@anonympins/fingerprint 0.4.5 → 0.5.0

package/src/js/fingerprint.js

@@ -8,6 +8,8 @@ import {DynamicWasmGenerator} from "./dynamic-wasm.js";
 import {readFileSync, existsSync} from "node:fs";
 import {fileURLToPath} from "node:url";
 import {dirname, join, resolve} from "node:path";
+import { verifyZkpProof, decodePolymorphicFingerprint, deepMerge, getHeaderSignature, parseJa3, modPow, hashNetwork, normalizeReferer, isPrivateIp, parseUserAgent } from "./fingerprint.utils.js";
+
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -15,6 +17,132 @@ const __dirname = dirname(__filename);
 export { createRedisStore } from "./redis-store.js";
 export { createMongoDbStore } from "./mongodb-store.js";
 
+let activeMappings = [];
+let lastMappingTime = 0;
+let isCompilingMapping = false;
+const MAPPING_ROTATION_INTERVAL = 60000; // 60 seconds
+
+function generateSessionMapping() {
+    const randomStr = (len = 6) => crypto.randomBytes(len).toString('hex').replace(/[0-9]/g, 'g').substring(0, len);
+    const randomHeader = () => `X-Sess-${crypto.randomBytes(4).toString('hex')}`;
+
+    return {
+        headers: {
+            'x-device-fingerprint': randomHeader(),
+            'x-behavior-metrics': randomHeader(),
+        },
+        globals: {
+            'ClientLibrary': `ClientLib_${randomStr(6)}`,
+            'getDeviceFingerprint': `getFP_${randomStr(6)}`,
+            'getClientBehaviorMetrics': `getMetrics_${randomStr(6)}`,
+        },
+        keys: {
+            'ua': randomStr(4),
+            'hw': randomStr(4),
+            'geo': randomStr(4),
+            'scr': randomStr(4),
+            'os': randomStr(4),
+            'gpu': randomStr(4),
+            'cvs': randomStr(4),
+            'cdp': randomStr(4),
+            'bot': randomStr(4),
+            'wasm': randomStr(4),
+        },
+        wasmConstants: {
+            seed: crypto.randomBytes(4).readInt32LE(0),
+            multiplier: crypto.randomBytes(4).readInt32LE(0) | 1,
+            adder: crypto.randomBytes(4).readInt32LE(0)
+        }
+    };
+}
+
+async function compilePolymorphicJs(mapping) {
+    const clientScriptPath = join(__dirname, 'fingerprint.client.js');
+    let jsCode = '';
+    try {
+        jsCode = readFileSync(clientScriptPath, 'utf-8');
+    } catch (e) {
+        console.error('[Fingerprint] Could not read fingerprint.client.js for dynamic obfuscation. Fallback to obfuscated build.');
+        try {
+            return readFileSync(join(__dirname, 'fingerprint.client.obfuscated.js'), 'utf-8');
+        } catch (err) {
+            return '';
+        }
+    }
+
+    jsCode = jsCode.replace(/X-Device-Fingerprint/g, mapping.headers['x-device-fingerprint']);
+    jsCode = jsCode.replace(/X-Behavior-Metrics/g, mapping.headers['x-behavior-metrics']);
+    jsCode = jsCode.replace(/ClientLibrary/g, mapping.globals['ClientLibrary']);
+    jsCode = jsCode.replace(/getDeviceFingerprint/g, mapping.globals['getDeviceFingerprint']);
+    jsCode = jsCode.replace(/getClientBehaviorMetrics/g, mapping.globals['getClientBehaviorMetrics']);
+
+    for (const [origKey, randKey] of Object.entries(mapping.keys)) {
+        const regex1 = new RegExp(`add\\(["']${origKey}["']`, 'g');
+        jsCode = jsCode.replace(regex1, `add("${randKey}"`);
+
+        const regex2 = new RegExp(`addRaw\\(["']${origKey}["']`, 'g');
+        jsCode = jsCode.replace(regex2, `addRaw("${randKey}"`);
+    }
+
+    const obfuscationResult = JavaScriptObfuscator.obfuscate(jsCode, {
+        compact: true,
+        controlFlowFlattening: true,
+        deadCodeInjection: true,
+        stringArray: true,
+        stringArrayRotate: true,
+        stringArrayShuffle: true,
+        seed: Math.abs(mapping.wasmConstants.seed),
+        selfDefending: true,
+    });
+
+    return obfuscationResult.getObfuscatedCode();
+}
+
+async function ensureLatestMapping() {
+    const now = Date.now();
+    if ((now - lastMappingTime > MAPPING_ROTATION_INTERVAL || activeMappings.length === 0) && !isCompilingMapping) {
+        isCompilingMapping = true;
+        try {
+            const mapping = generateSessionMapping();
+            const polymorphicJs = await compilePolymorphicJs(mapping);
+            const polymorphicWasm = DynamicWasmGenerator.generate(mapping.wasmConstants);
+
+            mapping.jsBuffer = Buffer.from(polymorphicJs, 'utf8');
+            mapping.wasmBuffer = polymorphicWasm;
+            mapping.timestamp = now;
+
+            activeMappings.unshift(mapping);
+            if (activeMappings.length > 5) {
+                activeMappings.pop();
+            }
+            lastMappingTime = now;
+
+            try {
+                await store.set('active-polymorphic-mappings', activeMappings.map(m => ({
+                    headers: m.headers,
+                    keys: m.keys
+                })));
+            } catch (e) {
+                // Ignore
+            }
+        } finally {
+            isCompilingMapping = false;
+        }
+    }
+}
+
+function getActiveMappingForRequest(headers) {
+    if (!headers) return null;
+    for (const mapping of activeMappings) {
+        const headerName = mapping.headers['x-device-fingerprint'].toLowerCase();
+        if (headers[headerName]) {
+            return mapping;
+        }
+    }
+    return null;
+}
+
+
 
 const base64UrlEncode = (buf) => buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
 const base64UrlDecode = (str) => {
@@ -26,6 +154,31 @@ const base64UrlDecode = (str) => {
 };
 
 export function generateStatelessTicket(payload) {
+  let ed25519Key = process.env.ED25519_PRIVATE_KEY;
+  if (ed25519Key) {
+    try {
+      ed25519Key = ed25519Key.replace(/\\n/g, '\n');
+      const serialized = JSON.stringify(payload);
+      let signature;
+      try {
+        signature = crypto.sign(undefined, Buffer.from(serialized), {
+          key: ed25519Key,
+          format: 'pem',
+          type: 'pkcs8'
+        });
+      } catch (signErr) {
+        signature = crypto.sign(null, Buffer.from(serialized), {
+          key: ed25519Key,
+          format: 'pem',
+          type: 'pkcs8'
+        });
+      }
+      return `ed25519.${base64UrlEncode(Buffer.from(serialized))}.${base64UrlEncode(signature)}`;
+    } catch (e) {
+      console.error('[Fingerprint] Ed25519 signing failed, falling back to symmetric:', e.message);
+    }
+  }
+
   const secret = getPowSecret();
   const key = crypto.createHash('sha256').update(secret).digest();
   const iv = crypto.randomBytes(16);
@@ -39,6 +192,40 @@ export function generateStatelessTicket(payload) {
 
