@anonympins/fingerprint 0.4.4 → 0.4.6

package/src/js/fingerprint.js

@@ -4,6 +4,7 @@ import * as dns from "node:dns/promises";
 import {getProblemManager, problemManager} from "./problem-manager.js";
 import {Optimization} from "./library.js";
 import {cyrb53, FingerprintBuilder} from "./fingerprint.builder.js";
+import {DynamicWasmGenerator} from "./dynamic-wasm.js";
 import {readFileSync, existsSync} from "node:fs";
 import {fileURLToPath} from "node:url";
 import {dirname, join, resolve} from "node:path";
@@ -14,6 +15,198 @@ const __dirname = dirname(__filename);
 export { createRedisStore } from "./redis-store.js";
 export { createMongoDbStore } from "./mongodb-store.js";
 
+let activeMappings = [];
+let lastMappingTime = 0;
+let isCompilingMapping = false;
+const MAPPING_ROTATION_INTERVAL = 60000; // 60 seconds
+
+function generateSessionMapping() {
+    const randomStr = (len = 6) => crypto.randomBytes(len).toString('hex').replace(/[0-9]/g, 'g').substring(0, len);
+    const randomHeader = () => `X-Sess-${crypto.randomBytes(4).toString('hex')}`;
+
+    return {
+        headers: {
+            'x-device-fingerprint': randomHeader(),
+            'x-behavior-metrics': randomHeader(),
+        },
+        globals: {
+            'ClientLibrary': `ClientLib_${randomStr(6)}`,
+            'getDeviceFingerprint': `getFP_${randomStr(6)}`,
+            'getClientBehaviorMetrics': `getMetrics_${randomStr(6)}`,
+        },
+        keys: {
+            'ua': randomStr(4),
+            'hw': randomStr(4),
+            'geo': randomStr(4),
+            'scr': randomStr(4),
+            'os': randomStr(4),
+            'gpu': randomStr(4),
+            'cvs': randomStr(4),
+            'cdp': randomStr(4),
+            'bot': randomStr(4),
+            'wasm': randomStr(4),
+        },
+        wasmConstants: {
+            seed: crypto.randomBytes(4).readInt32LE(0),
+            multiplier: crypto.randomBytes(4).readInt32LE(0) | 1,
+            adder: crypto.randomBytes(4).readInt32LE(0)
+        }
+    };
+}
+
+async function compilePolymorphicJs(mapping) {
+    const clientScriptPath = join(__dirname, 'fingerprint.client.js');
+    let jsCode = '';
+    try {
+        jsCode = readFileSync(clientScriptPath, 'utf-8');
+    } catch (e) {
+        console.error('[Fingerprint] Could not read fingerprint.client.js for dynamic obfuscation. Fallback to obfuscated build.');
+        try {
+            return readFileSync(join(__dirname, 'fingerprint.client.obfuscated.js'), 'utf-8');
+        } catch (err) {
+            return '';
+        }
+    }
+
+    jsCode = jsCode.replace(/X-Device-Fingerprint/g, mapping.headers['x-device-fingerprint']);
+    jsCode = jsCode.replace(/X-Behavior-Metrics/g, mapping.headers['x-behavior-metrics']);
+    jsCode = jsCode.replace(/ClientLibrary/g, mapping.globals['ClientLibrary']);
+    jsCode = jsCode.replace(/getDeviceFingerprint/g, mapping.globals['getDeviceFingerprint']);
+    jsCode = jsCode.replace(/getClientBehaviorMetrics/g, mapping.globals['getClientBehaviorMetrics']);
+
+    for (const [origKey, randKey] of Object.entries(mapping.keys)) {
+        const regex1 = new RegExp(`add\\(["']${origKey}["']`, 'g');
+        jsCode = jsCode.replace(regex1, `add("${randKey}"`);
+
+        const regex2 = new RegExp(`addRaw\\(["']${origKey}["']`, 'g');
+        jsCode = jsCode.replace(regex2, `addRaw("${randKey}"`);
+    }
+
+    const obfuscationResult = JavaScriptObfuscator.obfuscate(jsCode, {
+        compact: true,
+        controlFlowFlattening: true,
+        deadCodeInjection: true,
+        stringArray: true,
+        stringArrayRotate: true,
+        stringArrayShuffle: true,
+        seed: Math.abs(mapping.wasmConstants.seed),
+        selfDefending: true,
+    });
+
+    return obfuscationResult.getObfuscatedCode();
+}
+
+async function ensureLatestMapping() {
+    const now = Date.now();
+    if ((now - lastMappingTime > MAPPING_ROTATION_INTERVAL || activeMappings.length === 0) && !isCompilingMapping) {
+        isCompilingMapping = true;
+        try {
+            const mapping = generateSessionMapping();
+            const polymorphicJs = await compilePolymorphicJs(mapping);
+            const polymorphicWasm = DynamicWasmGenerator.generate(mapping.wasmConstants);
+
+            mapping.jsBuffer = Buffer.from(polymorphicJs, 'utf8');
+            mapping.wasmBuffer = polymorphicWasm;
+            mapping.timestamp = now;
+
+            activeMappings.unshift(mapping);
+            if (activeMappings.length > 5) {
+                activeMappings.pop();
+            }
+            lastMappingTime = now;
+
+            try {
+                await store.set('active-polymorphic-mappings', activeMappings.map(m => ({
+                    headers: m.headers,
+                    keys: m.keys
+                })));
+            } catch (e) {
+                // Ignore
+            }
+        } finally {
+            isCompilingMapping = false;
+        }
+    }
+}
+
+function getActiveMappingForRequest(headers) {
+    if (!headers) return null;
+    for (const mapping of activeMappings) {
+        const headerName = mapping.headers['x-device-fingerprint'].toLowerCase();
+        if (headers[headerName]) {
+            return mapping;
+        }
+    }
+    return null;
+}
+
+function decodePolymorphicFingerprint(fpString, mapping) {
+    if (!fpString || !mapping || !mapping.keys) return fpString;
+    const reverseKeys = {};
+    for (const [orig, rand] of Object.entries(mapping.keys)) {
+        reverseKeys[rand] = orig;
+    }
+    const parts = fpString.split('|');
+    const mappedParts = parts.map(part => {
+        const pair = part.split(':');
+        if (pair.length === 2) {
+            const origKey = reverseKeys[pair[0]] || pair[0];
+            return `${origKey}:${pair[1]}`;
+        }
+        return part;
+    });
+    return mappedParts.join('|');
+}
+
+const base64UrlEncode = (buf) => buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
+const base64UrlDecode = (str) => {
+  let base64 = str.replace(/-/g, '+').replace(/_/g, '/');
+  while (base64.length % 4) {
+    base64 += '=';
+  }
+  return Buffer.from(base64, 'base64');
+};
+
+export function generateStatelessTicket(payload) {
+  const secret = getPowSecret();
+  const key = crypto.createHash('sha256').update(secret).digest();
+  const iv = crypto.randomBytes(16);
+  const cipher = crypto.createCipheriv('aes-256-cbc', key, iv);
+  let encrypted = cipher.update(JSON.stringify(payload));
+  encrypted = Buffer.concat([encrypted, cipher.final()]);
+  
+  const signature = crypto.createHmac('sha256', key).update(Buffer.concat([iv, encrypted])).digest();
+  return `${base64UrlEncode(iv)}.${base64UrlEncode(encrypted)}.${base64UrlEncode(signature)}`;
+}
+
+export function parseStatelessTicket(ticket) {
+  try {
+    const parts = ticket.split('.');
+    if (parts.length !== 3) return null;
+    
+    const iv = base64UrlDecode(parts[0]);
+    const encrypted = base64UrlDecode(parts[1]);
+    const signature = base64UrlDecode(parts[2]);
+    
+    if (iv.length !== 16) return null;
+    
+    const secret = getPowSecret();
+    const key = crypto.createHash('sha256').update(secret).digest();
+    
+    const expectedSignature = crypto.createHmac('sha256', key).update(Buffer.concat([iv, encrypted])).digest();
+    if (signature.length !== expectedSignature.length || !crypto.timingSafeEqual(signature, expectedSignature)) {
+      return null;
+    }
+    
+    const decipher = crypto.createDecipheriv('aes-256-cbc', key, iv);
+    let decrypted = decipher.update(encrypted);
+    decrypted = Buffer.concat([decrypted, decipher.final()]);
+    
+    return JSON.parse(decrypted.toString('utf8'));
+  } catch (e) {
+    return null;
+  }
+}
 
