specific-ai-cli 0.0.0-stage → 0.1.1

package/dist/platforms/bilibili/web/geetest-vision.js

@@ -0,0 +1,232 @@
+import { SpecificAIError } from '../../../core/errors.js';
+import { classify, crop, decodeImage, detect } from './ddddocr.js';
+/**
+ * 极验点选识别（上游 utils/geetest_ocr.py、geetest_metric.py、geetest_hybrid.py）：
+ * 1. 题图切成拼图（上面）和提示条（底部 40px），ddddocr 检测模型分别找字框，合并同一个字的重叠框；
+ * 2. 每个字框抠出来过 ddddocr 识别模型，取 CTC 各时间步的字符概率最大值作为向量（不需要认对字）；
+ * 3. 提示字与候选字两两算余弦相似度，匈牙利算法求一一对应，按提示条从左到右的顺序输出点击坐标。
+ */
+export const HINT_HEIGHT = 40;
+const PAD = 4;
+/** 切成拼图和提示条（split_sprite）。 */
+export function splitSprite(sprite) {
+    const { width, height } = sprite;
+    return { puzzle: crop(sprite, 0, 0, width, height - HINT_HEIGHT), hint: crop(sprite, 0, height - HINT_HEIGHT, width, height) };
+}
+/** 按 x1 从左到右，x1 相同时保持原顺序（Python 的 sorted 是稳定排序）。 */
+const byX = (list) => list
+    .map((b, i) => [b, i])
+    .sort((a, b) => a[0][0] - b[0][0] || a[1] - b[1])
+    .map(([b]) => b);
+/** 检测字符框，按 x1 从左到右（detect_boxes）。 */
+export async function detectBoxes(im) {
+    return byX((await detect(im)));
+}
+function intersectionRatio(a, b) {
+    const inter = Math.max(0, Math.min(a[2], b[2]) - Math.max(a[0], b[0])) * Math.max(0, Math.min(a[3], b[3]) - Math.max(a[1], b[1]));
+    const areaA = Math.max(1, (a[2] - a[0]) * (a[3] - a[1]));
+    const areaB = Math.max(1, (b[2] - b[0]) * (b[3] - b[1]));
+    return inter / Math.min(areaA, areaB);
+}
+/** 合并同一个彩色字的重叠框（merge_duplicate_boxes）：交集占较小框的比例 ≥ threshold 的连成一组取并集。 */
+export function mergeDuplicateBoxes(boxes, threshold = 0.25) {
+    const groups = [];
+    for (const box of byX(boxes.map((b) => b.map((v) => Math.trunc(v))))) {
+        const hits = groups.map((g, i) => (g.some((old) => intersectionRatio(box, old) >= threshold) ? i : -1)).filter((i) => i >= 0);
+        if (!hits.length) {
+            groups.push([box]);
+            continue;
+        }
+        const target = groups[hits[0]];
+        target.push(box);
+        for (const index of hits.slice(1).reverse())
+            target.push(...groups.splice(index, 1)[0]);
+    }
+    return byX(groups.map((g) => [Math.min(...g.map((b) => b[0])), Math.min(...g.map((b) => b[1])), Math.max(...g.map((b) => b[2])), Math.max(...g.map((b) => b[3]))]));
+}
+/** 提示条相邻字框重叠时，从两框交界的中点切开（_split_overlaps）。 */
+export function splitOverlaps(boxes) {
+    const fixed = boxes.map((b) => [...b]);
+    for (let i = 0; i < fixed.length - 1; i++) {
+        const right = fixed[i][2];
+        const left = fixed[i + 1][0];
+        if (right > left) {
+            const mid = Math.floor((right + left) / 2);
+            fixed[i][2] = mid;
+            fixed[i + 1][0] = mid;
+        }
+    }
+    return fixed;
+}
+function cropPad(im, [x1, y1, x2, y2], pad) {
+    return crop(im, Math.max(0, x1 - pad), Math.max(0, y1 - pad), Math.min(im.width, x2 + pad), Math.min(im.height, y2 + pad));
+}
+/** CTC 概率压成单位向量：各时间步取最大值，去掉 blank（下标 0），再归一化（probability_vector）。 */
+export function probabilityVector(probabilities, steps, classes) {
+    const v = new Float64Array(classes);
+    for (let t = 0; t < steps; t++)
+        for (let c = 0; c < classes; c++)
+            v[c] = Math.max(v[c], probabilities[t * classes + c]);
+    v[0] = 0;
+    let norm = 0;
+    for (const x of v)
+        norm += x * x;
+    norm = Math.sqrt(norm) + 1e-9;
+    for (let c = 0; c < classes; c++)
+        v[c] /= norm;
+    return v;
+}
+async function signature(im) {
+    const r = await classify(im);
