specific-ai-cli 0.0.0-stage → 0.1.1

package/dist/platforms/kuaishou/web/captcha-crypto.js

@@ -0,0 +1,134 @@
+import { crc32 } from 'node:zlib';
+import { quote } from '../../../core/py.js';
+/**
+ * 滑块验证码 `verifyParam` 的加密（上游 utils/sign/captcha_crypto.py，对应 encrypt.js 的 `$encrypt`）。
+ *
+ * 32 字节定长头 + 流密码密文：魔数、头长度、协议版本、0x1001、6、crc32(appId)、2、crc32(密文)、密文长度，均为小端。
+ * 密文是逐字节 `b ^ keystream`，keystream 来自三路 LFSR 组合生成器。没有随机数也没有时间戳。
+ */
+const FEEDBACK = [0x80000062, 0x40000020, 0x10000002];
+const MASK = [0x7fffffff, 0x3fffffff, 0x0fffffff];
+const HIGH = [0x80000000, 0xc0000000, 0xf0000000];
+/** q()/f27 里的种子；只有密钥装填后寄存器为 0 才用到。 */
+const SEED = [324508639, 610839776, 4256789809];
+/** 顶层闭包变量 v：`$encrypt` 调 q(payload, v) 时传进去的密钥。 */
+export const CIPHER_KEY = 'BvWTr0uRBGH366Yb';
+const HEADER_LEN = 32;
+const MAGIC = 0xdeadc0de;
+const VERSION_HEX = '00000000000000000003';
+const FIELD_1001 = 4097;
+const CONST_6 = 6;
+const CONST_2 = 2;
+/** 页面 d702 包装器传进来的 appId。 */
+export const APP_ID = 'c7b645db-65e8-401f-b38c-4c07c5fff247';
+const u16le = (v) => Uint8Array.of(v & 0xff, (v >>> 8) & 0xff);
+const u32le = (v) => Uint8Array.of(v & 0xff, (v >>> 8) & 0xff, (v >>> 16) & 0xff, (v >>> 24) & 0xff);
+/** q() + z()：三路 LFSR，每字节输出 8 bit 的钥匙流。 */
+class Lfsr3 {
+    r;
+    constructor(key = CIPHER_KEY) {
+        // 密钥循环补齐到 12 字节；三条寄存器都用 key[4..7] 装填
+        const raw = [...key].map((ch) => ch.charCodeAt(0) & 0xff);
+        while (raw.length < 12)
+            raw.push(raw[raw.length - key.length]);
+        const regs = [...SEED];
+        for (let i = 0; i < 4; i++) {
+            const byte = raw[i + 4];
+            for (let r = 0; r < 3; r++)
+                regs[r] = ((regs[r] << 8) | byte) >>> 0;
+        }
+        this.r = regs.map((v, i) => v || SEED[i]);
+    }
+    next() {
+        const r = this.r;
+        let b1 = r[1] & 1;
+        let b2 = r[2] & 1;
+        let out = 0;
+        for (let i = 0; i < 8; i++) {
+            if (r[0] & 1) {
+                r[0] = ((r[0] ^ (FEEDBACK[0] >>> 1)) | HIGH[0]) >>> 0;
+                if (r[1] & 1) {
+                    r[1] = ((r[1] ^ (FEEDBACK[1] >>> 1)) | HIGH[1]) >>> 0;
+                    b1 = 1;
+                }
+                else {
+                    r[1] = ((r[1] >>> 1) & MASK[1]) >>> 0;
+                    b1 = 0;
+                }
+            }
+            else {
+                r[0] = ((r[0] >>> 1) & MASK[0]) >>> 0;
+                if (r[2] & 1) {
+                    r[2] = ((r[2] ^ (FEEDBACK[2] >>> 1)) | HIGH[2]) >>> 0;
+                    b2 = 1;
+                }
+                else {
+                    r[2] = ((r[2] >>> 1) & MASK[2]) >>> 0;
+                    b2 = 0;
+                }
+            }
+            out = ((out << 1) | (b1 ^ b2)) & 0xff;
+        }
+        return out;
+    }
+    apply(data) {
+        const out = new Uint8Array(data.length);
+        for (let i = 0; i < data.length; i++)
