feat(collect): 纯离线生成打通 1ms 签到文字点选 —— errorCode=0 收口

做了什么:
- 新增 tcaptcha/tdc_values.py: 37 个语义名的取值生成器（静态画像 / 会话量 /
  每次采集量三层）+ build_plain 四段组装 + generate_collect 纯离线出包
- crypto: 新增 generate_telemetry(mode="python_values")；轨迹生成统一到
  trajectory_points()（首点绝对坐标 + 增量 + 固定收尾 [1,1,12]）
- crypto.split_collect_segments 重写: pad 只有 1 个空格时旧 ` {2,}` 判据会漏段，
  且 UA 串里的普通空格会假阳性 —— 改为「模 24 算术 + 不落在 JSON 字符串内部 + 结构校验」
- tools/tdc_modules: trajectory 指纹原先指向只做 JSON.stringify 的模块，改为
  mouseMoveEvent/touchStartEvent（真轨迹模块），37/37 不变
- client 默认 telemetry_mode 改为 python_values
- 新增 scripts/verify/{align_session,audit_names,verify_values,verify_offline,send_test}.py
  与 tools/{cdp_collect,cdp_dump_scripts,tdc_profile}.py

为什么:
- 账本 #40「谁在发 HTTP 是 12 的剩余自变量」被推翻。同 aid/同客户端/同求解器、
  答案都对，只换 collect 构造方式: 本次会话构建生成 -> 0 (4/4)，
  旧模板回填 -> 12 (2/2)。真因是 collect 必须与本次会话构建同源。

怎么验证:
- .venv/bin/python -m tcaptcha.selftest  全绿（含新增四段切分与纯离线闭环回归）
- scripts/verify/verify_values.py        4 份真机明文 152/152 逐槽全等
- scripts/verify/verify_offline.py       逐槽全等 + 分段几何一致
- scripts/verify/send_test.py --mode python_values  1ms 签到页文字点选 errorCode=0 x4

