@anonympins/fingerprint 0.5.2 → 0.5.4

package/src/js/tests/fingerprint.client.init.test.js

@@ -1,144 +1,144 @@
-import {afterEach, beforeEach, describe, expect, it, vi} from 'vitest';
-import {JSDOM} from 'jsdom';
-import ClientLibrary from '../fingerprint.client.js';
-
-// --- Setup JSDOM Environment ---
-// Vitest peut être configuré pour le faire automatiquement, mais le faire manuellement
-// ici rend le test explicite et portable.
-const dom = new JSDOM('<!DOCTYPE html><html><body></body></html>', {
-    url: 'http://localhost',
-});
-
-// In recent Node.js versions, some global properties like 'navigator', 'performance',
-// and 'screen' are read-only. To ensure our JSDOM environment works correctly across
-// all versions, we use Object.defineProperty to make these properties writable.
-Object.defineProperty(global, 'window', { value: dom.window, writable: true });
-Object.defineProperty(global, 'document', { value: dom.window.document, writable: true });
-Object.defineProperty(global, 'navigator', { value: dom.window.navigator, writable: true });
-Object.defineProperty(global, 'screen', { value: dom.window.screen, writable: true });
-Object.defineProperty(global, 'performance', { value: dom.window.performance, writable: true });
-
-global.fetch = vi.fn(); // Mock global fetch
-global.Headers = dom.window.Headers;
-global.Request = dom.window.Request;
-global.URL = dom.window.URL;
-global.TextEncoder = dom.window.TextEncoder;
-
-
-describe('ClientLibrary.initializeClient', () => {
-
-    // On utilise des espions (spies) pour vérifier si les méthodes internes sont appelées.
-    let startMouseSpy, startKeystrokeSpy, startClickSpy, startTouchSpy, startRenderingSpy, initWasmSpy, initHoneypotsSpy, injectTrapsSpy, initFetchSpy, injectPhantomTrapsSpy;
-
-    beforeEach(() => {
-        // Réinitialiser l'état du client avant chaque test
-        ClientLibrary._resetCache();
-
-        // Créer les espions sur les méthodes internes
-        startMouseSpy = vi.spyOn(ClientLibrary, 'startMouseEntropyTracker');
-        startKeystrokeSpy = vi.spyOn(ClientLibrary, 'startKeystrokeDynamicsTracker');
-        startClickSpy = vi.spyOn(ClientLibrary, 'startClickTracker');
-        startTouchSpy = vi.spyOn(ClientLibrary, 'startTouchEventTracker');
-        startRenderingSpy = vi.spyOn(ClientLibrary, 'startRenderingTracker');
-        initWasmSpy = vi.spyOn(ClientLibrary, 'initializeWasm').mockResolvedValue(undefined);
-        initHoneypotsSpy = vi.spyOn(ClientLibrary, 'initializeHoneypots');
-        injectTrapsSpy = vi.spyOn(ClientLibrary, 'injectTrapLinks');
-        initFetchSpy = vi.spyOn(ClientLibrary, 'initializeFetch');
-        injectPhantomTrapsSpy = vi.spyOn(ClientLibrary, 'injectPhantomTraps');
-    });
-
-    afterEach(() => {
-        // Restaurer les espions après chaque test pour ne pas affecter les autres tests
-        vi.restoreAllMocks();
-    });
-
-    it('should enable all trackers by default', () => {
-        ClientLibrary.initializeClient();
-
-        expect(startMouseSpy).toHaveBeenCalled();
-        expect(startKeystrokeSpy).toHaveBeenCalled();
-        expect(startClickSpy).toHaveBeenCalled();
-        expect(startTouchSpy).toHaveBeenCalled();
-        expect(startRenderingSpy).toHaveBeenCalled();
-        expect(injectPhantomTrapsSpy).toHaveBeenCalled();
-    });
-
-    it('should disable trackers when configured', () => {
-        ClientLibrary.initializeClient({ mouse: false, keystrokes: false, clicks: false, touches: false, rendering: false });
-
-        expect(startMouseSpy).not.toHaveBeenCalled();
-        expect(startKeystrokeSpy).not.toHaveBeenCalled();
-        expect(startClickSpy).not.toHaveBeenCalled();
-        expect(startTouchSpy).not.toHaveBeenCalled();
-        expect(startRenderingSpy).not.toHaveBeenCalled();
-    });
-
-    it('should initialize WASM if wasmPath is configured', () => {
-        ClientLibrary.initializeClient({ wasmPath: '/fp.js' });
-
-        expect(initWasmSpy).toHaveBeenCalledWith('/fp.js');
-    });
-
-    it('should disable phantom traps when configured', () => {
-        ClientLibrary.initializeClient({ phantomTraps: false });
-
-        expect(injectPhantomTrapsSpy).not.toHaveBeenCalled();
