device-passport 1.0.0 → 1.2.0

package/CHANGELOG.md

@@ -5,6 +5,39 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.2.0] - 2026-11-14
+
+### Added
+- **ego-lite account profile layer** (`device-passport/ego`): `AccountProfileManager` maps one account (seed) onto a sticky passport, an ego-lite profile binding and a proxy declaration. It lists the profiles ego-lite already has (there is no create-profile API), binds an account to one of them, and produces a complete launch plan — ordered CDP commands, init scripts, canonical headers, the `profileId`, and the proxy declaration. The proxy is modelled as a declared *gap*, not a feature: ego-lite has no browser-level proxy API (CDP has no `Browser.setProxySettings`, `--proxy-server` is a launch flag rather than a CDP command, and the native bindings expose no proxy setter), so a profile reports `ready` only when a proxy is declared and `missing-proxy` otherwise, and every plan repeats `proxy.bound` / `proxy.resolution === 'system-level'` so an unbound proxy can never be mistaken for an effective one. The proxy must be bound outside the browser (OS proxy / TUN / local forwarder). The passports are persisted with the same durability as the account records, so a restart cannot silently regenerate a persona with a different geo context while keeping the same passport id.
+- **`passportStore` option on `AccountProfileManager`**: account records and personas are two different kinds of state. Persisting only the records left the persona living in memory, so a restart regenerated it from the default geo — the identity drifted while its `id` stayed the same and no caller could tell. The option makes the persona survive a restart for real, and `createSessionPlan()` now aligns the persona's geo context with the declared proxy country so the browser's claimed country and the traffic's exit country cannot diverge.
+- **`EgoSessionPlan` now extends `CdpPassportPlan`**: re-declaring `commands` / `initScripts` / `headers` let the two shapes drift apart and silently dropped `stealthScript` from the plan. The plan also carries its `sessionId` on the init script itself, so a caller that sends `plan.initScripts` directly cannot drop it.
+- **Single source for the profile id**: the session plan takes the profile id from the persisted account record only. Accepting a caller-supplied profile id as well let the plan's profile id and its readiness disagree, and a session could be launched under a profile that was never validated.
+
+## [1.1.0] - 2026-11-04
+
+
+### Added
+- **Pixel-level protection**: `getStealthScript()` now appends a deterministic noise layer that patches `canvas.toDataURL()`, `getImageData()`, `gl.readPixels()` and the audio analyser, so read-back no longer exposes the host GPU or a shared hash across personas. The noise is derived from the passport seed — stable per account, distinct per account — and uses discrete quantization levels rather than per-pixel dithering, because a smooth ±1 RGB jitter is itself a fingerprint.
+- **Raw CDP adapter**: `getCdpPlan()` and `applyCdpPassport()` emit an ordered, transport-agnostic Chrome DevTools Protocol command plan for tools that speak bare CDP (e.g. `lite-browser`'s `cdp` channel). Covers headers, `Emulation.setUserAgentOverride` with Client-Hints metadata, timezone, locale, device metrics, touch emulation and init-script installation.
+
+### Fixed
+- **Type-check baseline was red**: `bun run lint` failed on a clean checkout — `toGeoLocation()` dereferenced the optional `GeoContext.coordinates`, and `createPassport()` called the synchronous storage helpers that the `StorageAdapter` interface never declared. The sync capability is now declared on the interface as optional, and `toGeoLocation()` falls back to the country's representative coordinates so an emulated geolocation can never contradict the country/timezone pairing.
+- **`tsconfig.json` rejected by modern TypeScript**: the deprecated `baseUrl` option (unused — the `@/*` alias has no importers) broke `tsc --noEmit` on TypeScript 6, and node globals were unresolvable because `types` was never declared. Both are fixed, so the lint gate passes on TypeScript 5 and 6 alike.
+- **Canvas serialization recursion**: the temporary canvas used for re-serialization shares the patched prototype, so calling its `toDataURL` recursed until the stack limit. Serialization now uses the captured original method (verified with 25 repeated calls in real Chromium).
+- **WebGL canvases leaked the real framebuffer through `toDataURL()`**: a canvas with a WebGL context returns `null` from `getContext('2d')`, so that path silently skipped protection. Pixel perturbation now runs through `gl.readPixels` for such canvases.
+- **Alpha bytes were perturbed**: RGBA alpha now stays untouched, so transparent and opaque pixels keep their semantics (masks and hit-testing unaffected).
+- **Audio perturbation was seed-independent**: a fixed `1e-7` step was identical for every persona and rounded away in Float32 at typical dB values. The step is now seed-derived and representable.
+- **Injected stealth script was invalid JavaScript**: the runtime script embedded TypeScript-only syntax (`navigator as any`), which raised a `SyntaxError` in the page and silently disabled the **entire** stealth layer — `navigator.webdriver` stayed `true` and every spoofed API reverted to the real values. The script is now valid browser JavaScript, and a regression test parses it to prevent this from returning.
+- **CDP init scripts never executed**: `Page.addScriptToEvaluateOnNewDocument` was issued without `Page.enable`. Chrome accepted the script, returned an identifier and then never ran it, so a CDP-driven persona looked like a plain automation session. `Page.enable` is now emitted first, with a regression test covering the ordering.
+
+## [1.0.1] - 2026-10-17
+
+### Added
+- **Standard ESM subpath exports**: `device-passport/geo`, `device-passport/storage`, `device-passport/adapters` are now importable as separate entry points, each shipping its own `types` / `import` / `require` conditions. Consumers can tree-shake by pulling only the module they need instead of the whole bundle.
+
+### Fixed
+- **npm publish path**: the release workflow now runs on Node 24 with pure OIDC Trusted Publishing (the previous `NODE_AUTH_TOKEN` pointed at a secret that was never configured, which forced npm down the token-auth path and made Trusted Publishing ineffective).
+
 ## [1.0.0] - 2026-10-17
 
