@anonympins/fingerprint 0.7.3 → 0.7.5

package/src/js/fingerprint.js

@@ -68,7 +68,8 @@ function canAttemptDns() {
 }
 
 /**
- * Diffuse un ZKP banni aux pairs fédérés de manière asynchrone (non-bloquante).
+ * Diffuse un ZKP banni aux pairs fédérés de manière asynchrone (non-bloquante)
+ * avec protection par Anonymat Différentiel (Differential Privacy / Bruit de Laplace & Leurres).
  * @private
  * @param {string} zkpY - La clé publique ZKP du terminal banni.
  * @param {object} config - La configuration de sécurité.
@@ -77,46 +78,87 @@ async function broadcastBannedZkp(zkpY, config) {
     const peers = config.federatedPeers || [];
     if (peers.length === 0) return;
 
-    const timestamp = Date.now();
-    const msg = `${timestamp}:${zkpY}`;
-    
-    let signature = '';
-    let isAsymmetric = false;
+    const dpConfig = config.differentialPrivacy || {};
+    const dpEnabled = dpConfig.enabled !== false;
+    const epsilon = typeof dpConfig.epsilon === 'number' ? dpConfig.epsilon : (config.dpEpsilon || 1.0);
 
-    if (process.env.ED25519_PRIVATE_KEY) {
-        try {
-            const cleanKey = process.env.ED25519_PRIVATE_KEY.replace(/\\n/g, '\n');
-            const signBuffer = crypto.sign(null, Buffer.from(msg), {
-                key: cleanKey,
-                format: 'pem',
-                type: 'pkcs8'
-            });
-            signature = signBuffer.toString('hex');
-            isAsymmetric = true;
-        } catch (e) {
-            console.error('[Fingerprint] Asymmetric broadcast signing failed, falling back to HMAC:', e.message);
+    const sendReport = (targetZkpY, ts) => {
+        const msg = `${ts}:${targetZkpY}`;
+        let signature = '';
+        let isAsymmetric = false;
+
+        if (process.env.ED25519_PRIVATE_KEY) {
+            try {
+                const cleanKey = process.env.ED25519_PRIVATE_KEY.replace(/\\n/g, '\n');
+                const signBuffer = crypto.sign(null, Buffer.from(msg), {
+                    key: cleanKey,
+                    format: 'pem',
+                    type: 'pkcs8'
+                });
+                signature = signBuffer.toString('hex');
+                isAsymmetric = true;
+            } catch (e) {
+                console.error('[Fingerprint] Asymmetric broadcast signing failed, falling back to HMAC:', e.message);
+            }
         }
-    }
 
-    if (!isAsymmetric) {
-        const secret = config.federationSecret || getPowSecret();
-        signature = crypto.createHmac('sha256', secret).update(msg).digest('hex');
+        if (!isAsymmetric) {
+            const secret = config.federationSecret || getPowSecret();
+            signature = crypto.createHmac('sha256', secret).update(msg).digest('hex');
+        }
+
+        peers.forEach(peerUrl => {
+            fetch(peerUrl + '?coop_op=share_threat_intel', {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'X-Federation-Signature': isAsymmetric ? '' : signature,
+                    'X-Federation-Signature-Ed25519': isAsymmetric ? signature : '',
+                    'X-Federation-Timestamp': String(ts)
+                },
+                body: JSON.stringify({ zkpY: targetZkpY })
+            }).catch(() => {
+                // Échec de propagation silencieux pour ne pas perturber le thread principal
+            });
+        });
+    };
+
+    let reportTimestamp = Date.now();
+
+    // 1. Differential Privacy : Perturbation laplacienne de l'horodatage
+    if (dpEnabled) {
+        const deltaT = 5000; // Sensibilité de 5s
+        const b = deltaT / Math.max(0.1, epsilon);
+        const u = secureRandomFloat() - 0.5;
+        const safeU = Math.abs(u) < 1e-7 ? (u >= 0 ? 1e-7 : -1e-7) : u;
+        const laplaceNoise = -b * Math.sign(safeU) * Math.log(1 - 2 * Math.abs(safeU));
+        const clampedNoise = Math.max(-60000, Math.min(60000, Math.round(laplaceNoise)));
+        reportTimestamp = Date.now() + clampedNoise;
     }
 
-    peers.forEach(peerUrl => {
-        fetch(peerUrl + '?coop_op=share_threat_intel', {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                'X-Federation-Signature': isAsymmetric ? '' : signature,
-                'X-Federation-Signature-Ed25519': isAsymmetric ? signature : '',
-                'X-Federation-Timestamp': String(timestamp)
-            },
-            body: JSON.stringify({ zkpY })
-        }).catch(() => {
-            // Échec de propagation silencieux pour ne pas perturber le thread principal
-        });
-    });
+    sendReport(zkpY, reportTimestamp);
+
+    // 2. Differential Privacy : Réponse randomisée par injection de leurres (Decoy ZKP)
+    if (dpEnabled) {
+        const decoyProbability = dpConfig.dummyRate !== undefined
+            ? dpConfig.dummyRate
+            : (1 / (1 + Math.exp(epsilon)));
+
+        if (secureRandomFloat() < decoyProbability) {
+            const ZKP_P = 115792089237316195423570985008687907853269984665640564039457584007908834671663n;
+            const decoyBytes = crypto.randomBytes(32);
+            const decoyInt = (BigInt('0x' + decoyBytes.toString('hex')) % (ZKP_P - 2n)) + 1n;
+            const decoyZkpY = decoyInt.toString(16);
+
+            const uDecoy = secureRandomFloat() - 0.5;
+            const safeUDecoy = Math.abs(uDecoy) < 1e-7 ? (uDecoy >= 0 ? 1e-7 : -1e-7) : uDecoy;
+            const b = 5000 / Math.max(0.1, epsilon);
+            const decoyNoise = Math.max(-60000, Math.min(60000, Math.round(-b * Math.sign(safeUDecoy) * Math.log(1 - 2 * Math.abs(safeUDecoy)))));
+            const decoyTimestamp = Date.now() + decoyNoise;
+
+            sendReport(decoyZkpY, decoyTimestamp);
+        }
+    }
 }
 
 const withTimeout = (promise, ms) => {
@@ -158,25 +200,15 @@ const loadBotWhitelist = (filename, fallbackEntries) => {
 };
 
 const googlebotEntries = loadBotWhitelist('googlebot.json', [
-  "2001:4860:4801:10::/64",
-  "2001:4860:4801:11::/64",
-  "2001:4860:4801:12::/64",
-  // ... [Keep fallback inline values for safety]
-  "66.249.79.64"
 ]);
 
 const bingbotEntries = loadBotWhitelist('bingbot.json', [
-  "157.55.39.0/24",
-  "207.46.13.0/24",
-  // ... [Keep fallback inline values for safety]
-  "40.77.178.0/23"
 ]);
 
 const yandexEntries = loadBotWhitelist('yandex.json', [
-  "2a02:6b8::/29",
-  "5.45.192.0/18",
-  // ... [Keep fallback inline values for safety]
-  "213.180.192.0/19"
+]);
+
+const facebookEntries = loadBotWhitelist('facebook.json', [
 ]);
 
 function generateSessionMapping() {
@@ -361,7 +393,7 @@ export function generateStatelessTicket(payload) {
  * @param {object} context - Le contexte de la requête.
  * @returns {{protocolAnomalyScore: number}}
  */
-function getProtocolAnomalyScore(context) {
+export function getProtocolAnomalyScore(context) {
     let http2Anomaly = 0.0;
     let quicAnomaly = 0.0;
 
