@anonympins/fingerprint 0.4.6 → 0.5.1

package/CHANGELOG.md

@@ -1,3 +1,46 @@
+## Version 0.5.1
+
+### ✨ New Features
+
+- **GPU Proof-of-Work (PoW) Challenge**: Introduced a highly parallelized chaotic logistic map float computation challenge utilizing WebGPU (with a fallback to WebGL2). This challenge is specifically designed to exhaust CPU-based headless emulators (such as SwiftShader). It includes sample-based server-side verification to prevent DoS vectors.
+- **Biometric Keystroke Dynamics (Dwell & Flight Times)**: Introduced advanced behavioral biometric tracking by measuring key press duration (*dwell time*) and key-to-key transition intervals (*flight time*) to build a unique digraph/trigraph motor profile for the user.
+    - *Why it's a Killer Feature*: Automated text-injecting bots often simulate simple randomized delays between characters, but they fail to replicate natural human muscle memory patterns (such as ultra-fast cognitive transitions between adjacent keys on physical or virtual layouts). Server-side statistical checks (utilizing standard deviation, variance thresholds, and Benford's Law) immediately flag these robotic, uniform input patterns.
+- **Stealthy Honeypot Traps (Shadow DOM)**: Implemented a new honeypot mechanism that conceals trap links and form fields within a closed Shadow DOM, with dynamic rendering styles calculated by nested CSS variables. This makes them invisible to legitimate users and standard browser automation tools, but highly detectable by bots that inject specific JS or use complex selectors, significantly increasing their behavioral signature.
+- **Hot-Reloadable Security Configuration**: Enabled dynamic, in-memory updates of security configurations (weights, thresholds, patterns) without requiring a server restart. This ensures continuous adaptability to evolving threats (e.g., DDoS L7, scraping campaigns) without service interruption or latency.
+
+### 🚀 Improvements
+
+- **Display & Protocol Anomaly Scoring**: Fully integrated `renderingAnomalyScore` and `quicAnomalyScore` across all backend engines (Node.js, PHP, Python). This enables real-time detection of virtual software framebuffers (like `Xvfb`) lacking physical V-Sync through jitter analysis, as well as HTTP/3 stream setting inconsistencies.
+- **Security Profile Tuning**: Integrated display and QUIC anomaly detectors into the default security profiles (`balanced`, `strict`, `blog`, `ecommerce`) with custom weights.
+- **Layout-Agnostic Client Tracking**: Enhanced the keystroke dynamics tracker to prioritize physical key locations (`KeyboardEvent.code`) over localized characters (`KeyboardEvent.key`), ensuring robust detection across different keyboard layouts (QWERTY, AZERTY) and virtual mobile keyboards.
+
+### 🐛 Bug Fixes
+
+- **Node.js 24 Test Suite Compatibility**: Fixed unit test suite execution and environment configuration issues specifically encountered on Node.js 24.
+
+---
+
+## Version 0.5.0
+
+### ✨ New Features
+
+- **Zero-Knowledge Proofs (ZKP)**: Added cryptographically secure Schnorr Zero-Knowledge Proofs (`generateZkpProof` on client and `verifyZkpProof` on server) for device fingerprints, allowing zero-disclosure fingerprint validation and making session tickets completely tamper-proof.
+- **Optional Ed25519 Asymmetric Keys**: Implemented dynamic and optional Ed25519 asymmetric key binding with an automatic fallback to symmetric AES-256-CBC encryption.
+- **Cooperative Proof-of-Space (Coop PoSpace)**: Introduced decentralized, cooperative Proof-of-Space challenge routing within local subnets. Highly suspicious clients must coordinate with neighboring subnet peers to fetch and aggregate cryptographic blocks. This vastly increases the cost and complexity for distributed botnets trying to cycle residential proxy IPs, as they are forced to run and maintain real, synchronized, and cooperative peer nodes within the same local IP subnet to solve challenges.
+
+### 🚀 Improvements
+
+- **Enhanced Malicious Injection Detection**: Upgraded the WAF and input validation subsystem to recursively inspect deeply nested NoSQL/SQL structures, significantly improving protection against complex MongoDb/SQL injection vectors.
+- **Traffic Data Pruning**: Introduced automated traffic data pruning (`pruneTrafficData`) with time-based and size-based limiters to avoid memory leaks during long-running auto-tuning sessions.
+
+### 🐛 Bug Fixes
+
+- **CI/CD OpenSSL Compatibility**: Fixed test environment crashes on older systems or CI/CD pipelines where the `OPENSSL_KEYTYPE_ED25519` constant is undefined.
+- **Autoloader savePath Resolution**: Resolved file-system path resolution bugs when saving optimized configurations inside the auto-tuner.
+- **Repository Size Optimization**: Pruned obsolete resources and optimized package assets to significantly reduce overall repository footprint.
+
+---
+
 ## Version 0.4.6
 
