cdp-edge 1.2.2 → 1.4.0

package/server-edge-tracker/modules/ml/bidding.ts

@@ -0,0 +1,247 @@
+/**
+ * CDP Edge — Bidding Recommendations ML (Fase 2)
+ * Handlers das rotas /api/bidding/*
+ */
+
+import { tryParseJson } from '../utils.js';
+import { Env } from '../../types.js';
+import { ExecutionContext } from '@cloudflare/workers-types';
+
+// ── Constantes de calibração ──────────────────────────────────────────────────
+const PLATFORM_FACTORS: Record<string, number> = { meta: 0.85, google: 0.90, tiktok: 0.75 };
+
+function getSegmentMultiplier(avgLtvClass: string | number, avgBehaviorScore: string | number): number {
+  const ltv = parseFloat(String(avgLtvClass) || '0');
+  const eng = parseFloat(String(avgBehaviorScore) || '0');
+  if (ltv >= 0.7 && eng >= 0.7)  return 1.4;
+  if (ltv >= 0.7 && eng >= 0.4)  return 1.2;
+  if (ltv >= 0.4 && eng >= 0.7)  return 1.0;
+  if (ltv >= 0.4 && eng >= 0.4)  return 0.8;
+  return 0.6;
+}
+
+function getConfidenceAdjustment(confidence: number): number {
+  if (confidence >= 0.7) return 1.00;
+  if (confidence >= 0.4) return 0.85;
+  return 0.70;
+}
+
+// ── POST /api/bidding/recommend ───────────────────────────────────────────────
+export async function handleBiddingRecommend(env: Env, request: Request, headers: Headers): Promise<Response> {
+  if (!env.DB) return new Response(JSON.stringify({ error: 'DB não configurado' }), { status: 503, headers });
+
+  let body: any;
+  try { body = await request.json(); }
+  catch { return new Response(JSON.stringify({ error: 'JSON inválido no body' }), { status: 400, headers }); }
+
+  const {
+    vertical    = 'geral', platform    = 'meta',
+    target_roi  = 3.5,    period_days = 30,
+    campaign_id = null,   budget      = null,
+  } = body;
+
+  const platforms = platform === 'all'
+    ? Object.keys(PLATFORM_FACTORS)
+    : [platform].filter(p => PLATFORM_FACTORS[p]);
+
+  if (platforms.length === 0) {
+    return new Response(JSON.stringify({ error: 'platform deve ser: meta, google, tiktok ou all' }), { status: 400, headers });
+  }
+  if (target_roi < 1 || target_roi > 20) {
+    return new Response(JSON.stringify({ error: 'target_roi deve estar entre 1 e 20' }), { status: 400, headers });
+  }
+
+  try {
+    const segmentsRes = await env.DB.prepare(`
+      SELECT ms.id AS segment_id, ms.cluster_name, ms.avg_ltv_class, ms.avg_behavior_score,
+             ms.avg_engagement_score, ms.silhouette_score,
+             COUNT(msm.id) AS member_count,
+             AVG(l.predicted_ltv) AS real_avg_ltv,
+             SUM(CASE WHEN l.event_name IN ('Purchase','CompletePayment') THEN 1 ELSE 0 END) AS conversions
+      FROM ml_segments ms
+      LEFT JOIN ml_segment_members msm ON msm.cluster_id = ms.id
+      LEFT JOIN leads l ON CAST(msm.lead_id AS INTEGER) = l.id
+        AND l.created_at >= datetime('now', '-' || ? || ' days')
+      WHERE ms.is_active = 1 AND ms.client_vertical IN (?, 'general')
+      GROUP BY ms.id
+      HAVING member_count > 0
+      ORDER BY real_avg_ltv DESC
+      LIMIT 10
+    `).bind(period_days, vertical).all();
+
+    const segments = segmentsRes.results || [];
+
+    let globalLtv = 0, globalLeads = 0, globalConversions = 0;
+    if (segments.length === 0) {
+      const globalRes = await env.DB.prepare(`
+        SELECT COUNT(*) AS total_leads, AVG(predicted_ltv) AS avg_ltv,
+               SUM(CASE WHEN event_name IN ('Purchase','CompletePayment') THEN 1 ELSE 0 END) AS conversions
+        FROM leads
