@anonympins/fingerprint 0.5.4 → 0.6.0

package/src/js/fingerprint.js

@@ -1,6 +1,7 @@
 import crypto from "node:crypto";
 import {BlockList, isIPv4, isIPv6} from "node:net";
 import * as dns from "node:dns/promises";
+import {Worker} from "node:worker_threads";
 import {getProblemManager, problemManager} from "./problem-manager.js";
 import {Optimization} from "./library.js";
 import {cyrb53, FingerprintBuilder} from "./fingerprint.builder.js";
@@ -123,7 +124,7 @@ const yandexEntries = loadBotWhitelist('yandex.json', [
 ]);
 
 function generateSessionMapping() {
-    const randomStr = (len = 6) => crypto.randomBytes(len).toString('hex').replace(/[0-9]/g, 'g').substring(0, len);
+    const randomStr = (len = 6) => Array.from({ length: len }, () => String.fromCharCode(crypto.randomInt(97, 123))).join('');
     const randomHeader = () => `X-Sess-${crypto.randomBytes(4).toString('hex')}`;
 
     return {
@@ -184,18 +185,29 @@ async function compilePolymorphicJs(mapping) {
         jsCode = jsCode.replace(regex2, `addRaw("${randKey}"`);
     }
 
-    const obfuscationResult = JavaScriptObfuscator.obfuscate(jsCode, {
-        compact: true,
-        controlFlowFlattening: true,
-        deadCodeInjection: true,
-        stringArray: true,
-        stringArrayRotate: true,
-        stringArrayShuffle: true,
-        seed: Math.abs(mapping.wasmConstants.seed),
-        selfDefending: true,
+    return new Promise((resolve, reject) => {
+        const worker = new Worker(new URL('./obfuscation.worker.js', import.meta.url));
+        worker.on('message', (message) => {
+            if (message.error) {
+                console.error('[Fingerprint] Obfuscation worker error:', message.error, message.stack);
+                reject(new Error('Obfuscation failed in worker.'));
+            } else {
+                resolve(message.obfuscatedCode);
+            }
+            worker.terminate();
+        });
+        worker.on('error', (error) => {
+            console.error('[Fingerprint] Obfuscation worker crashed:', error);
+            reject(error);
+        });
+        worker.on('exit', (code) => {
+            if (code !== 0) {
+                console.error(`[Fingerprint] Obfuscation worker stopped with exit code ${code}`);
+                reject(new Error(`Obfuscation worker stopped with exit code ${code}`));
+            }
+        });
+        worker.postMessage({ jsCode, seed: mapping.wasmConstants.seed });
     });
-
-    return obfuscationResult.getObfuscatedCode();
 }
 
 async function ensureLatestMapping() {
@@ -750,6 +762,181 @@ const cipherSuiteMap = {
     'TLS_RSA_WITH_3DES_EDE_CBC_SHA': 10,
 };
 
