@anonympins/fingerprint 0.1.4 → 0.2.1

package/fingerprint.js

@@ -1,6 +1,7 @@
 import crypto from "node:crypto";
 import { BlockList } from "node:net";
 import dns from "node:dns/promises";
+import { problemManager } from "./problem-manager.js";
 import { Optimization } from "./library.js";
 import { cyrb53, FingerprintBuilder } from "./fingerprint.builder.js";
 import { readFileSync } from "node:fs";
@@ -26,111 +27,12 @@ const getPowSecret = () => {
  * @returns {string} The solver JavaScript code.
  */
 const getPowSolverCode = () => {
-  try {
-    const __filename = fileURLToPath(import.meta.url);
-    const __dirname = dirname(__filename);
-    const solverPath = join(__dirname, 'pow.solver.inline.js'); // Use the inline version
-    return readFileSync(solverPath, 'utf-8');
-  } catch (error) {
-    console.warn('Could not load pow.solver.js for inlining, using fallback inline code');
-    // Fallback inline code if file cannot be loaded
-    return `(function(global){
-        async function solveCpuTargetInline(clientIp, nonce, target, clientSecret, progressCallback){
-            const cpuTarget = typeof target === 'bigint' ? target : BigInt('0x' + target);
-            let cpuSolution = 0;
-            const ipPart = clientIp || '';
-            while(true){
-                // When a clientSecret is used, the IP is omitted from the hash to make it independent of the network.
-                const msg = clientSecret ? \`\${nonce}:\${cpuSolution}:\${clientSecret}\` : \`\${ipPart}:\${nonce}:\${cpuSolution}\`;
-                const buf = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(msg));
-                const hashHex = Array.from(new Uint8Array(buf)).map(b=>b.toString(16).padStart(2,'0')).join('');
-                if(BigInt('0x'+hashHex) < cpuTarget) break;
-                cpuSolution++;
-                if(cpuSolution % 100000 === 0) await new Promise(r=>setTimeout(r,0));
-            }
-            return cpuSolution;
-        }
-        async function solveMemory(seed, difficulty){
-            const size = difficulty * 1024 * 1024;
-            const buffer = new Uint32Array(size / 4);
-            let h = new TextEncoder().encode(seed).reduce((acc,v)=>acc+v,0);
-            for(let i=0;i<buffer.length;i++) buffer[i] = h = Math.imul(h^i,1597334677);
-            let solution = 0;
-            const iterations = size / 16;
-            let addr = buffer.length > 0 ? buffer[0] % buffer.length : 0;
-            for(let i=0;i<iterations;i++){
-                addr = buffer[addr] % buffer.length;
-                solution ^= addr;
-            }
-            return solution;
-        }
-        async function solveTsp(cities, targetMaxDistance){
-            function distance(c1,c2){return Math.sqrt(Math.pow(c1.x-c2.x,2)+Math.pow(c1.y-c2.y,2));}
-            function evaluatePathDistance(cities,path){
-                let total=0;
-                for(let i=0;i<path.length-1;i++) total+=distance(cities[path[i]],cities[path[i+1]]);
-                total+=distance(cities[path[path.length-1]],cities[path[0]]);
-                return total;
-            }
-            function solveTspNearestNeighbor(cities){
-                const n=cities.length;
-                if(n===0)return[];
-                let path=[0];
-                let visited=new Array(n).fill(false);
-                visited[0]=true;
-                for(let i=1;i<n;i++){
-                    let nearest=-1, minDist=Infinity;
-                    for(let j=0;j<n;j++){
-                        if(!visited[j]){
-                            const d=distance(cities[path[i-1]],cities[j]);
-                            if(d<minDist){minDist=d;nearest=j;}
-                        }
-                    }
-                    path.push(nearest);
-                    visited[nearest]=true;
-                }
-                return path;
-            }
-            await new Promise(r=>setTimeout(r,10));
-            const solutionPath=solveTspNearestNeighbor(cities);
-            const solutionDistance=evaluatePathDistance(cities,solutionPath);
-            return{path:solutionPath,distance:solutionDistance};
-        }
-        async function solveChallenge(challenge) {
-            const { type, nonce, clientSecret, cpuTarget, memDifficulty, cities, clientIp, targetMaxDistance } = challenge;
-            const solutions = {};
-
-            switch (type) {
-                case 'cpu_target':
-                    solutions.cpu = await solveCpuTargetInline(clientIp, nonce, cpuTarget, clientSecret);
-                    break;
-                case 'cpu_mem':
-                case 'cpu_mem_inline':
-                    const memSeed = nonce + ":" + clientSecret;
-                    const [cpuSol, memSol] = await Promise.all([
-                        solveCpuTargetInline(clientIp, nonce, cpuTarget, clientSecret),
-                        solveMemory(memSeed, memDifficulty)
-                    ]);
-                    solutions.cpu = cpuSol;
-                    solutions.mem = memSol;
-                    break;
-                case 'tsp':
-                    const tspResult = await solveTsp(cities, targetMaxDistance);
-                    solutions.tsp = tspResult.path;
-                    solutions.distance = tspResult.distance;
-                    break;
-                default:
-                    throw new Error(\`Unknown challenge type: \${type}\`);
-            }
-
-            return solutions;
-        }
-        global.solveCpuChallengeInline=solveCpuTargetInline;
-        global.solveMemoryChallenge=solveMemory;
-        global.solveTspChallenge=solveTsp;
-        global.solveChallenge=solveChallenge;
-    })(typeof window!=='undefined'?window:global);`;
-  }
+  // On supprime le try/catch. Si le fichier n'est pas trouvé, le processus plantera,
+  // ce qui est préférable à servir un code de secours potentiellement désynchronisé.
+  const __filename = fileURLToPath(import.meta.url);
+  const __dirname = dirname(__filename);
+  const solverPath = join(__dirname, 'pow.solver.inline.js'); // Utilise la version inline
+  return readFileSync(solverPath, 'utf-8');
 };
 
 /**
@@ -189,7 +91,7 @@ function getHeaderSignature(context) {
     for (let i = 0; i < context.rawHeaders.length; i += 2) {
         headerKeys.push(context.rawHeaders[i]);
     }
-    return cyrb53(headerKeys.join(','));
+    return cyrb53(headerKeys.sort().join(','));
 }
 
 /**
@@ -226,11 +128,6 @@ export function getCompositeDeviceHash(context) {
     const ua = context.headers["user-agent"];
     if (ua) {
         srv.add("ua", ua);
-        // Extraire des infos supplémentaires du UA
-        const uaParts = parseUserAgent(ua);
-        if (uaParts.browser) srv.add("browser", uaParts.browser);
-        if (uaParts.os) srv.add("os_version", uaParts.os);
-        if (uaParts.device) srv.add("device_type", uaParts.device);
     }
 
     // 2. SIGNAL FORT: JA3 TLS Fingerprint
@@ -265,9 +162,6 @@ export function getCompositeDeviceHash(context) {
         srv.add("upgrade", context.headers["upgrade-insecure-requests"]);
     }
 
-    // 10. SIGNAL FORT: Ordonnancement des headers
-    srv.add("h_ord", getHeaderSignature(context));
-
     // 11. SIGNAL AVANCÉ: Cookies (si disponible)
     if (context.cookies) {
         const cookieKeys = Object.keys(context.cookies).sort().join(',');
@@ -613,11 +507,11 @@ export const verifyPoWAndGenerateTicket = (
  * Verifies a memory PoW solution.
  * The server performs the same calculation to validate.
  */
-export const verifyMemoryPoW = (nonce, solution, difficulty = 16, clientSecret) => {
+export const verifyMemoryPoW = (nonce, solution, difficulty = 16, clientSecret = '') => {
   const size = difficulty * 1024 * 1024;
   const iterations = size / 16;
   const buffer = new Uint32Array(size / 4);
-  const seed = clientSecret ? `${nonce}:${clientSecret}` : nonce;
+  const seed = `:${nonce}:${clientSecret}`;
   let h = new TextEncoder().encode(seed).reduce((acc, v) => acc + v, 0);
 
   for (let i = 0; i < buffer.length; i++) {
@@ -762,6 +656,25 @@ function getHoneypotScore(context, honeypotConfig = {}) {
   return { honeypotScore: 0 };
 }
 
