specific-ai-cli 0.0.0-stage → 0.1.1

package/static/xhs/xhs_pc/js/rap_crypto.js

@@ -0,0 +1,73 @@
+/**
+ * x-rap-param 纯算 —— 加密侧（crypto + 信封），零补环境。
+ * 管线：payload → gzip(pure XHS) → alphabet36-random-pad → XOR(xorKey) → AES-128-ECB(自研S-box, 固定密钥) → body
+ *       encR = AES-128-ECB(xorKey)
+ *       信封 = header + nonce + encR + len + body + trailing(bodyLen)
+ * 分组密码 = 标准 AES-128-ECB，仅 S-box 换成小红书自研表。
+ * DEFLATE = deflate.js（简单贪婪LZ77 + 动态Huffman，字节对齐浏览器版本）。
+ */
+'use strict';
+const crypto = require('crypto');
+const zlib = require('zlib');
+const { aesEncBlock } = require('./aes_encrypt.js');
+const { aesDecBlock } = require('./aes_decrypt.js');
+const { encodeGzip } = require('./deflate.js');
+
+const SBOX = [122,1,88,224,80,78,2,121,29,75,83,218,107,72,212,82,237,119,18,33,20,21,236,16,24,229,185,241,12,8,252,125,249,205,181,200,230,55,38,135,86,186,184,43,173,240,104,247,139,141,211,94,54,77,46,146,49,130,242,41,112,61,45,215,182,64,178,67,68,128,120,210,13,73,74,9,99,108,7,58,158,213,6,198,225,98,244,52,36,89,169,87,42,0,62,23,44,10,26,66,250,147,190,220,245,179,106,19,232,3,199,151,187,115,118,134,227,70,114,71,208,5,76,56,124,31,129,171,117,81,235,243,50,116,17,143,132,137,156,113,34,126,157,207,63,145,105,101,60,109,150,162,152,153,51,57,154,202,195,159,160,188,228,163,164,84,127,167,168,4,111,93,172,183,39,175,176,40,65,174,180,110,11,27,223,142,48,177,254,144,97,96,192,203,92,14,239,22,131,234,32,233,201,85,196,69,133,204,30,170,103,138,123,53,214,25,216,217,194,219,148,221,28,222,166,255,248,191,91,90,15,231,193,189,209,102,197,37,238,140,226,95,136,161,59,165,246,206,149,47,100,35,251,253,79,155];
+const AES_KEY = [...Buffer.from('kqI1DTcwKX90ZtAy')];
+const ALPHABET36 = '0123456789abcdefghijklmnopqrstuvwxyz';
+
+function aesEcbEnc(data) { const o = []; for (let i = 0; i < data.length; i += 16) o.push(...aesEncBlock([...data.slice(i, i + 16)], AES_KEY.slice(), SBOX)); return Buffer.from(o); }
+function aesEcbDec(data) { const o = []; for (let i = 0; i + 16 <= data.length; i += 16) o.push(...aesDecBlock([...data.slice(i, i + 16)], AES_KEY.slice(), SBOX)); return Buffer.from(o); }
+
+// XHS 使用 alphabet36 随机 ASCII 填充到 16 字节边界 (NOT PKCS7)
+function alpha36Pad(buf) {
+  const n = 16 - (buf.length % 16);
+  const padActual = n === 0 ? 16 : n;
+  const rand = crypto.randomBytes(padActual);
+  const padBytes = Buffer.from([...rand].map(b => ALPHABET36.charCodeAt(b % 36)));
+  return Buffer.concat([buf, padBytes]);
+}
+
+function pkcs7(buf) { const n = 16 - (buf.length % 16); return Buffer.concat([buf, Buffer.alloc(n, n)]); }
+
+// 加密：payload(Buffer) + xorKey(16B) → {encR, body, gzipLen}
+// mtime 可选：想字节对齐浏览器需要提供 mtime 与 xorKey，padBytes（可选）覆盖随机填充
+function encryptPayload(payload, xorKey, opts = {}) {
+  let gz;
+  try {
+    gz = encodeGzip(payload, opts.mtime || 0);
+  } catch (err) {
+    // 大 payload（如 Creator 发布的 452B 指纹）会让自研 Huffman 树深超过 15
+    // 触发 overflow；回退 Node zlib 裸 deflate（与浏览器同族的合法编码，
+    // 服务端只做 AES-ECB + XOR + gunzip 校验，不逐字节比对 deflate）。
+    const deflated = zlib.deflateRawSync(payload, { level: 9 });
+    const mtime = opts.mtime || 0;
+    gz = Buffer.alloc(10 + deflated.length + 8);
+    gz[0] = 0x1f; gz[1] = 0x8b; gz[2] = 0x08; gz[3] = 0x00;
+    gz.writeUInt32LE(mtime, 4);
+    gz[8] = 0x00; gz[9] = 0x03;
+    deflated.copy(gz, 10);
+    gz.writeUInt32LE(zlib.crc32(payload), 10 + deflated.length);
+    gz.writeUInt32LE(payload.length & 0xffffffff, 14 + deflated.length);
+  }
+  const gzipLen = gz.length;
+  const padded = opts.padBytes
+    ? Buffer.concat([gz, Buffer.from(opts.padBytes)])
+    : alpha36Pad(gz);
+  const xored = Buffer.from(padded.map((b, i) => b ^ xorKey[i % 16]));
+  const body = aesEcbEnc(xored);
+  const encR = aesEcbEnc(Buffer.from(xorKey));
+  return { encR, body, gzipLen };
+}
+
+// 解密（验证用）— 通过尝试不同尾部长度找出 gzip 结束位置
+function decryptBody(encR, body) {
+  const xorKey = aesEcbDec(encR);
+  const xored = aesEcbDec(body);
+  const gz = Buffer.from(xored.map((b, i) => b ^ xorKey[i % 16]));
+  for (let trim = 0; trim <= 16; trim++) { try { return zlib.gunzipSync(gz.slice(0, gz.length - trim)); } catch (e) {} }
+  throw new Error('gunzip failed');
+}
+
+module.exports = { encryptPayload, decryptBody, aesEcbEnc, aesEcbDec, SBOX, AES_KEY, pkcs7, alpha36Pad };

