specific-ai-cli 0.0.0-stage → 0.1.1

package/static/xhs/xhs_pc/js/deflate.js

@@ -0,0 +1,320 @@
+'use strict';
+// Full DEFLATE encoder matching browser: simple greedy LZ77 + dynamic Huffman
+// Verify byte-exact against browser samples
+
+const LEN_BASE = [3,4,5,6,7,8,9,10,11,13,15,17,19,23,27,31,35,43,51,59,67,83,99,115,131,163,195,227,258];
+const LEN_EXTRA = [0,0,0,0,0,0,0,0,1,1,1,1,2,2,2,2,3,3,3,3,4,4,4,4,5,5,5,5,0];
+const DIST_BASE = [1,2,3,4,5,7,9,13,17,25,33,49,65,97,129,193,257,385,513,769,1025,1537,2049,3073,4097,6145,8193,12289,16385,24577];
+const DIST_EXTRA = [0,0,0,0,1,1,2,2,3,3,4,4,5,5,6,6,7,7,8,8,9,9,10,10,11,11,12,12,13,13];
+const CLC_ORDER = [16,17,18,0,8,7,9,6,10,5,11,4,12,3,13,2,14,1,15];
+
+function lenToCode(l) {
+  for (let i = 0; i < LEN_BASE.length; i++) {
+    if (l >= LEN_BASE[i] && (i === LEN_BASE.length - 1 || l < LEN_BASE[i + 1])) {
+      return { code: 257 + i, extra: LEN_EXTRA[i], extraBits: l - LEN_BASE[i] };
+    }
+  }
+  throw new Error('bad len ' + l);
+}
+
+function distToCode(d) {
+  for (let i = 0; i < DIST_BASE.length; i++) {
+    if (d >= DIST_BASE[i] && (i === DIST_BASE.length - 1 || d < DIST_BASE[i + 1])) {
+      return { code: i, extra: DIST_EXTRA[i], extraBits: d - DIST_BASE[i] };
+    }
+  }
+  throw new Error('bad dist ' + d);
+}
+
+function lz77Tokenize(input, maxMatchLen = 5, minMatchLen = 3, windowSize = 128) {
+  const tokens = [];
+  let pos = 0;
+  while (pos < input.length) {
+    let bestLen = 0, bestDist = 0;
+    const searchStart = Math.max(0, pos - windowSize);
+    for (let back = pos - 1; back >= searchStart; back--) {
+      const dist = pos - back;
+      let len = 0;
+      const maxLen = Math.min(maxMatchLen, input.length - pos);
+      while (len < maxLen && input[back + len] === input[pos + len]) len++;
+      if (len >= minMatchLen && len > bestLen) {
+        bestLen = len; bestDist = dist;
+        if (len === maxMatchLen) break;
+      }
+    }
+    if (bestLen >= minMatchLen) {
+      tokens.push({ t: 'M', len: bestLen, dist: bestDist });
+      pos += bestLen;
+    } else {
+      tokens.push({ t: 'L', v: input[pos] });
+      pos++;
+    }
+  }
+  tokens.push({ t: 'END' });
+  return tokens;
+}
+
+// Standard Huffman with length limit — package-merge would be more accurate, but zlib uses a specific heap-based algorithm
+function buildHuffmanLengths(freqs, maxBits = 15) {
+  // Build heap of (freq, sym) leaves; construct Huffman tree
+  const n = freqs.length;
+  const nodes = [];
+  for (let i = 0; i < n; i++) if (freqs[i] > 0) nodes.push({ freq: freqs[i], sym: i, left: null, right: null });
+  if (nodes.length === 0) return new Array(n).fill(0);
+  if (nodes.length === 1) {
+    const lens = new Array(n).fill(0);
+    lens[nodes[0].sym] = 1;
+    return lens;
+  }
+  // Build tree
+  const heap = nodes.slice();
+  const cmp = (a, b) => a.freq - b.freq;
+  heap.sort(cmp);
+  while (heap.length > 1) {
+    const a = heap.shift();
+    const b = heap.shift();
+    const parent = { freq: a.freq + b.freq, sym: -1, left: a, right: b };
+    let idx = 0;
+    while (idx < heap.length && heap[idx].freq <= parent.freq) idx++;
+    heap.splice(idx, 0, parent);
+  }
+  const lens = new Array(n).fill(0);
