@nodefony/http 10.0.0-alpha.9 → 10.0.0-beta.1

package/dist/nodefony/src/context/http2/Response.js

@@ -1,20 +1,43 @@
 import HttpResponse from "../http/Response.js";
-import { extend } from "nodefony";
+import { thenMaybe } from "nodefony";
 import http from "node:http";
 import http2 from "node:http2";
 //#region nodefony/src/context/http2/Response.ts
 const HTTP2_HEADER_STATUS = http2.constants.HTTP2_HEADER_STATUS;
+/**
+* Compose les en-têtes d'une réponse HTTP/2 : ceux posés sur la réponse, puis
+* ceux passés à `writeHead`, qui gagnent.
+*
+* Les clés sont ramenées en MINUSCULES : `getHeaders()` rend `content-type`,
+* un contrôleur passe `Content-Type` — fusionnées telles quelles, les deux
+* clés partaient ensemble et `stream.respond()` refusait la réponse
+* (`ERR_HTTP2_HEADER_SINGLE_VALUE`), soit une 500 sur tout média servi en
+* HTTP/2. HTTP/2 n'a de toute façon que des noms en minuscules (RFC 9113 §8.2.1).
+*
+* @param statusMessage - message de statut, recopié en `x-status-message`
+* @param current - en-têtes déjà posés sur la réponse
+* @param extra - en-têtes passés à `writeHead` (objet, ou liste plate clé/valeur)
+* @returns les en-têtes à transmettre à `respond()`
+*/
+function mergeResponseHeaders(statusMessage, current, extra) {
+	const merged = { "x-status-message": statusMessage };
+	for (const key in current) merged[key.toLowerCase()] = current[key];
+	if (Array.isArray(extra)) for (let i = 0; i + 1 < extra.length; i += 2) merged[String(extra[i]).toLowerCase()] = extra[i + 1];
+	else if (extra) for (const key in extra) {
+		const value = extra[key];
+		if (value !== void 0) merged[key.toLowerCase()] = value;
+	}
+	return merged;
+}
 var Http2Response = class extends HttpResponse {
 	statusCode = 200;
 	stream = null;
 	streamId;
 	constructor(response, context) {
 		super(response, context);
-		if (response) {
-			this.stream = response.stream;
-			this.streamId = this.stream.id;
-		}
-		if (this.stream && this.stream.pushAllowed) this.context.pushAllowed = true;
+		this.stream = response.stream;
+		this.streamId = this.stream.id;
+		if (this.stream.pushAllowed) this.context.pushAllowed = true;
 	}
 	isHeaderSent() {
 		if (this.stream) return this.stream.headersSent;
@@ -35,7 +58,7 @@ var Http2Response = class extends HttpResponse {
 				this.statusMessage = this.getStatusMessage();
 				this.setLength();
 				this.ensureContentTypeHeader();
-				this.headers = extend(true, { "X-Status-Message": this.statusMessage }, this.getHeaders(), headers);
+				this.headers = mergeResponseHeaders(this.statusMessage, this.getHeaders(), headers);
 				this.headers[HTTP2_HEADER_STATUS] = this.statusCode;
 				const requestId = this.context.requestId;
 				if (requestId) this.headers["x-request-id"] = requestId;
@@ -45,39 +68,44 @@ var Http2Response = class extends HttpResponse {
 			} else this.log("Headers already sent !!", "WARNING");
 		} else return super.writeHead(statusCode, headers);
 	}
-	async send(chunk, encoding, _flush = false) {
+	/**
+	* Écrit le corps sur le flux HTTP/2. Synchrone pour une redirection, un flux
+	* fermé ou le repli HTTP/1 ; une promesse quand le corps est écrit sur le
+	* flux, réglée par le rappel d'écriture (#505).
+	*
+	* @returns la réponse, ou sa promesse.
+	*/
+	send(chunk, encoding, _flush = false) {
 		if (this.context.isRedirect) {
 			if (this.stream && !this.stream.headersSent) this.writeHead();
-			await this.end();
-			return this;
+			return thenMaybe(this.end(), () => this);
 		}
 		const stream = this.stream;
-		if (!stream) return await super.send(chunk, encoding);
+		if (!stream) return super.send(chunk, encoding);
 		if (stream.destroyed || !stream.writable) {
 			this.log("HTTP/2 stream not writable before send — skip", "DEBUG");
 			return this;
 		}
 		if (chunk) this.setBody(chunk);
-		if (this.body === null) this.body = Buffer.alloc(0);
 		return new Promise((resolve, reject) => {
-			stream.write(this.body, encoding || this.encoding, (error) => {
+			stream.write(this.payload, this.payloadEncoding, (error) => {
 				if (error) return reject(error);
 				return resolve(this);
 			});
 		});
 	}
+	/**
+	* Termine le flux HTTP/2 (ou la réponse de repli) — synchrone (#505).
+	*
+	* @returns le flux terminé.
+	* @throws de façon SYNCHRONE ce que lève la fin du flux.
+	*/
 	end(chunk, encoding) {
-		return new Promise((resolve, reject) => {
-			try {
-				if (this.stream) {
-					if (this.stream.destroyed || this.stream.closed) return resolve(this.stream);
-					return resolve(this.stream.end(chunk, encoding || this.encoding));
-				}
-				return resolve(super.end(chunk, encoding));
-			} catch (e) {
-				return reject(e);
-			}
-		});
+		if (this.stream) {
+			if (this.stream.destroyed || this.stream.closed) return this.stream;
+			return this.stream.end(chunk, encoding || this.encoding);
+		}
+		return super.end(chunk, encoding);
 	}
 	getStatusMessage(code) {
 		if (code) {
@@ -94,4 +122,4 @@ var Http2Response = class extends HttpResponse {
 	}
 };
 //#endregion
-export { Http2Response as default };
+export { Http2Response as default, mergeResponseHeaders };