 ### ✨ New Features

package/README.md

@@ -1,12 +1,17 @@
 # Fingerprint anti-bot protection
 
-NodeJS tests : [![Test NodeJS](https://img.shields.io/github/actions/workflow/status/anonympins/fingerprint/ci-nodejs.yml)](https://github.com/anonympins/fingerprint/actions/workflows/ci.yml) / PHP tests : [![PHP](https://img.shields.io/github/actions/workflow/status/anonympins/fingerprint/ci-php.yml)](https://github.com/anonympins/fingerprint/actions/workflows/ci-php.yml) / Python tests : [![PHP](https://img.shields.io/github/actions/workflow/status/anonympins/fingerprint/ci-php.yml)](https://github.com/anonympins/fingerprint/actions/workflows/ci-python.yml)
+NodeJS tests : [![https://github.com/anonympins/fingerprint/actions/workflows/ci-nodejs.yml](https://img.shields.io/github/actions/workflow/status/anonympins/fingerprint/ci-nodejs.yml)](https://github.com/anonympins/fingerprint/actions/workflows/ci-nodejs.yml) / PHP tests : [![https://github.com/anonympins/fingerprint/actions/workflows/ci-php.yml](https://img.shields.io/github/actions/workflow/status/anonympins/fingerprint/ci-php.yml)](https://github.com/anonympins/fingerprint/actions/workflows/ci-php.yml) / Python tests : [![https://github.com/anonympins/fingerprint/actions/workflows/ci-python.yml](https://img.shields.io/github/actions/workflow/status/anonympins/fingerprint/ci-php.yml)](https://github.com/anonympins/fingerprint/actions/workflows/ci-python.yml)
 
-[![Release](https://img.shields.io/github/v/release/anonympins/fingerprint)](https://github.com/anonympins/fingerprint/releases)
-[![License](https://img.shields.io/github/license/anonympins/fingerprint)](https://github.com/anonympins/fingerprint/blob/main/LICENSE)
-![GitHub commit activity](https://img.shields.io/github/commit-activity/w/anonympins/fingerprint)
+[![https://github.com/anonympins/fingerprint/releases/tag/fingerprint-0.5.0](https://img.shields.io/github/v/release/anonympins/fingerprint)](https://github.com/anonympins/fingerprint/releases)
+[![https://raw.githubusercontent.com/anonympins/fingerprint/refs/heads/main/LICENSE](https://img.shields.io/github/license/anonympins/fingerprint)](https://github.com/anonympins/fingerprint/blob/main/LICENSE)
+[![https://github.com/anonympins/fingerprint/commits/main](https://img.shields.io/github/commit-activity/w/anonympins/fingerprint)](https://github.com/anonympins/fingerprint/commits/main)
+[![https://github.com/anonympins/fingerprint](https://img.shields.io/github/repo-size/anonympins/fingerprint)](https://github.com/anonympins/fingerprint)
 
-A multi-layered behavioral, cryptographic, and network analysis engine designed to identify and mitigate malicious requests (bots, scrapers, session hijacking, bot farms) in real-time. Supports **Node.js**, **Python** and **PHP** environments.
+A multi-layered behavioral, cryptographic, and network analysis production-grade engine designed to identify and mitigate malicious requests (bots, scrapers, session hijacking, bot farms) in real-time. Supports **Node.js**, **Python** and **PHP** environments. 
+
+It leverages multi-layer hardware fingerprinting, real-time behavioral analysis, passive network/TLS tracking, and adaptive/useful proof-of-work challenges to dynamically detect and mitigate scraping, scalping, account takeover (ATO), and sophisticated automated threats.
+
+Supported officially on **Node.js (>=20.0.0)**, **PHP (>=8.0)**, and **Python (>=3.8)**.
 
