jumpy-lion 0.1.6-beta.7 → 1.0.0-beta.0

package/dist/fingerprinting/profile-selector.js

@@ -0,0 +1,168 @@
+import { log } from 'crawlee';
+import { FingerprintGenerator } from 'fingerprint-generator';
+import { generateNonApifyFingerprint } from './non-apify-fingerprint-generator.js';
+import { describeOsConflict } from './os-consistency.js';
+import { rejectContaminatedProfile } from './profile-quality.js';
+import { osHintToPlatform, resolveOsHint, resolveSeedKey, } from '../session-profile.js';
+export const defaultProfilePoolPort = {
+    drawNonApify: async (opts) => generateNonApifyFingerprint(opts),
+    createApifyReroller: genOpts => new FingerprintGenerator(genOpts),
+};
+/** Key under which callers stamp the selection result onto the launch context. */
+export const PROFILE_SELECTION_KEY = 'profileSelection';
+const NON_APIFY_MAX_ATTEMPTS = 8;
+// The upstream Apify pool's contamination rate for macOS-arm is ~55-60%, so
+// 8 attempts has a ~0.6^8 = 1.7% miss rate but a clean profile may take
+// 15-20 tries when the rejection is hardware-coherence-strict.
+const APIFY_MAX_REROLL_ATTEMPTS = 32;
+/**
+ * Pick a clean fingerprint profile for the expected OS.
+ *
+ * Owns the whole selection protocol: seed-key resolution, OS-pin validation,
+ * os-hint expectation, pool choice (Apify synthetic vs non-Apify real-device),
+ * and the contamination re-roll loop gated by `rejectContaminatedProfile`.
+ *
+ * The pool-contamination background: the upstream fingerprint-generator
+ * dataset contains a recurring fraction of profiles from Lark/Feishu
+ * (ByteDance) modified Chrome installs - see `profile-quality.ts` for the
+ * telltales. A contaminated profile flows verbatim into FingerprintConfig and
+ * the C++ source-tree overrides dutifully spoof to it, so every
+ * CreepJS/DataDome/Naver run sees a bot. We re-roll until clean, capped.
+ *
+ * When `operatingSystems[0]` and the deprecated `fingerprintOptions.platform`
+ * contradict each other, `operatingSystems` wins and a warning is logged (see
+ * `describeOsConflict`) - the conflict is no longer fatal (issue #80).
+ */
+export async function selectFingerprintProfile(input, port = defaultProfilePoolPort) {
+    const fpOpts = input.fingerprintOptions;
+    const fpGenOpts = input.fingerprintGeneratorOptions;
+    const seedKey = resolveSeedKey({ proxyUrl: input.proxyUrl, explicitSeedKey: fpOpts?.seedKey });
+    const explicitPlatform = fpOpts?.platform;
+    // Defense in depth: catches direct CDPBrowserPlugin users who bypass the
+    // Crawler constructor. In a Crawler-driven launch crawler.ts has already
+    // warned + auto-filled, so this re-check cannot false-positive. Non-fatal:
+    // operatingSystems is the single source of truth and wins (issue #80).
+    const osConflict = describeOsConflict(fpGenOpts?.operatingSystems?.[0], explicitPlatform);
+    if (osConflict)
+        log.warning(osConflict);
+    // Priority: explicit fingerprintOptions.platform → pinned operatingSystems[0]
+    // → the OS of the fingerprint Crawlee already generated → host OS.
+    //
+    // The generated-fingerprint fallback is load-bearing: BrowserPool generates
+    // `launchContext.fingerprint` from its own `fingerprintGeneratorOptions` but
+    // does NOT copy those options onto `launchOptions`, so a pool-level OS pin
+    // only survives here through the generated fingerprint. We read the UA first
+    // and the platform only as a fallback: the upstream pool ships ~2.5% of
+    // "windows" draws whose UA + uaData say Windows but whose navigator.platform
+    // lies "Linux x86_64". Trusting platform there resolved the OS to linux and
+    // the non-Apify pool then drew a genuine Linux profile (issue: Win32 tests
+    // flaking to "Linux x86_64"). The UA is the coherent signal.
+    const currentNav = input.currentFingerprint?.fingerprint?.navigator;
+    const fingerprintUserAgent = currentNav?.userAgent;
+    const fingerprintPlatform = currentNav?.platform;
+    const expectedOs = resolveOsHint({
+        explicitPlatform,
+        operatingSystems: fpGenOpts?.operatingSystems,
+        fingerprintUserAgent,
+        fingerprintPlatform,
+        hostPlatform: input.hostPlatform,
+    });
+    const expectedPlatform = expectedOs ? osHintToPlatform(expectedOs) : null;
+    const reject = (fp) => rejectContaminatedProfile(fp, expectedPlatform);
+    const base = {
+        seedKey,
+        expectedOs,
+        expectedPlatform,
+    };
+    if (fpOpts?.useNonApifyFingerprints) {
+        // Real-device pool. Host-OS fallback at the end of the chain matches the
+        // crawler.ts default-OS policy (exotic hosts pool with Windows).
+        const osHint = expectedOs ?? 'windows';
+        // When `explicitPlatform` is unset, derive it from `osHint` so the pool's
+        // `platformToOs(platform)` mapping (which wins over the `os` field) lands
+        // on the same bucket.