+            out[i] = (data[i] ^ this.next()) & 0xff;
+        return out;
+    }
+}
+/** d702 的 `h()`：逐个 UTF-16 码元取低 8 位（不是 UTF-8，非 ASCII 字符会“丢字”，与浏览器一致）。 */
+export function toBytes(payload) {
+    const out = new Uint8Array(payload.length);
+    for (let i = 0; i < payload.length; i++)
+        out[i] = payload.charCodeAt(i) & 0xff;
+    return out;
+}
+/** `$encrypt`：明文 → 带 32 字节头的密文块。 */
+export function encrypt(payload, appId = APP_ID) {
+    const plain = typeof payload === 'string' ? toBytes(payload) : payload;
+    const cipher = new Lfsr3().apply(plain);
+    return Buffer.concat([
+        u32le(MAGIC),
+        u16le(HEADER_LEN),
+        Buffer.from(VERSION_HEX, 'hex'),
+        u16le(FIELD_1001),
+        Uint8Array.of(CONST_6),
+        u32le(crc32(Buffer.from(appId, 'utf8')) >>> 0),
+        Uint8Array.of(CONST_2),
+        u32le(crc32(cipher) >>> 0),
+        u32le(cipher.length),
+        cipher,
+    ]);
+}
+/** `$encrypt` 的逆：剥掉 32 字节头，用同一钥匙流还原明文（latin-1）。 */
+export function decrypt(blob) {
+    const b = Buffer.from(blob);
+    if (b.length < HEADER_LEN)
+        throw new Error(`密文块太短：${b.length} < ${HEADER_LEN}`);
+    if (b.readUInt32LE(0) !== MAGIC)
+        throw new Error('魔数不对');
+    const cipher = b.subarray(HEADER_LEN);
+    if (b.readUInt32LE(28) !== cipher.length)
+        throw new Error('长度字段与实际密文不符');
+    if (b.readUInt32LE(24) !== crc32(cipher) >>> 0)
+        throw new Error('密文 CRC32 校验失败');
+    return Buffer.from(new Lfsr3().apply(cipher)).toString('latin1');
+}
+/** d702 里的 `qs.stringify`：按插入顺序、键值都编码、跳过 null / undefined、布尔写成 true / false。 */
+export function qsStringify(params) {
+    const pairs = Array.isArray(params) ? params : Object.entries(params);
+    const out = [];
+    for (const [key, value] of pairs) {
+        if (value == null)
+            continue;
+        const v = typeof value === 'boolean' ? (value ? 'true' : 'false') : String(value);
+        out.push(`${quote(String(key), '*-._')}=${quote(v, '*-._')}`);
+    }
+    return out.join('&');
+}
+/** 参数 → 可以直接放进请求体的 base64 `verifyParam`。 */
+export function verifyParam(params, appId = APP_ID) {
+    return Buffer.from(encrypt(qsStringify(params), appId)).toString('base64');
+}

package/dist/platforms/kuaishou/web/captcha-fp.js

@@ -0,0 +1,180 @@
+import { compactJson } from '../../../core/py.js';
+import * as rand from '../../../core/rand.js';
+import { PROFILE, RESOLUTION } from './profile.js';
+/**
+ * 滑块验证码提交时的浏览器指纹块（上游 utils/captcha_fp.py）：`gpuInfo`（4 键）与 `captchaExtraParam`（65 键）。
+ * 默认值是上游在 Chrome 151 的验证码 iframe 里用 CDP 取回的真值，键序即 JSON.stringify 的输出顺序，不能重排。
+ * UA、时区、语言、CPU、平台、分辨率与几何（key3–key14、key37、key39）取自统一的浏览器档案 {@link PROFILE}，
+ * 与请求头、gdfp 载荷保持一致；canvas / webgl / 字体 / 音频等哈希和 key35 / key36 是这台浏览器稳定的环境哈希，不随机改写。
+ * 事件耗时与鼠标轨迹每次现算（原样重放会被判成回放，服务端回 350014）。
+ *
+ * 上游还可以用 `KuaishouAuth.set_captcha_fingerprint` 换成浏览器现抓的指纹（只有 Python API），specific-ai 没有移植，
+ * 始终用这里的默认值。
+ */
+export const GPU_INFO = {