tools/cdp_collect.js

@@ -0,0 +1,105 @@
+#!/usr/bin/env node
+/**
+ * cdp_collect.js —— 在**正在运行**的真 Chrome 里，对验证码 iframe 求 TDC.getData(true)，
+ * 并把结果**直接落盘**（不经 stdout），避免终端输出的脱敏 / 截断。
+ *
+ * 为什么要落盘: cdp_eval.js 把结果打到 stdout，链路上有脱敏风险；
+ * 而「同会话 build + 同会话 collect」必须逐字节保真才可用于对齐，故这里由 Node 直接写文件。
+ *
+ * 用法:
+ *   node tools/cdp_collect.js --match drag_ele --out /tmp/1ms_bridge/session_collect.json
+ *   node tools/cdp_collect.js --match drag_ele --expr /tmp/my_expr.js --out /tmp/x.json
+ */
+const fs = require('fs');
+const crypto = require('crypto');
+
+function arg(name, def) {
+    const i = process.argv.indexOf('--' + name);
+    if (i < 0) return def;
+    const v = process.argv[i + 1];
+    return (v === undefined || v.startsWith('--')) ? true : v;
+}
+const sleep = ms => new Promise(r => setTimeout(r, ms));
+
+class Cdp {
+    constructor(ws) { this.ws = ws; this.id = 0; this.waits = new Map(); this.handlers = []; }
+    static async connect(url) {
+        const ws = new WebSocket(url);
+        await new Promise((res, rej) => { ws.onopen = res; ws.onerror = rej; });
+        const c = new Cdp(ws);
+        ws.onmessage = ev => {
+            const m = JSON.parse(ev.data);
+            if (m.id && c.waits.has(m.id)) {
+                const { res, rej } = c.waits.get(m.id);
+                c.waits.delete(m.id);
+                m.error ? rej(new Error(JSON.stringify(m.error))) : res(m.result);
+            } else if (m.method) { for (const h of c.handlers) h(m); }
+        };
+        return c;
+    }
+    send(method, params = {}) {
+        const id = ++this.id;
+        this.ws.send(JSON.stringify({ id, method, params }));
+        return new Promise((res, rej) => this.waits.set(id, { res, rej }));
+    }
+    on(fn) { this.handlers.push(fn); }
+    close() { try { this.ws.close(); } catch (e) {} }
+}
+
+const DEFAULT_EXPR = `(async () => {
+  const o = { href: location.href, tdcType: typeof window.TDC };
+  try { o.tdcKeys = Object.keys(window.TDC || {}); } catch (e) { o.tdcKeysErr = String(e); }
+  try { o.collect = window.TDC.getData(true); } catch (e) { o.collectErr = String(e); }
+  try { o.info = window.TDC.getInfo(); } catch (e) { o.infoErr = String(e); }
+  return o;
+})()`;
+
+(async () => {
+    const port = parseInt(arg('port', '9222'), 10);
+    const match = arg('match', 'drag_ele');
+    const wait = parseInt(arg('wait', '800'), 10);
+    const exprFile = arg('expr', null);
+    const out = arg('out', '/tmp/1ms_bridge/session_collect.json');
+
+    const expr = (exprFile && exprFile !== true) ? fs.readFileSync(exprFile, 'utf8') : DEFAULT_EXPR;
+
+    const targets = (await (await fetch(`http://127.0.0.1:${port}/json/list`)).json())
+        .filter(t => t.type === 'page' || t.type === 'iframe');
+    const target = targets.find(t => (t.url || '').includes(match));
+    if (!target) throw new Error('没有匹配的 target: ' + match);
+    console.error(`[target] ${target.type} ${target.url.slice(0, 100)}`);
+
+    const cdp = await Cdp.connect(target.webSocketDebuggerUrl);
+    await cdp.send('Runtime.enable');
+    await sleep(wait);
+
+    const res = await cdp.send('Runtime.evaluate', {
+        expression: expr, awaitPromise: true, returnByValue: true, timeout: 30000,
+    });
+    const val = res.result ? res.result.value : null;
+    const exc = res.exceptionDetails
+        ? ((res.exceptionDetails.exception || {}).description || JSON.stringify(res.exceptionDetails))
+        : null;
+
+    const payload = {
+        fetchedAt: new Date().toISOString(),
+        target: { type: target.type, url: target.url, title: target.title },
+        ok: !res.exceptionDetails,
+        exception: exc,
+        data: val,
+    };
+    fs.mkdirSync(require('path').dirname(out), { recursive: true });
+    fs.writeFileSync(out, JSON.stringify(payload, null, 1), 'utf8');
+
+    const d = val || {};
+    const col = typeof d.collect === 'string' ? d.collect : null;
+    console.error(`[result] ok=${payload.ok} tdcType=${d.tdcType} tdcKeys=${JSON.stringify(d.tdcKeys || null)}`);
+    if (col) {
+        const sha = crypto.createHash('sha256').update(col).digest('hex').slice(0, 16);
+        console.error(`[collect] ${col.length} 字符 sha256=${sha} 头=${col.slice(0, 24)}... 尾=${col.slice(-24)}`);
+    } else {
+        console.error(`[collect] 无 (collectErr=${d.collectErr || '-'})`);
+    }
+    console.error(`-> ${out}`);
+    cdp.close();
+})().catch(e => { console.error('ERR', e.message); process.exit(1); });