 ![illustration](https://i.ibb.co/fV1QT6Mf/image-c6e10859baae53bb595112ec08fc9e27.png)
 
@@ -14,11 +19,42 @@ A multi-layered behavioral, cryptographic, and network analysis engine designed
 
 [![Presentation](https://i.ibb.co/1tkPS01C/Capture-d-cran-2026-09-07-194728.png)](https://www.youtube.com/watch?v=Ujeznl0JAl4)
 
-## Key Features
 
-- **Multi-Layered Detection**: Combines TLS/JA3/JA4 analysis, HTTP header consistency checks, IP reputation, and behavioral tracking (mouse movements, keystrokes).
-- **Adaptive Mitigation**: Imposes progressive cryptographic Proof-of-Work (PoW) challenges to block automated clients without impacting legitimate human users.
-- **Predefined Profiles**: Ready-to-use security profiles (`balanced`, `strict`, `api`, `blog`, `ecommerce`) tailored to your specific use case.
+## 🚀 Key Features
+
+### 1. 🧬 Polymorphic Client-Side WASM & JS Solvers
+* **Polymorphic WebAssembly Solver**: Dynamically generates unique, randomized C++ compiled WebAssembly binary modules per session. Prevents static analysis, bot automation, and emulator tampering.
+* **IndexedDB WASM Caching**: Transparently caches compiled WASM modules (`wasm-cache-db`) in the browser's IndexedDB, minimizing initialization overhead and execution lag on subsequent visits.
+* **Advanced Obfuscation**: Uses multi-layered control flow flattening and string array obfuscation for client-side libraries.
+
+### 2. 💱 Useful Proof-of-Work (uPoW) & PoSpace
+* **Collaborative Useful PoW**: Instead of burning CPU cycles on arbitrary mathematical hash puzzles, suspicious clients solve complex optimization problems (e.g., *Traveling Salesperson*, *Portfolio Allocation*, *Facility Location*, *Fraud Detection Parameter Tuning*).
+* **Proof-of-Space (PoSpace) Challenge**: Forces browser clients to allocate and verify access to massive, persistent storage chunks (e.g., 100MB) inside IndexedDB, multiplying the cost of multi-threaded headless automation.
+* **Chained CPU/Memory Challenges**: Employs client-side resource exhaustion techniques (Chained SHA-256 target seeking & Memory Hard allocation vectors up to 128MB) that are validated in $O(1)$ on the server.
+
+### 3. 🌐 Passive TLS, HTTP/2, and TCP/IP (p0f) Tracking
+* **Native JA3/JA4 TLS Handshake Parsing**: Inspects raw TLS client hello bytes to extract and analyze cipher suite arrangements, extensions, and elliptic curve formats.
+* **Passive TCP/IP Stack Fingerprinting**: Emulates `p0f` rules by analyzing raw TCP SYN packets (TTL, Window Size, MSS, WS, SACK) to classify client OS and detect raw network spoofing.
+* **Multi-Language Handshake Parser**: Built-in support for event-driven PHP runtimes (Swoole, ReactPHP, Workerman), Node.js native sockets, and Python ASGI/WSGI contexts.
+
+### 4. 🧠 Stateful Behavioral Entropy & Click Variance
+* **Click Coordinate Variance**: Tracks exact click relative positions on DOM elements to compute spatial entropy, flagging bots clicking targets with robotic, mathematically perfect precision (zero variance).
+* **Mobile Touch Move Dynamics**: Captures mobile-specific touchscreen signals, analyzing tactile contact area radius, variable pressure indices, and multi-touch capabilities.
+* **Typing Keystroke Latency**: Measures real-time keystroke interval latencies to prevent automated text insertion.
+
+### 5. 🔍 Cross-Layer & Analog Inconsistency Scoring
+* **Layer Cross-Referencing**: Analyzes inconsistencies between User-Agent declarations, Client-Hints (`Sec-CH-UA`), TLS Handshake capabilities, and TCP stacks (e.g., claiming Windows NT on Chrome but negotiating TLS like curl/Safari on a Linux kernel).
+* **Viewport Aspect ratio & Screen mismatches**: Detects virtualized viewports exceeding physical dimensions or fake hardware specifications.
+
+### 6. 🦠 Honeypot Traps & Extensible WAF
+* **Signed Trap URLs**: Injects visually hidden, signed trap URLs into the DOM. Attempts to crawl, probe, or scrape these URLs immediately condemn the device.
+* **Recursive Injection Filters**: Inspects deeply nested payload structures (JSON/NoSQL/GraphQL) using a robust regular expression matrix to flag SQLi, XSS, XXE, SSTI, and JNDI (Log4Shell) vulnerabilities.
+* **ModSecurity NodeJS Extensibility**: Allows plugging in native core rule sets or custom WAF rule compilers into the honeypot pipeline.
+
+### 🧬 Progressive Threshold Auto-Tuning
+* **Genetic Policy Optimizer**: Dynamically updates classification parameters using a multi-objective genetic algorithm on your actual sanitized traffic data.
+* **Inertial Parameter Sliding**: Adjusts security thresholds slowly with an adaptive learning rate to prevent configuration spikes.
+* **Sybil Protection**: Filters out traffic logs, ensuring individual compromised bot networks cannot pollute optimization datasets.
 
