specific-ai-cli 0.0.0-stage → 0.1.1

package/static/xhs/xhs_creator/js/profile.js

@@ -0,0 +1,115 @@
+'use strict';
+
+const CryptoJS = require('crypto-js');
+const reference = require('./reference_profile.json');
+
+const DES_KEY = CryptoJS.enc.Utf8.parse('zbp30y86');
+
+function clone(value) {
+  return JSON.parse(JSON.stringify(value));
+}
+
+function mapText(value) {
+  return Object.entries(value || {}).map(([key, item]) => `${key}:${item}`).join(',');
+}
+
+function buildTelemetry(options = {}) {
+  if (options.telemetry != null) return String(options.telemetry);
+  const timestampMs = Number(options.timestampMs ?? Date.now());
+  const timeOrigin = Number(options.timeOrigin ?? (timestampMs - 613.5));
+  const mouse = options.mouse || {};
+  const keyboard = options.keyboard || {};
+  const page = { ulr: 1, ps: 1, ...(options.page || {}) };
+  const state = { h: 0, f: 1, kr: 0, ...(options.state || {}) };
+  const features = {
+    ae: null,
+    ak: null,
+    cdr: null,
+    bf: null,
+    fi: null,
+    ...(options.features || {}),
+  };
+  const bfText = features.bf == null
+    ? 'null'
+    : `{ar:${features.bf.ar},fr:${features.bf.fr}}`;
+  return `{mt:{to:${timeOrigin}},m:{${mapText(mouse)}},k:{${mapText(keyboard)}},`
+    + `p:{${mapText(page)}},st:{${mapText(state)}},`
+    + `ft:{ae:${features.ae},ak:${features.ak},cdr:${features.cdr},bf:${bfText},fi:${features.fi}}}`;
+}
+
+function buildProfileFields(options = {}) {
+  const profileReference = reference.webProfile;
+  const fields = clone(profileReference.fields);
+  const timestampMs = Number(options.timestampMs ?? Date.now());
+  if (!Number.isSafeInteger(timestampMs) || timestampMs <= 0) {
+    throw new TypeError('timestampMs must be a positive safe integer');
+  }
+  if (options.documentCookie == null) {
+    throw new TypeError('documentCookie is required for Creator profileData');
+  }
+
+  fields.x44 = String(timestampMs);
+  fields.x57 = String(options.documentCookie);
+  fields.x84 = buildTelemetry({ ...options, timestampMs });
+  if (options.location || options.referer) {
+    fields.x66 = {
+      ...fields.x66,
+      location: String(options.location || fields.x66.location || ''),
+      referer: String(options.referer || fields.x66.referer || ''),
+    };
+  }
+
+  for (const [key, value] of Object.entries(options.fields || {})) {
+    if (!Object.prototype.hasOwnProperty.call(fields, key)) {
+      throw new TypeError(`unsupported Creator webProfile field: ${key}`);
+    }
+    fields[key] = value;
+  }
+  return fields;
+}
+
+function encodeProfileData(fields) {
+  if (!fields || typeof fields !== 'object' || Array.isArray(fields)) {
+    throw new TypeError('profile fields must be an object');
+  }
+  const serialized = JSON.stringify(fields);
+  const base64 = Buffer.from(serialized, 'utf8').toString('base64');
+  const encrypted = CryptoJS.DES.encrypt(
+    CryptoJS.enc.Latin1.parse(base64),
+    DES_KEY,
+    { mode: CryptoJS.mode.ECB, padding: CryptoJS.pad.ZeroPadding },
+  );
+  return encrypted.ciphertext.toString(CryptoJS.enc.Hex);
+}
+
+function generateProfileData(options = {}) {
+  return encodeProfileData(buildProfileFields(options));
+}
+
+function main() {
+  const options = process.argv[2] ? JSON.parse(process.argv[2]) : {};
+  const profileData = generateProfileData(options);
+  process.stdout.write(`${JSON.stringify({
+    profileData,
+    length: profileData.length,
+    sdkVersion: reference.release.webProfileSdkVersion,
+    algorithm: reference.webProfile.algorithm,
+  })}\n`);
+}
+
+if (require.main === module) {
+  try {
+    main();
+  } catch (error) {
+    process.stderr.write(`${error && error.stack ? error.stack : error}\n`);
+    process.exit(1);
+  }
+}
+
+module.exports = {
+  buildTelemetry,
+  buildProfileFields,
+  encodeProfileData,
+  generateProfileData,
+  main,
+};