@@ -374,9 +406,10 @@ function getProtocolAnomalyScore(context) {
         const h2Fp = context.headers?.['x-http2-fingerprint'] || context.http2Fingerprint || null;
         if (h2Fp && typeof h2Fp === 'string') {
             const parts = h2Fp.split('|');
-            if (parts.length >= 4) {
+            if (parts.length >= 3) {
                 const connWindow = parseInt(parts[1], 10);
-                const headerOrder = parts[3];
+                const streamPriority = parts[2] || '';
+                const headerOrder = parts.length > 3 ? parts[3] : '';
                 const isChromium = browser.startsWith('Chrome') || browser.startsWith('Edge');
                 const isFirefox = browser.startsWith('Firefox');
                 const isSafari = browser.startsWith('Safari');
@@ -384,11 +417,43 @@ function getProtocolAnomalyScore(context) {
                 if (isChromium) {
                     if (headerOrder && headerOrder !== 'm,a,s,p') http2Anomaly += 60.0;
                     if (connWindow === 65535 || connWindow === 65536) http2Anomaly += 40.0;
+                    if (streamPriority === '0' || streamPriority === '') http2Anomaly += 50.0;
                 } else if (isFirefox) {
                     if (headerOrder && headerOrder !== 'm,s,p,a') http2Anomaly += 60.0;
                 } else if (isSafari) {
                     if (headerOrder && headerOrder !== 'm,s,p,a') http2Anomaly += 60.0;
                 }
+
+                // Analyse fine des trames (PRIORITY, WINDOW_UPDATE, CONTINUATION)
+                if (parts.length >= 5) {
+                    const frameCountsStr = parts[4];
+                    const frameCounts = {};
+                    frameCountsStr.split(',').forEach(item => {
+                        const kv = item.split(':');
+                        if (kv.length === 2) {
+                            frameCounts[kv[0]] = parseInt(kv[1], 10);
+                        }
+                    });
+
+                    const priorityCount = frameCounts.p || 0;
+                    const windowUpdateCount = frameCounts.w || 0;
+                    const continuationCount = frameCounts.c || 0;
+
+                    if (isChromium) {
+                        // Chrome envoie des trames PRIORITY pour l'arbre de dépendances
+                        if (priorityCount === 0) http2Anomaly += 25.0;
+                        // Chrome est agressif avec les WINDOW_UPDATE
+                        if (windowUpdateCount < 2) http2Anomaly += 20.0;
+                    } else if (isFirefox) {
+                        // Firefox utilise un schéma de priorité différent, souvent avec moins de trames PRIORITY
+                        if (priorityCount > 1) http2Anomaly += 20.0;
+                    }
+
+                    // Les bots génériques n'envoient souvent pas de trames CONTINUATION pour les en-têtes longs
+                    if (continuationCount === 0 && (headerOrder.match(/,/g) || []).length > 3) {
+                        http2Anomaly += 30.0;
+                    }
+                }
             }
         }
 
@@ -490,7 +555,7 @@ function getProtocolAnomalyScore(context) {
  */
 function getRenderingAnomalyScore(context) {
   const behaviorHeader = context.headers?.['x-behavior-metrics'];
-  if (!behaviorHeader) {
+  if (!behaviorHeader || !isNaN(Number(behaviorHeader))) {
     return { renderingAnomalyScore: 0.0 };
   }
   try {
@@ -580,33 +645,45 @@ export function parseStatelessTicket(ticket) {
 }
 
 /**
- * Vérifie le limiteur de débit Token Bucket pour les demandes de challenge d'un sous-réseau.
+ * Vérifie le limiteur de débit Token Bucket pour les demandes de challenge d'un sous-réseau par domaine.
  * @param {string} clientIp - L'adresse IP du client.
+ * @param {string} [domain='default'] - Le domaine/hôte ciblé (en-tête Host).
+ * @param {object} [rateLimitConfig] - Configuration optionnelle du limiteur.
  * @returns {Promise<boolean>} True si la requête est autorisée, false si elle est limitée.
  */
-async function checkChallengeRateLimit(clientIp) {
-  const subnet = getIpSubnet(clientIp);
+async function checkChallengeRateLimit(clientIp, domain = 'default', rateLimitConfig = {}) {
+  if (rateLimitConfig && rateLimitConfig.enabled === false) {
+    return true;
+  }
+  if (!clientIp || isLoopbackIp(clientIp)) {
+    return true; // Bypass local/dev
+  }
+
+  const subnet = getIpSubnet(clientIp) || clientIp;
   if (!subnet) return false;
 
-  const key = `rate-limit:${subnet}`;
-  const rateLimitData = (await store.get(key)) || {
-    tokens: 5.0,
-    lastRefill: Date.now() / 1000
-  };
+  const host = (domain || 'default').toLowerCase().split(':')[0];
+  const key = `rate-limit:${host}:${subnet}`;
 
-  const capacity = 5.0;
-  const refillRate = 0.1; // 1 token toutes les 10 secondes
+  const capacity = Number(rateLimitConfig?.capacity ?? 30.0);
+  const refillRate = Number(rateLimitConfig?.refillRate ?? 1.0); // 1 token par seconde (au lieu de 0.1)
   const now = Date.now() / 1000;
 
-  const elapsed = now - rateLimitData.lastRefill;
+  const rateLimitData = (await store.get(key)) || {
+    tokens: capacity,
+    lastRefill: now
+  };
+
+  const elapsed = Math.max(0, now - rateLimitData.lastRefill);
   const tokens = Math.min(capacity, rateLimitData.tokens + elapsed * refillRate);
+  const ttl = Math.max(60, Math.ceil(capacity / Math.max(0.1, refillRate)));
 
   if (tokens < 1.0) {
-    await store.set(key, { tokens, lastRefill: now }, 60);
+    await store.set(key, { tokens, lastRefill: now }, ttl);
     return false;
   }
 
-  await store.set(key, { tokens: tokens - 1.0, lastRefill: now }, 60);
+  await store.set(key, { tokens: tokens - 1.0, lastRefill: now }, ttl);
   return true;
 }
 