tools/cdp_dump_scripts.js

@@ -0,0 +1,103 @@
+#!/usr/bin/env node
+/**
+ * cdp_dump_scripts.js —— 把某个 target 里**所有已解析脚本**逐个导出并标注特征。
+ *
+ * 为什么需要（2026-10-12 踩坑）:
+ *   cdp_script_source.js 取的是 `hits[hits.length-1]`（最后一个匹配），
+ *   在验证码 iframe（同 target 里有 dy-jy.js / dy-ele.js / tdc.js 多个脚本）里
+ *   **可能取错**。有一次取到的 205KB 文件既没有 __TENCENT_CHAOS_VM 也没有 delta，
+ *   根本不是 tdc.js。
+ *
+ * 本工具: 一律全量导出 + 对每个脚本标注是否含 VM 锚点 / delta / 长度，绝不猜。
+ *
+ * 用法:
+ *   node tools/cdp_dump_scripts.js --match drag_ele --outdir /tmp/1ms_bridge/scripts
+ */
+const fs = require('fs');
+const path = require('path');
+
+function arg(name, def) {
+    const i = process.argv.indexOf('--' + name);
+    if (i < 0) return def;
+    const v = process.argv[i + 1];
+    return (v === undefined || v.startsWith('--')) ? true : v;
+}
+const sleep = ms => new Promise(r => setTimeout(r, ms));
+
+class Cdp {
+    constructor(ws) { this.ws = ws; this.id = 0; this.waits = new Map(); this.handlers = []; }
+    static async connect(url) {
+        const ws = new WebSocket(url);
+        await new Promise((res, rej) => { ws.onopen = res; ws.onerror = rej; });
+        const c = new Cdp(ws);
+        ws.onmessage = ev => {
+            const m = JSON.parse(ev.data);
+            if (m.id && c.waits.has(m.id)) {
+                const { res, rej } = c.waits.get(m.id);
+                c.waits.delete(m.id);
+                m.error ? rej(new Error(JSON.stringify(m.error))) : res(m.result);
+            } else if (m.method) { for (const h of c.handlers) h(m); }
+        };
+        return c;
+    }
+    send(method, params = {}) {
+        const id = ++this.id;
+        this.ws.send(JSON.stringify({ id, method, params }));
+        return new Promise((res, rej) => this.waits.set(id, { res, rej }));
+    }
+    on(fn) { this.handlers.push(fn); }
+    close() { try { this.ws.close(); } catch (e) {} }
+}
+
+(async () => {
+    const port = parseInt(arg('port', '9222'), 10);
+    const match = arg('match', null);
+    const outdir = arg('outdir', '/tmp/cdp_scripts');
+    const wait = parseInt(arg('wait', '2000'), 10);
+
+    const targets = (await (await fetch(`http://127.0.0.1:${port}/json/list`)).json())
+        .filter(t => t.type === 'page' || t.type === 'iframe');
+    const target = match ? targets.find(t => (t.url || '').includes(match)) : targets[0];
+    if (!target) throw new Error('没有匹配的 target: ' + match);
+    console.error(`[target] ${target.type} ${target.url.slice(0, 90)}`);
+
+    const cdp = await Cdp.connect(target.webSocketDebuggerUrl);
+    const scripts = [];
+    cdp.on(m => { if (m.method === 'Debugger.scriptParsed') scripts.push(m.params); });
+    await cdp.send('Debugger.enable');
+    await sleep(wait);
+    await cdp.send('Runtime.enable');
+    await cdp.send('Runtime.evaluate', { expression: '1' });
+    await sleep(500);
+
+    fs.mkdirSync(outdir, { recursive: true });
+    const index = [];
+    const seen = new Set();
+    for (const s of scripts) {
+        if (seen.has(s.scriptId)) continue;
+        seen.add(s.scriptId);
+        let src = '';
+        try {
+            const r = await cdp.send('Debugger.getScriptSource', { scriptId: s.scriptId });
+            src = r.scriptSource || '';
+        } catch (e) { continue; }
+        if (!src) continue;
+        const hasVM = src.includes('__TENCENT_CHAOS_VM');
+        const hasDelta = src.includes('2654435769');
+        const hasTDCNAME = src.includes('TDC_NAME');
+        const base = (s.url || 'inline').split('?')[0].split('/').pop() || 'inline';
+        const fn = `${String(s.scriptId).replace(/[^\w.-]/g, '_')}_${base}`.slice(0, 80);
+        fs.writeFileSync(path.join(outdir, fn), src, 'utf8');
+        index.push({
+            scriptId: s.scriptId, url: String(s.url || '(inline)').slice(0, 130),
+            bytes: src.length, hasVM, hasDelta, hasTDCNAME, file: fn,
+        });
+    }
+    fs.writeFileSync(path.join(outdir, 'index.json'), JSON.stringify(index, null, 1), 'utf8');
+    for (const r of index) {
+        console.log(`${r.hasVM ? 'VM ' : '   '}${r.hasDelta ? 'DELTA' : '     '}`
+            + ` ${String(r.bytes).padStart(7)}B  ${r.url}`);
+    }
+    console.error(`\n-> ${outdir}  (共 ${index.length} 个脚本, 含 VM 的 ${index.filter(x => x.hasVM).length} 个)`);
+    cdp.close();
+})().catch(e => { console.error('ERR', e.message); process.exit(1); });

