@prosopo/fingerprint 2.6.28 → 2.7.0

package/dist/proof.js

@@ -0,0 +1,84 @@
+import { hexHash } from "@prosopo/util-crypto";
+import { buildMerkleLayers, merkleRootFromLayers, merkleProofFromLayers, verifyMerkleProof } from "./merkle.js";
+const FINGERPRINT_PROOF_VERSION = 1;
+const FINGERPRINT_DISCLOSURE_KEYS = [
+  "colorDepth",
+  "cookiesEnabled",
+  "sessionStorage",
+  "localStorage",
+  "timezone",
+  "hardwareConcurrency",
+  "languages",
+  "architecture"
+];
+const escapeKey = (key) => key.replace(/([:|\\])/g, "\\$1");
+const componentLeafContent = (key, component) => {
+  const serialized = "error" in component ? "error" : JSON.stringify(component.value);
+  return `${escapeKey(key)}:${serialized}`;
+};
+const disclosureLeafContent = (disclosure) => {
+  const serialized = disclosure.error ? "error" : JSON.stringify(disclosure.value);
+  return `${escapeKey(disclosure.key)}:${serialized}`;
+};
+const leafHashForContent = (content) => hexHash(content);
+const buildFingerprintProofFromComponents = (components, discloseKeys) => {
+  const keys = Object.keys(components).sort();
+  if (keys.length === 0) {
+    throw new Error("fingerprint proof: no components to commit to");
+  }
+  const leafHashes = keys.map((key) => {
+    const component = components[key];
+    if (component === void 0) {
+      throw new Error(`fingerprint proof: missing component ${key}`);
+    }
+    return leafHashForContent(componentLeafContent(key, component));
+  });
+  const layers = buildMerkleLayers(leafHashes);
+  const root = merkleRootFromLayers(layers);
+  const disclose = discloseKeys ?? keys;
+  const disclosures = [];
+  for (const key of disclose) {
+    const index = keys.indexOf(key);
+    if (index === -1) {
+      continue;
+    }
+    const component = components[key];
+    const leafHash = leafHashes[index];
+    if (component === void 0 || leafHash === void 0) {
+      continue;
+    }
+    const proof = merkleProofFromLayers(layers, leafHash);
+    disclosures.push(
+      "error" in component ? { key, error: true, proof } : { key, value: component.value, proof }
+    );
+  }
+  return { v: FINGERPRINT_PROOF_VERSION, root, disclosures };
+};
+const verifyFingerprintProofStructure = (proof) => {
+  if (proof.v !== FINGERPRINT_PROOF_VERSION) {
+    return false;
+  }
+  if (typeof proof.root !== "string" || proof.disclosures.length === 0) {
+    return false;
+  }
+  for (const disclosure of proof.disclosures) {
+    const leafHash = leafHashForContent(disclosureLeafContent(disclosure));
+    if (!verifyMerkleProof(leafHash, disclosure.proof)) {
+      return false;
+    }
+    const rootLayer = disclosure.proof[disclosure.proof.length - 1];
+    if (rootLayer === void 0 || rootLayer[0] !== proof.root) {
+      return false;
+    }
+  }
+  return true;
+};
+const encodeFingerprintProof = (proof) => JSON.stringify(proof);
+export {
+  FINGERPRINT_DISCLOSURE_KEYS,
+  FINGERPRINT_PROOF_VERSION,
+  buildFingerprintProofFromComponents,
+  encodeFingerprintProof,
+  leafHashForContent,
+  verifyFingerprintProofStructure
+};

