@anonympins/fingerprint 0.2.0 → 0.2.2

package/fingerprint.js

@@ -27,111 +27,12 @@ const getPowSecret = () => {
  * @returns {string} The solver JavaScript code.
  */
 const getPowSolverCode = () => {
-  try {
-    const __filename = fileURLToPath(import.meta.url);
-    const __dirname = dirname(__filename);
-    const solverPath = join(__dirname, 'pow.solver.inline.js'); // Use the inline version
-    return readFileSync(solverPath, 'utf-8');
-  } catch (error) {
-    console.warn('Could not load pow.solver.js for inlining, using fallback inline code');
-    // Fallback inline code if file cannot be loaded
-    return `(function(global){
-        async function solveCpuTargetInline(clientIp, nonce, target, clientSecret, progressCallback){
-            const cpuTarget = typeof target === 'bigint' ? target : BigInt('0x' + target);
-            let cpuSolution = 0;
-            const ipPart = clientIp || '';
-            while(true){
-                // When a clientSecret is used, the IP is omitted from the hash to make it independent of the network.
-                const msg = clientSecret ? \`\${nonce}:\${cpuSolution}:\${clientSecret}\` : \`\${ipPart}:\${nonce}:\${cpuSolution}\`;
-                const buf = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(msg));
-                const hashHex = Array.from(new Uint8Array(buf)).map(b=>b.toString(16).padStart(2,'0')).join('');
-                if(BigInt('0x'+hashHex) < cpuTarget) break;
-                cpuSolution++;
-                if(cpuSolution % 100000 === 0) await new Promise(r=>setTimeout(r,0));
-            }
-            return cpuSolution;
-        }
-        async function solveMemory(seed, difficulty){
-            const size = difficulty * 1024 * 1024;
-            const buffer = new Uint32Array(size / 4);
-            let h = new TextEncoder().encode(seed).reduce((acc,v)=>acc+v,0);
-            for(let i=0;i<buffer.length;i++) buffer[i] = h = Math.imul(h^i,1597334677);
-            let solution = 0;
-            const iterations = size / 16;
-            let addr = buffer.length > 0 ? buffer[0] % buffer.length : 0;
-            for(let i=0;i<iterations;i++){
-                addr = buffer[addr] % buffer.length;
-                solution ^= addr;
-            }
-            return solution;
-        }
-        async function solveTsp(cities, targetMaxDistance){
-            function distance(c1,c2){return Math.sqrt(Math.pow(c1.x-c2.x,2)+Math.pow(c1.y-c2.y,2));}
-            function evaluatePathDistance(cities,path){
-                let total=0;
-                for(let i=0;i<path.length-1;i++) total+=distance(cities[path[i]],cities[path[i+1]]);
-                total+=distance(cities[path[path.length-1]],cities[path[0]]);
-                return total;
-            }
-            function solveTspNearestNeighbor(cities){
-                const n=cities.length;
-                if(n===0)return[];
-                let path=[0];
-                let visited=new Array(n).fill(false);
-                visited[0]=true;
-                for(let i=1;i<n;i++){
-                    let nearest=-1, minDist=Infinity;
-                    for(let j=0;j<n;j++){
-                        if(!visited[j]){
-                            const d=distance(cities[path[i-1]],cities[j]);
-                            if(d<minDist){minDist=d;nearest=j;}
-                        }
-                    }
-                    path.push(nearest);
-                    visited[nearest]=true;
-                }
-                return path;
-            }
-            await new Promise(r=>setTimeout(r,10));
-            const solutionPath=solveTspNearestNeighbor(cities);
-            const solutionDistance=evaluatePathDistance(cities,solutionPath);
-            return{path:solutionPath,distance:solutionDistance};
-        }
-        async function solveChallenge(challenge) {
-            const { type, nonce, clientSecret, cpuTarget, memDifficulty, cities, clientIp, targetMaxDistance } = challenge;
-            const solutions = {};
-
-            switch (type) {
-                case 'cpu_target':
-                    solutions.cpu = await solveCpuTargetInline(clientIp, nonce, cpuTarget, clientSecret);
-                    break;
-                case 'cpu_mem':
-                case 'cpu_mem_inline':
-                    const memSeed = nonce + ":" + clientSecret;
-                    const [cpuSol, memSol] = await Promise.all([
-                        solveCpuTargetInline(clientIp, nonce, cpuTarget, clientSecret),
-                        solveMemory(memSeed, memDifficulty)
-                    ]);
-                    solutions.cpu = cpuSol;
-                    solutions.mem = memSol;
-                    break;
-                case 'tsp':
-                    const tspResult = await solveTsp(cities, targetMaxDistance);
-                    solutions.tsp = tspResult.path;
-                    solutions.distance = tspResult.distance;
-                    break;
-                default:
-                    throw new Error(\`Unknown challenge type: \${type}\`);
-            }
-
-            return solutions;
-        }
-        global.solveCpuChallengeInline=solveCpuTargetInline;
-        global.solveMemoryChallenge=solveMemory;
-        global.solveTspChallenge=solveTsp;
-        global.solveChallenge=solveChallenge;
-    })(typeof window!=='undefined'?window:global);`;
-  }
+  // On supprime le try/catch. Si le fichier n'est pas trouvé, le processus plantera,
+  // ce qui est préférable à servir un code de secours potentiellement désynchronisé.
+  const __filename = fileURLToPath(import.meta.url);
+  const __dirname = dirname(__filename);
+  const solverPath = join(__dirname, 'pow.solver.inline.js'); // Utilise la version inline
+  return readFileSync(solverPath, 'utf-8');
 };
 
 /**
@@ -190,7 +91,7 @@ function getHeaderSignature(context) {
     for (let i = 0; i < context.rawHeaders.length; i += 2) {
         headerKeys.push(context.rawHeaders[i]);
     }
-    return cyrb53(headerKeys.join(','));
+    return cyrb53(headerKeys.sort().join(','));
 }
 
 /**
@@ -227,11 +128,6 @@ export function getCompositeDeviceHash(context) {
     const ua = context.headers["user-agent"];
     if (ua) {
         srv.add("ua", ua);
-        // Extraire des infos supplémentaires du UA
-        const uaParts = parseUserAgent(ua);
-        if (uaParts.browser) srv.add("browser", uaParts.browser);
-        if (uaParts.os) srv.add("os_version", uaParts.os);
-        if (uaParts.device) srv.add("device_type", uaParts.device);
     }
 
     // 2. SIGNAL FORT: JA3 TLS Fingerprint
@@ -266,9 +162,6 @@ export function getCompositeDeviceHash(context) {
         srv.add("upgrade", context.headers["upgrade-insecure-requests"]);
     }
 
