jumpy-lion 0.1.6-beta.7 → 1.0.0-beta.0

package/dist/fingerprinting/fingerprint-overrides/stealth-script.js

@@ -214,7 +214,7 @@ export const createStealthScript = () => {
                 Object.defineProperty(arr, 'item', { value: (index) => arr[index] || null, writable: false, enumerable: false });
                 Object.defineProperty(arr, 'namedItem', { value: (name) => arr[name] || null, writable: false, enumerable: false });
                 Object.defineProperty(arr, 'refresh', { value: () => {}, writable: false, enumerable: false });
-                // Allow for...of iteration — checked by DataDome and FingerprintJS Pro
+                // Allow for...of iteration - checked by DataDome and FingerprintJS Pro
                 arr[Symbol.iterator] = function* () { for (let i = 0; i < fakePlugins.length; i++) yield arr[i]; };
                 return arr;
             };
@@ -648,7 +648,7 @@ export const createStealthScript = () => {
         if (originalGetGamepads) {
             navigator.getGamepads = function() {
                 // Real Chrome returns GamepadList with 4 null slots when no gamepads
-                // connected — NOT an empty array.  [] vs [null,null,null,null] is a
+                // connected - NOT an empty array.  [] vs [null,null,null,null] is a
                 // checked difference between headed Chrome and headless/Chromium.
                 return [null, null, null, null];
             };
@@ -954,11 +954,50 @@ export const createStealthScript = () => {
     // meaning Cloudflare / Akamai / PerimeterX saw raw headless values.  Move them
     // here so all crawls benefit.
     const spoofDocumentVisibility = () => {
+        // Capture the real (browser-native) accessors before any instance-level
+        // override, so we can (1) detect spurious visibilitychange events that
+        // fire without an underlying state transition (typical of CDP-driven
+        // lifecycle commands - these would expose automation if they reached
+        // the page), and (2) during real OS-driven transitions, briefly yield
+        // to the real accessors so a page's visibilitychange listener sees a
+        // visibilityState consistent with the event it just received (which
+        // is what happens on real Chrome).
+        let _origVisibilityGet = null;
+        let _origHiddenGet = null;
         try {
-            Object.defineProperty(document, 'hidden', { get: () => false, configurable: true });
-            Object.defineProperty(document, 'visibilityState', { get: () => 'visible', configurable: true });
+            const _vDesc = Object.getOwnPropertyDescriptor(Document.prototype, 'visibilityState');
+            const _hDesc = Object.getOwnPropertyDescriptor(Document.prototype, 'hidden');
+            if (_vDesc && _vDesc.get) _origVisibilityGet = _vDesc.get;
+            if (_hDesc && _hDesc.get) _origHiddenGet = _hDesc.get;
         } catch (e) {}
 
+        const installSpoof = () => {
+            try {
+                Object.defineProperty(document, 'hidden',
+                    { get: () => false, configurable: true });
+                Object.defineProperty(document, 'visibilityState',
+                    { get: () => 'visible', configurable: true });
+            } catch (e) {}
+        };
+        const restoreReal = () => {
+            try {
+                Object.defineProperty(document, 'hidden', {
+                    get: function() {
+                        return _origHiddenGet ? _origHiddenGet.call(this) : false;
+                    },
+                    configurable: true
+                });
+                Object.defineProperty(document, 'visibilityState', {
+                    get: function() {
+                        return _origVisibilityGet ? _origVisibilityGet.call(this) : 'visible';
+                    },
+                    configurable: true
+                });
+            } catch (e) {}
+        };
+
+        installSpoof();
+
         document.hasFocus = function() { return true; };
         try {
             Object.defineProperty(document.hasFocus, 'toString', {
@@ -967,12 +1006,39 @@ export const createStealthScript = () => {
             });
         } catch (e) {}
 
-        // Suppress CDP-lifecycle-driven visibilitychange events that expose headless state
+        let _lastReal = _origVisibilityGet ? _origVisibilityGet.call(document) : 'visible';
+        let _restoring = false;
+
         const origAEL = document.addEventListener.bind(document);
-        const _hiddenEvtHandler = (e) => {
-            if (e.type === 'visibilitychange') { e.stopImmediatePropagation(); }
+        const _visibilityHandler = (e) => {
+            if (e.type !== 'visibilitychange') return;
+            if (!_origVisibilityGet) return;
+            const real = _origVisibilityGet.call(document);
+            if (real === _lastReal) {
+                // Spurious dispatch (e.g. CDP-driven). Suppress so it cannot
+                // betray automation through an event-without-state-change.
+                e.stopImmediatePropagation();
+                return;
+            }
+            _lastReal = real;
+
+            // Genuine OS-driven transition (macOS Space switch, minimize,
+            // fullscreen toggle, etc.). Let the event propagate so the page's
+            // render loop / animation timers can resume, but yield to the
+            // real accessors for the duration of the synchronous dispatch so
+            // listeners read a state consistent with the event. The spoof is
+            // re-installed in the next microtask, after sync listeners have
+            // finished running.
+            if (!_restoring) {
+                _restoring = true;
+                restoreReal();
+                Promise.resolve().then(() => {
+                    installSpoof();
+                    _restoring = false;
+                });
+            }
         };
-        origAEL('visibilitychange', _hiddenEvtHandler, true);
+        origAEL('visibilitychange', _visibilityHandler, true);
     };
 