+        WHERE created_at >= datetime('now', '-' || ? || ' days')
+          AND (bot_score IS NULL OR bot_score < 2)
+      `).bind(period_days).first();
+
+      globalLeads       = Number((globalRes as any)?.total_leads)  || 0;
+      globalLtv         = Number((globalRes as any)?.avg_ltv)       || 0;
+      globalConversions = Number((globalRes as any)?.conversions)    || 0;
+
+      if (globalLeads < 10) {
+        return new Response(JSON.stringify({
+          error: `Dados insuficientes. Apenas ${globalLeads} leads no período de ${period_days} dias. Mínimo: 10.`,
+          leads_found: globalLeads, required: 10,
+        }), { status: 400, headers });
+      }
+    }
+
+    const now = new Date().toISOString();
+    const recommendations: any[] = [];
+
+    const targetSegments = segments.length > 0
+      ? segments
+      : [{ segment_id: null, cluster_name: 'Global (sem segmentação)', avg_ltv_class: 0.5, avg_behavior_score: 0.5, avg_engagement_score: 0.5, member_count: globalLeads, real_avg_ltv: globalLtv, conversions: globalConversions }];
+
+    for (const seg of targetSegments) {
+      const avgLtv     = parseFloat(String(seg.real_avg_ltv) || '0');
+      const convs      = parseInt(String(seg.conversions || '0'));
+      const confidence = Math.min(1, convs / 100);
+
+      const estimatedLtv = avgLtv > 0 ? avgLtv :
+        Number(seg.avg_ltv_class) >= 0.7 ? 497 : Number(seg.avg_ltv_class) >= 0.4 ? 297 : 97;
+
+      const cpaTarget    = estimatedLtv / target_roi;
+      const segMult      = getSegmentMultiplier(String(seg.avg_ltv_class), String(seg.avg_behavior_score));
+      const confAdj      = getConfidenceAdjustment(confidence);
+      const alertMsg     = convs < 30 ? `Atenção: apenas ${convs} conversões no período. Bid baseado em estimativa de LTV — aplique com cautela.` : null;
+
+      for (const plat of platforms) {
+        const platFactor     = PLATFORM_FACTORS[plat] || 0.8;
+        const recommendedBid = Math.max(5, cpaTarget * platFactor * segMult * confAdj);
+        const expectedRoi    = estimatedLtv / (recommendedBid / platFactor);
+
+        const reasoning = `Segmento "${seg.cluster_name}": LTV=${estimatedLtv.toFixed(0)} BRL, ` +
+          `CPA_alvo=${cpaTarget.toFixed(0)} BRL, fator_plataforma=${platFactor}, ` +
+          `mult_segmento=${segMult}, ajuste_confiança=${confAdj}, ` +
+          `base: ${convs} conversões em ${period_days} dias.`;
+
+        try {
+          await env.DB.prepare(`
+            INSERT INTO bid_recommendations (
+              generated_at, vertical, platform, period_days, target_roi,
+              segment_id, segment_name, leads_analyzed, conversions_found,
+              avg_ltv, cpa_target, recommended_bid, bid_currency,
+              confidence, expected_roi, reasoning, ai_used, alert_message,
+              platform_factor, confidence_adjustment, segment_multiplier, is_active
+            ) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0,?,?,?,?,1)
+          `).bind(
+            now, vertical, plat, period_days, target_roi,
+            seg.segment_id || null, seg.cluster_name,
+            seg.member_count || globalLeads, convs,
+            estimatedLtv, cpaTarget, recommendedBid, 'BRL',
+            confidence, expectedRoi, reasoning, alertMsg || null,
+            platFactor, confAdj, segMult,
+          ).run();
+        } catch (e: any) { console.error('[Bidding] D1 insert error:', e?.message || String(e)); }