-    // 10. SIGNAL FORT: Ordonnancement des headers
-    srv.add("h_ord", getHeaderSignature(context));
-
     // 11. SIGNAL AVANCÉ: Cookies (si disponible)
     if (context.cookies) {
         const cookieKeys = Object.keys(context.cookies).sort().join(',');
@@ -614,11 +507,11 @@ export const verifyPoWAndGenerateTicket = (
  * Verifies a memory PoW solution.
  * The server performs the same calculation to validate.
  */
-export const verifyMemoryPoW = (nonce, solution, difficulty = 16, clientSecret) => {
+export const verifyMemoryPoW = (nonce, solution, difficulty = 16, clientSecret = '') => {
   const size = difficulty * 1024 * 1024;
   const iterations = size / 16;
   const buffer = new Uint32Array(size / 4);
-  const seed = clientSecret ? `${nonce}:${clientSecret}` : nonce;
+  const seed = `:${nonce}:${clientSecret}`;
   let h = new TextEncoder().encode(seed).reduce((acc, v) => acc + v, 0);
 
   for (let i = 0; i < buffer.length; i++) {
@@ -929,113 +822,86 @@ function getCrossLayerInconsistency(context) {
 function getRequestPatternScore(context, deviceData, patternConfig = {}) {
     if (!deviceData) return { requestPatternScore: 0 };
 
-    // Default values for the pattern detection logic, which can be overridden by the auto-tuner.
+    // (NOUVEAU) Logique de détection de pattern simplifiée et unifiée.
     const {
-        velocityThreshold = 800, velocityWeight = 30,
-        burstThreshold = 1500, burstWeight = 50,
-        scrapeThreshold = 1000, scrapeWeight = 20, scrapeBurstWeight = 40,
-        historySize = 10,
-        decayFactor = 0.9,
-        inactivityReset = 30000, // 30 secondes
-        // Nouveaux paramètres pour l'analyse de distribution
-        benfordMinSamples = 15, benfordWeight = 50,
-        // Nouveau paramètre pour la détection de séquences
-        sequenceLength = 3, sequenceWeight = 60
+        historySize = 20,           // Nombre de requêtes à conserver pour l'analyse.
+        minSamples = 10,            // Nombre d'intervalles de temps à analyser avant de calculer.
+        regularityThreshold = 150,  // Écart-type (ms) en dessous duquel le comportement est "trop régulier".
+        benfordThreshold = 0.15,    // Seuil de déviation de Benford au-dessus duquel la distribution est "non naturelle".
+        patternWeight = 80,         // Pénalité FORTE et unique si un pattern est détecté.
+        decayFactor = 0.95,         // Décroissance du score dans le temps.
+        inactivityReset = 180000    // Réinitialisation du score après 3 minutes d'inactivité.
     } = patternConfig;
 
     const now = Date.now();
     const currentPath = context.path;
     // Make the function robust to handle both URLSearchParams and plain objects for query.
-    // Ensure query parameters are consistently handled, whether they come from a URLSearchParams object or a plain object.
-    const params = context.query instanceof URLSearchParams ? context.query : new URLSearchParams(context.query);
+    const params =
+      context.query instanceof URLSearchParams
+        ? new URLSearchParams(context.query.toString()) // Clone to avoid modifying the original
+        : new URLSearchParams(context.query || {});
     params.sort(); // Sort for deterministic order
     const currentQueryString = params.toString();
 
-    // Initialize request history if it doesn't exist
     if (!deviceData.requestHistory) deviceData.requestHistory = [];
-    // NOUVEAU: S'assurer que timingHistory est toujours initialisé.
-    // Cette vérification est séparée car deviceData peut exister avec requestHistory mais sans timingHistory.
     if (!deviceData.timingHistory) deviceData.timingHistory = [];
 
     const history = deviceData.requestHistory;
-    let score = 0;
-
-    // --- Analyze patterns based on the last few requests ---
-    if (history.length > 0) {
-        const lastRequest = history[history.length - 1];
-        const timeSinceLast = now - lastRequest.timestamp;
+    const lastRequest = history.length > 0 ? history[history.length - 1] : null;
+    const timeSinceLast = lastRequest ? now - lastRequest.timestamp : Infinity;
 
-        // Stocker le délai pour l'analyse de distribution
+    // Mise à jour de l'historique
+    history.push({
+        timestamp: now,
+        path: currentPath,
+        queryString: currentQueryString,
+    });
+    if (lastRequest) {
         deviceData.timingHistory.push(timeSinceLast);
+    }
 
-        // 1. Velocity Check: Penalize requests that are too fast to be human.
-        if (timeSinceLast < velocityThreshold) { // 150 < 200 -> true
-            score += velocityWeight; // score = 30
-        }
-
-        // 2. Burst Check: Add additional penalty for identical requests in a very short time frame.
-        if (currentPath === lastRequest.path && currentQueryString === lastRequest.queryString && timeSinceLast < burstThreshold) { // 150 < 500 -> true
-            score += burstWeight; // score = 30 + 50 = 80
-        }
+    let instantScore = 0;
+    const timings = deviceData.timingHistory;
 
-        // 3. Sequential Scraping Check: Add additional penalty for same path with different query params (potential scraping).
-        // This is a simplified check, now independent of the burst check.
-        if (currentPath === lastRequest.path && currentQueryString !== lastRequest.queryString && timeSinceLast < scrapeThreshold) {
-            const previousRequest = history.length > 2 ? history[history.length - 2] : null;
-            if (previousRequest && previousRequest.path === currentPath) {
-                score += scrapeBurstWeight; // This is at least the 3rd request in a sequence to the same path.
-            } else {
-                score += scrapeWeight; // First sign of a potential scraping pattern
-            }
-        }
+    // Analyse statistique unifiée si nous avons assez de données
+    if (timings.length >= minSamples) {
+        const timings = deviceData.timingHistory;
+        const mean = timings.reduce((a, b) => a + b, 0) / timings.length;
+        const variance = timings.reduce((a, b) => a + Math.pow(b - mean, 2), 0) / timings.length;
+        const stdDev = Math.sqrt(variance);
+        const benfordDeviation = Optimization.Operators.benfordTest(timings);
 
-        // 4. (NOUVEAU) Détection de séquences répétitives (ex: A -> B -> C -> A -> B -> C)
-        if (history.length >= sequenceLength * 2) {
-            const lastSequence = history.slice(-sequenceLength);
-            const previousSequence = history.slice(-sequenceLength * 2, -sequenceLength);
-            
-            const isRepeating = lastSequence.every((req, i) => 
-                req.path === previousSequence[i].path && req.queryString === previousSequence[i].queryString
-            );
-            if (isRepeating) score += sequenceWeight;
+        // Détection de régularité (bots de type "cron")
+        if (stdDev < regularityThreshold) {
+            instantScore = patternWeight;
         }
-
-        // 5. (NOUVEAU) Analyse de la distribution des délais avec la loi de Benford
-        if (deviceData.timingHistory.length >= benfordMinSamples) {
-            // On concatène tous les délais en une seule chaîne de chiffres.
-            const benfordDeviation = Optimization.Operators.benfordTest(deviceData.timingHistory);
-
-            // Une déviation > 0.15 est suspecte. On peut pondérer la pénalité.
-            // Une déviation de 0.3 (très suspecte) donnerait un score de 100 (0.3 / 0.3 * 100).
-            score += Math.min(100, (benfordDeviation / 0.3) * benfordWeight);
+        // Détection de distribution non-naturelle (bots "faussement aléatoires")
+        else if (benfordDeviation > benfordThreshold) {
+            instantScore = patternWeight;
         }
     }
 
