@anonympins/fingerprint 0.5.2 → 0.5.5

package/src/js/tests/fingerprint.client.test.js

@@ -1,129 +1,129 @@
-/**
- * @vitest-environment jsdom
- */
-
-import {afterEach, beforeEach, describe, expect, it, vi} from 'vitest';
-import ClientLibrary from '../fingerprint.client.js';
-
-describe('ClientLibrary WASM Integration', () => {
-    beforeEach(() => {
-        // Réinitialise le cache et les mocks avant chaque test
-        ClientLibrary._resetCache();
-        vi.spyOn(console, 'log').mockImplementation(() => {});
-        vi.spyOn(console, 'warn').mockImplementation(() => {});
-
-        // Supprime les mocks globaux pour éviter les fuites entre les tests
-        delete window.createFingerprintModule;
-    });
-
-    afterEach(() => {
-        vi.restoreAllMocks();
-    });
-
-    it('should successfully load WASM module and switch hasher', async () => {
-        // 1. Simuler un module WASM fonctionnel
-        const mockWasmModule = {
-            _hash_string: vi.fn((str) => 99999), // Un mock qui retourne une valeur distincte
-        };
-
-        // 2. Simuler le chargement du script et l'initialisation du module
-        // On attache les fonctions de simulation à `window` car c'est ce que le code cherche
-        window.createFingerprintModule = vi.fn().mockResolvedValue(mockWasmModule);
-
-        // On simule l'injection du script en appelant directement `onload`
-        vi.spyOn(document.head, 'appendChild').mockImplementation((script) => {
-            // Simule le chargement réussi du script
-            script.onload();
-            return script;
-        });
-
-        // 3. Appeler la fonction d'initialisation
-        await ClientLibrary.initializeWasm('/fake/path/to/fp.js');
-
-        // 4. Vérifier que le hasher a été remplacé
-        const wasmHash = ClientLibrary._hasher("test");
-        expect(wasmHash).toBe(99999);
-        expect(mockWasmModule._hash_string).toHaveBeenCalledWith("test");
-        expect(console.log).toHaveBeenCalledWith(expect.stringContaining('WASM module loaded successfully'));
-    });
-
-    it('should gracefully fall back to JS hasher if WASM module fails to load', async () => {
-        // 1. Simuler un échec de chargement du script
-        vi.spyOn(document.head, 'appendChild').mockImplementation((script) => {
-            script.onerror(new Error('Script loading failed'));
-            return script;
-        });
-
-        // 2. Appeler la fonction d'initialisation
-        await ClientLibrary.initializeWasm('/fake/path/to/fp.js');
-
-        // 3. Vérifier que le hasher est toujours l'implémentation JS
-        const jsHash = ClientLibrary._hasher("test");
-        const originalJsHash = (await import('../fingerprint.builder.js')).cyrb53("test");
-        
-        expect(jsHash).toBe(originalJsHash);
-        expect(console.warn).toHaveBeenCalledWith(expect.stringContaining('WASM module failed to load'), expect.any(Error));
-    });
-
-    it('should gracefully fall back if WASM module does not export _hash_string', async () => {
-        // 1. Simuler un module WASM malformé (sans la fonction attendue)
-        const mockWasmModule = {};
-        window.createFingerprintModule = vi.fn().mockResolvedValue(mockWasmModule);
-
-        vi.spyOn(document.head, 'appendChild').mockImplementation((script) => {
-            script.onload();
-            return script;
-        });
-
-        // 2. Appeler la fonction d'initialisation
-        await ClientLibrary.initializeWasm('/fake/path/to/fp.js');
-
-        // 3. Vérifier le fallback
-        const jsHash = ClientLibrary._hasher("test");
-        const originalJsHash = (await import('../fingerprint.builder.js')).cyrb53("test");
-        expect(jsHash).toBe(originalJsHash); 