 export function parseStatelessTicket(ticket) {
   try {
+    if (ticket.startsWith('ed25519.')) {
+      const parts = ticket.split('.');
+      if (parts.length !== 3) return null;
+      const payloadBuffer = base64UrlDecode(parts[1]);
+      const signatureBuffer = base64UrlDecode(parts[2]);
+      let publicKey = process.env.ED25519_PUBLIC_KEY;
+      if (!publicKey) {
+        console.error('[Fingerprint] ED25519_PUBLIC_KEY is not defined in environment.');
+        return null;
+      }
+      publicKey = publicKey.replace(/\\n/g, '\n');
+      
+      let isVerified = false;
+      try {
+        isVerified = crypto.verify(undefined, payloadBuffer, {
+          key: publicKey,
+          format: 'pem',
+          type: 'spki'
+        }, signatureBuffer);
+      } catch (verifyErr) {
+        try {
+          isVerified = crypto.verify(null, payloadBuffer, {
+            key: publicKey,
+            format: 'pem',
+            type: 'spki'
+          }, signatureBuffer);
+        } catch (verifyErr2) {
+          isVerified = false;
+        }
+      }
+      if (!isVerified) return null;
+      return JSON.parse(payloadBuffer.toString('utf8'));
+    }
+
     const parts = ticket.split('.');
     if (parts.length !== 3) return null;
     
@@ -97,26 +284,6 @@ async function checkChallengeRateLimit(clientIp) {
   return true;
 }
 
-/**
- * @private
- * Deep merges two objects. The `source` object's properties overwrite the `target`'s.
- * @param {object} target - The target object.
- * @param {object} source - The source object.
- * @returns {object} The merged object.
- */
-function deepMerge(target, source) {
-    const output = { ...target };
-    if (target && typeof target === 'object' && source && typeof source === 'object') {
-        Object.keys(source).forEach(key => {
-            if (source[key] && typeof source[key] === 'object' && key in target) {
-                output[key] = deepMerge(target[key], source[key]);
-            } else {
-                output[key] = source[key];
-            }
-        });
-    }
-    return output;
-}
 
 const securityProfiles = {
     /**
@@ -451,44 +618,6 @@ function getTlsFingerprint(context) {
     return { ja3, ja4 };
 }
 
-/**
- * Analyses a raw JA3 string.
- * Format: "TLSVersion,Ciphers,Extensions,EllipticCurves,EllipticCurveFormats"
- * @param {string} ja3String
- * @returns {object|null}
- */
-export function parseJa3(ja3String) {
-    if (!ja3String || typeof ja3String !== 'string') {
-        return null;
-    }
-    const parts = ja3String.split(',');
-    if (parts.length !== 5) {
-        return null;
-    }
-    return {
-        tlsVersion: parseInt(parts[0], 10),
-        ciphers: parts[1] !== '' ? parts[1].split('-').map(Number) : [],
-        extensions: parts[2] !== '' ? parts[2].split('-').map(Number) : [],
-        curves: parts[3] !== '' ? parts[3].split('-').map(Number) : [],
-        points: parts[4] !== '' ? parts[4].split('-').map(Number) : []
-    };
-}
-
-/**
- * Creates a stable hash based on device characteristics, independent of the IP.
- * This is our "level 2 fingerprint".
- * @param {object} context - The request context.
- * @returns {string} A hash representing the device.
- */
-function getHeaderSignature(context) {
-    if (!context.rawHeaders) return '';
-    const headerKeys = [];
-    for (let i = 0; i < context.rawHeaders.length; i += 2) {
-        headerKeys.push(context.rawHeaders[i]);
-    }
-    return cyrb53(headerKeys.sort().join(','));
-}
-
 /**
  * Returns the client-side fingerprint if available, otherwise computes a server-side hash.
  * This aligns with the test's expectation for prioritization.
@@ -624,79 +753,6 @@ function hasGrease(values) {
     return values.some(val => GREASE_VALUES.includes(val));
 }
 
-// Fonctions utilitaires
-function parseUserAgent(ua) {
-    // Parser basique du User-Agent
-    const result = {};
-
-    // Détection du navigateur
-    if (ua.includes('Chrome') && !ua.includes('Edg')) {
-        result.browser = 'Chrome';
-        const match = ua.match(/Chrome\/(\d+)/);
-        if (match) result.browser += `/${match[1]}`;
-    } else if (ua.includes('Firefox')) {
-        result.browser = 'Firefox';
-        const match = ua.match(/Firefox\/(\d+)/);
-        if (match) result.browser += `/${match[1]}`;
-    } else if (ua.includes('Safari') && !ua.includes('Chrome')) {
-        result.browser = 'Safari';
-        const match = ua.match(/Version\/(\d+)/);
-        if (match) result.browser += `/${match[1]}`;
-    } else if (ua.includes('Edg')) {
-        result.browser = 'Edge';
-        const match = ua.match(/Edg\/(\d+)/);
-        if (match) result.browser += `/${match[1]}`;
-    }
-
-    // Détection de l'OS
-    if (ua.includes('Windows NT 10.0')) result.os = 'Windows 10';
-    else if (ua.includes('Windows NT 6.1')) result.os = 'Windows 7';
-    else if (ua.includes('Mac OS X')) result.os = 'macOS';
-    else if (ua.includes('Linux') && !ua.includes('Android')) result.os = 'Linux';
-    else if (ua.includes('Android')) result.os = 'Android';
-    else if (ua.includes('iPhone') || ua.includes('iPad')) result.os = 'iOS';
-
-    // Détection du type d'appareil
-    if (ua.includes('Mobile')) result.device = 'mobile';
-    else if (ua.includes('Tablet')) result.device = 'tablet';
-    else result.device = 'desktop';
-
-    return result;
-}
-
-function normalizeReferer(referer) {
-    try {
-        const url = new URL(referer);
-        return `${url.protocol}//${url.hostname}`;
-    } catch {
-        return referer;
-    }
-}
-
-function isPrivateIp(ip) {
-    // Vérifier si l'IP est privée
-    const parts = ip.split('.');
-    if (parts.length !== 4) return false;
-    const first = parseInt(parts[0]);
-    return (first === 10) || (first === 172 && parseInt(parts[1]) >= 16 && parseInt(parts[1]) <= 31) || (first === 192 && parseInt(parts[1]) === 168);
-}
-
-function hashNetwork(ip, prefix = 24) {
-    // Hash du réseau (masque /24 ou /16)
-    const parts = ip.split('.');
-    if (parts.length !== 4) return null;
-    const maskBytes = prefix / 8;
-    const network = parts.slice(0, maskBytes).join('.');
-    // Hash simple
-    let hash = 0;
-    for (let i = 0; i < network.length; i++) {
-        const char = network.charCodeAt(i);
-        hash = ((hash << 5) - hash) + char;
-        hash = hash & hash;
-    }
-    return hash.toString(16);
-}
-
 /**
  * Generates the HTML content for a TSP (Traveling Salesperson Problem) challenge.
  * @param {string} nonce - Unique nonce for the challenge.
@@ -948,26 +1004,68 @@ export const verifyMemoryPoW = (nonce, solution, difficulty = 16, clientSecret =
   }
   return finalHash === parseInt(solution, 10);
 };
-export const isTicketValid = async (ip, ticket, deviceId = '', deviceHash = '', allowCrossNetworkRoaming = false) => {
-  // Input validation: ensure the ticket is a non-empty string with the correct format.
-  if (typeof ticket !== 'string' || ticket.length === 0) return false;
 
