phasmid-profile-gen 0.1.1__tar.gz

phasmid_profile_gen-0.1.1/.gitignore

@@ -0,0 +1,9 @@
+__pycache__/
+*.py[cod]
+.venv/
+.pytest_cache/
+.ruff_cache/
+dist/
+build/
+*.egg-info/
+.claude-scratch/

phasmid_profile_gen-0.1.1/.pre-commit-config.yaml

@@ -0,0 +1,8 @@
+repos:
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.13.0
+    hooks:
+      - id: ruff-check
+        args: [--fix]
+      - id: ruff-format
+

phasmid_profile_gen-0.1.1/.python-version

@@ -0,0 +1 @@
+3.12

phasmid_profile_gen-0.1.1/.ruff.toml

@@ -0,0 +1,63 @@
+# Exclude a variety of commonly ignored directories.
+exclude = [
+    ".bzr",
+    ".direnv",
+    ".eggs",
+    ".git",
+    ".git-rewrite",
+    ".hg",
+    ".ipynb_checkpoints",
+    ".mypy_cache",
+    ".nox",
+    ".pants.d",
+    ".pyenv",
+    ".pytest_cache",
+    ".pytype",
+    ".ruff_cache",
+    ".svn",
+    ".tox",
+    ".venv",
+    ".vscode",
+    "__pypackages__",
+    "_build",
+    "buck-out",
+    "build",
+    "dist",
+    "node_modules",
+    "site-packages",
+    "venv",
+    "*/migrations/*",
+]
+
+line-length = 100
+indent-width = 4
+
+[lint]
+select = [
+    "E",  # pycodestyle errors
+    "W",  # pycodestyle warnings
+    "F",  # pyflakes
+    "I",  # isort
+    "B",  # flake8-bugbear
+    "C4",  # flake8-comprehensions
+    "UP",  # pyupgrade
+]
+ignore = [
+]
+
+# Per-file ignores for common patterns
+[lint.per-file-ignores]
+"**/tests/**" = [
+    "F841",  # Local variable is assigned to but never used
+]
+
+[format]
+# Like Black, use double quotes for strings.
+quote-style = "double"
+
+# Like Black, indent with spaces, rather than tabs.
+indent-style = "space"
+
+# Like Black, respect magic trailing commas.
+skip-magic-trailing-comma = false
+

phasmid_profile_gen-0.1.1/CHANGELOG.md

@@ -0,0 +1,34 @@
+# Changelog
+
+## Unreleased
+
+- Profiles come from the bundled captures only. BrowserForge's network and the
+  fpgen GPU-claim extract are gone (with `forge.json.xz`, `fpgen.json.xz` and
+  the `build-data` dependency group): every device field is one capture's,
+  and `gpu=` selects a capture with that GPU.
+- `ProfileGenerator` protocol for choosing the capture, passed as
+  `generate_profile(generator=)`. `RandomCapture` (the default) draws one of
+  the OS's captures uniformly from the seed; `from_capture` builds the profile.
+- `list_gpus()` reports `captures` per GPU instead of `weight`.
+- `MissingCaptures` no longer carries a draft; `generate --draft` is removed.
+
+First release: Phasmid's `tools/genprofile` as a package, with its data bundled.
+
+- Generates the same profiles as `tools/genprofile` from the same captures,
+  byte for byte except for the generator's name in `captured.note`.
+- Data built from Phasmid at the commit in `data/manifest.json`, BrowserForge's
+  fingerprint network (`apify_fingerprint_datapoints` 0.15.0) and further
+  captures: seven in all (one Linux, six Windows).
+- Captures are named by OS family and PCI ids (`windows-0x8086-0x0412`). The
+  manifest lists refused dumps by hash only.
+- A Windows capture backs only its own marketing version (10 or 11), so the
+  claimed `platformVersion` agrees with the capture's fonts and colours.
+- One capture (`0x5916`) reports a heap limit that no whole-MB RAM gives
+  exactly, so its RAM is the nearest whole MB (8053) and its heap limit the one
+  the browser computes for it; `manifest.json` lists both as `assumed`.
+- A Windows sample that drew 640 CPU threads (over the schema's 256; about 1 seed
+  in 500) fails validation in `tools/genprofile`. It is drawn again here; every
+  other seed's profile is the same as there.
+- `PHASMID_GEOIP_MMDB` / `--geoip-db` use a DB-IP City Lite build other than
+  the pinned one once DB-IP stops serving it.
+- CLI subcommands: `generate`, `locate`, `gpus`, `captures`, `geoip`, `validate`.

