@anonympins/fingerprint 0.2.0 → 0.2.1

package/README.md

@@ -98,6 +98,10 @@ const securityConfig = {
         high: 75,   // Score for a very difficult challenge
         block: 95,  // Score above which the request is blocked outright (HTTP 404)
     },
+    cpu: {
+        minDifficultyBits: 8,
+        maxDifficultyBits: 24,
+    },
     // (Optional) Configure the duration (in milliseconds) for various temporary data.
     ticketMaxAge: 3600000, // 1 hour. Duration for which a solved challenge ticket is valid.
     challengeTtl: 300000, // 5 minutes. Time during which a challenge nonce is valid.

package/fingerprint.builder.js

@@ -1,104 +1,161 @@
-/**
- * Algorithme de hachage cyrb53 (rapide et faible taux de collision).
- */
-export const cyrb53 = (str, seed = 0) => {
-    let h1 = 0xdeadbeef ^ seed,
-        h2 = 0x41c6ce57 ^ seed;
-    for (let i = 0, ch; i < str.length; i++) {
-        ch = str.charCodeAt(i);
-        h1 = Math.imul(h1 ^ ch, 2654435761);
-        h2 = Math.imul(h2 ^ ch, 1597334677);
-    }
-    h1 =
-        Math.imul(h1 ^ (h1 >>> 16), 2246822507) ^
-        Math.imul(h2 ^ (h2 >>> 13), 3266489909);
-    h2 =
-        Math.imul(h2 ^ (h2 >>> 16), 2246822507) ^
-        Math.imul(h1 ^ (h1 >>> 13), 3266489909);
-    return 4294967296 * (2097151 & h2) + (h1 >>> 0);
-};
-
-/**
- * Classe pour construire une empreinte composite (Multi-Hash).
- * Format de sortie : "grp1:hash1|grp2:hash2|grp3:hash3"
- */
-export class FingerprintBuilder {
-    constructor() {
-        this.components = new Map();
-    }
-
-    /**
-     * Ajoute un composant au hash global.
-     * @param {string} group - Le nom du groupe (ex: 'hw', 'screen', 'geo')
-     * @param {string|number|boolean} value - La valeur brute à hasher
-     */
-    add(group, value) {
-        if (value === undefined || value === null) return this;
-        // On hash la valeur individuellement pour l'anonymiser et réduire sa taille
-        this.components.set(group, cyrb53(String(value)));
-        return this;
-    }
-
-    /**
-     * Adds a raw component without hashing it.
-     * Useful for metrics that need to be read on the server.
-     * @param {string} group - The name of the group.
-     * @param {string|number} value - The raw value.
-     */
-    addRaw(group, value) {
-        if (value === undefined || value === null) return this;
-        this.components.set(group, value);
-        return this;
-    }
-    /**
-     * Génère la chaîne de signature finale.
-     * Trie les clés pour garantir un ordre déterministe.
-     */
-    toString() {
-        return Array.from(this.components.entries())
-            .sort((a, b) => a[0].localeCompare(b[0])) // Tri alphabétique des clés
-            .map(([key, hash]) => `${key}:${hash}`)
-            .join("|");
-    }
-
-    /**
-     * Compares two fingerprints and returns a similarity score (0 to 1).
-     * Uses weights to give more importance to strong invariants (Canvas, GPU).
-     * @param {string} fpString1 - Fingerprint A
-     * @param {string} fpString2 - Fingerprint B
-     */
-    static compare(fpString1, fpString2) {
-        if (!fpString1 || !fpString2) return 0;
-
-        const parse = (str) => new Map(str.split("|").map(part => part.split(":")).filter(([k,v]) => k && v));
-
-        const map1 = parse(fpString1);
-        const map2 = parse(fpString2);
-
-        // Poids de "véracité" (Entropie/Stabilité)
-        const weights = {
-            cvs: 4.0,   // Canvas: Très haute entropie (Rendu unique)
-            gpu: 3.0,   // GPU: Haute entropie (Matériel spécifique)
-            hw: 1.5,    // Hardware: Moyenne entropie
-            scr: 1.0,   // Screen: Moyenne
-            geo: 0.5,   // Geo: Faible (VPN/Voyage)
-            os: 0.5,    // OS: Faible (Générique)
-            bot: 0.0,   // Bot: Informatif
-        };
-
-        let weightedMatches = 0;
-        let totalWeight = 0;
-
-        const allKeys = new Set([...map1.keys(), ...map2.keys()]);
-
-        allKeys.forEach((key) => {
-            const weight = weights[key] || 1.0;
-            totalWeight += weight;
-            if (map1.get(key) === map2.get(key)) {
-                weightedMatches += weight;
-            }
-        });
-
-        return totalWeight === 0 ? 0 : weightedMatches / totalWeight;
-    }
+/**
+ * Algorithme de hachage cyrb53 (rapide et faible taux de collision).
+ */
+export const cyrb53 = (str, seed = 0) => {
+    let h1 = 0xdeadbeef ^ seed,
+        h2 = 0x41c6ce57 ^ seed;
+    for (let i = 0, ch; i < str.length; i++) {
+        ch = str.charCodeAt(i);
+        h1 = Math.imul(h1 ^ ch, 2654435761);
+        h2 = Math.imul(h2 ^ ch, 1597334677);
+    }
+    h1 =
+        Math.imul(h1 ^ (h1 >>> 16), 2246822507) ^
+        Math.imul(h2 ^ (h2 >>> 13), 3266489909);
+    h2 =
+        Math.imul(h2 ^ (h2 >>> 16), 2246822507) ^
+        Math.imul(h1 ^ (h1 >>> 13), 3266489909);
+    return 4294967296 * (2097151 & h2) + (h1 >>> 0);
+};
+
+/**
+ * Classe pour construire une empreinte composite (Multi-Hash).
+ * Format de sortie : "grp1:hash1|grp2:hash2|grp3:hash3"
+ */
+export class FingerprintBuilder {
+    constructor() {
+        this.components = new Map();
+    }
+
+    /**
+     * Ajoute un composant au hash global.
+     * @param {string} group - Le nom du groupe (ex: 'hw', 'screen', 'geo')
+     * @param {string|number|boolean} value - La valeur brute à hasher
+     */
+    add(group, value) {
+        if (value === undefined || value === null) return this;
+        // On hash la valeur individuellement pour l'anonymiser et réduire sa taille
+        this.components.set(group, cyrb53(String(value)));
+        return this;
+    }
+
+    /**
+     * Adds a raw component without hashing it.
+     * Useful for metrics that need to be read on the server.
+     * @param {string} group - The name of the group.
+     * @param {string|number} value - The raw value.
+     */
+    addRaw(group, value) {
+        if (value === undefined || value === null) return this;
+        this.components.set(group, value);
+        return this;
+    }
+
+    /**
+     * Affiche les composants actuels dans la console.
+     * @param {string} [title='FingerprintBuilder Components'] - Un titre pour le log.
+     */
+    log(title = 'FingerprintBuilder Components') {
+        console.log(`--- ${title} ---`);
+        const sortedComponents = Array.from(this.components.entries())
+            .sort((a, b) => a[0].localeCompare(b[0]));
+        
+        console.table(Object.fromEntries(sortedComponents));
+        console.log(`Final string: ${this.toString()}`);
+        console.log(`---------------------------------${'-'.repeat(title.length)}`);
+    }
+
+    /**
+     * Génère la chaîne de signature finale.
+     * Trie les clés pour garantir un ordre déterministe.
+     */
+    toString() {
+        return Array.from(this.components.entries())
+            .sort((a, b) => a[0].localeCompare(b[0])) // Tri alphabétique des clés
+            .map(([key, hash]) => `${key}:${hash}`)
+            .join("|");
+    }
+        /**
+        * Adds a raw component without hashing it.
+        * Useful for metrics that need to be read on the server.
+    * @param {string} group - The name of the group.
+    * @param {string|number} value - The raw value.
+    */
+    addRaw(group, value) {
+        if (value === undefined || value === null) return this;
+        this.components.set(group, value);
+        return this;
+    }
+
+    /**
+     * Compares two fingerprints and returns a similarity score (0 to 1).
+     * Uses weights to give more importance to strong invariants (Canvas, GPU).
+     * @param {string} fpString1 - Fingerprint A
+     * @param {string} fpString2 - Fingerprint B
+     */
+    static compare(fpString1, fpString2) {
+        if (!fpString1 || !fpString2) return 0;
+
+        const parse = (str) => new Map(str.split("|").map(part => part.split(":")).filter(([k,v]) => k && v));
+
+        const map1 = parse(fpString1);
+        const map2 = parse(fpString2);
+
+        // Keys to ignore when comparing the initial request fingerprint with the challenge solver's fingerprint.
+        // Headers like Client-Hints (ch_*), cookie presence (cookie_keys), and upgrade-insecure-requests
+        // can vary or be absent on the subsequent request that submits the solution, especially after a redirect.
+        // By ignoring them, we focus the comparison on more stable identifiers like UA, JA3, GPU, etc.
+        const volatileKeys = new Set([
+            'ch_ua', 'ch_platform', 'ch_mobile', 'ch_model', 'ch_arch', 'ch_bitness',
+            'cookie_keys', 'upgrade',
+            // Also ignore network and http version as they can change between requests (e.g., proxy, protocol upgrade)
+            'network', 'http_ver',
+            // Ignore proxy-related headers as they are not stable client identifiers
+            'x_forwarded_for', 'x_real_ip', 'cf_connecting_ip'
+        ]);
+
+        // Poids de "véracité" (Entropie/Stabilité)
+        // Les poids sont augmentés pour donner plus d'importance aux signaux forts.
+        const weights = {
+            // --- Signaux très forts (difficiles à usurper) ---
+            cvs: 5.0,   // Canvas: Très haute entropie (Rendu unique du GPU/driver)
+            gpu: 4.0,   // GPU: Haute entropie (Matériel spécifique)
+            ja3: 3.5,   // JA3: Identifie la librairie TLS (très stable pour un client donné)
+            ua: 2.0,    // User-Agent: Signal fort, bien que modifiable
+            
+            // --- Signaux composites et dérivés ---
+            client_fp_hash: 3.0, // Le hash de l'empreinte client est un signal très fort.
+            browser: 1.5,        // Le navigateur extrait du UA.
+            os_version: 1.5,     // L'OS extrait du UA.
+            device_type: 1.0,    // Le type d'appareil extrait du UA.
+
+            // --- Signaux moyens ---
+            hw: 1.5,    // Hardware (CPU, RAM): Stabilité moyenne
+            scr: 1.0,   // Screen: Stabilité moyenne
+            // 'os' est souvent la même chose que 'ch_platform', on peut le déprécier ou lui donner un poids faible.
+            os: 0.8,    // OS (nav.platform): Assez stable
+            geo: 0.5,   // Geo/Langue: Peut changer (VPN, voyage)
+        };
+
+        let weightedMatches = 0;
+        let totalWeight = 0;
+
+        const allKeys = new Set([...map1.keys(), ...map2.keys()]);
+
+        allKeys.forEach((key) => {
+            // On ignore les clés volatiles pour cette comparaison spécifique.
+            if (volatileKeys.has(key)) return;
+
+            // On ne compare que les clés qui ont un poids défini.
+            const weight = weights[key];
+            if (!weight) return;
+
+            totalWeight += weight; // N'incrémenter que si la clé est pertinente.
+            if (map1.get(key) === map2.get(key)) {
+                weightedMatches += weight;
+            }
+        });
+
+        return totalWeight === 0 ? 0 : weightedMatches / totalWeight;
+    }
 }