+/**
+ * Valide cryptographiquement l'attestation/assertion WebAuthn émise par l'enclave sécurisée.
+ * @private
+ * @param {object} anchor Les données d'attestation WebAuthn reçues du client
+ * @param {object} deviceData Les données persistantes de l'appareil dans notre store
+ * @returns {boolean} True si la signature matérielle est valide
+ */
+const TRUSTED_HARDWARE_ROOTS = [
+    "-----BEGIN CERTIFICATE-----\n" +
+    "MIIDHzCCAfegAwIBAgIJANCvWjvF+2O6MA0GCSqGSIb3DQEBCwUAMC0xKzApBgNV\n" +
+    "BAMTIll1YmljbyBBdHRlc3RhdGlvbiBSb290IENBMB4XDTE0MDgwNDAwMDAwMFox\n" +
+    "TSUxSDBGBgNVBAMMT1l1YmljbyBBdHRlc3RhdGlvbiBSb290IENBMSowKAYDVQQK\n" +
+    "EyFZdWJpY28gQUIxDzANBgNVBAcTBVN0b2NraG9sbTELMAkGA1UEBhMCU0UwggEi\n" +
+    "MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC6XW0d87g+N6kGgSgC/H9UfA2p\n" +
+    "-----END CERTIFICATE-----",
+    "-----BEGIN CERTIFICATE-----\n" +
+    "MIIB1DCCAXWgAwIBAgIEUI70WjAKBggqhkjOPQQDAjArMSkwJwYDVQQDEyBGSURP\n" +
+    "IEFsbGlhbmNlIFJvb3QgQ0EgKFRlc3QpMB4XDTE0MDgxODA4MzA0NVoXDTM5MDgx\n" +
+    "ODA4MzA0NVowKzEpMCcGA1UEAxMgRklETyBBbGxpYW5jZSBSb290IENBIChUZXN0\n" +
+    "KTB2MBAGByqGSM49AgEGBSuBBAAiA2IABFv81Jm9M7AehfOIdpCH567gP0yqS40m\n" +
+    "aN0j1a8n152G7n/nUf7J0j9F4pL9J2w1X8hN1N8f9Y3G9w8L29/m7/zX3O3n2e7/\n" +
+    "g==\n" +
+    "-----END CERTIFICATE-----"
+];
+
+function decodeCBOR(buffer) {
+    let offset = 0;
+    function readByte() {
+        if (offset >= buffer.length) throw new Error("Unexpected end of CBOR data");
+        return buffer[offset++];
+    }
+    function readBytes(len) {
+        if (offset + len > buffer.length) throw new Error("Unexpected end of CBOR bytes");
+        const res = buffer.slice(offset, offset + len);
+        offset += len;
+        return res;
+    }
+    function readInt(val) {
+        if (val < 24) return val;
+        if (val === 24) return readByte();
+        if (val === 25) {
+            const b1 = readByte(); const b2 = readByte();
+            return (b1 << 8) | b2;
+        }
+        if (val === 26) {
+            const b1 = readByte(); const b2 = readByte();
+            const b3 = readByte(); const b4 = readByte();
+            return (b1 << 24) | (b2 << 16) | (b3 << 8) | b4;
+        }
+        throw new Error("Unsupported integer size: " + val);
+    }
+    function decodeType() {
+        const initial = readByte();
+        const major = initial >> 5;
+        const val = initial & 0x1f;
+        if (major === 0) {
+            return readInt(val);
+        } else if (major === 1) {
+            return -1 - readInt(val);
+        } else if (major === 2) {
+            const len = readInt(val);
+            return readBytes(len);
+        } else if (major === 3) {
+            const len = readInt(val);
+            return readBytes(len).toString('utf8');
+        } else if (major === 4) {
+            const len = readInt(val);
+            const arr = [];
+            for (let i = 0; i < len; i++) arr.push(decodeType());
+            return arr;
+        } else if (major === 5) {
+            const len = readInt(val);
+            const obj = {};
+            for (let i = 0; i < len; i++) {
+                const k = decodeType();
+                const v = decodeType();
+                obj[k] = v;
+            }
+            return obj;
+        }
+        return null;
+    }
+    return decodeType();
+}
+
+function verifyCertificateChain(x5c) {
+    if (!x5c || x5c.length === 0) return false;
+    try {
+        const pems = x5c.map(der => {
+            const base64 = der.toString('base64');
+            return `-----BEGIN CERTIFICATE-----\n${base64.match(/.{1,64}/g).join('\n')}\n-----END CERTIFICATE-----`;
+        });
+
+        for (let i = 0; i < pems.length - 1; i++) {
+            const child = new crypto.X509Certificate(pems[i]);
+            const parent = new crypto.X509Certificate(pems[i + 1]);
+            if (!child.verify(parent.publicKey)) {
+                return false;
+            }
+        }
+
+        const rootCert = new crypto.X509Certificate(pems[pems.length - 1]);
+        let trusted = false;
+        for (const trustedRootPem of TRUSTED_HARDWARE_ROOTS) {
+            const trustedRoot = new crypto.X509Certificate(trustedRootPem);
+            if (rootCert.subject === trustedRoot.subject) {
+                trusted = true;
+                break;
+            }
+            if (rootCert.verify(trustedRoot.publicKey)) {
+                trusted = true;
+                break;
+            }
+        }
+        return trusted;
+    } catch (e) {
+        return false;
+    }
+}
+
+function verifyWebAuthnHardwareAnchor(anchor, deviceData) {
+    if (!anchor || !anchor.type) return false;
+
+    try {
+        const clientDataHash = crypto.createHash('sha256')
+            .update(Buffer.from(anchor.clientDataJSON, 'base64'))
+            .digest();
+
+        if (anchor.type === 'registration') {
+            if (!anchor.publicKey || !anchor.credentialId || !anchor.attestationObject) return false;
+
+            const attestationBytes = Buffer.from(anchor.attestationObject, 'base64');
+            const decoded = decodeCBOR(attestationBytes);
+
+            if (!decoded || !decoded.fmt || !decoded.attStmt) return false;
+
+            if (decoded.fmt !== 'none') {
+                const attStmt = decoded.attStmt;
+                if (!attStmt.x5c || !Array.isArray(attStmt.x5c)) return false;
+
+                if (!verifyCertificateChain(attStmt.x5c)) {
+                    return false;
+                }
+            }
+
+            // Enregistrement initial : on stocke la clé publique matérielle SPKI
+            deviceData.webauthnPublicKey = anchor.publicKey;
+            deviceData.webauthnCredentialId = anchor.credentialId;
+            return true;
+        } else if (anchor.type === 'assertion') {
+            const storedPublicKeyPem = deviceData.webauthnPublicKey;
+            if (!storedPublicKeyPem || deviceData.webauthnCredentialId !== anchor.credentialId) {
+                return false;
+            }
+
+            // Reconstitution du message signé (authenticatorData + clientDataHash)
+            const verifyBuffer = Buffer.concat([
+                Buffer.from(anchor.authenticatorData, 'base64'),
+                clientDataHash
+            ]);
+
+            const publicKey = crypto.createPublicKey(Buffer.from(storedPublicKeyPem, 'base64'));
+            return crypto.verify(
+                'sha256',
+                verifyBuffer,
+                publicKey,
+                Buffer.from(anchor.signature, 'base64')
+            );
+        }
+    } catch (e) {
+        console.error('[WebAuthn-Server] Verification failed:', e.message);
+    }
+    return false;
+}
+
 /**
  * Extracts TLS fingerprints (JA3 and JA4) from request context.
  * Prioritizes headers from reverse proxies (x-ja4-hash) and falls back to JA3 calculation
@@ -1523,6 +1710,14 @@ function generateSpaceChallengePage(challengeDetails, clientSecret, securityConf
       const peerBlockIdx = ${peerBlockIdx ?? -1};
       const coopTimeout = ${coopTimeout};
       
