@magield/collectors 0.0.0-stage → 0.7.1

package/dist/signals/devices.js

@@ -0,0 +1,119 @@
+import { hash } from '../hash.js';
+/**
+ * What is plugged in, what can be played, and how much room there is.
+ *
+ * Three probes that share a theme: each asks the platform about itself rather
+ * than asking the page, so an anti-detect browser has to fake a subsystem
+ * rather than a string.
+ *
+ *   Media devices — counts only. `enumerateDevices` returns empty labels and
+ *   empty ids without permission, and this deliberately never asks for it. The
+ *   count is what carries the signal: a real laptop has a camera, a microphone
+ *   and speakers, a headless container has nothing, and a datacentre VM
+ *   usually has a lone dummy sink.
+ *
+ *   DRM — which content-protection systems are available. Widevine is present
+ *   on real consumer installs and absent from most automation images and
+ *   stripped builds.
+ *
+ *   Storage quota — the classic private-mode tell. Browsers report a smaller
+ *   quota in a private window, so an implausibly small one is a strong hint
+ *   without any API existing to ask the question directly.
+ *
+ * No permission prompt is triggered by any of them.
+ */
+const KEY_SYSTEMS = [
+    'com.widevine.alpha',
+    'com.microsoft.playready',
+    'com.apple.fps',
+    'org.w3.clearkey',
+];
+const VIDEO_CONFIG = [
+    {
+        initDataTypes: ['cenc'],
+        videoCapabilities: [{ contentType: 'video/mp4;codecs="avc1.42E01E"' }],
+    },
+];
+export const devicesCollector = {
+    id: 'devices',
+    wave: 'deep',
+    optional: true,
+    async collect({ navigator }) {
+        const out = {};
+        // ── Media devices ────────────────────────────────────────────────────
+        try {
+            const media = navigator.mediaDevices;
+            if (media === undefined || typeof media.enumerateDevices !== 'function') {
+                out['devices.audioIn'] = null;
+                out['devices.audioOut'] = null;
+                out['devices.videoIn'] = null;
+            }
+            else {
+                const list = await media.enumerateDevices();
+                let audioIn = 0;
+                let audioOut = 0;
+                let videoIn = 0;
+                for (const device of list) {
+                    if (device.kind === 'audioinput')
+                        audioIn++;
+                    else if (device.kind === 'audiooutput')
+                        audioOut++;
+                    else if (device.kind === 'videoinput')
+                        videoIn++;
+                }
+                out['devices.audioIn'] = audioIn;
+                out['devices.audioOut'] = audioOut;
+                out['devices.videoIn'] = videoIn;
+                // `groupId` is deliberately not reported. It reads empty on every
+                // device without microphone permission — measured on a real Chrome
+                // with three devices attached, zero non-empty ids — so it would be a
+                // signal that is always the same number, which is worse than no signal
+                // because it looks like one.
+            }
+        }
+        catch {
+            out['devices.audioIn'] = null;
+            out['devices.audioOut'] = null;
+            out['devices.videoIn'] = null;
+        }
+        // ── DRM ──────────────────────────────────────────────────────────────
+        try {
+            const request = navigator.requestMediaKeySystemAccess?.bind(navigator);
+            if (request === undefined) {
+                out['devices.drm'] = null;
+            }
+            else {
+                const supported = [];
+                await Promise.all(KEY_SYSTEMS.map(async (system) => {
+                    try {
+                        await request(system, VIDEO_CONFIG);
+                        supported.push(system);
+                    }
+                    catch {
+                        // Unsupported is the ordinary answer, not an error.
+                    }
+                }));
+                out['devices.drm'] = supported.sort().join(',');
+                out['devices.drmHash'] = hash(supported.sort().join(','));
+            }
+        }
+        catch {
+            out['devices.drm'] = null;
+        }
+        // ── Storage quota ────────────────────────────────────────────────────
+        try {
+            const estimate = navigator.storage?.estimate?.bind(navigator.storage);
+            if (estimate === undefined) {
+                out['devices.quotaMb'] = null;
+            }
+            else {
+                const { quota } = await estimate();
+                out['devices.quotaMb'] = quota === undefined ? null : Math.round(quota / (1024 * 1024));
+            }
+        }
+        catch {
+            out['devices.quotaMb'] = null;
+        }
+        return out;
+    },
+};