 ## Quick Start
 
@@ -62,9 +98,18 @@ We welcome community contributions! Please read our **[Contributing Guidelines](
 Thanks to our contributors : 
 - [anonympins](https://github.com/anonympins)
 
-## Used actively on
+## 💖 Sponsor This Project
+
+If this security suite helps protect your business against botnets, automated scraping, credential stuffing, or Layer 7 DDoS attacks, please consider supporting its active development!
+
+Sponsorship helps maintain the library, fund active updates, and keep the dynamic WebAssembly engine cutting-edge.
+
+### 🌟 Featured Sponsors
+
+<img src="https://s6.imgcdn.dev/YJTWv9.png" width="100" alt="YJTWv9.png" border="0" valign="middle"> 
+
+[https://primals.net](https://primals.net) and sub-sites
 
-- https://primals.net and sub-sites
 
 ## License
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anonympins/fingerprint",
-  "version": "0.4.6",
+  "version": "0.5.1",
   "description": "Advanced anti-bot library for Node.js using multi-layer fingerprinting (JA3, client-side, headers), behavioral analysis, and adaptive Proof-of-Work (PoW) challenges to mitigate scraping, scalping, and automated threats.",
   "main": "index.js",
   "type": "module",
@@ -9,6 +9,7 @@
   },
   "scripts": {
     "test": "vitest run --reporter=verbose",
+    "pub": "npm run build && npm login && npm publish --access public",
     "build": "node src/js/build-client.js"
   },
   "exports": {

package/src/js/fingerprint.client.js

@@ -82,6 +82,56 @@ const ClientLibrary = {
      */
     _hasher: (str, seed) => activeCyrb53(str, seed),
 
+    /**
+     * Génère une preuve de connaissance à divulgation nulle (ZKP) de Schnorr pour l'empreinte de l'appareil.
+     * Rend le tout stable et compatible avec les vérifications JS, PHP et Python.
+     * @param {string} fingerprint - L'empreinte de l'appareil.
+     * @returns {Promise<string>} La preuve sous format "y:t:s" en hexadécimal.
+     */
+    async generateZkpProof(fingerprint) {
+        const ZKP_P = 115792089237316195423570985008687907853269984665640564039457584007908834671663n;
+        const ZKP_G = 2n;
+        const cryptoObj = window.crypto || window.msCrypto;
+
+        const sha256Hex = async (str) => {
+            const encoder = new TextEncoder();
+            const data = encoder.encode(str);
+            const hashBuffer = await cryptoObj.subtle.digest('SHA-256', data);
+            const hashArray = Array.from(new Uint8Array(hashBuffer));
+            return hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
+        };
+
+        const modPow = (base, exponent, modulus) => {
+            if (modulus === 1n) return 0n;
+            let result = 1n;
+            base = base % modulus;
+            while (exponent > 0n) {
+                if (exponent % 2n === 1n) {
+                    result = (result * base) % modulus;
+                }
+                exponent = exponent >> 1n;
+                base = (base * base) % modulus;
+            }
+            return result;
+        };
+
+        const xHex = await sha256Hex(fingerprint);
+        const x = BigInt('0x' + xHex) % ZKP_P;
+        const y = modPow(ZKP_G, x, ZKP_P);
+        const randomBytes = new Uint8Array(32);
+        cryptoObj.getRandomValues(randomBytes);
+        let vHex = Array.from(randomBytes).map(b => b.toString(16).padStart(2, '0')).join('');
+        let v = BigInt('0x' + vHex) % (ZKP_P - 1n);
+        if (v === 0n) v = 1n;
+        const t = modPow(ZKP_G, v, ZKP_P);
+        const cStr = ZKP_G.toString() + y.toString() + t.toString();
+        const cHex = await sha256Hex(cStr);
+        const c = BigInt('0x' + cHex) % ZKP_P;
+        const s = (v + c * x) % (ZKP_P - 1n);
+
+        return `${y.toString(16)}:${t.toString(16)}:${s.toString(16)}`;
+    },
+
     /**
      * Génère l'empreinte de l'appareil actuel.
      */
@@ -290,6 +340,137 @@ const ClientLibrary = {
         document.addEventListener('touchend', handleTouch, { passive: true });
     },
 
