specific-ai-cli 0.0.0-stage → 0.1.1

package/dist/platforms/xhs/web/creator.js

@@ -0,0 +1,203 @@
+import { SpecificAIError } from '../../../core/errors.js';
+import { compactJson, pyFloatStr, urlencode } from '../../../core/py.js';
+import * as rand from '../../../core/rand.js';
+import { endpointFlag } from '../../../core/auth-store.js';
+import { b3TraceId, Session, xrayTraceId } from './client.js';
+import { checkSign, signFull } from './js.js';
+import { CREATOR, CREATOR_BROWSER, CREATOR_ORDER, LOGIN_LANG, orderedHeaders, UA, XHR_ACCEPT } from './profile.js';
+import { CreatorState, DS_REFRESH_MS } from './state.js';
+/**
+ * 创作者中心的会话（上游 xhs_utils/xhs_creator：XHSCreatorAuth + CreatorDeviceProfile + params）。
+ * 凭证在 `creator` scope（AGENTS 5.3）；签名状态存在凭证的 `device.creator`。
+ */
+const CREATOR_TIERS = { '0201': [200], '0101': [196, 197, 198] };
+const DS_TTL = 300_000;
+const AUTH_COOKIES = ['customer-sso-sid', 'access-token-creator.xiaohongshu.com', 'galaxy_creator_session_id', 'web_session'];
+/** 发布页请求的 cookie 顺序（Chrome 152）。 */
+export const PUBLISH_COOKIE_ORDER = [
+    'abRequestId', 'ets', 'a1', 'webId', 'gid', 'x-rednote-datactry', 'x-rednote-holderctry', '_gray_did', 'id_token',
+    'customer-sso-sid', 'x-user-id-creator.xiaohongshu.com', 'customerClientId', 'access-token-creator.xiaohongshu.com',
+    'galaxy_creator_session_id', 'galaxy.creator.beaker.session.id', 'web_session', 'unread', 'webBuild', 'xsecappid', 'acw_tc',
+    'websectiga', 'sec_poison_id', 'loadts',
+];
+/** Creator 的 splice_str：query 值里的 `:` 不转义。 */
+export const cspl = (api, params) => `${api}?${urlencode(Object.entries(params).map(([k, v]) => [k, v ?? '']), { safe: ':' })}`;
+/**
+ * Python 的 float。请求体由 Python 的 json.dumps 写出，整数值写成 `25.0`；签名 JS 拿到的是 JSON 解析后的对象，
+ * JSON.stringify 写成 `25`。toJSON 让签名侧照 JS 写，pyJson 让请求体照 Python 写。
+ */
+export class PyFloat {
+    value;
+    constructor(value) {
+        this.value = value;
+    }
+    toJSON() {
+        return this.value;
+    }
+}
+/** 与 compactJson 相同，PyFloat 按 Python 的 float 写。 */
+export function pyJson(v) {
+    if (v instanceof PyFloat)
+        return pyFloatStr(v.value);
+    if (Array.isArray(v))
+        return `[${v.map(pyJson).join(',')}]`;
+    if (v && typeof v === 'object' && !(v instanceof Map))
+        return `{${Object.entries(v).map(([k, x]) => `${compactJson(k)}:${pyJson(x)}`).join(',')}}`;
+    return compactJson(v);
+}
+/** 上游 get_request_headers_template（Creator）。 */
+function template(method, o) {
+    const h = {
+        'user-agent': UA,
+        accept: XHR_ACCEPT,
+        'accept-language': LOGIN_LANG,
+        'sec-fetch-dest': 'empty',
+        'sec-fetch-mode': 'cors',
+        'sec-fetch-site': o.site ?? 'same-site',
+        referer: o.referer ?? `${CREATOR}/`,
+        priority: 'u=1, i',
+    };
+    if (o.authorization ?? true)
+        h.authorization = '';
+    if (o.trace ?? true) {
+        h['x-b3-traceid'] = b3TraceId();
+        h['x-xray-traceid'] = xrayTraceId('core');
+    }
+    if (o.includeOrigin ?? method.toUpperCase() !== 'GET')
+        h.origin = o.origin ?? CREATOR;
+    if (method.toUpperCase() !== 'GET')
+        h['content-type'] = 'application/json';
+    if (o.clientHints) {
+        h['sec-ch-ua'] = '"Not;A=Brand";v="8", "Chromium";v="152", "Google Chrome";v="152"';
+        h['sec-ch-ua-mobile'] = '?0';
+        h['sec-ch-ua-platform'] = '"Windows"';
+    }
+    return h;
+}
+export class Creator extends Session {
+    state;
+    constructor(ctx) {
+        super(ctx, 'creator', CREATOR_BROWSER, CREATOR);
+        const device = (ctx.credential.device.creator ?? {});
+        this.state = new CreatorState(this.shared(), device.local);
+    }
+    resetState() {
+        this.state = new CreatorState(this.shared());
+    }
+    save() {
+        this.credential.device.creator = { local: this.state.storage() };
+    }
+    /** 缺 creator scope 时报 AUTH_REQUIRED，hint 带 --scope creator（AGENTS 5.3）。 */