package/fingerprint.client.js

@@ -335,7 +335,7 @@ const ClientLibrary = {
    * @private
    */
   async solveChallengeAndRetry(response, resource, options) {
-    if (response.status !== 404 || !response.headers.get('content-type')?.includes('application/json')) {
+    if (response.status !== 404 || !response.headers.get('content-type')?.includes('application/json') || response.bodyUsed) {
       return response;
     }
     
@@ -346,7 +346,9 @@ const ClientLibrary = {
       }
 
       console.log(`[Fingerprint] Received a '${challengeData.challenge.type}' challenge. Solving...`);
-      const solution = await solveChallenge(challengeData.challenge);
+      // L'empreinte de l'appareil qui résout le challenge est cruciale.
+      const solverFp = this.getDeviceFingerprint();
+      const solution = await solveChallenge(challengeData.challenge, solverFp);
       console.log('[Fingerprint] Challenge solved. Retrying original request.');
 
       // Ajouter la solution aux paramètres de la requête pour le nouvel essai
@@ -360,17 +362,15 @@ const ClientLibrary = {
         url.searchParams.set(`pow_solution_${key}`, String(value));
       });
 
-      // Pour le challenge d'optimisation, la solution est un tableau d'objets
-      if (solution.population) {
-        url.searchParams.set('pow_solution_population', JSON.stringify(solution.population));
-      }
-
       // Pour le challenge de travail utile
       if (solution.work_result) {
         url.searchParams.set('pow_solution_work_result', JSON.stringify(solution.work_result));
         url.searchParams.set('pow_problem_id', solution.problem_id);
       }
 
+      // On ajoute l'empreinte du solveur à la requête de réessai.
+      url.searchParams.set('pow_fp', solverFp);
+
       // On utilise la chaîne d'intercepteurs pour la requête réessayée,
       // ce qui garantit que le fetch original est appelé avec le bon contexte.
       // Cela évite de réintroduire l'erreur "Illegal invocation".
@@ -418,8 +418,9 @@ const ClientLibrary = {
         // Ajoute l'intercepteur pour la résolution de challenge
         if (fetchConfig.handleChallenges !== false) {
           this.addFetchInterceptor(async (resource, options, next) => {
-            const response = await next(resource, options);
-            return this.solveChallengeAndRetry(response, resource, options);
+            const originalResponse = await next(resource, options);
+            // On clone la réponse pour que la lecture du corps par solveChallengeAndRetry ne la consomme pas pour l'appelant original.
+            return this.solveChallengeAndRetry(originalResponse.clone(), resource, options);
           });
         }
     }