+
+        recommendations.push({
+          platform: plat, segment: seg.cluster_name, segment_id: seg.segment_id || null,
+          avg_ltv: Math.round(estimatedLtv * 100) / 100,
+          avg_ltv_class: Number(seg.avg_ltv_class) >= 0.7 ? 'High' : Number(seg.avg_ltv_class) >= 0.4 ? 'Medium' : 'Low',
+          cpa_target: Math.round(cpaTarget * 100) / 100,
+          recommended_bid: Math.round(recommendedBid * 100) / 100,
+          bid_currency: 'BRL', confidence: Math.round(confidence * 100) / 100,
+          expected_roi: Math.round(expectedRoi * 100) / 100, reasoning, alert: alertMsg,
+        });
+      }
+    }
+
+    await env.DB.prepare(`UPDATE bid_recommendations SET is_active = 0 WHERE vertical = ? AND generated_at < ? AND is_active = 1`).bind(vertical, now).run().catch(() => {});
+
+    const avgConfidence = recommendations.length > 0
+      ? recommendations.reduce((s, r) => s + r.confidence, 0) / recommendations.length
+      : 0;
+
+    return new Response(JSON.stringify({
+      success: true, generated_at: now, vertical, period_days, target_roi,
+      data_quality: {
+        leads_analyzed: targetSegments.reduce((s: number, sg: any) => s + (sg.member_count || 0), 0),
+        conversions_found: targetSegments.reduce((s: number, sg: any) => s + (sg.conversions || 0), 0),
+        segments_active: segments.length, confidence: Math.round(avgConfidence * 100) / 100,
+      },
+      recommendations,
+      global_summary: {
+        total_recommendations: recommendations.length,
+        avg_confidence: Math.round(avgConfidence * 100) / 100,
+        expected_cost_reduction: avgConfidence >= 0.7 ? '-20%' : avgConfidence >= 0.4 ? '-10%' : 'indefinido (dados insuficientes)',
+        segments_analyzed: segments.length,
+      },
+    }), { status: 200, headers });
+
+  } catch (err: any) {
+    console.error('[Bidding] recommend error:', err?.message || String(err));
+    return new Response(JSON.stringify({ error: 'Erro ao gerar recomendações', message: err?.message || String(err) }), { status: 500, headers });
+  }
+}
+
+// ── GET /api/bidding/history ──────────────────────────────────────────────────
+export async function handleBiddingHistory(env: Env, request: Request, headers: Headers): Promise<Response> {
+  if (!env.DB) return new Response(JSON.stringify({ error: 'DB não configurado' }), { status: 503, headers });
+
+  const url      = new URL(request.url);
+  const vertical = url.searchParams.get('vertical') || null;
+  const platform = url.searchParams.get('platform') || null;
+  const limit    = Math.min(parseInt(url.searchParams.get('limit') || '20'), 100);
+
+  try {
+    const conditions: string[] = [];
+    const bindings: (string | number)[]   = [];
+    if (vertical) { conditions.push('vertical = ?');  bindings.push(vertical); }
+    if (platform) { conditions.push('platform = ?');  bindings.push(platform); }
+    const where = conditions.length > 0 ? `WHERE ${conditions.join(' AND ')}` : '';
+
+    const result = await env.DB.prepare(`
+      SELECT id, generated_at, vertical, platform, period_days, target_roi,
+             segment_name, leads_analyzed, conversions_found, avg_ltv, cpa_target,
+             recommended_bid, bid_currency, confidence, expected_roi,
+             reasoning, alert_message, ai_used, is_active,
+             applied_at, applied_campaign, applied_result
+      FROM bid_recommendations
+      ${where}
+      ORDER BY generated_at DESC
+      LIMIT ?