-    });
-
-    it('should initialize honeypots with the provided field names', () => {
-        const honeypotFields = ['email_confirm', 'user_nickname'];
-        ClientLibrary.initializeClient({ honeypots: honeypotFields });
-
-        expect(initHoneypotsSpy).toHaveBeenCalledWith(honeypotFields);
-    });
-
-    it('should not initialize honeypots if the array is empty', () => {
-        ClientLibrary.initializeClient({ honeypots: [] });
-
-        expect(initHoneypotsSpy).not.toHaveBeenCalled();
-    });
-
-    it('should inject trap URLs when provided', () => {
-        const urls = ['/trap1?sig=123', '/trap2?sig=456'];
-        ClientLibrary.initializeClient({ trapUrls: urls });
-
-        expect(injectTrapsSpy).toHaveBeenCalledWith(urls);
-    });
-
-    it('should not inject trap URLs if the array is empty', () => {
-        ClientLibrary.initializeClient({ trapUrls: [] });
-
-        expect(injectTrapsSpy).not.toHaveBeenCalled();
-    });
-
-    it('should initialize fetch interception when fetch config is present', () => {
-        const targetDomains = ['api.example.com'];
-        ClientLibrary.initializeClient({ fetch: { targetDomains } });
-
-        expect(initFetchSpy).toHaveBeenCalledWith(targetDomains);
-    });
-
-    it('should not initialize fetch interception if fetch config is absent', () => {
-        ClientLibrary.initializeClient(); // No fetch config
-
-        expect(initFetchSpy).not.toHaveBeenCalled();
-    });
-
-    it('should call all initializers correctly when a full config is provided', () => {
-        const config = {
-            mouse: true,
-            keystrokes: true,
-            honeypots: ['field1'],
-            trapUrls: ['/trap1'],
-            fetch: { targetDomains: ['api.com'] }
-        };
-        ClientLibrary.initializeClient(config);
-
-        expect(startMouseSpy).toHaveBeenCalled();
-        expect(startKeystrokeSpy).toHaveBeenCalled();
-        expect(initHoneypotsSpy).toHaveBeenCalledWith(config.honeypots);
-        expect(injectTrapsSpy).toHaveBeenCalledWith(config.trapUrls);
-        expect(initFetchSpy).toHaveBeenCalledWith(config.fetch.targetDomains);
-    });
-
+import {afterEach, beforeEach, describe, expect, it, vi} from 'vitest';
+import {JSDOM} from 'jsdom';
+import ClientLibrary from '../fingerprint.client.js';
+
+// --- Setup JSDOM Environment ---
+// Vitest peut être configuré pour le faire automatiquement, mais le faire manuellement
+// ici rend le test explicite et portable.
+const dom = new JSDOM('<!DOCTYPE html><html><body></body></html>', {
+    url: 'http://localhost',
+});
+
+// In recent Node.js versions, some global properties like 'navigator', 'performance',
+// and 'screen' are read-only. To ensure our JSDOM environment works correctly across
+// all versions, we use Object.defineProperty to make these properties writable.
+Object.defineProperty(global, 'window', { value: dom.window, writable: true });
+Object.defineProperty(global, 'document', { value: dom.window.document, writable: true });
+Object.defineProperty(global, 'navigator', { value: dom.window.navigator, writable: true });
+Object.defineProperty(global, 'screen', { value: dom.window.screen, writable: true });
+Object.defineProperty(global, 'performance', { value: dom.window.performance, writable: true });
+
+global.fetch = vi.fn(); // Mock global fetch
+global.Headers = dom.window.Headers;
+global.Request = dom.window.Request;
+global.URL = dom.window.URL;
+global.TextEncoder = dom.window.TextEncoder;
+
+
+describe('ClientLibrary.initializeClient', () => {
+
+    // On utilise des espions (spies) pour vérifier si les méthodes internes sont appelées.
+    let startMouseSpy, startKeystrokeSpy, startClickSpy, startTouchSpy, startRenderingSpy, initWasmSpy, initHoneypotsSpy, injectTrapsSpy, initFetchSpy, injectPhantomTrapsSpy;
+
+    beforeEach(() => {
+        // Réinitialiser l'état du client avant chaque test
+        ClientLibrary._resetCache();
+
+        // Créer les espions sur les méthodes internes
+        startMouseSpy = vi.spyOn(ClientLibrary, 'startMouseEntropyTracker');
+        startKeystrokeSpy = vi.spyOn(ClientLibrary, 'startKeystrokeDynamicsTracker');
+        startClickSpy = vi.spyOn(ClientLibrary, 'startClickTracker');