+    requireScope() {
+        const c = this.state.cookies;
+        if (c.a1 && AUTH_COOKIES.some((k) => c[k]))
+            return;
+        const account = this.ctx.account && this.ctx.account !== 'guest' ? ` -a ${this.ctx.account}` : '';
+        throw new SpecificAIError('AUTH_REQUIRED', '需要登录小红书创作者中心', { hint: `specific-ai xhs auth login --scope creator${account}${endpointFlag(this.ctx.endpoint)}` });
+    }
+    /** 服务端 DS 程序与 _dsl（appId=ugc），5 分钟缓存（上游 xhs_creator/dsl.py）。 */
+    async dsBundle(force = false) {
+        const cached = this.credential.extra.creator_ds;
+        if (!force && cached?.dsl && cached.program && rand.now() - cached.at < DS_TTL)
+            return cached;
+        const { dsl, program } = await this.fetchDs('ugc', `${CREATOR}/`);
+        if (!dsl || !(program.includes('_dsf') || program.includes('__$c'))) {
+            if (cached?.dsl)
+                return cached;
+            throw new SpecificAIError('UPSTREAM', '小红书 ds 接口（ugc）没有返回 DS 程序，无法签名');
+        }
+        const bundle = { dsl, program, at: rand.now() };
+        this.credential.extra.creator_ds = bundle;
+        return bundle;
+    }
+    /** 上游 ensure_ds_material：安全就绪后保证 _dsl 与 _dsf 程序都在。 */
+    async ensureDs(force = false) {
+        if (!this.state.securityReady)
+            return;
+        const stale = rand.now() - this.state.dsllt >= DS_REFRESH_MS;
+        if (!force && !stale && this.state.dsl && this.state.dsProgram)
+            return;
+        const refresh = force || stale;
+        const b = await this.dsBundle(refresh);
+        if (refresh || !this.state.dsl)
+            this.state.dsl = b.dsl;
+        this.state.dsProgram = b.program;
+        if (refresh)
+            this.state.dsllt = rand.now();
+    }
+    /** 上游 generate_profile_request_params：签名 + 头模板，返回 headers 与紧凑 body。 */
+    async sign(api, data, method, o = {}, ensure = true) {
+        this.sync();
+        if (!this.state.cookies.a1)
+            throw new SpecificAIError('ERROR', '创作者中心 cookie 缺少 a1');
+        if (ensure && this.state.resolveMaterial(o.tier, o.mnsProfile).material.deviceTag !== 'nop')
+            await this.ensureDs();
+        const context = this.state.nextSignContext(o.tier, o.mnsProfile);
+        const b1 = o.b1Value ?? this.state.currentB1(context.now, o.b1Profile);
+        const dslPair = o.dslPairValue ?? this.state.dslPair(context.now);
+        if (context.tier === '0101' && context.deviceTag !== 'nop' && !context.dsProgram)
+            throw new SpecificAIError('ERROR', 'Creator mns0101 需要服务端下发的 DS 程序');
+        const input = { api, data: data ?? '', cookie: Object.entries(this.state.cookies).map(([k, v]) => `${k}=${v}`).join('; '), b1, dslPair, tier: context.tier };
+        for (const k of ['now', 'version', 'loadts', 'seq', 'envConst', 'envFpTail', 'deviceTag', 'b1b1', 'signCount', 'webBuild', 'signVersion', 'appId', 'platform', 'dsProgram', 'xt']) {
+            if (k in context)
+                input[k] = context[k];
+        }
+        if (context.dsProgram)
+            input.dsfProgram = context.dsProgram;
+        const r = checkSign(signFull(input), context.tier, CREATOR_TIERS[context.tier], 'Creator X-s');
+        if (!r.xs_common)
+            throw new SpecificAIError('ERROR', 'Creator X-S-Common 生成失败');
+        const headers = template(method, o);
+        headers['x-s'] = r.xs;
+        headers['x-t'] = String(r.xt);
+        headers['x-s-common'] = r.xs_common;
+        const body = data === '' || data == null ? '' : typeof data === 'string' ? data : pyJson(data);
+        return { headers, body };
+    }
+    /** 发往 creator.xiaohongshu.com 的 cookie 按发布页顺序重排。 */
+    wireFor(url) {
+        const cookies = this.wire(url);
+        if (!url.startsWith(CREATOR))
+            return cookies;
+        const out = {};
+        for (const k of PUBLISH_COOKIE_ORDER)
+            if (k in cookies)
+                out[k] = cookies[k];
