@anonympins/fingerprint 0.5.2 → 0.5.5

package/CHANGELOG.md

@@ -1,3 +1,30 @@
+## Version 0.5.5
+
+- **🔒 Client Session Handshake & HMAC Metric Signing**: Implemented elliptic-curve Diffie-Hellman (ECDH over curve `P-256`) key exchange protocol during client initialization (`?fp_handshake=1`). Leveraged the negotiated session key to cryptographically sign behavioral metrics (`signMetrics`) on the client using HMAC-SHA256, protecting against replay attacks and telemetry tampering.
+- **🧵 Non-Blocking Polymorphic Obfuscation Worker**: Offloaded CPU-heavy JavaScript obfuscation and parsing pipelines (`compilePolymorphicJs`) to a dedicated Node.js Worker Thread (`obfuscation.worker.js`). This isolates resource-intensive obfuscation tasks from the main event loop, preventing latency spikes on production servers.
+- **💾 Performance Optimizations with SimpleLRUCache**: Added an in-memory `SimpleLRUCache` to eliminate synchronous file system calls (`readFileSync`). Standardized caching of custom HTML challenge pages and static files (`fp.js`/`fp.wasm`).
+- **🛡️ Auto-Tuner Stability Guardrails & Rollbacks**: Implemented post-calculation validation checks with a configurable `validationTolerance` threshold (default `0.15`). Automatically rolls back unstable parameters and triggers an `autotuning_instability_alert` if proposed changes degrade FPR/FNR metrics.
+- **🧬 Strict Multi-Language Cross-Parity**: Aligned 32-bit single-precision floating-point (IEEE 754) calculations for chaotic map trajectories across WebGPU, WebGL, C++ WASM, and PHP environments. Guaranteed bit-to-bit convergence across 1,000 random seeds.
+- **🧮 Fixed Zero Threshold PoW Shift Error**: Patched a potential bitwise shift crash (`1n << shift` with a negative shift) inside `calculateTarget` when the suspicion score dropped to or below zero. Legitimate requests now resolve directly to the maximum target range.
+
+## Version 0.5.4
+
+- **🔒 JA3/JA4 Handshake Parsing Hardening (PHP/Python)**: Fixed ALPN length constraints and untangled nested loops in the binary TLS Client Hello decoder, ensuring native and highly reliable raw JA4 fingerprint calculations directly at the socket layer.
+- **⚡ Dynamic WebAssembly (WASM) & Memory Safety**: Secured heap memory allocation and the dynamic loading of the polymorphic WASM module. Added comprehensive client-side unit tests to validate safe execution and clean memory deallocation.
+- **🛠️ Useful Proof-of-Work (uPoW) & Integration Tests**: Finalized the end-to-end integration and orchestration of uPoW tasks, backed by robust validation tests for multi-objective optimization models (specifically CPC and fraud detection).
+- **🛡️ Store Resilience & CHIPS Cookie Support**: Enhanced fault tolerance for Redis and MongoDB database adapters with seamless, automatic fallback to local in-memory storage during network drops. Standardized CHIPS (`Partitioned`) cookie attributes across secure HTTPS environments.
+- **📁 Deterministic Path Resolution Fixes**: Implemented robust absolute and relative path resolution for loading configuration files (such as `problems.config.json`) uniformly across Node.js, PHP, and Python environments.
+
+## Version 0.5.3
+
+- **DNS Circuit Breaker with Strict Timeouts**: Protected reverse/forward DNS verification of legitimate crawlers against DNS server degradation or DDoS exhaustion. Integrated a stateful Circuit Breaker (`CLOSED`, `OPEN`, `HALF-OPEN`) with a strict **500 ms timeout** and **5-minute temporary negative caching** on resolution failures.
+- **Anti-Poisoning via Hardware Clustering**: Hardened `sanitizeTrafficData` to cluster traffic logs by stable hardware signatures (Canvas + GPU + CPU). Contributions from any single hardware footprint are strictly capped to **2% of the dataset**, neutralizing massive proxy-rotation Sybil attacks designed to manipulate tuning thresholds.
+- **Memory-Safe Traffic Pruning**: Standardized `pruneTrafficData` across Node.js and PHP engines. Includes strict time-based decay and size-capping policy, keeping the in-memory footprint minimal and preventing leaks during long-running background tuning sessions.
+- **Enhanced Subnet Detection**: Upgraded IPv4 and IPv6 subnet masking routines (`getIpSubnet`). Implemented proper binary bitwise masking and IPv6 compression normalization (`::` expansion), ensuring high-reliability network block reputation scoring (`subnetScore`).
+- **Centralized Problem Configuration**: Relocated `problems.config.json` to the central `/config` directory for unified configuration management and cleaner multi-environment deployments.
+- **Stealthy Honeypot Enhancements**: Hardened client-side honeypots by dynamically rendering hidden input elements inside a closed Shadow DOM using nested randomized CSS variables, effectively evading detection by headless crawlers.
+- **Mathematical Benford Test Optimization**: Re-engineered `benfordTest` across JavaScript, PHP, and Python to extract the first significant digit using math operations (logarithms and modulo) instead of string casts, significantly boosting performance on large time-series.
+
 ## Version 0.5.2
 