+/**
+ * @private
+ * Map of malicious patterns grouped by type.
+ */
+const injectionPatterns = {
+    // SQL/NoSQL injections, including time-based attacks
+    sql: /(\$ne|' *OR *'1'='1|['";]\s*--|; ?(DROP|TRUNCATE|DELETE)|UNION SELECT|SLEEP\(|BENCHMARK\(|WAITFOR DELAY)/i,
+    // Log4Shell (JNDI injection)
+    log4shell: /\$\{jndi:(ldap|rmi|dns):/i,
+    // Server-Side Template Injection (SSTI) for engines like Jinja2, Twig, etc.
+    ssti: /\{\{.*\}\}|\{%.*%\}/,
+    // XML External Entity (XXE) injection
+    xxe: /<!ENTITY\s+.*SYSTEM/i,
+    // Path Traversal
+    traversal: /(\.\.\/|\.\.\\)/,
+    // Remote Command Execution (RCE)
+    rce: /`.*`|(^|[\n;&|]\s*)(ping|ls|whoami|cat|rm|ncat|nc|bash|sh|powershell|cmd)\b/i,
+};
+
 /**
  * Calcule un score basé sur les métriques comportementales envoyées par le client.
  * @param {object} context - Le contexte de la requête, contenant les en-têtes.
@@ -821,6 +734,29 @@ function getBehaviorScore(context) {
   }
 }
 
+/**
+ * Calcule un score basé sur l'incohérence temporelle entre le client et le serveur pour détecter les attaques par rejeu.
+ * @param {object} context - Le contexte de la requête, contenant le timestamp de la requête.
+ * @param {object} metrics - Les métriques comportementales parsées depuis le client.
+ * @returns {{timeInconsistencyScore: number}}
+ */
+function getTimeInconsistencyScore(context, metrics) {
+  const REPLAY_THRESHOLD_MS = 5000; // 5 secondes
+  let score = 0;
+
+  if (metrics.clientTimestamp && context.requestTimestamp) {
+    const timeDelta = context.requestTimestamp - metrics.clientTimestamp;
+
+    // Un delta très grand est un signal fort d'attaque par rejeu.
+    // Un delta négatif peut arriver si l'horloge du client est en avance, on l'ignore.
+    if (timeDelta > REPLAY_THRESHOLD_MS) {
+      // La pénalité est proportionnelle au dépassement du seuil.
+      score = Math.min(100, (timeDelta / REPLAY_THRESHOLD_MS - 1) * 50);
+    }
+  }
+  return { timeInconsistencyScore: score };
+}
+
 /**
  * Calcule un score d'incohérence entre les données du fingerprint client et les en-têtes serveur.
  * @param {object} context - Le contexte de la requête.
@@ -903,8 +839,10 @@ function getRequestPatternScore(context, deviceData, patternConfig = {}) {
     const now = Date.now();
     const currentPath = context.path;
     // Make the function robust to handle both URLSearchParams and plain objects for query.
-    // Ensure query parameters are consistently handled, whether they come from a URLSearchParams object or a plain object.
-    const params = context.query instanceof URLSearchParams ? context.query : new URLSearchParams(context.query);
+    const params =
+      context.query instanceof URLSearchParams
+        ? new URLSearchParams(context.query.toString()) // Clone to avoid modifying the original
+        : new URLSearchParams(context.query || {});
     params.sort(); // Sort for deterministic order
     const currentQueryString = params.toString();
 
@@ -960,8 +898,7 @@ function getRequestPatternScore(context, deviceData, patternConfig = {}) {
         // 5. (NOUVEAU) Analyse de la distribution des délais avec la loi de Benford
         if (deviceData.timingHistory.length >= benfordMinSamples) {
             // On concatène tous les délais en une seule chaîne de chiffres.
-            const timingString = deviceData.timingHistory.join('');
-            const benfordDeviation = Optimization.Operators.benfordTest(timingString);
+            const benfordDeviation = Optimization.Operators.benfordTest(deviceData.timingHistory);
 
             // Une déviation > 0.15 est suspecte. On peut pondérer la pénalité.
             // Une déviation de 0.3 (très suspecte) donnerait un score de 100 (0.3 / 0.3 * 100).
@@ -1242,6 +1179,9 @@ export const getSuspicionVector = async (context, securityConfig) => {
   // On appelle getHoneypotScore ici pour que son résultat soit inclus dans le vecteur.
   const { honeypotScore } = getHoneypotScore(context, honeypotConfig);
 
+  // NOUVEAU: On calcule le score d'incohérence temporelle.
+  const { timeInconsistencyScore } = getTimeInconsistencyScore(context, JSON.parse(context.headers['x-behavior-metrics'] || '{}'));
+
   // NOUVEAU: On calcule le score d'incohérence entre les couches.
   const { crossLayerInconsistencyScore } = getCrossLayerInconsistency(context);
 
@@ -1257,7 +1197,7 @@ export const getSuspicionVector = async (context, securityConfig) => {
       deviceData.ips = new Set(deviceData.ips);
   }
   // Le vecteur de suspicion est maintenant complet.
-  return { ...behavioral, headerAnomalyScore, inconsistencyScore, behaviorScore, honeypotScore, requestPatternScore, crossLayerInconsistencyScore };
+  return { ...behavioral, headerAnomalyScore, inconsistencyScore, behaviorScore, honeypotScore, requestPatternScore, crossLayerInconsistencyScore, timeInconsistencyScore };
 };
 
 // A residential user can change networks (home, 4G, public wifi).
@@ -1320,20 +1260,44 @@ const BASE_TARGET = MAX_DIFFICULTY_TARGET >> 16n;
  * @param {number} suspicionFactor - A number from 0 to 1.
  * @returns {BigInt} The target number.
  */
-function calculateTarget(suspicionFactor) {
+function calculateTarget(suspicionFactor, securityConfig = {}) {
   // Difficulty range adjusted to be realistic.
   // MIN_DIFFICULTY: Fast enough not to bother a slightly suspicious user.
   // MAX_DIFFICULTY: Slow enough to heavily penalize a bot, but feasible for a patient human (5-30s).
-  const MIN_DIFFICULTY_BITS = 18; // Default value, should be configurable
-  const MAX_DIFFICULTY_BITS = 26; // Default value, should be configurable
+  // NOUVEAU: La difficulté est maintenant configurable.
+  const { cpu: cpuConfig = {} } = securityConfig;
+  const MIN_DIFFICULTY_BITS = cpuConfig.minDifficultyBits ?? 8;
+  const MAX_DIFFICULTY_BITS = cpuConfig.maxDifficultyBits ?? 16;
 
   // Use linear interpolation between min and max difficulty.
   const totalDifficultyBits =
     MIN_DIFFICULTY_BITS +
     suspicionFactor * (MAX_DIFFICULTY_BITS - MIN_DIFFICULTY_BITS);
+  
+  if (totalDifficultyBits <= 0) return 2n ** 256n - 1n; // Si la difficulté est nulle ou négative, la cible est maximale (aucun challenge).
+
+  // The correct way to calculate the target is to define the number of leading zero bits required.
+  // A target for N bits of difficulty is 2^(256-N).
+  // We can calculate this with a left-shift on 1.
+  const shift = 256n - BigInt(Math.floor(totalDifficultyBits));
+  return 1n << shift;
+}
 