-    // --- Update history ---
-    history.push({
-        timestamp: now,
-        path: currentPath,
-        queryString: currentQueryString,
-    });
-
-    // Keep history to a reasonable size (e.g., last 10 requests)
+    // Garder l'historique à une taille raisonnable
     if (history.length > historySize) {
         history.shift();
     }
-    if (deviceData.timingHistory.length > benfordMinSamples * 2) { // Garder un historique plus long pour Benford
+    if (deviceData.timingHistory.length > historySize) {
         deviceData.timingHistory.shift();
     }
 
-    // Decay the score over time if behavior becomes normal again.
-    // We can store the score in deviceData and decay it.
-    deviceData.lastPatternScore = Math.min(100, (deviceData.lastPatternScore || 0) * decayFactor + score); // Decay old score and add new, plafonné à 100
+    // Logique de décroissance et de score final
+    let newPatternScore = deviceData.lastPatternScore || 0;
 
-    // If there hasn't been a request in a while, reset the pattern score.
-    if (history.length > 1 && (now - history[history.length - 2].timestamp > inactivityReset)) { // X ms inactivity
-        deviceData.lastPatternScore = 0;
+    if (timeSinceLast > inactivityReset) {
+        newPatternScore = 0; // Réinitialisation complète après une longue inactivité
+    } else {
+        newPatternScore *= decayFactor;
     }
+    newPatternScore = Math.max(0, newPatternScore);
 
-    return { requestPatternScore: deviceData.lastPatternScore };
+    deviceData.lastPatternScore = newPatternScore + instantScore;
+
+    return { requestPatternScore: Math.min(100, deviceData.lastPatternScore) };
 }
 
 const trapUrlTemplates = [
@@ -1365,20 +1231,44 @@ const BASE_TARGET = MAX_DIFFICULTY_TARGET >> 16n;
  * @param {number} suspicionFactor - A number from 0 to 1.
  * @returns {BigInt} The target number.
  */
-function calculateTarget(suspicionFactor) {
+function calculateTarget(suspicionFactor, securityConfig = {}) {
   // Difficulty range adjusted to be realistic.
   // MIN_DIFFICULTY: Fast enough not to bother a slightly suspicious user.
   // MAX_DIFFICULTY: Slow enough to heavily penalize a bot, but feasible for a patient human (5-30s).
-  const MIN_DIFFICULTY_BITS = 18; // Default value, should be configurable
-  const MAX_DIFFICULTY_BITS = 26; // Default value, should be configurable
+  // NOUVEAU: La difficulté est maintenant configurable.
+  const { cpu: cpuConfig = {} } = securityConfig;
+  const MIN_DIFFICULTY_BITS = cpuConfig.minDifficultyBits ?? 8;
+  const MAX_DIFFICULTY_BITS = cpuConfig.maxDifficultyBits ?? 16;
 
   // Use linear interpolation between min and max difficulty.
   const totalDifficultyBits =
     MIN_DIFFICULTY_BITS +
     suspicionFactor * (MAX_DIFFICULTY_BITS - MIN_DIFFICULTY_BITS);
+  
+  if (totalDifficultyBits <= 0) return 2n ** 256n - 1n; // Si la difficulté est nulle ou négative, la cible est maximale (aucun challenge).
+
+  // The correct way to calculate the target is to define the number of leading zero bits required.
+  // A target for N bits of difficulty is 2^(256-N).
+  // We can calculate this with a left-shift on 1.
+  const shift = 256n - BigInt(Math.floor(totalDifficultyBits));
+  return 1n << shift;
+}
 
-  // The target is max / 2^bits
-  return MAX_DIFFICULTY_TARGET >> BigInt(Math.floor(totalDifficultyBits));
+/**
+ * @private
+ * Crée le bloc de base pour le challenge CPU.
+ * Ce buffer contient toutes les données sauf la solution.
+ * @param {string} nonce
+ * @param {string} clientSecret
+ * @param {string} fingerprint
+ * @returns {Buffer}
+ */
+function createCpuChallengeBaseBlock(nonce, clientSecret, fingerprint) {
+    const sortedFingerprint = (fingerprint || '').split('|').filter(p => p).sort().join('|');
+    // On concatène les chaînes, puis on les convertit en buffer une seule fois.
+    // Cela garantit que le client et le serveur travaillent sur la même base binaire.
+    const messageBase = `${nonce}:${clientSecret}:${sortedFingerprint}:`; // Le ':' final est le séparateur pour la solution.
+    return Buffer.from(messageBase, 'utf8');
 }
 
 /**
@@ -1389,12 +1279,15 @@ export function generateCpuTargetChallenge(
   nonce,
   suspicionFactor,
   originalUrl,
+  securityConfig,
 ) {
-  const target = calculateTarget(suspicionFactor);
+  const target = calculateTarget(suspicionFactor, securityConfig);
+  // Le baseBlock est créé ici et sera stocké dans le contexte du challenge.
+  const baseBlock = createCpuChallengeBaseBlock(nonce, null, ''); // Pour le challenge simple, le secret et le fingerprint sont vides.
   return {
     type: "cpu_target",
     nonce: nonce,
-    target: target.toString(16), // Send the target in hexadecimal
+    target: target.toString(16),
     path: originalUrl,
   };
 }
@@ -1419,10 +1312,11 @@ function generateCpuTargetChallengePage(challengeDetails, clientIp) {
           async function solve() {
             const clientIp = ${JSON.stringify(clientIp)};
             const nonce = ${JSON.stringify(nonce)};
-            const cpuTarget = BigInt("0x${target}");
-            const solution = await window.solveCpuChallengeInline(clientIp, nonce, cpuTarget, null, (progress) => {
-                // Optional progress callback
-            });
+            const cpuTarget = BigInt("0x" + "${target}");
+            // La nouvelle version de solveCpuChallengeInline n'a plus besoin de l'IP ou du secret,
+            // car tout est dans le baseBlock. Pour la compatibilité de ce challenge simple, on passe null.
+            const baseBlockBytes = new TextEncoder().encode(nonce + ":");
+            const solution = await window.solveCpuChallengeInline(baseBlockBytes, cpuTarget, (progress) => {});
             window.location.href = ${JSON.stringify(path)} + "?pow_type=cpu_target&pow_nonce=" + nonce + "&pow_solution=" + solution;
           }
           solve();
@@ -1437,9 +1331,14 @@ function generateCpuTargetChallengePage(challengeDetails, clientIp) {
  * @param {string} clientIp - The client's IP address.
  * @returns {string} HTML content.
  */
-function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty, clientIp, clientSecret, securityConfig, trapContainerHtml) {
+function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty, clientIp, clientSecret, securityConfig, trapContainerHtml, originalFingerprint) {
     const { nonce, target, path } = cpuChallengeDetails;
     const solverCode = getPowSolverCode();
+    // On prépare le baseBlock pour le client. Il sera envoyé sous forme de tableau d'octets.
+    // Le fingerprint est maintenant passé directement en paramètre.
+    const fingerprint = originalFingerprint;
+    const baseBlock = createCpuChallengeBaseBlock(nonce, clientSecret, fingerprint);
+    const baseBlockBytes = `[${baseBlock.toString('utf8').split('').map(c => c.charCodeAt(0)).join(',')}]`;
 
