specific-ai-cli 0.0.0-stage → 0.1.1

package/static/x/transaction_l1.json

@@ -0,0 +1,12 @@
+{
+  "capturedAt": "2026-09-26",
+  "source": "Chrome login shell /i/flow/login + current ondemand.s.fb6d53755aa5bd29a.js",
+  "key": "nHnf0az57nJeg3cryUhHijcrB07vzlQdJOY8jH0haiX1tcMeA4lEFbpO5I/mtsvn",
+  "indices": [13, 47, 26, 28],
+  "frames": [
+    "M 10,30 C 111,41 250,128 186,124 h 71 s 131,3 208,224 C 26,116 105,178 43,4 h 29 s 94,194 28,138 C 2,244 164,17 184,125 h 87 s 193,55 183,201 C 47,41 12,11 136,5 h 165 s 140,76 39,208 C 225,225 159,195 162,98 h 164 s 120,248 14,32 C 143,127 170,89 48,57 h 106 s 86,61 168,105 C 136,37 57,58 166,96 h 136 s 46,53 168,15 C 144,49 66,198 155,213 h 130 s 204,146 41,30 C 61,171 34,167 183,101 h 58 s 60,34 159,117 C 188,193 80,201 123,29 h 153 s 50,255 13,204 C 242,115 68,210 240,114 h 165 s 36,203 161,198 C 207,23 226,44 173,191 h 152 s 208,79 44,138 C 76,202 39,234 164,247 h 241 s 203,27 91,102 C 40,74 44,152 29,101 h 169 s 40,212 120,109 C 231,126 122,182 16,194 h 98 s 158,65 98,58 C 26,184 135,19 9,5 h 30 s 23,22 7,212",
+    "M 10,30 C 25,198 215,229 77,67 h 14 s 220,12 50,245 C 100,209 222,20 116,6 h 122 s 152,242 242,72 C 154,110 132,84 14,0 h 189 s 206,99 34,63 C 112,172 57,224 25,38 h 141 s 154,25 233,35 C 160,238 122,74 210,37 h 171 s 102,249 42,230 C 17,194 120,49 27,35 h 190 s 223,53 216,192 C 78,48 131,237 172,188 h 34 s 103,193 219,55 C 163,181 51,182 214,188 h 58 s 228,131 188,168 C 131,30 131,109 224,230 h 148 s 228,13 127,46 C 129,120 92,36 200,55 h 109 s 24,181 177,92 C 121,21 73,96 90,48 h 91 s 185,0 30,54 C 181,128 69,219 247,64 h 232 s 252,42 87,189 C 41,93 188,253 119,51 h 44 s 104,172 92,173 C 255,68 28,75 49,101 h 74 s 35,65 255,225 C 40,168 107,97 218,13 h 119 s 251,203 199,117 C 4,129 208,151 128,190 h 25 s 173,17 85,11",
+    "M 10,30 C 220,241 180,60 83,47 h 253 s 166,46 1,207 C 50,38 132,79 177,212 h 27 s 126,43 218,198 C 153,149 34,184 25,148 h 62 s 205,101 92,45 C 179,195 136,245 200,186 h 6 s 87,220 64,128 C 207,88 214,52 218,206 h 252 s 39,169 25,205 C 118,189 53,225 151,186 h 23 s 75,162 160,249 C 68,23 24,35 157,23 h 195 s 148,19 220,71 C 199,84 14,66 41,2 h 17 s 114,73 108,199 C 29,221 207,20 31,165 h 209 s 9,29 111,47 C 139,54 167,11 137,227 h 16 s 84,136 249,85 C 191,178 209,193 116,1 h 91 s 168,212 134,117 C 140,231 73,124 248,76 h 196 s 202,231 65,208 C 120,110 156,158 116,181 h 62 s 159,106 129,18 C 37,176 101,149 104,17 h 123 s 194,236 193,55 C 29,149 205,24 32,223 h 15 s 60,208 152,137 C 69,205 138,149 68,242 h 73 s 5,113 113,7",
+    "M 10,30 C 75,47 93,40 123,41 h 137 s 28,7 72,187 C 38,121 180,136 224,213 h 238 s 239,214 187,85 C 52,135 198,49 159,238 h 190 s 231,110 157,59 C 250,181 64,159 8,69 h 121 s 136,176 135,231 C 115,113 171,96 221,146 h 112 s 84,39 195,97 C 211,150 165,139 224,12 h 37 s 44,25 76,131 C 30,45 134,159 220,159 h 95 s 248,168 24,26 C 140,174 97,127 78,16 h 48 s 38,142 10,203 C 128,30 174,78 107,219 h 198 s 166,61 217,189 C 226,253 231,27 24,250 h 24 s 142,133 82,99 C 119,233 139,85 112,162 h 101 s 154,142 122,58 C 10,161 148,255 114,127 h 12 s 244,99 223,52 C 83,79 235,130 59,0 h 80 s 4,222 111,95 C 101,200 9,117 102,149 h 243 s 103,10 64,56 C 209,121 240,178 241,203 h 189 s 200,175 16,19 C 155,29 186,83 49,86 h 21 s 214,57 122,44"
+  ]
+}

package/static/xhs/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "commonjs"
+}

package/static/xhs/xhs_core/js/b1.js

@@ -0,0 +1,210 @@
+'use strict';
+
+const fs = require('fs');
+
+const B1_RC4_KEY = 'xhswebmplfbt';
+const B1_BASE64_ALPHABET = 'ZmserbBoHQtNP+wOcza/LpngG8yJq42KWYj0DSfdikx3VT16IlUAFM97hECvuRX5';
+const MINI_FIELD_KEYS = Object.freeze([
+  'x33', 'x34', 'x35', 'x36', 'x37', 'x38', 'x39',
+  'x42', 'x43', 'x44', 'x45', 'x46',
