engagelab-captcha-sdk 1.0.0

package/src/degradation.ts

@@ -0,0 +1,113 @@
+export interface DegradationConfig {
+  maxRetries: number;
+  retryDelayMs: number;
+  fallbackMode: 'invisible' | 'local-pow' | 'always-pass';
+  healthCheckIntervalMs: number;
+}
+
+const DEFAULT_CONFIG: DegradationConfig = {
+  maxRetries: 3,
+  retryDelayMs: 1000,
+  fallbackMode: 'local-pow',
+  healthCheckIntervalMs: 30000,
+};
+
+export class DegradationManager {
+  private config: DegradationConfig;
+  private isServerHealthy: boolean = true;
+  private consecutiveFailures: number = 0;
+  private healthCheckTimer: ReturnType<typeof setInterval> | null = null;
+
+  constructor(config?: Partial<DegradationConfig>) {
+    this.config = { ...DEFAULT_CONFIG, ...config };
+  }
+
+  async executeWithRetry<T>(fn: () => Promise<T>): Promise<T | null> {
+    for (let i = 0; i <= this.config.maxRetries; i++) {
+      try {
+        const result = await fn();
+        this.onSuccess();
+        return result;
+      } catch (e) {
+        this.onFailure();
+        if (i < this.config.maxRetries) {
+          await this.delay(this.config.retryDelayMs * Math.pow(2, i));
+        }
+      }
+    }
+    return null;
+  }
+
+  shouldDegrade(): boolean {
+    return !this.isServerHealthy || this.consecutiveFailures >= this.config.maxRetries;
+  }
+
+  getDegradedResult(): { success: boolean; token: string; degraded: boolean } {
+    switch (this.config.fallbackMode) {
+      case 'always-pass':
+        return { success: true, token: 'degraded_pass_' + Date.now(), degraded: true };
+      case 'local-pow':
+        return { success: true, token: 'degraded_pow_' + this.localPoW(), degraded: true };
+      case 'invisible':
+      default:
+        return { success: false, token: '', degraded: true };
+    }
+  }
+
+  private localPoW(): string {
+    const challenge = Date.now().toString(36);
+    let nonce = 0;
+    while (true) {
+      const hash = this.simpleHash(challenge + nonce);
+      if (hash.startsWith('00')) break;
+      nonce++;
+      if (nonce > 100000) break;
+    }
+    return challenge + ':' + nonce;
+  }
+
+  private simpleHash(input: string): string {
+    let hash = 0;
+    for (let i = 0; i < input.length; i++) {
+      const char = input.charCodeAt(i);
+      hash = ((hash << 5) - hash) + char;
+      hash = hash & hash;
+    }
+    return Math.abs(hash).toString(16).padStart(8, '0');
+  }
+
+  startHealthCheck(healthFn: () => Promise<boolean>): void {
+    this.stopHealthCheck();
+    this.healthCheckTimer = setInterval(async () => {
+      try {
+        this.isServerHealthy = await healthFn();
+        if (this.isServerHealthy) this.consecutiveFailures = 0;
+      } catch {
+        this.isServerHealthy = false;
+      }
+    }, this.config.healthCheckIntervalMs);
+  }
+
+  stopHealthCheck(): void {
+    if (this.healthCheckTimer) {
+      clearInterval(this.healthCheckTimer);
+      this.healthCheckTimer = null;
+    }
+  }
+
+  private onSuccess(): void {
+    this.consecutiveFailures = 0;
+    this.isServerHealthy = true;
+  }
+
+  private onFailure(): void {
+    this.consecutiveFailures++;
+    if (this.consecutiveFailures >= this.config.maxRetries) {
+      this.isServerHealthy = false;
+    }
+  }
+
+  private delay(ms: number): Promise<void> {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+  }
+}

package/src/device_attestation.ts

@@ -0,0 +1,109 @@
+/**
+ * Device Attestation — hardware-backed trust verification.
+ *
+ * Web: WebAuthn/FIDO2 for device binding
+ * The server can optionally require device attestation for high-risk scenarios.
