@magield/collectors 0.12.2 → 0.13.0

package/dist/registry.js

@@ -13,6 +13,7 @@ import { featuresCollector } from './signals/features.js';
 import { integrityCollector } from './signals/integrity.js';
 import { mathCollector } from './signals/math.js';
 import { navigatorCollector } from './signals/navigator.js';
+import { pageCollector } from './signals/page.js';
 import { pointerCollector } from './signals/pointer.js';
 import { canvasCollector, webglCollector } from './signals/render.js';
 import { screenCollector } from './signals/screen.js';
@@ -29,6 +30,8 @@ export const ALL_COLLECTORS = [
     // ran this sixth, behind a 5 ms budget its obfuscated build could not meet,
     // and shipped without bot detection for every integrator until 0.7.0.
     automationCollector,
+    // Second: two property reads, and the sequence check reads them.
+    pageCollector,
     navigatorCollector,
     screenCollector,
     featuresCollector,

package/dist/signals/page.d.ts

@@ -0,0 +1,24 @@
+import type { Collector } from '../types.js';
+/**
+ * How long the page had been open when the token was made, and whether anyone
+ * had touched it.
+ *
+ * A script that drives a browser loads the page and submits in one motion: no
+ * click, no key, a second or two after navigation. A person cannot, because
+ * typing a password takes longer than that. The behaviour recorder sees the
+ * same thing in far more detail, but only where the integrator calls
+ * `observe()`; this needs nothing.
+ *
+ * Read at collect() time, which is when the form is submitted in every
+ * integration the SDK documents. `instant`, because it is two property reads.
+ *
+ * - `page.ageMs`: `performance.now()`, the time since navigation started. A
+ *   single-page app reports the time since its first page loaded, which only
+ *   ever makes it longer, so it can hide a fast bot and never accuse a person.
+ * - `page.activated`: `navigator.userActivation.hasBeenActive`, the browser's
+ *   own record of a click, tap or key press on the page since it loaded. Kept
+ *   by the browser from the start, so it does not depend on when the SDK was
+ *   loaded; `null` where the browser lacks it (Firefox before 120, Safari
+ *   before 16.4), and rules reading it then abstain.
+ */
+export declare const pageCollector: Collector;

package/dist/signals/page.js

@@ -0,0 +1,33 @@
+/**
+ * How long the page had been open when the token was made, and whether anyone
+ * had touched it.
+ *
+ * A script that drives a browser loads the page and submits in one motion: no
+ * click, no key, a second or two after navigation. A person cannot, because
+ * typing a password takes longer than that. The behaviour recorder sees the
+ * same thing in far more detail, but only where the integrator calls
+ * `observe()`; this needs nothing.
+ *
+ * Read at collect() time, which is when the form is submitted in every
+ * integration the SDK documents. `instant`, because it is two property reads.
+ *
+ * - `page.ageMs`: `performance.now()`, the time since navigation started. A
+ *   single-page app reports the time since its first page loaded, which only
+ *   ever makes it longer, so it can hide a fast bot and never accuse a person.
+ * - `page.activated`: `navigator.userActivation.hasBeenActive`, the browser's
+ *   own record of a click, tap or key press on the page since it loaded. Kept
+ *   by the browser from the start, so it does not depend on when the SDK was
+ *   loaded; `null` where the browser lacks it (Firefox before 120, Safari
+ *   before 16.4), and rules reading it then abstain.
+ */
+export const pageCollector = {
+    id: 'page',
+    wave: 'instant',
+    collect(env) {
+        const out = {};
+        out['page.ageMs'] = Math.round(env.performance.now());
+        const activation = env.navigator.userActivation;
+        out['page.activated'] = typeof activation?.hasBeenActive === 'boolean' ? activation.hasBeenActive : null;
+        return out;
+    },
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@magield/collectors",
-  "version": "0.12.2",
+  "version": "0.13.0",
   "description": "Browser signal collectors used by the Magic Shield web SDK",
   "license": "SEE LICENSE IN LICENSE",
   "files": [