specific-ai-cli 0.0.0-stage → 0.1.1

package/dist/platforms/douyin/web/crypto.js

@@ -0,0 +1,247 @@
+import { createCipheriv, createECDH, createHash, createHmac, createPrivateKey, createPublicKey } from 'node:crypto';
+import { sha256Hex } from '../../../core/hash.js';
+import { compactJson } from '../../../core/py.js';
+import * as rand from '../../../core/rand.js';
+/**
+ * bd-ticket-guard、x-tt-session-dtrait、ImageX/VOD 网关签名（上游 utils/bd_ticket.py、dtrait.py、imagex_sign.py、passport.py）。
+ *
+ * 随机数一律经 core/rand：ECDSA 的 k、密钥生成与 RSA 填充都按上游 python-ecdsa / os.urandom 的消耗方式取字节，
+ * 对拍时与上游逐字节一致；平时 rand.bytes 走 crypto.randomBytes。
+ */
+// ================================================================ P-256
+const P256_ORDER = 0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551n;
+const SPKI_PREFIX = Buffer.from('3059301306072a8648ce3d020106082a8648ce3d03010703420004', 'hex');
+const toBig = (buf) => BigInt('0x' + (Buffer.from(buf).toString('hex') || '0'));
+const toBuf32 = (n) => Buffer.from(n.toString(16).padStart(64, '0'), 'hex');
+function modInv(a, m) {
+    let [r0, r1] = [((a % m) + m) % m, m];
+    let [s0, s1] = [1n, 0n];
+    while (r1) {
+        const q = r0 / r1;
+        [r0, r1] = [r1, r0 - q * r1];
+        [s0, s1] = [s1, s0 - q * s1];
+    }
+    return ((s0 % m) + m) % m;
+}
+/** python-ecdsa 的 randrange(order)：取 33 字节，截前 256 位加 1，落在 [1, order) 为止。 */
+function randrange(order = P256_ORDER) {
+    for (;;) {
+        const ent = rand.bytes(33);
+        const num = (toBig(ent) >> 8n) + 1n;
+        if (num > 0n && num < order)
+            return num;
+    }
+}
+/** 私钥标量：接受 PEM（SEC1 / PKCS8）或十六进制。 */
+function privateScalar(prv) {
+    if (prv.includes('-----BEGIN')) {
+        const jwk = createPrivateKey(prv).export({ format: 'jwk' });
+        return toBig(Buffer.from(jwk.d, 'base64url'));
+    }
+    return BigInt('0x' + prv.trim());
+}
+/** k·G 的未压缩点（借 ECDH 做标量乘）。 */
+function mulG(k) {
+    const ecdh = createECDH('prime256v1');
+    ecdh.setPrivateKey(toBuf32(k));
+    return ecdh.getPublicKey();
+}
+/** 生成登录用的 P-256 密钥对，返回 SEC1 PEM（上游 generate_ec_keypair）。 */
+export function generateEcKey() {
+    const d = randrange();
+    const pub = mulG(d);
+    const jwk = { kty: 'EC', crv: 'P-256', d: toBuf32(d).toString('base64url'), x: pub.subarray(1, 33).toString('base64url'), y: pub.subarray(33).toString('base64url') };
+    return createPrivateKey({ key: jwk, format: 'jwk' }).export({ type: 'sec1', format: 'pem' }).toString();
+}
+/** bd-ticket-guard-ree-public-key：base64(04 || X || Y)。 */
+export function reeKey(prv) {
+    return mulG(privateScalar(prv)).toString('base64');
+}
+function derInt(n) {
+    let hex = n.toString(16);
+    if (hex.length % 2)
+        hex = '0' + hex;
+    let b = Buffer.from(hex, 'hex');
+    if (b[0] & 0x80)
+        b = Buffer.concat([Buffer.from([0]), b]);
+    return Buffer.concat([Buffer.from([0x02, b.length]), b]);
+}
+/** ECDSA-SHA256，DER 编码（python-ecdsa 的 sign(..., sigencode_der)，不做 low-s）。 */
+export function ecdsaSign(message, prv) {
+    const d = privateScalar(prv);
+    const z = toBig(createHash('sha256').update(message, 'utf8').digest());
+    for (;;) {
+        const k = randrange();
+        const r = toBig(mulG(k).subarray(1, 33)) % P256_ORDER;
+        const s = (modInv(k, P256_ORDER) * ((z + ((d * r) % P256_ORDER)) % P256_ORDER)) % P256_ORDER;
+        if (!r || !s)
+            continue;
+        const body = Buffer.concat([derInt(r), derInt(s)]);
+        return Buffer.concat([Buffer.from([0x30, body.length]), body]).toString('base64');
+    }
+}
+/** 服务端证书里的 65 字节公钥点：`pub.<b64>` 或 PEM 证书。 */
+function serverPoint(cert) {
+    if (cert.startsWith('pub.'))