 /**
  * Vérifie le limiteur de débit Token Bucket pour les demandes de challenge d'un sous-réseau.
@@ -493,6 +686,7 @@ function getCompositeDeviceHash(context) {
         "ch_model": "sec-ch-ua-model",
         "ch_arch": "sec-ch-ua-arch",
         "ch_bitness": "sec-ch-ua-bitness",
+        "ch_full_version_list": "sec-ch-ua-full-version-list",
         "upgrade_req": "upgrade-insecure-requests",
         "accept_lang": "accept-language",
         "accept_enc": "accept-encoding",
@@ -835,18 +1029,16 @@ export const verifyPoWAndGenerateTicket = async (
     return null;
   }
 
-  // 2. Generate an opaque ticket ID and store session metadata securely on the server
-  const ticketId = crypto.randomUUID();
+  // 2. Generate a signed and encrypted stateless ticket
   const expiry = Date.now() + 3600000; // 1 hour
-
-  await store.set(`ticket:${ticketId}`, {
+  const payload = {
     expiry,
     originalIp: ip,
     deviceId,
     deviceHash
-  }, 3600); // 1 hour TTL
+  };
 
-  return ticketId;
+  return generateStatelessTicket(payload);
 };
 
 
@@ -898,11 +1090,56 @@ export const verifyMemoryPoW = (nonce, solution, difficulty = 16, clientSecret =
   }
   return finalHash === parseInt(solution, 10);
 };
+
+export function verifySpacePoW(nonce, solution, queries, seed, clientSecret) {
+  const combined = new Uint8Array(queries.length * 1024);
+  for (let i = 0; i < queries.length; i++) {
+    const idx = queries[i];
+    const block = generateBlock(seed, idx);
+    combined.set(block, i * 1024);
+  }
+  
+  const nonceBytes = Buffer.from(nonce + ":" + clientSecret, "utf8");
+  const finalBlock = Buffer.concat([Buffer.from(combined), nonceBytes]);
+  
+  const hash = crypto.createHash("sha256").update(finalBlock).digest("hex");
+  return hash === solution;
+}
+
+function generateBlock(seed, blockIndex, blockSize = 1024) {
+  const block = new Uint8Array(blockSize);
+  let h = cyrb53(seed + ":" + blockIndex);
+  for (let i = 0; i < blockSize; i++) {
+    h = Math.imul(h ^ i, 1597334677);
+    block[i] = h & 0xff;
+  }
+  return block;
+}
+
 export const isTicketValid = async (ip, ticket, deviceId = '', deviceHash = '', allowCrossNetworkRoaming = false) => {
   // Input validation: ensure the ticket is a non-empty string with the correct format.
   if (typeof ticket !== 'string' || ticket.length === 0) return false;
 
-  // 1. Resolve opaque ticket session from server-side store
+  // 1. Resolve stateless ticket first (zero database I/O cost)
+  const statelessData = parseStatelessTicket(ticket);
+  if (statelessData) {
+    const { expiry, originalIp, deviceId: storedDeviceId, deviceHash: storedDeviceHash } = statelessData;
+
+    if (!expiry || Date.now() > expiry) {
+      return false;
+    }
+
+    if (ip === originalIp) return true;
+    const currentSubnet = getIpSubnet(ip);
+    const originalSubnet = getIpSubnet(originalIp);
+    if (currentSubnet && originalSubnet && currentSubnet === originalSubnet) return true;
+
+    if (!allowCrossNetworkRoaming) return false;
+
+    return !!(deviceId && deviceId === storedDeviceId && deviceHash && deviceHash === storedDeviceHash);
+  }
+
+  // 2. Resolve opaque ticket session from server-side store
   const ticketData = await store.get(`ticket:${ticket}`);
   if (ticketData) {
     const { expiry, originalIp, deviceId: storedDeviceId, deviceHash: storedDeviceHash } = ticketData;
@@ -922,7 +1159,7 @@ export const isTicketValid = async (ip, ticket, deviceId = '', deviceHash = '',
     return !!(deviceId && deviceId === storedDeviceId && deviceHash && deviceHash === storedDeviceHash);
   }
 
