@magield/collectors 0.0.0-stage → 0.7.1

package/dist/signals/render.js

@@ -0,0 +1,214 @@
+import { hash, hashRecord } from '../hash.js';
+/**
+ * Canvas and WebGL: what the GPU and driver actually produce.
+ *
+ * These are the highest-entropy signals available to a page, because the output
+ * depends on the whole rendering stack — GPU, driver version, OS text
+ * rasteriser, font hinting. They are also the ones privacy browsers
+ * deliberately poison, so the *stability* of the result is collected alongside
+ * it: real hardware is deterministic, injected noise is not.
+ */
+export const canvasCollector = {
+    id: 'canvas',
+    wave: 'warm',
+    optional: true,
+    collect({ document }) {
+        const out = {};
+        const first = renderCanvas(document);
+        if (first === null) {
+            out['canvas.hash'] = null;
+            out['canvas.stable'] = null;
+            return out;
+        }
+        out['canvas.hash'] = hash(first);
+        // Rendered twice into two separate canvases. Identical output means real,
+        // deterministic hardware; differing output means the browser is
+        // randomising it, which is itself worth knowing and must not be mistaken
+        // for a new device on every visit.
+        const second = renderCanvas(document);
+        out['canvas.stable'] = second === first;
+        // Read twice from ONE canvas, with a `getImageData` between the reads.
+        //
+        // This is the check the one above misses, and it misses it in the case
+        // that matters. Brave farbles per session and per origin, so two separately
+        // rendered canvases agree and `canvas.stable` reads true — measured on two
+        // real Brave sessions, both of which reported stable while every other
+        // value they touched was being redrawn.
+        //
+        // A farbler that perturbs on each *read* is caught here instead, because
+        // this asks the same pixels twice rather than asking twice for the same
+        // drawing. The `getImageData` in between is not decoration: it is a second
+        // read path, and an implementation that noises one and not the other shows
+        // up as a difference between the two `toDataURL` calls surrounding it.
+        out['canvas.readStable'] = readStability(document);
+        // Whether text measurement lands on whole pixels.
+        //
+        // A real engine lays text out in fractional units — `measureText` on a
+        // proportional font returns values like 123.4560546875, and getting a whole
+        // number is a coincidence. Some anti-detect browsers round the result to
+        // defeat font fingerprinting, which removes the entropy and leaves a tell
+        // that is far harder to fake than the widths themselves.
+        out['canvas.textFractional'] = measureFractional(document);
+        return out;
+    },
+};
+/**
+ * How many of several measured strings had a fractional width.
+ *
+ * Several, not one: a single string genuinely can measure to a whole number,
+ * and a check built on one sample would fire on that coincidence. Null when
+ * the measurement could not be taken at all, which must not read as rounded.
+ */
+function measureFractional(document) {
+    try {
+        const context = document.createElement('canvas').getContext('2d');
+        if (context === null)
+            return null;
+        context.font = '11pt Arial';
+        let fractional = 0;
+        for (const sample of ['Magic Shield', 'mmmmmmmmmmlli', 'The quick brown fox', 'WWWWWWiiiiii']) {
+            const { width } = context.measureText(sample);
+            if (!Number.isFinite(width))
+                return null;
+            if (!Number.isInteger(width))
+                fractional++;
+        }
+        return fractional;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Whether one canvas returns the same bytes when read repeatedly.
+ *
+ * Distinct from rendering twice: this draws once and reads three times, with a
+ * `getImageData` between the two `toDataURL` calls so both read paths are
+ * exercised. Returns null when nothing could be measured, never false.
+ */
+function readStability(document) {
+    try {
+        const canvas = document.createElement('canvas');
+        canvas.width = 220;
+        canvas.height = 30;
+        const context = canvas.getContext('2d');
+        if (context === null)
+            return null;
+        context.textBaseline = 'alphabetic';
+        context.font = "14px 'Arial'";
+        context.fillStyle = '#f60';
+        context.fillRect(125, 1, 62, 20);
+        context.fillStyle = '#069';
+        context.fillText('Magic Shield read probe', 2, 15);