@@ -656,20 +733,25 @@ const securityProfiles = {
             headerAnomalyScore: 0.1,
             requestPatternScore: 0.6,
             inconsistencyScore: 0.8,
-            behaviorScore: 0.7, // Poids pour les métriques comportementales (souris, clavier)
+            behaviorScore: 0.7,
             honeypotScore: 1.0,
+            botScore: 1.0,
+            cookieDroppingScore: 0.9,
             crossLayerInconsistencyScore: 0.4,
             timeInconsistencyScore: 0.9,
-            tlsSpoofingScore: 0.8, // NOUVEAU: Poids pour la détection de spoofing TLS
-            subnetScore: 0.4, // NOUVEAU: Poids pour la réputation du sous-réseau
-            ipReputationScore: 0.5, // NOUVEAU: Poids pour la réputation IP
-            botnetClusterScore: 0.6, // NOUVEAU: Poids pour le clustering botnet
-            tcpAnomalyScore: 0.8, // NEW: Anomalie de pile TCP/IP
+            tlsSpoofingScore: 0.8,
+            clientHintsInconsistencyScore: 0.7,
+            clickVarianceScore: 0.6,
+            subnetScore: 0.4,
+            ipReputationScore: 0.5,
+            botnetClusterScore: 0.6,
+            tcpAnomalyScore: 0.8,
             quicAnomalyScore: 0.8, // NOUVEAU: Poids pour l'anomalie QUIC
-            protocolAnomalyScore: 0.8, // NOUVEAU: Poids pour l'anomalie HTTP/2
             renderingAnomalyScore: 0.8, // NOUVEAU: Poids pour l'anomalie de rendu
+            http2AnomalyScore: 0.8, // NOUVEAU: Poids pour l'anomalie HTTP/2
             threatIntelScore: 1.0, // NOUVEAU: Poids pour le réseau de Threat Intelligence Fédéré
             virtualizationScore: 0.8,
+            mtuAnomalyScore: 0.9, // NOUVEAU: Poids pour l'anomalie MTU/fragmentation
         },
         thresholds: { low: 20, medium: 45, high: 75, block: 95 },
         patterns: {
@@ -703,15 +785,23 @@ const securityProfiles = {
             inconsistencyScore: 1.0,
             behaviorScore: 0.8,
             honeypotScore: 1.0,
+            botScore: 1.0,
+            cookieDroppingScore: 1.0,
             crossLayerInconsistencyScore: 0.6,
             timeInconsistencyScore: 1.0,
-            tlsSpoofingScore: 1.0, // Plus agressif pour le spoofing TLS
+            tlsSpoofingScore: 1.0,
+            clientHintsInconsistencyScore: 0.9,
+            clickVarianceScore: 0.7,
             subnetScore: 0.5,
-            ipReputationScore: 0.6, // NOUVEAU: Poids pour la réputation IP
-            botnetClusterScore: 0.8, // NOUVEAU: Poids pour le clustering botnet
-            renderingAnomalyScore: 1.0, // NOUVEAU: Poids pour l'anomalie de rendu
-            protocolAnomalyScore: 1.0, // NOUVEAU
-            threatIntelScore: 1.0, // NOUVEAU: Poids pour le réseau de Threat Intelligence Fédéré
+            ipReputationScore: 0.6,
+            botnetClusterScore: 0.8,
+            tcpAnomalyScore: 1.0,
+            quicAnomalyScore: 1.0,
+            renderingAnomalyScore: 1.0,
+            http2AnomalyScore: 1.0,
+            threatIntelScore: 1.0,
+            mtuAnomalyScore: 0.9,
+            virtualizationScore: 1.0,
         },
         thresholds: { low: 10, medium: 35, high: 65, block: 90 },
         patterns: {
@@ -746,15 +836,23 @@ const securityProfiles = {
             inconsistencyScore: 0.7,
             behaviorScore: 0.2, // Lower weight, as browser behavior is not applicable
             honeypotScore: 1.0,
+            botScore: 0.8,
+            cookieDroppingScore: 0.8,
             crossLayerInconsistencyScore: 0.5,
             timeInconsistencyScore: 0.8,
-            tlsSpoofingScore: 0.7, // Important pour les API
+            tlsSpoofingScore: 0.7,
+            clientHintsInconsistencyScore: 0.6,
+            clickVarianceScore: 0.3,
             subnetScore: 0.4,
-            ipReputationScore: 0.5, // NOUVEAU: Poids pour la réputation IP
-            botnetClusterScore: 0.7, // NOUVEAU: Poids pour le clustering botnet
-            tcpAnomalyScore: 0.8, // NEW: Anomalie de pile TCP/IP
-            protocolAnomalyScore: 0.8,
-            quicAnomalyScore: 0.8 // NOUVEAU: Poids pour l'anomalie QUIC
+            ipReputationScore: 0.5,
+            botnetClusterScore: 0.7,
+            tcpAnomalyScore: 0.8,
+            quicAnomalyScore: 0.8,
+            http2AnomalyScore: 0.8,
+            renderingAnomalyScore: 0.2,
+            threatIntelScore: 0.6,
+            virtualizationScore: 0.8,
+            mtuAnomalyScore: 0.9,
         },
         thresholds: { low: 25, medium: 50, high: 80, block: 95 },
         patterns: {
@@ -801,9 +899,11 @@ const securityProfiles = {
             ipReputationScore: 0.3, // NOUVEAU: Poids pour la réputation IP
             botnetClusterScore: 0.5, // NOUVEAU: Poids pour le clustering botnet
             tcpAnomalyScore: 0.5, // NEW: Anomalie de pile TCP/IP
-            protocolAnomalyScore: 0.5,
             quicAnomalyScore: 0.5, // NOUVEAU: Poids pour l'anomalie QUIC
+            http2AnomalyScore: 0.5,
             renderingAnomalyScore: 0.5, // NOUVEAU: Poids pour l'anomalie de rendu
+            mtuAnomalyScore: 0.9,
+            virtualizationScore: 0.8,
         },
         thresholds: { low: 25, medium: 55, high: 80, block: 95 },
         patterns: {
@@ -832,7 +932,6 @@ const securityProfiles = {
             historyScore: 0.4,
             rotationScore: 0.6,
             headerAnomalyScore: 0.2,
-            // Utilisation d'un score de pattern unifié avec un poids très élevé
             requestPatternScore: 0.9,
             inconsistencyScore: 1.0, // Crucial for preventing account takeover
             behaviorScore: 0.8, // Important for checkout/login forms
@@ -849,9 +948,11 @@ const securityProfiles = {
             ipReputationScore: 0.6, // NOUVEAU: Poids pour la réputation IP
             botnetClusterScore: 0.9, // NOUVEAU: Poids pour le clustering botnet
             tcpAnomalyScore: 0.9, // NEW: Anomalie de pile TCP/IP
-            protocolAnomalyScore: 0.9,
             quicAnomalyScore: 0.9, // NOUVEAU: Poids pour l'anomalie QUIC
-            renderingAnomalyScore: 0.9, // NOUVEAU: Poids pour l'anomalie de rendu,threatIntelScore: 1.0, // NOUVEAU: Poids pour le réseau de Threat Intelligence Fédéré
+            http2AnomalyScore: 0.9,
+            renderingAnomalyScore: 0.9,
+            mtuAnomalyScore: 0.9,
+            virtualizationScore: 0.8,
         },
         thresholds: { low: 15, medium: 40, high: 70, block: 90 },
         patterns: {
@@ -1466,88 +1567,6 @@ export const verifyTspChallenge = (
   }
 };
 