-  // 2. Legacy fallback verification (backward compatibility for old client tokens)
+  // 3. Legacy fallback verification (backward compatibility for old client tokens)
   let expiry, originalIp, sig;
   if (ticket.includes('|')) {
     const parts = ticket.split('|');
@@ -1018,6 +1255,66 @@ function getHeaderAnomalies(context) {
   };
 }
 
+export function generateSpaceChallenge(clientIp, nonce, suspicionFactor, originalUrl, securityConfig) {
+  const sizeMb = securityConfig?.pospace?.sizeMb || 100;
+  const numQueries = securityConfig?.pospace?.numQueries || 10;
+  
+  const queries = [];
+  const maxBlocks = sizeMb * 1024;
+  while (queries.length < numQueries) {
+    const idx = Math.floor(Math.random() * maxBlocks);
+    if (!queries.includes(idx)) {
+      queries.push(idx);
+    }
+  }
+  
+  return {
+    type: "pospace",
+    nonce: nonce,
+    sizeMb,
+    queries,
+    path: originalUrl
+  };
+}
+
+function generateSpaceChallengePage(challengeDetails, clientSecret, securityConfig) {
+  const { nonce, sizeMb, queries, path } = challengeDetails;
+  const solverCode = getPowSolverCode();
+  
+  const challengeScript = `
+    async function solve() {
+      const nonce = ${JSON.stringify(nonce)};
+      const path = ${JSON.stringify(path)};
+      const clientSecret = ${JSON.stringify(clientSecret)};
+      const queries = ${JSON.stringify(queries)};
+      const sizeMb = ${sizeMb};
+      
+      document.getElementById('loader').innerText = '⚙️ Checking persistent local storage...';
+      await new Promise(r => setTimeout(r, 10));
+      
+      try {
+          await window.initializeSpace(nonce + ":" + clientSecret, sizeMb);
+          document.getElementById('loader').innerText = '⚙️ Generating Proof of Space...';
+          const hash = await window.solveSpaceChallenge(nonce + ":" + clientSecret, queries, nonce, clientSecret);
+          
+          window.location.href = path + "?pow_type=pospace&pow_nonce=" + nonce + "&pow_solution_space=" + hash;
+      } catch(e) {
+          document.getElementById('loader').innerText = "Error initializing local storage: " + e.message;
+      }
+    }
+    solve();
+  `;
+  
+  return `<html><head><title>Security Check</title></head>
+  <body style="font-family:sans-serif; text-align:center; padding-top:50px;">
+    <h1>Security Check (Level 2)</h1>
+    <p>We are verifying your storage allocation. This may take a few seconds on first load.</p>
+    <div id="loader" style="margin:20px;">⚙️ Initializing storage space...</div>
+    <script>${solverCode}</script>
+    <script>${challengeScript}</script>
+  </body></html>`;
+}
+
 /**
  * Checks for submitted honeypot fields to detect bots.
  * @param {object} context - The request context.
@@ -1400,11 +1697,27 @@ function getCrossLayerInconsistency(context) {
         const clientScreenHash = clientFpMap.get('scr');
         const viewportWidth = context.headers['sec-ch-viewport-width'];
         if (clientScreenHash && viewportWidth) {
-            const clientWidth = clientFpMap.get('scr')?.split('x')[0];
-            // Ce n'est pas une comparaison directe, mais un bot pourrait oublier de forger les CH.
-            // Si le client FP a une largeur et que le CH en a une autre, c'est suspect.
-            // Cette vérification est basique et pourrait être affinée.
-            if (clientWidth && clientWidth !== viewportWidth) {
+                  const viewportWidthInt = parseInt(viewportWidth, 10);
+                  let matchedScreenWidth = null;
+                  const commonWidths = [320, 360, 375, 390, 412, 414, 768, 1024, 1280, 1366, 1440, 1536, 1600, 1920, 2560, 3840];
+                  const commonHeights = [480, 568, 640, 667, 736, 800, 812, 844, 896, 900, 1024, 1080, 1200, 1440, 1600, 2160];
+                  const commonDepths = [24, 30, 32];
+
+                  for (const w of commonWidths) {
+                      for (const h of commonHeights) {
+                          for (const d of commonDepths) {
+                              const candidate = `${w}x${h}_${d}`;
+                              if (clientScreenHash === String(cyrb53(candidate))) {
+                                  matchedScreenWidth = w;
+                                  break;
+                              }
+                          }
+                          if (matchedScreenWidth !== null) break;
+                      }
+                      if (matchedScreenWidth !== null) break;
+                  }
+
+                  if (matchedScreenWidth !== null && viewportWidthInt > matchedScreenWidth) {
                 score += 20;
             }
         }
@@ -1415,10 +1728,17 @@ function getCrossLayerInconsistency(context) {
         const clientGpuHash = clientFpMap.get('gpu');
         const ja3 = getTlsFingerprint(context)?.ja3;
         if (clientGpuHash && ja3) {
-            // Une vraie implémentation nécessiterait une base de données mappant les GPU connus
-            // à des signatures JA3 typiques. Pour l'exemple, on simule une pénalité si les deux
-            // sont présents mais que le score de cohérence global est déjà faible.
-            // (Cette logique est déjà en partie couverte par le `consistencyScore`).
+            let expectedBrowsers = tlsFingerprintDb[ja3];
+            if (expectedBrowsers) {
+                if (!Array.isArray(expectedBrowsers)) {
+                    expectedBrowsers = [expectedBrowsers];
+                }
+                const nonBrowserLibraries = ['Python', 'Go', 'Java', 'curl'];
+                const isLibrary = expectedBrowsers.some(lib => nonBrowserLibraries.includes(lib));
+                if (isLibrary) {
+                    score += 30;
+                }
+            }
         }
 
         return { crossLayerInconsistencyScore: Math.min(100, score) };
@@ -1647,6 +1967,48 @@ function getClientHintsInconsistencyScore(context) {
         return { clientHintsInconsistencyScore: 0 };
     }
 