+  'x48', 'x49', 'x50', 'x51', 'x52', 'x82', 'x84',
+]);
+const DEFAULT_X37 = '0|0|0|0|0|0|0|0|0|1|0|0|1|0|0|0|0|1|1|0|0|0|0|0';
+const DEFAULT_X38 = '0|0|1|0|1|0|0|0|0|0|1|0|1|0|1|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0';
+const DEFAULT_X82 = '1|_BHjFmfUMEtxhI|_AUuXfEG27Xa3x|__xhsPendingNotePoint25300ReportMap|__xhsReportedNotePoint25300RecordMap|setImDebugMode|anti_hp_sign_config|__rap_app_id__|__rap_report__|__rap_last_sign_cost__|__rap_last_transform_cost__|__rap_hijack_installed__|__ed1a7dddf7c818e4bd|__hp_xhs_search_input_state__|__h';
+const DEFAULT_X39 = '22';
+const DEFAULT_X45 = '__SEC_CAV__1-1-1-1-1|';
+const DEFAULT_X50 = '131,88,103';
+
+function orderedMiniFields(input) {
+  const out = {};
+  for (const key of MINI_FIELD_KEYS) {
+    if (Object.prototype.hasOwnProperty.call(input || {}, key)) out[key] = input[key];
+  }
+  return out;
+}
+
+function rc4BinaryString(plainText, key = B1_RC4_KEY) {
+  const state = Array.from({ length: 256 }, (_, i) => i);
+  let j = 0;
+  for (let i = 0; i < 256; i++) {
+    j = (j + state[i] + key.charCodeAt(i % key.length)) & 0xff;
+    [state[i], state[j]] = [state[j], state[i]];
+  }
+
+  let i = 0;
+  j = 0;
+  let encrypted = '';
+  for (let offset = 0; offset < plainText.length; offset++) {
+    i = (i + 1) & 0xff;
+    j = (j + state[i]) & 0xff;
+    [state[i], state[j]] = [state[j], state[i]];
+    const keyByte = state[(state[i] + state[j]) & 0xff];
+    encrypted += String.fromCharCode(plainText.charCodeAt(offset) ^ keyByte);
+  }
+  return encrypted;
+}
+
+function customBase64(bytes, alphabet = B1_BASE64_ALPHABET) {
+  let out = '';
+  for (let offset = 0; offset < bytes.length; offset += 3) {
+    const a = bytes[offset];
+    const hasB = offset + 1 < bytes.length;
+    const hasC = offset + 2 < bytes.length;
+    const b = hasB ? bytes[offset + 1] : 0;
+    const c = hasC ? bytes[offset + 2] : 0;
+    out += alphabet[a >>> 2];
+    out += alphabet[((a & 0x03) << 4) | (b >>> 4)];
+    out += hasB ? alphabet[((b & 0x0f) << 2) | (c >>> 6)] : '=';
+    out += hasC ? alphabet[c & 0x3f] : '=';
+  }
+  return out;
+}
+
+function customBase64Decode(text, alphabet = B1_BASE64_ALPHABET) {
+  const reverse = new Map(Array.from(alphabet, (char, index) => [char, index]));
+  const bytes = [];
+  for (let offset = 0; offset < text.length; offset += 4) {
+    const a = reverse.get(text[offset]);
+    const b = reverse.get(text[offset + 1]);
+    const c = text[offset + 2] === '=' ? 0 : reverse.get(text[offset + 2]);
+    const d = text[offset + 3] === '=' ? 0 : reverse.get(text[offset + 3]);
+    if ([a, b, c, d].some(x => x === undefined)) throw new Error('invalid b1 base64 character');
+    bytes.push((a << 2) | (b >>> 4));
+    if (text[offset + 2] !== '=') bytes.push(((b & 0x0f) << 4) | (c >>> 2));
+    if (text[offset + 3] !== '=') bytes.push(((c & 0x03) << 6) | d);
+  }
+  return Uint8Array.from(bytes);
+}
+
+function encodeB1FromMini(miniFields) {
+  const plainText = JSON.stringify(orderedMiniFields(miniFields));
+  const encrypted = rc4BinaryString(plainText);
+  return customBase64(Buffer.from(encrypted, 'utf8'));
+}
+
+function decodeB1(b1) {
+  const encrypted = Buffer.from(customBase64Decode(b1)).toString('utf8');
+  const plainText = rc4BinaryString(encrypted);
+  return JSON.parse(plainText);
+}
+
+function formatTelemetry(options = {}) {
+  const now = Number(options.now ?? Date.now());
+  const timeOrigin = Number(options.timeOrigin ?? (now - Number(options.sessionAgeMs ?? 2151.1)));
+  const activeProfile = options.profile === 'active' || options.profile === 'legacy-active';
+  const mouse = activeProfile
+    ? { me: 50, mm: 50, md: 1, mu: 1, c: 1, ...(options.mouse || {}) }
