@nodefony/http 10.0.0-alpha.9 → 10.0.0-beta.1

package/dist/nodefony/src/context/http/Request.js

@@ -2,7 +2,7 @@ import HttpError from "../../errors/httpError.js";
 import { hasForwardingHeaders, resolveForwarded } from "../forwarded.js";
 import { Parser, ParserJson, ParserQs, ParserXml, acceptParser } from "./parser.js";
 import { isCanonicalAuthority, splitTarget } from "./urlFastPath.js";
-import { extend } from "nodefony";
+import { RequestContext, extend, useConfig } from "nodefony";
 import { createHash, randomUUID } from "node:crypto";
 import { URL } from "node:url";
 import fs from "node:fs";
@@ -39,6 +39,14 @@ const parse = {
 	PATCH: true,
 	DELETE: true
 };
+/**
+* La méthode porte-t-elle un corps à lire ? La règle a UNE implémentation : le
+* choix « lire le corps » (`parseRequest`) et le choix « rien à attendre »
+* (`initialize`) la lisent tous deux ici.
+*/
+function hasRequestBody(method) {
+	return method in parse;
+}
 const PERF_PROBE_SUB = process.env.NF_PERF_PROBE === "1";
 function perfMark(field) {
 	const p = globalThis.__nfPerfProbe;
@@ -129,12 +137,12 @@ var HttpRequest = class {
 	#acceptHtml = null;
 	/** Media-ranges de l'en-tête `Accept`, parsés au premier accès (mémoïsé). */
 	get accept() {
-		if (this.#accept === null) this.#accept = acceptParser(this.headers?.accept);
+		this.#accept ??= acceptParser(this.headers.accept);
 		return this.#accept;
 	}
 	/** `true` si le client accepte `text/html` — résolu au premier accès (mémoïsé). */
 	get acceptHtml() {
-		if (this.#acceptHtml === null) this.#acceptHtml = this.accepts("html");
+		this.#acceptHtml ??= this.accepts("html");
 		return this.#acceptHtml;
 	}
 	origin;
@@ -147,8 +155,8 @@ var HttpRequest = class {
 		this.request.body = null;
 		this.headers = request.headers;
 		this.origin = this.headers.origin;
-		const checker = this.context?.httpKernel?.getTrustProxyChecker();
-		const socketAddress = this.request.socket?.remoteAddress;
+		const checker = this.context.httpKernel?.getTrustProxyChecker();
+		const socketAddress = this.request.socket.remoteAddress;
 		this.trustedProxy = !!checker?.isTrusted(socketAddress);
 		if (this.trustedProxy && checker && hasForwardingHeaders(this.headers)) this.forwarded = resolveForwarded(this.headers, socketAddress, checker);
 		if (PERF_PROBE_SUB) perfMark("reqProxyNs");
@@ -167,11 +175,9 @@ var HttpRequest = class {
 			this.search = u.search;
 		}
 		if (PERF_PROBE_SUB) perfMark("reqUrlNs");
-		this.queryStringOptions = this.context?.httpKernel?.module.options.queryString || {};
-		this.uploadOption = this.context?.httpKernel?.module.options.upload || {};
-		this.maxBodySize = this.context?.httpKernel?.module.options.maxBodySize ?? 0;
+		this.queryStringOptions = this.context.httpKernel?.module.options.queryString || {};
 		let query;
-		if (this.search) query = QS.parse(this.search.slice(1), this.queryStringOptions || {});
+		if (this.search) query = QS.parse(this.search.slice(1), this.queryStringOptions ?? {});
 		else query = {};
 		if (this.#url !== null) this.#url.query = query;
 		this.queryGet = query;
@@ -198,32 +204,64 @@ var HttpRequest = class {
 		if (this.context.listenerCount("onRequestEnd") === 0) return false;
 		return this.context.fireAsync("onRequestEnd", this);
 	}
-	async initialize() {
+	/**
+	* Lit le corps de la requête, s'il y en a un, puis émet `onRequestEnd`.
