@anonympins/fingerprint 0.7.0 → 0.7.2

package/src/js/fingerprint.client.js

@@ -1,1464 +1,1532 @@
-import {cyrb53 as jsCyrb53, FingerprintBuilder} from './fingerprint.builder.js';
-import {solveChallenge} from './pow.solver.js';
-
-function secureRandom() {
-    if (typeof globalThis !== 'undefined' && globalThis.crypto && globalThis.crypto.getRandomValues) {
-        const array = new Uint32Array(1);
-        globalThis.crypto.getRandomValues(array);
-        return array[0] / 0xffffffff;
-    }
-    return Math.random();
-}
-
-// Variable pour stocker la fonction de hachage active.
-// Par défaut, c'est l'implémentation JavaScript.
-let activeCyrb53 = jsCyrb53;
-let derivedKey = null;
-
-async function negotiateSessionKey() {
-    if (typeof window === 'undefined' || !window.crypto || !window.crypto.subtle) return;
-    try {
-        const keyPair = await window.crypto.subtle.generateKey(
-            { name: "ECDH", namedCurve: "P-256" },
-            false,
-            ["deriveKey"]
-        );
-        const clientPubKeyBuffer = await window.crypto.subtle.exportKey("raw", keyPair.publicKey);
-        const clientPubKeyHex = Array.from(new Uint8Array(clientPubKeyBuffer))
-            .map(b => b.toString(16).padStart(2, '0'))
-            .join('');
-
-        const response = await fetch(window.location.pathname + '?fp_handshake=1', {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                'x-client-ephemeral-key': clientPubKeyHex
-            },
-            body: JSON.stringify({ fp: ClientLibrary.getDeviceFingerprint() })
-        });
-
-        const serverPubKeyHex = response.headers.get('x-server-ephemeral-key');
-        if (serverPubKeyHex) {
-            const serverPubKeyBuffer = new Uint8Array(
-                serverPubKeyHex.match(/.{1,2}/g).map(byte => parseInt(byte, 16))
-            );
-            const serverPubKey = await window.crypto.subtle.importKey(
-                "raw",
-                serverPubKeyBuffer,
-                { name: "ECDH", namedCurve: "P-256" },
-                true,
-                []
-            );
-            derivedKey = await window.crypto.subtle.deriveKey(
-                { name: "ECDH", public: serverPubKey },
-                keyPair.privateKey,
-                { name: "HMAC", hash: "SHA-256", length: 256 },
-                true,
-                ["sign"]
-            );
-            console.log('[Fingerprint] Cryptographic session negotiated successfully.');
-        }
-    } catch (e) {
-        console.warn('[Fingerprint] Cryptographic session negotiation failed:', e);
-    }
-}
-
-async function signMetrics(metricsObj) {
-    if (!derivedKey) return metricsObj;
-    try {
-        const copy = JSON.parse(JSON.stringify(metricsObj));
-        delete copy.signature;
-        const dataToSign = new TextEncoder().encode(JSON.stringify(copy));
-        const signatureBuffer = await window.crypto.subtle.sign(
-            "HMAC",
-            derivedKey,
-            dataToSign
-        );
-        copy.signature = Array.from(new Uint8Array(signatureBuffer))
-            .map(b => b.toString(16).padStart(2, '0'))
-            .join('');
-        return copy;
-    } catch (e) {
-        return metricsObj;
-    }
-}
-
-const DB_NAME = 'wasm-cache-db';
-const DB_VERSION = 1;
-const STORE_NAME = 'wasm-modules';
-
-const genRandStr = (len = 8) => {
-    return Array.from({ length: len }, () => String.fromCharCode(97 + Math.floor(secureRandom() * 26))).join('');
-};
-
-function getCachedWasm(url) {
-    return new Promise((resolve) => {
-        if (typeof indexedDB === 'undefined') return resolve(null);
-        const request = indexedDB.open(DB_NAME, DB_VERSION);
-        request.onupgradeneeded = (e) => {
-            const db = e.target.result;
-            if (!db.objectStoreNames.contains(STORE_NAME)) {
-                db.createObjectStore(STORE_NAME);
-            }
-        };
-        request.onsuccess = (e) => {
-            const db = e.target.result;
-            try {
-                const transaction = db.transaction(STORE_NAME, 'readonly');
-                const store = transaction.objectStore(STORE_NAME);
-                const getReq = store.get(url);
-                getReq.onsuccess = () => resolve(getReq.result);
-                getReq.onerror = () => resolve(null);
-            } catch (err) {
-                resolve(null);
-            }
-        };
-        request.onerror = () => resolve(null);
-    });
-}
-
-function cacheWasm(url, data) {
-    return new Promise((resolve) => {
-        if (typeof indexedDB === 'undefined') return resolve(false);
-        const request = indexedDB.open(DB_NAME, DB_VERSION);
-        request.onupgradeneeded = (e) => {
-            const db = e.target.result;
-            if (!db.objectStoreNames.contains(STORE_NAME)) {
-                db.createObjectStore(STORE_NAME);
-            }
-        };
-        request.onsuccess = (e) => {
-            const db = e.target.result;
-            try {
-                const transaction = db.transaction(STORE_NAME, 'readwrite');
-                const store = transaction.objectStore(STORE_NAME);
-                store.put(data, url);
-                transaction.oncomplete = () => resolve(true);
-                transaction.onerror = () => resolve(false);
-            } catch (err) {
-                resolve(false);
-            }
-        };
-        request.onerror = () => resolve(false);
-    });
-}
-
-const ClientLibrary = {
-    // Cache pour éviter de recalculer les constantes (Hardware, etc.)
-    _cachedBuilder: null,
-    /**
-     * @private
-     * Dispatches a custom event from the window object.
-     * @param {string} eventName - The name of the event.
-     * @param {object} [detail={}] - The data to include in the event's detail property.
-     */
-    _dispatchEvent(eventName, detail = {}) {
-        if (typeof window === 'undefined' || typeof CustomEvent === 'undefined') return;
-        const event = new CustomEvent(`fingerprint:${eventName}`, { detail });
-        window.dispatchEvent(event);
-    },
-
-    /**
-     * Wrapper interne pour la fonction de hachage.
-     * @private
-     */
-    _hasher: (str, seed) => activeCyrb53(str, seed),
-
-    /**
-     * Génère une preuve de connaissance à divulgation nulle (ZKP) de Schnorr pour l'empreinte de l'appareil.
-     * Rend le tout stable et compatible avec les vérifications JS, PHP et Python.
-     * @param {string} fingerprint - L'empreinte de l'appareil.
-     * @returns {Promise<string>} La preuve sous format "y:t:s" en hexadécimal.
-     */
-    async generateZkpProof(fingerprint) {
-        const ZKP_P = 115792089237316195423570985008687907853269984665640564039457584007908834671663n;
-        const ZKP_G = 2n;
-        const cryptoObj = window.crypto || window.msCrypto;
-
-        const sha256Hex = async (str) => {
-            const encoder = new TextEncoder();
-            const data = encoder.encode(str);
-            const hashBuffer = await cryptoObj.subtle.digest('SHA-256', data);
-            const hashArray = Array.from(new Uint8Array(hashBuffer));
-            return hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
-        };
-
-        const modPow = (base, exponent, modulus) => {
-            if (modulus === 1n) return 0n;
-            let result = 1n;
-            base = base % modulus;
-            while (exponent > 0n) {
-                if (exponent % 2n === 1n) {
-                    result = (result * base) % modulus;
-                }
-                exponent = exponent >> 1n;
-                base = (base * base) % modulus;
-            }
-            return result;
-        };
-
-        const xHex = await sha256Hex(fingerprint);
-        const x = BigInt('0x' + xHex) % ZKP_P;
-        const y = modPow(ZKP_G, x, ZKP_P);
-        const randomBytes = new Uint8Array(32);
-        cryptoObj.getRandomValues(randomBytes);
-        let vHex = Array.from(randomBytes).map(b => b.toString(16).padStart(2, '0')).join('');
-        let v = BigInt('0x' + vHex) % (ZKP_P - 1n);
-        if (v === 0n) v = 1n;
-        const t = modPow(ZKP_G, v, ZKP_P);
-        const cStr = ZKP_G.toString() + y.toString() + t.toString();
-        const cHex = await sha256Hex(cStr);
-        const c = BigInt('0x' + cHex) % ZKP_P;
-        const s = (v + c * x) % (ZKP_P - 1n);
-
-        return `${y.toString(16)}:${t.toString(16)}:${s.toString(16)}`;
-    },
-
-    /**
-     * Génère l'empreinte de l'appareil actuel.
-     */
-    getDeviceFingerprint() {
-        if (typeof window === "undefined") {
-            console.error("getDeviceFingerprint can only be called on the client-side.");
-            return "";
-        }
-        
-        if (!this._cachedBuilder) {
-            const nav = window.navigator;
-            const screen = window.screen;
-
-            this._cachedBuilder = new FingerprintBuilder();
-
-            // 1. Hardware (Très stable) : Cœurs, RAM, GPU (si dispo via canvas), Touch
-            this._cachedBuilder.add(
-                "hw", // Utilise maintenant le hasher actif
-                `${nav.hardwareConcurrency}_${nav.deviceMemory}_${nav.maxTouchPoints}`,
-            );
-
-            // 2. Geo/Locale (Stable sauf voyage/VPN) : Timezone, Langue
-            this._cachedBuilder.add(
-                "geo",
-                `${Intl.DateTimeFormat().resolvedOptions().timeZone}_${nav.language}_${new Date().getTimezoneOffset()}`,
-            );
-
-            // 3. Screen (Stable sauf changement moniteur/zoom) : Dimensions, ColorDepth
-            this._cachedBuilder.add(
-                "scr",
-                `${screen.width}x${screen.height}_${screen.colorDepth}`,
-            );
-
-            // 4. Platform (Stable) : OS, Engine
-            this._cachedBuilder.add("os", nav.platform);
-
-            // 5. Graphics (WebGL Vendor/Renderer) - Invariant matériel fort
-            try {
-                const canvas = document.createElement("canvas");
-                const gl =
-                    canvas.getContext("webgl2") ||
-                    canvas.getContext("webgl") ||
-                    canvas.getContext("experimental-webgl");
-                if (gl) {
-                    const debugInfo = gl.getExtension("WEBGL_debug_renderer_info");
-                    if (debugInfo) {
-                        const vendor = gl.getParameter(debugInfo.UNMASKED_VENDOR_WEBGL);
-                        const renderer = gl.getParameter(debugInfo.UNMASKED_RENDERER_WEBGL);
-                        this._cachedBuilder.add("gpu", `${vendor}_${renderer}`);
-                    }
-                }
-            } catch (e) {
-            }
-
-            // 6. Canvas Fingerprinting (Rendering quirks)
-            try {
-                const canvas = document.createElement("canvas");
-                const ctx = canvas.getContext("2d");
-                if (ctx) {
-                    canvas.width = 200;
-                    canvas.height = 50;
-                    ctx.textBaseline = "alphabetic";
-                    ctx.font = "14px 'Arial'";
-                    ctx.fillStyle = "#f60";
-                    ctx.fillRect(125, 1, 62, 20);
-                    ctx.fillStyle = "#069";
-                    ctx.fillText("fingerprint", 2, 15);
-                    ctx.fillStyle = "rgba(102, 204, 0, 0.7)";
-                    ctx.fillText("fingerprint", 4, 17);
-                    this._cachedBuilder.add("cvs", canvas.toDataURL());
-                }
-            } catch (e) {
-            }
-
-            // 7. Détection des artefacts du Chrome DevTools Protocol (CDP)
-            // Ces variables sont souvent injectées par les outils d'automatisation.
-            const cdpFootprints = [
-                'cdc_adoQpoasnfa76pfcZLmcfl_Array',
-                'cdc_adoQpoasnfa76pfcZLmcfl_Promise',
-                'cdc_adoQpoasnfa76pfcZLmcfl_Symbol',
-                '$cdc_asdjflasutopfhvcZLmcfl_',
-                '_selenium',
-                '_driver'
-            ];
-            if (cdpFootprints.some(fp => window[fp])) {
-                this._cachedBuilder.add("cdp", "true");
-            }
-
-            // 7. Bot Detection (Indication cachée)
-            if (nav.webdriver) this._cachedBuilder.add("bot", "true");
-        }
-
-        return this._cachedBuilder.toString();
-    },
-
-    /**
-     * Génère une signature de requête incluant le contexte.
-     * @param {object} payload
-     */
-    /**
-     * Génère une signature de requête incluant le contexte.
-     * @param {object} payload
-     */
-    generateRequestSignature(payload = {}) {
-        const deviceFp = this.getDeviceFingerprint();
-        const sortedPayload = Object.keys(payload)
-            .sort()
-            .map((k) => `${k}=${payload[k]}`)
-            .join("&");
-        const payloadHash = this._hasher(sortedPayload);
-        return `${deviceFp}|req:${payloadHash}`;
-    },
-
-    /**
-     * Génère une signature HMAC-SHA256 en utilisant l'API Web Crypto.
-     * @param {object} payload - Les données à signer.
-     * @param {string} secret - La clé secrète partagée.
-     * @returns {Promise<string>} La signature hexadécimale.
-     */
-    async generateClientSideSignature(payload, secret) {
-        const sortedPayload = Object.keys(payload).sort().map((k) => `${k}=${payload[k]}`).join("&");
-        const encoder = new TextEncoder();
-        const key = await window.crypto.subtle.importKey("raw", encoder.encode(secret), {
-            name: "HMAC",
-            hash: "SHA-256"
-        }, false, ["sign"]);
-        const signatureBuffer = await window.crypto.subtle.sign("HMAC", key, encoder.encode(sortedPayload));
-        const hashArray = Array.from(new Uint8Array(signatureBuffer));
-        return hashArray.map((b) => b.toString(16).padStart(2, "0")).join("");
-    },
-
-    /**
-     * @internal
-     * Resets the cached fingerprint builder. Used for testing purposes.
-     */
-    _resetCache() {
-        // Réinitialise le hasher à l'implémentation JS par défaut.
-        activeCyrb53 = jsCyrb53;
-        this._cachedBuilder = null;
-    },
-
-    /**
-     * Injecte des éléments interactifs fantômes invisibles pour piéger les bots (focus/hover).