tools/cdp_module_probe.js

@@ -0,0 +1,178 @@
+#!/usr/bin/env node
+/**
+ * cdp_module_probe.js —— 在真 Chrome 里**抓到每个采集器的真实取值**（不需要手工配平）。
+ *
+ * 背景（2026-10-12）:
+ *   腾讯验证码 iframe (captcha.gtimg.com) 与页面 (1ms.run) **不同站**，Chrome 站点隔离下
+ *   它是独立 target —— 直接在页面里包 Function.prototype.apply **进不去**（实测：
+ *   钩子装上时模块系统已经初始化完，__mods 恒为空）。
+ *
+ * 解法（CDP 标准做法）:
+ *   Target.setAutoAttach(autoAttach, waitForDebuggerOnStart, flatten)
+ *   -> 新的 iframe target 一创建就**暂停在任何脚本执行之前**；
+ *   -> 此时 Page.addScriptToEvaluateOnNewDocument 注册钩子，再 runIfWaitingForDebugger 放行；
+ *   -> tdc.js 执行时钩子已就位，模块工厂的 require/get 全被记账。
+ *
+ * 产出: {url, mods: [[module_id, get()返回值], ...], reqs: [module_id,...]}
+ *   配合同一会话的 tdc.js 静态分析（tdc_modules.analyze）即可得到「语义名 -> 真实取值」，
+ *   无需任何人工对齐。
+ *
+ * 用法:
+ *   node tools/cdp_module_probe.js --aid 195672344 --out /tmp/1ms_bridge/modvals.json
+ */
+const fs = require('fs');
+
+function arg(name, def) {
+    const i = process.argv.indexOf('--' + name);
+    if (i < 0) return def;
+    const v = process.argv[i + 1];
+    return (v === undefined || v.startsWith('--')) ? true : v;
+}
+const sleep = ms => new Promise(r => setTimeout(r, ms));
+
+class Cdp {
+    constructor(ws) { this.ws = ws; this.id = 0; this.waits = new Map(); this.handlers = []; }
+    static async connect(url) {
+        const ws = new WebSocket(url);
+        await new Promise((res, rej) => { ws.onopen = res; ws.onerror = rej; });
+        const c = new Cdp(ws);
+        ws.onmessage = ev => {
+            const m = JSON.parse(ev.data);
+            if (m.id && c.waits.has(m.id)) {
+                const { res, rej } = c.waits.get(m.id);
+                c.waits.delete(m.id);
+                m.error ? rej(new Error(JSON.stringify(m.error))) : res(m.result);
+            } else if (m.method) { for (const h of c.handlers) h(m); }
+        };
+        return c;
+    }
+    send(method, params = {}, sessionId) {
+        const id = ++this.id;
+        const msg = { id, method, params };
+        if (sessionId) msg.sessionId = sessionId;
+        this.ws.send(JSON.stringify(msg));
+        return new Promise((res, rej) => this.waits.set(id, { res, rej }));
+    }
+    on(fn) { this.handlers.push(fn); }
+    close() { try { this.ws.close(); } catch (e) {} }
+}
+
+// 在任何页面脚本之前注入的钩子：记账「模块工厂 require 了谁」+「每个模块 .get() 返回什么」
+const HOOK = `(() => {
+  if (window.__mp) return;
+  window.__mp = true;
+  window.__mods = [];
+  window.__reqs = [];
+  const oa = Function.prototype.apply;
+  Function.prototype.apply = function (t, a) {
+    try {
+      if (a && a.length >= 3 && typeof a[a.length - 1] === 'function') {
+        const req = a[a.length - 1];
+        if (typeof req === 'function' && !req.__w) {
+          const w = function (id) {
+            try { window.__reqs.push(String(id)); } catch (e) {}
+            const m = req.apply(this, arguments);
+            try {
+              if (m && typeof m.get === 'function' && !m.__g) {
+                m.__g = true;
+                const og = m.get;
+                m.get = function () {
+                  let v;
+                  try { v = og.apply(this, arguments); } catch (e) { v = '__ERR__:' + e; }
+                  try { window.__mods.push([String(id), v]); } catch (e) {}
+                  return v;
+                };
+              }
+            } catch (e) {}
+            return m;
+          };
+          w.__w = true;
+          const na = Array.prototype.slice.call(a);
+          na[na.length - 1] = w;
+          return oa.call(this, t, na);
+        }
+      }
+    } catch (e) {}
+    return oa.call(this, t, a);
+  };
+})();`;
+
+const SHOW = aid => `(async () => {