 - Security updates (CodeQL issues fixed)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anonympins/fingerprint",
-  "version": "0.5.2",
+  "version": "0.5.5",
   "description": "Advanced anti-bot library for Node.js using multi-layer fingerprinting (JA3, client-side, headers), behavioral analysis, and adaptive Proof-of-Work (PoW) challenges to mitigate scraping, scalping, and automated threats.",
   "main": "index.js",
   "type": "module",

package/src/js/build-client.js

@@ -1,68 +1,68 @@
-import {promises as fs} from 'node:fs';
-import {dirname, join} from 'node:path';
-import {fileURLToPath} from 'node:url';
-import {exec} from 'node:child_process';
-import JavaScriptObfuscator from 'javascript-obfuscator';
-
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
-
-/**
- * Tente d'exécuter la commande de build pour le module WASM.
- * Ne bloque pas le build si la commande échoue (ex: em++ non trouvé).
- */
-function buildWasm() {
-  return new Promise((resolve) => {
-    console.log('Attempting to build WASM module (optional)...');
-    const command = "em++ src/cpp/main.cpp src/cpp/utils.cpp -o public/fp.js -s WASM=1 -s MODULARIZE=1 -s EXPORT_NAME='createFingerprintModule' -s \"EXPORTED_FUNCTIONS=['_hash_string','_solve_cpu_target','_solve_memory_challenge']\" -O3 --no-entry";
-    
-    exec(command, (error, stdout, stderr) => {
-      if (error) {
-        console.warn('WASM build failed (this is optional and can be ignored):', stderr);
-      } else {
-        console.log('WASM module built successfully.');
-      }
-      resolve(); // Toujours résoudre la promesse pour ne pas bloquer le build principal.
-    });
-  });
-}
-
-async function buildClientScript() {
-  try {
-    console.log('Reading client script...');
-    const clientScriptPath = join(__dirname, 'fingerprint.client.js');
-    const clientScriptContent = await fs.readFile(clientScriptPath, 'utf-8');
-
-    console.log('Obfuscating client script...');
-    const obfuscationResult = JavaScriptObfuscator.obfuscate(clientScriptContent, {
-      compact: true,
-      controlFlowFlattening: true, // Aplatit le flux de contrôle
-      deadCodeInjection: true, // Injecte du code mort
-      stringArray: true,
-      stringArrayRotate: true, // Fait tourner le tableau de chaînes
-      stringArrayShuffle: true, // Mélange le tableau de chaînes
-      // L'utilisation d'une graine (seed) de 0 signifie que l'obfuscation sera déterministe
-      // pour une même entrée. Pour une obfuscation unique à chaque build, on peut utiliser
-      // une graine aléatoire, par exemple : seed: Math.random()
-      seed: Math.random(),
-      selfDefending: true,
-    });
-
-    const obfuscatedCode = obfuscationResult.getObfuscatedCode();
-
-    console.log('Writing obfuscated script to fingerprint.client.obfuscated.js...');
-    await fs.writeFile(join(__dirname, './fingerprint.client.obfuscated.js'), obfuscatedCode);
-