+    return { text: r.text, vector: probabilityVector(r.probabilities, r.steps, r.classes) };
+}
+/**
+ * 矩形指派问题（scipy.optimize.linear_sum_assignment，最小化），照抄 scipy 的 rectangular_lsap.cpp
+ * （Crouse 的最短增广路），平局时的取法也一致。返回 [行下标, 列下标]。
+ */
+export function linearSumAssignment(cost) {
+    let nr = cost.length;
+    let nc = nr ? cost[0].length : 0;
+    if (!nr || !nc)
+        return [[], []];
+    const transpose = nc < nr;
+    let c;
+    if (transpose) {
+        c = new Array(nr * nc);
+        for (let i = 0; i < nr; i++)
+            for (let j = 0; j < nc; j++)
+                c[j * nr + i] = cost[i][j];
+        [nr, nc] = [nc, nr];
+    }
+    else
+        c = cost.flat();
+    if (c.some((x) => Number.isNaN(x) || x === -Infinity))
+        throw new Error('指派矩阵含 NaN 或 -inf');
+    const u = new Array(nr).fill(0);
+    const v = new Array(nc).fill(0);
+    const shortest = new Array(nc);
+    const path = new Array(nc).fill(-1);
+    const col4row = new Array(nr).fill(-1);
+    const row4col = new Array(nc).fill(-1);
+    const SR = new Array(nr);
+    const SC = new Array(nc);
+    const remaining = new Array(nc);
+    for (let cur = 0; cur < nr; cur++) {
+        let minVal = 0;
+        let i = cur;
+        let num = nc;
+        for (let it = 0; it < nc; it++)
+            remaining[it] = nc - it - 1;
+        SR.fill(false);
+        SC.fill(false);
+        shortest.fill(Infinity);
+        let sink = -1;
+        while (sink === -1) {
+            let index = -1;
+            let lowest = Infinity;
+            SR[i] = true;
+            for (let it = 0; it < num; it++) {
+                const j = remaining[it];
+                const r = minVal + c[i * nc + j] - u[i] - v[j];
+                if (r < shortest[j]) {
+                    path[j] = i;
+                    shortest[j] = r;
+                }
+                if (shortest[j] < lowest || (shortest[j] === lowest && row4col[j] === -1)) {
+                    lowest = shortest[j];
+                    index = it;
+                }
+            }
+            minVal = lowest;
+            if (minVal === Infinity)
+                throw new Error('指派问题无可行解');
+            const j = remaining[index];
+            if (row4col[j] === -1)
+                sink = j;
+            else
+                i = row4col[j];
+            SC[j] = true;
+            remaining[index] = remaining[--num];
+        }
+        u[cur] += minVal;
+        for (let r = 0; r < nr; r++)
+            if (SR[r] && r !== cur)
+                u[r] += minVal - shortest[col4row[r]];
+        for (let j = 0; j < nc; j++)
+            if (SC[j])
+                v[j] -= minVal - shortest[j];
+        let j = sink;
+        for (;;) {
+            const r = path[j];
+            row4col[j] = r;
+            [col4row[r], j] = [j, col4row[r]];
+            if (r === cur)
+                break;
+        }
+    }
+    if (transpose) {
+        const order = col4row.map((col, row) => [col, row]).sort((a, b) => a[0] - b[0] || a[1] - b[1]);
+        return [order.map(([col]) => col), order.map(([, row]) => row)];
+    }
+    return [col4row.map((_, i) => i), col4row];
+}
+const pyList = (xs) => `[${xs.map((x) => (typeof x === 'string' ? `'${x}'` : String(x))).join(', ')}]`;
+const round4 = (x) => Math.round(x * 1e4) / 1e4;
+/** 点选识别：geetest_metric.solve，再加上 geetest_hybrid.solve 的旁证告警。 */
+export async function solveClick(spriteBytes) {
+    const sprite = await decodeImage(spriteBytes);