package/dist/nodefony/src/context/metaData.js

@@ -31,7 +31,7 @@ function buildMetaData(target, src, override) {
 	nf.scheme = src.scheme;
 	nf.requestId = src.requestId;
 	const r = src.resolver;
-	nf.route = r && r.route ? {
+	nf.route = r?.route ? {
 		name: r.route.name,
 		path: r.route.path,
 		variablesMap: r.getMatchedParams()

package/dist/nodefony/src/context/trustProxy.js

@@ -54,7 +54,8 @@ const TRUST_NONE = { isTrusted: () => false };
 function addEntry(list, raw) {
 	const entry = raw.trim();
 	if (!entry) return;
-	const preset = PRESETS[entry.toLowerCase()];
+	const key = entry.toLowerCase();
+	const preset = Object.hasOwn(PRESETS, key) ? PRESETS[key] : void 0;
 	if (preset) {
 		for (const [net, prefix, family] of preset) list.addSubnet(net, prefix, family);
 		return;
@@ -124,7 +125,7 @@ function resolveFromRight(chain, socketAddress, checker) {
 	let candidate = socketAddress;
 	for (let i = chain.length - 1; i >= 0; i -= 1) {
 		if (!checker.isTrusted(candidate)) return candidate;
-		const next = chain[i];
+		const next = chain[i] ?? null;
 		if (next === null) return candidate;
 		candidate = next;
 	}
@@ -156,7 +157,7 @@ function extractClientIp(xff, socketAddress, checker) {
 	if (!socketAddress) return null;
 	if (!xff) return socketAddress;
 	const s = Array.isArray(xff) ? xff.join(",") : xff;
-	if (s.indexOf(",") === -1) {
+	if (!s.includes(",")) {
 		const ip = s.trim();
 		if (!ip) return socketAddress;
 		return checker.isTrusted(socketAddress) ? ip : socketAddress;