+        for (const [k, v] of Object.entries(cookies))
+            if (!(k in out))
+                out[k] = v;
+        return out;
+    }
+    /**
+     * 上游 XHS_Creator_Apis._request_params：b1 默认用 login 快照、XHR 不带 sec-ch-ua*，UA 固定 Chrome 152。
+     * order 为 null 时不排序（post_note 带 x-rap-param，上游没有核实过它的头顺序）。
+     */
+    async business(api, data, method, o = {}) {
+        this.requireScope();
+        const signed = await this.sign(api, data, method, { b1Profile: 'login', origin: CREATOR, referer: `${CREATOR}/`, site: 'same-site', ...o, clientHints: false });
+        signed.headers['accept-language'] = LOGIN_LANG;
+        const url = (o.target ?? CREATOR) + api;
+        // 笔记管理页的请求再经 cookies_for_url 一次，回到存入顺序
+        const cookies = o.storeOrder ? this.wire(url) : this.wireFor(url);
+        let headers = { ...signed.headers, ...(o.extra ?? {}) };
+        headers['user-agent'] = UA;
+        let pairs;
+        if (o.order === null) {
+            // 不排序：dict 顺序，cookie 由 curl_cffi 的 cookies= 附上（accept-encoding 由调用方补在最后）
+            const cookie = Object.entries(cookies).map(([k, v]) => `${k}=${v}`).join('; ');
+            pairs = Object.entries(headers).filter((p) => p[1] != null);
+            if (cookie)
+                pairs.push(['cookie', cookie]);
+        }
+        else
+            pairs = orderedHeaders(headers, o.order ?? (method === 'GET' ? CREATOR_ORDER.get : CREATOR_ORDER.post), cookies);
+        const ua = pairs.findIndex(([k]) => k === 'user-agent');
+        if (ua >= 0)
+            pairs[ua] = ['user-agent', UA];
+        return { url, headers: pairs, body: signed.body };
+    }
+    async request(api, data = '', method = 'GET', o = {}) {
+        const r = await this.business(api, data, method, o);
+        return this.json({ method, url: r.url, headers: r.headers, ...(method === 'POST' ? { body: r.body } : {}) });
+    }
+}

package/dist/platforms/xhs/web/js.js

@@ -0,0 +1,194 @@
+import { spawn } from 'node:child_process';
+import * as nodeCrypto from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { dirname, join, resolve } from 'node:path';
+import vm from 'node:vm';
+import { SpecificAIError } from '../../../core/errors.js';
+import { PACKAGE_ROOT, staticFile } from '../../../core/paths.js';
+import * as rand from '../../../core/rand.js';
+import { createContext } from '../../../core/vm.js';
+/**
+ * 上游签名 JS（static/xhs/，原样复制，保持 xhs_core/js、xhs_pc/js、xhs_creator/js 的相对结构）。
+ *
+ * 上游按命令行脚本起 node 子进程（`node sign.js <json>`、`node b1.js --generate` 等），脚本本身都是 CommonJS 模块、
+ * 导出了真正干活的函数；这里在 node:vm 里按 CommonJS 加载它们，直接调用导出的函数。
+ * 确定性模式（对拍）下每次调用都新建 context——上游每次签名都新起一个进程，Math.random / Date 从头开始。
+ *
+ * websectiga_cli.js 例外：它改写进程级全局（隐藏 process、接管 Function.prototype.toString、
+ * `vm.runInThisContext` 跑服务端下发的程序），放不进 vm，和上游一样起子进程（AGENTS 7.4 的退路）。
+ */
+const hostRequire = createRequire(import.meta.url);
+const P = 'xhs';
+export const CORE_JS = (f) => staticFile(P, `xhs_core/js/${f}`);
+export const PC_JS = (f) => staticFile(P, `xhs_pc/js/${f}`);
+export const CREATOR_JS = (f) => staticFile(P, `xhs_creator/js/${f}`);
+/**
+ * 脚本里的 `require('crypto')`：确定性模式下 randomBytes 改为从该 context 已固定的 Math.random 取值
+ * （每字节 floor(Math.random() * 256)），与对拍时预加载的 scripts/golden/xhs/crypto_determinism.cjs 相同。
+ */
+function newRealm() {
+    const context = createContext();
+    if (!rand.isDeterministic())
+        return { context, modules: new Map(), crypto: nodeCrypto };
+    const random = vm.runInContext('Math.random', context);
+    const randomBytes = (n) => Buffer.from(Array.from({ length: n }, () => Math.floor(random() * 256)));
+    const crypto = new Proxy(nodeCrypto, { get: (t, k) => (k === 'randomBytes' ? randomBytes : Reflect.get(t, k)) });
+    return { context, modules: new Map(), crypto };
+}
+let shared = null;
+function realm() {
+    if (rand.isDeterministic())
+        return newRealm();
+    return (shared ??= newRealm());
+}
+function load(r, file) {
+    const cached = r.modules.get(file);