+    `).bind(...bindings, limit).all();
+
+    const items = (result.results || []).map((r: any) => ({ ...r, applied_result: tryParseJson(r.applied_result, null) }));
+    return new Response(JSON.stringify({ success: true, total: items.length, history: items }), { status: 200, headers });
+  } catch (err: any) {
+    console.error('[Bidding] history error:', err?.message || String(err));
+    return new Response(JSON.stringify({ error: err?.message || String(err) }), { status: 500, headers });
+  }
+}
+
+// ── GET /api/bidding/status ───────────────────────────────────────────────────
+export async function handleBiddingStatus(env: Env, request: Request, headers: Headers): Promise<Response> {
+  if (!env.DB) return new Response(JSON.stringify({ error: 'DB não configurado' }), { status: 503, headers });
+
+  const url      = new URL(request.url);
+  const vertical = url.searchParams.get('vertical') || null;
+
+  try {
+    let query = `
+      SELECT platform, vertical, MAX(generated_at) as last_generated,
+             AVG(confidence) as avg_confidence, AVG(recommended_bid) as avg_bid,
+             COUNT(*) as recommendations_count,
+             SUM(CASE WHEN alert_message IS NOT NULL THEN 1 ELSE 0 END) as alerts_count
+      FROM bid_recommendations
+      WHERE is_active = 1
+    `;
+    const bindings: (string | number)[] = [];
+    if (vertical) { query += ' AND vertical = ?'; bindings.push(vertical); }
+    query += ' GROUP BY platform, vertical ORDER BY last_generated DESC';
+
+    const result = await env.DB.prepare(query).bind(...bindings).all();
+    return new Response(JSON.stringify({ success: true, status: result.results || [] }), { status: 200, headers });
+  } catch (err: any) {
+    console.error('[Bidding] status error:', err?.message || String(err));
+    return new Response(JSON.stringify({ error: err?.message || String(err) }), { status: 500, headers });
+  }
+}

package/server-edge-tracker/modules/ml/fraud.ts

@@ -0,0 +1,302 @@
+/**
+ * CDP Edge — Fraud Detection (Fase 4)
+ * checkFraudGate, logFraudSignal, handlers das rotas /api/fraud/*
+ */
+
+import { sha256, tryParseJson } from '../utils.js';
+import { Env, TrackPayload } from '../../types.js';
+
+// ── Tipos ───────────────────────────────────────────────────────────────────────
+export interface FraudResult {
+  allowed: boolean;
+  score: number;
+  reasons: string[];
+  action: 'allowed' | 'flagged' | 'dropped';
+}
+
+export const DATACENTER_PATTERNS = /amazon|google|microsoft|digitalocean|linode|ovh|vultr|hetzner|contabo|cloudflare|packet|rackspace|leaseweb/i;
+
+// ── checkFraudGate — roda ANTES de qualquer processamento de evento ────────────
+// Retorna { allowed, score, reasons, action }
+// Falhas no gate = fail-safe (deixa passar)
+export async function checkFraudGate(env: Env, request: Request, payload: TrackPayload): Promise<FraudResult> {
+  const result: FraudResult = { allowed: true, score: 0, reasons: [], action: 'allowed' };
+
+  try {
+    const ip          = request.headers.get('CF-Connecting-IP') || '';
+    const ua          = request.headers.get('User-Agent')        || '';
+    const fingerprint = (payload as any).fingerprint                       || '';
+    const email       = payload.email                             || '';
+    const botScore    = parseInt(String(payload.botScore || (payload as any).bot_score || 0));
+    const asn         = String((request as any).cf?.asOrganization || '').toLowerCase();
+    const country     = ((request as any).cf?.country || '').toUpperCase();
+    const acceptLang  = request.headers.get('Accept-Language');
+
+    // 1. KV blocklist check — instantâneo (~0ms)
+    if (env.GEO_CACHE && ip) {
+      const ipBlocked = await env.GEO_CACHE.get(`fraud_block:ip:${ip}`);
+      if (ipBlocked) {
+        return { allowed: false, score: 100, reasons: ['ip_blocklisted'], action: 'dropped' };
+      }
+    }
+    if (env.GEO_CACHE && fingerprint) {
+      const fpBlocked = await env.GEO_CACHE.get(`fraud_block:fp:${fingerprint}`);
+      if (fpBlocked) {