-        // L'assertion est maintenant plus précise : elle vérifie le message générique ET le message d'erreur spécifique.
-        expect(console.warn).toHaveBeenCalledWith(
-            expect.stringContaining('WASM module failed to load'), 
-            expect.objectContaining({ message: 'WASM module did not export _hash_string.' })
-        );
-    });
-
-    it('should successfully load raw WASM and use standalone polymorphic hasher', async () => {
-        const mockWasmInstance = {
-            exports: {
-                memory: { buffer: new ArrayBuffer(65536) },
-                hash: vi.fn().mockReturnValue(123456)
-            }
-        };
-        
-        global.WebAssembly = {
-            compile: vi.fn().mockResolvedValue({}),
-            instantiate: vi.fn().mockResolvedValue(mockWasmInstance)
-        };
-        
-        global.fetch = vi.fn().mockResolvedValue({
-            arrayBuffer: vi.fn().mockResolvedValue(new ArrayBuffer(100))
-        });
-
-        await ClientLibrary.initializeWasm('/fp.wasm');
-
-        const hash = ClientLibrary._hasher("test");
-        expect(hash).toBe(123456);
-        expect(mockWasmInstance.exports.hash).toHaveBeenCalledWith(0, 4);
-    });
-
-    it('should use the default JS hasher if WASM is not configured', async () => {
-        // Ensure no WASM path is provided in the config
-        ClientLibrary.initializeClient({});
-
-        // Verify that the active hasher is the original JS implementation
-        const jsHash = ClientLibrary._hasher("another test string");
-        const originalJsHash = (await import('../fingerprint.builder.js')).cyrb53("another test string");
-
-        expect(jsHash).toBe(originalJsHash);
-        // Ensure no WASM-related console logs or warnings were made
-        expect(console.log).not.toHaveBeenCalledWith(expect.stringContaining('WASM module loaded successfully'));
-        expect(console.warn).not.toHaveBeenCalledWith(expect.stringContaining('WASM module failed to load'));
-    });
+/**
+ * @vitest-environment jsdom
+ */
+
+import {afterEach, beforeEach, describe, expect, it, vi} from 'vitest';
+import ClientLibrary from '../fingerprint.client.js';
+
+describe('ClientLibrary WASM Integration', () => {
+    beforeEach(() => {
+        // Réinitialise le cache et les mocks avant chaque test
+        ClientLibrary._resetCache();
+        vi.spyOn(console, 'log').mockImplementation(() => {});
+        vi.spyOn(console, 'warn').mockImplementation(() => {});
+
+        // Supprime les mocks globaux pour éviter les fuites entre les tests
+        delete window.createFingerprintModule;
+    });
+
+    afterEach(() => {
+        vi.restoreAllMocks();
+    });
+
+    it('should successfully load WASM module and switch hasher', async () => {
+        // 1. Simuler un module WASM fonctionnel
+        const mockWasmModule = {
+            _hash_string: vi.fn((str) => 99999), // Un mock qui retourne une valeur distincte
+        };
+
+        // 2. Simuler le chargement du script et l'initialisation du module
+        // On attache les fonctions de simulation à `window` car c'est ce que le code cherche
+        window.createFingerprintModule = vi.fn().mockResolvedValue(mockWasmModule);
+
+        // On simule l'injection du script en appelant directement `onload`
+        vi.spyOn(document.head, 'appendChild').mockImplementation((script) => {
+            // Simule le chargement réussi du script
+            script.onload();
+            return script;
+        });
+
+        // 3. Appeler la fonction d'initialisation
+        await ClientLibrary.initializeWasm('/fake/path/to/fp.js');
+
+        // 4. Vérifier que le hasher a été remplacé
+        const wasmHash = ClientLibrary._hasher("test");
+        expect(wasmHash).toBe(99999);
+        expect(mockWasmModule._hash_string).toHaveBeenCalledWith("test");