+    const fullVersionList = context.headers['sec-ch-ua-full-version-list'];
+    if (fullVersionList) {
+        let chFullVersion = null;
+        let chFullBrowser = null;
+        const matches = [...fullVersionList.matchAll(/"([^"]+)";v="([^"]+)"/g)];
+        for (const match of matches) {
+            const brand = match[1];
+            const version = match[2];
+            if (brand === 'Google Chrome' || brand === 'Chromium' || brand === 'Microsoft Edge') {
+                chFullVersion = version;
+                chFullBrowser = brand === 'Microsoft Edge' ? 'Edge' : 'Chrome';
+                if (brand === 'Google Chrome' || brand === 'Microsoft Edge') {
+                    break;
+                }
+            }
+        }
+        if (chFullVersion && chFullBrowser) {
+            let uaFullVersion = null;
+            const uaFullMatch = ua.match(/(Chrome|Edg)\/([\d\.]+)/);
+            if (uaFullMatch) {
+                const uaBrowserMapped = uaFullMatch[1] === 'Edg' ? 'Edge' : 'Chrome';
+                uaFullVersion = uaFullMatch[2];
+                if (uaBrowserMapped === chFullBrowser && uaFullVersion !== chFullVersion) {
+                    const parts1 = uaFullVersion.split('.').map(Number);
+                    const parts2 = chFullVersion.split('.').map(Number);
+                    let diffIndex = -1;
+                    for (let i = 0; i < Math.max(parts1.length, parts2.length); i++) {
+                        if ((parts1[i] || 0) !== (parts2[i] || 0)) {
+                            diffIndex = i;
+                            break;
+                        }
+                    }
+                    const baseScores = [95, 90, 85, 80];
+                    const baseScore = baseScores[diffIndex] || 80;
+                    const delta = Math.abs((parts1[diffIndex] || 0) - (parts2[diffIndex] || 0));
+                    const finalFullScore = Math.min(100, baseScore + Math.min(5, delta * 5));
+                    return { clientHintsInconsistencyScore: finalFullScore };
+                }
+            }
+        }
+    }
+
     // 1. Extract browser and version from User-Agent
     let uaVersion = null;
     let uaBrowser = null;
@@ -1681,10 +2043,19 @@ function getClientHintsInconsistencyScore(context) {
 
     const versionDifference = Math.abs(parseInt(uaVersion, 10) - parseInt(chVersion, 10));
 
-    if (versionDifference > 5) return { clientHintsInconsistencyScore: 80 };
-    if (versionDifference > 1) return { clientHintsInconsistencyScore: 40 };
+        let clientHintsInconsistencyScore = 0;
+        if (versionDifference > 0) {
+            if (versionDifference <= 2) {
+                clientHintsInconsistencyScore = versionDifference * 20;
+            } else if (versionDifference <= 7) {
+                clientHintsInconsistencyScore = 40 + (versionDifference - 2) * 8;
+            } else {
+                clientHintsInconsistencyScore = Math.min(100, 80 + (versionDifference - 7) * 3.33);
+            }
+            clientHintsInconsistencyScore = Math.round(clientHintsInconsistencyScore);
+        }
 
-    return { clientHintsInconsistencyScore: 0 };
+        return { clientHintsInconsistencyScore };
 }
 
 /**
@@ -2225,11 +2596,20 @@ export const configureStore = (externalStore) => {
 async function resolveRequestIdentity(context, securityConfig = {}) {
   const existingDeviceId = context.cookies?.device_id;
   const currentDeviceHash = getCompositeDeviceHash(context); // Use the composite hash for consistency checks
-  let deviceId = existingDeviceId;
+    const tlsSessionId = getTlsSessionId(context);
+    let deviceId = existingDeviceId;
   let consistencyScore = 1.0; // 1.0 = perfectly consistent
   let deviceData = null;
   let newCookie = null;
-  if (deviceId) {
+
+    if (!deviceId && tlsSessionId) {
+        const resumedDeviceId = await store.get(`tls-session:${tlsSessionId}`);
+        if (resumedDeviceId) {
+            deviceId = resumedDeviceId;
+        }
+    }
+
+    if (deviceId) {
     deviceData = await store.get(`device:${deviceId}`);
   }
 
@@ -2272,6 +2652,9 @@ async function resolveRequestIdentity(context, securityConfig = {}) {
     // The write will happen in getSuspicionVector after all modifications.
   }
 
+    if (deviceId && tlsSessionId) {
+        await store.set(`tls-session:${tlsSessionId}`, deviceId, 3600); // Bind TLS session for 1 hour
+    }
   return { deviceId, deviceData, consistencyScore, newCookie };
 }
 
@@ -2416,6 +2799,8 @@ export const getSuspicionVector = async (context, securityConfig) => {
   const stableFpHash = cyrb53(stableFp).toString();
   const { botnetClusterScore } = await getBotnetClusterScore(context, stableFpHash);
 
+    const { tcpAnomalyScore } = getTcpAnomalyScore(context);
+
   // Save the updated device state to the store
   // Note: deviceData.ips is a Set, which may not serialize correctly in all stores (e.g., JSON). A Redis store should handle this via custom serialization or by converting to an array.
   await store.set(`device:${deviceId}`, deviceData);
@@ -2426,7 +2811,7 @@ export const getSuspicionVector = async (context, securityConfig) => {
       deviceData.ips = new Set(deviceData.ips);
   }
   // Le vecteur de suspicion est maintenant complet.
-  return { ...behavioral, headerAnomalyScore, inconsistencyScore, behaviorScore, honeypotScore, botScore, requestPatternScore, crossLayerInconsistencyScore, timeInconsistencyScore, tlsSpoofingScore, clickVarianceScore, clientHintsInconsistencyScore, subnetScore, ipReputationScore, botnetClusterScore };
+  return { ...behavioral, headerAnomalyScore, inconsistencyScore, behaviorScore, honeypotScore, botScore, requestPatternScore, crossLayerInconsistencyScore, timeInconsistencyScore, tlsSpoofingScore, clickVarianceScore, clientHintsInconsistencyScore, subnetScore, ipReputationScore, botnetClusterScore, tcpAnomalyScore };
 };
 
 // A residential user can change networks (home, 4G, public wifi).
@@ -2722,19 +3107,15 @@ export async function verifyCpuTargetPoWAndGenerateTicket(
   if (isValid) {
       console.log('[FP Server Verify] CPU PoW verification PASSED. Details:', {
       });
-    // Generate an opaque ticket ID and store session metadata securely on the server
-    const ticketId = crypto.randomUUID();
     const ttl = ticketTtl || 3600000; // Calculates expiration from TTL
     const expiry = Date.now() + ttl;
 