+	*
+	* Le contrat de retour dit ce qui reste à ATTENDRE :
+	* - `undefined` — la méthode ne porte pas de corps (GET, HEAD, OPTIONS…) et
+	*   aucun écouteur `onRequestEnd` ne rend de promesse : tout est fait, de
+	*   façon SYNCHRONE ;
+	* - une `Promise` — le corps arrive du socket (POST, PUT, PATCH, DELETE), ou
+	*   un écouteur `onRequestEnd` est à attendre. Sa valeur n'est consommée par
+	*   personne : elle ne sert qu'au séquençage.
+	*
+	* L'appelant n'attend donc que ce qui attend vraiment
+	* (`const pending = request.initialize(); if (pending) await pending;`) : un
+	* `await` inconditionnel reportait le pipeline d'une micro-tâche, et la
+	* chaîne de promesses coûtait ~6 évènements asynchrones à un GET qui n'avait
+	* rien à lire (#505).
+	*
+	* Ne lève jamais de façon synchrone : un corps refusé (413) ou illisible rompt
+	* la promesse rendue, comme avant.
+	*
+	* @returns `undefined` quand tout est fait, sinon la promesse à attendre.
+	*/
+	initialize() {
+		if (!hasRequestBody(this.method)) return this.endWithoutBody();
 		return this.parseRequest().then(async (parser) => {
-			switch (true) {
-				case parser instanceof ParserXml:
-				case parser instanceof ParserQs:
-				case parser instanceof Parser: try {
+			if (parser instanceof ParserXml || parser instanceof ParserQs || parser instanceof Parser) {
+				let requestEnd;
+				try {
 					if (this.context.finished) return;
 					await parser.parse();
-					return this.fireRequestEnd();
-				} catch (error) {
-					return this.context?.httpKernel?.onError(error, this.context);
-				}
-				default: if (!parser) try {
-					if (this.context.finished) return;
-					this.context.requestEnded = true;
-					return this.fireRequestEnd();
+					requestEnd = this.fireRequestEnd();
 				} catch (error) {
 					return this.context.httpKernel?.onError(error, this.context);
 				}
+				return requestEnd;
 			}
+			if (!parser) return this.endWithoutBody();
 			return parser;
-		}).catch((e) => {
-			throw e;
 		});
 	}
 	/**
+	* Fin d'une requête SANS corps à lire : la marque terminée et émet
+	* `onRequestEnd`. Synchrone — ne rend une promesse que lorsqu'un écouteur
+	* `onRequestEnd` est à attendre, ou quand l'émission lève (celle d'`onError`).
+	*
+	* @returns `undefined` quand tout est fait, sinon la promesse à attendre.
+	*/
+	endWithoutBody() {
+		if (this.context.finished) return;
+		try {
+			this.context.requestEnded = true;
+			const requestEnd = this.fireRequestEnd();
+			return requestEnd === false ? void 0 : requestEnd;
+		} catch (error) {
+			return this.context.httpKernel?.onError(error, this.context);
+		}
+	}
+	/**
 	* B1 — Pré-contrôle de taille du corps via l'en-tête `Content-Length` :
 	* rejette en 413 (RFC 9110 §15.5.14 « Content Too Large ») AVANT toute lecture
 	* quand le client annonce une taille supérieure à `maxBodySize`. Rideau de
@@ -232,16 +270,28 @@ var HttpRequest = class {
 	*
 	* @throws {HttpError} 413 si `Content-Length` dépasse `maxBodySize`.
 	*/
+	/**
+	* Lit le plafond du corps et les limites d'envoi tels que les voit CETTE
+	* requête : la configuration http, surchargée par le calque que la requête a
+	* pu poser avant la lecture du corps (`overlayConfig`, #494). Hors pipeline
+	* (aucun scope ouvert), la configuration du module telle quelle.
