@anonympins/fingerprint 0.7.4 → 0.8.0

package/src/js/fingerprint.js

@@ -13,6 +13,9 @@ import {GpuPowSolver} from "./gpu_pow.solver.js";
 import {
     verifyZkpProof,
     sanitizeRedirectPath,
+    extractPrivateAccessTokens,
+    parsePrivateAccessToken,
+    verifyPatSignature,
     decodePolymorphicFingerprint,
     deepMerge,
     getHeaderSignature,
@@ -23,7 +26,8 @@ import {
     isLoopbackIp,
     isPrivateIp,
     parseUserAgent,
-    safeJsonStringify
+    safeJsonStringify,
+    generateIssuerPemKeys
 } from "./fingerprint.utils.js";
 
 
@@ -68,7 +72,8 @@ function canAttemptDns() {
 }
 
 /**
- * Diffuse un ZKP banni aux pairs fédérés de manière asynchrone (non-bloquante).
+ * Diffuse un ZKP banni aux pairs fédérés de manière asynchrone (non-bloquante)
+ * avec protection par Anonymat Différentiel (Differential Privacy / Bruit de Laplace & Leurres).
  * @private
  * @param {string} zkpY - La clé publique ZKP du terminal banni.
  * @param {object} config - La configuration de sécurité.
@@ -77,46 +82,87 @@ async function broadcastBannedZkp(zkpY, config) {
     const peers = config.federatedPeers || [];
     if (peers.length === 0) return;
 
-    const timestamp = Date.now();
-    const msg = `${timestamp}:${zkpY}`;
-    
-    let signature = '';
-    let isAsymmetric = false;
+    const dpConfig = config.differentialPrivacy || {};
+    const dpEnabled = dpConfig.enabled !== false;
+    const epsilon = typeof dpConfig.epsilon === 'number' ? dpConfig.epsilon : (config.dpEpsilon || 1.0);
 
-    if (process.env.ED25519_PRIVATE_KEY) {
-        try {
-            const cleanKey = process.env.ED25519_PRIVATE_KEY.replace(/\\n/g, '\n');
-            const signBuffer = crypto.sign(null, Buffer.from(msg), {
-                key: cleanKey,
-                format: 'pem',
-                type: 'pkcs8'
-            });
-            signature = signBuffer.toString('hex');
-            isAsymmetric = true;
-        } catch (e) {
-            console.error('[Fingerprint] Asymmetric broadcast signing failed, falling back to HMAC:', e.message);
+    const sendReport = (targetZkpY, ts) => {
+        const msg = `${ts}:${targetZkpY}`;
+        let signature = '';
+        let isAsymmetric = false;
+
+        if (process.env.ED25519_PRIVATE_KEY) {
+            try {
+                const cleanKey = process.env.ED25519_PRIVATE_KEY.replace(/\\n/g, '\n');
+                const signBuffer = crypto.sign(null, Buffer.from(msg), {
+                    key: cleanKey,
+                    format: 'pem',
+                    type: 'pkcs8'
+                });
+                signature = signBuffer.toString('hex');
+                isAsymmetric = true;
+            } catch (e) {
+                console.error('[Fingerprint] Asymmetric broadcast signing failed, falling back to HMAC:', e.message);
+            }
         }
-    }
 
-    if (!isAsymmetric) {
-        const secret = config.federationSecret || getPowSecret();
-        signature = crypto.createHmac('sha256', secret).update(msg).digest('hex');
+        if (!isAsymmetric) {
+            const secret = config.federationSecret || getPowSecret();
+            signature = crypto.createHmac('sha256', secret).update(msg).digest('hex');
+        }
+
+        peers.forEach(peerUrl => {
+            fetch(peerUrl + '?coop_op=share_threat_intel', {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'X-Federation-Signature': isAsymmetric ? '' : signature,
+                    'X-Federation-Signature-Ed25519': isAsymmetric ? signature : '',
+                    'X-Federation-Timestamp': String(ts)
+                },
+                body: JSON.stringify({ zkpY: targetZkpY })
+            }).catch(() => {
+                // Échec de propagation silencieux pour ne pas perturber le thread principal
+            });
+        });
+    };
+
+    let reportTimestamp = Date.now();
+
+    // 1. Differential Privacy : Perturbation laplacienne de l'horodatage
+    if (dpEnabled) {
+        const deltaT = 5000; // Sensibilité de 5s
+        const b = deltaT / Math.max(0.1, epsilon);
+        const u = secureRandomFloat() - 0.5;
+        const safeU = Math.abs(u) < 1e-7 ? (u >= 0 ? 1e-7 : -1e-7) : u;
+        const laplaceNoise = -b * Math.sign(safeU) * Math.log(1 - 2 * Math.abs(safeU));
+        const clampedNoise = Math.max(-60000, Math.min(60000, Math.round(laplaceNoise)));
+        reportTimestamp = Date.now() + clampedNoise;
     }
 
-    peers.forEach(peerUrl => {
-        fetch(peerUrl + '?coop_op=share_threat_intel', {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                'X-Federation-Signature': isAsymmetric ? '' : signature,
-                'X-Federation-Signature-Ed25519': isAsymmetric ? signature : '',
-                'X-Federation-Timestamp': String(timestamp)
-            },
-            body: JSON.stringify({ zkpY })
-        }).catch(() => {
-            // Échec de propagation silencieux pour ne pas perturber le thread principal
-        });
-    });
+    sendReport(zkpY, reportTimestamp);
+
+    // 2. Differential Privacy : Réponse randomisée par injection de leurres (Decoy ZKP)
+    if (dpEnabled) {
+        const decoyProbability = dpConfig.dummyRate !== undefined
+            ? dpConfig.dummyRate
+            : (1 / (1 + Math.exp(epsilon)));
+
+        if (secureRandomFloat() < decoyProbability) {
+            const ZKP_P = 115792089237316195423570985008687907853269984665640564039457584007908834671663n;
+            const decoyBytes = crypto.randomBytes(32);
+            const decoyInt = (BigInt('0x' + decoyBytes.toString('hex')) % (ZKP_P - 2n)) + 1n;
+            const decoyZkpY = decoyInt.toString(16);
+
+            const uDecoy = secureRandomFloat() - 0.5;
+            const safeUDecoy = Math.abs(uDecoy) < 1e-7 ? (uDecoy >= 0 ? 1e-7 : -1e-7) : uDecoy;
+            const b = 5000 / Math.max(0.1, epsilon);
+            const decoyNoise = Math.max(-60000, Math.min(60000, Math.round(-b * Math.sign(safeUDecoy) * Math.log(1 - 2 * Math.abs(safeUDecoy)))));
+            const decoyTimestamp = Date.now() + decoyNoise;
+
+            sendReport(decoyZkpY, decoyTimestamp);
+        }
+    }
 }
 