package/dist/proof.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof.js","sourceRoot":"","sources":["../src/proof.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EACN,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACpB,iBAAiB,GACjB,MAAM,aAAa,CAAC;AAErB,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC;AAa3C,MAAM,CAAC,MAAM,2BAA2B,GAAsB;IAC7D,YAAY;IACZ,gBAAgB;IAChB,gBAAgB;IAChB,cAAc;IACd,UAAU;IACV,qBAAqB;IACrB,WAAW;IACX,cAAc;CACd,CAAC;AA+BF,MAAM,SAAS,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;AAK5E,MAAM,oBAAoB,GAAG,CAC5B,GAAW,EACX,SAA6B,EACpB,EAAE;IACX,MAAM,UAAU,GACf,OAAO,IAAI,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAClE,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,UAAU,EAAE,CAAC;AAC1C,CAAC,CAAC;AAEF,MAAM,qBAAqB,GAAG,CAC7B,UAAqC,EAC5B,EAAE;IACX,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK;QAClC,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACpC,OAAO,GAAG,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,UAAU,EAAE,CAAC;AACrD,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AAShF,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAClD,UAA6B,EAC7B,YAAgC,EACb,EAAE;IACrB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACnC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,wCAAwC,GAAG,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,kBAAkB,CAAC,oBAAoB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAE1C,MAAM,QAAQ,GAAG,YAAY,IAAI,IAAI,CAAC;IACtC,MAAM,WAAW,GAAgC,EAAE,CAAC;IACpD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YAClB,SAAS;QACV,CAAC;QACD,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,SAAS,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACvD,SAAS;QACV,CAAC;QACD,MAAM,KAAK,GAAG,qBAAqB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACtD,WAAW,CAAC,IAAI,CACf,OAAO,IAAI,SAAS;YACnB,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE;YAC7B,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,CACzC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,CAAC,EAAE,yBAAyB,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AAC5D,CAAC,CAAC;AAQF,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAC9C,KAAuB,EACb,EAAE;IACZ,IAAI,KAAK,CAAC,CAAC,KAAK,yBAAyB,EAAE,CAAC;QAC3C,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtE,OAAO,KAAK,CAAC;IACd,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC,CAAC;QACvE,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACpD,OAAO,KAAK,CAAC;QACd,CAAC;QACD,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAChE,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;YAC5D,OAAO,KAAK,CAAC;QACd,CAAC;IACF,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,KAAuB,EAAU,EAAE,CACzE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC"}

package/dist/proof.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=proof.test.d.ts.map

package/dist/proof.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof.test.d.ts","sourceRoot":"","sources":["../src/proof.test.ts"],"names":[],"mappings":""}

package/dist/proof.test.js

@@ -0,0 +1,78 @@
+import { describe, expect, it } from "vitest";
+import { buildFingerprintProofFromComponents, verifyFingerprintProofStructure, } from "./proof.js";
+const sampleComponents = () => ({
+    colorDepth: { value: 24, duration: 1 },
+    cookiesEnabled: { value: true, duration: 1 },
+    hardwareConcurrency: { value: 8, duration: 1 },
+    timezone: { value: "UTC+1", duration: 2 },
+    canvas: {
+        value: { winding: true, geometry: "abc", text: "def" },
+        duration: 3,
+    },
+    languages: { value: [["en-GB"], ["en"]], duration: 1 },
+    broken: { error: new Error("source failed"), duration: 0 },
+});
+const HEX_HASH = /^0x[0-9a-f]{64}$/;
+const clone = (proof) => JSON.parse(JSON.stringify(proof));
+describe("fingerprint proof", () => {
+    it("commits to all components and discloses all by default", () => {
+        const proof = buildFingerprintProofFromComponents(sampleComponents());
+        expect(proof.root).toMatch(HEX_HASH);
+        expect(proof.disclosures).toHaveLength(7);
+        const keys = proof.disclosures.map((d) => d.key);
+        expect(keys).toStrictEqual([...keys].sort());
+    });
+    it("represents an errored source as an error leaf with no value", () => {
+        const proof = buildFingerprintProofFromComponents(sampleComponents());
+        const broken = proof.disclosures.find((d) => d.key === "broken");
+        expect(broken?.error).toBe(true);
+        expect(broken && "value" in broken).toBe(false);
+    });
+    it("verifies a freshly built proof", () => {
+        const proof = buildFingerprintProofFromComponents(sampleComponents());
+        expect(verifyFingerprintProofStructure(proof)).toBe(true);
+    });
+    it("verifies a selective disclosure of a subset of components", () => {
+        const proof = buildFingerprintProofFromComponents(sampleComponents(), [
+            "colorDepth",
+            "timezone",
+        ]);
+        expect(proof.disclosures).toHaveLength(2);
+        expect(verifyFingerprintProofStructure(proof)).toBe(true);
+        const full = buildFingerprintProofFromComponents(sampleComponents());
+        expect(proof.root).toBe(full.root);
+    });
+    it("skips requested keys that the fingerprint does not contain", () => {
+        const proof = buildFingerprintProofFromComponents(sampleComponents(), [
+            "colorDepth",
+            "doesNotExist",
+        ]);
+        expect(proof.disclosures.map((d) => d.key)).toStrictEqual(["colorDepth"]);
+        expect(verifyFingerprintProofStructure(proof)).toBe(true);
+    });
+    it("rejects a proof whose disclosed value was tampered with", () => {
+        const proof = clone(buildFingerprintProofFromComponents(sampleComponents()));
+        const target = proof.disclosures.find((d) => d.key === "colorDepth");
+        if (target === undefined) {
+            throw new Error("expected colorDepth disclosure");
+        }
+        target.value = 32;
+        expect(verifyFingerprintProofStructure(proof)).toBe(false);
+    });
+    it("rejects a proof whose root was tampered with", () => {
+        const proof = clone(buildFingerprintProofFromComponents(sampleComponents()));
+        proof.root = `0x${"0".repeat(64)}`;
+        expect(verifyFingerprintProofStructure(proof)).toBe(false);
+    });
+    it("rejects a disclosure carrying a non-sibling leaf's proof", () => {
+        const proof = clone(buildFingerprintProofFromComponents(sampleComponents()));
+        const broken = proof.disclosures.find((d) => d.key === "broken");
+        const timezone = proof.disclosures.find((d) => d.key === "timezone");
+        if (broken === undefined || timezone === undefined) {
+            throw new Error("expected broken and timezone disclosures");
+        }
+        broken.proof = timezone.proof;
+        expect(verifyFingerprintProofStructure(proof)).toBe(false);
+    });
+});
+//# sourceMappingURL=proof.test.js.map