+ */
+
+export interface AttestationResult {
+  supported: boolean;
+  type: 'webauthn' | 'none';
+  credential?: string;
+  attestationObject?: string;
+  clientDataJSON?: string;
+}
+
+export async function checkDeviceAttestationSupport(): Promise<{
+  webauthn: boolean;
+  platformAuthenticator: boolean;
+  conditionalMediation: boolean;
+}> {
+  const result = {
+    webauthn: false,
+    platformAuthenticator: false,
+    conditionalMediation: false,
+  };
+
+  try {
+    result.webauthn = typeof window.PublicKeyCredential !== 'undefined';
+
+    if (result.webauthn && PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable) {
+      result.platformAuthenticator = await PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable();
+    }
+
+    if (result.webauthn && (PublicKeyCredential as unknown as { isConditionalMediationAvailable?: () => Promise<boolean> }).isConditionalMediationAvailable) {
+      result.conditionalMediation = await (PublicKeyCredential as unknown as { isConditionalMediationAvailable: () => Promise<boolean> }).isConditionalMediationAvailable();
+    }
+  } catch {
+    // Ignore
+  }
+
+  return result;
+}
+
+export async function requestDeviceAttestation(
+  challenge: Uint8Array,
+  rpId: string,
+  userId: string,
+): Promise<AttestationResult> {
+  if (typeof window.PublicKeyCredential === 'undefined') {
+    return { supported: false, type: 'none' };
+  }
+
+  try {
+    const challengeBuffer = new Uint8Array(challenge.byteLength);
+    challengeBuffer.set(challenge);
+    const publicKeyOptions: PublicKeyCredentialCreationOptions = {
+      challenge: challengeBuffer as BufferSource,
+      rp: {
+        name: 'EngageLab CAPTCHA',
+        id: rpId,
+      },
+      user: {
+        id: new TextEncoder().encode(userId),
+        name: `captcha-${userId.substring(0, 8)}`,
+        displayName: 'CAPTCHA Verification',
+      },
+      pubKeyCredParams: [
+        { alg: -7, type: 'public-key' },   // ES256
+        { alg: -257, type: 'public-key' },  // RS256
+      ],
+      authenticatorSelection: {
+        authenticatorAttachment: 'platform',
+        userVerification: 'discouraged',
+        residentKey: 'discouraged',
+      },
+      timeout: 10000,
+      attestation: 'direct',
+    };
+
+    const credential = await navigator.credentials.create({
+      publicKey: publicKeyOptions,
+    }) as PublicKeyCredential;
+
+    if (!credential) {
+      return { supported: true, type: 'webauthn' };
+    }
+
+    const response = credential.response as AuthenticatorAttestationResponse;
+
+    return {
+      supported: true,
+      type: 'webauthn',
+      credential: bufferToBase64(credential.rawId),
+      attestationObject: bufferToBase64(response.attestationObject),
+      clientDataJSON: bufferToBase64(response.clientDataJSON),
+    };
+  } catch {
+    return { supported: true, type: 'webauthn' };
+  }
+}
+
+function bufferToBase64(buffer: ArrayBuffer): string {
+  const bytes = new Uint8Array(buffer);
+  let binary = '';
+  for (let i = 0; i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return btoa(binary);
+}

package/src/fingerprint.ts

@@ -0,0 +1,247 @@
+import { Fingerprint, FingerprintOptions, MathFingerprint, StorageInfo } from './types';
+import { sdkLogger } from './logger';
+
+const DEFAULT_OPTIONS: Required<FingerprintOptions> = {
+  audio: true,
+  canvas: true,
+  webgl: true,
+  fonts: true,
+  webrtc: true,
+};
+