+    const { puzzle, hint } = splitSprite(sprite);
+    const rawPuzzleBoxes = await detectBoxes(puzzle);
+    const puzzleBoxes = mergeDuplicateBoxes(rawPuzzleBoxes);
+    // 提示条相邻字会轻微相交，只合并高度嵌套的重复框，再切开相邻边界
+    const hintBoxes = splitOverlaps(mergeDuplicateBoxes(await detectBoxes(hint), 0.75));
+    const hints = [];
+    for (const box of hintBoxes)
+        hints.push(await signature(cropPad(hint, box, 2)));
+    const cands = [];
+    for (const box of puzzleBoxes)
+        cands.push(await signature(cropPad(puzzle, box, PAD)));
+    if (!hints.length || cands.length < hints.length) {
+        throw new SpecificAIError('RISK_CONTROL', `点选识别的检测框不足：提示 ${hints.length}，候选 ${cands.length}`, { detail: { kind: 'captcha' } });
+    }
+    const score = hints.map((h) => cands.map((p) => {
+        let dot = 0;
+        for (let i = 0; i < h.vector.length; i++)
+            dot += h.vector[i] * p.vector[i];
+        return Math.fround(dot);
+    }));
+    const [rows, cols] = linearSumAssignment(score.map((r) => r.map((x) => -x)));
+    const pairs = rows.map((r, i) => [r, cols[i]]).sort((a, b) => a[0] - b[0] || a[1] - b[1]);
+    const order = [];
+    const match = [];
+    for (const [h, p] of pairs) {
+        const box = puzzleBoxes[p];
+        order.push([Math.floor((box[0] + box[2]) / 2), Math.floor((box[1] + box[3]) / 2)]);
+        match.push({ hint: h, puzzle: p, score: round4(score[h][p]) });
+    }
+    const candChars = cands.map((c) => c.text);
+    const orderedChars = match.map((m) => candChars[m.puzzle]);
+    const warnings = [];
+    const low = match.filter((m) => m.score < 0.2);
+    if (low.length)
+        warnings.push(`${low.length} 个模型匹配低于 0.20，建议刷新题面`);
+    const blank = candChars.flatMap((c, i) => (c ? [] : [i + 1]));
+    if (blank.length)
+        warnings.push(`候选 ${pyList(blank)} ddddocr 认不出，字形匹配无旁证`);
+    const dupes = [...new Set(orderedChars.filter((c) => c && orderedChars.indexOf(c) !== orderedChars.lastIndexOf(c)))].sort();
+    if (dupes.length)
+        warnings.push(`点击序列里出现重复字 ${pyList(dupes)}，可能有两个提示位指到了同一类字形`);
+    return {
+        order,
+        match,
+        scoreMatrix: score.map((r) => r.map(round4)),
+        hintText: hints.map((h) => h.text),
+        candChars,
+        orderedChars,
+        warnings: [...new Set(warnings)],
+        hintBoxes,
+        puzzleBoxes,
+        rawPuzzleBoxes,
+        puzzleSize: [puzzle.width, puzzle.height],
+    };
+}

package/dist/platforms/bilibili/web/geetest.js

@@ -0,0 +1,450 @@
+import { createCipheriv } from 'node:crypto';
+import { SpecificAIError } from '../../../core/errors.js';
+import { md5Hex } from '../../../core/hash.js';
+import { HttpClient, parseJsonp } from '../../../core/http.js';
+import { interactive } from '../../../core/login.js';
+import { jsonDumps } from '../../../core/py.js';
+import * as rand from '../../../core/rand.js';
+import * as api from './api.js';
+import { fillSessionCookies, retrying } from './client.js';
+import { manualGeetest } from './geetest-manual.js';
+import { BROWSER, COOKIE_ORDER, PASSPORT, PROFILE } from './profile.js';
+/**
+ * 极验 v3（上游 utils/geetest_w.py、tools/geetest_solve.py）：
+ * `w` 的加密原语、fullpage 无感通道，以及降级到点选题后的自动识别（geetest-vision.ts）→ 提交 → 失败换题重试。
+ * 自动识别连续失败时，终端里改为在本地页面上手动验证（geetest-manual.ts）。
+ */
+const AES_IV = Buffer.from('0000000000000000');
+const RSA_N_HEX = '00C1E3934D1614465B33053E7F48EE4EC87B14B95EF88947713D25EECBFF7E74' +
+    'C7977D02DC1D9451F79DD5D1C10C29ACB6A9B4D6FB7D0A0279B6719E1772565F' +