-     */
-    injectPhantomTraps() {
-        if (typeof document === 'undefined') return;
-
-        // Création d'un élément interactif fantôme
-        const phantom = document.createElement('a');
-        phantom.href = '#';
-        // Nom trompeur aléatoire pour attirer les analyseurs automatiques de liens / formulaires
-        const phantomNames = ['sys-session-recovery', 'auth-token-refresh', 'debug-console-login', 'admin-portal-access', 'security-bypass-bypass', 'recovery-key-session', 'api-key-test', 'client-secrets-access'];
-        phantom.id = phantomNames[Math.floor(secureRandom() * phantomNames.length)] + '-' + genRandStr(6);
-        phantom.className = genRandStr(8);
-        phantom.tabIndex = 0; // Dans le flux naturel de tabulation
-        phantom.setAttribute('aria-hidden', 'true'); // Masqué pour les screen readers légitimes
-
-        // Style invisible mais interactif (1px x 1px, presque transparent)
-        phantom.style.position = 'fixed';
-        phantom.style.top = '1px';
-        phantom.style.left = '1px';
-        phantom.style.width = '1px';
-        phantom.style.height = '1px';
-        phantom.style.opacity = '0.001';
-        phantom.style.zIndex = '99999';
-        phantom.style.overflow = 'hidden';
-        phantom.style.pointerEvents = 'auto';
-
-        const triggerTrap = () => {
-            this.onHoneypotTrigger();
-        };
-
-        phantom.addEventListener('focus', triggerTrap, { passive: true });
-        phantom.addEventListener('mouseover', triggerTrap, { passive: true });
-
-        // Imbrication polymorphique du piège fantôme dans le corps du document
-        const nestingOptions = [
-            () => document.body.appendChild(phantom),
-            () => {
-                const wrapper = document.createElement(secureRandom() > 0.5 ? 'span' : 'div');
-                wrapper.className = genRandStr(8);
-                wrapper.style.position = 'absolute';
-                wrapper.style.width = '0';
-                wrapper.style.height = '0';
-                wrapper.style.overflow = 'hidden';
-                wrapper.appendChild(phantom);
-                document.body.appendChild(wrapper);
-            }
-        ];
-        nestingOptions[Math.floor(secureRandom() * nestingOptions.length)]();
-    },
-
-    /**
-     * Démarre le suivi des événements tactiles sur mobile/tablette.
-     */
-    startTouchEventTracker() {
-        if (this._touchTrackerAttached) return;
-        this._touchTrackerAttached = true;
-
-        const handleTouch = (e) => {
-            if (touchMovementsHistory.length >= TOUCH_HISTORY_MAX) {
-                touchMovementsHistory.shift();
-            }
-            const touch = e.touches[0] || e.changedTouches[0];
-            if (!touch) return;
-
-            const radiusX = touch.radiusX || 0;
-            const radiusY = touch.radiusY || 0;
-            const radius = (radiusX + radiusY) / 2;
-            const force = touch.force || touch.webkitForce || 0;
-
-            touchMovementsHistory.push({
-                x: touch.clientX,
-                y: touch.clientY,
-                t: performance.now(),
-                p: force,
-                r: radius,
-                num: e.touches.length
-            });
-        };
-
-        document.addEventListener('touchstart', handleTouch, { passive: true });
-        document.addEventListener('touchmove', handleTouch, { passive: true });
-        document.addEventListener('touchend', handleTouch, { passive: true });
-    },
-
-    /**
-     * Démarre le suivi de la régularité d'affichage (V-Sync/rAF) pour détecter les framebuffers logiciels sans V-Sync.
-     */
-    startRenderingTracker() {
-        if (this._renderingTrackerAttached) return;
-        this._renderingTrackerAttached = true;
-
-        if (typeof window === 'undefined' || !window.requestAnimationFrame) return;
-
-        const rAfTimestamps = [];
-        let lastTime = performance.now();
-        const maxSamples = 15;
-
-        const checkOffscreenAnom = () => {
-            try {
-                if ('OffscreenCanvas' in window && HTMLCanvasElement.prototype.transferControlToOffscreen) {
-                    const nativeToString = Function.prototype.toString.call(HTMLCanvasElement.prototype.transferControlToOffscreen);
-                    return !nativeToString.includes('[native code]');
-                }
-            } catch (e) {}
-            return false;
-        };
-
-        const loop = (time) => {
-            const delta = time - lastTime;
-            lastTime = time;
-            if (rAfTimestamps.length < maxSamples) {
-                if (rAfTimestamps.length > 0) { // Skip first delta
-                    rAfTimestamps.push(delta);
-                }
-                window.requestAnimationFrame(loop);
-            } else {
-                const avg = rAfTimestamps.reduce((a, b) => a + b, 0) / rAfTimestamps.length;
-                const sqDiffs = rAfTimestamps.map(v => Math.pow(v - avg, 2));
-                const avgSqDiff = sqDiffs.reduce((a, b) => a + b, 0) / sqDiffs.length;
-                
-                metrics.rendering = {
-                    fps: Math.round((1000 / avg) * 100) / 100,
-                    jitter: Math.round(Math.sqrt(avgSqDiff) * 100) / 100,
-                    offscreenAnom: checkOffscreenAnom()
-                };
-            }
-        };
-        window.requestAnimationFrame(loop);
-    },
-
-    /**
-     * Initialise l'espace Proof-of-Space persistant dans l'IndexedDB locale.
-     */
-    async initializeSpace(seed, sizeMb) {
-        return new Promise((resolve, reject) => {
-            const request = indexedDB.open('pospace-db', 1);
-            request.onupgradeneeded = (e) => {
-                const db = e.target.result;
-                if (!db.objectStoreNames.contains('blocks')) {
-                    db.createObjectStore('blocks');
-                }
-            };
-            request.onsuccess = async (e) => {
-                const db = e.target.result;
-                const tx = db.transaction('blocks', 'readwrite');
-                const store = tx.objectStore('blocks');
-                
-                const maxBlocks = sizeMb * 1024;
-                const countReq = store.count();
-                countReq.onsuccess = async () => {
-                    if (countReq.result < maxBlocks) {
-                        for (let i = 0; i < maxBlocks; i++) {
-                            const block = new Uint8Array(1024);
-                            let h = 5381;
-                            for (let j = 0; j < seed.length; j++) {
-                                h = (h << 5) + h + seed.charCodeAt(j);
-                            }
-                            h = (h << 5) + h + i;
-                            for (let k = 0; k < 1024; k++) {
-                                h = Math.imul(h ^ k, 1597334677);
-                                block[k] = h & 0xff;
-                            }
-                            store.put(block, i);
-                        }
-                    }
-                    resolve();
-                };
-            };
-            request.onerror = () => reject(new Error("Failed to open pospace database"));
-        });
-    },
-
-    /**
-     * Lit un bloc spécifique de l'IndexedDB locale sous format hexadécimal.
-     */
-    async readSpaceBlock(blockIdx) {
-        return new Promise((resolve, reject) => {
-            const request = indexedDB.open('pospace-db', 1);
-            request.onsuccess = (e) => {
-                const db = e.target.result;
-                const tx = db.transaction('blocks', 'readonly');
-                const store = tx.objectStore('blocks');
-                const getReq = store.get(blockIdx);
-                getReq.onsuccess = () => {
-                    const block = getReq.result;
-                    if (block) {
-                        const hex = Array.from(block).map(b => b.toString(16).padStart(2, '0')).join('');
-                        resolve(hex);
-                    } else {
-                        reject(new Error("Block not found"));
-                    }
-                };
-                getReq.onerror = () => reject(getReq.error);
-            };
-            request.onerror = () => reject(new Error("Failed to open pospace database"));
-        });
-    },
-
-    /**
-     * Résout le Proof-of-Space en combinant optionnellement le bloc du pair.
-     */
-    async solveSpaceChallenge(seed, queries, nonce, clientSecret, peerBlock = '') {
-        const blocks = [];
-        for (const idx of queries) {
-            const blockHex = await this.readSpaceBlock(idx);
-            blocks.push(blockHex);
-        }
-        let finalPayload = blocks.join('') + peerBlock + nonce + ":" + clientSecret;
-        const encoder = new TextEncoder();
-        const data = encoder.encode(finalPayload);
-        const hashBuffer = await window.crypto.subtle.digest('SHA-256', data);
-        const hashArray = Array.from(new Uint8Array(hashBuffer));
-        return hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
-    },
-
-    /**
-     * Démarre le suivi des mouvements de la souris pour calculer l'entropie.
-     * À appeler une fois sur la page.
-     */
-    startMouseEntropyTracker() {
-        // Utiliser un drapeau pour éviter d'attacher l'écouteur plusieurs fois
-        if (this._mouseTrackerAttached) return;
-        this._mouseTrackerAttached = true;
- 
-        document.addEventListener('mousemove', (e) => {
-            // NOUVEAU: Capturer une série de points {x, y, t}
-            if (mouseMovementsHistory.length >= MOUSE_HISTORY_MAX) {
-                // Garder la taille de l'historique constante pour éviter une consommation mémoire excessive.
-                mouseMovementsHistory.shift();
-            }
-            mouseMovementsHistory.push({
-                x: e.clientX,
-                y: e.clientY,
-                t: performance.now()
-            });
-        }, {passive: true});
-    },
-
-    /**
-     * Démarre le suivi de la dynamique de frappe pour calculer le dwell time et le flight time (digraphie/trigraphie).
-     * À appeler une fois sur la page.
-     */
-    startKeystrokeDynamicsTracker() {
-        // S'assurer de ne pas attacher l'écouteur plusieurs fois
-        if (this._keystrokeTrackerAttached) return;
-        this._keystrokeTrackerAttached = true;
-
-        const activeKeys = new Map();
-        let lastKeyDownTime = 0;
-        let lastKeyName = '';
-
-        document.addEventListener('keydown', (e) => {
-            const now = performance.now();
-            const key = e.key;
-            const code = e.code;
-            if (!key && !code) return;
-
-            const keyIdentifier = code || key;
-
-            // Prevent key repeat triggering multiple events
-            if (activeKeys.has(keyIdentifier)) return;
-            activeKeys.set(keyIdentifier, now);
-
-            if (keystrokeTimestamps.length > 0) {
-                const lastTimestamp = keystrokeTimestamps[keystrokeTimestamps.length - 1];
-                const latency = now - lastTimestamp;
-                if (latency > 10 && latency < 2000) {
-                    if (keystrokeLatencies.length >= KEYSTROKE_HISTORY_MAX) {
-                        keystrokeLatencies.shift();
-                    }
-                    keystrokeLatencies.push(latency);
-                }
-            }
-            keystrokeTimestamps.push(now);
-
-            // Flight Time (KeyDown to KeyDown)
-            if (lastKeyDownTime > 0) {
-                const flightTime = now - lastKeyDownTime;
-                if (flightTime > 10 && flightTime < 2000) {
-                    if (keystrokeFlightTimes.length >= KEYSTROKE_HISTORY_MAX) {
-                        keystrokeFlightTimes.shift();
-                    }
-                    const digraph = lastKeyName ? this._hasher(lastKeyName + "_" + keyIdentifier).toString() : "unknown";
-                    keystrokeFlightTimes.push({ digraph, time: flightTime });
-                }
-            }
-            lastKeyDownTime = now;
-            lastKeyName = keyIdentifier;
-        }, {passive: true});
-
-        document.addEventListener('keyup', (e) => {
-            const now = performance.now();
-            const key = e.key;
-            const code = e.code;
-            if (!key && !code) return;
-
-            const keyIdentifier = code || key;
-
-            if (activeKeys.has(keyIdentifier)) {
-                const pressTime = activeKeys.get(keyIdentifier);
-                const dwellTime = now - pressTime;
-                activeKeys.delete(keyIdentifier);
-
-                if (dwellTime > 5 && dwellTime < 1000) {
-                    if (keystrokeDwellTimes.length >= KEYSTROKE_HISTORY_MAX) {
-                        keystrokeDwellTimes.shift();
-                    }
-                    keystrokeDwellTimes.push(dwellTime);
-                }
-            }
-        }, {passive: true});
-    },
-
-    /**
-     * Starts tracking click events to analyze position variance.
-     * @private
-     */
-    startClickTracker() {
-        if (this._clickTrackerAttached) return;
-        this._clickTrackerAttached = true;
-
-        document.addEventListener('click', (e) => {
-            if (clicksHistory.length >= CLICKS_HISTORY_MAX) {
-                clicksHistory.shift();
-            }
-            // Generate a simple identifier for the target element
-            const target = e.target;
-            const targetId = target.id || target.name || target.tagName;
-
-            clicksHistory.push({
-                x: e.clientX,
-                y: e.clientY,
-                t: performance.now(),
-                targetId: this._hasher(targetId) // Hash the ID to keep it short and consistent
-            });
-        }, { passive: true });
-    },
-    /**
-     * Initialise ou réinitialise les honeypots côté client pour une détection immédiate.
-     * Les anciens écouteurs sont supprimés avant d'en ajouter de nouveaux.
-     * @param {string[]} honeypotFieldNames - Noms des champs de formulaire cachés.
-     */
-    initializeHoneypots(honeypotFieldNames) {
-        // 1. Nettoyer les anciens écouteurs
-        activeHoneypotListeners.forEach((listener, field) => {
-            field.removeEventListener('input', listener);
-        });
-        activeHoneypotListeners.clear();
-
-        // 2. Ajouter les nouveaux écouteurs sur le DOM classique
-        honeypotFieldNames.forEach(fieldName => {
-            const field = document.querySelector(`[name="${fieldName}"]`);
-            if (field) {
-                const listener = () => {
-                    this.onHoneypotTrigger();
-                    field.removeEventListener('input', listener);
-                };
-                field.addEventListener('input', listener);
-                activeHoneypotListeners.set(field, listener); // On stocke la référence
-            }
-        });
-
-        // 3. Générer des champs d'input pièges masqués dans un Shadow DOM fermé
-        if (typeof document !== 'undefined' && honeypotFieldNames.length > 0) {
-            const host = document.createElement('div');
-            host.setAttribute('aria-hidden', 'true');
-            host.style.position = 'absolute';
-            host.style.width = '0';
-            host.style.height = '0';
-            host.style.overflow = 'hidden';
-
-            const shadow = host.attachShadow({ mode: 'closed' });
-
-            // Aléatisation des classes, variables CSS et balises de structure
-            const wrapperClass = genRandStr(10);
-            const posStateVar = `--${genRandStr(8)}`;
-            const offValVar = `--${genRandStr(8)}`;
-            const visStateVar = `--${genRandStr(8)}`;
-            const scaleValVar = `--${genRandStr(8)}`;
-
-            const style = document.createElement('style');
-            style.textContent = `
-              :host {
-                ${posStateVar}: absolute;
-                ${offValVar}: -9999px;
-                ${visStateVar}: hidden;
-                ${scaleValVar}: 0;
-              }
-              .${wrapperClass} {
-                position: var(${posStateVar});
-                left: var(${offValVar});
-                top: var(${offValVar});
-                visibility: var(${visStateVar});
-                transform: scale(var(${scaleValVar}));
-              }
-            `;
-            shadow.appendChild(style);
-
-            const wrapperTags = ['div', 'section', 'p', 'span', 'form', 'main'];
-            const selectedWrapperTag = wrapperTags[Math.floor(secureRandom() * wrapperTags.length)];
-            const wrapper = document.createElement(selectedWrapperTag);
-            wrapper.className = wrapperClass;
-
-            honeypotFieldNames.forEach(fieldName => {
-                const label = document.createElement('label');
-                label.textContent = fieldName;
-                const input = document.createElement('input');
-                input.type = 'text';
-                input.name = fieldName;
-                input.tabIndex = -1;
-                input.className = genRandStr(6);
-                input.id = genRandStr(8);
-                input.autocomplete = 'off';
-
-                const trigger = () => {
-                    this.onHoneypotTrigger();
-                };
-
-                input.addEventListener('input', trigger, { passive: true });
-                input.addEventListener('change', trigger, { passive: true });
-                input.addEventListener('focus', trigger, { passive: true });
-
-                // Imbrication polymorphique du label et de l'input
-                const nestingType = Math.floor(secureRandom() * 3);
-                if (nestingType === 1) {
-                    label.appendChild(input);
-                    wrapper.appendChild(label);
-                } else if (nestingType === 2) {
-                    const innerContainer = document.createElement(secureRandom() > 0.5 ? 'span' : 'div');
-                    innerContainer.className = genRandStr(5);
-                    innerContainer.appendChild(label);
-                    innerContainer.appendChild(input);
-                    wrapper.appendChild(innerContainer);
-                } else {
-                    wrapper.appendChild(label);
-                    wrapper.appendChild(input);
-                }
-            });
-
-            shadow.appendChild(wrapper);
-            document.body.appendChild(host);
-        }
-    },
-    /**
-     * Sollicite silencieusement l'attestation matérielle FIDO2 (WebAuthn)
-     * pour ancrer l'identité physique de l'appareil via TPM / Secure Enclave.