package/fingerprint.js

@@ -27,111 +27,12 @@ const getPowSecret = () => {
  * @returns {string} The solver JavaScript code.
  */
 const getPowSolverCode = () => {
-  try {
-    const __filename = fileURLToPath(import.meta.url);
-    const __dirname = dirname(__filename);
-    const solverPath = join(__dirname, 'pow.solver.inline.js'); // Use the inline version
-    return readFileSync(solverPath, 'utf-8');
-  } catch (error) {
-    console.warn('Could not load pow.solver.js for inlining, using fallback inline code');
-    // Fallback inline code if file cannot be loaded
-    return `(function(global){
-        async function solveCpuTargetInline(clientIp, nonce, target, clientSecret, progressCallback){
-            const cpuTarget = typeof target === 'bigint' ? target : BigInt('0x' + target);
-            let cpuSolution = 0;
-            const ipPart = clientIp || '';
-            while(true){
-                // When a clientSecret is used, the IP is omitted from the hash to make it independent of the network.
-                const msg = clientSecret ? \`\${nonce}:\${cpuSolution}:\${clientSecret}\` : \`\${ipPart}:\${nonce}:\${cpuSolution}\`;
-                const buf = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(msg));
-                const hashHex = Array.from(new Uint8Array(buf)).map(b=>b.toString(16).padStart(2,'0')).join('');
-                if(BigInt('0x'+hashHex) < cpuTarget) break;
-                cpuSolution++;
-                if(cpuSolution % 100000 === 0) await new Promise(r=>setTimeout(r,0));
-            }
-            return cpuSolution;
-        }
-        async function solveMemory(seed, difficulty){
-            const size = difficulty * 1024 * 1024;
-            const buffer = new Uint32Array(size / 4);
-            let h = new TextEncoder().encode(seed).reduce((acc,v)=>acc+v,0);
-            for(let i=0;i<buffer.length;i++) buffer[i] = h = Math.imul(h^i,1597334677);
-            let solution = 0;
-            const iterations = size / 16;
-            let addr = buffer.length > 0 ? buffer[0] % buffer.length : 0;
-            for(let i=0;i<iterations;i++){
-                addr = buffer[addr] % buffer.length;
-                solution ^= addr;
-            }
-            return solution;
-        }
-        async function solveTsp(cities, targetMaxDistance){
-            function distance(c1,c2){return Math.sqrt(Math.pow(c1.x-c2.x,2)+Math.pow(c1.y-c2.y,2));}
-            function evaluatePathDistance(cities,path){
-                let total=0;
-                for(let i=0;i<path.length-1;i++) total+=distance(cities[path[i]],cities[path[i+1]]);
-                total+=distance(cities[path[path.length-1]],cities[path[0]]);
-                return total;
-            }
-            function solveTspNearestNeighbor(cities){
-                const n=cities.length;
-                if(n===0)return[];
-                let path=[0];
-                let visited=new Array(n).fill(false);
-                visited[0]=true;
-                for(let i=1;i<n;i++){
-                    let nearest=-1, minDist=Infinity;
-                    for(let j=0;j<n;j++){
-                        if(!visited[j]){
-                            const d=distance(cities[path[i-1]],cities[j]);
-                            if(d<minDist){minDist=d;nearest=j;}
-                        }
-                    }
-                    path.push(nearest);
-                    visited[nearest]=true;
-                }
-                return path;
-            }
-            await new Promise(r=>setTimeout(r,10));
-            const solutionPath=solveTspNearestNeighbor(cities);
-            const solutionDistance=evaluatePathDistance(cities,solutionPath);
-            return{path:solutionPath,distance:solutionDistance};
-        }
-        async function solveChallenge(challenge) {
-            const { type, nonce, clientSecret, cpuTarget, memDifficulty, cities, clientIp, targetMaxDistance } = challenge;
-            const solutions = {};
-
-            switch (type) {
-                case 'cpu_target':
-                    solutions.cpu = await solveCpuTargetInline(clientIp, nonce, cpuTarget, clientSecret);
-                    break;
-                case 'cpu_mem':
-                case 'cpu_mem_inline':
-                    const memSeed = nonce + ":" + clientSecret;
-                    const [cpuSol, memSol] = await Promise.all([
-                        solveCpuTargetInline(clientIp, nonce, cpuTarget, clientSecret),
-                        solveMemory(memSeed, memDifficulty)
-                    ]);
-                    solutions.cpu = cpuSol;
-                    solutions.mem = memSol;
-                    break;
-                case 'tsp':
-                    const tspResult = await solveTsp(cities, targetMaxDistance);
-                    solutions.tsp = tspResult.path;
-                    solutions.distance = tspResult.distance;
-                    break;
-                default:
-                    throw new Error(\`Unknown challenge type: \${type}\`);
-            }
-
-            return solutions;
-        }
-        global.solveCpuChallengeInline=solveCpuTargetInline;
-        global.solveMemoryChallenge=solveMemory;
-        global.solveTspChallenge=solveTsp;
-        global.solveChallenge=solveChallenge;
-    })(typeof window!=='undefined'?window:global);`;
-  }
+  // On supprime le try/catch. Si le fichier n'est pas trouvé, le processus plantera,
+  // ce qui est préférable à servir un code de secours potentiellement désynchronisé.
+  const __filename = fileURLToPath(import.meta.url);
+  const __dirname = dirname(__filename);
+  const solverPath = join(__dirname, 'pow.solver.inline.js'); // Utilise la version inline
+  return readFileSync(solverPath, 'utf-8');
 };
 
 /**
@@ -190,7 +91,7 @@ function getHeaderSignature(context) {
     for (let i = 0; i < context.rawHeaders.length; i += 2) {
         headerKeys.push(context.rawHeaders[i]);
     }
-    return cyrb53(headerKeys.join(','));
+    return cyrb53(headerKeys.sort().join(','));
 }
 
 /**
@@ -227,11 +128,6 @@ export function getCompositeDeviceHash(context) {
     const ua = context.headers["user-agent"];
     if (ua) {
         srv.add("ua", ua);
-        // Extraire des infos supplémentaires du UA
-        const uaParts = parseUserAgent(ua);
-        if (uaParts.browser) srv.add("browser", uaParts.browser);
-        if (uaParts.os) srv.add("os_version", uaParts.os);
-        if (uaParts.device) srv.add("device_type", uaParts.device);
     }
 
     // 2. SIGNAL FORT: JA3 TLS Fingerprint
@@ -266,9 +162,6 @@ export function getCompositeDeviceHash(context) {
         srv.add("upgrade", context.headers["upgrade-insecure-requests"]);
     }
 
-    // 10. SIGNAL FORT: Ordonnancement des headers
-    srv.add("h_ord", getHeaderSignature(context));
-
     // 11. SIGNAL AVANCÉ: Cookies (si disponible)
     if (context.cookies) {
         const cookieKeys = Object.keys(context.cookies).sort().join(',');
@@ -614,11 +507,11 @@ export const verifyPoWAndGenerateTicket = (
  * Verifies a memory PoW solution.
  * The server performs the same calculation to validate.
  */
-export const verifyMemoryPoW = (nonce, solution, difficulty = 16, clientSecret) => {
+export const verifyMemoryPoW = (nonce, solution, difficulty = 16, clientSecret = '') => {
   const size = difficulty * 1024 * 1024;
   const iterations = size / 16;
   const buffer = new Uint32Array(size / 4);
-  const seed = clientSecret ? `${nonce}:${clientSecret}` : nonce;
+  const seed = `:${nonce}:${clientSecret}`;
   let h = new TextEncoder().encode(seed).reduce((acc, v) => acc + v, 0);
 
   for (let i = 0; i < buffer.length; i++) {
@@ -946,8 +839,10 @@ function getRequestPatternScore(context, deviceData, patternConfig = {}) {
     const now = Date.now();
     const currentPath = context.path;
     // Make the function robust to handle both URLSearchParams and plain objects for query.
-    // Ensure query parameters are consistently handled, whether they come from a URLSearchParams object or a plain object.
-    const params = context.query instanceof URLSearchParams ? context.query : new URLSearchParams(context.query);
+    const params =
+      context.query instanceof URLSearchParams
+        ? new URLSearchParams(context.query.toString()) // Clone to avoid modifying the original
+        : new URLSearchParams(context.query || {});
     params.sort(); // Sort for deterministic order
     const currentQueryString = params.toString();
 
@@ -1365,20 +1260,44 @@ const BASE_TARGET = MAX_DIFFICULTY_TARGET >> 16n;
  * @param {number} suspicionFactor - A number from 0 to 1.
  * @returns {BigInt} The target number.
  */
-function calculateTarget(suspicionFactor) {
+function calculateTarget(suspicionFactor, securityConfig = {}) {
   // Difficulty range adjusted to be realistic.
   // MIN_DIFFICULTY: Fast enough not to bother a slightly suspicious user.
   // MAX_DIFFICULTY: Slow enough to heavily penalize a bot, but feasible for a patient human (5-30s).
-  const MIN_DIFFICULTY_BITS = 18; // Default value, should be configurable
-  const MAX_DIFFICULTY_BITS = 26; // Default value, should be configurable
+  // NOUVEAU: La difficulté est maintenant configurable.
+  const { cpu: cpuConfig = {} } = securityConfig;
+  const MIN_DIFFICULTY_BITS = cpuConfig.minDifficultyBits ?? 8;
+  const MAX_DIFFICULTY_BITS = cpuConfig.maxDifficultyBits ?? 16;
 