-  // The target is max / 2^bits
-  return MAX_DIFFICULTY_TARGET >> BigInt(Math.floor(totalDifficultyBits));
+/**
+ * @private
+ * Crée le bloc de base pour le challenge CPU.
+ * Ce buffer contient toutes les données sauf la solution.
+ * @param {string} nonce
+ * @param {string} clientSecret
+ * @param {string} fingerprint
+ * @returns {Buffer}
+ */
+function createCpuChallengeBaseBlock(nonce, clientSecret, fingerprint) {
+    const sortedFingerprint = (fingerprint || '').split('|').filter(p => p).sort().join('|');
+    // On concatène les chaînes, puis on les convertit en buffer une seule fois.
+    // Cela garantit que le client et le serveur travaillent sur la même base binaire.
+    const messageBase = `${nonce}:${clientSecret}:${sortedFingerprint}:`; // Le ':' final est le séparateur pour la solution.
+    return Buffer.from(messageBase, 'utf8');
 }
 
 /**
@@ -1344,12 +1308,15 @@ export function generateCpuTargetChallenge(
   nonce,
   suspicionFactor,
   originalUrl,
+  securityConfig,
 ) {
-  const target = calculateTarget(suspicionFactor);
+  const target = calculateTarget(suspicionFactor, securityConfig);
+  // Le baseBlock est créé ici et sera stocké dans le contexte du challenge.
+  const baseBlock = createCpuChallengeBaseBlock(nonce, null, ''); // Pour le challenge simple, le secret et le fingerprint sont vides.
   return {
     type: "cpu_target",
     nonce: nonce,
-    target: target.toString(16), // Send the target in hexadecimal
+    target: target.toString(16),
     path: originalUrl,
   };
 }
@@ -1374,10 +1341,11 @@ function generateCpuTargetChallengePage(challengeDetails, clientIp) {
           async function solve() {
             const clientIp = ${JSON.stringify(clientIp)};
             const nonce = ${JSON.stringify(nonce)};
-            const cpuTarget = BigInt("0x${target}");
-            const solution = await window.solveCpuChallengeInline(clientIp, nonce, cpuTarget, null, (progress) => {
-                // Optional progress callback
-            });
+            const cpuTarget = BigInt("0x" + "${target}");
+            // La nouvelle version de solveCpuChallengeInline n'a plus besoin de l'IP ou du secret,
+            // car tout est dans le baseBlock. Pour la compatibilité de ce challenge simple, on passe null.
+            const baseBlockBytes = new TextEncoder().encode(nonce + ":");
+            const solution = await window.solveCpuChallengeInline(baseBlockBytes, cpuTarget, (progress) => {});
             window.location.href = ${JSON.stringify(path)} + "?pow_type=cpu_target&pow_nonce=" + nonce + "&pow_solution=" + solution;
           }
           solve();
@@ -1392,9 +1360,14 @@ function generateCpuTargetChallengePage(challengeDetails, clientIp) {
  * @param {string} clientIp - The client's IP address.
  * @returns {string} HTML content.
  */
-function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty, clientIp, clientSecret, securityConfig, trapContainerHtml) {
+function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty, clientIp, clientSecret, securityConfig, trapContainerHtml, originalFingerprint) {
     const { nonce, target, path } = cpuChallengeDetails;
     const solverCode = getPowSolverCode();
+    // On prépare le baseBlock pour le client. Il sera envoyé sous forme de tableau d'octets.
+    // Le fingerprint est maintenant passé directement en paramètre.
+    const fingerprint = originalFingerprint;
+    const baseBlock = createCpuChallengeBaseBlock(nonce, clientSecret, fingerprint);
+    const baseBlockBytes = `[${baseBlock.toString('utf8').split('').map(c => c.charCodeAt(0)).join(',')}]`;
 
     const challengeScript = `
       async function solve() {
@@ -1402,19 +1375,18 @@ function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty,
         const path = ${JSON.stringify(path)};
         const clientSecret = ${JSON.stringify(clientSecret)};
         const clientIp = ${JSON.stringify(clientIp)};
-        const cpuTarget = BigInt("0x${target}");
+        const cpuTarget = BigInt("0x" + "${target}");
         const memDifficulty = ${memoryDifficulty};
+        // Le client reçoit directement le 'baseBlock' sous forme de tableau d'octets.
+        // Il n'a plus besoin de construire le message lui-même.
+        const baseBlock = new Uint8Array(${baseBlockBytes});
 
         // --- CPU Challenge ---
-        document.getElementById('loader').innerText = '⚙️ Performing CPU security calculation...';
-        const cpuSolution = await window.solveCpuChallengeInline(clientIp, nonce, cpuTarget, clientSecret, (progress) => {
-            // Optional progress callback
-        });
+        document.getElementById('loader').innerText = '⚙️ Performing CPU security calculation...';        const cpuSolution = await window.solveCpuChallengeInline(baseBlock, cpuTarget, (progress) => {});
 
         // --- Memory Challenge ---
         document.getElementById('loader').innerText = '⚙️ Performing memory allocation and calculation... (' + memDifficulty + ' MB)';
-        await new Promise(r => setTimeout(r, 10)); // Yield to update UI
-
+        await new Promise(r => setTimeout(r, 10)); // Yield to update UI        
         let memSolution = 0;
         try {
             const memSeed = nonce + ":" + clientSecret;
@@ -1423,7 +1395,10 @@ function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty,
             document.getElementById('loader').innerText = "Error: Insufficient memory. Please refresh.";
             return;
         }
-        window.location.href = path + "?pow_type=cpu_mem&pow_nonce=" + ${JSON.stringify(nonce)} + "&pow_solution_cpu=" + cpuSolution + "&pow_solution_mem=" + memSolution;
+
+        // Redirect with both solutions and the fingerprint used to solve.
+        const finalUrl = path + "?pow_type=cpu_mem&pow_nonce=" + ${JSON.stringify(nonce)} + "&pow_solution_cpu=" + cpuSolution + "&pow_solution_mem=" + memSolution;
+        window.location.href = finalUrl;
       }
       solve();
     `;
@@ -1454,22 +1429,56 @@ function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty,
  */
 export function verifyCpuTargetPoWAndGenerateTicket(
   clientIp, // This parameter is crucial and must be the actual client IP
-  ticketTtl, // NOUVEAU: Durée de validité du ticket (TTL en ms) configurable
+  ticketTtl,
   nonce,
   solution,
-  clientSecret, // Le secret est maintenant requis
-  target, // La cible est maintenant passée directement en hexadécimal
+  challengeContext = {}, // Le contexte complet du challenge est maintenant passé
 ) {
-  const message = clientSecret
-    ? `${nonce}:${solution}:${clientSecret}` // FIX: Ne pas inclure l'IP si un secret client est utilisé
-    : `${clientIp}:${nonce}:${solution}`; // L'IP est utilisée uniquement pour les challenges sans secret (plus anciens/simples)
+  const { cpuTarget, baseBlock } = challengeContext;
+  if (!cpuTarget || !baseBlock) {
+      console.error('[FP Server Verify] Invalid challenge context. Missing cpuTarget or baseBlock.');
+      return null;
+  }
+
+  // Le baseBlock est déjà un Buffer ou un tableau d'octets.
+  // On s'assure que c'est un Buffer pour la concaténation.
+  const baseBlockBuffer = Buffer.isBuffer(baseBlock) ? baseBlock : Buffer.from(baseBlock);
+  const solutionBuffer = Buffer.from(String(solution), 'utf8');
+
+  // Concaténation binaire directe. C'est la garantie de cohérence.
+  const finalBlock = Buffer.concat([baseBlockBuffer, solutionBuffer]);
+
   const hash = crypto
     .createHash("sha256")
-    .update(message)
+    .update(finalBlock)
     .digest("hex");
   const hashAsInt = BigInt("0x" + hash);
+  const targetAsInt = BigInt("0x" + cpuTarget);
+
+  // --- NOUVEAUX LOGS POUR LE DÉBOGAGE ---
+  console.log('[FP Server Verify] Intermediate values:', {
+    hashCalculated: `0x${hash}`,
+    hashAsInt: hashAsInt.toString(), // Log as string to see full value
+    target: `0x${cpuTarget}`,
+    targetAsInt: targetAsInt.toString(), // Log as string to see full value
+  });
+  // --- FIN DES NOUVEAUX LOGS ---
+
+  const isValid = hashAsInt < targetAsInt;
 