+        startTouchSpy = vi.spyOn(ClientLibrary, 'startTouchEventTracker');
+        startRenderingSpy = vi.spyOn(ClientLibrary, 'startRenderingTracker');
+        initWasmSpy = vi.spyOn(ClientLibrary, 'initializeWasm').mockResolvedValue(undefined);
+        initHoneypotsSpy = vi.spyOn(ClientLibrary, 'initializeHoneypots');
+        injectTrapsSpy = vi.spyOn(ClientLibrary, 'injectTrapLinks');
+        initFetchSpy = vi.spyOn(ClientLibrary, 'initializeFetch');
+        injectPhantomTrapsSpy = vi.spyOn(ClientLibrary, 'injectPhantomTraps');
+    });
+
+    afterEach(() => {
+        // Restaurer les espions après chaque test pour ne pas affecter les autres tests
+        vi.restoreAllMocks();
+    });
+
+    it('should enable all trackers by default', () => {
+        ClientLibrary.initializeClient();
+
+        expect(startMouseSpy).toHaveBeenCalled();
+        expect(startKeystrokeSpy).toHaveBeenCalled();
+        expect(startClickSpy).toHaveBeenCalled();
+        expect(startTouchSpy).toHaveBeenCalled();
+        expect(startRenderingSpy).toHaveBeenCalled();
+        expect(injectPhantomTrapsSpy).toHaveBeenCalled();
+    });
+
+    it('should disable trackers when configured', () => {
+        ClientLibrary.initializeClient({ mouse: false, keystrokes: false, clicks: false, touches: false, rendering: false });
+
+        expect(startMouseSpy).not.toHaveBeenCalled();
+        expect(startKeystrokeSpy).not.toHaveBeenCalled();
+        expect(startClickSpy).not.toHaveBeenCalled();
+        expect(startTouchSpy).not.toHaveBeenCalled();
+        expect(startRenderingSpy).not.toHaveBeenCalled();
+    });
+
+    it('should initialize WASM if wasmPath is configured', () => {
+        ClientLibrary.initializeClient({ wasmPath: '/fp.js' });
+
+        expect(initWasmSpy).toHaveBeenCalledWith('/fp.js');
+    });
+
+    it('should disable phantom traps when configured', () => {
+        ClientLibrary.initializeClient({ phantomTraps: false });
+
+        expect(injectPhantomTrapsSpy).not.toHaveBeenCalled();
+    });
+
+    it('should initialize honeypots with the provided field names', () => {
+        const honeypotFields = ['email_confirm', 'user_nickname'];
+        ClientLibrary.initializeClient({ honeypots: honeypotFields });
+
+        expect(initHoneypotsSpy).toHaveBeenCalledWith(honeypotFields);
+    });
+
+    it('should not initialize honeypots if the array is empty', () => {
+        ClientLibrary.initializeClient({ honeypots: [] });
+
+        expect(initHoneypotsSpy).not.toHaveBeenCalled();
+    });
+
+    it('should inject trap URLs when provided', () => {
+        const urls = ['/trap1?sig=123', '/trap2?sig=456'];
+        ClientLibrary.initializeClient({ trapUrls: urls });
+
+        expect(injectTrapsSpy).toHaveBeenCalledWith(urls);
+    });
+
+    it('should not inject trap URLs if the array is empty', () => {
+        ClientLibrary.initializeClient({ trapUrls: [] });
+
+        expect(injectTrapsSpy).not.toHaveBeenCalled();
+    });
+
+    it('should initialize fetch interception when fetch config is present', () => {
+        const targetDomains = ['api.example.com'];
+        ClientLibrary.initializeClient({ fetch: { targetDomains } });
+
+        expect(initFetchSpy).toHaveBeenCalledWith(targetDomains);
+    });
+
+    it('should not initialize fetch interception if fetch config is absent', () => {
+        ClientLibrary.initializeClient(); // No fetch config
+
+        expect(initFetchSpy).not.toHaveBeenCalled();
+    });
+
+    it('should call all initializers correctly when a full config is provided', () => {
+        const config = {
+            mouse: true,
+            keystrokes: true,
+            honeypots: ['field1'],
+            trapUrls: ['/trap1'],
+            fetch: { targetDomains: ['api.com'] }
+        };
+        ClientLibrary.initializeClient(config);
+
+        expect(startMouseSpy).toHaveBeenCalled();
+        expect(startKeystrokeSpy).toHaveBeenCalled();
+        expect(initHoneypotsSpy).toHaveBeenCalledWith(config.honeypots);
+        expect(injectTrapsSpy).toHaveBeenCalledWith(config.trapUrls);
+        expect(initFetchSpy).toHaveBeenCalledWith(config.fetch.targetDomains);
+    });
+
 });