+        context.fillStyle = 'rgba(102, 204, 0, 0.7)';
+        context.fillText('Magic Shield read probe', 4, 17);
+        const before = canvas.toDataURL();
+        // The second read path. Its own result is not compared — what matters is
+        // whether taking it changes what the first path returns next time.
+        context.getImageData(0, 0, canvas.width, canvas.height);
+        const after = canvas.toDataURL();
+        return before === after;
+    }
+    catch {
+        return null;
+    }
+}
+function renderCanvas(document) {
+    try {
+        const canvas = document.createElement('canvas');
+        canvas.width = 280;
+        canvas.height = 60;
+        const context = canvas.getContext('2d');
+        if (context === null)
+            return null;
+        // Text, curves and blending together: each exercises a different part of
+        // the rasteriser, so the result varies more between stacks than any one
+        // would alone.
+        context.textBaseline = 'alphabetic';
+        context.fillStyle = '#f60';
+        context.fillRect(100, 1, 62, 20);
+        context.fillStyle = '#069';
+        context.font = '11pt Arial';
+        context.fillText('Magic Shield 1/2/3 ☃', 2, 15);
+        context.fillStyle = 'rgba(102, 204, 0, 0.7)';
+        context.font = '18pt Arial';
+        context.fillText('Magic Shield 1/2/3 ☃', 4, 45);
+        context.globalCompositeOperation = 'multiply';
+        context.fillStyle = 'rgb(255,0,255)';
+        context.beginPath();
+        context.arc(50, 50, 50, 0, Math.PI * 2, true);
+        context.closePath();
+        context.fill();
+        return canvas.toDataURL();
+    }
+    catch {
+        return null;
+    }
+}
+const WEBGL_PARAMETERS = [
+    'MAX_TEXTURE_SIZE',
+    'MAX_VIEWPORT_DIMS',
+    'MAX_VERTEX_ATTRIBS',
+    'MAX_VERTEX_UNIFORM_VECTORS',
+    'MAX_FRAGMENT_UNIFORM_VECTORS',
+    'MAX_VARYING_VECTORS',
+    'MAX_COMBINED_TEXTURE_IMAGE_UNITS',
+    'MAX_CUBE_MAP_TEXTURE_SIZE',
+    'MAX_RENDERBUFFER_SIZE',
+    'ALIASED_LINE_WIDTH_RANGE',
+    'ALIASED_POINT_SIZE_RANGE',
+    'RED_BITS',
+    'GREEN_BITS',
+    'BLUE_BITS',
+    'ALPHA_BITS',
+    'DEPTH_BITS',
+    'STENCIL_BITS',
+];
+export const webglCollector = {
+    id: 'webgl',
+    wave: 'warm',
+    optional: true,
+    collect({ document }) {
+        const out = {};
+        try {
+            const canvas = document.createElement('canvas');
+            const gl = (canvas.getContext('webgl') ?? canvas.getContext('experimental-webgl'));
+            if (gl === null) {
+                out['webgl.vendor'] = null;
+                out['webgl.renderer'] = null;
+                return out;
+            }
+            // The unmasked strings name the actual GPU. SwiftShader, llvmpipe and
+            // Mesa here mean software rendering, which on a machine claiming to be a
+            // consumer laptop is a strong headless signal.
+            const debug = gl.getExtension('WEBGL_debug_renderer_info');
+            out['webgl.vendor'] = debug === null ? gl.getParameter(gl.VENDOR) : gl.getParameter(debug.UNMASKED_VENDOR_WEBGL);
+            out['webgl.renderer'] =
+                debug === null ? gl.getParameter(gl.RENDERER) : gl.getParameter(debug.UNMASKED_RENDERER_WEBGL);
+            out['webgl.version'] = gl.getParameter(gl.VERSION);
+            out['webgl.shadingLanguageVersion'] = gl.getParameter(gl.SHADING_LANGUAGE_VERSION);
+            const parameters = {};
+            for (const name of WEBGL_PARAMETERS) {
+                const constant = gl[name];
+                if (typeof constant !== 'number')
+                    continue;
+                const value = gl.getParameter(constant);
+                parameters[name] = Array.isArray(value) || ArrayBuffer.isView(value) ? Array.from(value).join(',') : value;
+            }
+            out['webgl.parametersHash'] = hashRecord(parameters);
+            // Per-GPU floating point precision ranges. Harder to fake than the vendor
+            // strings, because a plausible set has to match a real device family.
+            const precision = gl.getShaderPrecisionFormat(gl.FRAGMENT_SHADER, gl.HIGH_FLOAT);
+            if (precision !== null) {
+                out['webgl.fragmentHighFloat'] = `${precision.rangeMin},${precision.rangeMax},${precision.precision}`;
+            }
+            const extensions = gl.getSupportedExtensions() ?? [];
+            out['webgl.extensionCount'] = extensions.length;
+            out['webgl.extensionsHash'] = hash(extensions.slice().sort().join(','));
+        }
+        catch {
+            out['webgl.vendor'] = null;
+        }
+        return out;
+    },
+};