-    await store.set(`ticket:${ticketId}`, {
+    return generateStatelessTicket({
       expiry,
       originalIp: clientIp,
       deviceId,
       deviceHash
     }, Math.ceil(ttl / 1000));
-
-    return ticketId;
   }
 
   return null;
@@ -2836,7 +3217,8 @@ export class FingerprintEngine {
             (suspicionVector.clickVarianceScore || 0) * (weights.clickVarianceScore || 0) +
             (suspicionVector.clientHintsInconsistencyScore || 0) * (weights.clientHintsInconsistencyScore || 0) +
             (suspicionVector.subnetScore || 0) * (weights.subnetScore || 0) +
-            (suspicionVector.ipReputationScore || 0) * (weights.ipReputationScore || 0);
+            (suspicionVector.ipReputationScore || 0) * (weights.ipReputationScore || 0) +
+            (suspicionVector.tcpAnomalyScore || 0) * (weights.tcpAnomalyScore || 0);
 
         return Math.min(100, score);
     }
@@ -3094,7 +3476,7 @@ export class FingerprintEngine {
   async processRequest(requestContext) {
       sanitizeProxyHeaders(requestContext, this.securityConfig);
 
-      const { clientIp = "unknown", path, cookies, query, isStatic, graphqlOperationType, graphqlOperationName } = requestContext;
+      const { clientIp = "unknown", path, cookies = {}, query = {}, isStatic, graphqlOperationType, graphqlOperationName } = requestContext;
     const { weights, thresholds, logger, onDeviceCompromised } = this.securityConfig;
     
     this._log('Processing request', { clientIp, path, isStatic });
@@ -3174,6 +3556,13 @@ export class FingerprintEngine {
             decision.action = 'next';
             delete decision.status;
             delete decision.body;
+
+            if (requestContext._newCookies) {
+                const deviceCookie = requestContext._newCookies.find(c => c.name === 'device_id');
+                if (deviceCookie) {
+                    decision.newCookieForResponse = deviceCookie;
+                }
+            }
         }
         return decision;
     }
@@ -3213,8 +3602,8 @@ export class FingerprintEngine {
     // --- NOUVELLE LOGIQUE DE PRIORITÉ ---
     // Si une solution de challenge est soumise, on la traite en priorité absolue,
     // avant même de recalculer le score de suspicion.
-    const { pow_type, pow_solution, pow_solution_cpu, pow_solution_mem, pow_fp, pow_solution_population, pow_solution_work_result, pow_problem_id } = query;
-    if (pow_nonce && (pow_solution || pow_solution_cpu)) { // Vérifie pow_solution pour la compatibilité ascendante
+    const { pow_type, pow_solution, pow_solution_cpu, pow_solution_mem, pow_fp, pow_solution_population, pow_solution_work_result, pow_problem_id, pow_solution_space } = query;
+    if (pow_nonce && (pow_solution || pow_solution_cpu || pow_solution_space)) { // Vérifie pow_solution pour la compatibilité ascendante
         this._log('Challenge solution submitted', { pow_type, pow_nonce });
 
         // On doit calculer le score de suspicion *avant* de valider le ticket,
@@ -3292,13 +3681,13 @@ export class FingerprintEngine {
             } else {
                 optimalTtl = determineOptimalTicketTtl(preliminaryScore);
                 finalTtl = isProbationary ? probationaryTtl : optimalTtl;
-                this._log('Challenge context found, verifying solution', { optimalTtl, finalTtl });
+                this._log('Challenge context found, verifying solution', {optimalTtl, finalTtl});
 
                 if ((pow_type === "cpu_target" || !pow_type) && (pow_solution_cpu || pow_solution)) { // !pow_type pour compatibilité
                     const cpuSolution = pow_solution_cpu || pow_solution;
                     ticket = await verifyCpuTargetPoWAndGenerateTicket(clientIp, finalTtl, pow_nonce, cpuSolution, challengeContext, deviceId, currentDeviceHash);
                     isValid = ticket !== null;
-                    this._log('CPU target challenge verification', { isValid });
+                    this._log('CPU target challenge verification', {isValid});
                 } else if (pow_type === "cpu_mem" && pow_solution_cpu && pow_solution_mem) {
                     const cpuTicket = await verifyCpuTargetPoWAndGenerateTicket(clientIp, finalTtl, pow_nonce, pow_solution_cpu, challengeContext, deviceId, currentDeviceHash);
                     const isMemValid = verifyMemoryPoW(pow_nonce, pow_solution_mem, challengeContext.memDifficulty, challengeContext.clientSecret); // Memory PoW is independent of fingerprint
@@ -3309,6 +3698,18 @@ export class FingerprintEngine {
                         memValid: isMemValid,
                         isValid
                     });
+                } else if (pow_type === "pospace" && pow_solution_space) {
+                    const isSpaceValid = verifySpacePoW(pow_nonce, pow_solution_space, challengeContext.queries, pow_nonce + ":" + challengeContext.clientSecret, challengeContext.clientSecret);
+                    isValid = isSpaceValid;
+                    if (isValid) {
+                        const ttl = finalTtl || 3600000;
+                        ticket = generateStatelessTicket({
+                            expiry: Date.now() + ttl,
+                            originalIp: clientIp,
+                            deviceId,
+                            deviceHash
+                        });
+                    }
                 }
             }
         } else {
@@ -3345,6 +3746,7 @@ export class FingerprintEngine {
             finalSearchParams.delete('pow_solution_cpu');
             finalSearchParams.delete('pow_solution_mem');
             finalSearchParams.delete('pow_fp'); // Ne pas oublier de nettoyer le fingerprint
+            finalSearchParams.delete('pow_solution_space');
             // NOUVEAU: Nettoyer aussi les paramètres des challenges d'optimisation et de travail utile
             finalSearchParams.delete('pow_solution_population');
             finalSearchParams.delete('pow_solution_work_result');
@@ -3382,6 +3784,12 @@ export class FingerprintEngine {
                     decision.action = 'next';
                     delete decision.status;
                     delete decision.body;
+                    if (requestContext._newCookies) {
+                        const deviceCookie = requestContext._newCookies.find(c => c.name === 'device_id');
+                        if (deviceCookie) {
+                            decision.newCookieForResponse = deviceCookie;
+                        }
+                    }
                 }
                 return decision;
             }
@@ -3474,6 +3882,12 @@ export class FingerprintEngine {
             decision.action = 'next';
             delete decision.status;
             delete decision.body;
+            if (requestContext._newCookies) {
+                const deviceCookie = requestContext._newCookies.find(c => c.name === 'device_id');
+                if (deviceCookie) {
+                    decision.newCookieForResponse = deviceCookie;
+                }
+            }
         }
         return decision;
     }
@@ -3521,6 +3935,12 @@ export class FingerprintEngine {
           decision.action = 'next';
           delete decision.status;
           delete decision.body;
+          if (requestContext._newCookies) {
+              const deviceCookie = requestContext._newCookies.find(c => c.name === 'device_id');
+              if (deviceCookie) {
+                  decision.newCookieForResponse = deviceCookie;
+              }
+          }
       }
       return decision;
     }
@@ -3545,6 +3965,12 @@ export class FingerprintEngine {
             decision.action = 'next';
             delete decision.status;
             delete decision.body;
+            if (requestContext._newCookies) {
+                const deviceCookie = requestContext._newCookies.find(c => c.name === 'device_id');
+                if (deviceCookie) {
+                    decision.newCookieForResponse = deviceCookie;
+                }
+            }
         }
         return decision;
     }
@@ -3579,6 +4005,12 @@ export class FingerprintEngine {
                 decision.action = 'next';
                 delete decision.status;
                 delete decision.body;
+                if (requestContext._newCookies) {
+                    const deviceCookie = requestContext._newCookies.find(c => c.name === 'device_id');
+                    if (deviceCookie) {
+                        decision.newCookieForResponse = deviceCookie;
+                    }
+                }
             }
             return decision;
         }
@@ -3588,6 +4020,7 @@ export class FingerprintEngine {
         // --- SELECTION AND SENDING OF THE APPROPRIATE CHALLENGE ---
         const nonce = crypto.randomBytes(16).toString("hex");
         const clientSecret = crypto.randomBytes(16).toString("hex");
+            const isApi = requestContext.rawReq && this.securityConfig?.isApiRequest?.(requestContext.rawReq);
 