+  const load = (src) => new Promise((res, rej) => {
+    const s = document.createElement('script');
+    s.src = src; s.onload = () => res(true); s.onerror = () => rej(new Error('fail'));
+    document.head.appendChild(s);
+  });
+  if (typeof window.TencentCaptcha !== 'function') await load('https://ssl.captcha.qq.com/TCaptcha.js');
+  window.__capres = null;
+  window.__cap = new window.TencentCaptcha('${aid}', function (r) { window.__capres = r; }, {});
+  window.__cap.show();
+  return {ok: true};
+})()`;
+
+(async () => {
+    const port = parseInt(arg('port', '9222'), 10);
+    const aid = arg('aid', '195672344');
+    const out = arg('out', '/tmp/1ms_bridge/modvals.json');
+    const waitMs = parseInt(arg('wait', '9000'), 10);
+
+    const list = await (await fetch(`http://127.0.0.1:${port}/json/list`)).json();
+    const page = list.find(t => t.type === 'page' && !(t.url || '').startsWith('chrome'));
+    if (!page) throw new Error('没有可用 page target');
+    const pageCdp = await Cdp.connect(page.webSocketDebuggerUrl);
+    await pageCdp.send('Page.enable');
+    await pageCdp.send('Runtime.enable');
+
+    const ver = await (await fetch(`http://127.0.0.1:${port}/json/version`)).json();
+    const brCdp = await Cdp.connect(ver.webSocketDebuggerUrl);
+
+    const sessions = [];
+    brCdp.on(async m => {
+        if (m.method === 'Target.attachedToTarget') {
+            const { sessionId, targetInfo } = m.params;
+            sessions.push({ sessionId, targetInfo });
+            console.error(`[attach] ${targetInfo.type} ${(targetInfo.url || '').slice(0, 80)}`);
+            try {
+                await brCdp.send('Page.enable', {}, sessionId);
+                await brCdp.send('Page.addScriptToEvaluateOnNewDocument', { source: HOOK }, sessionId);
+                console.error('         -> hook registered');
+            } catch (e) { console.error('         -> hook fail', e.message); }
+            try { await brCdp.send('Runtime.runIfWaitingForDebugger', {}, sessionId); }
+            catch (e) {}
+        }
+    });
+    await brCdp.send('Target.setAutoAttach', {
+        autoAttach: true, waitForDebuggerOnStart: true, flatten: true,
+    });
+    console.error('[1] autoAttach 已开（新 target 会先暂停，等我们注册钩子）');
+
+    console.error('[2] 导航到 1ms.run 并拉起验证码');
+    await pageCdp.send('Page.navigate', { url: 'https://1ms.run/' });
+    await sleep(4000);
+    await pageCdp.send('Runtime.evaluate', {
+        expression: SHOW(aid), awaitPromise: true, returnByValue: true,
+    });
+    await sleep(waitMs);
+
+    console.error('[3] 在各 session 里读取记账结果');
+    const results = [];
+    for (const s of sessions) {
+        try {
+            const r = await brCdp.send('Runtime.evaluate', {
+                expression: `(() => { try { return {u: location.href, n: (window.__mods||[]).length,
+                  mods: window.__mods||[], reqs: window.__reqs||[]}; } catch(e) { return {err:String(e)}; } })()`,
+                returnByValue: true,
+            }, s.sessionId);
+            const v = r.result && r.result.value;
+            if (v && v.mods && v.mods.length) { results.push(v); }
+            else if (v) console.error(`    ${(v.u || '?').slice(0, 60)}: mods=${v.n || 0}`);
+        } catch (e) { console.error('    read fail', e.message); }
+    }
+
+    fs.writeFileSync(out, JSON.stringify(results, null, 1));
+    console.error(`[4] -> ${out}  (命中 ${results.length} 个 session 有记账)`);
+    for (const r of results) {
+        console.error(`    ${(r.u || '').slice(0, 70)}  mods=${r.mods.length} reqs=${r.reqs.length}`);
+    }
+    brCdp.close(); pageCdp.close();
+})().catch(e => { console.error('ERR', e.message); process.exit(1); });