+export async function collectFingerprint(options?: FingerprintOptions): Promise<Fingerprint> {
+  const opts = { ...DEFAULT_OPTIONS, ...options };
+  sdkLogger.info('Fingerprint', 'Collection start', {
+    canvas: opts.canvas,
+    webgl: opts.webgl,
+    audio: opts.audio,
+    fonts: opts.fonts,
+    webrtc: opts.webrtc,
+  });
+
+  let canvasHash = '';
+  let webgl = { renderer: '', vendor: '', hash: '' };
+  let audioHash = '';
+  let fonts: string[] = [];
+
+  try {
+    [canvasHash, webgl, audioHash, fonts] = await Promise.all([
+      opts.canvas ? getCanvasFingerprint() : Promise.resolve(''),
+      opts.webgl ? getWebGLInfo() : Promise.resolve({ renderer: '', vendor: '', hash: '' }),
+      opts.audio ? getAudioFingerprint() : Promise.resolve(''),
+      opts.fonts ? detectFonts() : Promise.resolve([]),
+    ]);
+  } catch (e: any) {
+    sdkLogger.error('Fingerprint', 'Parallel collection error', e?.message || e);
+    throw e;
+  }
+
+  const nav = navigator as any;
+
+  const fp: Fingerprint = {
+    canvasHash,
+    webglRenderer: webgl.renderer,
+    webglVendor: webgl.vendor,
+    webglHash: webgl.hash,
+    audioHash,
+    screenWidth: screen.width,
+    screenHeight: screen.height,
+    colorDepth: screen.colorDepth,
+    devicePixelRatio: window.devicePixelRatio || 1,
+    timezone: Intl.DateTimeFormat().resolvedOptions().timeZone || '',
+    timezoneOffset: new Date().getTimezoneOffset(),
+    language: navigator.language || '',
+    languages: Array.from(navigator.languages || []),
+    platform: nav.platform || '',
+    hardwareConcurrency: nav.hardwareConcurrency || 0,
+    deviceMemory: nav.deviceMemory || 0,
+    maxTouchPoints: nav.maxTouchPoints || 0,
+    fonts,
+    pluginCount: navigator.plugins?.length || 0,
+    webdriver: !!nav.webdriver,
+    hasChromeRuntime: !!(window as any).chrome?.runtime,
+    connectionType: nav.connection?.effectiveType || '',
+    screenAvailWidth: screen.availWidth,
+    screenAvailHeight: screen.availHeight,
+    outerWidth: window.outerWidth,
+    outerHeight: window.outerHeight,
+    innerWidth: window.innerWidth,
+    innerHeight: window.innerHeight,
+    headlessSignals: [],  // filled by headless.ts
+    mathFp: getMathFingerprint(),
+    storageInfo: getStorageInfo(),
+  };
+
+  sdkLogger.debug('Fingerprint', 'Collection done', {
+    canvasHashLen: fp.canvasHash.length,
+    webglRenderer: fp.webglRenderer?.substring(0, 40),
+    webglVendor: fp.webglVendor?.substring(0, 40),
+    audioHashLen: fp.audioHash.length,
+    fontCount: fp.fonts.length,
+    screen: `${fp.screenWidth}x${fp.screenHeight}`,
+    webdriver: fp.webdriver,
+  });
+
+  return fp;
+}
+
+function getCanvasFingerprint(): string {
+  try {
+    const canvas = document.createElement('canvas');
+    canvas.width = 280;
+    canvas.height = 60;
+    const ctx = canvas.getContext('2d');
+    if (!ctx) return '';
+
+    ctx.textBaseline = 'alphabetic';
+    ctx.fillStyle = '#f60';
+    ctx.fillRect(125, 1, 62, 20);
+    ctx.fillStyle = '#069';
+    ctx.font = '11pt Arial';
+    ctx.fillText('EngageLab,\ud83d\ude03', 2, 15);
+    ctx.fillStyle = 'rgba(102,204,0,0.7)';
+    ctx.font = '18pt Arial';
+    ctx.fillText('CAPTCHA Test', 4, 45);
+
+    ctx.strokeStyle = 'rgb(150,50,50)';
+    ctx.beginPath();
+    ctx.arc(50, 50, 20, 0, Math.PI * 2);
+    ctx.stroke();
+
+    const gradient = ctx.createLinearGradient(0, 0, 280, 0);
+    gradient.addColorStop(0, '#ff0000');
+    gradient.addColorStop(1, '#0000ff');