phasmid_profile_gen-0.1.1/LICENSE

@@ -0,0 +1,30 @@
+BSD 3-Clause License
+
+Copyright (c) 2026, The Phasmid Authors
+Copyright (c) 2015-2026, The ungoogled-chromium Authors
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

phasmid_profile_gen-0.1.1/PKG-INFO

@@ -0,0 +1,219 @@
+Metadata-Version: 2.5
+Name: phasmid-profile-gen
+Version: 0.1.1
+Summary: Generate Phasmid browser profiles from captured real devices
+Project-URL: Homepage, https://github.com/tintty1/phasmid-profile-gen
+Project-URL: Repository, https://github.com/tintty1/phasmid-profile-gen
+Project-URL: Issues, https://github.com/tintty1/phasmid-profile-gen/issues
+License-Expression: BSD-3-Clause
+License-File: LICENSE
+License-File: src/phasmid_profile_gen/data/LICENSES.md
+Keywords: browser fingerprint,browser profile,chromium,phasmid
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Internet :: WWW/HTTP :: Browsers
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Requires-Python: >=3.12
+Requires-Dist: jsonschema>=4.23
+Provides-Extra: location
+Requires-Dist: maxminddb==3.2.0; extra == 'location'
+Requires-Dist: timezonefinder-data==4.2026.5; extra == 'location'
+Requires-Dist: timezonefinder==9.2.0; extra == 'location'
+Description-Content-Type: text/markdown
+
+# phasmid-profile-gen
+
+[![Test](https://github.com/tintty1/phasmid-profile-gen/actions/workflows/test.yml/badge.svg)](https://github.com/tintty1/phasmid-profile-gen/actions/workflows/test.yml)
+[![License: BSD-3-Clause](https://img.shields.io/badge/License-BSD_3--Clause-blue.svg)](LICENSE)
+[![Python 3.12+](https://img.shields.io/badge/python-3.12+-blue.svg)](https://www.python.org/downloads/)
+
+Generates device profiles for [Phasmid](https://github.com/tintty1/phasmid), the
+Chromium fork that reports the device described by one JSON profile instead of
+the machine it runs on.
+
+Every device field of a profile comes from one capture of a real device: no
+population model is sampled and no GPU identity is derived. The captures, the
+schema and the locale tables are bundled in compressed form, so it runs without
+a Phasmid checkout.
+
+## Install
+
+```bash
+pip install phasmid-profile-gen                # profiles with a given time zone
+pip install 'phasmid-profile-gen[location]'    # also place profiles at a proxy exit IP
+```
+
+Python 3.12 or newer. The `location` extra adds `timezonefinder` (with its
+boundary data, about 33 MB) and `maxminddb`, pinned exactly because they decide
+which zone and position a seed gets.
+
+## Use
+
+```python
+from phasmid_profile_gen import dumps, generate_profile
+
+# Placed where the proxy comes out: zone, geolocation, WebRTC address, languages.
+profile = generate_profile("windows", exit_ip=proxy_exit_ip)
+
+# Or with an explicit locale, reproducibly.
+profile = generate_profile(
+    "linux",
+    seed="0a1b2c3d4e5f60718293a4b5c6d7e8f9",
+    timezone="Europe/Berlin",
+    languages=["de-DE", "de", "en-US", "en"],
+)
+open("profile.json", "w").write(dumps(profile))
+```
+
+```bash
+phasmid-profile-gen generate --os windows --exit-ip <proxy exit IP> -o profile.json
+phasmid-profile-gen generate --os linux --seed 0a1b2c3d4e5f60718293a4b5c6d7e8f9 \
+    --timezone Europe/Berlin --languages de-DE,de,en-US,en -o profile.json
+phasmid-profile-gen gpus          # GPUs the bundled captures back (for --gpu)
+phasmid-profile-gen captures      # the bundled captures
+phasmid-profile-gen locate <proxy exit IP> --seed <seed>
+phasmid-profile-gen validate profile.json
+```
+
+Give exactly one of an exit IP and a time zone. **Generate Windows profiles
+with an exit IP.** Windows Chrome answers geolocation from the system location
+provider, so a Windows profile with no position is a stronger tell than a Linux
+one. The seed is 32 lowercase hex characters. When omitted, a new one is drawn;
+read it back from `profile["seed"]`. The same seed and inputs always give the
+same bytes (`dumps`).
+
+### Choosing the capture
+
+Which capture backs a profile is a `ProfileGenerator`'s choice: any object
+with `generate(request: Request) -> dict`. The default, `RandomCapture()`,
+draws one of the OS's captures (those with the requested GPU, when `gpu=` is
+given) uniformly from the seed. Pass another strategy as `generator=`;
+`from_capture(capture, request)` builds the profile once a capture is chosen:
+
+```python
+from phasmid_profile_gen import Request, catalog, from_capture, generate_profile
+
+class Newest:
+    def generate(self, request: Request) -> dict:
+        captures = [c for c in catalog() if c.family == request.family]
+        newest = max(captures, key=lambda c: c.date)
+        return from_capture(newest, request, how="the newest capture")
+
+profile = generate_profile("windows", timezone="UTC", generator=Newest())
+```
+
+A generator draws only from `request.seed` (`_rng.decision_rng(seed,
+decision)`), so a seed keeps giving the same profile. `generate_profile`
+validates whatever it returns.
