specific-ai-cli 0.0.0-stage → 0.1.1

package/dist/platforms/kuaishou/web/gap.js

@@ -0,0 +1,144 @@
+import { decodeImage, loadCv } from '../../../core/image.js';
+/**
+ * 滑块缺口定位（上游 utils/captcha.py 的 find_gap_x，cv2 + numpy + Pillow）。
+ * 图片解码与 OpenCV 用 core/image.ts（PNG 与 Pillow 逐像素一致，半透明像素不经过预乘）。
+ * numpy 的部分照原样用 float32 重写。
+ */
+/** 解码验证码图片（RGBA，与 Pillow 的 `convert("RGBA")` 相同）。 */
+async function decode(buf) {
+    const img = await decodeImage(buf);
+    if (!img)
+        throw new Error('无法解码验证码图片');
+    return img;
+}
+/** RGBA 的一个矩形区域 → BGR 交错像素（`cv2.cvtColor(rgb, COLOR_RGB2BGR)`）。 */
+function bgr(img, x0 = 0, y0 = 0, w = img.width, h = img.height) {
+    const out = new Uint8Array(w * h * 3);
+    for (let y = 0; y < h; y++) {
+        for (let x = 0; x < w; x++) {
+            const s = ((y0 + y) * img.width + x0 + x) * 4;
+            const d = (y * w + x) * 3;
+            out[d] = img.rgba[s + 2];
+            out[d + 1] = img.rgba[s + 1];
+            out[d + 2] = img.rgba[s];
+        }
+    }
+    return out;
+}
+/**
+ * 在背景图里找缺口的横坐标（原图像素，滑块左边缘该落到的 x，保证落在 `[0, W - w]`）。
+ * 用滑块 alpha 裁出实际形状，在背景的边缘图上做带掩码的模板匹配；搜索范围裁掉右边界，
+ * 屏蔽滑块自身所在的 `[0, w)`；得分不超过 0.25 时退回到“逐列亮度突变”。
+ */
+export async function findGapX(bgPng, cutPng) {
+    const cv = await loadCv();
+    const bgImg = await decode(bgPng);
+    const cut = await decode(cutPng);
+    let x0 = Infinity;
+    let x1 = -1;
+    let y0 = Infinity;
+    let y1 = -1;
+    for (let y = 0; y < cut.height; y++) {
+        for (let x = 0; x < cut.width; x++) {
+            if (cut.rgba[(y * cut.width + x) * 4 + 3] > 32) {
+                if (x < x0)
+                    x0 = x;
+                if (x > x1)
+                    x1 = x;
+                if (y < y0)
+                    y0 = y;
+                if (y > y1)
+                    y1 = y;
+            }
+        }
+    }
+    if (x1 < 0)
+        throw new Error('滑块图 alpha 全空，无法定位');
+    const pieceW = x1 - x0 + 1;
+    const pieceH = y1 - y0 + 1;
+    const maskData = new Uint8Array(pieceW * pieceH);
+    for (let y = 0; y < pieceH; y++)
+        for (let x = 0; x < pieceW; x++)
+            maskData[y * pieceW + x] = cut.rgba[((y0 + y) * cut.width + x0 + x) * 4 + 3] > 32 ? 255 : 0;
+    const bgW = bgImg.width;
+    const bgH = bgImg.height;
+    const maxX = Math.max(0, bgW - pieceW);
+    const mats = [];
+    const keep = (m) => (mats.push(m), m);
+    try {
+        const bg = keep(cv.matFromArray(bgH, bgW, cv.CV_8UC3, bgr(bgImg)));
+        const piece = keep(cv.matFromArray(pieceH, pieceW, cv.CV_8UC3, bgr(cut, x0, y0, pieceW, pieceH)));
+        const mask = keep(cv.matFromArray(pieceH, pieceW, cv.CV_8UC1, maskData));
+        // 缺口和滑块的边缘形状一致，用边缘图匹配比灰度稳
+        const edge = (src) => {
+            const blur = keep(new cv.Mat());
+            cv.GaussianBlur(src, blur, new cv.Size(3, 3), 0, 0, cv.BORDER_DEFAULT);
+            const out = keep(new cv.Mat());
+            cv.Canny(blur, out, 60, 180, 3, false);
+            return out;
+        };
+        const bgEdge = edge(bg);
+        const pieceEdge = edge(piece);
+        const kernel = keep(cv.Mat.ones(3, 3, cv.CV_8U));
+        const eroded = keep(new cv.Mat());
+        cv.erode(mask, eroded, kernel, new cv.Point(-1, -1), 1, cv.BORDER_CONSTANT, cv.morphologyDefaultBorderValue());
+        const res = keep(new cv.Mat());
+        cv.matchTemplate(bgEdge, pieceEdge, res, cv.TM_CCOEFF_NORMED, eroded);
+        // np.nan_to_num(-1) 后按列取纵向最大（float32）
+        const cols = res.cols;
+        const rows = res.rows;
+        const scores = res.data32F;
+        const byX = new Float32Array(cols);
+        for (let c = 0; c < cols; c++) {
+            let m = -Infinity;
+            for (let r = 0; r < rows; r++) {
+                const v = scores[r * cols + c];
+                const s = Number.isFinite(v) ? v : -1;
+                if (s > m)
+                    m = s;
+            }
+            byX[c] = m;
+        }
+        const valid = new Float32Array(cols).fill(-1);
+        const upper = Math.min(maxX, cols - 1);
+        for (let c = 0; c <= upper; c++)
+            valid[c] = byX[c];
+        for (let c = 0; c < Math.min(pieceW, cols); c++)
+            valid[c] = -1;
+        const bestX = argmax(valid);
+        const clamp = (x) => Math.min(Math.max(x, 0), maxX);
+        if (valid[bestX] > 0.25)
+            return clamp(bestX);
+        // 退路：缺口通常比周围暗，逐列找亮度突变（同样只在合法区间里找）