+        return Buffer.from(cert.slice(4), 'base64');
+    const der = Buffer.from(cert.replace(/-----[^-]+-----/g, '').replace(/\s+/g, ''), 'base64');
+    const i = der.indexOf(SPKI_PREFIX);
+    if (i < 0)
+        throw new Error('服务端证书中未找到 P-256 公钥');
+    const start = i + SPKI_PREFIX.length;
+    return Buffer.concat([Buffer.from([4]), der.subarray(start, start + 64)]);
+}
+function hkdf(ikm, length = 32) {
+    const prk = createHmac('sha256', Buffer.alloc(32)).update(ikm).digest();
+    let okm = Buffer.alloc(0);
+    let block = Buffer.alloc(0);
+    for (let counter = 1; okm.length < length; counter++) {
+        block = createHmac('sha256', prk).update(Buffer.concat([block, Buffer.from([counter])])).digest();
+        okm = Buffer.concat([okm, block]);
+    }
+    return okm.subarray(0, length);
+}
+/** ECDH(客户端私钥, 服务端公钥) → HKDF-SHA256 → 32 字节 HMAC 密钥。 */
+export function ecdhKey(prv, serverCert) {
+    const ecdh = createECDH('prime256v1');
+    ecdh.setPrivateKey(toBuf32(privateScalar(prv)));
+    return hkdf(ecdh.computeSecret(serverPoint(serverCert)));
+}
+export function hmacSign(message, key) {
+    return createHmac('sha256', key).update(message, 'utf8').digest('base64');
+}
+/** bd-ticket-guard-client-data：有 ECDH 密钥走 HMAC，否则 ECDSA。 */
+export function ticketClientData(api, ticket, tsSign, prv, key, timestamp = rand.nowSeconds(), tTrust) {
+    const content = `ticket=${ticket}&path=${api}&timestamp=${timestamp}`;
+    const algo = key ? 'hmac' : 'ecdsa';
+    const payload = {
+        ts_sign: tsSign,
+        req_content: 'ticket,path,timestamp',
+        req_sign: key ? hmacSign(content, key) : ecdsaSign(content, prv),
+        timestamp,
+    };
+    if (tTrust !== undefined)
+        payload.t_trust = tTrust;
+    return { data: Buffer.from(compactJson(payload), 'utf8').toString('base64'), algo };
+}
+/** web-version 由 ts_sign 前缀决定：ts.1 → 1，其余 → 2。 */
+export const ticketGuardVersion = (tsSign) => (tsSign.startsWith('ts.1') ? 1 : 2);
+/** bd_ticket_guard_client_data：把自己的公钥交给服务端（base64(JSON) 再 encodeURIComponent）。 */
+export function clientDataCookie(prv) {
+    const payload = {
+        'bd-ticket-guard-version': 2,
+        'bd-ticket-guard-iteration-version': 1,
+        'bd-ticket-guard-ree-public-key': reeKey(prv),
+        'bd-ticket-guard-web-version': 2,
+    };
+    return encodeURIComponent(Buffer.from(compactJson(payload)).toString('base64'));
+}
+/** bd_ticket_guard_client_data_v2：对 `sec_ts=<sec_ts>` 做 HMAC（ECDH 密钥）。 */
+export function clientDataV2Cookie(prv, secTs, serverCert, tsSign = '') {
+    const payload = { ree_public_key: reeKey(prv) };
+    if (tsSign)
+        payload.ts_sign = tsSign;
+    payload.req_content = 'sec_ts';