+        expect(console.log).toHaveBeenCalledWith(expect.stringContaining('WASM module loaded successfully'));
+    });
+
+    it('should gracefully fall back to JS hasher if WASM module fails to load', async () => {
+        // 1. Simuler un échec de chargement du script
+        vi.spyOn(document.head, 'appendChild').mockImplementation((script) => {
+            script.onerror(new Error('Script loading failed'));
+            return script;
+        });
+
+        // 2. Appeler la fonction d'initialisation
+        await ClientLibrary.initializeWasm('/fake/path/to/fp.js');
+
+        // 3. Vérifier que le hasher est toujours l'implémentation JS
+        const jsHash = ClientLibrary._hasher("test");
+        const originalJsHash = (await import('../fingerprint.builder.js')).cyrb53("test");
+        
+        expect(jsHash).toBe(originalJsHash);
+        expect(console.warn).toHaveBeenCalledWith(expect.stringContaining('WASM module failed to load'), expect.any(Error));
+    });
+
+    it('should gracefully fall back if WASM module does not export _hash_string', async () => {
+        // 1. Simuler un module WASM malformé (sans la fonction attendue)
+        const mockWasmModule = {};
+        window.createFingerprintModule = vi.fn().mockResolvedValue(mockWasmModule);
+
+        vi.spyOn(document.head, 'appendChild').mockImplementation((script) => {
+            script.onload();
+            return script;
+        });
+
+        // 2. Appeler la fonction d'initialisation
+        await ClientLibrary.initializeWasm('/fake/path/to/fp.js');
+
+        // 3. Vérifier le fallback
+        const jsHash = ClientLibrary._hasher("test");
+        const originalJsHash = (await import('../fingerprint.builder.js')).cyrb53("test");
+        expect(jsHash).toBe(originalJsHash); 
+        // L'assertion est maintenant plus précise : elle vérifie le message générique ET le message d'erreur spécifique.
+        expect(console.warn).toHaveBeenCalledWith(
+            expect.stringContaining('WASM module failed to load'), 
+            expect.objectContaining({ message: 'WASM module did not export _hash_string.' })
+        );
+    });
+
+    it('should successfully load raw WASM and use standalone polymorphic hasher', async () => {
+        const mockWasmInstance = {
+            exports: {
+                memory: { buffer: new ArrayBuffer(65536) },
+                hash: vi.fn().mockReturnValue(123456)
+            }
+        };
+        
+        global.WebAssembly = {
+            compile: vi.fn().mockResolvedValue({}),
+            instantiate: vi.fn().mockResolvedValue(mockWasmInstance)
+        };
+        
+        global.fetch = vi.fn().mockResolvedValue({
+            arrayBuffer: vi.fn().mockResolvedValue(new ArrayBuffer(100))
+        });
+
+        await ClientLibrary.initializeWasm('/fp.wasm');
+
+        const hash = ClientLibrary._hasher("test");
+        expect(hash).toBe(123456);
+        expect(mockWasmInstance.exports.hash).toHaveBeenCalledWith(0, 4);
+    });
+
+    it('should use the default JS hasher if WASM is not configured', async () => {
+        // Ensure no WASM path is provided in the config
+        ClientLibrary.initializeClient({});
+
+        // Verify that the active hasher is the original JS implementation
+        const jsHash = ClientLibrary._hasher("another test string");
+        const originalJsHash = (await import('../fingerprint.builder.js')).cyrb53("another test string");
+
+        expect(jsHash).toBe(originalJsHash);
+        // Ensure no WASM-related console logs or warnings were made
+        expect(console.log).not.toHaveBeenCalledWith(expect.stringContaining('WASM module loaded successfully'));
+        expect(console.warn).not.toHaveBeenCalledWith(expect.stringContaining('WASM module failed to load'));
+    });
 });