+        const gray = keep(new cv.Mat());
+        cv.cvtColor(bg, gray, cv.COLOR_BGR2GRAY);
+        const g = gray.data;
+        const col = new Float32Array(bgW);
+        for (let x = 0; x < bgW; x++) {
+            let sum = 0;
+            for (let y = 0; y < bgH; y++)
+                sum = Math.fround(sum + g[y * bgW + x]);
+            col[x] = Math.fround(sum / bgH);
+        }
+        const diff = new Float32Array(Math.max(0, bgW - 1));
+        for (let x = 0; x < diff.length; x++)
+            diff[x] = Math.abs(Math.fround(col[x + 1] - col[x]));
+        const lo = pieceW;
+        const hi = Math.min(maxX, diff.length - 1);
+        if (hi <= lo)
+            return clamp(bestX);
+        return clamp(argmax(diff.subarray(lo, hi + 1)) + lo);
+    }
+    finally {
+        for (const m of mats)
+            m.delete();
+    }
+}
+/** np.argmax：第一个最大值的下标（这里没有 NaN）。 */
+function argmax(a) {
+    let best = 0;
+    for (let i = 1; i < a.length; i++)
+        if (a[i] > a[best])
+            best = i;
+    return best;
+}

package/dist/platforms/kuaishou/web/gdfp.js

@@ -0,0 +1,376 @@
+import { createHash } from 'node:crypto';
+import { SpecificAIError } from '../../../core/errors.js';
+import { md5Hex } from '../../../core/hash.js';
+import { compactJson, jsonLoads } from '../../../core/py.js';
+import * as rand from '../../../core/rand.js';
+import { ACCEPT_ENCODING, ACCEPT_LANGUAGE, CAPTCHA_HOST, PROFILE, RESOLUTION } from './profile.js';
+/**
+ * gdfp manMachine 预检（上游 utils/gdfp_manmachine.py）：滑块提交 verify 之前必须先上报的行为遥测。
+ * SDK_INIT（换策略，上报路径由它下发）→ core `/n/a/b` → 等策略里的 wait 毫秒 → whole `/n/a/b`。
+ * 不做这一步直接提交，服务端回 350014 anti check err。
+ *
+ * 分辨率、平台、CPU、WebGL 与屏幕尺寸取自统一的浏览器档案 {@link PROFILE}，与请求头和 captchaExtraParam 一致。
+ *
+ * 响应按上游严格校验：状态码、content-type、响应体逐字节。协议版本不查：上游抓包时是 HTTP/2，现在默认也接受
+ * HTTP/1.1（有的网络上这个接口只协商出 HTTP/1.1，只认 HTTP/2 会让验证码永远走不到 verify；设
+ * KS_STRICT_GDFP_HTTP2=1 才恢复只认 HTTP/2），而 specific-ai 的 HttpResponse 本来就拿不到协商的协议版本。
+ */
+export const APP_KEY = '10001001';
+export const SECRET_KEY = 'f2fff381c551a8dcdb765e316f3d44ac';
+const CORE_DATA_LOGGER_ID = '10001002';
+const RM_VERSION = '1.6.0';
+const HOST = 'https://gdfp.gifshow.com';
+const URL_STRATEGY = '/s/u/v';
+export const URL_CORE_REPORT = '/n/a/b';
+const BUSS_TYPE_MAN_MACHINE = 'manMachine';
+const FLAG = 2;
+const RESPONSE_CONTENT_TYPE = 'application/json;charset=UTF-8';
+export const MAN_MACHINE_INIT_RESPONSE = '{"result":1,"error_msg":"","antispamPluginRsp":' +
+    '"eyJzd2l0Y2giOjEsIm1heEJhdGNoTGVuZ3RoIjo1MCwid2FpdCI6MTAwMCwiZW5hYmxlTmF0aXZlIjoxLCJqc3ZlciI6IjEuMC4xIiwicmVwb3J0Q29uZmlnIjp7InJlcG9ydFVybHMiOlsiL24vYS9iIl19LCJwb2xpY3lJZCI6MjU0LCJwdmVyIjoiMS4wLjIiLCJzdGF0dXMiOjF9"}';
+export const REPORT_RESPONSE = '{"result":1,"error_msg":""}';
+const MAN_MACHINE_INIT_CONFIG = {
+    switch: 1,
+    maxBatchLength: 50,
+    wait: 1000,
+    enableNative: 1,
+    jsver: '1.0.1',
+    reportConfig: { reportUrls: ['/n/a/b'] },
+    policyId: 254,
+    pver: '1.0.2',
+    status: 1,
+};
+const SCRIPT_BASE = 'https://p23-plat.wskwai.com/kos/nlav111449/technology-platform/static/captcha/js';
+export const CAPTCHA_SCRIPT_URLS = [
+    `${SCRIPT_BASE}/weblogger.2e328f42.js`,
+    `${SCRIPT_BASE}/chunk-vendors.39300a01.js`,
+    `${SCRIPT_BASE}/encrypt.ee7d2a41.js`,
+    `${SCRIPT_BASE}/iframe/index.c9ae8c81.js`,
+];
+const PDF = 'Portable Document Format';
+const PLUGIN_LIST = compactJson(['PDF Viewer', 'Chrome PDF Viewer', 'Chromium PDF Viewer', 'Microsoft Edge PDF Viewer', 'WebKit built-in PDF'].map((name) => ({
+    name,
+    filename: 'internal-pdf-viewer',
+    description: PDF,
+})));
+const MIME_LIST = compactJson([
+    { type: 'application/pdf', description: PDF },
+    { type: 'text/pdf', description: PDF },
+]);
+const PERMISSION_STATES = [
+    ['speaker', 'error'],
+    ['device-info', 'error'],
+    ['bluetooth', 'error'],
+    ['ambient-light-sensor', 'error'],
+    ['clipboard', 'error'],
+    ['nfc', 'error'],
+    ['geolocation', 'denied'],
+    ['notifications', 'denied'],
+    ['push', 'denied'],
+    ['midi', 'denied'],
+    ['camera', 'denied'],
+    ['microphone', 'denied'],
+    ['background-fetch', 'prompt'],
+    ['background-sync', 'granted'],
+    ['persistent-storage', 'prompt'],
+    ['accelerometer', 'granted'],
+    ['gyroscope', 'granted'],
+    ['magnetometer', 'granted'],
+    ['display-capture', 'denied'],
+].map(([permissionName, state]) => ({ permissionName, state }));