+    if (cached)
+        return cached.exports;
+    const module = { exports: {} };
+    r.modules.set(file, module);
+    if (file.endsWith('.json')) {
+        module.exports = JSON.parse(readFileSync(file, 'utf8'));
+        return module.exports;
+    }
+    const dir = dirname(file);
+    const req = (id) => {
+        if (id.startsWith('.')) {
+            const target = resolve(dir, id);
+            return load(r, /\.(js|json)$/.test(target) ? target : `${target}.js`);
+        }
+        return id === 'crypto' ? r.crypto : hostRequire(id);
+    };
+    const wrapper = vm.runInContext(`(function (exports, require, module, __filename, __dirname) {${readFileSync(file, 'utf8')}\n})`, r.context, {
+        filename: file,
+    });
+    wrapper(module.exports, req, module, file, dir);
+    return module.exports;
+}
+/** 加载一个模块（及其依赖），返回 module.exports。 */
+export function jsModule(file) {
+    return load(realm(), file);
+}
+/** mns + X-s + X-t（+ X-S-Common，给了 dslPair 时）。入参与上游 runtime.run_signer 写给 node 的 JSON 相同。 */
+export function signFull(input) {
+    return jsModule(CORE_JS('sign.js')).signFull(input);
+}
+/** 上游 run_signer 的输出门禁：mns 前缀与长度（PC）或长度集合（Creator）。 */
+export function checkSign(result, tier, lengths, what = 'X-s') {
+    const x3 = String(result?.x3 ?? '');
+    if (!result?.xs || !x3.startsWith(`mns${tier}_`) || !lengths.includes(x3.length)) {
+        throw new SpecificAIError('ERROR', `小红书 ${what} 签名失败（mns${tier}，长度 ${x3.length}）`);
+    }
+    return result;
+}
+/** b1：19 个字段的环境快照 → RC4 → 自定义 base64（xhs_core/js/b1.js generateB1）。 */
+export function generateB1(options) {
+    const value = String(jsModule(CORE_JS('b1.js')).generateB1(options).b1);
+    if (value.length < 500 || value.length % 4)
+        throw new SpecificAIError('ERROR', `小红书 b1 长度不对：${value.length}`);
+    return value;
+}
+/** PC webprofile 的 profileData（xhs_pc/js/profile.js）。 */
+export function pcProfileData(options) {
+    return String(jsModule(PC_JS('profile.js')).generateProfileData(options));
+}
+/** Creator webprofile 的 profileData（xhs_creator/js/profile.js）。 */
+export function creatorProfileData(options) {
+    return String(jsModule(CREATOR_JS('profile.js')).generateProfileData(options));
+}
+/** x-rap-param（xhs_pc/js/rap.js buildRapPure）；fingerprintHex 为空时用 PC 的采集模板（与 rap_cli.js 相同）。 */
+export function rapParam(api, data, fingerprintHex = '') {
+    const r = realm();
+    const fingerprint = Buffer.from(fingerprintHex || load(r, PC_JS('rap_fingerprint_template.json')).bodyUnmaskedHex, 'hex');
+    const value = String(load(r, PC_JS('rap.js')).buildRapPure({ api, data, fingerprint }));
+    if (!value.startsWith('ByQ'))
+        throw new SpecificAIError('ERROR', '小红书 x-rap-param 生成失败');
+    return value;
+}
+/** Creator 发布接口的 rap 指纹模板：03ea 段的 16 字符 Uuid 每次随机（上游 load_creator_rap_fingerprint_hex）。 */
+export function creatorRapFingerprint() {
+    const raw = Buffer.from(jsModule(CREATOR_JS('rap_fingerprint_creator.json')).bodyUnmaskedHex, 'hex');
+    if (raw.subarray(0, 6).toString('hex') !== '03ea00000010')
+        throw new SpecificAIError('ERROR', 'Creator rap 指纹模板缺少 03ea 段');
+    Buffer.from(rand.string(16, '0123456789abcdefghijklmnopqrstuvwxyz'), 'ascii').copy(raw, 6);
+    return raw.toString('hex');
+}
+/**
+ * 登录激活的 X25519 握手。上游用 generateKeyPairSync；这里私钥取 32 个随机字节（经 core/rand，对拍可固定），
+ * 公钥用 web_ssk.js 的 privateKeyFromRaw 导出——两者产出的密钥对等价。
+ */
+export function createHandshake() {
+    const priv = Buffer.from(rand.bytes(32));
+    const key = jsModule(PC_JS('web_ssk.js')).privateKeyFromRaw(priv);
+    const pub = nodeCrypto.createPublicKey(key).export({ format: 'der', type: 'spki' }).subarray(-32);
+    return { private_key_base64: priv.toString('base64'), client_public_key_base64: pub.toString('base64') };
+}
+/** 激活响应里的加密 SSK：X25519 + AES-256-GCM 解开，返回 base64。 */
+export function acceptSsk(privateKeyBase64, encryptedSskBase64) {