package/dist/signals/display.d.ts

@@ -0,0 +1,2 @@
+import type { Collector } from '../types.js';
+export declare const displayCollector: Collector;

package/dist/signals/display.js

@@ -0,0 +1,101 @@
+import { hash } from '../hash.js';
+/**
+ * How the operating system paints, and what it says about the person using it.
+ *
+ * CSS system colours resolve to the platform's own theme, so the set separates
+ * Windows from macOS from a Linux desktop, light from dark, and — through the
+ * forced-colours and contrast queries — identifies an accessibility
+ * configuration.
+ *
+ * That last part is the reason for the split below. A high-contrast or
+ * reduced-motion setting is a strong, stable signal and it is also a statement
+ * about a person's eyesight or vestibular health. It is collected because an
+ * anti-detect browser will not think to fake it, and it is reported as its own
+ * signal rather than folded into a hash so that a tenant can see what it is
+ * acting on, and switch this collector off without losing the rest.
+ */
+/**
+ * The system colours still resolved by current engines.
+ *
+ * Most of CSS2's list was deprecated and now returns the same value
+ * everywhere, which is noise. These are the ones that still vary.
+ */
+const SYSTEM_COLORS = [
+    'ActiveText', 'ButtonBorder', 'ButtonFace', 'ButtonText', 'Canvas', 'CanvasText',
+    'Field', 'FieldText', 'GrayText', 'Highlight', 'HighlightText', 'LinkText',
+    'Mark', 'MarkText', 'SelectedItem', 'SelectedItemText', 'VisitedText',
+    'AccentColor', 'AccentColorText',
+];
+/** Queries that describe the configuration rather than the hardware. */
+const MEDIA_QUERIES = {
+    'display.colorScheme': '(prefers-color-scheme: dark)',
+    'display.reducedMotion': '(prefers-reduced-motion: reduce)',
+    'display.reducedTransparency': '(prefers-reduced-transparency: reduce)',
+    'display.forcedColors': '(forced-colors: active)',
+    'display.invertedColors': '(inverted-colors: inverted)',
+    'display.hdr': '(dynamic-range: high)',
+    'display.hover': '(hover: hover)',
+    'display.anyPointerCoarse': '(any-pointer: coarse)',
+    'display.standalone': '(display-mode: standalone)',
+};
+export const displayCollector = {
+    id: 'display',
+    wave: 'warm',
+    optional: true,
+    collect({ document, window }) {
+        const out = {};
+        try {
+            const probe = document.createElement('div');
+            probe.setAttribute('style', 'position:absolute;left:-9999px;top:-9999px;visibility:hidden');
+            document.body.appendChild(probe);
+            const resolved = [];
+            let distinct = 0;
+            const seen = new Set();
+            for (const name of SYSTEM_COLORS) {
+                try {
+                    probe.style.color = '';
+                    probe.style.color = name;
+                    // A colour the engine does not know leaves the property empty, which
+                    // is itself worth recording — the set of *recognised* names differs
+                    // between engines as much as the values do.
+                    const value = probe.style.color === '' ? '' : window.getComputedStyle(probe).color;
+                    resolved.push(`${name}=${value}`);
+                    if (value !== '')
+                        seen.add(value);
+                }
+                catch {
+                    resolved.push(`${name}=?`);
+                }
+            }
+            distinct = seen.size;
+            try {
+                if (probe.parentNode !== null)
+                    probe.parentNode.removeChild(probe);
+            }
+            catch {
+                // Nothing to do; the node is offscreen and hidden either way.
+            }
+            out['display.colorsHash'] = hash(resolved.join('|'));
+            // A theme that collapses to one or two distinct colours is not a theme.
+            // It is forced colours, a stripped engine, or a headless default.
+            out['display.colorsDistinct'] = distinct;
+        }
+        catch {
+            out['display.colorsHash'] = null;
+            out['display.colorsDistinct'] = null;
+        }
+        for (const [key, query] of Object.entries(MEDIA_QUERIES)) {
+            try {
+                // `matches` is false both when the condition does not hold and when the
+                // engine does not know the query, so `media` is checked: an
+                // unrecognised query is normalised to 'not all'.
+                const result = window.matchMedia(query);
+                out[key] = result.media === 'not all' ? null : result.matches;
+            }
+            catch {
+                out[key] = null;
+            }
+        }
+        return out;
+    },
+};