+	*/
+	readBodyLimits() {
+		const options = RequestContext.getScope() !== void 0 ? useConfig("@nodefony/http") : this.context.httpKernel?.module.options;
+		this.uploadOption = options?.upload ?? {};
+		this.maxBodySize = options?.maxBodySize ?? 0;
+	}
 	enforceBodyLimit() {
 		const max = this.maxBodySize;
 		if (max <= 0) return;
 		const cl = this.headers["content-length"];
 		if (cl === void 0) return;
-		const declared = parseInt(Array.isArray(cl) ? cl[0] : cl, 10);
+		const declared = parseInt(typeof cl === "string" ? cl : cl[0], 10);
 		if (Number.isFinite(declared) && declared > max) throw new HttpError(`Request body too large: ${declared} bytes > maxBodySize ${max}`, 413, this.context);
 	}
 	async parseRequest() {
-		if (!(this.method in parse)) return this.parser;
+		if (!hasRequestBody(this.method)) return this.parser;
+		this.readBodyLimits();
 		if (this.contentType !== "multipart/form-data") this.enforceBodyLimit();
 		switch (this.contentType) {
 			case "application/xml":
@@ -349,8 +399,7 @@ var HttpRequest = class {
 					stream.resume();
 					return;
 				}
-				const match = reg.exec(fieldname);
-				const field = match ? match[1] : fieldname;
+				const field = reg.exec(fieldname)?.[1] ?? fieldname;
 				const ext = filename ? path.extname(filename) : "";
 				const newFilename = `${randomUUID()}${ext}`;
 				const filepath = path.join(dir, newFilename);
@@ -415,7 +464,7 @@ var HttpRequest = class {
 	*/
 	assignField(fields, name, value) {
 		const match = reg.exec(name);
-		const key = match ? match[1] : name;
+		const key = match?.[1] ?? name;
 		if (key in fields) {
 			const cur = fields[key];
 			if (Array.isArray(cur)) cur.push(value);
@@ -427,7 +476,7 @@ var HttpRequest = class {
 		let subtype = "*";
 		let type = "*";
 		if (Type) parts = Type.split("/");
-		if (parts) switch (parts.length) {
+		switch (parts.length) {
 			case 1:
 				subtype = parts.shift();
 				break;
@@ -437,10 +486,7 @@ var HttpRequest = class {
 				break;
 			default: throw new Error("request accepts method bad type format");
 		}
-		for (let i = 0; i < this.accept.length; i++) {
-			const line = this.accept[i];
-			if ((type === "*" || line.type.test(type)) && (subtype === "*" || line.subtype.test(subtype))) return true;
-		}
+		for (const line of this.accept) if ((type === "*" || line.type.test(type)) && (subtype === "*" || line.subtype.test(subtype))) return true;
 		return false;
 	}
 	async createFileUpload(name, file) {
@@ -454,12 +500,15 @@ var HttpRequest = class {
 	getContentType(request) {
 		if (request.headers["content-type"]) {
 			const tab = request.headers["content-type"].split(";");
-			if (tab.length > 1) for (let i = 1; i < tab.length; i++) if (typeof tab[i] === "string") {
-				const ele = tab[i].split("=");
-				const key = ele[0].replace(/\s+/g, "").toLowerCase();
-				this.rawContentType[key] = ele[1];
-			} else continue;
-			return tab[0];
+			if (tab.length > 1) for (let i = 1; i < tab.length; i++) {
+				const part = tab[i];
+				if (typeof part === "string") {
+					const [rawKey = "", value] = part.split("=");
+					const key = rawKey.replace(/\s+/g, "").toLowerCase();