-/**
- * Generates the HTML content for a memory-intensive PoW challenge.
- */
-const generateMemoryPoWChallenge = (
-  clientIp,
-  nonce,
-  difficulty = 16,
-  path = "",
-) => {
-    const safePath = sanitizeRedirectPath(path);
-  // difficulty here is the buffer size in MB.
-  return `
-      <html>
-        <head><title>Advanced Security Check</title></head>
-        <body style="font-family:sans-serif; text-align:center; padding-top:50px;">
-          <h1>Enhanced Verification... (Level 2)</h1>
-          <p>Your activity requires an additional security check.</p>
-          <div id="loader" style="margin:20px;">⚙️ Performing memory allocation and calculation... (${difficulty} MB)</div>
-          <script>
-            async function solve() {
-              const nonce = ${safeJsonStringify(nonce)};
-                   const size = ${difficulty} * 1024 * 1024; // en octets
-              const iterations = size / 16;
-              
-              try {
-                const buffer = new Uint32Array(size / 4);
-                let h = new TextEncoder().encode(nonce).reduce((acc, v) => acc + v, 0);
-                for (let i = 0; i < buffer.length; i++) {
-                    buffer[i] = (h = Math.imul(h ^ i, 1597334677));
-                }
-                
-                let finalHash = 0;
-                for(let i = 0; i < iterations; i++) {
-                    const addr = buffer[i % buffer.length] % buffer.length;
-                    finalHash ^= buffer[addr];
-                }
-                window.location.href = "${path}" + "?pow_type=mem&pow_nonce=" + nonce + "&pow_solution=" + finalHash;
-              } catch(e) {
-                window.location.href = ${safeJsonStringify(safePath)} + "?pow_type=mem&pow_nonce=" + nonce + "&pow_solution=" + finalHash;
-                 }
-            }
-            solve();
-          </script>
-        </body>
-      </html>`;
-};
-
-/**
- * Verifies if a PoW solution is valid and generates a clearance ticket.
- */
-export const verifyPoWAndGenerateTicket = async (
-  ip,
-  nonce,
-  solution,
-  difficulty = 4,
-  deviceId = '',
-  deviceHash = ''
-) => {
-  // 1. Verify the solution: hash(ip + nonce + solution) must start with N zeros
-  const hash = crypto
-    .createHash("sha256")
-    .update(`${ip}:${nonce}:${solution}`)
-    .digest("hex");
-
-  if (!hash.startsWith("0".repeat(difficulty))) {
-    return null;
-  }
-
-  // 2. Generate a signed and encrypted stateless ticket
-  const expiry = Date.now() + 3600000; // 1 hour
-  const payload = {
-    expiry,
-    originalIp: ip,
-    deviceId,
-    deviceHash
-  };
-
-  return generateStatelessTicket(payload);
-};
-
-
-
 /**
  * Verifies a memory PoW solution.
  * 
@@ -1725,6 +1744,11 @@ export const isTicketValid = async (ip, ticket, deviceId = '', deviceHash = '',
     if (!expiry || Date.now() > expiry) {
       return false;
     }
+    if (statelessData.greenlist || (storedDeviceHash && storedDeviceHash.startsWith('webauthn:greenlist:'))) {
+        if (!deviceId || deviceId === storedDeviceId) {
+            return true;
+        }
+    }
     if (storedDeviceHash && storedDeviceHash.startsWith('zkp:')) {
         const expectedY = storedDeviceHash.split(':')[1];
         if (zkpProof) {
@@ -1752,6 +1776,11 @@ export const isTicketValid = async (ip, ticket, deviceId = '', deviceHash = '',
       await store.delete(`ticket:${ticket}`);
       return false;
     }
+    if (ticketData.greenlist || (storedDeviceHash && storedDeviceHash.startsWith('webauthn:greenlist:'))) {
+        if (!deviceId || deviceId === storedDeviceId) {
+            return true;
+        }
+    }
     if (storedDeviceHash && storedDeviceHash.startsWith('zkp:')) {
         const expectedY = storedDeviceHash.split(':')[1];
         if (zkpProof) {
@@ -2335,13 +2364,37 @@ function analyzeTouchMovements(history) {
  * @returns {{behaviorScore: number}}
  */
 function getBehaviorScore(context) {
-  const behaviorHeader = context.headers["x-behavior-metrics"];
-  if (!behaviorHeader) {
+  const behaviorHeader = context.headers ? (context.headers["x-behavior-metrics"] ?? context.headers["X-Behavior-Metrics"]) : undefined;
+  if (behaviorHeader === undefined || behaviorHeader === null || behaviorHeader === '') {
     return { behaviorScore: 0 }; // Pas de données, pas de pénalité.
   }
 
+  // Traitement direct si un flag binaire client-side (1 = humain, 0 = bot) est envoyé
+  if (behaviorHeader === 1 || behaviorHeader === '1') {
+    return { behaviorScore: 0 };
+  }
+  if (behaviorHeader === 0 || behaviorHeader === '0') {
+    return { behaviorScore: 100 };
+  }
+
+  // Traitement direct si un score numérique est envoyé côté client
+  if (typeof behaviorHeader === 'number') {
+    return { behaviorScore: Math.max(0, Math.min(100, behaviorHeader)) };
+  }
+  if (typeof behaviorHeader === 'string' && !isNaN(Number(behaviorHeader)) && behaviorHeader.trim() !== '') {
+    const trimmed = behaviorHeader.trim();
+    if (trimmed === '1') return { behaviorScore: 0 };
+    if (trimmed === '0') return { behaviorScore: 100 };
+    return { behaviorScore: Math.max(0, Math.min(100, parseFloat(trimmed))) };
+  }
+
   try {
     const metrics = JSON.parse(behaviorHeader);
+    if (metrics === 1) return { behaviorScore: 0 };
+    if (metrics === 0) return { behaviorScore: 100 };
+    if (typeof metrics === 'number') {
+      return { behaviorScore: Math.max(0, Math.min(100, metrics)) };
+    }
     let score = 0;
 