     // 31. Encrypted Media Extensions (Widevine) Spoofing
@@ -1101,7 +1167,7 @@ export const createStealthScript = () => {
         applyProtection('Worker Constructor Protection', protectWorkerConstructor);
         applyProtection('SharedWorker Protection', protectSharedWorkerConstructor);
         applyProtection('PostMessage Protection', protectPostMessage);
-        // Chrome authenticity patches — make Chromium look like real Chrome
+        // Chrome authenticity patches - make Chromium look like real Chrome
         applyProtection('Document Visibility Spoofing', spoofDocumentVisibility);
         applyProtection('EME/Widevine Spoofing', spoofEME);
 

package/dist/fingerprinting/fingerprint-overrides/stealth-script.js.map

@@ -1 +1 @@
-{"version":3,"file":"stealth-script.js","sourceRoot":"","sources":["../../../src/fingerprinting/fingerprint-overrides/stealth-script.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAW,EAAE;IAC5C,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MA2kCL,CAAC;AACP,CAAC,CAAC"}
+{"version":3,"file":"stealth-script.js","sourceRoot":"","sources":["../../../src/fingerprinting/fingerprint-overrides/stealth-script.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAW,EAAE;IAC5C,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MA6oCL,CAAC;AACP,CAAC,CAAC"}

package/dist/fingerprinting/fingerprint-overrides/ua-ch.d.ts

@@ -23,5 +23,5 @@ export interface UAClientHintsData {
     uaFullVersion?: string;
     wow64?: boolean;
 }
-export declare const createUAClientHintsSpoofingScript: (platform?: string, generatedUAData?: UAClientHintsData) => string;
+export declare const createUAClientHintsSpoofingScript: (platform?: string, generatedUAData?: UAClientHintsData, binaryFullVersion?: string) => string;
 //# sourceMappingURL=ua-ch.d.ts.map

package/dist/fingerprinting/fingerprint-overrides/ua-ch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ua-ch.d.ts","sourceRoot":"","sources":["../../../src/fingerprinting/fingerprint-overrides/ua-ch.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,WAAW,iBAAiB;IAC9B,MAAM,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC9C,eAAe,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACvD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,eAAO,MAAM,iCAAiC,wCAExB,iBAAiB,KACpC,MAuNF,CAAC"}
+{"version":3,"file":"ua-ch.d.ts","sourceRoot":"","sources":["../../../src/fingerprinting/fingerprint-overrides/ua-ch.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,MAAM,WAAW,iBAAiB;IAC9B,MAAM,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC9C,eAAe,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACvD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,eAAO,MAAM,iCAAiC,wCAExB,iBAAiB,sBACf,MAAM,KAC3B,MAmOF,CAAC"}

package/dist/fingerprinting/fingerprint-overrides/ua-ch.js

@@ -5,7 +5,9 @@
  * to ensure UA-CH brands/versions match the generated userAgent string.
  * When not provided, falls back to hardcoded defaults.
  */
-export const createUAClientHintsSpoofingScript = (platform = 'Win32', generatedUAData) => {
+import { resolvePlatformVersion } from '../hardware-realism.js';
+import { brandListScriptExpression } from '../ua-ch-brands.js';
+export const createUAClientHintsSpoofingScript = (platform = 'Win32', generatedUAData, binaryFullVersion) => {
     // When generated data is available, use it directly for consistency
     // with the generated userAgent string. Otherwise use defaults.
     let platformData;
@@ -13,30 +15,34 @@ export const createUAClientHintsSpoofingScript = (platform = 'Win32', generatedU
     let architecture;
     let bitness;
     let wow64;
+    // platformVersion comes from hardware-realism.ts rather than a literal, so the
+    // no-profile path cannot advertise a stale macOS release or a kernel version
+    // on Linux (real Chrome sends an empty string there) - see issue #137. Index 0
+    // is the most common value for the platform.
     if (generatedUAData) {
         platformData = generatedUAData.platform || 'Windows';
-        platformVersion = generatedUAData.platformVersion || '15.0.0';
+        platformVersion = generatedUAData.platformVersion ?? resolvePlatformVersion(platform, 0);
         architecture = generatedUAData.architecture || 'x86';
         bitness = generatedUAData.bitness || '64';
         wow64 = generatedUAData.wow64 ?? false;
     }
     else if (platform.startsWith('Win') || platform === 'Win32') {
         platformData = 'Windows';
-        platformVersion = '15.0.0';
+        platformVersion = resolvePlatformVersion('Win32', 0);
         architecture = 'x86';
         bitness = '64';
         wow64 = false;
     }
     else if (platform.startsWith('Mac')) {
         platformData = 'macOS';
-        platformVersion = '15.3.0';
+        platformVersion = resolvePlatformVersion('MacIntel', 0);
         architecture = 'arm';
         bitness = '64';
         wow64 = false;
     }
     else {
         platformData = 'Linux';
-        platformVersion = '6.8.0';
+        platformVersion = resolvePlatformVersion('Linux x86_64', 0);
         architecture = 'x86';
         bitness = '64';
         wow64 = false;
@@ -45,8 +51,15 @@ export const createUAClientHintsSpoofingScript = (platform = 'Win32', generatedU
     // When no generated data, we parse the version from navigator.userAgent at runtime
     // to ensure JS-side brands match the HTTP-level Sec-CH-UA headers set by
     // Network.setUserAgentOverride (which also parses from the UA string).
-    const hasGeneratedVersion = !!generatedUAData?.uaFullVersion;
-    const fullVersion = generatedUAData?.uaFullVersion || '';
+    // UA-CH keeps the REAL build version even though UA Reduction froze the UA
+    // string to MAJOR.0.0.0 - real Chrome 147 reports 147.0.7727.56 in
+    // uaFullVersion / fullVersionList. Parsing the version out of
+    // navigator.userAgent (the old fallback) therefore reported 147.0.0.0, a
+    // shape no Chrome emits and one that gets every high-entropy request
+    // refused (issue #131). Prefer the profile's build, then the binary's own.
+    const resolvedFullVersion = generatedUAData?.uaFullVersion || binaryFullVersion || '';
+    const hasGeneratedVersion = !!resolvedFullVersion;
+    const fullVersion = resolvedFullVersion;
     // Brands - use generated data if available
     const brandsJson = generatedUAData?.brands
         ? JSON.stringify(generatedUAData.brands)
@@ -66,24 +79,25 @@ export const createUAClientHintsSpoofingScript = (platform = 'Win32', generatedU
     // Parse Chrome version from UA at runtime to stay in sync with
     // HTTP-level Sec-CH-UA set by Network.setUserAgentOverride.
     const _parsedMatch = navigator.userAgent.match(/Chrome\\/([\\d.]+)/);
-    const _rtFullVersion = _parsedMatch ? _parsedMatch[1] : '134.0.6998.88';
-    const _rtMajorVersion = _rtFullVersion.split('.')[0];
+    const _rtUaVersion = _parsedMatch ? _parsedMatch[1] : '134.0.6998.88';
+    const _rtMajorVersion = _rtUaVersion.split('.')[0];
+    // UA Reduction zeroes minor/build/patch in the UA string only; UA-CH keeps
+    // the real build. Never derive the full version from the UA - a
+    // "147.0.0.0" full-version list is refused by origins that request
+    // high-entropy hints (issue #131).
+    const _rtFullVersion = ${hasGeneratedVersion ? `"${resolvedFullVersion}"` : '_rtUaVersion'};
 