-  if (hashAsInt < BigInt("0x" + target)) {
+  // --- AJOUT DE LOGS POUR LE DÉBOGAGE ---
+  if (!isValid) {
+    console.log('[FP Server Verify] CPU PoW verification FAILED. Details:', {
+      hashCalculated: `0x${hash}`,
+      target: `0x${cpuTarget}`,
+
+    });
+  }
+  // --- FIN DES LOGS ---
+
+  if (isValid) {
+      console.log('[FP Server Verify] CPU PoW verification PASSED. Details:', {
+      });
     // The comparison is direct with native BigInts
     // The proof is valid, generate the ticket
       const expiry = Date.now() + (ticketTtl || 3600000); // Calcule l'expiration à partir du TTL
@@ -1483,106 +1492,6 @@ export function verifyCpuTargetPoWAndGenerateTicket(
   return null;
 }
 
-const staticExtensions = new RegExp(
-  "\\.(js|css|png|jpg|jpeg|gif|svg|mp3|webp|ico|woff|woff2|ttf|otf|map|json|manifest|webmanifest)$",
-  "i",
-);
-const isStaticResource = (path) => staticExtensions.test(path);
-
-
-/**
- * Détermine le TTL optimal pour un ticket en utilisant un algorithme génétique multi-objectifs.
- * @param {number} suspicionScore - Le score de suspicion de la requête.
- * @returns {number} Le TTL optimal calculé en millisecondes.
-*/
-function determineOptimalTicketTtl(suspicionScore) {
-    // Définir les bornes pour la durée de vie du ticket (5 minutes à 24 heures)
-    const MIN_TTL = 300000;
-    const MAX_TTL = 86400000;
-
-    const solverFunction = () => {
-        const fitnessFunction = Optimization.Operators.createOptimalTtlEvaluator({ suspicionScore });
-
-        // Un "individu" est simplement une valeur de TTL en millisecondes.
-        const createIndividual = () => MIN_TTL + Math.random() * (MAX_TTL - MIN_TTL);
-        const crossover = (ttl1, ttl2) => (ttl1 + ttl2) / 2;
-        const mutate = (ttl) => {
-            const newTtl = ttl + (Math.random() - 0.5) * (MAX_TTL - MIN_TTL) * 0.1; // Mutation de +/- 10% max
-            return Math.max(MIN_TTL, Math.min(MAX_TTL, newTtl));
-        };
-
-        const paretoFront = Optimization.geneticAlgorithmMultiObjective(
-            createIndividual,
-            fitnessFunction,
-            crossover,
-            mutate,
-            {
-                generations: 40,
-                populationSize: 30,
-            }
-        );
-
-        // Pour runMultiple, on doit retourner un objet avec une propriété "fitness" ou "energy".
-        // Pour un front de Pareto, il n'y a pas de score unique. On choisit la meilleure solution
-        // en fonction du score de suspicion et on lui assigne un score de 0 pour que runMultiple la sélectionne.
-        if (!paretoFront || paretoFront.length === 0) {
-            return { solution: null, fitness: Infinity };
-        }
-
-        // Stratégie de sélection :
-        // Pour un score faible (< 50), on privilégie la solution avec le plus grand TTL (minimise la friction).
-        // Pour un score élevé (>= 50), on privilégie la solution avec le plus petit TTL (minimise le risque).
-        let bestSolutionInFront;
-        if (suspicionScore < 50) {
-            bestSolutionInFront = paretoFront.reduce((max, p) => Math.max(max, p.solution), 0);
-        } else {
-            bestSolutionInFront = paretoFront.reduce((min, p) => Math.min(min, p.solution), Infinity);
-        }
-        return { solution: bestSolutionInFront, fitness: 0 }; // fitness=0 car on a déjà la meilleure solution du cycle.
-    };
-
-    // On exécute le solveur 20 fois pour trouver une solution plus stable et robuste.
-    const { bestResult } = Optimization.runMultiple(solverFunction, 20);
-
-    if (!bestResult || !bestResult.solution || bestResult.solution === Infinity) {
-        // Fallback : si l'algo ne retourne rien, on applique une règle simple et sûre.
-        return Math.max(MIN_TTL, MAX_TTL - (suspicionScore / 100) * MAX_TTL);
-    }
-
-    // runMultiple choisit le meilleur résultat sur la base du score (ici, 0).
-    // La "meilleure" solution dépendra du cycle qui a trouvé le meilleur compromis.
-    return Math.round(bestResult.solution);
-}
-
-/**
- * Vérifie si une chaîne de caractères contient des patterns d'injection connus.
- * @param {string} str - La chaîne à vérifier.
- * @returns {boolean} - True si un pattern malveillant est détecté.
- * @private
- */
-function isMalicious(str) {
-    if (typeof str !== 'string') return false;
-    // Regex pour les injections SQL et NoSQL de base
-    // Ajout de la détection des injections basées sur le temps (SLEEP, BENCHMARK, WAITFOR) et d'autres commandes dangereuses.
-    const injectionRegex = /(\$ne|' *OR *'1'='1|['";]\s*--|; ?(DROP|TRUNCATE|DELETE)|UNION SELECT|SLEEP\(|BENCHMARK\(|WAITFOR DELAY)/i;
-    // Regex pour les injections plus avancées
-    const log4ShellRegex = /\$\{jndi:(ldap|rmi|dns):/i;
-    const sstiRegex = /\{\{.*\}\}|\{%.*%\}/; // Détecte les syntaxes de type Jinja2, Twig, etc.
-    const xxeRegex = /<!ENTITY\s+.*SYSTEM/i;
-    const pathTraversalRegex = /(\.\.\/|\.\.\\)/;
-    // Regex pour les injections de commandes.
-    // Elle détecte :
-    // 1. L'utilisation de backticks ``.
-    // 2. Des commandes dangereuses (rm, whoami...) qui sont soit au début de la chaîne,
-    //    soit précédées par un séparateur de commande (;, &&, ||, |) suivi d'espaces.
-    const commandInjectionRegex = /`.*`|(^|[\n;&|]\s*)(ping|ls|whoami|cat|rm|ncat|nc|bash|sh|powershell|cmd)\b/i;
-
-    return injectionRegex.test(str) || log4ShellRegex.test(str) || sstiRegex.test(str) || xxeRegex.test(str) || pathTraversalRegex.test(str) || commandInjectionRegex.test(str);
-}
-
-// --- Middleware Proof-of-Work (Le péage) ---
-export { isMalicious };
-
 export class FingerprintEngine {
   constructor(securityConfig) {
     const isProduction = process.env.NODE_ENV === 'production';
@@ -1609,7 +1518,8 @@ export class FingerprintEngine {
             (suspicionVector.inconsistencyScore || 0) * (weights.inconsistencyScore || 0) +
             (suspicionVector.honeypotScore || 0) * (weights.honeypotScore || 0) +
             (suspicionVector.behaviorScore || 0) * (weights.behaviorScore || 0) +
-            (suspicionVector.crossLayerInconsistencyScore || 0) * (weights.crossLayerInconsistencyScore || 0);
+            (suspicionVector.crossLayerInconsistencyScore || 0) * (weights.crossLayerInconsistencyScore || 0) +
+            (suspicionVector.timeInconsistencyScore || 0) * (weights.timeInconsistencyScore || 0);
 