     // 1. Pénalité maximale si un honeypot client a été déclenché.
@@ -2355,9 +2408,18 @@ function getBehaviorScore(context) {
     const { avgSpeed, avgAcceleration, straightness, pauses, segments } = analyzeMouseMovements(metrics.mouseMovementsHistory);
     const touchAnalysis = analyzeTouchMovements(metrics.touchMovementsHistory);
 
-    // Pénalité pour absence totale d'interaction (pas de mouvements, pas de frappes).
+    // Pénalité pour absence totale d'interaction. Un utilisateur légitime peut simplement lire la page.
+    // On applique donc une pénalité de base faible, qui est amplifiée uniquement si d'autres
+    // signaux passifs de bot (ex: rendu offscreen) sont présents.
     if (avgSpeed === 0 && touchAnalysis.avgSpeed === 0 && metrics.keystrokeLatency === 0) {
-      score += 40;
+      let noInteractionPenalty = 5; // Pénalité de base très faible.
+
+      // Amplification si d'autres signaux passifs de bot sont présents.
+      if (metrics.rendering?.offscreenAnom) {
+        noInteractionPenalty += 40;
+      }
+      
+      score += noInteractionPenalty;
     }
 
     // 3. (NOUVEAU) Analyse de la longueur de l'historique de navigation.
@@ -2397,21 +2459,19 @@ function getBehaviorScore(context) {
             if (touch.avgRadius > 0 && touch.radiusVariance === 0) {
                 score += 30; // Spoofed pointer area size
             }
-        }
-        if (touch.segments.length > 10) {
-            const benfordDev = Optimization.Operators.benfordTest(touch.segments);
-            if (benfordDev > 0.18) score += 35;
-        }
-
-        // Détection de ferme mobile : Touch actif sur mobile sans aucune vibration physique (châssis/rack ADB)
-        const isMobileDevice = (context.headers['user-agent'] || '').includes('Mobile');
-        if (isMobileDevice && touchHistory.length >= 5 && typeof metrics.motionVariance === 'number') {
-            if (metrics.motionVariance === 0) {
-                score += 50; // Terminal fixé sur un châssis mécanique (rack ADB)
+            if (touch.segments.length > 10) {
+                const benfordDev = Optimization.Operators.benfordTest(touch.segments);
+                if (benfordDev > 0.18) score += 35;
             }
         }
     }
 
+    // Détection de ferme mobile : un appareil mobile parfaitement immobile est suspect, indépendamment des interactions tactiles.
+    const isMobileDevice = (context.headers['user-agent'] || '').includes('Mobile');
+    if (isMobileDevice && typeof metrics.motionVariance === 'number' && metrics.motionVariance === 0) {
+        score += 50; // Terminal fixé sur un châssis mécanique (rack ADB)
+    }
+
     // Plausibilité de la latence de frappe
     if (metrics.keystrokeLatency > 0 && metrics.keystrokeLatency < 40) score += 25; // Frappe trop rapide pour un humain.
     if (metrics.keystrokeLatency > 1000) score += 15; // Latence très élevée, peut être un script lent.
@@ -2981,6 +3041,10 @@ function analyzeClickPositions(history) {
  * @returns {{clickVarianceScore: number}}
  */
 function getClickVarianceScore(context) {
+    const rawMetrics = context.headers?.['x-behavior-metrics'];
+    if (!rawMetrics || !isNaN(Number(rawMetrics))) {
+        return { clickVarianceScore: 0 };
+    }
     const metrics = JSON.parse(context.headers['x-behavior-metrics'] || '{}');
     const score = analyzeClickPositions(metrics.clicksHistory);
     return { clickVarianceScore: score };
@@ -3832,7 +3896,7 @@ async function getBehavioralIndicators(context, deviceData) {
   // --- VALIDATION DE L'ANCRAGE MATÉRIEL WEBAUTHN ---
   const behaviorHeader = context.headers?.['x-behavior-metrics'];
   let webauthnVerified = false;
-  if (behaviorHeader) {
+  if (behaviorHeader && typeof behaviorHeader === 'string' && behaviorHeader.startsWith('{')) {
       try {
           const metrics = JSON.parse(behaviorHeader);
           if (metrics && metrics.webauthnAnchor) {
@@ -3908,6 +3972,52 @@ function getVirtualizationAnomalyScore(context) {
     return Math.min(100.0, score);
 }
 
+/**
+ * @private
+ * Analyzes TCP MTU and fragmentation flags to detect network tunnels (VPN/Proxy).
+ * @param {object} context - The request context.
+ * @returns {{mtuAnomalyScore: number}}
+ */
+function getMtuAnomalyScore(context) {
+    const mtuHeader = context.headers?.['x-tcp-mtu-info'];
+    if (!mtuHeader || typeof mtuHeader !== 'string') {
+        return { mtuAnomalyScore: 0.0 };
+    }
+
+    const parts = mtuHeader.split(':');
+    if (parts.length < 2) {
+        return { mtuAnomalyScore: 0.0 };
+    }
+
+    const mtu = parseInt(parts[0], 10);
+    const df = parseInt(parts[1], 10); // Don't Fragment bit (1 or 0)
+
+    if (isNaN(mtu) || isNaN(df)) {
+        return { mtuAnomalyScore: 0.0 };
+    }
+
+    let score = 0.0;
+
+    // Pénalité modérée pour les MTU typiques des VPNs/tunnels.
+    if (mtu > 1200 && mtu <= 1420) {
+        score += 35.0;
+    } else if (mtu > 1420 && mtu < 1492) {
+        score += 20.0;
+    }
+
+    const ua = context.headers?.['user-agent'] || '';
+    const uaParts = parseUserAgent(ua);
+    const os = uaParts.os;
+
+    // Pénalités additionnelles en cas d'incohérence OS vs signature réseau.
+    if (os) {
+        if (os.startsWith('Windows') && mtu < 1492) score += 20.0;
+        if ((os.startsWith('Android') || os.startsWith('iOS')) && mtu < 1480) score += 15.0;
+        if (df === 0 && (os.startsWith('Windows') || os.startsWith('Mac') || os.startsWith('Linux'))) score += 40.0;
+    }
+
+    return { mtuAnomalyScore: Math.min(100.0, score) };
+}
 
 /**
  * Returns a vector of raw (unweighted) suspicion scores.
@@ -3976,7 +4086,12 @@ export const getSuspicionVector = async (context, securityConfig) => {
       const { botScore } = getBotScore(context);
 
       // NOUVEAU: On calcule le score d'incohérence temporelle.
-      const { timeInconsistencyScore } = getTimeInconsistencyScore(context, JSON.parse(context.headers['x-behavior-metrics'] || '{}'), deviceData);
+      let parsedBehaviorMetrics = {};
+      const rawBehaviorHeader = context.headers?.['x-behavior-metrics'];
+      if (rawBehaviorHeader && typeof rawBehaviorHeader === 'string' && rawBehaviorHeader.startsWith('{')) {
+          try { parsedBehaviorMetrics = JSON.parse(rawBehaviorHeader); } catch (e) {}
+      }
+      const { timeInconsistencyScore } = getTimeInconsistencyScore(context, parsedBehaviorMetrics, deviceData);
 
