karin-plugin-kkk 2.45.0 → 2.45.1-beta.1

package/lib/core_chunk/default.js

@@ -1,7 +1,8 @@
 globalThis.__KTR_BUNDLED__ = true;
 import { o as __toESM } from "./rolldown-runtime.js";
-import { $r as number$1, Gr as CryptoConfig, Jr as xRapParam, Kr as FingerprintGenerator, Qr as literal, Wr as require_protobufjs, Xr as _enum, Yr as number, Zr as array, ei as object, ni as union, qr as Xhshow, ri as toJSONSchema, ti as string } from "./vendor.js";
+import { $r as record, Gr as require_protobufjs, Jr as any, Kr as number, Qr as object, Xr as literal, Yr as array, Zr as number$1, ei as string, ni as ZodError, qr as _enum, ri as toJSONSchema, ti as union } from "./vendor.js";
 import crypto, { createCipheriv, createHash, randomBytes, randomUUID } from "node:crypto";
+import { gzipSync } from "node:zlib";
 import express, { Router } from "node-karin/express";
 import axios, { AxiosError, AxiosHeaders, mergeConfig } from "node-karin/axios";
 import { EventEmitter } from "node:events";
@@ -986,7 +987,7 @@ var SALT = "dhzx";
 /** header 携带的两个明文字节，是这套格式最接近魔数的东西，也是 {@link structureError} 的第一道检查 */
 var HEADER_MAGIC = [3, 82];
 /** `"1.0.1.19-fix.01"` 被 SDK 解析后的版本块，实测解码结果 */
-var SDK_VERSION = [
+var SDK_VERSION$1 = [
 	1,
 	0,
 	1,
@@ -1458,7 +1459,7 @@ var ABogus = class {
 		const now = options.nowMs ?? Date.now();
 		if (now < 17218368e5) throw new Error(`时钟早于 a_bogus 纪元：${now}`);
 		const fields = this.fields(query, body, now);
-		const version = [...maskPair(SDK_VERSION.slice(0, 2), this.rng), ...maskPair(SDK_VERSION.slice(2, 4), this.rng, {
+		const version = [...maskPair(SDK_VERSION$1.slice(0, 2), this.rng), ...maskPair(SDK_VERSION$1.slice(2, 4), this.rng, {
 			low: probeNoise(this.rng),
 			high: tripwireNoise(this.rng)
 		})];
@@ -2563,7 +2564,7 @@ var deriveKuaishouPureSignature = (context) => {
 	};
 };
 //#endregion
-//#region ../amagi/packages/core/dist/steps-bZrsb4W6.mjs
+//#region ../amagi/packages/core/dist/steps-BuOxvrAo.mjs
 /**
 * B站视频流签名器（qtparam 前置）。
 *
@@ -3438,32 +3439,2544 @@ var hxfalcon = (signer = sharedKuaishouSigner) => ({
 	phase: "sign",
 	apply: createHxfalconSigner(signer)
 });
-/** 初始化签名配置。 */
-var createXiaohongshuCryptoConfig = () => new CryptoConfig().withOverrides({
-	DATA_WEB_BUILD: "6.12.3",
-	SIGNATURE_DATA_TEMPLATE: {
+/**
+* 平台判定：把 UA 映射成小红书前端签名里用到的那几个平台量。
+*
+* 前端 `vendor-dynamic.js` 里有一个枚举和一个 switch，两者一起决定
+* `x-s-common` 的 `s0` 与 `x2`：
+*
+* ```js
+* PlatformCode: Windows=0, iOS=1, Android=2, MacOs=3, Linux=4, other=5
+*
+* function getPlatformCode (e) {
+*   switch (e) {
+*     case "Android": return PlatformCode.Android
+*     case "iOS":     return PlatformCode.iOS
+*     case "Mac OS":  return PlatformCode.MacOs
+*     case "Linux":   return PlatformCode.Linux
+*     default:        return PlatformCode.other
+*   }
+* }
+* ```
+*
+* 那个 switch **没有 `case "Windows"`** —— Windows 落到 `default`，于是它的 `s0`
+* 是 5（other）而不是枚举里的 0。这不是前端的 bug，是必须照抄的行为：
+* 2026-09-25 真机 Edge 153 登录态抓下来的 `x-s-common` 解出来就是
+* `{"s0":5,"x2":"Windows",...}`。
+*
+* a1 Cookie 尾部那一位平台码走的是另一条路径（前端 `generateLocalId`），但用的是
+* **同一套映射** —— 同一次实测里 a1 尾部是 `"50000"`，平台位也是 `5`。于是
+* `PlatformCode.Windows = 0` 在 Web 端两条路径上都产不出来。
+*/
+/** 前端 `PlatformCode` 枚举原值。照录用，Web 端实际只会取到 1~5。 */
+var PLATFORM_CODE = {
+	Windows: 0,
+	iOS: 1,
+	Android: 2,
+	MacOs: 3,
+	Linux: 4,
+	other: 5
+};
+/**
+* 从 UA 推断平台名，对应前端的 `e.platform`。
+*
+* 判定顺序要紧：iOS 的 UA 里带 `Mac OS X`，Android 的 UA 里带 `Linux`，
+* 所以移动端必须先判，否则 iPhone 会被认成 Mac、Android 会被认成 Linux。
+* @param userAgent - 实际发请求用的 UA
+* @returns 平台名；认不出时返回 undefined，由调用方决定兜底
+*/
+function platformFromUserAgent(userAgent) {
+	if (!userAgent) return void 0;
+	const ua = userAgent.toLowerCase();
+	if (/iphone|ipad|ipod/.test(ua)) return "iOS";
+	if (/android/.test(ua)) return "Android";
+	if (/windows|win64|win32/.test(ua)) return "Windows";
+	if (/mac os x|macintosh/.test(ua)) return "Mac OS";
+	if (/linux|x11|cros/.test(ua)) return "Linux";
+}
+/**
+* 复刻前端 `getPlatformCode`，产出 `x-s-common` 的 `s0`。
+*
+* 刻意保留「没有 Windows 分支」这个行为 —— Windows 必须落到 `other`(5)。
+* 把它"修正"成 0 会让签名与真实浏览器不一致。
+* @param platform - 平台名，取自 {@link platformFromUserAgent}
+* @returns `s0` 的取值
+*/
+function getPlatformCode(platform) {
+	switch (platform) {
+		case "Android": return PLATFORM_CODE.Android;
+		case "iOS": return PLATFORM_CODE.iOS;
+		case "Mac OS": return PLATFORM_CODE.MacOs;
+		case "Linux": return PLATFORM_CODE.Linux;
+		default: return PLATFORM_CODE.other;
+	}
+}
+/**
+* `XYW_` 载荷里 `x2` 那 19 位环境标志的真实浏览器取值。
+*
+* **这一串不按 OS 变，别给它建平台查表。** 2026-09-25 同机对照实测：
+*
+* | 环境 | `navigator.webdriver` | 第 11 位 |
+* | --- | --- | --- |
+* | Windows 真机 Edge 153（登录态） | `false` | `0` |
+* | Windows 自动化 Chrome 154 | `true` | `1` |
+*
+* 同一台机器、同一个 OS，只有自动化状态不同，第 11 位就翻转 —— 它测的是
+* webdriver，不是平台。此前有份调研归档把「第 11 位为 1」记成 Linux 的特征，
+* 那是在沙箱里抓的，测到的其实是沙箱自身的自动化标志。照那个建按 OS 查表的话，
+* 跑在 Linux 服务器上的签名会主动自报自动化特征，等于给风控送判据。
+*
+* 真正随平台变的是 `x-s-common` 的 `s0` 与 `x2`，见本文件上面两个函数。
+*/
+var XYW_ENV_FLAGS_BROWSER = "0|0|0|1|0|0|1|0|0|0|1|0|0|0|0|1|0|0|0";
+var XHS_SESSION_START_MS = Date.now();
+var CryptoConfig = class CryptoConfig {
+	DES_KEY = "zbp30y86";
+	GID_URL = "https://as.xiaohongshu.com/api/sec/v1/shield/webprofile";
+	DATA_PLATFORM = "Windows";
+	DATA_SVN = "2";
+	DATA_SDK_VERSION = "4.3.5";
+	DATA_WEB_BUILD = "6.56.3";
+	MAX_32BIT = 4294967295;
+	MAX_SIGNED_32BIT = 2147483647;
+	MAX_BYTE = 255;
+	STANDARD_BASE64_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+	CUSTOM_BASE64_ALPHABET = "ZmserbBoHQtNP+wOcza/LpngG8yJq42KWYj0DSfdikx3VT16IlUAFM97hECvuRX5";
+	X3_BASE64_ALPHABET = "MfgqrsbcyzPQRStuvC7mn501HIJBo2DEFTKdeNOwxWXYZap89+/A4UVLhijkl63G";
+	HEX_KEY = "71a302257793271ddd273bcee3e4b98d9d7935e1da33f5765e2ea8afb6dc77a51a499d23b67c20660025860cbf13d4540d92497f58686c574e508f46e1956344f39139bf4faf22a3eef120b79258145b2feb5193b6478669961298e79bedca646e1a693a926154a5a7a1bd1cf0dedb742f917a747a1e388b234f2277516db7116035439730fa61e9822a0eca7bff72d8";
+	EXPECTED_HEX_LENGTH = 32;
+	OUTPUT_BYTE_COUNT = 8;
+	HEX_CHUNK_SIZE = 2;
+	VERSION_BYTES = [
+		121,
+		104,
+		96,
+		41
+	];
+	PAYLOAD_LENGTH = 144;
+	A1_LENGTH = 52;
+	APP_ID_LENGTH = 10;
+	MD5_XOR_LENGTH = 8;
+	A3_PREFIX = [
+		2,
+		97,
+		51,
+		16
+	];
+	TIMESTAMP_LE_LENGTH = 8;
+	SEQUENCE_VALUE_MIN = 15;
+	SEQUENCE_VALUE_MAX = 50;
+	WINDOW_PROPS_LENGTH_MIN = 1e3;
+	WINDOW_PROPS_LENGTH_MAX = 1200;
+	SESSION_WINDOW_PROPS_INIT_MIN = 1e3;
+	SESSION_WINDOW_PROPS_INIT_MAX = 2e3;
+	SESSION_SEQUENCE_INIT_MIN = 15;
+	SESSION_SEQUENCE_INIT_MAX = 17;
+	SESSION_SEQUENCE_STEP_MIN = 0;
+	SESSION_SEQUENCE_STEP_MAX = 1;
+	SESSION_WINDOW_PROPS_STEP_MIN = 1;
+	SESSION_WINDOW_PROPS_STEP_MAX = 10;
+	CHECKSUM_VERSION = 1;
+	CHECKSUM_XOR_KEY = 115;
+	CHECKSUM_FIXED_TAIL = [
+		249,
+		65,
+		103,
+		103,
+		201,
+		181,
+		129,
+		99,
+		94,
+		7,
+		68,
+		250,
+		132,
+		21
+	];
+	ENV_TABLE = [
+		115,
+		248,
+		83,
+		102,
+		103,
+		201,
+		181,
+		131,
+		99,
+		94,
+		4,
+		68,
+		250,
+		132,
+		21
+	];
+	ENV_CHECKS_DEFAULT = [
+		0,
+		1,
+		18,
+		1,
+		0,
+		0,
+		0,
+		2,
+		0,
+		0,
+		3,
+		0,
+		0,
+		0,
+		0
+	];
+	HASH_IV = [
+		1831565813,
+		461845907,
+		2246822507,
+		3266489909
+	];
+	ENV_FINGERPRINT_XOR_KEY = 41;
+	ENV_FINGERPRINT_TIME_OFFSET_MIN = 10;
+	ENV_FINGERPRINT_TIME_OFFSET_MAX = 50;
+	SIGNATURE_DATA_TEMPLATE = {
 		x0: "4.4.3",
 		x1: "xhs-pc-web",
 		x2: "Windows",
 		x3: "",
 		x4: ""
-	},
-	SIGNATURE_XSCOMMON_TEMPLATE: {
+	};
+	SSK_SERVER_PUBLIC_KEY = "Kr0iygsCu3inYJNXCL4k4JuzaYQ2afI1xbwc7BH6sm8=";
+	X3_PREFIX = "mns0301_";
+	XYS_PREFIX = "XYS_";
+	XYW_PREFIX = "XYW_";
+	XYW_SIGN_SVN = "56";
+	XYW_SIGN_TYPE = "x2";
+	XYW_SIGN_VERSION = "1";
+	XYW_AES_KEY = "7cc4adla5ay0701v";
+	XYW_AES_IV = "4uzjr7mbsibcaldp";
+	XYW_ENV_FLAGS_DEFAULT = XYW_ENV_FLAGS_BROWSER;
+	HEX_CHARS = "abcdef0123456789";
+	XRAY_TRACE_ID_SEQ_MAX = 8388607;
+	XRAY_TRACE_ID_TIMESTAMP_SHIFT = 23;
+	XRAY_TRACE_ID_PART1_LENGTH = 16;
+	XRAY_TRACE_ID_PART2_LENGTH = 16;
+	B3_TRACE_ID_LENGTH = 16;
+	B1_SECRET_KEY = "xhswebmplfbt";
+	XRAP_SDK_VERSION = 10301;
+	XRAP_MASTER_KEY = "kqI1DTcwKX90ZtAy";
+	SIGNATURE_XSCOMMON_TEMPLATE = {
 		s0: 5,
 		s1: "",
 		x0: "1",
-		x1: "4.3.5",
+		x1: "4.4.3",
 		x2: "Windows",
 		x3: "xhs-pc-web",
-		x4: "6.12.3",
+		x4: "6.56.3",
 		x5: "",
 		x6: "",
 		x7: "",
 		x8: "",
 		x9: -596800761,
 		x10: 0,
-		x11: "normal"
+		x11: "normal",
+		get x12() {
+			return `${Date.now()};${XHS_SESSION_START_MS}`;
+		}
+	};
+	PUBLIC_USERAGENT = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36 Edg/142.0.0.0";
+	/**
+	* Create a new config instance with overridden values
+	*/
+	withOverrides(overrides) {
+		const newConfig = new CryptoConfig();
+		Object.assign(newConfig, overrides);
+		return newConfig;
+	}
+	/**
+	* 按 UA 派生出平台相关的那几个字段，返回新实例（不改动当前实例）。
+	*
+	* 会跟着 UA 变的只有三处，都经真机验证过是平台绑定的：
+	*
+	* - `SIGNATURE_XSCOMMON_TEMPLATE.s0` —— 复刻前端 `getPlatformCode`，
+	*   Windows 落 `other`(5)、Mac OS 是 3、Linux 是 4、iOS 1、Android 2
+	* - `SIGNATURE_XSCOMMON_TEMPLATE.x2` 与 `SIGNATURE_DATA_TEMPLATE.x2` ——
+	*   平台名字符串，认不出时用前端的兜底值 `'PC'`
+	* - `DATA_PLATFORM` —— webprofile（gid）请求体里的平台名
+	* - `PUBLIC_USERAGENT` —— b1 指纹直接把 UA 写进 `fingerprint.x1`，必须跟着一起换
+	*
+	* `XYW_ENV_FLAGS_DEFAULT` 刻意**不**跟着 UA 变：那 19 位里唯一观测到会变的是
+	* webdriver 位，与 OS 无关，详见 `./platform.ts`。
+	*
+	* 与 {@link withOverrides} 可组合，后者优先：
+	* ```ts
+	* new CryptoConfig().forUserAgent(ua).withOverrides({ DATA_WEB_BUILD: '6.12.3' })
+	* ```
+	* @param userAgent - 实际发请求用的 UA；认不出平台时退回 `'PC'`
+	* @returns 平台字段已就位的新配置实例
+	*/
+	forUserAgent(userAgent) {
+		const platform = platformFromUserAgent(userAgent);
+		const platformName = platform ?? "PC";
+		const field = (value) => ({
+			value,
+			enumerable: true,
+			writable: true,
+			configurable: true
+		});
+		const xsCommonTemplate = Object.defineProperties({}, {
+			...Object.getOwnPropertyDescriptors(this.SIGNATURE_XSCOMMON_TEMPLATE),
+			s0: field(getPlatformCode(platform)),
+			x2: field(platformName)
+		});
+		return this.withOverrides({
+			...this,
+			...userAgent ? { PUBLIC_USERAGENT: userAgent } : {},
+			DATA_PLATFORM: platformName,
+			SIGNATURE_DATA_TEMPLATE: {
+				...this.SIGNATURE_DATA_TEMPLATE,
+				x2: platformName
+			},
+			SIGNATURE_XSCOMMON_TEMPLATE: xsCommonTemplate
+		});
+	}
+};
+var BitOperations = class {
+	config;
+	constructor(config) {
+		this.config = config || new CryptoConfig();
+	}
+	normalizeTo32bit(value) {
+		return value & this.config.MAX_32BIT;
+	}
+	toSigned32bit(unsignedValue) {
+		if (unsignedValue > this.config.MAX_SIGNED_32BIT) return unsignedValue - 4294967296;
+		return unsignedValue;
+	}
+	computeSeedValue(seed32bit) {
+		const normalizedSeed = this.normalizeTo32bit(seed32bit);
+		const shift15Bits = normalizedSeed >> 15;
+		const shift13Bits = normalizedSeed >> 13;
+		const shift12Bits = normalizedSeed >> 12;
+		const shift10Bits = normalizedSeed >> 10;
+		const shiftedResult = ((shift15Bits & ~shift13Bits | shift13Bits & ~shift15Bits) ^ shift12Bits ^ shift10Bits) << 31 & this.config.MAX_32BIT;
+		return this.toSigned32bit(shiftedResult);
+	}
+	xorTransformArray(sourceIntegers) {
+		const result = new Uint8Array(sourceIntegers.length);
+		const keyBytes = Buffer.from(this.config.HEX_KEY, "hex");
+		const keyLength = keyBytes.length;
+		for (let i = 0; i < sourceIntegers.length; i++) if (i < keyLength) result[i] = (sourceIntegers[i] ^ keyBytes[i]) & 255;
+		else result[i] = sourceIntegers[i] & 255;
+		return result;
+	}
+};
+var Base64Encoder = class {
+	config;
+	customEncodeTable;
+	customDecodeTable;
+	x3EncodeTable;
+	x3DecodeTable;
+	constructor(config) {
+		this.config = config || new CryptoConfig();
+		this.customEncodeTable = this.buildTranslationTable(this.config.STANDARD_BASE64_ALPHABET, this.config.CUSTOM_BASE64_ALPHABET);
+		this.customDecodeTable = this.buildTranslationTable(this.config.CUSTOM_BASE64_ALPHABET, this.config.STANDARD_BASE64_ALPHABET);
+		this.x3EncodeTable = this.buildTranslationTable(this.config.STANDARD_BASE64_ALPHABET, this.config.X3_BASE64_ALPHABET);
+		this.x3DecodeTable = this.buildTranslationTable(this.config.X3_BASE64_ALPHABET, this.config.STANDARD_BASE64_ALPHABET);
+	}
+	buildTranslationTable(from, to) {
+		const table = /* @__PURE__ */ new Map();
+		for (let i = 0; i < from.length; i++) table.set(from[i], to[i]);
+		return table;
+	}
+	translate(str, table) {
+		let result = "";
+		for (const char of str) result += table.get(char) ?? char;
+		return result;
+	}
+	/**
+	* Encode a string using custom Base64 alphabet
+	*/
+	encode(dataToEncode) {
+		const standardEncoded = Buffer.from(dataToEncode, "utf8").toString("base64");
+		return this.translate(standardEncoded, this.customEncodeTable);
+	}
+	/**
+	* Decode string using custom Base64 alphabet
+	*/
+	decode(encodedString) {
+		const standardEncoded = this.translate(encodedString, this.customDecodeTable);
+		try {
+			return Buffer.from(standardEncoded, "base64").toString("utf8");
+		} catch {
+			throw new Error("Invalid Base64 input: unable to decode string");
+		}
+	}
+	/**
+	* Decode x3 signature using X3_BASE64_ALPHABET
+	*/
+	decodeX3(encodedString) {
+		const standardEncoded = this.translate(encodedString, this.x3DecodeTable);
+		try {
+			return Buffer.from(standardEncoded, "base64");
+		} catch {
+			throw new Error("Invalid Base64 input: unable to decode string");
+		}
+	}
+	/**
+	* Encode x3 signature using X3_BASE64_ALPHABET
+	*/
+	encodeX3(inputBytes) {
+		const standardEncoded = Buffer.from(inputBytes).toString("base64");
+		return this.translate(standardEncoded, this.x3EncodeTable);
+	}
+};
+var HexProcessor = class {
+	config;
+	constructor() {
+		this.config = new CryptoConfig();
+	}
+	hexStringToBytes(hexString) {
+		const byteValues = [];
+		for (let i = 0; i < hexString.length; i += this.config.HEX_CHUNK_SIZE) {
+			const hexChunk = hexString.slice(i, i + this.config.HEX_CHUNK_SIZE);
+			byteValues.push(parseInt(hexChunk, 16));
+		}
+		return byteValues;
+	}
+	processHexParameter(hexString, xorKey) {
+		if (hexString.length !== this.config.EXPECTED_HEX_LENGTH) throw new Error(`hex parameter must be ${this.config.EXPECTED_HEX_LENGTH} characters`);
+		return this.hexStringToBytes(hexString).map((byteVal) => byteVal ^ xorKey).slice(0, this.config.OUTPUT_BYTE_COUNT);
+	}
+};
+var BASE36_CHARS = "0123456789abcdefghijklmnopqrstuvwxyz";
+var A1_CHARSET = "abcdefghijklmnopqrstuvwxyz1234567890";
+var STD_CRC32_TABLE = null;
+function stdCrc32(bytes) {
+	if (STD_CRC32_TABLE === null) {
+		const tbl = new Array(256);
+		for (let n = 0; n < 256; n++) {
+			let c = n;
+			for (let k = 0; k < 8; k++) c = c & 1 ? c >>> 1 ^ 3988292384 : c >>> 1;
+			tbl[n] = c >>> 0;
+		}
+		STD_CRC32_TABLE = tbl;
+	}
+	let crc = 4294967295;
+	for (let i = 0; i < bytes.length; i++) crc = (STD_CRC32_TABLE[(crc ^ bytes[i]) & 255] ^ crc >>> 8) >>> 0;
+	return (crc ^ 4294967295) >>> 0;
+}
+/**
+* Convert a non-negative BigInt to a base36 string.