package/src/js/tests/fingerprint.test.js

@@ -31,6 +31,7 @@ const {
     default_whitelist,
     stopThresholdAutoTuning,
     getCompositeDeviceHash,
+    sanitizeTrafficData,
 } = fingerprint;
 const { store, getRequestPatternScore, getDeviceHash } = __internal;
 const { getRenderingAnomalyScore } = __internal;
@@ -1083,6 +1084,35 @@ describe('Fingerprint & PoW Security Suite', () => {
     describe('Threshold Auto-Tuning', () => {
         let setIntervalSpy, clearIntervalSpy, consoleLogSpy;
 
+    test('should sanitize traffic data based on stable hardware cluster', async () => {
+        const trafficData = [];
+        // Attacker rotating IPs and deviceIds but having the same hardware fingerprint
+        for (let i = 0; i < 100; i++) {
+            trafficData.push({
+                type: 'trap_triggered',
+                deviceId: `attacker-dev-${i}`,
+                clientIp: `192.168.1.${i}`,
+                fingerprint: 'gpu:spoofed-nvidia-gpu|cvs:spoofed-canvas-data'
+            });
+        }
+
+        // Unique legit users
+        for (let i = 0; i < 10; i++) {
+            trafficData.push({
+                type: 'challenge_solved',
+                deviceId: `legit-dev-${i}`,
+                clientIp: `10.0.0.${i}`,
+                fingerprint: `gpu:legit-gpu-${i}|cvs:legit-canvas-${i}`
+            });
+        }
+
+        const sanitized = sanitizeTrafficData(trafficData);
+        const attackerLogs = sanitized.filter(log => log.deviceId.startsWith('attacker-dev-'));
+
+        // Total 110 logs. 2% limit = Math.max(3, 2) = 3.
+        expect(attackerLogs.length).toBeLessThanOrEqual(3);
+    });
+
         beforeEach(() => {
             setIntervalSpy = vi.spyOn(global, 'setInterval');
             clearIntervalSpy = vi.spyOn(global, 'clearInterval');
@@ -2045,6 +2075,31 @@ describe('getTimeInconsistencyScore', () => {
         expect(timeInconsistencyScore).toBe(0);
     });
 
+    it('should return 100 if the signature is invalid or missing when sessionHmacKey is negotiated', () => {
+        const requestTimestamp = Date.now();
+        const clientTimestamp = requestTimestamp - 100;
+        const context = { requestTimestamp };
+        const metrics = { clientTimestamp, signature: 'bad-signature' };
+        const deviceData = { sessionHmacKey: '0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef' };
+
+        const { timeInconsistencyScore } = __internal.getTimeInconsistencyScore(context, metrics, deviceData);
+        expect(timeInconsistencyScore).toBe(100);
+    });
+
+    it('should return 0 if the signature is valid when sessionHmacKey is negotiated', () => {
+        const requestTimestamp = Date.now();
+        const clientTimestamp = requestTimestamp - 100;
+        const context = { requestTimestamp };
+        const deviceData = { sessionHmacKey: '0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef' };
+        const metrics = { clientTimestamp };
+        const dataToSign = JSON.stringify(metrics);
+        const signature = createHmac('sha256', Buffer.from(deviceData.sessionHmacKey, 'hex')).update(dataToSign).digest('hex');
+        metrics.signature = signature;
+
+        const { timeInconsistencyScore } = __internal.getTimeInconsistencyScore(context, metrics, deviceData);
+        expect(timeInconsistencyScore).toBe(0);
+    });
+
     it('should return a score > 0 for a replayed request (clientTimestamp significantly before requestTimestamp)', () => {
         const requestTimestamp = Date.now();
         const clientTimestamp = requestTimestamp - (REPLAY_THRESHOLD_MS + 1000); // 1 second beyond threshold
@@ -2305,9 +2360,9 @@ describe('Subnet Scoring (Node.js)', () => {
         // The new version handles other prefixes
         expect(getIpSubnet('10.20.30.40', 16)).toBe('10.20.0.0/16');
         // IPv6
-        expect(getIpSubnet('2001:db8:abcd:0012:0000:0000:0000:0001', 48)).toBe('2001:db8:abcd:0:0:0:0:0/48');
+        expect(getIpSubnet('2001:db8:abcd:0012:0000:0000:0000:0001', 48)).toBe('2001:0db8:abcd:0000:0000:0000:0000:0000/48');
         // The new version handles other prefixes
-        expect(getIpSubnet('2a01:e0a:129:57c0:a1b2:c3d4:e5f6:a7b8', 64)).toBe('2a01:e0a:129:0:0:0:0:0/48');
+        expect(getIpSubnet('2a01:e0a:129:57c0:a1b2:c3d4:e5f6:a7b8', 64)).toBe('2a01:0e0a:0129:0000:0000:0000:0000:0000/48');
         // Invalid IPs
         expect(getIpSubnet('not-an-ip')).toBeNull();
     });