       // NOUVEAU: On calcule le score d'incohérence entre les couches.
       const { crossLayerInconsistencyScore } = getCrossLayerInconsistency(context);
@@ -3990,9 +4105,10 @@ export const getSuspicionVector = async (context, securityConfig) => {
       const { requestPatternScore } = getRequestPatternScore(context, deviceData, securityConfig.patterns);
 
   const { tcpAnomalyScore } = getTcpAnomalyScore(context);
-    const { protocolAnomalyScore } = getProtocolAnomalyScore(context);
+    const { protocolAnomalyScore, http2AnomalyScore, quicAnomalyScore } = getProtocolAnomalyScore(context);
     const { renderingAnomalyScore } = getRenderingAnomalyScore(context);
     const virtualizationScore = getVirtualizationAnomalyScore(context);
+    const { mtuAnomalyScore } = getMtuAnomalyScore(context);
 
   // Save the updated device state to the store
   // Note: deviceData.ips is a Set, which may not serialize correctly in all stores (e.g., JSON). A Redis store should handle this via custom serialization or by converting to an array.
@@ -4003,8 +4119,8 @@ export const getSuspicionVector = async (context, securityConfig) => {
   if (Array.isArray(deviceData.ips)) {
       deviceData.ips = new Set(deviceData.ips);
   }
-  // Le vecteur de suspicion est maintenant complet.
-  return { ...behavioral, headerAnomalyScore, inconsistencyScore, behaviorScore, honeypotScore, botScore, requestPatternScore, crossLayerInconsistencyScore, timeInconsistencyScore, tlsSpoofingScore, clickVarianceScore, clientHintsInconsistencyScore, subnetScore, ipReputationScore, botnetClusterScore, tcpAnomalyScore, protocolAnomalyScore, renderingAnomalyScore, threatIntelScore, virtualizationScore };
+    // Le vecteur de suspicion est maintenant complet.
+    return { ...behavioral, headerAnomalyScore, inconsistencyScore, behaviorScore, honeypotScore, botScore, requestPatternScore, crossLayerInconsistencyScore, timeInconsistencyScore, tlsSpoofingScore, clickVarianceScore, clientHintsInconsistencyScore, subnetScore, ipReputationScore, botnetClusterScore, tcpAnomalyScore, protocolAnomalyScore, http2AnomalyScore, quicAnomalyScore, renderingAnomalyScore, threatIntelScore, virtualizationScore, mtuAnomalyScore };
 };
 
 // A residential user can change networks (home, 4G, public wifi).
@@ -4027,7 +4143,31 @@ export const identifyRequest = (securityConfig) => async (req, res) => {
   // This function now acts as a lightweight wrapper around the engine's identifyRequest method.
   // It requires a default configuration to work.
   const config = securityConfig || {
-    weights: { historyScore: 0.3, rotationScore: 0.5, headerAnomalyScore: 0.1, inconsistencyScore: 0.8, honeypotScore: 1.0 },
+    weights: {
+      historyScore: 0.3,
+      rotationScore: 0.5,
+      headerAnomalyScore: 0.2,
+      requestPatternScore: 0.6,
+      inconsistencyScore: 0.8,
+      behaviorScore: 0.7,
+      honeypotScore: 1.0,
+      botScore: 1.0,
+      cookieDroppingScore: 0.9,
+      crossLayerInconsistencyScore: 0.4,
+      timeInconsistencyScore: 0.9,
+      tlsSpoofingScore: 0.8,
+      clientHintsInconsistencyScore: 0.7,
+      clickVarianceScore: 0.6,
+      subnetScore: 0.4,
+      ipReputationScore: 0.5,
+      botnetClusterScore: 0.7,
+      tcpAnomalyScore: 0.8,
+      quicAnomalyScore: 0.8,
+      renderingAnomalyScore: 0.8,
+      http2AnomalyScore: 0.8,
+      threatIntelScore: 1.0,
+      virtualizationScore: 0.8
+    },
     thresholds: { low: 20, medium: 40, high: 75 },
     honeypot: { fields: [] } // Ensure honeypot config exists to prevent errors
   };
@@ -4199,6 +4339,24 @@ function generateCpuTargetChallengePage(challengeDetails, clientIp) {
       </body></html>`;
 }
 
+/**
+ * Generates closed-shadow DOM honeypot markup for server-rendered challenge pages.
+ * Utilizes Declarative Shadow DOM with mode="closed" to prevent screen reader false positives
+ * while capturing bot web scrapers and crawlers.
+ * @param {string[]} trapUrls
+ * @returns {string}
+ */
+function generateClosedShadowTraps(trapUrls = []) {
+  const list = Array.isArray(trapUrls) ? trapUrls : [];
+  if (list.length === 0) return '';
+
+  const trapLinksHtml = list.map((url, idx) => {
+    return `<a href="${url}" rel="nofollow" tabindex="-1"><span>&gt; ${idx + 1}</span></a>`;
+  }).join(' ');
+
+  return `<div style="position:absolute;left:-9999px;top:-9999px;width:0;height:0;overflow:hidden;visibility:hidden;pointer-events:none;" aria-hidden="true"><template shadowrootmode="closed" shadowroot="closed"><style>:host { position: absolute; left: -9999px; top: -9999px; width: 0; height: 0; overflow: hidden; visibility: hidden; pointer-events: none; } a { color: transparent; text-decoration: none; }</style>${trapLinksHtml}</template></div>`;
+}
+
 /**
  * Generates the HTML content for a combined CPU + Memory PoW challenge.
  * @param {object} cpuChallengeDetails - Details from generateCpuTargetChallenge.
@@ -4215,6 +4373,7 @@ function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty,
     const fingerprint = originalFingerprint;
     const baseBlock = createCpuChallengeBaseBlock(nonce, clientSecret, fingerprint, clientIp, tlsSessionId);
     const baseBlockBytes = `[${baseBlock.toString('utf8').split('').map(c => c.charCodeAt(0)).join(',')}]`;
+    const trapContainerHtml = generateClosedShadowTraps(trapUrls);
 