package/static/xhs/xhs_pc/js/rap_fingerprint_template.json

@@ -0,0 +1,8 @@
+{
+  "captured": "2026-07-14",
+  "source": "capture_20260714.json sample[1] (homefeed 235B)",
+  "mask": "0x38",
+  "plLen": 235,
+  "bodyLen": 219,
+  "bodyUnmaskedHex": "03ea00000010346c326b326a6a673668696d6472366203ebb0037bbb041b00041c00041d00041e00041f00042000042100042200042300042400042500042600042700042800042900042e00042a00042b00042c00042d00044c00000000042f00043000043100043600000000043a00000000043c00000000044000000000044200000000044900000012000000019f615912f2010000019f617b376d044400000a000446000004f704470000019f615908a50445000000000448000443000000040012ffff048400048500000000048000048100048200048300"
+}

package/static/xhs/xhs_pc/js/reference_profile.json

@@ -0,0 +1,262 @@
+{
+  "schemaVersion": 1,
+  "source": "xhs-pc-browser-fixtures-20260718",
+  "release": {
+    "appId": "xhs-pc-web",
+    "platform": "Windows",
+    "signVersion": "4.4.3",
+    "b1SdkVersion": "3.5.4",
+    "webProfileSdkVersion": "4.4.3",
+    "webBuild": "6.47.2",
+    "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36",
+    "secChUa": "\"Not;A=Brand\";v=\"8\", \"Chromium\";v=\"152\", \"Google Chrome\";v=\"152\""
+  },
+  "b1Reference": {
+    "frameCount": 2,
+    "x39": 22,
+    "x50": "131,88,103",
+    "secCanvas": "__SEC_CAV__1-1-1-1-1|",
+    "timeOriginOffsetMs": -2027.8,
+    "telemetryProfile": "active",
+    "selectedGlobalNames": [
+      "_BHjFmfUMEtxhI",
+      "_AUuXfEG27Xa3x",
+      "__xhsPendingNotePoint25300ReportMap",
+      "__xhsReportedNotePoint25300RecordMap",
+      "setImDebugMode",
+      "anti_hp_sign_config",
+      "__rap_app_id__",
+      "__rap_report__",
+      "__rap_last_sign_cost__",
+      "__rap_last_transform_cost__",
+      "__rap_hijack_installed__",
+      "__ed1a7dddf7c818e4bd",
+      "__hp_xhs_search_input_state__",
+      "__hp_xhs_search_submit_state__"
+    ],
+    "mouse": {
+      "me": 50,
+      "mm": 50,
+      "md": 3,
+      "mu": 3,
+      "c": 3,
+      "dc": 1
+    },
+    "keyboard": {},
+    "page": {
+      "ulr": 5,
+      "ps": 1,
+      "f": 20,
+      "b": 19,
+      "vc": 2,
+      "rs": 1,
+      "sc": 1
+    },
+    "state": {
+      "h": 0,
+      "f": 1,
+      "kr": 0
+    },
+    "features": {
+      "ae": 2.8905690597867015,
+      "ak": 5.664426623996462,
+      "cdr": 0.15566784512304102,
+      "bf": {
+        "ar": 0.9785478547854786,
+        "fr": 6.242728437964205
+      },
+      "fi": 3363
+    }
+  },
+  "b1Profiles": {
+    "login": {
+      "frameCount": 2,
+      "x39": 0,
+      "x50": "",
+      "generatedAtOffsetMs": 1839,
+      "secCanvas": "__SEC_CAV__1-1-1-1-1|__SEC_UD__|",