-    // Brand list - from generated fingerprint or derived from UA at runtime
+    // Brand list - from generated fingerprint or derived from UA at runtime.
+    // The runtime path derives the GREASE token and the list order from the
+    // major the way Chromium does (see ua-ch-brands.ts): a hardcoded
+    // "Not_A Brand";v="24" would contradict any major but 131 - the exact
+    // mismatch Naver answers with a challenge-free 418 (issue #131).
     const brands = Object.freeze(
-        ${brandsJson || `[
-            { brand: "Google Chrome", version: _rtMajorVersion },
-            { brand: "Chromium", version: _rtMajorVersion },
-            { brand: "Not_A Brand", version: "24" },
-        ]`}.map(b => Object.freeze(b))
+        ${brandsJson || brandListScriptExpression('_rtMajorVersion', '_rtMajorVersion', 'major')}.map(b => Object.freeze(b))
     );
 
     const fullVersionList = Object.freeze(
-        ${fullVersionListJson || `[
-            { brand: "Google Chrome", version: _rtFullVersion },
-            { brand: "Chromium", version: _rtFullVersion },
-            { brand: "Not_A Brand", version: "24.0.0.0" },
-        ]`}.map(b => Object.freeze(b))
+        ${fullVersionListJson || brandListScriptExpression('_rtMajorVersion', '_rtFullVersion', 'full')}.map(b => Object.freeze(b))
     );
     
     const mobile = false;