+    glRenderer: 'WebKit WebGL',
+    glVendor: 'WebKit',
+    unmaskRenderer: PROFILE.webglRenderer,
+    unmaskVendor: PROFILE.webglVendor,
+};
+/** Ga() 的完整产物。没有形如整数的键，普通对象的插入顺序就是输出顺序。 */
+export const CAPTCHA_EXTRA_PARAM = {
+    ua: PROFILE.ua,
+    userAgent: PROFILE.ua,
+    timeZone: PROFILE.timeZone,
+    language: PROFILE.language,
+    cpuCoreCnt: String(PROFILE.cpuCores),
+    platform: PROFILE.platform,
+    riskBrowser: 'false',
+    webDriver: 'false',
+    exactRiskBrowser: 'false',
+    webDriverDeep: 'false',
+    exactRiskBrowser2: 'false',
+    webDriverDeep2: 'false',
+    battery: '1',
+    plugins: '1a68ba429dd293b14e41a28b6535aa590',
+    resolution: RESOLUTION,
+    pixelDepth: '24',
+    colorDepth: '24',
+    canvasGraphFingerPrint: '16d9e8c3c415322269b38d1449ec153ea',
+    canvasGraph: '16d9e8c3c415322269b38d1449ec153ea',
+    canvasTextFingerPrintEn: '11f6fbca159129e1aa778346fbe0b9c6d',
+    canvasTextEn: '11f6fbca159129e1aa778346fbe0b9c6d',
+    canvasTextFingerPrintZh: '1c086b7340d764f7c141910da1af587f2',
+    canvasTextZh: '1c086b7340d764f7c141910da1af587f2',
+    webglGraphFingerPrint: '1537e3a006691fc8474abd41438c08a5d',
+    webglGraph: '1537e3a006691fc8474abd41438c08a5d',
+    webglGPUFingerPrint: '1192e522040bbe560567d4321fed3c16a',
+    webglGpu: '1192e522040bbe560567d4321fed3c16a',
+    cssFontFingerPrintEn: '1e4c353075d9fe0c911b00a7f7dba2f26',
+    fontListEn: '1e4c353075d9fe0c911b00a7f7dba2f26',
+    cssFontFingerPrintZh: '154ef9bb94c26d3f7b091868f7a41c387',
+    fontListZh: '154ef9bb94c26d3f7b091868f7a41c387',
+    voiceFingerPrint: '1e49aa834eb6783f919c45022f2fcf7ef',
+    audioTriangle: '1e49aa834eb6783f919c45022f2fcf7ef',
+    nativeFunc: '1973dcbb27a04c3a2ee240d9d2549e105',
+    // 占位；每次请求都换成会话的 did
+    key1: 'web_' + '0'.repeat(32),
+    key2: 1786880034017,
+    key3: PROFILE.ua,
+    key4: PROFILE.productSub,
+    key5: PROFILE.language,
+    key6: PROFILE.product,
+    // screen.width / height、availWidth / availHeight、innerHeight、innerWidth（取屏幕宽）、outerHeight、outerWidth
+    key7: PROFILE.screenWidth,
+    key8: PROFILE.screenHeight,
+    key9: PROFILE.availWidth,
+    key10: PROFILE.availHeight,
+    key11: PROFILE.innerHeight,
+    key12: PROFILE.screenWidth,
+    key13: PROFILE.outerHeight,
+    key14: PROFILE.outerWidth,
+    key15: '00000111',
+    key16: 1,
+    key17: 1,
+    key18: ['0,103,-1,-1,-1,prepare1'],
+    key19: { prepare1: '0,103,-1,-1,-1' },
+    key20: ['0,102,-1,-1,-1,prepare1'],
+    key21: { prepare1: '0,102,-1,-1,-1' },
+    key22: ['0,102,-1,-1,-1,prepare1'],
+    key23: { prepare1: '0,102,-1,-1,-1' },
+    key24: ['0,102,-1,-1,-1,prepare1'],
+    key25: { prepare1: '0,102,-1,-1,-1' },
+    key26: {
+        key27: [
+            '0,1,40012,1310,169,prepare1',
+            '1,1,40015,1305,153,prepare1',
+            '2,1,40017,1301,140,prepare1',
+            '3,1,40022,1293,119,prepare1',
+            '4,1,40026,1284,93,prepare1',