+        const platformForPool = explicitPlatform ?? osHintToPlatform(osHint);
+        let fp = await port.drawNonApify({ platform: platformForPool, os: osHint, proxySeedKey: seedKey });
+        let rejection = reject(fp);
+        let attempts = 1;
+        while (rejection && attempts < NON_APIFY_MAX_ATTEMPTS) {
+            log.debug(`[AntiDetect] Rejected non-Apify profile (attempt ${attempts}): ${rejection}`);
+            fp = await port.drawNonApify({
+                platform: platformForPool,
+                os: osHint,
+                // Deterministic re-roll: same seed + attempt suffix → same escape path.
+                // With no seed key, the pool draw is deterministic per seed, so
+                // reusing `null` every attempt would redraw the SAME contaminated
+                // profile forever; a synthetic per-attempt seed makes each draw
+                // distinct while staying reproducible across runs.
+                proxySeedKey: seedKey ? `${seedKey}-r${attempts}` : `reroll-${attempts}`,
+            });
+            rejection = reject(fp);
+            attempts++;
+        }
+        if (rejection) {
+            log.warning(`[AntiDetect] non-Apify profile pool returned contaminated entries for ${NON_APIFY_MAX_ATTEMPTS} attempts; using last: ${rejection}`);
+        }
+        return {
+            ...base,
+            fingerprint: fp,
+            rerolls: attempts - 1,
+            rejection,
+            replaced: true,
+            usedNonApifyPool: true,
+        };
+    }
+    // Default Apify synthetic pool - also contains contaminated profiles
+    // (LarkUrl / Rambox / newsai / 184-cores / Linux-platform-with-Mac-UA).
+    let fp = input.currentFingerprint;
+    let rejection = reject(fp);
+    let attempts = 1;
+    if (rejection) {
+        const rerollGenOpts = {
+            ...(fpGenOpts ?? {}),
+            browsers: ['chrome'],
+            devices: ['desktop'],
+            // When the OS wasn't pinned via fingerprintGeneratorOptions (e.g. it
+            // came through BrowserPool-level config instead), constrain the
+            // re-roller to the resolved OS - otherwise it pulls host-biased
+            // profiles the platform filter then rejects, either shipping a
+            // wrong-OS profile or exhausting all attempts.
+            ...(expectedOs && !fpGenOpts?.operatingSystems
+                ? { operatingSystems: [expectedOs] }
+                : {}),
+        };
+        const reroller = input.externalGenerator?.getFingerprint
+            ? input.externalGenerator
+            : port.createApifyReroller(rerollGenOpts);
+        while (rejection && attempts < APIFY_MAX_REROLL_ATTEMPTS) {
+            log.debug(`[AntiDetect] Rejected Apify profile (attempt ${attempts}): ${rejection}`);
+            try {
+                const next = await reroller.getFingerprint();
+                if (!next)
+                    break;
+                fp = next;
+            }
+            catch (e) {
+                log.debug(`[AntiDetect] Re-roll attempt ${attempts} failed: ${e?.message}`);
+                break;
+            }
+            rejection = reject(fp);
+            attempts++;
+        }
+        if (rejection) {
+            log.warning(`[AntiDetect] Apify fingerprint pool kept returning contaminated entries after ${attempts - 1} re-rolls; using last: ${rejection}`);
+        }
+        else {
+            log.debug(`[AntiDetect] Escaped contaminated pool entry after ${attempts - 1} re-rolls`);
+        }
+    }
+    return {
+        ...base,
+        fingerprint: fp,
+        rerolls: attempts - 1,
+        rejection,
+        replaced: attempts > 1 && !!fp,
+        usedNonApifyPool: false,
+    };
+}
+//# sourceMappingURL=profile-selector.js.map