package/dist/fingerprinting/fingerprint-overrides/ua-ch.js.map

@@ -1 +1 @@
-{"version":3,"file":"ua-ch.js","sourceRoot":"","sources":["../../../src/fingerprinting/fingerprint-overrides/ua-ch.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAeH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAC7C,QAAQ,GAAG,OAAO,EAClB,eAAmC,EAC7B,EAAE;IACR,oEAAoE;IACpE,+DAA+D;IAC/D,IAAI,YAAoB,CAAC;IACzB,IAAI,eAAuB,CAAC;IAC5B,IAAI,YAAoB,CAAC;IACzB,IAAI,OAAe,CAAC;IACpB,IAAI,KAAc,CAAC;IAEnB,IAAI,eAAe,EAAE,CAAC;QAClB,YAAY,GAAG,eAAe,CAAC,QAAQ,IAAI,SAAS,CAAC;QACrD,eAAe,GAAG,eAAe,CAAC,eAAe,IAAI,QAAQ,CAAC;QAC9D,YAAY,GAAG,eAAe,CAAC,YAAY,IAAI,KAAK,CAAC;QACrD,OAAO,GAAG,eAAe,CAAC,OAAO,IAAI,IAAI,CAAC;QAC1C,KAAK,GAAG,eAAe,CAAC,KAAK,IAAI,KAAK,CAAC;IAC3C,CAAC;SAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC5D,YAAY,GAAG,SAAS,CAAC;QACzB,eAAe,GAAG,QAAQ,CAAC;QAC3B,YAAY,GAAG,KAAK,CAAC;QACrB,OAAO,GAAG,IAAI,CAAC;QACf,KAAK,GAAG,KAAK,CAAC;IAClB,CAAC;SAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,YAAY,GAAG,OAAO,CAAC;QACvB,eAAe,GAAG,QAAQ,CAAC;QAC3B,YAAY,GAAG,KAAK,CAAC;QACrB,OAAO,GAAG,IAAI,CAAC;QACf,KAAK,GAAG,KAAK,CAAC;IAClB,CAAC;SAAM,CAAC;QACJ,YAAY,GAAG,OAAO,CAAC;QACvB,eAAe,GAAG,OAAO,CAAC;QAC1B,YAAY,GAAG,KAAK,CAAC;QACrB,OAAO,GAAG,IAAI,CAAC;QACf,KAAK,GAAG,KAAK,CAAC;IAClB,CAAC;IAED,oDAAoD;IACpD,mFAAmF;IACnF,yEAAyE;IACzE,uEAAuE;IACvE,MAAM,mBAAmB,GAAG,CAAC,CAAC,eAAe,EAAE,aAAa,CAAC;IAC7D,MAAM,WAAW,GAAG,eAAe,EAAE,aAAa,IAAI,EAAE,CAAC;IAEzD,2CAA2C;IAC3C,MAAM,UAAU,GAAG,eAAe,EAAE,MAAM;QACtC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,MAAM,CAAC;QACxC,CAAC,CAAC,EAAE,CAAC;IAET,MAAM,mBAAmB,GAAG,eAAe,EAAE,eAAe;QACxD,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,eAAe,CAAC;QACjD,CAAC,CAAC,EAAE,CAAC;IAET,OAAO;;;;;;;;;;;;;;;;;UAiBD,UAAU,IAAI;;;;UAId;;;;UAIA,mBAAmB,IAAI;;;;UAIvB;;;;4BAIkB,YAAY;+BACT,eAAe;4BAClB,YAAY;uBACjB,OAAO;oBACV,KAAK;;;;;;;;;;;;yBAYA,mBAAmB,CAAC,CAAC,CAAC,IAAI,WAAW,GAAG,CAAC,CAAC,CAAC,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkHnF,CAAC;AACF,CAAC,CAAC"}
+{"version":3,"file":"ua-ch.js","sourceRoot":"","sources":["../../../src/fingerprinting/fingerprint-overrides/ua-ch.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAe/D,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAC7C,QAAQ,GAAG,OAAO,EAClB,eAAmC,EACnC,iBAA0B,EACpB,EAAE;IACR,oEAAoE;IACpE,+DAA+D;IAC/D,IAAI,YAAoB,CAAC;IACzB,IAAI,eAAuB,CAAC;IAC5B,IAAI,YAAoB,CAAC;IACzB,IAAI,OAAe,CAAC;IACpB,IAAI,KAAc,CAAC;IAEnB,+EAA+E;IAC/E,6EAA6E;IAC7E,+EAA+E;IAC/E,6CAA6C;IAC7C,IAAI,eAAe,EAAE,CAAC;QAClB,YAAY,GAAG,eAAe,CAAC,QAAQ,IAAI,SAAS,CAAC;QACrD,eAAe,GAAG,eAAe,CAAC,eAAe,IAAI,sBAAsB,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACzF,YAAY,GAAG,eAAe,CAAC,YAAY,IAAI,KAAK,CAAC;QACrD,OAAO,GAAG,eAAe,CAAC,OAAO,IAAI,IAAI,CAAC;QAC1C,KAAK,GAAG,eAAe,CAAC,KAAK,IAAI,KAAK,CAAC;IAC3C,CAAC;SAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC5D,YAAY,GAAG,SAAS,CAAC;QACzB,eAAe,GAAG,sBAAsB,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACrD,YAAY,GAAG,KAAK,CAAC;QACrB,OAAO,GAAG,IAAI,CAAC;QACf,KAAK,GAAG,KAAK,CAAC;IAClB,CAAC;SAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,YAAY,GAAG,OAAO,CAAC;QACvB,eAAe,GAAG,sBAAsB,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QACxD,YAAY,GAAG,KAAK,CAAC;QACrB,OAAO,GAAG,IAAI,CAAC;QACf,KAAK,GAAG,KAAK,CAAC;IAClB,CAAC;SAAM,CAAC;QACJ,YAAY,GAAG,OAAO,CAAC;QACvB,eAAe,GAAG,sBAAsB,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;QAC5D,YAAY,GAAG,KAAK,CAAC;QACrB,OAAO,GAAG,IAAI,CAAC;QACf,KAAK,GAAG,KAAK,CAAC;IAClB,CAAC;IAED,oDAAoD;IACpD,mFAAmF;IACnF,yEAAyE;IACzE,uEAAuE;IACvE,2EAA2E;IAC3E,mEAAmE;IACnE,8DAA8D;IAC9D,yEAAyE;IACzE,qEAAqE;IACrE,2EAA2E;IAC3E,MAAM,mBAAmB,GAAG,eAAe,EAAE,aAAa,IAAI,iBAAiB,IAAI,EAAE,CAAC;IACtF,MAAM,mBAAmB,GAAG,CAAC,CAAC,mBAAmB,CAAC;IAClD,MAAM,WAAW,GAAG,mBAAmB,CAAC;IAExC,2CAA2C;IAC3C,MAAM,UAAU,GAAG,eAAe,EAAE,MAAM;QACtC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,MAAM,CAAC;QACxC,CAAC,CAAC,EAAE,CAAC;IAET,MAAM,mBAAmB,GAAG,eAAe,EAAE,eAAe;QACxD,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,eAAe,CAAC;QACjD,CAAC,CAAC,EAAE,CAAC;IAET,OAAO;;;;;;;;;;;;;;;;;;6BAkBkB,mBAAmB,CAAC,CAAC,CAAC,IAAI,mBAAmB,GAAG,CAAC,CAAC,CAAC,cAAc;;;;;;;;UAQpF,UAAU,IAAI,yBAAyB,CAAC,iBAAiB,EAAE,iBAAiB,EAAE,OAAO,CAAC;;;;UAItF,mBAAmB,IAAI,yBAAyB,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,CAAC;;;;4BAI3E,YAAY;+BACT,eAAe;4BAClB,YAAY;uBACjB,OAAO;oBACV,KAAK;;;;;;;;;;;;yBAYA,mBAAmB,CAAC,CAAC,CAAC,IAAI,WAAW,GAAG,CAAC,CAAC,CAAC,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkHnF,CAAC;AACF,CAAC,CAAC"}

package/dist/fingerprinting/fingerprint-overrides/webgl-spoofing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webgl-spoofing.d.ts","sourceRoot":"","sources":["../../../src/fingerprinting/fingerprint-overrides/webgl-spoofing.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,WAAW;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,eAAO,MAAM,yBAAyB,sBAAuB,WAAW,KAAG,MAwQ1E,CAAC"}
+{"version":3,"file":"webgl-spoofing.d.ts","sourceRoot":"","sources":["../../../src/fingerprinting/fingerprint-overrides/webgl-spoofing.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,WAAW;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,eAAO,MAAM,yBAAyB,sBAAuB,WAAW,KAAG,MA2R1E,CAAC"}