tools/cdp_show_captcha.js

@@ -0,0 +1,79 @@
+// 在真 Chrome(9222) 里拉起 1ms 的腾讯验证码。
+// 用法: node tools/cdp_show_captcha.js
+function arg(name, def) {
+    const i = process.argv.indexOf('--' + name);
+    if (i < 0) return def;
+    const v = process.argv[i + 1];
+    return (v === undefined || v.startsWith('--')) ? true : v;
+}
+const sleep = ms => new Promise(r => setTimeout(r, ms));
+
+class Cdp {
+    constructor(ws) { this.ws = ws; this.id = 0; this.waits = new Map(); this.handlers = []; }
+    static async connect(url) {
+        const ws = new WebSocket(url);
+        await new Promise((res, rej) => { ws.onopen = res; ws.onerror = rej; });
+        const c = new Cdp(ws);
+        ws.onmessage = ev => {
+            const m = JSON.parse(ev.data);
+            if (m.id && c.waits.has(m.id)) {
+                const { res, rej } = c.waits.get(m.id);
+                c.waits.delete(m.id);
+                m.error ? rej(new Error(JSON.stringify(m.error))) : res(m.result);
+            } else if (m.method) { for (const h of c.handlers) h(m); }
+        };
+        return c;
+    }
+    send(method, params = {}) {
+        const id = ++this.id;
+        this.ws.send(JSON.stringify({ id, method, params }));
+        return new Promise((res, rej) => this.waits.set(id, { res, rej }));
+    }
+    on(fn) { this.handlers.push(fn); }
+    close() { try { this.ws.close(); } catch (e) {} }
+}
+
+async function listTargets(port) {
+    const r = await fetch(`http://127.0.0.1:${port}/json/list`);
+    return r.json();
+}
+
+(async () => {
+    const port = parseInt(arg('port', '9222'), 10);
+    const aid = arg('aid', '195672344');
+    const pageUrl = arg('url', 'https://1ms.run/');
+
+    const targets = await listTargets(port);
+    let page = targets.find(t => t.type === 'page' && !(t.url || '').startsWith('chrome'));
+    if (!page) throw new Error('没有可用页面 target');
+
+    const cdp = await Cdp.connect(page.webSocketDebuggerUrl);
+    await cdp.send('Page.enable');
+    await cdp.send('Runtime.enable');
+
+    console.log(`[1] 导航到 ${pageUrl}`);
+    await cdp.send('Page.navigate', { url: pageUrl });
+    await sleep(4000);
+
+    console.log(`[2] 注入 TCaptcha SDK 并 show(aid=${aid})`);
+    const expr = `(async () => {
+      const load = (src) => new Promise((res, rej) => {
+        const s = document.createElement('script');
+        s.src = src; s.onload = () => res(true); s.onerror = () => rej(new Error('fail'));
+        document.head.appendChild(s);
+      });
+      if (typeof window.TencentCaptcha !== 'function') await load('https://ssl.captcha.qq.com/TCaptcha.js');
+      window.__capres = null;
+      window.__cap = new window.TencentCaptcha('${aid}', function (r) { window.__capres = r; }, {});
+      window.__cap.show();
+      return {ok: true};
+    })()`;
+    const r = await cdp.send('Runtime.evaluate', { expression: expr, awaitPromise: true, returnByValue: true });
+    console.log('   ', JSON.stringify(r.result && r.result.value));
+
+    await sleep(2500);
+    const t2 = await listTargets(port);
+    console.log('[3] 当前 targets:');
+    for (const t of t2) console.log(`    ${t.type}\t${(t.url || '').slice(0, 100)}`);
+    cdp.close();
+})().catch(e => { console.error('ERR', e.message); process.exit(1); });

tools/tdc_modules.py

@@ -90,6 +90,11 @@ FINGERPRINTS: List[Tuple[str, Set[str], Set[str]]] = [
     ("charset",              {"characterSet", "charset"}, set()),
     ("viewport_size",        {"clientWidth", "clientHeight"}, set()),
     ("time_since_load",      {"getTime", "load"}, set()),
+    # 轨迹采集器：真机实测其字符串集是鼠标/触摸事件名（2026-10-12 修正）。
+    # 旧规则写成 {"stringify"} —— 那抓到的是另一个只做 JSON.stringify 的模块，
+    # 结果「空数组」被记成 trajectory，真正的轨迹却在 window_time 名下。
+    ("trajectory",           {"mouseMoveEvent", "touchStartEvent"}, set()),
+    ("struct_76_33",         {"stringify"}, set()),
     # ---- 单串规则（放最后，避免压过上面的复合规则）----
     ("user_agent",           {"userAgent"}, set()),
     ("platform",             {"platform"}, set()),
@@ -106,7 +111,6 @@ FINGERPRINTS: List[Tuple[str, Set[str], Set[str]]] = [
     ("touch_detect",         {"ontouchstart"}, set()),
     ("window_time",          {"getTime"}, set()),
     ("constant_98k",         {"98k"}, set()),
-    ("trajectory",           {"stringify"}, set()),
     ("screen_width",         {"screen", "width"}, set()),
     ("screen_height",        {"screen", "height"}, set()),
     ("screen_color_depth",   {"colorDepth"}, set()),