-    console.log('Client script build process completed successfully.');
-  } catch (error) {
-    console.error('Error during client script build:', error);
-    process.exit(1);
-  }
-}
-
-async function main() {
-  await buildClientScript();
-  await buildWasm();
-}
-
+import {promises as fs} from 'node:fs';
+import {dirname, join} from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {exec} from 'node:child_process';
+import JavaScriptObfuscator from 'javascript-obfuscator';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+
+/**
+ * Tente d'exécuter la commande de build pour le module WASM.
+ * Ne bloque pas le build si la commande échoue (ex: em++ non trouvé).
+ */
+function buildWasm() {
+  return new Promise((resolve) => {
+    console.log('Attempting to build WASM module (optional)...');
+    const command = "em++ src/cpp/main.cpp src/cpp/utils.cpp -o public/fp.js -s WASM=1 -s MODULARIZE=1 -s EXPORT_NAME='createFingerprintModule' -s \"EXPORTED_FUNCTIONS=['_hash_string','_solve_cpu_target','_solve_memory_challenge','_generate_gpu_pow_trajectory']\" -O3 --no-entry";
+    
+    exec(command, (error, stdout, stderr) => {
+      if (error) {
+        console.warn('WASM build failed (this is optional and can be ignored):', stderr);
+      } else {
+        console.log('WASM module built successfully.');
+      }
+      resolve(); // Toujours résoudre la promesse pour ne pas bloquer le build principal.
+    });
+  });
+}
+
+async function buildClientScript() {
+  try {
+    console.log('Reading client script...');
+    const clientScriptPath = join(__dirname, 'fingerprint.client.js');
+    const clientScriptContent = await fs.readFile(clientScriptPath, 'utf-8');
+
+    console.log('Obfuscating client script...');
+    const obfuscationResult = JavaScriptObfuscator.obfuscate(clientScriptContent, {
+      compact: true,
+      controlFlowFlattening: true, // Aplatit le flux de contrôle
+      deadCodeInjection: true, // Injecte du code mort
+      stringArray: true,
+      stringArrayRotate: true, // Fait tourner le tableau de chaînes
+      stringArrayShuffle: true, // Mélange le tableau de chaînes
+      // L'utilisation d'une graine (seed) de 0 signifie que l'obfuscation sera déterministe
+      // pour une même entrée. Pour une obfuscation unique à chaque build, on peut utiliser
+      // une graine aléatoire, par exemple : seed: Math.random()
+      seed: Math.random(),
+      selfDefending: true,
+    });
+
+    const obfuscatedCode = obfuscationResult.getObfuscatedCode();
+
+    console.log('Writing obfuscated script to fingerprint.client.obfuscated.js...');
+    await fs.writeFile(join(__dirname, './fingerprint.client.obfuscated.js'), obfuscatedCode);
+
+    console.log('Client script build process completed successfully.');
+  } catch (error) {
+    console.error('Error during client script build:', error);
+    process.exit(1);
+  }
+}
+
+async function main() {
+  await buildClientScript();
+  await buildWasm();
+}
+
 main();