-     * @returns {Promise<object|null>}
-     */
-    async getWebAuthnAnchor() {
-        if (typeof window === 'undefined' || !window.PublicKeyCredential) return null;
-        try {
-            const isPlatformAvailable = await PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable();
-            if (!isPlatformAvailable) return null;
-
-            const storedCredIdBase64 = localStorage.getItem('fp_webauthn_cred_id');
-            const challenge = new Uint8Array([109, 101, 116, 114, 105, 99, 115, 95, 97, 110, 99, 104, 111, 114, 95, 115, 101, 99, 117, 114, 101]); // Static stable challenge
-
-            if (storedCredIdBase64) {
-                // Tentative d'assertion silencieuse (Authentification)
-                const credentialId = Uint8Array.from(atob(storedCredIdBase64), c => c.charCodeAt(0));
-                const assertion = await navigator.credentials.get({
-                    publicKey: {
-                        challenge,
-                        allowCredentials: [{
-                            id: credentialId,
-                            type: 'public-key'
-                        }],
-                        userVerification: 'discouraged',
-                        timeout: 1000
-                    }
-                });
-                if (assertion) {
-                    return {
-                        type: 'assertion',
-                        credentialId: storedCredIdBase64,
-                        signature: btoa(String.fromCharCode(...new Uint8Array(assertion.response.signature))),
-                        authenticatorData: btoa(String.fromCharCode(...new Uint8Array(assertion.response.authenticatorData))),
-                        clientDataJSON: btoa(String.fromCharCode(...new Uint8Array(assertion.response.clientDataJSON)))
-                    };
-                }
-            } else {
-                // Création silencieuse (Enregistrement initial)
-                const options = {
-                    publicKey: {
-                        challenge,
-                        rp: { name: window.location.hostname, id: window.location.hostname },
-                        user: {
-                            id: new Uint8Array([102, 112, 105, 100]),
-                            name: 'silent-device-anchor',
-                            displayName: 'Hardware Device Anchor'
-                        },
-                        pubKeyCredParams: [
-                            { type: 'public-key', alg: -7 },  // ES256 (P-256) - Secure Enclave / TPM / Android Keystore
-                            { type: 'public-key', alg: -257 } // RS256 - Windows Hello TPM
-                        ],
-                        authenticatorSelection: {
-                            authenticatorAttachment: 'platform',
-                            userVerification: 'discouraged',
-                            residentKey: 'preferred'
-                        },
-                        timeout: 1500,
-                        attestation: 'indirect'
-                    }
-                };
-                const credential = await navigator.credentials.create(options);
-                if (credential) {
-                    const credIdBase64 = btoa(String.fromCharCode(...new Uint8Array(credential.rawId)));
-                    localStorage.setItem('fp_webauthn_cred_id', credIdBase64);
-                    const publicKeyDer = credential.response.getPublicKey ? credential.response.getPublicKey() : null;
-                    return {
-                        type: 'registration',
-                        credentialId: credIdBase64,
-                        publicKey: publicKeyDer ? btoa(String.fromCharCode(...new Uint8Array(publicKeyDer))) : null,
-                        attestationObject: btoa(String.fromCharCode(...new Uint8Array(credential.response.getAttestationObject()))),
-                        clientDataJSON: btoa(String.fromCharCode(...new Uint8Array(credential.response.clientDataJSON)))
-                    };
-                }
-            }
-        } catch (e) {
-            // Ignore et bypass silencieusement pour garder l'invisibilité en cas de non-support
-            console.log('[WebAuthn-Anchor] Silent attestation bypassed:', e.message);
-        }
-        return null;
-    },
-
-    /**
-     * Récupère les métriques comportementales collectées.
-     * À appeler avant d'envoyer une requête sensible.
-     * @returns {ClientBehaviorMetrics}
-     */
-    getClientBehaviorMetrics() {
-        // Add history length as a behavioral signal.
-        metrics.historyLength = window.history.length;
-
-        // Ajoute un timestamp au moment de la collecte pour la détection de rejeu.
-        metrics.clicksHistory = clicksHistory;
-        metrics.clientTimestamp = Date.now();
-
-        metrics.touchMovementsHistory = touchMovementsHistory;
-        // NOUVEAU: Inclure l'historique des mouvements de la souris pour une analyse côté serveur.
-        metrics.mouseMovementsHistory = mouseMovementsHistory;
-
-        // NOUVEAU: Keystroke dynamics metrics (dwell and flight times)
-        metrics.keystrokeDwellTimes = keystrokeDwellTimes;
-        metrics.keystrokeFlightTimes = keystrokeFlightTimes;
-
-        // Calcule la latence moyenne des frappes
-        if (keystrokeLatencies.length > 0) {
-            const sum = keystrokeLatencies.reduce((a, b) => a + b, 0);
-            metrics.keystrokeLatency = sum / keystrokeLatencies.length;
-        } else {
-            metrics.keystrokeLatency = 0;
-        }
-        return metrics;
-    },
-
-    /**
-     * Enrichit une requête fetch avec les en-têtes de fingerprinting et de comportement.
-     * @param {RequestInfo} resource
-     * @param {RequestInit} [options]
-     * @returns {Promise<Response>}
-     */
-    async protectedFetch(resource, options = {}) {
-        const fp = this.getDeviceFingerprint();
-        const rawBehavior = this.getClientBehaviorMetrics();
-        const zkpProof = await this.generateZkpProof(fp); // Generate ZKP proof
-        const behavior = await signMetrics(rawBehavior);
-
-        const headers = new Headers(options.headers || {});
-        headers.set('X-ZKP-Proof', zkpProof); // Add ZKP proof to headers
-        headers.set('X-Device-Fingerprint', fp);
-        headers.set('X-Behavior-Metrics', JSON.stringify(behavior));
-
-        options.headers = headers;
-        return fetch(resource, options);
-    },
-
-// --- Système d'interception de Fetch robuste et anti-conflit ---
-
-    _isFetchPatched: false,
-    _interceptorChain: [],
-    // On stocke la fonction fetch originale et on la lie à son contexte (window)
-    // pour éviter les erreurs "Illegal invocation" si une autre lib la modifie.
-    _originalFetch: (typeof window !== 'undefined') ? window.fetch.bind(window) : null,
-
-/**
- * Adds an interceptor function to the `fetch` chain.
- * Chaque intercepteur reçoit `resource`, `options`, et une fonction `next`.
- * Il DOIT appeler `next(resource, options)` pour continuer la chaîne.
- * @param {function(RequestInfo, RequestInit, function): Promise<Response>} interceptor
- */
-  addFetchInterceptor(interceptor) {
-    if (!this._isFetchPatched) {
-        this.patchGlobalFetch();
-    }
-    this._interceptorChain.push(interceptor);
-  },
-
-  patchGlobalFetch() {
-    if (this._isFetchPatched || !this._originalFetch) return;
-
-    this._isFetchPatched = true;
-    window.fetch = (resource, options) => {
-        // Le "dispatcher" qui exécute la chaîne.
-        const dispatch = (index, res, opts) => {
-            if (index >= this._interceptorChain.length) {
-                // Fin de la chaîne, on appelle le fetch original.
-                return this._originalFetch(res, opts);
-            }
-            const nextInterceptor = this._interceptorChain[index];
-            // Appelle l'intercepteur actuel en lui passant la fonction pour appeler le suivant.
-            return nextInterceptor(res, opts, (nextRes, nextOpts) => dispatch(index + 1, nextRes, nextOpts));
-        };
-        return dispatch(0, resource, options || {});
-    };
-  },
-
-    /**
-     * La fonction qui est appelée lorsqu'un honeypot est déclenché.
-     * @private
-     */
-    onHoneypotTrigger() {
-        metrics.honeypotInteraction = true;
-        // Émettre un événement pour que l'application puisse réagir.
-        this._dispatchEvent('honeypotTriggered');
-    },
-
-  /**
-   * Initialise l'intercepteur de fingerprinting.
-   * Il s'ajoute à la chaîne d'interception sans écraser les autres.
-   * @param {string[]} [targetDomains] - Optionnel. Liste de domaines à protéger.
-   * Si non fourni, protège les requêtes de même origine.
-   */
-  initializeFetch(targetDomains = []) {
-    const fingerprintInterceptor = async (resource, options, next) => {        
-        const requestUrl = (resource instanceof Request) ? resource.url : String(resource);        
-        let shouldProtect = false;
-
-        try {
-            const url = new URL(requestUrl, window.location.origin);
-            // Protéger si la liste de domaines est vide ET que la requête est de même origine,
-            // OU si le domaine de la requête est dans la liste fournie.
-            shouldProtect = (targetDomains.length === 0 && url.origin === window.location.origin) || 
-                            (targetDomains.length > 0 && targetDomains.includes(url.hostname));
-        } catch (e) {
-            // Si l'URL est relative (ex: '/api/data'), new URL() ne lèvera pas d'erreur.
-            // Ce bloc est une sécurité pour les cas où l'URL serait malformée.
-            // On protège par défaut si aucune liste de domaines n'est spécifiée.
-            shouldProtect = targetDomains.length === 0;
-        }
-
-        if (shouldProtect) {
-            const fp = this.getDeviceFingerprint();
-            const rawBehavior = this.getClientBehaviorMetrics();
-            const behavior = await signMetrics(rawBehavior);
-            const headers = new Headers(options.headers || {});
-            headers.set('X-Device-Fingerprint', fp);
-            headers.set('X-Behavior-Metrics', JSON.stringify(behavior));
-            options.headers = headers;
-        }
-
-        // Passe la main à l'intercepteur suivant dans la chaîne.
-        return next(resource, options);
-    };
-
-    this.addFetchInterceptor(fingerprintInterceptor);
-  }, // <-- VIRGULE AJOUTÉE ICI
-  
-  /**
-   * Injects visually hidden "honeypot" links into the DOM to trap bots.
-   * @param {string[]} urls - An array of trap URLs to inject.
-   * @private
-   */
-  injectTrapLinks(urls) {
-    if (!urls || urls.length === 0 || typeof document === 'undefined') {
-      return;
-    }
-
-    const host = document.createElement('div');
-    host.setAttribute('aria-hidden', 'true');
-    host.style.position = 'absolute';
-    host.style.width = '0';
-    host.style.height = '0';
-    host.style.overflow = 'hidden';
-
-    const shadow = host.attachShadow({ mode: 'closed' });
-
-        // Aléatisation des classes, variables CSS et balises de structure
-        const wrapperClass = genRandStr(10);
-        const layoutPosVar = `--${genRandStr(8)}`;
-        const offsetValVar = `--${genRandStr(8)}`;
-        const visibilityStateVar = `--${genRandStr(8)}`;
-        const scaleFactorVar = `--${genRandStr(8)}`;
-        const ptrEventsVar = `--${genRandStr(8)}`;
-        const linkColorClass = genRandStr(6);
-
-    const style = document.createElement('style');
-    style.textContent = `
-      :host {
-            ${layoutPosVar}: absolute;
-            ${offsetValVar}: -9999px;
-            ${visibilityStateVar}: hidden;
-            ${scaleFactorVar}: 0;
-            ${ptrEventsVar}: none;
-      }
-          .${wrapperClass} {
-            position: var(${layoutPosVar});
-            left: var(${offsetValVar});
-            top: var(${offsetValVar});
-            visibility: var(${visibilityStateVar});
-            transform: scale(var(${scaleFactorVar}));
-            pointer-events: var(${ptrEventsVar});
-      }
-          .${linkColorClass} {
-        color: transparent;
-        text-decoration: none;
-      }
-    `;
-    shadow.appendChild(style);
-
-        const wrapperTags = ['div', 'section', 'p', 'span', 'nav', 'aside'];
-        const selectedWrapperTag = wrapperTags[Math.floor(secureRandom() * wrapperTags.length)];
-        const wrapper = document.createElement(selectedWrapperTag);
-        wrapper.className = wrapperClass;
-
-    urls.forEach((url, i) => {
-      const link = document.createElement('a');
-      link.href = url;
-      link.rel = 'nofollow';
-      link.tabIndex = -1;
-          link.className = linkColorClass;
-          link.id = genRandStr(8);
-
-          // Structure interne polymorphique du lien
-          const contentNestingType = Math.floor(secureRandom() * 3);
-          if (contentNestingType === 1) {
-              const span = document.createElement('span');
-              span.className = genRandStr(5);
-              span.innerHTML = `&gt; ${i + 1}`;
-              link.appendChild(span);
-          } else if (contentNestingType === 2) {
-              const b = document.createElement('b');
-              b.className = genRandStr(5);
-              b.innerHTML = `&gt; ${i + 1}`;
-              link.appendChild(b);
-          } else {
-              link.innerHTML = `<span>&gt; ${i + 1}</span>`;
-          }
-
-      const trigger = () => {
-        this.onHoneypotTrigger();
-      };
-      link.addEventListener('click', trigger, { passive: true });
-      link.addEventListener('focus', trigger, { passive: true });
-      link.addEventListener('mouseover', trigger, { passive: true });
-
-          // Imbrication du lien de manière polymorphique
-          if (secureRandom() > 0.5) {
-              const itemContainer = document.createElement('span');
-              itemContainer.className = genRandStr(5);
-              itemContainer.appendChild(link);
-              wrapper.appendChild(itemContainer);
-          } else {
-              wrapper.appendChild(link);
-          }
-    });
-
-    shadow.appendChild(wrapper);
-    document.body.appendChild(host);
-  },
-  /**
-   * Intercepte une réponse de challenge JSON, le résout, et réessaie la requête.
-   * @param {Response} response - La réponse initiale (potentiellement 429).
-   * @param {RequestInfo} resource - La ressource de la requête originale.
-   * @param {RequestInit} options - Les options de la requête originale.
-   * @returns {Promise<Response>} - La réponse de la requête réessayée.
-   * @private
-   */
-  async solveChallengeAndRetry(response, resource, options) {
-    if (response.status !== 404 || !response.headers.get('content-type')?.includes('application/json') || response.bodyUsed) {
-      return response;
-    }
-    
-    try {
-      const challengeData = await response.json();
-      if (!challengeData.challenge || !challengeData.challenge.type) {
-        return response; // Pas un challenge JSON valide
-      }
-
-      console.log(`[Fingerprint] Received a '${challengeData.challenge.type}' challenge. Solving...`);
-      this._dispatchEvent('challengeReceived', { challenge: challengeData.challenge });
-
-      // L'empreinte de l'appareil qui résout le challenge est cruciale.