+            '5,1,40030,1278,75,prepare1',
+            '6,1,40033,1275,66,prepare1',
+            '7,1,41016,-1,-1,prepare1',
+            '8,1,41017,-1,-1,prepare1',
+            '9,1,41022,1385,2,prepare1',
+        ],
+        key28: [],
+        key29: [],
+        key30: [],
+        key31: { prepare1: '9,1,41022,1385,2' },
+        key32: {},
+        key33: {},
+        key34: {},
+    },
+    key35: 'c1740e16914faedad278c0a1dea75811',
+    key36: 'f22a94013fc94e90e2af2798023a1985',
+    key37: PROFILE.devicePixelRatio,
+    key38: 'not support',
+    key39: PROFILE.cpuCores,
+};
+/**
+ * _session_fields：每次验证都现算的事件耗时与鼠标轨迹（key18–key26）。key35 / key36 是稳定的浏览器哈希，不在这里。
+ * 上游用 `random.Random(now_ms ^ random.getrandbits(32))` 新建一个生成器；这里直接用全局随机数，
+ * 先消耗一次对应 getrandbits(32) 的那个数，后续调用顺序与上游相同。
+ */
+export function sessionFields(_nowMs) {
+    void rand.random();
+    const timing = () => {
+        const s = `0,${rand.randint(88, 132)},-1,-1,-1`;
+        return [[`${s},prepare1`], { prepare1: s }];
+    };
+    const [k18, k19] = timing();
+    const [k20, k21] = timing();
+    const [k22, k23] = timing();
+    const [k24, k25] = timing();
+    let t = rand.randint(38000, 46000);
+    let x = rand.randint(1240, 1400);
+    let y = rand.randint(120, 210);
+    const track = [];
+    const n = rand.randint(8, 14);
+    for (let i = 0; i < n; i++) {
+        t += rand.randint(2, 9);
+        x += rand.randint(-9, 3);
+        y += rand.randint(-22, 6);
+        // 真实样本里后面几条的 x/y 是 -1（元素外 / 未捕获）
+        if (i >= 7 && rand.random() < 0.4)
+            track.push(`${i},1,${t},-1,-1,prepare1`);
+        else
+            track.push(`${i},1,${t},${x},${y},prepare1`);
+    }
+    const tail = track.at(-1);
+    const last = tail.slice(0, tail.lastIndexOf(','));
+    return {
+        key18: k18,
+        key19: k19,
+        key20: k20,
+        key21: k21,
+        key22: k22,
+        key23: k23,
+        key24: k24,
+        key25: k25,
+        key26: { key27: track, key28: [], key29: [], key30: [], key31: { prepare1: last }, key32: {}, key33: {}, key34: {} },
+    };
+}
+/** `gpuInfo` 字段的值（JSON 字符串，四个已知键在前）。 */
+export function gpuInfoJson(overrides = {}) {
+    const info = { ...GPU_INFO, ...overrides };
+    const ordered = {};
+    for (const k of ['glRenderer', 'glVendor', 'unmaskRenderer', 'unmaskVendor'])
+        if (k in info)
+            ordered[k] = info[k];
+    for (const [k, v] of Object.entries(info))
+        if (!(k in ordered))
+            ordered[k] = v;
+    return compactJson(ordered);
+}
+/**
+ * `captchaExtraParam` 字段的值（JSON 字符串）：key1 = did，key2 = 当前毫秒，会话字段现算。
+ * overrides 先合并，再刷新 key1 / key2 与会话字段：浏览器快照里的 key2、key18–key26 属于旧的 iframe 实例，
+ * 原样重放正是 350014 的原因。
+ */
+export function captchaExtraParamJson(o = {}) {
+    const data = { ...CAPTCHA_EXTRA_PARAM, ...o.overrides };
+    const stamp = o.nowMs ?? rand.now();
+    if (o.did)
+        data.key1 = o.did;
+    data.key2 = stamp;