package/dist/signals/screen.d.ts

@@ -0,0 +1,9 @@
+import type { Collector } from '../types.js';
+/**
+ * Screen geometry and the window's relationship to it.
+ *
+ * The derived values matter more than the raw ones. A headless browser
+ * classically reports zero browser chrome, and a non-integer devicePixelRatio
+ * is characteristic of real hardware in a way a round number is not.
+ */
+export declare const screenCollector: Collector;

package/dist/signals/screen.js

@@ -0,0 +1,80 @@
+/**
+ * Screen geometry and the window's relationship to it.
+ *
+ * The derived values matter more than the raw ones. A headless browser
+ * classically reports zero browser chrome, and a non-integer devicePixelRatio
+ * is characteristic of real hardware in a way a round number is not.
+ */
+export const screenCollector = {
+    id: 'screen',
+    wave: 'instant',
+    collect({ screen, window, document }) {
+        const out = {
+            'screen.width': screen.width ?? null,
+            'screen.height': screen.height ?? null,
+            'screen.availWidth': screen.availWidth ?? null,
+            'screen.availHeight': screen.availHeight ?? null,
+            'screen.colorDepth': screen.colorDepth ?? null,
+            'screen.pixelDepth': screen.pixelDepth ?? null,
+            'screen.orientation': screen.orientation?.type ?? null,
+            'screen.devicePixelRatio': window.devicePixelRatio ?? null,
+            'screen.innerWidth': window.innerWidth ?? null,
+            'screen.innerHeight': window.innerHeight ?? null,
+            'screen.outerWidth': window.outerWidth ?? null,
+            'screen.outerHeight': window.outerHeight ?? null,
+        };
+        // Browser chrome height. Zero on a real windowed browser is close to
+        // impossible: there is always a tab strip and an address bar.
+        //
+        // **Only valid while the document has focus.** Chrome does not maintain
+        // live window geometry for a backgrounded tab, and what it reports instead
+        // looks exactly like a headless browser. Measured on a real Chrome 152,
+        // same tab, three states:
+        //
+        //   unfocused, not yet rendered   outer 0    inner 962   ->  -962
+        //   unfocused, stale geometry     outer 962  inner 962   ->     0
+        //   focused                       outer 962  inner 906   ->    56
+        //
+        // A background tab is completely ordinary — a link opened with cmd+click, a
+        // prerendered page, a form the user switched away from. Reporting any of
+        // those as zero chrome flags real people, so when the window is not focused
+        // the measurement simply is not available.
+        const focused = safeHasFocus(document);
+        if (focused === true &&
+            typeof window.outerHeight === 'number' &&
+            typeof window.innerHeight === 'number' &&
+            window.outerHeight > 0) {
+            out['screen.chromeHeight'] = window.outerHeight - window.innerHeight;
+        }
+        else {
+            out['screen.chromeHeight'] = null;
+        }
+        out['screen.focused'] = focused;
+        // How far the viewport overruns the screen it claims to be on.
+        //
+        // Reported as a ratio rather than a verdict, because the honest causes are
+        // real and this collector must not decide. Browser zoom inflates
+        // innerWidth while screen.width holds, and a window dragged across two
+        // monitors is wider than the screen the page thinks it is on. Whether any
+        // given ratio means anything is the consistency matrix's problem, and the
+        // measurement below is what tells it where the line is.
+        if (typeof screen.width === 'number' && screen.width > 0 && typeof window.innerWidth === 'number') {
+            out['screen.viewportRatio'] = Math.round((window.innerWidth / screen.width) * 100) / 100;
+        }
+        // The taskbar or menu bar. A screen whose available area exactly equals its
+        // full area is usually a virtual display.
+        if (typeof screen.height === 'number' && typeof screen.availHeight === 'number') {
+            out['screen.reservedHeight'] = screen.height - screen.availHeight;
+        }
+        return out;
+    },
+};
+/** `hasFocus` can be absent or throw in embedded and hardened contexts. */
+function safeHasFocus(document) {
+    try {
+        return typeof document.hasFocus === 'function' ? document.hasFocus() : null;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/signals/storage.d.ts