+					this.rawContentType[key] = value;
+				} else continue;
+			}
+			return tab[0] ?? null;
 		}
 		return null;
 	}
@@ -485,8 +534,8 @@ var HttpRequest = class {
 	}
 	getHostName(host) {
 		if (this.#url?.hostname) return this.#url.hostname;
-		if (host) return host.split(":")[0];
-		if (host = this.getHost()) return host.split(":")[0];
+		if (host) return host.split(":")[0] ?? "";
+		if (host = this.getHost()) return host.split(":")[0] ?? "";
 		return "";
 	}
 	getHost() {
@@ -494,7 +543,7 @@ var HttpRequest = class {
 	}
 	getRemoteAddress() {
 		if (this.forwarded) return this.forwarded.clientIp;
-		return this.request.socket?.remoteAddress ?? null;
+		return this.request.socket.remoteAddress ?? null;
 	}
 	/**
 	* Request-target brut (origin-form) tel que reçu du transport — SOURCE
@@ -511,7 +560,7 @@ var HttpRequest = class {
 	*/
 	resolveScheme(request) {
 		if (this.forwarded?.proto) return this.forwarded.proto;
-		if ("encrypted" in request.socket && request.socket.encrypted) return "https";
+		if (request.socket.encrypted) return "https";
 		return "http";
 	}
 	getFullUrl(request = this.request) {

package/dist/nodefony/src/context/http/Response.js

@@ -1,5 +1,5 @@
 import Cookie from "../../cookies/cookie.js";
-import { typeOf } from "nodefony";
+import { thenMaybe, typeOf } from "nodefony";
 import http from "node:http";
 import mime from "mime-types";
 //#region nodefony/src/context/http/Response.ts
@@ -14,11 +14,6 @@ const REDIRECT_STATUS_CODES = /* @__PURE__ */ new Set([
 	307,
 	308
 ]);
-const NO_CONTENT_LENGTH_METHODS = /* @__PURE__ */ new Set([
-	"HEAD",
-	"OPTIONS",
-	"TRACE"
-]);
 const NO_CONTENT_LENGTH_STATUS = /* @__PURE__ */ new Set([204, 304]);
 var HttpResponse = class {
 	context;
@@ -27,7 +22,9 @@ var HttpResponse = class {
 	statusMessage = "";
 	flushing = false;
 	encoding = "utf-8";
-	body = null;
+	#text = null;
+	#textEncoding = "utf-8";
+	#buffer = null;
 	contentType = "application/octet-stream";
 	headers = {};
 	timeout;
@@ -35,7 +32,7 @@ var HttpResponse = class {
 	constructor(response, context) {
 		this.context = context;
 		this.response = response;
-		this.timeout = this.context?.httpKernel?.responseTimeout[this.context.type];
+		this.timeout = this.context.httpKernel?.responseTimeout[this.context.type];
 	}
 	/**
 	* Filet posé juste avant l'émission des en-têtes : si aucun `Content-Type`
@@ -46,6 +43,33 @@ var HttpResponse = class {
 	ensureContentTypeHeader() {
 		if (this.response && !this.response.hasHeader("content-type")) this.response.setHeader("content-type", this.contentType);
 	}
+	/**
+	* Corps de la réponse en octets. Un corps posé en texte n'est encodé qu'à la
+	* première lecture de cette propriété — l'envoi, lui, écrit le texte tel quel.
+	*/
+	get body() {
+		if (this.#text !== null) {
+			this.#buffer = Buffer.from(this.#text, this.#textEncoding);
+			this.#text = null;
+		}
+		return this.#buffer;
+	}
+	set body(value) {
+		this.#text = null;
+		this.#buffer = value;
+	}
+	/**
+	* Corps tel qu'il part sur le fil : le texte s'il n'a jamais été encodé, sinon
+	* les octets — vide légal si rien n'a été posé (`write(null)` jetterait
+	* ERR_STREAM_NULL_VALUES).