+  const depths = new Array(n).fill(0);
+  function walk(node, depth) {
+    if (node.sym >= 0) { lens[node.sym] = depth || 1; depths[node.sym] = depth || 1; return; }
+    walk(node.left, depth + 1);
+    walk(node.right, depth + 1);
+  }
+  walk(heap[0], 0);
+
+  // Enforce max bits limit（pako/zlib gen_bitlen 溢出修正，2026-07-25 移植）
+  let overflow = 0;
+  for (let i = 0; i < n; i++) if (lens[i] > maxBits) overflow++;
+  if (overflow === 0) return lens;
+
+  const bl_count = new Array(maxBits + 1).fill(0);
+  for (let i = 0; i < n; i++) {
+    if (lens[i]) bl_count[Math.min(lens[i], maxBits)]++;
+  }
+  do {
+    let bits = maxBits - 1;
+    while (bl_count[bits] === 0) bits--;
+    bl_count[bits]--;
+    bl_count[bits + 1] += 2;
+    bl_count[maxBits]--;
+    overflow -= 2;
+  } while (overflow > 0);
+
+  // 按 pako 的 smaller() 顺序（freq 升序、depth 升序、sym 升序）把叶子排好；
+  // pako 的 heap 尾删序使最长码从最低频叶子开始分配（heap[--h] 从最小端扫）。
+  const leaves = nodes
+    .map(node => ({ sym: node.sym, freq: node.freq, depth: depths[node.sym] }))
+    .sort((a, b) => (a.freq - b.freq) || (a.depth - b.depth) || (a.sym - b.sym));
+  const out = new Array(n).fill(0);
+  let h = 0;
+  for (let bits = maxBits; bits !== 0; bits--) {
+    let cnt = bl_count[bits];
+    while (cnt !== 0) {
+      const leaf = leaves[h++];
+      out[leaf.sym] = bits;
+      cnt--;
+    }
+  }
+  return out;
+}
+
+// Canonical Huffman codes from lengths
+function buildCanonical(lens) {
+  const maxLen = Math.max(...lens, 0);
+  const bl_count = new Array(maxLen + 1).fill(0);
+  for (const l of lens) if (l) bl_count[l]++;
+  const next_code = new Array(maxLen + 1).fill(0);
+  let code = 0;
+  for (let bits = 1; bits <= maxLen; bits++) {
+    code = (code + bl_count[bits - 1]) << 1;
+    next_code[bits] = code;
+  }
+  const codes = new Array(lens.length).fill(0);
+  for (let n = 0; n < lens.length; n++) {
+    if (lens[n]) {
+      codes[n] = next_code[lens[n]];
+      next_code[lens[n]]++;
+    }
+  }
+  return codes;
+}
+
+class BitWriter {
+  constructor() { this.chunks = []; this.buf = 0; this.nbits = 0; }
+  writeBits(val, n) {
+    this.buf |= (val << this.nbits) >>> 0;
+    this.nbits += n;
+    while (this.nbits >= 8) {
+      this.chunks.push(this.buf & 0xff);
+      this.buf >>>= 8;
+      this.nbits -= 8;
+    }
+  }
+  writeCode(code, len) {
+    // DEFLATE Huffman codes emitted MSB-first
+    let rev = 0;
+    for (let i = 0; i < len; i++) {
+      rev |= (((code >> (len - 1 - i)) & 1) << i);
+    }
+    this.writeBits(rev, len);
+  }
+  flush() {
+    if (this.nbits > 0) {
+      this.chunks.push(this.buf & 0xff);
+      this.buf = 0; this.nbits = 0;
+    }
+    return Buffer.from(this.chunks);
+  }
+}
+
+// Encode code-length sequence with RLE for the code-length alphabet
+function rleCodeLens(lens) {
+  const rle = [];
+  let i = 0;
+  while (i < lens.length) {
+    const cur = lens[i];
+    let run = 1;
+    while (i + run < lens.length && lens[i + run] === cur) run++;
+    if (cur === 0) {
+      // Encode run of zeros
+      while (run >= 11) {
+        const r = Math.min(run, 138);
+        rle.push({ sym: 18, extra: r - 11, extraBits: 7 });
+        run -= r;
+      }
+      while (run >= 3) {
+        const r = Math.min(run, 10);