package/src/js/fingerprint.client.js

@@ -1,14 +1,96 @@
 import {cyrb53 as jsCyrb53, FingerprintBuilder} from './fingerprint.builder.js';
 import {solveChallenge} from './pow.solver.js';
 
+function secureRandom() {
+    if (typeof window !== 'undefined' && (window.crypto || window.msCrypto)) {
+        const array = new Uint32Array(1);
+        (window.crypto || window.msCrypto).getRandomValues(array);
+        return array[0] / 0x100000000;
+    }
+    return Math.random();
+}
+
 // Variable pour stocker la fonction de hachage active.
 // Par défaut, c'est l'implémentation JavaScript.
 let activeCyrb53 = jsCyrb53;
+let derivedKey = null;
+
+async function negotiateSessionKey() {
+    if (typeof window === 'undefined' || !window.crypto || !window.crypto.subtle) return;
+    try {
+        const keyPair = await window.crypto.subtle.generateKey(
+            { name: "ECDH", namedCurve: "P-256" },
+            false,
+            ["deriveKey"]
+        );
+        const clientPubKeyBuffer = await window.crypto.subtle.exportKey("raw", keyPair.publicKey);
+        const clientPubKeyHex = Array.from(new Uint8Array(clientPubKeyBuffer))
+            .map(b => b.toString(16).padStart(2, '0'))
+            .join('');
+
+        const response = await fetch(window.location.pathname + '?fp_handshake=1', {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'x-client-ephemeral-key': clientPubKeyHex
+            },
+            body: JSON.stringify({ fp: ClientLibrary.getDeviceFingerprint() })
+        });
+
+        const serverPubKeyHex = response.headers.get('x-server-ephemeral-key');
+        if (serverPubKeyHex) {
+            const serverPubKeyBuffer = new Uint8Array(
+                serverPubKeyHex.match(/.{1,2}/g).map(byte => parseInt(byte, 16))
+            );
+            const serverPubKey = await window.crypto.subtle.importKey(
+                "raw",
+                serverPubKeyBuffer,
+                { name: "ECDH", namedCurve: "P-256" },
+                true,
+                []
+            );
+            derivedKey = await window.crypto.subtle.deriveKey(
+                { name: "ECDH", public: serverPubKey },
+                keyPair.privateKey,
+                { name: "HMAC", hash: "SHA-256", length: 256 },
+                true,
+                ["sign"]
+            );
+            console.log('[Fingerprint] Cryptographic session negotiated successfully.');
+        }
+    } catch (e) {
+        console.warn('[Fingerprint] Cryptographic session negotiation failed:', e);
+    }
+}
+
+async function signMetrics(metricsObj) {
+    if (!derivedKey) return metricsObj;
+    try {
+        const copy = JSON.parse(JSON.stringify(metricsObj));
+        delete copy.signature;
+        const dataToSign = new TextEncoder().encode(JSON.stringify(copy));
+        const signatureBuffer = await window.crypto.subtle.sign(
+            "HMAC",
+            derivedKey,
+            dataToSign
+        );
+        copy.signature = Array.from(new Uint8Array(signatureBuffer))
+            .map(b => b.toString(16).padStart(2, '0'))
+            .join('');
+        return copy;
+    } catch (e) {
+        return metricsObj;
+    }
+}
 
 const DB_NAME = 'wasm-cache-db';
 const DB_VERSION = 1;
 const STORE_NAME = 'wasm-modules';
 
+const genRandStr = (len = 8) => {
+    return Array.from({ length: len }, () => String.fromCharCode(97 + Math.floor(secureRandom() * 26))).join('');
+};
+
 function getCachedWasm(url) {
     return new Promise((resolve) => {
         if (typeof indexedDB === 'undefined') return resolve(null);
@@ -282,8 +364,10 @@ const ClientLibrary = {
         // Création d'un élément interactif fantôme
         const phantom = document.createElement('a');
         phantom.href = '#';
-        // Nom trompeur pour attirer les analyseurs automatiques de liens / formulaires
-        phantom.id = 'sys-session-recovery';
+        // Nom trompeur aléatoire pour attirer les analyseurs automatiques de liens / formulaires
+        const phantomNames = ['sys-session-recovery', 'auth-token-refresh', 'debug-console-login', 'admin-portal-access', 'security-bypass-bypass', 'recovery-key-session', 'api-key-test', 'client-secrets-access'];
+        phantom.id = phantomNames[Math.floor(secureRandom() * phantomNames.length)] + '-' + genRandStr(6);
+        phantom.className = genRandStr(8);
         phantom.tabIndex = 0; // Dans le flux naturel de tabulation
         phantom.setAttribute('aria-hidden', 'true'); // Masqué pour les screen readers légitimes
 
@@ -305,7 +389,21 @@ const ClientLibrary = {
         phantom.addEventListener('focus', triggerTrap, { passive: true });
         phantom.addEventListener('mouseover', triggerTrap, { passive: true });
 
-        document.body.appendChild(phantom);
+        // Imbrication polymorphique du piège fantôme dans le corps du document
+        const nestingOptions = [
+            () => document.body.appendChild(phantom),
+            () => {
+                const wrapper = document.createElement(secureRandom() > 0.5 ? 'span' : 'div');
+                wrapper.className = genRandStr(8);
+                wrapper.style.position = 'absolute';
+                wrapper.style.width = '0';
+                wrapper.style.height = '0';
+                wrapper.style.overflow = 'hidden';
+                wrapper.appendChild(phantom);
+                document.body.appendChild(wrapper);
+            }
+        ];
+        nestingOptions[Math.floor(secureRandom() * nestingOptions.length)]();
     },
 
     /**
@@ -631,26 +729,35 @@ const ClientLibrary = {
 
             const shadow = host.attachShadow({ mode: 'closed' });
 