+        return { allowed: false, score: 100, reasons: ['fingerprint_blocklisted'], action: 'dropped' };
+      }
+    }
+
+    // 2. Bot score
+    if (botScore >= 3) { result.score += 60; result.reasons.push('bot_score_high'); }
+    else if (botScore === 2) { result.score += 30; result.reasons.push('bot_score_medium'); }
+
+    // 3. User-Agent suspeito
+    if (/headless|phantomjs|selenium|webdriver|curl|python|scrapy|bot|crawler|spider/i.test(ua)) {
+      result.score += 40; result.reasons.push('suspicious_user_agent');
+    }
+
+    // 4. Datacenter IP
+    if (ip && DATACENTER_PATTERNS.test(asn)) {
+      result.score += 35; result.reasons.push('datacenter_ip');
+    }
+
+    // 5. Sem Accept-Language
+    if (!acceptLang) {
+      result.score += 20; result.reasons.push('no_accept_language');
+    }
+
+    // 6. Velocity check via KV
+    if (env.GEO_CACHE && ip) {
+      const velKey1h = `fraud_velocity:${ip}:h`;
+      const velStr   = await env.GEO_CACHE.get(velKey1h);
+      const vel1h    = parseInt(velStr || '0') + 1;
+
+      await env.GEO_CACHE.put(velKey1h, String(vel1h), { expirationTtl: 3600 });
+
+      if (vel1h > 20) { result.score += 50; result.reasons.push('ip_velocity_very_high'); }
+      else if (vel1h > 10) { result.score += 25; result.reasons.push('ip_velocity_high'); }
+    }
+
+    result.score = Math.min(100, result.score);
+
+    // 8. Decisão final
+    if (result.score >= 80) {
+      result.allowed = false;
+      result.action  = 'dropped';
+    } else if (result.score >= 40) {
+      result.action = 'flagged';
+    }
+
+    return result;
+
+  } catch (err: any) {
+    console.error('[Fraud] checkFraudGate error:', err?.message || String(err));
+    return { allowed: true, score: 0, reasons: ['gate_error_fallback'], action: 'allowed' };
+  }
+}
+
+// ── logFraudSignal — persiste no D1 em background ────────────────────────────
+export async function logFraudSignal(env: Env, request: Request, payload: TrackPayload, fraudResult: FraudResult): Promise<void> {
+  if (!env.DB || fraudResult.action === 'allowed') return;
+  try {
+    const ip          = request.headers.get('CF-Connecting-IP') || '';
+    const ua          = request.headers.get('User-Agent')        || '';
+    const fingerprint = (payload as any).fingerprint                       || '';
+    const botScore    = parseInt(String(payload.botScore || (payload as any).bot_score || 0));
+    const asn         = String((request as any).cf?.asOrganization || '');
+    const country     = (request as any).cf?.country              || '';
+    const velKey1h    = `fraud_velocity:${ip}:h`;
+    const vel1h       = env.GEO_CACHE ? parseInt(await env.GEO_CACHE.get(velKey1h) || '0') : 0;
+
+    let emailHash = null;
+    if (payload.email) {
+      try {
+        emailHash = await sha256(payload.email.trim().toLowerCase());
+      } catch (err: any) {
+        console.error('[Fraud] Error generating email hash:', {
+          email: payload.email,
+          error: err?.message || String(err),
+          stack: err?.stack,
+        });
+      }
+    }
+
+    await env.DB.prepare(`
+      INSERT INTO fraud_signals (
+        ip_address, fingerprint, user_id, email_hash, event_name, event_id,
+        fraud_score, action_taken, reasons,
+        ip_country, ip_asn, user_agent, bot_score, velocity_1h, detected_at
+      ) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,datetime('now'))
+    `).bind(
+      ip, fingerprint || null, payload.userId || null, emailHash,
+      payload.eventName || null, payload.eventId || null,
+      fraudResult.score, fraudResult.action, JSON.stringify(fraudResult.reasons),
+      country, asn, ua.substring(0, 255), botScore, vel1h,
+    ).run();
+
+    if (fraudResult.action === 'dropped' && ip) {
+      await env.DB.prepare(`
+        INSERT INTO fraud_alerts (alert_type, entity_type, entity_value, events_total, events_dropped, peak_score, first_seen, last_seen, top_reasons)
+        VALUES ('ip_attack', 'ip', ?, 1, 1, ?, datetime('now'), datetime('now'), ?)