+const CORE_NATIVE_FINGERPRINT = { cf: 585, ch: '3b4de2be29905d2bcc3812d4fa039bc3', ff: 166, fh: '7daf378bafe0d3babac2696177d5de0d', el: 33, eh: 'dc4d3e06840e103f3e77747a82029aa9' };
+const WHOLE_NATIVE_FINGERPRINT = {
+    pc: 134,
+    ph: '594d639a69bb0bdf419c1c14ccbb560a',
+    wf: 1159,
+    wh: '6a9ba63fd2cbda1ce03b5204db881cac',
+    cf: 585,
+    ch: '3b4de2be29905d2bcc3812d4fa039bc3',
+    mf: 1052,
+    mh: '3bbcec74126d8f15aa514a6c7b4179f8',
+    ff: 166,
+    fh: '7daf378bafe0d3babac2696177d5de0d',
+    af: 1031,
+    ah: '744f127aa70ee2cd33f97f47cf641a77',
+    gr: 598,
+    gh: '54a77c38470096d9684100f3909f3109',
+    el: 33,
+    eh: 'dc4d3e06840e103f3e77747a82029aa9',
+    ow: 19748,
+    oh: '4f323cba12d2aba1b62665eb7b260b40',
+    ky: 33,
+    kh: '61792d30f54bedfe1007347e9fdc4223',
+};
+const sha1 = (s) => createHash('sha1').update(s, 'utf8').digest('hex');
+/** `md5Hex(appKey + secretKey + 秒级时间戳)`。 */
+export const signFor = (ts) => md5Hex(`${APP_KEY}${SECRET_KEY}${ts}`);
+/** gdfp 请求地址（appkey / seckey / bussType / timestamp / sign）。 */
+export function buildUrl(path, bussType = BUSS_TYPE_MAN_MACHINE, tsSeconds, extra = '') {
+    const ts = tsSeconds ?? rand.nowSeconds();
+    return `${HOST}${path}?appkey=${APP_KEY}&seckey=${SECRET_KEY}&bussType=${bussType}&timestamp=${ts}&sign=${signFor(ts)}${extra}`;
+}
+function scriptList(scriptUrls = []) {
+    const out = [...CAPTCHA_SCRIPT_URLS];
+    for (const url of scriptUrls)
+        if (url && !out.includes(url))
+            out.push(url);
+    return out;
+}
+function cookieFingerprint(cookies) {
+    const line = cookies.map(([k, v]) => `${k}=${v}`).join('; ');
+    return { ci: [...line].length, ih: md5Hex(line) };
+}
+function callStack(kind) {
+    const base = CAPTCHA_SCRIPT_URLS[0];
+    const frames = kind === 'whole'
+        ? [
+            ['printCallStack', 34236],
+            ['RiskMgt._this.generateModuleSection', 77458],
+            ['RiskMgt.<anonymous>', 84095],
+            ['', 4825],
+            ['Object.next', 4930],
+            ['', 3857],
+            ['newPromise(<anonymous>)', null],
+            ['__awaiter', 3602],
+            ['RiskMgt.sendWholeData', 83975],
+            ['RiskMgt.<anonymous>', 83076],
+        ]
+        : [
+            ['printCallStack', 34236],
+            ['RiskMgt._this.generateCoreModuleSection', 79648],
+            ['RiskMgt.<anonymous>', 83773],
+            ['', 4825],
+            ['Object.next', 4930],
+            ['', 3857],
+            ['newPromise(<anonymous>)', null],
+            ['__awaiter', 3602],
+            ['RiskMgt.sendCoreData', 83346],
+            ['n', 82235],
+        ];
+    return frames.map(([name, offset]) => (offset == null ? `at${name}` : name ? `at${name}(${base}:1:${offset})` : `at${base}:1:${offset}`)).join('');
+}
+function timings(begin, now, whole = false) {
+    const values = { cs: begin + 246, ce: begin + 250, as: begin + 255, ae: begin + 259, cae: begin + 338, ls: now };
+    if (whole)
+        Object.assign(values, { le: begin + 472, cre: begin + 688, gs: begin + 492, ge: begin + 515 });
+    return values;
+}
+const afterMozilla = (ua) => (ua.includes('Mozilla/') ? ua.slice(ua.indexOf('Mozilla/') + 'Mozilla/'.length) : ua);
+/**
+ * `generateCoreModuleSection` 的产物（`/n/a/b` 第一次上报）。
+ * 字段号都是递增的，普通对象里形如整数的键按数值升序输出，与上游的插入顺序一致。
+ */
+export function buildCorePayload(o) {
+    const resolution = o.resolution || RESOLUTION;
+    const section = {
+        1: { page: o.parentUrl, identity: o.identity, page_type: 2 },
+        2: o.iframeUrl,
+        5: o.sessionId,
+        7: Object.fromEntries(o.cookies),
+        8: resolution,
+        11: o.ua,
+        17: o.did,
+        21: { type: 'PAGE_ENTER', timestamp: o.nowMs - 20, initTime: o.beginMs },
+        28: sha1(`${o.did}${o.parentUrl}${resolution}${o.ua}${o.iframeUrl}`),
+        33: 'Mozilla',
+        34: 'Netscape',
+        35: afterMozilla(o.ua),
+        36: PROFILE.platform,
+        55: 0,
+        56: o.ua,
+        69: '0043c0b8a0b002e8133a140d14068859',
+        75: '1',
+        76: '',
+        77: scriptList(o.scriptUrls),
+        79: callStack('core'),
+        82: { ...CORE_NATIVE_FINGERPRINT, ...cookieFingerprint(o.cookies) },
+        89: timings(o.beginMs, o.nowMs),
+        102: 50,
+        108: {},
+    };
+    return { 1: o.did, 3: CORE_DATA_LOGGER_ID, 6: BUSS_TYPE_MAN_MACHINE, 7: 10, 9: o.nowMs, 10: '', 12: APP_KEY, 13: '', 14: RM_VERSION, module_section: [section] };