+
+Other functions: `locate(ip, seed)`, `list_gpus()`, `list_captures()`,
+`validate(profile)` (against the bundled Phasmid schema) and `new_seed()`.
+Errors are `GenerationError`, `LocationError` and `geoip.GeoipError`.
+
+## What a profile is made of
+
+| Part | From |
+| --- | --- |
+| OS identity and version, CPU threads, memory, touch points, screen and window geometry, GPU with its WebGL and WebGPU surface, fonts, voices, audio, codecs, system colours, pointer, preferences, RAM, disk, media devices, battery, connection | One capture of a real device, taken whole. |
+| Time zone, geolocation, WebRTC public IP, languages | The exit IP: DB-IP City Lite, timezonefinder, CLDR, and Chrome's default accept-languages for the country's UI locale. Otherwise the time zone and languages you pass. |
+
+No user-agent or version string is written. Phasmid builds those from its own
+version. Nothing is invented: a field only a capture can supply is never
+filled in by guessing, and an OS without a capture fails with
+`MissingCaptures`. `captured.note` records where every part came from.
+
+### Bundled captures
+
+Run `phasmid-profile-gen captures` for the current list. It is also in
+[`data/manifest.json`](src/phasmid_profile_gen/data/manifest.json), which lists
+the dumps refused and why.
+
+Each is named by its OS family and PCI ids (`windows-0x8086-0x0412`). Where a
+capture has no media device labels (a page visit grants no media permission),
+profiles built from it claim no microphone, speaker or camera.
+
+A profile's OS version is its capture's, so a Windows 11 capture gives
+Windows 11 profiles with Windows 11 fonts and colours.
+
+## The location database
+
+The exit IP is looked up in DB-IP IP to City Lite (CC BY 4.0, "IP Geolocation
+by DB-IP"). It is about 127 MB, so it is not bundled. The build pinned in
+`data/dbip-city-lite.json` is downloaded on first use, checked against the
+pin, and kept in `$XDG_CACHE_HOME/phasmid/geoip/`. That is the cache Phasmid's
+tools use, so an existing download is reused.
+
+```bash
+phasmid-profile-gen geoip                     # download and verify now
+phasmid-profile-gen geoip --archive dbip-city-lite-2026-10.mmdb.gz
+```
+
+DB-IP serves only the last two monthly builds. Once the pinned one is gone,
+either install a saved copy with `--archive`, or use any other DB-IP City Lite
+build with `PHASMID_GEOIP_MMDB=/path/to/dbip-city-lite.mmdb`, `--geoip-db` or
+`geoip_db=`. Another build is not checked against the pin; the profile's note
+names its build date and sha256 instead.
+
+## Rebuilding the data
+
+`src/phasmid_profile_gen/data/` is generated, compressed and committed. It is
+rebuilt from a Phasmid checkout and further harness dumps by
+[`scripts/build_data.py`](scripts/build_data.py):
+
+```bash
+uv run python scripts/build_data.py \
+    --phasmid ../phasmid \
+    --dumps /path/to/dumps
+```
+
+The build:
+
+- maps every dump with the checkout's own `tests/consistency/capture.py` (the
+  code `consistency capture` runs), and checks Phasmid's captures against their
+  records as `tools/genprofile` does;
+- keeps a dump only if it is stock desktop Google Chrome on Windows
+  or Linux, with a hardware GPU, a consistent UA and UA-CH, and a window inside
+  its screen, and only if it maps to a valid profile. Each refusal is listed
+  with its reason in `manifest.json`;
+- takes the nearest whole-MB RAM when a dump's heap limit sits within 1 MiB of
+  one but matches none exactly (a fraction of a MB of RAM), sets the heap limit
+  to the one the browser computes for it, and lists both as `assumed` in
+  `manifest.json`; a limit further off is refused;
+- stores only what generation reads, under a neutral name (OS family and PCI
+  ids). Raw dumps, file names, notes and the device's locale are never written,
+  and a refused dump is listed by hash only.
+
+The output is deterministic, so a rebuild from the same sources gives the same
+bytes. A Linux dump also needs the operator's OS version (`operator.os_version`),
+which a page cannot read.
+
+## Develop
+
+```bash
+uv sync --all-extras
+uv run pytest
+uv run pre-commit run --all-files
+PHASMID_GEOIP_NETWORK=1 uv run pytest -m network   # reads the real DB-IP build
+```
+
+Releases are published to PyPI by `.github/workflows/publish-pypi.yaml` when a
+GitHub release is published. The version comes from the release tag
+(`uv-dynamic-versioning`, e.g. `v0.1.0`). Publishing uses PyPI trusted
+publishing: register the repository and that workflow as a trusted publisher
+of `phasmid-profile-gen` on PyPI once.
+
+## Licence
+
+The code is BSD 3-Clause, as Phasmid is ([`LICENSE`](LICENSE)). The bundled
+data keeps its sources' licences:
+
+- Unicode CLDR: Unicode License v3.
+- Chromium's locale table: BSD-style.
+
+DB-IP (CC BY 4.0) and timezone-boundary-builder (ODbL 1.0) are used at runtime
+but not bundled. See
+[`data/LICENSES.md`](src/phasmid_profile_gen/data/LICENSES.md).