+        rle.push({ sym: 17, extra: r - 3, extraBits: 3 });
+        run -= r;
+      }
+      while (run > 0) { rle.push({ sym: 0 }); run--; }
+    } else {
+      // Emit first, then use 16 (repeat prev) for subsequent
+      rle.push({ sym: cur });
+      run--;
+      while (run >= 3) {
+        const r = Math.min(run, 6);
+        rle.push({ sym: 16, extra: r - 3, extraBits: 2 });
+        run -= r;
+      }
+      while (run > 0) { rle.push({ sym: cur }); run--; }
+    }
+    i += (run === 0 ? (i + run + 1 === i ? 1 : 0) : 0);  // this loop advance
+    // Actually: re-set i to start of next different value
+    let jmp = 1;
+    while (i + jmp < lens.length && lens[i + jmp] === cur) jmp++;
+    i += jmp;
+  }
+  return rle;
+}
+
+function encodeDeflate(input) {
+  const tokens = lz77Tokenize(input);
+
+  // Count frequencies
+  const litFreq = new Array(286).fill(0);
+  const distFreq = new Array(30).fill(0);
+  litFreq[256] = 1; // END
+  for (const t of tokens) {
+    if (t.t === 'L') litFreq[t.v]++;
+    else if (t.t === 'M') {
+      const lc = lenToCode(t.len);
+      litFreq[lc.code]++;
+      const dc = distToCode(t.dist);
+      distFreq[dc.code]++;
+    }
+  }
+
+  // Build Huffman code lengths
+  const litLens = buildHuffmanLengths(litFreq, 15);
+  const distLens = buildHuffmanLengths(distFreq, 15);
+
+  // Find HLIT, HDIST
+  let hlitMax = 256;
+  for (let i = 285; i > 256; i--) if (litLens[i]) { hlitMax = i; break; }
+  const HLIT = hlitMax - 256;  // HLIT + 257 = alphabet size
+  let hdistMax = 0;
+  for (let i = 29; i > 0; i--) if (distLens[i]) { hdistMax = i; break; }
+  const HDIST = hdistMax;  // HDIST + 1 = alphabet size
+
+  // Trim to actual size
+  const litLensTrim = litLens.slice(0, HLIT + 257);
+  const distLensTrim = distLens.slice(0, HDIST + 1);
+
+  // RLE encode the lengths
+  const combined = litLensTrim.concat(distLensTrim);
+  const rle = rleCodeLens(combined);
+
+  // Build code-length alphabet Huffman
+  const clenFreq = new Array(19).fill(0);
+  for (const r of rle) clenFreq[r.sym]++;
+  const clenLens = buildHuffmanLengths(clenFreq, 7);
+
+  // Find HCLEN (minimum needed by CLC_ORDER)
+  let HCLEN = 0;
+  for (let i = 18; i >= 4; i--) if (clenLens[CLC_ORDER[i]]) { HCLEN = i - 3; break; }
+
+  // Build canonical codes for all three Huffman tables
+  const litCodes = buildCanonical(litLensTrim);
+  const distCodes = buildCanonical(distLensTrim);
+  const clenCodes = buildCanonical(clenLens);
+
+  // Write DEFLATE stream
+  const bw = new BitWriter();
+  bw.writeBits(1, 1);       // BFINAL
+  bw.writeBits(2, 2);       // BTYPE=10 (dynamic)
+  bw.writeBits(HLIT, 5);
+  bw.writeBits(HDIST, 5);
+  bw.writeBits(HCLEN, 4);
+  for (let i = 0; i < HCLEN + 4; i++) bw.writeBits(clenLens[CLC_ORDER[i]], 3);
+
+  // Write encoded code lengths using clen Huffman
+  for (const r of rle) {
+    bw.writeCode(clenCodes[r.sym], clenLens[r.sym]);
+    if (r.sym === 16) bw.writeBits(r.extra, 2);
+    else if (r.sym === 17) bw.writeBits(r.extra, 3);
+    else if (r.sym === 18) bw.writeBits(r.extra, 7);
+  }
+
+  // Write actual data
+  for (const t of tokens) {
+    if (t.t === 'L') {
+      bw.writeCode(litCodes[t.v], litLensTrim[t.v]);
+    } else if (t.t === 'M') {