+      "timeOriginOffsetMs": -791.9,
+      "telemetryProfile": "login",
+      "telemetryTemplate": "{mt:{to:__TIME_ORIGIN__},m:{},k:{},p:{ulr:0,rs:1,ps:1,f:1},st:{h:0,f:1,kr:0},ft:{ae:null,ak:null,cdr:null,bf:null,fi:null}}",
+      "x37": "0|0|0|0|0|0|0|0|0|1|0|0|0|0|0|0|0|0|1|0|0|0|0|0",
+      "x38": "0|0|1|0|1|0|0|0|0|0|1|0|1|0|1|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0",
+      "x82": "1|_BHjFmfUMEtxhI|_AUuXfEG27Xa3x|__xhsPendingNotePoint25300ReportMap|__xhsReportedNotePoint25300RecordMap|setImDebugMode|anti_hp_sign_config|__rap_app_id__|__rap_report__|__rap_last_sign_cost__|__rap_last_transform_cost__|__rap_hijack_installed__|__ed1a7dddf7c818e4bd|__hp_xhs_search_input_state__|__h",
+      "evidence": "Fresh isolated PC login page6 webprofile collector on 2026-07-19"
+    }
+  },
+  "webProfile": {
+    "algorithm": "base64-des-ecb-zero-padding-hex",
+    "i12Seed": 70,
+    "i12DynamicIndexes": [],
+    "telemetryFi": 326,
+    "timeOriginOffsetMs": -791.9,
+    "telemetryTemplate": "{mt:{to:__TIME_ORIGIN__},m:{},k:{},p:{ulr:0,rs:1,ps:1,f:1},st:{h:0,f:1,kr:0},ft:{ae:null,ak:null,cdr:null,bf:null,fi:null}}",
+    "fields": {
+      "x1": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36",
+      "x2": "false",
+      "x3": "zh-CN",
+      "x4": "24",
+      "x5": "32",
+      "x6": "24",
+      "x7": "Google Inc. (NVIDIA),ANGLE (NVIDIA, NVIDIA GeForce RTX 5060 Ti (0x00002D04) Direct3D11 vs_5_0 ps_5_0, D3D11)",
+      "x8": "20",
+      "x9": "2560;1440",
+      "x10": "2560;1392",
+      "x11": "-480",
+      "x12": "Asia/Shanghai",
+      "x13": "true",
+      "x14": "true",
+      "x15": "true",
+      "x16": "false",
+      "x17": "false",
+      "x18": "un",
+      "x19": "Win32",
+      "x20": "un",
+      "x21": "PDF Viewer,Chrome PDF Viewer,Chromium PDF Viewer,Microsoft Edge PDF Viewer,WebKit built-in PDF",
+      "x22": "c8e2f6ff2a07957f70a18cde6b905ebb",
+      "x23": "false",
+      "x24": "false",
+      "x25": "false",
+      "x26": "false",
+      "x27": "false",
+      "x28": "10,false,false",
+      "x29": "4,7,8",
+      "x30": "swf object not loaded",
+      "x31": "124.04347527516074",
+      "x33": "0",
+      "x34": "0",
+      "x35": "0",
+      "x36": "2",
+      "x37": "0|0|0|0|0|0|0|0|0|1|0|0|0|0|0|0|0|0|1|0|0|0|0|0",
+      "x38": "0|0|1|0|1|0|0|0|0|0|1|0|1|0|1|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0",
+      "x39": "0",
+      "x40": "0",
+      "x41": "0",
+      "x42": "3.5.4",
+      "x43": "Canvas not supported",
+      "x44": "1784388700729",
+      "x45": "__SEC_CAV__1-1-1-1-1|__SEC_UD__|",
+      "x46": "false",
+      "x47": "1|0|0|0|0|0",
+      "x48": "",
+      "x49": "{list:[],type:}",