+    payload.req_sign = hmacSign('sec_ts=' + secTs, ecdhKey(prv, serverCert));
+    payload.sec_ts = secTs;
+    return encodeURIComponent(Buffer.from(compactJson(payload)).toString('base64'));
+}
+// ================================================================ x-tt-session-dtrait
+/** 登录页 bundle 内置的 d0 公钥（上游 dtrait.py 的 _BUILTIN_TRAIT_PK1_B64）。 */
+const BUILTIN_PK1 = Buffer.from('LS0tLS1CRUdJTiBSU0EgUFVCTElDIEtFWS0tLS0tCk1JSUJDZ0tDQVFFQTQrZHZ2WTd1TStvcGMrbkxHL0R1bVNlRm83YVZjSW0xTE8rbVVJcldwclJ6UDBhMUdwRVEKNHF0TzlN' +
+    'UmYvbHdFSXgzOCs0Qlo0WE9HemV2VnR1VXZmSU9VRTdBVHRRVzdGS0pmNVBuU0xDSTYvazB2bDFGQwpMVVNWbUVQNnFQSnJJalo0elhvcWkzeXVOWisxb2RiUkEvL0dIZ2NnU3l5' +
+    'eWFMcXp3amtwV0dYb3VNWW12WXNTCnBway9mdjJFV0FCc3RQTnhXYTRFT0JDYWRUVVBrWE5RNzZOQkVQOXh6ZkpTMjB3aUR2MW9TL3ZLdnJTVXBXY0oKbmF6a2tCdnFRYmJBcVZi' +
+    'UUZURi9EUGlrcHB1NlpUNmxHSVh2SktDcmVlRmlIQTJxSzZ0UzE4U1dWSFc5QVJ6MQorcGpCMWVxSUlZdG9oV3BUMkI0ME9DNE84dFZlQkFuYmlRSURBUUFCCi0tLS0tRU5EIFJT' +
+    'QSBQVUJMSUMgS0VZLS0tLS0=', 'base64').toString('ascii');
+const PK1_VERSION = 'd0';
+const DTRAIT_SDK_VERSION = '1.0.0.16';
+function rsaPkcs1v15(pem, message) {
+    const jwk = createPublicKey(pem).export({ format: 'jwk' });
+    const n = toBig(Buffer.from(jwk.n, 'base64url'));
+    const e = toBig(Buffer.from(jwk.e, 'base64url'));
+    const k = Buffer.from(jwk.n, 'base64url').length;
+    const psLen = k - message.length - 3;
+    const ps = [];
+    while (ps.length < psLen)
+        for (const b of rand.bytes(psLen - ps.length))
+            if (b !== 0)
+                ps.push(b);
+    const em = toBig(Buffer.concat([Buffer.from([0, 2]), Buffer.from(ps.slice(0, psLen)), Buffer.from([0]), message]));
+    let c = 1n;
+    let base = em % n;
+    for (let x = e; x > 0n; x >>= 1n) {
+        if (x & 1n)
+            c = (c * base) % n;
+        base = (base * base) % n;
+    }
+    return Buffer.from(c.toString(16).padStart(k * 2, '0'), 'hex');
+}
+function aes128cbc(key, iv, plaintext) {
+    const cipher = createCipheriv('aes-128-cbc', key, iv);
+    return Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
+}
+/**
+ * 按请求 path 生成 x-tt-session-dtrait。同一会话复用 RSA 加密后的 AES 密钥（第一段），
+ * 每次请求重新取 IV 并按 path 加密 payload（第二段）。首次调用时的随机消耗顺序：key → iv → RSA 填充。
+ */
+export function sessionDtrait(path, blob, material) {
+    let iv;
+    if (!material) {
+        const keyHex = Buffer.from(rand.bytes(16)).toString('hex');
+        iv = rand.bytes(16);
+        material = { keyHex, encKey: rsaPkcs1v15(BUILTIN_PK1, Buffer.from(keyHex, 'ascii')) };
+    }
+    else
+        iv = rand.bytes(16);
+    const payload = compactJson({ dtrait: blob, timestamp: rand.nowSeconds(), sdkVersion: DTRAIT_SDK_VERSION, path });
+    const cipher = aes128cbc(Buffer.from(material.keyHex, 'hex'), iv, payload);