+    '09AF627715919221AEF91899CAE08C0D686D748B20A3603BE2318CA6BC2B5970' +
+    '6592A9219D0BF05C9F65023A21D2330807252AE0066D59CEEFA5F2748EA80BAB81';
+const B64_ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789()';
+const B64_MASKS = [0x6f0000, 0x90b400, 0x004b14, 0x0000eb];
+export const GEETEST_VERSION = '9.2.0-guwyxh';
+export function genAesKey(length = 16) {
+    return rand.string(length, '0123456789abcdef');
+}
+export function aesEncrypt(plaintext, key) {
+    const c = createCipheriv('aes-128-cbc', Buffer.from(key), AES_IV);
+    return Buffer.concat([c.update(plaintext, 'utf8'), c.final()]);
+}
+function gatherBits(value, mask) {
+    let n = 0;
+    for (let r = 23; r >= 0; r--)
+        if ((mask >> r) & 1)
+            n = (n << 1) + ((value >> r) & 1);
+    return n;
+}
+/** 极验自定义 base64：按掩码做位挑选，尾部用 '.' 填充。 */
+export function customB64(data) {
+    let res = '';
+    let end = '';
+    const size = data.length;
+    for (let a = 0; a < size; a += 3) {
+        let v;
+        let take;
+        if (a + 2 < size) {
+            v = (data[a] << 16) + (data[a + 1] << 8) + data[a + 2];
+            take = 4;
+        }
+        else if (size % 3 === 2) {
+            v = (data[a] << 16) + (data[a + 1] << 8);
+            take = 3;
+            end = '.';
+        }
+        else {
+            v = data[a] << 16;
+            take = 2;
+            end = '..';
+        }
+        for (const m of B64_MASKS.slice(0, take))
+            res += B64_ALPHABET[gatherBits(v, m)];
+    }
+    return res + end;
+}
+const RSA_N = BigInt('0x' + RSA_N_HEX);
+const RSA_E = 0x10001n;
+const RSA_BYTES = 128;
+function modPow(base, exp, mod) {
+    let result = 1n;
+    base %= mod;
+    for (; exp > 0n; exp >>= 1n) {
+        if (exp & 1n)
+            result = (result * base) % mod;
+        base = (base * base) % mod;
+    }
+    return result;
+}
+/**
+ * 用极验公钥加密 AES 密钥（PKCS#1 v1.5），十六进制。填充的非零随机字节逐个从 rand.bytes 取（取到 0 就重取），
+ * 这样对拍时与上游（gen.py 换成确定性随机字节的同一套填充）逐字节一致；平时就是 crypto.randomBytes。
+ */
+export function rsaEncryptKey(key) {
+    const m = Buffer.from(key);
+    const ps = [];
+    while (ps.length < RSA_BYTES - m.length - 3) {
+        const b = rand.bytes(1)[0];
+        if (b)
+            ps.push(b);
+    }
+    const em = Buffer.concat([Buffer.from([0, 2]), Buffer.from(ps), Buffer.from([0]), m]);
+    return modPow(BigInt('0x' + em.toString('hex')), RSA_E, RSA_N).toString(16).padStart(RSA_BYTES * 2, '0');
+}
+/** `tt` 字段的插入式混淆；取模用原始 track 的长度。 */
+export function csCipher(track, c, s) {
+    if (!c?.length || !s)
+        return track;
+    const [s0, , a, , tail] = c;
+    let result = track;
+    const base = track.length;
+    for (let offset = 0; offset < s.length - 1; offset += 2) {
+        const ch = parseInt(s.slice(offset, offset + 2), 16);
+        const pos = (s0 * ch * ch + a * ch + tail) % base;
+        result = result.slice(0, pos) + String.fromCharCode(ch) + result.slice(pos);
+    }
+    return result;
+}
+const EMPTY_TRACK = 'M(*((1((M((';
+const EMPTY_HDL_TRACK = 'tEQOYESJYERVYEQ.';
+const EMPTY_BUF_MAGIC = '-1magic data'.repeat(73) + '-1';
+const EMPTY_BUF_BANG = '-1!!'.repeat(73) + '-1';
+const EMPTY_HDL_N = 'dGFdxFsdzEBYxHgZ'.repeat(73) + 'dGE.';
+export function defaultEp(nowMs = rand.now()) {
+    const tm = {};
+    [...'abcdefghijklmnopqrstu'].forEach((k, i) => (tm[k] = 'afghijlmnopqr'.includes(k) ? nowMs + i : 0));
+    return {
+        v: GEETEST_VERSION,
+        te: false,