 ### Added

package/README.md

@@ -1,5 +1,5 @@
 <p align="center">
-  <img src="assets/banner.svg" alt="device-passport banner" width="800"/>
+  <img src="https://cdn.jsdelivr.net/gh/webkubor/free-imgbed@main/device-passport/banner.svg" alt="device-passport banner" width="800"/>
 </p>
 
 <h1 align="center">🛂 device-passport</h1>
@@ -59,7 +59,7 @@ Modern anti-bot classifiers (Cloudflare Turnstile, DataDome, Akamai, GitHub Anti
    Under-parameterized headers ($H(X) < 4.6$ bits/char) scream "naive scraper"; chaotic randomized noise ($H(X) > 5.6$ bits/char) screams "evasion bot". `device-passport` operates strictly within the natural human entropy equilibrium ($5.24$ bits/char).
 
 <p align="center">
-  <img src="assets/architecture.svg" alt="device-passport formal state-space architecture" width="100%"/>
+  <img src="https://cdn.jsdelivr.net/gh/webkubor/free-imgbed@main/device-passport/architecture.svg" alt="device-passport formal state-space architecture" width="100%"/>
 </p>
 
 ---
@@ -292,6 +292,60 @@ await passport.injectToPuppeteer(page);
 await page.goto('https://bot.sannysoft.com');
 ```
 
+### Raw CDP Integration (lite-browser, custom transports)
+
+Tools that drive Chrome over a bare DevTools Protocol socket cannot use the Playwright or
+Puppeteer adapters, because those return framework-shaped options. `getCdpPlan()` returns
+an ordered, transport-agnostic command plan instead:
+
+```typescript
+import { createPassport, applyCdpPassport } from 'device-passport';
+
+const passport = createPassport({ seed: 'worker_de_19', geo: 'DE', os: 'windows' });
+
+// `send` is yours: a WebSocket, stdio, or an in-process socket.
+await applyCdpPassport(passport, (cmd) => transport.send(cmd.method, cmd.params));
+```
+
+The plan covers `Page.enable`, extra HTTP headers, `Emulation.setUserAgentOverride`
+(with Client-Hints metadata), timezone, locale, device metrics and touch emulation, and
+installs the stealth script through `Page.addScriptToEvaluateOnNewDocument`.
+
+> **`Page.enable` is mandatory.** Without it Chrome accepts the init script, returns an
+> identifier, and then never runs it — the persona stays a plain automation session.
+> `applyCdpPassport` emits it first for that reason.
+
+---
+
+## Pixel-Level Protection
+
+API-level spoofing is not sufficient on its own. `canvas.toDataURL()` and
+`gl.readPixels()` hand back the **real** framebuffer, so a headless browser exposes
+SwiftShader while its User-Agent claims a discrete GPU — and every persona rendered on
+the same machine produces a **byte-identical** canvas hash, which makes a fleet easy to
+cluster.
+
+`getStealthScript()` now appends a deterministic pixel-protection layer that patches
+`toDataURL`, `getImageData`, `readPixels` and the audio analyser:
+
+```typescript
+import { createPassport, getStealthScript } from 'device-passport';
+
+const passport = createPassport('alice');
+const script = getStealthScript(passport);
+// Use with Playwright addInitScript, Puppeteer evaluateOnNewDocument, or CDP.
+```
+
+Properties:
+
+- **Deterministic per seed** — the same account reads back identical pixels forever,
+  which is what makes "sticky hardware" true beyond the API layer.
+- **Distinct per account** — different seeds produce different noise tables.
+- **Plausible** — a discrete quantization of a few levels, not per-pixel dithering. Real
+  GPUs quantize; a smooth ±1 RGB jitter on every pixel is itself a fingerprint.
+- **Self-contained** — dependency-free IIFE, safe to inject repeatedly (re-injection is
+  a no-op).
+
 ---
 
 ## Multi-Account Fleet Management (`PassportManager`)
@@ -323,6 +377,47 @@ const fleetSnapshot = await manager.exportAll();
 
 ---
 
+## ego-lite Account Profiles (`AccountProfileManager`)
+
+![device-passport ego-lite account profile manager — real run output](assets/ego-profile-manager.png)
+
+When the browser is [ego-lite](https://github.com/citrolabs/ego-lite), one account maps to three things that must travel together: a sticky passport, an ego-lite **profile** binding (cookies and login state persist per profile), and a **proxy declaration**.