+    ctx.fillStyle = gradient;
+    ctx.fillRect(0, 50, 280, 10);
+
+    return hashString(canvas.toDataURL());
+  } catch (e: any) {
+    sdkLogger.warn('Fingerprint', 'Canvas fingerprint failed', e?.message || e);
+    return '';
+  }
+}
+
+function getWebGLInfo(): { renderer: string; vendor: string; hash: string } {
+  try {
+    const canvas = document.createElement('canvas');
+    const gl = canvas.getContext('webgl') || canvas.getContext('experimental-webgl') as WebGLRenderingContext | null;
+    if (!gl) return { renderer: '', vendor: '', hash: '' };
+
+    const ext = gl.getExtension('WEBGL_debug_renderer_info');
+    const renderer = ext ? gl.getParameter(ext.UNMASKED_RENDERER_WEBGL) : '';
+    const vendor = ext ? gl.getParameter(ext.UNMASKED_VENDOR_WEBGL) : '';
+
+    const params = [
+      gl.getParameter(gl.MAX_TEXTURE_SIZE),
+      gl.getParameter(gl.MAX_RENDERBUFFER_SIZE),
+      gl.getParameter(gl.MAX_VIEWPORT_DIMS),
+      gl.getParameter(gl.ALIASED_LINE_WIDTH_RANGE),
+      gl.getParameter(gl.ALIASED_POINT_SIZE_RANGE),
+      gl.getSupportedExtensions()?.join(','),
+    ].join('|');
+
+    return { renderer, vendor, hash: hashString(params) };
+  } catch (e: any) {
+    sdkLogger.warn('Fingerprint', 'WebGL fingerprint failed', e?.message || e);
+    return { renderer: '', vendor: '', hash: '' };
+  }
+}
+
+async function getAudioFingerprint(): Promise<string> {
+  try {
+    const ctx = new OfflineAudioContext(1, 44100, 44100);
+    const oscillator = ctx.createOscillator();
+    const compressor = ctx.createDynamicsCompressor();
+
+    oscillator.type = 'triangle';
+    oscillator.frequency.setValueAtTime(10000, ctx.currentTime);
+    compressor.threshold.setValueAtTime(-50, ctx.currentTime);
+    compressor.knee.setValueAtTime(40, ctx.currentTime);
+    compressor.ratio.setValueAtTime(12, ctx.currentTime);
+    compressor.attack.setValueAtTime(0, ctx.currentTime);
+    compressor.release.setValueAtTime(0.25, ctx.currentTime);
+
+    oscillator.connect(compressor);
+    compressor.connect(ctx.destination);
+
+    oscillator.start(0);
+    oscillator.stop(0.5);
+
+    const rendered = await ctx.startRendering();
+    const data = rendered.getChannelData(0);
+
+    const sample = Array.from(data.slice(4500, 4530)).map(v => v.toFixed(6)).join(',');
+    return hashString(sample);
+  } catch (e: any) {
+    sdkLogger.warn('Fingerprint', 'Audio fingerprint failed', e?.message || e);
+    return '';
+  }
+}
+
+function detectFonts(): string[] {
+  const baseFonts = ['monospace', 'sans-serif', 'serif'];
+  const testFonts = [
+    'Arial', 'Verdana', 'Times New Roman', 'Courier New', 'Georgia',
+    'Palatino', 'Garamond', 'Comic Sans MS', 'Trebuchet MS', 'Arial Black',
+    'Impact', 'Lucida Console', 'Tahoma', 'Lucida Sans', 'Century Gothic',
+    'Bookman Old Style', 'Brush Script MT', 'Rockwell', 'Segoe UI',
+    'Microsoft YaHei', 'SimHei', 'SimSun', 'PingFang SC', 'Hiragino Sans',
+    'Noto Sans', 'Roboto', 'Open Sans', 'Helvetica', 'Futura',
+  ];
+
+  const span = document.createElement('span');
+  span.style.position = 'absolute';
+  span.style.left = '-9999px';
+  span.style.fontSize = '72px';
+  span.textContent = 'mmmmmmmmmmlli';
+  document.body.appendChild(span);
+
+  const baseWidths: Record<string, number> = {};
+  for (const base of baseFonts) {
+    span.style.fontFamily = base;
+    baseWidths[base] = span.offsetWidth;
+  }
+
+  const detected: string[] = [];
+  for (const font of testFonts) {