package/dist/fingerprinting/fingerprint-overrides/webgl-spoofing.js

@@ -56,16 +56,35 @@ export const createWebGLSpoofingScript = (fingerprintWebGL) => {
                 ],
             },
             'MacIntel': {
-                vendors: ['Google Inc. (Apple)', 'Google Inc. (Intel)', 'Google Inc. (AMD)'],
+                // Modern Mac population is overwhelmingly Apple Silicon. Intel and
+                // AMD discrete-GPU Macs (2018-2020) are rare in 2026; including them
+                // creates a much wider hash distribution than reality and the
+                // discrete-GPU strings imply Metal hardware that can't match the
+                // SwiftShader-rendered pixels we actually produce. Pin to Apple
+                // Silicon variants so the spoofed renderer string and the actual
+                // rendering backend stay closer aligned.
+                vendors: ['Google Inc. (Apple)'],
                 renderers: [
+                    'ANGLE (Apple, Apple M1, OpenGL 4.1)',
                     'ANGLE (Apple, Apple M1 Pro, OpenGL 4.1)',
+                    'ANGLE (Apple, Apple M1 Max, OpenGL 4.1)',
                     'ANGLE (Apple, Apple M2, OpenGL 4.1)',
-                    'ANGLE (Intel Inc., Intel(R) Iris(TM) Plus Graphics OpenGL Engine, OpenGL 4.1)',
-                    'ANGLE (AMD, AMD Radeon Pro 5500M OpenGL Engine, OpenGL 4.1)',
+                    'ANGLE (Apple, Apple M2 Pro, OpenGL 4.1)',
+                    'ANGLE (Apple, Apple M2 Max, OpenGL 4.1)',
+                    'ANGLE (Apple, Apple M3, OpenGL 4.1)',
+                    'ANGLE (Apple, Apple M3 Pro, OpenGL 4.1)',
+                    'ANGLE (Apple, Apple M3 Max, OpenGL 4.1)',
+                    'ANGLE (Apple, Apple M4, OpenGL 4.1)',
+                    'ANGLE (Apple, Apple M4 Pro, OpenGL 4.1)',
                 ],
                 vendorPairs: [
+                    { vendor: 'Google Inc. (Apple)', renderer: 'ANGLE (Apple, Apple M1, OpenGL 4.1)' },
                     { vendor: 'Google Inc. (Apple)', renderer: 'ANGLE (Apple, Apple M1 Pro, OpenGL 4.1)' },
-                    { vendor: 'Google Inc. (Intel)', renderer: 'ANGLE (Intel Inc., Intel(R) Iris(TM) Plus Graphics OpenGL Engine, OpenGL 4.1)' },
+                    { vendor: 'Google Inc. (Apple)', renderer: 'ANGLE (Apple, Apple M2, OpenGL 4.1)' },
+                    { vendor: 'Google Inc. (Apple)', renderer: 'ANGLE (Apple, Apple M2 Pro, OpenGL 4.1)' },
+                    { vendor: 'Google Inc. (Apple)', renderer: 'ANGLE (Apple, Apple M3, OpenGL 4.1)' },
+                    { vendor: 'Google Inc. (Apple)', renderer: 'ANGLE (Apple, Apple M3 Pro, OpenGL 4.1)' },
+                    { vendor: 'Google Inc. (Apple)', renderer: 'ANGLE (Apple, Apple M4, OpenGL 4.1)' },
                 ],
             },
             'Linux x86_64': {
@@ -162,7 +181,7 @@ export const createWebGLSpoofingScript = (fingerprintWebGL) => {
         // Override getShaderPrecisionFormat to prevent GPU cross-referencing.
         // Anti-bot scripts can compare precision values against the claimed GPU/platform.
         // These values match the standard IEEE 754 precision formats reported by modern
-        // D3D11/Metal/Vulkan drivers — consistent across NVIDIA, AMD, and Intel GPUs.
+        // D3D11/Metal/Vulkan drivers - consistent across NVIDIA, AMD, and Intel GPUs.
         const _shaderPrecision = {
             35633: { // VERTEX_SHADER
                 36336: { rangeMin: 1, rangeMax: 1, precision: 8 },    // LOW_FLOAT
@@ -187,7 +206,7 @@ export const createWebGLSpoofingScript = (fingerprintWebGL) => {
             const fmt = shaderFmts && shaderFmts[precisionType];
             if (fmt) {
                 // Return a plain object that mirrors WebGLShaderPrecisionFormat fields.
-                // Anti-bot scripts read .rangeMin/.rangeMax/.precision — instanceof is not checked.
+                // Anti-bot scripts read .rangeMin/.rangeMax/.precision - instanceof is not checked.
                 return { rangeMin: fmt.rangeMin, rangeMax: fmt.rangeMax, precision: fmt.precision };
             }
             return _origGetShaderPrecisionFormat.apply(this, arguments);

package/dist/fingerprinting/fingerprint-overrides/webgl-spoofing.js.map

@@ -1 +1 @@
-{"version":3,"file":"webgl-spoofing.js","sourceRoot":"","sources":["../../../src/fingerprinting/fingerprint-overrides/webgl-spoofing.ts"],"names":[],"mappings":"AAAA;;;GAGG;AASH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,gBAA8B,EAAU,EAAE;IAChF,iFAAiF;IACjF,MAAM,cAAc,GAAG,gBAAgB,IAAI,CAAC,gBAAgB,CAAC,cAAc,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;IAElH,OAAO;;;;;;;;;;UAUD,cAAc,CAAC,CAAC,CAAC;;oCAES,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC;;;;SAI3D,CAAC,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;SAuFH;;;;;;;;;;;;;;;;;;;yBAmBgB,cAAc,IAAI,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,UAAU;;;yBAGxF,cAAc,IAAI,gBAAgB,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAgFjH,CAAC,cAAc,CAAC,CAAC,CAAC;;;;;;;;;SASnB,CAAC,CAAC,CAAC;;SAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MA2CH,CAAC;AACP,CAAC,CAAC"}
+{"version":3,"file":"webgl-spoofing.js","sourceRoot":"","sources":["../../../src/fingerprinting/fingerprint-overrides/webgl-spoofing.ts"],"names":[],"mappings":"AAAA;;;GAGG;AASH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,gBAA8B,EAAU,EAAE;IAChF,iFAAiF;IACjF,MAAM,cAAc,GAAG,gBAAgB,IAAI,CAAC,gBAAgB,CAAC,cAAc,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;IAElH,OAAO;;;;;;;;;;UAUD,cAAc,CAAC,CAAC,CAAC;;oCAES,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC;;;;SAI3D,CAAC,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;SA0GH;;;;;;;;;;;;;;;;;;;yBAmBgB,cAAc,IAAI,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,UAAU;;;yBAGxF,cAAc,IAAI,gBAAgB,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAgFjH,CAAC,cAAc,CAAC,CAAC,CAAC;;;;;;;;;SASnB,CAAC,CAAC,CAAC;;SAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MA2CH,CAAC;AACP,CAAC,CAAC"}