package/dist/nodefony/src/context/websocket/Response.js

@@ -1,7 +1,8 @@
 import Cookie from "../../cookies/cookie.js";
 import { decideSend, readBackpressureOptions } from "./wsBackpressure.js";
-import Ws from "ws";
+import { toWsCloseReason } from "./wsCloseReason.js";
 import http from "node:http";
+import Ws from "ws";
 //#region nodefony/src/context/websocket/Response.ts
 /**
 * Codes d'erreur d'écriture « le client est PARTI » : reload de page, onglet
@@ -57,7 +58,7 @@ var WebsocketResponse = class {
 		this.connection = connection;
 	}
 	log(pci, severity, msgid, msg) {
-		const syslog = this.context?.container?.get("syslog");
+		const syslog = this.context.container?.get("syslog");
 		if (!msgid) msgid = "WEBSOCKET RESPONSE";
 		return syslog?.log(pci, severity, msgid, msg);
 	}
@@ -70,7 +71,7 @@ var WebsocketResponse = class {
 		if (payload == null) throw new Error("no data");
 		return new Promise((resolve, reject) => {
 			if (!this.connection || this.connection.readyState !== Ws.OPEN) return reject(/* @__PURE__ */ new Error("WebSocket not open"));
-			const { max, policy, closeAfterDrops } = readBackpressureOptions(this.context?.server);
+			const { max, policy, closeAfterDrops } = readBackpressureOptions(this.context.server);
 			const decision = decideSend(this.connection, max, policy, closeAfterDrops);
 			if (decision !== "send") {
 				this.logFirstDrop(this.connection, decision, max);
@@ -93,7 +94,7 @@ var WebsocketResponse = class {
 	broadcast(data, type) {
 		const payload = data ?? this.body;
 		if (!payload) return;
-		const wss = this.context?.server;
+		const wss = this.context.server;
 		if (!wss) return;
 		const sendData = type === "binary" && Buffer.isBuffer(payload) ? payload : payload instanceof Buffer ? payload.toString(this.encoding) : payload;
 		const { max, policy, closeAfterDrops } = readBackpressureOptions(wss);
@@ -124,11 +125,17 @@ var WebsocketResponse = class {
 		return this.body;
 	}
 	drop(reasonCode, description) {
-		if (this.connection && this.connection.readyState === Ws.OPEN) return this.connection.close(reasonCode ?? this.statusCode, description);
+		if (this.connection && this.connection.readyState === Ws.OPEN) {
+			this.connection.close(reasonCode ?? this.statusCode, toWsCloseReason(description));
+			return;
+		}
 		throw new Error("Connection already closed");
 	}
 	close(reasonCode, description) {
-		if (this.connection && this.connection.readyState === Ws.OPEN) return this.connection.close(reasonCode ?? this.statusCode, description ?? "closed");
+		if (this.connection && this.connection.readyState === Ws.OPEN) {
+			this.connection.close(reasonCode ?? this.statusCode, toWsCloseReason(description ?? "closed"));
+			return;
+		}
 		throw new Error("Connection already closed");
 	}
 	getStatus() {