package/dist/fingerprinting/profile-selector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile-selector.js","sourceRoot":"","sources":["../../src/fingerprinting/profile-selector.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE7D,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EACH,gBAAgB,EAChB,aAAa,EACb,cAAc,GAGjB,MAAM,uBAAuB,CAAC;AA4C/B,MAAM,CAAC,MAAM,sBAAsB,GAAoB;IACnD,YAAY,EAAE,KAAK,EAAC,IAAI,EAAC,EAAE,CAAC,2BAA2B,CAAC,IAAI,CAA6B;IACzF,mBAAmB,EAAE,OAAO,CAAC,EAAE,CAAC,IAAI,oBAAoB,CAAC,OAAgB,CAAC;CAC7E,CAAC;AAuCF,kFAAkF;AAClF,MAAM,CAAC,MAAM,qBAAqB,GAAG,kBAAkB,CAAC;AAExD,MAAM,sBAAsB,GAAG,CAAC,CAAC;AACjC,4EAA4E;AAC5E,wEAAwE;AACxE,+DAA+D;AAC/D,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAErC;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC1C,KAA4B,EAC5B,OAAwB,sBAAsB;IAE9C,MAAM,MAAM,GAAG,KAAK,CAAC,kBAAkB,CAAC;IACxC,MAAM,SAAS,GAAG,KAAK,CAAC,2BAA2B,CAAC;IACpD,MAAM,OAAO,GAAG,cAAc,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAE/F,MAAM,gBAAgB,GAAG,MAAM,EAAE,QAAyC,CAAC;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,uEAAuE;IACvE,MAAM,UAAU,GAAG,kBAAkB,CAAC,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;IAC1F,IAAI,UAAU;QAAE,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAExC,8EAA8E;IAC9E,mEAAmE;IACnE,EAAE;IACF,4EAA4E;IAC5E,6EAA6E;IAC7E,2EAA2E;IAC3E,6EAA6E;IAC7E,wEAAwE;IACxE,6EAA6E;IAC7E,4EAA4E;IAC5E,2EAA2E;IAC3E,6DAA6D;IAC7D,MAAM,UAAU,GAAG,KAAK,CAAC,kBAAkB,EAAE,WAAW,EAAE,SACnB,CAAC;IACxC,MAAM,oBAAoB,GAAG,UAAU,EAAE,SAA+B,CAAC;IACzE,MAAM,mBAAmB,GAAG,UAAU,EAAE,QAA8B,CAAC;IACvE,MAAM,UAAU,GAAG,aAAa,CAAC;QAC7B,gBAAgB;QAChB,gBAAgB,EAAE,SAAS,EAAE,gBAAgB;QAC7C,oBAAoB;QACpB,mBAAmB;QACnB,YAAY,EAAE,KAAK,CAAC,YAAY;KACnC,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE1E,MAAM,MAAM,GAAG,CAAC,EAAW,EAAiB,EAAE,CAC1C,yBAAyB,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAEpD,MAAM,IAAI,GAAqG;QAC3G,OAAO;QACP,UAAU;QACV,gBAAgB;KACnB,CAAC;IAEF,IAAI,MAAM,EAAE,uBAAuB,EAAE,CAAC;QAClC,yEAAyE;QACzE,iEAAiE;QACjE,MAAM,MAAM,GAAG,UAAU,IAAI,SAAS,CAAC;QACvC,0EAA0E;QAC1E,0EAA0E;QAC1E,sBAAsB;QACtB,MAAM,eAAe,GAAG,gBAAgB,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACrE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;QACnG,IAAI,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3B,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,OAAO,SAAS,IAAI,QAAQ,GAAG,sBAAsB,EAAE,CAAC;YACpD,GAAG,CAAC,KAAK,CAAC,oDAAoD,QAAQ,MAAM,SAAS,EAAE,CAAC,CAAC;YACzF,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC;gBACzB,QAAQ,EAAE,eAAe;gBACzB,EAAE,EAAE,MAAM;gBACV,wEAAwE;gBACxE,gEAAgE;gBAChE,kEAAkE;gBAClE,gEAAgE;gBAChE,mDAAmD;gBACnD,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,KAAK,QAAQ,EAAE,CAAC,CAAC,CAAC,UAAU,QAAQ,EAAE;aAC3E,CAAC,CAAC;YACH,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;YACvB,QAAQ,EAAE,CAAC;QACf,CAAC;QACD,IAAI,SAAS,EAAE,CAAC;YACZ,GAAG,CAAC,OAAO,CAAC,yEAAyE,sBAAsB,0BAA0B,SAAS,EAAE,CAAC,CAAC;QACtJ,CAAC;QACD,OAAO;YACH,GAAG,IAAI;YACP,WAAW,EAAE,EAAE;YACf,OAAO,EAAE,QAAQ,GAAG,CAAC;YACrB,SAAS;YACT,QAAQ,EAAE,IAAI;YACd,gBAAgB,EAAE,IAAI;SACzB,CAAC;IACN,CAAC;IAED,qEAAqE;IACrE,wEAAwE;IACxE,IAAI,EAAE,GAAG,KAAK,CAAC,kBAAkB,CAAC;IAClC,IAAI,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;IAC3B,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,SAAS,EAAE,CAAC;QACZ,MAAM,aAAa,GAA4B;YAC3C,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC;YACpB,QAAQ,EAAE,CAAC,QAAQ,CAAC;YACpB,OAAO,EAAE,CAAC,SAAS,CAAC;YACpB,qEAAqE;YACrE,gEAAgE;YAChE,gEAAgE;YAChE,+DAA+D;YAC/D,+CAA+C;YAC/C,GAAG,CAAC,UAAU,IAAI,CAAC,SAAS,EAAE,gBAAgB;gBAC1C,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,UAAU,CAAC,EAAE;gBACpC,CAAC,CAAC,EAAE,CAAC;SACZ,CAAC;QACF,MAAM,QAAQ,GAAG,KAAK,CAAC,iBAAiB,EAAE,cAAc;YACpD,CAAC,CAAC,KAAK,CAAC,iBAAiB;YACzB,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,CAAC;QAC9C,OAAO,SAAS,IAAI,QAAQ,GAAG,yBAAyB,EAAE,CAAC;YACvD,GAAG,CAAC,KAAK,CAAC,gDAAgD,QAAQ,MAAM,SAAS,EAAE,CAAC,CAAC;YACrF,IAAI,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,cAAc,EAAE,CAAC;gBAC7C,IAAI,CAAC,IAAI;oBAAE,MAAM;gBACjB,EAAE,GAAG,IAAuB,CAAC;YACjC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACT,GAAG,CAAC,KAAK,CAAC,gCAAgC,QAAQ,YAAa,CAAW,EAAE,OAAO,EAAE,CAAC,CAAC;gBACvF,MAAM;YACV,CAAC;YACD,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;YACvB,QAAQ,EAAE,CAAC;QACf,CAAC;QACD,IAAI,SAAS,EAAE,CAAC;YACZ,GAAG,CAAC,OAAO,CAAC,iFAAiF,QAAQ,GAAG,CAAC,0BAA0B,SAAS,EAAE,CAAC,CAAC;QACpJ,CAAC;aAAM,CAAC;YACJ,GAAG,CAAC,KAAK,CAAC,sDAAsD,QAAQ,GAAG,CAAC,WAAW,CAAC,CAAC;QAC7F,CAAC;IACL,CAAC;IACD,OAAO;QACH,GAAG,IAAI;QACP,WAAW,EAAE,EAAE;QACf,OAAO,EAAE,QAAQ,GAAG,CAAC;QACrB,SAAS;QACT,QAAQ,EAAE,QAAQ,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE;QAC9B,gBAAgB,EAAE,KAAK;KAC1B,CAAC;AACN,CAAC"}

package/dist/fingerprinting/ua-alignment.d.ts

@@ -0,0 +1,83 @@
+/**
+ * UaAlignment - pure functions that align a fingerprint profile's version
+ * surfaces (User-Agent string, UA-CH brands/full-version list, the
+ * platform-consistency config, and injectable headers) with the version of
+ * the binary that is actually running.