   // Use linear interpolation between min and max difficulty.
   const totalDifficultyBits =
     MIN_DIFFICULTY_BITS +
     suspicionFactor * (MAX_DIFFICULTY_BITS - MIN_DIFFICULTY_BITS);
+  
+  if (totalDifficultyBits <= 0) return 2n ** 256n - 1n; // Si la difficulté est nulle ou négative, la cible est maximale (aucun challenge).
+
+  // The correct way to calculate the target is to define the number of leading zero bits required.
+  // A target for N bits of difficulty is 2^(256-N).
+  // We can calculate this with a left-shift on 1.
+  const shift = 256n - BigInt(Math.floor(totalDifficultyBits));
+  return 1n << shift;
+}
 
-  // The target is max / 2^bits
-  return MAX_DIFFICULTY_TARGET >> BigInt(Math.floor(totalDifficultyBits));
+/**
+ * @private
+ * Crée le bloc de base pour le challenge CPU.
+ * Ce buffer contient toutes les données sauf la solution.
+ * @param {string} nonce
+ * @param {string} clientSecret
+ * @param {string} fingerprint
+ * @returns {Buffer}
+ */
+function createCpuChallengeBaseBlock(nonce, clientSecret, fingerprint) {
+    const sortedFingerprint = (fingerprint || '').split('|').filter(p => p).sort().join('|');
+    // On concatène les chaînes, puis on les convertit en buffer une seule fois.
+    // Cela garantit que le client et le serveur travaillent sur la même base binaire.
+    const messageBase = `${nonce}:${clientSecret}:${sortedFingerprint}:`; // Le ':' final est le séparateur pour la solution.
+    return Buffer.from(messageBase, 'utf8');
 }
 
 /**
@@ -1389,12 +1308,15 @@ export function generateCpuTargetChallenge(
   nonce,
   suspicionFactor,
   originalUrl,
+  securityConfig,
 ) {
-  const target = calculateTarget(suspicionFactor);
+  const target = calculateTarget(suspicionFactor, securityConfig);
+  // Le baseBlock est créé ici et sera stocké dans le contexte du challenge.
+  const baseBlock = createCpuChallengeBaseBlock(nonce, null, ''); // Pour le challenge simple, le secret et le fingerprint sont vides.
   return {
     type: "cpu_target",
     nonce: nonce,
-    target: target.toString(16), // Send the target in hexadecimal
+    target: target.toString(16),
     path: originalUrl,
   };
 }
@@ -1419,10 +1341,11 @@ function generateCpuTargetChallengePage(challengeDetails, clientIp) {
           async function solve() {
             const clientIp = ${JSON.stringify(clientIp)};
             const nonce = ${JSON.stringify(nonce)};
-            const cpuTarget = BigInt("0x${target}");
-            const solution = await window.solveCpuChallengeInline(clientIp, nonce, cpuTarget, null, (progress) => {
-                // Optional progress callback
-            });
+            const cpuTarget = BigInt("0x" + "${target}");
+            // La nouvelle version de solveCpuChallengeInline n'a plus besoin de l'IP ou du secret,
+            // car tout est dans le baseBlock. Pour la compatibilité de ce challenge simple, on passe null.
+            const baseBlockBytes = new TextEncoder().encode(nonce + ":");
+            const solution = await window.solveCpuChallengeInline(baseBlockBytes, cpuTarget, (progress) => {});
             window.location.href = ${JSON.stringify(path)} + "?pow_type=cpu_target&pow_nonce=" + nonce + "&pow_solution=" + solution;
           }
           solve();
@@ -1437,9 +1360,14 @@ function generateCpuTargetChallengePage(challengeDetails, clientIp) {
  * @param {string} clientIp - The client's IP address.
  * @returns {string} HTML content.
  */
-function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty, clientIp, clientSecret, securityConfig, trapContainerHtml) {
+function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty, clientIp, clientSecret, securityConfig, trapContainerHtml, originalFingerprint) {
     const { nonce, target, path } = cpuChallengeDetails;
     const solverCode = getPowSolverCode();
+    // On prépare le baseBlock pour le client. Il sera envoyé sous forme de tableau d'octets.
+    // Le fingerprint est maintenant passé directement en paramètre.
+    const fingerprint = originalFingerprint;
+    const baseBlock = createCpuChallengeBaseBlock(nonce, clientSecret, fingerprint);
+    const baseBlockBytes = `[${baseBlock.toString('utf8').split('').map(c => c.charCodeAt(0)).join(',')}]`;
 
     const challengeScript = `
       async function solve() {
@@ -1447,22 +1375,18 @@ function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty,
         const path = ${JSON.stringify(path)};
         const clientSecret = ${JSON.stringify(clientSecret)};
         const clientIp = ${JSON.stringify(clientIp)};
-        const cpuTarget = BigInt("0x${target}");
+        const cpuTarget = BigInt("0x" + "${target}");
         const memDifficulty = ${memoryDifficulty};
-        // The client-side fingerprint library must be available to generate the fingerprint
-        // of the machine solving the challenge. This assumes a client library is loaded.
-        // We need a function to get the client fingerprint. Let's assume it's available on window.
-        const getClientFingerprint = () => (window.ClientLibrary && typeof window.ClientLibrary.getDeviceFingerprint === 'function') ? window.ClientLibrary.getDeviceFingerprint() : '';
-        const fingerprint = getClientFingerprint();
+        // Le client reçoit directement le 'baseBlock' sous forme de tableau d'octets.
+        // Il n'a plus besoin de construire le message lui-même.
+        const baseBlock = new Uint8Array(${baseBlockBytes});
 
         // --- CPU Challenge ---
-        document.getElementById('loader').innerText = '⚙️ Performing CPU security calculation...';
-        const cpuSolution = await window.solveCpuChallengeInline(clientIp, nonce, cpuTarget, clientSecret, fingerprint, (progress) => {
-            // Optional progress callback
-        });
+        document.getElementById('loader').innerText = '⚙️ Performing CPU security calculation...';        const cpuSolution = await window.solveCpuChallengeInline(baseBlock, cpuTarget, (progress) => {});
+
         // --- Memory Challenge ---
         document.getElementById('loader').innerText = '⚙️ Performing memory allocation and calculation... (' + memDifficulty + ' MB)';
-        await new Promise(r => setTimeout(r, 10)); // Yield to update UI
+        await new Promise(r => setTimeout(r, 10)); // Yield to update UI        
         let memSolution = 0;
         try {
             const memSeed = nonce + ":" + clientSecret;
@@ -1471,7 +1395,10 @@ function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty,
             document.getElementById('loader').innerText = "Error: Insufficient memory. Please refresh.";
             return;
         }
-        window.location.href = path + "?pow_type=cpu_mem&pow_nonce=" + ${JSON.stringify(nonce)} + "&pow_solution_cpu=" + cpuSolution + "&pow_solution_mem=" + memSolution + "&pow_fp=" + encodeURIComponent(fingerprint);
+
+        // Redirect with both solutions and the fingerprint used to solve.
+        const finalUrl = path + "?pow_type=cpu_mem&pow_nonce=" + ${JSON.stringify(nonce)} + "&pow_solution_cpu=" + cpuSolution + "&pow_solution_mem=" + memSolution;
+        window.location.href = finalUrl;
       }
       solve();
     `;
@@ -1502,23 +1429,56 @@ function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty,
  */
 export function verifyCpuTargetPoWAndGenerateTicket(
   clientIp, // This parameter is crucial and must be the actual client IP
-  ticketTtl, // NOUVEAU: Durée de validité du ticket (TTL en ms) configurable
+  ticketTtl,
   nonce,
   solution,
-  clientSecret, // Le secret est maintenant requis
-  target, // La cible est maintenant passée directement en hexadécimal,
-  fingerprint, // Le fingerprint du SOLVER, soumis par le client
+  challengeContext = {}, // Le contexte complet du challenge est maintenant passé
 ) {
-  const message = clientSecret
-    ? `${nonce}:${solution}:${clientSecret}:${fingerprint}`
-    : `${clientIp}:${nonce}:${solution}`; // L'IP est utilisée uniquement pour les challenges sans secret (plus anciens/simples)
+  const { cpuTarget, baseBlock } = challengeContext;
+  if (!cpuTarget || !baseBlock) {
+      console.error('[FP Server Verify] Invalid challenge context. Missing cpuTarget or baseBlock.');
+      return null;
+  }
+
+  // Le baseBlock est déjà un Buffer ou un tableau d'octets.
+  // On s'assure que c'est un Buffer pour la concaténation.
+  const baseBlockBuffer = Buffer.isBuffer(baseBlock) ? baseBlock : Buffer.from(baseBlock);
+  const solutionBuffer = Buffer.from(String(solution), 'utf8');
+
+  // Concaténation binaire directe. C'est la garantie de cohérence.
+  const finalBlock = Buffer.concat([baseBlockBuffer, solutionBuffer]);
+
   const hash = crypto
     .createHash("sha256")
-    .update(message)
+    .update(finalBlock)
     .digest("hex");
   const hashAsInt = BigInt("0x" + hash);
+  const targetAsInt = BigInt("0x" + cpuTarget);
+
+  // --- NOUVEAUX LOGS POUR LE DÉBOGAGE ---
+  console.log('[FP Server Verify] Intermediate values:', {
+    hashCalculated: `0x${hash}`,
+    hashAsInt: hashAsInt.toString(), // Log as string to see full value
+    target: `0x${cpuTarget}`,
+    targetAsInt: targetAsInt.toString(), // Log as string to see full value
+  });
+  // --- FIN DES NOUVEAUX LOGS ---
+
+  const isValid = hashAsInt < targetAsInt;
 