+*/
+function intToBase36(value) {
+	if (value === 0n) return "0";
+	let result = "";
+	const base = 36n;
+	while (value > 0n) {
+		const remainder = value % base;
+		value = value / base;
+		result = BASE36_CHARS[Number(remainder)] + result;
+	}
+	return result;
+}
+var RandomGenerator = class {
+	config;
+	constructor() {
+		this.config = new CryptoConfig();
+	}
+	/**
+	* Generate random byte array
+	*/
+	generateRandomBytes(byteCount) {
+		return Array.from({ length: byteCount }, () => Math.floor(Math.random() * (this.config.MAX_BYTE + 1)));
+	}
+	/**
+	* Generate random integer in range
+	*/
+	generateRandomByteInRange(minVal, maxVal) {
+		return Math.floor(Math.random() * (maxVal - minVal + 1)) + minVal;
+	}
+	/**
+	* Generate 32-bit random integer
+	*/
+	generateRandomInt() {
+		return Math.floor(Math.random() * (this.config.MAX_32BIT + 1));
+	}
+	/**
+	* Generate x-b3-traceid (16 random hex characters)
+	*/
+	generateB3TraceId() {
+		let result = "";
+		for (let i = 0; i < this.config.B3_TRACE_ID_LENGTH; i++) result += this.config.HEX_CHARS[Math.floor(Math.random() * this.config.HEX_CHARS.length)];
+		return result;
+	}
+	/**
+	* Generate x-xray-traceid (32 characters: 16 timestamp+seq + 16 random)
+	*/
+	generateXrayTraceId(timestamp, seq) {
+		if (timestamp === void 0) timestamp = Date.now();
+		if (seq === void 0) seq = Math.floor(Math.random() * (this.config.XRAY_TRACE_ID_SEQ_MAX + 1));
+		const part1 = (BigInt(timestamp) << BigInt(this.config.XRAY_TRACE_ID_TIMESTAMP_SHIFT) | BigInt(seq)).toString(16).padStart(this.config.XRAY_TRACE_ID_PART1_LENGTH, "0");
+		let part2 = "";
+		for (let i = 0; i < this.config.XRAY_TRACE_ID_PART2_LENGTH; i++) part2 += this.config.HEX_CHARS[Math.floor(Math.random() * this.config.HEX_CHARS.length)];
+		return part1 + part2;
+	}
+	/**
+	* Generate a random ASCII string of the given length
+	*/
+	static generateRandomAscii(length, charset = "abcdefghijklmnopqrstuvwxyz0123456789") {
+		let result = "";
+		for (let i = 0; i < length; i++) result += charset[Math.floor(Math.random() * charset.length)];
+		return result;
+	}
+	/**
+	* Generate an a1 cookie value (52 characters)
+	*/
+	static generateA1() {
+		const tsHex = Math.floor(Date.now()).toString(16);
+		let randomStr = "";
+		for (let i = 0; i < 30; i++) randomStr += A1_CHARSET[Math.floor(Math.random() * 36)];
+		const aPart = tsHex + randomStr + "50000";
+		const crc = stdCrc32(Buffer.from(aPart)) >>> 0;
+		return (aPart + String(crc)).slice(0, 52);
+	}
+	/**
+	* Generate web_id (32-character hex MD5) from an a1 cookie value
+	*/
+	static generateWebId(a1) {
+		return createHash("md5").update(a1).digest("hex");
+	}
+	/**
+	* Generate search_id for search endpoints (base36 of (timestamp_ms << 64) + random)
+	*/
+	generateSearchId() {
+		const timestampMs = BigInt(Date.now());
+		const randomPart = BigInt(Math.ceil(2147483646 * Math.random()));
+		return intToBase36((timestampMs << 64n) + randomPart);
+	}
+	/**
+	* Generate search request_id for search endpoints. Format: "{random}-{timestamp_ms}"
+	*/
+	generateSearchRequestId() {
+		const timestampMs = Date.now();
+		return `${Math.ceil(2147483646 * Math.random())}-${timestampMs}`;
+	}
+};
+/**
+* Extract URI path from full URL (removes protocol, host, query, fragment)
+*/
+function extractUri(url) {
+	if (!url || typeof url !== "string") throw new Error("URL must be a non-empty string");
+	url = url.trim();
+	try {
+		if (url.startsWith("http://") || url.startsWith("https://")) {
+			const path = new URL(url).pathname;
+			if (!path || path === "/") throw new Error(`Cannot extract valid URI path from URL: ${url}`);
+			return path;
+		}
+		const queryIndex = url.indexOf("?");
+		const path = queryIndex >= 0 ? url.substring(0, queryIndex) : url;
+		if (!path || path === "/") throw new Error(`Cannot extract valid URI path from URL: ${url}`);
+		return path;
+	} catch (e) {
+		if (e instanceof Error && e.message.includes("Cannot extract")) throw e;
+		throw new Error(`Cannot extract valid URI path from URL: ${url}`);
+	}
+}
+/**
+* Build complete URL with query parameters (handles parameter escaping)
+*
+* IMPORTANT: This function uses XHS platform-specific encoding rules.
+* Only '=' characters are encoded as '%3D'. Other special characters
+* (including ',') are NOT encoded, as required by XHS signature algorithm.
+*/
+function buildUrl(baseUrl, params) {
+	if (!baseUrl || typeof baseUrl !== "string") throw new Error("baseUrl must be a non-empty string");
+	if (!params) return baseUrl;
+	const queryParts = [];
+	for (const [key, value] of Object.entries(params)) {
+		let formattedValue;
+		if (Array.isArray(value)) formattedValue = value.map((v) => String(v)).join(",");
+		else if (value !== null && value !== void 0) formattedValue = String(value);
+		else formattedValue = "";
+		const encodedValue = formattedValue.replace(/=/g, "%3D");
+		queryParts.push(`${key}=${encodedValue}`);
+	}
+	const queryString = queryParts.join("&");
+	let separator;
+	if (!baseUrl.includes("?")) separator = "?";
+	else if (baseUrl.endsWith("?") || baseUrl.endsWith("&")) separator = "";
+	else separator = "&";
+	return `${baseUrl}${separator}${queryString}`;
+}
+/**
+* Pure TypeScript xxHash32 implementation.
+*
+* Ported from the upstream Python `utils/hash.py`. Used by the x-rap-param
+* generator to compute integrity hashes over the request body and envelope.
+*/
+var MASK_32 = 4294967295;
+/**
+* 32-bit left rotation (unsigned)
+*/
+function rotl32$1(val, shift) {
+	val = val >>> 0;
+	return (val << shift | val >>> 32 - shift) >>> 0;
+}
+/**
+* Compute the xxHash32 digest of the given bytes.
+*
+* @param data - Input bytes
+* @param seed - Optional seed (default 0)
+* @returns Unsigned 32-bit hash value
+*/
+function xxh32(data, seed = 0) {
+	const buf = data;
+	const length = buf.length;
+	let pos = 0;
+	const prime1 = 2654435761;
+	const prime2 = 2246822519;
+	const prime3 = 3266489917;
+	const prime4 = 668265263;
+	const prime5 = 374761393;
+	let digest;
+	if (length >= 16) {
+		let acc1 = seed + prime1 + prime2 >>> 0;
+		let acc2 = seed + prime2 >>> 0;
+		let acc3 = seed >>> 0;
+		let acc4 = seed - prime1 >>> 0;
+		const end = length - 16;
+		while (pos <= end) for (let accRef = 0; accRef < 4; accRef++) {
+			const word = readU32LE(buf, pos);
+			pos += 4;
+			if (accRef === 0) acc1 = Math.imul(rotl32$1(acc1 + Math.imul(word, prime2) >>> 0, 13), prime1) >>> 0;
+			else if (accRef === 1) acc2 = Math.imul(rotl32$1(acc2 + Math.imul(word, prime2) >>> 0, 13), prime1) >>> 0;
+			else if (accRef === 2) acc3 = Math.imul(rotl32$1(acc3 + Math.imul(word, prime2) >>> 0, 13), prime1) >>> 0;
+			else acc4 = Math.imul(rotl32$1(acc4 + Math.imul(word, prime2) >>> 0, 13), prime1) >>> 0;
+		}
+		digest = rotl32$1(acc1, 1) + rotl32$1(acc2, 7) + rotl32$1(acc3, 12) + rotl32$1(acc4, 18) >>> 0;
+	} else digest = seed + prime5 >>> 0;
+	digest = digest + length >>> 0;
+	while (pos + 4 <= length) {
+		const word = readU32LE(buf, pos);
+		pos += 4;
+		digest = Math.imul(rotl32$1(digest + Math.imul(word, prime3) >>> 0, 17), prime4) >>> 0;
+	}
+	while (pos < length) {
+		digest = Math.imul(rotl32$1(digest + Math.imul(buf[pos], prime5) >>> 0, 11), prime1) >>> 0;
+		pos += 1;
+	}
+	digest ^= digest >>> 15;
+	digest = Math.imul(digest, prime2) >>> 0;
+	digest ^= digest >>> 13;
+	digest = Math.imul(digest, prime3) >>> 0;
+	digest ^= digest >>> 16;
+	return (digest & MASK_32) >>> 0;
+}
+/**
+* Read a 32-bit little-endian unsigned integer from a byte buffer.
+*/
+function readU32LE(buf, off) {
+	return (buf[off] | buf[off + 1] << 8 | buf[off + 2] << 16 | buf[off + 3] << 24) >>> 0;
+}
+/**
+* Sharding key generation for the `xy-direction` request header.
+*
+* Ported from the upstream Python `utils/sharding.py`. When a `user_id` is
+* provided, the key is derived deterministically via a MurmurHash3-x86-32
+* variant; otherwise a random value in [10, 100] is returned.
+*/
+var C1 = 3432918353;
+var C2 = 461845907;
+/**
+* 32-bit left rotation (unsigned)
+*/
+function rotl32(x, r) {
+	x = x >>> 0;
+	return (x << r | x >>> 32 - r) >>> 0;
+}
+/**
+* Compute the sharding key for the `xy-direction` header.
+*
+* @param userId - Optional user id. If omitted, a random value in [10, 100].