package/dist/fingerprinting/fingerprint-overrides/webrtc-spoofing.js

@@ -60,7 +60,7 @@ export const createWebRTCSpoofingScript = () => {
         if (!candidateStr) return candidateStr;
         // Match private/local IPs (10.x, 172.16-31.x, 192.168.x, fd00::/8, fe80::/10)
         return candidateStr
-            .replace(/(?:(?:10|127)\.\\d{1,3}|192\\.168|172\\.(?:1[6-9]|2\\d|3[01]))(?:\\.\\d{1,3}){2}/g, '0.0.0.0')
+            .replace(/(?:(?:10|127)\\.\\d{1,3}|192\\.168|172\\.(?:1[6-9]|2\\d|3[01]))(?:\\.\\d{1,3}){2}/g, '0.0.0.0')
             .replace(/[0-9a-f]{1,4}(?::[0-9a-f]{1,4}){7}/gi, (match) => {
                 if (match.startsWith('fd') || match.startsWith('fe80')) return '0.0.0.0';
                 return match;

package/dist/fingerprinting/hardware-realism.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Hardware- and OS-realism helpers shared by BOTH injection paths.
+ *
+ * The native (C++ FingerprintConfig) path and the JS-injection path each used
+ * to carry their own copy of these decisions, and they disagreed - which is how
+ * issue #137 happened:
+ *
+ *   - The native path fell back to a macOS platform version on LINUX profiles,
+ *     because 90% of the harvested Linux pool rows carry no platform version and
+ *     the fallback was a bare "15.0.0". A Linux Chrome reporting a Sequoia
+ *     version is a contradiction on its own, and the JS path meanwhile used
+ *     kernel-shaped values for Linux, so the two paths also disagreed with each
+ *     other.
+ *   - The native path resampled the pool's implausible `deviceMemory` values
+ *     (0 / 1 / 2 / 4 GB on machines that have never shipped with less than 8);
+ *     the JS path baked the raw value into the page, and because `0` is falsy it
+ *     skipped the override entirely and leaked the HOST's real RAM.
+ *   - The storage quota was derived from the RAW pool memory while the page
+ *     reported the resampled value, so a session could claim 32 GB of RAM with a
+ *     1 GB machine's disk quota.
+ *
+ * Everything here is a pure function of (seed, input), so both paths produce the
+ * same values for the same session and the whole surface stays coherent.
+ */
+/**
+ * UA-CH `platformVersion` candidates per `navigator.platform`.
+ *
+ * - **Linux** is the empty string. Chromium's `GetPlatformVersion()`
+ *   (components/embedder_support/user_agent_utils.cc) returns `std::string()` on
+ *   Linux once the platform-version reduction is enabled, and the harvested pool
+ *   corroborates it: 90% of real Linux rows carry no platform version at all.
+ *   Never a version number here, and never a macOS one.
+ * - **macOS** is Tahoe-era. Measured on a real macOS host running Chrome 150:
+ *   `sec-ch-ua-platform-version: "26.3.0"`. The pool agrees, with 57% of mac
+ *   rows on 26.x. Repeats weight the distribution toward the current release.
+ * - **Windows** keeps the UA-CH reduced mapping, which is overwhelmingly 15.0.0
+ *   for Windows 11 with a small tail at 14.0.0.
+ */
+export declare const PLATFORM_VERSION_CANDIDATES: Readonly<Record<string, readonly string[]>>;
+/**
+ * Resolve the UA-CH `platformVersion` for a platform, deterministically per
+ * seed. Both injection paths call this, so the JS override, the native config
+ * and the `sec-ch-ua-platform-version` header cannot disagree.
+ */
+export declare function resolvePlatformVersion(platform: string | undefined, seed: number): string;
+/**
+ * Pick a `navigator.deviceMemory` that a real machine of this class would
+ * report. Plausible upstream values pass through untouched; the pool's legacy
+ * spec-bucketed values (≤ 8 GB, including 0) are resampled from
+ * `MEMORY_DISTRIBUTION`.
+ *
+ * Guaranteed to return at least 8, so no caller can end up with a falsy value -
+ * that is what silently disabled the JS-path override and leaked the host's RAM.
+ */
+export declare function deriveRealisticDeviceMemory(seed: number, rawFromFingerprint: number | undefined): number;
+/**
+ * `navigator.storage.estimate().quota`, pinned per session so the host's real
+ * disk never leaks and so the same profile reports the same quota on every host.
+ *
+ * MUST be called with the memory value we actually report, not the raw pool
+ * value - the point is coherence between the two. Chrome's StorageManager
+ * reports roughly 60% of total disk space; the ±10% seed-driven jitter keeps
+ * different sessions from sharing one quota.
+ */
+export declare function deriveStorageQuota(seed: number, deviceMemoryGB: number): number;
+/**
+ * Stable non-negative hash of a session key, for paths that hold a seed STRING
+ * (the JS injector's proxy session key) rather than the numeric seed the native
+ * config generator computes. Math-only so the no-bitwise lint rule stays happy.
+ */
+export declare function stableSeedFromString(key: string): number;
+/**
+ * The platform version to advertise for a profile: the profile's own value when
+ * it has a usable one, otherwise a seeded candidate - except on Linux, where the
+ * answer is always the empty string.
+ *
+ * Linux is unconditional because the profile cannot be trusted there: 10% of the
+ * harvested Linux rows carry a kernel-shaped version (6.x) from before Chrome
+ * reduced the Linux platform version, and advertising one today announces a
+ * value current Chrome never sends.
+ */
+export declare function normalizePlatformVersion(platform: string | undefined, profileValue: string | undefined, seed: number): string;
+//# sourceMappingURL=hardware-realism.d.ts.map