package/src/js/tests/ip-reputation.test.js

@@ -96,7 +96,7 @@ describe('IP Reputation Local System (Node.js)', () => {
         expect(ipv4Subnet).toBe('192.168.1.0/24');
 
         const ipv6Subnet = __internal.getIpSubnet('2001:db8:abcd:12::1', 24, 48);
-        expect(ipv6Subnet).toBe('2001:db8:abcd:0:0:0:0:0/48');
+        expect(ipv6Subnet).toBe('2001:0db8:abcd:0000:0000:0000:0000:0000/48');
     });
 
     it('should calculate client hints inconsistency score correctly', async () => {

package/src/js/tests/obfuscation.test.js

@@ -0,0 +1,48 @@
+import { describe, expect, it } from 'vitest';
+import { __internal } from '../fingerprint.js';
+
+describe('Système de Polymorphisme et Compilateur d\'Obfuscation', () => {
+    
+    it('should generate a valid session mapping with randomized headers and globals', () => {
+        const mapping1 = __internal.generateSessionMapping();
+        const mapping2 = __internal.generateSessionMapping();
+
+        // Vérification de la présence des structures attendues
+        expect(mapping1).toBeDefined();
+        expect(mapping1.headers).toHaveProperty('x-device-fingerprint');
+        expect(mapping1.headers).toHaveProperty('x-behavior-metrics');
+        expect(mapping1.globals).toHaveProperty('ClientLibrary');
+        expect(mapping1.globals).toHaveProperty('getDeviceFingerprint');
+        expect(mapping1.globals).toHaveProperty('getClientBehaviorMetrics');
+        expect(mapping1.keys).toHaveProperty('ua');
+        expect(mapping1.wasmConstants).toHaveProperty('seed');
+
+        // Vérification de l'aléa (deux sessions consécutives doivent avoir des mappings uniques)
+        expect(mapping1.headers['x-device-fingerprint']).not.toBe(mapping2.headers['x-device-fingerprint']);
+        expect(mapping1.globals['ClientLibrary']).not.toBe(mapping2.globals['ClientLibrary']);
+        expect(mapping1.keys['ua']).not.toBe(mapping2.keys['ua']);
+        expect(mapping1.wasmConstants.seed).not.toBe(mapping2.wasmConstants.seed);
+    });
+
+    it('should compile and obfuscate client script asynchronously using the obfuscation worker', async () => {
+        const mapping = __internal.generateSessionMapping();
+        
+        // On lance la compilation lourde qui instancie le Worker d'arrière-plan
+        const obfuscatedCode = await __internal.compilePolymorphicJs(mapping);
+
+        expect(obfuscatedCode).toBeDefined();
+        expect(typeof obfuscatedCode).toBe('string');
+        expect(obfuscatedCode.length).toBeGreaterThan(0);
+
+        // Vérification que les placeholders originaux ont bien été purgés du code client final
+        expect(obfuscatedCode).not.toContain('X-Device-Fingerprint');
+        expect(obfuscatedCode).not.toContain('X-Behavior-Metrics');
+        expect(obfuscatedCode).not.toContain('ClientLibrary');
+
+        // Vérification que le code est minifié/obfusqué (ne contient pas de commentaires de développement par exemple)
+        expect(obfuscatedCode).not.toContain('// Nom trompeur aléatoire pour attirer les analyseurs');
+        
+        // La structure globale de javascript-obfuscator génère typiquement un tableau de chaînes au début
+        expect(obfuscatedCode).toMatch(/_0x/);
+    }, 15000); // Augmentation du timeout à 15s car l'obfuscation via Worker thread consomme du CPU
+});

package/src/js/tests/pow.solver.test.js

@@ -223,9 +223,12 @@ describe('Proof-of-Work Solvers', () => {
             const seed = 'test-wasm-seed';
             const difficulty = 4; // 4 MB
 