+    const header = `${PK1_VERSION}_${material.encKey.toString('base64')}_${Buffer.concat([iv, cipher]).toString('base64')}`;
+    return { header, material };
+}
+// ================================================================ ImageX / VOD 网关的 AWS SigV4
+export const IMAGEX_HOST = 'imagex.bytedanceapi.com';
+export const VOD_HOST = 'vod.bytedanceapi.com';
+const REGION = 'cn-north-1';
+const rfc3986 = (s) => encodeURIComponent(s).replace(/[!'()*]/g, (c) => '%' + c.charCodeAt(0).toString(16).toUpperCase());
+function canonicalQuery(query) {
+    const enc = query.map(([k, v]) => [rfc3986(String(k)), rfc3986(String(v))]);
+    enc.sort((a, b) => (a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : a[1] < b[1] ? -1 : a[1] > b[1] ? 1 : 0));
+    return enc.map(([k, v]) => `${k}=${v}`).join('&');
+}
+/** 返回要合入请求的头：authorization、x-amz-date、x-amz-security-token（POST 另有 x-amz-content-sha256）。 */
+export function sigv4(sts, method, query, body = '', service = 'imagex') {
+    const d = new Date(rand.now());
+    const pad = (n) => String(n).padStart(2, '0');
+    const dateStamp = `${d.getUTCFullYear()}${pad(d.getUTCMonth() + 1)}${pad(d.getUTCDate())}`;
+    const amzDate = `${dateStamp}T${pad(d.getUTCHours())}${pad(d.getUTCMinutes())}${pad(d.getUTCSeconds())}Z`;
+    const payloadHash = sha256Hex(body);
+    const signed = { 'x-amz-date': amzDate, 'x-amz-security-token': sts.SessionToken };
+    if (method === 'POST')
+        signed['x-amz-content-sha256'] = payloadHash;
+    const names = Object.keys(signed).sort();
+    const canonical = [method, '/', canonicalQuery(query), names.map((k) => `${k}:${signed[k]}\n`).join(''), names.join(';'), payloadHash].join('\n');
+    const scope = `${dateStamp}/${REGION}/${service}/aws4_request`;
+    const toSign = ['AWS4-HMAC-SHA256', amzDate, scope, sha256Hex(canonical)].join('\n');
+    let key = createHmac('sha256', 'AWS4' + sts.SecretAccessKey).update(dateStamp).digest();
+    for (const part of [REGION, service, 'aws4_request'])
+        key = createHmac('sha256', key).update(part).digest();
+    const signature = createHmac('sha256', key).update(toSign).digest('hex');
+    const out = {
+        authorization: `AWS4-HMAC-SHA256 Credential=${sts.AccessKeyID}/${scope}, SignedHeaders=${names.join(';')}, Signature=${signature}`,
+        'x-amz-date': amzDate,
+        'x-amz-security-token': sts.SessionToken,
+    };
+    if (method === 'POST')
+        out['x-amz-content-sha256'] = payloadHash;
+    return out;
+}
+/** content-crc32：小写 8 位十六进制。 */
+export function crc32Hex(data) {
+    let c = ~0;
+    for (const b of data) {
+        c ^= b;
+        for (let k = 0; k < 8; k++)
+            c = (c >>> 1) ^ (0xedb88320 & -(c & 1));
+    }