+    : { ...(options.mouse || {}) };
+  const page = activeProfile
+    ? { ulr: 1, ps: 1, f: 3, b: 3, vc: 0, rs: 1, sc: 0, ...(options.page || {}) }
+    : { ulr: 2, ps: 1, ...(options.page || {}) };
+  const state = { h: 0, f: 1, kr: 0, ...(options.state || {}) };
+  const featureInput = options.features || {};
+  const features = activeProfile ? {
+    ae: 3.3656015629507223,
+    ak: 6.231183732330187,
+    cdr: 0.4096814442007536,
+    bf: { ar: 0.6210873146622735, fr: 7.158084478545331 },
+    fi: Number(options.firstInteraction ?? 2151.1),
+    ...featureInput,
+  } : {
+    ae: null,
+    ak: null,
+    cdr: null,
+    bf: null,
+    fi: null,
+    ...featureInput,
+  };
+  const keyboard = options.keyboard || {};
+  const mapText = value => Object.entries(value)
+    .map(([key, item]) => `${key}:${item}`)
+    .join(',');
+  const bfText = features.bf == null
+    ? 'null'
+    : `{ar:${features.bf.ar},fr:${features.bf.fr}}`;
+  return `{mt:{to:${timeOrigin}},m:{${mapText(mouse)}},k:{${mapText(keyboard)}},p:{${mapText(page)}},st:{${mapText(state)}},ft:{ae:${features.ae},ak:${features.ak},cdr:${features.cdr},bf:${bfText},fi:${features.fi}}}`;
+}
+
+// 默认构造“冷启动/低交互”profile。b1 是环境快照，不是稳定设备 ID：
+// x36/x39/x44/x50/x82/x84 会随页面、浏览器能力和交互状态变化。
+// 如需和某一条浏览器样本逐字节相等，必须把该样本解出的字段通过 overrides 传入。
+function buildMiniFields(options = {}) {
+  const now = Number(options.now ?? Date.now());
+  const windowKeysRaw = Array.isArray(options.windowKeys)
+    ? `1|${options.windowKeys.join('|')}`
+    : (options.x82 ?? DEFAULT_X82);
+  // 浏览器 collector 对页面全局名快照最多保留 300 个字符。
+  const windowKeys = String(windowKeysRaw).slice(0, 300);
+  const fields = {
+    x33: '0',
+    x34: '0',
+    x35: '0',
+    x36: String(options.frameCount ?? 2),
+    x37: DEFAULT_X37,
+    x38: DEFAULT_X38,
+    // x39 不是 window/global 数量。Creator 4.3.6 的发布页采集器通常
+    // 落在 16-22；纯算层把它作为显式环境输入，历史 fixture 可覆盖。
+    x39: String(options.x39 ?? DEFAULT_X39),
+    // Creator's current 4.3.6 collector reports 3.5.6.  Captured fixture
+    // callers can still override x42 explicitly for historical replays.
+    x42: String(options.sdkVersion ?? '3.5.6'),
+    x43: String(options.canvasFingerprint ?? 'Canvas not supported'),
+    x44: String(now),
+    x45: String(options.secCanvas ?? DEFAULT_X45),
+    x46: String(options.webdriver ?? false),
+    x48: String(options.x48 ?? ''),
+    x49: String(options.x49 ?? '{list:[],type:}'),
+    // x50 是初始化期缓存的三元素浏览器能力向量，不是 global 数量。
+    x50: String(options.x50 ?? options.globalCount ?? DEFAULT_X50),
+    x51: String(options.x51 ?? ''),
+    x52: String(options.x52 ?? ''),
+    x82: String(windowKeys),
+    x84: String(options.x84 ?? formatTelemetry({ ...options.telemetry, now })),
+  };
+  return Object.assign(fields, options.overrides || {});
+}
+
+function generateB1(options = {}) {
+  const mini = buildMiniFields(options);
+  return { b1: encodeB1FromMini(mini), mini };
+}
+
+function main(argv = process.argv) {
+  const arg = argv[2];
+  if (arg === '--generate') {
+    const options = argv[3] ? JSON.parse(argv[3]) : {};
+    process.stdout.write(JSON.stringify(generateB1(options)) + '\n');
+    return;
+  }
+  if (arg === '--decode') {
+    process.stdout.write(JSON.stringify(decodeB1(argv[3] || ''), null, 2) + '\n');
+    return;
+  }
+  if (!arg) {
+    process.stdout.write(JSON.stringify(generateB1()) + '\n');
+    return;
+  }
+  const input = arg.startsWith('@')
+    ? JSON.parse(fs.readFileSync(arg.slice(1), 'utf8'))
+    : JSON.parse(arg);
+  process.stdout.write(encodeB1FromMini(input) + '\n');
+}
+
+if (require.main === module) main();
+
+module.exports = {
+  B1_RC4_KEY,
+  B1_BASE64_ALPHABET,
+  MINI_FIELD_KEYS,
+  orderedMiniFields,
+  rc4BinaryString,
+  customBase64,