         // Pour les scores élevés, on choisit aléatoirement entre un challenge de travail utile et un PoW classique.
         // Cela rend l'automatisation plus difficile pour un attaquant.
@@ -3630,7 +4063,6 @@ export class FingerprintEngine {
         }
 
         if (isSuspicious && usefulWorkDispatched) {
-            const isApi = requestContext.rawReq && this.securityConfig?.isApiRequest?.(requestContext.rawReq);
             if (isApi) {
                 return { action: 'challenge', score: finalScore, vector: suspicionVector, status: 404, body: challengePayload };
             } else {
@@ -3648,6 +4080,33 @@ export class FingerprintEngine {
                     delete decision.status;
                     return decision;
                 }
+            if (this.securityConfig.enableProofOfSpace) {
+                const spaceChallenge = generateSpaceChallenge(clientIp, nonce, suspicionFactor, path, this.securityConfig);
+                const clientSecret = crypto.randomBytes(16).toString("hex");
+                await store.set(`secret:${nonce}`, {
+                    clientSecret,
+                    suspicionScore: finalScore,
+                    queries: spaceChallenge.queries,
+                    sizeMb: spaceChallenge.sizeMb,
+                    originalPath: path,
+                }, this.securityConfig.challengeTtl || 300);
+                
+                if (isApi) {
+                    decision.body = {
+                        challenge: {
+                            type: 'pospace',
+                            nonce: nonce,
+                            clientSecret,
+                            queries: spaceChallenge.queries,
+                            sizeMb: spaceChallenge.sizeMb,
+                        }
+                    };
+                } else {
+                    const page = generateSpaceChallengePage(spaceChallenge, clientSecret, this.securityConfig);
+                    decision.body = page;
+                }
+                return decision;
+            }
             // Generate some trap URLs to embed in the challenge page.
             // These links are visually hidden but present in the DOM to trap bots.
             const trapUrls = Array.from({ length: 3 }, () => generateTrapUrl(nonce)); // Génère les URL
@@ -3706,9 +4165,6 @@ export class FingerprintEngine {
                 logger({ type: 'challenge_issued', deviceId: cookies?.device_id, score: finalScore, timestamp: Date.now(), vector: suspicionVector });
             }
 
-            // Check if the request is an API request to return a JSON challenge
-            const isApi = requestContext.rawReq && this.securityConfig?.isApiRequest?.(requestContext.rawReq);
-
             if (isApi) {
                 // For API clients, send a JSON response with challenge details.
                 const challengePayload = {
@@ -3742,8 +4198,14 @@ export class FingerprintEngine {
     if (logger) {
         logger({ type: 'request_passed', deviceId: cookies?.device_id, score: finalScore, timestamp: Date.now(), vector: suspicionVector });
     }
-
-    return { action: 'next', score: finalScore, vector: suspicionVector, intendedAction: 'next' };
+      const response = { action: 'next', score: finalScore, vector: suspicionVector, intendedAction: 'next' };
+      if (requestContext._newCookies) {
+          const deviceCookie = requestContext._newCookies.find(c => c.name === 'device_id');
+          if (deviceCookie) {
+              response.newCookieForResponse = deviceCookie;
+          }
+      }
+      return response;
   }
 
   /**
@@ -3982,6 +4444,185 @@ function determineOptimalTicketTtl(suspicionScore) {
     return ttl;
 }
 