+      const lc = lenToCode(t.len);
+      bw.writeCode(litCodes[lc.code], litLensTrim[lc.code]);
+      if (lc.extra) bw.writeBits(lc.extraBits, lc.extra);
+      const dc = distToCode(t.dist);
+      bw.writeCode(distCodes[dc.code], distLensTrim[dc.code]);
+      if (dc.extra) bw.writeBits(dc.extraBits, dc.extra);
+    } else if (t.t === 'END') {
+      bw.writeCode(litCodes[256], litLensTrim[256]);
+    }
+  }
+
+  return bw.flush();
+}
+
+// Wrap in gzip format
+function encodeGzip(input, mtime = 0) {
+  const deflate = encodeDeflate(input);
+  const gzip = Buffer.alloc(10 + deflate.length + 8);
+  gzip[0] = 0x1f; gzip[1] = 0x8b;
+  gzip[2] = 0x08;    // CM = DEFLATE
+  gzip[3] = 0x00;    // FLG = 0
+  gzip.writeUInt32LE(mtime, 4);  // MTIME
+  gzip[8] = 0x00;    // XFL
+  gzip[9] = 0x03;    // OS = Unix
+  deflate.copy(gzip, 10);
+  const crc = require('zlib').crc32(input);
+  gzip.writeUInt32LE(crc, 10 + deflate.length);
+  gzip.writeUInt32LE(input.length & 0xffffffff, 14 + deflate.length);
+  return gzip;
+}
+
+module.exports = { encodeDeflate, encodeGzip, lz77Tokenize };

package/static/xhs/xhs_pc/js/mns.js

@@ -0,0 +1,4 @@
+'use strict';
+
+// Legacy PC import path for the current pure MNS implementation.
+module.exports = require('../../xhs_core/js/mns.js');

package/static/xhs/xhs_pc/js/profile.js

@@ -0,0 +1,141 @@
+'use strict';
+
+const CryptoJS = require('crypto-js');
+const reference = require('./reference_profile.json');
+
+const DES_KEY = CryptoJS.enc.Utf8.parse('zbp30y86');
+const I12_DYNAMIC_INDEXES = [18, 53, 69, 86, 103, 120];
+
+function clone(value) {
+    return JSON.parse(JSON.stringify(value));
+}
+
+function integerOption(value, fallback, minimum, maximum) {
+    const resolved = value == null ? fallback : Number(value);
+    if (!Number.isInteger(resolved) || resolved < minimum || resolved > maximum) {
+        throw new TypeError(`integer option must be in [${minimum}, ${maximum}]`);
+    }
+    return resolved;
+}
+
+function buildI12Data(seed, templateValue, dynamicIndexes = I12_DYNAMIC_INDEXES) {
+    const decoded = JSON.parse(Buffer.from(String(templateValue), 'base64').toString('utf8'));
+    for (const index of dynamicIndexes) decoded.d[String(index)] = seed;
+    return Buffer.from(JSON.stringify(decoded), 'utf8').toString('base64');
+}
+
+function buildTelemetryValue(fi, options = {}, profileReference = {}) {
+    if (profileReference.telemetryTemplate) {
+        return String(profileReference.telemetryTemplate).replace(
+            '__TIME_ORIGIN__',
+            String(options.timeOrigin ?? ''),
+        );
+    }
+    return '{mt:{},m:{me:1},k:{},p:{ulr:0,ps:1,f:1,rs:1,sc:1,vc:1},'
+        + `st:{h:0,f:1,kr:0},ft:{ae:null,ak:null,cdr:null,bf:null,fi:${fi}}}`;
+}
+
+function buildProfileFields(options = {}) {
+    const profileReference = reference.webProfile;
+    if (!profileReference || !profileReference.fields) {
+        throw new Error('webProfile reference fields are missing');
+    }
+
+    const fields = clone(profileReference.fields);
+    // A complete DevTools capture can be replayed byte-for-byte.  In this
+    // mode every field is required and preserved; no local timestamp, cookie,
+    // telemetry, or i12 value is substituted.