+}
+const LETTERS_DIGITS = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
+/** _webrtc_fields：每个 iframe 现生成的 mDNS 主机名、端口、ICE 凭据、证书指纹与 SDP。 */
+export function webrtcFields() {
+    const mdns1 = `${rand.uuid4()}.local`;
+    const mdns2 = `${rand.uuid4()}.local`;
+    const port1 = rand.randint(50000, 59998);
+    const port2 = rand.randint(50000, 59998);
+    const ufrag = rand.string(4, LETTERS_DIGITS);
+    const pwd = rand.string(24, LETTERS_DIGITS + '+/');
+    const fingerprint = Array.from({ length: 32 }, () => Math.floor(rand.random() * 256)
+        .toString(16)
+        .toUpperCase()
+        .padStart(2, '0')).join(':');
+    // randint(10**18, 10**19 - 1)：超出 double 的整数范围，用 BigInt 做加法
+    const session = (10n ** 18n + BigInt(Math.floor(rand.random() * 9e18))).toString();
+    const candidates = `;candidate:1801140675 1 udp 2113937151 ${mdns1} ${port1} typ host generation 0 ufrag ${ufrag} network-cost 999` +
+        `;candidate:1070259456 1 udp 2113939711 ${mdns2} ${port2} typ host generation 0 ufrag ${ufrag} network-cost 999`;
+    const candidate1 = `a=candidate:1801140675 1 udp 2113937151 ${mdns1} ${port1} typ host generation 0 network-cost 999\r\n`;
+    const candidate2 = `a=candidate:1070259456 1 udp 2113939711 ${mdns2} ${port2} typ host generation 0 network-cost 999\r\n`;
+    const prefix = `v=0\r\no=- ${session} 2 IN IP4 127.0.0.1\r\ns=-\r\nt=0 0\r\n` +
+        'a=group:BUNDLE 0\r\na=extmap-allow-mixed\r\na=msid-semantic: WMS\r\n' +
+        'm=application 9 UDP/DTLS/SCTP webrtc-datachannel\r\n' +
+        'c=IN IP4 0.0.0.0\r\n';
+    const suffix = `a=ice-ufrag:${ufrag}\r\na=ice-pwd:${pwd}\r\n` +
+        `a=ice-options:trickle\r\na=fingerprint:sha-256 ${fingerprint}\r\n` +
+        'a=setup:actpass\r\na=mid:0\r\na=sctp-port:5000\r\na=max-message-size:262144\r\n';
+    // Chrome 的 promise 先在第一个 host candidate 时 resolve，第二个收集完再来一次：两段 `;v=0`
+    const sdp = `;${prefix}${candidate1}${suffix};${prefix}${candidate1}${candidate2}${suffix}`;
+    return [candidates, sdp];
+}
+/** `sendWholeData` 的完整上报（第二次 `/n/a/b`）。 */
+export function buildWholePayload(o) {
+    const resolution = o.resolution || RESOLUTION;
+    const [candidates, sdp] = webrtcFields();
+    const section = {
+        1: { page: o.parentUrl, identity: o.identity, page_type: 2 },
+        2: o.iframeUrl,
+        4: CAPTCHA_HOST,
+        5: o.sessionId,
+        6: 'captcha',
+        7: Object.fromEntries(o.cookies),
+        8: resolution,
+        9: 360,
+        10: 360,
+        11: o.ua,
+        12: 'NT 10.0',
+        13: 'zh-CN',
+        14: 'Windows',
+        17: o.did,
+        21: { type: 'PAGE_ENTER', timestamp: o.beginMs + 491, initTime: o.beginMs },
+        24: '10',
+        25: '10-1',
+        26: '0',
+        28: sha1(`${o.did}${o.parentUrl}${resolution}${o.ua}${o.iframeUrl}`),
+        29: o.reportPath ?? URL_CORE_REPORT,
+        30: 'production',
+        31: 1,
+        32: '0.00',
+        33: 'Mozilla',
+        34: 'Netscape',
+        35: afterMozilla(o.ua),
+        36: PROFILE.platform,
+        37: '["zh-CN","zh","en","zh-TW","ja"]',
+        41: '20030107',
+        42: 'Google Inc.',
+        43: '',
+        44: PROFILE.cpuCores,
+        50: 10,
+        51: '',
+        52: 1,
+        53: 'Gecko',
+        54: true,
+        55: 0,
+        56: o.ua,
+        57: 'zh-CN',
+        58: PLUGIN_LIST,
+        59: MIME_LIST,
+        61: PROFILE.webglVendor,
+        62: PROFILE.webglRenderer,
+        63: '1',
+        64: 'WebKit',
+        65: 'WebGL 1.0 (OpenGL ES 2.0 Chromium)',
+        66: 'WebGL GLSL ES 1.0 (OpenGL ES GLSL ES 1.0 Chromium)',
+        67: 0,
+        68: 'f3bd24f5b153d57f5817372fd5f22573',
+        69: '0043c0b8a0b002e8133a140d14068859',
+        70: 'ba6689f9a1550fb5eef25d1fc682c8c1',
+        75: '1',
+        76: '',
+        77: scriptList(o.scriptUrls),
+        78: { w: { pc: 1256, kc: 255, lc: 261 }, n: { pc: 0, kc: 0, lc: 82 } },
+        79: callStack('whole'),
+        80: '2200',
+        81: '1032',
+        82: { ...WHOLE_NATIVE_FINGERPRINT, ...cookieFingerprint(o.cookies) },
+        85: candidates,
+        86: sdp,
+        87: { w: PROFILE.screenWidth, h: PROFILE.screenHeight, c: 24, p: 24 },
+        88: md5Hex(sdp),
+        89: timings(o.beginMs, o.nowMs, true),
+        90: '',
+        100: 11,
+        101: { lsc: 10, ssc: 2 },
+        102: 50,