     const challengeScript = `
       async function solve() {
@@ -1447,22 +1346,18 @@ function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty,
         const path = ${JSON.stringify(path)};
         const clientSecret = ${JSON.stringify(clientSecret)};
         const clientIp = ${JSON.stringify(clientIp)};
-        const cpuTarget = BigInt("0x${target}");
+        const cpuTarget = BigInt("0x" + "${target}");
         const memDifficulty = ${memoryDifficulty};
-        // The client-side fingerprint library must be available to generate the fingerprint
-        // of the machine solving the challenge. This assumes a client library is loaded.
-        // We need a function to get the client fingerprint. Let's assume it's available on window.
-        const getClientFingerprint = () => (window.ClientLibrary && typeof window.ClientLibrary.getDeviceFingerprint === 'function') ? window.ClientLibrary.getDeviceFingerprint() : '';
-        const fingerprint = getClientFingerprint();
+        // Le client reçoit directement le 'baseBlock' sous forme de tableau d'octets.
+        // Il n'a plus besoin de construire le message lui-même.
+        const baseBlock = new Uint8Array(${baseBlockBytes});
 
         // --- CPU Challenge ---
-        document.getElementById('loader').innerText = '⚙️ Performing CPU security calculation...';
-        const cpuSolution = await window.solveCpuChallengeInline(clientIp, nonce, cpuTarget, clientSecret, fingerprint, (progress) => {
-            // Optional progress callback
-        });
+        document.getElementById('loader').innerText = '⚙️ Performing CPU security calculation...';        const cpuSolution = await window.solveCpuChallengeInline(baseBlock, cpuTarget, (progress) => {});
+
         // --- Memory Challenge ---
         document.getElementById('loader').innerText = '⚙️ Performing memory allocation and calculation... (' + memDifficulty + ' MB)';
-        await new Promise(r => setTimeout(r, 10)); // Yield to update UI
+        await new Promise(r => setTimeout(r, 10)); // Yield to update UI        
         let memSolution = 0;
         try {
             const memSeed = nonce + ":" + clientSecret;
@@ -1471,7 +1366,10 @@ function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty,
             document.getElementById('loader').innerText = "Error: Insufficient memory. Please refresh.";
             return;
         }
-        window.location.href = path + "?pow_type=cpu_mem&pow_nonce=" + ${JSON.stringify(nonce)} + "&pow_solution_cpu=" + cpuSolution + "&pow_solution_mem=" + memSolution + "&pow_fp=" + encodeURIComponent(fingerprint);
+
+        // Redirect with both solutions and the fingerprint used to solve.
+        const finalUrl = path + "?pow_type=cpu_mem&pow_nonce=" + ${JSON.stringify(nonce)} + "&pow_solution_cpu=" + cpuSolution + "&pow_solution_mem=" + memSolution;
+        window.location.href = finalUrl;
       }
       solve();
     `;
@@ -1502,23 +1400,56 @@ function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty,
  */
 export function verifyCpuTargetPoWAndGenerateTicket(
   clientIp, // This parameter is crucial and must be the actual client IP
-  ticketTtl, // NOUVEAU: Durée de validité du ticket (TTL en ms) configurable
+  ticketTtl,
   nonce,
   solution,
-  clientSecret, // Le secret est maintenant requis
-  target, // La cible est maintenant passée directement en hexadécimal,
-  fingerprint, // Le fingerprint du SOLVER, soumis par le client
+  challengeContext = {}, // Le contexte complet du challenge est maintenant passé
 ) {
-  const message = clientSecret
-    ? `${nonce}:${solution}:${clientSecret}:${fingerprint}`
-    : `${clientIp}:${nonce}:${solution}`; // L'IP est utilisée uniquement pour les challenges sans secret (plus anciens/simples)
+  const { cpuTarget, baseBlock } = challengeContext;
+  if (!cpuTarget || !baseBlock) {
+      console.error('[FP Server Verify] Invalid challenge context. Missing cpuTarget or baseBlock.');
+      return null;
+  }
+
+  // Le baseBlock est déjà un Buffer ou un tableau d'octets.
+  // On s'assure que c'est un Buffer pour la concaténation.
+  const baseBlockBuffer = Buffer.isBuffer(baseBlock) ? baseBlock : Buffer.from(baseBlock);
+  const solutionBuffer = Buffer.from(String(solution), 'utf8');
+
+  // Concaténation binaire directe. C'est la garantie de cohérence.
+  const finalBlock = Buffer.concat([baseBlockBuffer, solutionBuffer]);
+
   const hash = crypto
     .createHash("sha256")
-    .update(message)
+    .update(finalBlock)
     .digest("hex");
   const hashAsInt = BigInt("0x" + hash);
+  const targetAsInt = BigInt("0x" + cpuTarget);
+
+  // --- NOUVEAUX LOGS POUR LE DÉBOGAGE ---
+  console.log('[FP Server Verify] Intermediate values:', {
+    hashCalculated: `0x${hash}`,
+    hashAsInt: hashAsInt.toString(), // Log as string to see full value
+    target: `0x${cpuTarget}`,
+    targetAsInt: targetAsInt.toString(), // Log as string to see full value
+  });
+  // --- FIN DES NOUVEAUX LOGS ---
 
-  if (hashAsInt < BigInt("0x" + target)) {
+  const isValid = hashAsInt < targetAsInt;
+
+  // --- AJOUT DE LOGS POUR LE DÉBOGAGE ---
+  if (!isValid) {
+    console.log('[FP Server Verify] CPU PoW verification FAILED. Details:', {
+      hashCalculated: `0x${hash}`,
+      target: `0x${cpuTarget}`,
+
+    });
+  }
+  // --- FIN DES LOGS ---
+
+  if (isValid) {
+      console.log('[FP Server Verify] CPU PoW verification PASSED. Details:', {
+      });
     // The comparison is direct with native BigInts
     // The proof is valid, generate the ticket
       const expiry = Date.now() + (ticketTtl || 3600000); // Calcule l'expiration à partir du TTL
@@ -1593,6 +1524,46 @@ export class FingerprintEngine {
     }
     return blockList;
   }
+
+  /**
+   * Checks if the client's IP resolves to any of the hostnames in the hostname allowlist.
+   * The result is cached to avoid repeated DNS lookups.
+   * @private
+   * @param {string} clientIp - The IP address of the client.
+   * @returns {Promise<boolean>} True if the IP is in the hostname allowlist.
+   */
+  async _isIpInHostnameAllowlist(clientIp) {
+    const { whitelist = [] } = this.securityConfig;
+    const hostnameRule = whitelist.find(rule => rule.type === 'hostname_allowlist');
+
+    if (!hostnameRule || !hostnameRule.entries || hostnameRule.entries.length === 0) {
+      return false;
+    }
+
+    const cacheKey = `ip-hostname-allowlist:${clientIp}`;
+    const cachedStatus = await store.get(cacheKey);
+
+    if (cachedStatus === 'verified') return true;
+    if (cachedStatus === 'failed') return false;
+
+    try {
+      // Reverse DNS lookup to get hostnames for the IP
+      const hostnames = await dns.reverse(clientIp);
+
+      // Check if any of the resolved hostnames is in our allowlist
+      const isAllowed = hostnames.some(hostname => hostnameRule.entries.includes(hostname));
+
+      if (isAllowed) {
+        await store.set(cacheKey, 'verified', 86400); // Cache success for 24h
+        return true;
+      }
+    } catch (error) {
+      // DNS errors (like no rDNS record) are treated as a failure.
+    }
+
+    await store.set(cacheKey, 'failed', 86400); // Cache failure for 24h
+    return false;
+  }
   _isIpInAllowlist(clientIp) {
     return this._allowlist.check(clientIp);
   }
@@ -1678,6 +1649,12 @@ export class FingerprintEngine {
       return { action: 'next', score: 0, vector: { whitelisted: 100, type: 'allowlist' } };
     }
 