-            const solution = await solveMemory(seed, difficulty);
+            const result = await solveMemory(seed, difficulty);
 
-            expect(solution).toBe(777);
+            expect(result).toBeInstanceOf(Object);
+            expect(result.solution).toBe(777);
+            expect(result.merkleRoot).toBeDefined();
+            expect(result.proofs).toBeDefined();
             expect(mockWasmModule._malloc).toHaveBeenCalledTimes(1);
             expect(mockWasmModule._free).toHaveBeenCalledTimes(1);
             expect(mockWasmModule._solve_memory_challenge).toHaveBeenCalledWith(1234, difficulty);

package/src/js/tests/usefulWorkSolver.test.js

@@ -0,0 +1,162 @@
+import { describe, expect, it, vi, beforeEach, afterEach } from 'vitest';
+import { solveChallenge } from '../pow.solver.js'; // Assuming pow.solver.js is the ES module version
+
+// Mock crypto.subtle for hashing operations
+const mockSubtleDigest = vi.fn(async (algorithm, data) => {
+    // Return a consistent mock hash for testing purposes
+    const hash = new Uint8Array(32); // 32 bytes for SHA-256
+    for (let i = 0; i < hash.length; i++) {
+        hash[i] = i; // Simple predictable hash
+    }
+    return hash.buffer;
+});
+
+// Mock Math.random for deterministic optimization results
+const mockMathRandom = vi.fn(() => 0.5);
+
+// Mock IndexedDB for pospace challenges, even if not directly used by this test
+const mockIndexedDB = {
+    open: vi.fn(() => ({
+        onupgradeneeded: null,
+        onsuccess: null,
+        onerror: null,
+        result: {
+            objectStoreNames: { contains: vi.fn(() => true) },
+            createObjectStore: vi.fn(),
+            transaction: vi.fn(() => ({
+                objectStore: vi.fn(() => ({
+                    put: vi.fn(),
+                    get: vi.fn(() => ({ onsuccess: null, result: null }))
+                }))
+            }))
+        }
+    }))
+};
+
+describe('Useful Work Solver for Optimization Challenges', () => {
+    let originalMathRandom;
+    let originalIndexedDB;
+
+    beforeEach(() => {
+        // Save original implementations
+        originalMathRandom = global.Math.random;
+        originalIndexedDB = global.indexedDB;
+
+        // Mock global objects
+        vi.stubGlobal('crypto', {
+            subtle: {
+                digest: mockSubtleDigest,
+            },
+            randomInt: vi.fn((min, max) => Math.floor(mockMathRandom() * (max - min) + min)), // Mock randomInt for crypto
+            randomBytes: vi.fn((length) => new Uint8Array(length).fill(0x01)), // Mock randomBytes for crypto
+        });
+        global.Math.random = mockMathRandom;
+        global.indexedDB = mockIndexedDB;
+
+        // Reset mocks
+        mockSubtleDigest.mockClear();
+        mockMathRandom.mockClear();
+        mockIndexedDB.open.mockClear();
+    });
+
+    afterEach(() => {
+        // Restore original implementations
+        vi.unstubAllGlobals();
+        global.Math.random = originalMathRandom;
+        global.indexedDB = originalIndexedDB;
+    });
+
+    it('should solve a "useful_work_task" with fraud.solve and return a Pareto front', async () => {
+        const mockChallenge = {
+            type: 'useful_work_task',
+            nonce: 'test-nonce-fraud',
+            usefulWorkTask: {
+                problemId: 'fraud_detection_challenge',
+                task: {
+                    type: 'multi_objective_genetic_algorithm',
+                    solverName: 'fraud.solve',
+                    generations: 5, // Keep generations low for quick test
+                    populationSize: 10, // Keep population low for quick test
+                    payload: {
+                        legitimateClicks: [
+                            { fingerprint: 'fp1', timeToClick: 500, clickX: 10, clickY: 10, mouseEntropy: 0.8, scrollEvents: 5 },
+                            { fingerprint: 'fp1', timeToClick: 600, clickX: 12, clickY: 12, mouseEntropy: 0.7, scrollEvents: 6 },
+                            { fingerprint: 'fp2', timeToClick: 700, clickX: 20, clickY: 20, mouseEntropy: 0.9, scrollEvents: 7 },
+                        ],
+                        fraudulentClicks: [