+  customBase64Decode,
+  encodeB1FromMini,
+  decodeB1,
+  formatTelemetry,
+  buildMiniFields,
+  generateB1,
+  main,
+};

package/static/xhs/xhs_core/js/mns.js

@@ -0,0 +1,340 @@
+/**
+ * mnsv2 → mns0101_/0201_/0301_ 100% 纯算法
+ * ============================================================
+ *
+ *   sign = "mns0301_" + base64_custom( XOR( pack(fields), KEYSTREAM ) )
+ *
+ * 全部子过程均已还原为可读算法（无 VM / 无 __$c / 无补环境）：
+ *   - pack        : 见 packPlaintext（TLV 字段布局）
+ *   - ds 环境指纹 : envFp()  = [1, ver0^115, <14 固定环境常量>]
+ *   - ds 设备签名 : dsSig()  = dsf(le64(ts)++md5(api+data)) 逐字节 XOR ver0
+ *   - _dsf        : 自定义 4-lane ARX 哈希（见 dsf()）
+ *   - encrypt     : XOR 固定密钥流（stream cipher）
+ *   - base64      : 自定义字母表
+ */
+'use strict';
+
+const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
+
+const ALPHABET = 'MfgqrsbcyzPQRStuvC7mn501HIJBo2DEFTKdeNOwxWXYZap89+/A4UVLhijkl63G';
+const MNS0101_ALPHABET = 'NOPQRStuvwxWXYZabcyz012DEFTKLMdefghijkl4563GHIJBC7mnop89+/';
+
+const KEYSTREAM = (() => {
+  const j = JSON.parse(fs.readFileSync(path.join(__dirname, 'mns_keystreams.json'), 'utf8'));
+  return [...Buffer.from(j.b64, 'base64')];
+})();
+
+const MNS0101_KEYSTREAM = (() => {
+  const j = JSON.parse(fs.readFileSync(path.join(__dirname, 'mns_0101_keystream.json'), 'utf8'));
+  return [...Buffer.from(j.b64, 'base64')];
+})();
+
+// envConst/envFpTail/loadts/seq/appId/deviceTag 属于页面、平台与会话状态，
+// 不是算法常量。PC 与 Creator 共用本文件，平台层必须显式传入这些材料。
+
+function md5Bytes(s) {
+  return [...crypto.createHash('md5').update(String(s), 'utf8').digest()];
+}
+function le32(n) {
+  n >>>= 0;
+  return [n & 255, (n >>> 8) & 255, (n >>> 16) & 255, (n >>> 24) & 255];
+}
+function le64(n) {
+  const out = [];
+  let b = BigInt(n);
+  for (let i = 0; i < 8; i++) { out.push(Number(b & 255n)); b >>= 8n; }
+  return out;
+}
+function strBytes(s) {
+  return [...Buffer.from(String(s), 'utf8')];
+}
+function base64Custom(bytes) {
+  let out = '';
+  for (let i = 0; i < bytes.length; i += 3) {
+    const b0 = bytes[i], b1 = bytes[i + 1], b2 = bytes[i + 2];
+    out += ALPHABET[b0 >> 2];
+    out += ALPHABET[((b0 & 3) << 4) | ((b1 || 0) >> 4)];
+    if (b1 === undefined) { out += '=='; break; }
+    out += ALPHABET[((b1 & 15) << 2) | ((b2 || 0) >> 6)];
+    if (b2 === undefined) { out += '='; break; }
+    out += ALPHABET[b2 & 63];
+  }
+  return out;
+}
+
+// mns0101 使用自定义 Base58，而不是 0201/0301 的自定义 Base64。
+// 前导零使用该字母表中的 `1` 表示。
+function base58Custom(bytes) {
+  let value = 0n;
+  for (const byte of bytes) value = (value << 8n) | BigInt(byte);
+  let body = '';
+  while (value > 0n) {
+    body = MNS0101_ALPHABET[Number(value % 58n)] + body;
+    value /= 58n;
+  }
+  let zeros = 0;
+  for (const byte of bytes) {
+    if (byte !== 0) break;
+    zeros++;
+  }
+  return '1'.repeat(zeros) + body;
+}
+
+function base58CustomDecode(text) {
+  const reverse = new Map(Array.from(MNS0101_ALPHABET, (char, index) => [char, BigInt(index)]));
+  let value = 0n;
+  let offset = 0;
+  while (offset < text.length && text[offset] === '1') offset++;
+  for (let i = offset; i < text.length; i++) {
+    const digit = reverse.get(text[i]);
+    if (digit === undefined) throw new Error(`invalid mns0101 base58 character at ${i}`);
+    value = value * 58n + digit;
+  }
+  const bytes = [];
+  while (value > 0n) {
+    bytes.unshift(Number(value & 255n));
+    value >>= 8n;
+  }
+  return new Array(offset).fill(0).concat(bytes);
+}
+
+// --- ds 设备签名 _dsf：自定义 4-lane ARX 哈希 ---
+function rotl(x, r) {
+  return (((x << r) | 0) + (x >>> (32 - r))) | 0;
+}
+function dsf(data) {
+  const len = data.length;
+  const rd = (o) => (data[o] | (data[o + 1] << 8) | (data[o + 2] << 16) | (data[o + 3] << 24)) | 0;
+  let h1 = (0x6d2b79f5 ^ len) | 0;