package/dist/proof.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof.test.js","sourceRoot":"","sources":["../src/proof.test.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAEN,mCAAmC,EACnC,+BAA+B,GAC/B,MAAM,YAAY,CAAC;AAEpB,MAAM,gBAAgB,GAAG,GAAsB,EAAE,CAAC,CAAC;IAClD,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE;IACtC,cAAc,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE;IAC5C,mBAAmB,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE;IAC9C,QAAQ,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE;IACzC,MAAM,EAAE;QACP,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE;QACtD,QAAQ,EAAE,CAAC;KACX;IACD,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE;IACtD,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE;CAC1D,CAAC,CAAC;AAEH,MAAM,QAAQ,GAAG,kBAAkB,CAAC;AAEpC,MAAM,KAAK,GAAG,CAAC,KAAuB,EAAoB,EAAE,CAC3D,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAqB,CAAC;AAEvD,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QACjE,MAAM,KAAK,GAAG,mCAAmC,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACtE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAEjD,MAAM,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACtE,MAAM,KAAK,GAAG,mCAAmC,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC;QACjE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,CAAC,MAAM,IAAI,OAAO,IAAI,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACzC,MAAM,KAAK,GAAG,mCAAmC,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACtE,MAAM,CAAC,+BAA+B,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACpE,MAAM,KAAK,GAAG,mCAAmC,CAAC,gBAAgB,EAAE,EAAE;YACrE,YAAY;YACZ,UAAU;SACV,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,CAAC,+BAA+B,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE1D,MAAM,IAAI,GAAG,mCAAmC,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACrE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACrE,MAAM,KAAK,GAAG,mCAAmC,CAAC,gBAAgB,EAAE,EAAE;YACrE,YAAY;YACZ,cAAc;SACd,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;QAC1E,MAAM,CAAC,+BAA+B,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QAClE,MAAM,KAAK,GAAG,KAAK,CAClB,mCAAmC,CAAC,gBAAgB,EAAE,CAAC,CACvD,CAAC;QACF,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,YAAY,CAAC,CAAC;QACrE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC;QAClB,MAAM,CAAC,+BAA+B,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACvD,MAAM,KAAK,GAAG,KAAK,CAClB,mCAAmC,CAAC,gBAAgB,EAAE,CAAC,CACvD,CAAC;QACF,KAAK,CAAC,IAAI,GAAG,KAAK,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;QACnC,MAAM,CAAC,+BAA+B,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QACnE,MAAM,KAAK,GAAG,KAAK,CAClB,mCAAmC,CAAC,gBAAgB,EAAE,CAAC,CACvD,CAAC;QAIF,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC;QACrE,IAAI,MAAM,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,CAAC,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;QAC9B,MAAM,CAAC,+BAA+B,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@prosopo/fingerprint",
-	"version": "2.6.28",
+	"version": "2.7.0",
 	"description": "Provider fingerprint",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",
@@ -22,11 +22,13 @@
 		"build:cross-env": "vite build --config vite.esm.config.ts",
 		"build:tsc": "tsc --build --verbose",
 		"build:cjs": "NODE_ENV=${NODE_ENV:-development}; vite build --config vite.cjs.config.ts --mode $NODE_ENV",
+		"test": "NODE_ENV=${NODE_ENV:-test}; npx vitest run --config ./vite.test.config.ts",
 		"typecheck": "tsc --project tsconfig.types.json"
 	},
 	"repository": {
 		"type": "git",
-		"url": "git+ssh://git@github.com/prosopo/captcha.git"
+		"url": "git+https://github.com/prosopo/captcha.git",
+		"directory": "packages/fingerprint"
 	},
 	"author": "Prosopo Limited",
 	"license": "Apache-2.0",
@@ -35,10 +37,12 @@
 	},
 	"homepage": "https://github.com/prosopo/captcha#readme",
 	"dependencies": {
-		"@fingerprintjs/fingerprintjs": "3.4.2"
+		"@prosopo/fingerprintjs": "5.2.0",
+		"@prosopo/types": "4.7.0",
+		"@prosopo/util-crypto": "13.5.29"
 	},
 	"devDependencies": {
-		"@prosopo/config": "3.3.0",
+		"@prosopo/config": "3.3.2",
 		"@types/node": "22.10.2",
 		"@vitest/coverage-v8": "3.2.4",
 		"concurrently": "9.0.1",