+    return String(jsModule(PC_JS('web_ssk.js')).acceptSsk(privateKeyBase64, encryptedSskBase64));
+}
+// ---------------------------------------------------------------- Creator 上传（xhs_creator/js）
+/** 文件加密接口的 sign：md5(固定盐 + fileId + 秒级时间戳的十六进制)。 */
+export function urlSign(fileId) {
+    return String(jsModule(CREATOR_JS('xhs_creator_sign.js')).urlSing(fileId));
+}
+/**
+ * ROS 上传的 q-signature（xhs_creator_signature.js 的 getSignature）。
+ * 这个脚本是给 PyExecJS 用的：没有 module.exports，只有一个顶层函数，所以按普通脚本在 context 里执行后取出。
+ */
+export function uploadSignature(message, fileId, size, host) {
+    const r = realm();
+    const file = CREATOR_JS('xhs_creator_signature.js');
+    if (!r.modules.has(file)) {
+        vm.runInContext(readFileSync(file, 'utf8'), r.context, { filename: file });
+        r.modules.set(file, { exports: {} });
+    }
+    return String(r.context.getSignature(message, fileId, size, host));
+}
+// ---------------------------------------------------------------- websectiga（子进程）
+/**
+ * 执行服务端下发的 seccallback 程序，得到 cookie `websectiga`（上游 runtime.generate_websectiga）。
+ * 确定性模式下和上游对拍时一样预加载 scripts/golden/node_determinism.cjs。
+ */
+export async function generateWebsectiga(code, profile) {
+    if (code.length < 1000)
+        throw new SpecificAIError('UPSTREAM', '小红书 seccallback 程序为空或被截断');
+    const deterministic = rand.isDeterministic();
+    const env = deterministic
+        ? {
+            NODE_OPTIONS: `--require "${join(PACKAGE_ROOT, 'scripts', 'golden', 'node_determinism.cjs').replaceAll('\\', '/')}"`,
+            SPECIFIC_AI_GOLDEN_SEED: String(rand.DEFAULT_SEED),
+            SPECIFIC_AI_GOLDEN_NOW: String(rand.now()),
+        }
+        : { NODE_OPTIONS: '' };
+    const script = CORE_JS('websectiga_cli.js');
+    const input = JSON.stringify({ code, userAgent: profile.userAgent, platform: profile.platform, pageUrl: profile.pageUrl, ...(profile.timeoutMs ? { timeoutMs: profile.timeoutMs } : {}) });
+    const stdout = await new Promise((ok, fail) => {
+        const child = spawn(process.execPath, [script], { cwd: dirname(script), env: { ...process.env, ...env }, stdio: ['pipe', 'pipe', 'pipe'], windowsHide: true });
+        const out = [];
+        const timer = setTimeout(() => child.kill(), 30_000);
+        child.stdout.on('data', (d) => out.push(d));
+        child.stderr.on('data', () => { });
+        child.on('error', (e) => {
+            clearTimeout(timer);
+            fail(new SpecificAIError('ERROR', `websectiga 进程启动失败：${e.message}`));
+        });
+        child.on('close', () => {
+            clearTimeout(timer);
+            ok(Buffer.concat(out).toString('utf8'));
+        });
+        child.stdin.end(input);
+    });
+    for (const line of stdout.split(/\r?\n/)) {
+        if (!line.trim().startsWith('{'))
+            continue;
+        try {
+            const token = String(JSON.parse(line).websectiga ?? '');
+            if (/^[0-9a-f]{64}$/i.test(token))
+                return token;
+        }
+        catch { }
+    }
+    throw new SpecificAIError('RISK_CONTROL', '小红书安全程序执行失败，拿不到 websectiga', { detail: { kind: 'blocked' } });
+}

package/dist/platforms/xhs/web/login.js

@@ -0,0 +1,230 @@
+import { crc32 } from 'node:zlib';
+import { SpecificAIError } from '../../../core/errors.js';
+import { md5Hex } from '../../../core/hash.js';
+import { parseJson } from '../../../core/http.js';
+import * as rand from '../../../core/rand.js';
+import { checkStatus, getdss, jsonOf as parseResponse, loginOrder, splice } from './client.js';
+import { acceptSsk, createHandshake, generateWebsectiga, pcProfileData } from './js.js';
+import { AS, EDITH, LOGIN_LANG, navigationHeaders, orderedHeaders, PC_ORDER, PC_REFERENCE, SEM, WEB, XHR_ACCEPT } from './profile.js';
+import { normalizeEts } from './state.js';
+/**
+ * PC 端的匿名设备初始化与登录（上游 apis/xhs_pc_login_apis.py 的 XHSLoginApi）。
+ *
+ * 匿名链路：www 导航拿 abRequestId → 本地生成 a1 / webId → 安全初始化（honeypot、redcaptcha、sem_sdk、