+ *
+ * The fingerprint pool routinely ships profiles a few majors behind the
+ * shipped binary (132–135 vs 147+); an unaligned UA contradicts
+ * `Browser.getVersion` and every UA-CH surface - an instant detection signal.
+ * The injector probes the binary version over CDP and feeds it in here; all
+ * the rewriting itself is deterministic string/structure work, unit-testable
+ * without a browser.
+ */
+import type { PlatformConfig } from './fingerprint-overrides/platform-consistency.js';
+import type { UAClientHintsData } from './fingerprint-overrides/ua-ch.js';
+/**
+ * Re-stamp the Chrome version in a UA string to the running binary's major.
+ *
+ * Chrome UA Reduction (shipped Chrome 107+) freezes minor/build/patch to
+ * 0.0.0 in the User-Agent string - the full build version lives only in
+ * UA-CH uaFullVersion. We must use major.0.0.0 here or risk producing a
+ * non-existent version string like "Chrome/147.0.7727.56" which is trivially
+ * detectable.
+ *
+ * Direction matters: the UA is always pulled UP to the real binary, never the
+ * binary's identity pushed down to the profile's older major. A UA announcing a
+ * version the TLS/H2 handshake does not corroborate is itself a hard block -
+ * measured on `search.shopping.naver.com`, which refuses a Chrome/147 UA sent
+ * over a Chrome 142 handshake (issue #131). The binary is the ground truth
+ * every other surface aligns to.
+ */
+export declare function alignUserAgentWithBrowserVersion(userAgent: string, browserVersion: string | null): string;
+/**
+ * Align UA-CH brands with the actual running Chrome binary version.
+ *
+ * Every entry is rewritten, GREASE included. The GREASE token is not bogus
+ * padding: Chromium derives its separators, its fake version and the order of
+ * the three-entry list from the major version (see `ua-ch-brands.ts`), so a
+ * profile's GREASE token is a fingerprint of the major that profile came from.
+ * Keeping a Chrome 134 GREASE on a Chrome 147 UA produced a `sec-ch-ua` no
+ * Chromium has ever emitted - and a hard, challenge-free HTTP 418 on
+ * `search.shopping.naver.com` (issue #131).
+ */
+export declare function alignUAClientHintsVersion(uaClientHints: UAClientHintsData, fullVersion: string): UAClientHintsData;
+/**
+ * Platform-consistency config alignment: when using real fingerprint data,
+ * align its UA/appVersion with the actual binary version; when using
+ * hardcoded defaults, inject a minimal version-aligned UA for any known
+ * platform (Win32 / MacIntel / Linux x86_64) so we don't bake in the static
+ * Chrome/134.0.0.0 fallback. Returns the input untouched when no platform is
+ * requested - so the UA-mismatch warn log doesn't fire for runs that never
+ * inject the platform-consistency override.
+ */
+export declare function alignPlatformConfigWithBinary(platformConfig: PlatformConfig | undefined, requestedPlatform: string | undefined, actualChromeVersion: string | null): PlatformConfig | undefined;
+/**
+ * Filter fingerprint-generator headers down to the set injectable via CDP,
+ * apply the resolved Accept-Language (it wins over whatever the generator
+ * headers had so `fingerprintOptions.locale: 'ko-KR'` reaches the wire), and
+ * stamp the version-aligned User-Agent.
+ *
+ * `binaryVersion` also rewrites the UA-CH request headers, which
+ * `Network.setExtraHTTPHeaders` puts on the wire ABOVE whatever the
+ * `setUserAgentOverride` metadata would have produced. Forwarding the
+ * generator's copy verbatim shipped three separate contradictions (issue #131):
+ *
+ *   - the profile's ORIGINAL major next to an aligned User-Agent;
+ *   - a GREASE token from that original major;
+ *   - a third-party brand - 44 of the 200 bundled non-Apify rows carry a
+ *     `sec-ch-ua` header advertising **Brave** while their JS-side
+ *     `userAgentData.brands` says Google Chrome. The brand-cohort gate only
+ *     inspected the JS side, so the header walked straight past it.
+ *
+ * So `sec-ch-ua` is rebuilt from scratch - the canonical list a real Chrome of
+ * this binary emits - rather than aligned in place.
+ * `sec-ch-ua-full-version-list` is dropped instead of rewritten: it is a
+ * high-entropy hint that real Chrome sends only after an origin asks via
+ * `accept-ch`, so forcing it onto every request is itself a tell. Chrome emits
+ * it from the UA metadata when it is actually requested.
+ *
+ * Omit the argument (or pass null) to leave the headers alone.