+    if (options.exactFields === true) {
+        const captured = options.fields;
+        if (!captured || typeof captured !== 'object' || Array.isArray(captured)) {
+            throw new TypeError('exactFields requires captured fields');
+        }
+        const expected = Object.keys(fields);
+        const missing = expected.filter((key) => !Object.prototype.hasOwnProperty.call(captured, key));
+        const extra = Object.keys(captured).filter((key) => !Object.prototype.hasOwnProperty.call(fields, key));
+        if (missing.length || extra.length) {
+            throw new TypeError(`exactFields schema mismatch; missing=${missing.join(',')}; extra=${extra.join(',')}`);
+        }
+        return clone(captured);
+    }
+    // Keep historical 6.32.2 fixtures reproducible while using the current
+    // 6.47.2 browser profile by default. Cookie input selects old fixtures.
+    const cookie = String(options.documentCookie || '');
+    if (/webBuild=6\.32\.2(?:;|$)/.test(cookie)) {
+        fields.x1 = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36';
+    }
+    const timestampMs = integerOption(options.timestampMs, Date.now(), 1, Number.MAX_SAFE_INTEGER);
+    const ets = integerOption(options.ets, timestampMs, 1, Number.MAX_SAFE_INTEGER);
+    const i12Seed = integerOption(
+        options.i12Seed,
+        profileReference.i12Seed,
+        0,
+        255,
+    );
+    const telemetryFi = integerOption(
+        options.telemetryFi,
+        profileReference.telemetryFi,
+        0,
+        1000000,
+    );
+
+    fields.x44 = String(timestampMs);
+    fields.x57 = options.documentCookie == null
+        ? `ets=${ets}; domain=.xiaohongshu.com; path=/; max-age=2592000`
+        : String(options.documentCookie);
+    fields.x83 = buildI12Data(
+        i12Seed,
+        fields.x83,
+        profileReference.i12DynamicIndexes ?? I12_DYNAMIC_INDEXES,
+    );
+    fields.x84 = buildTelemetryValue(telemetryFi, options, profileReference);
+
+    const overrides = options.fields || {};
+    for (const [key, value] of Object.entries(overrides)) {
+        if (!Object.prototype.hasOwnProperty.call(fields, key)) {
+            throw new TypeError(`unsupported webProfile field: ${key}`);
+        }
+        fields[key] = value;
+    }
+    return fields;
+}
+
+function encodeProfileData(fields) {
+    if (!fields || typeof fields !== 'object' || Array.isArray(fields)) {
+        throw new TypeError('profile fields must be an object');
+    }
+    const serialized = JSON.stringify(fields);
+    const base64 = Buffer.from(serialized, 'utf8').toString('base64');
+    const encrypted = CryptoJS.DES.encrypt(
+        CryptoJS.enc.Latin1.parse(base64),
+        DES_KEY,
+        { mode: CryptoJS.mode.ECB, padding: CryptoJS.pad.ZeroPadding },
+    );
+    return encrypted.ciphertext.toString(CryptoJS.enc.Hex);
+}
+
+function generateProfileData(options = {}) {
+    return encodeProfileData(buildProfileFields(options));
+}
+
+if (require.main === module) {
+    try {
+        const options = process.argv[2] ? JSON.parse(process.argv[2]) : {};
+        const profileData = generateProfileData(options);
+        process.stdout.write(`${JSON.stringify({
+            profileData,
+            length: profileData.length,
+            sdkVersion: reference.release.webProfileSdkVersion,
+            algorithm: 'base64-des-ecb-zero-padding-hex',
+        })}\n`);
+    } catch (error) {
+        process.stderr.write(`${error && error.stack ? error.stack : error}\n`);
+        process.exit(1);
+    }
+}
+
+module.exports = {
+    buildProfileFields,
+    encodeProfileData,
+    generateProfileData,
+};

package/static/xhs/xhs_pc/js/rap.js

@@ -0,0 +1,173 @@
+/**
+ * x-rap-param algorithm — zero VMP execution.
+ *
+ * Reversed 2026-07-15 from captured Sanji/Garp VMP browser evidence.