+        ON CONFLICT(entity_type, entity_value) DO UPDATE SET
+          events_total   = events_total + 1,
+          events_dropped = events_dropped + 1,
+          peak_score     = MAX(peak_score, excluded.peak_score),
+          last_seen      = datetime('now'),
+          updated_at     = datetime('now')
+      `).bind(ip, fraudResult.score, JSON.stringify(fraudResult.reasons)).run().catch(() => {});
+    }
+  } catch (err: any) {
+    console.error('[Fraud] logFraudSignal error:', err?.message || String(err));
+  }
+}
+
+// ── GET /api/fraud/alerts ─────────────────────────────────────────────────────
+export async function handleFraudAlerts(env: Env, request: Request, headers: Headers): Promise<Response> {
+  if (!env.DB) return new Response(JSON.stringify({ error: 'DB não configurado' }), { status: 503, headers });
+
+  const url    = new URL(request.url);
+  const action = url.searchParams.get('action') || null;
+  const hours  = parseInt(url.searchParams.get('hours') || '24');
+  const limit  = Math.min(parseInt(url.searchParams.get('limit') || '50'), 200);
+
+  try {
+    const cond     = action ? 'AND action_taken = ?' : '';
+    const bindings = action ? [hours, action, limit] : [hours, limit];
+
+    const result = await env.DB.prepare(`
+      SELECT ip_address, fingerprint, event_name, fraud_score, action_taken,
+             reasons, ip_country, ip_asn, bot_score, velocity_1h, detected_at
+      FROM fraud_signals
+      WHERE detected_at >= datetime('now', '-' || ? || ' hours')
+        ${cond}
+      ORDER BY fraud_score DESC, detected_at DESC
+      LIMIT ?
+    `).bind(...bindings).all();
+
+    const signals = (result.results || []).map((s: any) => ({ ...s, reasons: tryParseJson(s.reasons, []) }));
+    const stats = await env.DB.prepare(`SELECT * FROM v_fraud_dashboard`).first().catch(() => null);
+
+    return new Response(JSON.stringify({ success: true, period_hours: hours, total: signals.length, stats, alerts: signals }), { status: 200, headers });
+  } catch (err: any) {
+    console.error('[Fraud] alerts error:', err?.message || String(err));
+    return new Response(JSON.stringify({ error: err?.message || String(err) }), { status: 500, headers });
+  }
+}
+
+// ── GET /api/fraud/blocklist ──────────────────────────────────────────────────
+export async function handleFraudBlocklist(env: Env, request: Request, headers: Headers): Promise<Response> {
+  if (!env.DB) return new Response(JSON.stringify({ error: 'DB não configurado' }), { status: 503, headers });
+
+  try {
+    const result = await env.DB.prepare(`
+      SELECT entity_type, entity_value, events_total, events_dropped,
+             peak_score, first_seen, last_seen, blocked_at, block_expires, top_reasons
+      FROM fraud_alerts WHERE is_blocked = 1 ORDER BY events_dropped DESC LIMIT 100
+    `).all();
+
+    const blocklist = (result.results || []).map((r: any) => ({ ...r, top_reasons: tryParseJson(r.top_reasons, []) }));
+    return new Response(JSON.stringify({ success: true, total: blocklist.length, blocklist }), { status: 200, headers });
+  } catch (err: any) {
+    console.error('[Fraud] blocklist error:', err?.message || String(err));
+    return new Response(JSON.stringify({ error: err?.message || String(err) }), { status: 500, headers });
+  }
+}
+
+// ── POST /api/fraud/blocklist/add ─────────────────────────────────────────────
+export async function handleFraudBlocklistAdd(env: Env, request: Request, headers: Headers): Promise<Response> {
+  if (!env.DB) return new Response(JSON.stringify({ error: 'DB não configurado' }), { status: 503, headers });
+
+  let body: any;
+  try { body = await request.json(); }
+  catch { return new Response(JSON.stringify({ error: 'JSON inválido' }), { status: 400, headers }); }
+
+  const { entity_type, entity_value, ttl_hours = 24, reason = 'manual_block' } = body;
+  if (!entity_type || !entity_value) {
+    return new Response(JSON.stringify({ error: 'entity_type (ip|fingerprint) e entity_value são obrigatórios' }), { status: 400, headers });
+  }
+  if (!['ip', 'fingerprint'].includes(entity_type)) {
+    return new Response(JSON.stringify({ error: 'entity_type deve ser: ip ou fingerprint' }), { status: 400, headers });
+  }
+
+  try {
+    const kvKey    = `fraud_block:${entity_type}:${entity_value}`;
+    const ttlSec   = Math.min(ttl_hours * 3600, 7 * 24 * 3600);
+    const expiresAt = new Date(Date.now() + ttlSec * 1000).toISOString();
+
+    if (env.GEO_CACHE) {
+      await env.GEO_CACHE.put(kvKey, JSON.stringify({ reason, blocked_at: new Date().toISOString() }), { expirationTtl: ttlSec });
+    }
+
+    await env.DB.prepare(`
+      INSERT INTO fraud_alerts (alert_type, entity_type, entity_value, events_total, events_dropped, peak_score, first_seen, last_seen, is_blocked, blocked_at, block_expires, top_reasons)
+      VALUES ('manual', ?, ?, 0, 0, 100, datetime('now'), datetime('now'), 1, datetime('now'), ?, ?)