-      const solverFp = this.getDeviceFingerprint();
-      const solutionWrapper = await solveChallenge(challengeData.challenge, solverFp);
-      console.log('[Fingerprint] Challenge solved. Retrying original request.');
-
-      this._dispatchEvent('challengeSolved', { solution: solutionWrapper.rawSolution });
-      // Ajouter la solution aux paramètres de la requête pour le nouvel essai
-              const url = new URL((resource instanceof Request) ? resource.url : String(resource), window.location.origin);
-      // La logique de formatage est maintenant cachée dans la classe ChallengeSolution.
-      solutionWrapper.applyToUrl(url);
-
-      // On ajoute l'empreinte du solveur à la requête de réessai.
-      url.searchParams.set('pow_fp', solverFp);
-
-      // On utilise la chaîne d'intercepteurs pour la requête réessayée,
-      // ce qui garantit que le fetch original est appelé avec le bon contexte.
-      // Cela évite de réintroduire l'erreur "Illegal invocation".
-      return window.fetch(url.toString(), options);
-    } catch (e) {
-      console.error('[Fingerprint] Failed to solve or retry challenge:', e);
-      return response; // Retourne la réponse 429 originale en cas d'échec
-    }
-  }, // <-- VIRGULE AJOUTÉE ICI
-
-/**
- * Initialise toutes les protections côté client en une seule fois.
- * Tente également de charger le module WASM si `wasmPath` est fourni.
- * C'est la méthode d'initialisation recommandée.
- * @param {ClientConfig} [config={}] - L'objet de configuration.
- */
-  initializeClient(config = {}) {
-    const {
-        mouse = true,
-        keystrokes = true,
-        clicks = true, // Add new option
-        touches = true, // Nouveau paramètre tactiles
-            rendering = true,
-            phantomTraps = true, // NOUVEAU
-        honeypots = [],
-        trapUrls = [], // Nouveau paramètre pour les URL pièges
-        wasmPath, // Nouveau paramètre
-        workerPath, // NOUVEAU
-        fetch: fetchConfig = {}
-    } = config;
-
-        negotiateSessionKey();
-    // Tentative de chargement du WASM si le chemin est fourni
-    if (wasmPath) {
-        this.initializeWasm(wasmPath);
-    }
-
-    if (mouse) {
-        this.startMouseEntropyTracker();
-    }
-    if (workerPath) {
-        this.workerPath = workerPath;
-    }
-    if (keystrokes) {
-        this.startKeystrokeDynamicsTracker();
-    }
-    if (clicks) {
-        this.startClickTracker();
-    }
-    if (touches) {
-        this.startTouchEventTracker();
-    }
-        if (rendering) {
-            this.startRenderingTracker();
-        }
-        if (phantomTraps) {
-            this.injectPhantomTraps();
-        }
-    if (honeypots.length > 0) {
-        this.initializeHoneypots(honeypots);
-    }
-
-    // Injection dynamique des liens pièges au démarrage
-    if (trapUrls.length > 0) {
-        this.injectTrapLinks(trapUrls);
-    }
-    // On active l'interception si `fetch` est configuré, même avec un objet vide.
-    if (config.fetch) {
-        this.initializeFetch(fetchConfig.targetDomains);
-
-        // Ajoute l'intercepteur pour la résolution de challenge
-        if (fetchConfig.handleChallenges !== false) {
-            this.addFetchInterceptor(async (resource, options, next) => {
-                const originalResponse = await next(resource, options);
-                // On clone la réponse pour que la lecture du corps par solveChallengeAndRetry ne la consomme pas pour l'appelant original.
-                return this.solveChallengeAndRetry(originalResponse.clone(), resource, options);
-            });
-        }
-    }
-  },
-
-    /**
-     * Tente de charger et d'initialiser le module WebAssembly pour un hachage plus rapide.
-     * Si le chargement échoue, il se rabat silencieusement sur l'implémentation JS.
-     * @param {string} wasmPath - Le chemin vers le script de chargement du module WASM (ex: '/fp.js').
-     */
-    async initializeWasm(wasmPath) {
-        try {
-            // Direct standalone polymorphic WebAssembly loading
-            if (wasmPath.endsWith('.wasm')) {
-                let instance;
-                if (typeof WebAssembly.instantiateStreaming === 'function') {
-                    try {
-                        const response = await fetch(wasmPath);
-                        const result = await WebAssembly.instantiateStreaming(response, {});
-                        instance = result.instance;
-                    } catch (streamingError) {
-                        console.warn('[Fingerprint] WebAssembly.instantiateStreaming failed, falling back to compile:', streamingError);
-                    }
-                }
-                if (!instance) {
-                    const response = await fetch(wasmPath);
-                    const arrayBuffer = await response.arrayBuffer();
-                    const module = await WebAssembly.compile(arrayBuffer);
-                    instance = await WebAssembly.instantiate(module, {});
-                }
-                const exports = instance.exports;
-                const memory = exports.memory;
-                activeCyrb53 = (str) => {
-                    const encoder = new TextEncoder();
-                    const bytes = encoder.encode(str);
-                    const view = new Uint8Array(memory.buffer, 0, bytes.length);
-                    view.set(bytes);
-                    return exports.hash(0, bytes.length);
-                };
-                console.log('[Fingerprint] Standalone polymorphic WASM loaded successfully. Using fast dynamic hashing.');
-                if (this._cachedBuilder) {
-                    this._cachedBuilder.addRaw('wasm', 'true');
-                }
-                return;
-            }
-            // 1. Injecter le script qui charge le module WASM
-            const script = document.createElement('script');
-            script.src = wasmPath;
-            await new Promise((resolve, reject) => {
-                script.onload = resolve;
-                script.onerror = reject;
-                document.head.appendChild(script);
-            });
-
-            // 2. Attendre que la fonction globale `createFingerprintModule` soit disponible
-            if (typeof window.createFingerprintModule !== 'function') {
-                throw new Error('WASM loader script did not expose createFingerprintModule.');
-            }
-
-            // 3. Initialiser le module
-            const wasmUrl = wasmPath.replace(/\.js$/, '.wasm');
-            const wasmModule = await window.createFingerprintModule({
-                instantiateWasm: (imports, successCallback) => {
-                    (async () => {
-                        try {
-                            const cached = await getCachedWasm(wasmUrl);
-                            if (cached) {
-                                let instance;
-                                if (cached instanceof WebAssembly.Module) {
-                                    instance = await WebAssembly.instantiate(cached, imports);
-                                } else {
-                                    const result = await WebAssembly.instantiate(cached, imports);
-                                    instance = result.instance;
-                                }
-                                successCallback(instance, cached);
-                                return;
-                            }
-
-                            const response = await fetch(wasmUrl);
-                            const arrayBuffer = await response.arrayBuffer();
-
-                            let cachedData = arrayBuffer;
-                            let isModuleCached = false;
-                            try {
-                                const compiledModule = await WebAssembly.compile(arrayBuffer);
-                                const success = await cacheWasm(wasmUrl, compiledModule);
-                                if (success) {
-                                    cachedData = compiledModule;
-                                    isModuleCached = true;
-                                }
-                            } catch (e) {
-                                // Fallback if browser doesn't allow structured cloning of Compiled Modules
-                            }
-
-                            if (!isModuleCached) {
-                                await cacheWasm(wasmUrl, arrayBuffer);
-                            }
-
-                            let instance;
-                            if (cachedData instanceof WebAssembly.Module) {
-                                instance = await WebAssembly.instantiate(cachedData, imports);
-                            } else {
-                                const result = await WebAssembly.instantiate(arrayBuffer, imports);
-                                instance = result.instance;
-                            }
-                            successCallback(instance, cachedData);
-                        } catch (err) {
-                            console.warn('[Fingerprint] Custom WASM instantiation failed, falling back to default Emscripten loader:', err);
-                            successCallback(null);
-                        }
-                    })();
-                    return {}; // Async instantiation indicator for Emscripten
-                }
-            });
-            if (typeof wasmModule._hash_string !== 'function') {
-                throw new Error('WASM module did not export _hash_string.');
-            }
-        window.wasmModule = wasmModule;
-        ClientLibrary.wasmModule = wasmModule;
-
-        // Pooling de mémoire statique : pré-allocation d'un buffer réutilisable de 4 Ko
-        // Évite d'allouer/libérer de la mémoire sur le tas Emscripten lors des frappes clavier/mouvements souris rapides
-        const staticBufferSize = 4096;
-        const staticBufferPtr = wasmModule._malloc(staticBufferSize);
-        const encoder = new TextEncoder();
-
-        // 4. Remplacer la fonction de hachage par la version WASM optimisée via le buffer statique
-        activeCyrb53 = (str) => {
-            const bytes = encoder.encode(str);
-            if (bytes.length < staticBufferSize) {
-                wasmModule.HEAPU8.set(bytes, staticBufferPtr);
-                wasmModule.HEAPU8[staticBufferPtr + bytes.length] = 0; // null-terminator
-                return wasmModule._hash_string(staticBufferPtr);
-            }
-            // Fallback dynamique sécurisé si la chaîne dépasse la taille du buffer statique
-            return wasmModule._hash_string(str);
-        };
-
-            console.log('[Fingerprint] WASM module loaded successfully. Using fast hashing.');
-            // NOUVEAU: Ajoute un indicateur à l'empreinte pour que le serveur sache que le WASM est actif.
-            if (this._cachedBuilder) {
-                this._cachedBuilder.addRaw('wasm', 'true');
-            }
-        } catch (error) {
-            console.warn('[Fingerprint] WASM module failed to load. Falling back to JS implementation. Error:', error);
-        }
-    }
-};
-
-/**
- * @typedef {object} ClientBehaviorMetrics
- * @property {number} mouseEntropy - Entropie des mouvements de la souris.
- * @property {Array<{x: number, y: number, t: number}>} mouseMovementsHistory - Historique des points de la souris.
- * @property {number} keystrokeLatency - Latence moyenne entre les frappes.
- * @property {boolean} honeypotInteraction - Vrai si un honeypot a été touché.
- * @property {Array<{x: number, y: number, t: number, targetId: string}>} clicksHistory - Historique des clics.
- * @property {Array<{x: number, y: number, t: number, p: number, r: number, num: number}>} touchMovementsHistory - Historique des glissements tactiles.
- * @property {number} historyLength - La longueur de l'historique de session du navigateur (`window.history.length`).
- * @property {number} clientTimestamp - Timestamp (Date.now()) de la collecte des métriques.
- * @property {string[]} [trapUrls] - URLs pièges à injecter dynamiquement.
- */
-/** @type {ClientBehaviorMetrics} */
-const metrics = {
-    mouseEntropy: 0, // Conservé pour la compatibilité, mais l'analyse se fait maintenant sur l'historique
-    mouseMovementsHistory: [],
-    touchMovementsHistory: [],
-    clicksHistory: [],
-    keystrokeLatency: 0,
-    honeypotInteraction: false,
-    historyLength: 0,
-    clientTimestamp: 0,
-    rendering: { fps: 0, jitter: 0, offscreenAnom: false },
-};
-
-let lastMousePos = { x: 0, y: 0 };
-let mouseMovementsHistory = []; // NOUVEAU: Historique des points de la souris
-let touchMovementsHistory = []; // NOUVEAU: Historique des gestes tactiles
-const TOUCH_HISTORY_MAX = 100;
-const MOUSE_HISTORY_MAX = 100; // Limite le nombre de points stockés
-let clicksHistory = [];
-const CLICKS_HISTORY_MAX = 50;
-let activeHoneypotListeners = new Map(); // Garde une trace des écouteurs actifs
-let keystrokeTimestamps = [];
-let keystrokeLatencies = []; // NOUVEAU: Tableau dédié pour les latences
-let keystrokeDwellTimes = [];
-let keystrokeFlightTimes = [];
-const KEYSTROKE_HISTORY_MAX = 20; // On garde l'historique des 20 dernières frappes
-
-
-
-// Exporter les fonctions individuellement pour la compatibilité ascendante
-export const getDeviceFingerprint = ClientLibrary.getDeviceFingerprint.bind(ClientLibrary);
-export const generateRequestSignature = ClientLibrary.generateRequestSignature.bind(ClientLibrary);
-export const generateClientSideSignature = ClientLibrary.generateClientSideSignature.bind(ClientLibrary);
-export const _resetCache = ClientLibrary._resetCache.bind(ClientLibrary);
-export const startMouseEntropyTracker = ClientLibrary.startMouseEntropyTracker.bind(ClientLibrary);
-export const startKeystrokeDynamicsTracker = ClientLibrary.startKeystrokeDynamicsTracker.bind(ClientLibrary);
-export const startClickTracker = ClientLibrary.startClickTracker.bind(ClientLibrary);
-export const startTouchEventTracker = ClientLibrary.startTouchEventTracker.bind(ClientLibrary);
-export const startRenderingTracker = ClientLibrary.startRenderingTracker.bind(ClientLibrary);
-export const initializeHoneypots = ClientLibrary.initializeHoneypots.bind(ClientLibrary);
-export const getClientBehaviorMetrics = ClientLibrary.getClientBehaviorMetrics.bind(ClientLibrary);
-export const protectedFetch = ClientLibrary.protectedFetch.bind(ClientLibrary);
-export const addFetchInterceptor = ClientLibrary.addFetchInterceptor.bind(ClientLibrary);
-export const patchGlobalFetch = ClientLibrary.patchGlobalFetch.bind(ClientLibrary);
-export const initializeFetch = ClientLibrary.initializeFetch.bind(ClientLibrary);
-export const initializeClient = ClientLibrary.initializeClient.bind(ClientLibrary);
-export const initializeWasm = ClientLibrary.initializeWasm.bind(ClientLibrary);
-export const injectTrapLinks = ClientLibrary.injectTrapLinks.bind(ClientLibrary);
-export const injectPhantomTraps = ClientLibrary.injectPhantomTraps.bind(ClientLibrary);
-export const solveChallengeAndRetry = ClientLibrary.solveChallengeAndRetry.bind(ClientLibrary);
-export const generateZkpProof = ClientLibrary.generateZkpProof.bind(ClientLibrary);
-export const initializeSpace = ClientLibrary.initializeSpace.bind(ClientLibrary);
-export const readSpaceBlock = ClientLibrary.readSpaceBlock.bind(ClientLibrary);
-export const solveSpaceChallenge = ClientLibrary.solveSpaceChallenge.bind(ClientLibrary);
-
-// Export the internal object for testing purposes
-export default ClientLibrary;
-
-// --- Global Export for Browser ---
-// Attach the library to the window object to make it accessible from inline scripts.