package/dist/signals/errors.d.ts

@@ -0,0 +1,2 @@
+import type { Collector } from '../types.js';
+export declare const errorsCollector: Collector;

package/dist/signals/errors.js

@@ -0,0 +1,84 @@
+import { hash } from '../hash.js';
+/**
+ * The shape of a stack trace.
+ *
+ * Every engine formats stacks differently, and the details shift between
+ * versions: the header line, whether column numbers appear, how anonymous
+ * functions are named. It corroborates the engine claimed by the user agent,
+ * and instrumented environments perturb it in ways that are hard to predict.
+ */
+/**
+ * Which engine is actually running, read from how it words one mistake.
+ *
+ * This exists because the engine cannot be inferred from the APIs it exposes.
+ * `Error.captureStackTrace` and `Error.stackTraceLimit` look V8-specific and
+ * are not — JavaScriptCore ships both, and a check built on that premise fired
+ * on every real iPhone before a capture from one disproved it.
+ *
+ * The message text does separate them, because it is prose each engine wrote
+ * independently rather than an API anyone had reason to copy:
+ *
+ *   V8    Cannot read properties of null (reading 'x')
+ *   JSC   null is not an object (evaluating 'null.x')
+ *
+ * All three measured — V8 in Node and in six desktop captures, JavaScriptCore
+ * in macOS JavaScriptCore and in a capture from a real iPhone, SpiderMonkey in
+ * a capture from a real Firefox. Each hash matches what its capture reported.
+ *
+ *   SM    can't access property "x" of null
+ *
+ * SpiderMonkey was left unclassified until a capture from a real Firefox
+ * arrived, and the restraint paid: the guess would have been "null has no
+ * properties", which hashes to 6a0162a0 and is not what Firefox 150 reports.
+ * The measured string hashes to c5f95f17, exactly what the capture carries.
+ *
+ * Anything else stays `unknown`, and every check reading this stays
+ * inconclusive for it — the honest answer to a question nobody has measured.
+ */
+function classifyEngine(message) {
+    if (message.includes('Cannot read properties of'))
+        return 'v8';
+    if (message.includes('is not an object'))
+        return 'javascriptcore';
+    if (message.includes('access property'))
+        return 'spidermonkey';
+    return 'unknown';
+}
+export const errorsCollector = {
+    id: 'err',
+    wave: 'instant',
+    collect() {
+        const out = {};
+        try {
+            const error = new Error('probe');
+            const stack = error.stack ?? '';
+            out['err.hasStack'] = stack.length > 0;
+            // The first line: "Error: probe" in V8, "probe@..." in SpiderMonkey.
+            out['err.headerShape'] = hash(stack.split('\n')[0]?.replace(/[^\w:@]/g, '') ?? '');
+            out['err.frameCount'] = stack.split('\n').length;
+            out['err.hasColumns'] = /:\d+:\d+/.test(stack);
+            // NOT V8 only, whatever this comment used to say. JavaScriptCore
+            // implements both for V8 compatibility — measured on a real iPhone
+            // running Chrome for iOS, and again against macOS JavaScriptCore
+            // directly. They are collected because instrumented environments perturb
+            // them, not because their presence names an engine.
+            out['err.hasCaptureStackTrace'] = typeof Error.captureStackTrace === 'function';
+            out['err.stackTraceLimit'] = typeof Error.stackTraceLimit === 'number';
+        }
+        catch {
+            out['err.hasStack'] = false;
+        }
+        try {
+            // Engines disagree on the message text for the same mistake.
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            ;
+            null.x;
+        }
+        catch (err) {
+            const message = err.message;
+            out['err.nullAccessMessage'] = hash(message);
+            out['err.engine'] = classifyEngine(message);
+        }
+        return out;
+    },
+};

package/dist/signals/features.d.ts

@@ -0,0 +1,2 @@
+import type { Collector } from '../types.js';
+export declare const featuresCollector: Collector;