+    // 2. Check hostname-based allowlist.
+    if (await this._isIpInHostnameAllowlist(clientIp)) {
+      this._log('IP resolves to a whitelisted hostname - allowing request', { clientIp });
+      return { action: 'next', score: 0, vector: { whitelisted: 100, type: 'hostname_allowlist' } };
+    }
+
     const { pow_nonce } = query;
 
     // Honeypot: Direct probing of challenge endpoints is highly suspicious.
@@ -1706,7 +1683,7 @@ export class FingerprintEngine {
     if (deviceData?.condemned) {
         this._log('Device condemned - blocking request', { deviceId });
         if (onDeviceCompromised) {
-            onDeviceCompromised({ deviceId: cookies?.device_id, clientIp, reason: 'Previously condemned', score: 100, vector: { honeypotScore: 100 } });
+            onDeviceCompromised({ deviceId: deviceId, clientIp, reason: 'Previously condemned', score: 100, vector: { honeypotScore: 100 } });
         }
         return { action: 'block', status: 404, body: 'Forbidden', score: 100, vector: { honeypotScore: 100 } };
     }
@@ -1768,7 +1745,7 @@ export class FingerprintEngine {
     // Si une solution de challenge est soumise, on la traite en priorité absolue,
     // avant même de recalculer le score de suspicion.
     const { pow_type, pow_solution, pow_solution_cpu, pow_solution_mem, pow_fp, pow_solution_population, pow_solution_work_result, pow_problem_id } = query;
-    if (pow_nonce && (pow_solution || (pow_solution_cpu && pow_solution_mem))) {
+    if (pow_nonce && (pow_solution || pow_solution_cpu)) { // Vérifie pow_solution pour la compatibilité ascendante
         this._log('Challenge solution submitted', { pow_type, pow_nonce });
 
         // On doit calculer le score de suspicion *avant* de valider le ticket,
@@ -1795,14 +1772,33 @@ export class FingerprintEngine {
         if (challengeContext) {
             // *** NOUVELLE VÉRIFICATION CRUCIALE ***
             // On compare le fingerprint soumis par le solver (`pow_fp`) avec celui stocké
-            // lors de l'émission du challenge (`challengeContext.fingerprint`).
-            const solverFingerprint = pow_fp;
-            const originalFingerprint = challengeContext.fingerprint;
+            // lors de l'émission du challenge.
+            // --- FIX: Use submitted fingerprint, but fallback to current request's fingerprint ---
+            // This handles API clients that might not use the full client-side library but still solve the challenge.
+            const solverFingerprint = pow_fp || getCompositeDeviceHash(requestContext);
+    const originalFingerprint = challengeContext.fingerprint; // This is the fingerprint of the request that *triggered* the challenge
+
+            let similarity;
+            const similarityThreshold = this.securityConfig.similarityThreshold ?? 0.95;
+
+            // If fingerprints are simple strings (like test placeholders 'fp-probation')
+            // and don't contain the typical structure, fall back to a strict equality check.
+            if (!originalFingerprint?.includes(':') || !solverFingerprint?.includes(':')) {
+                similarity = (originalFingerprint === solverFingerprint) ? 1.0 : 0.0;
+            } else {
+                // Use the weighted comparison for structured fingerprints.
+        // We compare the fingerprint of the request that triggered the challenge
+        // with the fingerprint of the request that is submitting the solution.
+        // They should be very similar.
+        similarity = FingerprintBuilder.compare(originalFingerprint, getCompositeDeviceHash(requestContext));
+            }
 
-            if (solverFingerprint !== originalFingerprint) {
+            if (similarity < similarityThreshold) {
                 this._log('Fingerprint mismatch - challenge solved on a different machine!', {
                     original: originalFingerprint,
                     solver: solverFingerprint,
+                    similarity: similarity.toFixed(4),
+                    threshold: similarityThreshold
                 });
                 isValid = false;
             } else {
@@ -1810,13 +1806,13 @@ export class FingerprintEngine {
                 finalTtl = isProbationary ? probationaryTtl : optimalTtl;
                 this._log('Challenge context found, verifying solution', { optimalTtl, finalTtl });
 
-                if (pow_type === "cpu_target" && pow_solution) {
-                    ticket = verifyCpuTargetPoWAndGenerateTicket(clientIp, finalTtl, pow_nonce, pow_solution, challengeContext.clientSecret, challengeContext.cpuTarget, solverFingerprint);
+                if ((pow_type === "cpu_target" || !pow_type) && (pow_solution_cpu || pow_solution)) { // !pow_type pour compatibilité
+                    const cpuSolution = pow_solution_cpu || pow_solution;
+            ticket = verifyCpuTargetPoWAndGenerateTicket(clientIp, finalTtl, pow_nonce, cpuSolution, challengeContext);
                     isValid = ticket !== null;
                     this._log('CPU target challenge verification', { isValid });
-                } else if (pow_type === "cpu_mem" && pow_solution_cpu && pow_solution_mem) {
-                    const cpuTicket = verifyCpuTargetPoWAndGenerateTicket(clientIp, finalTtl, pow_nonce, pow_solution_cpu, challengeContext.clientSecret, challengeContext.cpuTarget, solverFingerprint);
-                    const isMemValid = verifyMemoryPoW(pow_nonce, pow_solution_mem, challengeContext.memDifficulty, challengeContext.clientSecret);
+                } else if (pow_type === "cpu_mem" && pow_solution_cpu && pow_solution_mem) {                    const cpuTicket = verifyCpuTargetPoWAndGenerateTicket(clientIp, finalTtl, pow_nonce, pow_solution_cpu, challengeContext);
+            const isMemValid = verifyMemoryPoW(pow_nonce, pow_solution_mem, challengeContext.memDifficulty, challengeContext.clientSecret); // Memory PoW is independent of fingerprint
                     isValid = cpuTicket !== null && isMemValid;
                     if (isValid) ticket = cpuTicket; // Le ticket est le même, on le réutilise
                     this._log('Combined CPU+Memory challenge verification', {
@@ -1835,12 +1831,12 @@ export class FingerprintEngine {
             this._log('Challenge solution valid - issuing ticket', { ticketMaxAge: finalTtl, isProbationary });
 
             if (logger) {
-                logger({ type: 'challenge_solved', deviceId: cookies?.device_id, score: preliminaryScore, challengeType: pow_type, timestamp: Date.now() });
+                logger({ type: 'challenge_solved', deviceId: cookies?.device_id, score: preliminaryScore, challengeType: pow_type, timestamp: Date.now(), vector: preliminaryVector });
             }
 