+	*/
+	get payload() {
+		return this.#text ?? this.#buffer ?? "";
+	}
+	/** Encodage à passer avec {@link payload} (ignoré par Node pour des octets). */
+	get payloadEncoding() {
+		return this.#text !== null ? this.#textEncoding : this.encoding;
+	}
 	clean() {
 		this.response = null;
 		this.body = null;
@@ -68,7 +92,7 @@ var HttpResponse = class {
 	}
 	deleteCookie(cookie) {
 		if (cookie instanceof Cookie) {
-			if (this.cookies[cookie.name]) {
+			if (Object.hasOwn(this.cookies, cookie.name)) {
 				delete this.cookies[cookie.name];
 				return true;
 			}
@@ -77,19 +101,20 @@ var HttpResponse = class {
 		throw new Error("Response delCookie not valid cookies");
 	}
 	deleteCookieByName(name) {
-		if (this.cookies[name]) {
+		if (Object.hasOwn(this.cookies, name)) {
 			delete this.cookies[name];
 			return true;
 		}
 		return false;
 	}
 	setCookies() {
-		const names = Object.keys(this.cookies);
-		if (names.length === 0) return;
-		if (names.length === 1) return this.setCookie(this.cookies[names[0]]);
+		const cookies = Object.values(this.cookies);
+		const first = cookies.at(0);
+		if (first === void 0) return;
+		if (cookies.length === 1) return this.setCookie(first);
 		const serialized = [];
-		for (const name of names) {
-			const s = this.cookies[name].serialize();
+		for (const cookie of cookies) {
+			const s = cookie.serialize();
 			this.log(`ADD COOKIE ==> ${s}`, "DEBUG");
 			serialized.push(s);
 		}
@@ -105,7 +130,8 @@ var HttpResponse = class {
 			if (this.flushing) {
 				const obj = {};
 				obj[name] = value;
-				return this.addTrailers(obj);
+				this.addTrailers(obj);
+				return;
 			}
 			if (!this.response.headersSent) {
 				const lower = name.toLowerCase();
@@ -125,7 +151,7 @@ var HttpResponse = class {
 	*/
 	#mergeVary(value) {
 		const incoming = (Array.isArray(value) ? value.join(",") : String(value)).split(",").map((t) => t.trim()).filter(Boolean);
-		const current = this.response?.getHeader?.("vary");
+		const current = this.response?.getHeader("vary");
 		const all = [...(Array.isArray(current) ? current.join(",") : String(current ?? "")).split(",").map((t) => t.trim()).filter(Boolean), ...incoming];
 		if (all.some((t) => t === "*")) return "*";
 		const seen = /* @__PURE__ */ new Set();
@@ -151,9 +177,9 @@ var HttpResponse = class {
 	}
 	setContentType(type, encoding) {
 		if (type && encoding) {
-			let mytype = mime.contentType(type);
-			if (mytype) {
-				mytype = mytype.split(";")[0];
+			const full = mime.contentType(type);
+			if (full) {
+				const mytype = full.split(";")[0] ?? full;
 				this.contentType = mytype;
 				this.encoding = encoding;
 				if (mytype === "application/json" || mytype.endsWith("+json")) return this.setHeader("Content-Type", mytype);
@@ -230,30 +256,45 @@ var HttpResponse = class {
 		if (this.response) return this.statusMessage || this.response.statusMessage || http.STATUS_CODES[this.statusCode];
 		return this.statusMessage || http.STATUS_CODES[this.statusCode];
 	}
+	/**
+	* Pose le corps de la réponse : texte gardé tel quel, octets copiés sur leur
+	* seule fenêtre, tout autre valeur sérialisée en JSON.
+	*
+	* @param ele - corps à envoyer.
+	* @param encoding - encodage d'un corps texte (défaut : `this.encoding`).
+	*/
 	setBody(ele, encoding) {
-		if (typeof ele === "string") this.body = Buffer.from(ele, encoding || this.encoding);
+		if (typeof ele === "string") this.#setText(ele, encoding || this.encoding);
 		else if (ele instanceof ArrayBuffer || ele instanceof SharedArrayBuffer) this.body = Buffer.from(ele);
 		else if (ArrayBuffer.isView(ele) && ele.buffer instanceof ArrayBuffer) this.body = Buffer.from(ele.buffer, ele.byteOffset, ele.byteLength);
-		else try {
-			this.body = Buffer.from(JSON.stringify(ele));
-		} catch (e) {
-			this.body = Buffer.from(String(ele));
+		else {
+			let text;
+			try {
+				text = JSON.stringify(ele);
+			} catch {
+				text = String(ele);
+			}
+			this.#setText(text, "utf-8");
 		}
-		return this.body;
+	}
+	#setText(text, encoding) {
+		this.#buffer = null;
+		this.#text = text;
+		this.#textEncoding = encoding;
 	}
 	setLength(body) {
 		if (this.response?.headersSent) throw new Error("Headers already sended");
-		const actualBody = body || this.body;