+    if (o.freshSession ?? true)
+        Object.assign(data, sessionFields(stamp));
+    return compactJson(data);
+}

package/dist/platforms/kuaishou/web/captcha.js

@@ -0,0 +1,273 @@
+import { SpecificAIError } from '../../../core/errors.js';
+import { compactJson, jsonLoads, parseQsl, pyFloatStr, pyRound, quote } from '../../../core/py.js';
+import * as rand from '../../../core/rand.js';
+import { verifyParam } from './captcha-crypto.js';
+import { captchaExtraParamJson, gpuInfoJson } from './captcha-fp.js';
+import { findGapX } from './gap.js';
+import * as gdfp from './gdfp.js';
+import { ACCEPT_AXIOS, ACCEPT_ENCODING, ACCEPT_LANGUAGE, CAPTCHA_HOST, RECO_REFERER, UA } from './profile.js';
+/**
+ * 快手滑块验证码（captcha.zt.kuaishou.com，上游 utils/captcha.py 与 KuaishouAPI._pass_captcha）。
+ *
+ * 风控接口返回 `{"data":{"result":400002,"url":"…/iframe/index.html?captchaSession=…"}}`（GraphQL 是
+ * `errors` + `data.captcha.url`）时：验证码 iframe 的 webweapon 引导 → config → 下载背景图与滑块图 → 找缺口 →
+ * 造轨迹 → gdfp manMachine 预检 → `$encrypt` → 提交 verifyUrl2（kSecretApiVerify）。通过后调用方重新序列化
+ * 同一条 Cookie 线序，把原请求重发一次。
+ */
+const CONFIG_URL = `${CAPTCHA_HOST}/rest/zt/captcha/sliding/config`;
+const VERIFY_URL = `${CAPTCHA_HOST}/rest/zt/captcha/sliding/kSecretApiVerify`;
+const TIMEOUT = 30;
+/** Python 的真值判断：空数组 / 空对象 / 空串 / 0 / null 为假。 */
+function truthy(v) {
+    if (Array.isArray(v))
+        return v.length > 0;
+    if (v && typeof v === 'object')
+        return Object.keys(v).length > 0;
+    return Boolean(v);
+}
+/** _is_risk：REST `data.result == 400002` 且有 `data.url`，或 GraphQL `errors` + `data.captcha.url`。 */
+export function isRisk(resp) {
+    const data = resp?.data && typeof resp.data === 'object' ? resp.data : {};
+    if (data.result === 400002 && truthy(data.url))
+        return true;
+    return truthy(data.captcha?.url) && truthy(resp?.errors);
+}
+/** _graphql_risk_as_rest：GraphQL 的挑战改成 REST 的形状，交给同一个求解器。 */
+export function graphqlRiskAsRest(resp) {
+    const url = resp?.data?.captcha?.url;
+    return url ? { data: { result: 400002, url } } : (resp ?? {});
+}
+/** extract_captcha_url：验证码 iframe 的完整地址（它的 query 会带进 Referer，不能截短）。 */
+export function extractCaptchaUrl(risk) {
+    const data = truthy(risk?.data) ? risk.data : risk;
+    return String(data?.url || data?.captcha?.url || '');
+}
+/** extract_session：iframe 地址里的 captchaSession。 */
+export function extractSession(risk) {
+    const url = extractCaptchaUrl(risk);
+    if (!url)
+        return '';
+    const q = url.indexOf('?');
+    if (q < 0)
+        return '';
+    const hash = url.indexOf('#', q);
+    const query = url.slice(q + 1, hash < 0 ? undefined : hash);
+    return parseQsl(query).find(([k, v]) => k === 'captchaSession' && v !== '')?.[1] ?? '';
+}
+/**
+ * build_trajectory：先加速后减速、末段带小幅回调与抖动的拖动轨迹（t 是毫秒偏移）。
+ * distanceInt 表示 distance 在上游是 int（缺口 x 减 disX）还是 float（兜底的 1.0）。
+ */
+export function buildTrajectory(distance, distanceInt, startY = 0) {