+    return ((~c) >>> 0).toString(16).padStart(8, '0');
+}

package/dist/platforms/douyin/web/dtrait.js

@@ -0,0 +1,190 @@
+import { readFileSync } from 'node:fs';
+import { SpecificAIError } from '../../../core/errors.js';
+import { staticFile } from '../../../core/paths.js';
+/**
+ * x-tt-session-dtrait 里的内层设备特征 blob（上游 utils/dtrait_features.py 的 build_blob、utils/dtrait_profile.py）。
+ *
+ * 结构逆自 `@byted/uc-secure-dtrait-core` 的字节码 VM：`[1 字节头][bool 位图][字符串特征段]`，整体 base64。
+ * - 头字节 = `(reserved << 6) | (dTraitType << 5) | (accessType << 4) | version`
+ * - bool 位图：`(floor(maxIdx/32)+1) * 5` 字节，第 n 个 bool 落在 `buf[5*(floor(n/32)+1) - floor((n%32)/8) - 1]` 的第 `n%8` 位
+ * - 字符串特征：34 条，每条 5 字节 = `[tag][murmur3 大端 4 字节]`；`str_1..str_33` → tag 32..64，`str_34` → 71
+ *
+ * canvas / WebGL / audio / 字体像素这类特征必须真实渲染，档案里直接存 murmur3 结果（render_hashes）；
+ * 其余由档案字段现算。随包的默认档案 static/douyin/dtrait_profile.json 是上游从 Chrome 153 DevTools 取证固化的，原样复制。
+ */
+/** 算不出 blob 时的说明：默认档案随包提供，只有导入的档案坏了（或安装不完整）才会走到这里。 */
+export const DTRAIT_BROKEN = '凭证里的 dtrait_profile 无效，或随包的默认设备档案缺失';
+export const DTRAIT_HINT = '用 specific-ai douyin auth login --method cookie --cookie @<凭证 JSON> 重新导入有效的 dtrait_profile / dtrait_blob，或把它们设为 null 改用内置档案';
+/** 档案无效时的错误（上游 _normalise_profile 在加载时就调 build_blob 校验）。 */
+function invalid(message) {
+    throw new SpecificAIError('USAGE', `dtrait_profile 无效：${message}`);
+}
+const isObject = (v) => v != null && typeof v === 'object' && !Array.isArray(v);
+/** str_N 的 tag（上游 STR_TAGS）。 */
+const strTag = (n) => (n <= 33 ? 31 + n : 71);
+/**
+ * Math 指纹的取值（str_11 / str_12，上游 math_features）。入参全是字面常量（VM 的 fn#313），结果只取决于浏览器的 V8，
+ * 所以直接写 Chrome 的值（与上游测试里 Chrome 153 抓到的 blob 一致），不在运行时现算：Node 自带的 V8 与 Chrome 的不同，
+ * Node 24 实测 Math.atanh(0.5)、Math.log(3)、Math.expm1(1) 都差 1 ULP（上游同样把 expm1(1) 写成常量 _V8_EXPM1_1）。
+ * 数值转字符串就是 JS 的 Number::toString（上游 js_number_to_str）。
+ */
+const MATH = {
+    tan: -1.4214488238747245, // Math.tan(-1e300)
+    atanh: 0.5493061443340549, // Math.atanh(0.5)
+    atanhPolyfill: 0.5493061443340549, // SDK 自带的 atanh polyfill：Math.log((1 + 0.5) / (1 - 0.5)) / 2
+    cos: -0.8390715290095377, // Math.cos(10.000000000123)
+    expm1: 1.7182818284590453, // Math.expm1(1)
+    powPi: 1.9275814160560206e-50, // Math.pow(Math.PI, -100)
+    sin: 0.8178819121159085, // Math.sin(-1e300)
+};
+/** Math 指纹的特征串（VM 的 fn#313 拼接顺序）。 */
+export function mathFeatures() {
+    const m = MATH;
+    return {
+        11: `${m.tan},${m.atanh},${m.atanhPolyfill},${m.cos}`,
+        12: `${m.expm1},${m.powPi},${m.sin},${m.tan}`,
+    };
+}
+/** MurmurHash3 x86 32 位，按 UTF-8 字节算（上游 murmur3_32，与 SDK 内的实现一致）。 */
+export function murmur3(s, seed = 0) {
+    const data = Buffer.from(s, 'utf8');