-if (typeof window !== 'undefined') {
-    window.ClientLibrary = ClientLibrary;
+import {cyrb53 as jsCyrb53, FingerprintBuilder} from './fingerprint.builder.js';
+import {solveChallenge} from './pow.solver.js';
+
+function secureRandom() {
+    if (typeof globalThis !== 'undefined' && globalThis.crypto && globalThis.crypto.getRandomValues) {
+        const array = new Uint32Array(1);
+        globalThis.crypto.getRandomValues(array);
+        return array[0] / 0xffffffff;
+    }
+    return Math.random();
+}
+
+// Variable storing the active hash function.
+// Defaults to the JavaScript implementation.
+let activeCyrb53 = jsCyrb53;
+let derivedKey = null;
+
+async function negotiateSessionKey() {
+    if (typeof window === 'undefined' || !window.crypto || !window.crypto.subtle) return;
+    try {
+        const keyPair = await window.crypto.subtle.generateKey(
+            { name: "ECDH", namedCurve: "P-256" },
+            false,
+            ["deriveKey"]
+        );
+        const clientPubKeyBuffer = await window.crypto.subtle.exportKey("raw", keyPair.publicKey);
+        const clientPubKeyHex = Array.from(new Uint8Array(clientPubKeyBuffer))
+            .map(b => b.toString(16).padStart(2, '0'))
+            .join('');
+
+        const response = await fetch(window.location.pathname + '?fp_handshake=1', {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'x-client-ephemeral-key': clientPubKeyHex
+            },
+            body: JSON.stringify({ fp: ClientLibrary.getDeviceFingerprint() })
+        });
+
+        if (!response || !response.headers) return;
+        let serverPubKeyHex = null;
+        if (typeof response.headers.get === 'function') {
+            serverPubKeyHex = response.headers.get('x-server-ephemeral-key');
+        } else if (typeof response.headers === 'object') {
+            serverPubKeyHex = response.headers['x-server-ephemeral-key'] || response.headers['X-Server-Ephemeral-Key'];
+        }
+        if (serverPubKeyHex) {
+            const serverPubKeyBuffer = new Uint8Array(
+                serverPubKeyHex.match(/.{1,2}/g).map(byte => parseInt(byte, 16))
+            );
+            const serverPubKey = await window.crypto.subtle.importKey(
+                "raw",
+                serverPubKeyBuffer,
+                { name: "ECDH", namedCurve: "P-256" },
+                true,
+                []
+            );
+            derivedKey = await window.crypto.subtle.deriveKey(
+                { name: "ECDH", public: serverPubKey },
+                keyPair.privateKey,
+                { name: "HMAC", hash: "SHA-256", length: 256 },
+                true,
+                ["sign"]
+            );
+            console.log('[Fingerprint] Cryptographic session negotiated successfully.');
+        }
+    } catch (e) {
+        console.warn('[Fingerprint] Cryptographic session negotiation failed:', e);
+    }
+}
+
+async function signMetrics(metricsObj) {
+    if (!derivedKey) return metricsObj;
+    try {
+        const copy = JSON.parse(JSON.stringify(metricsObj));
+        delete copy.signature;
+        const dataToSign = new TextEncoder().encode(JSON.stringify(copy));
+        const signatureBuffer = await window.crypto.subtle.sign(
+            "HMAC",
+            derivedKey,
+            dataToSign
+        );
+        copy.signature = Array.from(new Uint8Array(signatureBuffer))
+            .map(b => b.toString(16).padStart(2, '0'))
+            .join('');
+        return copy;
+    } catch (e) {
+        return metricsObj;
+    }
+}
+
+const DB_NAME = 'wasm-cache-db';
+const DB_VERSION = 1;
+const STORE_NAME = 'wasm-modules';
+
+const genRandStr = (len = 8) => {
+    return Array.from({ length: len }, () => String.fromCharCode(97 + Math.floor(secureRandom() * 26))).join('');
+};
+
+function getCachedWasm(url) {
+    return new Promise((resolve) => {
+        if (typeof indexedDB === 'undefined') return resolve(null);
+        const request = indexedDB.open(DB_NAME, DB_VERSION);
+        request.onupgradeneeded = (e) => {
+            const db = e.target.result;
+            if (!db.objectStoreNames.contains(STORE_NAME)) {
+                db.createObjectStore(STORE_NAME);
+            }
+        };
+        request.onsuccess = (e) => {
+            const db = e.target.result;
+            try {
+                const transaction = db.transaction(STORE_NAME, 'readonly');
+                const store = transaction.objectStore(STORE_NAME);
+                const getReq = store.get(url);
+                getReq.onsuccess = () => resolve(getReq.result);
+                getReq.onerror = () => resolve(null);
+            } catch (err) {
+                resolve(null);
+            }
+        };
+        request.onerror = () => resolve(null);
+    });
+}
+
+function cacheWasm(url, data) {
+    return new Promise((resolve) => {
+        if (typeof indexedDB === 'undefined') return resolve(false);
+        const request = indexedDB.open(DB_NAME, DB_VERSION);
+        request.onupgradeneeded = (e) => {
+            const db = e.target.result;
+            if (!db.objectStoreNames.contains(STORE_NAME)) {
+                db.createObjectStore(STORE_NAME);
+            }
+        };
+        request.onsuccess = (e) => {
+            const db = e.target.result;
+            try {
+                const transaction = db.transaction(STORE_NAME, 'readwrite');
+                const store = transaction.objectStore(STORE_NAME);
+                store.put(data, url);
+                transaction.oncomplete = () => resolve(true);
+                transaction.onerror = () => resolve(false);
+            } catch (err) {
+                resolve(false);
+            }
+        };
+        request.onerror = () => resolve(false);
+    });
+}
+
+const ClientLibrary = {
+    // Cache to avoid recalculating hardware constants
+    _cachedBuilder: null,
+    /**
+     * @private
+     * Dispatches a custom event from the window object.
+     * @param {string} eventName - The name of the event.
+     * @param {object} [detail={}] - The data to include in the event's detail property.
+     */
+    _dispatchEvent(eventName, detail = {}) {
+        if (typeof window === 'undefined' || typeof CustomEvent === 'undefined') return;
+        const event = new CustomEvent(`fingerprint:${eventName}`, { detail });
+        window.dispatchEvent(event);
+    },
+
+    /**
+     * Checks if native JavaScript prototypes have been tampered with or hooked (Frida, Puppeteer Stealth).
+     */
+    detectTamperedPrototypes() {
+        const checkNative = (obj, method) => {
+            try {
+                if (!obj) return false;
+                const fn = obj[method];
+                if (!fn) return false;
+                const str = Function.prototype.toString.call(fn);
+                if (!str.includes('[native code]')) return true; // Standard JS hook
+                const desc = Object.getOwnPropertyDescriptor(obj, method);
+                if (desc && (!desc.writable && !desc.configurable && desc.value)) return false;
+                return false;
+            } catch (e) {
+                return true;
+            }
+        };
+
+        const win = typeof window !== 'undefined' ? window : (typeof globalThis !== 'undefined' ? globalThis : null);
+        if (!win) return false;
+
+        const htmlCanvas = typeof HTMLCanvasElement !== 'undefined' ? HTMLCanvasElement : win.HTMLCanvasElement;
+        const canvas2d = typeof CanvasRenderingContext2D !== 'undefined' ? CanvasRenderingContext2D : win.CanvasRenderingContext2D;
+        const webgl = typeof WebGLRenderingContext !== 'undefined' ? WebGLRenderingContext : win.WebGLRenderingContext;
+
+        return checkNative(htmlCanvas?.prototype, 'toDataURL') ||
+               checkNative(canvas2d?.prototype, 'getImageData') ||
+               checkNative(webgl?.prototype, 'getParameter') ||
+               checkNative(win, 'fetch');
+    },
+
+    /**
+     * Internal wrapper for the active hash function.
+     * @private
+     */
+    _hasher: (str, seed) => activeCyrb53(str, seed),
+
+    /**
+     * Generates a Schnorr Zero-Knowledge Proof (ZKP) of the device fingerprint.
+     * Ensures compatibility across JS, PHP, and Java verification engines.
+     * @param {string} fingerprint - Device fingerprint string.
+     * @returns {Promise<string>} Proof in hex format "y:t:s".
+     */
+    async generateZkpProof(fingerprint) {
+        const ZKP_P = 115792089237316195423570985008687907853269984665640564039457584007908834671663n;
+        const ZKP_G = 2n;
+        const cryptoObj = window.crypto || window.msCrypto;
+
+        const sha256Hex = async (str) => {
+            const encoder = new TextEncoder();
+            const data = encoder.encode(str);
+            const hashBuffer = await cryptoObj.subtle.digest('SHA-256', data);
+            const hashArray = Array.from(new Uint8Array(hashBuffer));
+            return hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
+        };
+
+        const modPow = (base, exponent, modulus) => {
+            if (modulus === 1n) return 0n;
+            let result = 1n;
+            base = base % modulus;
+            while (exponent > 0n) {
+                if (exponent % 2n === 1n) {
+                    result = (result * base) % modulus;
+                }
+                exponent = exponent >> 1n;
+                base = (base * base) % modulus;
+            }
+            return result;
+        };
+
+        const xHex = await sha256Hex(fingerprint);
+        const x = BigInt('0x' + xHex) % ZKP_P;
+        const y = modPow(ZKP_G, x, ZKP_P);
+        const randomBytes = new Uint8Array(32);
+        cryptoObj.getRandomValues(randomBytes);
+        let vHex = Array.from(randomBytes).map(b => b.toString(16).padStart(2, '0')).join('');
+        let v = BigInt('0x' + vHex) % (ZKP_P - 1n);
+        if (v === 0n) v = 1n;
+        const t = modPow(ZKP_G, v, ZKP_P);
+        const cStr = ZKP_G.toString() + y.toString() + t.toString();
+        const cHex = await sha256Hex(cStr);
+        const c = BigInt('0x' + cHex) % ZKP_P;
+        const s = (v + c * x) % (ZKP_P - 1n);
+
+        return `${y.toString(16)}:${t.toString(16)}:${s.toString(16)}`;
+    },
+
+    /**
+     * Generates the current device fingerprint.
+     */
+    getDeviceFingerprint() {
+        if (typeof window === "undefined") {
+            console.error("getDeviceFingerprint can only be called on the client-side.");
+            return "";
+        }
+        
+        if (!this._cachedBuilder) {
+            const nav = window.navigator;
+            const screen = window.screen;
+
+            this._cachedBuilder = new FingerprintBuilder();
+
+            // 1. Hardware (Very stable): Cores, RAM, GPU, Touch
+            this._cachedBuilder.add(
+                "hw",
+                `${nav.hardwareConcurrency}_${nav.deviceMemory}_${nav.maxTouchPoints}`,
+            );
+
+            // 2. Geo/Locale (Stable unless traveling/VPN): Timezone, Language
+            this._cachedBuilder.add(
+                "geo",
+                `${Intl.DateTimeFormat().resolvedOptions().timeZone}_${nav.language}_${new Date().getTimezoneOffset()}`,
+            );
+
+            // 3. Screen (Stable unless monitor/zoom changes): Dimensions, ColorDepth
+            this._cachedBuilder.add(
+                "scr",
+                `${screen.width}x${screen.height}_${screen.colorDepth}`,
+            );
+
+            // 4. Platform (Stable) : OS, Engine
+            this._cachedBuilder.add("os", nav.platform);
+
+            // 5. Graphics (WebGL Vendor/Renderer) - Invariant matériel fort
+            try {
+                const canvas = document.createElement("canvas");
+                const gl =
+                    canvas.getContext("webgl2") ||
+                    canvas.getContext("webgl") ||
+                    canvas.getContext("experimental-webgl");
+                if (gl) {
+                    const debugInfo = gl.getExtension("WEBGL_debug_renderer_info");
+                    if (debugInfo) {
+                        const vendor = gl.getParameter(debugInfo.UNMASKED_VENDOR_WEBGL);
+                        const renderer = gl.getParameter(debugInfo.UNMASKED_RENDERER_WEBGL);
+                        this._cachedBuilder.add("gpu", `${vendor}_${renderer}`);
+                    }
+                }
+            } catch (e) {
+            }
+
+            // 6. Canvas Fingerprinting (Rendering quirks)
+            try {
+                const canvas = document.createElement("canvas");
+                const ctx = canvas.getContext("2d");
+                if (ctx) {
+                    canvas.width = 200;
+                    canvas.height = 50;
+                    ctx.textBaseline = "alphabetic";
+                    ctx.font = "14px 'Arial'";
+                    ctx.fillStyle = "#f60";
+                    ctx.fillRect(125, 1, 62, 20);
+                    ctx.fillStyle = "#069";
+                    ctx.fillText("fingerprint", 2, 15);
+                    ctx.fillStyle = "rgba(102, 204, 0, 0.7)";
+                    ctx.fillText("fingerprint", 4, 17);
+                    this._cachedBuilder.add("cvs", canvas.toDataURL());
+                }
+            } catch (e) {
+            }
+
+            // 7. Detection of Chrome DevTools Protocol (CDP) artifacts
+            // Injected by automation tools
+            const cdpFootprints = [
+                'cdc_adoQpoasnfa76pfcZLmcfl_Array',
+                'cdc_adoQpoasnfa76pfcZLmcfl_Promise',
+                'cdc_adoQpoasnfa76pfcZLmcfl_Symbol',
+                '$cdc_asdjflasutopfhvcZLmcfl_',
+                '_selenium',
+                '_driver'
+            ];
+            if (cdpFootprints.some(fp => window[fp])) {
+                this._cachedBuilder.add("cdp", "true");
+            }
+
+            // 8. Bot Detection (Hidden indicators)
+            if (nav.webdriver) this._cachedBuilder.add("bot", "true");
+            if (ClientLibrary.detectTamperedPrototypes()) {
+                this._cachedBuilder.add("tampered", "true");
+            }
+        }
+
+        return this._cachedBuilder.toString();
+    },
+
+    /**
+     * Generates a request signature including context.
+     * @param {object} payload
+     */
+    /**
+     * Génère une signature de requête incluant le contexte.
+     * @param {object} payload
+     */
+    generateRequestSignature(payload = {}) {
+        const deviceFp = this.getDeviceFingerprint();
+        const sortedPayload = Object.keys(payload)
+            .sort()
+            .map((k) => `${k}=${payload[k]}`)
+            .join("&");
+        const payloadHash = this._hasher(sortedPayload);
+        return `${deviceFp}|req:${payloadHash}`;
+    },
+
+    /**
+     * Generates an HMAC-SHA256 signature using the Web Crypto API.
+     * @param {object} payload - Data payload to sign.
+     * @param {string} secret - Shared secret key.
+     * @returns {Promise<string>} Hexadecimal signature.
+     */
+    async generateClientSideSignature(payload, secret) {
+        const sortedPayload = Object.keys(payload).sort().map((k) => `${k}=${payload[k]}`).join("&");
+        const encoder = new TextEncoder();
+        const key = await window.crypto.subtle.importKey("raw", encoder.encode(secret), {
+            name: "HMAC",
+            hash: "SHA-256"
+        }, false, ["sign"]);
+        const signatureBuffer = await window.crypto.subtle.sign("HMAC", key, encoder.encode(sortedPayload));
+        const hashArray = Array.from(new Uint8Array(signatureBuffer));
+        return hashArray.map((b) => b.toString(16).padStart(2, "0")).join("");
+    },
+
+    /**
+     * @internal
+     * Resets the cached fingerprint builder. Used for testing purposes.