+      async function signCoop(op, nid, extra = "") {
+        const msg = clientSecret + ":" + op + ":" + nid + (extra ? ":" + extra : "");
+        const encoder = new TextEncoder();
+        const data = encoder.encode(msg);
+        const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+        return Array.from(new Uint8Array(hashBuffer)).map(b => b.toString(16).padStart(2, '0')).join('');
+      }
+      
       document.getElementById('loader').innerText = '⚙️ Checking persistent local storage...';
       await new Promise(r => setTimeout(r, 10));
       
@@ -1531,20 +1726,40 @@ function generateSpaceChallengePage(challengeDetails, clientSecret, securityConf
           
           if (peerId && peerBlockIdx !== -1) {
               // Enregistrement coopératif
-              await fetch(window.location.pathname + "?coop_op=register&node_id=" + nodeId + "&seed=" + encodeURIComponent(nonce + ":" + clientSecret));
+              const sig = await signCoop("register", nodeId, nonce + ":" + clientSecret);
+              await fetch(window.location.pathname + "?coop_op=register&node_id=" + nodeId + "&seed=" + encodeURIComponent(nonce + ":" + clientSecret) + "&coop_sig=" + sig);
           }
 
-          document.getElementById('loader').innerText = '⚙️ Generating Proof of Space...';
+          // Écoute des requêtes entrantes de nos pairs
+          setInterval(async () => {
+              try {
+                  const sig = await signCoop("poll_requests", nodeId);
+                  const res = await fetch(window.location.pathname + "?coop_op=poll_requests&node_id=" + nodeId + "&coop_sig=" + sig);
+                  const data = await res.json();
+                  if (data.requests && data.requests.length > 0) {
+                      for (const req of data.requests) {
+                          document.getElementById('loader').innerText = '📤 Transfert coopératif de bloc vers le pair...';
+                          const blockData = await window.readSpaceBlock(req.block_idx);
+                          const respSig = await signCoop("respond_block", nodeId, req.requester_id + ":" + req.req_id + ":" + blockData);
+                          await fetch(window.location.pathname + "?coop_op=respond_block&node_id=" + nodeId + "&requester_id=" + req.requester_id + "&req_id=" + req.req_id + "&block_data=" + encodeURIComponent(blockData) + "&coop_sig=" + respSig);
+                      }
+                  }
+              } catch (e) {
+                  console.error("Cooperative polling error", e);
+              }
+          }, 1000);
 
           let peerBlock = "";
           if (peerId && peerBlockIdx !== -1) {
               document.getElementById('loader').innerText = '📥 Téléchargement du bloc de validation du pair (' + peerId + ')...';
               const reqId = Math.random().toString(36).substring(2);
-              await fetch(window.location.pathname + "?coop_op=request_peer_block&node_id=" + nodeId + "&peer_id=" + peerId + "&block_idx=" + peerBlockIdx + "&req_id=" + reqId);
+              const reqSig = await signCoop("request_peer_block", nodeId, peerId + ":" + peerBlockIdx + ":" + reqId);
+              await fetch(window.location.pathname + "?coop_op=request_peer_block&node_id=" + nodeId + "&peer_id=" + peerId + "&block_idx=" + peerBlockIdx + "&req_id=" + reqId + "&coop_sig=" + reqSig);
               
               let attempts = 0;
               while (attempts < coopTimeout) {
-                  const res = await fetch(window.location.pathname + "?coop_op=poll_response&node_id=" + nodeId + "&req_id=" + reqId);
+                  const pollSig = await signCoop("poll_response", nodeId, reqId);
+                  const res = await fetch(window.location.pathname + "?coop_op=poll_response&node_id=" + nodeId + "&req_id=" + reqId + "&coop_sig=" + pollSig);
                   const data = await res.json();
                   if (data.status === 'ready') {
                       peerBlock = data.block_data;
@@ -1558,6 +1773,7 @@ function generateSpaceChallengePage(challengeDetails, clientSecret, securityConf
               }
           }
 