+    const c1 = 0xcc9e2d51;
+    const c2 = 0x1b873593;
+    let h = seed | 0;
+    const n = data.length & ~3;
+    for (let i = 0; i < n; i += 4) {
+        let k = data.readUInt32LE(i);
+        k = Math.imul(k, c1);
+        k = (k << 15) | (k >>> 17);
+        k = Math.imul(k, c2);
+        h ^= k;
+        h = (h << 13) | (h >>> 19);
+        h = (Math.imul(h, 5) + 0xe6546b64) | 0;
+    }
+    if (data.length > n) {
+        let k = 0;
+        for (let i = n; i < data.length; i++)
+            k |= data[i] << (8 * (i - n));
+        k = Math.imul(k, c1);
+        k = (k << 15) | (k >>> 17);
+        k = Math.imul(k, c2);
+        h ^= k;
+    }
+    h ^= data.length;
+    h ^= h >>> 16;
+    h = Math.imul(h, 0x85ebca6b);
+    h ^= h >>> 13;
+    h = Math.imul(h, 0xc2b2ae35);
+    h ^= h >>> 16;
+    return h >>> 0;
+}
+/** 直接当特征串用的字段（上游对它们直接取 murmur3，必须是字符串）。 */
+const STRING_FIELDS = ['ua', 'notification_permission', 'hook_score'];
+/** 用逗号拼接的字符串列表。 */
+const LIST_FIELDS = ['languages', 'str16_list', 'str18_list'];
+/** 拼进特征串的标量：字符串或数字。 */
+const SCALAR_FIELDS = [
+    'downlink', 'effective_type', 'language', 'vendor', 'platform', 'str17_tail', 'locale', 'timezone', 'str29_head', 'device_memory',
+    'hardware_concurrency', 'max_touch_points', 'avail_height', 'avail_left', 'avail_top', 'avail_width', 'screen_height', 'screen_width',
+    'color_depth', 'pixel_depth', 'device_pixel_ratio',
+];
+function checkFields(p) {
+    for (const k of STRING_FIELDS)
+        if (typeof p[k] !== 'string')
+            invalid(`缺少字符串字段 ${k}`);
+    for (const k of LIST_FIELDS) {
+        const v = p[k];
+        if (!Array.isArray(v) || v.some((x) => typeof x !== 'string'))
+            invalid(`${k} 要是字符串数组`);
+    }
+    for (const k of SCALAR_FIELDS) {
+        const v = p[k];
+        if (typeof v !== 'string' && !(typeof v === 'number' && Number.isFinite(v)))
+            invalid(`缺少字段 ${k}`);
+    }
+    for (const k of ['reserved', 'dtrait_type', 'version'])
+        if (p[k] != null && !Number.isInteger(p[k]))
+            invalid(`${k} 要是整数`);
+}
+/** 从档案字段现算的特征串，键是 str_N 的 N（上游 computed_features）。 */
+export function computedFeatures(p) {
+    return {
+        ...mathFeatures(),
+        14: `${p.downlink},${p.effective_type}`,
+        15: `${p.language},${p.languages.join(',')}`,
+        16: `${p.str16_list.join(',')},${p.vendor}`,
+        17: `${p.platform},${p.str17_tail}`,
+        18: p.str18_list.join(','),
+        19: p.ua,
+        27: `${p.locale}+${p.timezone}`,
+        28: p.notification_permission,
+        29: `${p.str29_head},${p.device_memory},${p.hardware_concurrency},${p.max_touch_points}`,
+        30: `${p.avail_height},${p.avail_left},${p.avail_top},${p.avail_width}`,