+export async function verifySpacePoW(nonce, solution, queries, seed, clientSecret) {
+    let combined = [];
+    for (let i = 0; i < queries.length; i++) {
+        const idx = queries[i];
+        const block = generateBlock(seed, idx);
+        combined.push(...block);
+    }
+
+    const assoc = await store.get(`coop-assoc:${nonce}`);
+    if (assoc) {
+        const peerSeed = assoc.peerSeed;
+        const peerBlockIdx = assoc.peerBlockIdx;
+        if (peerSeed !== undefined && peerBlockIdx !== undefined) {
+            const peerBlock = generateBlock(peerSeed, peerBlockIdx);
+            combined.push(...peerBlock);
+        }
+        await store.delete(`coop-assoc:${nonce}`);
+    }
+
+    const nonceBytes = Buffer.from(nonce + ":" + clientSecret, "utf8");
+    const finalBlock = Buffer.concat([Buffer.from(combined), nonceBytes]);
+
+    const hash = crypto.createHash("sha256").update(finalBlock).digest("hex");
+    return hash === solution;
+}
+
+function generateBlock(seed, blockIndex, blockSize = 1024) {
+  const block = new Uint8Array(blockSize);
+  let h = cyrb53(seed + ":" + blockIndex);
+  for (let i = 0; i < blockSize; i++) {
+    h = Math.imul(h ^ i, 1597334677);
+    block[i] = h & 0xff;
+  }
+  return block;
+}
+
+export const isTicketValid = async (ip, ticket, deviceId = '', deviceHash = '', allowCrossNetworkRoaming = false, zkpProof = '') => {
+  // Input validation: ensure the ticket is a non-empty string with the correct format.
+    if (typeof ticket !== 'string' || ticket.length === 0) return false;
   // 1. Resolve stateless ticket first (zero database I/O cost)
   const statelessData = parseStatelessTicket(ticket);
   if (statelessData) {
     const { expiry, originalIp, deviceId: storedDeviceId, deviceHash: storedDeviceHash } = statelessData;
-
     if (!expiry || Date.now() > expiry) {
       return false;
     }
-
+    if (storedDeviceHash && storedDeviceHash.startsWith('zkp:')) {
+        const expectedY = storedDeviceHash.split(':')[1];
+        if (zkpProof) {
+            const [y, t, s] = zkpProof.split(':');
+            if (y === expectedY && verifyZkpProof(y, t, s)) {
+                return true;
+            }
+        }
+        return false;
+    }
     if (ip === originalIp) return true;
     const currentSubnet = getIpSubnet(ip);
     const originalSubnet = getIpSubnet(originalIp);
     if (currentSubnet && originalSubnet && currentSubnet === originalSubnet) return true;
-
     if (!allowCrossNetworkRoaming) return false;
-
     return !!(deviceId && deviceId === storedDeviceId && deviceHash && deviceHash === storedDeviceHash);
   }
 
@@ -980,6 +1078,16 @@ export const isTicketValid = async (ip, ticket, deviceId = '', deviceHash = '',
       await store.delete(`ticket:${ticket}`);
       return false;
     }
+    if (storedDeviceHash && storedDeviceHash.startsWith('zkp:')) {
+        const expectedY = storedDeviceHash.split(':')[1];
+        if (zkpProof) {
+            const [y, t, s] = zkpProof.split(':');
+            if (y === expectedY && verifyZkpProof(y, t, s)) {
+                return true;
+            }
+        }
+        return false;
+    }
 
     if (ip === originalIp) return true;
     const currentSubnet = getIpSubnet(ip);
@@ -1087,6 +1195,80 @@ function getHeaderAnomalies(context) {
   };
 }
 
+export async function generateSpaceChallenge(clientIp, nonce, suspicionFactor, originalUrl, securityConfig) {
+  const sizeMb = securityConfig?.pospace?.sizeMb || 100;
+  const numQueries = securityConfig?.pospace?.numQueries || 10;
+  
+  const queries = [];
+  const maxBlocks = sizeMb * 1024;
+  while (queries.length < numQueries) {
+    const idx = Math.floor(Math.random() * maxBlocks);
+    if (!queries.includes(idx)) {
+      queries.push(idx);
+    }
+  }
+  
+  const challenge = {
+    type: "pospace",
+    nonce: nonce,
+    sizeMb,
+    queries,
+    path: originalUrl
+  };
+
+  const peer = await findPeerInSubnet(clientIp, nonce);
+  if (peer) {
+    challenge.peerId = peer.nodeId;
+    challenge.peerBlockIdx = Math.floor(Math.random() * maxBlocks);
+
+    await store.set(`coop-assoc:${nonce}`, {
+      peerNodeId: peer.nodeId,
+      peerSeed: peer.seed,
+      peerBlockIdx: challenge.peerBlockIdx
+    }, 120);
+  }
+
+  return challenge;
+}
+
+function generateSpaceChallengePage(challengeDetails, clientSecret, securityConfig) {
+  const { nonce, sizeMb, queries, path } = challengeDetails;
+  const solverCode = getPowSolverCode();
+  
+  const challengeScript = `
+    async function solve() {
+      const nonce = ${JSON.stringify(nonce)};
+      const path = ${JSON.stringify(path)};
+      const clientSecret = ${JSON.stringify(clientSecret)};
+      const queries = ${JSON.stringify(queries)};
+      const sizeMb = ${sizeMb};
+      
+      document.getElementById('loader').innerText = '⚙️ Checking persistent local storage...';
+      await new Promise(r => setTimeout(r, 10));
+      
+      try {
+          await window.initializeSpace(nonce + ":" + clientSecret, sizeMb);
+          document.getElementById('loader').innerText = '⚙️ Generating Proof of Space...';
+          const hash = await window.solveSpaceChallenge(nonce + ":" + clientSecret, queries, nonce, clientSecret);
+          
+          window.location.href = path + "?pow_type=pospace&pow_nonce=" + nonce + "&pow_solution_space=" + hash;
+      } catch(e) {
+          document.getElementById('loader').innerText = "Error initializing local storage: " + e.message;
+      }
+    }
+    solve();
+  `;
+  
+  return `<html><head><title>Security Check</title></head>
+  <body style="font-family:sans-serif; text-align:center; padding-top:50px;">
+    <h1>Security Check (Level 2)</h1>
+    <p>We are verifying your storage allocation. This may take a few seconds on first load.</p>
+    <div id="loader" style="margin:20px;">⚙️ Initializing storage space...</div>
+    <script>${solverCode}</script>
+    <script>${challengeScript}</script>
+  </body></html>`;
+}
+
 /**
  * Checks for submitted honeypot fields to detect bots.
  * @param {object} context - The request context.
@@ -1190,6 +1372,20 @@ const injectionPatterns = {
     traversal: /(\.\.\/|\.\.\\)/,
     // Remote Command Execution (RCE)
     rce: /`.*`|(^|[\n;&|]\s*)(ping|ls|whoami|cat|rm|ncat|nc|bash|sh|powershell|cmd)\b/i,
+    // Server-Side Request Forgery (SSRF) - Detects local/private IPs and hosts
+    ssrf: /((?:https?:\/\/)?(?:127\.\d+\.\d+\.\d+\b|169\.254\.169\.254\b|10\.\d+\.\d+\.\d+\b|172\.(?:1[6-9]|2\d|3[01])\.\d+\.\d+\b|192\.168\.\d+\.\d+\b|localhost\b|0\.0\.0\.0\b|\[[0:]+1\](?=\W|$)))/i,
+    // Carriage Return Line Feed (CRLF) Injection / HTTP Response Splitting
+    crlf: /[\r\n]|%0[ad]/i,
+    // Cross-Site Scripting (XSS) - Fast native regex fallback
+    xss: /(<script|javascript:|on\w+\s*=|alert\s*\(|confirm\s*\(|prompt\s*\(|<img\s+src[^>]+onerror|<iframe)/i,
+    // Open Redirect - Basic detection of external protocol/URLs
+    openRedirect: /^(https?:)?\/\/(?![^\/]*?(localhost|127\.0\.0\.1))[^\s\/]+/i,
+    // Local/Remote File Inclusion (LFI/RFI)
+    lfi: /(?:etc\/passwd|win\.ini|boot\.ini|php:\/\/filter|data:\/\/|zip:\/\/)/i,
+    // Shellshock (CVE-2014-6271)
+    shellshock: /\(\)\s*\{\s*:\s*;\s*\}\s*/i,
+    // NoSQL Injection (MongoDB query operators)
+    nosql: /\$(?:eq|ne|gt|gte|lt|lte|in|nin|and|or|nor|not|expr|jsonSchema|mod|regex|text|where|elemMatch)/i
 };
 