+                            { fingerprint: 'fp3', timeToClick: 50, clickX: 5, clickY: 5, mouseEntropy: 0.1, scrollEvents: 0 },
+                            { fingerprint: 'fp3', timeToClick: 60, clickX: 6, clickY: 6, mouseEntropy: 0.2, scrollEvents: 1 },
+                            { fingerprint: 'fp4', timeToClick: 100, clickX: 10, clickY: 10, mouseEntropy: 0.3, scrollEvents: 2 },
+                        ],
+                    },
+                },
+            },
+        };
+
+        const solution = await solveChallenge(mockChallenge);
+
+        // Assert the structure of the returned solution
+        expect(solution.type).toBe('useful_work_task');
+        expect(solution.nonce).toBe('test-nonce-fraud');
+        expect(solution.rawSolution).toHaveProperty('problem_id', 'fraud_detection_challenge');
+        expect(solution.rawSolution).toHaveProperty('work_result');
+
+        const workResult = solution.rawSolution.work_result;
+        expect(workResult).toHaveProperty('paretoFront');
+        expect(workResult.paretoFront).toBeInstanceOf(Array);
+        expect(workResult.paretoFront.length).toBeGreaterThan(0);
+
+        // Check the structure of a single solution in the Pareto front
+        const firstParetoSolution = workResult.paretoFront[0];
+        expect(firstParetoSolution).toHaveProperty('solution');
+        expect(firstParetoSolution.solution).toBeInstanceOf(Array); // fraud.solve returns an array of thresholds
+        expect(firstParetoSolution.solution.length).toBe(4); // [minTimeToClick, maxClickVariance, minMouseEntropy, minScrollEvents]
+        expect(firstParetoSolution).toHaveProperty('objectives');
+        expect(firstParetoSolution.objectives).toBeInstanceOf(Array); // [objective1, objective2]
+        expect(firstParetoSolution.objectives.length).toBe(2);
+    }, 10000); // Increase timeout for GA, even with low generations/population
+
+    it('should solve a "useful_work_task" with cpc.solve and return a Pareto front', async () => {
+        const mockChallenge = {
+            type: 'useful_work_task',
+            nonce: 'test-nonce-cpc',
+            usefulWorkTask: {
+                problemId: 'cpc_optimization_challenge',
+                task: {
+                    type: 'multi_objective_genetic_algorithm',
+                    solverName: 'cpc.solve',
+                    generations: 5, // Keep generations low for quick test
+                    populationSize: 10, // Keep population low for quick test
+                    payload: {
+                        platformParams: { optimalBaseCommission: 0.3, optimalBonusFactor: 0.1 },
+                        website: { relevanceScore: 70 },
+                        advertiser: { credits: 1000 },
+                        estimatedImpressions: 500,
+                        competingAds: [{ id: 'ad1' }, { id: 'ad2' }],
+                    },
+                },
+            },
+        };
+
+        const solution = await solveChallenge(mockChallenge);
+
+        // Assert the structure of the returned solution
+        expect(solution.type).toBe('useful_work_task');
+        expect(solution.nonce).toBe('test-nonce-cpc');
+        expect(solution.rawSolution).toHaveProperty('problem_id', 'cpc_optimization_challenge');
+        expect(solution.rawSolution).toHaveProperty('work_result');
+
+        const workResult = solution.rawSolution.work_result;
+        expect(workResult).toHaveProperty('paretoFront');
+        expect(workResult.paretoFront).toBeInstanceOf(Array);
+        expect(workResult.paretoFront.length).toBeGreaterThan(0);
+
+        // Check the structure of a single solution in the Pareto front
+        const firstParetoSolution = workResult.paretoFront[0];
+        expect(firstParetoSolution).toHaveProperty('solution');
+        expect(typeof firstParetoSolution.solution).toBe('number'); // cpc.solve returns a single CPC value
+        expect(firstParetoSolution).toHaveProperty('objectives');
+        expect(firstParetoSolution.objectives).toBeInstanceOf(Array); // [platformRevenue, advertiserValue, marketImbalance]
+        expect(firstParetoSolution.objectives.length).toBe(3);
+    }, 10000);
+});