+        103: { en: false, isF: false },
+        104: { ts: o.beginMs + 520, cts: o.beginMs + 520 },
+        105: '0',
+        106: PERMISSION_STATES.map((p) => ({ ...p })),
+        107: -8,
+        108: {},
+    };
+    return { 1: o.did, 3: APP_KEY, 6: BUSS_TYPE_MAN_MACHINE, 7: 10, 9: o.nowMs, 10: '', 12: APP_KEY, 13: '', 14: RM_VERSION, module_section: [section] };
+}
+/** 外层封装：`{"flag":2,"data":"<base64(JSON)>"}`。 */
+export function encodeBody(payload) {
+    return compactJson({ flag: FLAG, data: Buffer.from(compactJson(payload), 'utf8').toString('base64') });
+}
+/** `/s/u/v?type=SDK_INIT` 的 body：`{"data":"<base64>","flag":2}`（发空 body 会被回 PARAM_INVALID）。 */
+export function buildInitBody(did, sdkVer = RM_VERSION, pver = '0.0.0', platform = 3, bussType = BUSS_TYPE_MAN_MACHINE) {
+    const inner = compactJson({ device_id: did, sdkver: sdkVer, pver, hp: bussType, platform });
+    return compactJson({ data: Buffer.from(inner, 'utf8').toString('base64'), flag: FLAG });
+}
+/** 解 SDK_INIT 响应里的 `antispamPluginRsp`（base64 的 JSON）；`/n/a/b` 这个上报路径就是从这里下发的。 */
+export function parseInitResponse(resp) {
+    const blob = String(resp?.antispamPluginRsp ?? '');
+    if (!blob)
+        return {};
+    try {
+        return jsonLoads(Buffer.from(blob, 'base64').toString('utf8'));
+    }
+    catch {
+        return {};
+    }
+}
+async function validate(res, role, expected) {
+    const fail = (why) => new SpecificAIError('UPSTREAM', `gdfp manMachine ${role} ${why}`, { detail: { kind: 'captcha', status: res.status } });
+    if (res.status !== 200)
+        throw fail(`HTTP 状态不是 200：${res.status}`);
+    const type = res.headers.get('content-type') ?? '';
+    if (type !== RESPONSE_CONTENT_TYPE)
+        throw fail(`content-type 偏离：${type}`);
+    const raw = await res.text();
+    if (raw !== expected)
+        throw fail(`响应体偏离：${raw.slice(0, 200)}`);
+    return jsonLoads(raw);
+}
+/** 完整的 manMachine 预检：SDK_INIT → core /n/a/b → whole /n/a/b。 */
+export async function report(ks, o) {
+    const identity = o.identity || rand.uuid4();
+    const sessionId = rand.uuid4();
+    const beginMs = rand.now();
+    const headers = [
+        ['user-agent', o.ua],
+        ['content-type', 'text/plain;charset=UTF-8'],
+        ['referer', o.iframeUrl],
+        ['accept', '*/*'],
+        ['accept-encoding', ACCEPT_ENCODING],
+        ['accept-language', ACCEPT_LANGUAGE],
+        ['origin', CAPTCHA_HOST],
+        ['priority', 'u=1, i'],
+        ['sec-fetch-dest', 'empty'],
+        ['sec-fetch-mode', 'cors'],
+        ['sec-fetch-site', 'cross-site'],
+    ];
+    const post = (url, body) => ks.http.request({ method: 'POST', url, headers, body, cookies: false, timeout: 30 });
+    // 1) SDK_INIT：换策略，上报路径由它下发
+    const init = await validate(await post(buildUrl(URL_STRATEGY, BUSS_TYPE_MAN_MACHINE, undefined, '&type=SDK_INIT'), buildInitBody(o.did)), 'SDK_INIT', MAN_MACHINE_INIT_RESPONSE);
+    if (Object.keys(init).join() !== 'result,error_msg,antispamPluginRsp' || init.result !== 1 || init.error_msg !== '') {
+        throw new SpecificAIError('UPSTREAM', 'gdfp manMachine SDK_INIT 响应偏离', { detail: { kind: 'captcha' } });
+    }
+    const config = parseInitResponse(init);
+    if (compactJson(config) !== compactJson(MAN_MACHINE_INIT_CONFIG)) {
+        throw new SpecificAIError('UPSTREAM', 'gdfp manMachine 策略偏离，拒绝继续', { detail: { kind: 'captcha', config } });
+    }
+    const path = String(config.reportConfig.reportUrls[0]);
+    // 2) 行为遥测
+    const common = { ...o, identity, beginMs, sessionId };
+    const corePayload = buildCorePayload({ ...common, nowMs: rand.now() });
+    const core = await validate(await post(buildUrl(path), encodeBody(corePayload)), 'core report', REPORT_RESPONSE);
+    // 3) SDK 策略里的 wait 隔开 core 与 whole 两次上报
+    await rand.sleep(Number(config.wait));
+    const wholePayload = buildWholePayload({ ...common, nowMs: rand.now(), reportPath: path });
+    const whole = await validate(await post(buildUrl(path), encodeBody(wholePayload)), 'whole report', REPORT_RESPONSE);
+    return { identity, init, config, core, whole };
+}

package/dist/platforms/kuaishou/web/gql.js

@@ -0,0 +1,11 @@
+/**
+ * GraphQL query 文本（上游 ks_apis/kuaishou_api.py 逐字复制：服务端按 query 文本做持久化校验，一个字符都不能改）。
+ */