 const withTimeout = (promise, ms) => {
@@ -166,6 +212,9 @@ const bingbotEntries = loadBotWhitelist('bingbot.json', [
 const yandexEntries = loadBotWhitelist('yandex.json', [
 ]);
 
+const facebookEntries = loadBotWhitelist('facebook.json', [
+]);
+
 function generateSessionMapping() {
     const randomStr = (len = 6) => Array.from({ length: len }, () => String.fromCharCode(crypto.randomInt(97, 123))).join('');
     const randomHeader = () => `X-Sess-${crypto.randomBytes(4).toString('hex')}`;
@@ -355,6 +404,12 @@ export function getProtocolAnomalyScore(context) {
     const ua = context.headers?.['user-agent'] || '';
     const uaParts = parseUserAgent(ua);
     const browser = uaParts.browser;
+    const isChromium = browser?.startsWith('Chrome') || browser?.startsWith('Edge');
+    const isFirefox = browser?.startsWith('Firefox');
+    const isSafari = browser?.startsWith('Safari');
+    const isHumanBrowser = ['Chrome', 'Firefox', 'Safari', 'Edge'].includes(
+        browser?.split('/')[0] || null
+    );
 
     if (browser) {
         // HTTP/2 Anomaly Logic
@@ -365,9 +420,6 @@ export function getProtocolAnomalyScore(context) {
                 const connWindow = parseInt(parts[1], 10);
                 const streamPriority = parts[2] || '';
                 const headerOrder = parts.length > 3 ? parts[3] : '';
-                const isChromium = browser.startsWith('Chrome') || browser.startsWith('Edge');
-                const isFirefox = browser.startsWith('Firefox');
-                const isSafari = browser.startsWith('Safari');
 
                 if (isChromium) {
                     if (headerOrder && headerOrder !== 'm,a,s,p') http2Anomaly += 60.0;
@@ -379,6 +431,33 @@ export function getProtocolAnomalyScore(context) {
                     if (headerOrder && headerOrder !== 'm,s,p,a') http2Anomaly += 60.0;
                 }
 
+                // Analyse de la structure des dépendances de flux HTTP/2 (RFC 7540)
+                if (streamPriority) {
+                    const priorityEntries = streamPriority.split(',').map(s => s.trim()).filter(Boolean);
+                    for (const entry of priorityEntries) {
+                        const sub = entry.split(':');
+                        if (sub.length >= 4) {
+                            const streamId = parseInt(sub[0], 10);
+                            const exclusive = parseInt(sub[1], 10);
+                            const depStreamId = parseInt(sub[2], 10);
+                            const weight = parseInt(sub[3], 10);
+
+                            // Auto-dépendance interdite (RFC 7540 Section 5.3.1)
+                            if (streamId === depStreamId && streamId > 0) {
+                                http2Anomaly += 60.0;
+                            }
+                            // Poids en dehors de [1, 256] (RFC 7540 Section 5.3.2)
+                            if (weight < 1 || weight > 256) {
+                                http2Anomaly += 45.0;
+                            }
+                            // Signature scraper : Go net/http2 ou Python h2 par défaut (poids 16 sur flux 0 non-exclusif)
+                            if (isChromium && depStreamId === 0 && weight === 16 && exclusive === 0) {
+                                http2Anomaly += 55.0;
+                            }
+                        }
+                    }
+                }
+
                 // Analyse fine des trames (PRIORITY, WINDOW_UPDATE, CONTINUATION)
                 if (parts.length >= 5) {
                     const frameCountsStr = parts[4];
@@ -399,6 +478,13 @@ export function getProtocolAnomalyScore(context) {
                         if (priorityCount === 0) http2Anomaly += 25.0;
                         // Chrome est agressif avec les WINDOW_UPDATE
                         if (windowUpdateCount < 2) http2Anomaly += 20.0;
+
+                        // NOUVEAU: Analyse de l'arbre de dépendances HTTP/2.
+                        // Un arbre plat (peu de dépendances) est suspect pour Chromium.
+                        const priorityDependencies = streamPriority.split(',').length - 1;
+                        if (streamPriority.includes(',') && priorityDependencies < 2 && priorityCount > 0) {
+                            http2Anomaly += 35.0;
+                        }
                     } else if (isFirefox) {
                         // Firefox utilise un schéma de priorité différent, souvent avec moins de trames PRIORITY
                         if (priorityCount > 1) http2Anomaly += 20.0;
@@ -426,10 +512,6 @@ export function getProtocolAnomalyScore(context) {
                 const frameOrderRaw = parts[3] || context.headers?.['x-quic-frame-order'] || context.quicFrameOrder || '';
                 const frameOrder = frameOrderRaw.toLowerCase().split(',').map(s => s.trim()).filter(Boolean);
 