 /**
@@ -1469,11 +1665,27 @@ function getCrossLayerInconsistency(context) {
         const clientScreenHash = clientFpMap.get('scr');
         const viewportWidth = context.headers['sec-ch-viewport-width'];
         if (clientScreenHash && viewportWidth) {
-            const clientWidth = clientFpMap.get('scr')?.split('x')[0];
-            // Ce n'est pas une comparaison directe, mais un bot pourrait oublier de forger les CH.
-            // Si le client FP a une largeur et que le CH en a une autre, c'est suspect.
-            // Cette vérification est basique et pourrait être affinée.
-            if (clientWidth && clientWidth !== viewportWidth) {
+                  const viewportWidthInt = parseInt(viewportWidth, 10);
+                  let matchedScreenWidth = null;
+                  const commonWidths = [320, 360, 375, 390, 412, 414, 768, 1024, 1280, 1366, 1440, 1536, 1600, 1920, 2560, 3840];
+                  const commonHeights = [480, 568, 640, 667, 736, 800, 812, 844, 896, 900, 1024, 1080, 1200, 1440, 1600, 2160];
+                  const commonDepths = [24, 30, 32];
+
+                  for (const w of commonWidths) {
+                      for (const h of commonHeights) {
+                          for (const d of commonDepths) {
+                              const candidate = `${w}x${h}_${d}`;
+                              if (clientScreenHash === String(cyrb53(candidate))) {
+                                  matchedScreenWidth = w;
+                                  break;
+                              }
+                          }
+                          if (matchedScreenWidth !== null) break;
+                      }
+                      if (matchedScreenWidth !== null) break;
+                  }
+
+                  if (matchedScreenWidth !== null && viewportWidthInt > matchedScreenWidth) {
                 score += 20;
             }
         }
@@ -1484,10 +1696,17 @@ function getCrossLayerInconsistency(context) {
         const clientGpuHash = clientFpMap.get('gpu');
         const ja3 = getTlsFingerprint(context)?.ja3;
         if (clientGpuHash && ja3) {
-            // Une vraie implémentation nécessiterait une base de données mappant les GPU connus
-            // à des signatures JA3 typiques. Pour l'exemple, on simule une pénalité si les deux
-            // sont présents mais que le score de cohérence global est déjà faible.
-            // (Cette logique est déjà en partie couverte par le `consistencyScore`).
+            let expectedBrowsers = tlsFingerprintDb[ja3];
+            if (expectedBrowsers) {
+                if (!Array.isArray(expectedBrowsers)) {
+                    expectedBrowsers = [expectedBrowsers];
+                }
+                const nonBrowserLibraries = ['Python', 'Go', 'Java', 'curl'];
+                const isLibrary = expectedBrowsers.some(lib => nonBrowserLibraries.includes(lib));
+                if (isLibrary) {
+                    score += 30;
+                }
+            }
         }
 
         return { crossLayerInconsistencyScore: Math.min(100, score) };
@@ -2345,11 +2564,20 @@ export const configureStore = (externalStore) => {
 async function resolveRequestIdentity(context, securityConfig = {}) {
   const existingDeviceId = context.cookies?.device_id;
   const currentDeviceHash = getCompositeDeviceHash(context); // Use the composite hash for consistency checks
-  let deviceId = existingDeviceId;
+    const tlsSessionId = getTlsSessionId(context);
+    let deviceId = existingDeviceId;
   let consistencyScore = 1.0; // 1.0 = perfectly consistent
   let deviceData = null;
   let newCookie = null;
-  if (deviceId) {
+
+    if (!deviceId && tlsSessionId) {
+        const resumedDeviceId = await store.get(`tls-session:${tlsSessionId}`);
+        if (resumedDeviceId) {
+            deviceId = resumedDeviceId;
+        }
+    }
+
+    if (deviceId) {
     deviceData = await store.get(`device:${deviceId}`);
   }
 
@@ -2392,6 +2620,9 @@ async function resolveRequestIdentity(context, securityConfig = {}) {
     // The write will happen in getSuspicionVector after all modifications.
   }
 
+    if (deviceId && tlsSessionId) {
+        await store.set(`tls-session:${tlsSessionId}`, deviceId, 3600); // Bind TLS session for 1 hour
+    }
   return { deviceId, deviceData, consistencyScore, newCookie };
 }
 
@@ -2884,12 +3115,33 @@ function parseGraphQLQuery(body) {
 export class FingerprintEngine {
   constructor(securityConfig) {
     const isProduction = process.env.NODE_ENV === 'production';
-    this.securityConfig = securityConfig;
+    
+    // Dynamically bind Ed25519 keys if passed via config
+    if (securityConfig && securityConfig.ed25519_private_key) {
+      process.env.ED25519_PRIVATE_KEY = securityConfig.ed25519_private_key;
+    }
+    if (securityConfig && securityConfig.ed25519_public_key) {
+      process.env.ED25519_PUBLIC_KEY = securityConfig.ed25519_public_key;
+    }
+
+    let finalConfig = securityConfig;
+    if (securityConfig && securityConfig.autotuning && securityConfig.autotuning.savePath) {
+      const sPath = securityConfig.autotuning.savePath;
+      if (existsSync(sPath)) {
+        try {
+          const savedConfig = JSON.parse(readFileSync(sPath, 'utf-8'));
+          finalConfig = deepMerge(securityConfig, savedConfig);
+        } catch (e) {
+          console.warn(`[Fingerprint] Failed to auto-load optimized config from ${sPath}:`, e.message);
+        }
+      }
+    }
+    this.securityConfig = finalConfig;
     this.isProduction = isProduction;
     this._allowlist = this._buildAllowlist();
-    this._validateConfig(securityConfig); // Validate the configuration
-    this.verbose = securityConfig.verbose || false;
-    this.dryRun = securityConfig.dryRun || false;
+    this._validateConfig(finalConfig); // Validate the configuration
+    this.verbose = finalConfig.verbose || false;
+    this.dryRun = finalConfig.dryRun || false;
   }
 