+export const SHORT_VIDEO_RECO = "fragment photoContent on PhotoEntity {\n  __typename\n  id\n  duration\n  caption\n  originCaption\n  likeCount\n  viewCount\n  commentCount\n  realLikeCount\n  coverUrl\n  photoUrl\n  photoH265Url\n  manifest\n  manifestH265\n  videoResource\n  coverUrls {\n    url\n    __typename\n  }\n  timestamp\n  expTag\n  animatedCoverUrl\n  distance\n  disableSensitivePhoto\n  videoRatio\n  liked\n  stereoType\n  profileUserTopPhoto\n  musicBlocked\n  riskTagContent\n  riskTagUrl\n}\n\nquery visionShortVideoReco($semKeyword: String, $semCrowd: String, $utmSource: String, $utmMedium: String, $page: String, $photoId: String, $utmCampaign: String) {\n  visionShortVideoReco(semKeyword: $semKeyword, semCrowd: $semCrowd, utmSource: $utmSource, utmMedium: $utmMedium, page: $page, photoId: $photoId, utmCampaign: $utmCampaign) {\n    llsid\n    feeds {\n      type\n      author {\n        id\n        name\n        following\n        headerUrl\n        __typename\n      }\n      photo {\n        ...photoContent\n        __typename\n      }\n      tags {\n        type\n        name\n        __typename\n      }\n      authorStatement {\n        content\n        type\n        riskStyleType\n        __typename\n      }\n      canAddComment\n      __typename\n    }\n    __typename\n  }\n}\n";
+export const COMMENT_LIST = "query commentListQuery($photoId: String, $pcursor: String) {\n  visionCommentList(photoId: $photoId, pcursor: $pcursor) {\n    commentCount\n    commentCountV2\n    pcursor\n    rootCommentsV2 {\n      commentId\n      authorId\n      authorName\n      content\n      headurl\n      timestamp\n      hasSubComments\n      likedCount\n      liked\n      status\n      __typename\n    }\n    pcursorV2\n    rootComments {\n      commentId\n      authorId\n      authorName\n      content\n      headurl\n      timestamp\n      likedCount\n      realLikedCount\n      liked\n      status\n      authorLiked\n      subCommentCount\n      subCommentsPcursor\n      subComments {\n        commentId\n        authorId\n        authorName\n        content\n        headurl\n        timestamp\n        likedCount\n        realLikedCount\n        liked\n        status\n        authorLiked\n        replyToUserName\n        replyTo\n        __typename\n      }\n      __typename\n    }\n    __typename\n  }\n}\n";
+export const SUB_COMMENT_LIST = "mutation visionSubCommentList($photoId: String, $rootCommentId: String, $pcursor: String) {\n  visionSubCommentList(photoId: $photoId, rootCommentId: $rootCommentId, pcursor: $pcursor) {\n    pcursor\n    subComments {\n      commentId\n      authorId\n      authorName\n      content\n      headurl\n      timestamp\n      likedCount\n      realLikedCount\n      liked\n      status\n      authorLiked\n      replyToUserName\n      replyTo\n      __typename\n    }\n    pcursorV2\n    subCommentsV2 {\n      commentId\n      authorId\n      authorName\n      content\n      headurl\n      timestamp\n      hasSubComments\n      likedCount\n      liked\n      status\n      replyToUserName\n      replyTo\n      __typename\n    }\n    __typename\n  }\n}\n";
+export const VIDEO_DETAIL = "query visionVideoDetail($photoId: String, $type: String, $page: String, $webPageArea: String) {\n  visionVideoDetail(photoId: $photoId, type: $type, page: $page, webPageArea: $webPageArea) {\n    status\n    type\n    author {\n      id\n      name\n      following\n      headerUrl\n      livingInfo\n      verifiedDetail\n      __typename\n    }\n    photo {\n      id\n      duration\n      caption\n      likeCount\n      realLikeCount\n      coverUrl\n      photoUrl\n      liked\n      timestamp\n      expTag\n      llsid\n      viewCount\n      videoRatio\n      stereoType\n      musicBlocked\n      riskTagContent\n      riskTagUrl\n      manifest {\n        mediaType\n        businessType\n        version\n        adaptationSet {\n          id\n          duration\n          representation {\n            id\n            defaultSelect\n            backupUrl\n            codecs\n            url\n            height\n            width\n            avgBitrate\n            maxBitrate\n            m3u8Slice\n            qualityType\n            qualityLabel\n            frameRate\n            featureP2sp\n            hidden\n            disableAdaptive\n            __typename\n          }\n          __typename\n        }\n        __typename\n      }\n      manifestH265\n      photoH265Url\n      coronaCropManifest\n      coronaCropManifestH265\n      croppedPhotoH265Url\n      croppedPhotoUrl\n      videoResource\n      __typename\n    }\n    authorStatement {\n      content\n      type\n      riskStyleType\n      __typename\n    }\n    tags {\n      type\n      name\n      __typename\n    }\n    commentLimit {\n      canAddComment\n      __typename\n    }\n    llsid\n    danmakuSwitch\n    __typename\n  }\n}\n";