+    let found = false;
+    for (const base of baseFonts) {
+      span.style.fontFamily = `'${font}', ${base}`;
+      if (span.offsetWidth !== baseWidths[base]) {
+        found = true;
+        break;
+      }
+    }
+    if (found) detected.push(font);
+  }
+
+  document.body.removeChild(span);
+  return detected;
+}
+
+function getMathFingerprint(): MathFingerprint {
+  return {
+    tanValue: Math.tan(-1e300),
+    atan2Value: Math.atan2(1, 1),
+    logValue: Math.log(1000),
+    sinValue: Math.sin(1),
+  };
+}
+
+function getStorageInfo(): StorageInfo {
+  let ls = false, ss = false, idb = false;
+  try { ls = !!window.localStorage; } catch {}
+  try { ss = !!window.sessionStorage; } catch {}
+  try { idb = !!window.indexedDB; } catch {}
+  return { localStorage: ls, sessionStorage: ss, indexedDb: idb };
+}
+
+function hashString(str: string): string {
+  let hash = 0;
+  for (let i = 0; i < str.length; i++) {
+    const char = str.charCodeAt(i);
+    hash = ((hash << 5) - hash) + char;
+    hash = hash & hash;
+  }
+  return Math.abs(hash).toString(36);
+}

package/src/headless.ts

@@ -0,0 +1,233 @@
+import { HeadlessSignal } from './types';
+import { sdkLogger } from './logger';
+
+export async function detectHeadless(): Promise<HeadlessSignal[]> {
+  sdkLogger.debug('Headless', 'Starting headless signal checks');
+  const signals: HeadlessSignal[] = [];
+
+  signals.push(checkWebdriver());
+  signals.push(checkChromeRuntime());
+  signals.push(checkPlugins());
+  signals.push(checkLanguages());
+  signals.push(checkWindowSize());
+  signals.push(checkScreenAvail());
+  signals.push(await checkNotificationPermission());
+  signals.push(await checkPermissionsAPI());
+  signals.push(checkErrorStack());
+  signals.push(checkMediaQueries());
+  signals.push(checkImageLoadTiming());
+  signals.push(checkNativeFunctions());
+  signals.push(checkPrototypeChain());
+  signals.push(checkConnectionAPI());
+  signals.push(await checkWebRTC());
+  signals.push(checkPerformanceAPI());
+  signals.push(checkIframeAccess());
+  signals.push(checkConsoleLog());
+  signals.push(checkPhantomJS());
+  signals.push(checkSeleniumArtifacts());
+
+  const detected = signals.filter(s => s.detected);
+  const headlessScore = detected.reduce((sum, s) => sum + s.weight, 0);
+  sdkLogger.info('Headless', `Checked ${signals.length} signals, ${detected.length} positive`, {
+    names: detected.map(s => s.name),
+    headlessScore,
+  });
+  sdkLogger.debug(
+    'Headless',
+    'Per-signal',
+    signals.map(s => ({ name: s.name, detected: s.detected, weight: s.weight })),
+  );
+
+  return signals;
+}
+
+function checkWebdriver(): HeadlessSignal {
+  const detected = !!(navigator as any).webdriver;
+  return { name: 'webdriver', detected, value: String(detected), weight: 30 };
+}
+
+function checkChromeRuntime(): HeadlessSignal {
+  const w = window as any;
+  const hasChrome = !!w.chrome;
+  const hasRuntime = hasChrome && !!w.chrome.runtime;
+  const isChromeBrowser = /Chrome/.test(navigator.userAgent) && !/Edge|OPR/.test(navigator.userAgent);
+  const detected = isChromeBrowser && hasChrome && !hasRuntime;
+  return { name: 'chrome_runtime_missing', detected, value: `chrome=${hasChrome},runtime=${hasRuntime}`, weight: 10 };
+}
+
+function checkPlugins(): HeadlessSignal {
+  const count = navigator.plugins?.length || 0;
+  const isMobile = /Mobile|Android|iPhone/.test(navigator.userAgent);
+  const detected = count === 0 && !isMobile;