             // NOUVELLE LOGIQUE DE REDIRECTION (plus robuste)
             // 1. On part du chemin original stocké, qui peut contenir des query params.
-            const originalUrl = new URL(challengeContext?.originalPath || path, `http://${requestContext.headers.host || 'localhost'}`);
+            const originalUrl = new URL(challengeContext?.originalPath || requestContext.path, `http://${requestContext.headers.host || 'localhost'}`);
             // 2. On crée un nouvel objet de paramètres à partir de la requête entrante (qui contient les solutions ET les params originaux).
             const finalSearchParams = new URLSearchParams(requestContext.query);
 
@@ -1851,6 +1847,10 @@ export class FingerprintEngine {
             finalSearchParams.delete('pow_solution_cpu');
             finalSearchParams.delete('pow_solution_mem');
             finalSearchParams.delete('pow_fp'); // Ne pas oublier de nettoyer le fingerprint
+            // NOUVEAU: Nettoyer aussi les paramètres des challenges d'optimisation et de travail utile
+            finalSearchParams.delete('pow_solution_population');
+            finalSearchParams.delete('pow_solution_work_result');
+            finalSearchParams.delete('pow_problem_id');
 
             // 4. On reconstruit le chemin final.
             const finalQueryString = finalSearchParams.toString();
@@ -1873,6 +1873,13 @@ export class FingerprintEngine {
             this._log('Challenge solution invalid', { pow_nonce });
             suspicionVector.honeypotScore = 100; // Invalid solution is a strong bot signal.
             finalScore = this.calculateFinalScore(suspicionVector);
+            // --- FIX: After invalidating a solution, immediately check if the new score triggers a block ---
+            const newBlockThreshold = thresholds.block ?? 95;
+            if (finalScore >= newBlockThreshold) {
+                this._log('Request blocked after invalid challenge solution', { finalScore, newBlockThreshold });
+                return { action: 'block', status: 404, body: 'Forbidden', score: finalScore, vector: suspicionVector };
+            }
+            // If not blocked, the request will proceed to be re-challenged.
         }
     } else if (pow_nonce && pow_type === 'optimization_task' && pow_solution_population) {
         this._log('Optimization task solution submitted', { pow_nonce });
@@ -1935,7 +1942,10 @@ export class FingerprintEngine {
     if (isBlocked) {
       this._log('Request blocked - score exceeded block threshold', { finalScore, blockThreshold });
       if (onDeviceCompromised) {
-        onDeviceCompromised({ deviceId: cookies?.device_id, clientIp, reason: 'Score exceeded block threshold', score: finalScore, vector: suspicionVector });
+        onDeviceCompromised({ deviceId: deviceId, clientIp, reason: 'Score exceeded block threshold', score: finalScore, vector: suspicionVector });
+      }
+      if (logger) {
+        logger({ type: 'request_blocked', deviceId: deviceId, score: finalScore, vector: suspicionVector, timestamp: Date.now() });
       }
       return { action: 'block', status: 404, body: 'Forbidden', score: finalScore, vector: suspicionVector };
     }
@@ -1947,16 +1957,27 @@ export class FingerprintEngine {
         this._log('Honeypot trap URL triggered - condemning device', { path, deviceId });
         deviceData.condemned = true; // This device is a bot. Condemn it.
         if (onDeviceCompromised) {
-            onDeviceCompromised({ deviceId: cookies?.device_id, clientIp, reason: 'Triggered signed honeypot trap URL', score: 100, vector: { honeypotScore: 100 } });
+            onDeviceCompromised({ deviceId: deviceId, clientIp, reason: 'Triggered signed honeypot trap URL', score: 100, vector: { honeypotScore: 100 } });
         }
         if (logger) {
-            logger({ type: 'trap_triggered', deviceId: cookies?.device_id, score: 100, path: path, timestamp: Date.now() });
+            logger({ type: 'trap_triggered', deviceId: cookies?.device_id, score: 100, path: path, timestamp: Date.now(), vector: { honeypotScore: 100 } });
         }
         await store.set(`device:${cookies.device_id}`, deviceData); // No TTL for condemned status
         return { action: 'block', status: 404, score: 100, vector: { honeypotScore: 100 } };
     }
-
-    if (isSuspicious && !isTicketValid(clientIp, powCookie)) { // The powCookie check is now after the PoW solution check
+    
+    // --- NOUVELLE LOGIQUE DE RE-CHALLENGE ---
+    // Un challenge est nécessaire si :
+    // 1. La requête est suspecte ET il n'y a pas de ticket valide.
+    // OU
+    // 2. La requête est *très* suspecte (dépasse le seuil 'high'), ce qui annule la validité du ticket actuel.
+    const hasValidTicket = isTicketValid(clientIp, powCookie);
+    const mustReChallenge = isSuspiciousHigh && hasValidTicket;
+
+    if (isSuspicious && (!hasValidTicket || mustReChallenge)) {
+        if (mustReChallenge) {
+            this._log('High suspicion score detected - overriding valid ticket to re-issue challenge', { finalScore, deviceId });
+        }
         this._log('Suspicious request without valid ticket - issuing challenge', { finalScore, hasPowCookie: !!powCookie });
         // Honeypot: Direct probing of challenge endpoints is highly suspicious.
         // A legitimate user only hits these endpoints via the challenge page itself.
@@ -1966,7 +1987,7 @@ export class FingerprintEngine {
         if (pow_nonce && !isChallengeResponse) {
             this._log('Honeypot probe detected - blocking request', { path, pow_nonce });
             if (logger) {
-                logger({ type: 'honeypot_probe', deviceId: cookies?.device_id, score: finalScore, path: path, timestamp: Date.now() });
+                logger({ type: 'honeypot_probe', deviceId: cookies?.device_id, score: finalScore, path: path, timestamp: Date.now(), vector: suspicionVector });
             }
             suspicionVector.honeypotScore = 100; // Bot is probing. Max penalty.
             // Recalculate the final score with the updated vector.
@@ -2002,8 +2023,8 @@ export class FingerprintEngine {
             const trapUrls = Array.from({ length: 3 }, () => generateTrapUrl(nonce));
             const trapLinksHtml = trapUrls.map(url => `<a href="${url}" tabindex="-1">config</a>`).join(' ');
 
-
-            const cpuChallengeDetails = generateCpuTargetChallenge(clientIp, nonce, suspicionFactor, path);
+            // On passe la configuration pour que la difficulté soit calculée correctement.
+            const cpuChallengeDetails = generateCpuTargetChallenge(clientIp, nonce, suspicionFactor, path, this.securityConfig);
 