+ */
+export declare function buildInjectableHeaders(headers: Record<string, string>, resolvedLanguages: string | undefined, alignedUserAgent: string, binaryVersion?: string | null): Record<string, string>;
+//# sourceMappingURL=ua-alignment.d.ts.map

package/dist/fingerprinting/ua-alignment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ua-alignment.d.ts","sourceRoot":"","sources":["../../src/fingerprinting/ua-alignment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACtF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAG1E;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gCAAgC,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAwBzG;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CACrC,aAAa,EAAE,iBAAiB,EAChC,WAAW,EAAE,MAAM,GACpB,iBAAiB,CAanB;AAgBD;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CACzC,cAAc,EAAE,cAAc,GAAG,SAAS,EAC1C,iBAAiB,EAAE,MAAM,GAAG,SAAS,EACrC,mBAAmB,EAAE,MAAM,GAAG,IAAI,GACnC,cAAc,GAAG,SAAS,CAmC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,sBAAsB,CAClC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,iBAAiB,EAAE,MAAM,GAAG,SAAS,EACrC,gBAAgB,EAAE,MAAM,EACxB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,GAC9B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAqCxB"}

package/dist/fingerprinting/ua-alignment.js

@@ -0,0 +1,197 @@
+/**
+ * UaAlignment - pure functions that align a fingerprint profile's version
+ * surfaces (User-Agent string, UA-CH brands/full-version list, the
+ * platform-consistency config, and injectable headers) with the version of
+ * the binary that is actually running.
+ *
+ * The fingerprint pool routinely ships profiles a few majors behind the
+ * shipped binary (132–135 vs 147+); an unaligned UA contradicts
+ * `Browser.getVersion` and every UA-CH surface - an instant detection signal.
+ * The injector probes the binary version over CDP and feeds it in here; all
+ * the rewriting itself is deterministic string/structure work, unit-testable
+ * without a browser.
+ */
+import { log } from 'crawlee';
+import { alignBrandList, buildSecChUaHeader, canonicalBrandList } from './ua-ch-brands.js';
+/**
+ * Re-stamp the Chrome version in a UA string to the running binary's major.
+ *
+ * Chrome UA Reduction (shipped Chrome 107+) freezes minor/build/patch to
+ * 0.0.0 in the User-Agent string - the full build version lives only in
+ * UA-CH uaFullVersion. We must use major.0.0.0 here or risk producing a
+ * non-existent version string like "Chrome/147.0.7727.56" which is trivially
+ * detectable.
+ *
+ * Direction matters: the UA is always pulled UP to the real binary, never the
+ * binary's identity pushed down to the profile's older major. A UA announcing a
+ * version the TLS/H2 handshake does not corroborate is itself a hard block -
+ * measured on `search.shopping.naver.com`, which refuses a Chrome/147 UA sent
+ * over a Chrome 142 handshake (issue #131). The binary is the ground truth
+ * every other surface aligns to.
+ */
+export function alignUserAgentWithBrowserVersion(userAgent, browserVersion) {
+    if (!browserVersion || !userAgent) {
+        return userAgent;
+    }
+    const uaMatch = userAgent.match(/Chrome\/(\d+\.\d+\.\d+\.\d+)/);
+    if (!uaMatch) {
+        return userAgent;
+    }
+    const majorVersion = browserVersion.split('.')[0];
+    const frozenVersion = `${majorVersion}.0.0.0`;
+    if (uaMatch[1] === frozenVersion) {
+        return userAgent;
+    }
+    const alignedUA = userAgent.replace(/Chrome\/\d+\.\d+\.\d+\.\d+/, `Chrome/${frozenVersion}`);
+    log.warning('User-Agent version mismatch detected. Aligning UA with running Chrome binary.', {
+        previousVersion: uaMatch[1],
+        binaryVersion: browserVersion,
+        alignedTo: frozenVersion,
+    });
+    return alignedUA;
+}
+/**
+ * Align UA-CH brands with the actual running Chrome binary version.
+ *
+ * Every entry is rewritten, GREASE included. The GREASE token is not bogus
+ * padding: Chromium derives its separators, its fake version and the order of
+ * the three-entry list from the major version (see `ua-ch-brands.ts`), so a
+ * profile's GREASE token is a fingerprint of the major that profile came from.
+ * Keeping a Chrome 134 GREASE on a Chrome 147 UA produced a `sec-ch-ua` no
+ * Chromium has ever emitted - and a hard, challenge-free HTTP 418 on
+ * `search.shopping.naver.com` (issue #131).
+ */
+export function alignUAClientHintsVersion(uaClientHints, fullVersion) {
+    const majorVersion = fullVersion.split('.')[0];
+    return {
+        ...uaClientHints,
+        brands: uaClientHints.brands
+            ? alignBrandList(uaClientHints.brands, majorVersion)
+            : uaClientHints.brands,
+        fullVersionList: uaClientHints.fullVersionList
+            ? alignBrandList(uaClientHints.fullVersionList, fullVersion)
+            : uaClientHints.fullVersionList,
+        uaFullVersion: fullVersion,
+    };
+}
+/**
+ * Per-platform UA "body" (everything between "Mozilla/5.0 (" … the OS token …
+ * ") AppleWebKit/537.36 (KHTML, like Gecko) Chrome/<ver> Safari/537.36").
+ * Used to synthesize a version-aligned fallback UA on the
+ * useFingerprintDefaults path so we never bake in the static Chrome/134.0.0.0
+ * fallback from platform-consistency. Keys match the requestedPlatform values
+ * (navigator.platform strings).
+ */
+const PLATFORM_UA_OS_TOKEN = {
+    'Win32': 'Windows NT 10.0; Win64; x64',
+    'MacIntel': 'Macintosh; Intel Mac OS X 10_15_7',
+    'Linux x86_64': 'X11; Linux x86_64',
+};
+/**
+ * Platform-consistency config alignment: when using real fingerprint data,
+ * align its UA/appVersion with the actual binary version; when using
+ * hardcoded defaults, inject a minimal version-aligned UA for any known
+ * platform (Win32 / MacIntel / Linux x86_64) so we don't bake in the static
+ * Chrome/134.0.0.0 fallback. Returns the input untouched when no platform is
+ * requested - so the UA-mismatch warn log doesn't fire for runs that never
+ * inject the platform-consistency override.