     // Prépare la configuration pour l'initialisation du client, y compris les URL pièges.
     const clientInitConfig = {
@@ -4282,12 +4441,24 @@ function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty,
     }
 
     if (!htmlTemplate) {
-        htmlTemplate = `<html><head><title>Advanced Security Check</title></head><body style="font-family:sans-serif; text-align:center; padding-top:50px;"><h1>Enhanced Verification... (Level 2)</h1><p>Your activity requires an additional security check. This may take a few moments.</p><div id="loader" style="margin:20px;">⚙️ Initializing combined verification...</div><script><!-- FINGERPRINT_SOLVER_SCRIPT --></script><script><!-- FINGERPRINT_CHALLENGE_SCRIPT --></script></body></html>`; // eslint-disable-line max-len
+        htmlTemplate = `<html><head><title>Advanced Security Check</title></head><body style="font-family:sans-serif; text-align:center; padding-top:50px;"><h1>Enhanced Verification... (Level 2)</h1><p>Your activity requires an additional security check. This may take a few moments.</p><div id="loader" style="margin:20px;">⚙️ Initializing combined verification...</div><script><!-- FINGERPRINT_SOLVER_SCRIPT --></script><script><!-- FINGERPRINT_CHALLENGE_SCRIPT --></script><!-- FINGERPRINT_TRAPS --></body></html>`; // eslint-disable-line max-len
     }
 
-    return htmlTemplate
+    let renderedHtml = htmlTemplate
         .replace('<!-- FINGERPRINT_SOLVER_SCRIPT -->', solverCode)
         .replace('<!-- FINGERPRINT_CHALLENGE_SCRIPT -->', challengeScript);
+
+    if (renderedHtml.includes('<!-- FINGERPRINT_TRAPS -->')) {
+        renderedHtml = renderedHtml.replace('<!-- FINGERPRINT_TRAPS -->', trapContainerHtml);
+    } else if (trapContainerHtml) {
+        if (renderedHtml.includes('</body>')) {
+            renderedHtml = renderedHtml.replace('</body>', `${trapContainerHtml}</body>`);
+        } else {
+            renderedHtml += trapContainerHtml;
+        }
+    }
+
+    return renderedHtml;
 }
 
 /**
@@ -4415,7 +4586,7 @@ async function getThreatIntelScore(context, zkpY, threatIntelConfig = {}) {
     const tcpRtt = tcpRttHeader ? parseInt(tcpRttHeader, 10) : null;
 
     const behaviorHeader = context.headers?.['x-behavior-metrics'];
-    if (behaviorHeader) {
+    if (behaviorHeader && typeof behaviorHeader === 'string' && behaviorHeader.startsWith('{')) {
         try {
             const metrics = JSON.parse(behaviorHeader);
             if (metrics && typeof metrics.clientTimestamp === 'number' && typeof context.requestTimestamp === 'number') {
@@ -4577,7 +4748,9 @@ export class FingerprintEngine {
       'wasm',
       'similarityThreshold', 'reset',
       'ed25519_private_key', 'ed25519_public_key', 'upowModel',
-      'federatedPeers', 'federationSecret', 'filterWhitelist'
+      'federatedPeers', 'federationSecret', 'filterWhitelist',
+      'challengeRateLimit',
+      'differentialPrivacy', 'dpEpsilon'
     ]);
 
     // 1. Check for essential keys
@@ -4615,36 +4788,31 @@ export class FingerprintEngine {
     }
   }
     calculateFinalScore(suspicionVector) {
-        const { weights } = this.securityConfig;
-        if (!weights) return 0;
-
-        const score =
-            (suspicionVector.historyScore || 0) * (weights.historyScore || 0) +
-            (suspicionVector.rotationScore || 0) * (weights.rotationScore || 0) +
-            (suspicionVector.headerAnomalyScore || 0) * (weights.headerAnomalyScore || 0) +
-            (suspicionVector.requestPatternScore || 0) * (weights.requestPatternScore || 0) +
-            (suspicionVector.inconsistencyScore || 0) * (weights.inconsistencyScore || 0) +
-            (suspicionVector.honeypotScore || 0) * (weights.honeypotScore || 0) +
-            (suspicionVector.behaviorScore || 0) * (weights.behaviorScore || 0) +
-            (suspicionVector.botScore || 0) * (weights.botScore || 0) + // Ajout du nouveau score
-            (suspicionVector.crossLayerInconsistencyScore || 0) * (weights.crossLayerInconsistencyScore || 0) +
-            (suspicionVector.botnetClusterScore || 0) * (weights.botnetClusterScore || 0) +
-            (suspicionVector.tlsSpoofingScore || 0) * (weights.tlsSpoofingScore || 0) + // NOUVEAU: TLS Spoofing
-            (suspicionVector.timeInconsistencyScore || 0) * (weights.timeInconsistencyScore || 0) +
-            (suspicionVector.clickVarianceScore || 0) * (weights.clickVarianceScore || 0) +
-            (suspicionVector.clientHintsInconsistencyScore || 0) * (weights.clientHintsInconsistencyScore || 0) +
-            (suspicionVector.subnetScore || 0) * (weights.subnetScore || 0) +
-            (suspicionVector.ipReputationScore || 0) * (weights.ipReputationScore || 0) +
-            (suspicionVector.tcpAnomalyScore || 0) * (weights.tcpAnomalyScore || 0) +
-            (suspicionVector.quicAnomalyScore || 0) * (weights.quicAnomalyScore || 0) + // NOUVEAU: QUIC Anomaly
-            (suspicionVector.http2AnomalyScore || 0) * (weights.http2AnomalyScore || 0) + // NOUVEAU: HTTP/2 Anomaly
-            (suspicionVector.protocolAnomalyScore || 0) * (weights.protocolAnomalyScore || 0) +
-            (suspicionVector.cookieDroppingScore || 0) * (weights.cookieDroppingScore || 0) +
-            (suspicionVector.virtualizationScore || 0) * (weights.virtualizationScore || 0) +
-            (suspicionVector.threatIntelScore || 0) * (weights.threatIntelScore || 0) + // NOUVEAU: QUIC Anomaly
-            (suspicionVector.renderingAnomalyScore || 0) * (weights.renderingAnomalyScore || 0); // NOUVEAU: Rendering Anomaly
-
-        return Math.min(100, score);
+        const baseWeights = this.securityConfig.weights;
+        if (!baseWeights) return 0;
+
+        const dynamicWeights = { ...baseWeights };
+        if ((suspicionVector.mtuAnomalyScore || 0) > 50.0) {
+            this._log('Tunnel detected, amplifying suspicion weights.', { mtuScore: suspicionVector.mtuAnomalyScore });
+
+            // Augmente le poids des incohérences de bas niveau (difficiles à falsifier)
+            dynamicWeights.tlsSpoofingScore = (baseWeights.tlsSpoofingScore || 0.8) * 1.25;
+            dynamicWeights.crossLayerInconsistencyScore = (baseWeights.crossLayerInconsistencyScore || 0.4) * 1.4;
+            dynamicWeights.clientHintsInconsistencyScore = (baseWeights.clientHintsInconsistencyScore || 0.7) * 1.2;
+
+            // Augmente le poids des anomalies comportementales (un bot derrière un VPN est plus suspect)
+            dynamicWeights.behaviorScore = (baseWeights.behaviorScore || 0.7) * 1.15;
+            dynamicWeights.requestPatternScore = (baseWeights.requestPatternScore || 0.6) * 1.2;
+        }
+
+        let score = 0;
+        for (const key in dynamicWeights) {
+            const metricScore = suspicionVector[key] || 0.0;
+            if (metricScore > 0) {
+                score += metricScore * dynamicWeights[key];
+            }
+        }
+        return Math.min(100.0, score);
     }
 
