browser-commander 0.16.0 → 0.17.0

package/src/fingerprint/cdp-overrides.js

@@ -0,0 +1,176 @@
+/**
+ * Translate a fingerprint profile into CDP `Emulation` commands.
+ *
+ * These are the overrides Chrome itself enforces. They apply to workers and to
+ * outgoing HTTP headers, not only to the main world, which is what makes them
+ * strictly better than patching JavaScript properties. Anything that has no
+ * command here needs a page init script instead; `limitations.js` records why.
+ */
+
+function userAgentMetadata(profile) {
+  const data = profile.userAgentData;
+  if (!data) {
+    return undefined;
+  }
+  // platform, platformVersion, architecture, model and mobile are required by
+  // the protocol; Chrome rejects the command when any of them is missing.
+  const metadata = {
+    platform: data.platform ?? '',
+    platformVersion: data.platformVersion ?? '',
+    architecture: data.architecture ?? '',
+    model: data.model ?? '',
+    mobile: data.mobile ?? false,
+  };
+  if (data.brands) {
+    metadata.brands = data.brands.map((entry) => ({ ...entry }));
+  }
+  if (data.fullVersionList) {
+    metadata.fullVersionList = data.fullVersionList.map((entry) => ({
+      ...entry,
+    }));
+  }
+  if (data.bitness !== undefined) {
+    metadata.bitness = data.bitness;
+  }
+  if (data.fullVersion !== undefined) {
+    // Deprecated in the protocol, but `fullVersionList` does not cover the
+    // `uaFullVersion` hint: without this the page still reads the real Chrome
+    // build number. See analysis-artifacts/ua-hints-detail.json.
+    metadata.fullVersion = data.fullVersion;
+  }
+  if (data.wow64 !== undefined) {
+    metadata.wow64 = data.wow64;
+  }
+  if (data.formFactors !== undefined) {
+    metadata.formFactors = [...data.formFactors];
+  }
+  return metadata;
+}
+
+function emulatedMediaFeatures(profile) {
+  const features = [];
+  if (profile.reducedMotion !== undefined) {
+    features.push({
+      name: 'prefers-reduced-motion',
+      value: profile.reducedMotion,
+    });
+  }
+  if (profile.forcedColors !== undefined) {
+    features.push({ name: 'forced-colors', value: profile.forcedColors });
+  }
+  if (profile.colorScheme !== undefined) {
+    features.push({ name: 'prefers-color-scheme', value: profile.colorScheme });
+  }
+  return features;
+}
+
+function deviceMetrics(profile) {
+  const { viewport, screen } = profile;
+  if (!viewport && !screen) {
+    return undefined;
+  }
+  const params = {
+    // 0 means "no override" for the viewport, so a profile that only sets
+    // screen dimensions still leaves the real window size alone.
+    width: viewport?.width ?? 0,
+    height: viewport?.height ?? 0,
+    deviceScaleFactor: viewport?.deviceScaleFactor ?? 0,
+    mobile: viewport?.mobile ?? false,
+  };
+  if (screen?.width !== undefined) {
+    params.screenWidth = screen.width;
+    params.screenHeight = screen.height;
+  }
+  return params;
+}
+
+/**
+ * Build the ordered CDP command list for a profile.
+ *
+ * @param {object} profile Normalized fingerprint profile.
+ * @returns {Array<{method: string, params: object}>} Commands to send in order.
+ */
+export function buildCdpEmulationCommands(profile) {
+  if (!profile || typeof profile !== 'object') {
+    throw new TypeError('profile must be a normalized fingerprint profile');
+  }
+  const commands = [];
+
+  if (profile.userAgent !== undefined || profile.acceptLanguage !== undefined) {
+    const params = {};
+    if (profile.userAgent !== undefined) {
+      params.userAgent = profile.userAgent;
+    }
+    if (profile.acceptLanguage !== undefined) {
+      params.acceptLanguage = profile.acceptLanguage;
+    }
+    if (profile.platform !== undefined) {
+      params.platform = profile.platform;
+    }
+    const metadata = userAgentMetadata(profile);
+    if (metadata) {
+      params.userAgentMetadata = metadata;
+    }
+    // userAgent is a required parameter even when only the language changes.