+            // Aléatisation des classes, variables CSS et balises de structure
+            const wrapperClass = genRandStr(10);
+            const posStateVar = `--${genRandStr(8)}`;
+            const offValVar = `--${genRandStr(8)}`;
+            const visStateVar = `--${genRandStr(8)}`;
+            const scaleValVar = `--${genRandStr(8)}`;
+
             const style = document.createElement('style');
             style.textContent = `
               :host {
-                --trap-pos-state: absolute;
-                --trap-off-val: -9999px;
-                --trap-vis-state: hidden;
-                --trap-scale-val: 0;
+                ${posStateVar}: absolute;
+                ${offValVar}: -9999px;
+                ${visStateVar}: hidden;
+                ${scaleValVar}: 0;
               }
-              .shadow-form-wrapper {
-                position: var(--trap-pos-state);
-                left: var(--trap-off-val);
-                top: var(--trap-off-val);
-                visibility: var(--trap-vis-state);
-                transform: scale(var(--trap-scale-val));
+              .${wrapperClass} {
+                position: var(${posStateVar});
+                left: var(${offValVar});
+                top: var(${offValVar});
+                visibility: var(${visStateVar});
+                transform: scale(var(${scaleValVar}));
               }
             `;
             shadow.appendChild(style);
 
-            const wrapper = document.createElement('div');
-            wrapper.className = 'shadow-form-wrapper';
+            const wrapperTags = ['div', 'section', 'p', 'span', 'form', 'main'];
+            const selectedWrapperTag = wrapperTags[Math.floor(secureRandom() * wrapperTags.length)];
+            const wrapper = document.createElement(selectedWrapperTag);
+            wrapper.className = wrapperClass;
 
             honeypotFieldNames.forEach(fieldName => {
                 const label = document.createElement('label');
@@ -659,6 +766,8 @@ const ClientLibrary = {
                 input.type = 'text';
                 input.name = fieldName;
                 input.tabIndex = -1;
+                input.className = genRandStr(6);
+                input.id = genRandStr(8);
                 input.autocomplete = 'off';
 
                 const trigger = () => {
@@ -669,14 +778,108 @@ const ClientLibrary = {
                 input.addEventListener('change', trigger, { passive: true });
                 input.addEventListener('focus', trigger, { passive: true });
 
-                wrapper.appendChild(label);
-                wrapper.appendChild(input);
+                // Imbrication polymorphique du label et de l'input
+                const nestingType = Math.floor(secureRandom() * 3);
+                if (nestingType === 1) {
+                    label.appendChild(input);
+                    wrapper.appendChild(label);
+                } else if (nestingType === 2) {
+                    const innerContainer = document.createElement(secureRandom() > 0.5 ? 'span' : 'div');
+                    innerContainer.className = genRandStr(5);
+                    innerContainer.appendChild(label);
+                    innerContainer.appendChild(input);
+                    wrapper.appendChild(innerContainer);
+                } else {
+                    wrapper.appendChild(label);
+                    wrapper.appendChild(input);
+                }
             });
 