phasmid_profile_gen-0.1.1/README.md

@@ -0,0 +1,192 @@
+# phasmid-profile-gen
+
+[![Test](https://github.com/tintty1/phasmid-profile-gen/actions/workflows/test.yml/badge.svg)](https://github.com/tintty1/phasmid-profile-gen/actions/workflows/test.yml)
+[![License: BSD-3-Clause](https://img.shields.io/badge/License-BSD_3--Clause-blue.svg)](LICENSE)
+[![Python 3.12+](https://img.shields.io/badge/python-3.12+-blue.svg)](https://www.python.org/downloads/)
+
+Generates device profiles for [Phasmid](https://github.com/tintty1/phasmid), the
+Chromium fork that reports the device described by one JSON profile instead of
+the machine it runs on.
+
+Every device field of a profile comes from one capture of a real device: no
+population model is sampled and no GPU identity is derived. The captures, the
+schema and the locale tables are bundled in compressed form, so it runs without
+a Phasmid checkout.
+
+## Install
+
+```bash
+pip install phasmid-profile-gen                # profiles with a given time zone
+pip install 'phasmid-profile-gen[location]'    # also place profiles at a proxy exit IP
+```
+
+Python 3.12 or newer. The `location` extra adds `timezonefinder` (with its
+boundary data, about 33 MB) and `maxminddb`, pinned exactly because they decide
+which zone and position a seed gets.
+
+## Use
+
+```python
+from phasmid_profile_gen import dumps, generate_profile
+
+# Placed where the proxy comes out: zone, geolocation, WebRTC address, languages.
+profile = generate_profile("windows", exit_ip=proxy_exit_ip)
+
+# Or with an explicit locale, reproducibly.
+profile = generate_profile(
+    "linux",
+    seed="0a1b2c3d4e5f60718293a4b5c6d7e8f9",
+    timezone="Europe/Berlin",
+    languages=["de-DE", "de", "en-US", "en"],
+)
+open("profile.json", "w").write(dumps(profile))
+```
+
+```bash
+phasmid-profile-gen generate --os windows --exit-ip <proxy exit IP> -o profile.json
+phasmid-profile-gen generate --os linux --seed 0a1b2c3d4e5f60718293a4b5c6d7e8f9 \
+    --timezone Europe/Berlin --languages de-DE,de,en-US,en -o profile.json
+phasmid-profile-gen gpus          # GPUs the bundled captures back (for --gpu)
+phasmid-profile-gen captures      # the bundled captures
+phasmid-profile-gen locate <proxy exit IP> --seed <seed>
+phasmid-profile-gen validate profile.json
+```
+
+Give exactly one of an exit IP and a time zone. **Generate Windows profiles
+with an exit IP.** Windows Chrome answers geolocation from the system location
+provider, so a Windows profile with no position is a stronger tell than a Linux
+one. The seed is 32 lowercase hex characters. When omitted, a new one is drawn;
+read it back from `profile["seed"]`. The same seed and inputs always give the
+same bytes (`dumps`).
+
+### Choosing the capture
+
+Which capture backs a profile is a `ProfileGenerator`'s choice: any object
+with `generate(request: Request) -> dict`. The default, `RandomCapture()`,
+draws one of the OS's captures (those with the requested GPU, when `gpu=` is
+given) uniformly from the seed. Pass another strategy as `generator=`;
+`from_capture(capture, request)` builds the profile once a capture is chosen:
+
+```python
+from phasmid_profile_gen import Request, catalog, from_capture, generate_profile
+
+class Newest:
+    def generate(self, request: Request) -> dict:
+        captures = [c for c in catalog() if c.family == request.family]
+        newest = max(captures, key=lambda c: c.date)
+        return from_capture(newest, request, how="the newest capture")
+
+profile = generate_profile("windows", timezone="UTC", generator=Newest())
+```
+
+A generator draws only from `request.seed` (`_rng.decision_rng(seed,
+decision)`), so a seed keeps giving the same profile. `generate_profile`
+validates whatever it returns.
+
+Other functions: `locate(ip, seed)`, `list_gpus()`, `list_captures()`,
+`validate(profile)` (against the bundled Phasmid schema) and `new_seed()`.
+Errors are `GenerationError`, `LocationError` and `geoip.GeoipError`.
+
+## What a profile is made of
+
+| Part | From |
+| --- | --- |
+| OS identity and version, CPU threads, memory, touch points, screen and window geometry, GPU with its WebGL and WebGPU surface, fonts, voices, audio, codecs, system colours, pointer, preferences, RAM, disk, media devices, battery, connection | One capture of a real device, taken whole. |