package/static/xhs/xhs_creator/js/rap_fingerprint_creator.json

@@ -0,0 +1,6 @@
+{
+  "schemaVersion": 1,
+  "source": "creator-publish-rap-decrypt-20260725",
+  "note": "从浏览器 Creator post_note(reqid=5609, build 1.19.3)的 x-rap-param 信封 AES 解密所得 436B 指纹模板（rap_crypto decryptBody + mask=0x64）。03ea 段为 16 字符 Uuid（每次生成时应随机化），03eb 段为 RequestHash 槽位（生成时按 url+body 现算覆写）。",
+  "bodyUnmaskedHex": "03ea0000001038697236613636656a3471637239793403eb0cbf3674041b00041c00041d00041e00041f00042000042100042200042300042400042500042600042700042800042900042e00042a00042b00042c00042d00044c00000000042f000430000431000433000002b30434000004c904350000019f97e30e7b04360000002affffffff0002c300000000000001fffe000000000100000000000100ffffffff0016c000000000000102043a00000000043b0000019f97e22f5e043c000000a4000000044b657950000501044b657950000500044b657949000b01044b657949000c00044b657944001001044b657944001100044b657945001501044b657945001600044b657952001a01044b657952001b00054d696e7573001f01054d696e7573001f00044b657958002301044b657958002400044b657948002a01044b657948002b00044b657953002e01044b657953002f000553706163650032010553706163650440000000000442000000000449000000000444000004fe0446000004f604470000019f97d9f906044500000000044800044300000004001effff047f00048000048100048200048300048400"
+}