+        $_BBn: false,
+        ven: PROFILE.webglVendor,
+        ren: PROFILE.webglRenderer,
+        fp: null,
+        lp: null,
+        em: { ph: 0, cp: 0, ek: '11', wd: 1, nt: 0, si: 0, sc: 0 },
+        tm,
+        dnf: 'dnf',
+        by: 2,
+    };
+}
+/** 极验手工拼的 JSON：`"key":value`，值用 Python json.dumps 的默认分隔符。 */
+function stringify(fields) {
+    return '{' + fields.map(([k, v]) => `${jsonDumps(k)}:${jsonDumps(v, { ensureAscii: false })}`).join(',') + '}';
+}
+const tt = (c, s) => (c?.length && s ? csCipher(EMPTY_TRACK, c, s) : EMPTY_TRACK);
+/** fullpage（无感判定）的明文载荷（build_payload）。 */
+export function buildPayload(gt, challenge, passtime, c, s = '', ep = defaultEp()) {
+    return stringify([
+        ['lang', 'zh-cn'],
+        ['type', 'fullpage'],
+        ['tt', tt(c, s)],
+        ['light', -1],
+        ['s', md5Hex(EMPTY_HDL_TRACK)],
+        ['h', md5Hex(EMPTY_HDL_N)],
+        ['hh', md5Hex(EMPTY_BUF_MAGIC)],
+        ['hi', md5Hex(EMPTY_BUF_BANG)],
+        ['vip_order', -1],
+        ['ct', -1],
+        ['ep', ep],
+        ['passtime', passtime],
+        ['rp', md5Hex(`${gt}${challenge}${passtime}`)],
+    ]);
+}
+/** 第一发 get.php 的明文载荷（build_init_payload）。 */
+export function buildInitPayload(gt, challenge) {
+    return jsonDumps({
+        gt,
+        challenge,
+        offline: false,
+        new_captcha: true,
+        product: 'bind',
+        https: true,
+        lang: 'zh-cn',
+        type: 'fullpage',
+        protocol: 'https://',
+        width: '300px',
+        cc: 20,
+        ww: true,
+        i: EMPTY_BUF_BANG,
+    }, { separators: [',', ':'], ensureAscii: false });
+}
+/** 点选提交（ajax.php）的明文载荷（build_click_payload）：有 a 时才带 rp。 */
+export function buildClickPayload(gt, challenge, a, pic, passtime, c, s = '', ep = defaultEp()) {
+    const fields = [
+        ['lang', 'zh-cn'],
+        ['passtime', passtime],
+        ['a', a],
+        ['pic', pic],
+        ['tt', tt(c, s)],
+        ['ep', ep],
+    ];
+    if (a)
+        fields.push(['rp', md5Hex(`${gt}${challenge}${passtime}`)]);
+    return stringify(fields);
+}
+/** JS 的 Math.round（.5 一律向 +∞），即上游的 _js_round。 */
+const jsRound = (x) => Math.floor(x + 0.5);
+/** 点击坐标 → `a` 字段：`x_y,x_y`，坐标是相对图片宽高的万分比（encode_click_a）。 */
+export function encodeClickA(clicks) {
+    return clicks.map(([x, y]) => `${Math.trunc(x)}_${Math.trunc(y)}`).join(',');
+}
+/** 0~1 的相对坐标 → `a` 字段（encode_click_a_from_ratio）。 */
+export function encodeClickAFromRatio(ratios) {
+    return encodeClickA(ratios.map(([rx, ry]) => [jsRound(rx * 10000), jsRound(ry * 10000)]));
+}
+export function buildW(payload, key = genAesKey(), withRsa = true) {
+    const body = customB64(aesEncrypt(payload, key));
+    return withRsa ? body + rsaEncryptKey(key) : body;
+}
+// ---------------------------------------------------------------- 链路
+const GEETEST = 'https://api.geetest.com';
+const REFERER = 'https://passport.bilibili.com/';
+/** 点选最多试几道题（上游 BiliAuth.from_sms_login 的 attempts=4）。 */
+const ATTEMPTS = 4;
+/** trans_cookies：Cookie 串 → 有序的名值表。 */
+function parseCookies(str) {
+    const out = new Map();
+    for (let item of str.split(';')) {
+        item = item.trim();
+        const i = item.indexOf('=');
+        if (!item || i < 0)
+            continue;
+        out.set(item.slice(0, i).trim(), item.slice(i + 1).trim());
+    }
+    return out;
+}
+const cookieString = (c) => [...c].map(([k, v]) => `${k}=${v}`).join('; ');
+/** sort_cookies：按浏览器的 cookie 顺序重排，表外的按原顺序排在最后。 */