+  let h2 = (0x1b873593 ^ (len << 8)) | 0;
+  let h3 = (0x85ebca6b ^ (len << 16)) | 0;
+  let h4 = (0xc2b2ae35 ^ (len << 24)) | 0;
+  for (let i = 0; i + 8 <= len; i += 8) {
+    const w0 = rd(i), w1 = rd(i + 4);
+    h1 = rotl((((h1 + w0) | 0) ^ h3) | 0, 7);
+    h2 = rotl((((h2 ^ w0) | 0) + h4) | 0, 11);
+    h3 = rotl((((h3 + w1) | 0) ^ h1) | 0, 13);
+    h4 = rotl((((h4 ^ w1) | 0) + h2) | 0, 17);
+  }
+  h1 = (h1 ^ len) | 0;
+  h2 = (h2 ^ h1) | 0;
+  h3 = (h3 + h2) | 0;
+  h4 = (h4 ^ h3) | 0;
+  h1 = rotl(h1, 9); h2 = rotl(h2, 13); h3 = rotl(h3, 17); h4 = rotl(h4, 19);
+  h1 = (h1 + h3) | 0;
+  h2 = (h2 ^ h4) | 0;
+  h3 = (h3 + h1) | 0;
+  h4 = (h4 ^ h2) | 0;
+  const out = [];
+  for (const h of [h1 >>> 0, h2 >>> 0, h3 >>> 0, h4 >>> 0]) {
+    out.push(h & 255, (h >>> 8) & 255, (h >>> 16) & 255, (h >>> 24) & 255);
+  }
+  return out;
+}
+
+function envFp(versionKey, tail) {
+  if (!Array.isArray(tail) || tail.length !== 14) {
+    throw new Error('envFpTail required (14 bytes)');
+  }
+  return [1, versionKey ^ 115].concat(tail);
+}
+
+function packPlaintext(p) {
+  if (p.loadts == null) throw new Error('mns loadts required');
+  if (p.seq == null) throw new Error('mns seq required');
+  if (p.envConst == null) throw new Error('mns envConst required');
+  if (!Array.isArray(p.envFpTail) || p.envFpTail.length !== 14) {
+    throw new Error('mns envFpTail required (14 bytes)');
+  }
+  const version = p.version >>> 0;
+  const vKey = version & 255;
+  const ts = p.ts;
+  const loadts = p.loadts;
+  const appId = String(p.appId || 'xhs-pc-web');
+  const deviceTag = String(p.deviceTag || p.dsn || 'a3');
+  const full = String(p.api) + (p.data || '');
+  // md5FullBytes / md5UrlBytes are the u and p params from seccore_signv2 (already-computed md5s).
+  // If not supplied, compute from api+data / api locally.
+  const md5full = p.md5FullBytes ? [...p.md5FullBytes] : md5Bytes(full);
+  const md5api = p.md5UrlBytes ? [...p.md5UrlBytes] : md5Bytes(p.api);
+  // DS 脚本尚未就绪时浏览器的 window._dsn = "nop"，此阶段尾部直接放
+  // MD5(url) XOR versionLowByte；DS 就绪后 PC/Creator 分别使用 a3/a1，
+  // 尾部改为 _dsf(null, timestamp || MD5(url)) XOR versionLowByte。
+  // Creator 的 _dsf 来自当前服务端 DS 程序，通过 dsSigBytes 显式传入；
+  // 本地 dsf() 仅保留给已经完成静态提纯的平台路径。
+  let rawDsSig;
+  if (deviceTag === 'nop') {
+    rawDsSig = md5api;
+  } else if (Array.isArray(p.dsSigBytes) || ArrayBuffer.isView(p.dsSigBytes)) {
+    rawDsSig = Array.from(p.dsSigBytes);
+    if (rawDsSig.length !== 16) throw new Error('mns dsSigBytes must be 16 bytes');
+  } else {
+    rawDsSig = dsf(le64(ts).concat(md5api));
+  }
+  const dsSig = rawDsSig.map((b) => b ^ vKey);
+
+  const out = [];
+  const push = (a) => { for (const b of a) out.push(b); };
+  push([121, 104, 96, 41]);
+  push(le32(version));
+  push(le64(ts));
+  push(le64(loadts));
+  push(le32(p.seq >>> 0)); // 请求序列号（会话自增计数器）
+  push(le32(p.envConst >>> 0));
+  push(le32(p.fullLen != null ? p.fullLen >>> 0 : Buffer.byteLength(full, 'utf8')));
+  push(md5full.slice(0, 8).map((b) => b ^ vKey));
+  push([p.a1.length]);
+  push(strBytes(p.a1));
+  const appBytes = strBytes(appId);
+  if (appBytes.length > 255) throw new Error('mns appId too long');
+  push([appBytes.length]);
+  push(appBytes);
+  push(envFp(vKey, p.envFpTail));
+  const tagBytes = strBytes(deviceTag);
+  if (tagBytes.length > 255) throw new Error('mns deviceTag too long');
+  push([tagBytes.length]);
+  push(tagBytes);
+  push([16]);
+  push(dsSig);
+  return out;
+}
+
+// Helper: hex string → bytes array
+function hexToBytes(hex) {
+  const out = [];
+  for (let i = 0; i < hex.length; i += 2) out.push(parseInt(hex.slice(i, i + 2), 16));
+  return out;
+}
+
+// seccore_signv2 wrapper: matches browser's exact call convention.