package/dist/fingerprinting/hardware-realism.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hardware-realism.d.ts","sourceRoot":"","sources":["../../src/fingerprinting/hardware-realism.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AA0BH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,2BAA2B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAInF,CAAC;AAKF;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAKzF;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CASxG;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,MAAM,CAe/E;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAMxD;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CACpC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,IAAI,EAAE,MAAM,GACb,MAAM,CAOR"}

package/dist/fingerprinting/hardware-realism.js

@@ -0,0 +1,156 @@
+/**
+ * Hardware- and OS-realism helpers shared by BOTH injection paths.
+ *
+ * The native (C++ FingerprintConfig) path and the JS-injection path each used
+ * to carry their own copy of these decisions, and they disagreed - which is how
+ * issue #137 happened:
+ *
+ *   - The native path fell back to a macOS platform version on LINUX profiles,
+ *     because 90% of the harvested Linux pool rows carry no platform version and
+ *     the fallback was a bare "15.0.0". A Linux Chrome reporting a Sequoia
+ *     version is a contradiction on its own, and the JS path meanwhile used
+ *     kernel-shaped values for Linux, so the two paths also disagreed with each
+ *     other.
+ *   - The native path resampled the pool's implausible `deviceMemory` values
+ *     (0 / 1 / 2 / 4 GB on machines that have never shipped with less than 8);
+ *     the JS path baked the raw value into the page, and because `0` is falsy it
+ *     skipped the override entirely and leaked the HOST's real RAM.
+ *   - The storage quota was derived from the RAW pool memory while the page
+ *     reported the resampled value, so a session could claim 32 GB of RAM with a
+ *     1 GB machine's disk quota.
+ *
+ * Everything here is a pure function of (seed, input), so both paths produce the
+ * same values for the same session and the whole surface stays coherent.
+ */
+/**
+ * Memory sizes a real consumer machine reports. Chrome on desktop no longer
+ * clamps `navigator.deviceMemory` to the legacy W3C spec buckets - it reports
+ * the raw host RAM in GB (verified against a real Chrome on a 32 GB Mac, which
+ * reports 32). The upstream fingerprint pool still carries the old capped
+ * values, so anything at or below 8 is resampled.
+ */
+const PLAUSIBLE_RAW_MEMORY = new Set([16, 24, 32, 48, 64, 96, 128]);
+/**
+ * Cumulative-weight table over a realistic 2026 consumer RAM distribution. 8 GB
+ * survives as a minority (older Apple Silicon and budget PCs) - Apple's base
+ * configuration has been 16 GB since the M4 generation.
+ */
+const MEMORY_DISTRIBUTION = [
+    [8, 15],
+    [16, 55],
+    [24, 70],
+    [32, 90],
+    [48, 95],
+    [64, 99],
+    [128, 100],
+];
+/**
+ * UA-CH `platformVersion` candidates per `navigator.platform`.
+ *
+ * - **Linux** is the empty string. Chromium's `GetPlatformVersion()`
+ *   (components/embedder_support/user_agent_utils.cc) returns `std::string()` on
+ *   Linux once the platform-version reduction is enabled, and the harvested pool
+ *   corroborates it: 90% of real Linux rows carry no platform version at all.
+ *   Never a version number here, and never a macOS one.
+ * - **macOS** is Tahoe-era. Measured on a real macOS host running Chrome 150:
+ *   `sec-ch-ua-platform-version: "26.3.0"`. The pool agrees, with 57% of mac
+ *   rows on 26.x. Repeats weight the distribution toward the current release.
+ * - **Windows** keeps the UA-CH reduced mapping, which is overwhelmingly 15.0.0
+ *   for Windows 11 with a small tail at 14.0.0.
+ */
+export const PLATFORM_VERSION_CANDIDATES = {
+    'Win32': ['15.0.0', '15.0.0', '15.0.0', '14.0.0'],
+    'MacIntel': ['26.3.0', '26.3.0', '26.2.0', '26.1.0', '26.0.0', '15.6.0', '15.5.0'],
+    'Linux x86_64': [''],
+};
+/** Platform used when the requested one is unknown - desktop Windows dominates the population. */
+const PLATFORM_VERSION_FALLBACK_KEY = 'Win32';
+/**
+ * Resolve the UA-CH `platformVersion` for a platform, deterministically per
+ * seed. Both injection paths call this, so the JS override, the native config
+ * and the `sec-ch-ua-platform-version` header cannot disagree.
+ */
+export function resolvePlatformVersion(platform, seed) {
+    const candidates = PLATFORM_VERSION_CANDIDATES[platform ?? '']
+        ?? PLATFORM_VERSION_CANDIDATES[PLATFORM_VERSION_FALLBACK_KEY];
+    const index = Math.abs(Math.trunc(Number.isFinite(seed) ? seed : 0)) % candidates.length;
+    return candidates[index];
+}
+/**
+ * Pick a `navigator.deviceMemory` that a real machine of this class would
+ * report. Plausible upstream values pass through untouched; the pool's legacy
+ * spec-bucketed values (≤ 8 GB, including 0) are resampled from
+ * `MEMORY_DISTRIBUTION`.
+ *
+ * Guaranteed to return at least 8, so no caller can end up with a falsy value -
+ * that is what silently disabled the JS-path override and leaked the host's RAM.
+ */
+export function deriveRealisticDeviceMemory(seed, rawFromFingerprint) {
+    if (typeof rawFromFingerprint === 'number' && PLAUSIBLE_RAW_MEMORY.has(rawFromFingerprint)) {
+        return rawFromFingerprint;
+    }
+    const pick = Math.abs(Math.trunc(Number.isFinite(seed) ? seed : 0)) % 100;
+    for (const [gb, cumulative] of MEMORY_DISTRIBUTION) {
+        if (pick < cumulative)
+            return gb;
+    }
+    return 16;
+}
+/**
+ * `navigator.storage.estimate().quota`, pinned per session so the host's real
+ * disk never leaks and so the same profile reports the same quota on every host.
+ *
+ * MUST be called with the memory value we actually report, not the raw pool
+ * value - the point is coherence between the two. Chrome's StorageManager
+ * reports roughly 60% of total disk space; the ±10% seed-driven jitter keeps
+ * different sessions from sharing one quota.
+ */
+export function deriveStorageQuota(seed, deviceMemoryGB) {
+    // eslint-disable-next-line no-bitwise -- low bit selects between two SSD sizes
+    const lowBit = seed & 1;
+    let ssdSizeGB;
+    if (deviceMemoryGB <= 8) {
+        ssdSizeGB = lowBit ? 256 : 512;
+    }
+    else if (deviceMemoryGB <= 16) {
+        ssdSizeGB = lowBit ? 512 : 1024;
+    }
+    else {
+        ssdSizeGB = lowBit ? 1024 : 2048;
+    }
+    // eslint-disable-next-line no-bitwise -- byte 1 of the seed drives the jitter
+    const jitterFraction = (((seed >>> 8) & 0xFF) / 255) * 0.2 - 0.1;
+    const totalBytes = ssdSizeGB * 1024 * 1024 * 1024;
+    return Math.floor(totalBytes * (0.60 + jitterFraction));
+}
+/**
+ * Stable non-negative hash of a session key, for paths that hold a seed STRING
+ * (the JS injector's proxy session key) rather than the numeric seed the native
+ * config generator computes. Math-only so the no-bitwise lint rule stays happy.
+ */
+export function stableSeedFromString(key) {
+    let hash = 0x811C9DC5;
+    for (let i = 0; i < key.length; i++) {
+        hash = (hash * 31 + key.charCodeAt(i)) % 0x7FFFFFFF;
+    }
+    return hash;
+}
+/**
+ * The platform version to advertise for a profile: the profile's own value when
+ * it has a usable one, otherwise a seeded candidate - except on Linux, where the
+ * answer is always the empty string.
+ *
+ * Linux is unconditional because the profile cannot be trusted there: 10% of the
+ * harvested Linux rows carry a kernel-shaped version (6.x) from before Chrome
+ * reduced the Linux platform version, and advertising one today announces a
+ * value current Chrome never sends.
+ */
+export function normalizePlatformVersion(platform, profileValue, seed) {
+    if (platform === 'Linux x86_64') {
+        return '';
+    }
+    return profileValue && profileValue.length > 0
+        ? profileValue
+        : resolvePlatformVersion(platform, seed);
+}
+//# sourceMappingURL=hardware-realism.js.map