-                const isChromium = browser.startsWith('Chrome') || browser.startsWith('Edge');
-                const isFirefox = browser.startsWith('Firefox');
-                const isSafari = browser.startsWith('Safari');
-
                 const maxData = parseInt(params['1'] || params['0x01'] || '0', 10);
                 const maxStreams = parseInt(params['4'] || params['8'] || params['0x08'] || '0', 10);
                 const bidiLocal = parseInt(params['5'] || params['0x05'] || '0', 10);
@@ -439,7 +521,33 @@ export function getProtocolAnomalyScore(context) {
                     // Contrôle de flux global et nombre de flux bidirectionnels
                     if (maxData > 0 && maxData < 1048576) quicAnomaly += 40.0;
                     if (maxStreams > 0 && maxStreams !== 100) quicAnomaly += 30.0;
-                    if (priorityOrder && !priorityOrder.includes('u=')) quicAnomaly += 30.0;
+
+                    // NOUVEAU: Analyse des trames PRIORITY_UPDATE (RFC 9218)
+                    if (priorityOrder) {
+                        // Contrôle de l'urgence (u: 0 à 7 strict)
+                        const uMatch = priorityOrder.match(/\bu=(-?\d+)\b/);
+                        if (uMatch) {
+                            const urgency = parseInt(uMatch[1], 10);
+                            if (urgency < 0 || urgency > 7) {
+                                quicAnomaly += 50.0;
+                            }
+                        } else if (!priorityOrder.includes('u=')) {
+                            quicAnomaly += 30.0;
+                        }
+
+                        // Paramètre incrémental invalide ou malformé
+                        if (/\bi=\d+\b/.test(priorityOrder)) {
+                            quicAnomaly += 40.0;
+                        }
+                        if (/\bw=\d+\b/.test(priorityOrder)) {
+                            quicAnomaly += 45.0;
+                        }
+                        // Un navigateur légitime enverra probablement une mise à jour incrémentale 'i'
+                        if (priorityOrder.includes('u=') && !priorityOrder.includes('i') && !/\bu=[0-7],i\b/.test(priorityOrder)) {
+                            quicAnomaly += 40.0; // Urgence envoyée sans drapeau incrémental, suspect pour Chrome
+                        }
+                        if (priorityOrder === 'p' || priorityOrder === 'i') quicAnomaly += 50.0; // Champ malformé
+                    }
 
                     // Contrôle de flux bidi (Chromium alloue 6MB = 6291456 ou au minimum 512 Ko)
                     // curl-impersonate / quiche alloue 256 Ko (262144) ou 128 Ko (131072)
@@ -461,6 +569,12 @@ export function getProtocolAnomalyScore(context) {
                         if (pIdx !== -1 && sIdx !== -1 && pIdx < sIdx) {
                             quicAnomaly += 60.0;
                         }
+
+                        // RFC 9114: Le flux de contrôle ne doit pas contenir de doublon SETTINGS
+                        const sCount = frameOrder.filter(f => f === 's' || f === 'settings' || f === '4').length;
+                        if (sCount > 1) {
+                            quicAnomaly += 50.0;
+                        }
                     }
                 } else if (isFirefox) {
                     const maxData = parseInt(params['1'] || '0', 10);
@@ -490,6 +604,55 @@ export function getProtocolAnomalyScore(context) {
                 }
             }
         }
+
+        // NOUVEAU: Analyse du ratio de compression HPACK/QPACK
+        const compressionInfo = context.headers?.['x-compression-info'] || null;
+        if (compressionInfo) {
+            const info = {};
+            compressionInfo.split(',').forEach(p => {
+                const [key, value] = p.split(':');
+                if (key && value) info[key.trim()] = parseFloat(value);
+            });
+
+            const reqCount = info.req_count || 0;
+            const hpackRatio = info.hpack_ratio;
+            const qpackRatio = info.qpack_ratio;
+            const dynamicEntries = info.dynamic_table_entries !== undefined ? info.dynamic_table_entries : info.table_entries;
+            const dynamicHits = info.dynamic_hits;
+            const dynamicTableSize = info.dynamic_table_size;
+
+            // Après quelques requêtes, un vrai navigateur doit avoir un bon ratio de compression
+            if (reqCount > 3 && isHumanBrowser) {
+                if (hpackRatio !== undefined) {
+                    if (hpackRatio < 0.4) {
+                        http2Anomaly += (1 - hpackRatio) * 50;
+                    } else if (hpackRatio > 0.75) {
+                        http2Anomaly += Math.min(50.0, (hpackRatio - 0.5) * 100);
+                    }
+                }
+                if (qpackRatio !== undefined) {
+                    if (qpackRatio < 0.4) {
+                        quicAnomaly += (1 - qpackRatio) * 50;
+                    } else if (qpackRatio > 0.75) {
+                        quicAnomaly += Math.min(50.0, (qpackRatio - 0.5) * 100);
+                    }
+                }
+
+                // Détection de réinitialisation de table dynamique
+                if (dynamicEntries !== undefined && dynamicEntries === 0) {
+                    http2Anomaly += 45.0;
+                    quicAnomaly += 45.0;
+                }
+                if (dynamicHits !== undefined && dynamicHits === 0) {
+                    http2Anomaly += 35.0;
+                    quicAnomaly += 35.0;
+                }
+                if (dynamicTableSize !== undefined && dynamicTableSize === 0) {
+                    http2Anomaly += 40.0;
+                    quicAnomaly += 40.0;
+                }
+            }
+        }
     }
 