+  return { name: 'no_plugins', detected, value: String(count), weight: 8 };
+}
+
+function checkLanguages(): HeadlessSignal {
+  const langs = navigator.languages;
+  const detected = !langs || langs.length === 0;
+  return { name: 'no_languages', detected, value: String(langs?.length || 0), weight: 5 };
+}
+
+function checkWindowSize(): HeadlessSignal {
+  const ow = window.outerWidth, oh = window.outerHeight;
+  const iw = window.innerWidth, ih = window.innerHeight;
+  const detected = ow > 0 && iw > 0 && ow === iw && oh === ih;
+  return { name: 'outer_equals_inner', detected, value: `${ow}x${oh}==${iw}x${ih}`, weight: 8 };
+}
+
+function checkScreenAvail(): HeadlessSignal {
+  const detected = screen.availWidth === screen.width && screen.availHeight === screen.height;
+  return { name: 'no_taskbar', detected, value: `avail=${screen.availWidth}x${screen.availHeight}`, weight: 3 };
+}
+
+async function checkNotificationPermission(): Promise<HeadlessSignal> {
+  try {
+    const perm = Notification.permission;
+    const detected = perm === 'denied';
+    return { name: 'notification_denied', detected, value: perm, weight: 5 };
+  } catch {
+    return { name: 'notification_denied', detected: true, value: 'error', weight: 5 };
+  }
+}
+
+async function checkPermissionsAPI(): Promise<HeadlessSignal> {
+  try {
+    const result = await navigator.permissions.query({ name: 'notifications' as PermissionName });
+    const detected = result.state === 'denied';
+    return { name: 'permissions_api_denied', detected, value: result.state, weight: 5 };
+  } catch {
+    return { name: 'permissions_api_denied', detected: false, value: 'unsupported', weight: 0 };
+  }
+}
+
+function checkErrorStack(): HeadlessSignal {
+  try {
+    throw new Error('test');
+  } catch (e: any) {
+    const stack = e.stack || '';
+    const isChrome = stack.includes('at ');
+    const isFirefox = stack.includes('@');
+    const detected = !isChrome && !isFirefox && stack.length < 10;
+    return { name: 'unusual_error_stack', detected, value: stack.substring(0, 50), weight: 5 };
+  }
+}
+
+function checkMediaQueries(): HeadlessSignal {
+  let score = 0;
+  try {
+    const hover = window.matchMedia('(hover: hover)').matches;
+    const pointer = window.matchMedia('(pointer: fine)').matches;
+    const prefersColor = window.matchMedia('(prefers-color-scheme)').matches;
+    if (!hover && !pointer && !/Mobile/.test(navigator.userAgent)) score++;
+    if (!prefersColor) score++;
+  } catch {
+    score = 1;
+  }
+  return { name: 'media_query_anomaly', detected: score > 0, value: String(score), weight: 5 };
+}
+
+function checkImageLoadTiming(): HeadlessSignal {
+  // Synchronous check: measure data URI image decode speed
+  const start = performance.now();
+  const img = new Image();
+  img.src = 'data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7';
+  const elapsed = performance.now() - start;
+  const detected = elapsed < 0.001;
+  return { name: 'instant_image_decode', detected, value: `${elapsed.toFixed(4)}ms`, weight: 3 };
+}
+
+function checkNativeFunctions(): HeadlessSignal {
+  const functionsToCheck = [
+    { name: 'fetch', fn: window.fetch },
+    { name: 'XMLHttpRequest.send', fn: XMLHttpRequest.prototype.send },
+  ];
+  const patched: string[] = [];
+  for (const { name, fn } of functionsToCheck) {
+    if (fn) {
+      const str = Function.prototype.toString.call(fn);