             // La difficulté mémoire démarre à 0 et augmente seulement après un certain seuil de suspicion.
             // Par exemple, elle ne commence à augmenter qu'à partir de 25% du chemin entre 'low' et 'high'.
@@ -2019,16 +2040,18 @@ export class FingerprintEngine {
                 memDifficulty,
                 cpuTarget: cpuChallengeDetails.target
             });
-            // (NOUVEAU) On stocke le fingerprint de la requête qui a déclenché le challenge.
-            const originalFingerprint = requestContext.headers['x-device-fingerprint'] || getCompositeDeviceHash(requestContext);
+            // (NOUVEAU) On stocke le fingerprint de la requête qui a déclenché le challenge. We call it via __internal to allow mocking.
+            const originalFingerprint = requestContext.headers['x-device-fingerprint'] || __internal.getCompositeDeviceHash(requestContext);
 
             // Store the entire challenge context with a short TTL (e.g., 5 minutes)
+            const baseBlock = createCpuChallengeBaseBlock(nonce, clientSecret, originalFingerprint);
             await store.set(`secret:${nonce}`, {
                 clientSecret,
                 cpuTarget: cpuChallengeDetails.target,
                 suspicionScore: finalScore, // *** FIX: Store the score that triggered the challenge ***
                 fingerprint: originalFingerprint, // *** NOUVEAU ***
                 memDifficulty: memDifficulty,
+                baseBlock: baseBlock, // *** NOUVEAU: Le bloc de base est stocké pour la vérification ***
                 originalPath: path, // *** FIX: Store the original path ***
             }, this.securityConfig.challengeTtl || 300); // NOUVEAU: TTL configurable (5min par défaut)
 
@@ -2045,7 +2068,7 @@ export class FingerprintEngine {
             });
 
             if (logger) {
-                logger({ type: 'challenge_issued', deviceId: cookies?.device_id, score: finalScore, timestamp: Date.now() });
+                logger({ type: 'challenge_issued', deviceId: cookies?.device_id, score: finalScore, timestamp: Date.now(), vector: suspicionVector });
             }
 
             // Check if the request is an API request to return a JSON challenge
@@ -2060,13 +2083,14 @@ export class FingerprintEngine {
                         clientSecret: clientSecret, // The client needs this to solve the challenge
                         cpuTarget: cpuChallengeDetails.target,
                         memDifficulty: memDifficulty,
+                        baseBlock: [...baseBlock], // Envoyer le buffer comme un tableau d'octets
                     }
                 };
                 this._log('API challenge response generated', { challengePayload });
                 return { action: 'challenge', score: finalScore, vector: suspicionVector, status: 404, body: challengePayload };
             } else {
                 // For browsers, send the HTML page.
-                const trapContainer = `<div style="position:absolute;left:-9999px;top:-9999px;" aria-hidden="true">${trapLinksHtml}</div>`;                const page = generateCombinedPoWChallengePage(cpuChallengeDetails, memDifficulty, clientIp, clientSecret, this.securityConfig, trapContainer);
+                const trapContainer = `<div style="position:absolute;left:-9999px;top:-9999px;" aria-hidden="true">${trapLinksHtml}</div>`;                const page = generateCombinedPoWChallengePage(cpuChallengeDetails, memDifficulty, clientIp, clientSecret, this.securityConfig, trapContainer, originalFingerprint);
                 this._log('Browser challenge page generated', { 
                     pageLength: page.length, 
                     hasTrapContainer: true 
@@ -2080,7 +2104,7 @@ export class FingerprintEngine {
     this._log('Request passed - no challenge required', { finalScore, hasValidTicket: isTicketValid(clientIp, powCookie) });
     
     if (logger) {
-        logger({ type: 'request_passed', deviceId: cookies?.device_id, score: finalScore, timestamp: Date.now() });
+        logger({ type: 'request_passed', deviceId: cookies?.device_id, score: finalScore, timestamp: Date.now(), vector: suspicionVector });
     }
 
     return { action: 'next', score: finalScore, vector: suspicionVector };
@@ -2523,115 +2547,58 @@ let autoTuningJobId = null;
  * @param {object} securityConfig - The security configuration object to update.
  * @param {Array<object>} trafficData - The array containing traffic logs.
  * @param {number} minDataPoints - The minimum number of data points required to start optimization.
+ * @param {number} maxDataPoints - The maximum number of data points to keep after an optimization cycle.
  */
-function runThresholdOptimization(securityConfig, trafficData, minDataPoints) {
-    if (trafficData.length < minDataPoints) {
-        console.log(`[AutoTuning] Reporté : ${trafficData.length}/${minDataPoints} points de données.`);
-        return;
-    }
-    console.log(`[AutoTuning] Démarrage du cycle d'optimisation avec ${trafficData.length} points de données.`);
-
-    // Classify historical requests with a confidence weight.
-    const solvedDevices = new Set(trafficData.filter(e => e.type === 'challenge_solved').map(e => e.deviceId));
-    const challengedDevices = new Set(trafficData.filter(e => e.type === 'challenge_issued').map(e => e.deviceId));
-
-    const historicalRequests = trafficData.map(log => {
-        // Assign a label ('bot' or 'human') and a confidence weight to each log entry.
-        switch (log.type) {
-            case 'honeypot_probe':
-            case 'trap_triggered':
-                return { score: log.score, label: 'bot', confidence: 10.0 }; // Very high confidence
-            
-            case 'challenge_issued':
-                // A challenge issued to a device that never solved it is a strong bot signal.
-                if (!solvedDevices.has(log.deviceId)) {
-                    return { score: log.score, label: 'bot', confidence: 3.0 }; // High confidence
-                }
-                // If the challenge was eventually solved, this specific log is neutral.
-                return null;
+function runThresholdOptimization(securityConfig, trafficData, minDataPoints, maxDataPoints) {
+  if (trafficData.length < minDataPoints) {
+    console.log(`[AutoTuning] Reporté : ${trafficData.length}/${minDataPoints} points de données.`);
+    return;
+  }
 
-            case 'challenge_solved':
-                return { score: log.score, label: 'human', confidence: 5.0 }; // High confidence
+  if (trafficData.length > maxDataPoints) {
+    console.log(`[AutoTuning] Le journal de trafic a atteint ${trafficData.length} entrées (max: ${maxDataPoints}). Troncation des données les plus anciennes.`);
+    trafficData.splice(0, trafficData.length - maxDataPoints);
+  }
 