package/src/index.ts

@@ -0,0 +1,105 @@
+// Copyright 2021-2026 Prosopo (UK) Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import type { UnknownComponents } from "@prosopo/fingerprintjs";
+import {
+	type FingerprintProof,
+	buildFingerprintProofFromComponents,
+} from "./proof.js";
+
+// webGlExtensions walks every supported WebGL extension + shader-precision
+// combination, costing 1.5-2s on real GPUs. Dropped from the visitorId hash;
+// webGlBasics still covers vendor/UNMASKED_RENDERER.
+const EXCLUDED_SOURCES = ["webGlExtensions"] as const;
+
+const FingerprintJSImport = async () => import("@prosopo/fingerprintjs");
+
+// Cache the resolved components (the expensive part) rather than just the hash,
+// so the visitorId and the proof are derived from one identical run.
+let componentsCache: Promise<UnknownComponents> | null = null;
+
+const loadComponents = (): Promise<UnknownComponents> => {
+	if (!componentsCache) {
+		const pending = (async () => {
+			const { sources, loadSources, prepareForSources } =
+				await FingerprintJSImport();
+			await prepareForSources();
+			// Structural supertype of every per-source Options shape — fpjs's
+			// `BuiltinSourceOptions` isn't exported.
+			const sourceOptions: { cache: Record<string, unknown>; debug?: boolean } =
+				{
+					cache: {},
+				};
+			const getComponents = loadSources(
+				sources,
+				sourceOptions,
+				EXCLUDED_SOURCES,
+			);
+			return getComponents();
+		})();
+		componentsCache = pending;
+		// Don't cache a rejected run — let the next caller retry.
+		pending.catch(() => {
+			if (componentsCache === pending) {
+				componentsCache = null;
+			}
+		});
+	}
+	return componentsCache;
+};
+
+export const getFingerprint = async (): Promise<string> => {
+	const [{ hashComponents }, components] = await Promise.all([
+		FingerprintJSImport(),
+		loadComponents(),
+	]);
+	return hashComponents(components);
+};
+
+/**
+ * Produce a proof of fingerprint: a Merkle commitment to the full component set
+ * plus a selective disclosure of the requested components. Callers should pass
+ * {@link FINGERPRINT_DISCLOSURE_KEYS} — omitting `discloseKeys` discloses every
+ * component, which produces a very large payload. Derived from the same
+ * component run as {@link getFingerprint}.
+ */
+export const getFingerprintProof = async (
+	discloseKeys?: readonly string[],
+): Promise<FingerprintProof> => {
+	const components = await loadComponents();
+	return buildFingerprintProofFromComponents(components, discloseKeys);
+};
+
+export const prefetchFingerprint = (): void => {
+	loadComponents().catch(() => {
+		/* swallow — loadComponents already clears its own failed cache */
+	});
+};
+
+export type { FingerprintLeafDisclosure, FingerprintProof } from "./proof.js";
+export {
+	FINGERPRINT_DISCLOSURE_KEYS,
+	FINGERPRINT_PROOF_VERSION,
+	buildFingerprintProofFromComponents,
+	encodeFingerprintProof,
+	leafHashForContent,
+	verifyFingerprintProofStructure,
+} from "./proof.js";
+export {
+	buildMerkleLayers,
+	hashMerklePair,
+	merkleProofFromLayers,
+	merkleRootFromLayers,
+	verifyMerkleProof,
+} from "./merkle.js";