package/src/js/tests/fingerprint.client.test.js

@@ -1,129 +1,129 @@
-/**
- * @vitest-environment jsdom
- */
-
-import {afterEach, beforeEach, describe, expect, it, vi} from 'vitest';
-import ClientLibrary from '../fingerprint.client.js';
-
-describe('ClientLibrary WASM Integration', () => {
-    beforeEach(() => {
-        // Réinitialise le cache et les mocks avant chaque test
-        ClientLibrary._resetCache();
-        vi.spyOn(console, 'log').mockImplementation(() => {});
-        vi.spyOn(console, 'warn').mockImplementation(() => {});
-
-        // Supprime les mocks globaux pour éviter les fuites entre les tests
-        delete window.createFingerprintModule;
-    });
-
-    afterEach(() => {
-        vi.restoreAllMocks();
-    });
-
-    it('should successfully load WASM module and switch hasher', async () => {
-        // 1. Simuler un module WASM fonctionnel
-        const mockWasmModule = {
-            _hash_string: vi.fn((str) => 99999), // Un mock qui retourne une valeur distincte
-        };
-
-        // 2. Simuler le chargement du script et l'initialisation du module
-        // On attache les fonctions de simulation à `window` car c'est ce que le code cherche
-        window.createFingerprintModule = vi.fn().mockResolvedValue(mockWasmModule);
-
-        // On simule l'injection du script en appelant directement `onload`
-        vi.spyOn(document.head, 'appendChild').mockImplementation((script) => {
-            // Simule le chargement réussi du script
-            script.onload();
-            return script;
-        });
-
-        // 3. Appeler la fonction d'initialisation
-        await ClientLibrary.initializeWasm('/fake/path/to/fp.js');
-
-        // 4. Vérifier que le hasher a été remplacé
-        const wasmHash = ClientLibrary._hasher("test");
-        expect(wasmHash).toBe(99999);
-        expect(mockWasmModule._hash_string).toHaveBeenCalledWith("test");
-        expect(console.log).toHaveBeenCalledWith(expect.stringContaining('WASM module loaded successfully'));
-    });
-
-    it('should gracefully fall back to JS hasher if WASM module fails to load', async () => {
-        // 1. Simuler un échec de chargement du script
-        vi.spyOn(document.head, 'appendChild').mockImplementation((script) => {
-            script.onerror(new Error('Script loading failed'));
-            return script;
-        });
-
-        // 2. Appeler la fonction d'initialisation
-        await ClientLibrary.initializeWasm('/fake/path/to/fp.js');
-
-        // 3. Vérifier que le hasher est toujours l'implémentation JS
-        const jsHash = ClientLibrary._hasher("test");
-        const originalJsHash = (await import('../fingerprint.builder.js')).cyrb53("test");
-        
-        expect(jsHash).toBe(originalJsHash);
-        expect(console.warn).toHaveBeenCalledWith(expect.stringContaining('WASM module failed to load'), expect.any(Error));
-    });
-
-    it('should gracefully fall back if WASM module does not export _hash_string', async () => {
-        // 1. Simuler un module WASM malformé (sans la fonction attendue)
-        const mockWasmModule = {};
-        window.createFingerprintModule = vi.fn().mockResolvedValue(mockWasmModule);
-
-        vi.spyOn(document.head, 'appendChild').mockImplementation((script) => {
-            script.onload();
-            return script;
-        });
-
-        // 2. Appeler la fonction d'initialisation
-        await ClientLibrary.initializeWasm('/fake/path/to/fp.js');
-
-        // 3. Vérifier le fallback
-        const jsHash = ClientLibrary._hasher("test");
-        const originalJsHash = (await import('../fingerprint.builder.js')).cyrb53("test");
-        expect(jsHash).toBe(originalJsHash); 
-        // L'assertion est maintenant plus précise : elle vérifie le message générique ET le message d'erreur spécifique.