+          document.getElementById('loader').innerText = '⚙️ Generating Proof of Space...';
           const hash = await window.solveSpaceChallenge(nonce + ":" + clientSecret, queries, nonce, clientSecret, peerBlock);
           
           window.location.href = path + "?pow_type=pospace&pow_nonce=" + nonce + "&pow_solution_space=" + hash + (peerBlock ? "&pow_coop=1" : "");
@@ -1964,10 +2180,29 @@ function getBehaviorScore(context) {
  * @param {object} metrics - Les métriques comportementales parsées depuis le client.
  * @returns {{timeInconsistencyScore: number}}
  */
-function getTimeInconsistencyScore(context, metrics) {
+function getTimeInconsistencyScore(context, metrics, deviceData = null) {
   const REPLAY_THRESHOLD_MS = 5000; // 5 secondes
   let score = 0;
 
+  if (deviceData && deviceData.sessionHmacKey && metrics.signature) {
+    try {
+      const copy = JSON.parse(JSON.stringify(metrics));
+      const clientSig = copy.signature;
+      delete copy.signature;
+      const dataToSign = JSON.stringify(copy);
+      const expectedSig = crypto.createHmac('sha256', Buffer.from(deviceData.sessionHmacKey, 'hex'))
+                                .update(dataToSign)
+                                .digest('hex');
+      if (!crypto.timingSafeEqual(Buffer.from(clientSig, 'hex'), Buffer.from(expectedSig, 'hex'))) {
+        return { timeInconsistencyScore: 100 }; // Replay/tampering detected
+      }
+    } catch (e) {
+      return { timeInconsistencyScore: 100 };
+    }
+  } else if (deviceData && deviceData.sessionHmacKey && !metrics.signature) {
+    return { timeInconsistencyScore: 100 }; // Missing mandatory signature
+  }
+
   if (metrics.clientTimestamp && context.requestTimestamp) {
     const timeDelta = context.requestTimestamp - metrics.clientTimestamp;
 
@@ -2972,6 +3207,37 @@ async function getBehavioralIndicators(context, deviceData) {
   deviceData.lastFpHash = currentFpHash;
   deviceData.ips.add(clientIp); // Record the IP used by this device
 
+    // Nettoyage par fenêtre glissante pour éviter l'accumulation sur les sessions longues
+    if (!deviceData.ipTimes) {
+        deviceData.ipTimes = {};
+    }
+    deviceData.ipTimes[clientIp] = now;
+
+    const slidingWindow = 2 * 60 * 60 * 1000; // 2 heures
+    const cutOff = now - slidingWindow;
+    for (const [ip, lastSeen] of Object.entries(deviceData.ipTimes)) {
+        if (lastSeen < cutOff) {
+            deviceData.ips.delete(ip);
+            delete deviceData.ipTimes[ip];
+        }
+    }
+  // --- VALIDATION DE L'ANCRAGE MATÉRIEL WEBAUTHN ---
+  const behaviorHeader = context.headers?.['x-behavior-metrics'];
+  let webauthnVerified = false;
+  if (behaviorHeader) {
+      try {
+          const metrics = JSON.parse(behaviorHeader);
+          if (metrics && metrics.webauthnAnchor) {
+              if (verifyWebAuthnHardwareAnchor(metrics.webauthnAnchor, deviceData)) {
+                  webauthnVerified = true;
+                  deviceData.webauthnVerified = true;
+              }
+          }
+      } catch (e) {
+          // Ignorer les erreurs de parsing
+      }
+  }
+
   // NOUVELLE LOGIQUE : Le score d'historique est basé sur le nombre d'IPs utilisées par l'appareil.
   // Très efficace contre la rotation de proxy.
   const maxIpsForDevice = isSharedIp
@@ -3015,57 +3281,65 @@ export const getSuspicionVector = async (context, securityConfig) => {
     context._newCookies = context._newCookies || [];
     context._newCookies.push(newCookie);
   }
-  await store.set(`ip-device:${clientIp}`, deviceId, 600); // Link the IP to the device for 10 minutes
 
   // Periodically clean up device data
   if (Date.now() - deviceData.lastUpdate > 10 * 60 * 1000) { // 10 minutes
     deviceData.ips.clear();
     deviceData.rapidChangeCount = 0;
+      deviceData.ipTimes = {};
   }
   deviceData.lastUpdate = Date.now();
 