+    if (params.userAgent === undefined) {
+      params.userAgent = '';
+    }
+    commands.push({ method: 'Emulation.setUserAgentOverride', params });
+  }
+
+  if (profile.timezoneId !== undefined) {
+    commands.push({
+      method: 'Emulation.setTimezoneOverride',
+      params: { timezoneId: profile.timezoneId },
+    });
+  }
+
+  if (profile.locale !== undefined) {
+    commands.push({
+      method: 'Emulation.setLocaleOverride',
+      params: { locale: profile.locale },
+    });
+  }
+
+  if (profile.hardwareConcurrency !== undefined) {
+    commands.push({
+      method: 'Emulation.setHardwareConcurrencyOverride',
+      params: { hardwareConcurrency: profile.hardwareConcurrency },
+    });
+  }
+
+  const metrics = deviceMetrics(profile);
+  if (metrics) {
+    commands.push({
+      method: 'Emulation.setDeviceMetricsOverride',
+      params: metrics,
+    });
+  }
+
+  if (profile.maxTouchPoints !== undefined) {
+    commands.push({
+      method: 'Emulation.setTouchEmulationEnabled',
+      params: {
+        enabled: profile.maxTouchPoints > 0,
+        maxTouchPoints: Math.max(profile.maxTouchPoints, 1),
+      },
+    });
+  }
+
+  const features = emulatedMediaFeatures(profile);
+  if (features.length > 0) {
+    commands.push({
+      method: 'Emulation.setEmulatedMedia',
+      params: { features },
+    });
+  }
+
+  if (profile.geolocation !== undefined) {
+    commands.push({
+      method: 'Emulation.setGeolocationOverride',
+      params: { ...profile.geolocation },
+    });
+  }
+
+  return commands;
+}

package/src/fingerprint/derive.js

@@ -0,0 +1,104 @@
+/**
+ * Derive User-Agent Client Hints from a User-Agent string.
+ *
+ * This exists because of a measured trap: `Emulation.setUserAgentOverride`
+ * replaces the whole identity, so overriding `userAgent` *without*
+ * `userAgentMetadata` leaves `navigator.userAgentData.brands` empty and
+ * `getHighEntropyValues(['fullVersionList'])` returning `[]`. A real browser
+ * never reports that combination, so a bare UA override is a louder automation
+ * signal than the default UA it replaced. See
+ * `docs/case-studies/issue-79/analysis-artifacts/ua-hints-detail.json`.
+ *
+ * Deriving is best effort. Chrome's GREASE brand -- the `Not=A?Brand` entry --
+ * is generated from a per-version permutation table that this module does not
+ * reproduce; `limitations.js` records that.
+ */
+
+const CHROME_VERSION = /Chrome\/(\d+)(?:\.(\d+)\.(\d+)\.(\d+))?/u;
+
+const GREASE_BRAND = 'Not=A?Brand';
+const GREASE_VERSION = '24';
+
+function platformFromUserAgent(userAgent) {
+  if (/Windows NT/u.test(userAgent)) {
+    return { platform: 'Windows', architecture: 'x86', bitness: '64' };
+  }
+  if (/Android/u.test(userAgent)) {
+    return { platform: 'Android', architecture: '', bitness: '' };
+  }
+  if (/(Macintosh|Mac OS X)/u.test(userAgent)) {
+    return { platform: 'macOS', architecture: 'arm', bitness: '64' };
+  }
+  if (/CrOS/u.test(userAgent)) {
+    return { platform: 'Chrome OS', architecture: 'x86', bitness: '64' };
+  }
+  if (/(X11|Linux)/u.test(userAgent)) {
+    return { platform: 'Linux', architecture: 'x86', bitness: '64' };
+  }
+  return { platform: '', architecture: '', bitness: '' };
+}
+
+function platformVersionFromUserAgent(userAgent, platform) {
+  if (platform === 'Windows') {
+    // Chrome freezes the UA string at "Windows NT 10.0" and moves the real
+    // version into the platformVersion hint: 13+ means Windows 11.
+    return /Windows NT 10\.0/u.test(userAgent) ? '15.0.0' : '0.0.0';
+  }
+  if (platform === 'macOS') {
+    const match = /Mac OS X (\d+)[._](\d+)(?:[._](\d+))?/u.exec(userAgent);
+    return match ? `${match[1]}.${match[2]}.${match[3] || '0'}` : '';
+  }
+  if (platform === 'Android') {
+    const match = /Android (\d+(?:\.\d+)*)/u.exec(userAgent);
+    return match ? match[1] : '';
+  }
+  return '';
+}
+
+/**
+ * Build a complete `userAgentData` block for a Chrome User-Agent string.