-        expect(console.warn).toHaveBeenCalledWith(
-            expect.stringContaining('WASM module failed to load'), 
-            expect.objectContaining({ message: 'WASM module did not export _hash_string.' })
-        );
-    });
-
-    it('should successfully load raw WASM and use standalone polymorphic hasher', async () => {
-        const mockWasmInstance = {
-            exports: {
-                memory: { buffer: new ArrayBuffer(65536) },
-                hash: vi.fn().mockReturnValue(123456)
-            }
-        };
-        
-        global.WebAssembly = {
-            compile: vi.fn().mockResolvedValue({}),
-            instantiate: vi.fn().mockResolvedValue(mockWasmInstance)
-        };
-        
-        global.fetch = vi.fn().mockResolvedValue({
-            arrayBuffer: vi.fn().mockResolvedValue(new ArrayBuffer(100))
-        });
-
-        await ClientLibrary.initializeWasm('/fp.wasm');
-
-        const hash = ClientLibrary._hasher("test");
-        expect(hash).toBe(123456);
-        expect(mockWasmInstance.exports.hash).toHaveBeenCalledWith(0, 4);
-    });
-
-    it('should use the default JS hasher if WASM is not configured', async () => {
-        // Ensure no WASM path is provided in the config
-        ClientLibrary.initializeClient({});
-
-        // Verify that the active hasher is the original JS implementation
-        const jsHash = ClientLibrary._hasher("another test string");
-        const originalJsHash = (await import('../fingerprint.builder.js')).cyrb53("another test string");
-
-        expect(jsHash).toBe(originalJsHash);
-        // Ensure no WASM-related console logs or warnings were made
-        expect(console.log).not.toHaveBeenCalledWith(expect.stringContaining('WASM module loaded successfully'));
-        expect(console.warn).not.toHaveBeenCalledWith(expect.stringContaining('WASM module failed to load'));
-    });
+/**
+ * @vitest-environment jsdom
+ */
+
+import {afterEach, beforeEach, describe, expect, it, vi} from 'vitest';
+import ClientLibrary from '../fingerprint.client.js';
+
+describe('ClientLibrary WASM Integration', () => {
+    beforeEach(() => {
+        // Réinitialise le cache et les mocks avant chaque test
+        ClientLibrary._resetCache();
+        vi.spyOn(console, 'log').mockImplementation(() => {});
+        vi.spyOn(console, 'warn').mockImplementation(() => {});
+
+        // Supprime les mocks globaux pour éviter les fuites entre les tests
+        delete window.createFingerprintModule;
+    });
+
+    afterEach(() => {
+        vi.restoreAllMocks();
+    });
+
+    it('should successfully load WASM module and switch hasher', async () => {
+        // 1. Simuler un module WASM fonctionnel
+        const mockWasmModule = {
+            _hash_string: vi.fn((str) => 99999), // Un mock qui retourne une valeur distincte
+        };
+
+        // 2. Simuler le chargement du script et l'initialisation du module
+        // On attache les fonctions de simulation à `window` car c'est ce que le code cherche
+        window.createFingerprintModule = vi.fn().mockResolvedValue(mockWasmModule);
+
+        // On simule l'injection du script en appelant directement `onload`
+        vi.spyOn(document.head, 'appendChild').mockImplementation((script) => {
+            // Simule le chargement réussi du script
+            script.onload();
+            return script;
+        });
+
+        // 3. Appeler la fonction d'initialisation
+        await ClientLibrary.initializeWasm('/fake/path/to/fp.js');
+
+        // 4. Vérifier que le hasher a été remplacé
+        const wasmHash = ClientLibrary._hasher("test");
+        expect(wasmHash).toBe(99999);
+        expect(mockWasmModule._hash_string).toHaveBeenCalledWith("test");