package/dist/nodefony/src/context/websocket/WebsocketContext.js

@@ -1,5 +1,6 @@
 import { hasForwardingHeaders, resolveForwarded } from "../forwarded.js";
 import Context from "../Context.js";
+import { toWsCloseReason } from "./wsCloseReason.js";
 import WebsocketResponse from "./Response.js";
 import { sanitizeRequestId } from "../requestId.js";
 import { FrameProfile } from "../../profiler/FrameProfile.js";
@@ -10,6 +11,24 @@ import { AsyncResource } from "node:async_hooks";
 import url, { URL } from "node:url";
 //#region nodefony/src/context/websocket/WebsocketContext.ts
 /**
+* Appelle l'action résolue et rend TOUJOURS une promesse.
+*
+* `callController` rend une valeur ou une promesse, et peut lever de façon
+* synchrone (#505). Démarré dans l'exécuteur d'une promesse, l'appel transforme
+* une exception synchrone en REJET : les deux sites WS la traitent comme avant
+* — le handshake par son `catch` de fermeture RFC 6455, le message en la
+* rendant à l'appelant sans passer par le `catch` 1011.
+*
+* @param resolver - le résolveur de la connexion.
+* @param data - les arguments de l'action (message reçu).
+* @returns la promesse du rendu, rompue par toute erreur de l'action.
+*/
+function callAsPromise(resolver, data) {
+	return new Promise((resolve) => {
+		resolve(resolver.callController(data));
+	});
+}
+/**
 * Coerce un code (applicatif / HTTP / WS) en code de fermeture WebSocket VALIDE
 * et conforme RFC 6455 §7.4, en PRÉFÉRANT les codes standard §7.4.1 quand le
 * sens existe :
@@ -65,7 +84,7 @@ var WebsocketContext = class extends Context {
 		this.method = this.getMethod();
 		this.origin = req.headers.origin ?? "";
 		const checker = this.httpKernel?.getTrustProxyChecker();
-		const socketAddress = req.socket?.remoteAddress;
+		const socketAddress = req.socket.remoteAddress;
 		if (checker && checker.isTrusted(socketAddress) && hasForwardingHeaders(req.headers)) this.forwarded = resolveForwarded(req.headers, socketAddress, checker);
 		this.remoteAddress = this.getRemoteAddress();
 		this.acceptedProtocol = req.headers["sec-websocket-protocol"];
@@ -104,7 +123,7 @@ var WebsocketContext = class extends Context {
 				proxyHost: fwd.host ?? req.headers["x-forwarded-host"],
 				proxyVia: req.headers.via
 			};
-			this.log(`PROXY WEBSOCKET REQUEST ${fwd.fromStandard ? "Forwarded (RFC 7239)" : "x-forwarded"} VIA : ${this.proxy?.proxyVia}`, "DEBUG");
+			this.log(`PROXY WEBSOCKET REQUEST ${fwd.fromStandard ? "Forwarded (RFC 7239)" : "x-forwarded"} VIA : ${this.proxy.proxyVia}`, "DEBUG");
 		}
 	}
 	log(pci, severity, msgid, msg) {
@@ -117,9 +136,11 @@ var WebsocketContext = class extends Context {
 			if (!logger) return;
 			const entry = logger.renderWebsocket(this, httpError ?? null, acceptedProtocol ?? null);
 			const pdu = this.log(entry.text, entry.severity, entry.msgid);
-			if (pdu && pdu.requestId === void 0) pdu.requestId = this.requestId;
+			pdu.requestId ??= this.requestId;
 			return pdu;
-		} catch {}
+		} catch {
+			return;
+		}
 	}
 	async connect() {
 		if (!this.response || !this.request || !this.connection) throw new Error("Nodefony Websocket Bad request/response/connection");
@@ -140,37 +161,38 @@ var WebsocketContext = class extends Context {
 			this.webSocketState = "error";
 			throw new Error("Nodefony Websocket rejected");
 		}
-		if (!this.resolver) this.resolver = this.router?.resolve(this);
+		if (!this.resolver) this.resolver = this.router?.resolve(this) ?? null;
 		else try {
 			this.resolver.match(this.resolver.route, this);
 		} catch (e) {
-			if (!this.rejected) this.reject(e.code ?? void 0, e.message);
+			if (!this.isRejected()) this.reject(e.code ?? void 0, e.message);
 			throw e;
 		}
 		await this.fireAsync("onRequest", this, this.resolver);
 		await this.kernel?.fireAsync("onRequest", this, this.resolver);
-		if (this.resolver && this.resolver.resolve) {
+		if (this.resolver?.resolve) {
 			this.setMetaData({ nodefony: { websocket: {
 				state: this.webSocketState,
 				protocol: this.acceptedProtocol
 			} } });
-			await this.resolver.callController(data).then(async () => {
+			await callAsPromise(this.resolver, data).then(async () => {
 				await this.saveSession().then((session) => {
 					if (session) this.log(`SAVE SESSION ID : ${session.id}`, "DEBUG");
-				}).catch((e) => {
-					throw e;
 				});
 				return this;
 			}).catch((error) => {
 				if (!this.rejected) {
-					if (this.requestEnded) throw this.close(error.code, error.message);
+					if (this.requestEnded) {
+						this.close(error.code, error.message);
+						throw error;
+					}