+// c = url + JSON.stringify(data) or url + data(string), u = md5(c) hex, p = md5(url) hex.
+function seccoreSignV2({
+  url, data, a1, ts, loadts, seq, version, envConst, envFpTail,
+  appId = 'xhs-pc-web', deviceTag = 'a3',
+}) {
+  const c = String(url) + (data == null ? '' : (typeof data === 'object' ? JSON.stringify(data) : String(data)));
+  const uHex = crypto.createHash('md5').update(c).digest('hex');
+  const pHex = crypto.createHash('md5').update(String(url)).digest('hex');
+  const md5FullBytes = hexToBytes(uHex);
+  const md5UrlBytes = hexToBytes(pHex);
+  return sign({
+    api: url, data, a1, ts, loadts, seq, version, envConst, envFpTail,
+    appId, deviceTag,
+    md5FullBytes, md5UrlBytes,
+    fullLen: Buffer.byteLength(c, 'utf8'),
+  });
+}
+
+function sign(p) {
+  const plain = packPlaintext(p);
+  const cipher = plain.map((b, i) => b ^ KEYSTREAM[i]);
+  return 'mns0301_' + base64Custom(cipher);
+}
+
+// mns0101：同一 144B pack → 固定密钥流 XOR → 自定义 Base58。
+// 浏览器冷启动内容请求夹具已从显式 pack 输入 6/6 byte-exact。
+function sign0101(p) {
+  const plain = packPlaintext(p);
+  if (plain.length > MNS0101_KEYSTREAM.length) {
+    throw new Error(`mns0101 keystream too short: ${MNS0101_KEYSTREAM.length} < ${plain.length}`);
+  }
+  const cipher = plain.map((byte, index) => byte ^ MNS0101_KEYSTREAM[index]);
+  return 'mns0101_' + base58Custom(cipher);
+}
+
+// ============================================================
+// mns0201 档位：XXTEA(自定义 DELTA) + 同一自定义 base64 字母表
+// ------------------------------------------------------------
+// 从 vendor-dynamic VM 字节码静态还原（f_13448_141 管线）：
+//   pack(144B) --toWordsLE(includeLength=true)--> 37 words
+//   --XXTEA_encrypt(key, DELTA=1013904243)--> 37 words
+//   --fromWordsLE(includeLength=false)--> 148 bytes
+//   --base64_custom--> payload ；结果 = "mns0201_" + payload
+// 真实密钥 = utf8("e6483ca2a1eed5e3")（VM 内 "e6"+"483c"+"a2a1eed5e3" 拼接）。
+// 注意："99754106633f94d350db34d548d6091a" 是字节码里的诱饵（其派生值随即被覆盖）。
+const MNS0201_DELTA = 1013904243; // 0x3C6EF373（非标准 golden-ratio）
+const MNS0201_KEY_STR = 'e6483ca2a1eed5e3';
+
+function mnsKeyWords() {
+  let kb = [...Buffer.from(MNS0201_KEY_STR, 'utf8')];
+  if (kb.length < 16) kb = kb.concat(new Array(16 - kb.length).fill(0));
+  return toWordsLE(kb, false);
+}
+function toWordsLE(bytes, includeLength) {
+  const e = bytes.length;
+  let a = e >> 2;
+  if (e & 3) a++;
+  const t = includeLength ? new Array(a + 1).fill(0) : new Array(a).fill(0);
+  if (includeLength) t[a] = e;
+  for (let o = 0; o < e; o++) t[o >> 2] |= bytes[o] << ((o & 3) << 3);
+  return t;
+}
+function fromWordsLE(r, includeLength) {
+  let t = r.length, a = t << 2;
+  if (includeLength) { const e = r[t - 1]; a -= 4; if (e < a - 3 || e > a) return null; a = e; }