   /**
@@ -2910,7 +3162,8 @@ export class FingerprintEngine {
       'autotuning', 'enableUsefulWork', 'usefulWorkConfigPath', 'challengeNewDevices', 'graphql_operation_allowlist', 'dryRun',
       'trustedProxies',
       'wasm',
-      'similarityThreshold'
+      'similarityThreshold',
+      'ed25519_private_key', 'ed25519_public_key'
     ]);
 
     // 1. Check for essential keys
@@ -3213,8 +3466,18 @@ export class FingerprintEngine {
   async processRequest(requestContext) {
       sanitizeProxyHeaders(requestContext, this.securityConfig);
 
-      const { clientIp = "unknown", path, cookies, query, isStatic, graphqlOperationType, graphqlOperationName } = requestContext;
-    const { weights, thresholds, logger, onDeviceCompromised } = this.securityConfig;
+      const { clientIp = "unknown", path, cookies = {}, query = {}, isStatic, graphqlOperationType, graphqlOperationName } = requestContext;
+
+      if (query.coop_op) {
+          const result = await handleCooperativeRequest(query, clientIp);
+          return {
+              action: 'challenge',
+              status: 200,
+              body: result
+          };
+      }
+
+      const { weights, thresholds, logger, onDeviceCompromised } = this.securityConfig;
     
     this._log('Processing request', { clientIp, path, isStatic });
     
@@ -3293,6 +3556,13 @@ export class FingerprintEngine {
             decision.action = 'next';
             delete decision.status;
             delete decision.body;
+
+            if (requestContext._newCookies) {
+                const deviceCookie = requestContext._newCookies.find(c => c.name === 'device_id');
+                if (deviceCookie) {
+                    decision.newCookieForResponse = deviceCookie;
+                }
+            }
         }
         return decision;
     }
@@ -3332,8 +3602,8 @@ export class FingerprintEngine {
     // --- NOUVELLE LOGIQUE DE PRIORITÉ ---
     // Si une solution de challenge est soumise, on la traite en priorité absolue,
     // avant même de recalculer le score de suspicion.
-    const { pow_type, pow_solution, pow_solution_cpu, pow_solution_mem, pow_fp, pow_solution_population, pow_solution_work_result, pow_problem_id } = query;
-    if (pow_nonce && (pow_solution || pow_solution_cpu)) { // Vérifie pow_solution pour la compatibilité ascendante
+    const { pow_type, pow_solution, pow_solution_cpu, pow_solution_mem, pow_fp, pow_solution_population, pow_solution_work_result, pow_problem_id, pow_solution_space } = query;
+    if (pow_nonce && (pow_solution || pow_solution_cpu || pow_solution_space)) { // Vérifie pow_solution pour la compatibilité ascendante
         this._log('Challenge solution submitted', { pow_type, pow_nonce });
 
         // On doit calculer le score de suspicion *avant* de valider le ticket,
@@ -3411,13 +3681,13 @@ export class FingerprintEngine {
             } else {
                 optimalTtl = determineOptimalTicketTtl(preliminaryScore);
                 finalTtl = isProbationary ? probationaryTtl : optimalTtl;
-                this._log('Challenge context found, verifying solution', { optimalTtl, finalTtl });
+                this._log('Challenge context found, verifying solution', {optimalTtl, finalTtl});
 
                 if ((pow_type === "cpu_target" || !pow_type) && (pow_solution_cpu || pow_solution)) { // !pow_type pour compatibilité
                     const cpuSolution = pow_solution_cpu || pow_solution;
                     ticket = await verifyCpuTargetPoWAndGenerateTicket(clientIp, finalTtl, pow_nonce, cpuSolution, challengeContext, deviceId, currentDeviceHash);
                     isValid = ticket !== null;
-                    this._log('CPU target challenge verification', { isValid });
+                    this._log('CPU target challenge verification', {isValid});
                 } else if (pow_type === "cpu_mem" && pow_solution_cpu && pow_solution_mem) {
                     const cpuTicket = await verifyCpuTargetPoWAndGenerateTicket(clientIp, finalTtl, pow_nonce, pow_solution_cpu, challengeContext, deviceId, currentDeviceHash);
                     const isMemValid = verifyMemoryPoW(pow_nonce, pow_solution_mem, challengeContext.memDifficulty, challengeContext.clientSecret); // Memory PoW is independent of fingerprint
@@ -3428,6 +3698,18 @@ export class FingerprintEngine {
                         memValid: isMemValid,
                         isValid
                     });
+                } else if (pow_type === "pospace" && pow_solution_space) {
+                    const isSpaceValid = await verifySpacePoW(pow_nonce, pow_solution_space, challengeContext.queries, pow_nonce + ":" + challengeContext.clientSecret, challengeContext.clientSecret);
+                    isValid = isSpaceValid;
+                    if (isValid) {
+                        const ttl = finalTtl || 3600000;
+                        ticket = generateStatelessTicket({
+                            expiry: Date.now() + ttl,
+                            originalIp: clientIp,
+                            deviceId,
+                            deviceHash: currentDeviceHash
+                        });
+                    }
                 }
             }
         } else {
@@ -3464,6 +3746,7 @@ export class FingerprintEngine {
             finalSearchParams.delete('pow_solution_cpu');
             finalSearchParams.delete('pow_solution_mem');
             finalSearchParams.delete('pow_fp'); // Ne pas oublier de nettoyer le fingerprint
+            finalSearchParams.delete('pow_solution_space');
             // NOUVEAU: Nettoyer aussi les paramètres des challenges d'optimisation et de travail utile
             finalSearchParams.delete('pow_solution_population');
             finalSearchParams.delete('pow_solution_work_result');
@@ -3501,6 +3784,12 @@ export class FingerprintEngine {
                     decision.action = 'next';
                     delete decision.status;
                     delete decision.body;
+                    if (requestContext._newCookies) {
+                        const deviceCookie = requestContext._newCookies.find(c => c.name === 'device_id');
+                        if (deviceCookie) {
+                            decision.newCookieForResponse = deviceCookie;
+                        }
+                    }
                 }
                 return decision;
             }
@@ -3593,6 +3882,12 @@ export class FingerprintEngine {
             decision.action = 'next';
             delete decision.status;
             delete decision.body;
+            if (requestContext._newCookies) {
+                const deviceCookie = requestContext._newCookies.find(c => c.name === 'device_id');
+                if (deviceCookie) {
+                    decision.newCookieForResponse = deviceCookie;
+                }
+            }
         }
         return decision;
     }
@@ -3640,6 +3935,12 @@ export class FingerprintEngine {
           decision.action = 'next';
           delete decision.status;
           delete decision.body;
+          if (requestContext._newCookies) {
+              const deviceCookie = requestContext._newCookies.find(c => c.name === 'device_id');
+              if (deviceCookie) {
+                  decision.newCookieForResponse = deviceCookie;
+              }
+          }
       }
       return decision;
     }
@@ -3664,6 +3965,12 @@ export class FingerprintEngine {
             decision.action = 'next';
             delete decision.status;
             delete decision.body;
+            if (requestContext._newCookies) {
+                const deviceCookie = requestContext._newCookies.find(c => c.name === 'device_id');
+                if (deviceCookie) {
+                    decision.newCookieForResponse = deviceCookie;
+                }
+            }
         }
         return decision;
     }
@@ -3673,7 +3980,8 @@ export class FingerprintEngine {
     // 1. La requête est suspecte ET il n'y a pas de ticket valide.
     // OU
     // 2. La requête est *très* suspecte (dépasse le seuil 'high'), ce qui annule la validité du ticket actuel.
-    const hasValidTicket = await isTicketValid(clientIp, powCookie, deviceId, currentDeviceHash, allowRoaming);
+    const zkpProof = requestContext.headers['x-zkp-proof'] || query.pow_zkp || '';
+    const hasValidTicket = await isTicketValid(clientIp, powCookie, deviceId, currentDeviceHash, allowRoaming, zkpProof);
     const mustReChallenge = isSuspiciousHigh && hasValidTicket;
 