+        expect(console.log).toHaveBeenCalledWith(expect.stringContaining('WASM module loaded successfully'));
+    });
+
+    it('should gracefully fall back to JS hasher if WASM module fails to load', async () => {
+        // 1. Simuler un échec de chargement du script
+        vi.spyOn(document.head, 'appendChild').mockImplementation((script) => {
+            script.onerror(new Error('Script loading failed'));
+            return script;
+        });
+
+        // 2. Appeler la fonction d'initialisation
+        await ClientLibrary.initializeWasm('/fake/path/to/fp.js');
+
+        // 3. Vérifier que le hasher est toujours l'implémentation JS
+        const jsHash = ClientLibrary._hasher("test");
+        const originalJsHash = (await import('../fingerprint.builder.js')).cyrb53("test");
+        
+        expect(jsHash).toBe(originalJsHash);
+        expect(console.warn).toHaveBeenCalledWith(expect.stringContaining('WASM module failed to load'), expect.any(Error));
+    });
+
+    it('should gracefully fall back if WASM module does not export _hash_string', async () => {
+        // 1. Simuler un module WASM malformé (sans la fonction attendue)
+        const mockWasmModule = {};
+        window.createFingerprintModule = vi.fn().mockResolvedValue(mockWasmModule);
+
+        vi.spyOn(document.head, 'appendChild').mockImplementation((script) => {
+            script.onload();
+            return script;
+        });
+
+        // 2. Appeler la fonction d'initialisation
+        await ClientLibrary.initializeWasm('/fake/path/to/fp.js');
+
+        // 3. Vérifier le fallback
+        const jsHash = ClientLibrary._hasher("test");
+        const originalJsHash = (await import('../fingerprint.builder.js')).cyrb53("test");
+        expect(jsHash).toBe(originalJsHash); 
+        // L'assertion est maintenant plus précise : elle vérifie le message générique ET le message d'erreur spécifique.
+        expect(console.warn).toHaveBeenCalledWith(
+            expect.stringContaining('WASM module failed to load'), 
+            expect.objectContaining({ message: 'WASM module did not export _hash_string.' })
+        );
+    });
+
+    it('should successfully load raw WASM and use standalone polymorphic hasher', async () => {
+        const mockWasmInstance = {
+            exports: {
+                memory: { buffer: new ArrayBuffer(65536) },
+                hash: vi.fn().mockReturnValue(123456)
+            }
+        };
+        
+        global.WebAssembly = {
+            compile: vi.fn().mockResolvedValue({}),
+            instantiate: vi.fn().mockResolvedValue(mockWasmInstance)
+        };
+        
+        global.fetch = vi.fn().mockResolvedValue({
+            arrayBuffer: vi.fn().mockResolvedValue(new ArrayBuffer(100))
+        });
+
+        await ClientLibrary.initializeWasm('/fp.wasm');
+
+        const hash = ClientLibrary._hasher("test");
+        expect(hash).toBe(123456);
+        expect(mockWasmInstance.exports.hash).toHaveBeenCalledWith(0, 4);
+    });
+
+    it('should use the default JS hasher if WASM is not configured', async () => {
+        // Ensure no WASM path is provided in the config
+        ClientLibrary.initializeClient({});
+
+        // Verify that the active hasher is the original JS implementation
+        const jsHash = ClientLibrary._hasher("another test string");
+        const originalJsHash = (await import('../fingerprint.builder.js')).cyrb53("another test string");
+
+        expect(jsHash).toBe(originalJsHash);
+        // Ensure no WASM-related console logs or warnings were made
+        expect(console.log).not.toHaveBeenCalledWith(expect.stringContaining('WASM module loaded successfully'));
+        expect(console.warn).not.toHaveBeenCalledWith(expect.stringContaining('WASM module failed to load'));
+    });
 });