+    const points = [];
+    let t = 0;
+    let x = 0;
+    let xInt = false;
+    let v = 0;
+    // 前 70%～80% 加速，之后减速
+    const mid = distance * (0.7 + rand.random() * 0.1);
+    while (x < distance) {
+        const a = x < mid ? 2.0 + rand.random() * 2.0 : -(2.5 + rand.random() * 2.0);
+        const dt = 8 + rand.random() * 14;
+        v = Math.max(0.4, v + (a * dt) / 100.0);
+        // min(distance, x + v)：相等时 Python 返回第一个参数
+        if (x + v < distance) {
+            x = x + v;
+            xInt = false;
+        }
+        else {
+            x = distance;
+            xInt = distanceInt;
+        }
+        t += Math.trunc(dt);
+        points.push({ x: xInt ? x : pyRound(x, 2), xInt, y: startY + pyRound(rand.gauss(0, 0.8), 2), t });
+    }
+    // 冲过头一点再拉回来
+    for (const back of [2.2, 1.1, 0.4, 0.0]) {
+        t += Math.trunc(20 + rand.random() * 40);
+        points.push({ x: pyRound(distance - back, 2), xInt: false, y: startY + pyRound(rand.gauss(0, 0.6), 2), t });
+    }
+    return points;
+}
+/** format_trajectory：`x|y|dt` 逗号连接，dt 相对第一个点。 */
+export function formatTrajectory(points) {
+    if (!points.length)
+        return '';
+    const t0 = points[0].t;
+    return points.map((p) => `${p.xInt ? String(p.x) : pyFloatStr(p.x)}|${pyFloatStr(p.y)}|${p.t - t0}`).join(',');
+}
+/** Python 的 `int(v)`：数字截断，字符串按十进制解析。 */
+function pyInt(v) {
+    const n = typeof v === 'number' ? v : Number(String(v).trim());
+    if (!Number.isFinite(n))
+        throw new SpecificAIError('UPSTREAM', `验证码配置里的数值不合法：${String(v)}`, { detail: { kind: 'captcha' } });
+    return Math.trunc(n);
+}
+/** SlidingCaptcha：一次滑块验证会话。 */
+export class SlidingCaptcha {
+    ks;
+    o;
+    config = {};
+    constructor(ks, o) {
+        this.ks = ks;
+        this.o = o;
+    }
+    /** 各请求的 Chrome 请求头：config / verify 是 XHR（带 kww），图片是 `<img>` 子资源（不带）。 */
+    headers(kind) {
+        const h = kind === 'image'
+            ? [
+                ['user-agent', UA],
+                ['accept', 'image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8'],
+                ['accept-encoding', ACCEPT_ENCODING],
+                ['accept-language', ACCEPT_LANGUAGE],
+                ['referer', this.o.referer],
+                ['sec-fetch-dest', 'image'],
+                ['sec-fetch-mode', 'no-cors'],
+                ['sec-fetch-site', 'same-origin'],
+            ]
+            : [
+                ['user-agent', UA],
+                ['accept', ACCEPT_AXIOS],
+                ['accept-encoding', ACCEPT_ENCODING],
+                ['accept-language', ACCEPT_LANGUAGE],
+                ['origin', CAPTCHA_HOST],
+                ['referer', this.o.referer],
+                ['sec-fetch-dest', 'empty'],
+                ['sec-fetch-mode', 'cors'],
+                ['sec-fetch-site', 'same-origin'],
+            ];
+        if (kind === 'config')
+            h.push(['content-type', 'application/x-www-form-urlencoded']);