+  const f = new Array(a);
+  for (let i = 0; i < a; i++) f[i] = (r[i >> 2] >>> ((i & 3) << 3)) & 0xff;
+  return f;
+}
+function xxteaMx(sum, y, z, p, e, k) {
+  return ((((z >>> 5) ^ (y << 2)) + ((y >>> 3) ^ (z << 4))) ^ (((sum ^ y) + (k[(p & 3) ^ e] ^ z)))) | 0;
+}
+function xxteaEncrypt(v, k) {
+  const n = v.length;
+  if (n < 2) return v;
+  const nn = n - 1;
+  let rounds = Math.floor(6 + 52 / n);
+  let sum = 0, y, z = v[nn], e, p;
+  while (rounds-- > 0) {
+    sum = (sum + MNS0201_DELTA) | 0;
+    e = (sum >>> 2) & 3;
+    for (p = 0; p < nn; p++) { y = v[p + 1]; z = v[p] = (v[p] + xxteaMx(sum, y, z, p, e, k)) | 0; }
+    y = v[0]; z = v[nn] = (v[nn] + xxteaMx(sum, y, z, nn, e, k)) | 0;
+  }
+  return v;
+}
+function xxteaDecrypt(v, k) {
+  const n = v.length;
+  if (n < 2) return v;
+  const nn = n - 1;
+  let rounds = Math.floor(6 + 52 / n);
+  let sum = (rounds * MNS0201_DELTA) | 0, y = v[0], z, e, p;
+  while (sum !== 0) {
+    e = (sum >>> 2) & 3;
+    for (p = nn; p > 0; p--) { z = v[p - 1]; y = v[p] = (v[p] - xxteaMx(sum, y, z, p, e, k)) | 0; }
+    z = v[nn]; y = v[0] = (v[0] - xxteaMx(sum, y, z, 0, e, k)) | 0;
+    sum = (sum - MNS0201_DELTA) | 0;
+  }
+  return v;
+}
+
+function encrypt0201(pack) {
+  const kw = mnsKeyWords();
+  const dataWords = toWordsLE(pack, true);
+  const cipherWords = xxteaEncrypt(dataWords.slice(), kw);
+  return fromWordsLE(cipherWords, false);
+}
+function sign0201(p) {
+  const plain = packPlaintext(p);
+  return 'mns0201_' + base64Custom(encrypt0201(plain));
+}
+
+// 统一入口：按档位分发（0301 默认；0201 = XXTEA）
+function signTier(p, tier) {
+  switch (tier || '0301') {
+    case '0101': return sign0101(p);
+    case '0201': return sign0201(p);
+    case '0301': return sign(p);
+    default: throw new Error(`unsupported mns tier: ${tier}`);
+  }
+}
+
+module.exports = {
+  sign, sign0101, sign0201, signTier, packPlaintext, dsf, envFp,
+  base58Custom, base58CustomDecode, base64Custom,
+  KEYSTREAM, MNS0101_KEYSTREAM, ALPHABET, MNS0101_ALPHABET,
+  encrypt0201, xxteaEncrypt, xxteaDecrypt, toWordsLE, fromWordsLE, mnsKeyWords,
+  MNS0201_DELTA, MNS0201_KEY_STR, seccoreSignV2, hexToBytes, le64
+};

package/static/xhs/xhs_core/js/mns_0101_keystream.json

@@ -0,0 +1,5 @@
+{
+  "source": "browser-cold-start-fixtures-20260716",
+  "length": 160,
+  "b64": "r1crlcplstnsdrtdLpfLZTKZzGYzmcxmM5nM5nM5nM5nMxkMBgMBAAAAAACAQCCQSCQSicTicTgcDgcDAYBAoFAoFIrFYjEYDAaDwWAwmEwmk8lkslmsVqvV6vX6/X4/n08nk0mk0ul0Op1OJ5NJpNLp9Ho9Ho9HI5FIpNJpNBqNRiMRCIRCIZDIZDKZTKbT6XS63e53Ox2OR6NRKBSKxQ=="
+}

package/static/xhs/xhs_core/js/mns_keystreams.json

@@ -0,0 +1 @@