         return Math.min(100, score);
     }
@@ -1746,7 +1656,7 @@ export class FingerprintEngine {
       this._log('Whitelisted bot verified - allowing request', { clientIp });
       return { action: 'next', score: 0, vector: { whitelisted: 100, type: 'bot' } };
     }
-
+    
     // Resolve identity and check for persisted "condemned" status early.
     const { deviceId, deviceData, newCookie } = await resolveRequestIdentity(requestContext, this.securityConfig);
     const isNewDevice = !!newCookie;
@@ -1756,7 +1666,7 @@ export class FingerprintEngine {
     if (deviceData?.condemned) {
         this._log('Device condemned - blocking request', { deviceId });
         if (onDeviceCompromised) {
-            onDeviceCompromised({ deviceId: cookies?.device_id, clientIp, reason: 'Previously condemned', score: 100, vector: { honeypotScore: 100 } });
+            onDeviceCompromised({ deviceId: deviceId, clientIp, reason: 'Previously condemned', score: 100, vector: { honeypotScore: 100 } });
         }
         return { action: 'block', status: 404, body: 'Forbidden', score: 100, vector: { honeypotScore: 100 } };
     }
@@ -1792,6 +1702,7 @@ export class FingerprintEngine {
     const isSuspiciousHigh = finalScore >= thresholds.high && !isBlocked;
     const isSuspiciousMedium = finalScore >= thresholds.medium;
     const isSuspicious = finalScore >= thresholds.low;
+    const isVerySuspicious = finalScore >= thresholds.medium; // Seuil pour le challenge d'optimisation
 
     // Calculate an analog "suspicion factor" (0 to 1+) for progressive difficulty
     const suspicionFactor = isSuspicious
@@ -1816,10 +1727,10 @@ export class FingerprintEngine {
     // --- NOUVELLE LOGIQUE DE PRIORITÉ ---
     // Si une solution de challenge est soumise, on la traite en priorité absolue,
     // avant même de recalculer le score de suspicion.
-    const { pow_type, pow_solution, pow_solution_cpu, pow_solution_mem } = query;
-    if (pow_nonce && (pow_solution || (pow_solution_cpu && pow_solution_mem))) {
+    const { pow_type, pow_solution, pow_solution_cpu, pow_solution_mem, pow_fp, pow_solution_population, pow_solution_work_result, pow_problem_id } = query;
+    if (pow_nonce && (pow_solution || pow_solution_cpu)) { // Vérifie pow_solution pour la compatibilité ascendante
         this._log('Challenge solution submitted', { pow_type, pow_nonce });
-        
+
         // On doit calculer le score de suspicion *avant* de valider le ticket,
         // car le TTL optimal en dépend.
         const preliminaryVector = suspicionVector; // Use the already calculated vector
@@ -1842,27 +1753,57 @@ export class FingerprintEngine {
         const probationaryTtl = 30000; // 30 secondes
 
         if (challengeContext) {
-            optimalTtl = determineOptimalTicketTtl(preliminaryScore);
-            finalTtl = isProbationary ? probationaryTtl : optimalTtl;
-            this._log('Challenge context found, verifying solution', { optimalTtl, finalTtl });
-
-            if (pow_type === "cpu_target" && pow_solution) {
-                // On passe la durée de vie du ticket configurée
-                console.log("ticket");
-                ticket = verifyCpuTargetPoWAndGenerateTicket(clientIp, finalTtl, pow_nonce, pow_solution, challengeContext.clientSecret, challengeContext.cpuTarget);
-                console.log(ticket !== null)
-                isValid = ticket !== null;
-                this._log('CPU target challenge verification', { isValid });
-            } else if (pow_type === "cpu_mem" && pow_solution_cpu && pow_solution_mem) {
-                const cpuTicket = verifyCpuTargetPoWAndGenerateTicket(clientIp, finalTtl, pow_nonce, pow_solution_cpu, challengeContext.clientSecret, challengeContext.cpuTarget);
-                const isMemValid = verifyMemoryPoW(pow_nonce, pow_solution_mem, challengeContext.memDifficulty, challengeContext.clientSecret);
-                isValid = cpuTicket !== null && isMemValid;
-                if (isValid) ticket = cpuTicket; // Le ticket est le même, on le réutilise
-                this._log('Combined CPU+Memory challenge verification', {
-                    cpuValid: cpuTicket !== null,
-                    memValid: isMemValid,
-                    isValid
+            // *** NOUVELLE VÉRIFICATION CRUCIALE ***
+            // On compare le fingerprint soumis par le solver (`pow_fp`) avec celui stocké
+            // lors de l'émission du challenge.
+            // --- FIX: Use submitted fingerprint, but fallback to current request's fingerprint ---
+            // This handles API clients that might not use the full client-side library but still solve the challenge.
+            const solverFingerprint = pow_fp || getCompositeDeviceHash(requestContext);
+    const originalFingerprint = challengeContext.fingerprint; // This is the fingerprint of the request that *triggered* the challenge
+
+            let similarity;
+            const similarityThreshold = this.securityConfig.similarityThreshold ?? 0.95;
+
+            // If fingerprints are simple strings (like test placeholders 'fp-probation')
+            // and don't contain the typical structure, fall back to a strict equality check.
+            if (!originalFingerprint?.includes(':') || !solverFingerprint?.includes(':')) {
+                similarity = (originalFingerprint === solverFingerprint) ? 1.0 : 0.0;
+            } else {
+                // Use the weighted comparison for structured fingerprints.
+        // We compare the fingerprint of the request that triggered the challenge
+        // with the fingerprint of the request that is submitting the solution.
+        // They should be very similar.
+        similarity = FingerprintBuilder.compare(originalFingerprint, getCompositeDeviceHash(requestContext));
+            }
+
+            if (similarity < similarityThreshold) {
+                this._log('Fingerprint mismatch - challenge solved on a different machine!', {
+                    original: originalFingerprint,
+                    solver: solverFingerprint,
+                    similarity: similarity.toFixed(4),
+                    threshold: similarityThreshold
                 });
+                isValid = false;
+            } else {
+                optimalTtl = determineOptimalTicketTtl(preliminaryScore);
+                finalTtl = isProbationary ? probationaryTtl : optimalTtl;
+                this._log('Challenge context found, verifying solution', { optimalTtl, finalTtl });
+
+                if ((pow_type === "cpu_target" || !pow_type) && (pow_solution_cpu || pow_solution)) { // !pow_type pour compatibilité
+                    const cpuSolution = pow_solution_cpu || pow_solution;
+            ticket = verifyCpuTargetPoWAndGenerateTicket(clientIp, finalTtl, pow_nonce, cpuSolution, challengeContext);
+                    isValid = ticket !== null;
+                    this._log('CPU target challenge verification', { isValid });
+                } else if (pow_type === "cpu_mem" && pow_solution_cpu && pow_solution_mem) {                    const cpuTicket = verifyCpuTargetPoWAndGenerateTicket(clientIp, finalTtl, pow_nonce, pow_solution_cpu, challengeContext);
+            const isMemValid = verifyMemoryPoW(pow_nonce, pow_solution_mem, challengeContext.memDifficulty, challengeContext.clientSecret); // Memory PoW is independent of fingerprint
+                    isValid = cpuTicket !== null && isMemValid;
+                    if (isValid) ticket = cpuTicket; // Le ticket est le même, on le réutilise
+                    this._log('Combined CPU+Memory challenge verification', {
+                        cpuValid: cpuTicket !== null,
+                        memValid: isMemValid,
+                        isValid
+                    });
+                }
             }
         } else {
             this._log('Challenge context not found or expired', { pow_nonce });
@@ -1878,7 +1819,7 @@ export class FingerprintEngine {
 