+ * ds、sbtsource、seccallback → websectiga）→ login/activate 拿访客 web_session 与 webSsk → webprofile 拿 gid。
+ * 游客态就是这条链路走完的访客会话，缓存在 guest.json（AGENTS 5.2）。
+ */
+const A1_CHARSET = 'abcdefghijklmnopqrstuvwxyz1234567890';
+/** 上游 common_util.generate_a1：时间戳十六进制 + 30 位随机 + '50000' + crc32，截到 52 位。 */
+export function generateA1() {
+    const part = rand.now().toString(16) + rand.string(30, A1_CHARSET) + '5' + '0' + '000';
+    return (part + String(crc32(Buffer.from(part)) >>> 0)).slice(0, 52);
+}
+export const generateWebId = (a1) => md5Hex(a1);
+/** 登录链路的一次请求：签名（可选）→ 按实抓顺序排头 → 发送 → 合并 cookie → 解析 JSON。 */
+async function send(p, method, url, headers, kind, o = {}) {
+    const cookies = o.cookieUrl === null ? null : p.wire(o.cookieUrl ?? url);
+    const pairs = kind === 'raw' ? orderedHeaders(headers, PC_ORDER.navigation, cookies, { optional: ['cookie'] }) : orderedHeaders(headers, loginOrder(headers, kind), cookies);
+    return p.send({ method, url, headers: pairs, ...(o.body !== undefined ? { body: o.body } : {}) }, o.appendShared);
+}
+/** 登录接口触发风控时，退回到浏览器登录后导入 cookie。 */
+const COOKIE_HINT = '在浏览器里登录小红书后导入 cookie：specific-ai xhs auth login --method cookie --cookie "<Cookie>"';
+/** 登录链路的响应 → JSON：461 / 471 / 406 / 429 报风控并提示改用 cookie 登录，不是 JSON 时报 UPSTREAM。 */
+const jsonOf = (res) => parseResponse(res, COOKIE_HINT);
+// ---------------------------------------------------------------- 安全初始化
+async function navigate(p) {
+    const h = navigationHeaders();
+    await p.send({ url: `${WEB}/`, headers: orderedHeaders(h, PC_ORDER.navigation, null, { optional: ['cookie'] }), redirect: 'manual' });
+    await p.send({ url: `${WEB}/explore`, headers: orderedHeaders(h, PC_ORDER.navigation, p.wire(`${WEB}/explore`), { optional: ['cookie'] }), redirect: 'manual' });
+    if (!p.shared().abRequestId)
+        throw new SpecificAIError('UPSTREAM', '小红书首页导航没有下发 abRequestId');
+}
+async function honeypot(p) {
+    const h = {
+        'sec-ch-ua-platform': '"Windows"',
+        referer: `${WEB}/`,
+        'user-agent': PC_REFERENCE.release.userAgent,
+        accept: XHR_ACCEPT,
+        'sec-ch-ua': PC_REFERENCE.release.secChUa,
+        'content-type': 'application/json;charset=UTF-8',
+        'sec-ch-ua-mobile': '?0',
+        'accept-language': LOGIN_LANG,
+        origin: WEB,
+        priority: 'u=1, i',
+        'sec-fetch-dest': 'empty',
+        'sec-fetch-mode': 'cors',
+        'sec-fetch-site': 'same-site',
+    };
+    await send(p, 'POST', `${AS}/api/p/pj`, h, 'honeypot', { body: '{"callFrom":"xhs-pc-web"}' });
+}
+async function security(p, api, payload, o) {
+    const s = await p.loginSigned(api, payload, 'POST', { secDomain: true, tier: o.tier, mnsProfile: o.mnsProfile, trace: o.trace ?? false, includeB1: o.includeB1 });
+    return send(p, 'POST', (o.origin ?? AS) + api, s.headers, o.kind ?? 'security', { body: s.body });
+}
+async function scripting(p, payload, tier, mnsProfile) {
+    const res = await security(p, '/api/sec/v1/scripting', payload, { tier, mnsProfile });
+    const body = await jsonOf(res);
+    if (!res.ok || !body?.success)
+        throw new SpecificAIError('UPSTREAM', body?.msg || `scripting HTTP ${res.status}`);
+    return body;
+}
+/** 上游 _initialize_security：冷启动两段安全程序，按浏览器顺序。 */
+async function initializeSecurity(p) {
+    const dsl = await p.dsl();
+    p.setLoginDsl(dsl);
+    await honeypot(p);
+    await security(p, '/api/redcaptcha/v2/getconfig', {}, { tier: '0201', mnsProfile: 'security_initial', trace: true, origin: EDITH, kind: 'post' });
+    const sem = await p.loginSigned('/data/sem_sdk', '', 'GET', { secDomain: true, tier: '0201', mnsProfile: 'security_initial', trace: false });
+    await send(p, 'GET', `${SEM}/data/sem_sdk`, sem.headers, 'sem', { cookieUrl: null });
+    const ds = await scripting(p, { callFrom: 'web', callback: '', type: 'ds', appId: 'xhs-pc-web' }, '0201', 'security_initial');
+    const anchor = getdss(String(ds?.data?.data ?? ''));
+    if (!anchor)