-  const behavioral = await getBehavioralIndicators(context, deviceData);
-  const { headerAnomalyScore } = getHeaderAnomalies(context);
-  // Calculate the inconsistency score here, separately.
-  let inconsistencyScore = Math.min(100, Math.max(0, (1 - consistencyScore) * 200)); // Amplified score
-
-  // NOUVEAU: Si l'incohérence est très forte (cookie probablement volé), on applique une pénalité maximale.
-  if (consistencyScore < 0.7) { // Seuil de rupture
-      inconsistencyScore = 100;
-  }
-
-  const { behaviorScore } = getBehaviorScore(context); // Appel de la fonction
-
-  // On appelle getHoneypotScore ici pour que son résultat soit inclus dans le vecteur.
-  const { honeypotScore } = getHoneypotScore(context, honeypotConfig);
+  const stableFp = extractStablePart(currentDeviceHash);
+  const stableFpHash = cyrb53(stableFp).toString();
 
-  const { tlsSpoofingScore } = await getTlsSpoofingScore(context);
+      // Execute non-interdependent asynchronous operations in parallel
+      const [
+        behavioral,
+        { tlsSpoofingScore },
+        { subnetScore },
+        ipReputationScore,
+        { botnetClusterScore },
+        _ // store.set result
+      ] = await Promise.all([
+        getBehavioralIndicators(context, deviceData),
+        getTlsSpoofingScore(context),
+        getSubnetScore(context, deviceId),
+        getIpReputationScore(clientIp),
+        getBotnetClusterScore(context, stableFpHash),
+        store.set(`ip-device:${clientIp}`, deviceId, 600) // Link the IP to the device for 10 minutes
+      ]);
+
+      // Synchronous calculations
+      const { headerAnomalyScore } = getHeaderAnomalies(context);
+      let inconsistencyScore = Math.min(100, Math.max(0, (1 - consistencyScore) * 200)); // Amplified score
+
+      // NOUVEAU: Si l'incohérence est très forte (cookie probablement volé), on applique une pénalité maximale.
+      if (consistencyScore < 0.7) { // Seuil de rupture
+          inconsistencyScore = 100;
+      }
 
-  const { botScore } = getBotScore(context);
+      const { behaviorScore } = getBehaviorScore(context); // Appel de la fonction
 
-  // NOUVEAU: On calcule le score d'incohérence temporelle.
-  const { timeInconsistencyScore } = getTimeInconsistencyScore(context, JSON.parse(context.headers['x-behavior-metrics'] || '{}'));
+      // On appelle getHoneypotScore ici pour que son résultat soit inclus dans le vecteur.
+      const { honeypotScore } = getHoneypotScore(context, honeypotConfig);
 
-  // NOUVEAU: On calcule le score d'incohérence entre les couches.
-  const { crossLayerInconsistencyScore } = getCrossLayerInconsistency(context);
+      const { botScore } = getBotScore(context);
 
-  // NOUVEAU: On calcule le score de variance des clics.
-  const { clickVarianceScore } = getClickVarianceScore(context);
+      // NOUVEAU: On calcule le score d'incohérence temporelle.
+      const { timeInconsistencyScore } = getTimeInconsistencyScore(context, JSON.parse(context.headers['x-behavior-metrics'] || '{}'), deviceData);
 
-  // NOUVEAU: On calcule le score d'incohérence des Client-Hints.
-  const { clientHintsInconsistencyScore } = getClientHintsInconsistencyScore(context);
+      // NOUVEAU: On calcule le score d'incohérence entre les couches.
+      const { crossLayerInconsistencyScore } = getCrossLayerInconsistency(context);
 
-  // NOUVEAU: On calcule le score de réputation du sous-réseau.
-  // FIX: Pass the deviceId to getSubnetScore
-  const { subnetScore } = await getSubnetScore(context, deviceId);
+      // NOUVEAU: On calcule le score de variance des clics.
+      const { clickVarianceScore } = getClickVarianceScore(context);
 
-  const { requestPatternScore } = getRequestPatternScore(context, deviceData, securityConfig.patterns);
+      // NOUVEAU: On calcule le score d'incohérence des Client-Hints.
+      const { clientHintsInconsistencyScore } = getClientHintsInconsistencyScore(context);
 
-  const ipReputationScore = await getIpReputationScore(clientIp);
+      const { requestPatternScore } = getRequestPatternScore(context, deviceData, securityConfig.patterns);
 
-  const stableFp = extractStablePart(currentDeviceHash);
-  const stableFpHash = cyrb53(stableFp).toString();
-  const { botnetClusterScore } = await getBotnetClusterScore(context, stableFpHash);
   const { tcpAnomalyScore } = getTcpAnomalyScore(context);
   const { quicAnomalyScore } = getQuicAnomalyScore(context);
   const { renderingAnomalyScore } = getRenderingAnomalyScore(context);
@@ -3204,7 +3478,40 @@ export function generateCpuTargetChallenge(
   };
 }
 