+| Time zone, geolocation, WebRTC public IP, languages | The exit IP: DB-IP City Lite, timezonefinder, CLDR, and Chrome's default accept-languages for the country's UI locale. Otherwise the time zone and languages you pass. |
+
+No user-agent or version string is written. Phasmid builds those from its own
+version. Nothing is invented: a field only a capture can supply is never
+filled in by guessing, and an OS without a capture fails with
+`MissingCaptures`. `captured.note` records where every part came from.
+
+### Bundled captures
+
+Run `phasmid-profile-gen captures` for the current list. It is also in
+[`data/manifest.json`](src/phasmid_profile_gen/data/manifest.json), which lists
+the dumps refused and why.
+
+Each is named by its OS family and PCI ids (`windows-0x8086-0x0412`). Where a
+capture has no media device labels (a page visit grants no media permission),
+profiles built from it claim no microphone, speaker or camera.
+
+A profile's OS version is its capture's, so a Windows 11 capture gives
+Windows 11 profiles with Windows 11 fonts and colours.
+
+## The location database
+
+The exit IP is looked up in DB-IP IP to City Lite (CC BY 4.0, "IP Geolocation
+by DB-IP"). It is about 127 MB, so it is not bundled. The build pinned in
+`data/dbip-city-lite.json` is downloaded on first use, checked against the
+pin, and kept in `$XDG_CACHE_HOME/phasmid/geoip/`. That is the cache Phasmid's
+tools use, so an existing download is reused.
+
+```bash
+phasmid-profile-gen geoip                     # download and verify now
+phasmid-profile-gen geoip --archive dbip-city-lite-2026-10.mmdb.gz
+```
+
+DB-IP serves only the last two monthly builds. Once the pinned one is gone,
+either install a saved copy with `--archive`, or use any other DB-IP City Lite
+build with `PHASMID_GEOIP_MMDB=/path/to/dbip-city-lite.mmdb`, `--geoip-db` or
+`geoip_db=`. Another build is not checked against the pin; the profile's note
+names its build date and sha256 instead.
+
+## Rebuilding the data
+
+`src/phasmid_profile_gen/data/` is generated, compressed and committed. It is
+rebuilt from a Phasmid checkout and further harness dumps by
+[`scripts/build_data.py`](scripts/build_data.py):
+
+```bash
+uv run python scripts/build_data.py \
+    --phasmid ../phasmid \
+    --dumps /path/to/dumps
+```
+
+The build:
+
+- maps every dump with the checkout's own `tests/consistency/capture.py` (the
+  code `consistency capture` runs), and checks Phasmid's captures against their
+  records as `tools/genprofile` does;
+- keeps a dump only if it is stock desktop Google Chrome on Windows
+  or Linux, with a hardware GPU, a consistent UA and UA-CH, and a window inside
+  its screen, and only if it maps to a valid profile. Each refusal is listed
+  with its reason in `manifest.json`;
+- takes the nearest whole-MB RAM when a dump's heap limit sits within 1 MiB of
+  one but matches none exactly (a fraction of a MB of RAM), sets the heap limit
+  to the one the browser computes for it, and lists both as `assumed` in
+  `manifest.json`; a limit further off is refused;
+- stores only what generation reads, under a neutral name (OS family and PCI
+  ids). Raw dumps, file names, notes and the device's locale are never written,
+  and a refused dump is listed by hash only.
+
+The output is deterministic, so a rebuild from the same sources gives the same
+bytes. A Linux dump also needs the operator's OS version (`operator.os_version`),
+which a page cannot read.
+
+## Develop
+
+```bash
+uv sync --all-extras
+uv run pytest
+uv run pre-commit run --all-files
+PHASMID_GEOIP_NETWORK=1 uv run pytest -m network   # reads the real DB-IP build
+```
+
+Releases are published to PyPI by `.github/workflows/publish-pypi.yaml` when a
+GitHub release is published. The version comes from the release tag
+(`uv-dynamic-versioning`, e.g. `v0.1.0`). Publishing uses PyPI trusted
+publishing: register the repository and that workflow as a trusted publisher
+of `phasmid-profile-gen` on PyPI once.
+
+## Licence
+
+The code is BSD 3-Clause, as Phasmid is ([`LICENSE`](LICENSE)). The bundled
+data keeps its sources' licences:
+
+- Unicode CLDR: Unicode License v3.
+- Chromium's locale table: BSD-style.
+
+DB-IP (CC BY 4.0) and timezone-boundary-builder (ODbL 1.0) are used at runtime
+but not bundled. See
+[`data/LICENSES.md`](src/phasmid_profile_gen/data/LICENSES.md).

