<!DOCTYPE html>\")}\n <html lang=\"en\">\n <head>\n <meta charSet=\"UTF-8\" />\n <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\" />\n <title>薪火AI创作平台 · 扒站报告\n