tools/tdc_profile.py

@@ -0,0 +1,202 @@
+# -*- coding: utf-8 -*-
+"""
+tdc_profile.py —— 设备画像（fingerprint profile）的**提取**与**定义**。
+
+背景（账本 §五 第 0 项，`har/1ms_dianxuan/PROGRESS.md`）:
+  「纯离线生成」的唯一阻塞点，是需要为每个**语义名**提供取值。
+  多数语义名是静态环境量（UA / 屏幕 / 时区 / 语言 / 核数 / charset /
+  WebGL / Canvas），可以从一份真机明文里**按值的内容反查**出来。
+
+为什么不靠"明文属于哪份构建":
+  真机明文的槽顺序 = **它自己那次会话构建**的 require 顺序，而那份 tdc.js
+  通常没保存（本项目实测：自洽性打分全为负，即明文不属于手上任何构建）。
+  但**值本身携带强语义**：`"MacIntel"` 只可能是 platform，`"UTF-8"` 只可能是
+  charset，`"ANGLE (Apple, …)"` 只可能是 webgl_renderer。所以按内容反查
+  比按位置配对更稳，也不需要那份丢失的构建。
+
+镜像自洽（案例 §6.3）: 一套画像内的值必须互相一致 ——
+  screen_fingerprint `"1440-2560-2530-24-…"` 里的 1440/2560/24 应当分别等于
+  screen_width / screen_height / screen_color_depth（字段序 = 宽-高-可用高-色深）。
+  本模块会做这个交叉校验。
+
+标准画像请以 `tcaptcha/tdc_values.py::DEVICE_PROFILE` 为准（那里是 37 个语义名
+全部对齐后的产物）；本文件只是**从明文按值反查**的开发期工具。
+
+用法:
+    # 从一份已解密的真机明文提取画像基线
+    .venv/bin/python tools/tdc_profile.py from-sample <明文文件> [--json 输出]
+
+    # 打印内置画像
+    .venv/bin/python tools/tdc_profile.py show
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import re
+import sys
+from pathlib import Path
+from typing import Any, Dict, List, Optional, Tuple
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+# --------------------------------------------------------------------------- #
+# 内容反查：值 -> 语义名（可能多个候选，按置信度排序）                             #
+# --------------------------------------------------------------------------- #
+def guess_names(v: Any) -> List[str]:
+    """按**值的内容**反推它可能出自哪个语义名（不依赖槽位置）。"""
+    out: List[str] = []
+    if isinstance(v, str):
+        if "Mozilla" in v and "AppleWebKit" in v:
+            out.append("user_agent")
+        if v == "MacIntel":
+            out.append("platform")
+        if re.fullmatch(r"[+-]\d{2}(:\d{2})?", v):
+            out.append("timezone_offset")
+        if v.upper() in ("UTF-8", "UTF8"):
+            out.append("charset")
+        if "ANGLE" in v or "Metal Renderer" in v or "OpenGL" in v:
+            out.append("webgl_renderer")
+        if "Inc." in v or ("Google" in v and "Apple" in v):
+            out.append("webgl_vendor")
+        if v.startswith("GgoA") and len(v) > 40:
+            out.append("canvas_fingerprint")
+        if "captcha" in v and "rand=" in v:
+            out.append("template_url")
+        if v == "98k":
+            out.append("constant_98k")
+        if v == "iframe":
+            out.append("iframe_detect")
+        if "-" in v and "*" in v and re.fullmatch(r"[\d\-*|]+", v):
+            out.append("screen_fingerprint")
+        if v.startswith("http") and "1ms.run" in v:
+            out.append("entry_url")
+        elif v.startswith("http"):
+            out.append("location_href")
+    elif isinstance(v, list):
+        if v and all(isinstance(x, list) and len(x) == 3 for x in v):
+            out.append("trajectory")
+        if v and all(isinstance(x, str) for x in v) and 1 <= len(v) <= 4:
+            out.append("languages")
+    elif isinstance(v, int) and not isinstance(v, bool):
+        if 1_600_000_000 <= v <= 2_100_000_000:
+            out.append("timestamp")
+    return out
+
+
+# --------------------------------------------------------------------------- #
+# 内置画像（MacBook 画像基线；取自真机样本，可按需替换/随机化）                     #
+# --------------------------------------------------------------------------- #
+DEFAULT_PROFILE: Dict[str, Any] = {
+    "name": "Mac / Chrome",
+    # --- 明文里能直接看到的静态量 ---
+    "user_agent": ("Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) "
+                   "AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.36"),
+    "platform": "MacIntel",
+    "languages": ["zh-CN", "zh"],
+    "timezone_offset": "+08",
+    "charset": "UTF-8",
+    "hardware_concurrency": 10,
+    # ⚠️ 方向别弄反：真机 screen.width == 1440、screen.height == 2560
+    #    （2026-10-12 浏览器实测；1440x2560 竖屏，availHeight 2530）
+    "screen_width": 1440,