             shadow.appendChild(wrapper);
             document.body.appendChild(host);
         }
     },
+    /**
+     * Sollicite silencieusement l'attestation matérielle FIDO2 (WebAuthn)
+     * pour ancrer l'identité physique de l'appareil via TPM / Secure Enclave.
+     * @returns {Promise<object|null>}
+     */
+    async getWebAuthnAnchor() {
+        if (typeof window === 'undefined' || !window.PublicKeyCredential) return null;
+        try {
+            const isPlatformAvailable = await PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable();
+            if (!isPlatformAvailable) return null;
+
+            const storedCredIdBase64 = localStorage.getItem('fp_webauthn_cred_id');
+            const challenge = new Uint8Array([109, 101, 116, 114, 105, 99, 115, 95, 97, 110, 99, 104, 111, 114, 95, 115, 101, 99, 117, 114, 101]); // Static stable challenge
+
+            if (storedCredIdBase64) {
+                // Tentative d'assertion silencieuse (Authentification)
+                const credentialId = Uint8Array.from(atob(storedCredIdBase64), c => c.charCodeAt(0));
+                const assertion = await navigator.credentials.get({
+                    publicKey: {
+                        challenge,
+                        allowCredentials: [{
+                            id: credentialId,
+                            type: 'public-key'
+                        }],
+                        userVerification: 'discouraged',
+                        timeout: 1000
+                    }
+                });
+                if (assertion) {
+                    return {
+                        type: 'assertion',
+                        credentialId: storedCredIdBase64,
+                        signature: btoa(String.fromCharCode(...new Uint8Array(assertion.response.signature))),
+                        authenticatorData: btoa(String.fromCharCode(...new Uint8Array(assertion.response.authenticatorData))),
+                        clientDataJSON: btoa(String.fromCharCode(...new Uint8Array(assertion.response.clientDataJSON)))
+                    };
+                }
+            } else {
+                // Création silencieuse (Enregistrement initial)
+                const options = {
+                    publicKey: {
+                        challenge,
+                        rp: { name: window.location.hostname, id: window.location.hostname },
+                        user: {
+                            id: new Uint8Array([102, 112, 105, 100]),
+                            name: 'silent-device-anchor',
+                            displayName: 'Hardware Device Anchor'
+                        },
+                        pubKeyCredParams: [
+                            { type: 'public-key', alg: -7 },  // ES256 (P-256) - Secure Enclave / TPM / Android Keystore
+                            { type: 'public-key', alg: -257 } // RS256 - Windows Hello TPM
+                        ],
+                        authenticatorSelection: {
+                            authenticatorAttachment: 'platform',
+                            userVerification: 'discouraged',
+                            residentKey: 'preferred'
+                        },
+                        timeout: 1500,
+                        attestation: 'indirect'
+                    }
+                };
+                const credential = await navigator.credentials.create(options);
+                if (credential) {
+                    const credIdBase64 = btoa(String.fromCharCode(...new Uint8Array(credential.rawId)));
+                    localStorage.setItem('fp_webauthn_cred_id', credIdBase64);
+                    const publicKeyDer = credential.response.getPublicKey ? credential.response.getPublicKey() : null;
+                    return {
+                        type: 'registration',
+                        credentialId: credIdBase64,
+                        publicKey: publicKeyDer ? btoa(String.fromCharCode(...new Uint8Array(publicKeyDer))) : null,
+                        attestationObject: btoa(String.fromCharCode(...new Uint8Array(credential.response.getAttestationObject()))),
+                        clientDataJSON: btoa(String.fromCharCode(...new Uint8Array(credential.response.clientDataJSON)))
+                    };
+                }
+            }
+        } catch (e) {
+            // Ignore et bypass silencieusement pour garder l'invisibilité en cas de non-support
+            console.log('[WebAuthn-Anchor] Silent attestation bypassed:', e.message);
+        }
+        return null;
+    },
 
     /**
      * Récupère les métriques comportementales collectées.
@@ -717,7 +920,8 @@ const ClientLibrary = {
      */
     async protectedFetch(resource, options = {}) {
         const fp = this.getDeviceFingerprint();
-        const behavior = this.getClientBehaviorMetrics();
+        const rawBehavior = this.getClientBehaviorMetrics();
+        const behavior = await signMetrics(rawBehavior);
 
         const headers = new Headers(options.headers || {});
         headers.set('X-Device-Fingerprint', fp);
@@ -784,7 +988,7 @@ const ClientLibrary = {
    * Si non fourni, protège les requêtes de même origine.
    */
   initializeFetch(targetDomains = []) {
-    const fingerprintInterceptor = (resource, options, next) => {        
+    const fingerprintInterceptor = async (resource, options, next) => {        
         const requestUrl = (resource instanceof Request) ? resource.url : String(resource);        
         let shouldProtect = false;
 
@@ -803,7 +1007,8 @@ const ClientLibrary = {
 
         if (shouldProtect) {
             const fp = this.getDeviceFingerprint();
-            const behavior = this.getClientBehaviorMetrics();
+            const rawBehavior = this.getClientBehaviorMetrics();
+            const behavior = await signMetrics(rawBehavior);
             const headers = new Headers(options.headers || {});
             headers.set('X-Device-Fingerprint', fp);
             headers.set('X-Behavior-Metrics', JSON.stringify(behavior));
@@ -836,39 +1041,67 @@ const ClientLibrary = {
 
     const shadow = host.attachShadow({ mode: 'closed' });
 