package/src/php/AutoTuner.php

@@ -30,6 +30,7 @@ class AutoTuner
     /** @var ?callable */
     private $onCleanup;
     private ?string $savePath;
+    private float $validationTolerance;
 
     /**
      * @var ?array<string, mixed> La dernière meilleure solution trouvée par l'optimiseur.
@@ -51,6 +52,7 @@ class AutoTuner
         $this->clearAfterTuning = $options['clearAfterTuning'] ?? false;
         $this->onCleanup = $options['onCleanup'] ?? null;
         $this->savePath = $options['savePath'] ?? null;
+        $this->validationTolerance = $options['validationTolerance'] ?? 0.15;
     }
 
     /**
@@ -211,6 +213,46 @@ class AutoTuner
             }
         };
 
+        // --- VALIDATION POST-CALCUL (PHP Rollback & Seuil de Tolérance) ---
+        $tempConfig = [
+            'thresholds' => $this->securityConfig['thresholds'],
+            'weights' => $this->securityConfig['weights'],
+            'patterns' => $this->securityConfig['patterns'],
+        ];
+
+        $applyInertialUpdate($tempConfig['thresholds'], $newConfig['thresholds'], 'thresholds', $trafficConfidence);
+        $applyInertialUpdate($tempConfig['weights'], $newConfig['weights'], 'weights', $trafficConfidence);
+        $applyInertialUpdate($tempConfig['patterns'], $newConfig['patterns'], 'patterns', $trafficConfidence);
+
+        $evaluator = OptimizationOperators::createFullSecurityConfigEvaluator(['trafficData' => $sanitizedData]);
+        $currentObjectives = $evaluator($this->securityConfig);
+        $proposedObjectives = $evaluator($tempConfig);
+
+        $currentFPR = $currentObjectives[0];
+        $currentFNR = $currentObjectives[1];
+        $proposedFPR = $proposedObjectives[0];
+        $proposedFNR = $proposedObjectives[1];
+
+        $validationTolerance = $this->securityConfig['autotuning']['validationTolerance'] ?? $this->validationTolerance;
+
+        if ($proposedFPR > $currentFPR + $validationTolerance || $proposedFNR > $currentFNR + $validationTolerance) {
+            error_log(sprintf(
+                "[AutoTuning] [SECURITY ALERT] Proposed configuration rejected due to instability/poisoning risk! Proposed FPR: %.4f (Current: %.4f), Proposed FNR: %.4f (Current: %.4f)",
+                $proposedFPR, $currentFPR, $proposedFNR, $currentFNR
+            ));
+            if (isset($this->securityConfig['logger']) && is_callable($this->securityConfig['logger'])) {
+                call_user_func($this->securityConfig['logger'], [
+                    'type' => 'autotuning_instability_alert',
+                    'proposedFPR' => $proposedFPR,
+                    'currentFPR' => $currentFPR,
+                    'proposedFNR' => $proposedFNR,
+                    'currentFNR' => $currentFNR,
+                    'timestamp' => (int)(microtime(true) * 1000)
+                ]);
+            }
+            return; // Rollback
+        }
+
         $applyInertialUpdate($this->securityConfig['thresholds'], $newConfig['thresholds'], 'thresholds', $trafficConfidence);
         $applyInertialUpdate($this->securityConfig['weights'], $newConfig['weights'], 'weights', $trafficConfidence);
         $applyInertialUpdate($this->securityConfig['patterns'], $newConfig['patterns'], 'patterns', $trafficConfidence);