+* @returns Sharding key
+*/
+function getShardingKey(userId) {
+	if (userId === null || userId === void 0) return Math.floor(Math.random() * 91) + 10;
+	const data = Buffer.from(userId, "utf-8");
+	const length = data.length;
+	let r = 151488;
+	const nblocks = Math.floor(length / 4);
+	for (let o = 0; o < nblocks; o++) {
+		const i = 4 * o;
+		let u = (data[i] | data[i + 1] << 8 | data[i + 2] << 16 | data[i + 3] << 24) >>> 0;
+		u = Math.imul(u, C1) >>> 0;
+		u = rotl32(u, 15);
+		u = Math.imul(u, C2) >>> 0;
+		r = (r ^ u) >>> 0;
+		r = rotl32(r, 13);
+		r = Math.imul(r, 5) + 3864292196 >>> 0;
+	}
+	const s = 4 * nblocks;
+	let c = 0;
+	const rem = length % 4;
+	if (rem >= 3) c ^= data[s + 2] << 16;
+	if (rem >= 2) c ^= data[s + 1] << 8;
+	if (rem >= 1) {
+		c ^= data[s];
+		c = Math.imul(c, C1) >>> 0;
+		c = rotl32(c, 15);
+		c = Math.imul(c, C2) >>> 0;
+		r = (r ^ c) >>> 0;
+	}
+	r = (r ^ length) >>> 0;
+	r ^= r >>> 16;
+	r = Math.imul(r, 2246822507) >>> 0;
+	r ^= r >>> 13;
+	r = Math.imul(r, 3266489909) >>> 0;
+	r ^= r >>> 16;
+	r = r >>> 0;
+	return r % 100 + 1;
+}
+var CryptoProcessor = class {
+	config;
+	bitOps;
+	b64encoder;
+	hexProcessor;
+	randomGen;
+	constructor(config) {
+		this.config = config || new CryptoConfig();
+		this.bitOps = new BitOperations(this.config);
+		this.b64encoder = new Base64Encoder(this.config);
+		this.hexProcessor = new HexProcessor();
+		this.randomGen = new RandomGenerator();
+	}
+	intToLeBytes(val, length = 4) {
+		const arr = [];
+		for (let i = 0; i < length; i++) {
+			arr.push(val & 255);
+			val = Math.floor(val / 256);
+		}
+		return arr;
+	}
+	/**
+	* 32-bit left rotation
+	*/
+	rotateLeft(val, n) {
+		return (val << n | val >>> 32 - n) >>> 0;
+	}
+	/**
+	* Custom hash function for a3 field generation
+	* Input: byte array (must be multiple of 8)
+	* Output: 16-byte array
+	*/
+	customHashV2(inputBytes) {
+		let [s0, s1, s2, s3] = this.config.HASH_IV;
+		const length = inputBytes.length;
+		s0 ^= length;
+		s1 ^= length << 8;
+		s2 ^= length << 16;
+		s3 ^= length << 24;
+		for (let i = 0; i < Math.floor(length / 8); i++) {
+			const offset = i * 8;
+			const v0 = (inputBytes[offset] | inputBytes[offset + 1] << 8 | inputBytes[offset + 2] << 16 | inputBytes[offset + 3] << 24) >>> 0;
+			const v1 = (inputBytes[offset + 4] | inputBytes[offset + 5] << 8 | inputBytes[offset + 6] << 16 | inputBytes[offset + 7] << 24) >>> 0;
+			s0 = this.rotateLeft(s0 + v0 & this.config.MAX_32BIT ^ s2, 7);
+			s1 = this.rotateLeft((v0 ^ s1) + s3 & this.config.MAX_32BIT, 11);
+			s2 = this.rotateLeft(s2 + v1 & this.config.MAX_32BIT ^ s0, 13);
+			s3 = this.rotateLeft((s3 ^ v1) + s1 & this.config.MAX_32BIT, 17);
+		}
+		const t0 = s0 ^ length;
+		const t1 = s1 ^ t0;
+		const t2 = s2 + t1 & this.config.MAX_32BIT;
+		const t3 = s3 ^ t2;
+		const rotT0 = this.rotateLeft(t0, 9);
+		const rotT1 = this.rotateLeft(t1, 13);
+		const rotT2 = this.rotateLeft(t2, 17);
+		const rotT3 = this.rotateLeft(t3, 19);
+		s0 = rotT0 + rotT2 & this.config.MAX_32BIT;
+		s1 = rotT1 ^ rotT3;
+		s2 = rotT2 + s0 & this.config.MAX_32BIT;
+		s3 = rotT3 ^ s1;
+		const result = [];
+		for (const s of [
+			s0,
+			s1,
+			s2,
+			s3
+		]) result.push(...this.intToLeBytes(s, 4));
+		return result;
+	}
+	/**
+	* Build 144-byte payload array (mns0301 version)
+	*
+	* @param hexParameter - 32-char hex (MD5 of uri+data), used for the MD5 XOR segment
+	* @param hexMd5Path - 32-char hex path hash (GET: MD5 of uri+params, POST: MD5 of uri)
+	* @param a1Value - a1 value from cookies
+	* @param appIdentifier - Application identifier, default "xhs-pc-web"
+	* @param stringParam - String parameter (URI+data, used for length calculation)
+	* @param timestamp - Unix timestamp in seconds (defaults to current time)
+	* @param signState - Optional session state
+	*/
+	buildPayloadArray(hexParameter, hexMd5Path, a1Value, appIdentifier = "xhs-pc-web", stringParam = "", timestamp, signState) {
+		if (timestamp === void 0) timestamp = Date.now() / 1e3;
+		const seed = this.randomGen.generateRandomInt();
+		const seedByte = seed & 255;
+		const payload = [];
+		payload.push(...this.config.VERSION_BYTES);
+		payload.push(...this.intToLeBytes(seed, 4));
+		const tsBytes = this.intToLeBytes(Math.floor(timestamp * 1e3), this.config.TIMESTAMP_LE_LENGTH);
+		payload.push(...tsBytes);
+		if (signState) {
+			payload.push(...this.intToLeBytes(signState.pageLoadTimestamp, this.config.TIMESTAMP_LE_LENGTH));
+			payload.push(...this.intToLeBytes(signState.sequenceValue, 4));
+			payload.push(...this.intToLeBytes(signState.windowPropsLength, 4));
+			payload.push(...this.intToLeBytes(signState.uriLength, 4));
+		} else {
+			const timeOffset = this.randomGen.generateRandomByteInRange(this.config.ENV_FINGERPRINT_TIME_OFFSET_MIN, this.config.ENV_FINGERPRINT_TIME_OFFSET_MAX);
+			const effectiveTsMs = Math.floor((timestamp - timeOffset) * 1e3);
+			payload.push(...this.intToLeBytes(effectiveTsMs, this.config.TIMESTAMP_LE_LENGTH));
+			const sequenceValue = this.randomGen.generateRandomByteInRange(this.config.SEQUENCE_VALUE_MIN, this.config.SEQUENCE_VALUE_MAX);
+			payload.push(...this.intToLeBytes(sequenceValue, 4));
+			const windowPropsLength = this.randomGen.generateRandomByteInRange(this.config.WINDOW_PROPS_LENGTH_MIN, this.config.WINDOW_PROPS_LENGTH_MAX);
+			payload.push(...this.intToLeBytes(windowPropsLength, 4));
+			const uriLength = Buffer.from(stringParam, "utf-8").length;
+			payload.push(...this.intToLeBytes(uriLength, 4));
+		}
+		const md5Bytes = Buffer.from(hexParameter, "hex");
+		for (let i = 0; i < this.config.MD5_XOR_LENGTH; i++) payload.push(md5Bytes[i] ^ seedByte);
+		const a1Bytes = Buffer.from(a1Value, "utf-8").subarray(0, this.config.A1_LENGTH);
+		const a1Padded = Buffer.alloc(this.config.A1_LENGTH);
+		a1Bytes.copy(a1Padded);
+		payload.push(a1Padded.length);
+		payload.push(...Array.from(a1Padded));
+		const appBytes = Buffer.from(appIdentifier, "utf-8").subarray(0, this.config.APP_ID_LENGTH);
+		const appPadded = Buffer.alloc(this.config.APP_ID_LENGTH);
+		appBytes.copy(appPadded);
+		payload.push(appPadded.length);
+		payload.push(...Array.from(appPadded));
+		const part11 = [1, seedByte ^ this.config.ENV_TABLE[0]];
+		for (let i = 1; i < 15; i++) part11.push(this.config.ENV_TABLE[i] ^ this.config.ENV_CHECKS_DEFAULT[i]);
+		payload.push(...part11);
+		const md5PathBytes = [];
+		for (let i = 0; i < 32; i += 2) md5PathBytes.push(parseInt(hexMd5Path.substring(i, i + 2), 16));
+		const a3Hash = this.customHashV2([...tsBytes, ...md5PathBytes]);
+		const a3Field = [...this.config.A3_PREFIX, ...a3Hash.map((b) => b ^ seedByte)];
+		payload.push(...a3Field);
+		return payload;
+	}
+};
+/**
+* Browser fingerprint data constants
+*/
+var GPU_VENDORS = [
+	"Google Inc. (Intel)|ANGLE (Intel, Intel(R) HD Graphics 400 (0x00000166) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (Intel)|ANGLE (Intel, Intel(R) HD Graphics 4400 (0x00001112) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (Intel)|ANGLE (Intel, Intel(R) HD Graphics 4600 (0x00000412) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (Intel)|ANGLE (Intel, Intel(R) HD Graphics 520 (0x1912) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (Intel)|ANGLE (Intel, Intel(R) HD Graphics 530 (0x00001912) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (Intel)|ANGLE (Intel, Intel(R) HD Graphics 550 (0x00001512) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (Intel)|ANGLE (Intel, Intel(R) HD Graphics 6000 (0x1606) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (Intel)|ANGLE (Intel, Intel(R) Iris(TM) Graphics 540 (0x1912) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (Intel)|ANGLE (Intel, Intel(R) Iris(TM) Graphics 550 (0x1913) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (Intel)|ANGLE (Intel, Intel(R) Iris(TM) Plus Graphics 640 (0x161C) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (Intel)|ANGLE (Intel, Intel(R) UHD Graphics 600 (0x3E80) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (Intel)|ANGLE (Intel, Intel(R) UHD Graphics 620 (0x00003EA0) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (Intel)|ANGLE (Intel, Intel(R) UHD Graphics 630 (0x00003E9B) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (Intel)|ANGLE (Intel, Intel(R) UHD Graphics 655 (0x00009BC8) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (Intel)|ANGLE (Intel, Intel(R) Iris(R) Xe Graphics (0x000046A8) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (Intel)|ANGLE (Intel, Intel(R) Iris(R) Xe Graphics (0x00009A49) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (Intel)|ANGLE (Intel, Intel(R) Iris(R) Xe MAX Graphics (0x00009BC0) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (Intel)|ANGLE (Intel, Intel Arc A370M (0x0000AF51) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (Intel)|ANGLE (Intel, Intel Arc A380 (0x0000AF41) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (Intel)|ANGLE (Intel, Intel Arc A380M (0x0000AF5E) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (Intel)|ANGLE (Intel, Intel Arc A550 (0x0000AF42) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (Intel)|ANGLE (Intel, Intel Arc A770 (0x0000AF43) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (Intel)|ANGLE (Intel, Intel Arc A770M (0x0000AF50) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (Intel)|ANGLE (Intel, Mesa Intel(R) Graphics (RPL‑P GT1) (0x0000A702) OpenGL 4.6)",
+	"Google Inc. (Intel)|ANGLE (Intel, Mesa Intel(R) UHD Graphics 770 (0x00004680) OpenGL 4.6)",
+	"Google Inc. (Intel)|ANGLE (Intel, Mesa Intel(R) HD Graphics 4400 (0x00001122) OpenGL 4.6)",
+	"Google Inc. (Intel)|ANGLE (Intel, Mesa Intel(R) Graphics (ADL‑S GT1) (0x0000A0A1) OpenGL 4.6)",
+	"Google Inc. (Intel)|ANGLE (Intel, Mesa Intel(R) Graphics (RKL GT1) (0x0000A9A1) OpenGL 4.6)",
+	"Google Inc. (Intel)|ANGLE (Intel, Mesa Intel(R) UHD Graphics (CML GT2) (0x00009A14) OpenGL 4.6)",
+	"Google Inc. (Intel)|ANGLE (Intel, Intel(R) HD Graphics 3000 (0x00001022) Direct3D9Ex vs_3_0 ps_3_0, igdumd64.dll)",
+	"Google Inc. (Intel)|ANGLE (Intel, Intel(R) HD Graphics Family (0x00000A16) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (Intel)|ANGLE (Intel, Intel(R) Iris Pro OpenGL Engine, OpenGL 4.1)",
+	"Google Inc. (Intel)|ANGLE (Intel, Intel(R) Iris(TM) Plus Graphics 645 (0x1616) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (Intel)|ANGLE (Intel, Intel(R) Iris(TM) Plus Graphics 655 (0x161E) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (Intel)|ANGLE (Intel, Intel(R) UHD Graphics 730 (0x0000A100) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (Intel)|ANGLE (Intel, Intel(R) UHD Graphics 805 (0x0000B0A0) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (AMD)|ANGLE (AMD, AMD Radeon Vega 3 Graphics (0x000015E0) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (AMD)|ANGLE (AMD, AMD Radeon Vega 8 Graphics (0x000015D8) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (AMD)|ANGLE (AMD, AMD Radeon Vega 11 Graphics (0x000015DD) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (AMD)|ANGLE (AMD, AMD Radeon Graphics (0x00001636) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (AMD)|ANGLE (AMD, AMD Radeon RX 5500 XT Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (AMD)|ANGLE (AMD, AMD Radeon RX 560 (0x000067EF) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (AMD)|ANGLE (AMD, AMD Radeon RX 570 (0x000067DF) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (AMD)|ANGLE (AMD, AMD Radeon RX 580 2048SP (0x00006FDF) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (AMD)|ANGLE (AMD, AMD Radeon RX 590 (0x000067FF) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (AMD)|ANGLE (AMD, AMD Radeon RX 6600 (0x000073FF) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (AMD)|ANGLE (AMD, AMD Radeon RX 6600 XT (0x000073FF) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (AMD)|ANGLE (AMD, AMD Radeon RX 6650 XT Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (AMD)|ANGLE (AMD, AMD Radeon RX 6700 XT (0x000073DF) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (AMD)|ANGLE (AMD, AMD Radeon RX 6800 (0x000073BF) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (AMD)|ANGLE (AMD, AMD Radeon RX 6900 XT (0x000073C2) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (AMD)|ANGLE (AMD, AMD Radeon RX 7700 XT Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (AMD)|ANGLE (AMD, AMD Radeon Pro 5300M OpenGL Engine, OpenGL 4.1)",
+	"Google Inc. (AMD)|ANGLE (AMD, AMD Radeon Pro 5500 XT OpenGL Engine, OpenGL 4.1)",
+	"Google Inc. (AMD)|ANGLE (AMD, AMD Radeon R7 370 Series (0x00006811) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (AMD)|ANGLE (AMD, ATI Technologies Inc. AMD Radeon RX Vega 64 OpenGL Engine, OpenGL 4.1)",
+	"Google Inc. (NVIDIA)|ANGLE (NVIDIA, NVIDIA GeForce GTX 1050 (0x00001C81) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (NVIDIA)|ANGLE (NVIDIA, NVIDIA GeForce GTX 1050 Ti (0x00001C8C) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (NVIDIA)|ANGLE (NVIDIA, NVIDIA GeForce GTX 1060 6GB (0x000010DE) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (NVIDIA)|ANGLE (NVIDIA, NVIDIA GeForce GTX 1070 (0x00001B81) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (NVIDIA)|ANGLE (NVIDIA, NVIDIA GeForce GTX 1080 (0x00001B80) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (NVIDIA)|ANGLE (NVIDIA, NVIDIA GeForce RTX 2060 (0x00001F06) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (NVIDIA)|ANGLE (NVIDIA, NVIDIA GeForce RTX 2060 SUPER (0x00001F06) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (NVIDIA)|ANGLE (NVIDIA, NVIDIA GeForce RTX 2070 (0x00001F10) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (NVIDIA)|ANGLE (NVIDIA, NVIDIA GeForce RTX 2070 SUPER (0x00001F10) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (NVIDIA)|ANGLE (NVIDIA, NVIDIA GeForce RTX 3060 (0x0000250F) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (NVIDIA)|ANGLE (NVIDIA, NVIDIA GeForce RTX 3060 Ti (0x00002489) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (NVIDIA)|ANGLE (NVIDIA, NVIDIA GeForce RTX 3070 (0x00002488) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (NVIDIA)|ANGLE (NVIDIA, NVIDIA GeForce RTX 3070 Ti (0x000028A5) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (NVIDIA)|ANGLE (NVIDIA, NVIDIA GeForce RTX 3080 (0x00002206) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (NVIDIA)|ANGLE (NVIDIA, NVIDIA GeForce RTX 3080 Ti (0x00002208) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (NVIDIA)|ANGLE (NVIDIA, NVIDIA GeForce RTX 3090 (0x00002204) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (NVIDIA)|ANGLE (NVIDIA, NVIDIA GeForce RTX 4060 (0x00002882) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (NVIDIA)|ANGLE (NVIDIA, NVIDIA GeForce RTX 4060 Ti (0x00002803) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (NVIDIA)|ANGLE (NVIDIA, NVIDIA GeForce RTX 4070 (0x00002786) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (NVIDIA)|ANGLE (NVIDIA, NVIDIA GeForce RTX 4070 Ti (0x00002857) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (NVIDIA)|ANGLE (NVIDIA, NVIDIA GeForce RTX 4080 (0x00002819) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (NVIDIA)|ANGLE (NVIDIA, NVIDIA GeForce RTX 4090 (0x00002684) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (NVIDIA)|ANGLE (NVIDIA, NVIDIA Quadro RTX 5000 Ada Generation (0x000026B2) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (NVIDIA)|ANGLE (NVIDIA, NVIDIA Quadro P400 (0x00001CB3) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+	"Google Inc. (Google)|ANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver)",
+	"Google Inc. (Google)|ANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero)), SwiftShader driver)",
+	"Google Inc. (Google)|ANGLE (Google, Vulkan 1.3.0 (SwiftShader Device), SwiftShader driver)"
+];
+var SCREEN_RESOLUTIONS = {
+	resolutions: [
+		"1366;768",
+		"1600;900",
+		"1920;1080",
+		"2560;1440",
+		"3840;2160",
+		"7680;4320"
+	],
+	weights: [
+		.25,
+		.15,
+		.35,
+		.15,
+		.08,
+		.02
+	]
+};
+var COLOR_DEPTH_OPTIONS = {
+	values: [
+		16,
+		24,
+		30,
+		32
+	],
+	weights: [
+		.05,
+		.6,
+		.05,
+		.3
+	]
+};
+var DEVICE_MEMORY_OPTIONS = {
+	values: [
+		1,
+		2,
+		4,
+		8,
+		12,
+		16
+	],
+	weights: [
+		.1,
+		.25,
+		.4,
+		.2,
+		.03,
+		.01
+	]
+};
+var CORE_OPTIONS = {
+	values: [
+		2,
+		4,
+		6,
+		8,
+		12,
+		16,
+		24,
+		32
+	],
+	weights: [
+		.1,
+		.4,
+		.2,
+		.15,
+		.08,
+		.04,
+		.02,
+		.01
+	]
+};
+var BROWSER_PLUGINS = "PDF Viewer,Chrome PDF Viewer,Chromium PDF Viewer,Microsoft Edge PDF Viewer,WebKit built-in PDF";
+var VOICE_HASH_OPTIONS = "10311144241322244122";
+/**
+* b1 的 x82：首位 `1` + 页面 `window` 自有的非标准键（按 `Object.keys` 顺序取前 14 个），`|` 连接后截到 300 字符。
+* 2026-10-07 在 Edge 154 无扩展、无登录的隔离上下文里打开 explore 实测（fp 脚本 `as/v2/fp/c4a1036f…`）；
+* 这里存的是截断前的 14 个键，最后一段被 300 字符截断是浏览器的原样行为。
+*/
+var B1_PAGE_GLOBALS = [
+	"_BHjFmfUMEtxhI",
+	"_AUuXfEG27Xa3x",