+      ON CONFLICT DO UPDATE SET is_blocked = 1, blocked_at = datetime('now'), block_expires = excluded.block_expires, updated_at = datetime('now')
+    `).bind(entity_type, entity_value, expiresAt, JSON.stringify([reason])).run().catch(() => {});
+
+    return new Response(JSON.stringify({
+      success: true, entity_type, entity_value, kv_key: kvKey, ttl_hours, expires_at: expiresAt,
+      message: `${entity_type} '${entity_value}' bloqueado por ${ttl_hours}h. Efeito imediato via KV.`,
+    }), { status: 200, headers });
+  } catch (err: any) {
+    console.error('[Fraud] blocklist add error:', err?.message || String(err));
+    return new Response(JSON.stringify({ error: err?.message || String(err) }), { status: 500, headers });
+  }
+}
+
+// ── DELETE /api/fraud/blocklist/remove ───────────────────────────────────────
+export async function handleFraudBlocklistRemove(env: Env, request: Request, headers: Headers): Promise<Response> {
+  if (!env.DB) return new Response(JSON.stringify({ error: 'DB não configurado' }), { status: 503, headers });
+
+  let body: any;
+  try { body = await request.json(); }
+  catch { return new Response(JSON.stringify({ error: 'JSON inválido' }), { status: 400, headers }); }
+
+  const { entity_type, entity_value } = body;
+  if (!entity_type || !entity_value) {
+    return new Response(JSON.stringify({ error: 'entity_type e entity_value são obrigatórios' }), { status: 400, headers });
+  }
+
+  try {
+    const kvKey = `fraud_block:${entity_type}:${entity_value}`;
+    if (env.GEO_CACHE) await env.GEO_CACHE.delete(kvKey);
+    await env.DB.prepare(`UPDATE fraud_alerts SET is_blocked = 0, resolved_at = datetime('now'), resolved_by = 'manual' WHERE entity_type = ? AND entity_value = ?`).bind(entity_type, entity_value).run();
+
+    return new Response(JSON.stringify({
+      success: true, entity_type, entity_value,
+      message: `${entity_type} '${entity_value}' removido do blocklist. Efeito imediato via KV.`,
+    }), { status: 200, headers });
+  } catch (err: any) {
+    console.error('[Fraud] blocklist remove error:', err?.message || String(err));
+    return new Response(JSON.stringify({ error: err?.message || String(err) }), { status: 500, headers });
+  }
+}
+
+// ── GET /api/fraud/stats ──────────────────────────────────────────────────────
+export async function handleFraudStats(env: Env, request: Request, headers: Headers): Promise<Response> {
+  if (!env.DB) return new Response(JSON.stringify({ error: 'DB não configurado' }), { status: 503, headers });
+
+  try {
+    const dashboard  = await env.DB.prepare(`SELECT * FROM v_fraud_dashboard`).first();
+    const topIps     = await env.DB.prepare(`
+      SELECT ip_address, COUNT(*) as events, MAX(fraud_score) as peak_score
+      FROM fraud_signals
+      WHERE detected_at >= datetime('now', '-24 hours') AND action_taken = 'dropped'
+      GROUP BY ip_address ORDER BY events DESC LIMIT 10
+    `).all();
+    const topReasons = await env.DB.prepare(`
+      SELECT action_taken, COUNT(*) as count FROM fraud_signals
+      WHERE detected_at >= datetime('now', '-24 hours')
+      GROUP BY action_taken
+    `).all();
+
+    return new Response(JSON.stringify({
+      success: true, period: '24h', dashboard,
+      top_attacking_ips: topIps.results || [],
+      by_action: topReasons.results || [],
+    }), { status: 200, headers });
+  } catch (err: any) {
+    console.error('[Fraud] stats error:', err?.message || String(err));
+    return new Response(JSON.stringify({ error: err?.message || String(err) }), { status: 500, headers });
+  }
+}