 					this.reject(error.code ?? void 0, error.message);
 					this.rejected = true;
 					this.webSocketState = "error";
 					throw error;
 				}
 			});
-		} else if (!this.rejected) {
+		} else if (!this.isRejected()) {
 			this.reject(4004, "Not Found");
 			this.rejected = true;
 			this.webSocketState = "error";
@@ -204,7 +226,8 @@ var WebsocketContext = class extends Context {
 				this.logMessageContent("BROADCAST", payload);
 				this.fire("onMessage", payload, this, "BROADCAST");
 				this.fire("onBroadcast", payload, this);
-				return this.response.broadcast(payload, encoding);
+				this.response.broadcast(payload, encoding);
+				return;
 			}
 		}
 		return null;
@@ -219,7 +242,7 @@ var WebsocketContext = class extends Context {
 	* @param data - charge utile (string, Buffer binaire, objet, ou null).
 	*/
 	logMessageContent(dir, data) {
-		if (wsContentLogging === null) wsContentLogging = this.kernel?.environment !== "production";
+		wsContentLogging ??= this.kernel?.environment !== "production";
 		if (!wsContentLogging) return;
 		this.log(formatWsLogContent(data), "DEBUG", `WS ${dir}`);
 	}
@@ -292,23 +315,22 @@ var WebsocketContext = class extends Context {
 		this.webSocketState = "message";
 		const message = isBinary ? data : data.toString();
 		this.logMessageContent("RECEIVE", message);
-		if (this.response) this.response.body = Buffer.isBuffer(data) ? data : Buffer.from(data.toString());
+		if (this.response) this.response.body = Buffer.isBuffer(data) ? data : Buffer.from(data);
 		try {
-			if (!this.resolver) this.resolver = this.router?.resolve(this);
-			else this.resolver.match(this.resolver?.route, this);
+			if (!this.resolver) this.resolver = this.router?.resolve(this) ?? null;
+			else this.resolver.match(this.resolver.route, this);
 			await this.fireAsync("onMessage", message, this, "RECEIVE");
-			if (this.resolver.resolve) {
+			if (this.resolver?.resolve) {
 				this.setMetaData({ nodefony: { websocket: {
 					state: this.webSocketState,
 					protocol: this.acceptedProtocol
 				} } });
-				return this.resolver.callController([message]).catch((e) => {
-					throw e;
-				});
+				return callAsPromise(this.resolver, [message]);
 			} else if (!this.rejected) {
 				this.reject(4004, "Not Found");
 				this.rejected = true;
 			}
+			return;
 		} catch (e) {
 			this.reject(1011, "Internal Error");
 			throw e;
@@ -338,7 +360,7 @@ var WebsocketContext = class extends Context {
 	*/
 	onConnectionError(error) {
 		this.webSocketState = "error";
-		this.log(`${logColor.cyan("URL")} : ${this.url}  ${logColor.cyan("FROM")} : ${this.remoteAddress} ${logColor.cyan("ID")} : ${this.requestId} ${logColor.cyan("error")} : ${error?.message}`, "ERROR", `${this.type} ${logColor.red("SOCKET ERROR")} ${this.method}`);
+		this.log(`${logColor.cyan("URL")} : ${this.url}  ${logColor.cyan("FROM")} : ${this.remoteAddress} ${logColor.cyan("ID")} : ${this.requestId} ${logColor.cyan("error")} : ${error.message}`, "ERROR", `${this.type} ${logColor.red("SOCKET ERROR")} ${this.method}`);
 		this.fire("onError", error, this);
 	}
 	setScheme() {
@@ -346,7 +368,7 @@ var WebsocketContext = class extends Context {
 	}
 	getRemoteAddress() {
 		if (this.forwarded) return this.forwarded.clientIp;
-		return this.request?.socket?.remoteAddress ?? null;
+		return this.request?.socket.remoteAddress ?? null;
 	}
 	getHost() {
 		return this.request?.headers.host;
@@ -372,15 +394,26 @@ var WebsocketContext = class extends Context {
 		super.clean();
 	}
 	close(reasonCode, description) {
-		if (this.response) return this.response.close(toWsCloseCode(reasonCode), description);
+		if (this.response) this.response.close(toWsCloseCode(reasonCode), description);
 	}
 	drop(reasonCode, description) {
-		if (this.response) return this.response.drop(reasonCode, description);
+		if (this.response) this.response.drop(reasonCode, description);
+	}
+	/**
+	* Relit `rejected` sans le rétrécissement de TypeScript : après la garde
+	* d'entrée de {@link handle}, le compilateur le croit `false` pour toute la
+	* méthode, alors qu'un écouteur `onRequest` (pare-feu) ou le `match` du
+	* resolver peut avoir rejeté entre-temps.
+	*
+	* @returns `true` si la connexion a été rejetée.
+	*/
+	isRejected() {
+		return this.rejected;
 	}
 	reject(code, message) {
 		if (this.connection && this.connection.readyState === Ws.OPEN) {
 			const raw = typeof code === "string" ? parseInt(code, 10) : code;
-			this.connection.close(toWsCloseCode(raw), message ?? "Rejected");
+			this.connection.close(toWsCloseCode(raw), toWsCloseReason(message ?? "Rejected"));
 		}
 		this.rejected = true;
 	}