+        // Aléatisation des classes, variables CSS et balises de structure
+        const wrapperClass = genRandStr(10);
+        const layoutPosVar = `--${genRandStr(8)}`;
+        const offsetValVar = `--${genRandStr(8)}`;
+        const visibilityStateVar = `--${genRandStr(8)}`;
+        const scaleFactorVar = `--${genRandStr(8)}`;
+        const ptrEventsVar = `--${genRandStr(8)}`;
+        const linkColorClass = genRandStr(6);
+
     const style = document.createElement('style');
     style.textContent = `
       :host {
-        --trap-layout-pos: absolute;
-        --trap-offset-val: -9999px;
-        --trap-visibility-state: hidden;
-        --trap-scale-factor: 0;
-        --trap-ptr-events: none;
+            ${layoutPosVar}: absolute;
+            ${offsetValVar}: -9999px;
+            ${visibilityStateVar}: hidden;
+            ${scaleFactorVar}: 0;
+            ${ptrEventsVar}: none;
       }
-      .shadow-trap-wrapper {
-        position: var(--trap-layout-pos);
-        left: var(--trap-offset-val);
-        top: var(--trap-offset-val);
-        visibility: var(--trap-visibility-state);
-        transform: scale(var(--trap-scale-factor));
-        pointer-events: var(--trap-ptr-events);
+          .${wrapperClass} {
+            position: var(${layoutPosVar});
+            left: var(${offsetValVar});
+            top: var(${offsetValVar});
+            visibility: var(${visibilityStateVar});
+            transform: scale(var(${scaleFactorVar}));
+            pointer-events: var(${ptrEventsVar});
       }
-      a {
+          .${linkColorClass} {
         color: transparent;
         text-decoration: none;
       }
     `;
     shadow.appendChild(style);
 
-    const wrapper = document.createElement('div');
-    wrapper.className = 'shadow-trap-wrapper';
+        const wrapperTags = ['div', 'section', 'p', 'span', 'nav', 'aside'];
+        const selectedWrapperTag = wrapperTags[Math.floor(secureRandom() * wrapperTags.length)];
+        const wrapper = document.createElement(selectedWrapperTag);
+        wrapper.className = wrapperClass;
 
     urls.forEach((url, i) => {
       const link = document.createElement('a');
       link.href = url;
       link.rel = 'nofollow';
       link.tabIndex = -1;
-      link.innerHTML = `<span>&gt; ${i + 1}</span>`;
+          link.className = linkColorClass;
+          link.id = genRandStr(8);
+
+          // Structure interne polymorphique du lien
+          const contentNestingType = Math.floor(secureRandom() * 3);
+          if (contentNestingType === 1) {
+              const span = document.createElement('span');
+              span.className = genRandStr(5);
+              span.innerHTML = `&gt; ${i + 1}`;
+              link.appendChild(span);
+          } else if (contentNestingType === 2) {
+              const b = document.createElement('b');
+              b.className = genRandStr(5);
+              b.innerHTML = `&gt; ${i + 1}`;
+              link.appendChild(b);
+          } else {
+              link.innerHTML = `<span>&gt; ${i + 1}</span>`;
+          }
 
       const trigger = () => {
         this.onHoneypotTrigger();
@@ -877,7 +1110,15 @@ const ClientLibrary = {
       link.addEventListener('focus', trigger, { passive: true });
       link.addEventListener('mouseover', trigger, { passive: true });
 
-      wrapper.appendChild(link);
+          // Imbrication du lien de manière polymorphique
+          if (secureRandom() > 0.5) {
+              const itemContainer = document.createElement('span');
+              itemContainer.className = genRandStr(5);
+              itemContainer.appendChild(link);
+              wrapper.appendChild(itemContainer);
+          } else {
+              wrapper.appendChild(link);
+          }
     });
 
     shadow.appendChild(wrapper);
@@ -912,7 +1153,7 @@ const ClientLibrary = {
 
       this._dispatchEvent('challengeSolved', { solution: solutionWrapper.rawSolution });
       // Ajouter la solution aux paramètres de la requête pour le nouvel essai
-      const url = new URL((resource instanceof Request) ? resource.url : String(resource), window.location.origin);
+              const url = new URL((resource instanceof Request) ? resource.url : String(resource), window.location.origin);
       // La logique de formatage est maintenant cachée dans la classe ChallengeSolution.
       solutionWrapper.applyToUrl(url);
 
@@ -949,6 +1190,7 @@ const ClientLibrary = {
         fetch: fetchConfig = {}
     } = config;
 
+        negotiateSessionKey();
     // Tentative de chargement du WASM si le chemin est fourni
     if (wasmPath) {
         this.initializeWasm(wasmPath);