+export const USER_INFO = "query userInfoQuery {\n  userInfo {\n    id\n    name\n    avatar\n    eid\n    userId\n    __typename\n  }\n}\n";
+export const LIKE_DATA = "fragment photoContent on PhotoEntity {\n  __typename\n  id\n  duration\n  caption\n  originCaption\n  likeCount\n  viewCount\n  commentCount\n  realLikeCount\n  coverUrl\n  photoUrl\n  photoH265Url\n  manifest\n  manifestH265\n  videoResource\n  coverUrls {\n    url\n    __typename\n  }\n  timestamp\n  expTag\n  animatedCoverUrl\n  distance\n  disableSensitivePhoto\n  videoRatio\n  liked\n  stereoType\n  profileUserTopPhoto\n  musicBlocked\n  riskTagContent\n  riskTagUrl\n}\n\nfragment recoPhotoFragment on recoPhotoEntity {\n  __typename\n  id\n  duration\n  caption\n  originCaption\n  likeCount\n  viewCount\n  commentCount\n  realLikeCount\n  coverUrl\n  photoUrl\n  photoH265Url\n  manifest\n  manifestH265\n  videoResource\n  coverUrls {\n    url\n    __typename\n  }\n  timestamp\n  expTag\n  animatedCoverUrl\n  distance\n  videoRatio\n  liked\n  stereoType\n  profileUserTopPhoto\n  musicBlocked\n  riskTagContent\n  riskTagUrl\n}\n\nfragment feedContentWithLiveInfo on Feed {\n  type\n  author {\n    id\n    name\n    headerUrl\n    following\n    livingInfo\n    headerUrls {\n      url\n      __typename\n    }\n    verifiedDetail {\n      description\n      iconType\n      newVerified\n      musicCompany\n      type\n      __typename\n    }\n    __typename\n  }\n  photo {\n    ...photoContent\n    ...recoPhotoFragment\n    __typename\n  }\n  canAddComment\n  llsid\n  status\n  authorStatement {\n    content\n    type\n    riskStyleType\n    __typename\n  }\n  currentPcursor\n  tags {\n    type\n    name\n    __typename\n  }\n  __typename\n}\n\nfragment photoResult on PhotoResult {\n  result\n  llsid\n  expTag\n  serverExpTag\n  pcursor\n  feeds {\n    ...feedContentWithLiveInfo\n    __typename\n  }\n  webPageArea\n  __typename\n}\n\nquery likeDataQuery($pcursor: String, $page: String, $token: String, $st: Long) {\n  likeData(pcursor: $pcursor, page: $page, token: $token, st: $st) {\n    ...photoResult\n    __typename\n  }\n}\n";
+export const VISION_PROFILE_REDUCED = "query visionProfileReduced($userId: String) {\n  visionProfileReduced(userId: $userId) {\n    result\n    hostName\n    userProfile {\n      profile {\n        gender\n        user_name\n        user_id\n        headurl\n        user_text\n        user_profile_bg_url\n        __typename\n      }\n      isFollowing\n      isUserIsolated\n      livingInfo\n      __typename\n    }\n    __typename\n  }\n}\n";
+export const CHECK_LOGIN = "query checkLoginQuery {\n  checkLogin\n}\n";

package/dist/platforms/kuaishou/web/live.js

@@ -0,0 +1,125 @@
+import { readFileSync } from 'node:fs';
+import { createDecipheriv } from 'node:crypto';
+import { gunzipSync, inflateRawSync } from 'node:zlib';
+import protobuf from 'protobufjs';
+import * as n from '../../../core/normalize.js';
+import { staticFile } from '../../../core/paths.js';
+/**
+ * 直播弹幕 WebSocket 的 protobuf 编解码（上游 utils/live_proto.py）。schema 是 live-app.js 内嵌的
+ * protobufjs descriptor（static/kuaishou/fixtures/live_ws_proto.json），直接交给 Root.fromJSON。
+ *
+ * 信封 SocketMessage { payloadType=1, compressionType=2, payload=3 }；payload 按 compressionType
+ * 处理：3 → AES-128-CBC 解密，2 → gzip，其余原样；再按 payloadType 对应的消息类型解码。
+ */
+const WS_AES_KEY = Buffer.from('PPbzKKL7NB15leYy');
+const WS_AES_IV = Buffer.from('JRODKJiolJ9xqso0');
+let cached = null;
+function schema() {
+    if (cached)
+        return cached;
+    // 上游抽出的 descriptor 里 CommentImageSegment 有个拼写错误的类型 `unit32`（上游 Python 解码器不校验类型，
+    // protobufjs 会拒绝）；静态文件保持原样，这里在内存里改成 uint32
+    const descriptor = JSON.parse(readFileSync(staticFile('kuaishou', 'fixtures/live_ws_proto.json'), 'utf8').replaceAll('"type": "unit32"', '"type": "uint32"').replaceAll('"type":"unit32"', '"type":"uint32"'));
+    const maps = JSON.parse(readFileSync(staticFile('kuaishou', 'fixtures/live_ws_maps.json'), 'utf8'));
+    const root = protobuf.Root.fromJSON({ nested: descriptor });
+    const types = new Map();
+    const enums = new Map();
+    // 与上游一样按简单名字索引：先深后浅，根上的同名类型覆盖嵌套的