package/dist/nodefony/src/context/websocket/wsCloseReason.js

@@ -0,0 +1,41 @@
+//#region nodefony/src/context/websocket/wsCloseReason.ts
+/**
+* Taille maximale, en octets UTF-8, de la raison d'une trame Close (RFC 6455
+* §5.5 : charge d'une trame de contrôle ≤ 125 octets, dont 2 pour le code).
+*/
+const MAX_WS_CLOSE_REASON_BYTES = 123;
+/** Marqueur de troncature : « … » (U+2026) pèse 3 octets en UTF-8. */
+const ELLIPSIS = "…";
+/**
+* Borne la raison d'une fermeture WebSocket à 123 octets UTF-8, coupée sur une
+* frontière de caractère.
+*
+* `ws.close(code, reason)` LÈVE une `RangeError` au-delà de 123 octets, et la
+* connexion n'est alors PAS fermée : jusqu'en `ws` 8.21 elle restait en
+* `CLOSING` sans trame Close ni minuterie — hors de portée de toute garde
+* `readyState === OPEN` et du heartbeat, donc ouverte jusqu'à la mort TCP ;
+* depuis 8.22 elle reste `OPEN`. Or la raison porte souvent un message
+* d'erreur, dont rien ne borne la longueur.
+*
+* @param reason - raison candidate (message d'erreur, libellé…)
+* @returns la raison telle quelle si elle tient, sinon tronquée et terminée
+*          par « … » ; chaîne vide si elle n'est pas une chaîne.
+*/
+function toWsCloseReason(reason) {
+	if (typeof reason !== "string") return "";
+	if (reason.length <= 41) return reason;
+	if (Buffer.byteLength(reason, "utf8") <= 123) return reason;
+	const budget = 120;
+	let bytes = 0;
+	let end = 0;
+	for (const char of reason) {
+		const cp = char.codePointAt(0);
+		const size = cp < 128 ? 1 : cp < 2048 ? 2 : cp < 65536 ? 3 : 4;
+		if (bytes + size > budget) break;
+		bytes += size;
+		end += char.length;
+	}
+	return reason.slice(0, end) + ELLIPSIS;
+}
+//#endregion
+export { MAX_WS_CLOSE_REASON_BYTES, toWsCloseReason };