+        else if (kind === 'verify')
+            h.push(['content-type', 'application/json']);
+        if (kind !== 'image' && this.o.kww)
+            h.push(['kww', this.o.kww]);
+        return h;
+    }
+    /** 第 1 步：拿 captchaSn 与图片尺寸。 */
+    async loadConfig() {
+        if (!this.o.kww || !this.o.cookieHeader)
+            throw new SpecificAIError('UPSTREAM', '验证码 config 请求缺少页面 kww 或 Cookie', { detail: { kind: 'captcha' } });
+        const res = await this.ks.send({ method: 'POST', url: CONFIG_URL, headers: this.headers('config'), cookie: this.o.cookieHeader, body: `captchaSession=${quote(this.o.session, '')}`, timeout: TIMEOUT });
+        this.config = await this.ks.json(res);
+        if (this.config?.result !== 1)
+            this.ks.log.debug('验证码 config 失败', this.config);
+        return this.config;
+    }
+    /** 第 2 步：下背景图与滑块图。 */
+    async loadImages() {
+        const sn = String(this.config.captchaSn);
+        const get = async (url) => {
+            const res = await this.ks.send({ method: 'GET', url, query: [['captchaSn', sn]], headers: this.headers('image'), cookie: this.o.cookieHeader, timeout: TIMEOUT });
+            return new Uint8Array(await res.arrayBuffer());
+        };
+        const bg = await get(String(this.config.bgPicUrl));
+        const cut = await get(String(this.config.cutPicUrl));
+        return [bg, cut];
+    }
+    /** 走完整条：config → 下图 → 找缺口 → 造轨迹 → gdfp 预检 → 加密提交。返回 verify 的响应。 */
+    async solve() {
+        if (!Object.keys(this.config).length)
+            await this.loadConfig();
+        if (this.config?.result !== 1)
+            return this.config;
+        const [bg, cut] = await this.loadImages();
+        const gapX = await findGapX(bg, cut);
+        const disX = pyInt(this.config.disX ?? 0);
+        // max(1.0, gap_x - dis_x)：差值大于 1 时是 int，否则是 float 的 1.0
+        const diff = gapX - disX;
+        const distanceInt = diff > 1;
+        const distance = distanceInt ? diff : 1;
+        this.ks.log.debug(`验证码缺口 x=${gapX}，起点 disX=${disX}，移动 ${distance.toFixed(1)}px`);
+        const points = buildTrajectory(distance, distanceInt, pyInt(this.config.disY ?? 0));
+        // 提交前先做 gdfp manMachine 预检，不做服务端回 350014 anti check err
+        await this.precheck();
+        const payload = [
+            ['captchaSn', this.config.captchaSn],
+            ['bgDisWidth', pyInt(this.config.bgPicWidth)],
+            ['bgDisHeight', pyInt(this.config.bgPicHeight)],
+            ['cutDisWidth', pyInt(this.config.cutPicWidth)],
+            ['cutDisHeight', pyInt(this.config.cutPicHeight)],
+            ['relativeX', Math.round(disX + distance)],
+            ['relativeY', pyInt(this.config.disY ?? 0)],
+            ['trajectory', formatTrajectory(points)],
+            ['gpuInfo', gpuInfoJson()],
+            ['captchaExtraParam', captchaExtraParamJson({ did: this.o.did })],
+        ];
+        return this.submit(payload);
+    }