     return {
@@ -706,6 +869,7 @@ const securityProfiles = {
             http2AnomalyScore: 0.8, // NOUVEAU: Poids pour l'anomalie HTTP/2
             threatIntelScore: 1.0, // NOUVEAU: Poids pour le réseau de Threat Intelligence Fédéré
             virtualizationScore: 0.8,
+            mtuAnomalyScore: 0.9, // NOUVEAU: Poids pour l'anomalie MTU/fragmentation
         },
         thresholds: { low: 20, medium: 45, high: 75, block: 95 },
         patterns: {
@@ -754,6 +918,7 @@ const securityProfiles = {
             renderingAnomalyScore: 1.0,
             http2AnomalyScore: 1.0,
             threatIntelScore: 1.0,
+            mtuAnomalyScore: 0.9,
             virtualizationScore: 1.0,
         },
         thresholds: { low: 10, medium: 35, high: 65, block: 90 },
@@ -805,6 +970,7 @@ const securityProfiles = {
             renderingAnomalyScore: 0.2,
             threatIntelScore: 0.6,
             virtualizationScore: 0.8,
+            mtuAnomalyScore: 0.9,
         },
         thresholds: { low: 25, medium: 50, high: 80, block: 95 },
         patterns: {
@@ -854,6 +1020,7 @@ const securityProfiles = {
             quicAnomalyScore: 0.5, // NOUVEAU: Poids pour l'anomalie QUIC
             http2AnomalyScore: 0.5,
             renderingAnomalyScore: 0.5, // NOUVEAU: Poids pour l'anomalie de rendu
+            mtuAnomalyScore: 0.9,
             virtualizationScore: 0.8,
         },
         thresholds: { low: 25, medium: 55, high: 80, block: 95 },
@@ -902,6 +1069,7 @@ const securityProfiles = {
             quicAnomalyScore: 0.9, // NOUVEAU: Poids pour l'anomalie QUIC
             http2AnomalyScore: 0.9,
             renderingAnomalyScore: 0.9,
+            mtuAnomalyScore: 0.9,
             virtualizationScore: 0.8,
         },
         thresholds: { low: 15, medium: 40, high: 70, block: 90 },
@@ -1694,6 +1862,11 @@ export const isTicketValid = async (ip, ticket, deviceId = '', deviceHash = '',
     if (!expiry || Date.now() > expiry) {
       return false;
     }
+    if (statelessData.greenlist || (storedDeviceHash && storedDeviceHash.startsWith('webauthn:greenlist:'))) {
+        if (!deviceId || deviceId === storedDeviceId) {
+            return true;
+        }
+    }
     if (storedDeviceHash && storedDeviceHash.startsWith('zkp:')) {
         const expectedY = storedDeviceHash.split(':')[1];
         if (zkpProof) {
@@ -1721,6 +1894,11 @@ export const isTicketValid = async (ip, ticket, deviceId = '', deviceHash = '',
       await store.delete(`ticket:${ticket}`);
       return false;
     }
+    if (ticketData.greenlist || (storedDeviceHash && storedDeviceHash.startsWith('webauthn:greenlist:'))) {
+        if (!deviceId || deviceId === storedDeviceId) {
+            return true;
+        }
+    }
     if (storedDeviceHash && storedDeviceHash.startsWith('zkp:')) {
         const expectedY = storedDeviceHash.split(':')[1];
         if (zkpProof) {
@@ -2309,29 +2487,17 @@ function getBehaviorScore(context) {
     return { behaviorScore: 0 }; // Pas de données, pas de pénalité.
   }
 
-  // Traitement direct si un flag binaire client-side (1 = humain, 0 = bot) est envoyé
-  if (behaviorHeader === 1 || behaviorHeader === '1') {
-    return { behaviorScore: 0 };
-  }
-  if (behaviorHeader === 0 || behaviorHeader === '0') {
-    return { behaviorScore: 100 };
-  }
-
   // Traitement direct si un score numérique est envoyé côté client
   if (typeof behaviorHeader === 'number') {
     return { behaviorScore: Math.max(0, Math.min(100, behaviorHeader)) };
   }
   if (typeof behaviorHeader === 'string' && !isNaN(Number(behaviorHeader)) && behaviorHeader.trim() !== '') {
     const trimmed = behaviorHeader.trim();
-    if (trimmed === '1') return { behaviorScore: 0 };
-    if (trimmed === '0') return { behaviorScore: 100 };
     return { behaviorScore: Math.max(0, Math.min(100, parseFloat(trimmed))) };
   }
 
   try {
     const metrics = JSON.parse(behaviorHeader);
-    if (metrics === 1) return { behaviorScore: 0 };
-    if (metrics === 0) return { behaviorScore: 100 };
     if (typeof metrics === 'number') {
       return { behaviorScore: Math.max(0, Math.min(100, metrics)) };
     }
@@ -2653,7 +2819,7 @@ export function getTlsSpoofingScore(context, getTlsFingerprintFn = getTlsFingerp
     }
 
     const { ja3, ja4 } = actualGetTlsFingerprintFn(context) || { ja3: null, ja4: null }; // Defensive check
-    const ua = context.headers["user-agent"] || '';
+    const ua = context.headers?.["user-agent"] || '';
     const ja3Raw = context.headers['x-ja3-raw'] || null;
     const httpVersion = context.httpVersion || '';
 
@@ -2675,7 +2841,8 @@ export function getTlsSpoofingScore(context, getTlsFingerprintFn = getTlsFingerp
         score = Math.max(score, 100);
     }
 
-    const claimedBrowser = parseUserAgent(ua).browser?.split('/')[0] || null;
+    const uaParts = parseUserAgent(ua);
+    const claimedBrowser = uaParts.browser?.split('/')[0] || null;
     const isHumanBrowser = ['Chrome', 'Firefox', 'Safari', 'Edge'].includes(claimedBrowser);
 
     // --- ANALYSE 2 : CONTRÔLE PROFOND SUR L'EMPREINTE BRUTE (RAW JA3) ---
@@ -2717,8 +2884,6 @@ export function getTlsSpoofingScore(context, getTlsFingerprintFn = getTlsFingerp
     if (ja4) {
         const parsedJa4 = parseJa4(ja4);
         if (parsedJa4) {
-            const uaParts = parseUserAgent(ua);
-
             // Check 1: Incohérence ALPN / HTTP Version
             if (parsedJa4.alpn === 'h2' && (context.httpVersion === '1.1' || context.httpVersion === '1.0')) {
                 const hasProxy = context.headers['via'] || context.headers['forwarded'] || context.headers['x-forwarded-proto'] || context.headers['x-forwarded-for'];
@@ -2742,6 +2907,25 @@ export function getTlsSpoofingScore(context, getTlsFingerprintFn = getTlsFingerp
         }
     }
 