+ *
+ * @param {string} userAgent A Chrome or Chromium User-Agent string.
+ * @returns {object|null} Client hints, or `null` when the string does not name
+ *   a Chrome version and there is nothing trustworthy to derive.
+ */
+export function deriveUserAgentData(userAgent) {
+  if (typeof userAgent !== 'string') {
+    throw new TypeError('userAgent must be a string');
+  }
+  const version = CHROME_VERSION.exec(userAgent);
+  if (!version) {
+    return null;
+  }
+  const major = version[1];
+  const full = version[2]
+    ? version[0].slice('Chrome/'.length)
+    : `${major}.0.0.0`;
+  const { platform, architecture, bitness } = platformFromUserAgent(userAgent);
+  const mobile = /Mobile/u.test(userAgent);
+  const model = mobile
+    ? (/; ([^;)]+) Build\//u.exec(userAgent)?.[1] ?? '')
+    : '';
+
+  return {
+    brands: [
+      { brand: 'Chromium', version: major },
+      { brand: 'Google Chrome', version: major },
+      { brand: GREASE_BRAND, version: GREASE_VERSION },
+    ],
+    fullVersionList: [
+      { brand: 'Chromium', version: full },
+      { brand: 'Google Chrome', version: full },
+      { brand: GREASE_BRAND, version: `${GREASE_VERSION}.0.0.0` },
+    ],
+    fullVersion: full,
+    platform,
+    platformVersion: platformVersionFromUserAgent(userAgent, platform),
+    architecture,
+    bitness,
+    model,
+    mobile,
+    wow64: false,
+    formFactors: [mobile ? 'Mobile' : 'Desktop'],
+  };
+}

package/src/fingerprint/init-payload.js

@@ -0,0 +1,181 @@
+/**
+ * Shared fingerprint init payload -- the one copy the three implementations run.
+ *
+ * This file is not a module. It is source text: every implementation reads it
+ * verbatim and sends it to `Page.addScriptToEvaluateOnNewDocument`, which runs
+ * a classic script, so it must contain no `import` and no `export`.
+ *
+ * The same bytes live in three places, because npm, PyPI and crates.io each
+ * package one directory and none of them can reference a file outside it:
+ *
+ * - js/src/fingerprint/init-payload.js
+ * - python/src/browser_commander/fingerprint/init_payload.js
+ * - rust/src/fingerprint/init_payload.js
+ *
+ * `scripts/check-shared-fingerprint-assets.sh` fails the build when they differ.
+ * Editing one and forgetting the others is the failure mode that rotted
+ * selenium-stealth and playwright_stealth -- see
+ * docs/case-studies/issue-79/prior-art.md -- so the check exists to make a
+ * silent divergence impossible rather than unlikely.
+ */
+
+/**
+ * Runs inside the page, before any page script, in every frame.
+ *
+ * @param {object} config Plain JSON produced by `buildInitScriptConfig`.
+ */
+function fingerprintPayload(config) {
+  const scope = globalThis;
+  // Playwright and Puppeteer both re-inject init scripts on same-document
+  // navigations in some versions; patching twice would stack getters and make
+  // the descriptor chain observable.
+  const marker = '__browserCommanderFingerprint';
+  if (scope[marker]) {
+    return;
+  }
+  Object.defineProperty(scope, marker, {
+    value: true,
+    configurable: true,
+    enumerable: false,
+    writable: false,
+  });
+
+  const nativeSources = new WeakMap();
+  const functionToString = Function.prototype.toString;
+  const objectDefineProperty = Object.defineProperty;
+
+  /** Make a replacement report `[native code]`, like the accessor it replaces. */
+  function asNative(fn, name) {
+    try {
+      objectDefineProperty(fn, 'name', {
+        value: name,
+        configurable: true,
+        enumerable: false,
+        writable: false,
+      });
+    } catch {
+      // A frozen function name is not worth failing the whole patch over.
+    }
+    nativeSources.set(fn, `function ${name}() { [native code] }`);
+    return fn;
+  }
+
+  const patchedToString = function toString() {
+    const source = nativeSources.get(this);
+    return source === undefined ? functionToString.call(this) : source;
+  };
+  nativeSources.set(patchedToString, functionToString.call(functionToString));
+  Function.prototype.toString = patchedToString;
+
+  /**
+   * Replace a native accessor on a prototype, keeping the shape a real one has:
+   * an enumerable, configurable getter with no setter, named `get <property>`.