+	"__XHS_AGENT_V2",
+	"__xhsPendingNotePoint25300ReportMap",
+	"__xhsReportedNotePoint25300RecordMap",
+	"anti_hp_sign_config",
+	"__rap_app_id__",
+	"__rap_report__",
+	"__rap_last_sign_cost__",
+	"__rap_last_transform_cost__",
+	"__rap_hijack_installed__",
+	"__ed1a7dddf7c818e4bd",
+	"__hp_xhs_search_input_state__",
+	"__hp_xhs_search_submit_state__"
+];
+var FONTS = "system-ui, \"Apple Color Emoji\", \"Segoe UI Emoji\", \"Segoe UI Symbol\", \"Noto Color Emoji\", -apple-system, \"Segoe UI\", Roboto, Ubuntu, Cantarell, \"Noto Sans\", sans-serif, BlinkMacSystemFont, \"Helvetica Neue\", Arial, \"PingFang SC\", \"PingFang TC\", \"PingFang HK\", \"Microsoft Yahei\", \"Microsoft JhengHei\"";
+/**
+* Fingerprint generation helper functions
+*/
+/**
+* Random choice a value from list according to the given weights
+*/
+function weightedRandomChoice(options, weights) {
+	const totalWeight = weights.reduce((sum, w) => sum + w, 0);
+	let random = Math.random() * totalWeight;
+	for (let i = 0; i < options.length; i++) {
+		random -= weights[i];
+		if (random <= 0) return String(options[i]);
+	}
+	return String(options[options.length - 1]);
+}
+/**
+* Get random GPU renderer information
+*/
+function getRendererInfo() {
+	const [vendor, renderer] = GPU_VENDORS[Math.floor(Math.random() * GPU_VENDORS.length)].split("|");
+	return [vendor, renderer];
+}
+/**
+* Get random screen configuration with width, height, and available dimensions
+*/
+function getScreenConfig() {
+	const [widthStr, heightStr] = weightedRandomChoice(SCREEN_RESOLUTIONS.resolutions, SCREEN_RESOLUTIONS.weights).split(";");
+	const width = parseInt(widthStr, 10);
+	const height = parseInt(heightStr, 10);
+	let availWidth;
+	let availHeight;
+	if (Math.random() < .5) {
+		availWidth = width - parseInt(weightedRandomChoice([
+			0,
+			30,
+			60,
+			80
+		], [
+			.1,
+			.4,
+			.3,
+			.2
+		]), 10);
+		availHeight = height;
+	} else {
+		availWidth = width;
+		availHeight = height - parseInt(weightedRandomChoice([
+			30,
+			60,
+			80,
+			100
+		], [
+			.2,
+			.5,
+			.2,
+			.1
+		]), 10);
+	}
+	return {
+		width,
+		height,
+		availWidth,
+		availHeight
+	};
+}
+/**
+* Generate WebGL fingerprint hash
+*/
+function generateWebglHash() {
+	return createHash("md5").update(randomBytes(32)).digest("hex");
+}
+/**
+* Browser fingerprint generator
+*/
+/** b1 只取指纹里的这 19 个键，顺序即浏览器 JSON 的键序 */
+var B1_KEYS = [
+	"x33",
+	"x34",
+	"x35",
+	"x36",
+	"x37",
+	"x38",
+	"x39",
+	"x42",
+	"x43",
+	"x44",
+	"x45",
+	"x46",
+	"x48",
+	"x49",
+	"x50",
+	"x51",
+	"x52",
+	"x82",
+	"x84"
+];
+var FingerprintGenerator = class {
+	config;
+	b1Key;
+	encoder;
+	constructor(config) {
+		this.config = config || new CryptoConfig();
+		this.b1Key = Buffer.from(this.config.B1_SECRET_KEY, "utf8");
+		this.encoder = new Base64Encoder(this.config);
+	}
+	/**
+	* Generate b1 parameter from fingerprint
+	*
+	* 格式：customBase64(UTF-8(RC4(JSON(19 键), B1_SECRET_KEY)))。RC4 密文按 latin1 读成字符串后再走
+	* UTF-8，所以 ≥0x80 的字节各占两个字节 —— 与 Python 版 `quote` + 按 `%` 拆字节等价。
+	* 2026-10-07 用 Edge 154 的 `localStorage.b1` 反解确认（fp 脚本 `as/v2/fp/c4a1036f…`）。
+	* 旧实现把字节数组再 `JSON.stringify` 一次才编码，产出的是浏览器从不会发的「数字数组文本」。
+	*/
+	generateB1(fp) {
+		const b1Fp = {};
+		for (const key of B1_KEYS) b1Fp[key] = fp[key];
+		return this.encoder.encode(this.rc4Encrypt(JSON.stringify(b1Fp), this.b1Key));
+	}
+	/**
+	* RC4 encryption implementation
+	*/
+	rc4Encrypt(data, key) {
+		const S = new Array(256);
+		for (let i = 0; i < 256; i++) S[i] = i;
+		let j = 0;
+		for (let i = 0; i < 256; i++) {
+			j = (j + S[i] + key[i % key.length]) % 256;
+			[S[i], S[j]] = [S[j], S[i]];
+		}
+		const dataBytes = Buffer.from(data, "utf8");
+		const result = Buffer.alloc(dataBytes.length);
+		let i = 0;
+		j = 0;
+		for (let k = 0; k < dataBytes.length; k++) {
+			i = (i + 1) % 256;
+			j = (j + S[i]) % 256;
+			[S[i], S[j]] = [S[j], S[i]];
+			const t = (S[i] + S[j]) % 256;
+			result[k] = dataBytes[k] ^ S[t];
+		}
+		return result.toString("latin1");
+	}
+	/**
+	* Generate browser fingerprint
+	*/
+	generate(cookies, userAgent) {
+		const cookieString = Object.entries(cookies).map(([k, v]) => `${k}=${v}`).join("; ");
+		const screenConfig = getScreenConfig();
+		const isIncognitoMode = weightedRandomChoice(["true", "false"], [.95, .05]);
+		const [vendor, renderer] = getRendererInfo();
+		const x78Y = Math.floor(Math.random() * 100) + 2350;
+		const collectedAt = Date.now() - 100 - Math.floor(Math.random() * 1400);
+		const timeOrigin = Math.round((collectedAt - 3e3 - Math.random() * 11e3) * 10) / 10;
+		return {
+			x1: userAgent,
+			x2: "false",
+			x3: "zh-CN",
+			x4: weightedRandomChoice(COLOR_DEPTH_OPTIONS.values, COLOR_DEPTH_OPTIONS.weights),
+			x5: weightedRandomChoice(DEVICE_MEMORY_OPTIONS.values, DEVICE_MEMORY_OPTIONS.weights),
+			x6: "24",
+			x7: `${vendor},${renderer}`,
+			x8: weightedRandomChoice(CORE_OPTIONS.values, CORE_OPTIONS.weights),
+			x9: `${screenConfig.width};${screenConfig.height}`,
+			x10: `${screenConfig.availWidth};${screenConfig.availHeight}`,
+			x11: "-480",
+			x12: "Asia/Shanghai",
+			x13: isIncognitoMode,
+			x14: isIncognitoMode,
+			x15: isIncognitoMode,
+			x16: "false",
+			x17: "false",
+			x18: "un",
+			x19: "Win32",
+			x20: "",
+			x21: BROWSER_PLUGINS,
+			x22: generateWebglHash(),
+			x23: "false",
+			x24: "false",
+			x25: "false",
+			x26: "false",
+			x27: "false",
+			x28: "0,false,false",
+			x29: "4,7,8",
+			x30: "swf object not loaded",
+			x33: "0",
+			x34: "0",
+			x35: "0",
+			x36: `${Math.floor(Math.random() * 20) + 1}`,
+			x37: "0|0|0|0|0|0|0|0|0|1|0|0|1|0|0|0|0|1|1|0|0|0|0|0",
+			x38: "0|0|1|0|1|0|0|0|0|0|1|0|1|0|1|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0",
+			x39: "0",
+			x40: "0",
+			x41: "0",
+			x42: "3.5.6",
+			x43: "Canvas not supported",
+			x44: `${collectedAt}`,
+			x45: "__SEC_CAV__1-1-1-1-1|",
+			x46: "false",
+			x47: "1|0|0|0|0|0",
+			x48: "",
+			x49: "{list:[],type:}",
+			x50: "",
+			x51: "",
+			x52: "",
+			x55: "380,380,360,400,380,400,420,380,400,400,360,360,440,420",
+			x56: `${vendor}|${renderer}|${generateWebglHash()}|35`,
+			x57: cookieString,
+			x58: "180",
+			x59: "2",
+			x60: "63",
+			x61: "1291",
+			x62: "2047",
+			x63: "0",
+			x64: "0",
+			x65: "0",
+			x66: {
+				referer: "",
+				location: "https://www.xiaohongshu.com/explore",
+				frame: 0
+			},
+			x67: "1|0",
+			x68: "0",
+			x69: "326|1292|30",
+			x70: ["location"],
+			x71: "true",
+			x72: "complete",
+			x73: "1191",
+			x74: "0|0|0",
+			x75: "Google Inc.",
+			x76: "true",
+			x77: "1|1|1|1|1|1|1|1|1|1",
+			x78: {
+				x: 0,
+				y: x78Y,
+				left: 0,
+				right: 290.828125,
+				bottom: x78Y + 18,
+				height: 18,
+				top: x78Y,
+				width: 290.828125,
+				font: FONTS
+			},
+			x82: `1|${B1_PAGE_GLOBALS.join("|")}`.slice(0, 300),
+			x84: `{mt:{to:${timeOrigin}},m:{},k:{},p:{ulr:0,f:1,ps:1},st:{h:0,f:1,kr:0},ft:{ae:null,ak:null,cdr:null,bf:null,fi:null}}`,
+			x31: "124.04347527516074",
+			x79: "144|599565058866",
+			x53: createHash("md5").update(randomBytes(32)).digest("hex"),
+			x54: VOICE_HASH_OPTIONS,
+			x80: "1|[object FileSystemDirectoryHandle]"
+		};
+	}
+	/**
+	* Update fingerprint with new cookies and URL
+	*/
+	update(fp, cookies, url) {
+		const cookieString = Object.entries(cookies).map(([k, v]) => `${k}=${v}`).join("; ");
+		fp.x39 = "0";
+		fp.x44 = `${Date.now()}`;
+		fp.x57 = cookieString;
+		fp.x66 = {
+			referer: "https://www.xiaohongshu.com/explore",
+			location: url,
+			frame: 0
+		};
+	}
+};
+/** b1 按不透明字符串保留；undefined 表示未提供。 */
+function validateB1(b1) {
+	if (b1 !== void 0 && (typeof b1 !== "string" || b1.trim().length === 0)) throw new TypeError("b1 必须是非空字符串");
+}
+/**
+* Custom CRC32 helper class.
+*
+* This implements a JavaScript-style CRC32 variant compatible with:
+*   (-1 ^ c ^ 0xEDB88320) >>> 0
+* where `c` is the intermediate CRC state produced by the core CRC32 loop.
+*/
+var MASK32 = 4294967295;
+var POLY = 3988292384;
+var TABLE = null;
+function ensureTable() {
+	if (TABLE !== null) return TABLE;
+	const tbl = new Array(256);
+	for (let d = 0; d < 256; d++) {
+		let r = d;
+		for (let i = 0; i < 8; i++) {
+			r = r & 1 ? r >>> 1 ^ POLY : r >>> 1;
+			r = r >>> 0;
+		}
+		tbl[d] = r;
+	}
+	TABLE = tbl;
+	return TABLE;
+}
+function crc32Core(data, stringMode = "js") {
+	const table = ensureTable();
+	let c = MASK32;
+	let bytes;
+	if (typeof data === "string") {
+		if (stringMode === "utf8") bytes = Array.from(Buffer.from(data, "utf8"));
+		else {
+			bytes = [];
+			for (let i = 0; i < data.length; i++) bytes.push(data.charCodeAt(i) & 255);
+		}
+	} else bytes = data.map((b) => b & 255);
+	for (const b of bytes) c = (table[(c & 255 ^ b) & 255] ^ c >>> 8) >>> 0;
+	return c;
+}
+function toSigned32(u) {
+	return u & 2147483648 ? u - 4294967296 : u;
+}
+var CRC32 = class {
+	/**
+	* JavaScript-style CRC32 public entry.
+	*
+	* This matches the JS expression:
+	*   (-1 ^ c ^ 0xEDB88320) >>> 0
+	*/
+	static crc32JsInt(data, options = {}) {
+		const { stringMode = "js", signed = true } = options;
+		const u = (crc32Core(data, stringMode) ^ 306674911) >>> 0;
+		return signed ? toSigned32(u) : u;
+	}
+};
+/**
+* x-s-common signature generation
+*/
+var XsCommonSigner = class {
+	config;
+	encoder;
+	constructor(config) {
+		this.config = config || new CryptoConfig();
+		this.encoder = new Base64Encoder(this.config);
+	}
+	/**
+	* Generate x-s-common signature
+	*/
+	sign(cookieDict, options = {}) {
+		const a1Value = cookieDict.a1;
+		if (!a1Value) throw new Error("Missing 'a1' in cookies");
+		let b1 = options.b1;
+		validateB1(b1);
+		if (b1 === void 0) {
+			const fpGenerator = new FingerprintGenerator(this.config);
+			b1 = fpGenerator.generateB1(fpGenerator.generate(cookieDict, this.config.PUBLIC_USERAGENT));
+		}
+		const x9 = CRC32.crc32JsInt(b1);
+		const signStruct = { ...this.config.SIGNATURE_XSCOMMON_TEMPLATE };
+		signStruct.x5 = a1Value;
+		signStruct.x8 = b1;
+		signStruct.x9 = x9;
+		if (cookieDict.webBuild) signStruct.x4 = cookieDict.webBuild;
+		const signJson = JSON.stringify(signStruct);
+		return this.encoder.encode(signJson);
+	}
+};
+/**
+* XYW_ signature crypto (AES-128-CBC).
+*
+* Ported from the upstream Python `core/xyw_crypto.py`. Data-fetching APIs
+* (user_posted, otherinfo, etc.) reject the traditional XYS_ format with HTTP
+* 406; the XYW_ format uses an independent AES-128-CBC crypto path.
+*
+* The upstream ships a hand-rolled AES-128 implementation. Since it is
+* standard AES-128 (identical S-box, RCON, key schedule and MixColumns), this
+* port uses Node's native `aes-128-cbc` cipher, which produces byte-identical
+* ciphertext while being far less error-prone.
+*/
+var AES_BLOCK_SIZE = 16;
+/**
+* Apply PKCS#7 padding to a byte buffer.
+*/
+function pkcs7Pad(data) {
+	const padLen = AES_BLOCK_SIZE - data.length % AES_BLOCK_SIZE;
+	return Buffer.concat([data, Buffer.alloc(padLen, padLen)]);
+}
+/**
+* AES-128-CBC cipher matching the upstream XYW implementation.
+*/
+var XywCipher = class {
+	key;
+	iv;
+	constructor(key, iv) {
+		if (key.length !== AES_BLOCK_SIZE) throw new Error("AES-128 requires a 16-byte key");
+		if (iv.length !== AES_BLOCK_SIZE) throw new Error("AES-CBC IV must be 16 bytes");
+		this.key = key;
+		this.iv = iv;
+	}
+	/**
+	* Encrypt PKCS#7-padded plaintext with AES-128-CBC.
+	*
+	* @param plaintextBytes - Plaintext, already padded to a 16-byte boundary
+	* @returns Ciphertext bytes
+	*/
+	encrypt(plaintextBytes) {
+		if (plaintextBytes.length % AES_BLOCK_SIZE !== 0) throw new Error("plaintextBytes must be PKCS#7 padded to a 16-byte boundary");
+		const cipher = createCipheriv("aes-128-cbc", this.key, this.iv);
+		cipher.setAutoPadding(false);
+		return Buffer.concat([cipher.update(plaintextBytes), cipher.final()]);
+	}
+};
+/**
+* Build the hex-encoded payload for an XYW_ signature.
+*
+* @param options.fullUri - The content string (uri + params/body)
+* @param options.a1Value - a1 value from cookies
+* @param options.timestampMs - Millisecond timestamp string
+* @param options.config - Crypto configuration
+* @param options.envFlags - Optional environment flags string
+* @returns Hex-encoded AES-128-CBC ciphertext
+*/
+function buildXywPayloadHex(options) {
+	const { fullUri, a1Value, timestampMs, config, envFlags } = options;
+	const x1 = createHash("md5").update(`url=${fullUri}`).digest("hex");
+	const x2 = envFlags || config.XYW_ENV_FLAGS_DEFAULT;
+	const message = Buffer.from(`x1=${x1};x2=${x2};x3=${a1Value};x4=${timestampMs};`);
+	const plaintext = pkcs7Pad(Buffer.from(message.toString("base64")));
+	return new XywCipher(Buffer.from(config.XYW_AES_KEY, "utf-8"), Buffer.from(config.XYW_AES_IV, "utf-8")).encrypt(plaintext).toString("hex");
+}
+/**
+* x-rap-param generation.
+*
+* Ported from the upstream Python `core/xrap.py`. Required for feed, search,
+* and note-publishing endpoints. Builds a TLV body structure, gzip-compresses
+* it, then XOR + block-encrypts and wraps it in a base64 envelope.
+*
+* 分组密码这一层此前被当成「换了 S 盒和轮密钥的 SM4 变体」，实际是**换了 S 盒的
+* AES-128** —— 轮函数、T 表构造、ShiftRows、末轮置换都与 AES 一致，只换了那张
+* 256 项代换表。据此 11 组轮密钥不必再抄成魔数：用 ASCII 主密钥
+* `kqI1DTcwKX90ZtAy` 配合同一张 S 盒做标准 AES 密钥展开，可逐字复现
+* SDK 里硬编码的全部 11 组（含末轮），见 {@link expandXrapKey}。
+* 这样平台换密钥时只需替换 16 字节，而不是重新逆一遍常量池。
+*/
+var cfg = new CryptoConfig();
+var XRAP_SDK_VERSION = cfg.XRAP_SDK_VERSION;
+var SBOX = [
+	122,
+	1,
+	88,
+	224,
+	80,
+	78,
+	2,
+	121,
+	29,
+	75,
+	83,
+	218,
+	107,
+	72,
+	212,
+	82,
+	237,
+	119,
+	18,
+	33,
+	20,
+	21,
+	236,
+	16,
+	24,
+	229,
+	185,
+	241,
+	12,
+	8,
+	252,
+	125,
+	249,
+	205,
+	181,
+	200,
+	230,
+	55,
+	38,
+	135,
+	86,
+	186,
+	184,
+	43,
+	173,
+	240,
+	104,
+	247,
+	139,
+	141,
+	211,
+	94,
+	54,
+	77,
+	46,
+	146,
+	49,
+	130,
+	242,
+	41,
+	112,
+	61,
+	45,
+	215,
+	182,
+	64,
+	178,
+	67,
+	68,
+	128,
+	120,
+	210,
+	13,
+	73,
+	74,
+	9,
+	99,
+	108,
+	7,
+	58,
+	158,
+	213,
+	6,
+	198,
+	225,
+	98,
+	244,
+	52,
+	36,
+	89,
+	169,
+	87,
+	42,
+	0,
+	62,
+	23,
+	44,
+	10,
+	26,
+	66,
+	250,
+	147,
+	190,
+	220,
+	245,
+	179,
+	106,
+	19,
+	232,
+	3,
+	199,
+	151,
+	187,
+	115,
+	118,
+	134,
+	227,
+	70,
+	114,
+	71,
+	208,
+	5,
+	76,
+	56,
+	124,
+	31,
+	129,
+	171,
+	117,
+	81,
+	235,
+	243,
+	50,
+	116,
+	17,
+	143,
+	132,
+	137,
+	156,
+	113,
+	34,
+	126,
+	157,
+	207,
+	63,
+	145,
+	105,
+	101,
+	60,
+	109,
+	150,
+	162,
+	152,
+	153,
+	51,
+	57,
+	154,
+	202,
+	195,
+	159,
+	160,
+	188,
+	228,
+	163,
+	164,
+	84,
+	127,
+	167,
+	168,
+	4,
+	111,
+	93,
+	172,
+	183,
+	39,
+	175,
+	176,
+	40,
+	65,
+	174,
+	180,
+	110,
+	11,
+	27,
+	223,
+	142,
+	48,
+	177,
+	254,
+	144,
+	97,
+	96,
+	192,
+	203,
+	92,
+	14,
+	239,
+	22,
+	131,
+	234,
+	32,
+	233,
+	201,
+	85,
+	196,
+	69,
+	133,
+	204,
+	30,
+	170,
+	103,
+	138,
+	123,
+	53,
+	214,
+	25,
+	216,
+	217,
+	194,
+	219,
+	148,
+	221,
+	28,
+	222,
+	166,
+	255,
+	248,
+	191,
+	91,
+	90,
+	15,
+	231,
+	193,
+	189,
+	209,
+	102,
+	197,
+	37,
+	238,
+	140,
+	226,
+	95,
+	136,
+	161,
+	59,
+	165,
+	246,
+	206,
+	149,
+	47,
+	100,
+	35,
+	251,
+	253,
+	79,
+	155
+];
+/** AES 密钥展开的轮常量，前 10 轮。 */
+var RCON = [
+	1,
+	2,
+	4,
+	8,
+	16,
+	32,
+	64,
+	128,
+	27,
+	54
+];
+/**
+* 用自定义 S 盒做标准 AES-128 密钥展开。
+*
+* 与教科书 AES 的唯一差别是 `SubWord` 查的是上面那张 {@link SBOX}。
+* 对主密钥 `kqI1DTcwKX90ZtAy` 展开的结果与 SDK 里硬编码的 11 组轮密钥逐字相同 ——
+* 第 0 轮本身就是主密钥的 ASCII 字节（`6b714931 44546377 4b583930 5a744179`）。
+* @param masterKey - 16 字节主密钥
+* @returns 11 组轮密钥，每组 4 个 32 位字；末组即末轮密钥
+*/
+function expandXrapKey(masterKey) {
+	if (masterKey.length !== 16) throw new Error(`x-rap master key must be 16 bytes, got ${masterKey.length}`);
+	const subWord = (w) => (SBOX[w >>> 24 & 255] << 24 | SBOX[w >>> 16 & 255] << 16 | SBOX[w >>> 8 & 255] << 8 | SBOX[w & 255]) >>> 0;
+	const rotWord = (w) => (w << 8 | w >>> 24) >>> 0;
+	const words = [];
+	for (let i = 0; i < 4; i++) words.push(masterKey.readUInt32BE(i * 4));
+	for (let i = 4; i < 44; i++) {
+		let temp = words[i - 1];
+		if (i % 4 === 0) temp = (subWord(rotWord(temp)) ^ RCON[i / 4 - 1] << 24) >>> 0;
+		words.push((words[i - 4] ^ temp) >>> 0);
+	}
+	return Array.from({ length: 11 }, (_, r) => words.slice(r * 4, r * 4 + 4).map((w) => w >>> 0));
+}
+var EXPANDED_KEYS = expandXrapKey(Buffer.from(cfg.XRAP_MASTER_KEY, "ascii"));
+var ROUND_KEYS = EXPANDED_KEYS.slice(0, 10);
+var LAST_ROUND_KEY = EXPANDED_KEYS[10];
+var LAST_ROUND_KEY_BYTES = (() => {
+	const b = Buffer.alloc(16);
+	for (let i = 0; i < 4; i++) b.writeUInt32BE(LAST_ROUND_KEY[i] >>> 0, i * 4);
+	return b;
+})();
+function gfDouble(x) {
+	x <<= 1;
+	return x & 256 ? (x ^ 283) & 255 : x & 255;
+}
+function gfMul(x, n) {
+	if (n === 1) return x;
+	if (n === 2) return gfDouble(x);
+	if (n === 3) return gfDouble(x) ^ x;
+	throw new Error(`unsupported GF multiplier: ${n}`);
+}
+/**
+* Pre-compute 4 shifted T-tables from the S-box for the round function.