package/src/merkle.ts

@@ -0,0 +1,123 @@
+// Copyright 2021-2026 Prosopo (UK) Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import type { MerkleLeaf, MerkleProof, MerkleProofLayer } from "@prosopo/types";
+import { hexHashArray } from "@prosopo/util-crypto";
+
+// A standalone, dependency-light Merkle tree that mirrors the layout of
+// @prosopo/datasets' CaptchaMerkleTree (odd nodes paired with themselves,
+// parent = hexHashArray([left, right])) so the proofs use the shared
+// @prosopo/types MerkleProof shape and the same blake2b-256 hash. Both the
+// browser client and the (closed-source) provider-side validator can rely on
+// the identical pure-JS hashing here, with no WASM and no implementation drift.
+
+const at = <T>(arr: readonly T[], index: number): T => {
+	const value = arr[index];
+	if (value === undefined) {
+		throw new Error(
+			`merkle: index ${index} out of range (length ${arr.length})`,
+		);
+	}
+	return value;
+};
+
+/** Hash a pair of child hashes into their parent. */
+export const hashMerklePair = (left: string, right: string): string =>
+	hexHashArray([left, right]);
+
+/**
+ * Build every layer of the Merkle tree, bottom-up. Layer 0 is the leaf hashes,
+ * the final layer is `[root]`. An odd node at the end of a layer is paired with
+ * itself.
+ */
+export const buildMerkleLayers = (leafHashes: string[]): string[][] => {
+	if (leafHashes.length === 0) {
+		throw new Error("merkle: cannot build a tree with no leaves");
+	}
+	const layers: string[][] = [[...leafHashes]];
+	let current: string[] = leafHashes;
+	while (current.length > 1) {
+		const next: string[] = [];
+		for (let i = 0; i < current.length; i += 2) {
+			const left = at(current, i);
+			const right = i + 1 < current.length ? at(current, i + 1) : left;
+			next.push(hashMerklePair(left, right));
+		}
+		layers.push(next);
+		current = next;
+	}
+	return layers;
+};
+
+export const merkleRootFromLayers = (layers: string[][]): string =>
+	at(at(layers, layers.length - 1), 0);
+
+/** Produce the sibling path proving `leafHash` belongs to the tree. */
+export const merkleProofFromLayers = (
+	layers: string[][],
+	leafHash: MerkleLeaf,
+): MerkleProof => {
+	const proof: MerkleProofLayer[] = [];
+	let hash = leafHash;
+	for (let layerNum = 0; layerNum < layers.length - 1; layerNum++) {
+		const layer = at(layers, layerNum);
+		const index = layer.indexOf(hash);
+		if (index === -1) {
+			throw new Error("merkle: leaf hash not present in layer");
+		}
+		let partnerIndex = index % 2 === 1 ? index - 1 : index + 1;
+		if (partnerIndex > layer.length - 1) {
+			// odd node at the end of the layer is paired with itself
+			partnerIndex = index;
+		}
+		const partner = at(layer, partnerIndex);
+		const pair: MerkleProofLayer =
+			partnerIndex > index ? [hash, partner] : [partner, hash];
+		proof.push(pair);
+		hash = hashMerklePair(pair[0], pair[1]);
+	}
+	return [...proof, [merkleRootFromLayers(layers)]];
+};
+
+/** Verify a leaf + sibling path recomputes to the proof's embedded root. */
+export const verifyMerkleProof = (
+	leafHash: MerkleLeaf,
+	proof: MerkleProof,
+): boolean => {
+	try {
+		const firstLayer = proof[0];
+		if (firstLayer === undefined || firstLayer.indexOf(leafHash) === -1) {
+			return false;
+		}
+		// Single-leaf tree: the only layer is `[root]` and the leaf is the root.
+		if (proof.length === 1) {
+			return at(firstLayer, 0) === leafHash;
+		}
+		const root = at(at(proof, proof.length - 1), 0);
+		let hash = leafHash;
+		for (let i = 0; i < proof.length - 1; i++) {
+			const layer = at(proof, i);
+			if (layer.indexOf(hash) === -1) {
+				return false;
+			}
+			hash = hashMerklePair(at(layer, 0), at(layer, 1));
+			if (at(proof, i + 1).indexOf(hash) === -1) {
+				return false;
+			}
+		}
+		return hash === root;
+	} catch {
+		return false;
+	}
+};