package/dist/nodefony/src/cookies/cookie.js

@@ -25,7 +25,7 @@ function cookiesParser(context) {
 		case "http":
 		case "https":
 		case "http2":
-			if (context.request.request && context.request.request.headers.cookie) cookies = context.request.request.headers.cookie;
+			if (context.request.request.headers.cookie) cookies = context.request.request.headers.cookie;
 			if (cookies) {
 				const obj = parser(cookies);
 				for (const cookie in obj) {
@@ -37,7 +37,7 @@ function cookiesParser(context) {
 			break;
 		case "websocket":
 		case "websocket-secure": {
-			const cookieHeader = context.request?.headers?.cookie;
+			const cookieHeader = context.request?.headers.cookie;
 			if (cookieHeader) {
 				const parsed = parser(cookieHeader);
 				for (const name in parsed) {
@@ -65,7 +65,7 @@ var Cookie = class Cookie {
 	sameSite;
 	priority;
 	constructor(cookiesOrName, value, options) {
-		this.options = extend({}, cookieDefaultSettings, options || {});
+		this.options = extend({}, cookieDefaultSettings, options ?? {});
 		if (!cookiesOrName) throw new Error("cookie must have name");
 		this.name = cookiesOrName;
 		if (typeof cookiesOrName === "string") {

package/dist/nodefony/src/errors/httpError.js

@@ -32,16 +32,16 @@ var HttpError = class extends nodefonyError {
 	constructor(message, code, context) {
 		super(message, code);
 		this.context = context;
-		this.response = context?.response;
-		this.request = context?.request;
+		const res = context?.response;
+		this.response = res ?? void 0;
+		this.request = context?.request ?? void 0;
 		this.url = this.context?.url;
-		if (this.response && code) this.response.statusCode = code;
-		if (!this.message) this.message = (context?.response)?.body?.toString() || (context?.response)?.statusMessage || (context?.response)?.getStatusMessage();
+		if (res && code) res.statusCode = code;
+		if (!this.message && res) this.message = res.body?.toString() || res.statusMessage || res.getStatusMessage();
 		const resolver = context?.resolver;
 		this.controller = resolver?.controller?.name ?? void 0;
 		this.action = resolver?.actionName ?? void 0;
-		const res = context?.response;
-		if (res) this.jsonResponse = `${res.statusCode} ${res.statusMessage ?? ""}`.trim();
+		if (res) this.jsonResponse = `${res.statusCode} ${res.statusMessage}`.trim();
 	}
 	toString() {
 		if (this.context) return `${clc.red(this.message)}

package/dist/nodefony/src/errors/thrownMessage.js

@@ -0,0 +1,27 @@
+//#region nodefony/src/errors/thrownMessage.ts
+/**
+* Message lisible d'une valeur LEVÉE (`catch`, rejet) dont on ignore le type.
+*
+* Même rendu que `String(value)` pour une `Error` (son `message`) et pour les
+* primitives ; un objet quelconque rend son étiquette (`[object Object]`) sans
+* appeler un `toString` arbitraire ni sérialiser son contenu — ce texte peut
+* finir dans une réponse ou un journal, il ne doit rien divulguer.
+*
+* @param value - la valeur levée.
+* @returns un texte court, jamais vide pour une valeur définie.
+*/
+function thrownMessage(value) {
+	if (value instanceof Error) return value.message;
+	switch (typeof value) {
+		case "string": return value;
+		case "number":
+		case "boolean":
+		case "bigint":
+		case "symbol":
+		case "undefined": return String(value);
+		case "object":
+		case "function": return value === null ? "null" : Object.prototype.toString.call(value);
+	}
+}
+//#endregion
+export { thrownMessage };