+
+```typescript
+import { AccountProfileManager } from 'device-passport/ego';
+
+const manager = new AccountProfileManager({
+  store: './data/accounts.json',   // atomic JSON persistence
+  // bridge: egoLiteBridge,          // optional; inject ego-lite's native bridge
+});
+
+// List the profiles ego-lite already has — there is no create-profile API.
+const profiles = await manager.listEgoProfiles();   // [{ id, name, isDefault }]
+
+// Bind one account (seed) to one profile and declare its proxy.
+await manager.bindProfile('account_9041', {
+  profileId: 'Profile 2',
+  proxy: { url: 'http://user-jp:pass@gate.example.com:7000', description: 'Tokyo residential exit', country: 'JP' },
+});
+
+// The complete launch plan: CDP commands, init scripts, headers, profileId, proxy declaration.
+const plan = await manager.createSessionPlan('account_9041');
+plan.readiness;   // 'ready' | 'missing-proxy' | 'missing-profile'
+plan.launchable;  // true only when a proxy is declared
+```
+
+### ⚠️ The proxy gap, stated plainly
+
+**ego-lite cannot configure a proxy at the browser layer, and neither can this library.**
+
+- CDP has no `Browser.setProxySettings` — Chromium has never shipped one.
+- `--proxy-server` is a browser **launch** flag on the process, not a CDP command; it cannot be changed after the profile is running.
+- ego-lite's native bindings expose no proxy setter either.
+
+A proxy is therefore bound **outside the browser**: at the OS level (system proxy / TUN / transparent redirect), or by routing the ego-lite process through a local forwarder that owns the upstream proxy. This layer refuses to fake it: an account profile is `ready` only when a proxy is **declared**, `missing-proxy` otherwise, and every session plan repeats that state (`plan.proxy.bound`, `plan.proxy.resolution === 'system-level'`) so an unbound proxy can never be mistaken for an effective one.
+
+---
+
 ## Self-Diagnostic Coherence Evaluation
 
 Verify any passport or raw external request headers against the theoretical coherence framework:
@@ -411,6 +506,19 @@ npx device-passport inspect --seed production_user_102
  │ Native Fetch │                │  Playwright  │                │  Puppeteer   │
  │   Headers    │                │Context Options│               │ Emulation Hook│
  └──────────────┘                └──────────────┘                └──────────────┘
+                                 │                               │
+                                 └───────────────┬───────────────┘
+                                                 ▼
+                                 ┌───────────────────────────┐
+                                 │  Pixel-Level Protection   │
+                                 │ canvas / WebGL / audio    │
+                                 │ deterministic per seed    │
+                                 └───────────┬───────────────┘
+                                             ▼
+                                 ┌───────────────────────────┐
+                                 │  Raw CDP Command Plan     │
+                                 │ (lite-browser, custom)    │
+                                 └───────────────────────────┘
 ```
 
 ---

package/dist/adapters/index.cjs

@@ -0,0 +1,19 @@
+'use strict';
+
+const cdp = require('../shared/device-passport.D9xW6R0B.cjs');
+require('node:crypto');
+require('../shared/device-passport.BKtmLzPt.cjs');
+
+
+
+exports.CANONICAL_HEADER_ORDER = cdp.CANONICAL_HEADER_ORDER;
+exports.applyCdpPassport = cdp.applyCdpPassport;
+exports.applyToPlaywrightContext = cdp.applyToPlaywrightContext;
+exports.applyToPuppeteerPage = cdp.applyToPuppeteerPage;
+exports.formatCanonicalHeaders = cdp.formatCanonicalHeaders;
+exports.getCdpPlan = cdp.getCdpPlan;
+exports.getPlaywrightContext = cdp.getPlaywrightContext;
+exports.getPuppeteerArgs = cdp.getPuppeteerArgs;
+exports.getStealthScript = cdp.getStealthScript;
+exports.toCurl = cdp.toCurl;
+exports.withPassport = cdp.withPassport;