+        throw new SpecificAIError('UPSTREAM', 'ds scripting 响应里没有 getdss()');
+    p.setLoginDsl(anchor);
+    await security(p, '/api/sec/v1/sbtsource', { callFrom: 'web', appId: 'xhs-pc-web' }, { tier: '0201', mnsProfile: 'security_initial' });
+    const sec = await scripting(p, { callFrom: 'web', callback: 'seccallback' }, '0101', 'security_callback');
+    const poison = String(sec?.data?.secPoisonId ?? '');
+    const code = String(sec?.data?.data ?? '');
+    if (!poison || code.length < 1000)
+        throw new SpecificAIError('UPSTREAM', 'seccallback 响应缺少 secPoisonId 或安全程序');
+    const tiga = await generateWebsectiga(code, { userAgent: PC_REFERENCE.release.userAgent, platform: 'Win32', pageUrl: `${WEB}/explore`, timeoutMs: 15000 });
+    p.setCookie('websectiga', tiga);
+    p.setCookie('sec_poison_id', poison);
+    p.sync();
+    p.state.lastTiga = rand.now();
+    p.state.dsllt = p.state.lastTiga;
+}
+/** 上游 _activate：访客 web_session + webSsk（X25519 协商）。 */
+async function activate(p) {
+    const hs = createHandshake();
+    const s = await p.loginSigned('/api/sns/web/v1/login/activate', { client_public_key_base64: hs.client_public_key_base64 }, 'POST', { tier: '0101', mnsProfile: 'activate' });
+    const res = await send(p, 'POST', `${EDITH}/api/sns/web/v1/login/activate`, s.headers, 'post', { body: s.body });
+    const body = await jsonOf(res);
+    if (!res.ok || !body?.success)
+        throw new SpecificAIError('UPSTREAM', body?.msg || `login/activate HTTP ${res.status}`);
+    const d = body.data ?? {};
+    if (d.session)
+        p.setCookie('web_session', String(d.session));
+    p.sync();
+    if (!p.shared().web_session)
+        throw new SpecificAIError('UPSTREAM', 'login/activate 没有下发访客 web_session');
+    if (!d.ssk)
+        throw new SpecificAIError('UPSTREAM', 'login/activate 没有下发 SSK');
+    p.state.webSsk = JSON.stringify({ 'xhs-pc-web': acceptSsk(hs.private_key_base64, String(d.ssk)) });
+    p.state.fingerprintReady = true;
+}
+/** 上游 _fetch_gid / ensure_webprofile：上报 profileData，换 gid。 */
+export async function webprofile(p) {
+    const existing = p.shared().gid;
+    if (p.webprofileReported && existing)
+        return existing;
+    const data = {
+        platform: 'Windows',
+        sdkVersion: PC_REFERENCE.release.webProfileSdkVersion,
+        svn: '2',
+        profileData: pcProfileData(p.state.profileDataOptions(rand.now())),
+    };
+    const res = await security(p, '/api/sec/v1/shield/webprofile', data, { tier: '0301', mnsProfile: 'webprofile', includeB1: true });
+    // 风控状态码照常抛出；只有响应体不是 JSON 时按上报失败处理（上游 except 后返回 None）
+    checkStatus(res, COOKIE_HINT);
+    const body = await parseJson(res).catch(() => ({}));
+    const gid = p.shared().gid;
+    if (!res.ok || !(body?.success === true || body?.code === 0) || !gid)
+        throw new SpecificAIError('RISK_CONTROL', 'webprofile 上报没有换到 gid', { detail: { kind: 'blocked' } });
+    p.state.p1 += 1;
+    p.state.fingerprintReady = true;
+    p.webprofileReported = true;
+    return gid;
+}
+/** 上游 generate_init_cookies：从零建立一个匿名设备会话（不含 webprofile）。 */
+export async function initAnonymous(p) {
+    // 上游先用空 cookie 建一次 profile（消耗一次 tab 设备 ID 的 uuid4，这里是 Pc 构造时的那次），导航后再用初始 cookie 重建
+    p.jar.cookies.splice(0);
+    await navigate(p);
+    const ts = rand.now();
+    const a1 = generateA1();
+    const webId = generateWebId(a1);
+    const loadts = ts + rand.randint(50, 200);
+    p.replaceShared({
+        abRequestId: p.shared().abRequestId,
+        ets: String(normalizeEts(ts)),
+        webBuild: PC_REFERENCE.release.webBuild,
+        xsecappid: PC_REFERENCE.release.appId,
+        loadts: String(loadts),
+        a1,
+        webId,
+    });
+    p.resetState();
+    p.loginB1 = '';
+    p.webprofileReported = false;
+    await initializeSecurity(p);
+    await activate(p);
+}
+// ---------------------------------------------------------------- 二维码 / 短信
+export async function qrcodeCreate(p) {