+      "x50": "",
+      "x51": "",
+      "x52": "",
+      "x54": "11311144241322244122",
+      "x55": "280,300,280,260,280,280,260,280,240,280,280,340,260,320",
+      "x56": "Google Inc. (NVIDIA)|ANGLE (NVIDIA, NVIDIA GeForce RTX 5060 Ti (0x00002D04) Direct3D11 vs_5_0 ps_5_0, D3D11)|0ebc53d03ea89d69525d81de558e2544|35",
+      "x53": "993da9a681fd3994c9f53de11f2903b3",
+      "x57": "ets=1784388696387; domain=.xiaohongshu.com; path=/; max-age=2592000",
+      "x58": "251",
+      "x59": "47",
+      "x60": "63",
+      "x61": "1352",
+      "x62": "2047",
+      "x63": "0",
+      "x64": "0",
+      "x65": "0",
+      "x66": {
+        "referer": "",
+        "location": "https://www.xiaohongshu.com/explore",
+        "frame": 0
+      },
+      "x67": "1|0",
+      "x68": "0",
+      "x69": "un",
+      "x70": [
+        "location",
+        "getElementById",
+        "getElementsByTagName",
+        "querySelector",
+        "querySelectorAll",
+        "evaluate"
+      ],
+      "x71": "true",
+      "x72": "complete",
+      "x73": "1800",
+      "x74": "0|0|0",
+      "x75": "Google Inc.",
+      "x76": "true",
+      "x77": "1|1|1|1|1|1|1|1|1|1",
+      "x78": {
+        "x": 0,
+        "y": 2598.9375,
+        "left": 0,
+        "right": 290.828125,
+        "bottom": 2616.9375,
+        "height": 18,
+        "top": 2598.9375,
+        "width": 290.828125,
+        "font": "system-ui, \"Apple Color Emoji\", \"Segoe UI Emoji\", \"Segoe UI Symbol\", \"Noto Color Emoji\", -apple-system, \"Segoe UI\", Roboto, Ubuntu, Cantarell, \"Noto Sans\", sans-serif, BlinkMacSystemFont, \"Helvetica Neue\", Arial, \"PingFang SC\", \"PingFang TC\", \"PingFang HK\", \"Microsoft Yahei\", \"Microsoft JhengHei\""
+      },
+      "x79": "14442|6442465386",
+      "x80": "1|[object FileSystemDirectoryHandle]",
+      "x82": "1|_BHjFmfUMEtxhI|_AUuXfEG27Xa3x|__xhsPendingNotePoint25300ReportMap|__xhsReportedNotePoint25300RecordMap|setImDebugMode|anti_hp_sign_config|__rap_app_id__|__rap_report__|__rap_last_sign_cost__|__rap_last_transform_cost__|__rap_hijack_installed__|__ed1a7dddf7c818e4bd|__hp_xhs_search_input_state__|__h",
+      "x83": "eyJkIjp7IjAiOjEzMiwiMSI6MTYyLCIyIjoxMDksIjMiOjExNiwiNCI6MTI5LCI1IjoxNjIsIjYiOjExNiwiNyI6MTExLCI4IjoyMDMsIjkiOjY2LCIxMCI6MTIxLCIxMSI6MjQ3LCIxMiI6MTU4LCIxMyI6MTQ0LCIxNCI6MTQ1LCIxNSI6ODEsIjE2IjoxNTQsIjE3IjoxNjEsIjE4IjoxMDksIjE5IjoxMjgsIjIwIjoxNjEsIjIxIjoxMDcsIjIyIjoxMjgsIjIzIjoxNjEsIjI0IjoxMTIsIjI1IjoxMzIsIjI2IjoxNjMsIjI3IjoxMTcsIjI4IjoxMDgsIjI5IjoxMTQsIjMwIjoxNDQsIjMxIjoxNjIsIjMyIjoxMTQsIjMzIjoxMTUsIjM0IjoxNDUsIjM1IjoxMzEsIjM2IjoxNjIsIjM3IjoxMTYsIjM4IjoxMTUsIjM5IjoyMDUsIjQwIjoyLCI0MSI6MTUwLCI0MiI6MTYxLCI0MyI