+   */
+  function defineNativeGetter(target, property, produce) {
+    if (!target) {
+      return;
+    }
+    const descriptor = Object.getOwnPropertyDescriptor(target, property);
+    if (descriptor && !descriptor.configurable) {
+      return;
+    }
+    const getter = asNative(() => produce(), `get ${property}`);
+    try {
+      objectDefineProperty(target, property, {
+        get: getter,
+        set: undefined,
+        enumerable: descriptor ? descriptor.enumerable : true,
+        configurable: true,
+      });
+    } catch {
+      // Some engines refuse redefinition on cross-origin-ish prototypes.
+    }
+  }
+
+  const navigatorPrototype = scope.Navigator && scope.Navigator.prototype;
+  const workerNavigatorPrototype =
+    scope.WorkerNavigator && scope.WorkerNavigator.prototype;
+
+  function defineNavigator(property, value) {
+    defineNativeGetter(navigatorPrototype, property, () => value);
+    defineNativeGetter(workerNavigatorPrototype, property, () => value);
+  }
+
+  if (config.webdriver !== undefined) {
+    defineNavigator('webdriver', config.webdriver);
+  }
+  if (config.deviceMemory !== undefined) {
+    defineNavigator('deviceMemory', config.deviceMemory);
+  }
+  if (config.hardwareConcurrency !== undefined) {
+    defineNavigator('hardwareConcurrency', config.hardwareConcurrency);
+  }
+  if (config.vendor !== undefined) {
+    defineNavigator('vendor', config.vendor);
+  }
+  if (config.platform !== undefined) {
+    defineNavigator('platform', config.platform);
+  }
+  if (config.maxTouchPoints !== undefined) {
+    defineNavigator('maxTouchPoints', config.maxTouchPoints);
+  }
+  if (config.doNotTrack !== undefined) {
+    defineNativeGetter(
+      navigatorPrototype,
+      'doNotTrack',
+      () => config.doNotTrack
+    );
+  }
+  if (config.languages !== undefined) {
+    // navigator.languages is a frozen array in Chrome; hand out a fresh frozen
+    // copy so page code cannot mutate the one we hold.
+    defineNavigator('language', config.languages[0]);
+    defineNativeGetter(navigatorPrototype, 'languages', () =>
+      Object.freeze(config.languages.slice())
+    );
+    defineNativeGetter(workerNavigatorPrototype, 'languages', () =>
+      Object.freeze(config.languages.slice())
+    );
+  }
+
+  const screenPrototype = scope.Screen && scope.Screen.prototype;
+  if (config.screen) {
+    for (const property of Object.keys(config.screen)) {
+      const value = config.screen[property];
+      defineNativeGetter(screenPrototype, property, () => value);
+    }
+  }
+
+  if (config.webgl) {
+    // 0x9245/0x9246 are UNMASKED_VENDOR_WEBGL and UNMASKED_RENDERER_WEBGL from
+    // the WEBGL_debug_renderer_info extension; 0x1F00/0x1F01 are the plain
+    // VENDOR and RENDERER constants that need no extension at all.
+    const replacements = new Map();
+    if (config.webgl.unmaskedVendor !== undefined) {
+      replacements.set(0x9245, config.webgl.unmaskedVendor);
+    }
+    if (config.webgl.unmaskedRenderer !== undefined) {
+      replacements.set(0x9246, config.webgl.unmaskedRenderer);
+    }
+    if (config.webgl.vendor !== undefined) {
+      replacements.set(0x1f00, config.webgl.vendor);
+    }
+    if (config.webgl.renderer !== undefined) {
+      replacements.set(0x1f01, config.webgl.renderer);
+    }
+    for (const name of ['WebGLRenderingContext', 'WebGL2RenderingContext']) {
+      const prototype = scope[name] && scope[name].prototype;
+      if (!prototype || typeof prototype.getParameter !== 'function') {
+        continue;
+      }
+      const original = prototype.getParameter;
+      const patched = asNative(function getParameter(parameter) {
+        if (replacements.has(parameter)) {
+          return replacements.get(parameter);
+        }
+        return original.call(this, parameter);
+      }, 'getParameter');
+      prototype.getParameter = patched;
+    }
+  }
+}

package/src/fingerprint/init-script.js

@@ -0,0 +1,104 @@
+/**
+ * Page init script for the fingerprint surfaces CDP cannot override.