+
+/**
+ * Parse une trame TCP SYN brute (IPv4 ou IPv6).
+ * @private
+ * @param {Buffer|Uint8Array} binary - Le paquet binaire.
+ * @returns {object|null}
+ */
+function parseTcpSyn(binary) {
+    if (!binary || binary.length < 40) return null;
+    let ttl = 64;
+    let tcpOffset = 20;
+    const version = binary[0] >> 4;
+
+    if (version === 4) {
+        ttl = binary[8];
+        const ihl = binary[0] & 0x0f;
+        tcpOffset = ihl * 4;
+    } else if (version === 6) {
+        ttl = binary[7]; // Hop Limit
+        tcpOffset = 40;
+    } else {
+        tcpOffset = 0;
+        ttl = 64;
+    }
+
+    if (binary.length < tcpOffset + 20) return null;
+
+    const windowSize = (binary[tcpOffset + 14] << 8) | binary[tcpOffset + 15];
+    const dataOffset = (binary[tcpOffset + 12] >> 4) * 4;
+    const optionsEnd = tcpOffset + dataOffset;
+
+    let mss = null;
+    let ws = null;
+    let sack = false;
+
+    let i = tcpOffset + 20;
+    while (i < optionsEnd && i < binary.length) {
+        const optType = binary[i];
+        if (optType === 0) break;
+        if (optType === 1) {
+            i++;
+            continue;
+        }
+        if (i + 1 >= binary.length) break;
+        const optLen = binary[i + 1];
+        if (optLen < 2 || i + optLen > binary.length) break;
+
+        if (optType === 2 && optLen === 4) {
+            mss = (binary[i + 2] << 8) | binary[i + 3];
+        } else if (optType === 3 && optLen === 3) {
+            ws = binary[i + 2];
+        } else if (optType === 4 && optLen === 2) {
+            sack = true;
+        }
+        i += optLen;
+    }
+
+    return { ttl, windowSize, mss, ws, sack };
+}
+
+/**
+ * Classifie l'OS à partir du fingerprint de la pile TCP/IP.
+ * @private
+ * @param {object|null} fingerprint
+ * @returns {string}
+ */
+function classifyTcpOs(fingerprint) {
+    if (!fingerprint) return 'unknown';
+    const ttl = fingerprint.ttl ?? 64;
+    const windowSize = fingerprint.windowSize ?? 0;
+    const ws = fingerprint.ws ?? null;
+
+    if (ttl > 64 && ttl <= 128) {
+        return 'Windows';
+    }
+    if (ttl > 32 && ttl <= 64) {
+        if (windowSize === 29200 || windowSize === 14600 || windowSize === 5840) {
+            return 'Linux';
+        }
+        return 'Linux';
+    }
+    if (ttl <= 64) {
+        if (windowSize === 65535 && (ws === 6 || ws === 8 || ws === 5)) {
+            return 'macOS/iOS';
+        }
+    }
+    if (ttl > 64) return 'Windows';
+    if (ttl > 0) return 'Linux';
+    return 'unknown';
+}
+
+/**
+ * Détecte les anomalies de pile réseau par rapport au User-Agent.
+ * @private
+ * @param {object} context - Le contexte de la requête.
+ * @returns {{tcpAnomalyScore: number}}
+ */
+function getTcpAnomalyScore(context) {
+    let fp = null;
+    const rawTcpBinary = context.headers?.['x-raw-tcp-binary'] || context.rawTcpBinary || null;
+    if (rawTcpBinary) {
+        const binary = Buffer.isBuffer(rawTcpBinary) ? rawTcpBinary : (typeof rawTcpBinary === 'string' ? Buffer.from(rawTcpBinary, 'hex') : rawTcpBinary);
+        fp = parseTcpSyn(binary);
+    }
+
+    if (!fp) {
+        const tcpHeader = context.headers?.['x-tcp-fingerprint'] || context.tcpFingerprint || null;
+        if (tcpHeader && typeof tcpHeader === 'string') {
+            const parts = tcpHeader.split(':');
+            if (parts.length >= 2) {
+                fp = {
+                    ttl: parseInt(parts[0], 10),
+                    windowSize: parseInt(parts[1], 10),
+                    mss: parts[2] ? parseInt(parts[2], 10) : null,
+                    ws: parts[3] ? parseInt(parts[3], 10) : null,
+                    sack: parts[4] === '1' || parts[4] === 'true'
+                };
+            }
+        }
+    }
+
+    if (!fp) {
+        return { tcpAnomalyScore: 0.0 };
+    }
+
+    const tcpOs = classifyTcpOs(fp);
+    const ua = context.headers?.['user-agent'] || '';
+    const uaParts = parseUserAgent(ua);
+    const uaOs = uaParts.os;
+
+    if (!uaOs || tcpOs === 'unknown') {
+        return { tcpAnomalyScore: 0.0 };
+    }
+
+        let mappedOs = null;
+        if (uaOs.startsWith('Windows')) mappedOs = 'Windows';
+        else if (uaOs.startsWith('Mac') || uaOs.startsWith('macOS')) mappedOs = 'macOS';
+        else if (uaOs.startsWith('iOS')) mappedOs = 'iOS';
+        else if (uaOs.startsWith('Linux')) mappedOs = 'Linux';
+
+        if (!mappedOs) {
+            return { tcpAnomalyScore: 0.0 };
+        }
+
+        const OS_EXPECTED_TCP = {
+            'Windows': { ttl: 128, windowSize: 64240, ws: 8, mss: 1460, sack: true },
+            'Linux': { ttl: 64, windowSize: 29200, ws: 7, mss: 1460, sack: true },
+            'macOS': { ttl: 64, windowSize: 65535, ws: 6, mss: 1460, sack: true },
+            'iOS': { ttl: 64, windowSize: 65535, ws: 6, mss: 1460, sack: true }
+        };
+
+        const expected = OS_EXPECTED_TCP[mappedOs];
+        const ttlDiff = Math.abs(fp.ttl - expected.ttl) / expected.ttl;
+        const winDiff = Math.abs(fp.windowSize - expected.windowSize) / expected.windowSize;
+        const wsDiff = expected.ws !== null && fp.ws !== null ? Math.abs(fp.ws - expected.ws) / expected.ws : 0.0;
+        const mssDiff = expected.mss !== null && fp.mss !== null ? Math.abs(fp.mss - expected.mss) / expected.mss : 0.0;
+        const sackDiff = (fp.sack ?? true) === (expected.sack ?? true) ? 0.0 : 1.0;
+
+        const deviation = (
+            Math.min(1.0, ttlDiff) * 0.50 +
+            Math.min(1.0, winDiff) * 0.25 +
+            Math.min(1.0, wsDiff) * 0.15 +
+            Math.min(1.0, mssDiff) * 0.05 +
+            sackDiff * 0.05
+        );
+
+        let tcpAnomalyScore = 0.0;
+        if (tcpOs !== mappedOs && tcpOs !== 'unknown') {
+            const baseAnomaly = mappedOs === 'Windows' ? 80.0 :
+                                (mappedOs === 'macOS' || mappedOs === 'iOS' ? 85.0 : 75.0);
+            tcpAnomalyScore = baseAnomaly + (deviation - 0.4) * 10.0;
+        } else {
+            tcpAnomalyScore = deviation * 40.0;
+        }
+
+        tcpAnomalyScore = Math.max(0.0, Math.min(100.0, Math.round(tcpAnomalyScore * 10) / 10));
+        return { tcpAnomalyScore };
+}
+
 /**
  * Vérifie si une chaîne de caractères contient des patterns d'injection connus.
  * @private
@@ -4191,6 +4832,32 @@ export const default_whitelist = () => [
 ];
 