+{"len":2048,"b64":"caMCJXeTJx3dJzvO4+S5jZ15NeHaM/V2Xi6or7bcd6UaSZ0jtnwgZgAlhgy/E9RUDZJJf1hobFdOUI9G4ZVjRPOROb9PryKj7vEgt5JYFFsv61GTtkeGaZYSmOeb7cpkbhppOpJhVKWnob0c8N7bdC+RenR6HjiLI08id1FttxFgNUOXMPph6YIqDsp7/3LYuiyDzNAm7K7b0M8PE+qxGcftcdHkES1hGoTMeqIO5IOK9bAdyZ9Ua86pkQYMdu2cKikkJSCBj6/Gzd4zjce19s6yvX8DPj5xI+vQA4B9YerOnYOfKXwyxXk1vR+pZRck5g17NB/umq5WUdT0brc32dQ/vEOK2WPs9nmN3N/LE/QkhvDsBMr4U0i6TFjZqPMkk2qFXj2QiMNKclFozf+EwF4S8GfypYc071HDNOzn+6E7Pebc3oX2tQP/BIpRh0ctyxunjJ0XLaNEmC8K7+Xq7QqIIPT/pcaPO/RxN1l9j/F5RP3wRBVoQq/+ckkhzRHX3pRsrkXYMeLm/YrGCVTgONUprhQTXiGHBt7lqXfJZe2sifN1NJ/Y7AFCHLyHpFaUOJynJQR2h7xFqgroroNR96qobgSX9wtzWKy7tuXJY/foUSMZrNKCd0DwsJdeNQQT/AxVKJV0S2kPyRYD8F0c806kIuOyjgFtiIMXt/l9zinKiUIeARq99gKS+A0zBusxfgzmGKRuU0xwUzN0pDBoC2t3KJHFxk3JDwNgnSIrKd+xKUwm2qYuTdnnSnH8B9L2NrFPSUqPaXmm1kB+kFJF6UVaWQTdfgcXCNTARqjCno4fIwaTQR2yUDGcLW3jwfSD5kR5EqvSuowYQV2Klr2boaCcbqfplJTahQmv4/kjCgsdGe/zzAe5FL8V5r6uq0ZOXt+hsOu+zGluc4BtvHRf+ml561z6QDjyHph9ebP46S3bG1xF7YGL97i7lGKdh+gA4AXDJRqg1TyA/35/n2PTjq2RGc27DQqwpW7Ig02h2enYqrG7vnf6/o/NGuwIqI6GKz97JgiZ27YE7h3/rGa0kDCQRDAW4K27445Z50eQUyMJ0giu0JDxmqxbiUBx1Fy3KvRNLn6Eff7REe7I269LB1nmsXRDaq6Nt2wK02RL0pVy+V1aIPCKRu7cvSxvd0ft4LkJ721oFY7rXFcdi0OTai8c6NR56Nvh8VU/Krt2cegnzXLozqVk4zyf40vVLdFfY0m+Gc2bAcSDnwqn9fAyCbBZXSAcxJpfo/YnSlSsJftRpzf5TyryQwhcG1fHRKJ1rwJLgzOKpKgFEMorDtklgBhKZzR7ZaE095T5VU1xD28kXQBBWStfJrMKlm1rIOhrP46sIcUwPrkoGo6UBVg7lSOue2kzAk5AAdeCWplT3kIsUnhwTBzLs7LEpER8IMEwjMH3cGTSgU6er6JS6TbXRnDPdxJ0B3ZAPLW5/dl2nRT1ukTmjML/EYN5KfcK0eknyXxJF7rbcWM9a4kYAri2BnSIW+aJzY3JBlQ4zvHfbDz6oQYNKcNgIb9EqG5/eZQf5zh3ZyjpXpYMLx6e281S+iS+NphCurDhwdgEwL1/JyxU7NQ25ub0hZiaJkSVabJPHurrz9bcyOCZAm1Ud8An9P+t9iVexHQ86zGrAXqWn9Ak432VmsPVOmuySesy9J6jyO/EVSrL/AKS4vF3d2XT1Vec70mKhjRSFY1H3IQCC+tyS5OF75/0ZcfQzL8xw4C6aAg8BbuQUwuyi3dY/7+kuApRO74Iv3XqSzDkpF/7puu0X3LccG4dfM3Y8uM2IQOrWuWLW+dNlNgKh55SdDmU55AFl9b+9c7Jl754V5F1/SCBJquZPN4PKigIF9nY8j+rey/JyGI4ADXuFjO/eggsUBMlqJpse2iC+IEJH80WLXL7KzXsinvml1cTHbfcL1Afkw74oEAxT3wjr2wqqblTc/Q/9JRCtVfhjMt4Orr/aTa8sCpnqdp3GSOoHxIKD4AVZbNAU1Qm2A27o8b5O2rObsLKVBB9EWl2XmxZfn9PNO3HE66dLJVYt5HuNyVF92YuxCPiyt+OphWvHEYFTRqgGdPRWGuYg4os3vodNtP6Ter7mse1LhbGVV+5jN83DSNyOCRqu7zR9ZxeGQuPUQRzE4rnEqszkKZ5/5oG4670QAgDpN8EYc28/8n2Az4d9okK7ucETRn9dqHQ7MRmG6OunBr701R2GZXUK4INLOOkkl4pU6SwmfmEn5E6jlNohGXha9i0TqCox78Sc2mIyr6rqVSW3kcwxkzovRFvFK9zNC7aq6fQ0aHWMtQMD5pLbqyqitPtT+1jYGLjJBik2cQTzQJGxnpFNyhlGf/YE6WcpNjO15FOXx1A35tBxkYj3smYUGABB8SSc2orIaPnz5OYnLdEbC7j91MyIksu3LZIswvrk7Jv0oiNICLuFMZtwEFcmomLpwU5Midf2ek3KfEnG8ymbCh4fczWyQfUtsGqOK2CMlDc2GzyRxauPxWD4SxJdFv+BuP+ykHOMchhSPldyYYJrePMyFtQm+qDzv3f+EZfsLt2IXbHK1JwUqKW4d+v7GyQ0ulJir/j9po87IALKkuwbnTWdSjoICtEKmf8Jo9ehKu40bWYPh5sIdpcsJd/6pD1Sa29qlqMVSTOc3O9LumtdFuGdBl/qbVxnzGcjGCDsl0/5A2ghjVrW2DwgBWj8eN9V7BkhCNzoMw8HRm3SnPehuAdbboPITim0nxdrG4="}