+*/
+function buildLookupTables() {
+	const col0 = [];
+	const col1 = [];
+	const col2 = [];
+	const col3 = [];
+	for (const s of SBOX) {
+		const a = gfMul(s, 2);
+		const d = gfMul(s, 3);
+		col0.push((a << 24 | s << 16 | s << 8 | d) >>> 0);
+		col1.push((d << 24 | a << 16 | s << 8 | s) >>> 0);
+		col2.push((s << 24 | d << 16 | a << 8 | s) >>> 0);
+		col3.push((s << 24 | s << 16 | d << 8 | a) >>> 0);
+	}
+	return [
+		col0,
+		col1,
+		col2,
+		col3
+	];
+}
+var [LUT0, LUT1, LUT2, LUT3] = buildLookupTables();
+function readU32BE(buf, off = 0) {
+	return buf.readUInt32BE(off);
+}
+function toCompactJson(data) {
+	if (typeof data === "string") return data;
+	if (Buffer.isBuffer(data) || data instanceof Uint8Array) return Buffer.from(data).toString("utf-8");
+	return JSON.stringify(data);
+}
+function fieldByte(tag, val = 0) {
+	const b = Buffer.alloc(3);
+	b.writeUInt16BE(tag, 0);
+	b.writeUInt8(val & 255, 2);
+	return b;
+}
+function fieldU32(tag, val) {
+	const b = Buffer.alloc(6);
+	b.writeUInt16BE(tag, 0);
+	b.writeUInt32BE(val >>> 0, 2);
+	return b;
+}
+function fieldU64(tag, val) {
+	const b = Buffer.alloc(10);
+	b.writeUInt16BE(tag, 0);
+	b.writeBigUInt64BE(BigInt(val), 2);
+	return b;
+}
+function fieldBlob(tag, data) {
+	const head = Buffer.alloc(6);
+	head.writeUInt16BE(tag, 0);
+	head.writeUInt32BE(data.length >>> 0, 2);
+	return Buffer.concat([head, data]);
+}
+/**
+* Encrypt a single 16-byte block; shorter input is zero-padded on the right.
+*/
+function encryptBlock16(block) {
+	const src = Buffer.from(block);
+	if (src.length > 16) throw new Error("block length must be <= 16");
+	const padded = Buffer.alloc(16);
+	src.copy(padded);
+	let s0 = (readU32BE(padded, 0) ^ ROUND_KEYS[0][0]) >>> 0;
+	let s1 = (readU32BE(padded, 4) ^ ROUND_KEYS[0][1]) >>> 0;
+	let s2 = (readU32BE(padded, 8) ^ ROUND_KEYS[0][2]) >>> 0;
+	let s3 = (readU32BE(padded, 12) ^ ROUND_KEYS[0][3]) >>> 0;
+	for (let rnd = 1; rnd < 10; rnd++) {
+		const rk = ROUND_KEYS[rnd];
+		const n0 = (LUT0[s0 >>> 24 & 255] ^ LUT1[s1 >>> 16 & 255] ^ LUT2[s2 >>> 8 & 255] ^ LUT3[s3 & 255] ^ rk[0]) >>> 0;
+		const n1 = (LUT0[s1 >>> 24 & 255] ^ LUT1[s2 >>> 16 & 255] ^ LUT2[s3 >>> 8 & 255] ^ LUT3[s0 & 255] ^ rk[1]) >>> 0;
+		const n2 = (LUT0[s2 >>> 24 & 255] ^ LUT1[s3 >>> 16 & 255] ^ LUT2[s0 >>> 8 & 255] ^ LUT3[s1 & 255] ^ rk[2]) >>> 0;
+		const n3 = (LUT0[s3 >>> 24 & 255] ^ LUT1[s0 >>> 16 & 255] ^ LUT2[s1 >>> 8 & 255] ^ LUT3[s2 & 255] ^ rk[3]) >>> 0;
+		s0 = n0;
+		s1 = n1;
+		s2 = n2;
+		s3 = n3;
+	}
+	const state = [
+		s0,
+		s1,
+		s2,
+		s3
+	];
+	const out = Buffer.alloc(16);
+	for (let row = 0; row < 4; row++) for (let col = 0; col < 4; col++) {
+		const idx = state[row + col & 3] >>> 24 - 8 * col & 255;
+		out[4 * row + col] = SBOX[idx] ^ LAST_ROUND_KEY_BYTES[4 * row + col];
+	}
+	return out;
+}
+/**
+* Encrypt data by splitting into 16-byte blocks (ECB mode).
+*/
+function encryptBlocks(src) {
+	const parts = [];
+	for (let i = 0; i < src.length; i += 16) parts.push(encryptBlock16(src.subarray(i, i + 16)));
+	return Buffer.concat(parts);
+}
+/**
+* Encrypt the 16-byte session key and append its length.
+*/
+function encryptSessionKey(key) {
+	if (key.length !== 16) throw new Error("session key must be 16 bytes");
+	const len = Buffer.alloc(4);
+	len.writeUInt32BE(16, 0);
+	return Buffer.concat([encryptBlock16(key), len]);
+}
+var DEFAULT_INTERACTION_TRACE = Buffer.from("0002000200004700000000000001ffd9ffa8005c23fff1ffff001501ff90fff9000022fff2ffff001501ffb800770061a5ffe3ffff002a01fffcffe70000f0ffe4ffff002a01ffd30000003e01ffd40000003e01ffc8ffff005301ffbdfffa006901ffbefffb006901ffb1fff4007d01ffa6ffee009301ffa8ffef009301ff9effe900a801ff96ffe600be01ff97ffe600be01ff93ffe500d301ff92ffe500ea01ff92ffe4010501ff92ffe3011b01ff92ffe402d101ff93ffe502f201ff94ffe6040501", "hex");
+var DEFAULT_ENVIRONMENT_SNAPSHOT = Buffer.from("000000010000000000000000fffeffff00000000000000390001ffff00bc00000000006e00020001013400000000012f00000002011a00000000016100000000019f0000000002470000000002790000000002b1", "hex");
+/**
+* Build the pre-compression TLV payload for the RAP parameter.
+*/
+function buildBodyStructure(api, data, options = {}) {
+	const bodyStr = toCompactJson(data);
+	const hashInput = Buffer.from(api + bodyStr, "utf-8");
+	const ts = options.timestampMs === null || options.timestampMs === void 0 ? Math.floor(Date.now()) : Math.floor(options.timestampMs);
+	let key;
+	if (typeof options.sessionKey === "string") key = Buffer.from(options.sessionKey, "ascii");
+	else if (options.sessionKey) key = Buffer.from(options.sessionKey);
+	else key = Buffer.from(RandomGenerator.generateRandomAscii(16), "ascii");
+	if (key.length !== 16) throw new Error("sessionKey must be 16 bytes");
+	const xorByte = options.obfuscationByte === null || options.obfuscationByte === void 0 ? Math.floor(Math.random() * 255) + 1 : options.obfuscationByte & 255;
+	const randNonce = options.nonce === null || options.nonce === void 0 ? Math.floor(Math.random() * 4294967296) >>> 0 : options.nonce >>> 0;
+	const trace = options.interactionTrace ?? DEFAULT_INTERACTION_TRACE;
+	const env = options.environmentSnapshot ?? DEFAULT_ENVIRONMENT_SNAPSHOT;
+	const parts = [];
+	parts.push(fieldU64(1e3, ts));
+	parts.push(fieldU32(1001, randNonce));
+	parts.push(fieldBlob(1002, key));
+	parts.push(fieldU32(1003, xxh32(hashInput)));
+	const flagTags = [];
+	for (let t = 1051; t < 1066; t++) flagTags.push(t);
+	flagTags.push(1070);
+	for (let t = 1066; t < 1070; t++) flagTags.push(t);
+	for (const tag of flagTags) parts.push(fieldByte(tag));
+	parts.push(fieldU32(1100, 0));
+	for (let t = 1071; t < 1074; t++) parts.push(fieldByte(t));
+	parts.push(fieldU32(1075, 1380));
+	parts.push(fieldU32(1076, 44));
+	parts.push(fieldU64(1077, Math.max(0, ts - 1076)));
+	parts.push(fieldBlob(1078, trace));
+	parts.push(fieldU32(1082, 0));
+	parts.push(fieldU32(1084, 0));
+	parts.push(fieldU32(1085, 0));
+	parts.push(fieldU32(1086, 100));
+	parts.push(fieldU64(1087, Math.max(0, ts - 727)));
+	parts.push(fieldBlob(1088, env));
+	parts.push(fieldU32(1090, 0));
+	parts.push(fieldU32(1097, 0));
+	parts.push(fieldU32(1092, 1382));
+	parts.push(fieldU32(1094, 1305));
+	parts.push(fieldU64(1095, Math.max(0, ts - 8588)));
+	parts.push(fieldU32(1093, 0));
+	parts.push(fieldByte(1096));
+	parts.push(fieldBlob(1091, Buffer.from([
+		0,
+		0,
+		255,
+		255
+	])));
+	for (let t = 1151; t < 1157; t++) parts.push(fieldByte(t));
+	const buf = Buffer.concat(parts);
+	const out = Buffer.from(buf);
+	for (let i = 16; i < out.length; i++) out[i] = out[i] ^ xorByte;
+	return out;
+}
+/**
+* Gzip-compress with OS byte patched to match the browser runtime (0x03).
+*/
+function compressBody(raw, mtime, level = 6) {
+	const mt = mtime === null || mtime === void 0 ? Math.floor(Date.now() / 1e3) : mtime;
+	const out = Buffer.from(gzipSync(raw, { level }));
+	if (out.length >= 10) {
+		out.writeUInt32LE(mt >>> 0, 4);
+		out[9] = 3;
+	}
+	return out;
+}
+function cyclicXor(data, key) {
+	const out = Buffer.alloc(data.length);
+	for (let i = 0; i < data.length; i++) out[i] = data[i] ^ key[i % key.length];
+	return out;
+}
+/**
+* Encrypt, wrap, and base64-encode the compressed body into the final x-rap-param.
+*/
+function packEnvelope(compressed, options = {}) {
+	const gz = Buffer.from(compressed);
+	let key;
+	if (typeof options.encryptionKey === "string") key = Buffer.from(options.encryptionKey, "ascii");
+	else if (options.encryptionKey) key = Buffer.from(options.encryptionKey);
+	else key = Buffer.from(RandomGenerator.generateRandomAscii(16), "ascii");
+	if (key.length !== 16) throw new Error("encryptionKey must be 16 bytes");
+	const salt = options.saltString === null || options.saltString === void 0 ? RandomGenerator.generateRandomAscii([
+		4,
+		5,
+		6
+	][Math.floor(Math.random() * 3)]) : options.saltString;
+	const saltBytes = Buffer.from(salt, "ascii");
+	if (saltBytes.length < 0 || saltBytes.length > 255) throw new Error("saltString length must fit one byte");
+	const cipherBlocks = encryptBlocks(cyclicXor(gz, key));
+	const gzLen = Buffer.alloc(4);
+	gzLen.writeUInt32BE(gz.length >>> 0, 0);
+	const cipherBody = Buffer.concat([cipherBlocks, gzLen]);
+	const content = Buffer.concat([
+		saltBytes,
+		encryptSessionKey(key),
+		cipherBody
+	]);
+	const contentHash = xxh32(content);
+	const encTime = options.processingTime === null || options.processingTime === void 0 ? Math.floor(Math.random() * 181) + 60 : options.processingTime;
+	const protocolVersion = options.protocolVersion ?? XRAP_SDK_VERSION;
+	const header = Buffer.alloc(36);
+	header[0] = 7;
+	header[1] = 36;
+	header[2] = 1;
+	header[3] = saltBytes.length & 255;
+	header.writeUInt32BE(1, 4);
+	header.writeUInt32BE(20, 8);
+	header.writeUInt32BE(cipherBody.length >>> 0, 12);
+	header.writeUInt32BE(contentHash >>> 0, 16);
+	header.writeUInt32BE(protocolVersion >>> 0, 20);
+	header.writeUInt32BE(encTime >>> 0, 24);
+	return Buffer.concat([header, content]).toString("base64");
+}
+/**
+* Generate x-rap-param from API path and request payload.
+*
+* @param api - Request API path (e.g. "//edith.xiaohongshu.com/api/sns/web/v1/feed")
+* @param data - Request body as object, JSON string, or raw bytes
+* @param options - Optional deterministic overrides (used for testing)
+* @returns Base64-encoded x-rap-param string
+*/
+function xRapParam(api, data, options = {}) {
+	return packEnvelope(compressBody(buildBodyStructure(api, data, {
+		sessionKey: options.innerKey,
+		timestampMs: options.timestampMs,
+		nonce: options.bodyRand32,
+		obfuscationByte: options.mask,
+		interactionTrace: options.tracePayload,
+		environmentSnapshot: options.envPayload
+	}), options.gzipMtime, options.compresslevel ?? 6), {
+		encryptionKey: options.aesKey,
+		saltString: options.randomString,
+		processingTime: options.bodyEncryTime,
+		protocolVersion: options.sdkVersion ?? XRAP_SDK_VERSION
+	});
+}
+/**
+* XYS 签名的会话 SSK：x6/x7 证明，以及拿到 SSK 的 X25519 交换。
+*
+* 逆自前端 `vendor-dynamic.js` 的 `buildEncSskSign` / `createWebSskExchange`。
+* 2026-09-25 用页面自己签出的 21 条 XYS_（GET 16 / POST 5）逐字节核对，x6/x7 全部一致。
+*/
+/** SSK 至少 32 字节；超出部分原样拼进 x7 尾部。 */
+var SSK_MIN_LENGTH = 32;
+var NONCE_LENGTH = 4;
+var sha1 = (data) => createHash("sha1").update(data).digest();
+function decodeStandardBase64(value) {
+	if (typeof value !== "string" || value.length % 4 !== 0 || !/^[A-Za-z0-9+/]*={0,2}$/.test(value)) throw new Error("Invalid Base64 value");
+	return Buffer.from(value, "base64");
+}
+/**
+* 生成 x7 开头的 4 字节 nonce：`uint32LE((Date.now() >>> 0) + 随机 u32)`，与前端 `createEncSskNonce` 一致。
+*/
+function createNonce() {
+	const nonce = Buffer.alloc(NONCE_LENGTH);
+	nonce.writeUInt32LE((Date.now() >>> 0) + randomBytes(NONCE_LENGTH).readUInt32LE(0) >>> 0);
+	return nonce;
+}
+/**
+* 计算 XYS 的 x6 / x7（会话 SSK 证明）。
+*
+* 对 webSsk 里的每个 appId 各算一份；SSK 解不开或不足 32 字节的项跳过。
+* 一项都没有时返回 `null`，此时 x-s 里不应出现 x6/x7（与前端一致）。
+* @param contentMd5 - x5，即签名内容串的 MD5（32 位 hex）
+* @param webSsk - appId → SSK 映射
+* @param nonce - 固定 4 字节 nonce，仅用于测试与复现；省略时每个 appId 各自随机
+* @returns x6 / x7，或 `null`
+*/
+function buildSskProof(contentMd5, webSsk, nonce) {
+	if (!/^[0-9a-f]{32}$/i.test(contentMd5)) throw new Error("contentMd5 must be a 16-byte MD5 hex string");
+	const digest = Buffer.from(contentMd5, "hex");
+	if (nonce !== void 0 && nonce.length !== NONCE_LENGTH) throw new Error(`nonce must be ${NONCE_LENGTH} bytes`);
+	const x6 = Object.create(null);
+	const x7 = Object.create(null);
+	for (const [appId, value] of Object.entries(webSsk)) {
+		let ssk;
+		try {
+			ssk = decodeStandardBase64(value);
+		} catch {
+			continue;
+		}
+		if (!appId || ssk.length < SSK_MIN_LENGTH) continue;
+		const v = nonce ? Buffer.from(nonce) : createNonce();
+		const encSsk = Buffer.concat([
+			v,
+			sha1(Buffer.concat([ssk, v])),
+			ssk.subarray(SSK_MIN_LENGTH)
+		]);
+		x6[appId] = sha1(Buffer.concat([digest, encSsk])).toString("base64");
+		x7[appId] = encSsk.toString("base64");
+	}
+	return Object.keys(x6).length > 0 ? {
+		x6,
+		x7
+	} : null;
+}
+var methodSchema = _enum(["GET", "POST"], { message: "method must be \"GET\" or \"POST\"" });
+var uriSchema = string({ message: "uri must be a string" }).min(1, "uri cannot be empty");
+var a1ValueSchema = string({ message: "a1Value must be a string" }).min(1, "a1Value cannot be empty");
+var cookieSchema = union([record(string(), any()), string()]);
+var signatureParamsSchema = object({
+	method: methodSchema,
+	uri: uriSchema,
+	a1Value: a1ValueSchema
+});
+var getSignatureParamsSchema = object({
+	uri: uriSchema,
+	a1Value: a1ValueSchema
+});
+var postSignatureParamsSchema = object({
+	uri: uriSchema,
+	a1Value: a1ValueSchema
+});
+var xsCommonParamsSchema = object({ cookieDict: cookieSchema });
+function validateSignatureParams(method, uri, a1Value) {
+	try {
+		signatureParamsSchema.parse({
+			method,