     if (isSuspicious && (!hasValidTicket || mustReChallenge)) {
@@ -3698,6 +4006,12 @@ export class FingerprintEngine {
                 decision.action = 'next';
                 delete decision.status;
                 delete decision.body;
+                if (requestContext._newCookies) {
+                    const deviceCookie = requestContext._newCookies.find(c => c.name === 'device_id');
+                    if (deviceCookie) {
+                        decision.newCookieForResponse = deviceCookie;
+                    }
+                }
             }
             return decision;
         }
@@ -3707,6 +4021,7 @@ export class FingerprintEngine {
         // --- SELECTION AND SENDING OF THE APPROPRIATE CHALLENGE ---
         const nonce = crypto.randomBytes(16).toString("hex");
         const clientSecret = crypto.randomBytes(16).toString("hex");
+            const isApi = requestContext.rawReq && this.securityConfig?.isApiRequest?.(requestContext.rawReq);
 
         // Pour les scores élevés, on choisit aléatoirement entre un challenge de travail utile et un PoW classique.
         // Cela rend l'automatisation plus difficile pour un attaquant.
@@ -3749,7 +4064,6 @@ export class FingerprintEngine {
         }
 
         if (isSuspicious && usefulWorkDispatched) {
-            const isApi = requestContext.rawReq && this.securityConfig?.isApiRequest?.(requestContext.rawReq);
             if (isApi) {
                 return { action: 'challenge', score: finalScore, vector: suspicionVector, status: 404, body: challengePayload };
             } else {
@@ -3767,6 +4081,33 @@ export class FingerprintEngine {
                     delete decision.status;
                     return decision;
                 }
+            if (this.securityConfig.enableProofOfSpace) {
+                const spaceChallenge = await generateSpaceChallenge(clientIp, nonce, suspicionFactor, path, this.securityConfig);
+                const clientSecret = crypto.randomBytes(16).toString("hex");
+                await store.set(`secret:${nonce}`, {
+                    clientSecret,
+                    suspicionScore: finalScore,
+                    queries: spaceChallenge.queries,
+                    sizeMb: spaceChallenge.sizeMb,
+                    originalPath: path,
+                }, this.securityConfig.challengeTtl || 300);
+                
+                if (isApi) {
+                    decision.body = {
+                        challenge: {
+                            type: 'pospace',
+                            nonce: nonce,
+                            clientSecret,
+                            queries: spaceChallenge.queries,
+                            sizeMb: spaceChallenge.sizeMb,
+                        }
+                    };
+                } else {
+                    const page = generateSpaceChallengePage(spaceChallenge, clientSecret, this.securityConfig);
+                    decision.body = page;
+                }
+                return decision;
+            }
             // Generate some trap URLs to embed in the challenge page.
             // These links are visually hidden but present in the DOM to trap bots.
             const trapUrls = Array.from({ length: 3 }, () => generateTrapUrl(nonce)); // Génère les URL
@@ -3825,9 +4166,6 @@ export class FingerprintEngine {
                 logger({ type: 'challenge_issued', deviceId: cookies?.device_id, score: finalScore, timestamp: Date.now(), vector: suspicionVector });
             }
 
-            // Check if the request is an API request to return a JSON challenge
-            const isApi = requestContext.rawReq && this.securityConfig?.isApiRequest?.(requestContext.rawReq);
-
             if (isApi) {
                 // For API clients, send a JSON response with challenge details.
                 const challengePayload = {
@@ -3861,8 +4199,14 @@ export class FingerprintEngine {
     if (logger) {
         logger({ type: 'request_passed', deviceId: cookies?.device_id, score: finalScore, timestamp: Date.now(), vector: suspicionVector });
     }
-
-    return { action: 'next', score: finalScore, vector: suspicionVector, intendedAction: 'next' };
+      const response = { action: 'next', score: finalScore, vector: suspicionVector, intendedAction: 'next' };
+      if (requestContext._newCookies) {
+          const deviceCookie = requestContext._newCookies.find(c => c.name === 'device_id');
+          if (deviceCookie) {
+              response.newCookieForResponse = deviceCookie;
+          }
+      }
+      return response;
   }
 
   /**
@@ -3919,6 +4263,117 @@ const staticExtensions = new RegExp(
 );
 const isStaticResource = (path) => staticExtensions.test(path);
 