             // NOUVELLE LOGIQUE DE REDIRECTION (plus robuste)
             // 1. On part du chemin original stocké, qui peut contenir des query params.
-            const originalUrl = new URL(challengeContext?.originalPath || path, `http://${requestContext.headers.host || 'localhost'}`);
+            const originalUrl = new URL(challengeContext?.originalPath || requestContext.path, `http://${requestContext.headers.host || 'localhost'}`);
             // 2. On crée un nouvel objet de paramètres à partir de la requête entrante (qui contient les solutions ET les params originaux).
             const finalSearchParams = new URLSearchParams(requestContext.query);
 
@@ -1888,11 +1829,16 @@ export class FingerprintEngine {
             finalSearchParams.delete('pow_solution');
             finalSearchParams.delete('pow_solution_cpu');
             finalSearchParams.delete('pow_solution_mem');
+            finalSearchParams.delete('pow_fp'); // Ne pas oublier de nettoyer le fingerprint
+            // NOUVEAU: Nettoyer aussi les paramètres des challenges d'optimisation et de travail utile
+            finalSearchParams.delete('pow_solution_population');
+            finalSearchParams.delete('pow_solution_work_result');
+            finalSearchParams.delete('pow_problem_id');
 
             // 4. On reconstruit le chemin final.
             const finalQueryString = finalSearchParams.toString();
             const finalRedirectPath = finalQueryString ? `${originalUrl.pathname}?${finalQueryString}` : originalUrl.pathname;
-            this._log('Redirecting to clean path', { finalRedirectPath });
+            this._log('Redirecting to clean path', { finalRedirectPath, cookieMaxAge: finalTtl });
             return {
               action: 'redirect',
               path: finalRedirectPath,
@@ -1900,8 +1846,8 @@ export class FingerprintEngine {
               vector: { challenge_solved: 100 },
               cookie: {
                 name: 'pow_clearance',
-                value: ticket,
-                options: { httpOnly: true, secure: this.isProduction, maxAge: finalTtl }
+                value: ticket, // The ticket itself
+                options: { httpOnly: true, secure: this.isProduction, maxAge: finalTtl } // Options for setting the cookie
               }
             };
         } else {
@@ -1910,7 +1856,68 @@ export class FingerprintEngine {
             this._log('Challenge solution invalid', { pow_nonce });
             suspicionVector.honeypotScore = 100; // Invalid solution is a strong bot signal.
             finalScore = this.calculateFinalScore(suspicionVector);
+            // --- FIX: After invalidating a solution, immediately check if the new score triggers a block ---
+            const newBlockThreshold = thresholds.block ?? 95;
+            if (finalScore >= newBlockThreshold) {
+                this._log('Request blocked after invalid challenge solution', { finalScore, newBlockThreshold });
+                return { action: 'block', status: 404, body: 'Forbidden', score: finalScore, vector: suspicionVector };
+            }
+            // If not blocked, the request will proceed to be re-challenged.
+        }
+    } else if (pow_nonce && pow_type === 'optimization_task' && pow_solution_population) {
+        this._log('Optimization task solution submitted', { pow_nonce });
+        const challengeContext = await store.get(`secret:${pow_nonce}`);
+        let isValid = false;
+
+        if (challengeContext?.optimizationProblem) {
+            try {
+                const submittedChromosomes = JSON.parse(pow_solution_population);
+                // Vérification simple : le client a-t-il renvoyé le bon nombre de solutions ?
+                if (Array.isArray(submittedChromosomes) && submittedChromosomes.length === challengeContext.optimizationProblem.population.length) {
+                    // Le serveur recalcule la fitness pour la nouvelle population.
+                    const fitnessFunction = Optimization.Operators.createFullSecurityConfigEvaluator({ trafficData: challengeContext.optimizationProblem.trafficData });
+                    const newPopulation = submittedChromosomes.map(chromosome => ({ chromosome, fitness: fitnessFunction(chromosome) }));
+                    
+                    // On met à jour le problème principal avec la nouvelle population.
+                    challengeContext.optimizationProblem.population = newPopulation;
+                    await store.set(`device:${deviceId}`, deviceData); // Sauvegarde l'état mis à jour
+                    isValid = true;
+                }
+            } catch (e) {
+                this._log('Error parsing optimization solution', { error: e.message });
+            }
+        }
+
+        if (isValid) {
+            await store.delete(`secret:${pow_nonce}`);
+            // La solution est valide, on accorde un ticket et on redirige.
+            const ticket = "valid_ticket_placeholder"; // Générer un vrai ticket ici
+            return { action: 'redirect', path: path, score: 0, vector: { challenge_solved: 100 }, cookie: { name: 'pow_clearance', value: ticket, options: { httpOnly: true, secure: this.isProduction, maxAge: 60000 } } };
+        } else {
+            this._log('Optimization task solution invalid', { pow_nonce });
+            suspicionVector.honeypotScore = 100;
+            finalScore = this.calculateFinalScore(suspicionVector);
         }
+    } else if (pow_nonce && pow_type === 'useful_work_task' && pow_solution_work_result && pow_problem_id) {
+        this._log('Useful work solution submitted', { problemId: pow_problem_id });
+        const challengeContext = await store.get(`secret:${pow_nonce}`);
+        if (challengeContext) {
+            try {
+                const workResult = JSON.parse(pow_solution_work_result);
+                problemManager.integrateSolution(pow_problem_id, workResult);
+
+                await store.delete(`secret:${pow_nonce}`);
+                // Accorder un ticket de passage comme pour un PoW normal
+                const ticket = "valid_ticket_placeholder"; // Générer un vrai ticket ici
+                return { action: 'redirect', path: path, score: 0, vector: { challenge_solved: 100 }, cookie: { name: 'pow_clearance', value: ticket, options: { httpOnly: true, secure: this.isProduction, maxAge: 60000 } } };
+
+            } catch (e) {
+                this._log('Error parsing useful work solution', { error: e.message });
+            }
+        }
+        // Si la validation échoue, on pénalise fortement
+        suspicionVector.honeypotScore = 100;
+        finalScore = this.calculateFinalScore(suspicionVector);
     }
     // --- FIN DE LA LOGIQUE DE PRIORITÉ ---
 
@@ -1918,7 +1925,7 @@ export class FingerprintEngine {
     if (isBlocked) {
       this._log('Request blocked - score exceeded block threshold', { finalScore, blockThreshold });
       if (onDeviceCompromised) {
-        onDeviceCompromised({ deviceId: cookies?.device_id, clientIp, reason: 'Score exceeded block threshold', score: finalScore, vector: suspicionVector });
+        onDeviceCompromised({ deviceId: deviceId, clientIp, reason: 'Score exceeded block threshold', score: finalScore, vector: suspicionVector });
       }
       return { action: 'block', status: 404, body: 'Forbidden', score: finalScore, vector: suspicionVector };
     }
@@ -1930,7 +1937,7 @@ export class FingerprintEngine {
         this._log('Honeypot trap URL triggered - condemning device', { path, deviceId });
         deviceData.condemned = true; // This device is a bot. Condemn it.
         if (onDeviceCompromised) {
-            onDeviceCompromised({ deviceId: cookies?.device_id, clientIp, reason: 'Triggered signed honeypot trap URL', score: 100, vector: { honeypotScore: 100 } });
+            onDeviceCompromised({ deviceId: deviceId, clientIp, reason: 'Triggered signed honeypot trap URL', score: 100, vector: { honeypotScore: 100 } });
         }
         if (logger) {
             logger({ type: 'trap_triggered', deviceId: cookies?.device_id, score: 100, path: path, timestamp: Date.now() });
@@ -1961,20 +1968,32 @@ export class FingerprintEngine {
         const nonce = crypto.randomBytes(16).toString("hex");
         const clientSecret = crypto.randomBytes(16).toString("hex");
 