+ *
+ * Discoveries:
+ *   - Xorkeyverifyvalue = xxHash32([mask_byte], seed=0)
+ *   - RequestHash       = xxHash32(url_pathAndBeyond + jsonBody, seed=0)
+ *   - Payload wire format: header(16B raw) + body(N B XOR-masked with 1B mask)
+ *       header: [0:2]=0x03e8 op, [2:10]=8B ts BE, [10:12]=0x03e9 op, [12:16]=4B xorKeyVerify
+ *       body: TLV opcodes 0x3ea..0x484, each XOR'd with mask
+ *   - Random ASCII generation: bytes → alphabet36[b % 36]
+ *   - AES key: "kqI1DTcwKX90ZtAy" (fixed)
+ *   - Envelope: rap_crypto.js
+ *
+ * Fingerprint (~200B of behavior/detection data) is captured once per session
+ * and reused (same approach as mns envConst/envFpTail).
+ */
+'use strict';
+const crypto = require('crypto');
+const { encryptPayload } = require('./rap_crypto.js');
+
+const ALPHABET36 = '0123456789abcdefghijklmnopqrstuvwxyz';
+
+/** xxHash32 (32-bit variant of xxHash). Byte-exact vs reference. */
+function xxHash32(buf, seed = 0) {
+  const P1 = 0x9E3779B1 >>> 0, P2 = 0x85EBCA77 >>> 0, P3 = 0xC2B2AE3D >>> 0;
+  const P4 = 0x27D4EB2F >>> 0, P5 = 0x165667B1 >>> 0;
+  const M = Math.imul;
+  const rotl = (x, n) => ((x << n) | (x >>> (32 - n))) >>> 0;
+  let h, p = 0; const len = buf.length;
+  if (len >= 16) {
+    let v1 = (seed + P1 + P2) >>> 0, v2 = (seed + P2) >>> 0, v3 = seed >>> 0, v4 = (seed - P1) >>> 0;
+    while (p + 16 <= len) {
+      const l1 = (buf[p] | buf[p+1]<<8 | buf[p+2]<<16 | buf[p+3]<<24) >>> 0;
+      const l2 = (buf[p+4] | buf[p+5]<<8 | buf[p+6]<<16 | buf[p+7]<<24) >>> 0;
+      const l3 = (buf[p+8] | buf[p+9]<<8 | buf[p+10]<<16 | buf[p+11]<<24) >>> 0;
+      const l4 = (buf[p+12] | buf[p+13]<<8 | buf[p+14]<<16 | buf[p+15]<<24) >>> 0;
+      v1 = M(rotl((v1 + M(l1, P2)) >>> 0, 13), P1) >>> 0;
+      v2 = M(rotl((v2 + M(l2, P2)) >>> 0, 13), P1) >>> 0;
+      v3 = M(rotl((v3 + M(l3, P2)) >>> 0, 13), P1) >>> 0;
+      v4 = M(rotl((v4 + M(l4, P2)) >>> 0, 13), P1) >>> 0;
+      p += 16;
+    }
+    h = (rotl(v1, 1) + rotl(v2, 7) + rotl(v3, 12) + rotl(v4, 18)) >>> 0;
+  } else h = (seed + P5) >>> 0;
+  h = (h + len) >>> 0;
+  while (p + 4 <= len) {
+    const l = (buf[p] | buf[p+1]<<8 | buf[p+2]<<16 | buf[p+3]<<24) >>> 0;
+    h = M(rotl((h + M(l, P3)) >>> 0, 17), P4) >>> 0; p += 4;
+  }
+  while (p < len) { h = M(rotl((h + M(buf[p], P5)) >>> 0, 11), P1) >>> 0; p++; }
+  h ^= h >>> 15; h = M(h, P2) >>> 0; h ^= h >>> 13; h = M(h, P3) >>> 0; h ^= h >>> 16;
+  return h >>> 0;
+}
+
+/** Map N raw random bytes to ASCII: alphabet36[b % 36] for each byte. */
+function randomAscii(n) {
+  const buf = crypto.randomBytes(n);
+  let out = '';
+  for (const b of buf) out += ALPHABET36[b % 36];
+  return out;
+}
+
+/** Build a fresh 235B payload (no Uuid; the minimal common form).
+ *  Returns Uint8Array of the plaintext payload (before gzip).
+ *  fingerprint is a 201-byte Buffer captured from browser (or all-zeros for a bare minimum). */
+function buildPayload({ ts, url, body, fingerprint, mask }) {
+  // Layout for 235B payload (Uuid absent):
+  //   [0:16]  header (raw)
+  //   [16:38] Uuid section — for 235B we still need SOMETHING at [16:] starting with 0x03ea
+  //   ... 219B body ...