+function sortCookies(c) {
+    const known = COOKIE_ORDER.filter((k) => c.has(k));
+    return new Map([...known, ...[...c.keys()].filter((k) => !COOKIE_ORDER.includes(k))].map((k) => [k, c.get(k)]));
+}
+/**
+ * 上游 `BiliAuth.from_cookie(state['cookies'], fill_device=False)` 的 cookie：极验 cookie 之外补上会话级的
+ * sid / PVID / b_lsid，再按浏览器顺序排好。上游提交和换题都用这份 cookie 请求 api.geetest.com。
+ */
+function sessionCookies(str) {
+    const c = parseCookies(str);
+    fillSessionCookies((name) => c.has(name), (name, value) => c.set(name, value));
+    return sortCookies(c);
+}
+/** 响应里新设的 cookie（requests_cookies_to_dict）。 */
+function setCookies(res) {
+    return res.headers.getSetCookie().map((line) => {
+        const i = line.indexOf('=');
+        return [line.slice(0, i).trim(), line.slice(i + 1).split(';', 1)[0].trim()];
+    });
+}
+/**
+ * 极验的请求：只带 referer（上游 `request(..., headers={'referer': REFERER})`），cookie 每次显式给出。
+ * 用单独的 HTTP 客户端，极验的 cookie 不进 B 站凭证的 cookie 罐。
+ */
+class Geetest {
+    b;
+    http;
+    constructor(b) {
+        this.b = b;
+        const { ctx } = b;
+        this.http = new HttpClient({ browser: BROWSER, os: 'windows', proxy: ctx.config.proxy, timeout: ctx.config.timeout, log: ctx.log });
+    }
+    /** 带退避重试的 GET（上游 http_util.request）。 */
+    get(url, query, cookies) {
+        return retrying(() => this.http.request({ url, query, headers: [['referer', REFERER]], cookies: Object.fromEntries(cookies) }), this.b.ctx.signal);
+    }
+    /** JSONP 接口：自动带 callback，返回解析后的对象和新设的 cookie。 */
+    async call(path, query, cookies) {
+        const res = await this.get(`${GEETEST}${path}`, [...query, ['callback', `geetest_${rand.now()}`]], cookies);
+        const text = await res.text();
+        const body = parseJsonp(text);
+        if (body == null)
+            throw new SpecificAIError('UPSTREAM', `极验 ${path} 返回的不是 JSON（HTTP ${res.status}）`, { detail: { status: res.status, body: text.slice(0, 300) } });
+        return { body, cookies: setCookies(res) };
+    }
+    /** 下载题图。 */
+    async image(servers, pic, cookies) {
+        const server = (servers?.[0] ?? 'static.geetest.com/').replace(/\/+$/, '');
+        const res = await this.get(`https://${server}/${pic.replace(/^\/+/, '')}`, undefined, cookies);
+        if (res.status !== 200)
+            throw captchaError(`下载极验题图失败（HTTP ${res.status}）`);
+        return new Uint8Array(await res.arrayBuffer());
+    }
+}
+function captchaError(message, detail = {}) {
+    return new SpecificAIError('RISK_CONTROL', message, { detail: { kind: 'captcha', ...detail } });
+}
+/** B 站会话的 cookie（上游 `auth.cookie`）。上游下载第一张题图时没传 cookies，带的就是这一份。 */
+function biliCookies(b) {
+    return new Map(b.http.prepare({ url: `${PASSPORT}/` }).cookies);
+}
+/** 向 B 站申请一次人机验证（上游 get_captcha），返回 token 与极验的 gt / challenge。 */
+async function requestCaptcha(b) {
+    const captcha = await api.captcha(b);
+    if (captcha.code !== 0)
+        throw new SpecificAIError('UPSTREAM', `申请人机验证失败：${captcha.message ?? captcha.code}`, { detail: { code: captcha.code } });
+    return { token: captcha.data.token, gt: captcha.data.geetest.gt, challenge: captcha.data.geetest.challenge };
+}
+/**
+ * 申请 B 站 captcha，走 fullpage 无感判定（上游 fetch）：
+ * 1. get.php（w = AES + RSA）建立会话，拿 c / s；
+ * 2. ajax.php（w 复用 AES）无感判定，直接放行时返回 validate；
+ * 3. 降级到点选时，get.php?is_next=true&type=click 下发题图和新的 c / s，再下载题图。
+ */
+async function fetchPuzzle(g) {
+    const { b } = g;
+    const { token, gt, challenge } = await requestCaptcha(b);