-  if (hashAsInt < BigInt("0x" + target)) {
+  // --- AJOUT DE LOGS POUR LE DÉBOGAGE ---
+  if (!isValid) {
+    console.log('[FP Server Verify] CPU PoW verification FAILED. Details:', {
+      hashCalculated: `0x${hash}`,
+      target: `0x${cpuTarget}`,
+
+    });
+  }
+  // --- FIN DES LOGS ---
+
+  if (isValid) {
+      console.log('[FP Server Verify] CPU PoW verification PASSED. Details:', {
+      });
     // The comparison is direct with native BigInts
     // The proof is valid, generate the ticket
       const expiry = Date.now() + (ticketTtl || 3600000); // Calcule l'expiration à partir du TTL
@@ -1706,7 +1666,7 @@ export class FingerprintEngine {
     if (deviceData?.condemned) {
         this._log('Device condemned - blocking request', { deviceId });
         if (onDeviceCompromised) {
-            onDeviceCompromised({ deviceId: cookies?.device_id, clientIp, reason: 'Previously condemned', score: 100, vector: { honeypotScore: 100 } });
+            onDeviceCompromised({ deviceId: deviceId, clientIp, reason: 'Previously condemned', score: 100, vector: { honeypotScore: 100 } });
         }
         return { action: 'block', status: 404, body: 'Forbidden', score: 100, vector: { honeypotScore: 100 } };
     }
@@ -1768,7 +1728,7 @@ export class FingerprintEngine {
     // Si une solution de challenge est soumise, on la traite en priorité absolue,
     // avant même de recalculer le score de suspicion.
     const { pow_type, pow_solution, pow_solution_cpu, pow_solution_mem, pow_fp, pow_solution_population, pow_solution_work_result, pow_problem_id } = query;
-    if (pow_nonce && (pow_solution || (pow_solution_cpu && pow_solution_mem))) {
+    if (pow_nonce && (pow_solution || pow_solution_cpu)) { // Vérifie pow_solution pour la compatibilité ascendante
         this._log('Challenge solution submitted', { pow_type, pow_nonce });
 
         // On doit calculer le score de suspicion *avant* de valider le ticket,
@@ -1795,14 +1755,33 @@ export class FingerprintEngine {
         if (challengeContext) {
             // *** NOUVELLE VÉRIFICATION CRUCIALE ***
             // On compare le fingerprint soumis par le solver (`pow_fp`) avec celui stocké
-            // lors de l'émission du challenge (`challengeContext.fingerprint`).
-            const solverFingerprint = pow_fp;
-            const originalFingerprint = challengeContext.fingerprint;
+            // lors de l'émission du challenge.
+            // --- FIX: Use submitted fingerprint, but fallback to current request's fingerprint ---
+            // This handles API clients that might not use the full client-side library but still solve the challenge.
+            const solverFingerprint = pow_fp || getCompositeDeviceHash(requestContext);
+    const originalFingerprint = challengeContext.fingerprint; // This is the fingerprint of the request that *triggered* the challenge
+
+            let similarity;
+            const similarityThreshold = this.securityConfig.similarityThreshold ?? 0.95;
+
+            // If fingerprints are simple strings (like test placeholders 'fp-probation')
+            // and don't contain the typical structure, fall back to a strict equality check.
+            if (!originalFingerprint?.includes(':') || !solverFingerprint?.includes(':')) {
+                similarity = (originalFingerprint === solverFingerprint) ? 1.0 : 0.0;
+            } else {
+                // Use the weighted comparison for structured fingerprints.
+        // We compare the fingerprint of the request that triggered the challenge
+        // with the fingerprint of the request that is submitting the solution.
+        // They should be very similar.
+        similarity = FingerprintBuilder.compare(originalFingerprint, getCompositeDeviceHash(requestContext));
+            }
 
-            if (solverFingerprint !== originalFingerprint) {
+            if (similarity < similarityThreshold) {
                 this._log('Fingerprint mismatch - challenge solved on a different machine!', {
                     original: originalFingerprint,
                     solver: solverFingerprint,
+                    similarity: similarity.toFixed(4),
+                    threshold: similarityThreshold
                 });
                 isValid = false;
             } else {
@@ -1810,13 +1789,13 @@ export class FingerprintEngine {
                 finalTtl = isProbationary ? probationaryTtl : optimalTtl;
                 this._log('Challenge context found, verifying solution', { optimalTtl, finalTtl });
 
-                if (pow_type === "cpu_target" && pow_solution) {
-                    ticket = verifyCpuTargetPoWAndGenerateTicket(clientIp, finalTtl, pow_nonce, pow_solution, challengeContext.clientSecret, challengeContext.cpuTarget, solverFingerprint);
+                if ((pow_type === "cpu_target" || !pow_type) && (pow_solution_cpu || pow_solution)) { // !pow_type pour compatibilité
+                    const cpuSolution = pow_solution_cpu || pow_solution;
+            ticket = verifyCpuTargetPoWAndGenerateTicket(clientIp, finalTtl, pow_nonce, cpuSolution, challengeContext);
                     isValid = ticket !== null;
                     this._log('CPU target challenge verification', { isValid });
-                } else if (pow_type === "cpu_mem" && pow_solution_cpu && pow_solution_mem) {
-                    const cpuTicket = verifyCpuTargetPoWAndGenerateTicket(clientIp, finalTtl, pow_nonce, pow_solution_cpu, challengeContext.clientSecret, challengeContext.cpuTarget, solverFingerprint);
-                    const isMemValid = verifyMemoryPoW(pow_nonce, pow_solution_mem, challengeContext.memDifficulty, challengeContext.clientSecret);
+                } else if (pow_type === "cpu_mem" && pow_solution_cpu && pow_solution_mem) {                    const cpuTicket = verifyCpuTargetPoWAndGenerateTicket(clientIp, finalTtl, pow_nonce, pow_solution_cpu, challengeContext);
+            const isMemValid = verifyMemoryPoW(pow_nonce, pow_solution_mem, challengeContext.memDifficulty, challengeContext.clientSecret); // Memory PoW is independent of fingerprint
                     isValid = cpuTicket !== null && isMemValid;
                     if (isValid) ticket = cpuTicket; // Le ticket est le même, on le réutilise
                     this._log('Combined CPU+Memory challenge verification', {
@@ -1840,7 +1819,7 @@ export class FingerprintEngine {
 