+     */
+    _resetCache() {
+        // Reset hasher to default JS implementation.
+        activeCyrb53 = jsCyrb53;
+        this._cachedBuilder = null;
+    },
+
+    /**
+     * Injects invisible phantom interactive elements to trap bots (focus/hover).
+     */
+    injectPhantomTraps() {
+        if (typeof document === 'undefined') return;
+
+        // Create a phantom interactive element
+        const phantom = document.createElement('a');
+        phantom.href = '#';
+        // Random deceptive name to attract automated link/form parsers
+        const phantomNames = ['sys-session-recovery', 'auth-token-refresh', 'debug-console-login', 'admin-portal-access', 'security-bypass-bypass', 'recovery-key-session', 'api-key-test', 'client-secrets-access'];
+        phantom.id = phantomNames[Math.floor(secureRandom() * phantomNames.length)] + '-' + genRandStr(6);
+        phantom.className = genRandStr(8);
+        phantom.tabIndex = 0; // In natural tab flow
+        phantom.setAttribute('aria-hidden', 'true'); // Hidden from legitimate screen readers
+
+        // Invisible yet interactive style (1px x 1px, nearly transparent)
+        phantom.style.position = 'fixed';
+        phantom.style.top = '1px';
+        phantom.style.left = '1px';
+        phantom.style.width = '1px';
+        phantom.style.height = '1px';
+        phantom.style.opacity = '0.001';
+        phantom.style.zIndex = '99999';
+        phantom.style.overflow = 'hidden';
+        phantom.style.pointerEvents = 'auto';
+
+        const triggerTrap = () => {
+            this.onHoneypotTrigger();
+        };
+
+        phantom.addEventListener('focus', triggerTrap, { passive: true });
+        phantom.addEventListener('mouseover', triggerTrap, { passive: true });
+
+        // Polymorphic DOM insertion of the phantom trap
+        const nestingOptions = [
+            () => document.body.appendChild(phantom),
+            () => {
+                const wrapper = document.createElement(secureRandom() > 0.5 ? 'span' : 'div');
+                wrapper.className = genRandStr(8);
+                wrapper.style.position = 'absolute';
+                wrapper.style.width = '0';
+                wrapper.style.height = '0';
+                wrapper.style.overflow = 'hidden';
+                wrapper.appendChild(phantom);
+                document.body.appendChild(wrapper);
+            }
+        ];
+        nestingOptions[Math.floor(secureRandom() * nestingOptions.length)]();
+    },
+
+    /**
+     * Measures gyroscope/accelerometer noise to detect phone farm racks.
+     */
+    startMotionTracker() {
+        if (this._motionTrackerAttached || typeof window === 'undefined') return;
+        this._motionTrackerAttached = true;
+        const motionSamples = [];
+        const handleMotion = (e) => {
+            const acc = e.accelerationIncludingGravity || e.acceleration;
+            if (!acc) return;
+            const mag = Math.sqrt((acc.x || 0)**2 + (acc.y || 0)**2 + (acc.z || 0)**2);
+            motionSamples.push(mag);
+            if (motionSamples.length > 20) motionSamples.shift();
+            if (motionSamples.length >= 10) {
+                const avg = motionSamples.reduce((a, b) => a + b, 0) / motionSamples.length;
+                const variance = motionSamples.reduce((a, b) => a + (b - avg)**2, 0) / motionSamples.length;
+                metrics.motionVariance = Math.round(variance * 10000) / 10000;
+            }
+        };
+        try {
+            window.addEventListener('devicemotion', handleMotion, { passive: true });
+        } catch (e) {}
+    },
+
+    /**
+     * Starts tracking touch events on mobile/tablet devices.
+     */
+    startTouchEventTracker() {
+        if (this._touchTrackerAttached) return;
+        this._touchTrackerAttached = true;
+
+        const handleTouch = (e) => {
+            if (touchMovementsHistory.length >= TOUCH_HISTORY_MAX) {
+                touchMovementsHistory.shift();
+            }
+            const touch = e.touches[0] || e.changedTouches[0];
+            if (!touch) return;
+
+            const radiusX = touch.radiusX || 0;
+            const radiusY = touch.radiusY || 0;
+            const radius = (radiusX + radiusY) / 2;
+            const force = touch.force || touch.webkitForce || 0;
+
+            touchMovementsHistory.push({
+                x: touch.clientX,
+                y: touch.clientY,
+                t: performance.now(),
+                p: force,
+                r: radius,
+                num: e.touches.length
+            });
+        };
+
+        document.addEventListener('touchstart', handleTouch, { passive: true });
+        document.addEventListener('touchmove', handleTouch, { passive: true });
+        document.addEventListener('touchend', handleTouch, { passive: true });
+    },
+
+    /**
+     * Starts tracking display regularity (V-Sync/rAF) to detect software framebuffers lacking V-Sync.
+     */
+    startRenderingTracker() {
+        if (this._renderingTrackerAttached) return;
+        this._renderingTrackerAttached = true;
+
+        if (typeof window === 'undefined' || !window.requestAnimationFrame) return;
+
+        const rAfTimestamps = [];
+        let lastTime = performance.now();
+        const maxSamples = 15;
+
+        const checkOffscreenAnom = () => {
+            try {
+                const htmlCanvas = typeof HTMLCanvasElement !== 'undefined' ? HTMLCanvasElement : window.HTMLCanvasElement;
+                if ('OffscreenCanvas' in window && htmlCanvas?.prototype?.transferControlToOffscreen) {
+                    const nativeToString = Function.prototype.toString.call(htmlCanvas.prototype.transferControlToOffscreen);
+                    return !nativeToString.includes('[native code]');
+                }
+            } catch (e) {}
+            return false;
+        };
+
+        const loop = (time) => {
+            const delta = time - lastTime;
+            lastTime = time;
+            if (rAfTimestamps.length < maxSamples) {
+                if (rAfTimestamps.length > 0) { // Skip first delta
+                    rAfTimestamps.push(delta);
+                }
+                window.requestAnimationFrame(loop);
+            } else {
+                const avg = rAfTimestamps.reduce((a, b) => a + b, 0) / rAfTimestamps.length;
+                const sqDiffs = rAfTimestamps.map(v => Math.pow(v - avg, 2));
+                const avgSqDiff = sqDiffs.reduce((a, b) => a + b, 0) / sqDiffs.length;
+                
+                metrics.rendering = {
+                    fps: Math.round((1000 / avg) * 100) / 100,
+                    jitter: Math.round(Math.sqrt(avgSqDiff) * 100) / 100,
+                    offscreenAnom: checkOffscreenAnom()
+                };
+            }
+        };
+        window.requestAnimationFrame(loop);
+    },
+
+    /**
+     * Initializes persistent Proof-of-Space allocation in local IndexedDB.
+     */
+    async initializeSpace(seed, sizeMb) {
+        return new Promise((resolve, reject) => {
+            const request = indexedDB.open('pospace-db', 1);
+            request.onupgradeneeded = (e) => {
+                const db = e.target.result;
+                if (!db.objectStoreNames.contains('blocks')) {
+                    db.createObjectStore('blocks');
+                }
+            };
+            request.onsuccess = async (e) => {
+                const db = e.target.result;
+                const tx = db.transaction('blocks', 'readwrite');
+                const store = tx.objectStore('blocks');
+                
+                const maxBlocks = sizeMb * 1024;
+                const countReq = store.count();
+                countReq.onsuccess = async () => {
+                    if (countReq.result < maxBlocks) {
+                        for (let i = 0; i < maxBlocks; i++) {
+                            const block = new Uint8Array(1024);
+                            let h = 5381;
+                            for (let j = 0; j < seed.length; j++) {
+                                h = (h << 5) + h + seed.charCodeAt(j);
+                            }
+                            h = (h << 5) + h + i;
+                            for (let k = 0; k < 1024; k++) {
+                                h = Math.imul(h ^ k, 1597334677);
+                                block[k] = h & 0xff;
+                            }
+                            store.put(block, i);
+                        }
+                    }
+                    resolve();
+                };
+            };
+            request.onerror = () => reject(new Error("Failed to open pospace database"));
+        });
+    },
+
+    /**
+     * Reads a specific block from local IndexedDB formatted as hex.
+     */
+    async readSpaceBlock(blockIdx) {
+        return new Promise((resolve, reject) => {
+            const request = indexedDB.open('pospace-db', 1);
+            request.onsuccess = (e) => {
+                const db = e.target.result;
+                const tx = db.transaction('blocks', 'readonly');
+                const store = tx.objectStore('blocks');
+                const getReq = store.get(blockIdx);
+                getReq.onsuccess = () => {
+                    const block = getReq.result;
+                    if (block) {
+                        const hex = Array.from(block).map(b => b.toString(16).padStart(2, '0')).join('');
+                        resolve(hex);
+                    } else {
+                        reject(new Error("Block not found"));
+                    }
+                };
+                getReq.onerror = () => reject(getReq.error);
+            };
+            request.onerror = () => reject(new Error("Failed to open pospace database"));
+        });
+    },
+
+    /**
+     * Solves Proof-of-Space by optionally combining a peer's block.
+     */
+    async solveSpaceChallenge(seed, queries, nonce, clientSecret, peerBlock = '') {
+        const blocks = [];
+        for (const idx of queries) {
+            const blockHex = await this.readSpaceBlock(idx);
+            blocks.push(blockHex);
+        }
+        let finalPayload = blocks.join('') + peerBlock + nonce + ":" + clientSecret;
+        const encoder = new TextEncoder();
+        const data = encoder.encode(finalPayload);
+        const hashBuffer = await window.crypto.subtle.digest('SHA-256', data);
+        const hashArray = Array.from(new Uint8Array(hashBuffer));
+        return hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
+    },
+
+    /**
+     * Starts tracking mouse movements to evaluate entropy.
+     * Call once per page lifecycle.
+     */
+    startMouseEntropyTracker() {
+        // Utiliser un drapeau pour éviter d'attacher l'écouteur plusieurs fois
+        if (this._mouseTrackerAttached) return;
+        this._mouseTrackerAttached = true;
+ 
+        document.addEventListener('mousemove', (e) => {
+            // Capture trajectory points {x, y, t}
+            if (mouseMovementsHistory.length >= MOUSE_HISTORY_MAX) {
+                // Cap history size to prevent unbounded memory growth
+                mouseMovementsHistory.shift();
+            }
+            mouseMovementsHistory.push({
+                x: e.clientX,
+                y: e.clientY,
+                t: performance.now()
+            });
+        }, {passive: true});
+    },
+
+    /**
+     * Starts tracking keystroke dynamics to evaluate dwell and flight times.
+     * Call once per page lifecycle.
+     */
+    startKeystrokeDynamicsTracker() {
+        // S'assurer de ne pas attacher l'écouteur plusieurs fois
+        if (this._keystrokeTrackerAttached) return;
+        this._keystrokeTrackerAttached = true;
+
+        const activeKeys = new Map();
+        let lastKeyDownTime = 0;
+        let lastKeyName = '';
+
+        document.addEventListener('keydown', (e) => {
+            const now = performance.now();
+            const key = e.key;
+            const code = e.code;
+            if (!key && !code) return;
+
+            const keyIdentifier = code || key;
+
+            // Prevent key repeat triggering multiple events
+            if (activeKeys.has(keyIdentifier)) return;
+            activeKeys.set(keyIdentifier, now);
+
+            if (keystrokeTimestamps.length > 0) {
+                const lastTimestamp = keystrokeTimestamps[keystrokeTimestamps.length - 1];
+                const latency = now - lastTimestamp;
+                if (latency > 10 && latency < 2000) {
+                    if (keystrokeLatencies.length >= KEYSTROKE_HISTORY_MAX) {
+                        keystrokeLatencies.shift();
+                    }
+                    keystrokeLatencies.push(latency);
+                }
+            }
+            keystrokeTimestamps.push(now);
+
+            // Flight Time (KeyDown to KeyDown)
+            if (lastKeyDownTime > 0) {
+                const flightTime = now - lastKeyDownTime;
+                if (flightTime > 10 && flightTime < 2000) {
+                    if (keystrokeFlightTimes.length >= KEYSTROKE_HISTORY_MAX) {
+                        keystrokeFlightTimes.shift();
+                    }
+                    const digraph = lastKeyName ? this._hasher(lastKeyName + "_" + keyIdentifier).toString() : "unknown";
+                    keystrokeFlightTimes.push({ digraph, time: flightTime });
+                }
+            }
+            lastKeyDownTime = now;
+            lastKeyName = keyIdentifier;
+        }, {passive: true});
+
+        document.addEventListener('keyup', (e) => {
+            const now = performance.now();
+            const key = e.key;
+            const code = e.code;
+            if (!key && !code) return;
+
+            const keyIdentifier = code || key;
+
+            if (activeKeys.has(keyIdentifier)) {
+                const pressTime = activeKeys.get(keyIdentifier);
+                const dwellTime = now - pressTime;
+                activeKeys.delete(keyIdentifier);
+
+                if (dwellTime > 5 && dwellTime < 1000) {
+                    if (keystrokeDwellTimes.length >= KEYSTROKE_HISTORY_MAX) {
+                        keystrokeDwellTimes.shift();
+                    }
+                    keystrokeDwellTimes.push(dwellTime);
+                }
+            }
+        }, {passive: true});
+    },
+
+    /**
+     * Starts tracking click events to analyze position variance.
+     * @private
+     */
+    startClickTracker() {
+        if (this._clickTrackerAttached) return;
+        this._clickTrackerAttached = true;
+
+        document.addEventListener('click', (e) => {
+            if (clicksHistory.length >= CLICKS_HISTORY_MAX) {
+                clicksHistory.shift();
+            }
+            // Generate a simple identifier for the target element
+            const target = e.target;
+            const targetId = target.id || target.name || target.tagName;
+
+            clicksHistory.push({
+                x: e.clientX,
+                y: e.clientY,
+                t: performance.now(),
+                targetId: this._hasher(targetId) // Hash the ID to keep it short and consistent
+            });
+        }, { passive: true });
+    },
+    /**
+     * Initializes or resets client-side honeypots for immediate detection.
+     * Previous listeners are removed before attaching new ones.
+     * @param {string[]} honeypotFieldNames - Hidden form field names.