package/dist/adapters/index.d.cts

@@ -0,0 +1,66 @@
+import { DevicePassport, CdpCommand, CdpPassportPlan } from '../types/index.cjs';
+export { P as PlaywrightContextOptions, a as PuppeteerEmulationOptions, b as applyToPlaywrightContext, c as applyToPuppeteerPage, g as getPlaywrightContext, d as getPuppeteerArgs, e as getStealthScript } from '../shared/device-passport.CsOWqPIr.cjs';
+import '../shared/device-passport.C_F1vBE8.cjs';
+
+/**
+ * Standard Chromium browser header ordering.
+ * Anti-bot systems (Cloudflare, Akamai, DataDome, Kasada) strictly inspect
+ * the sequence of HTTP request headers. A mismatch in header order triggers
+ * immediate bot heuristics.
+ */
+declare const CANONICAL_HEADER_ORDER: readonly string[];
+/**
+ * Sorts and formats HTTP headers according to canonical browser ordering.
+ * Merges base headers with optional overrides.
+ */
+declare function formatCanonicalHeaders(baseHeaders: Record<string, string>, overrides?: Record<string, string>): Record<string, string>;
+interface PassportLike {
+    headers: Record<string, string>;
+    getHeaders?: (overrides?: Record<string, string>) => Record<string, string>;
+}
+/**
+ * Higher-order fetch function wrapping standard fetch with canonical DevicePassport headers.
+ * Ensures consistent TLS/HTTP persona across API calls, scraping requests, and webhooks.
+ *
+ * @param passport DevicePassport instance or object
+ * @param customFetch Optional fetch implementation (e.g. node-fetch, undici, or global fetch)
+ */
+declare function withPassport(passport: PassportLike | DevicePassport, customFetch?: typeof fetch): typeof fetch;
+/**
+ * Generates an executable cURL command with correct browser headers.
+ */
+declare function toCurl(passport: PassportLike | DevicePassport, url: string, options?: {
+    method?: string;
+    data?: any;
+    headers?: Record<string, string>;
+}): string;
+
+/**
+ * Raw Chrome DevTools Protocol adapter.
+ *
+ * 🔴 Why this exists (2026-11-04):
+ *   Tools that drive Chrome over a bare CDP socket — `lite-browser`'s `cdp <method> [json]`
+ *   channel, for example — cannot use the Playwright/Puppeteer adapters, because those
+ *   hand back framework-shaped options. This adapter speaks plain CDP so any CDP client
+ *   can apply a passport.
+ *
+ * The returned plan is deliberately **declarative**: a `send(method, params)` function
+ * applies every command in order. The caller owns the transport, so this module has no
+ * dependency and works over WebSocket, stdio, or an in-process socket.
+ */
+/**
+ * Builds the ordered CDP command plan for a passport.
+ *
+ * Order matters: the UA override must precede navigation, and the init script has to be
+ * installed before the first document is created.
+ */
+declare function getCdpPlan(passport: DevicePassport, sessionId?: string): CdpPassportPlan;
+/**
+ * Applies a passport through a raw CDP transport.
+ *
+ * @param send Function that sends one CDP command and resolves with its result.
+ */
+declare function applyCdpPassport(passport: DevicePassport, send: (command: CdpCommand) => Promise<unknown>, sessionId?: string): Promise<void>;
+
+export { CANONICAL_HEADER_ORDER, applyCdpPassport, formatCanonicalHeaders, getCdpPlan, toCurl, withPassport };
+export type { PassportLike };