phasmid_profile_gen-0.1.1/pyproject.toml

@@ -0,0 +1,62 @@
+[project]
+name = "phasmid-profile-gen"
+dynamic = ["version"]
+description = "Generate Phasmid browser profiles from captured real devices"
+readme = "README.md"
+requires-python = ">=3.12"
+license = "BSD-3-Clause"
+license-files = ["LICENSE", "src/phasmid_profile_gen/data/LICENSES.md"]
+keywords = ["phasmid", "chromium", "browser fingerprint", "browser profile"]
+classifiers = [
+    "Intended Audience :: Developers",
+    "Operating System :: OS Independent",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
+    "Topic :: Internet :: WWW/HTTP :: Browsers",
+    "Topic :: Software Development :: Libraries :: Python Modules",
+]
+dependencies = [
+    "jsonschema>=4.23",
+]
+
+[project.optional-dependencies]
+# Placing a profile at a proxy exit IP. Pinned exactly: the zone polygons decide
+# which zone and position a seed gives, so another data release changes profiles.
+location = [
+    "maxminddb==3.2.0",
+    "timezonefinder==9.2.0",
+    "timezonefinder-data==4.2026.5",
+]
+
+[project.scripts]
+phasmid-profile-gen = "phasmid_profile_gen.cli:main"
+
+[project.urls]
+Homepage = "https://github.com/tintty1/phasmid-profile-gen"
+Repository = "https://github.com/tintty1/phasmid-profile-gen"
+Issues = "https://github.com/tintty1/phasmid-profile-gen/issues"
+
+[build-system]
+requires = ["hatchling", "uv-dynamic-versioning"]
+build-backend = "hatchling.build"
+
+[tool.hatch.version]
+source = "uv-dynamic-versioning"
+
+[tool.hatch.build.targets.sdist]
+exclude = [".github", ".claude-scratch"]
+
+[dependency-groups]
+dev = [
+    "pytest>=8",
+    "ruff",
+    "pre-commit>=4.3.0",
+]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+markers = [
+    "network: downloads the pinned DB-IP database (run with PHASMID_GEOIP_NETWORK=1)",
+]