package/src/js/tests/fingerprint.test.js

@@ -31,6 +31,7 @@ const {
     default_whitelist,
     stopThresholdAutoTuning,
     getCompositeDeviceHash,
+    sanitizeTrafficData,
 } = fingerprint;
 const { store, getRequestPatternScore, getDeviceHash } = __internal;
 const { getRenderingAnomalyScore } = __internal;
@@ -1083,6 +1084,35 @@ describe('Fingerprint & PoW Security Suite', () => {
     describe('Threshold Auto-Tuning', () => {
         let setIntervalSpy, clearIntervalSpy, consoleLogSpy;
 
+    test('should sanitize traffic data based on stable hardware cluster', async () => {
+        const trafficData = [];
+        // Attacker rotating IPs and deviceIds but having the same hardware fingerprint
+        for (let i = 0; i < 100; i++) {
+            trafficData.push({
+                type: 'trap_triggered',
+                deviceId: `attacker-dev-${i}`,
+                clientIp: `192.168.1.${i}`,
+                fingerprint: 'gpu:spoofed-nvidia-gpu|cvs:spoofed-canvas-data'
+            });
+        }
+
+        // Unique legit users
+        for (let i = 0; i < 10; i++) {
+            trafficData.push({
+                type: 'challenge_solved',
+                deviceId: `legit-dev-${i}`,
+                clientIp: `10.0.0.${i}`,
+                fingerprint: `gpu:legit-gpu-${i}|cvs:legit-canvas-${i}`
+            });
+        }
+
+        const sanitized = sanitizeTrafficData(trafficData);
+        const attackerLogs = sanitized.filter(log => log.deviceId.startsWith('attacker-dev-'));
+
+        // Total 110 logs. 2% limit = Math.max(3, 2) = 3.
+        expect(attackerLogs.length).toBeLessThanOrEqual(3);
+    });
+
         beforeEach(() => {
             setIntervalSpy = vi.spyOn(global, 'setInterval');
             clearIntervalSpy = vi.spyOn(global, 'clearInterval');
@@ -2305,9 +2335,9 @@ describe('Subnet Scoring (Node.js)', () => {
         // The new version handles other prefixes
         expect(getIpSubnet('10.20.30.40', 16)).toBe('10.20.0.0/16');
         // IPv6
-        expect(getIpSubnet('2001:db8:abcd:0012:0000:0000:0000:0001', 48)).toBe('2001:db8:abcd:0:0:0:0:0/48');
+        expect(getIpSubnet('2001:db8:abcd:0012:0000:0000:0000:0001', 48)).toBe('2001:0db8:abcd:0000:0000:0000:0000:0000/48');
         // The new version handles other prefixes
-        expect(getIpSubnet('2a01:e0a:129:57c0:a1b2:c3d4:e5f6:a7b8', 64)).toBe('2a01:e0a:129:0:0:0:0:0/48');
+        expect(getIpSubnet('2a01:e0a:129:57c0:a1b2:c3d4:e5f6:a7b8', 64)).toBe('2a01:0e0a:0129:0000:0000:0000:0000:0000/48');
         // Invalid IPs
         expect(getIpSubnet('not-an-ip')).toBeNull();
     });

package/src/js/tests/ip-reputation.test.js

@@ -96,7 +96,7 @@ describe('IP Reputation Local System (Node.js)', () => {
         expect(ipv4Subnet).toBe('192.168.1.0/24');
 
         const ipv6Subnet = __internal.getIpSubnet('2001:db8:abcd:12::1', 24, 48);
-        expect(ipv6Subnet).toBe('2001:db8:abcd:0:0:0:0:0/48');
+        expect(ipv6Subnet).toBe('2001:0db8:abcd:0000:0000:0000:0000:0000/48');
     });
 
     it('should calculate client hints inconsistency score correctly', async () => {

package/src/js/tests/pow.solver.test.js

@@ -223,9 +223,12 @@ describe('Proof-of-Work Solvers', () => {
             const seed = 'test-wasm-seed';
             const difficulty = 4; // 4 MB
 
-            const solution = await solveMemory(seed, difficulty);
+            const result = await solveMemory(seed, difficulty);
 
-            expect(solution).toBe(777);
+            expect(result).toBeInstanceOf(Object);
+            expect(result.solution).toBe(777);
+            expect(result.merkleRoot).toBeDefined();
+            expect(result.proofs).toBeDefined();
             expect(mockWasmModule._malloc).toHaveBeenCalledTimes(1);
             expect(mockWasmModule._free).toHaveBeenCalledTimes(1);
             expect(mockWasmModule._solve_memory_challenge).toHaveBeenCalledWith(1234, difficulty);