package/dist/adapters/index.d.mts

@@ -0,0 +1,66 @@
+import { DevicePassport, CdpCommand, CdpPassportPlan } from '../types/index.mjs';
+export { P as PlaywrightContextOptions, a as PuppeteerEmulationOptions, b as applyToPlaywrightContext, c as applyToPuppeteerPage, g as getPlaywrightContext, d as getPuppeteerArgs, e as getStealthScript } from '../shared/device-passport.ZBspe4ZW.mjs';
+import '../shared/device-passport.C_F1vBE8.mjs';
+
+/**
+ * Standard Chromium browser header ordering.
+ * Anti-bot systems (Cloudflare, Akamai, DataDome, Kasada) strictly inspect
+ * the sequence of HTTP request headers. A mismatch in header order triggers
+ * immediate bot heuristics.
+ */
+declare const CANONICAL_HEADER_ORDER: readonly string[];
+/**
+ * Sorts and formats HTTP headers according to canonical browser ordering.
+ * Merges base headers with optional overrides.
+ */
+declare function formatCanonicalHeaders(baseHeaders: Record<string, string>, overrides?: Record<string, string>): Record<string, string>;
+interface PassportLike {
+    headers: Record<string, string>;
+    getHeaders?: (overrides?: Record<string, string>) => Record<string, string>;
+}
+/**
+ * Higher-order fetch function wrapping standard fetch with canonical DevicePassport headers.
+ * Ensures consistent TLS/HTTP persona across API calls, scraping requests, and webhooks.
+ *
+ * @param passport DevicePassport instance or object
+ * @param customFetch Optional fetch implementation (e.g. node-fetch, undici, or global fetch)
+ */
+declare function withPassport(passport: PassportLike | DevicePassport, customFetch?: typeof fetch): typeof fetch;
+/**
+ * Generates an executable cURL command with correct browser headers.
+ */
+declare function toCurl(passport: PassportLike | DevicePassport, url: string, options?: {
+    method?: string;
+    data?: any;
+    headers?: Record<string, string>;
+}): string;
+
+/**
+ * Raw Chrome DevTools Protocol adapter.
+ *
+ * 🔴 Why this exists (2026-11-04):
+ *   Tools that drive Chrome over a bare CDP socket — `lite-browser`'s `cdp <method> [json]`
+ *   channel, for example — cannot use the Playwright/Puppeteer adapters, because those
+ *   hand back framework-shaped options. This adapter speaks plain CDP so any CDP client
+ *   can apply a passport.
+ *
+ * The returned plan is deliberately **declarative**: a `send(method, params)` function
+ * applies every command in order. The caller owns the transport, so this module has no
+ * dependency and works over WebSocket, stdio, or an in-process socket.
+ */
+/**
+ * Builds the ordered CDP command plan for a passport.
+ *
+ * Order matters: the UA override must precede navigation, and the init script has to be
+ * installed before the first document is created.
+ */
+declare function getCdpPlan(passport: DevicePassport, sessionId?: string): CdpPassportPlan;
+/**
+ * Applies a passport through a raw CDP transport.
+ *
+ * @param send Function that sends one CDP command and resolves with its result.
+ */
+declare function applyCdpPassport(passport: DevicePassport, send: (command: CdpCommand) => Promise<unknown>, sessionId?: string): Promise<void>;
+
+export { CANONICAL_HEADER_ORDER, applyCdpPassport, formatCanonicalHeaders, getCdpPlan, toCurl, withPassport };
+export type { PassportLike };

package/dist/adapters/index.d.ts

@@ -0,0 +1,66 @@
+import { DevicePassport, CdpCommand, CdpPassportPlan } from '../types/index.js';
+export { P as PlaywrightContextOptions, a as PuppeteerEmulationOptions, b as applyToPlaywrightContext, c as applyToPuppeteerPage, g as getPlaywrightContext, d as getPuppeteerArgs, e as getStealthScript } from '../shared/device-passport.D7pEnyp2.js';
+import '../shared/device-passport.C_F1vBE8.js';
+
+/**
+ * Standard Chromium browser header ordering.
+ * Anti-bot systems (Cloudflare, Akamai, DataDome, Kasada) strictly inspect
+ * the sequence of HTTP request headers. A mismatch in header order triggers
+ * immediate bot heuristics.
+ */
+declare const CANONICAL_HEADER_ORDER: readonly string[];
+/**
+ * Sorts and formats HTTP headers according to canonical browser ordering.
+ * Merges base headers with optional overrides.
+ */
+declare function formatCanonicalHeaders(baseHeaders: Record<string, string>, overrides?: Record<string, string>): Record<string, string>;
+interface PassportLike {
+    headers: Record<string, string>;
+    getHeaders?: (overrides?: Record<string, string>) => Record<string, string>;
+}
+/**
+ * Higher-order fetch function wrapping standard fetch with canonical DevicePassport headers.
+ * Ensures consistent TLS/HTTP persona across API calls, scraping requests, and webhooks.
+ *
+ * @param passport DevicePassport instance or object
+ * @param customFetch Optional fetch implementation (e.g. node-fetch, undici, or global fetch)
+ */
+declare function withPassport(passport: PassportLike | DevicePassport, customFetch?: typeof fetch): typeof fetch;
+/**
+ * Generates an executable cURL command with correct browser headers.
+ */
+declare function toCurl(passport: PassportLike | DevicePassport, url: string, options?: {
+    method?: string;
+    data?: any;
+    headers?: Record<string, string>;
+}): string;
+
+/**
+ * Raw Chrome DevTools Protocol adapter.
+ *
+ * 🔴 Why this exists (2026-11-04):
+ *   Tools that drive Chrome over a bare CDP socket — `lite-browser`'s `cdp <method> [json]`
+ *   channel, for example — cannot use the Playwright/Puppeteer adapters, because those
+ *   hand back framework-shaped options. This adapter speaks plain CDP so any CDP client
+ *   can apply a passport.
+ *
+ * The returned plan is deliberately **declarative**: a `send(method, params)` function
+ * applies every command in order. The caller owns the transport, so this module has no
+ * dependency and works over WebSocket, stdio, or an in-process socket.
+ */
+/**
+ * Builds the ordered CDP command plan for a passport.
+ *
+ * Order matters: the UA override must precede navigation, and the init script has to be
+ * installed before the first document is created.
+ */
+declare function getCdpPlan(passport: DevicePassport, sessionId?: string): CdpPassportPlan;
+/**
+ * Applies a passport through a raw CDP transport.
+ *
+ * @param send Function that sends one CDP command and resolves with its result.
+ */
+declare function applyCdpPassport(passport: DevicePassport, send: (command: CdpCommand) => Promise<unknown>, sessionId?: string): Promise<void>;
+
+export { CANONICAL_HEADER_ORDER, applyCdpPassport, formatCanonicalHeaders, getCdpPlan, toCurl, withPassport };
+export type { PassportLike };