-		const isChunked = this.getHeader("Transfer-Encoding") === "chunked";
-		if (!NO_CONTENT_LENGTH_METHODS.has(this.context?.method) && !NO_CONTENT_LENGTH_STATUS.has(this.statusCode) && !isChunked) {
-			if (actualBody) {
-				const length = Buffer.byteLength(actualBody);
-				this.setHeader("Content-Length", String(length));
-				return length;
-			}
+		if (this.getHeader("Transfer-Encoding") === "chunked") {
+			this.response?.removeHeader("Content-Length");
 			return 0;
 		}
-		if (!NO_CONTENT_LENGTH_STATUS.has(this.statusCode)) this.setHeader("Content-Length", "0");
+		if (NO_CONTENT_LENGTH_STATUS.has(this.statusCode)) return 0;
+		const actualBody = body || this.#text || this.#buffer;
+		if (actualBody) {
+			const length = typeof actualBody === "string" && actualBody === this.#text ? Buffer.byteLength(actualBody, this.#textEncoding) : Buffer.byteLength(actualBody);
+			this.setHeader("Content-Length", String(length));
+			return length;
+		}
 		return 0;
 	}
 	writeHead(statusCode, headers) {
@@ -264,8 +305,8 @@ var HttpResponse = class {
 				if (this.statusCode > 599) this.statusCode = 500;
 			}
 			this.statusMessage = this.getStatusMessage();
-			if (this.context.requestId && !this.response.headersSent) this.response.setHeader("x-request-id", this.context.requestId);
-			if (this.context.traceparent && !this.response.headersSent) this.response.setHeader("traceparent", this.context.traceparent);
+			if (this.context.requestId) this.response.setHeader("x-request-id", this.context.requestId);
+			if (this.context.traceparent) this.response.setHeader("traceparent", this.context.traceparent);
 			this.setLength();
 			this.ensureContentTypeHeader();
 			const std = http.STATUS_CODES[this.statusCode];
@@ -287,18 +328,29 @@ var HttpResponse = class {
 		this.setHeader("Transfer-Encoding", "chunked");
 		return this.send(chunk, encoding, true);
 	}
-	async send(chunk, encoding, _flush = false) {
+	/**
+	* Écrit le corps sur le flux et, pour une réponse unique, la termine.
+	*
+	* Synchrone pour une réponse unique ou une redirection : `end(corps)` est un
+	* appel synchrone de Node, rien n'y est à attendre (#505). Une promesse
+	* seulement en streaming chunké (`flush()`), réglée quand le flux accepte
+	* l'écriture suivante (`drain`) — c'est la contre-pression.
+	*
+	* @param chunk - le corps (posé par `setBody`) ; absent, le corps déjà posé.
+	* @param encoding - l'encodage d'un corps texte.
+	* @returns la réponse, ou sa promesse en streaming chunké.
+	* @throws de façon SYNCHRONE quand la réponse Node n'existe plus.
+	*/
+	send(chunk, encoding, _flush = false) {
 		if (this.context.isRedirect) {
 			if (!this.response?.headersSent) this.writeHead();
-			await this.end();
-			return this;
+			return thenMaybe(this.end(), () => this);
 		}
-		if (chunk) this.setBody(chunk);
+		if (chunk) this.setBody(chunk, encoding);
 		if (!this.response) throw new Error(`Http Response not found`);
-		if (this.body === null) this.body = Buffer.alloc(0);
 		const res = this.response;
 		if (!_flush && !this.flushing && !res.writableEnded) {
-			res.end(this.body, encoding || this.encoding);
+			res.end(this.payload, this.payloadEncoding);
 			return this;
 		}
 		return new Promise((resolve) => {
@@ -310,7 +362,7 @@ var HttpResponse = class {
 				}
 			};
 			const onDrain = () => done();
-			if (res.write(this.body, encoding || this.encoding, (error) => {
+			if (res.write(this.payload, this.payloadEncoding, (error) => {
 				if (error) {
 					this.log(error, "ERROR");
 					res.removeListener("drain", onDrain);
@@ -320,17 +372,21 @@ var HttpResponse = class {
 			else res.once("drain", onDrain);
 		});
 	}
-	async write(chunk, encoding) {
-		return await this.send(chunk, encoding || this.encoding);
+	write(chunk, encoding) {
+		return this.send(chunk, encoding || this.encoding);
 	}
 	writeContinue() {
 		return this.response?.writeContinue();
 	}
-	async end(chunk, encoding) {
-		return new Promise((resolve, reject) => {
-			if (this.response) return resolve(this.response.end(chunk, encoding || this.encoding));
-			return reject(/* @__PURE__ */ new Error(`response not found`));
-		});
+	/**
+	* Termine la réponse Node — un appel synchrone, rien n'y est à attendre (#505).