+ */
+export function alignPlatformConfigWithBinary(platformConfig, requestedPlatform, actualChromeVersion) {
+    if (!requestedPlatform) {
+        return platformConfig;
+    }
+    if (platformConfig?.userAgent && actualChromeVersion) {
+        return {
+            ...platformConfig,
+            userAgent: alignUserAgentWithBrowserVersion(platformConfig.userAgent, actualChromeVersion),
+            appVersion: platformConfig.appVersion
+                ? alignUserAgentWithBrowserVersion(platformConfig.appVersion, actualChromeVersion)
+                : platformConfig.appVersion,
+        };
+    }
+    const osToken = PLATFORM_UA_OS_TOKEN[requestedPlatform];
+    if (!platformConfig && actualChromeVersion && osToken) {
+        // useFingerprintDefaults=true path: override only the UA/appVersion
+        // fields so the hardcoded platform defaults pick up the real Chrome
+        // version instead of Chrome/134. appVersion is the UA minus the
+        // leading "Mozilla/".
+        //
+        // MAJOR.0.0.0, never the full build version: Chrome UA Reduction
+        // (107+) freezes minor/build/patch to zero in the UA string, so a
+        // synthesized "Chrome/147.0.7727.56" is a shape that no real Chrome
+        // emits - and it would contradict the plan-level `userAgent`
+        // (which alignUserAgentWithBrowserVersion already froze) plus every
+        // sec-ch-ua header derived from it. The full build version belongs
+        // only in UA-CH `uaFullVersion` / `fullVersionList`.
+        const frozenVersion = `${actualChromeVersion.split('.')[0]}.0.0.0`;
+        const userAgent = `Mozilla/5.0 (${osToken}) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/${frozenVersion} Safari/537.36`;
+        return {
+            userAgent,
+            appVersion: userAgent.replace(/^Mozilla\//, ''),
+        };
+    }
+    return platformConfig;
+}
+/**
+ * Filter fingerprint-generator headers down to the set injectable via CDP,
+ * apply the resolved Accept-Language (it wins over whatever the generator
+ * headers had so `fingerprintOptions.locale: 'ko-KR'` reaches the wire), and
+ * stamp the version-aligned User-Agent.
+ *
+ * `binaryVersion` also rewrites the UA-CH request headers, which
+ * `Network.setExtraHTTPHeaders` puts on the wire ABOVE whatever the
+ * `setUserAgentOverride` metadata would have produced. Forwarding the
+ * generator's copy verbatim shipped three separate contradictions (issue #131):
+ *
+ *   - the profile's ORIGINAL major next to an aligned User-Agent;
+ *   - a GREASE token from that original major;
+ *   - a third-party brand - 44 of the 200 bundled non-Apify rows carry a
+ *     `sec-ch-ua` header advertising **Brave** while their JS-side
+ *     `userAgentData.brands` says Google Chrome. The brand-cohort gate only
+ *     inspected the JS side, so the header walked straight past it.
+ *
+ * So `sec-ch-ua` is rebuilt from scratch - the canonical list a real Chrome of
+ * this binary emits - rather than aligned in place.
+ * `sec-ch-ua-full-version-list` is dropped instead of rewritten: it is a
+ * high-entropy hint that real Chrome sends only after an origin asks via
+ * `accept-ch`, so forcing it onto every request is itself a tell. Chrome emits
+ * it from the UA metadata when it is actually requested.
+ *
+ * Omit the argument (or pass null) to leave the headers alone.
+ */
+export function buildInjectableHeaders(headers, resolvedLanguages, alignedUserAgent, binaryVersion) {
+    const filteredHeaders = {};
+    const allowedHeaders = ['accept', 'accept-encoding', 'accept-language', 'user-agent', 'referer', 'sec-ch-ua', 'sec-ch-ua-mobile', 'sec-ch-ua-platform', 'sec-ch-ua-full-version-list'];
+    for (const [key, value] of Object.entries(headers)) {
+        if (allowedHeaders.includes(key.toLowerCase()) && typeof value === 'string') {
+            filteredHeaders[key] = value;
+        }
+    }
+    if (resolvedLanguages) {
+        filteredHeaders['accept-language'] = resolvedLanguages;
+        delete filteredHeaders['Accept-Language'];
+    }
+    if (alignedUserAgent) {
+        filteredHeaders['user-agent'] = alignedUserAgent;
+        delete filteredHeaders['User-Agent'];
+    }
+    if (binaryVersion) {
+        const majorVersion = binaryVersion.split('.')[0];
+        let hadSecChUa = false;
+        for (const key of Object.keys(filteredHeaders)) {
+            const name = key.toLowerCase();
+            if (name === 'sec-ch-ua') {
+                hadSecChUa = true;
+                delete filteredHeaders[key];
+            }