+    // Validation TLS 1.3 Encrypted Client Hello (ECH) & Discrépance SNI
+    const outerSni = context.headers?.['x-ech-outer-sni'];
+    const host = (context.headers?.['host'] || '').split(':')[0].trim();
+    const hasEch = context.headers?.['x-ech-present'] === 'true' || context.headers?.['x-has-ech'] === 'true';
+    const echExpected = context.headers?.['x-ech-expected'] === 'true' || Boolean(outerSni);
+
+    if (outerSni && host && outerSni.toLowerCase() !== host.toLowerCase() && !hasEch) {
+        score = Math.max(score, 60.0);
+    }
+
+    const browserVersion = parseInt(uaParts.browser?.split('/')[1] || '0', 10);
+    const isModernEchBrowser = (
+        (claimedBrowser === 'Chrome' || claimedBrowser === 'Edge') && browserVersion >= 119
+    ) || (claimedBrowser === 'Firefox' && browserVersion >= 118);
+
+    if (context.isHttps && isModernEchBrowser && echExpected && !hasEch) {
+        score = Math.max(score, 55.0);
+    }
+
     // 2. If no JA3 hash is available, we cannot perform the consistency check.
     if (ja3 && ua) {
         // Look up the expected browser family (or families) from our database.
@@ -2780,7 +2964,6 @@ export function getTlsSpoofingScore(context, getTlsFingerprintFn = getTlsFingerp
     // Create the promise for the async part (Check 4)
     const promise = (async () => {
         let asyncScore = score;
-        const uaParts = parseUserAgent(ua);
         
         if (uaParts.browser) {
             const browserFamily = uaParts.browser.split('/')[0];
@@ -3912,6 +4095,52 @@ function getVirtualizationAnomalyScore(context) {
     return Math.min(100.0, score);
 }
 
+/**
+ * @private
+ * Analyzes TCP MTU and fragmentation flags to detect network tunnels (VPN/Proxy).
+ * @param {object} context - The request context.
+ * @returns {{mtuAnomalyScore: number}}
+ */
+function getMtuAnomalyScore(context) {
+    const mtuHeader = context.headers?.['x-tcp-mtu-info'];
+    if (!mtuHeader || typeof mtuHeader !== 'string') {
+        return { mtuAnomalyScore: 0.0 };
+    }
+
+    const parts = mtuHeader.split(':');
+    if (parts.length < 2) {
+        return { mtuAnomalyScore: 0.0 };
+    }
+
+    const mtu = parseInt(parts[0], 10);
+    const df = parseInt(parts[1], 10); // Don't Fragment bit (1 or 0)
+
+    if (isNaN(mtu) || isNaN(df)) {
+        return { mtuAnomalyScore: 0.0 };
+    }
+
+    let score = 0.0;
+
+    // Pénalité modérée pour les MTU typiques des VPNs/tunnels.
+    if (mtu > 1200 && mtu <= 1420) {
+        score += 35.0;
+    } else if (mtu > 1420 && mtu < 1492) {
+        score += 20.0;
+    }
+
+    const ua = context.headers?.['user-agent'] || '';
+    const uaParts = parseUserAgent(ua);
+    const os = uaParts.os;
+
+    // Pénalités additionnelles en cas d'incohérence OS vs signature réseau.
+    if (os) {
+        if (os.startsWith('Windows') && mtu < 1492) score += 20.0;
+        if ((os.startsWith('Android') || os.startsWith('iOS')) && mtu < 1480) score += 15.0;
+        if (df === 0 && (os.startsWith('Windows') || os.startsWith('Mac') || os.startsWith('Linux'))) score += 40.0;
+    }
+
+    return { mtuAnomalyScore: Math.min(100.0, score) };
+}
 
 /**
  * Returns a vector of raw (unweighted) suspicion scores.
@@ -4002,6 +4231,7 @@ export const getSuspicionVector = async (context, securityConfig) => {
     const { protocolAnomalyScore, http2AnomalyScore, quicAnomalyScore } = getProtocolAnomalyScore(context);
     const { renderingAnomalyScore } = getRenderingAnomalyScore(context);
     const virtualizationScore = getVirtualizationAnomalyScore(context);
+    const { mtuAnomalyScore } = getMtuAnomalyScore(context);
 
   // Save the updated device state to the store
   // Note: deviceData.ips is a Set, which may not serialize correctly in all stores (e.g., JSON). A Redis store should handle this via custom serialization or by converting to an array.
@@ -4013,7 +4243,7 @@ export const getSuspicionVector = async (context, securityConfig) => {
       deviceData.ips = new Set(deviceData.ips);
   }
     // Le vecteur de suspicion est maintenant complet.
-    return { ...behavioral, headerAnomalyScore, inconsistencyScore, behaviorScore, honeypotScore, botScore, requestPatternScore, crossLayerInconsistencyScore, timeInconsistencyScore, tlsSpoofingScore, clickVarianceScore, clientHintsInconsistencyScore, subnetScore, ipReputationScore, botnetClusterScore, tcpAnomalyScore, protocolAnomalyScore, http2AnomalyScore, quicAnomalyScore, renderingAnomalyScore, threatIntelScore, virtualizationScore };
+    return { ...behavioral, headerAnomalyScore, inconsistencyScore, behaviorScore, honeypotScore, botScore, requestPatternScore, crossLayerInconsistencyScore, timeInconsistencyScore, tlsSpoofingScore, clickVarianceScore, clientHintsInconsistencyScore, subnetScore, ipReputationScore, botnetClusterScore, tcpAnomalyScore, protocolAnomalyScore, http2AnomalyScore, quicAnomalyScore, renderingAnomalyScore, threatIntelScore, virtualizationScore, mtuAnomalyScore };
 };
 
 // A residential user can change networks (home, 4G, public wifi).
@@ -4232,6 +4462,24 @@ function generateCpuTargetChallengePage(challengeDetails, clientIp) {
       </body></html>`;
 }
 