+	*
+	* @returns le flux terminé (valeur de `ServerResponse.end`).
+	* @throws de façon SYNCHRONE quand la réponse Node n'existe plus.
+	*/
+	end(chunk, encoding) {
+		if (!this.response) throw new Error(`response not found`);
+		return this.response.end(chunk, encoding || this.encoding);
 	}
 	getHeader(name) {
 		return this.response?.getHeader(name);

package/dist/nodefony/src/context/http/parser.js

@@ -19,7 +19,7 @@ var Parser = class {
 	}
 	write(buffer) {
 		if (this.aborted) return buffer;
-		const max = this.request.maxBodySize ?? 0;
+		const max = this.request.maxBodySize;
 		this.received += buffer.length;
 		if (max > 0 && this.received > max) {
 			this.aborted = true;
@@ -78,7 +78,7 @@ var ParserQs = class extends Parser {
 	charset = "utf8";
 	constructor(request) {
 		super(request);
-		this.parserOptions = this.request.queryStringOptions || {};
+		this.parserOptions = this.request.queryStringOptions ?? {};
 		this.charset = this.request.charset;
 	}
 	async parse() {
@@ -151,13 +151,15 @@ const ACCEPT_ANY = [{
 * corrige aussi la négociation (match du token ENTIER, pas d'une sous-chaîne).
 */
 const acceptMatcher = (token) => !token || token === "*" ? /.*/ : new RegExp(`^${escapeRegExp(token)}$`);
+/** Qualité `q` d'une entrée `Accept` : sa valeur si c'est un nombre fini, 1 sinon. */
+const qualityOf = (entry) => typeof entry.q === "number" && Number.isFinite(entry.q) ? entry.q : 1;
 const acceptParser = function(acc) {
 	if (!acc) return ACCEPT_ANY;
 	const arr = [];
 	try {
 		const types = acc.split(",");
-		for (let i = 0; i < types.length; i++) {
-			const type = types[i].split(";");
+		for (const segment of types) {
+			const type = segment.split(";");
 			const mine = type.shift();
 			if (!mine) continue;
 			const dec = mine.trim().split("/");
@@ -167,8 +169,8 @@ const acceptParser = function(acc) {
 				type: acceptMatcher(ele1),
 				subtype: acceptMatcher(ele2)
 			};
-			for (let j = 0; j < type.length; j++) {
-				const params = type[j].split("=");
+			for (const param of type) {
+				const params = param.split("=");
 				const name = params.shift();
 				const value = params.shift();
 				obj[name] = name === "q" ? parseFloat(value) : value;
@@ -176,10 +178,7 @@ const acceptParser = function(acc) {
 			arr.push(obj);
 		}
 		if (arr.length === 0) return ACCEPT_ANY;
-		return arr.sort((a, b) => {
-			const qA = a.q || 1;
-			return (b.q || 1) - qA;
-		});
+		return arr.sort((a, b) => qualityOf(b) - qualityOf(a));
 	} catch {
 		return ACCEPT_ANY;
 	}

package/dist/nodefony/src/context/http/urlFastPath.js

@@ -81,8 +81,7 @@ function isCanonicalAuthority(host, scheme) {
 	}
 	const labels = name.split(".");
 	for (const label of labels) if (label.length === 0) return false;
-	const last = labels[labels.length - 1];
-	if (isDigits(last)) {
+	if (isDigits(labels.at(-1) ?? "")) {
 		if (labels.length !== 4) return false;
 		for (const label of labels) {
 			if (!isDigits(label) || label.length > 3) return false;