+ *
+ * Everything here is strictly worse than a browser-enforced override: a
+ * JavaScript patch is visible to anyone who inspects the property descriptor
+ * carefully enough, and it does not reach workers or HTTP headers. It exists
+ * only for fields the `Emulation` domain has no command for -- see
+ * `limitations.js` for the measured list -- and for `connectBrowser`, where the
+ * launch switches were already fixed by whoever started the browser.
+ *
+ * The payload itself lives in `init-payload.js` and is read as source text
+ * rather than serialized from a function in this file, because Python and Rust
+ * run the same bytes. `String(fn)` has no equivalent there, and a hand
+ * translation of a patch this delicate would drift within a release.
+ */
+import { readFileSync } from 'node:fs';
+
+/** The shared payload source, read once at import time. */
+export const FINGERPRINT_PAYLOAD_SOURCE = readFileSync(
+  new URL('./init-payload.js', import.meta.url),
+  'utf8'
+);
+
+const SCREEN_FIELDS = [
+  'width',
+  'height',
+  'availWidth',
+  'availHeight',
+  'colorDepth',
+  'pixelDepth',
+];
+
+/**
+ * Decide what the init script still has to do once the browser-side overrides
+ * have been applied.
+ *
+ * @param {object} profile Normalized fingerprint profile.
+ * @param {object} [options]
+ * @param {boolean} [options.patchWebdriver] Force `navigator.webdriver` to
+ *   `false` from JavaScript. Only needed when the browser was launched by
+ *   somebody else and the automation switches can no longer be changed.
+ * @param {boolean} [options.patchLanguages] Also patch `navigator.languages`.
+ * @returns {object|null} Config for the payload, or `null` when nothing is left.
+ */
+export function buildInitScriptConfig(profile, options = {}) {
+  const config = {};
+
+  if (options.patchWebdriver) {
+    config.webdriver = false;
+  }
+  if (profile.deviceMemory !== undefined) {
+    config.deviceMemory = profile.deviceMemory;
+  }
+  if (profile.vendor !== undefined) {
+    config.vendor = profile.vendor;
+  }
+  if (profile.doNotTrack !== undefined) {
+    config.doNotTrack = profile.doNotTrack;
+  }
+  if (options.patchLanguages && profile.languages !== undefined) {
+    config.languages = [...profile.languages];
+  }
+  if (profile.webgl !== undefined) {
+    config.webgl = { ...profile.webgl };
+  }
+  if (profile.screen !== undefined) {
+    const screen = {};
+    for (const field of SCREEN_FIELDS) {
+      if (profile.screen[field] !== undefined) {
+        screen[field] = profile.screen[field];
+      }
+    }
+    // width and height are already enforced by setDeviceMetricsOverride; the
+    // avail*/depth fields are not, so only those need patching.
+    delete screen.width;
+    delete screen.height;
+    if (Object.keys(screen).length > 0) {
+      config.screen = screen;
+    }
+  }
+
+  return Object.keys(config).length > 0 ? config : null;
+}
+
+/**
+ * Serialize the init script for a profile.
+ *
+ * @param {object} profile Normalized fingerprint profile.
+ * @param {object} [options] See `buildInitScriptConfig`.
+ * @returns {string|null} Script source, or `null` when no patching is needed.
+ */
+export function buildFingerprintInitScript(profile, options = {}) {
+  if (!profile || typeof profile !== 'object') {
+    throw new TypeError('profile must be a normalized fingerprint profile');
+  }
+  const config = buildInitScriptConfig(profile, options);
+  if (!config) {
+    return null;
+  }
+  // The payload is wrapped in an IIFE so the declaration never becomes a
+  // property of the page's global object; a stray `fingerprintPayload` global
+  // would be a far louder signal than anything the payload hides.
+  return `(() => {\n${FINGERPRINT_PAYLOAD_SOURCE}\nfingerprintPayload(${JSON.stringify(config)});\n})();`;
+}

package/src/fingerprint/limitations.js

@@ -0,0 +1,107 @@
+/**
+ * What Browser Commander cannot make identical, and why.