package/dist/adapters/index.mjs

@@ -0,0 +1,3 @@
+export { C as CANONICAL_HEADER_ORDER, a as applyCdpPassport, b as applyToPlaywrightContext, c as applyToPuppeteerPage, f as formatCanonicalHeaders, g as getCdpPlan, d as getPlaywrightContext, e as getPuppeteerArgs, h as getStealthScript, t as toCurl, w as withPassport } from '../shared/device-passport.gNo82fQ5.mjs';
+import 'node:crypto';
+import '../shared/device-passport.BPQj0qdT.mjs';

package/dist/ego/index.cjs

@@ -0,0 +1,22 @@
+'use strict';
+
+const bridge = require('../shared/device-passport.qL4tjwc0.cjs');
+require('../shared/device-passport.D9xW6R0B.cjs');
+require('node:crypto');
+require('../shared/device-passport.BKtmLzPt.cjs');
+require('../shared/device-passport.EK4RX7Xd.cjs');
+require('../shared/device-passport.Cjxlv8xI.cjs');
+require('node:fs');
+require('node:path');
+
+
+
+exports.AccountProfileManager = bridge.AccountProfileManager;
+exports.PROXY_MISSING_NOTE = bridge.PROXY_MISSING_NOTE;
+exports.PROXY_RESOLUTION_NOTE = bridge.PROXY_RESOLUTION_NOTE;
+exports.buildEgoSessionPlan = bridge.buildEgoSessionPlan;
+exports.buildProxyDeclaration = bridge.buildProxyDeclaration;
+exports.createEgoBridge = bridge.createEgoBridge;
+exports.defaultTaskSpaceName = bridge.defaultTaskSpaceName;
+exports.getEgoNativeBridge = bridge.getEgoNativeBridge;
+exports.getProfileReadiness = bridge.getProfileReadiness;

package/dist/ego/index.d.cts

@@ -0,0 +1,5 @@
+export { A as AccountProfileManager, a as AccountProfileManagerOptions, B as BindProfileOptions, b as BuildEgoSessionPlanOptions, c as CreateSessionPlanOptions, E as EgoNativeBridge, P as PROXY_MISSING_NOTE, d as PROXY_RESOLUTION_NOTE, g as buildEgoSessionPlan, h as buildProxyDeclaration, i as createEgoBridge, k as defaultTaskSpaceName, l as getEgoNativeBridge, m as getProfileReadiness } from '../shared/device-passport.CfLes-lq.cjs';
+import '../types/index.cjs';
+import '../shared/device-passport.C_F1vBE8.cjs';
+import '../shared/device-passport.CsOWqPIr.cjs';
+import '../shared/device-passport.DirQmSd4.cjs';