             // NOUVELLE LOGIQUE DE REDIRECTION (plus robuste)
             // 1. On part du chemin original stocké, qui peut contenir des query params.
-            const originalUrl = new URL(challengeContext?.originalPath || path, `http://${requestContext.headers.host || 'localhost'}`);
+            const originalUrl = new URL(challengeContext?.originalPath || requestContext.path, `http://${requestContext.headers.host || 'localhost'}`);
             // 2. On crée un nouvel objet de paramètres à partir de la requête entrante (qui contient les solutions ET les params originaux).
             const finalSearchParams = new URLSearchParams(requestContext.query);
 
@@ -1851,6 +1830,10 @@ export class FingerprintEngine {
             finalSearchParams.delete('pow_solution_cpu');
             finalSearchParams.delete('pow_solution_mem');
             finalSearchParams.delete('pow_fp'); // Ne pas oublier de nettoyer le fingerprint
+            // NOUVEAU: Nettoyer aussi les paramètres des challenges d'optimisation et de travail utile
+            finalSearchParams.delete('pow_solution_population');
+            finalSearchParams.delete('pow_solution_work_result');
+            finalSearchParams.delete('pow_problem_id');
 
             // 4. On reconstruit le chemin final.
             const finalQueryString = finalSearchParams.toString();
@@ -1873,6 +1856,13 @@ export class FingerprintEngine {
             this._log('Challenge solution invalid', { pow_nonce });
             suspicionVector.honeypotScore = 100; // Invalid solution is a strong bot signal.
             finalScore = this.calculateFinalScore(suspicionVector);
+            // --- FIX: After invalidating a solution, immediately check if the new score triggers a block ---
+            const newBlockThreshold = thresholds.block ?? 95;
+            if (finalScore >= newBlockThreshold) {
+                this._log('Request blocked after invalid challenge solution', { finalScore, newBlockThreshold });
+                return { action: 'block', status: 404, body: 'Forbidden', score: finalScore, vector: suspicionVector };
+            }
+            // If not blocked, the request will proceed to be re-challenged.
         }
     } else if (pow_nonce && pow_type === 'optimization_task' && pow_solution_population) {
         this._log('Optimization task solution submitted', { pow_nonce });
@@ -1935,7 +1925,7 @@ export class FingerprintEngine {
     if (isBlocked) {
       this._log('Request blocked - score exceeded block threshold', { finalScore, blockThreshold });
       if (onDeviceCompromised) {
-        onDeviceCompromised({ deviceId: cookies?.device_id, clientIp, reason: 'Score exceeded block threshold', score: finalScore, vector: suspicionVector });
+        onDeviceCompromised({ deviceId: deviceId, clientIp, reason: 'Score exceeded block threshold', score: finalScore, vector: suspicionVector });
       }
       return { action: 'block', status: 404, body: 'Forbidden', score: finalScore, vector: suspicionVector };
     }
@@ -1947,7 +1937,7 @@ export class FingerprintEngine {
         this._log('Honeypot trap URL triggered - condemning device', { path, deviceId });
         deviceData.condemned = true; // This device is a bot. Condemn it.
         if (onDeviceCompromised) {
-            onDeviceCompromised({ deviceId: cookies?.device_id, clientIp, reason: 'Triggered signed honeypot trap URL', score: 100, vector: { honeypotScore: 100 } });
+            onDeviceCompromised({ deviceId: deviceId, clientIp, reason: 'Triggered signed honeypot trap URL', score: 100, vector: { honeypotScore: 100 } });
         }
         if (logger) {
             logger({ type: 'trap_triggered', deviceId: cookies?.device_id, score: 100, path: path, timestamp: Date.now() });
@@ -2002,8 +1992,8 @@ export class FingerprintEngine {
             const trapUrls = Array.from({ length: 3 }, () => generateTrapUrl(nonce));
             const trapLinksHtml = trapUrls.map(url => `<a href="${url}" tabindex="-1">config</a>`).join(' ');
 
-
-            const cpuChallengeDetails = generateCpuTargetChallenge(clientIp, nonce, suspicionFactor, path);
+            // On passe la configuration pour que la difficulté soit calculée correctement.
+            const cpuChallengeDetails = generateCpuTargetChallenge(clientIp, nonce, suspicionFactor, path, this.securityConfig);
 
             // La difficulté mémoire démarre à 0 et augmente seulement après un certain seuil de suspicion.
             // Par exemple, elle ne commence à augmenter qu'à partir de 25% du chemin entre 'low' et 'high'.
@@ -2019,16 +2009,18 @@ export class FingerprintEngine {
                 memDifficulty,
                 cpuTarget: cpuChallengeDetails.target
             });
-            // (NOUVEAU) On stocke le fingerprint de la requête qui a déclenché le challenge.
-            const originalFingerprint = requestContext.headers['x-device-fingerprint'] || getCompositeDeviceHash(requestContext);
+            // (NOUVEAU) On stocke le fingerprint de la requête qui a déclenché le challenge. We call it via __internal to allow mocking.
+            const originalFingerprint = requestContext.headers['x-device-fingerprint'] || __internal.getCompositeDeviceHash(requestContext);
 
             // Store the entire challenge context with a short TTL (e.g., 5 minutes)
+            const baseBlock = createCpuChallengeBaseBlock(nonce, clientSecret, originalFingerprint);
             await store.set(`secret:${nonce}`, {
                 clientSecret,
                 cpuTarget: cpuChallengeDetails.target,
                 suspicionScore: finalScore, // *** FIX: Store the score that triggered the challenge ***
                 fingerprint: originalFingerprint, // *** NOUVEAU ***
                 memDifficulty: memDifficulty,
+                baseBlock: baseBlock, // *** NOUVEAU: Le bloc de base est stocké pour la vérification ***
                 originalPath: path, // *** FIX: Store the original path ***
             }, this.securityConfig.challengeTtl || 300); // NOUVEAU: TTL configurable (5min par défaut)
 
@@ -2060,13 +2052,14 @@ export class FingerprintEngine {
                         clientSecret: clientSecret, // The client needs this to solve the challenge
                         cpuTarget: cpuChallengeDetails.target,
                         memDifficulty: memDifficulty,
+                        baseBlock: [...baseBlock], // Envoyer le buffer comme un tableau d'octets
                     }
                 };
                 this._log('API challenge response generated', { challengePayload });
                 return { action: 'challenge', score: finalScore, vector: suspicionVector, status: 404, body: challengePayload };
             } else {
                 // For browsers, send the HTML page.
-                const trapContainer = `<div style="position:absolute;left:-9999px;top:-9999px;" aria-hidden="true">${trapLinksHtml}</div>`;                const page = generateCombinedPoWChallengePage(cpuChallengeDetails, memDifficulty, clientIp, clientSecret, this.securityConfig, trapContainer);
+                const trapContainer = `<div style="position:absolute;left:-9999px;top:-9999px;" aria-hidden="true">${trapLinksHtml}</div>`;                const page = generateCombinedPoWChallengePage(cpuChallengeDetails, memDifficulty, clientIp, clientSecret, this.securityConfig, trapContainer, originalFingerprint);
                 this._log('Browser challenge page generated', { 
                     pageLength: page.length, 
                     hasTrapContainer: true 

package/optimization.worker.js

@@ -0,0 +1,28 @@
+/**
+ * @file @/optimization.worker.js
+ * @description Web Worker générique pour exécuter les algorithmes d'optimisation de la bibliothèque `Optimization`.
+ * Ce script s'exécute sur un thread séparé pour ne pas bloquer l'interface utilisateur.
+ */
+
+import { parentPort, workerData } from 'worker_threads';
+import { Optimization } from './library.js'; // Assurez-vous que le chemin est correct
+
+if (parentPort) {
+    parentPort.on('message', async () => { // Le message est vide, on utilise workerData
+        const { solverName, solverArgs } = workerData;
+
+        // Gérer les solveurs imbriqués (ex: 'Operators.solvePortfolio')
+        const solverFunction = solverName.split('.').reduce((obj, prop) => obj && obj[prop], Optimization);
+
+        if (typeof solverFunction === 'function') {
+            try {
+                const result = await solverFunction(...solverArgs);
+                parentPort.postMessage(result);
+            } catch (error) {
+                parentPort.postMessage({ error: error.message, stack: error.stack });
+            }
+        } else {
+            parentPort.postMessage({ error: `Solver '${solverName}' not found or is not a function in Optimization library.` });
+        }
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anonympins/fingerprint",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "An HTTP(S) client mitigation and anti-bot protection library for Node.js/Express, based on digital fingerprinting and dynamic Proof-of-Work (PoW) challenges.",
   "main": "fingerprint.js",
   "type": "module",
@@ -15,6 +15,9 @@
     "fingerprint.client.js",
     "fingerprint.builder.js",
     "pow.solver.js",
+    "pow.worker.js",
+    "problem-manager.js",
+    "optimization.worker.js",
     "library.js",
     "redis-store.js",
     "mongodb-store.js",

package/pow.solver.js

@@ -10,26 +10,42 @@
 'use strict';
 