+export async function registerCooperativeNode(clientIp, nodeId, seed) {
+    const subnet = getIpSubnet(clientIp);
+    if (!subnet) return;
+
+    const key = `coop-pospace:subnet:${subnet}`;
+    const nodes = (await store.get(key)) || {};
+    const now = Math.floor(Date.now() / 1000);
+
+    // Clean up expired nodes (older than 120 seconds)
+    const cleanedNodes = {};
+    for (const [id, node] of Object.entries(nodes)) {
+        if (now - node.timestamp < 120) {
+            cleanedNodes[id] = node;
+        }
+    }
+
+    cleanedNodes[nodeId] = {
+        nodeId,
+        seed,
+        timestamp: now
+    };
+
+    await store.set(key, cleanedNodes, 120);
+}
+
+export async function findPeerInSubnet(clientIp, excludeNodeId) {
+    const subnet = getIpSubnet(clientIp);
+    if (!subnet) return null;
+
+    const key = `coop-pospace:subnet:${subnet}`;
+    const nodes = (await store.get(key)) || {};
+    const now = Math.floor(Date.now() / 1000);
+
+    const activePeers = [];
+    for (const [id, node] of Object.entries(nodes)) {
+        if (id !== excludeNodeId && now - node.timestamp < 120) {
+            activePeers.push(node);
+        }
+    }
+
+    if (activePeers.length === 0) return null;
+
+    // Select a random peer
+    const randomIndex = Math.floor(Math.random() * activePeers.length);
+    return activePeers[randomIndex];
+}
+
+export async function handleCooperativeRequest(params, clientIp = '127.0.0.1') {
+    const op = params.coop_op;
+    if (!op) return null;
+
+    const nodeId = params.node_id || '';
+    if (!nodeId) {
+        return { error: 'Missing node_id' };
+    }
+
+    switch (op) {
+        case 'register':
+            const seed = params.seed || '';
+            await registerCooperativeNode(clientIp, nodeId, seed);
+            return { status: 'registered' };
+
+        case 'request_peer_block':
+            const peerId = params.peer_id || '';
+            const blockIdx = parseInt(params.block_idx || '0', 10);
+            const requestId = params.req_id || '';
+            if (!peerId || !requestId) {
+                return { error: 'Invalid parameters' };
+            }
+
+            const queueKey = `coop-mailbox:queue:${peerId}`;
+            const requests = (await store.get(queueKey)) || [];
+            requests.push({
+                req_id: requestId,
+                requester_id: nodeId,
+                block_idx: blockIdx
+            });
+            await store.set(queueKey, requests, 30);
+            return { status: 'queued' };
+
+        case 'poll_requests':
+            const pollQueueKey = `coop-mailbox:queue:${nodeId}`;
+            const polledRequests = (await store.get(pollQueueKey)) || [];
+            await store.delete(pollQueueKey);
+            return { requests: polledRequests };
+
+        case 'respond_block':
+            const requesterId = params.requester_id || '';
+            const respondRequestId = params.req_id || '';
+            const blockData = params.block_data || '';
+            if (!requesterId || !respondRequestId) {
+                return { error: 'Invalid parameters' };
+            }
+
+            const responseKey = `coop-mailbox:res:${requesterId}:${respondRequestId}`;
+            await store.set(responseKey, { block_data: blockData }, 30);
+            return { status: 'delivered' };
+
+        case 'poll_response':
+            const pollResponseRequestId = params.req_id || '';
+            const pollResponseKey = `coop-mailbox:res:${nodeId}:${pollResponseRequestId}`;
+            const data = await store.get(pollResponseKey);
+            if (data) {
+                await store.delete(pollResponseKey);
+                return { status: 'ready', block_data: data.block_data };
+            }
+            return { status: 'pending' };
+    }
+    return null;
+}
+
 
 /** @type {Map<number, number>} Cache des TTL optimisés par score de suspicion (clés de 0 à 100 par pas de 10) */
 let optimizedTtlCache = new Map();
@@ -4287,7 +4742,7 @@ function getTcpAnomalyScore(context) {
  * @param {string[]} [typesToDetect=['sql', 'log4shell', 'ssti', 'xxe', 'traversal', 'rce']] - Les types d'injections à détecter.
  * @returns {boolean} - True si un pattern malveillant est détecté.
  */
-function isMalicious(str, typesToDetect = Object.keys(injectionPatterns)) {
+function isMalicious(str, typesToDetect = Object.keys(injectionPatterns).filter(k => k !== 'openRedirect')) {
     if (typeof str !== 'string') return false;
 
     for (const type of typesToDetect) {
@@ -4489,6 +4944,32 @@ export const default_whitelist = () => [
 ];
 
 
+/**
+ * Extracts the TLS Session ID or ticket hash from the request context.
+ * Prioritizes proxy-provided headers and falls back to Node's native socket session.
+ * @private
+ * @param {object} context - The request context.
+ * @returns {string|null}
+ */
+function getTlsSessionId(context) {
+    if (!context) return null;
+    const fromHeader = context.headers ? (context.headers['x-tls-session-id'] || context.headers['x-ssl-session-id']) : null;
+    if (fromHeader) return fromHeader;
+
+    const socket = context.rawReq?.socket;
+    if (socket) {
+        if (socket.sessionId) {
+            return socket.sessionId.toString('hex');
+        }
+        if (typeof socket.getSession === 'function') {
+            const session = socket.getSession();
+            if (session) {
+                return crypto.createHash('sha256').update(session).digest('hex');
+            }
+        }
+    }
+    return null;
+}
 
 // --- Proof-of-Work Middleware (The Tollbooth) ---
 export const powMiddleware = (securityConfig) => {
@@ -4521,6 +5002,24 @@ export const powMiddleware = (securityConfig) => {
   }
 
   return async (req, res, next) => {
+      if (!req.headers_translated) {
+          req.headers_translated = true;
+          const matchedMapping = getActiveMappingForRequest(req.headers);
+          if (matchedMapping) {
+              const devFpHeader = matchedMapping.headers['x-device-fingerprint'].toLowerCase();
+              const behaviorHeader = matchedMapping.headers['x-behavior-metrics'].toLowerCase();
+
+              if (req.headers[devFpHeader]) {
+                  req.headers['x-device-fingerprint'] = req.headers[devFpHeader];
+              }
+              if (req.headers[behaviorHeader]) {
+                  req.headers['x-behavior-metrics'] = req.headers[behaviorHeader];
+              }
+              if (req.headers['x-device-fingerprint']) {
+                  req.headers['x-device-fingerprint'] = decodePolymorphicFingerprint(req.headers['x-device-fingerprint'], matchedMapping);
+              }
+          }
+      }
     if (securityConfig?.wasm) {
       const wasmConfig = securityConfig.wasm;
       let jsPath = '/fp.js';
@@ -4542,45 +5041,40 @@ export const powMiddleware = (securityConfig) => {
         wasmFile = wasmConfig.wasmFile ? resolve(wasmConfig.wasmFile) : resolve(__dirname, '..', '..', 'public', 'fp.wasm');
       }
 
-      if (jsFile && req.path === jsPath) {
-        try {
-          if (wasmConfig === 'dynamic' || wasmConfig.dynamic || wasmConfig.polymorphic) {
-            console.log('[Fingerprint] Generating dynamic polymorphic WASM module...');
-            // Génère des constantes aléatoires uniques pour cette session / requête
-            const seed = crypto.randomBytes(4).readInt32LE(0);
-            const multiplier = crypto.randomBytes(4).readInt32LE(0) | 1; // Doit être impair pour un LCG optimal
-            const adder = crypto.randomBytes(4).readInt32LE(0);
-            
-            const wasmBuffer = DynamicWasmGenerator.generate({ seed, multiplier, adder });
-            res.setHeader('Content-Type', 'application/wasm');
-            return res.send(wasmBuffer);
-          }
-          const fileContent = readFileSync(wasmFile);
-          res.setHeader('Content-Type', 'application/wasm');
-          return res.send(fileContent);
-        } catch (e) {
-          // Fallback
+        if (req.path === jsPath) {
+            try {
+                if (wasmConfig === 'dynamic' || wasmConfig.dynamic || wasmConfig.polymorphic) {
+                    await ensureLatestMapping();
+                    const latest = activeMappings[0];
+                    if (latest && latest.jsBuffer) {
+                        res.setHeader('Content-Type', 'application/javascript');
+                        return res.send(latest.jsBuffer);
+                    }
+                }
+                if (jsFile && existsSync(jsFile)) {
+                    const fileContent = readFileSync(jsFile);
+                    res.setHeader('Content-Type', 'application/javascript');
+                    return res.send(fileContent);
+                }
+            } catch (e) {}
         }
-      }
-      if (wasmFile && req.path === wasmPath) {
-        try {
-          if (wasmConfig === 'dynamic' || wasmConfig.dynamic || wasmConfig.polymorphic) {
-            // Génère des constantes aléatoires uniques pour cette session / requête
-            const seed = crypto.randomBytes(4).readInt32LE(0);
-            const multiplier = crypto.randomBytes(4).readInt32LE(0) | 1; // Doit être impair pour un LCG optimal
-            const adder = crypto.randomBytes(4).readInt32LE(0);
-            
-            const wasmBuffer = DynamicWasmGenerator.generate({ seed, multiplier, adder });
-            res.setHeader('Content-Type', 'application/wasm');
-            return res.send(wasmBuffer);
-          }
-          const fileContent = readFileSync(wasmFile);
-          res.setHeader('Content-Type', 'application/wasm');
-          return res.send(fileContent);
-        } catch (e) {
-          // Fallback
+        if (req.path === wasmPath) {
+            try {
+                if (wasmConfig === 'dynamic' || wasmConfig.dynamic || wasmConfig.polymorphic) {
+                    await ensureLatestMapping();
+                    const latest = activeMappings[0];
+                    if (latest && latest.wasmBuffer) {
+                        res.setHeader('Content-Type', 'application/wasm');
+                        return res.send(latest.wasmBuffer);
+                    }
+                }
+                if (wasmFile && existsSync(wasmFile)) {
+                    const fileContent = readFileSync(wasmFile);
+                    res.setHeader('Content-Type', 'application/wasm');
+                    return res.send(fileContent);
+                }
+            } catch (e) {}
         }
-      }
     }
 