+    "screen_height": 2560,
+    "screen_color_depth": 24,
+    "screen_fingerprint": "1440-2560-2530-24-*-*-|-*",
+    "webgl_renderer": "ANGLE (Apple, ANGLE Metal Renderer: Apple M4, Unspecified Version)",
+    "webgl_vendor": "Google Inc. (Apple)",
+    "canvas_fingerprint": ("GgoAAAANSUhEUgAAASwAAACWCAYAAATf3v8bh+ryWcfSBSLkmN3N1"
+                           "PQinPL7Bi3TG0qE2CogAAAABJRU5ErkJggg=="),
+    "constant_98k": "98k",
+    "cookie_enabled": 1,
+    "touch_detect": 2,                # 真机实测（该机 maxTouchPoints 为 0，值仍是 2）
+    "viewport_size": [360, 360],
+}
+
+
+def cross_check(profile: Dict[str, Any]) -> List[str]:
+    """做镜像自洽性交叉校验（案例 §6.3）。返回不一致项列表。"""
+    problems: List[str] = []
+    fp = profile.get("screen_fingerprint") or ""
+    parts = fp.split("-")
+    if len(parts) >= 4:
+        try:
+            # 字段序 = 宽-高-可用高-色深（2026-10-12 与浏览器真值 1440/2560/2530/24 对齐；
+            # 旧代码把它当成 高-宽-?-色深，方向是反的）
+            w, h, _avail, depth = int(parts[0]), int(parts[1]), int(parts[2]), int(parts[3])
+            if h != profile.get("screen_height"):
+                problems.append("screen_fingerprint 的高度 %d != screen_height %s"
+                                % (h, profile.get("screen_height")))
+            if w != profile.get("screen_width"):
+                problems.append("screen_fingerprint 的宽度 %d != screen_width %s"
+                                % (w, profile.get("screen_width")))
+            if depth != profile.get("screen_color_depth"):
+                problems.append("screen_fingerprint 的色深 %d != screen_color_depth %s"
+                                % (depth, profile.get("screen_color_depth")))
+        except ValueError:
+            problems.append("screen_fingerprint 格式无法解析: %r" % fp)
+    ua = profile.get("user_agent") or ""
+    if "Chrome/" in ua and "Macintosh" in ua and profile.get("platform") != "MacIntel":
+        problems.append("UA 说是 Mac，但 platform=%r" % profile.get("platform"))
+    return problems
+
+
+def from_sample(path: str) -> Tuple[Dict[str, Any], List[Dict]]:
+    """从一份真机明文，按内容反查提取画像基线。
+
+    返回 (识别到的状态量, 未识别的槽列表)。
+    """
+    raw = open(path, encoding="latin1").read().rstrip("\x00")
+    logical = re.sub(r" {2,}", "", raw)
+    cd = json.loads(logical)["cd"]
+
+    found: Dict[str, Any] = {}
+    unidentified: List[Dict] = []
+    for i, v in enumerate(cd):
+        cands = guess_names(v)
+        if len(cands) == 1:
+            found[cands[0]] = v
+        elif cands:
+            found.setdefault(cands[0], v)
+        else:
+            unidentified.append({"slot": i, "value": v})
+    return found, unidentified
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser(description="TDC 设备画像提取/查看")
+    sub = ap.add_subparsers(dest="cmd", required=True)
+    p1 = sub.add_parser("from-sample", help="从真机明文提取画像基线")
+    p1.add_argument("plain")
+    p1.add_argument("--json", default=None)
+    sub.add_parser("show", help="打印内置画像")
+
+    args = ap.parse_args()
+    if args.cmd == "show":
+        print(json.dumps(DEFAULT_PROFILE, ensure_ascii=False, indent=1))
+        probs = cross_check(DEFAULT_PROFILE)
+        print()
+        print("交叉校验:", "全部自洽" if not probs else probs)
+        return 0
+
+    found, unk = from_sample(args.plain)
+    print("从 %s 反查到的状态量:" % Path(args.plain).name)
+    for k, v in found.items():
+        print("  %-22s %s" % (k, json.dumps(v, ensure_ascii=False)[:70]))
+    print()
+    print("未识别的槽: %d 个" % len(unk))
+    for u in unk:
+        print("  槽%-3d %s" % (u["slot"], json.dumps(u["value"], ensure_ascii=False)[:60]))
+    print()
+    probs = cross_check(found)
+    print("交叉校验:", "全部自洽 ✓" if not probs else probs)
+    if args.json:
+        Path(args.json).write_text(json.dumps(found, ensure_ascii=False, indent=1),
+                                   encoding="utf-8")
+        print("画像 -> %s" % args.json)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())