package/dist/fingerprinting/hardware-realism.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hardware-realism.js","sourceRoot":"","sources":["../../src/fingerprinting/hardware-realism.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH;;;;;;GAMG;AACH,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;AAEpE;;;;GAIG;AACH,MAAM,mBAAmB,GAAgC;IACrD,CAAC,CAAC,EAAE,EAAE,CAAC;IACP,CAAC,EAAE,EAAE,EAAE,CAAC;IACR,CAAC,EAAE,EAAE,EAAE,CAAC;IACR,CAAC,EAAE,EAAE,EAAE,CAAC;IACR,CAAC,EAAE,EAAE,EAAE,CAAC;IACR,CAAC,EAAE,EAAE,EAAE,CAAC;IACR,CAAC,GAAG,EAAE,GAAG,CAAC;CACb,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAgD;IACpF,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC;IACjD,UAAU,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC;IAClF,cAAc,EAAE,CAAC,EAAE,CAAC;CACvB,CAAC;AAEF,kGAAkG;AAClG,MAAM,6BAA6B,GAAG,OAAO,CAAC;AAE9C;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAA4B,EAAE,IAAY;IAC7E,MAAM,UAAU,GAAG,2BAA2B,CAAC,QAAQ,IAAI,EAAE,CAAC;WACvD,2BAA2B,CAAC,6BAA6B,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC;IACzF,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAAY,EAAE,kBAAsC;IAC5F,IAAI,OAAO,kBAAkB,KAAK,QAAQ,IAAI,oBAAoB,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACzF,OAAO,kBAAkB,CAAC;IAC9B,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;IAC1E,KAAK,MAAM,CAAC,EAAE,EAAE,UAAU,CAAC,IAAI,mBAAmB,EAAE,CAAC;QACjD,IAAI,IAAI,GAAG,UAAU;YAAE,OAAO,EAAE,CAAC;IACrC,CAAC;IACD,OAAO,EAAE,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,cAAsB;IACnE,+EAA+E;IAC/E,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC;IACxB,IAAI,SAAiB,CAAC;IACtB,IAAI,cAAc,IAAI,CAAC,EAAE,CAAC;QACtB,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IACnC,CAAC;SAAM,IAAI,cAAc,IAAI,EAAE,EAAE,CAAC;QAC9B,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACpC,CAAC;SAAM,CAAC;QACJ,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACrC,CAAC;IACD,8EAA8E;IAC9E,MAAM,cAAc,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC;IACjE,MAAM,UAAU,GAAG,SAAS,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;IAClD,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC5C,IAAI,IAAI,GAAG,UAAU,CAAC;IACtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC;IACxD,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB,CACpC,QAA4B,EAC5B,YAAgC,EAChC,IAAY;IAEZ,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;QAC9B,OAAO,EAAE,CAAC;IACd,CAAC;IACD,OAAO,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC;QAC1C,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AACjD,CAAC"}