@@ -0,0 +1,33 @@
+import type { Collector } from '../types.js';
+/**
+ * What the storage subsystem will admit to.
+ *
+ * This was written to detect private windows and it does not, which is worth
+ * stating at the top rather than leaving for somebody to discover.
+ *
+ * The two classic techniques are a reduced quota and a missing
+ * `storageBuckets`. Both were shipped here and both were then measured against
+ * a real Chrome incognito window on the machine that produced
+ * `tools/fp-lab/captures/human-chrome.json`:
+ *
+ *   store.quotaMb          10240   identical to the ordinary window
+ *   store.bucketsMissing   false   the API is present
+ *   every storage mechanism        works
+ *
+ * Every other signal in the capture was byte-identical too — the same
+ * permission hash, the same voice hash, the same WebGPU limits. Chrome closed
+ * these vectors deliberately, and a `quotaSmall` threshold guessed from how
+ * Chromium used to behave would have reported `false` on every private window
+ * while looking like a working detector.
+ *
+ * So nothing here claims to detect private mode. What remains are the raw
+ * measurements, which are honest about something else: a quota and a set of
+ * working storage mechanisms describe how hardened or stripped an environment
+ * is, and a client where `localStorage` throws is not a private window, it is
+ * a container or a locked-down profile.
+ *
+ * If private-mode detection is wanted, it needs a technique nobody here has
+ * measured, and it should be built from a capture rather than from a
+ * description of how browsers once worked.
+ */
+export declare const storageCollector: Collector;

package/dist/signals/storage.js

@@ -0,0 +1,100 @@
+/**
+ * What the storage subsystem will admit to.
+ *
+ * This was written to detect private windows and it does not, which is worth
+ * stating at the top rather than leaving for somebody to discover.
+ *
+ * The two classic techniques are a reduced quota and a missing
+ * `storageBuckets`. Both were shipped here and both were then measured against
+ * a real Chrome incognito window on the machine that produced
+ * `tools/fp-lab/captures/human-chrome.json`:
+ *
+ *   store.quotaMb          10240   identical to the ordinary window
+ *   store.bucketsMissing   false   the API is present
+ *   every storage mechanism        works
+ *
+ * Every other signal in the capture was byte-identical too — the same
+ * permission hash, the same voice hash, the same WebGPU limits. Chrome closed
+ * these vectors deliberately, and a `quotaSmall` threshold guessed from how
+ * Chromium used to behave would have reported `false` on every private window
+ * while looking like a working detector.
+ *
+ * So nothing here claims to detect private mode. What remains are the raw
+ * measurements, which are honest about something else: a quota and a set of
+ * working storage mechanisms describe how hardened or stripped an environment
+ * is, and a client where `localStorage` throws is not a private window, it is
+ * a container or a locked-down profile.
+ *
+ * If private-mode detection is wanted, it needs a technique nobody here has
+ * measured, and it should be built from a capture rather than from a
+ * description of how browsers once worked.
+ */
+export const storageCollector = {
+    id: 'store',
+    wave: 'deep',
+    optional: true,
+    async collect({ navigator, window }) {
+        const out = {};
+        // ── Quota ────────────────────────────────────────────────────────────
+        // A description of the environment, not of the window. Measured identical
+        // between an ordinary and a private Chrome window, so it says nothing
+        // about privacy — but a container with a tiny quota still looks different
+        // from a laptop, and that is worth a number.
+        try {
+            const estimate = navigator.storage?.estimate?.bind(navigator.storage);
+            if (estimate === undefined) {
+                out['store.quotaMb'] = null;
+                out['store.quotaSmall'] = null;
+            }
+            else {
+                const { quota } = await estimate();
+                if (quota === undefined) {
+                    out['store.quotaMb'] = null;
+                }
+                else {
+                    out['store.quotaMb'] = Math.round(quota / (1024 * 1024));
+                }
+            }
+        }
+        catch {
+            out['store.quotaMb'] = null;
+        }
+        // `storageBuckets` was probed here on the premise that Chromium omits it in
+        // a private window. Measured present in a real incognito window, so the
+        // premise is false and the signal is gone rather than left in reporting a
+        // constant. `features` covers the API's existence as one bit among 891,
+        // which is all it was ever worth.
+        // ── Which storage mechanisms actually work ───────────────────────────
+        // A profile with storage disabled, or a hardened container, fails these
+        // in a pattern that does not look like a private window.
+        for (const [key, probe] of [
+            ['store.localStorage', () => testStorage(window, 'localStorage')],
+            ['store.sessionStorage', () => testStorage(window, 'sessionStorage')],
+            ['store.indexedDb', () => 'indexedDB' in window && window.indexedDB !== null],
+            ['store.caches', () => 'caches' in window],
+        ]) {
+            try {
+                out[key] = probe();
+            }
+            catch {
+                out[key] = false;
+            }
+        }
+        return out;
+    },
+};
+/** Writes and removes one key. Throwing is the answer, not an error. */
+function testStorage(window, name) {
+    try {
+        const store = window[name];
+        if (store === undefined || store === null)
+            return false;
+        const probe = '__ms_probe__';
+        store.setItem(probe, '1');
+        store.removeItem(probe);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/signals/timezone.d.ts