-        // LEVEL 3: CAPTCHA (the highest)
-        if (isSuspiciousHigh) {
-            // ... logic for TSP/Captcha challenge
-        }
+        // Pour les scores élevés, on choisit aléatoirement entre un challenge de travail utile et un PoW classique.
+        // Cela rend l'automatisation plus difficile pour un attaquant.
+        if (isSuspicious && this.securityConfig.enableUsefulWork && Math.random() > 0.5) {
+            this._log('Issuing a useful work challenge', { finalScore });
+
+            const { problemId, task } = problemManager.dispatchWork(suspicionFactor);
+
+            await store.set(`secret:${nonce}`, { clientSecret, originalPath: path }, 300);
 
-        // UNIFIED CHALLENGE LOGIC for all suspicion levels (low, medium, high)
-        if (isSuspicious) { // Couvre à la fois low et medium
+            const challengePayload = {
+                challenge: {
+                    type: 'useful_work_task',
+                    nonce: nonce,
+                    clientSecret: clientSecret,
+                    usefulWorkTask: { problemId, task }
+                }
+            };
+            return { action: 'challenge', score: finalScore, vector: suspicionVector, status: 404, body: challengePayload };
+        } else if (isSuspicious) { // Pour les scores bas/moyens ou si le travail utile n'est pas choisi
             // Generate some trap URLs to embed in the challenge page.
             // These links are visually hidden but present in the DOM to trap bots.
             const trapUrls = Array.from({ length: 3 }, () => generateTrapUrl(nonce));
             const trapLinksHtml = trapUrls.map(url => `<a href="${url}" tabindex="-1">config</a>`).join(' ');
 
-
-            const cpuChallengeDetails = generateCpuTargetChallenge(clientIp, nonce, suspicionFactor, path);
+            // On passe la configuration pour que la difficulté soit calculée correctement.
+            const cpuChallengeDetails = generateCpuTargetChallenge(clientIp, nonce, suspicionFactor, path, this.securityConfig);
 
             // La difficulté mémoire démarre à 0 et augmente seulement après un certain seuil de suspicion.
             // Par exemple, elle ne commence à augmenter qu'à partir de 25% du chemin entre 'low' et 'high'.
@@ -1990,13 +2009,18 @@ export class FingerprintEngine {
                 memDifficulty,
                 cpuTarget: cpuChallengeDetails.target
             });
+            // (NOUVEAU) On stocke le fingerprint de la requête qui a déclenché le challenge. We call it via __internal to allow mocking.
+            const originalFingerprint = requestContext.headers['x-device-fingerprint'] || __internal.getCompositeDeviceHash(requestContext);
 
             // Store the entire challenge context with a short TTL (e.g., 5 minutes)
+            const baseBlock = createCpuChallengeBaseBlock(nonce, clientSecret, originalFingerprint);
             await store.set(`secret:${nonce}`, {
                 clientSecret,
                 cpuTarget: cpuChallengeDetails.target,
                 suspicionScore: finalScore, // *** FIX: Store the score that triggered the challenge ***
+                fingerprint: originalFingerprint, // *** NOUVEAU ***
                 memDifficulty: memDifficulty,
+                baseBlock: baseBlock, // *** NOUVEAU: Le bloc de base est stocké pour la vérification ***
                 originalPath: path, // *** FIX: Store the original path ***
             }, this.securityConfig.challengeTtl || 300); // NOUVEAU: TTL configurable (5min par défaut)
 
@@ -2017,7 +2041,7 @@ export class FingerprintEngine {
             }
 
             // Check if the request is an API request to return a JSON challenge
-            const isApi = requestContext.rawReq && this.securityConfig.thresholds?.isApiRequest?.(requestContext.rawReq);
+            const isApi = requestContext.rawReq && this.securityConfig?.isApiRequest?.(requestContext.rawReq);
 
             if (isApi) {
                 // For API clients, send a JSON response with challenge details.
@@ -2028,13 +2052,14 @@ export class FingerprintEngine {
                         clientSecret: clientSecret, // The client needs this to solve the challenge
                         cpuTarget: cpuChallengeDetails.target,
                         memDifficulty: memDifficulty,
+                        baseBlock: [...baseBlock], // Envoyer le buffer comme un tableau d'octets
                     }
                 };
                 this._log('API challenge response generated', { challengePayload });
                 return { action: 'challenge', score: finalScore, vector: suspicionVector, status: 404, body: challengePayload };
             } else {
                 // For browsers, send the HTML page.
-                const trapContainer = `<div style="position:absolute;left:-9999px;top:-9999px;" aria-hidden="true">${trapLinksHtml}</div>`;                const page = generateCombinedPoWChallengePage(cpuChallengeDetails, memDifficulty, clientIp, clientSecret, this.securityConfig, trapContainer);
+                const trapContainer = `<div style="position:absolute;left:-9999px;top:-9999px;" aria-hidden="true">${trapLinksHtml}</div>`;                const page = generateCombinedPoWChallengePage(cpuChallengeDetails, memDifficulty, clientIp, clientSecret, this.securityConfig, trapContainer, originalFingerprint);
                 this._log('Browser challenge page generated', { 
                     pageLength: page.length, 
                     hasTrapContainer: true 
@@ -2110,6 +2135,176 @@ export class FingerprintEngine {
   }
 }
 