+    /**
+     * Démarre le suivi de la régularité d'affichage (V-Sync/rAF) pour détecter les framebuffers logiciels sans V-Sync.
+     */
+    startRenderingTracker() {
+        if (this._renderingTrackerAttached) return;
+        this._renderingTrackerAttached = true;
+
+        if (typeof window === 'undefined' || !window.requestAnimationFrame) return;
+
+        const rAfTimestamps = [];
+        let lastTime = performance.now();
+        const maxSamples = 15;
+
+        const checkOffscreenAnom = () => {
+            try {
+                if ('OffscreenCanvas' in window && HTMLCanvasElement.prototype.transferControlToOffscreen) {
+                    const nativeToString = Function.prototype.toString.call(HTMLCanvasElement.prototype.transferControlToOffscreen);
+                    return !nativeToString.includes('[native code]');
+                }
+            } catch (e) {}
+            return false;
+        };
+
+        const loop = (time) => {
+            const delta = time - lastTime;
+            lastTime = time;
+            if (rAfTimestamps.length < maxSamples) {
+                if (rAfTimestamps.length > 0) { // Skip first delta
+                    rAfTimestamps.push(delta);
+                }
+                window.requestAnimationFrame(loop);
+            } else {
+                const avg = rAfTimestamps.reduce((a, b) => a + b, 0) / rAfTimestamps.length;
+                const sqDiffs = rAfTimestamps.map(v => Math.pow(v - avg, 2));
+                const avgSqDiff = sqDiffs.reduce((a, b) => a + b, 0) / sqDiffs.length;
+                
+                metrics.rendering = {
+                    fps: Math.round((1000 / avg) * 100) / 100,
+                    jitter: Math.round(Math.sqrt(avgSqDiff) * 100) / 100,
+                    offscreenAnom: checkOffscreenAnom()
+                };
+            }
+        };
+        window.requestAnimationFrame(loop);
+    },
+
+    /**
+     * Initialise l'espace Proof-of-Space persistant dans l'IndexedDB locale.
+     */
+    async initializeSpace(seed, sizeMb) {
+        return new Promise((resolve, reject) => {
+            const request = indexedDB.open('pospace-db', 1);
+            request.onupgradeneeded = (e) => {
+                const db = e.target.result;
+                if (!db.objectStoreNames.contains('blocks')) {
+                    db.createObjectStore('blocks');
+                }
+            };
+            request.onsuccess = async (e) => {
+                const db = e.target.result;
+                const tx = db.transaction('blocks', 'readwrite');
+                const store = tx.objectStore('blocks');
+                
+                const maxBlocks = sizeMb * 1024;
+                const countReq = store.count();
+                countReq.onsuccess = async () => {
+                    if (countReq.result < maxBlocks) {
+                        for (let i = 0; i < maxBlocks; i++) {
+                            const block = new Uint8Array(1024);
+                            let h = 5381;
+                            for (let j = 0; j < seed.length; j++) {
+                                h = (h << 5) + h + seed.charCodeAt(j);
+                            }
+                            h = (h << 5) + h + i;
+                            for (let k = 0; k < 1024; k++) {
+                                h = Math.imul(h ^ k, 1597334677);
+                                block[k] = h & 0xff;
+                            }
+                            store.put(block, i);
+                        }
+                    }
+                    resolve();
+                };
+            };
+            request.onerror = () => reject(new Error("Failed to open pospace database"));
+        });
+    },
+
+    /**
+     * Lit un bloc spécifique de l'IndexedDB locale sous format hexadécimal.
+     */
+    async readSpaceBlock(blockIdx) {
+        return new Promise((resolve, reject) => {
+            const request = indexedDB.open('pospace-db', 1);
+            request.onsuccess = (e) => {
+                const db = e.target.result;
+                const tx = db.transaction('blocks', 'readonly');
+                const store = tx.objectStore('blocks');
+                const getReq = store.get(blockIdx);
+                getReq.onsuccess = () => {
+                    const block = getReq.result;
+                    if (block) {
+                        const hex = Array.from(block).map(b => b.toString(16).padStart(2, '0')).join('');
+                        resolve(hex);
+                    } else {
+                        reject(new Error("Block not found"));
+                    }
+                };
+                getReq.onerror = () => reject(getReq.error);
+            };
+            request.onerror = () => reject(new Error("Failed to open pospace database"));
+        });
+    },
+
+    /**
+     * Résout le Proof-of-Space en combinant optionnellement le bloc du pair.
+     */
+    async solveSpaceChallenge(seed, queries, nonce, clientSecret, peerBlock = '') {
+        const blocks = [];
+        for (const idx of queries) {
+            const blockHex = await this.readSpaceBlock(idx);
+            blocks.push(blockHex);
+        }
+        let finalPayload = blocks.join('') + peerBlock + nonce + ":" + clientSecret;
+        const encoder = new TextEncoder();
+        const data = encoder.encode(finalPayload);
+        const hashBuffer = await window.crypto.subtle.digest('SHA-256', data);
+        const hashArray = Array.from(new Uint8Array(hashBuffer));
+        return hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
+    },
+
     /**
      * Démarre le suivi des mouvements de la souris pour calculer l'entropie.
      * À appeler une fois sur la page.
@@ -314,27 +495,77 @@ const ClientLibrary = {
     },
 