+/**
+ * Generates closed-shadow DOM honeypot markup for server-rendered challenge pages.
+ * Utilizes Declarative Shadow DOM with mode="closed" to prevent screen reader false positives
+ * while capturing bot web scrapers and crawlers.
+ * @param {string[]} trapUrls
+ * @returns {string}
+ */
+function generateClosedShadowTraps(trapUrls = []) {
+  const list = Array.isArray(trapUrls) ? trapUrls : [];
+  if (list.length === 0) return '';
+
+  const trapLinksHtml = list.map((url, idx) => {
+    return `<a href="${url}" rel="nofollow" tabindex="-1"><span>&gt; ${idx + 1}</span></a>`;
+  }).join(' ');
+
+  return `<div style="position:absolute;left:-9999px;top:-9999px;width:0;height:0;overflow:hidden;visibility:hidden;pointer-events:none;" aria-hidden="true"><template shadowrootmode="closed" shadowroot="closed"><style>:host { position: absolute; left: -9999px; top: -9999px; width: 0; height: 0; overflow: hidden; visibility: hidden; pointer-events: none; } a { color: transparent; text-decoration: none; }</style>${trapLinksHtml}</template></div>`;
+}
+
 /**
  * Generates the HTML content for a combined CPU + Memory PoW challenge.
  * @param {object} cpuChallengeDetails - Details from generateCpuTargetChallenge.
@@ -4248,6 +4496,7 @@ function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty,
     const fingerprint = originalFingerprint;
     const baseBlock = createCpuChallengeBaseBlock(nonce, clientSecret, fingerprint, clientIp, tlsSessionId);
     const baseBlockBytes = `[${baseBlock.toString('utf8').split('').map(c => c.charCodeAt(0)).join(',')}]`;
+    const trapContainerHtml = generateClosedShadowTraps(trapUrls);
 
     // Prépare la configuration pour l'initialisation du client, y compris les URL pièges.
     const clientInitConfig = {
@@ -4315,12 +4564,24 @@ function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty,
     }
 
     if (!htmlTemplate) {
-        htmlTemplate = `<html><head><title>Advanced Security Check</title></head><body style="font-family:sans-serif; text-align:center; padding-top:50px;"><h1>Enhanced Verification... (Level 2)</h1><p>Your activity requires an additional security check. This may take a few moments.</p><div id="loader" style="margin:20px;">⚙️ Initializing combined verification...</div><script><!-- FINGERPRINT_SOLVER_SCRIPT --></script><script><!-- FINGERPRINT_CHALLENGE_SCRIPT --></script></body></html>`; // eslint-disable-line max-len
+        htmlTemplate = `<html><head><title>Advanced Security Check</title></head><body style="font-family:sans-serif; text-align:center; padding-top:50px;"><h1>Enhanced Verification... (Level 2)</h1><p>Your activity requires an additional security check. This may take a few moments.</p><div id="loader" style="margin:20px;">⚙️ Initializing combined verification...</div><script><!-- FINGERPRINT_SOLVER_SCRIPT --></script><script><!-- FINGERPRINT_CHALLENGE_SCRIPT --></script><!-- FINGERPRINT_TRAPS --></body></html>`; // eslint-disable-line max-len
     }
 
-    return htmlTemplate
+    let renderedHtml = htmlTemplate
         .replace('<!-- FINGERPRINT_SOLVER_SCRIPT -->', solverCode)
         .replace('<!-- FINGERPRINT_CHALLENGE_SCRIPT -->', challengeScript);
+
+    if (renderedHtml.includes('<!-- FINGERPRINT_TRAPS -->')) {
+        renderedHtml = renderedHtml.replace('<!-- FINGERPRINT_TRAPS -->', trapContainerHtml);
+    } else if (trapContainerHtml) {
+        if (renderedHtml.includes('</body>')) {
+            renderedHtml = renderedHtml.replace('</body>', `${trapContainerHtml}</body>`);
+        } else {
+            renderedHtml += trapContainerHtml;
+        }
+    }
+
+    return renderedHtml;
 }
 
 /**
@@ -4502,6 +4763,8 @@ export class FingerprintEngine {
         // Auto-generate Ed25519 key pair on load if indicated and keys are not set
         if (securityConfig && (securityConfig.useAsymmetricTickets || securityConfig.ed25519 === 'auto') && !process.env.ED25519_PRIVATE_KEY) {
             const persistentKeyPath = join(configDir, 'ed25519_key.json');
+            const privatePemPath = join(configDir, 'issuer-private.pem');
+            const publicPemPath = join(configDir, 'issuer-public.pem');
             if (existsSync(persistentKeyPath)) {
                 try {
                     const keys = JSON.parse(readFileSync(persistentKeyPath, 'utf-8'));
@@ -4511,6 +4774,14 @@ export class FingerprintEngine {
                 } catch (e) {
                     console.error('[Fingerprint] Failed to load persistent Ed25519 keys:', e.message);
                 }
+            } else if (existsSync(privatePemPath) && existsSync(publicPemPath)) {
+                try {
+                    process.env.ED25519_PRIVATE_KEY = readFileSync(privatePemPath, 'utf-8');
+                    process.env.ED25519_PUBLIC_KEY = readFileSync(publicPemPath, 'utf-8');
+                    this._log('Persistent Ed25519 PEM keys loaded from disk');
+                } catch (e) {
+                    console.error('[Fingerprint] Failed to load persistent Ed25519 PEM keys:', e.message);
+                }
             } else {
                 try {
                     const { privateKey, publicKey } = crypto.generateKeyPairSync('ed25519', {
@@ -4611,7 +4882,9 @@ export class FingerprintEngine {
       'similarityThreshold', 'reset',
       'ed25519_private_key', 'ed25519_public_key', 'upowModel',
       'federatedPeers', 'federationSecret', 'filterWhitelist',
-      'challengeRateLimit'
+      'challengeRateLimit',
+      'differentialPrivacy', 'dpEpsilon'
+      ,'pat'
     ]);
 