+    const walk = (ns, depth, out) => {
+        for (const obj of ns.nestedArray) {
+            out.push([depth, obj]);
+            if (obj instanceof protobuf.Namespace)
+                walk(obj, depth + 1, out);
+        }
+    };
+    const all = [];
+    walk(root, 0, all);
+    all.sort((a, b) => b[0] - a[0]);
+    for (const [, obj] of all) {
+        if (obj instanceof protobuf.Type)
+            types.set(obj.name, obj);
+        else if (obj instanceof protobuf.Enum)
+            enums.set(obj.name, obj);
+    }
+    cached = { root, types, enums, numberToName: maps.number_to_name, nameToType: maps.name_to_type, upstream: maps.upstream };
+    return cached;
+}
+function type(name) {
+    const t = schema().types.get(name);
+    if (!t)
+        throw new Error(`live proto 没有类型 ${name}`);
+    return t;
+}
+/** 编一帧上行：CS_ENTER_ROOM / CS_HEARTBEAT / CS_USER_EXIT。 */
+export function encodeFrame(kind, payload) {
+    const [number, typeName] = schema().upstream[kind];
+    const body = type(typeName).encode(type(typeName).fromObject(payload)).finish();
+    return type('SocketMessage').encode({ payloadType: number, payload: body }).finish();
+}
+/** 进房帧：连上 WebSocket 后第一件事，token 来自 liveroom/websocketinfo。 */
+export function enterRoomFrame(token, liveStreamId, reconnectCount = 0) {
+    const payload = { token, liveStreamId };
+    if (reconnectCount)
+        payload.reconnectCount = reconnectCount;
+    return encodeFrame('CS_ENTER_ROOM', payload);
+}
+export const heartbeatFrame = (timestampMs) => encodeFrame('CS_HEARTBEAT', { timestamp: timestampMs });
+export const userExitFrame = (timeMs) => encodeFrame('CS_USER_EXIT', { time: timeMs });
+function decompress(payload, compression) {
+    if (compression === 3) {
+        const d = createDecipheriv('aes-128-cbc', WS_AES_KEY, WS_AES_IV);
+        d.setAutoPadding(false);
+        let plain = Buffer.concat([d.update(payload), d.final()]);
+        const pad = plain[plain.length - 1] ?? 0;
+        if (pad >= 1 && pad <= 16 && plain.subarray(plain.length - pad).every((b) => b === pad))
+            plain = plain.subarray(0, plain.length - pad);
+        return plain;
+    }
+    if (compression === 2) {
+        try {
+            return gunzipSync(payload);
+        }
+        catch {
+            return inflateRawSync(payload);
+        }
+    }
+    return Buffer.from(payload);
+}
+/** 解一帧下行。不在 bundle h 表里的类型浏览器会直接丢弃，这里保留原始字节。 */
+export function decodeFrame(frame) {
+    const s = schema();
+    const env = type('SocketMessage').decode(frame);
+    const number = Number(env.payloadType ?? 0);
+    const name = s.numberToName[String(number)] ?? s.enums.get('PayloadType')?.valuesById[number] ?? String(number);
+    let payload = {};
+    if (env.payload?.length) {
+        const raw = decompress(env.payload, Number(env.compressionType ?? 0));
+        const typeName = s.nameToType[name];
+        payload = typeName && s.types.has(typeName) ? type(typeName).toObject(type(typeName).decode(raw), { longs: String, enums: String, defaults: false }) : { _raw: raw.toString('hex') };
+    }
+    return { type: name, payloadType: number, payload };
+}
+function liveUser(u) {
+    if (!u?.principalId)
+        return null;
+    return n.userRef({ id: u.principalId, name: u.userName, url: `https://live.kuaishou.com/profile/${u.principalId}` });
+}
+/** SC_FEED_PUSH → Event：弹幕、点赞、礼物、分享与系统通知。 */
+export function feedEvents(payload, giftName) {
+    const out = [];
+    const at = (v) => n.time(v) ?? undefined;
+    for (const f of payload?.commentFeeds ?? [])
+        out.push(n.event({ type: 'chat', time: at(f.time), user: liveUser(f.user), text: String(f.content ?? '') }, f));
+    for (const f of payload?.likeFeeds ?? [])
+        out.push(n.event({ type: 'like', user: liveUser(f.user) }, f));
+    for (const f of payload?.giftFeeds ?? []) {
+        const id = String(f.giftId ?? '');
+        const count = Number(f.batchSize || f.comboCount || 1);
+        out.push(n.event({ type: 'gift', time: at(f.time), user: liveUser(f.user), gift: { name: giftName(id) ?? id, count } }, f));
+    }
+    for (const f of payload?.shareFeeds ?? [])
+        out.push(n.event({ type: 'other', time: at(f.time), user: liveUser(f.user), text: '分享了直播间' }, f));
+    for (const f of payload?.systemNoticeFeeds ?? [])
+        out.push(n.event({ type: 'other', time: at(f.time), user: liveUser(f.user), text: n.str(f.content) }, f));
+    return out;
+}