package/static/xhs/xhs_creator/js/reference_profile.json

@@ -0,0 +1,282 @@
+{
+  "schemaVersion": 1,
+  "source": "creator-browser-4.3.6-20260906",
+  "release": {
+    "appId": "ugc",
+    "platform": "Windows",
+    "signVersion": "4.3.6",
+    "b1SdkVersion": "3.5.4",
+    "webProfileSdkVersion": "4.3.6",
+    "webBuild": "1.26.0",
+    "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36",
+    "secChUa": "\"Not;A=Brand\";v=\"8\", \"Chromium\";v=\"152\", \"Google Chrome\";v=\"152\""
+  },
+  "webProfile": {
+    "algorithm": "base64-des-ecb-zero-padding-hex",
+    "svn": "2",
+    "fields": {
+      "x1": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36",
+      "x2": "false",
+      "x3": "zh-CN",
+      "x4": "24",
+      "x5": "32",
+      "x6": "24",
+      "x7": "Google Inc. (NVIDIA),ANGLE (NVIDIA, NVIDIA GeForce RTX 5060 Ti (0x00002D04) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+      "x8": "20",
+      "x9": "2560;1440",
+      "x10": "2560;1392",
+      "x11": "-480",
+      "x12": "Asia/Shanghai",
+      "x13": "true",
+      "x14": "true",
+      "x15": "true",
+      "x16": "false",
+      "x17": "false",
+      "x18": "un",
+      "x19": "Win32",
+      "x20": "un",
+      "x21": "PDF Viewer,Chrome PDF Viewer,Chromium PDF Viewer,Microsoft Edge PDF Viewer,WebKit built-in PDF",
+      "x22": "c8e2f6ff2a07957f70a18cde6b905ebb",
+      "x23": "false",
+      "x24": "false",
+      "x25": "false",
+      "x26": "false",
+      "x27": "false",
+      "x28": "10,false,false",
+      "x29": "4,7,8",
+      "x30": "swf object not loaded",
+      "x31": "124.04347527516074",
+      "x33": "0",
+      "x34": "0",
+      "x35": "0",
+      "x36": "2",
+      "x37": "0|0|0|0|0|0|0|0|0|1|0|0|0|0|0|0|0|0|1|0|0|0|0|0",
+      "x38": "0|0|1|0|1|0|0|0|0|0|1|0|1|0|1|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0",
+      "x39": "2",
+      "x40": "0",
+      "x41": "0",
+      "x42": "3.5.4",
+      "x43": "Canvas not supported",
+      "x44": "__TIMESTAMP_MS__",
+      "x45": "__SEC_CAV__1-1-1-1-1|__SEC_UD__|",
+      "x46": "false",
+      "x47": "1|0|0|0|0|0",
+      "x48": "",
+      "x49": "{list:[],type:}",
+      "x50": "",
+      "x51": "",
+      "x52": "",
+      "x54": "11311144241322244122",
+      "x55": "320,260,280,280,280,300,260,260,340,260,240,280,240,320",
+      "x56": "Google Inc. (NVIDIA)|ANGLE (NVIDIA, NVIDIA GeForce RTX 5060 Ti (0x00002D04) Direct3D11 vs_5_0 ps_5_0, D3D11)|0ebc53d03ea89d69525d81de558e2544|35",
+      "x53": "993da9a681fd3994c9f53de11f2903b3",
+      "x57": "__DOCUMENT_COOKIE__",
+      "x58": "575",
+      "x59": "141",
+      "x60": "63",
+      "x61": "1342",
+      "x62": "2047",
+      "x63": "0",
+      "x64": "0",
+      "x65": "0",
+      "x66": {
+        "referer": "https://creator.xiaohongshu.com/login",
+        "location": "https://creator.xiaohongshu.com/new/home",
+        "frame": 0
+      },
+      "x67": "1|0",
+      "x68": "0",
+      "x69": "un",
+      "x70": [
+        "location",
+        "getElementById",
+        "getElementsByTagName",
+        "querySelector",
+        "querySelectorAll",
+        "evaluate"
+      ],
+      "x71": "true",
+      "x72": "complete",
+      "x73": "990",
+      "x74": "0|0|0",
+      "x75": "Google Inc.",
+      "x76": "true",
+      "x77": "1|1|1|1|1|1|1|1|1|1",
+      "x78": {
+        "x": 0,
+        "y": 1213,
+        "left": 0,