+ *
+ * Issue 79 asks for the limitations to be stated clearly rather than implied,
+ * so every entry here names the surface, the mechanism that would be needed,
+ * the privacy consequence, and the evidence it rests on. Entries marked
+ * `measured` were reproduced in this repository; the artifacts are under
+ * `docs/case-studies/issue-79/analysis-artifacts/`.
+ *
+ * The catalogue itself lives in `limitations.json`, because Python and Rust
+ * publish the same eleven entries and a hand-copied paragraph of prose drifts
+ * as easily as a hand-copied patch. This module owns the JSON; the copies are
+ * checked byte for byte by `scripts/check-shared-fingerprint-assets.sh`.
+ *
+ * `severity` describes how much the limitation helps someone identify the
+ * browser as automated or as a specific machine:
+ * - `high`: on its own it identifies automation or the physical machine.
+ * - `medium`: it is a strong signal when combined with others.
+ * - `low`: it narrows the field but is common in real browsers too.
+ */
+import { readFileSync } from 'node:fs';
+
+/**
+ * @typedef {object} FingerprintLimitation
+ * @property {string} id Stable identifier.
+ * @property {string} surface What the page can observe.
+ * @property {'high'|'medium'|'low'} severity
+ * @property {'measured'|'documented'} evidence
+ * @property {string} detail What happens and why it cannot be fixed here.
+ * @property {string} [workaround] What a caller can do about it.
+ * @property {string} [reference] Artifact, source file or specification.
+ */
+
+/** @type {ReadonlyArray<FingerprintLimitation>} */
+export const FINGERPRINT_LIMITATIONS = Object.freeze(
+  JSON.parse(
+    readFileSync(new URL('./limitations.json', import.meta.url), 'utf8')
+  ).map((limitation) => Object.freeze(limitation))
+);
+
+/**
+ * Look a limitation up by id.
+ *
+ * @param {string} id
+ * @returns {FingerprintLimitation|undefined}
+ */
+export function findFingerprintLimitation(id) {
+  return FINGERPRINT_LIMITATIONS.find((limitation) => limitation.id === id);
+}
+
+/**
+ * Limitations that apply to a specific profile.
+ *
+ * A profile that never touches WebGL does not need to hear about the WebGL
+ * limitation, and hiding the irrelevant entries is what makes the relevant ones
+ * worth reading.
+ *
+ * @param {object} profile Normalized fingerprint profile.
+ * @param {object} [options]
+ * @param {boolean} [options.headless] Whether the browser runs headless.
+ * @param {boolean} [options.attached] Whether the browser was launched by
+ *   somebody else, so the automation switches are already fixed.
+ * @returns {ReadonlyArray<FingerprintLimitation>}
+ */
+export function relevantFingerprintLimitations(profile = {}, options = {}) {
+  const always = new Set([
+    'canvas-audio-font-follow-the-host',
+    'network-layer-not-covered',
+  ]);
+  const conditions = {
+    'automation-controlled-is-launch-only': () => options.attached === true,
+    'no-cdp-device-memory-override': () => profile.deviceMemory !== undefined,
+    'no-cdp-vendor-or-dnt-override': () =>
+      profile.vendor !== undefined || profile.doNotTrack !== undefined,
+    'screen-depth-and-avail-not-emulated': () =>
+      profile.screen !== undefined &&
+      (profile.screen.colorDepth !== undefined ||
+        profile.screen.pixelDepth !== undefined ||
+        profile.screen.availWidth !== undefined ||
+        profile.screen.availHeight !== undefined),
+    'webgl-strings-only': () => profile.webgl !== undefined,
+    'grease-brand-not-reproduced': () => profile.userAgentData !== undefined,
+    'touch-emulation-changes-pointer-media': () =>
+      profile.maxTouchPoints !== undefined && profile.maxTouchPoints > 0,
+    'headless-is-distinguishable': () => options.headless === true,
+    // Everything a worker reads differently from its document: the fields no
+    // override reaches, plus the ones the page session keeps to itself.
+    'init-script-does-not-reach-workers': () =>
+      [
+        'deviceMemory',
+        'vendor',
+        'doNotTrack',
+        'webgl',
+        'platform',
+        'languages',
+        'hardwareConcurrency',
+      ].some((field) => profile[field] !== undefined),
+  };
+
+  return Object.freeze(
+    FINGERPRINT_LIMITATIONS.filter(
+      (limitation) =>
+        always.has(limitation.id) ||
+        (conditions[limitation.id] ? conditions[limitation.id]() : false)
+    )
+  );
+}