+const staticExtensions = new RegExp(
+  "\\.(js|css|png|jpg|jpeg|gif|svg|mp3|webp|ico|woff|woff2|ttf|otf|map|json|manifest|webmanifest)$",
+  "i",
+);
+const isStaticResource = (path) => staticExtensions.test(path);
+
+
+/**
+ * Détermine le TTL optimal pour un ticket en utilisant un algorithme génétique multi-objectifs.
+ * @param {number} suspicionScore - Le score de suspicion de la requête.
+ * @returns {number} Le TTL optimal calculé en millisecondes.
+*/
+function determineOptimalTicketTtl(suspicionScore) {
+    // Définir les bornes pour la durée de vie du ticket (5 minutes à 24 heures)
+    const MIN_TTL = 300000;
+    const MAX_TTL = 86400000;
+
+    const solverFunction = () => {
+        const fitnessFunction = Optimization.Operators.createOptimalTtlEvaluator({ suspicionScore });
+
+        // Un "individu" est simplement une valeur de TTL en millisecondes.
+        const createIndividual = () => MIN_TTL + Math.random() * (MAX_TTL - MIN_TTL);
+        const crossover = (ttl1, ttl2) => (ttl1 + ttl2) / 2;
+        const mutate = (ttl) => {
+            const newTtl = ttl + (Math.random() - 0.5) * (MAX_TTL - MIN_TTL) * 0.1; // Mutation de +/- 10% max
+            return Math.max(MIN_TTL, Math.min(MAX_TTL, newTtl));
+        };
+
+        const paretoFront = Optimization.geneticAlgorithmMultiObjective(
+            createIndividual,
+            fitnessFunction,
+            crossover,
+            mutate,
+            {
+                generations: 40,
+                populationSize: 30,
+            }
+        );
+
+        // Pour runMultiple, on doit retourner un objet avec une propriété "fitness" ou "energy".
+        // Pour un front de Pareto, il n'y a pas de score unique. On choisit la meilleure solution
+        // en fonction du score de suspicion et on lui assigne un score de 0 pour que runMultiple la sélectionne.
+        if (!paretoFront || paretoFront.length === 0) {
+            return { solution: null, fitness: Infinity };
+        }
+
+        // Stratégie de sélection :
+        // Pour un score faible (< 50), on privilégie la solution avec le plus grand TTL (minimise la friction).
+        // Pour un score élevé (>= 50), on privilégie la solution avec le plus petit TTL (minimise le risque).
+        let bestSolutionInFront;
+        if (suspicionScore < 50) {
+            bestSolutionInFront = paretoFront.reduce((max, p) => Math.max(max, p.solution), 0);
+        } else {
+            bestSolutionInFront = paretoFront.reduce((min, p) => Math.min(min, p.solution), Infinity);
+        }
+        return { solution: bestSolutionInFront, fitness: 0 }; // fitness=0 car on a déjà la meilleure solution du cycle.
+    };
+
+    // On exécute le solveur 20 fois pour trouver une solution plus stable et robuste.
+    const { bestResult } = Optimization.runMultiple(solverFunction, 20);
+
+    if (!bestResult || !bestResult.solution || bestResult.solution === Infinity) {
+        // Fallback : si l'algo ne retourne rien, on applique une règle simple et sûre.
+        return Math.max(MIN_TTL, MAX_TTL - (suspicionScore / 100) * MAX_TTL);
+    }
+
+    // runMultiple choisit le meilleur résultat sur la base du score (ici, 0).
+    // La "meilleure" solution dépendra du cycle qui a trouvé le meilleur compromis.
+    return Math.round(bestResult.solution);
+}
+
+/**
+ * Vérifie si une chaîne de caractères contient des patterns d'injection connus.
+ * @private
+ * @param {string} str - La chaîne à vérifier.
+ * @param {string[]} [typesToDetect=['sql', 'log4shell', 'ssti', 'xxe', 'traversal', 'rce']] - Les types d'injections à détecter.
+ * @returns {boolean} - True si un pattern malveillant est détecté.
+ */
+function isMalicious(str, typesToDetect = Object.keys(injectionPatterns)) {
+    if (typeof str !== 'string') return false;
+
+    for (const type of typesToDetect) {
+        const regex = injectionPatterns[type];
+        if (regex && regex.test(str)) {
+            return true;
+        }
+    }
+
+    return false;
+}
+
+// --- Middleware Proof-of-Work (Le péage) ---
+export { isMalicious };
+
+/**
+ * Returns a default list of security analyzers for honeypot detection.
+ * This list can be used as a base and extended with custom rules.
+ * Currently includes an XSS detection analyzer.
+ * @returns {Array<Function>}
+ */
+export const default_analyzers = () => [
+    // Analyzer for Cross-Site Scripting (XSS) detection.
+    // It uses the 'xss' library, which should be installed by the user (`npm install xss`).
+    // If 'xss' is not available, this analyzer will be safely ignored.
+    xss_analyzer
+];
+
+export const xss_analyzer = async (data) => {
+    try {
+        // Dynamically import the 'xss' library.
+        // The module is loaded only once by Node's cache.
+        const xss = (await import('xss')).default;
+        const originalData = JSON.stringify(data);
+        // If the sanitized string is different, it means malicious HTML/JS was found and removed.
+        return xss(originalData) !== originalData;
+    } catch (error) {
+        // This catch block handles the case where the 'xss' module is not installed.
+        if (error.code === 'ERR_MODULE_NOT_FOUND') {
+            console.warn('[Fingerprint] Warning: The "xss" package is not installed. The default XSS analyzer is disabled. Run "npm install xss" to enable it.');
+            // To avoid repeated warnings, we can replace this function with a no-op.
+            this.isXssAnalyzerAvailable = false; // A flag to prevent future attempts.
+        }
+        return false; // In case of any error, we assume the data is not malicious.
+    }
+}
+/**
+ * Returns a powerful WAF (Web Application Firewall) analyzer based on ModSecurity.
+ * This analyzer is highly effective against a wide range of attacks (SQLi, XSS, RCE, etc.)
+ * by using the OWASP Core Rule Set.
+ *
+ * **Note:** This is an optional and advanced feature.
+ * 1. The user must install the package: `npm install modsecurity-nodejs`
+ * 2. ModSecurity rules (like the OWASP CRS) must be available on the server.
+ *
+ * If the package is not installed, the analyzer will be safely ignored.
+ *
+ * @param {string} rulesPath - The path to the ModSecurity rules configuration file (e.g., `crs-setup.conf`).
+ * @returns {Function} An analyzer function to be used in the `honeypot.analyzers` array.
+ */
+export const modsecurity_analyzer = (rulesPath) => {
+    let wafInstance = null; // Singleton instance for the WAF
+
+    return async (data) => {
+        if (!rulesPath) {
+            console.warn('[Fingerprint] ModSecurity analyzer disabled: `rulesPath` is not provided.');
+            return false;
+        }
+
+        try {
+            if (!wafInstance) {
+                // Dynamically import the library only when needed.
+                const { ModSecurity } = await import('modsecurity-nodejs');
+                wafInstance = new ModSecurity();
+                wafInstance.init();
+                wafInstance.addRules(rulesPath);
+                console.log('[Fingerprint] ModSecurity WAF analyzer initialized successfully.');
+            }
+
+            // The `transaction` method checks the data against the loaded rules.
+            // It returns `null` if no rules are matched, or an object with intervention details if a threat is found.
+            const result = wafInstance.transaction(data);
+            return result !== null; // A non-null result means a threat was detected.
+        } catch (error) {
+            if (error.code === 'ERR_MODULE_NOT_FOUND') {
+                console.warn('[Fingerprint] Warning: "modsecurity-nodejs" is not installed. The WAF analyzer is disabled. Run "npm install modsecurity-nodejs" to enable it.');
+            }
+            return false; // Assume data is safe if any error occurs.
+        }
+    };
+};
 /**
  * Returns a default list of whitelisting rules for common and legitimate web crawlers.
  * This list can be used as a base and extended with custom rules.
@@ -2228,9 +2423,8 @@ export const powMiddleware = (securityConfig) => {
 
   // Provide a default for isApiRequest if not specified by the user.
   // This makes API challenge handling work more seamlessly out-of-the-box.
-  if (!securityConfig.thresholds?.isApiRequest) {
-    if (!securityConfig.thresholds) securityConfig.thresholds = {};
-    securityConfig.thresholds.isApiRequest = (req) => 
+  if (!securityConfig?.isApiRequest) {
+    securityConfig.isApiRequest = (req) =>
       req.headers?.accept?.includes('application/json');
   }
 
@@ -2242,9 +2436,10 @@ export const powMiddleware = (securityConfig) => {
       query: req.query,
       body: req.body,
       headers: req.headers,
-      isStatic: isStaticResource(req.path),
+      isStatic: securityConfig?.isStaticResource?.(req.path) || isStaticResource(req.path),
       // Pass the original request object for the isApiRequest function
       rawReq: req,
+      requestTimestamp: Date.now(), // Timestamp de début de requête
       // Add the newly required properties for full decoupling
       rawHeaders: req.rawHeaders,
       // Pass the raw request object for advanced inspection (e.g., JA3)
@@ -2306,6 +2501,7 @@ export const __internal = {
     getBehaviorScore, // Expose for testing
     getCrossLayerInconsistency, // Expose for testing
     // Expose page generators for security testing
+    getTimeInconsistencyScore,
     generateCpuTargetChallengePage,
     generateCombinedPoWChallengePage,
 };