 /**
- * Résout un challenge CPU basé sur une cible (version inline pour compatibilité HTML).
- * @param {string} clientIp - L'adresse IP du client.
- * @param {string} nonce - Le nonce du challenge.
+ * Résout un challenge CPU basé sur une cible en utilisant un bloc de base binaire.
+ * @param {Uint8Array} baseBlock - Le bloc de données initial (nonce, secret, fp) fourni par le serveur.
  * @param {bigint} target - La cible à atteindre.
- * @param {string} clientSecret - Le secret client (optionnel).
  * @param {Function} progressCallback - Callback pour les mises à jour de progression.
  * @returns {Promise<number>} La solution (un nombre entier).
  */
-export async function solveCpuTargetInline(clientIp, nonce, target, clientSecret = null, progressCallback) {
-    // Le 'target' est déjà un BigInt lorsqu'il est appelé depuis la page de challenge.
-    // On s'assure juste qu'il est bien de ce type.
+export async function solveCpuTargetInline(baseBlock, target, progressCallback) {
+    // --- FIX: Add validation for the target to prevent BigInt conversion errors ---
+    if (typeof target !== 'bigint' && (typeof target !== 'string' || !/^[0-9a-fA-F]+$/.test(target))) {
+        throw new TypeError(`Invalid target type: expected a BigInt or a hex string, but got ${typeof target} with value ${target}`);
+    }
+
     const cpuTarget = typeof target === 'bigint' ? target : BigInt('0x' + target);
+    // --- END FIX ---
+    const encoder = new TextEncoder();
     let cpuSolution = 0;
-    const ipPart = clientIp || ''; // Use empty string if IP is null/undefined
-    while (true) { // When a clientSecret is used, the IP is omitted from the hash to make it independent of the network.
-        const msg = clientSecret ?
-            `${nonce}:${cpuSolution}:${clientSecret}` :
-            `${ipPart}:${nonce}:${cpuSolution}`;
-        const buf = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(msg));
+
+    while (true) {
+        const solutionBytes = encoder.encode(String(cpuSolution));
+        
+        // Concaténation binaire directe : c'est plus rapide et plus sûr.
+        const finalBlock = new Uint8Array(baseBlock.length + solutionBytes.length);
+        finalBlock.set(baseBlock);
+        finalBlock.set(solutionBytes, baseBlock.length);
+
+        if (cpuSolution === 0) {
+            const reconstructedMsg = new TextDecoder().decode(finalBlock);
+            console.log('[FP Solve Debug] Client will hash message:', reconstructedMsg);
+        }
+        const buf = await crypto.subtle.digest("SHA-256", finalBlock);
         const hashHex = Array.from(new Uint8Array(buf)).map(b => b.toString(16).padStart(2, '0')).join('');
+        // --- AJOUT DE LOGS POUR LE DÉBOGAGE CÔTÉ CLIENT ---
+        if (cpuSolution === 0) { // Log only the first attempt
+            console.log(`[FP Client Solve] Attempt 0 hash: "0x${hashHex}"`);
+        }
+        // --- FIN DES LOGS ---
         if (BigInt('0x' + hashHex) < cpuTarget) break;
         cpuSolution++;
         if (cpuSolution % 100000 === 0) {
@@ -328,27 +344,30 @@ export async function solveOptimizationTask(initialPopulation, generations) {
  * @param {object} challenge - L'objet challenge reçu du serveur.
  * @returns {Promise<object>} Un objet contenant la ou les solutions.
  */
-export async function solveChallenge(challenge) {
+export async function solveChallenge(challenge, fingerprint = '') { // The fingerprint is now passed from the client library
     const { type, nonce, clientSecret, cpuTarget, memDifficulty, cities, clientIp, targetMaxDistance, optimizationTask, usefulWorkTask } = challenge;
     const solutions = {};
 
     switch (type) {
         case 'cpu_target':
-            const baseMessageCpu = `:${nonce}`; // L'IP est gérée côté serveur
+            // Note: This case is not fully exercised by tests as it relies on Web Workers.
             if (!cpuTarget) {
                 throw new Error("Challenge data is missing 'cpuTarget' property.");
             }
             const target = cpuTarget; // Keep variable name for consistency below
-            solutions.cpu = await solveCpuTarget(baseMessageCpu, BigInt('0x' + target));
+            // Pour ce challenge simple, le baseBlock est juste le nonce.
+            const baseBlockBytes = new TextEncoder().encode(nonce + ":");
+            solutions.cpu = await solveCpuTargetInline(baseBlockBytes, target, null);
             break;
         case 'cpu_mem':
             // Pour les appels API, le client IP n'est pas connu, on ne le met pas dans le message
-            const baseMessageCombined = `${nonce}:${clientSecret}`;
+            const baseMessageCombined = `:${nonce}:${clientSecret}`;
             const memSeed = `:${nonce}:${clientSecret}`;
             const [cpuSol, memSol] = await Promise.all([
                 (async () => {
-                    if (!cpuTarget) throw new Error("Challenge data is missing 'cpuTarget' property.");
-                    return solveCpuTargetInline(null, nonce, cpuTarget, clientSecret);
+                    if (!cpuTarget) throw new Error("Challenge data is missing 'cpuTarget' property."); // Pass fingerprint to solver
+                    const baseBlock = new Uint8Array(challenge.baseBlock);
+                    return solveCpuTargetInline(baseBlock, cpuTarget, null);
                 })(),
                 solveMemory(memSeed, memDifficulty)
             ]);
@@ -357,11 +376,12 @@ export async function solveChallenge(challenge) {
             break;
         case 'cpu_mem_inline':
             // Version inline pour compatibilité HTML avec IP incluse
-            const memSeedInline = `${nonce}:${clientSecret}`;
+            const memSeedInline = `:${nonce}:${clientSecret}`;
             const [cpuSolInline, memSolInline] = await Promise.all([
                 (async () => {
                     if (!cpuTarget) throw new Error("Challenge data is missing 'cpuTarget' property.");
-                    return solveCpuTargetInline(clientIp, nonce, cpuTarget, clientSecret);
+                    const baseBlock = new Uint8Array(challenge.baseBlock);
+                    return solveCpuTargetInline(baseBlock, cpuTarget, null);
                 })(),
                 solveMemory(memSeedInline, memDifficulty)
             ]);

package/pow.worker.js

@@ -0,0 +1,27 @@
+/**
+ * @file @/pow.worker.js
+ * @description Web Worker dédié à la résolution du challenge CPU.
+ * Ce script s'exécute sur un thread séparé pour ne pas bloquer l'interface utilisateur.
+ */
+
+self.onmessage = async (event) => {
+    const { message, target } = event.data;
+    let solution = 0;
+    const encoder = new TextEncoder();
+
+    // La boucle de calcul intensive est isolée dans ce worker.
+    while (true) {
+        const currentMessage = `${message}:${solution}`;
+        const data = encoder.encode(currentMessage);
+        const hashBuffer = await crypto.subtle.digest('SHA-256', data);
+        const hashArray = Array.from(new Uint8Array(hashBuffer));
+        const hashHex = hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
+
+        if (BigInt('0x' + hashHex) < target) {
+            // Une fois la solution trouvée, on la renvoie au thread principal.
+            self.postMessage({ solution });
+            return;
+        }
+        solution++;
+    }
+};