+    /** gdfp manMachine 预检：SDK_INIT → core → whole，任何一步不通过都不提交 verify。 */
+    async precheck() {
+        const r = await gdfp.report(this.ks, {
+            did: this.o.did,
+            cookies: this.o.cookies,
+            parentUrl: this.o.parentUrl,
+            iframeUrl: this.o.referer,
+            ua: UA,
+            scriptUrls: this.o.scriptUrls,
+        });
+        const reportUrls = r.config?.reportConfig?.reportUrls ?? [];
+        if (r.init?.result !== 1 || r.config?.switch !== 1 || r.config?.status !== 1 || !reportUrls.length || r.core?.result !== 1 || r.whole?.result !== 1) {
+            throw new SpecificAIError('UPSTREAM', '验证码 gdfp 预检没有完整通过，不提交 verify', { detail: { kind: 'captcha' } });
+        }
+    }
+    /** 把载荷加密成 verifyParam 提交到 verifyUrl2（明文 verifyUrl 服务端回 350013）。 */
+    async submit(payload) {
+        if (!this.o.kww || !this.o.cookieHeader)
+            throw new SpecificAIError('UPSTREAM', '验证码 verify 缺少页面 kww 或 Cookie', { detail: { kind: 'captcha' } });
+        const res = await this.ks.send({
+            method: 'POST',
+            url: String(this.config.verifyUrl2 || VERIFY_URL),
+            headers: this.headers('verify'),
+            cookie: this.o.cookieHeader,
+            body: compactJson({ verifyParam: verifyParam(payload) }),
+            timeout: TIMEOUT,
+        });
+        const text = await res.text();
+        try {
+            return jsonLoads(text);
+        }
+        catch {
+            return { _status: res.status, _text: text.slice(0, 200) };
+        }
+    }
+}
+/**
+ * _pass_captcha：撞上滑块时过一次验证码。通过返回 true；没过或出错返回 false，调用方按原样返回风控响应
+ * （最后报 RISK_CONTROL）。referer 是触发风控的业务页。
+ */
+export async function passCaptcha(ks, risk, referer) {
+    const session = extractSession(risk);
+    if (!session)
+        return false;
+    ks.log.info('快手要求滑块验证，正在自动验证…');
+    let result;
+    try {
+        const iframeUrl = extractCaptchaUrl(risk);
+        const context = await ks.s.prepareCaptchaContext(iframeUrl);
+        const solver = new SlidingCaptcha(ks, {
+            session,
+            cookies: context.cookies,
+            did: ks.s.did,
+            referer: iframeUrl,
+            kww: context.kww,
+            cookieHeader: context.cookieHeader,
+            parentUrl: referer || RECO_REFERER,
+            scriptUrls: context.scriptUrls,
+        });
+        result = await solver.solve();
+    }
+    catch (err) {
+        ks.log.warn(`自动过滑块出错：${err.message}`);
+        ks.lastCaptcha = { error: err.message };
+        return false;
+    }
+    const ok = result?.result === 1;
+    if (ok)
+        ks.log.info('滑块验证通过，重发原请求');
+    else
+        ks.log.warn(`滑块验证没有通过：${JSON.stringify(result).slice(0, 120)}`);
+    // 没过时把服务端的回复（result、error_msg）带进最后的 RISK_CONTROL，方便判断是缺口不对（350002）还是人机检查不认（350014）
+    ks.lastCaptcha = ok ? null : { result: result?.result ?? null, error_msg: result?.error_msg ?? result?.message ?? null };
+    return ok;
+}