+  // Simpler: use the exact template we captured and only overwrite dynamic bytes.
+  // Header: 03e8 <8B ts BE> 03e9 <4B xorKeyVerify>
+  const p = new Uint8Array(fingerprint.length + 16);
+  // Header
+  p[0] = 0x03; p[1] = 0xe8;
+  // 8B ts BE
+  const tsHi = Math.floor(ts / 0x100000000);
+  const tsLo = ts >>> 0;
+  p[2] = (tsHi >>> 24) & 0xff; p[3] = (tsHi >>> 16) & 0xff; p[4] = (tsHi >>> 8) & 0xff; p[5] = tsHi & 0xff;
+  p[6] = (tsLo >>> 24) & 0xff; p[7] = (tsLo >>> 16) & 0xff; p[8] = (tsLo >>> 8) & 0xff; p[9] = tsLo & 0xff;
+  p[10] = 0x03; p[11] = 0xe9;
+  // xorKeyVerify = xxHash32([mask])
+  const verify = xxHash32(Buffer.from([mask]));
+  p[12] = (verify >>> 24) & 0xff; p[13] = (verify >>> 16) & 0xff; p[14] = (verify >>> 8) & 0xff; p[15] = verify & 0xff;
+  // Body: copy fingerprint template + write dynamic fields, then XOR with mask
+  const bodyUnmasked = Buffer.from(fingerprint);
+  // Fingerprint template must already have 0x03ea at [0] (Uuid) or 0x03eb at [0] (RequestHash).
+  // Locate RequestHash slot (opcode 0x03eb) and write current URL+body hash.
+  // Search for 03eb marker in template.
+  let reqHashOff = -1;
+  for (let i = 0; i < bodyUnmasked.length - 5; i++) {
+    if (bodyUnmasked[i] === 0x03 && bodyUnmasked[i+1] === 0xeb) { reqHashOff = i + 2; break; }
+  }
+  if (reqHashOff >= 0) {
+    const reqHash = xxHash32(Buffer.from(url + body));
+    bodyUnmasked[reqHashOff]   = (reqHash >>> 24) & 0xff;
+    bodyUnmasked[reqHashOff+1] = (reqHash >>> 16) & 0xff;
+    bodyUnmasked[reqHashOff+2] = (reqHash >>> 8)  & 0xff;
+    bodyUnmasked[reqHashOff+3] = reqHash & 0xff;
+  }
+  // XOR-mask the body
+  for (let i = 0; i < bodyUnmasked.length; i++) p[16 + i] = bodyUnmasked[i] ^ mask;
+  return p;
+}
+
+/** Full rap generator.
+ *  Optional inputs for byte-exact reproduction: mtime, padBytes, bodyEncryTime.
+ */
+function buildRapPure({ api, data, fingerprint, mask, xorKey, ts, nonce, mtime, padBytes, bodyEncryTime, returnLayers }) {
+  api = api || '/api/sns/web/v1/homefeed';
+  data = typeof data === 'string' ? data : JSON.stringify(data || {});
+  ts = ts || Date.now();
+  // URL form used by the browser rap for RequestHash.
+  // 2026-07-25 实证（Creator post_note 模板 03eb 槽反解）：
+  // 浏览器对发布接口用**完整 https URL** 求 xxHash32(url+body)；
+  // 传完整 URL 时按原样使用，传路径时退回协议相对形式（兼容 PC 旧调用）。
+  let url;
+  if (/^https?:\/\//.test(api)) url = api;
+  else if (api.startsWith('//')) url = api;
+  else url = '//edith.xiaohongshu.com' + api;
+
+  // mask: a random byte mapped to alphabet36 ASCII (like '0'..'9','a'..'z')
+  if (mask == null) mask = ALPHABET36.charCodeAt(crypto.randomBytes(1)[0] % 36);
+
+  // xorKey: 16 ASCII chars from alphabet36
+  if (!xorKey) xorKey = Buffer.from(randomAscii(16));
+  else if (typeof xorKey === 'string') xorKey = Buffer.from(xorKey);
+
+  // Envelope nonce: 4-6 ASCII chars — magic byte determines length. Accept override.