package/problem-manager.js

@@ -0,0 +1,175 @@
+import { readFileSync, writeFileSync } from 'node:fs';
+import { Optimization } from './library.js';
+
+/**
+ * @namespace ProblemInitializers
+ * @description Fonctions pour générer dynamiquement les données d'un problème.
+ */
+const ProblemInitializers = {
+    /**
+     * Génère un ensemble de points aléatoires pour un problème de TSP.
+     * @param {object} params - Les paramètres de génération.
+     * @param {number} params.count - Le nombre de points à générer.
+     * @param {{x: number, y: number}} [params.bounds={x: 1000, y: 1000}] - Les limites spatiales.
+     * @returns {Array<{x: number, y: number}>}
+     */
+    'generate:randomPoints': (params) => {
+        const { count, bounds = { x: 1000, y: 1000 } } = params;
+        if (isNaN(count)) return [];
+        return Array.from({ length: count }, () => ({ x: Math.random() * bounds.x, y: Math.random() * bounds.y }));
+    },
+
+    /**
+     * Génère un ensemble d'actifs financiers aléatoires pour un problème de portefeuille.
+     * @param {object} params - Les paramètres de génération.
+     * @param {number} params.count - Le nombre d'actifs à générer.
+     * @returns {Array<{expectedReturn: number, volatility: number}>}
+     */
+    'generate:randomAssets': (params) => {
+        const { count } = params;
+        if (isNaN(count)) return [];
+        return Array.from({ length: count }, () => ({
+            expectedReturn: Math.random() * 0.2,
+            volatility: 0.1 + Math.random() * 0.3
+        }));
+    },
+
+    /**
+     * Crée une fonction qui génère des arguments pour chaque worker de `runMultipleParallel`.
+     * Permet de faire varier les paramètres (ex: solution initiale) pour chaque cycle.
+     * @param {object} params - Les paramètres de configuration.
+     * @param {Array<any>} params.baseArgs - Les arguments de base, communs à tous les workers.
+     * @param {object} params.variations - Décrit comment faire varier un argument.
+     * @returns {function(number): Array<any>} La fonction `workerDataGenerator`.
+     */
+    'generate:parallelArgs': (params) => {
+        const { baseArgs, variations } = params;
+        return (cycleIndex) => {
+            const cycleArgs = [...baseArgs];
+            // Pour l'instant, on gère la variation de la solution initiale pour le TSP
+            if (variations?.initialSolution === 'random') {
+                cycleArgs[0] = cycleArgs[0].sort(() => Math.random() - 0.5);
+            }
+            return cycleArgs;
+        };
+    }
+};
+
+class ProblemManager {
+    constructor(configPath) {
+        this.configPath = configPath;
+        this.problems = this.loadProblems();
+        this.currentProblemIndex = 0;
+    }
+
+    loadProblems() {
+        try {
+            const data = readFileSync(this.configPath, 'utf-8');
+            const problems = JSON.parse(data);
+            // Initialisation dynamique des problèmes
+            for (const problem of problems) { // eslint-disable-line no-unused-vars
+                for (const key in problem.payload) {
+                    const value = problem.payload[key];
+                    // On cherche une instruction d'initialisation (ex: { "$init": "generate:randomPoints", ... })
+                    if (typeof value === 'object' && value !== null && value.$init) {
+                        const initializer = ProblemInitializers[value.$init];
+                        if (initializer) {
+                            // On remplace l'objet d'instruction par les données générées.
+                            problem.payload[key] = initializer(value.params || {});
+                        }
+                    }
+                }
+            }
+            return problems;
+        } catch (error) {
+            console.error(`[ProblemManager] Erreur lors du chargement du fichier de problèmes: ${error.message}`);
+            return []; // Retourne un tableau vide en cas d'erreur pour éviter un crash
+        }
+    }
+
+    saveProblems() {
+        // Note: Dans un vrai scénario, utilisez une base de données pour éviter les race conditions.
+        try {
+            writeFileSync(this.configPath, JSON.stringify(this.problems, null, 2));
+        } catch (error) {
+            console.error(`[ProblemManager] Erreur lors de la sauvegarde du fichier de problèmes: ${error.message}`);
+        }
+    }
+
+    /**
+     * Sélectionne un problème et génère une unité de travail.
+     * @param {number} suspicionFactor - Le facteur de suspicion pour ajuster la difficulté.
+     * @returns {{problemId: string, task: object}|null}
+     */
+    dispatchWork(suspicionFactor) {
+        if (this.problems.length === 0) return null;
+
+        const problem = this.problems[this.currentProblemIndex];
+        this.currentProblemIndex = (this.currentProblemIndex + 1) % this.problems.length;
+
+        const task = { type: problem.workUnit.type };
+        const { scalingFactor } = problem.workUnit;
+
+        switch (problem.workUnit.type) {
+            case 'simulated_annealing_iterations':
+                // Assurer une difficulté minimale pour que le challenge soit significatif
+                const baseIterations = Math.max(15000, problem.workUnit.baseIterations || 0);
+                task.iterations = scalingFactor
+                    ? Math.floor(baseIterations * Math.pow(scalingFactor, suspicionFactor))
+                    : Math.floor(baseIterations * (0.5 + suspicionFactor));
+                task.payload = problem.payload;
+                task.initialSolution = problem.state.bestSolution;
+                break;
+
+            case 'genetic_algorithm_generations':
+                // Assurer une difficulté minimale pour que le challenge soit significatif
+                const baseGenerations = Math.max(50, problem.workUnit.baseGenerations || 0);
+                task.generations = scalingFactor
+                    ? Math.floor(baseGenerations * Math.pow(scalingFactor, suspicionFactor))
+                    : Math.floor(baseGenerations * (0.5 + suspicionFactor));
+                task.payload = problem.payload;
+                task.initialPopulation = problem.state.population;
+                break;
+
+            case 'run_multiple_parallel':
+                task.solverName = problem.workUnit.solverName;
+                task.numCycles = problem.workUnit.numCycles;
+                // Les arguments et le générateur sont dans le payload pour plus de flexibilité
+                task.baseSolverArgs = problem.payload.baseSolverArgs;
+                task.workerDataGenerator = problem.payload.workerDataGenerator;
+                task.logProgress = problem.payload.logProgress || false;
+                task.concurrency = problem.payload.concurrency;
+                break;
+        }
+
+        return { problemId: problem.id, task };
+    }
+
+    /**
+     * Intègre la solution d'un client dans l'état du problème.
+     * @param {string} problemId - L'ID du problème.
+     * @param {object} solutionData - La solution renvoyée par le client.
+     */
+    integrateSolution(problemId, solutionData) {
+        const problem = this.problems.find(p => p.id === problemId);
+        if (!problem) return;
+
+        switch (problem.workUnit.type) {
+            case 'simulated_annealing_iterations':
+                if (solutionData.energy < (parseFloat(problem.state.bestEnergy) || Infinity)) {
+                    problem.state.bestSolution = solutionData.solution;
+                    problem.state.bestEnergy = solutionData.energy;
+                    console.log(`[ProblemManager] Nouvelle meilleure solution pour ${problemId}: ${solutionData.energy.toFixed(2)}`);
+                }
+                break;
+            case 'genetic_algorithm_generations':
+                problem.state.population = solutionData.population;
+                console.log(`[ProblemManager] Population mise à jour pour ${problemId}.`);
+                break;
+        }
+        this.saveProblems();
+    }
+}
+
+export { ProblemManager }; // Export the class for testing
+export const problemManager = new ProblemManager('./problems.config.json');