-const htmlTemplateCache = new Map();
+class SimpleLRUCache {
+    constructor(maxSize = 100) {
+        this.maxSize = maxSize;
+        this.cache = new Map();
+    }
+
+    get(key) {
+        if (!this.cache.has(key)) return undefined;
+        const value = this.cache.get(key);
+        this.cache.delete(key);
+        this.cache.set(key, value);
+        return value;
+    }
+
+    set(key, value) {
+        if (this.cache.has(key)) {
+            this.cache.delete(key);
+        } else if (this.cache.size >= this.maxSize) {
+            const lruKey = this.cache.keys().next().value;
+            this.cache.delete(lruKey);
+        }
+        this.cache.set(key, value);
+    }
+
+    has(key) {
+        return this.cache.has(key);
+    }
+
+    clear() {
+        this.cache.clear();
+    }
+}
+
+const htmlTemplateCache = new SimpleLRUCache(100);
 
 /**
  * Generates the HTML page for the CPU target challenge.
@@ -3812,13 +4119,19 @@ export class FingerprintEngine {
     
     this._log('Processing request', { clientIp, path, isStatic });
     
+    // Bypass instantané si l'appareil a prouvé cryptographiquement son identité matérielle (Secure Enclave / TPM)
+    const { deviceId, deviceData, newCookie } = await resolveRequestIdentity(requestContext, this.securityConfig);
+    if (deviceData && deviceData.webauthnVerified) {
+        this._log('Hardware-anchored device verified (WebAuthn) - full bypass granted', { deviceId });
+        return { action: 'next', score: 0, vector: { webauthn_verified: 100 } };
+    }
+
     if (isStatic) {
       this._log('Static resource - skipping checks');
       return { action: 'next', score: 0, vector: {} };
     }
 
     // Resolve identity and check for persisted "condemned" status early.
-    const { deviceId, deviceData, newCookie } = await resolveRequestIdentity(requestContext, this.securityConfig);
     const currentDeviceHash = getCompositeDeviceHash(requestContext);
     const isNewDevice = !!newCookie;
     const allowRoaming = this.securityConfig?.allowCrossNetworkRoaming ?? false;
@@ -4237,17 +4550,22 @@ export class FingerprintEngine {
 
     const isBlocked = finalScore >= blockThreshold;
 
-    const isSuspiciousHigh = finalScore >= thresholds.high && !isBlocked;
+    const isSuspiciousHigh = finalScore >= thresholds.high && !isBlocked && finalScore > 0;
     const isSuspiciousMedium = finalScore >= thresholds.medium;
     const isSuspicious = finalScore >= thresholds.low;
     const isVerySuspicious = finalScore >= thresholds.medium; // Seuil pour le challenge d'optimisation
 
     // Calculate an analog "suspicion factor" (0 to 1+) for progressive difficulty
-    const suspicionFactor = isSuspicious
-        ? Math.min(
-            1.5, // On autorise un dépassement pour rendre les challenges très difficiles si le score est très élevé
-            (finalScore - thresholds.low) / (thresholds.high - thresholds.low),
-        )
+    const suspicionFactor = isSuspicious // eslint-disable-line no-nested-ternary
+        ? (() => {
+            const denominator = thresholds.high - thresholds.low;
+            if (denominator === 0) {
+                // If the range is zero, and finalScore is at or above low threshold,
+                // return 0 to avoid NaN.
+                return 0;
+            }
+            return Math.min(1.5, (finalScore - thresholds.low) / denominator);
+        })()
         : 0;
 
     this._log('Suspicion levels evaluated', { 
@@ -4661,6 +4979,42 @@ export async function handleCooperativeRequest(params, clientIp = '127.0.0.1') {
         return { error: 'Missing node_id' };
     }
 
+    // --- VÉRIFICATION DE LA SIGNATURE COOPÉRATIVE ---
+    const challengeContext = await store.get(`secret:${nodeId}`);
+    if (!challengeContext || !challengeContext.clientSecret) {
+        return { error: 'Invalid or expired node_id' };
+    }
+
+    const clientSecret = challengeContext.clientSecret;
+    const coopSig = params.coop_sig || '';
+
+    let expectedMsg = '';
+    switch (op) {
+        case 'register':
+            expectedMsg = `${clientSecret}:register:${nodeId}:${params.seed || ''}`;
+            break;
+        case 'request_peer_block':
+            expectedMsg = `${clientSecret}:request_peer_block:${nodeId}:${params.peer_id || ''}:${params.block_idx || '0'}:${params.req_id || ''}`;
+            break;
+        case 'poll_requests':
+            expectedMsg = `${clientSecret}:poll_requests:${nodeId}`;
+            break;
+        case 'respond_block':
+            expectedMsg = `${clientSecret}:respond_block:${nodeId}:${params.requester_id || ''}:${params.req_id || ''}:${params.block_data || ''}`;
+            break;
+        case 'poll_response':
+            expectedMsg = `${clientSecret}:poll_response:${nodeId}:${params.req_id || ''}`;
+            break;
+        default:
+            return { error: 'Invalid cooperative operation' };
+    }
+
+    const expectedSig = crypto.createHash('sha256').update(expectedMsg).digest('hex');
+    if (coopSig.length !== expectedSig.length || !crypto.timingSafeEqual(Buffer.from(coopSig, 'hex'), Buffer.from(expectedSig, 'hex'))) {
+        return { error: 'Invalid cooperative signature' };
+    }
+    // --- FIN DE LA VÉRIFICATION ---
+
     switch (op) {
         case 'register':
             const seed = params.seed || '';
@@ -4773,66 +5127,25 @@ function sanitizeProxyHeaders(context, securityConfig) {
 