+			uri,
+			a1Value
+		});
+	} catch (error) {
+		if (error instanceof ZodError) {
+			const firstError = error.issues[0];
+			throw new TypeError(firstError.message);
+		}
+		throw error;
+	}
+}
+function validateGetSignatureParams(uri, a1Value) {
+	try {
+		getSignatureParamsSchema.parse({
+			uri,
+			a1Value
+		});
+	} catch (error) {
+		if (error instanceof ZodError) {
+			const firstError = error.issues[0];
+			throw new TypeError(firstError.message);
+		}
+		throw error;
+	}
+}
+function validatePostSignatureParams(uri, a1Value) {
+	try {
+		postSignatureParamsSchema.parse({
+			uri,
+			a1Value
+		});
+	} catch (error) {
+		if (error instanceof ZodError) {
+			const firstError = error.issues[0];
+			throw new TypeError(firstError.message);
+		}
+		throw error;
+	}
+}
+function validateXsCommonParams(cookieDict) {
+	try {
+		xsCommonParamsSchema.parse({ cookieDict });
+	} catch (error) {
+		if (error instanceof ZodError) {
+			const firstError = error.issues[0];
+			throw new TypeError(firstError.message);
+		}
+		throw error;
+	}
+}
+var Xhshow = class {
+	config;
+	cryptoProcessor;
+	randomGenerator;
+	/**
+	* 创建 Xhshow 实例
+	* @param config - 可选的加密配置对象，不传则使用默认配置
+	*/
+	constructor(config) {
+		this.config = config || new CryptoConfig();
+		this.cryptoProcessor = new CryptoProcessor(this.config);
+		this.randomGenerator = new RandomGenerator();
+	}
+	/**
+	* 构建内容字符串（用于 MD5 计算和签名生成）
+	* @param method - HTTP 请求方法
+	* @param uri - 请求 URI 路径
+	* @param payload - 请求参数或请求体
+	* @returns 用于签名的内容字符串
+	*/
+	buildContentString(method, uri, payload = null) {
+		const normalizedPayload = payload || {};
+		if (method.toUpperCase() === "POST") return uri + JSON.stringify(normalizedPayload);
+		else {
+			if (Object.keys(normalizedPayload).length === 0) return uri;
+			return `${uri}?${Object.entries(normalizedPayload).map(([key, value]) => {
+				let valStr = "";
+				if (Array.isArray(value)) valStr = value.map((v) => String(v)).join(",");
+				else valStr = value !== null && value !== void 0 ? String(value) : "";
+				return `${key}=${valStr.replace(/=/g, "%3D")}`;
+			}).join("&")}`;
+		}
+	}
+	/**
+	* 根据内容字符串生成 d 值（MD5 哈希）
+	* @param content - 内容字符串
+	* @returns MD5 哈希值（十六进制字符串）
+	*/
+	generateDValue(content) {
+		return createHash("md5").update(content, "utf8").digest("hex");
+	}
+	/**
+	* 构建签名
+	* @param dValue - MD5 哈希值
+	* @param a1Value - Cookie 中的 a1 值
+	* @param xsecAppid - 应用 ID，默认为 'xhs-pc-web'
+	* @param stringParam - 字符串参数
+	* @param timestamp - 可选的时间戳
+	* @param signState - 可选的签名状态（用于会话管理）
+	* @returns 编码后的签名字符串
+	*/
+	buildSignature(dValue, mValue, a1Value, xsecAppid = "xhs-pc-web", stringParam = "", timestamp, signState) {
+		const payloadArray = this.cryptoProcessor.buildPayloadArray(dValue, mValue, a1Value, xsecAppid, stringParam, timestamp, signState);
+		const xorResult = this.cryptoProcessor.bitOps.xorTransformArray(payloadArray);
+		return this.cryptoProcessor.b64encoder.encodeX3(xorResult.subarray(0, this.config.PAYLOAD_LENGTH));
+	}
+	/**
+	* 生成请求签名（支持 GET 和 POST）
+	*
+	* 字段口径与前端 `seccore_signv2` 一致：x0~x2 取自模板，x3 为 mnsv2 签名，
+	* x4 为请求体类型（POST 为 `'object'`、GET 为 `''`），x5 为签名内容串的 MD5；
+	* 会话带 webSsk 时再加 x6/x7（会话 SSK 证明，见 {@link buildSskProof}）。
+	*
+	* @param method - HTTP 请求方法，'GET' 或 'POST'
+	* @param uri - 请求 URI 路径（可以是完整 URL，会自动提取路径部分）
+	* @param a1Value - Cookie 中的 a1 值
+	* @param xsecAppid - 应用 ID，默认为 'xhs-pc-web'
+	* @param payload - GET 请求的查询参数或 POST 请求的请求体
+	* @param timestamp - 可选的时间戳（秒），不传则使用当前时间
+	* @param session - 可选的会话管理器，用于生成更真实的签名；带 webSsk 时生成 x6/x7
+	* @returns x-s 签名字符串
+	*/
+	signXs(method, uri, a1Value, xsecAppid = "xhs-pc-web", payload = null, timestamp, session) {
+		validateSignatureParams(method, uri, a1Value);
+		uri = extractUri(uri);
+		const signatureData = { ...this.config.SIGNATURE_DATA_TEMPLATE };
+		const contentString = this.buildContentString(method, uri, payload);
+		const dValue = this.generateDValue(contentString);
+		const mValue = method === "GET" ? dValue : createHash("md5").update(uri, "utf8").digest("hex");
+		const signState = session ? session.getCurrentState(contentString) : void 0;
+		signatureData.x3 = this.config.X3_PREFIX + this.buildSignature(dValue, mValue, a1Value, xsecAppid, contentString, timestamp, signState);
+		signatureData.x4 = method === "POST" ? "object" : "";
+		signatureData.x5 = dValue;
+		const proof = session ? buildSskProof(dValue, session.webSsk) : null;
+		if (proof) {
+			signatureData.x6 = proof.x6;
+			signatureData.x7 = proof.x7;
+		}
+		const jsonStr = JSON.stringify(signatureData);
+		return this.config.XYS_PREFIX + this.cryptoProcessor.b64encoder.encode(jsonStr);
+	}
+	/**
+	* 生成 XYW_ 格式签名（AES-128-CBC 加密）
+	*
+	* 使用独立于 signXs 的加密路径。签名格式由调用方显式选择，
+	* 不根据登录态或 HTTP 406/461 自动切换。
+	*
+	* @param method - HTTP 请求方法，'GET' 或 'POST'
+	* @param uri - 请求 URI 路径（可以是完整 URL）
+	* @param a1Value - Cookie 中的 a1 值
+	* @param xsecAppid - 应用 ID，默认为 'xhs-pc-web'
+	* @param payload - GET 请求的查询参数或 POST 请求的请求体
+	* @param timestamp - 可选的时间戳（秒），不传则使用当前时间
+	* @param _session - 未使用，仅为保持与 signXs 的接口一致
+	* @returns XYW_ 格式签名字符串
+	*/
+	signXyw(method, uri, a1Value, xsecAppid = "xhs-pc-web", payload = null, timestamp, _session) {
+		validateSignatureParams(method, uri, a1Value);
+		uri = extractUri(uri);
+		const payloadHex = buildXywPayloadHex({
+			fullUri: this.buildContentString(method, uri, payload),
+			a1Value,
+			timestampMs: String(this.getXT(timestamp)),
+			config: this.config
+		});
+		const xywData = {
+			signSvn: this.config.XYW_SIGN_SVN,
+			signType: this.config.XYW_SIGN_TYPE,
+			appId: xsecAppid,
+			signVersion: this.config.XYW_SIGN_VERSION,
+			payload: payloadHex
+		};
+		const xywJson = JSON.stringify(xywData);
+		return this.config.XYW_PREFIX + Buffer.from(xywJson, "utf-8").toString("base64");
+	}
+	/**
+	* 生成 x-s-common 签名
+	* @param cookieDict - Cookie 字典对象或 Cookie 字符串
+	* @param options - 同一会话的 b1；省略时保留原有生成行为
+	* @returns x-s-common 签名字符串
+	*/
+	signXsCommon(cookieDict, options = {}) {
+		const parsedCookies = this.parseCookies(cookieDict);
+		return new XsCommonSigner(this.config).sign(parsedCookies, options);
+	}
+	/**
+	* 生成 GET 请求签名（便捷方法）
+	* @param uri - 请求 URI 路径
+	* @param a1Value - Cookie 中的 a1 值
+	* @param xsecAppid - 应用 ID，默认为 'xhs-pc-web'
+	* @param params - 查询参数对象
+	* @param timestamp - 可选的时间戳（秒）
+	* @param session - 可选的会话管理器
+	* @returns x-s 签名字符串
+	*/
+	signXsGet(uri, a1Value, xsecAppid = "xhs-pc-web", params = null, timestamp, session) {
+		validateGetSignatureParams(uri, a1Value);
+		return this.signXs("GET", uri, a1Value, xsecAppid, params, timestamp, session);
+	}
+	/**
+	* 生成 POST 请求签名（便捷方法）
+	* @param uri - 请求 URI 路径
+	* @param a1Value - Cookie 中的 a1 值
+	* @param xsecAppid - 应用 ID，默认为 'xhs-pc-web'
+	* @param payload - 请求体对象
+	* @param timestamp - 可选的时间戳（秒）
+	* @param session - 可选的会话管理器
+	* @returns x-s 签名字符串
+	*/
+	signXsPost(uri, a1Value, xsecAppid = "xhs-pc-web", payload = null, timestamp, session) {
+		validatePostSignatureParams(uri, a1Value);
+		return this.signXs("POST", uri, a1Value, xsecAppid, payload, timestamp, session);
+	}
+	/**
+	* 生成 x-s-common 签名的便捷包装方法
+	* @param cookieDict - Cookie 字典对象或 Cookie 字符串
+	* @param options - 同一会话的 b1；省略时保留原有生成行为
+	* @returns x-s-common 签名字符串
+	*/
+	signXsc(cookieDict, options = {}) {
+		validateXsCommonParams(cookieDict);
+		return this.signXsCommon(cookieDict, options);
+	}
+	/**
+	* 解密 x3 签名（Base64 格式）
+	* @param x3Signature - x3 签名字符串
+	* @returns 解密后的字节数组
+	*/
+	decodeX3(x3Signature) {
+		if (x3Signature.startsWith(this.config.X3_PREFIX)) x3Signature = x3Signature.slice(this.config.X3_PREFIX.length);
+		const decodedBytes = this.cryptoProcessor.b64encoder.decodeX3(x3Signature);
+		return this.cryptoProcessor.bitOps.xorTransformArray(Array.from(decodedBytes));
+	}
+	/**
+	* 解密完整的 XYS 签名
+	* @param xsSignature - x-s 签名字符串
+	* @returns 解密后的签名数据对象
+	* @throws 如果 JSON 解析失败则抛出错误
+	*/
+	decodeXs(xsSignature) {
+		if (xsSignature.startsWith(this.config.XYS_PREFIX)) xsSignature = xsSignature.slice(this.config.XYS_PREFIX.length);
+		const jsonString = this.cryptoProcessor.b64encoder.decode(xsSignature);
+		try {
+			return JSON.parse(jsonString);
+		} catch (e) {
+			throw new Error(`Invalid signature: JSON decode failed - ${e}`);
+		}
+	}
+	/**
+	* 构建带查询参数的完整 URL（便捷方法）
+	* @param baseUrl - 基础 URL
+	* @param params - 可选的查询参数对象
+	* @returns 完整的 URL 字符串
+	*/
+	buildUrl(baseUrl, params) {
+		return buildUrl(baseUrl, params);
+	}
+	/**
+	* 构建 POST 请求的 JSON 请求体字符串（便捷方法）
+	* @param payload - 请求体对象
+	* @returns JSON 字符串
+	*/
+	buildJsonBody(payload) {
+		return JSON.stringify(payload);
+	}
+	/**
+	* 生成 HTTP 请求头中的 x-b3-traceid
+	* @returns x-b3-traceid 字符串
+	*/
+	getB3TraceId() {
+		return this.randomGenerator.generateB3TraceId();
+	}
+	/**
+	* 生成 HTTP 请求头中的 x-xray-traceid
+	* @param timestamp - 可选的时间戳（毫秒）
+	* @param seq - 可选的序列号
+	* @returns x-xray-traceid 字符串
+	*/
+	getXrayTraceId(timestamp, seq) {
+		return this.randomGenerator.generateXrayTraceId(timestamp, seq);
+	}
+	/**
+	* 生成搜索接口所需的 search_id
+	* @returns Base36 编码的搜索 ID
+	*/
+	getSearchId() {
+		return this.randomGenerator.generateSearchId();
+	}
+	/**
+	* 生成搜索接口所需的 request_id
+	* @returns 格式为 "{random}-{timestamp_ms}" 的字符串
+	*/
+	getSearchRequestId() {
+		return this.randomGenerator.generateSearchRequestId();
+	}
+	/**
+	* 生成 a1 Cookie 值
+	* @returns 52 字符的 a1 值
+	*/
+	static generateA1() {
+		return RandomGenerator.generateA1();
+	}
+	/**
+	* 根据 a1 值生成 web_id
+	* @param a1 - a1 Cookie 值
+	* @returns 32 字符的十六进制 web_id
+	*/
+	static generateWebId(a1) {
+		return RandomGenerator.generateWebId(a1);
+	}
+	/**
+	* 生成 x-t 请求头值（Unix 时间戳，毫秒）
+	* @param timestamp - 可选的时间戳（秒），不传则使用当前时间
+	* @returns Unix 时间戳（毫秒）
+	*/
+	getXT(timestamp) {
+		if (timestamp === void 0) timestamp = Date.now() / 1e3;
+		return Math.floor(timestamp * 1e3);
+	}
+	/**
+	* 将 Cookie 解析为字典格式
+	* @param cookies - Cookie 字典对象或 Cookie 字符串
+	* @returns Cookie 字典对象
+	*/
+	parseCookies(cookies) {
+		if (typeof cookies === "string") {
+			const result = {};
+			const pairs = cookies.split(";");
+			for (const pair of pairs) {
+				const trimmed = pair.trim();
+				const eqIndex = trimmed.indexOf("=");
+				if (eqIndex > 0) {
+					const key = trimmed.substring(0, eqIndex).trim();
+					result[key] = trimmed.substring(eqIndex + 1).trim();
+				}
+			}
+			return result;
+		}
+		return cookies;
+	}
+	/**
+	* 生成包含签名和追踪 ID 的完整请求头
+	* @param method - HTTP 请求方法，'GET' 或 'POST'
+	* @param uri - 请求 URI 路径
+	* @param cookies - Cookie 字典对象或 Cookie 字符串（必须包含 a1）
+	* @param xsecAppid - 应用 ID，默认为 'xhs-pc-web'
+	* @param params - GET 请求的查询参数（POST 请求时不可用）
+	* @param payload - POST 请求的请求体（GET 请求时不可用）
+	* @param timestamp - 可选的时间戳（秒）
+	* @param session - 可选的会话管理器
+	* @returns 包含 x-s、x-s-common、x-t、x-b3-traceid、x-xray-traceid 的请求头对象
+	* @throws 如果 GET 请求使用 payload 或 POST 请求使用 params 则抛出错误
+	* @throws 如果 cookies 中缺少 a1 则抛出错误
+	*/
+	signHeaders(method, uri, cookies, xsecAppid = "xhs-pc-web", params, payload, timestamp, session, signFormat = "xys", userId, xRap = false) {
+		if (timestamp === void 0) timestamp = Date.now() / 1e3;
+		const methodUpper = method.toUpperCase();
+		let requestData;
+		if (methodUpper === "GET") {
+			if (payload !== void 0 && payload !== null) throw new Error("GET requests must use 'params', not 'payload'");
+			requestData = params ?? null;
+		} else if (methodUpper === "POST") {
+			if (params !== void 0 && params !== null) throw new Error("POST requests must use 'payload', not 'params'");
+			requestData = payload ?? null;
+		} else throw new Error(`Unsupported method: ${method}`);
+		if (signFormat !== "xys" && signFormat !== "xyw") throw new Error(`Unsupported signFormat=${JSON.stringify(signFormat)}; expected 'xys' or 'xyw'`);
+		const cookieDict = this.parseCookies(cookies);
+		const a1Value = cookieDict.a1;
+		if (!a1Value) throw new Error("Missing 'a1' in cookies");
+		const xS = signFormat === "xyw" ? this.signXyw(methodUpper, uri, a1Value, xsecAppid, requestData, timestamp) : this.signXs(methodUpper, uri, a1Value, xsecAppid, requestData, timestamp, session);
+		const xSCommon = this.signXsCommon(cookieDict, { b1: session?.b1 });
+		const xT = this.getXT(timestamp);
+		const xB3Traceid = this.getB3TraceId();
+		const xXrayTraceid = this.getXrayTraceId(Math.floor(timestamp * 1e3));
+		const headers = {
+			"x-s": xS,
+			"x-s-common": xSCommon,
+			"x-t": String(xT),
+			"x-b3-traceid": xB3Traceid,
+			"x-xray-traceid": xXrayTraceid,
+			"x-mns": "unload",
+			"xy-direction": String(getShardingKey(userId))
+		};
+		if (xRap) headers["x-rap-param"] = xRapParam("//edith.xiaohongshu.com" + extractUri(uri), requestData || {});
+		return headers;
+	}
+	/**
+	* 生成 GET 请求的完整请求头（便捷方法）
+	* @param uri - 请求 URI 路径
+	* @param cookies - Cookie 字典对象或 Cookie 字符串（必须包含 a1）
+	* @param xsecAppid - 应用 ID，默认为 'xhs-pc-web'
+	* @param params - 查询参数对象