6MTA0LCI0NCI6MTk0LCI0NSI6MTYxLCI0NiI6MTAyLCI0NyI6MTk1LCI0OCI6MTYyLCI0OSI6MTEyLCI1MCI6MTE1LCI1MSI6MTQ1LCI1MiI6MTMxLCI1MyI6MTYyLCI1NCI6MTE2LCI1NSI6MTE1LCI1NiI6MjA1LCI1NyI6NSwiNTgiOjU1LCI1OSI6MTYxLCI2MCI6MTA0LCI2MSI6MTk0LCI2MiI6MTYxLCI2MyI6MTAyLCI2NCI6MTk1LCI2NSI6MTYxLCI2NiI6MTAyLCI2NyI6MTQ1LCI2OCI6MTMxLCI2OSI6MTYyLCI3MCI6MTE2LCI3MSI6MTE1LCI3MiI6MjA1LCI3MyI6NywiNzQiOjU3LCI3NSI6MTYxLCI3NiI6MTA0LCI3NyI6MTk0LCI3OCI6MTYxLCI3OSI6MTAyLCI4MCI6MTk1fSwidiI6MSwiZSI6Im0ifQ==",
+      "x84": "{mt:{to:1784456743189.1},m:{},k:{},p:{ulr:0,rs:1,ps:1,f:1},st:{h:0,f:1,kr:0},ft:{ae:null,ak:null,cdr:null,bf:null,fi:null}}"
+    }
+  },
+  "mnsStages": {
+    "security": {
+      "tier": "0201",
+      "envConst": 1315,
+      "envFpTailHex": "f8536767c9b581635e0744fa8415",
+      "evidence": "cold-start seq 1-4, four browser fixtures byte-exact"
+    },
+    "coldContent": {
+      "tier": "0101",
+      "envConst": 1327,
+      "envFpTailHex": "f9536767c9b581635e0744fa8415",
+      "evidence": "cold-start seq 5-10, six browser fixtures byte-exact"
+    },
+    "steadyContent": {
+      "tier": "0301",
+      "envConst": 1352,
+      "envFpTailHex": "f9416767c9b581635e0744fa8415",
+      "evidence": "Fresh isolated PC login page6 webprofile x61; runtime-state dependent"
+    }
+  },
+  "loginMnsProfiles": {
+    "security_initial": {
+      "tier": "0201",
+      "envConst": 1322,
+      "envFpTailHex": "f8536767c9b581635e0744fa8415",
+      "evidence": "Fresh isolated Chrome 152 PC login security chain, 2026-09-06"
+    },
+    "security_callback": {
+      "tier": "0101",
+      "envConst": 1332,
+      "envFpTailHex": "f9526767c9b581635e0744fa8415",
+      "evidence": "Fresh isolated Chrome 152 PC seccallback, 2026-09-06"
+    },
+    "activate": {
+      "tier": "0101",
+      "envConst": 1335,
+      "envFpTailHex": "f9526767c9b581635e0744fa8415",
+      "evidence": "Fresh isolated Chrome 152 PC login activation, 2026-09-06"
+    },
+    "qrcode_create": {
+      "tier": "0301",
+      "envConst": 1350,
+      "envFpTailHex": "f9416767c9b581635e0744fa8415",
+      "evidence": "Fresh isolated Chrome 152 PC QR creation, 2026-09-06"
+    },
+    "qrcode_poll": {
+      "tier": "0301",
+      "envConst": 1351,
+      "envFpTailHex": "f9416767c9b581635e0744fa8415",
+      "evidence": "Fresh isolated Chrome 152 PC QR polling, 2026-09-06"
+    },
+    "webprofile": {
+      "tier": "0301",
+      "envConst": 1358,
+      "envFpTailHex": "f9416767c9b581635e0744fa8415",
+      "evidence": "Fresh isolated Chrome 152 PC webprofile, 2026-09-06"
+    }
+  },
+  "rap": {
+    "fingerprintVersion": 10301,
+    "fingerprintTemplate": "rap_fingerprint_template.json"
+  }
+}