     /**
-     * Démarre le suivi de la dynamique de frappe pour calculer la latence.
+     * Démarre le suivi de la dynamique de frappe pour calculer le dwell time et le flight time (digraphie/trigraphie).
      * À appeler une fois sur la page.
      */
     startKeystrokeDynamicsTracker() {
         // S'assurer de ne pas attacher l'écouteur plusieurs fois
-        if (keystrokeTimestamps.length > 0) return;
+        if (this._keystrokeTrackerAttached) return;
+        this._keystrokeTrackerAttached = true;
 
-        document.addEventListener('keydown', () => {
+        const activeKeys = new Map();
+        let lastKeyDownTime = 0;
+        let lastKeyName = '';
+
+        document.addEventListener('keydown', (e) => {
             const now = performance.now();
+            const key = e.key;
+            const code = e.code;
+            if (!key && !code) return;
+
+            const keyIdentifier = code || key;
+
+            // Prevent key repeat triggering multiple events
+            if (activeKeys.has(keyIdentifier)) return;
+            activeKeys.set(keyIdentifier, now);
+
             if (keystrokeTimestamps.length > 0) {
                 const lastTimestamp = keystrokeTimestamps[keystrokeTimestamps.length - 1];
                 const latency = now - lastTimestamp;
-                // On ignore les latences irréalistes (trop longues ou trop courtes)
-                if (latency > 10 && latency < 2000) { // Augmenté à 2s
+                if (latency > 10 && latency < 2000) {
                     if (keystrokeLatencies.length >= KEYSTROKE_HISTORY_MAX) {
-                        keystrokeLatencies.shift(); // Garder la taille de l'historique
+                        keystrokeLatencies.shift();
                     }
                     keystrokeLatencies.push(latency);
                 }
             }
             keystrokeTimestamps.push(now);
+
+            // Flight Time (KeyDown to KeyDown)
+            if (lastKeyDownTime > 0) {
+                const flightTime = now - lastKeyDownTime;
+                if (flightTime > 10 && flightTime < 2000) {
+                    if (keystrokeFlightTimes.length >= KEYSTROKE_HISTORY_MAX) {
+                        keystrokeFlightTimes.shift();
+                    }
+                    const digraph = lastKeyName ? this._hasher(lastKeyName + "_" + keyIdentifier).toString() : "unknown";
+                    keystrokeFlightTimes.push({ digraph, time: flightTime });
+                }
+            }
+            lastKeyDownTime = now;
+            lastKeyName = keyIdentifier;
+        }, {passive: true});
+
+        document.addEventListener('keyup', (e) => {
+            const now = performance.now();
+            const key = e.key;
+            const code = e.code;
+            if (!key && !code) return;
+
+            const keyIdentifier = code || key;
+
+            if (activeKeys.has(keyIdentifier)) {
+                const pressTime = activeKeys.get(keyIdentifier);
+                const dwellTime = now - pressTime;
+                activeKeys.delete(keyIdentifier);
+
+                if (dwellTime > 5 && dwellTime < 1000) {
+                    if (keystrokeDwellTimes.length >= KEYSTROKE_HISTORY_MAX) {
+                        keystrokeDwellTimes.shift();
+                    }
+                    keystrokeDwellTimes.push(dwellTime);
+                }
+            }
         }, {passive: true});
     },
 
@@ -374,22 +605,75 @@ const ClientLibrary = {
         });
         activeHoneypotListeners.clear();
 