@@ -0,0 +1,9 @@
+import type { Collector } from '../types.js';
+/**
+ * Time zone, established two independent ways.
+ *
+ * `Intl` reports a zone name; `Date` reveals the actual UTC offsets the engine
+ * applies. Spoofing tools routinely patch one and forget the other, so the
+ * disagreement between them is worth more than either value.
+ */
+export declare const timezoneCollector: Collector;

package/dist/signals/timezone.js

@@ -0,0 +1,63 @@
+/**
+ * Time zone, established two independent ways.
+ *
+ * `Intl` reports a zone name; `Date` reveals the actual UTC offsets the engine
+ * applies. Spoofing tools routinely patch one and forget the other, so the
+ * disagreement between them is worth more than either value.
+ */
+export const timezoneCollector = {
+    id: 'tz',
+    wave: 'instant',
+    collect() {
+        const out = {};
+        let declared = null;
+        try {
+            declared = Intl.DateTimeFormat().resolvedOptions().timeZone ?? null;
+        }
+        catch {
+            declared = null;
+        }
+        out['tz.timezone'] = declared;
+        try {
+            // January and July: their offsets differ wherever DST is observed, and by
+            // how much. That pair is a coarse fingerprint of the zone on its own.
+            const january = -new Date(Date.UTC(2024, 0, 15)).getTimezoneOffset();
+            const july = -new Date(Date.UTC(2024, 6, 15)).getTimezoneOffset();
+            out['tz.offsetJan'] = january;
+            out['tz.offsetJul'] = july;
+            out['tz.observesDst'] = january !== july;
+            if (declared !== null) {
+                // Does the named zone actually produce the offsets the engine applies?
+                const observed = offsetOf(declared, new Date(Date.UTC(2024, 0, 15)));
+                out['tz.consistent'] = observed === null ? null : observed === january;
+            }
+        }
+        catch {
+            out['tz.offsetJan'] = null;
+        }
+        return out;
+    },
+};
+/** Minutes east of UTC that a named zone was at a given instant. */
+function offsetOf(timeZone, at) {
+    try {
+        const formatter = new Intl.DateTimeFormat('en-US', {
+            timeZone,
+            hour12: false,
+            year: 'numeric',
+            month: '2-digit',
+            day: '2-digit',
+            hour: '2-digit',
+            minute: '2-digit',
+            second: '2-digit',
+        });
+        const parts = {};
+        for (const part of formatter.formatToParts(at))
+            parts[part.type] = part.value;
+        const asUtc = Date.UTC(Number(parts['year']), Number(parts['month']) - 1, Number(parts['day']), Number(parts['hour']), Number(parts['minute']), Number(parts['second']));
+        return Math.round((asUtc - at.getTime()) / 60_000);
+    }
+    catch {
+        return null;
+    }
+}

package/dist/signals/webrtc.d.ts

@@ -0,0 +1,2 @@
+import type { Collector } from '../types.js';
+export declare const webrtcCollector: Collector;