package/dist/ego/index.d.mts

@@ -0,0 +1,5 @@
+export { A as AccountProfileManager, a as AccountProfileManagerOptions, B as BindProfileOptions, b as BuildEgoSessionPlanOptions, c as CreateSessionPlanOptions, E as EgoNativeBridge, P as PROXY_MISSING_NOTE, d as PROXY_RESOLUTION_NOTE, g as buildEgoSessionPlan, h as buildProxyDeclaration, i as createEgoBridge, k as defaultTaskSpaceName, l as getEgoNativeBridge, m as getProfileReadiness } from '../shared/device-passport.dVEqzSEb.mjs';
+import '../types/index.mjs';
+import '../shared/device-passport.C_F1vBE8.mjs';
+import '../shared/device-passport.ZBspe4ZW.mjs';
+import '../shared/device-passport.DirQmSd4.mjs';

package/dist/ego/index.d.ts

@@ -0,0 +1,5 @@
+export { A as AccountProfileManager, a as AccountProfileManagerOptions, B as BindProfileOptions, b as BuildEgoSessionPlanOptions, c as CreateSessionPlanOptions, E as EgoNativeBridge, P as PROXY_MISSING_NOTE, d as PROXY_RESOLUTION_NOTE, g as buildEgoSessionPlan, h as buildProxyDeclaration, i as createEgoBridge, k as defaultTaskSpaceName, l as getEgoNativeBridge, m as getProfileReadiness } from '../shared/device-passport.CDS7xrj8.js';
+import '../types/index.js';
+import '../shared/device-passport.C_F1vBE8.js';
+import '../shared/device-passport.D7pEnyp2.js';
+import '../shared/device-passport.DirQmSd4.js';

package/dist/ego/index.mjs

@@ -0,0 +1,8 @@
+export { A as AccountProfileManager, P as PROXY_MISSING_NOTE, a as PROXY_RESOLUTION_NOTE, b as buildEgoSessionPlan, c as buildProxyDeclaration, d as createEgoBridge, e as defaultTaskSpaceName, g as getEgoNativeBridge, f as getProfileReadiness } from '../shared/device-passport.kekU28UM.mjs';
+import '../shared/device-passport.gNo82fQ5.mjs';
+import 'node:crypto';
+import '../shared/device-passport.BPQj0qdT.mjs';
+import '../shared/device-passport.BGfRcQNh.mjs';
+import '../shared/device-passport.CyQtcZeD.mjs';
+import 'node:fs';
+import 'node:path';