+        "right": 319.40625,
+        "bottom": 1230,
+        "height": 17,
+        "top": 1213,
+        "width": 319.40625,
+        "font": "RedNum, RedZh, RedEn, -apple-system"
+      },
+      "x79": "32851|10737451091",
+      "x80": "1|[object FileSystemDirectoryHandle]",
+      "x82": "_AUuXfEG27Xa3x|CUSTOMER_SSO_LOGIN_GLOBAL_EMITTER|anti_hp_sign_config|__rap_app_id__|__rap_report__|__rap_last_sign_cost__|__rap_last_transform_cost__|__rap_hijack_installed__|__setVerifyMsgBase64__|_BHjFmfUMEtxhI|anti__hp__|__hp_creator_tab_state__|__SW_AB_GROUP__|MicroappMountContainer|spamTimer",
+      "x83": "eyJkIjp7IjAiOjEzMiwiMSI6MTYyLCIyIjoxMDksIjMiOjExNiwiNCI6MTI5LCI1IjoxNjIsIjYiOjExNiwiNyI6MTExLCI4IjoyMDMsIjkiOjY2LCIxMCI6MTIxLCIxMSI6MjQ3LCIxMiI6MTAyLCIxMyI6MTQyLCIxNCI6MjM2LCIxNSI6MjMyLCIxNiI6MCwiMTciOjE2MSwiMTgiOjEwOSwiMTkiOjEyOCwiMjAiOjE2MSwiMjEiOjEwNywiMjIiOjEyOCwiMjMiOjE2MSwiMjQiOjExMiwiMjUiOjEzMCwiMjYiOjE2MywiMjciOjExNywiMjgiOjEwOCwiMjkiOjExNCwiMzAiOjE0NSwiMzEiOjE0NiwiMzIiOjIwMywiMzMiOjY2LCIzNCI6MTIxLCIzNSI6MjQ3LCIzNiI6MTAyLCIzNyI6NSwiMzgiOjEzLCIzOSI6MjMwLCI0MCI6MTAyLCI0MSI6MjA2LCI0MiI6MCwiNDMiOjgsIjQ0IjoxNTcsIjQ1IjoyMzksIjQ2IjoxNjIsIjQ3IjoxMTIsIjQ4IjoxMTUsIjQ5IjoxNDUsIjUwIjoxMzEsIjUxIjoxNjIsIjUyIjoxMTYsIjUzIjoxMTUsIjU0IjoyMDUsIjU1IjozLCI1NiI6NDAsIjU3IjoxNjEsIjU4IjoxMDQsIjU5IjoxOTQsIjYwIjoxNjEsIjYxIjoxMDIsIjYyIjoxOTV9LCJ2IjoxLCJlIjoibSJ9",
+      "x84": "__TELEMETRY__"
+    }
+  },
+  "b1Reference": {
+    "frameCount": 2,
+    "x39": 16,
+    "x50": "",
+    "x51": "",
+    "generatedAtOffsetMs": 1895,
+    "secCanvas": "__SEC_CAV__1-1-1-1-1|__SEC_UD__|",
+    "timeOriginOffsetMs": -870.4,
+    "x37": "0|0|0|0|0|0|0|0|0|1|0|0|1|0|0|0|0|1|1|0|0|0|0|0",
+    "x38": "0|0|1|0|1|0|0|0|0|0|1|0|1|0|1|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0",
+    "selectedGlobalNames": [
+      "_AUuXfEG27Xa3x",
+      "CUSTOMER_SSO_LOGIN_GLOBAL_EMITTER",
+      "anti_hp_sign_config",
+      "__rap_app_id__",
+      "__rap_report__",
+      "__rap_last_sign_cost__",
+      "__rap_last_transform_cost__",
+      "__rap_hijack_installed__",
+      "_BHjFmfUMEtxhI",
+      "__USE_CUSTOM_TIMING__",
+      "__CUSTOM_FMP_ELEMENTS__",
+      "__COLLECTED_FMP_ELEMENTS__",
+      "__CUSTOM_TTI_ELEMENTS__",
+      "__setVerifyMsgBase64__"
+    ],
+    "page": {"ulr": 5, "rs": 1, "ps": 1},
+    "state": {"h": 0, "f": 1, "kr": 0},
+    "features": {"ae": null, "ak": null, "cdr": null, "bf": null, "fi": null},
+    "evidence": "Fresh authenticated Creator publish page b1 decoded on Chrome 152, 2026-09-07"
+  },
+  "b1Profiles": {
+    "note_manager": {
+      "frameCount": 6,
+      "x39": 22,
+      "x50": "",
+      "x51": "",
+      "x37": "0|0|0|0|0|0|0|0|0|1|0|0|1|0|0|0|0|1|1|0|0|0|0|0",
+      "generatedAtOffsetMs": -5816,
+      "timeOriginOffsetMs": -357490.2,
+      "selectedGlobalNames": [
+        "_AUuXfEG27Xa3x",
+        "CUSTOMER_SSO_LOGIN_GLOBAL_EMITTER",
+        "anti_hp_sign_config",
+        "__rap_app_id__",
+        "__rap_report__",
+        "__rap_last_sign_cost__",
+        "__rap_last_transform_cost__",
+        "__rap_hijack_installed__",
+        "_BHjFmfUMEtxhI",
+        "__setVerifyMsgBase64__",
+        "anti__hp__",
+        "__hp_creator_tab_state__",
+        "__SW_AB_GROUP__",
+        "MicroappMountContainer",
+        "spamTimer"
+      ],
+      "mouse": {"me": 14, "mm": 28},
+      "keyboard": {},
+      "page": {"ulr": 5, "ps": 1},