     // 1. Check for essential keys
@@ -4649,35 +4922,31 @@ export class FingerprintEngine {
     }
   }
     calculateFinalScore(suspicionVector) {
-        const { weights } = this.securityConfig;
-        if (!weights) return 0;
-
-        const score =
-            (suspicionVector.historyScore || 0) * (weights.historyScore || 0) +
-            (suspicionVector.rotationScore || 0) * (weights.rotationScore || 0) +
-            (suspicionVector.headerAnomalyScore || 0) * (weights.headerAnomalyScore || 0) +
-            (suspicionVector.requestPatternScore || 0) * (weights.requestPatternScore || 0) +
-            (suspicionVector.inconsistencyScore || 0) * (weights.inconsistencyScore || 0) +
-            (suspicionVector.honeypotScore || 0) * (weights.honeypotScore || 0) +
-            (suspicionVector.behaviorScore || 0) * (weights.behaviorScore || 0) +
-            (suspicionVector.botScore || 0) * (weights.botScore || 0) + // Ajout du nouveau score
-            (suspicionVector.crossLayerInconsistencyScore || 0) * (weights.crossLayerInconsistencyScore || 0) +
-            (suspicionVector.botnetClusterScore || 0) * (weights.botnetClusterScore || 0) +
-            (suspicionVector.tlsSpoofingScore || 0) * (weights.tlsSpoofingScore || 0) + // NOUVEAU: TLS Spoofing
-            (suspicionVector.timeInconsistencyScore || 0) * (weights.timeInconsistencyScore || 0) +
-            (suspicionVector.clickVarianceScore || 0) * (weights.clickVarianceScore || 0) +
-            (suspicionVector.clientHintsInconsistencyScore || 0) * (weights.clientHintsInconsistencyScore || 0) +
-            (suspicionVector.subnetScore || 0) * (weights.subnetScore || 0) +
-            (suspicionVector.ipReputationScore || 0) * (weights.ipReputationScore || 0) +
-            (suspicionVector.tcpAnomalyScore || 0) * (weights.tcpAnomalyScore || 0) +
-            (suspicionVector.quicAnomalyScore || 0) * (weights.quicAnomalyScore || 0) + // NOUVEAU: QUIC Anomaly
-            (suspicionVector.http2AnomalyScore || 0) * (weights.http2AnomalyScore || 0) +
-            (suspicionVector.cookieDroppingScore || 0) * (weights.cookieDroppingScore || 0) +
-            (suspicionVector.virtualizationScore || 0) * (weights.virtualizationScore || 0) +
-            (suspicionVector.threatIntelScore || 0) * (weights.threatIntelScore || 0) + // NOUVEAU: QUIC Anomaly
-            (suspicionVector.renderingAnomalyScore || 0) * (weights.renderingAnomalyScore || 0); // NOUVEAU: Rendering Anomaly
-
-        return Math.min(100, score);
+        const baseWeights = this.securityConfig.weights;
+        if (!baseWeights) return 0;
+
+        const dynamicWeights = { ...baseWeights };
+        if ((suspicionVector.mtuAnomalyScore || 0) > 50.0) {
+            this._log('Tunnel detected, amplifying suspicion weights.', { mtuScore: suspicionVector.mtuAnomalyScore });
+
+            // Augmente le poids des incohérences de bas niveau (difficiles à falsifier)
+            dynamicWeights.tlsSpoofingScore = (baseWeights.tlsSpoofingScore || 0.8) * 1.25;
+            dynamicWeights.crossLayerInconsistencyScore = (baseWeights.crossLayerInconsistencyScore || 0.4) * 1.4;
+            dynamicWeights.clientHintsInconsistencyScore = (baseWeights.clientHintsInconsistencyScore || 0.7) * 1.2;
+
+            // Augmente le poids des anomalies comportementales (un bot derrière un VPN est plus suspect)
+            dynamicWeights.behaviorScore = (baseWeights.behaviorScore || 0.7) * 1.15;
+            dynamicWeights.requestPatternScore = (baseWeights.requestPatternScore || 0.6) * 1.2;
+        }
+
+        let score = 0;
+        for (const key in dynamicWeights) {
+            const metricScore = suspicionVector[key] || 0.0;
+            if (metricScore > 0) {
+                score += metricScore * dynamicWeights[key];
+            }
+        }
+        return Math.min(100.0, score);
     }
 
 
@@ -4998,9 +5267,84 @@ export class FingerprintEngine {
     
     // Bypass instantané si l'appareil a prouvé cryptographiquement son identité matérielle (Secure Enclave / TPM)
     const { deviceId, deviceData, newCookie } = await resolveRequestIdentity(requestContext, this.securityConfig);
+
+    // Règle Anti-Ferme : Même avec du matériel sécurisé, un appareil condamné ou menant une attaque certaine est révoqué et bloqué
+    if (deviceData?.condemned || this._hasCertainAttack(requestContext)) {
+        if (deviceData) {
+            deviceData.condemned = true;
+            deviceData.webauthnVerified = false;
+            await store.set(`device:${deviceId}`, deviceData);
+        }
+        this._log('Condemned device or attack detected - revoking hardware trust and blocking', { deviceId });
+        const decision = { action: 'block', status: 404, body: 'Forbidden', score: 100, vector: { honeypotScore: 100 } };
+        if (this.dryRun) {
+            this._log(`[Dry Run] Intended action: ${decision.action}`, { score: decision.score });
+            decision.intendedAction = decision.action;
+            decision.action = 'next';
+            delete decision.status;
+            delete decision.body;
+            if (requestContext._newCookies) {
+                const deviceCookie = requestContext._newCookies.find(c => c.name === 'device_id');
+                if (deviceCookie) decision.newCookieForResponse = deviceCookie;
+            }
+        }
+        return decision;
+    }
+
+    // Validation immédiate de l'attestation matérielle WebAuthn si présente dans la requête
+    const behaviorHeader = requestContext.headers?.['x-behavior-metrics'];
+    if (behaviorHeader && typeof behaviorHeader === 'string' && behaviorHeader.startsWith('{')) {
+        try {
+            const parsedMetrics = JSON.parse(behaviorHeader);
+            if (parsedMetrics && parsedMetrics.webauthnAnchor && deviceData) {
+                if (verifyWebAuthnHardwareAnchor(parsedMetrics.webauthnAnchor, deviceData)) {
+                    deviceData.webauthnVerified = true;
+                    await store.set(`device:${deviceId}`, deviceData);
+                }
+            }
+        } catch (e) {}
+    }
+
     if (deviceData && deviceData.webauthnVerified) {
         this._log('Hardware-anchored device verified (WebAuthn) - full bypass granted', { deviceId });
-        return { action: 'next', score: 0, vector: { webauthn_verified: 100 } };
+        const greenlistTtl = 365 * 86400 * 1000; // 1 an (permanent)
+        const greenlistTicket = generateStatelessTicket({
+            expiry: Date.now() + greenlistTtl,
+            originalIp: clientIp,
+            deviceId,
+            deviceHash: 'webauthn:greenlist:' + (deviceData.webauthnCredentialId || deviceId),
+            greenlist: true
+        });
+        const isHttps = requestContext.headers?.['x-forwarded-proto'] === 'https' || 
+                        requestContext.rawReq?.secure || 
+                        requestContext.rawReq?.protocol === 'https' ||
+                        requestContext.rawReq?.connection?.encrypted;
+        const secureOption = isHttps || this.isProduction;
+
+        const decision = {
+            action: 'next',
+            score: 0,
+            vector: { webauthn_verified: 100 },
+            cookie: {
+                name: 'pow_clearance',
+                value: greenlistTicket,
+                options: {
+                    httpOnly: true,
+                    secure: secureOption,
+                    sameSite: 'strict',
+                    ...(secureOption && { partitioned: true }),
+                    maxAge: greenlistTtl,
+                    path: '/'
+                }
+            }
+        };
+        if (requestContext._newCookies) {
+            const deviceCookie = requestContext._newCookies.find(c => c.name === 'device_id');
+            if (deviceCookie) {
+                decision.newCookieForResponse = deviceCookie;
+            }
+        }
+        return decision;
     }
 