 /**
  * Exécute l'optimisation des TTL en tâche de fond de manière asynchrone et non-bloquante.
- * Utilise l'algorithme génétique multi-objectifs de Pareto pour trouver des solutions stables.
+ * Déporté dans un worker thread dédié pour libérer l'Event Loop principale de Node.js.
  */
 export async function runBackgroundTtlOptimization() {
-    const MIN_TTL = 300000;
-    const MAX_TTL = 86400000;
-    const tempCache = new Map();
-    const keyScores = [0, 10, 20, 30, 40, 50, 60, 70, 80, 90, 100];
-
-    for (const suspicionScore of keyScores) {
-        // Rend la main à la boucle d'événements Node.js à chaque itération pour ne pas bloquer les requêtes web actives
-        await new Promise(resolve => {
-            if (typeof setImmediate === 'function') {
-                setImmediate(resolve);
-            } else {
-                setTimeout(resolve, 0);
+    return new Promise((resolve, reject) => {
+        const worker = new Worker(new URL('./ttl-optimization.worker.js', import.meta.url));
+        worker.on("message", (tempCache) => {
+            const tempMap = new Map();
+            for (const [key, value] of Object.entries(tempCache)) {
+                tempMap.set(Number(key), value);
             }
+            optimizedTtlCache = tempMap;
+            resolve();
+            worker.terminate();
         });
-
-        const solverFunction = () => {
-            const fitnessFunction = Optimization.Operators.createOptimalTtlEvaluator({ suspicionScore });
-            const createIndividual = () => MIN_TTL + Math.random() * (MAX_TTL - MIN_TTL);
-            const crossover = (ttl1, ttl2) => (ttl1 + ttl2) / 2;
-            const mutate = (ttl) => {
-                const newTtl = ttl + (Math.random() - 0.5) * (MAX_TTL - MIN_TTL) * 0.1;
-                return Math.max(MIN_TTL, Math.min(MAX_TTL, newTtl));
-            };
-
-            const paretoFront = Optimization.geneticAlgorithmMultiObjective(
-                createIndividual,
-                fitnessFunction,
-                crossover,
-                mutate,
-                {
-                    generations: 40,
-                    populationSize: 30,
-                }
-            );
-
-            if (!paretoFront || paretoFront.length === 0) {
-                return { solution: null, fitness: Infinity };
-            }
-
-            let bestSolutionInFront;
-            if (suspicionScore < 50) {
-                bestSolutionInFront = paretoFront.reduce((max, p) => Math.max(max, p.solution), 0);
-            } else {
-                bestSolutionInFront = paretoFront.reduce((min, p) => Math.min(min, p.solution), Infinity);
-            }
-            return { solution: bestSolutionInFront, fitness: 0 };
-        };
-
-        const { bestResult } = Optimization.runMultiple(solverFunction, 20);
-        if (bestResult && bestResult.solution && bestResult.solution !== Infinity) {
-            tempCache.set(suspicionScore, Math.round(bestResult.solution));
-        } else {
-            tempCache.set(suspicionScore, Math.max(MIN_TTL, MAX_TTL - (suspicionScore / 100) * MAX_TTL));
-        }
-    }
-
-    optimizedTtlCache = tempCache;
+        worker.on("error", (err) => {
+            console.error('[Fingerprint] TTL optimization worker error:', err);
+            reject(err);
+        });
+    });
 }
 
 // Lancement de l'optimisation initiale immédiate en arrière-plan
@@ -5337,7 +5650,7 @@ function getTlsSessionId(context) {
 }
 
 // --- Proof-of-Work Middleware (The Tollbooth) ---
-const staticFileCache = new Map();
+const staticFileCache = new SimpleLRUCache(50);
 
 export const powMiddleware = (securityConfig) => {
   const engine = new FingerprintEngine(securityConfig);
@@ -5369,6 +5682,36 @@ export const powMiddleware = (securityConfig) => {
   }
 