+     */
+    initializeHoneypots(honeypotFieldNames) {
+        // 1. Clean up existing listeners
+        activeHoneypotListeners.forEach((listener, field) => {
+            field.removeEventListener('input', listener);
+        });
+        activeHoneypotListeners.clear();
+
+        // 2. Attach new listeners to existing DOM elements
+        honeypotFieldNames.forEach(fieldName => {
+            const field = document.querySelector(`[name="${fieldName}"]`);
+            if (field) {
+                const listener = () => {
+                    this.onHoneypotTrigger();
+                    field.removeEventListener('input', listener);
+                };
+                field.addEventListener('input', listener);
+                activeHoneypotListeners.set(field, listener);
+            }
+        });
+
+        // 3. Generate trap inputs inside a closed Shadow DOM
+        if (typeof document !== 'undefined' && honeypotFieldNames.length > 0) {
+            const host = document.createElement('div');
+            host.setAttribute('aria-hidden', 'true');
+            host.style.position = 'absolute';
+            host.style.width = '0';
+            host.style.height = '0';
+            host.style.overflow = 'hidden';
+
+            const shadow = host.attachShadow({ mode: 'closed' });
+
+            // Randomize classes, CSS variables, and layout tags
+            const wrapperClass = genRandStr(10);
+            const posStateVar = `--${genRandStr(8)}`;
+            const offValVar = `--${genRandStr(8)}`;
+            const visStateVar = `--${genRandStr(8)}`;
+            const scaleValVar = `--${genRandStr(8)}`;
+
+            const style = document.createElement('style');
+            style.textContent = `
+              :host {
+                ${posStateVar}: absolute;
+                ${offValVar}: -9999px;
+                ${visStateVar}: hidden;
+                ${scaleValVar}: 0;
+              }
+              .${wrapperClass} {
+                position: var(${posStateVar});
+                left: var(${offValVar});
+                top: var(${offValVar});
+                visibility: var(${visStateVar});
+                transform: scale(var(${scaleValVar}));
+              }
+            `;
+            shadow.appendChild(style);
+
+            const wrapperTags = ['div', 'section', 'p', 'span', 'form', 'main'];
+            const selectedWrapperTag = wrapperTags[Math.floor(secureRandom() * wrapperTags.length)];
+            const wrapper = document.createElement(selectedWrapperTag);
+            wrapper.className = wrapperClass;
+
+            honeypotFieldNames.forEach(fieldName => {
+                const label = document.createElement('label');
+                label.textContent = fieldName;
+                const input = document.createElement('input');
+                input.type = 'text';
+                input.name = fieldName;
+                input.tabIndex = -1;
+                input.className = genRandStr(6);
+                input.id = genRandStr(8);
+                input.autocomplete = 'off';
+
+                const trigger = () => {
+                    this.onHoneypotTrigger();
+                };
+
+                input.addEventListener('input', trigger, { passive: true });
+                input.addEventListener('change', trigger, { passive: true });
+                input.addEventListener('focus', trigger, { passive: true });
+
+                // Polymorphic nesting of label and input
+                const nestingType = Math.floor(secureRandom() * 3);
+                if (nestingType === 1) {
+                    label.appendChild(input);
+                    wrapper.appendChild(label);
+                } else if (nestingType === 2) {
+                    const innerContainer = document.createElement(secureRandom() > 0.5 ? 'span' : 'div');
+                    innerContainer.className = genRandStr(5);
+                    innerContainer.appendChild(label);
+                    innerContainer.appendChild(input);
+                    wrapper.appendChild(innerContainer);
+                } else {
+                    wrapper.appendChild(label);
+                    wrapper.appendChild(input);
+                }
+            });
+
+            shadow.appendChild(wrapper);
+            document.body.appendChild(host);
+        }
+    },
+    /**
+     * Silently requests FIDO2 hardware attestation (WebAuthn)
+     * to anchor physical device identity via TPM / Secure Enclave.
+     * @returns {Promise<object|null>}
+     */
+    async getWebAuthnAnchor() {
+        const win = typeof window !== 'undefined' ? window : null;
+        if (!win || !win.PublicKeyCredential) return null;
+        try {
+            const isPlatformAvailable = await win.PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable();
+            if (!isPlatformAvailable) return null;
+
+            const storedCredIdBase64 = localStorage.getItem('fp_webauthn_cred_id');
+            const challenge = new Uint8Array([109, 101, 116, 114, 105, 99, 115, 95, 97, 110, 99, 104, 111, 114, 95, 115, 101, 99, 117, 114, 101]); // Static stable challenge
+
+            if (storedCredIdBase64) {
+                // Silent assertion attempt (Authentication)
+                const credentialId = Uint8Array.from(atob(storedCredIdBase64), c => c.charCodeAt(0));
+                const assertion = await navigator.credentials.get({
+                    publicKey: {
+                        challenge,
+                        allowCredentials: [{
+                            id: credentialId,
+                            type: 'public-key'
+                        }],
+                        userVerification: 'discouraged',
+                        timeout: 1000
+                    }
+                });
+                if (assertion) {
+                    return {
+                        type: 'assertion',
+                        credentialId: storedCredIdBase64,
+                        signature: btoa(String.fromCharCode(...new Uint8Array(assertion.response.signature))),
+                        authenticatorData: btoa(String.fromCharCode(...new Uint8Array(assertion.response.authenticatorData))),
+                        clientDataJSON: btoa(String.fromCharCode(...new Uint8Array(assertion.response.clientDataJSON)))
+                    };
+                }
+            } else {
+                // Silent creation attempt (Registration)
+                const options = {
+                    publicKey: {
+                        challenge,
+                        rp: { name: window.location.hostname, id: window.location.hostname },
+                        user: {
+                            id: new Uint8Array([102, 112, 105, 100]),
+                            name: 'silent-device-anchor',
+                            displayName: 'Hardware Device Anchor'
+                        },
+                        pubKeyCredParams: [
+                            { type: 'public-key', alg: -7 },  // ES256 (P-256) - Secure Enclave / TPM / Android Keystore
+                            { type: 'public-key', alg: -257 } // RS256 - Windows Hello TPM
+                        ],
+                        authenticatorSelection: {
+                            authenticatorAttachment: 'platform',
+                            userVerification: 'discouraged',
+                            residentKey: 'preferred'
+                        },
+                        timeout: 1500,
+                        attestation: 'indirect'
+                    }
+                };
+                const credential = await navigator.credentials.create(options);
+                if (credential) {
+                    const credIdBase64 = btoa(String.fromCharCode(...new Uint8Array(credential.rawId)));
+                    localStorage.setItem('fp_webauthn_cred_id', credIdBase64);
+                    const publicKeyDer = credential.response.getPublicKey ? credential.response.getPublicKey() : null;
+                    return {
+                        type: 'registration',
+                        credentialId: credIdBase64,
+                        publicKey: publicKeyDer ? btoa(String.fromCharCode(...new Uint8Array(publicKeyDer))) : null,
+                        attestationObject: btoa(String.fromCharCode(...new Uint8Array(credential.response.getAttestationObject()))),
+                        clientDataJSON: btoa(String.fromCharCode(...new Uint8Array(credential.response.clientDataJSON)))
+                    };
+                }
+            }
+        } catch (e) {
+            // Bypass silently when unsupported to remain non-intrusive
+            console.log('[WebAuthn-Anchor] Silent attestation bypassed:', e.message);
+        }
+        return null;
+    },
+
+    /**
+     * Retrieves collected client behavioral metrics.
+     * Call before submitting sensitive requests.
+     * @returns {ClientBehaviorMetrics}
+     */
+    getClientBehaviorMetrics() {
+        // Add history length as a behavioral signal.
+        metrics.historyLength = window.history.length;
+
+        // Attach collection timestamp for replay detection
+        metrics.clicksHistory = clicksHistory;
+        metrics.clientTimestamp = Date.now();
+
+        metrics.touchMovementsHistory = touchMovementsHistory;
+        if (ClientLibrary.detectTamperedPrototypes()) {
+            metrics.prototypeTampered = true;
+        }
+        metrics.motionVariance = metrics.motionVariance ?? -1;
+        // Include mouse trajectory history for server-side evaluation
+        metrics.mouseMovementsHistory = mouseMovementsHistory;
+
+        // NOUVEAU: Keystroke dynamics metrics (dwell and flight times)
+        metrics.keystrokeDwellTimes = keystrokeDwellTimes;
+        metrics.keystrokeFlightTimes = keystrokeFlightTimes;
+
+        // Calculate mean keystroke latency
+        if (keystrokeLatencies.length > 0) {
+            const sum = keystrokeLatencies.reduce((a, b) => a + b, 0);
+            metrics.keystrokeLatency = sum / keystrokeLatencies.length;
+        } else {
+            metrics.keystrokeLatency = 0;
+        }
+        return metrics;
+    },
+
+    /**
+     * Enriches a fetch request with fingerprinting and behavioral headers.
+     * @param {RequestInfo} resource
+     * @param {RequestInit} [options]
+     * @returns {Promise<Response>}
+     */
+    async protectedFetch(resource, options = {}) {
+        const fp = this.getDeviceFingerprint();
+        const rawBehavior = this.getClientBehaviorMetrics();
+        const zkpProof = await this.generateZkpProof(fp); // Generate ZKP proof
+        const behavior = await signMetrics(rawBehavior);
+
+        const headers = new Headers(options.headers || {});
+        headers.set('X-ZKP-Proof', zkpProof); // Add ZKP proof to headers
+        headers.set('X-Device-Fingerprint', fp);
+        headers.set('X-Behavior-Metrics', JSON.stringify(behavior));
+
+        options.headers = headers;
+        return fetch(resource, options);
+    },
+
+// --- Fetch Interception Chain ---
+    _isFetchPatched: false,
+    _interceptorChain: [],
+    // Store original fetch bound to window to prevent illegal invocation errors
+    _originalFetch: (typeof window !== 'undefined') ? window.fetch.bind(window) : null,
+
+/**
+ * Adds an interceptor function to the `fetch` chain.
+ * Each interceptor receives `resource`, `options`, and a `next` function.
+ * Must call `next(resource, options)` to continue the chain.
+ * @param {function(RequestInfo, RequestInit, function): Promise<Response>} interceptor
+ */
+  addFetchInterceptor(interceptor) {
+    if (!this._isFetchPatched) {
+        this.patchGlobalFetch();
+    }
+    this._interceptorChain.push(interceptor);
+  },
+
+  patchGlobalFetch() {
+    if (this._isFetchPatched || !this._originalFetch) return;
+
+    this._isFetchPatched = true;
+    window.fetch = (resource, options) => {
+        const dispatch = (index, res, opts) => {
+            if (index >= this._interceptorChain.length) {
+                return this._originalFetch(res, opts);
+            }
+            const nextInterceptor = this._interceptorChain[index];
+            return nextInterceptor(res, opts, (nextRes, nextOpts) => dispatch(index + 1, nextRes, nextOpts));
+        };
+        return dispatch(0, resource, options || {});
+    };
+  },
+
+    /**
+     * Invoked when a honeypot trigger occurs.
+     * @private
+     */
+    onHoneypotTrigger() {
+        metrics.honeypotInteraction = true;
+        // Dispatch event allowing host applications to react
+        this._dispatchEvent('honeypotTriggered');
+    },
+
+  /**
+   * Initializes the fingerprinting fetch interceptor.
+   * Appends to interceptor chain without clobbering existing handlers.
+   * @param {string[]} [targetDomains] - Domains to protect. Defaults to same-origin.
+   */
+  initializeFetch(targetDomains = []) {
+    const fingerprintInterceptor = async (resource, options, next) => {        
+        const requestUrl = (resource instanceof Request) ? resource.url : String(resource);        
+        let shouldProtect = false;
+
+        try {
+            const url = new URL(requestUrl, window.location.origin);
+            // Protect if targetDomains is empty and same-origin, or host matches targetDomains
+            shouldProtect = (targetDomains.length === 0 && url.origin === window.location.origin) || 
+                            (targetDomains.length > 0 && targetDomains.includes(url.hostname));
+        } catch (e) {
+            // Fallback for malformed URLs
+            shouldProtect = targetDomains.length === 0;
+        }
+
+        if (shouldProtect) {
+            const fp = this.getDeviceFingerprint();
+            const rawBehavior = this.getClientBehaviorMetrics();
+            const behavior = await signMetrics(rawBehavior);
+            const headers = new Headers(options.headers || {});
+            headers.set('X-Device-Fingerprint', fp);
+            headers.set('X-Behavior-Metrics', JSON.stringify(behavior));
+            options.headers = headers;
+        }
+
+        // Forward to next interceptor in chain
+        return next(resource, options);
+    };
+
+    this.addFetchInterceptor(fingerprintInterceptor);
+  },
+  
+  /**
+   * Injects visually hidden "honeypot" links into the DOM to trap bots.
+   * @param {string[]} urls - An array of trap URLs to inject.
+   * @private
+   */
+  injectTrapLinks(urls) {
+    if (!urls || urls.length === 0 || typeof document === 'undefined') {
+      return;
+    }
+
+    const host = document.createElement('div');
+    host.setAttribute('aria-hidden', 'true');
+    host.style.position = 'absolute';
+    host.style.width = '0';
+    host.style.height = '0';
+    host.style.overflow = 'hidden';
+
+    const shadow = host.attachShadow({ mode: 'closed' });
+
+        // Randomize classes, CSS variables, and layout tags
+        const wrapperClass = genRandStr(10);
+        const layoutPosVar = `--${genRandStr(8)}`;
+        const offsetValVar = `--${genRandStr(8)}`;
+        const visibilityStateVar = `--${genRandStr(8)}`;
+        const scaleFactorVar = `--${genRandStr(8)}`;
+        const ptrEventsVar = `--${genRandStr(8)}`;
+        const linkColorClass = genRandStr(6);
+
+    const style = document.createElement('style');
+    style.textContent = `
+      :host {
+            ${layoutPosVar}: absolute;
+            ${offsetValVar}: -9999px;
+            ${visibilityStateVar}: hidden;
+            ${scaleFactorVar}: 0;
+            ${ptrEventsVar}: none;
+      }
+          .${wrapperClass} {
+            position: var(${layoutPosVar});
+            left: var(${offsetValVar});
+            top: var(${offsetValVar});
+            visibility: var(${visibilityStateVar});
+            transform: scale(var(${scaleFactorVar}));
+            pointer-events: var(${ptrEventsVar});
+      }
+          .${linkColorClass} {
+        color: transparent;
+        text-decoration: none;
+      }
+    `;
+    shadow.appendChild(style);
+
+        const wrapperTags = ['div', 'section', 'p', 'span', 'nav', 'aside'];
+        const selectedWrapperTag = wrapperTags[Math.floor(secureRandom() * wrapperTags.length)];
+        const wrapper = document.createElement(selectedWrapperTag);
+        wrapper.className = wrapperClass;
+
+    urls.forEach((url, i) => {
+      const link = document.createElement('a');
+      link.href = url;
+      link.rel = 'nofollow';
+      link.tabIndex = -1;
+          link.className = linkColorClass;
+          link.id = genRandStr(8);
+
+          // Polymorphic link content structure
+          const contentNestingType = Math.floor(secureRandom() * 3);
+          if (contentNestingType === 1) {
+              const span = document.createElement('span');
+              span.className = genRandStr(5);
+              span.innerHTML = `&gt; ${i + 1}`;
+              link.appendChild(span);
+          } else if (contentNestingType === 2) {
+              const b = document.createElement('b');
+              b.className = genRandStr(5);
+              b.innerHTML = `&gt; ${i + 1}`;
+              link.appendChild(b);
+          } else {
+              link.innerHTML = `<span>&gt; ${i + 1}</span>`;
+          }
+
+      const trigger = () => {
+        this.onHoneypotTrigger();
+      };
+      link.addEventListener('click', trigger, { passive: true });
+      link.addEventListener('focus', trigger, { passive: true });
+      link.addEventListener('mouseover', trigger, { passive: true });
+
+          // Polymorphic link nesting
+          if (secureRandom() > 0.5) {
+              const itemContainer = document.createElement('span');
+              itemContainer.className = genRandStr(5);
+              itemContainer.appendChild(link);
+              wrapper.appendChild(itemContainer);
+          } else {
+              wrapper.appendChild(link);
+          }
+    });
+
+    shadow.appendChild(wrapper);
+    document.body.appendChild(host);
+  },
+  /**
+   * Intercepts a JSON challenge response, solves it, and retries the request.