     if (isStatic) {
@@ -5008,6 +5352,39 @@ export class FingerprintEngine {
       return { action: 'next', score: 0, vector: {} };
     }
 
+    // --- PRIVATE ACCESS TOKENS (PAT / RFC 9505 & Privacy Pass) ZERO-FRICTION BYPASS ---
+    const rawPatTokens = extractPrivateAccessTokens(requestContext.headers);
+    if (rawPatTokens.length > 0) {
+        const patConfig = this.securityConfig.pat || {};
+        for (const rawToken of rawPatTokens) {
+            const parsedToken = parsePrivateAccessToken(rawToken);
+            if (parsedToken) {
+                const nonceKey = `pat-nonce:${parsedToken.nonce}`;
+                const isReplayed = await store.has(nonceKey);
+                if (!isReplayed) {
+                    const isValid = verifyPatSignature(parsedToken, patConfig);
+                    if (isValid) {
+                        // Anti-replay: cache nonce with 24-hour TTL
+                        const nonceTtl = patConfig.nonceTtl || 86400;
+                        await store.set(nonceKey, true, nonceTtl);
+                        this._log('Private Access Token (PAT) cryptographically verified - granting zero-friction bypass', {
+                            tokenType: parsedToken.tokenType,
+                            tokenKeyId: parsedToken.tokenKeyId
+                        });
+                        const decision = {
+                            action: 'next',
+                            score: 0.0,
+                            vector: { pat_verified: 100.0, privacy_pass: 100.0 },
+                            intendedAction: 'next'
+                        };
+                        if (newCookie) decision.newCookieForResponse = newCookie;
+                        return decision;
+                    }
+                }
+            }
+        }
+    }
+
     // Resolve identity and check for persisted "condemned" status early.
     const currentDeviceHash = getCompositeDeviceHash(requestContext);
     const isNewDevice = !!newCookie;
@@ -5043,7 +5420,7 @@ export class FingerprintEngine {
       if (filterWhitelist === true) {
         bypassWhitelist = this._hasCertainAttack(requestContext);
       } else if (typeof filterWhitelist === 'number') {
-        const res = await getScoreAndVector();
+          const res = await getScoreAndVector();
         if (res.score > filterWhitelist) {
           bypassWhitelist = true;
         }
@@ -6216,7 +6593,8 @@ function sanitizeProxyHeaders(context, securityConfig) {
         'x-ja4-hash',
         'x-http2-fingerprint',
         'x-tcp-fingerprint',
-        'x-ja3-raw'
+        'x-ja3-raw',
+        'x-compression-info'
     ];
 
     if (securityConfig && securityConfig.trustedProxies) {
@@ -6633,6 +7011,7 @@ export const default_whitelist = () => [
     googlebot_whitelist(),
     bingbot_whitelist(),
     yandex_whitelist(),
+    facebook_whitelist(),
     // === Moteurs de recherche majeurs ===
     { userAgent: 'Googlebot', hostnameSuffix: '.googlebot.com' },
     { userAgent: 'Google-Extended', hostnameSuffix: '.google.com' },
@@ -6750,6 +7129,11 @@ export const bingbot_whitelist = () => ({
     entries: bingbotEntries
 });
 
+export const facebook_whitelist = () => ({
+    type: 'allowlist',
+    entries: facebookEntries
+});
+
 
 /**
  * Extracts the TLS Session ID or ticket hash from the request context.
@@ -6983,6 +7367,9 @@ export const powMiddleware = (securityConfig) => {
 
       case 'next':
       default:
+        if (decision.cookie && res && typeof res.cookie === 'function') {
+          res.cookie(decision.cookie.name, decision.cookie.value, decision.cookie.options);
+        }
         return next();
     }
   };
@@ -6999,6 +7386,7 @@ export const __internal = {
     checkChallengeRateLimit,
     getDeviceHash,
     getCompositeDeviceHash,
+    generateClosedShadowTraps,
     getSuspicionVector,
     getTlsSessionId,
     pruneTrafficData,
@@ -7050,6 +7438,7 @@ export const __internal = {
     findPeerInSubnet,
     handleCooperativeRequest,
     broadcastBannedZkp,
+    generateIssuerPemKeys,
     getMetric,
     incrementCounter,
     observeValue
@@ -7749,4 +8138,5 @@ export async function handleMetricsRequest(req, res, securityConfig) {
     // 3. Si autorisé, servir les métriques.
     res.set('Content-Type', 'text/plain; version=0.0.4; charset=utf-8');
     res.send(MetricsManager.getPrometheusMetrics(securityConfig));
-}
+}
+export { generateIssuerPemKeys };