+      "state": {"h": 0, "f": 1, "kr": 0},
+      "features": {
+        "ae": 2.5875282962354187,
+        "ak": 6.255902207830465,
+        "cdr": null,
+        "bf": {"ar": 0.42814667988107036, "fr": 4.885235736344873},
+        "fi": 6438.29999999702
+      },
+      "evidence": "Fresh post-login Creator note-manager req1155 decoded on 2026-07-19"
+    }
+  },
+  "mnsStages": {
+    "bootstrap": {
+      "tier": "0201",
+      "deviceTag": "nop",
+      "envConst": 1306,
+      "envFpTailHex": "f8536767c9b581635e0744fa8415",
+      "evidence": "Fresh Creator login page11 DS request seq=1 decoded on 2026-07-19"
+    },
+    "ready": {
+      "tier": "0101",
+      "deviceTag": "a1",
+      "envConst": 1341,
+      "envFpTailHex": "f9536767c9b581635e0744fa8415",
+      "evidence": "Fresh Creator login page11 steady webprofile/QR-ready state"
+    }
+  },
+  "mnsProfiles": {
+    "login_early": {
+      "tier": "0101",
+      "deviceTag": "a1",
+      "envConst": 1325,
+      "envFpTailHex": "f9536767c9b581635e0744fa8415",
+      "evidence": "Creator page11 redcaptcha/sbtsource/zones/tgt seq=2-5"
+    },
+    "login_callback": {
+      "tier": "0101",
+      "deviceTag": "a1",
+      "envConst": 1327,
+      "envFpTailHex": "f9536767c9b581635e0744fa8415",
+      "evidence": "Creator page11 seccallback seq=6"
+    },
+    "login_ready": {
+      "tier": "0101",
+      "deviceTag": "a1",
+      "envConst": 1350,
+      "envFpTailHex": "f9536767c9b581635e0744fa8415",
+      "evidence": "Creator page11 webprofile seq=7 and steady login requests"
+    },
+    "publish_user_info": {
+      "tier": "0101",
+      "deviceTag": "a1",
+      "envConst": 1337,
+      "envFpTailHex": "f9536767c9b581635e0744fa8415",
+      "evidence": "Authenticated Creator publish navigation user/info, Chrome 152, 2026-09-07"
+    },
+    "note_manager": {
+      "tier": "0101",
+      "deviceTag": "a1",
+      "envConst": 1339,
+      "envFpTailHex": "f9536767c9b581635e0744fa8415",
+      "evidence": "Authenticated Creator note-manager request, Chrome 152, 2026-09-06"
+    },
+    "note_manager_steady": {
+      "tier": "0101",
+      "deviceTag": "a1",
+      "envConst": 1339,
+      "envFpTailHex": "f9536767c9b581635e0744fa8415",
+      "evidence": "Authenticated Creator note-manager subsequent request, Chrome 152, 2026-09-06"
+    },
+    "publish_mountable": {
+      "tier": "0101",
+      "deviceTag": "a1",
+      "envConst": 1341,
+      "envFpTailHex": "f9536767c9b581635e0744fa8415",
+      "evidence": "Authenticated Creator publish mountable APIs, Chrome 152, 2026-09-06"
+    },
+    "publish_permit": {
+      "tier": "0101",
+      "deviceTag": "a1",
+      "envConst": 1349,
+      "envFpTailHex": "f9536767c9b581635e0744fa8415",
+      "evidence": "Authenticated Creator image upload permit req110, Chrome 152, 2026-09-07"
+    },
+    "publish_permit_image": {
+      "tier": "0101",
+      "deviceTag": "a1",
+      "envConst": 1349,
+      "envFpTailHex": "f9536767c9b581635e0744fa8415",
+      "evidence": "Authenticated Creator scene=image upload permit req110, Chrome 152, 2026-09-07"
+    },
+    "publish_permit_video": {
+      "tier": "0101",
+      "deviceTag": "a1",
+      "envConst": 1349,
+      "envFpTailHex": "f9536767c9b581635e0744fa8415",
+      "evidence": "Authenticated Creator scene=video upload permit req98, Chrome 152, 2026-09-07"
+    }
+  }
+}