+    const s = await p.loginSigned('/api/sns/web/v1/login/qrcode/create', { qr_type: 1 }, 'POST', { tier: '0301', mnsProfile: 'qrcode_create' });
+    const body = await jsonOf(await send(p, 'POST', `${EDITH}/api/sns/web/v1/login/qrcode/create`, s.headers, 'post', { body: s.body }));
+    const d = body?.data ?? {};
+    if (!body?.success || !d.qr_id || !d.code || !d.url)
+        throw new SpecificAIError('UPSTREAM', body?.msg || '获取二维码失败');
+    return { qrId: String(d.qr_id), code: String(d.code), url: String(d.url) };
+}
+/** 上游 check_qrcode_status：0 待扫码、1 待确认、2 成功（成功时换正式 web_session）、3 过期。 */
+export async function qrcodeStatus(p, qrId, code) {
+    const s = await p.loginSigned('/api/qrcode/userinfo', { qrId, code }, 'POST', { tier: '0301', mnsProfile: 'qrcode_poll' });
+    const body = await jsonOf(await send(p, 'POST', `${EDITH}/api/qrcode/userinfo`, s.headers, 'post', { body: s.body }));
+    const status = body?.data?.codeStatus;
+    if (status == null)
+        throw new SpecificAIError('UPSTREAM', body?.msg || '二维码状态响应缺少 codeStatus');
+    if (status === 2)
+        await qrcodeFinish(p, qrId, code);
+    return Number(status);
+}
+export async function qrcodeFinish(p, qrId, code) {
+    const api = splice('/api/sns/web/v1/login/qrcode/status', { qr_id: qrId, code });
+    const visitor = p.shared().web_session ?? '';
+    const s = await p.loginSigned(api, '', 'GET', { tier: '0301', mnsProfile: 'qrcode_poll' });
+    s.headers['x-login-mode'] = '';
+    const res = await send(p, 'GET', EDITH + api, s.headers, 'get-login-mode', { appendShared: ['web_session', 'id_token', 'x-rednote-datactry', 'x-rednote-holderctry'] });
+    const body = await jsonOf(res);
+    const d = body?.data ?? {};
+    if (!body?.success || d.code_status !== 2)
+        throw new SpecificAIError('AUTH_REQUIRED', body?.msg || '二维码登录状态无效');
+    // 上游 `cookies.pop(name); cookies[name] = value` 在 cookie dict 里挪到末尾，但 HostCookieStore 记住的发送顺序不变，
+    // 线上仍在原位，所以这里只改值
+    const session = String(d.login_info?.session ?? '');
+    if (session)
+        p.setCookie('web_session', session);
+    else if (!p.shared().web_session || p.shared().web_session === visitor)
+        throw new SpecificAIError('AUTH_REQUIRED', '二维码登录响应缺少正式 web_session');
+    p.sync();
+}
+export async function sendSmsCode(p, phone, zone = '86') {
+    const api = splice('/api/sns/web/v2/login/send_code', { phone, zone, type: 'login' });
+    const s = await p.loginSigned(api, '', 'GET');
+    const body = await jsonOf(await send(p, 'GET', EDITH + api, s.headers, 'get'));
+    if (!body?.success)
+        throw new SpecificAIError('UPSTREAM', body?.msg || '发送验证码失败', { detail: { code: body?.code } });
+}
+export async function smsLoginCode(p, phone, code, zone = '86') {
+    const api = splice('/api/sns/web/v1/login/check_code', { phone, zone, code });
+    const s = await p.loginSigned(api, '', 'GET');
+    const checked = await jsonOf(await send(p, 'GET', EDITH + api, s.headers, 'get'));
+    const token = checked?.data?.mobile_token;
+    if (!checked?.success || !token)
+        throw new SpecificAIError('AUTH_REQUIRED', checked?.msg || '验证码验证失败');
+    const login = '/api/sns/web/v2/login/code';
+    const s2 = await p.loginSigned(login, { mobile_token: token, zone, phone }, 'POST');
+    const body = await jsonOf(await send(p, 'POST', EDITH + login, s2.headers, 'post', { body: s2.body }));
+    const session = body?.data?.session;
+    if (!body?.success || !session)
+        throw new SpecificAIError('AUTH_REQUIRED', body?.msg || '登录失败');
+    p.setCookie('web_session', String(session));
+    p.sync();
+}
+/** 上游 XHSLoginApi.get_user_info：user/me，guest 为 false 才算正式登录。 */
+export async function loginUserMe(p) {
+    const s = await p.loginSigned('/api/sns/web/v2/user/me', '', 'GET');
+    const body = await jsonOf(await send(p, 'GET', `${EDITH}/api/sns/web/v2/user/me`, s.headers, 'get'));
+    return body?.success ? (body.data ?? {}) : null;
+}