+	* @param timestamp - 可选的时间戳（秒）
+	* @param session - 可选的会话管理器
+	* @returns 包含签名和追踪 ID 的请求头对象
+	*/
+	signHeadersGet(uri, cookies, xsecAppid = "xhs-pc-web", params, timestamp, session, signFormat = "xys", userId, xRap = false) {
+		return this.signHeaders("GET", uri, cookies, xsecAppid, params, void 0, timestamp, session, signFormat, userId, xRap);
 	}
+	/**
+	* 生成 POST 请求的完整请求头（便捷方法）
+	* @param uri - 请求 URI 路径
+	* @param cookies - Cookie 字典对象或 Cookie 字符串（必须包含 a1）
+	* @param xsecAppid - 应用 ID，默认为 'xhs-pc-web'
+	* @param payload - 请求体对象
+	* @param timestamp - 可选的时间戳（秒）
+	* @param session - 可选的会话管理器
+	* @returns 包含签名和追踪 ID 的请求头对象
+	*/
+	signHeadersPost(uri, cookies, xsecAppid = "xhs-pc-web", payload, timestamp, session, signFormat = "xys", userId, xRap = false) {
+		return this.signHeaders("POST", uri, cookies, xsecAppid, void 0, payload, timestamp, session, signFormat, userId, xRap);
+	}
+};
+/**
+* 小红书 Web 端的**运行时版本号** —— 真机抓包实测，比库默认值新。
+*
+* 2026-10-12 对真实游客会话抓包：`webBuild` cookie 是 `6.57.2`，webprofile 请求体里的
+* `sdkVersion` 是 `"4.4.3"`。库默认是 `6.56.3` / `4.3.5`（上游 2026-09-25 测）——
+* 站点构建号随发版递增，所以这里钉更新的那组。
+*
+* 两个值的去向不同，**都不是只影响一个地方**：
+* - `DATA_WEB_BUILD` → 游客 CK 的 `webBuild` cookie；而 x-s-common 的 `x4` 自上游 v1.2.0
+*   起会**优先读这个 cookie**（见 `xhshow/core/commonSign.ts`），所以它同时决定了请求头里的 x4。
+* - `DATA_SDK_VERSION` → webprofile（gid）请求体的 `sdkVersion`。
+*/
+var WEB_BUILD = "6.57.2";
+var SDK_VERSION = "4.4.3";
+/**
+* 初始化小红书签名配置。
+*
+* ## 为什么不再覆盖那两个模板
+*
+* 此前这里用对象字面量整个替换 `SIGNATURE_DATA_TEMPLATE` 与 `SIGNATURE_XSCOMMON_TEMPLATE`，
+* 用来把签名世代手工抬到真机的 `4.4.3` / `6.57.2`。**上游 v1.2.0 已经自己对齐了**
+* （x-s 的 `x0` 与 x-s-common 的 `x1` 默认值都是 `4.4.3`），所以那几处 override 已成冗余。
+*
+* 更要紧的是**留着它们会坏**：`SIGNATURE_XSCOMMON_TEMPLATE.x12` 是个 **getter**
+* （每次求值刷新时间戳 `${Date.now()};<会话起点>`），用对象字面量整个替换会把它求值成
+* 一个固定字符串 —— 之后每个请求的 x-s-common 都带同一个时间戳，签名不再随时间滚动。
+*
+* ## 为什么不调 `forUserAgent()`
+*
+* 上游 v1.2.0 新增的 `forUserAgent(ua)` 按 UA 派生 `s0` / `x2` / `DATA_PLATFORM` /
+* `PUBLIC_USERAGENT`，看着正合适 —— 但**无 UA 时它会退回 `'PC'`**，而本函数是模块级
+* 单例用的、拿不到调用方的 UA；真实浏览器发的是 `"Windows"`。保持库默认的 Windows
+* 那组反而正确。要真按平台派生，得先把 UA 从 client 串到这里，那是另一件事。
+*/
+var createXiaohongshuCryptoConfig = () => new CryptoConfig().withOverrides({
+	DATA_WEB_BUILD: WEB_BUILD,
+	DATA_SDK_VERSION: SDK_VERSION
 });
 /** @see https://github.com/Cialle/RedCrack */
 /** 小红书 Web 端游客会话初始化使用的浏览器请求头。 */
@@ -3482,8 +5995,22 @@ var GUEST_HEADERS$1 = {
 	"sec-fetch-site": "same-site",
 	"user-agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 Edg/141.0.0.0"
 };
-/** 生成 a1 随机段时使用的 Web 端字符集。 */
-var COOKIE_RANDOM_CHARS$1 = "abcdefghijklmnopqrstuvwxyz1234567890";
+/**
+* 生成 a1，以及由 a1 派生的 webId —— 直接用 `./xhshow` 的纯算实现。
+*
+* 逆向实证（xhshow-ts dev.ts 里一份真机 a1
+* `196d54a86df7…ielezi1r50000628328`）：a1 结构是 `hex(ts) + rand + "50000" + crc32`，
+* 常量段是 **`50000`**。amagi 旧的手搓版写成 `"5000"`（少一个 0），a1 内部 crc 因此是
+* 对错误结构算的 —— 虽也能换到 web_session，但疑为被风控降权（search 回 -104、homefeed
+* 回 461）。改用 `Xhshow.generateA1 / generateWebId` 对齐真实格式。
+*/
+var generateA1AndWebId$1 = () => {
+	const a1 = Xhshow.generateA1();
+	return {
+		a1,
+		webId: Xhshow.generateWebId(a1)
+	};
+};
 /** 将 Cookie Jar 序列化为可直接写入 HTTP Cookie 请求头的字符串。 */
 var toCookieString$1 = (cookies) => Object.entries(cookies).map(([key, value]) => `${key}=${value}`).join("; ");
 /** 将响应头中的 Set-Cookie 字段合并到当前游客会话的 Cookie Jar。 */
@@ -3495,24 +6022,6 @@ var updateCookiesFromResponse$1 = (cookies, setCookie) => {
 		if (separatorIndex > 0) cookies[nameValue.slice(0, separatorIndex).trim()] = nameValue.slice(separatorIndex + 1).trim();
 	}
 };
-/** 按小红书 Web 端规则生成 a1，以及由 a1 派生的 webId。 */
-var generateA1AndWebId$1 = () => {
-	const source = `${Date.now().toString(16)}${Array.from(randomBytes(30), (byte) => COOKIE_RANDOM_CHARS$1[byte % 36]).join("")}5000`;
-	const a1 = `${source}${crc32$1(source)}`.slice(0, 52);
-	return {
-		a1,
-		webId: createHash("md5").update(a1).digest("hex")
-	};
-};
-/** 计算与浏览器端实现兼容的无符号 CRC32 校验值。 */
-var crc32$1 = (input) => {
-	let value = 4294967295;
-	for (const byte of Buffer.from(input)) {
-		value ^= byte;
-		for (let bit = 0; bit < 8; bit += 1) value = value & 1 ? value >>> 1 ^ 3988292384 : value >>> 1;
-	}
-	return (value ^ 4294967295) >>> 0;
-};
 /** 从 scripting 接口返回的 VMP 数据中解码 websectiga Cookie。 */
 var generateWebsectiga$1 = (payload) => {
 	const bMatch = payload.match(/"b":"(.*?)",/);
@@ -3615,18 +6124,70 @@ var createXiaohongshuGuestCookie$1 = async (send, requestConfig) => {
 	return toCookieString$1(cookies);
 };
 /**
+* 游客 Cookie 进程级缓存：键为 UA、值为铸造好的 Cookie 串。
+*
+* 铸造一次要走 scripting → webprofile → activate 三个真实会话请求，开销不小；匿名
+* 游客会话在进程内可复用，故按 UA 缓存（指纹由 UA 参与生成，不同 UA 视作不同会话）。
+*/
+var guestCookieCache = /* @__PURE__ */ new Map();
+/** in-flight 去重：并发首调共享同一次铸造，避免并发打出多份会话初始化 */
+var inflightGuestMint = /* @__PURE__ */ new Map();
+/** 缓存条目上限，防异常 UA 把缓存撑爆 */
+var GUEST_CACHE_MAX_ENTRIES = 32;
+/**
+* 端点 `prepare` 钩子：**下游未传有效用户 Cookie（无 a1）时，用游客 Cookie 解析接口**。
+*
+* 判据沿用既有约定（见 fetcher 测试「cookie 带 a1 时不再跑 guest-cookie 前置请求」）：
+* cookie 里有 a1 视作有效用户凭证、原样放行；没有就铸造一份游客 Cookie 顶上。铸造走
+* `ctx.send`（而非自带 transport）—— 游客会话初始化的三个请求因此与主请求同一出口
+* （代理 / agent / 超时 / 出口 IP 一致）；小红书游客会话与出口 IP、指纹绑定，同出口才稳，
+* 这也是不走平台级 `ensureCookie`（拿不到 `ctx.send`）而留在 `prepare` 的原因。
+*
+* 铸造结果按 UA 进程级缓存并对并发去重：重复调用只铸一次。会话失效时主请求会被 judge
+* 判失败，调用方可 {@link resetXiaohongshuGuestCookieCache} 后重试。
+* @param ctx - 端点执行上下文（取 `cookie` / `userAgent` / `requestConfig` / `send`）
+* @param mint - 铸造函数，默认 {@link createXiaohongshuGuestCookie}；测试可注入假铸造
+* @returns 需要升级时返回 `{ cookie }`，否则 `{}`（保持原 cookie）
+*/
+var prepareXiaohongshuGuestCookie = async (ctx, mint = createXiaohongshuGuestCookie$1) => {
+	if (getCookieValue(ctx.cookie, "a1")) return {};
+	const key = ctx.userAgent || "";
+	const cached = guestCookieCache.get(key);
+	if (cached !== void 0) return { cookie: cached };
+	let pending = inflightGuestMint.get(key);
+	if (pending === void 0) {
+		pending = (async () => {
+			try {
+				const cookie = await mint(ctx.send, ctx.requestConfig);
+				guestCookieCache.set(key, cookie);
+				if (guestCookieCache.size > GUEST_CACHE_MAX_ENTRIES) {
+					const oldest = guestCookieCache.keys().next().value;
+					if (oldest !== void 0) guestCookieCache.delete(oldest);
+				}
+				return cookie;
+			} finally {
+				inflightGuestMint.delete(key);
+			}
+		})();
+		inflightGuestMint.set(key, pending);
+	}
+	return { cookie: await pending };
+};
+/**
 * 小红书签名算法。
 *
-* 包装 `@ikenxuan/xhshow-ts` 的 `Xhshow` 实例，提供 GET / POST / X-S-Common /
+* 包装 `./xhshow` 的 `Xhshow` 实例，提供 GET / POST / X-S-Common /
 * X-T / X-B3-Traceid / X-Xray-Traceid / X-Rap-Param / 搜索 ID / 搜索 request_id
 * 的生成函数。a1 从 cookie 取值的逻辑用 `contracts/cookie.ts` 的 `getCookieValue`。
 *
 * `Xhshow` 实例是模块级单例，行为与性能无额外开销。
 *
 * 上游 2026-02 之后的新协议由这里落地：
-* - **XYW_ 格式**（`generateXSGetXyw` / `generateXSPostXyw`）：数据获取类接口
-*   （`user_posted`、`user/otherinfo` 等）自 2026-03 起以 HTTP 406 拒绝传统 XYS_
-*   格式，改用基于 AES-128-CBC 的 XYW_ 签名。x-s 值以 `XYW_` 开头。
+* - **XYW_ 格式**（`generateXSGetXyw` / `generateXSPostXyw`）：AES-128-CBC 的另一套 x-s
+*   信封，值以 `XYW_` 开头。曾按「数据获取类接口自 2026-03 起拒收 XYS_」全线切到它 ——
+*   该说法**未经线上验证、且已被真机实测推翻**（2026-10-11：同一游客 cookie 下
+*   `user_posted` 用 XYW_ 回 HTTP 461 空 data、用 XYS_ 回 200 + 真数据）。当前
+*   **所有端点都用 XYS_**，本格式保留实现与形状检查，但无端点引用。
 * - **x-rap-param**（`generateXRapParam`）：feed / 搜索 / 发布类接口的额外校验头。
 * - **x-xray-traceid**（`generateXrayTraceid`）：追踪头，随现代浏览器每次请求下发。
 * - **search request_id**（`getSearchRequestId`）：搜索接口所需的 `{random}-{ts_ms}`。
@@ -3654,8 +6215,8 @@ var generateXSPost = (path, a1Cookie, clientType = "xhs-pc-web", body = {}) => c
 /**
 * 生成 GET 请求的 XYW_ 格式 X-S 签名（AES-128-CBC）。
 *
-* 数据获取类接口（`user_posted` 等）自 2026-03 起以 HTTP 406 拒绝 XYS_ 格式，
-* 需改用本函数。返回值以 `XYW_` 开头，走独立于 `signXsGet` 的加密路径。
+* **当前无端点使用**：那轮「数据获取类接口拒收 XYS_、需换本函数」的切换已被真机实测
+* 推翻（见文件头），端点一律走 XYS_。返回值以 `XYW_` 开头，走独立于 `signXsGet` 的加密路径。
 * @param path - API 路径，如 `/api/sns/web/v1/user_posted`
 * @param a1Cookie - a1 cookie 值
 * @param clientType - 客户端类型，默认 `'xhs-pc-web'`
@@ -3722,9 +6283,10 @@ var getSearchId = () => client.getSearchId();
 * ## XYS_ 与 XYW_ 两套 x-s 格式
 *
 * - **XYS_（传统）**：`xhsGetSigner` / `xhsPostSigner`，x-s 用 `signXsGet` / `signXsPost`。
-* - **XYW_（2026-03 之后）**：`xhsGetXywSigner` / `xhsPostXywSigner`，数据获取类接口
-*   （`user_posted` 等）自 2026-03 起以 HTTP 406 拒绝 XYS_，x-s 改用以 `XYW_` 开头的
-*   AES-128-CBC 签名。
+* - **XYW_（2026-03 之后）**：`xhsGetXywSigner` / `xhsPostXywSigner`，以 `XYW_` 开头的
+*   AES-128-CBC 签名。那轮「数据获取类接口自 2026-03 起拒收 XYS_」的切换**未经线上验证、
+*   且已被真机实测推翻**（2026-10-11：`user_posted` 用 XYW_ 回 461 空 data、XYS_ 回
+*   200 + 真数据），故这条路径**当前无端点使用** —— 实现与形状检查保留，便于日后平台再变。
 *
 * 签名路径取自 `spec.signPath`（build 里填 `apiPath`），不是 `spec.url`：小红书签名只用
 * 接口路径，与完整 URL 无关。x-rap-param 例外，它要 host + path（见 {@link rapApiOf}）。
@@ -3779,7 +6341,7 @@ var xhsPostXywSigner = (spec, ctx) => {
 * `x-s` + `x-s-common` + `x-t` + `x-xray-traceid` 四个签名头。
 *
 * @param method - GET 签 query、POST 签 body
-* @param protocol - `'xys'` 传统 / `'xyw'` 绕 406（2026-03 后数据接口必用）
+* @param protocol - `'xys'` 传统 / `'xyw'` XYW_ 信封（当前无端点使用，见文件头）
 */
 var xs = (method, protocol) => ({
 	phase: "sign",
@@ -3804,7 +6366,7 @@ var rap = () => ({
 	apply: (spec) => withHeader(spec, "x-rap-param", generateXRapParam(rapApiOf(spec), spec.body ?? {}))
 });
 //#endregion
-//#region ../amagi/packages/core/dist/src-Bu8lly0v.mjs
+//#region ../amagi/packages/core/dist/src-4GqoEcVR.mjs
 var import_protobufjs = /* @__PURE__ */ __toESM(require_protobufjs(), 1);
 /**
 * B站评论区类型代码（`comments` / `commentReplies` 的 `type` 参数）。
@@ -6811,12 +9373,23 @@ var createXiaohongshuConfig = (cookie, requestConfig) => {
 /**
 * 小红书平台默认响应判定。
 *
-* 两条行为：
+* 三条行为：
 * - **HTML 反爬页判为 `risk` / `ANTIBOT_PAGE`**：字符串响应（含 `<html>` 的反爬页
 *   与纯文本拦截页）判失败，原始 HTML 留在 `error.raw`
 *   （`createClient({ debug: true })` 时才填，见 `ClientOptions.debug`）。
 * - **不把一切失败归一化为 500**：judge 只分类，失败信封由 runtime 统一从原始响应
 *   提取 `platform.code` / `message`。
+* - **HTTP 461 判为 `risk` / `RISK_CONTROL`**：461 是小红书专属的风控码，必须在
+*   {@link verdictFromHttpStatus} **之前**拦下 —— 那个通用 helper 只特判
+*   401/403/404/408/429，461 会落进它的兜底分支，被报成 `kind: 'unknown'` /
+*   `PLATFORM_ERROR` / `retryable: false`：把一个明确的风控状态说成「未知平台错误」，
+*   可重试性也与同为风控的 403 相左。它属于平台专属码，因此留在本 judge 而不下沉到
+*   共享 helper（下沉会让其它三个平台也认领一个它们不会遇到的码）。
+*
+*   461 的典型面目是**伪装成成功的空壳**：`HTTP 461` 配
+*   `{"code": 0, "success": true, "msg": "成功", "data": {}}` —— 平台不告诉你原因，
+*   只看响应体像是成功了。实测（2026-10-12 真机抓包，游客会话）：`comment/page`
+*   首页正常、**翻页**必回此形态。
 *
 * 成功判定：`code === 0`。没有 `code` 字段的 JSON 响应（如 `emojiList` 之外的部分
 * 端点）视为成功，交给 normalize 处理 —— 缺失 code 不判失败。
@@ -6830,6 +9403,12 @@ var xiaohongshuJudge = (raw, http) => {
 	if (typeof raw === "object" && raw !== null && "code" in raw) {
 		if (raw.code !== 0) return { ok: false };
 	}
+	if (http.status === 461) return {
+		ok: false,
+		kind: "risk",
+		code: "RISK_CONTROL",
+		retryable: true
+	};
 	return verdictFromHttpStatus(http.status) ?? { ok: true };
 };
 /**
@@ -6852,8 +9431,8 @@ var xiaohongshuJudge = (raw, http) => {
 * - `'xhs-get-trace'`：GET + `x-b3-traceid`（userNoteList 专用）
 * - `'xhs-post-rap'`：POST + `x-rap-param`（feed / 搜索 / 发布类接口的额外校验）
 *
-* XYW_（2026-03 之后）路径 —— 数据获取类接口以 HTTP 406 拒绝 XYS_，x-s 改用以 `XYW_`
-* 开头的 AES-128-CBC 签名：
+* XYW_（2026-03 之后）路径 —— 以 `XYW_` 开头的 AES-128-CBC 签名。那轮「数据获取类接口
+* 拒收 XYS_」的切换已被真机实测推翻（见 `./steps.ts` 文件头），三个名字保留但无端点引用：
 * - `'xhs-get-xyw'`：GET，x-s 用 `signXyw`
 * - `'xhs-post-xyw'`：POST，x-s 用 `signXyw`
 * - `'xhs-get-xyw-trace'`：GET XYW + `x-b3-traceid`（userNoteList 专用）
@@ -7672,10 +10251,14 @@ var resolveTarget = (raw, maxPageSize) => {
 *
 * **不 catch 任何异常** —— `runPage` 抛出的东西直接往外传，由 `execute`
 * 唯一的那处 catch 归因。
+*
+* **中途失败不丢已有页**：只要已经取到过至少一页，后续某页失败就返回**部分结果**，
+* 而不是整体失败 —— 丢掉已取到的条目毫无道理，「比目标少」与 `hasMore: false`
+* 提前收尾本是同一种结局。**第一页就失败仍是整体失败**（没有任何部分可言）。
 * @param def - 翻页声明
 * @param params - 校验后的参数
 * @param runPage - 跑一页的回调
-* @returns 累积结果，或第一个失败页的错误
+* @returns 累积结果（页数可能少于目标），或第一页的错误
 */
 var runPaginated = async (def, params, runPage) => {
 	const limitKey = def.limitParam ?? "number";
@@ -7689,6 +10272,8 @@ var runPaginated = async (def, params, runPage) => {
 	let current = params;
 	let lastPage;
 	let isFirst = true;
+	/** 已经跑完的页数：中断现场据此标页码，也用来区分「第一页就失败」 */
+	let donePages = 0;
 	while (collected.length < target) {
 		const pageSize = Math.min(target - collected.length, def.maxPageSize);
 		const pageParams = {
@@ -7696,10 +10281,21 @@ var runPaginated = async (def, params, runPage) => {
 			[countKey]: pageSize
 		};
 		const outcome = await runPage(pageParams, isFirst ? "initial" : "page");
-		if (!outcome.ok) return {
-			ok: false,
-			error: outcome.error
-		};
+		if (!outcome.ok) {
+			if (donePages === 0) return {
+				ok: false,
+				error: outcome.error
+			};
+			return {
+				ok: true,
+				value: {
+					empty: false,
+					lastPage,
+					items: collected.slice(0, target)
+				}
+			};
+		}
+		donePages += 1;