package/static/xhs/xhs_creator/js/xhs_creator_sign.js

@@ -0,0 +1,29 @@
+'use strict';
+
+const crypto = require('crypto');
+
+function dec2hex(value, width) {
+    let result = '';
+    for (let number = value; number;) {
+        const digit = 15 & number;
+        result = String.fromCharCode((digit > 9 ? 55 : 48) + digit) + result;
+        number >>= 4;
+    }
+    if (width) {
+        while (result.length < width) result = `0${result}`;
+    }
+    return result.toLowerCase();
+}
+
+function urlSing(value, timestampMs) {
+    const now = timestampMs == null ? Date.now() : Number(timestampMs);
+    const secondsHex = dec2hex(now / 1000);
+    return crypto
+        .createHash('md5')
+        .update(`hIJXulBFYcGRQjrz${value}${secondsHex}`)
+        .digest('hex');
+}
+
+if (typeof module !== 'undefined') {
+    module.exports = { dec2hex, urlSing };
+}

package/static/xhs/xhs_creator/js/xhs_creator_signature.js

@@ -0,0 +1,23 @@
+const CryptoJS = require('crypto-js');
+
+function getSignature(message, fileId, contentLength, host) {
+    host = host || 'ros-upload.xiaohongshu.com';
+    let key = 'null'
+    let hash = CryptoJS.HmacSHA1(message, key);
+    key = CryptoJS.enc.Hex.stringify(hash);
+    let new_message = "put\n" +
+    `/spectrum/${fileId}\n` +
+    "\n" +
+    `content-length=${contentLength}&host=${host}\n`;
+    let params = CryptoJS.SHA1(new_message).toString()
+    message = "sha1\n" +
+    `${message}\n` +
+    `${params}\n`;
+    hash = CryptoJS.HmacSHA1(message, key);
+    return CryptoJS.enc.Hex.stringify(hash);
+}
+// let message = "1709905283;1709912483"
+// let fileId = 'UcaECZ-40xa7Uir1V8msV4XAq3bF6E8m16IT5eoR6Z12spg'
+// let contentLength = 13975
+// console.log(getSignature(message, fileId, contentLength))
+

package/static/xhs/xhs_pc/js/aes_decrypt.js

@@ -0,0 +1,22 @@
+'use strict';
+// AES-128 decrypt with custom S-box (standard InvMixColumns/InvShiftRows)
+const { keyExpand } = require('./aes_encrypt.js');
+function mul(a, b) { let r = 0; for (let i = 0; i < 8; i++) { if (b & 1) r ^= a; const hi = a & 0x80; a = (a << 1) & 0xff; if (hi) a ^= 0x1b; b >>= 1; } return r; }
+function invSboxOf(sbox) { const inv = new Array(256); for (let i = 0; i < 256; i++) inv[sbox[i]] = i; return inv; }
+function aesDecBlock(ct, key, sbox) {
+  const inv = invSboxOf(sbox); const Nr = 10; const w = keyExpand(key, sbox);
+  const s = new Array(16);
+  for (let c = 0; c < 4; c++) for (let r = 0; r < 4; r++) s[r * 4 + c] = ct[c * 4 + r];
+  function addRK(round) { for (let c = 0; c < 4; c++) for (let r = 0; r < 4; r++) s[r * 4 + c] ^= w[round * 4 + c][r]; }
+  addRK(Nr);
+  for (let round = Nr - 1; round >= 0; round--) {
+    // InvShiftRows
+    const t = s.slice(); for (let r = 1; r < 4; r++) for (let c = 0; c < 4; c++) s[r * 4 + c] = t[r * 4 + ((c - r + 4) % 4)];
+    for (let i = 0; i < 16; i++) s[i] = inv[s[i]];
+    addRK(round);
+    if (round > 0) { const o = s.slice(); for (let c = 0; c < 4; c++) { const a0 = o[c], a1 = o[4 + c], a2 = o[8 + c], a3 = o[12 + c]; s[c] = mul(a0, 14) ^ mul(a1, 11) ^ mul(a2, 13) ^ mul(a3, 9); s[4 + c] = mul(a0, 9) ^ mul(a1, 14) ^ mul(a2, 11) ^ mul(a3, 13); s[8 + c] = mul(a0, 13) ^ mul(a1, 9) ^ mul(a2, 14) ^ mul(a3, 11); s[12 + c] = mul(a0, 11) ^ mul(a1, 13) ^ mul(a2, 9) ^ mul(a3, 14); } }
+  }
+  const out = new Array(16); for (let c = 0; c < 4; c++) for (let r = 0; r < 4; r++) out[c * 4 + r] = s[r * 4 + c];
+  return out;
+}
+module.exports = { aesDecBlock, invSboxOf };