 
+/**
+ * Extracts the TLS Session ID or ticket hash from the request context.
+ * Prioritizes proxy-provided headers and falls back to Node's native socket session.
+ * @private
+ * @param {object} context - The request context.
+ * @returns {string|null}
+ */
+function getTlsSessionId(context) {
+    if (!context) return null;
+    const fromHeader = context.headers ? (context.headers['x-tls-session-id'] || context.headers['x-ssl-session-id']) : null;
+    if (fromHeader) return fromHeader;
+
+    const socket = context.rawReq?.socket;
+    if (socket) {
+        if (socket.sessionId) {
+            return socket.sessionId.toString('hex');
+        }
+        if (typeof socket.getSession === 'function') {
+            const session = socket.getSession();
+            if (session) {
+                return crypto.createHash('sha256').update(session).digest('hex');
+            }
+        }
+    }
+    return null;
+}
 
 // --- Proof-of-Work Middleware (The Tollbooth) ---
 export const powMiddleware = (securityConfig) => {
@@ -4223,6 +4890,24 @@ export const powMiddleware = (securityConfig) => {
   }
 
   return async (req, res, next) => {
+      if (!req.headers_translated) {
+          req.headers_translated = true;
+          const matchedMapping = getActiveMappingForRequest(req.headers);
+          if (matchedMapping) {
+              const devFpHeader = matchedMapping.headers['x-device-fingerprint'].toLowerCase();
+              const behaviorHeader = matchedMapping.headers['x-behavior-metrics'].toLowerCase();
+
+              if (req.headers[devFpHeader]) {
+                  req.headers['x-device-fingerprint'] = req.headers[devFpHeader];
+              }
+              if (req.headers[behaviorHeader]) {
+                  req.headers['x-behavior-metrics'] = req.headers[behaviorHeader];
+              }
+              if (req.headers['x-device-fingerprint']) {
+                  req.headers['x-device-fingerprint'] = decodePolymorphicFingerprint(req.headers['x-device-fingerprint'], matchedMapping);
+              }
+          }
+      }
     if (securityConfig?.wasm) {
       const wasmConfig = securityConfig.wasm;
       let jsPath = '/fp.js';
@@ -4244,24 +4929,40 @@ export const powMiddleware = (securityConfig) => {
         wasmFile = wasmConfig.wasmFile ? resolve(wasmConfig.wasmFile) : resolve(__dirname, '..', '..', 'public', 'fp.wasm');
       }
 
-      if (jsFile && req.path === jsPath) {
-        try {
-          const fileContent = readFileSync(jsFile);
-          res.setHeader('Content-Type', 'application/javascript');
-          return res.send(fileContent);
-        } catch (e) {
-          // Fallback
+        if (req.path === jsPath) {
+            try {
+                if (wasmConfig === 'dynamic' || wasmConfig.dynamic || wasmConfig.polymorphic) {
+                    await ensureLatestMapping();
+                    const latest = activeMappings[0];
+                    if (latest && latest.jsBuffer) {
+                        res.setHeader('Content-Type', 'application/javascript');
+                        return res.send(latest.jsBuffer);
+                    }
+                }
+                if (jsFile && existsSync(jsFile)) {
+                    const fileContent = readFileSync(jsFile);
+                    res.setHeader('Content-Type', 'application/javascript');
+                    return res.send(fileContent);
+                }
+            } catch (e) {}
         }
-      }
-      if (wasmFile && req.path === wasmPath) {
-        try {
-          const fileContent = readFileSync(wasmFile);
-          res.setHeader('Content-Type', 'application/wasm');
-          return res.send(fileContent);
-        } catch (e) {
-          // Fallback
+        if (req.path === wasmPath) {
+            try {
+                if (wasmConfig === 'dynamic' || wasmConfig.dynamic || wasmConfig.polymorphic) {
+                    await ensureLatestMapping();
+                    const latest = activeMappings[0];
+                    if (latest && latest.wasmBuffer) {
+                        res.setHeader('Content-Type', 'application/wasm');
+                        return res.send(latest.wasmBuffer);
+                    }
+                }
+                if (wasmFile && existsSync(wasmFile)) {
+                    const fileContent = readFileSync(wasmFile);
+                    res.setHeader('Content-Type', 'application/wasm');
+                    return res.send(fileContent);
+                }
+            } catch (e) {}
         }
-      }
     }
 
     const requestContext = {
@@ -4338,6 +5039,7 @@ export const __internal = {
     getDeviceHash,
     getCompositeDeviceHash,
     getSuspicionVector,
+    getTlsSessionId,
     cyrb53, // Export for testing
     FingerprintBuilder, // Export for testing
     calculateTarget,
@@ -4352,6 +5054,8 @@ export const __internal = {
     getTlsFingerprint, // NOUVEAU: Expose pour les tests
     sanitizeTrafficData, // NOUVEAU: Expose pour l'auto-tuner/tests
     getTlsSpoofingScore, // NOUVEAU: Expose pour les tests
+    generateStatelessTicket,
+    parseStatelessTicket,
     parseJa3,
     getBotnetClusterScore, // NOUVEAU: Expose pour les tests
     generateCpuTargetChallengePage,
@@ -4364,6 +5068,9 @@ export const __internal = {
     getIpReputationScore, // Expose for testing
     updateIpReputationScore, // Expose for testing
     setLastBestSolution: (val) => { lastBestSolution = val; }, // Expose to test auto-tuning metrics
+    parseTcpSyn, // Expose for testing
+    classifyTcpOs, // Expose for testing
+    getTcpAnomalyScore // Expose for testing
 };
 
 // --- THRESHOLD AUTO-TUNING SECTION ---