package/dist/nodefony/src/profiler/FrameProfile.js

@@ -1,3 +1,4 @@
+import { thrownMessage } from "../errors/thrownMessage.js";
 //#region nodefony/src/profiler/FrameProfile.ts
 /**
 * Profil d'**une invocation** du pont RPC (une frame `api.request`), et non de
@@ -72,8 +73,8 @@ var FrameProfile = class {
 	phaseEnd(name) {
 		if (!this.timing) return;
 		for (let i = this.phases.length - 1; i >= 0; i--) {
-			const p = this.phases[i];
-			if (p.name === name && p.endMs === void 0) {
+			const p = this.phases.at(i);
+			if (p?.name === name && p.endMs === void 0) {
 				p.endMs = performance.now();
 				p.durationMs = p.endMs - p.startMs;
 				return;
@@ -88,7 +89,7 @@ var FrameProfile = class {
 	*/
 	finish(status, error) {
 		this.response = { statusCode: status };
-		if (error !== void 0 && error !== null) this.error = { message: error instanceof Error ? error.message : String(error) };
+		if (error !== void 0 && error !== null) this.error = { message: thrownMessage(error) };
 	}
 };
 //#endregion

package/dist/nodefony/src/profiler/Profiler.js

@@ -2,8 +2,8 @@
 /** Durée totale = (fin de la dernière phase terminée) − (début de la 1ère). */
 function totalDuration(phases) {
 	if (phases.length === 0) return null;
-	const first = phases[0];
-	if (typeof first.startMs !== "number") return null;
+	const first = phases.at(0);
+	if (first === void 0 || typeof first.startMs !== "number") return null;
 	let end = first.startMs;
 	for (const p of phases) {
 		const e = p.startMs + (p.durationMs ?? 0);
@@ -71,8 +71,8 @@ var Profiler = class {
 	recent(limit = 60) {
 		const out = [];
 		const entries = [...this._buf.values()];
-		for (let i = entries.length - 1; i >= 0 && out.length < limit; i--) {
-			const e = entries[i];
+		for (const e of entries.reverse()) {
+			if (out.length >= limit) break;
 			out.push({
 				requestId: e.requestId,
 				ts: e.ts,

package/dist/nodefony/src/servers/kernelServers.js

@@ -0,0 +1,29 @@
+//#region nodefony/src/servers/kernelServers.ts
+/**
+* Rétrécit la section `servers` de la configuration du kernel (lue dans le sac
+* de config non typé du cœur) en {@link ServersConfig}, sans propager `any`.
+*
+* Seule lecture de `kernel.options.servers` dans `@nodefony/http` : les serveurs
+* et le `HttpKernel` passent tous par ici.
+*
+* @param servers - la valeur brute de `kernel.options.servers`.
+* @returns la section typée, ou `undefined` si elle est absente ou n'est pas un objet.
+*/
+function asServersConfig(servers) {
+	return servers !== null && typeof servers === "object" ? servers : void 0;
+}
+/**
+* Port DEMANDÉ pour un serveur (`servers.<type>.port`), ou `undefined` si le
+* serveur est désactivé, absent, ou sans port numérique.
+*
+* @param servers - section `servers` déjà rétrécie ({@link asServersConfig}).
+* @param type - le serveur visé.
+*/
+function configuredServerPort(servers, type) {
+	const entry = servers?.[type];
+	if (!entry) return void 0;
+	const port = entry.port;
+	return typeof port === "number" ? port : void 0;
+}
+//#endregion
+export { asServersConfig, configuredServerPort };