-        // 2. Ajouter les nouveaux écouteurs
+        // 2. Ajouter les nouveaux écouteurs sur le DOM classique
         honeypotFieldNames.forEach(fieldName => {
             const field = document.querySelector(`[name="${fieldName}"]`);
             if (field) {
-                // On utilise une fonction nommée (ou une référence) pour pouvoir la supprimer plus tard.
-                // L'option { once: true } est excellente, mais pour une réinitialisation complète,
-                // il est plus propre de gérer le nettoyage nous-mêmes.
                 const listener = () => {
                     this.onHoneypotTrigger();
-                    // Se supprime lui-même après exécution, comme { once: true }
                     field.removeEventListener('input', listener);
                 };
                 field.addEventListener('input', listener);
                 activeHoneypotListeners.set(field, listener); // On stocke la référence
             }
         });
+
+        // 3. Générer des champs d'input pièges masqués dans un Shadow DOM fermé
+        if (typeof document !== 'undefined' && honeypotFieldNames.length > 0) {
+            const host = document.createElement('div');
+            host.setAttribute('aria-hidden', 'true');
+            host.style.position = 'absolute';
+            host.style.width = '0';
+            host.style.height = '0';
+            host.style.overflow = 'hidden';
+
+            const shadow = host.attachShadow({ mode: 'closed' });
+
+            const style = document.createElement('style');
+            style.textContent = `
+              :host {
+                --trap-pos-state: absolute;
+                --trap-off-val: -9999px;
+                --trap-vis-state: hidden;
+                --trap-scale-val: 0;
+              }
+              .shadow-form-wrapper {
+                position: var(--trap-pos-state);
+                left: var(--trap-off-val);
+                top: var(--trap-off-val);
+                visibility: var(--trap-vis-state);
+                transform: scale(var(--trap-scale-val));
+              }
+            `;
+            shadow.appendChild(style);
+
+            const wrapper = document.createElement('div');
+            wrapper.className = 'shadow-form-wrapper';
+
+            honeypotFieldNames.forEach(fieldName => {
+                const label = document.createElement('label');
+                label.textContent = fieldName;
+                const input = document.createElement('input');
+                input.type = 'text';
+                input.name = fieldName;
+                input.tabIndex = -1;
+                input.autocomplete = 'off';
+
+                const trigger = () => {
+                    this.onHoneypotTrigger();
+                };
+
+                input.addEventListener('input', trigger, { passive: true });
+                input.addEventListener('change', trigger, { passive: true });
+                input.addEventListener('focus', trigger, { passive: true });
+
+                wrapper.appendChild(label);
+                wrapper.appendChild(input);
+            });
+
+            shadow.appendChild(wrapper);
+            document.body.appendChild(host);
+        }
     },
 
     /**
@@ -409,6 +693,10 @@ const ClientLibrary = {
         // NOUVEAU: Inclure l'historique des mouvements de la souris pour une analyse côté serveur.
         metrics.mouseMovementsHistory = mouseMovementsHistory;
 
+        // NOUVEAU: Keystroke dynamics metrics (dwell and flight times)
+        metrics.keystrokeDwellTimes = keystrokeDwellTimes;
+        metrics.keystrokeFlightTimes = keystrokeFlightTimes;
+
         // Calcule la latence moyenne des frappes
         if (keystrokeLatencies.length > 0) {
             const sum = keystrokeLatencies.reduce((a, b) => a + b, 0);
@@ -537,24 +825,61 @@ const ClientLibrary = {
       return;
     }
 
-    const trapContainer = document.createElement('div');
-    trapContainer.setAttribute('aria-hidden', 'true');
-    trapContainer.style.position = 'absolute';
-    trapContainer.style.left = '-9999px';
-    trapContainer.style.top = '-9999px';
-      trapContainer.style.transform = 'scale(0)';
-      trapContainer.style.pointerEvents = 'none';
+    const host = document.createElement('div');
+    host.setAttribute('aria-hidden', 'true');
+    host.style.position = 'absolute';
+    host.style.width = '0';
+    host.style.height = '0';
+    host.style.overflow = 'hidden';
+
+    const shadow = host.attachShadow({ mode: 'closed' });
+
+    const style = document.createElement('style');
+    style.textContent = `
+      :host {
+        --trap-layout-pos: absolute;
+        --trap-offset-val: -9999px;
+        --trap-visibility-state: hidden;
+        --trap-scale-factor: 0;
+        --trap-ptr-events: none;
+      }
+      .shadow-trap-wrapper {
+        position: var(--trap-layout-pos);
+        left: var(--trap-offset-val);
+        top: var(--trap-offset-val);
+        visibility: var(--trap-visibility-state);
+        transform: scale(var(--trap-scale-factor));
+        pointer-events: var(--trap-ptr-events);
+      }
+      a {
+        color: transparent;
+        text-decoration: none;
+      }
+    `;
+    shadow.appendChild(style);
+
+    const wrapper = document.createElement('div');
+    wrapper.className = 'shadow-trap-wrapper';
 