+    const type = (await g.call('/gettype.php', [['gt', gt]], new Map())).body?.data?.type;
+    b.ctx.log.debug(`极验产品类型：${type}`);
+    const cookies = new Map();
+    const key = genAesKey();
+    const common = [
+        ['gt', gt],
+        ['challenge', challenge],
+        ['lang', 'zh-cn'],
+        ['pt', 0],
+        ['client_type', 'web'],
+    ];
+    const init = await g.call('/get.php', [...common, ['w', buildW(buildInitPayload(gt, challenge), key, true)]], cookies);
+    for (const [k, v] of init.cookies)
+        cookies.set(k, v);
+    if (init.body.status !== 'success')
+        throw captchaError('人机验证初始化被拒绝', { response: init.body });
+    const { c, s } = init.body.data ?? {};
+    const startedAt = rand.now();
+    const decision = await g.call('/ajax.php', [...common, ['w', buildW(buildPayload(gt, challenge, 800, c, s ?? ''), key, false)]], cookies);
+    for (const [k, v] of decision.cookies)
+        cookies.set(k, v);
+    const result = decision.body.data?.result;
+    b.ctx.log.debug(`极验 fullpage 判定：${result}`);
+    if (result !== 'click') {
+        const validate = decision.body.data?.validate;
+        if (validate)
+            return { validate: { token, challenge, validate, seccode: `${validate}|jordan` } };
+        throw captchaError(`极验没有放行，也没有下发点选题：${result ?? decision.body.status}`, { result: result ?? null });
+    }
+    const puzzle = await g.call('/get.php', [
+        ['is_next', 'true'],
+        ['type', 'click'],
+        ['gt', gt],
+        ['challenge', challenge],
+        ['lang', 'zh-cn'],
+        ['https', 'true'],
+        ['protocol', 'https://'],
+        ['offline', 'false'],
+        ['product', 'embed'],
+        ['api_server', 'api.geetest.com'],
+        ['isPC', 'true'],
+        ['autoReset', 'true'],
+        ['width', '100%'],
+    ], cookies);
+    for (const [k, v] of puzzle.cookies)
+        cookies.set(k, v);
+    if (puzzle.body.status !== 'success')
+        throw captchaError('极验拒绝下发点选题', { response: puzzle.body });
+    const data = puzzle.body.data ?? {};
+    if (!data.pic)
+        throw captchaError('极验没有下发点选题图', { type: data.pic_type ?? null });
+    const sprite = await g.image(data.static_servers, data.pic, biliCookies(b));
+    return {
+        state: { gt, challenge, token, pic: data.pic, c: data.c ?? null, s: data.s ?? '', cookies: cookieString(cookies), fetchedAt: startedAt },
+        sprite,
+    };
+}
+/** 提交点击坐标（上游 _post_ajax）。click 插件会重新生成 AES 密钥，并且总带 RSA 段。 */
+async function postAjax(g, state, a) {
+    // 服务端会拿请求到达时间校验 passtime：识别太快时补足等待，避免 `duration short`
+    const elapsed = rand.now() - state.fetchedAt;
+    if (elapsed < 3500)
+        await rand.sleep(3500 - elapsed, g.b.ctx.signal);
+    const passtime = rand.now() - state.fetchedAt;
+    const w = buildW(buildClickPayload(state.gt, state.challenge, a, state.pic, passtime, state.c, state.s), undefined, true);
+    const { body } = await g.call('/ajax.php', [
+        ['gt', state.gt],
+        ['challenge', state.challenge],
+        ['lang', 'zh-cn'],
+        ['pt', 0],
+        ['client_type', 'web'],
+        ['w', w],
+    ], sessionCookies(state.cookies));
+    return body;
+}
+/** 验证失败后换一道题（上游 _refresh，对齐 click.3.1.2.js 的 refresh.php）。c / s 沿用原来的。 */
+async function refresh(g, state) {
+    const cookies = sessionCookies(state.cookies);
+    const { body, cookies: set } = await g.call('/refresh.php', [
+        ['gt', state.gt],
+        ['challenge', state.challenge],