+  let nonceLen;
+  if (nonce != null) {
+    if (typeof nonce === 'string') nonce = Buffer.from(nonce, 'ascii');
+    nonceLen = nonce.length;
+  } else {
+    nonceLen = 4 + Math.floor(crypto.randomBytes(1)[0] / 86); // 4/5/6 roughly balanced
+    nonce = Buffer.from(randomAscii(nonceLen), 'ascii');
+  }
+
+  // Build the plaintext payload (single canonical build; RequestHash uses url + data)
+  const p2 = buildPayload({ ts, url, body: data, fingerprint, mask });
+
+  // Encrypt via rap_crypto (DEFLATE + alphabet36 pad)
+  const encryptStart = Date.now();
+  const { encR, body: bodyEnc, gzipLen } = encryptPayload(Buffer.from(p2), Array.from(xorKey), { mtime: mtime || 0, padBytes });
+  const encryptTimeMs = bodyEncryTime != null ? bodyEncryTime : Math.max(1, Date.now() - encryptStart);
+
+  const B = bodyEnc.length;
+  const env = Buffer.alloc(60 + nonceLen + B);
+  env[0] = 0x07; env[1] = 0x24; env[2] = 0x01; env[3] = nonceLen;
+  env.writeUInt32BE(1, 4);                              // ver (protocolCryptVersion)
+  env.writeUInt32BE(20, 8);                             // keyLength (encR + encRlen)
+  env.writeUInt32BE(B + 4, 12);                         // payloadLen (bodyLen + 4)
+  // env[16:20] = chk16 (bodyhash) — computed below after body written
+  env.writeUInt32BE(0x0000283d, 20);                    // Version (0x283d = fingerprint version)
+  env.writeUInt32BE(encryptTimeMs, 24);                 // bodyEncryTime (elapsed ms)
+  // env[28:36] = 0 (already zero from Buffer.alloc) — note: header prototype writes 512 at [28:32] but final envelope has 0
+  nonce.copy(env, 36);
+  Buffer.from(encR).copy(env, 36 + nonceLen);
+  env.writeUInt32BE(16, 52 + nonceLen);
+  Buffer.from(bodyEnc).copy(env, 56 + nonceLen);
+  env.writeUInt32BE(gzipLen, 56 + nonceLen + B);  // trailing = actual gzip length (NOT encrypted body length)
+  // Now compute chk16 = xxHash32(env[36:], seed=0) — hash of everything after the 36B header
+  const chk16 = xxHash32(env.slice(36), 0);
+  env.writeUInt32BE(chk16, 16);
+
+  const rap = env.toString('base64');
+  if (returnLayers) return { rap, plaintext: Buffer.from(p2), encR: Buffer.from(encR), body: Buffer.from(bodyEnc), envelope: env, mask, xorKey, nonce };
+  return rap;
+}
+
+module.exports = { buildRapPure, xxHash32, randomAscii, ALPHABET36 };

package/static/xhs/xhs_pc/js/rap_cli.js

@@ -0,0 +1,30 @@
+'use strict';
+// CLI: node rap_cli.js <api> [dataJsonString] [appId] [fingerprintHex]
+// 输出 100% 纯算 x-rap-param（ByQ...）到 stdout。
+// 零 VMP 执行、零浏览器补环境、零历史 bundle 加载。
+const path = require('path');
+const fs = require('fs');
+const { buildRapPure } = require('./rap.js');
+
+const api = process.argv[2];
+const data = process.argv[3] || '';
+const appId = process.argv[4] || undefined;
+const fingerprintHex = process.argv[5] || '';
+if (!api) { process.stderr.write('usage: rap_cli.js <api> [data] [appId]\n'); process.exit(2); }
+
+// Fingerprint template: 219-byte captured behavior/detection blob (session-safe reuse)
+const TPL_PATH = path.join(__dirname, 'rap_fingerprint_template.json');
+const tpl = JSON.parse(fs.readFileSync(TPL_PATH, 'utf8'));
+const fingerprint = Buffer.from(fingerprintHex || tpl.bodyUnmaskedHex, 'hex');
+if (!fingerprint.length) {
+  process.stderr.write('rap gen failed: fingerprint is empty\n');
+  process.exit(2);
+}
+
+try {
+  const rap = buildRapPure({ api, data, fingerprint });
+  process.stdout.write(rap);
+} catch (e) {
+  process.stderr.write('rap gen failed: ' + (e && e.message) + '\n');
+  process.exit(1);
+}