   return async (req, res, next) => {
+      if (req.query && req.query.fp_handshake) {
+          const clientKeyHex = req.headers['x-client-ephemeral-key'];
+          if (clientKeyHex) {
+              try {
+                  const serverECDH = crypto.createECDH('prime256v1');
+                  serverECDH.generateKeys();
+                  const serverPubKeyHex = serverECDH.getKeys('hex');
+                  const sharedSecret = serverECDH.computeSecret(clientKeyHex, 'hex');
+                  const hmacKey = crypto.createHash('sha256').update(sharedSecret).digest('hex');
+
+                  const requestContext = {
+                      clientIp: req.ip || req.socket?.remoteAddress || "unknown",
+                      headers: req.headers,
+                      cookies: req.cookies
+                  };
+                  const { deviceId, deviceData } = await resolveRequestIdentity(requestContext, securityConfig);
+                  if (deviceData) {
+                      deviceData.sessionHmacKey = hmacKey;
+                      await store.set(`device:${deviceId}`, deviceData);
+                  }
+
+                  res.setHeader('x-server-ephemeral-key', serverPubKeyHex);
+                  return res.status(200).json({ status: 'success' });
+              } catch (e) {
+                  return res.status(400).json({ error: 'Handshake failed' });
+              }
+          }
+          return res.status(400).json({ error: 'Missing client key' });
+      }
+
       if (!req.headers_translated) {
           req.headers_translated = true;
           const matchedMapping = getActiveMappingForRequest(req.headers);
@@ -5523,7 +5866,7 @@ export const powMiddleware = (securityConfig) => {
  * This is a common pattern to allow mocking of ES module functions.
  */
 export const __internal = {
-    store, // Export the store for testing
+    get store() { return store; }, // Export the store for testing
     getDeviceHash,
     getCompositeDeviceHash,
     getSuspicionVector,
@@ -5543,6 +5886,7 @@ export const __internal = {
     getTlsFingerprint, // NOUVEAU: Expose pour les tests
     sanitizeTrafficData, // NOUVEAU: Expose pour l'auto-tuner/tests
     getTlsSpoofingScore, // NOUVEAU: Expose pour les tests
+    verifyWebAuthnHardwareAnchor,
     generateStatelessTicket,
     parseStatelessTicket,
     parseJa3,
@@ -5559,6 +5903,8 @@ export const __internal = {
     setLastBestSolution: (val) => { lastBestSolution = val; }, // Expose to test auto-tuning metrics
     verifyZkpProof,
     modPow,
+    generateSessionMapping,
+    compilePolymorphicJs,
     parseTcpSyn, // Expose for testing
     classifyTcpOs, // Expose for testing
     getTcpAnomalyScore, // Expose for testing,
@@ -5839,6 +6185,43 @@ function runThresholdOptimization(securityConfig, trafficData, minDataPoints, ma
   // Plus le ratio est équilibré et le volume important, plus nous faisons confiance au Front de Pareto.
   const trafficConfidence = Math.min(1.5, Math.max(0.3, highConfidenceRatio * 4));
 
+    // --- VALIDATION POST-CALCUL (Anti-empoisonnement & Validation Croisée) ---
+    const tempConfig = {
+        thresholds: { ...securityConfig.thresholds },
+        weights: { ...securityConfig.weights },
+        patterns: { ...securityConfig.patterns }
+    };
+
+    applyInertialUpdate(tempConfig.thresholds, newConfig.thresholds, 'thresholds', trafficConfidence);
+    applyInertialUpdate(tempConfig.weights, newConfig.weights, 'weights', trafficConfidence);
+    applyInertialUpdate(tempConfig.patterns, newConfig.patterns, 'patterns', trafficConfidence);
+
+    const fitnessFunction = Optimization.Operators.createFullSecurityConfigEvaluator({ trafficData: sanitizedData });
+    const currentObjectives = fitnessFunction(securityConfig);
+    const proposedObjectives = fitnessFunction(tempConfig);
+
+    const currentFPR = currentObjectives[0];
+    const currentFNR = currentObjectives[1];
+    const proposedFPR = proposedObjectives[0];
+    const proposedFNR = proposedObjectives[1];
+
+    const validationTolerance = securityConfig?.autotuning?.validationTolerance ?? tuningOptions?.validationTolerance ?? 0.15;
+
+    if (proposedFPR > currentFPR + validationTolerance || proposedFNR > currentFNR + validationTolerance) {
+        console.error(`[AutoTuning] [SECURITY ALERT] Proposed configuration rejected due to instability/poisoning risk! Proposed FPR: ${proposedFPR.toFixed(4)} (Current: ${currentFPR.toFixed(4)}), Proposed FNR: ${proposedFNR.toFixed(4)} (Current: ${currentFNR.toFixed(4)})`);
+        if (securityConfig.logger && typeof securityConfig.logger === 'function') {
+            securityConfig.logger({
+                type: 'autotuning_instability_alert',
+                proposedFPR,
+                currentFPR,
+                proposedFNR,
+                currentFNR,
+                timestamp: Date.now()
+            });
+        }
+        return; // Rollback automatique : On arrête l'application
+    }
+
   applyInertialUpdate(securityConfig.thresholds, newConfig.thresholds, 'thresholds', trafficConfidence);
   applyInertialUpdate(securityConfig.weights, newConfig.weights, 'weights', trafficConfidence);
   applyInertialUpdate(securityConfig.patterns, newConfig.patterns, 'patterns', trafficConfidence);