+   * @param {Response} response - Initial response (status 404/challenge).
+   * @param {RequestInfo} resource - Original request resource.
+   * @param {RequestInit} options - Original request options.
+   * @returns {Promise<Response>} - Retried response.
+   * @private
+   */
+  async solveChallengeAndRetry(response, resource, options) {
+    if (!response || response.status !== 404 || !response.headers?.get?.('content-type')?.includes('application/json') || response.bodyUsed) {
+      return response;
+    }
+    
+    try {
+      const challengeData = await response.json();
+      if (!challengeData.challenge || !challengeData.challenge.type) {
+        return response; // Not a valid JSON challenge
+      }
+
+      console.log(`[Fingerprint] Received a '${challengeData.challenge.type}' challenge. Solving...`);
+      this._dispatchEvent('challengeReceived', { challenge: challengeData.challenge });
+
+      // The device fingerprint solving the challenge is crucial
+      const solverFp = this.getDeviceFingerprint();
+      const solutionWrapper = await solveChallenge(challengeData.challenge, solverFp);
+      console.log('[Fingerprint] Challenge solved. Retrying original request.');
+
+      this._dispatchEvent('challengeSolved', { solution: solutionWrapper.rawSolution });
+      // Append solution parameters to retry request URL
+              const url = new URL((resource instanceof Request) ? resource.url : String(resource), window.location.origin);
+      solutionWrapper.applyToUrl(url);
+
+      // Attach solver fingerprint to retry request
+      url.searchParams.set('pow_fp', solverFp);
+
+      // Use fetch to retry with appropriate execution context
+      return window.fetch(url.toString(), options);
+    } catch (e) {
+      console.error('[Fingerprint] Failed to solve or retry challenge:', e);
+      return response; // Retourne la réponse 429 originale en cas d'échec
+    }
+  },
+
+/**
+ * Initializes all client-side protections in one call.
+ * Also loads WASM module if `wasmPath` is provided.
+ * Recommended initialization approach.
+ * @param {ClientConfig} [config={}] - Client configuration options.
+ */
+  initializeClient(config = {}) {
+    const {
+        mouse = true,
+        keystrokes = true,
+        clicks = true, // Add new option
+        touches = true, // Touch event tracking
+        motion = true,
+            rendering = true,
+        phantomTraps = true,
+        honeypots = [],
+        trapUrls = [], // Trap URLs
+        wasmPath,
+        workerPath, // NOUVEAU
+        fetch: fetchConfig = {}
+    } = config;
+
+        negotiateSessionKey();
+    // Load WASM module if path provided
+    if (wasmPath) {
+        this.initializeWasm(wasmPath);
+    }
+
+    if (mouse) {
+        this.startMouseEntropyTracker();
+    }
+    if (workerPath) {
+        this.workerPath = workerPath;
+    }
+    if (keystrokes) {
+        this.startKeystrokeDynamicsTracker();
+    }
+    if (clicks) {
+        this.startClickTracker();
+    }
+    if (touches) {
+        this.startTouchEventTracker();
+    }
+    if (motion) {
+        this.startMotionTracker();
+    }
+    if (ClientLibrary.detectTamperedPrototypes()) {
+        metrics.prototypeTampered = true;
+    }
+        if (rendering) {
+            this.startRenderingTracker();
+        }
+        if (phantomTraps) {
+            this.injectPhantomTraps();
+        }
+    if (honeypots.length > 0) {
+        this.initializeHoneypots(honeypots);
+    }
+
+    // Dynamically inject trap links on startup
+    if (trapUrls.length > 0) {
+        this.injectTrapLinks(trapUrls);
+    }
+    // Enable fetch interception if configured
+    if (config.fetch) {
+        this.initializeFetch(fetchConfig.targetDomains);
+
+        // Add challenge resolution interceptor
+        if (fetchConfig.handleChallenges !== false) {
+            this.addFetchInterceptor(async (resource, options, next) => {
+                const originalResponse = await next(resource, options);
+                // Clone response to prevent draining the body stream for original caller
+                return this.solveChallengeAndRetry(originalResponse.clone(), resource, options);
+            });
+        }
+    }
+  },
+
+    /**
+     * Attempts to load and initialize WebAssembly module for accelerated hashing.
+     * Falls back to JavaScript implementation on error.
+     * @param {string} wasmPath - Path to WASM loader script or binary.
+     */
+    async initializeWasm(wasmPath) {
+        try {
+            // Direct standalone polymorphic WebAssembly loading
+            if (wasmPath.endsWith('.wasm')) {
+                let instance;
+                if (typeof WebAssembly.instantiateStreaming === 'function') {
+                    try {
+                        const response = await fetch(wasmPath);
+                        const result = await WebAssembly.instantiateStreaming(response, {});
+                        instance = result.instance;
+                    } catch (streamingError) {
+                        console.warn('[Fingerprint] WebAssembly.instantiateStreaming failed, falling back to compile:', streamingError);
+                    }
+                }
+                if (!instance) {
+                    const response = await fetch(wasmPath);
+                    const arrayBuffer = await response.arrayBuffer();
+                    const module = await WebAssembly.compile(arrayBuffer);
+                    instance = await WebAssembly.instantiate(module, {});
+                }
+                const exports = instance.exports;
+                const memory = exports.memory;
+                activeCyrb53 = (str) => {
+                    const encoder = new TextEncoder();
+                    const bytes = encoder.encode(str);
+                    const view = new Uint8Array(memory.buffer, 0, bytes.length);
+                    view.set(bytes);
+                    return exports.hash(0, bytes.length);
+                };
+                console.log('[Fingerprint] Standalone polymorphic WASM loaded successfully. Using fast dynamic hashing.');
+                if (this._cachedBuilder) {
+                    this._cachedBuilder.addRaw('wasm', 'true');
+                }
+                return;
+            }
+            // 1. Inject WASM loader script
+            const script = document.createElement('script');
+            script.src = wasmPath;
+            await new Promise((resolve, reject) => {
+                script.onload = resolve;
+                script.onerror = reject;
+                document.head.appendChild(script);
+            });
+
+            // 2. Await global module factory
+            if (typeof window.createFingerprintModule !== 'function') {
+                throw new Error('WASM loader script did not expose createFingerprintModule.');
+            }
+
+            // 3. Initialize module
+            const wasmUrl = wasmPath.replace(/\.js$/, '.wasm');
+            const wasmModule = await window.createFingerprintModule({
+                instantiateWasm: (imports, successCallback) => {
+                    (async () => {
+                        try {
+                            const cached = await getCachedWasm(wasmUrl);
+                            if (cached) {
+                                let instance;
+                                if (cached instanceof WebAssembly.Module) {
+                                    instance = await WebAssembly.instantiate(cached, imports);
+                                } else {
+                                    const result = await WebAssembly.instantiate(cached, imports);
+                                    instance = result.instance;
+                                }
+                                successCallback(instance, cached);
+                                return;
+                            }
+
+                            const response = await fetch(wasmUrl);
+                            const arrayBuffer = await response.arrayBuffer();
+
+                            let cachedData = arrayBuffer;
+                            let isModuleCached = false;
+                            try {
+                                const compiledModule = await WebAssembly.compile(arrayBuffer);
+                                const success = await cacheWasm(wasmUrl, compiledModule);
+                                if (success) {
+                                    cachedData = compiledModule;
+                                    isModuleCached = true;
+                                }
+                            } catch (e) {
+                                // Fallback if browser doesn't allow structured cloning of Compiled Modules
+                            }
+
+                            if (!isModuleCached) {
+                                await cacheWasm(wasmUrl, arrayBuffer);
+                            }
+
+                            let instance;
+                            if (cachedData instanceof WebAssembly.Module) {
+                                instance = await WebAssembly.instantiate(cachedData, imports);
+                            } else {
+                                const result = await WebAssembly.instantiate(arrayBuffer, imports);
+                                instance = result.instance;
+                            }
+                            successCallback(instance, cachedData);
+                        } catch (err) {
+                            console.warn('[Fingerprint] Custom WASM instantiation failed, falling back to default Emscripten loader:', err);
+                            successCallback(null);
+                        }
+                    })();
+                    return {}; // Async instantiation indicator for Emscripten
+                }
+            });
+            if (typeof wasmModule._hash_string !== 'function') {
+                throw new Error('WASM module did not export _hash_string.');
+            }
+        window.wasmModule = wasmModule;
+        ClientLibrary.wasmModule = wasmModule;
+
+        // Static memory pool: 4KB pre-allocated buffer
+        // Avoids heap malloc/free churn on rapid mouse and keyboard tracking
+        const staticBufferSize = 4096;
+        const staticBufferPtr = wasmModule._malloc(staticBufferSize);
+        const encoder = new TextEncoder();
+
+        // 4. Swap hash function with WASM implementation
+        activeCyrb53 = (str) => {
+            const bytes = encoder.encode(str);
+            if (bytes.length < staticBufferSize) {
+                wasmModule.HEAPU8.set(bytes, staticBufferPtr);
+                wasmModule.HEAPU8[staticBufferPtr + bytes.length] = 0; // null-terminator
+                return wasmModule._hash_string(staticBufferPtr);
+            }
+            // Fallback if string exceeds static buffer size
+            return wasmModule._hash_string(str);
+        };
+
+            console.log('[Fingerprint] WASM module loaded successfully. Using fast hashing.');
+            // Tag fingerprint with wasm marker
+            if (this._cachedBuilder) {
+                this._cachedBuilder.addRaw('wasm', 'true');
+            }
+        } catch (error) {
+            console.warn('[Fingerprint] WASM module failed to load. Falling back to JS implementation. Error:', error);
+        }
+    }
+};
+
+/**
+ * @typedef {object} ClientBehaviorMetrics
+ * @property {number} mouseEntropy - Mouse entropy estimate.
+ * @property {Array<{x: number, y: number, t: number}>} mouseMovementsHistory - Mouse movement coordinates.
+ * @property {number} keystrokeLatency - Average latency between keystrokes.
+ * @property {boolean} honeypotInteraction - True if honeypot was triggered.
+ * @property {Array<{x: number, y: number, t: number, targetId: string}>} clicksHistory - Click interaction history.
+ * @property {Array<{x: number, y: number, t: number, p: number, r: number, num: number}>} touchMovementsHistory - Touch movement trajectory.
+ * @property {number} historyLength - Browser window.history.length.
+ * @property {number} clientTimestamp - Metrics collection timestamp.
+ * @property {string[]} [trapUrls] - Dynamically injected trap URLs.
+ */
+/** @type {ClientBehaviorMetrics} */
+const metrics = {
+    mouseEntropy: 0, // Retained for compatibility; analysis primarily evaluates trajectory history
+    mouseMovementsHistory: [],
+    touchMovementsHistory: [],
+    clicksHistory: [],
+    keystrokeLatency: 0,
+    honeypotInteraction: false,
+    historyLength: 0,
+    clientTimestamp: 0,
+    rendering: { fps: 0, jitter: 0, offscreenAnom: false },
+};
+
+let lastMousePos = { x: 0, y: 0 };
+let mouseMovementsHistory = []; // Mouse movement trajectory
+let touchMovementsHistory = []; // Touch movement trajectory
+const TOUCH_HISTORY_MAX = 100;
+const MOUSE_HISTORY_MAX = 100;
+let clicksHistory = [];
+const CLICKS_HISTORY_MAX = 50;
+let activeHoneypotListeners = new Map();
+let keystrokeTimestamps = [];
+let keystrokeLatencies = [];
+let keystrokeDwellTimes = [];
+let keystrokeFlightTimes = [];
+const KEYSTROKE_HISTORY_MAX = 20; // Keep the last 20 keystroke events
+
+
+
+// Exporter les fonctions individuellement pour la compatibilité ascendante
+export const getDeviceFingerprint = ClientLibrary.getDeviceFingerprint.bind(ClientLibrary);
+export const generateRequestSignature = ClientLibrary.generateRequestSignature.bind(ClientLibrary);
+export const generateClientSideSignature = ClientLibrary.generateClientSideSignature.bind(ClientLibrary);
+export const _resetCache = ClientLibrary._resetCache.bind(ClientLibrary);
+export const startMouseEntropyTracker = ClientLibrary.startMouseEntropyTracker.bind(ClientLibrary);
+export const startKeystrokeDynamicsTracker = ClientLibrary.startKeystrokeDynamicsTracker.bind(ClientLibrary);
+export const startClickTracker = ClientLibrary.startClickTracker.bind(ClientLibrary);
+export const startTouchEventTracker = ClientLibrary.startTouchEventTracker.bind(ClientLibrary);
+export const startRenderingTracker = ClientLibrary.startRenderingTracker.bind(ClientLibrary);
+export const startMotionTracker = ClientLibrary.startMotionTracker.bind(ClientLibrary);
+export const detectTamperedPrototypes = ClientLibrary.detectTamperedPrototypes.bind(ClientLibrary);
+export const initializeHoneypots = ClientLibrary.initializeHoneypots.bind(ClientLibrary);
+export const getClientBehaviorMetrics = ClientLibrary.getClientBehaviorMetrics.bind(ClientLibrary);
+export const protectedFetch = ClientLibrary.protectedFetch.bind(ClientLibrary);
+export const addFetchInterceptor = ClientLibrary.addFetchInterceptor.bind(ClientLibrary);
+export const patchGlobalFetch = ClientLibrary.patchGlobalFetch.bind(ClientLibrary);
+export const initializeFetch = ClientLibrary.initializeFetch.bind(ClientLibrary);
+export const initializeClient = ClientLibrary.initializeClient.bind(ClientLibrary);
+export const initializeWasm = ClientLibrary.initializeWasm.bind(ClientLibrary);
+export const injectTrapLinks = ClientLibrary.injectTrapLinks.bind(ClientLibrary);
+export const injectPhantomTraps = ClientLibrary.injectPhantomTraps.bind(ClientLibrary);
+export const solveChallengeAndRetry = ClientLibrary.solveChallengeAndRetry.bind(ClientLibrary);
+export const generateZkpProof = ClientLibrary.generateZkpProof.bind(ClientLibrary);
+export const initializeSpace = ClientLibrary.initializeSpace.bind(ClientLibrary);
+export const readSpaceBlock = ClientLibrary.readSpaceBlock.bind(ClientLibrary);
+export const solveSpaceChallenge = ClientLibrary.solveSpaceChallenge.bind(ClientLibrary);
+
+// Export the internal object for testing purposes
+export default ClientLibrary;
+
+// --- Global Export for Browser ---
+// Attach the library to the window object to make it accessible from inline scripts.
+if (typeof window !== 'undefined') {
+    window.ClientLibrary = ClientLibrary;
 }