+      if (!str.includes('[native code]') && !str.includes('{ [native code] }')) {
+        patched.push(name);
+      }
+    }
+  }
+  return { name: 'native_fn_override', detected: patched.length > 0, value: patched.join(','), weight: 10 };
+}
+
+function checkPrototypeChain(): HeadlessSignal {
+  try {
+    const navProto = Object.getPrototypeOf(navigator);
+    const expected = Navigator.prototype;
+    const detected = navProto !== expected;
+    return { name: 'prototype_tampered', detected, value: String(detected), weight: 8 };
+  } catch {
+    return { name: 'prototype_tampered', detected: true, value: 'error', weight: 8 };
+  }
+}
+
+function checkConnectionAPI(): HeadlessSignal {
+  const conn = (navigator as any).connection;
+  const detected = !conn && !/Safari|Firefox/.test(navigator.userAgent);
+  return { name: 'no_connection_api', detected, value: conn ? conn.effectiveType : 'missing', weight: 3 };
+}
+
+async function checkWebRTC(): Promise<HeadlessSignal> {
+  try {
+    const pc = new RTCPeerConnection({ iceServers: [] });
+    pc.createDataChannel('');
+    const offer = await pc.createOffer();
+    await pc.setLocalDescription(offer);
+    const sdp = pc.localDescription?.sdp || '';
+    pc.close();
+    const hasCandidate = sdp.includes('a=candidate');
+    return { name: 'webrtc_anomaly', detected: !hasCandidate, value: hasCandidate ? 'ok' : 'no_candidates', weight: 5 };
+  } catch {
+    return { name: 'webrtc_anomaly', detected: false, value: 'unsupported', weight: 0 };
+  }
+}
+
+function checkPerformanceAPI(): HeadlessSignal {
+  const t1 = performance.now();
+  const t2 = performance.now();
+  const precision = t2 - t1;
+  const detected = precision === 0 || precision > 5;
+  return { name: 'performance_precision', detected, value: `${precision.toFixed(4)}ms`, weight: 3 };
+}
+
+function checkIframeAccess(): HeadlessSignal {
+  try {
+    const iframe = document.createElement('iframe');
+    iframe.style.display = 'none';
+    document.body.appendChild(iframe);
+    const hasContent = !!iframe.contentWindow;
+    document.body.removeChild(iframe);
+    return { name: 'iframe_anomaly', detected: !hasContent, value: String(hasContent), weight: 3 };
+  } catch {
+    return { name: 'iframe_anomaly', detected: true, value: 'error', weight: 3 };
+  }
+}
+
+function checkConsoleLog(): HeadlessSignal {
+  const original = console.log.toString();
+  const isNative = original.includes('[native code]') || original.includes('{ [native code] }');
+  return { name: 'console_override', detected: !isNative, value: isNative ? 'native' : 'overridden', weight: 3 };
+}
+
+function checkPhantomJS(): HeadlessSignal {
+  const w = window as any;
+  const detected = !!(w._phantom || w.callPhantom || w.__phantomas);
+  return { name: 'phantomjs', detected, value: String(detected), weight: 20 };
+}
+
+function checkSeleniumArtifacts(): HeadlessSignal {
+  const w = window as any;
+  const d = document as any;
+  const artifacts = [
+    w._selenium, w._Selenium_IDE_Recorder, w.calledSelenium,
+    d.__webdriver_evaluate, d.__selenium_evaluate, d.__webdriver_script_function,
+    d.__webdriver_script_func, d.__webdriver_script_fn, d.__fxdriver_evaluate,
+    d.__driver_unwrapped, d.__webdriver_unwrapped, d.__driver_evaluate,
+    d.__selenium_unwrapped, d.__fxdriver_unwrapped,
+  ];
+  const found = artifacts.filter(a => a !== undefined).length;
+  return { name: 'selenium_artifacts', detected: found > 0, value: String(found), weight: 25 };
+}