package/src/proof.test.ts

@@ -0,0 +1,119 @@
+// Copyright 2021-2026 Prosopo (UK) Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import type { UnknownComponents } from "@prosopo/fingerprintjs";
+import { describe, expect, it } from "vitest";
+import {
+	type FingerprintProof,
+	buildFingerprintProofFromComponents,
+	verifyFingerprintProofStructure,
+} from "./proof.js";
+
+const sampleComponents = (): UnknownComponents => ({
+	colorDepth: { value: 24, duration: 1 },
+	cookiesEnabled: { value: true, duration: 1 },
+	hardwareConcurrency: { value: 8, duration: 1 },
+	timezone: { value: "UTC+1", duration: 2 },
+	canvas: {
+		value: { winding: true, geometry: "abc", text: "def" },
+		duration: 3,
+	},
+	languages: { value: [["en-GB"], ["en"]], duration: 1 },
+	broken: { error: new Error("source failed"), duration: 0 },
+});
+
+const HEX_HASH = /^0x[0-9a-f]{64}$/;
+
+const clone = (proof: FingerprintProof): FingerprintProof =>
+	JSON.parse(JSON.stringify(proof)) as FingerprintProof;
+
+describe("fingerprint proof", () => {
+	it("commits to all components and discloses all by default", () => {
+		const proof = buildFingerprintProofFromComponents(sampleComponents());
+		expect(proof.root).toMatch(HEX_HASH);
+		expect(proof.disclosures).toHaveLength(7);
+		const keys = proof.disclosures.map((d) => d.key);
+		// disclosures follow the sorted commitment order
+		expect(keys).toStrictEqual([...keys].sort());
+	});
+
+	it("represents an errored source as an error leaf with no value", () => {
+		const proof = buildFingerprintProofFromComponents(sampleComponents());
+		const broken = proof.disclosures.find((d) => d.key === "broken");
+		expect(broken?.error).toBe(true);
+		expect(broken && "value" in broken).toBe(false);
+	});
+
+	it("verifies a freshly built proof", () => {
+		const proof = buildFingerprintProofFromComponents(sampleComponents());
+		expect(verifyFingerprintProofStructure(proof)).toBe(true);
+	});
+
+	it("verifies a selective disclosure of a subset of components", () => {
+		const proof = buildFingerprintProofFromComponents(sampleComponents(), [
+			"colorDepth",
+			"timezone",
+		]);
+		expect(proof.disclosures).toHaveLength(2);
+		expect(verifyFingerprintProofStructure(proof)).toBe(true);
+		// the root still commits to every component, not just the disclosed ones
+		const full = buildFingerprintProofFromComponents(sampleComponents());
+		expect(proof.root).toBe(full.root);
+	});
+
+	it("skips requested keys that the fingerprint does not contain", () => {
+		const proof = buildFingerprintProofFromComponents(sampleComponents(), [
+			"colorDepth",
+			"doesNotExist",
+		]);
+		expect(proof.disclosures.map((d) => d.key)).toStrictEqual(["colorDepth"]);
+		expect(verifyFingerprintProofStructure(proof)).toBe(true);
+	});
+
+	it("rejects a proof whose disclosed value was tampered with", () => {
+		const proof = clone(
+			buildFingerprintProofFromComponents(sampleComponents()),
+		);
+		const target = proof.disclosures.find((d) => d.key === "colorDepth");
+		if (target === undefined) {
+			throw new Error("expected colorDepth disclosure");
+		}
+		target.value = 32;
+		expect(verifyFingerprintProofStructure(proof)).toBe(false);
+	});
+
+	it("rejects a proof whose root was tampered with", () => {
+		const proof = clone(
+			buildFingerprintProofFromComponents(sampleComponents()),
+		);
+		proof.root = `0x${"0".repeat(64)}`;
+		expect(verifyFingerprintProofStructure(proof)).toBe(false);
+	});
+
+	it("rejects a disclosure carrying a non-sibling leaf's proof", () => {
+		const proof = clone(
+			buildFingerprintProofFromComponents(sampleComponents()),
+		);
+		// `broken` and `timezone` are the first and last leaves in sorted order, so
+		// they are not Merkle siblings — `broken`'s leaf does not appear anywhere in
+		// `timezone`'s proof, so lending it that proof must fail verification.
+		const broken = proof.disclosures.find((d) => d.key === "broken");
+		const timezone = proof.disclosures.find((d) => d.key === "timezone");
+		if (broken === undefined || timezone === undefined) {
+			throw new Error("expected broken and timezone disclosures");
+		}
+		broken.proof = timezone.proof;
+		expect(verifyFingerprintProofStructure(proof)).toBe(false);
+	});
+});