+            else if (name === 'sec-ch-ua-full-version-list') {
+                delete filteredHeaders[key];
+            }
+        }
+        if (hadSecChUa) {
+            filteredHeaders['sec-ch-ua'] = buildSecChUaHeader(canonicalBrandList(majorVersion));
+        }
+    }
+    return filteredHeaders;
+}
+//# sourceMappingURL=ua-alignment.js.map

package/dist/fingerprinting/ua-alignment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ua-alignment.js","sourceRoot":"","sources":["../../src/fingerprinting/ua-alignment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,GAAG,EAAE,MAAM,SAAS,CAAC;AAI9B,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAE3F;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,gCAAgC,CAAC,SAAiB,EAAE,cAA6B;IAC7F,IAAI,CAAC,cAAc,IAAI,CAAC,SAAS,EAAE,CAAC;QAChC,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAChE,IAAI,CAAC,OAAO,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,MAAM,aAAa,GAAG,GAAG,YAAY,QAAQ,CAAC;IAE9C,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,aAAa,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,4BAA4B,EAAE,UAAU,aAAa,EAAE,CAAC,CAAC;IAC7F,GAAG,CAAC,OAAO,CAAC,+EAA+E,EAAE;QACzF,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3B,aAAa,EAAE,cAAc;QAC7B,SAAS,EAAE,aAAa;KAC3B,CAAC,CAAC;IACH,OAAO,SAAS,CAAC;AACrB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yBAAyB,CACrC,aAAgC,EAChC,WAAmB;IAEnB,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAE/C,OAAO;QACH,GAAG,aAAa;QAChB,MAAM,EAAE,aAAa,CAAC,MAAM;YACxB,CAAC,CAAC,cAAc,CAAC,aAAa,CAAC,MAAM,EAAE,YAAY,CAAC;YACpD,CAAC,CAAC,aAAa,CAAC,MAAM;QAC1B,eAAe,EAAE,aAAa,CAAC,eAAe;YAC1C,CAAC,CAAC,cAAc,CAAC,aAAa,CAAC,eAAe,EAAE,WAAW,CAAC;YAC5D,CAAC,CAAC,aAAa,CAAC,eAAe;QACnC,aAAa,EAAE,WAAW;KAC7B,CAAC;AACN,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,oBAAoB,GAA2B;IACjD,OAAO,EAAE,6BAA6B;IACtC,UAAU,EAAE,mCAAmC;IAC/C,cAAc,EAAE,mBAAmB;CACtC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,6BAA6B,CACzC,cAA0C,EAC1C,iBAAqC,EACrC,mBAAkC;IAElC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACrB,OAAO,cAAc,CAAC;IAC1B,CAAC;IACD,IAAI,cAAc,EAAE,SAAS,IAAI,mBAAmB,EAAE,CAAC;QACnD,OAAO;YACH,GAAG,cAAc;YACjB,SAAS,EAAE,gCAAgC,CAAC,cAAc,CAAC,SAAS,EAAE,mBAAmB,CAAC;YAC1F,UAAU,EAAE,cAAc,CAAC,UAAU;gBACjC,CAAC,CAAC,gCAAgC,CAAC,cAAc,CAAC,UAAU,EAAE,mBAAmB,CAAC;gBAClF,CAAC,CAAC,cAAc,CAAC,UAAU;SAClC,CAAC;IACN,CAAC;IACD,MAAM,OAAO,GAAG,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;IACxD,IAAI,CAAC,cAAc,IAAI,mBAAmB,IAAI,OAAO,EAAE,CAAC;QACpD,oEAAoE;QACpE,oEAAoE;QACpE,gEAAgE;QAChE,sBAAsB;QACtB,EAAE;QACF,iEAAiE;QACjE,kEAAkE;QAClE,oEAAoE;QACpE,6DAA6D;QAC7D,oEAAoE;QACpE,mEAAmE;QACnE,qDAAqD;QACrD,MAAM,aAAa,GAAG,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QACnE,MAAM,SAAS,GAAG,gBAAgB,OAAO,mDAAmD,aAAa,gBAAgB,CAAC;QAC1H,OAAO;YACH,SAAS;YACT,UAAU,EAAE,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;SAClD,CAAC;IACN,CAAC;IACD,OAAO,cAAc,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,sBAAsB,CAClC,OAA+B,EAC/B,iBAAqC,EACrC,gBAAwB,EACxB,aAA6B;IAE7B,MAAM,eAAe,GAA2B,EAAE,CAAC;IACnD,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,6BAA6B,CAAC,CAAC;IACvL,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC1E,eAAe,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACjC,CAAC;IACL,CAAC;IAED,IAAI,iBAAiB,EAAE,CAAC;QACpB,eAAe,CAAC,iBAAiB,CAAC,GAAG,iBAAiB,CAAC;QACvD,OAAO,eAAe,CAAC,iBAAiB,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,gBAAgB,EAAE,CAAC;QACnB,eAAe,CAAC,YAAY,CAAC,GAAG,gBAAgB,CAAC;QACjD,OAAO,eAAe,CAAC,YAAY,CAAC,CAAC;IACzC,CAAC;IAED,IAAI,aAAa,EAAE,CAAC;QAChB,MAAM,YAAY,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;YAC/B,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;gBACvB,UAAU,GAAG,IAAI,CAAC;gBAClB,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC;YAChC,CAAC;iBAAM,IAAI,IAAI,KAAK,6BAA6B,EAAE,CAAC;gBAChD,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC;YAChC,CAAC;QACL,CAAC;QACD,IAAI,UAAU,EAAE,CAAC;YACb,eAAe,CAAC,WAAW,CAAC,GAAG,kBAAkB,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC;QACxF,CAAC;IACL,CAAC;IAED,OAAO,eAAe,CAAC;AAC3B,CAAC"}

package/dist/fingerprinting/ua-ch-brands.d.ts

@@ -0,0 +1,88 @@
+/**
+ * UA-CH brand-list derivation - the GREASE token, its version, and the order
+ * of the three-entry brand list are all deterministic functions of the Chrome
+ * major version. This module is the single source of truth for that
+ * derivation; every surface that emits `sec-ch-ua` /
+ * `navigator.userAgentData.brands` (JS injection, CDP
+ * `Network.setUserAgentOverride` metadata, the native FingerprintConfig JSON,
+ * the bundled profile tables) must go through it.