 		const page = outcome.value;
 		lastPage = page;
 		const list = def.items(page);
@@ -12214,7 +14810,7 @@ var comments = defineKuaishouEndpoint({
 	},
 	params: object({
 		photoId: string().min(1, { error: "photoId 不能为空" }).describe("作品 ID"),
-		number: number().int().min(1).max(500).optional().describe("目标条数，默认一页")
+		number: number().int().min(1).max(500).optional().describe("目标条数；不传时按单页上限翻页取满，而不是只取一页")
 	}),
 	sign: [hxfalcon()],
 	prepare: kuaishouDidPrepare,
@@ -13236,7 +15832,7 @@ var SEARCH_NOTE_TYPE = {
 /**
 * 构建查询字符串：跳过 null / undefined。
 *
-* **编码规则必须与 `@ikenxuan/xhshow-ts` 的签名内部编码完全一致**：只把值里的
+* **编码规则必须与 `sign/xhshow/` 的签名内部编码完全一致**：只把值里的
 * `=` 转成 `%3D`，其余字符（含 `,`）原样保留。小红书对 GET 请求按「路径 + 这套
 * 编码的 query」计算 x-s，若这里用 `encodeURIComponent`（会把 `,` 转成 `%2C`），
 * 发出去的 query 与被签名的内容不一致，平台返回 HTTP 406。
@@ -13295,10 +15891,12 @@ var noteComments$1 = (data) => {
 		signParams: params
 	};
 };
-/** 用户信息（GET，请求的是 HTML 页，由 judge / decode 层处理） */
+/** 用户信息（GET，请求的是 HTML 页，由 judge / decode 层处理）。
+*  游客必须带 `xsec_token` + `xsec_source`（否则只拿到未水合空壳页）；有效登录 CK 可省
+*  （省略时 URL 回到 v6 形态 `/user/profile/{id}`，不改变已登录用户的既有行为）。 */
 var userProfile$1 = (data) => ({
 	apiPath: "/api/sns/web/v1/user/otherinfo",
-	Url: `https://www.xiaohongshu.com/user/profile/${data.user_id}`
+	Url: `https://www.xiaohongshu.com/user/profile/${data.user_id}${data.xsec_token ? `?xsec_token=${data.xsec_token}&xsec_source=pc_feed` : ""}`
 });
 /** 用户笔记列表（GET，参数进 query） */
 var userNoteList$1 = (data) => {
@@ -13311,6 +15909,7 @@ var userNoteList$1 = (data) => {
 			"webp",
 			"avif"
 		].join(","),
+		...data.xsec_token ? { xsec_token: data.xsec_token } : {},
 		xsec_source: "pc_feed"
 	};
 	return {
@@ -13378,13 +15977,37 @@ var xiaohongshuApiUrls$1 = {
 /**
 * 小红书端点声明。
 *
-* 就是 {@link defineEndpoint} 绑定了小红书签名器名联合 {@link XiaohongshuSignerName}：
-* `sign` 的字符串分支被收窄成小红书那几个 `xhs-*` 名字，写错名字编译期即报错，不必
-* 等运行时查表失败。运行时仍是恒等函数，其余行为与通用 `defineEndpoint` 完全一致。
+* 在 {@link defineEndpoint} 的基础上做两件小红书专属的事：
+*
+* 1. **签名器名收窄**：`sign` 的字符串分支被收窄成小红书那几个 `xhs-*` 名字
+*    （{@link XiaohongshuSignerName}），写错名字编译期即报错，不必等运行时查表失败。
+* 2. **游客 Cookie 降级**：注入平台级 `prepare`（{@link prepareXiaohongshuGuestCookie}）——
+*    下游未传有效用户 Cookie（无 a1）时自动铸造游客 Cookie 来解析接口。这是**每个**
+*    小红书端点都要的横切能力，放在这里一处注入，保证全体端点（含将来新增的）一致
+*    覆盖，不会漏配。端点若自带 `prepare`，在游客降级**之后**再跑、其结果优先。
+*
 * @param def - 端点声明（`sign` 的名字受小红书签名器表约束）
-* @returns 原样返回 `def`，带上推导好的具体类型
-*/
-var defineXiaohongshuEndpoint = (def) => defineEndpoint(def);
+* @returns 带上推导好的具体类型、并注入游客降级 `prepare` 的 `def`
+*/
+var defineXiaohongshuEndpoint = (def) => {
+	const own = def.prepare;
+	const prepare = async (ctx) => {
+		const upgraded = await prepareXiaohongshuGuestCookie(ctx);
+		if (own === void 0) return upgraded;
+		const ownResult = await own({
+			...ctx,
+			...upgraded
+		});
+		return {
+			...upgraded,
+			...ownResult
+		};
+	};
+	return defineEndpoint({
+		...def,
+		prepare
+	});
+};
 /**
 * 表情列表（GET，无参数）。
 *
@@ -13411,14 +16034,11 @@ var emojiList = defineXiaohongshuEndpoint({
 	response: type()
 });
 /**
-* 首页推荐（POST + prepare 换 guest cookie）。
-*
-* 覆盖两种非常规形态：POST 请求体 + 前置请求换凭证。
+* 首页推荐（POST）。
 *
-* `prepare`：cookie 里没有 a1 时，用 transport 换一份 guest cookie
-* （scripting → webprofile → activate 三个会话请求，`reason: 'prepare'`
-* 进 trace）。已有 a1 直接跳过 —— guest cookie 流程有真实网络开销，
-* 不能每次调用都重跑。
+* 无有效用户 Cookie（无 a1）时自动用游客 Cookie 解析 —— 该降级已上移到
+* `defineXiaohongshuEndpoint` 的平台级 `prepare`（见 `sign/guestCookie.ts` 的
+* `prepareXiaohongshuGuestCookie`），对全体小红书端点一致生效，homeFeed 不再单独声明。
 */
 var homeFeed = defineXiaohongshuEndpoint({
 	name: "xiaohongshu.homeFeed",
@@ -13435,10 +16055,6 @@ var homeFeed = defineXiaohongshuEndpoint({
 		category: string().optional().describe("内容分类，默认首页推荐流"),
 		search_key: string().optional().describe("搜索关键词，默认空字符串")
 	}),
-	prepare: async (ctx) => {
-		if (getCookieValue(ctx.cookie, "a1")) return {};
-		return { cookie: await createXiaohongshuGuestCookie$1(ctx.send, ctx.requestConfig) };
-	},
 	build: (p) => {
 		const { Url, Body, apiPath } = homeFeed$1(p);
 		return {
@@ -13460,19 +16076,49 @@ var homeFeed = defineXiaohongshuEndpoint({
 * xhs 响应里的 `data.cursor` 是 string（平台协议如此），
 * `data.has_more` 是 boolean，与抖音的 `has_more === 1` 不同 ——
 * 差异收敛在 `paginate` 声明里，管线不感知。
+*
+* ## 游客会话只能取到第一页
+*
+* 真机实测（2026-10-12）：游客身份下首页（`cursor=''`）稳定 HTTP 200 并返回
+* **10 条**；**第二页**（非空 cursor）必被平台以 **HTTP 461** 拒绝，响应体还是
+* 一个伪装成成功的空壳 `{"code":0,"success":true,"msg":"成功","data":{}}`。
+* 这是平台侧对「游客 + 签名内出现翻页 cursor」的硬门，纯算无解 ——
+* 单页判为 `risk` / `RISK_CONTROL`（见 `judge.ts`）。
+*
+* 后果：游客调这个端点**最多拿到 10 条**，而且返回的是一个**正常的成功信封** ——
+* 翻页在第二页停下、把首页那 10 条原样返回，不报错也不加文案（见
+* `runtime/paginate.ts` 的部分结果规则）。想让 `number` 生效必须有**有效登录 CK**；
+* 游客传超过单页容量没有副作用，只是拿到的比要的少。
+*
+* ## `comment/page` 的限流比 `/v1/feed` 紧得多
+*
+* 真机实测（2026-10-12）：**同一会话、同一时刻**，`noteDetail`（`/v1/feed`）能过而
+* 本端点回 461 —— 两个端点的预算不是一个量级。这是「详情解析成功、评论却失败」这类
+* 现象的主因。
+*
+* 超限后的表现与上面的翻页硬门**完全一样**（461 + 伪装成成功的空壳），平台不给任何
+* 可区分的信号，所以**两者在错误码上分不开**，都只能报 `RISK_CONTROL`。
+*
+* 限流是**滑动窗口**，恢复要分钟级：实测 1.5 秒间隔连打 8 次，第 3 次起连续失败；
+* 而窗口空闲时同一份会话能连过 7 次。`isRetryableStatus` 只认 429 与 ≥500，461
+* 因此**不会自动重试**，失败是即时的、要靠调用方自己退避。
+*
+* **排查时踩过的坑**：一度把「连发的第 4 个请求必挂」误判成「`xsec_source=pc_share`
+* 是毒药」—— 其实是请求顺序造成的假象（两次跑挂的都是第 4 个，只是恰好那次轮到
+* `pc_share`）。顺序敏感的探针**必须做重复组或打乱顺序**，单次结果不能下结论。
 */
 var noteComments = defineXiaohongshuEndpoint({
 	name: "xiaohongshu.noteComments",
 	route: "/fetch_note_comments",
 	doc: {
 		summary: "笔记评论列表",
-		description: "取笔记评论列表。`number` 指定目标条数，翻页由端点自动完成。"
+		description: "取笔记评论列表。`number` 指定目标条数，翻页由端点自动完成。**游客身份下平台对本接口限流较紧**：超限回 HTTP 461（伪装成成功的空壳），退避需分钟级、秒级无效；而且**不传 `number` 会触发翻页、多烧一次请求** —— 传具体小值可把请求数降到 1。"
 	},
 	params: object({
 		cursor: internalParam(string().optional().describe("分页游标，由端点接管，不用传")),
 		note_id: string().min(1, { error: "note_id 不能为空" }).describe("笔记 ID；从笔记分享链接里取"),
-		xsec_token: string().min(1, { error: "xsec_token 不能为空" }).describe("反爬令牌，随笔记分享链接下发"),
-		number: number().int().min(1).max(500).optional().describe("目标条数，默认一页")
+		xsec_token: string().min(1, { error: "xsec_token 不能为空" }).describe("反爬令牌，随笔记分享链接下发；**与发放它的会话绑定** —— 游客下换会话即 461，须同会话现取或带上原游客 CK"),
+		number: number().int().min(1).max(500).optional().describe("目标条数；不传时按单页上限翻页取满，而不是只取一页 —— 游客下翻页必被拒且多烧一次请求，传具体小值可降到 1 次")
 	}),
 	build: (p) => {
 		const { Url, apiPath, signParams } = noteComments$1(p);
@@ -13516,7 +16162,7 @@ var noteDetail = defineXiaohongshuEndpoint({
 	},
 	params: object({
 		note_id: string().min(1, { error: "note_id 不能为空" }).describe("笔记 ID；从笔记分享链接里取"),
-		xsec_token: string().min(1, { error: "xsec_token 不能为空" }).describe("反爬令牌，随笔记分享链接下发，不能自己拼")
+		xsec_token: string().min(1, { error: "xsec_token 不能为空" }).describe("反爬令牌，随笔记分享链接下发；**与发放它的会话绑定** —— 游客下换会话即 461，须同会话现取或带上原游客 CK")
 	}),
 	build: (p) => {
 		const { Url, Body, apiPath } = noteDetail$1(p);
@@ -13561,11 +16207,14 @@ var searchNotes = defineXiaohongshuEndpoint({
 	response: type()
 });
 /**
-* 用户笔记列表（GET + x-b3-traceid，XYW_ 签名）。
+* 用户笔记列表（GET + x-b3-traceid，XYS_ 签名）。
 *
-* 这个端点额外带 `x-b3-traceid` 头，且属于数据获取类接口 —— 自 2026-03 起传统
-* XYS_ 签名会被平台以 HTTP 406 拒绝，因此用 `'xhs-get-xyw-trace'`
-* （XYW_ GET 签名 + traceid），而不是给所有 GET 都换。
+* 这个端点额外带 `x-b3-traceid` 头。签名用 XYS_（与 v6 一致）—— 真机实证（2026-10-11）：
+* 同一游客 cookie 下 `user_posted` 用 **XYS_ 回 200 + 真数据**、用 XYW_ 回 **HTTP 461 空 data**；
+* 且 v6/legacy 本就只有 XYS（无 XYW）。早先「数据接口 XYS 会 406 必须换 XYW」是未经线上验证的
+* 文档默认值，已被平台改回、不再成立（见 [[amagi-xhshow-xyw-rap-integration]] 的修正）。
+* `xsec_token`：游客必传（user 级令牌，缺它平台回 461），有效登录 CK 可省（省略时 query 与 v6
+* 逐字节一致）。
 */
 var userNoteList = defineXiaohongshuEndpoint({
 	name: "xiaohongshu.userNoteList",
@@ -13576,7 +16225,7 @@ var userNoteList = defineXiaohongshuEndpoint({
 	},
 	params: object({
 		user_id: string().min(1, { error: "user_id 不能为空" }).describe("用户 ID"),
-		xsec_token: string().min(1, { error: "xsec_token 不能为空" }).describe("反爬令牌，随笔记分享链接下发"),
+		xsec_token: string().optional().describe("反爬令牌，随用户主页分享链接下发；游客必传、有效登录 CK 可省；**与发放它的会话绑定**（游客下换会话即 461）"),
 		cursor: string().optional().describe("翻页游标；传上一页最后一条的 ID，首页不传"),
 		num: number().int().min(1).max(100).optional().describe("单次请求的笔记条数，默认 30")
 	}),
@@ -13589,7 +16238,7 @@ var userNoteList = defineXiaohongshuEndpoint({
 			extra: { signParams }
 		};
 	},
-	sign: [xs("get", "xyw"), traceId()],
+	sign: [xs("get", "xys"), traceId()],
 	response: type()
 });
 /**
@@ -13611,7 +16260,10 @@ var xiaohongshuRegistry = {
 			summary: "用户主页信息",
 			description: "取用户主页的资料与统计。笔记列表见 `userNoteList`。"
 		},
-		params: object({ user_id: string().min(1, { error: "user_id 不能为空" }).describe("用户 ID，从主页地址里取") }),
+		params: object({
+			user_id: string().min(1, { error: "user_id 不能为空" }).describe("用户 ID，从主页地址里取"),
+			xsec_token: string().optional().describe("反爬令牌，随用户主页分享链接下发；游客必传、有效登录 CK 可省；**与发放它的会话绑定**（游客下换会话即 461）")
+		}),
 		build: (p) => {
 			const { Url, apiPath } = userProfile$1(p);
 			return {
@@ -15469,6 +18121,21 @@ var RESPONSE_SCHEMAS = {
 				"success"
 			]
 		},
+		"xiaohongshu_userNoteList": {
+			"type": "object",
+			"properties": {
+				"code": { "type": "number" },
+				"data": { "$ref": "#/components/schemas/xiaohongshu_userNoteList.UserNoteList_V0.Data" },
+				"msg": { "type": "string" },
+				"success": { "type": "boolean" }
+			},
+			"required": [
+				"code",
+				"data",
+				"msg",
+				"success"
+			]
+		},
 		"xiaohongshu_userProfile": {
 			"type": "object",
 			"properties": {
@@ -54711,6 +57378,107 @@ var RESPONSE_SCHEMAS = {
 				"xsec_token"
 			]
 		},
+		"xiaohongshu_userNoteList.UserNoteList_V0.Cover": {
+			"type": "object",
+			"properties": {
+				"file_id": { "type": "string" },
+				"height": { "type": "number" },
+				"info_list": {
+					"type": "array",
+					"items": { "$ref": "#/components/schemas/xiaohongshu_userNoteList.UserNoteList_V0.InfoList" }
+				},
+				"trace_id": { "type": "string" },
+				"url": { "type": "string" },
+				"url_default": { "type": "string" },
+				"url_pre": { "type": "string" },
+				"width": { "type": "number" }
+			},
+			"required": [
+				"file_id",
+				"height",
+				"info_list",
+				"trace_id",
+				"url",
+				"url_default",
+				"url_pre",
+				"width"
+			]
+		},
+		"xiaohongshu_userNoteList.UserNoteList_V0.Data": {
+			"type": "object",
+			"properties": {
+				"cursor": { "type": "string" },
+				"has_more": { "type": "boolean" },
+				"notes": {
+					"type": "array",
+					"items": { "$ref": "#/components/schemas/xiaohongshu_userNoteList.UserNoteList_V0.Note" }
+				}
+			},
+			"required": [
+				"cursor",
+				"has_more",
+				"notes"
+			]
+		},
+		"xiaohongshu_userNoteList.UserNoteList_V0.InfoList": {
+			"type": "object",
+			"properties": {
+				"image_scene": { "type": "string" },
+				"url": { "type": "string" }
+			},
+			"required": ["image_scene", "url"]
+		},
+		"xiaohongshu_userNoteList.UserNoteList_V0.InteractInfo": {
+			"type": "object",
+			"properties": {
+				"liked": { "type": "boolean" },
+				"liked_count": { "type": "string" },
+				"sticky": { "type": "boolean" }
+			},
+			"required": [
+				"liked",
+				"liked_count",
+				"sticky"
+			]
+		},
+		"xiaohongshu_userNoteList.UserNoteList_V0.Note": {
+			"type": "object",
+			"properties": {
+				"cover": { "$ref": "#/components/schemas/xiaohongshu_userNoteList.UserNoteList_V0.Cover" },
+				"display_title": { "type": "string" },
+				"interact_info": { "$ref": "#/components/schemas/xiaohongshu_userNoteList.UserNoteList_V0.InteractInfo" },
+				"note_id": { "type": "string" },
+				"time": { "type": "number" },
+				"type": { "type": "string" },
+				"user": { "$ref": "#/components/schemas/xiaohongshu_userNoteList.UserNoteList_V0.User" },
+				"xsec_token": { "type": "string" }
+			},
+			"required": [
+				"cover",
+				"display_title",
+				"interact_info",
+				"note_id",
+				"time",
+				"type",
+				"user",
+				"xsec_token"
+			]
+		},
+		"xiaohongshu_userNoteList.UserNoteList_V0.User": {
+			"type": "object",
+			"properties": {
+				"avatar": { "type": "string" },
+				"nick_name": { "type": "string" },
+				"nickname": { "type": "string" },
+				"user_id": { "type": "string" }
+			},
+			"required": [
+				"avatar",
+				"nick_name",
+				"nickname",
+				"user_id"
+			]
+		},
 		"xiaohongshu_userProfile.UserProfile_V0.BasicInfo": {
 			"type": "object",
 			"properties": {
@@ -55168,7 +57936,7 @@ var buildOpenApiSpec = (options = {}) => {
 		openapi: "3.1.0",
 		info: {
 			title: "amagi HTTP API",
-			version: options.version ?? "7.0.0-beta.8",
+			version: options.version ?? "7.0.0-beta.9",
 			description: [
 				"由端点注册表派生的规范 —— 手写的那份已经漂移，这份不会（`gen-openapi --check` 进 CI）。",
 				"",
@@ -57214,7 +59982,7 @@ var DynamicType = /* @__PURE__ */ function(DynamicType) {
 * 构建后使用 __VERSION__，开发环境从 package.json 读取
 */
 var getVersion = () => {
-	return "7.0.0-beta.8";
+	return "7.0.0-beta.9";
 };
 var VERSION = getVersion();
 /**