     const requestContext = {
@@ -4657,6 +5151,8 @@ export const __internal = {
     getDeviceHash,
     getCompositeDeviceHash,
     getSuspicionVector,
+    getTlsSessionId,
+    pruneTrafficData,
     cyrb53, // Export for testing
     FingerprintBuilder, // Export for testing
     calculateTarget,
@@ -4685,9 +5181,14 @@ export const __internal = {
     getIpReputationScore, // Expose for testing
     updateIpReputationScore, // Expose for testing
     setLastBestSolution: (val) => { lastBestSolution = val; }, // Expose to test auto-tuning metrics
+    verifyZkpProof,
+    modPow,
     parseTcpSyn, // Expose for testing
     classifyTcpOs, // Expose for testing
-    getTcpAnomalyScore // Expose for testing
+    getTcpAnomalyScore, // Expose for testing,
+    registerCooperativeNode,
+    findPeerInSubnet,
+    handleCooperativeRequest
 };
 
 // --- THRESHOLD AUTO-TUNING SECTION ---
@@ -4749,13 +5250,55 @@ export function sanitizeTrafficData(trafficData) {
 
   return [...suspiciousLogs, ...selectedPassed];
 }
+/**
+ * Assainit et limite la taille/ancienneté des données de trafic pour éviter les fuites de mémoire.
+ * @private
+ */
+function pruneTrafficData(trafficData, maxDataPoints, maxAgeMs, onCleanup) {
+    if (!Array.isArray(trafficData)) return;
+    const now = Date.now();
+    const removed = [];
+
+    // 1. Politique temporelle d'expiration
+    if (maxAgeMs && maxAgeMs > 0) {
+        const threshold = now - maxAgeMs;
+        let i = 0;
+        while (i < trafficData.length) {
+            const log = trafficData[i];
+            const logTs = log.timestamp || log.requestTimestamp || now;
+            if (logTs < threshold) {
+                removed.push(trafficData.splice(i, 1)[0]);
+            } else {
+                i++;
+            }
+        }
+    }
 
+    // 2. Politique de taille maximale (conserver les plus récents)
+    if (maxDataPoints && maxDataPoints > 0 && trafficData.length > maxDataPoints) {
+        const overflowCount = trafficData.length - maxDataPoints;
+        const spliced = trafficData.splice(0, overflowCount);
+        removed.push(...spliced);
+    }
+
+    // 3. Callback de nettoyage
+    if (onCleanup && typeof onCleanup === 'function' && removed.length > 0) {
+        try {
+            onCleanup(removed);
+        } catch (e) {
+            console.error('[AutoTuning] Error in onCleanup callback:', e);
+        }
+    }
+}
 /**
  * Executes a threshold optimization pass using collected traffic data.
  * @private
  */
-function runThresholdOptimization(securityConfig, trafficData, minDataPoints, maxDataPoints, savePath) {
-  const sanitizedData = sanitizeTrafficData(trafficData);
+function runThresholdOptimization(securityConfig, trafficData, minDataPoints, maxDataPoints, savePath, tuningOptions = {}) {
+    const { maxAgeMs, clearAfterTuning = false, onCleanup } = tuningOptions;
+
+    pruneTrafficData(trafficData, maxDataPoints, maxAgeMs, onCleanup);
+    const sanitizedData = sanitizeTrafficData(trafficData);
 
   const highConfidenceLogs = sanitizedData.filter(log => log.type === 'challenge_solved' || log.type === 'trap_triggered').length;
   const highConfidenceRatio = sanitizedData.length > 0 ? highConfidenceLogs / sanitizedData.length : 0;
@@ -4772,12 +5315,6 @@ function runThresholdOptimization(securityConfig, trafficData, minDataPoints, ma
     }
     return;
   }
-
-  if (trafficData.length > maxDataPoints) {
-    console.log(`[AutoTuning] Le journal de trafic a atteint ${trafficData.length} entrées (max: ${maxDataPoints}). Troncation des données les plus anciennes.`);
-    trafficData.splice(0, trafficData.length - maxDataPoints);
-  }
-
   console.log(`[AutoTuning] Démarrage du cycle d'optimisation complet avec ${sanitizedData.length} points de données assainis.`);
 
   const paretoFront = Optimization.Operators.solveFullSecurityTuning({ trafficData: sanitizedData });
@@ -4912,6 +5449,18 @@ function runThresholdOptimization(securityConfig, trafficData, minDataPoints, ma
           console.error(`[AutoTuning] Erreur lors de la sauvegarde de la configuration optimisée : ${error.message}`);
       }
   }
+
+    if (clearAfterTuning) {
+        const cleared = trafficData.splice(0, trafficData.length);
+        if (onCleanup && typeof onCleanup === 'function' && cleared.length > 0) {
+            try {
+                onCleanup(cleared);
+            } catch (e) {
+                console.error('[AutoTuning] Error in onCleanup callback after clearing:', e);
+            }
+        }
+        console.log(`[AutoTuning] Explicitly cleared ${cleared.length} processed traffic data points.`);
+    }
 }
 
 /**
@@ -4938,6 +5487,9 @@ export function startThresholdAutoTuning(options) {
         minDataPoints = 200,
         maxDataPoints = 10000, // Limite par défaut à 10 000 entrées
         savePath, // NOUVEAU: Chemin de sauvegarde optionnel
+        maxAgeMs,
+        clearAfterTuning = false,
+        onCleanup,
     } = options;
 
     if (!securityConfig || !trafficData) {
@@ -4947,7 +5499,7 @@ export function startThresholdAutoTuning(options) {
     console.log(`[AutoTuning] Job d'optimisation des seuils démarré. Prochain cycle dans ${interval / 60000} minutes.`);
 
     autoTuningJobId = setInterval(() => {
-        runThresholdOptimization(securityConfig, trafficData, minDataPoints, maxDataPoints, savePath);
+        runThresholdOptimization(securityConfig, trafficData, minDataPoints, maxDataPoints, savePath, { maxAgeMs, clearAfterTuning, onCleanup });
     }, interval);
 }