package/static/xhs/xhs_pc/js/aes_encrypt.js

@@ -0,0 +1,30 @@
+'use strict';
+// AES-128 single-block encrypt with swappable S-box (standard MixColumns/ShiftRows/Rcon)
+function mul(a, b) { let r = 0; for (let i = 0; i < 8; i++) { if (b & 1) r ^= a; const hi = a & 0x80; a = (a << 1) & 0xff; if (hi) a ^= 0x1b; b >>= 1; } return r; }
+function keyExpand(key, sbox) {
+  const Nk = 4, Nr = 10; const w = [];
+  for (let i = 0; i < Nk; i++) w[i] = [key[4 * i], key[4 * i + 1], key[4 * i + 2], key[4 * i + 3]];
+  const rcon = [0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36];
+  for (let i = Nk; i < 4 * (Nr + 1); i++) {
+    let t = w[i - 1].slice();
+    if (i % Nk === 0) { t = [t[1], t[2], t[3], t[0]].map((x) => sbox[x]); t[0] ^= rcon[i / Nk - 1]; }
+    w[i] = w[i - Nk].map((x, j) => x ^ t[j]);
+  }
+  return w;
+}
+function aesEncBlock(pt, key, sbox) {
+  const Nr = 10; const w = keyExpand(key, sbox);
+  const s = new Array(16);
+  for (let c = 0; c < 4; c++) for (let r = 0; r < 4; r++) s[r * 4 + c] = pt[c * 4 + r];
+  function addRK(round) { for (let c = 0; c < 4; c++) for (let r = 0; r < 4; r++) s[r * 4 + c] ^= w[round * 4 + c][r]; }
+  addRK(0);
+  for (let round = 1; round <= Nr; round++) {
+    for (let i = 0; i < 16; i++) s[i] = sbox[s[i]];
+    const t = s.slice(); for (let r = 1; r < 4; r++) for (let c = 0; c < 4; c++) s[r * 4 + c] = t[r * 4 + ((c + r) % 4)];
+    if (round < Nr) { const o = s.slice(); for (let c = 0; c < 4; c++) { const a0 = o[c], a1 = o[4 + c], a2 = o[8 + c], a3 = o[12 + c]; s[c] = mul(a0, 2) ^ mul(a1, 3) ^ a2 ^ a3; s[4 + c] = a0 ^ mul(a1, 2) ^ mul(a2, 3) ^ a3; s[8 + c] = a0 ^ a1 ^ mul(a2, 2) ^ mul(a3, 3); s[12 + c] = mul(a0, 3) ^ a1 ^ a2 ^ mul(a3, 2); } }
+    addRK(round);
+  }
+  const out = new Array(16); for (let c = 0; c < 4; c++) for (let r = 0; r < 4; r++) out[c * 4 + r] = s[r * 4 + c];
+  return out;
+}
+module.exports = { aesEncBlock, mul, keyExpand };

package/static/xhs/xhs_pc/js/b1.js

@@ -0,0 +1,9 @@
+'use strict';
+
+// Compatibility entry point for callers that historically invoked the PC
+// path directly.  The maintained implementation lives in xhs_core/js/b1.js;
+// forwarding argv/stdin keeps the CLI contract identical without duplicating
+// the algorithm.
+const impl = require('../../xhs_core/js/b1.js');
+if (require.main === module) impl.main();
+module.exports = impl;