-            case 'request_passed':
-                // A passed request from a device that was never even challenged is likely a human.
-                if (!challengedDevices.has(log.deviceId)) {
-                    return { score: log.score, label: 'human', confidence: 0.5 }; // Low confidence
-                }
-                // If the device was challenged at some point, this log is ambiguous.
-                return null;
-            
-            default:
-                return null;
-        }
-    }).filter(Boolean); // Remove null entries
-
-    // The "fitness" function evaluates the quality of a set of thresholds.
-    // A lower score is better.
-    const fitnessFunction = (solution) => {
-        const [low, medium, high, velocityThreshold, burstThreshold, scrapeThreshold] = solution;
-        if (low >= medium || medium >= high || low < 10 || high > 90) return Infinity;
-        if (velocityThreshold < 50 || velocityThreshold > burstThreshold || burstThreshold > scrapeThreshold) return Infinity;
-
-        let weightedFalsePositives = 0; // Humans challenged unnecessarily.
-        let weightedFalseNegatives = 0; // Undetected bots.
-
-        for (const req of historicalRequests) {
-            if (req.label === 'bot') {
-                if (req.score < low) weightedFalseNegatives += req.confidence;
-            } else { // 'human'
-                if (req.score >= low) weightedFalsePositives += req.confidence;
-            }
-        }
-        // The penalty for false negatives is implicitly higher due to the higher confidence scores of bot signals.
-        return weightedFalsePositives + weightedFalseNegatives;
-    };
+  console.log(`[AutoTuning] Démarrage du cycle d'optimisation complet avec ${trafficData.length} points de données.`);
 
-    // Functions for the genetic algorithm.
-    const createIndividual = () => [
-        10 + Math.random() * 20, // low
-        30 + Math.random() * 30, // medium
-        60 + Math.random() * 30, // high
-        100 + Math.random() * 150, // velocityThreshold (100-250ms)
-        300 + Math.random() * 400, // burstThreshold (300-700ms)
-        800 + Math.random() * 700, // scrapeThreshold (800-1500ms)
-    ];
-    const crossover = (p1, p2) => p1.map((val, i) => (val + p2[i]) / 2);
-    const mutate = (s) => {
-        const n = [...s];
-        const i = Math.floor(Math.random() * n.length);
-        // Adjust mutation range based on parameter
-        const mutationRange = i < 3 ? 5 : 50;
-        n[i] += (Math.random() - 0.5) * mutationRange;
-        return n;
-    };
+  const paretoFront = Optimization.Operators.solveFullSecurityTuning({ trafficData });
 
-    // Start optimization.
-    const result = Optimization.geneticAlgorithm(createIndividual, fitnessFunction, crossover, mutate, {
-        generations: 50,
-        populationSize: 40
-    });
+  if (!paretoFront || paretoFront.length === 0) {
+    console.warn("[AutoTuning] L'optimisation n'a retourné aucune solution.");
+    return;
+  }
+
+  // Stratégie de sélection : choisir la solution la plus équilibrée du front de Pareto.
+  // On cherche la solution la plus proche de l'origine (0,0) dans l'espace des objectifs.
+  let bestSolution = paretoFront[0];
+  let minDistance = Math.sqrt(Math.pow(bestSolution.objectives[0], 2) + Math.pow(bestSolution.objectives[1], 2));
+
+  for (let i = 1; i < paretoFront.length; i++) {
+    const distance = Math.sqrt(Math.pow(paretoFront[i].objectives[0], 2) + Math.pow(paretoFront[i].objectives[1], 2));
+    if (distance < minDistance) {
+      minDistance = distance;
+      bestSolution = paretoFront[i];
+    }
+  }
 
-    const [newLow, newMedium, newHigh, newVelocity, newBurst, newScrape] = result.solution;
+  // Appliquer la nouvelle configuration optimisée
+  const newConfig = bestSolution.solution;
 
-    // Update the configuration live.
-    // Ensure thresholds object exists
-    if (!securityConfig.thresholds) securityConfig.thresholds = {};
-    securityConfig.thresholds.low = Math.round(newLow);
-    securityConfig.thresholds.medium = Math.round(newMedium);
-    securityConfig.thresholds.high = Math.round(newHigh);
+  // S'assurer que les objets de configuration existent avant d'utiliser Object.assign
+  if (!securityConfig.thresholds) securityConfig.thresholds = {};
+  if (!securityConfig.weights) securityConfig.weights = {};
+  if (!securityConfig.patterns) securityConfig.patterns = {};
 
-    // Update pattern detection parameters
-    if (!securityConfig.patterns) securityConfig.patterns = {};
-    securityConfig.patterns.velocityThreshold = Math.round(newVelocity);
-    securityConfig.patterns.burstThreshold = Math.round(newBurst);
-    securityConfig.patterns.scrapeThreshold = Math.round(newScrape);
-    // Weights could also be optimized, but let's keep it to thresholds for now for simplicity.
+  Object.assign(securityConfig.thresholds, newConfig.thresholds || {});
+  Object.assign(securityConfig.weights, newConfig.weights || {});
+  Object.assign(securityConfig.patterns, newConfig.patterns || {});
 
-    console.log("[AutoTuning] Nouveaux seuils optimisés appliqués :", securityConfig.thresholds);
-    if (securityConfig.patterns) {
-        console.log("[AutoTuning] Nouveaux paramètres de pattern appliqués :", securityConfig.patterns);
-    }
+  console.log("[AutoTuning] Nouvelle configuration de sécurité optimisée appliquée.");
+  console.log("[AutoTuning] Objectifs atteints :", { falsePositiveRate: bestSolution.objectives[0].toFixed(4), falseNegativeRate: bestSolution.objectives[1].toFixed(4) });
+  console.log("[AutoTuning] Seuils :", securityConfig.thresholds);
+  console.log("[AutoTuning] Poids :", securityConfig.weights);
+  console.log("[AutoTuning] Patterns :", securityConfig.patterns);
 }
 
 /**
@@ -2641,7 +2608,8 @@ function runThresholdOptimization(securityConfig, trafficData, minDataPoints) {
  * @param {object} options.securityConfig - The live security configuration object that will be mutated.
  * @param {Array<object>} options.trafficData - The array where the logger pushes traffic data.
  * @param {number} [options.interval=1800000] - The interval in milliseconds between each optimization cycle (default: 30 minutes).
- * @param {number} [options.minDataPoints=200] - The minimum number of requests to analyze before starting a cycle (default: 200).
+ * @param {number} [options.minDataPoints=200] - The minimum number of requests to have before starting a cycle (default: 200).
+ * @param {number} [options.maxDataPoints=10000] - The maximum number of log entries to keep in memory (default: 10,000).
  */
 export function startThresholdAutoTuning(options) {
     if (autoTuningJobId) {
@@ -2652,8 +2620,9 @@ export function startThresholdAutoTuning(options) {
     const {
         securityConfig,
         trafficData,
-        interval = 1800000,
-        minDataPoints = 200
+        interval = 1800000, // 30 minutes
+        minDataPoints = 200,
+        maxDataPoints = 10000 // Limite par défaut à 10 000 entrées
     } = options;
 
     if (!securityConfig || !trafficData) {
@@ -2663,7 +2632,7 @@ export function startThresholdAutoTuning(options) {
     console.log(`[AutoTuning] Job d'optimisation des seuils démarré. Prochain cycle dans ${interval / 60000} minutes.`);
 
     autoTuningJobId = setInterval(() => {
-        runThresholdOptimization(securityConfig, trafficData, minDataPoints);
+        runThresholdOptimization(securityConfig, trafficData, minDataPoints, maxDataPoints);
     }, interval);
 }