+ *
+ * Why this matters: the GREASE entry is NOT arbitrary padding. Chromium
+ * (`components/embedder_support/user_agent_utils.cc`,
+ * `GetGreasedUserAgentBrandVersion` / `GenerateBrandVersionList`) derives the
+ * separators, the fake version and the list order from the major version:
+ *
+ *     brand   = 'Not' + chars[major % 11] + 'A' + chars[(major + 1) % 11] + 'Brand'
+ *     version = versions[major % 3]
+ *     order   = ORDERS[major % 6]   // permutation of [greasey, chromium, brand]
+ *
+ * So a profile's GREASE token is a fingerprint of the major it was harvested
+ * from. Carrying a Chrome 134 GREASE (`"Not:A-Brand";v="24"`) on a Chrome 147
+ * User-Agent yields a `sec-ch-ua` no Chromium has ever emitted - four lines of
+ * server-side code catch it. `search.shopping.naver.com` does exactly that and
+ * answers HTTP 418 with no challenge (issue #131).
+ *
+ * Corroboration for the derivation (real Chrome, on the wire): majors 116
+ * (`Not)A;Brand`/24), 128 (`Not;A=Brand`/24), 131 (`Not_A Brand`/24), 142
+ * (`Not_A Brand`/99, accepted by Naver). The order rule was verified against
+ * the 187 harvested `sec-ch-ua` strings bundled in `non-apify-profiles.json`
+ * (majors 140, 142, 143, 144, 145, 146 - every one matches `major % 6`).
+ */
+export interface BrandVersion {
+    brand: string;
+    version: string;
+}
+/**
+ * Match the UA-CH GREASE brand token. Chrome rotates the label across releases
+ * ("Not_A Brand", "Not)A;Brand", "Not.A/Brand", …); the separators vary but the
+ * Not?A?Brand shape is stable. Anchored, so it only ever matches the GREASE
+ * entry and never a real brand.
+ */
+export declare function isGreaseBrand(brand: string): boolean;
+/** The GREASE brand + version a real Chromium of this major emits. */
+export declare function greasedBrandForMajor(major: number): BrandVersion;
+/**
+ * Rebuild a UA-CH brand list so it is byte-identical to what Chromium
+ * `version` emits: derived GREASE token, real brands re-stamped to `version`,
+ * and the triple permuted by `major % 6`.
+ *
+ * `version` selects the surface, from its own shape:
+ *   - `"147"`             → the `brands` surface; GREASE version is `"8"`
+ *   - `"147.0.7727.56"`   → the `fullVersionList` surface; GREASE version is `"8.0.0.0"`
+ *
+ * The profile's real brand *names* are preserved (a Chromium-only profile stays
+ * Chromium-only); only versions, the GREASE entry and the order are rewritten.
+ * A GREASE entry is added when the profile has none - a two-brand `sec-ch-ua`
+ * is refused by the same checks that reject a mismatched GREASE.
+ */
+export declare function alignBrandList(brands: BrandVersion[], version: string): BrandVersion[];
+/**
+ * The canonical brand list of a real Google Chrome build of `version` - what
+ * `sec-ch-ua` looks like when we have no profile brands to preserve.
+ */
+export declare function canonicalBrandList(version: string): BrandVersion[];
+/** Serialize a brand list into a `sec-ch-ua` / `sec-ch-ua-full-version-list` header value. */
+export declare function buildSecChUaHeader(brands: BrandVersion[]): string;
+/**
+ * Does this brand list carry the GREASE token its own major implies?
+ *
+ * Used as a pool-contamination gate: a real Chrome profile always agrees with
+ * the derivation, so a disagreement means the brand list was synthesized or
+ * re-stamped by something that did not know the rule (including older versions
+ * of this crawler). Returns a human-readable reason, or null when coherent.
+ */
+export declare function describeGreaseIncoherence(brands: BrandVersion[]): string | null;
+/**
+ * JS source for an expression that derives the brand list *inside the page*.
+ *
+ * The injected-script fallbacks (ua-ch, datadome-bypass) learn the Chrome
+ * version only at runtime, by parsing `navigator.userAgent`, so they cannot use
+ * the helpers above at build time. This keeps their derivation identical to
+ * ours instead of hardcoding a literal GREASE token that rots.
+ *
+ * @param majorExpr in-scope JS expression holding the major version
+ * @param versionExpr in-scope JS expression holding the version to stamp on the real brands
+ * @param style 'major' for the `brands` surface, 'full' for `fullVersionList`
+ */
+export declare function brandListScriptExpression(majorExpr: string, versionExpr: string, style: 'major' | 'full'): string;
+//# sourceMappingURL=ua-ch-brands.d.ts.map

package/dist/fingerprinting/ua-ch-brands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ua-ch-brands.d.ts","sourceRoot":"","sources":["../../src/fingerprinting/ua-ch-brands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,MAAM,WAAW,YAAY;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACnB;AAsBD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,sEAAsE;AACtE,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,CAIhE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,MAAM,GAAG,YAAY,EAAE,CA+BtF;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,EAAE,CAKlE;AAED,8FAA8F;AAC9F,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,CAEjE;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,GAAG,IAAI,CAoB/E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CACrC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,OAAO,GAAG,MAAM,GACxB,MAAM,CAeR"}