-    urls.forEach((url,i) => {
+    urls.forEach((url, i) => {
       const link = document.createElement('a');
       link.href = url;
       link.rel = 'nofollow';
-      link.tabIndex = -1; // Make it unfocusable
-      link.innerHTML = `<span>&gt; ${i+1}</span>`; // SEO-insignificant content
-      trapContainer.appendChild(link);
+      link.tabIndex = -1;
+      link.innerHTML = `<span>&gt; ${i + 1}</span>`;
+
+      const trigger = () => {
+        this.onHoneypotTrigger();
+      };
+      link.addEventListener('click', trigger, { passive: true });
+      link.addEventListener('focus', trigger, { passive: true });
+      link.addEventListener('mouseover', trigger, { passive: true });
+
+      wrapper.appendChild(link);
     });
 
-    document.body.appendChild(trapContainer);
+    shadow.appendChild(wrapper);
+    document.body.appendChild(host);
   },
   /**
    * Intercepte une réponse de challenge JSON, le résout, et réessaie la requête.
@@ -614,6 +939,7 @@ const ClientLibrary = {
         keystrokes = true,
         clicks = true, // Add new option
         touches = true, // Nouveau paramètre tactiles
+            rendering = true,
             phantomTraps = true, // NOUVEAU
         honeypots = [],
         trapUrls = [], // Nouveau paramètre pour les URL pièges
@@ -638,6 +964,9 @@ const ClientLibrary = {
     if (touches) {
         this.startTouchEventTracker();
     }
+        if (rendering) {
+            this.startRenderingTracker();
+        }
         if (phantomTraps) {
             this.injectPhantomTraps();
         }
@@ -806,6 +1135,7 @@ const metrics = {
     honeypotInteraction: false,
     historyLength: 0,
     clientTimestamp: 0,
+    rendering: { fps: 0, jitter: 0, offscreenAnom: false },
 };
 
 let lastMousePos = { x: 0, y: 0 };
@@ -818,6 +1148,8 @@ const CLICKS_HISTORY_MAX = 50;
 let activeHoneypotListeners = new Map(); // Garde une trace des écouteurs actifs
 let keystrokeTimestamps = [];
 let keystrokeLatencies = []; // NOUVEAU: Tableau dédié pour les latences
+let keystrokeDwellTimes = [];
+let keystrokeFlightTimes = [];
 const KEYSTROKE_HISTORY_MAX = 20; // On garde l'historique des 20 dernières frappes
 
 
@@ -831,6 +1163,7 @@ export const startMouseEntropyTracker = ClientLibrary.startMouseEntropyTracker.b
 export const startKeystrokeDynamicsTracker = ClientLibrary.startKeystrokeDynamicsTracker.bind(ClientLibrary);
 export const startClickTracker = ClientLibrary.startClickTracker.bind(ClientLibrary);
 export const startTouchEventTracker = ClientLibrary.startTouchEventTracker.bind(ClientLibrary);
+export const startRenderingTracker = ClientLibrary.startRenderingTracker.bind(ClientLibrary);
 export const initializeHoneypots = ClientLibrary.initializeHoneypots.bind(ClientLibrary);
 export const getClientBehaviorMetrics = ClientLibrary.getClientBehaviorMetrics.bind(ClientLibrary);
 export const protectedFetch = ClientLibrary.protectedFetch.bind(ClientLibrary);
@@ -842,6 +1175,10 @@ export const initializeWasm = ClientLibrary.initializeWasm.bind(ClientLibrary);
 export const injectTrapLinks = ClientLibrary.injectTrapLinks.bind(ClientLibrary);
 export const injectPhantomTraps = ClientLibrary.injectPhantomTraps.bind(ClientLibrary);
 export const solveChallengeAndRetry = ClientLibrary.solveChallengeAndRetry.bind(ClientLibrary);
+export const generateZkpProof = ClientLibrary.generateZkpProof.bind(ClientLibrary);
+export const initializeSpace = ClientLibrary.initializeSpace.bind(ClientLibrary);
+export const readSpaceBlock = ClientLibrary.readSpaceBlock.bind(ClientLibrary);
+export const solveSpaceChallenge = ClientLibrary.solveSpaceChallenge.bind(ClientLibrary);
 
 // Export the internal object for testing purposes
 export default ClientLibrary;