package/static/xhs/xhs_pc/js/sign.js

@@ -0,0 +1,6 @@
+'use strict';
+
+// Legacy PC CLI path; the algorithm is maintained under xhs_core/js.
+const impl = require('../../xhs_core/js/sign.js');
+if (require.main === module && typeof impl.main === 'function') impl.main();
+module.exports = impl;

package/static/xhs/xhs_pc/js/web_ssk.js

@@ -0,0 +1,82 @@
+'use strict';
+
+const crypto = require('crypto');
+
+const X25519_PKCS8_PREFIX = Buffer.from('302e020100300506032b656e04220420', 'hex');
+const X25519_SPKI_PREFIX = Buffer.from('302a300506032b656e032100', 'hex');
+const SERVER_PUBLIC_KEY = Buffer.from(
+  'Kr0iygsCu3inYJNXCL4k4JuzaYQ2afI1xbwc7BH6sm8=',
+  'base64',
+);
+
+function privateKeyFromRaw(raw) {
+  const value = Buffer.from(raw);
+  if (value.length !== 32) throw new Error('X25519 private key must be 32 bytes');
+  return crypto.createPrivateKey({
+    key: Buffer.concat([X25519_PKCS8_PREFIX, value]),
+    format: 'der',
+    type: 'pkcs8',
+  });
+}
+
+function publicKeyFromRaw(raw) {
+  const value = Buffer.from(raw);
+  if (value.length !== 32) throw new Error('X25519 public key must be 32 bytes');
+  return crypto.createPublicKey({
+    key: Buffer.concat([X25519_SPKI_PREFIX, value]),
+    format: 'der',
+    type: 'spki',
+  });
+}
+
+function createHandshake() {
+  const { privateKey, publicKey } = crypto.generateKeyPairSync('x25519');
+  const privateDer = privateKey.export({ format: 'der', type: 'pkcs8' });
+  const publicDer = publicKey.export({ format: 'der', type: 'spki' });
+  return {
+    private_key_base64: privateDer.subarray(-32).toString('base64'),
+    client_public_key_base64: publicDer.subarray(-32).toString('base64'),
+  };
+}
+
+function acceptSsk(privateKeyBase64, encryptedSskBase64, serverPublicKey = SERVER_PUBLIC_KEY) {
+  const privateKey = privateKeyFromRaw(Buffer.from(String(privateKeyBase64), 'base64'));
+  const publicKey = publicKeyFromRaw(Buffer.from(serverPublicKey));
+  const sharedSecret = crypto.diffieHellman({ privateKey, publicKey });
+  const encrypted = Buffer.from(String(encryptedSskBase64), 'base64');
+  if (encrypted.length < 12 + 16) throw new Error('encrypted SSK is truncated');
+  const nonce = encrypted.subarray(0, 12);
+  const payload = encrypted.subarray(12);
+  const ciphertext = payload.subarray(0, -16);
+  const tag = payload.subarray(-16);
+  const decipher = crypto.createDecipheriv('aes-256-gcm', sharedSecret, nonce);
+  decipher.setAuthTag(tag);
+  const plain = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+  if (plain.length < 32) throw new Error('decrypted SSK is too short');
+  return plain.toString('base64');
+}
+
+function main() {
+  const input = JSON.parse(process.argv[2] || '{}');
+  if (input.action === 'create') {
+    process.stdout.write(JSON.stringify(createHandshake()) + '\n');
+    return;
+  }
+  if (input.action === 'accept') {
+    process.stdout.write(JSON.stringify({
+      ssk_base64: acceptSsk(input.private_key_base64, input.encrypted_ssk_base64),
+    }) + '\n');
+    return;
+  }
+  throw new Error('action must be create or accept');
+}
+
+if (require.main === module) main();
+
+module.exports = {
+  SERVER_PUBLIC_KEY,
+  createHandshake,
+  acceptSsk,
+  privateKeyFromRaw,
+  publicKeyFromRaw,
+};

package/static/xhs/xhs_pc/js/xs_common.js

@@ -0,0 +1,4 @@
+'use strict';
+
+// Legacy PC path kept in sync with the maintained pure implementation.
+module.exports = require('../../xhs_core/js/xs_common.js');