 
@@ -4965,9 +5133,84 @@ export class FingerprintEngine {
     
     // Bypass instantané si l'appareil a prouvé cryptographiquement son identité matérielle (Secure Enclave / TPM)
     const { deviceId, deviceData, newCookie } = await resolveRequestIdentity(requestContext, this.securityConfig);
+
+    // Règle Anti-Ferme : Même avec du matériel sécurisé, un appareil condamné ou menant une attaque certaine est révoqué et bloqué
+    if (deviceData?.condemned || this._hasCertainAttack(requestContext)) {
+        if (deviceData) {
+            deviceData.condemned = true;
+            deviceData.webauthnVerified = false;
+            await store.set(`device:${deviceId}`, deviceData);
+        }
+        this._log('Condemned device or attack detected - revoking hardware trust and blocking', { deviceId });
+        const decision = { action: 'block', status: 404, body: 'Forbidden', score: 100, vector: { honeypotScore: 100 } };
+        if (this.dryRun) {
+            this._log(`[Dry Run] Intended action: ${decision.action}`, { score: decision.score });
+            decision.intendedAction = decision.action;
+            decision.action = 'next';
+            delete decision.status;
+            delete decision.body;
+            if (requestContext._newCookies) {
+                const deviceCookie = requestContext._newCookies.find(c => c.name === 'device_id');
+                if (deviceCookie) decision.newCookieForResponse = deviceCookie;
+            }
+        }
+        return decision;
+    }
+
+    // Validation immédiate de l'attestation matérielle WebAuthn si présente dans la requête
+    const behaviorHeader = requestContext.headers?.['x-behavior-metrics'];
+    if (behaviorHeader && typeof behaviorHeader === 'string' && behaviorHeader.startsWith('{')) {
+        try {
+            const parsedMetrics = JSON.parse(behaviorHeader);
+            if (parsedMetrics && parsedMetrics.webauthnAnchor && deviceData) {
+                if (verifyWebAuthnHardwareAnchor(parsedMetrics.webauthnAnchor, deviceData)) {
+                    deviceData.webauthnVerified = true;
+                    await store.set(`device:${deviceId}`, deviceData);
+                }
+            }
+        } catch (e) {}
+    }
+
     if (deviceData && deviceData.webauthnVerified) {
         this._log('Hardware-anchored device verified (WebAuthn) - full bypass granted', { deviceId });
-        return { action: 'next', score: 0, vector: { webauthn_verified: 100 } };
+        const greenlistTtl = 365 * 86400 * 1000; // 1 an (permanent)
+        const greenlistTicket = generateStatelessTicket({
+            expiry: Date.now() + greenlistTtl,
+            originalIp: clientIp,
+            deviceId,
+            deviceHash: 'webauthn:greenlist:' + (deviceData.webauthnCredentialId || deviceId),
+            greenlist: true
+        });
+        const isHttps = requestContext.headers?.['x-forwarded-proto'] === 'https' || 
+                        requestContext.rawReq?.secure || 
+                        requestContext.rawReq?.protocol === 'https' ||
+                        requestContext.rawReq?.connection?.encrypted;
+        const secureOption = isHttps || this.isProduction;
+
+        const decision = {
+            action: 'next',
+            score: 0,
+            vector: { webauthn_verified: 100 },
+            cookie: {
+                name: 'pow_clearance',
+                value: greenlistTicket,
+                options: {
+                    httpOnly: true,
+                    secure: secureOption,
+                    sameSite: 'strict',
+                    ...(secureOption && { partitioned: true }),
+                    maxAge: greenlistTtl,
+                    path: '/'
+                }
+            }
+        };
+        if (requestContext._newCookies) {
+            const deviceCookie = requestContext._newCookies.find(c => c.name === 'device_id');
+            if (deviceCookie) {
+                decision.newCookieForResponse = deviceCookie;
+            }
+        }
+        return decision;
     }
 
     if (isStatic) {
@@ -5010,7 +5253,7 @@ export class FingerprintEngine {
       if (filterWhitelist === true) {
         bypassWhitelist = this._hasCertainAttack(requestContext);
       } else if (typeof filterWhitelist === 'number') {
-        const res = await getScoreAndVector();
+          const res = await getScoreAndVector();
         if (res.score > filterWhitelist) {
           bypassWhitelist = true;
         }
@@ -5589,10 +5832,11 @@ export class FingerprintEngine {
             this._log('High suspicion score detected - overriding valid ticket to re-issue challenge', { finalScore, deviceId });
         }
 
-        // --- AJOUT : Limiteur de débit (Token Bucket) ---
-        const rateLimitPassed = await checkChallengeRateLimit(clientIp);
+        // --- Limiteur de débit par domaine et sous-réseau (Token Bucket) ---
+        const domain = requestContext.headers?.host || 'default';
+        const rateLimitPassed = await checkChallengeRateLimit(clientIp, domain, this.securityConfig?.challengeRateLimit);
         if (!rateLimitPassed) {
-            this._log('Challenge rate limit exceeded - blocking with 429', { clientIp });
+            this._log('Challenge rate limit exceeded - blocking with 429', { clientIp, domain });
             const decision = {
                 action: 'block',
                 status: 429,
@@ -6599,6 +6843,7 @@ export const default_whitelist = () => [
     googlebot_whitelist(),
     bingbot_whitelist(),
     yandex_whitelist(),
+    facebook_whitelist(),
     // === Moteurs de recherche majeurs ===
     { userAgent: 'Googlebot', hostnameSuffix: '.googlebot.com' },
     { userAgent: 'Google-Extended', hostnameSuffix: '.google.com' },
@@ -6716,6 +6961,11 @@ export const bingbot_whitelist = () => ({
     entries: bingbotEntries
 });
 
+export const facebook_whitelist = () => ({
+    type: 'allowlist',
+    entries: facebookEntries
+});
+
 
 /**
  * Extracts the TLS Session ID or ticket hash from the request context.
@@ -6949,6 +7199,9 @@ export const powMiddleware = (securityConfig) => {
 
       case 'next':
       default:
+        if (decision.cookie && res && typeof res.cookie === 'function') {
+          res.cookie(decision.cookie.name, decision.cookie.value, decision.cookie.options);
+        }
         return next();
     }
   };
@@ -6962,8 +7215,10 @@ export const powMiddleware = (securityConfig) => {
  */
 export const __internal = {
     get store() { return store; }, // Export the store for testing
+    checkChallengeRateLimit,
     getDeviceHash,
     getCompositeDeviceHash,
+    generateClosedShadowTraps,
     getSuspicionVector,
     getTlsSessionId,
     pruneTrafficData,