package/dist/evaluator/index.cjs

@@ -0,0 +1,140 @@
+'use strict';
+
+const entropy = require('../shared/device-passport.EK4RX7Xd.cjs');
+
+function evaluateGeoAlignment(passport) {
+  const geoContradictions = entropy.detectGeoChronoContradictions(passport);
+  let score = 100;
+  for (const c of geoContradictions) {
+    score -= c.impactPenalty;
+  }
+  const acceptLang = passport.headers["accept-language"] || "";
+  if (acceptLang) {
+    if (!/^[a-zA-Z]{2,3}(-[a-zA-Z0-9]+)?(;q=[0-1](\.\d{1,3})?)?/.test(acceptLang.trim())) {
+      score -= 10;
+    }
+  } else {
+    score -= 15;
+  }
+  return Math.max(0, Math.min(100, score));
+}
+function evaluateCoherence(passport) {
+  const contradictions = entropy.detectAllContradictions(passport);
+  const geoAlignmentScore = evaluateGeoAlignment(passport);
+  const entropyResult = entropy.analyzeHeaderEntropy(passport.headers || {});
+  const entropyScore = entropyResult.entropyScore;
+  let totalPenalty = 0;
+  let fatalCount = 0;
+  let warningCount = 0;
+  for (const item of contradictions) {
+    totalPenalty += item.impactPenalty;
+    if (item.severity === "fatal") {
+      fatalCount++;
+    } else {
+      warningCount++;
+    }
+  }
+  if (entropyResult.anomaly !== "optimal") {
+    const entropyPenalty = Math.max(0, 100 - entropyScore) * 0.25;
+    totalPenalty += entropyPenalty;
+  }
+  const rawCoherence = 100 - totalPenalty;
+  const coherenceScore = Number(Math.max(0, Math.min(100, rawCoherence)).toFixed(1));
+  const hContradictions = contradictions.filter((c) => c.category === "hardware_system");
+  const sContradictions = contradictions.filter((c) => c.category === "os_browser");
+  const gContradictions = contradictions.filter((c) => c.category === "geo_chrono");
+  const cContradictions = contradictions.filter((c) => c.category === "client_hints");
+  const calcSubScore = (list) => Math.max(0, 100 - list.reduce((acc, curr) => acc + curr.impactPenalty, 0));
+  const mathematicalModel = {
+    formalism: "P = \u27E8H, S, G, C\u27E9",
+    definition: {
+      H: "Hardware Sub-space \u27E8Screen, CPU, Memory, GPU\u27E9",
+      S: "System Sub-space \u27E8OS, Browser, UserAgent\u27E9",
+      G: "Geo-Chrono Sub-space \u27E8Country, Timezone, Locale, Languages, Coordinates\u27E9",
+      C: "Client-Hints Sub-space \u27E8Sec-CH-UA*, Low & High Entropy Hints\u27E9"
+    },
+    subspaces: {
+      H: {
+        valid: hContradictions.every((c) => c.severity !== "fatal"),
+        score: calcSubScore(hContradictions),
+        notes: hContradictions.map((c) => c.description)
+      },
+      S: {
+        valid: sContradictions.every((c) => c.severity !== "fatal"),
+        score: calcSubScore(sContradictions),
+        notes: sContradictions.map((c) => c.description)
+      },
+      G: {
+        valid: gContradictions.every((c) => c.severity !== "fatal"),
+        score: geoAlignmentScore,
+        notes: gContradictions.map((c) => c.description)
+      },
+      C: {
+        valid: cContradictions.every((c) => c.severity !== "fatal"),
+        score: calcSubScore(cContradictions),
+        notes: cContradictions.map((c) => c.description)
+      }
+    }
+  };
+  let grade = "F";
+  if (fatalCount === 0) {
+    if (coherenceScore >= 95 && entropyScore >= 80) grade = "A+";
+    else if (coherenceScore >= 88) grade = "A";
+    else if (coherenceScore >= 75) grade = "B";
+    else grade = "C";
+  } else {
+    grade = "F";
+  }
+  const passed = fatalCount === 0 && coherenceScore >= 80;
+  let verdict = "";
+  if (grade === "A+") {
+    verdict = "Flawless mathematical coherence. Zero contradictions across H, S, G, C spaces.";
+  } else if (grade === "A") {
+    verdict = "High consistency persona with natural browser characteristics and low bot detection risk.";
+  } else if (grade === "B" || grade === "C") {
+    verdict = "Minor cross-layer discrepancies detected; susceptible to advanced anti-bot heuristics.";
+  } else {
+    verdict = "Fatal architectural contradiction detected. Persona is trivially flagged by Cloudflare/DataDome.";
+  }
+  return {
+    coherenceScore,
+    geoAlignmentScore,
+    entropyScore,
+    contradictions,
+    mathematicalModel,
+    entropyAnalysis: entropyResult,
+    summary: {
+      passed,
+      fatalCount,
+      warningCount,
+      grade,
+      verdict
+    }
+  };
+}
+
+function evaluatePassport(passport) {
+  return evaluateCoherence(passport);
+}
+
+exports.BASELINE_OPTIMAL_ENTROPY = entropy.BASELINE_OPTIMAL_ENTROPY;
+exports.BROWSER_BASELINE_FREQUENCIES = entropy.BROWSER_BASELINE_FREQUENCIES;
+exports.COUNTRY_PRIMARY_LANGUAGES = entropy.COUNTRY_PRIMARY_LANGUAGES;
+exports.COUNTRY_TIMEZONE_MAP = entropy.COUNTRY_TIMEZONE_MAP;
+exports.MIN_STRUCTURAL_ENTROPY = entropy.MIN_STRUCTURAL_ENTROPY;
+exports.OPTIMAL_CHAR_ENTROPY_MAX = entropy.OPTIMAL_CHAR_ENTROPY_MAX;
+exports.OPTIMAL_CHAR_ENTROPY_MIN = entropy.OPTIMAL_CHAR_ENTROPY_MIN;
+exports.OPTIMAL_ENTROPY_MAX = entropy.OPTIMAL_ENTROPY_MAX;
+exports.OPTIMAL_ENTROPY_MIN = entropy.OPTIMAL_ENTROPY_MIN;
+exports.analyzeHeaderEntropy = entropy.analyzeHeaderEntropy;
+exports.calculateKLDivergence = entropy.calculateKLDivergence;
+exports.calculateShannonEntropy = entropy.calculateShannonEntropy;
+exports.calculateStructuralEntropy = entropy.calculateStructuralEntropy;
+exports.detectAllContradictions = entropy.detectAllContradictions;
+exports.detectClientHintsContradictions = entropy.detectClientHintsContradictions;
+exports.detectGeoChronoContradictions = entropy.detectGeoChronoContradictions;
+exports.detectHardwareContradictions = entropy.detectHardwareContradictions;
+exports.detectOSBrowserContradictions = entropy.detectOSBrowserContradictions;
+exports.evaluateCoherence = evaluateCoherence;
+exports.evaluateGeoAlignment = evaluateGeoAlignment;
+exports.evaluatePassport = evaluatePassport;