+        ['lang', 'zh-cn'],
+        ['type', 'click'],
+    ], cookies);
+    for (const [k, v] of set)
+        cookies.set(k, v);
+    const sorted = sortCookies(cookies);
+    const data = body.data ?? {};
+    if (body.status !== 'success' || !data.pic)
+        throw captchaError('极验拒绝换题', { response: body });
+    const sprite = await g.image(data.image_servers, data.pic, sorted);
+    return { state: { ...state, pic: data.pic, cookies: cookieString(sorted), fetchedAt: rand.now() }, sprite };
+}
+/**
+ * 自动过极验（上游 tools/geetest_solve.solve）：无感通道放行就直接返回；降级到点选时自动识别并提交，
+ * 服务端判 fail 就换题重试，最多 attempts 道题。识别或提交失败报 RISK_CONTROL（captcha）。
+ */
+export async function autoSolve(b, attempts = ATTEMPTS) {
+    const g = new Geetest(b);
+    const first = await fetchPuzzle(g);
+    if ('validate' in first)
+        return first.validate;
+    let { state, sprite } = first;
+    const { solveClick } = await import('./geetest-vision.js');
+    let body;
+    for (let attempt = 1; attempt <= attempts; attempt++) {
+        const r = await solveClick(sprite).catch((err) => {
+            if (err instanceof SpecificAIError)
+                throw err;
+            throw captchaError(`点选识别出错：${err instanceof Error ? err.message : String(err)}`);
+        });
+        b.ctx.log.debug(`极验点选第 ${attempt}/${attempts} 题：提示 ${r.hintText.join(' ')}，候选 ${r.candChars.join(' ')}，点击 ${JSON.stringify(r.order)}`, r.match);
+        for (const w of r.warnings)
+            b.ctx.log.debug(`极验点选：${w}`);
+        const [width, height] = r.puzzleSize;
+        const a = encodeClickAFromRatio(r.order.map(([x, y]) => [x / width, y / height]));
+        body = await postAjax(g, state, a);
+        const validate = body?.data?.validate;
+        if (validate)
+            return { token: state.token, challenge: state.challenge, validate, seccode: `${validate}|jordan` };
+        if (body?.data?.result !== 'fail' || attempt === attempts)
+            break;
+        ({ state, sprite } = await refresh(g, state));
+    }
+    throw captchaError(`极验点选在 ${attempts} 道题内没有通过：${body?.data?.result ?? body?.status ?? '未知结果'}`, { result: body?.data?.result ?? null });
+}
+/** 自动识别失败后是否该交给人：验证码本身的失败（RISK_CONTROL），或者识别环境有问题（ERROR，例如缺模型）。 */
+function isSolveFailure(err) {
+    return err instanceof SpecificAIError && (err.code === 'RISK_CONTROL' || err.code === 'ERROR');
+}
+/**
+ * 登录用的极验：先自动过（无感 / 点选识别）；自动识别失败时，终端里（stdin 与 stderr 都是 TTY）重新申请一次 captcha，
+ * 在本地页面上手动验证（上游 quick_sms_login.complete_geetest 的人工分支）；否则报 RISK_CONTROL。
+ */
+export async function solve(b) {
+    try {
+        return await autoSolve(b);
+    }
+    catch (err) {
+        if (!isSolveFailure(err))
+            throw err;
+        if (!interactive()) {
+            // 环境问题（例如缺 OCR 模型）原样报出，带着它自己的修复提示
+            if (err.code === 'ERROR')
+                throw err;
+            throw new SpecificAIError('RISK_CONTROL', `人机验证没有自动通过：${err.message}`, {
+                hint: '在终端里重新执行这条登录命令：自动识别失败时会在本地打开验证页面，在浏览器里手动完成即可；也可以改用扫码登录 specific-ai bilibili auth login --method qrcode',
+                detail: { kind: 'captcha', ...(err.detail && typeof err.detail === 'object' ? err.detail : {}) },
+            });
+        }
+        b.ctx.log.warn(`人机验证没有自动通过（${err.message}），改为在浏览器里手动验证`);
+        const { token, gt, challenge } = await requestCaptcha(b);
+        const r = await manualGeetest(b.ctx, gt, challenge);
+        return { token, challenge: r.challenge, validate: r.validate, seccode: r.seccode };
+    }
+}