+        31: `${p.screen_height},${p.screen_width}`,
+        32: `${p.color_depth},${p.pixel_depth},${p.device_pixel_ratio}`,
+        34: p.hook_score,
+    };
+}
+/** bools / render_hashes 的键转成序号（上游 _normalise_profile 的 `int(key)`）。 */
+function indexed(p, field) {
+    const v = p[field];
+    if (!isObject(v))
+        invalid(`${field} 要是对象`);
+    const out = new Map();
+    for (const [k, x] of Object.entries(v)) {
+        const n = Number(k);
+        if (!k.trim() || !Number.isInteger(n) || n < 0)
+            invalid(`${field} 的键 ${k} 不是序号`);
+        out.set(n, x);
+    }
+    return out;
+}
+/** bool 特征的位图（上游 _bool_buffer，即 VM 的 getBoolBuffer）。 */
+function boolBuffer(bools) {
+    if (!bools.size)
+        return Buffer.alloc(0);
+    const keys = [...bools.keys()].sort((a, b) => a - b);
+    const buf = Buffer.alloc((Math.floor(keys.at(-1) / 32) + 1) * 5);
+    for (const n of keys) {
+        if (n % 32 === 0)
+            buf[n / 32] = n / 8;
+        if (bools.get(n)) {
+            const i = 5 * (Math.floor(n / 32) + 1) - Math.floor((n % 32) / 8) - 1;
+            buf[i] = buf[i] | (1 << (n % 8));
+        }
+    }
+    return buf;
+}
+/**
+ * 由设备档案生成内层 dtrait blob（base64）。档案的结构同 static/douyin/dtrait_profile.json：
+ * `render_hashes`（渲染类特征的 murmur3）、`bools`，加上可算特征需要的字段。档案不完整时报 USAGE。
+ * accessType：central 与 edge 侧都是 0（实测两者头字节都是 0x20）。
+ */
+export function buildBlob(profile, accessType = 0) {
+    if (!isObject(profile))
+        invalid('要是 JSON 对象');
+    const bools = indexed(profile, 'bools');
+    for (const [n, v] of bools)
+        if (typeof v !== 'boolean')
+            invalid(`bools 的 ${n} 要是 true / false`);
+    const values = indexed(profile, 'render_hashes');
+    checkFields(profile);
+    for (const [n, s] of Object.entries(computedFeatures(profile)))
+        values.set(Number(n), murmur3(s));
+    const body = Buffer.alloc(34 * 5);
+    for (let n = 1; n <= 34; n++) {
+        const v = values.get(n);
+        if (typeof v !== 'number' || !Number.isInteger(v) || v < 0 || v > 0xffffffff)
+            invalid(`render_hashes 缺少 ${n}，或不是 32 位无符号整数`);
+        body[(n - 1) * 5] = strTag(n);
+        body.writeUInt32BE(v, (n - 1) * 5 + 1);
+    }
+    const num = (k, fallback) => (profile[k] ?? fallback);
+    const head = ((num('reserved', 0) & 0x3) << 6) | ((num('dtrait_type', 1) & 0x1) << 5) | ((accessType & 0x1) << 4) | (num('version', 0) & 0xf);
+    return Buffer.concat([Buffer.from([head]), boolBuffer(bools), body]).toString('base64');
+}
+let defaults;
+/** 随包的默认设备档案（上游 load_dtrait_profile 的默认路径 utils/dtrait_profile.json）。 */
+export function defaultProfile() {
+    return (defaults ??= JSON.parse(readFileSync(staticFile('douyin', 'dtrait_profile.json'), 'utf8')));
+}