@nodefony/http 10.0.0-alpha.9 → 10.0.0-beta.2

package/dist/nodefony/service/trace.js

@@ -29,7 +29,7 @@ function parseTraceparent(header) {
 	if (typeof header !== "string") return null;
 	const m = TRACEPARENT_RE.exec(header.trim().toLowerCase());
 	if (!m) return null;
-	const [, version, traceId, parentId, flags] = m;
+	const [, version = "", traceId = "", parentId = "", flags = ""] = m;
 	if (version === "ff") return null;
 	if (/^0+$/.test(traceId)) return null;
 	if (/^0+$/.test(parentId)) return null;
@@ -66,7 +66,8 @@ function resolveTraceparent(header) {
 		const newSpanId = randomHex(8);
 		return `${parsed.version}-${parsed.traceId}-${newSpanId}-${parsed.flags}`;
 	}
-	return `00-${randomHex(16)}-${randomHex(8)}-01`;
+	const hex = randomHex(24);
+	return `00-${hex.slice(0, 32)}-${hex.slice(32)}-01`;
 }
 //#endregion
 export { parseTraceparent, resolveTraceparent };

package/dist/nodefony/service/upload/upload-service.js

@@ -1,7 +1,7 @@
-import __decorateMetadata from "../../../_virtual/_@oxc-project_runtime@0.151.0/helpers/esm/decorateMetadata.js";
-import __decorate from "../../../_virtual/_@oxc-project_runtime@0.151.0/helpers/esm/decorate.js";
+import __decorateMetadata from "../../../_virtual/_@oxc-project_runtime@0.152.0/helpers/esm/decorateMetadata.js";
+import __decorate from "../../../_virtual/_@oxc-project_runtime@0.152.0/helpers/esm/decorate.js";
 import http_kernel_default from "../http-kernel.js";
-import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.151.0/helpers/esm/decorateParam.js";
+import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.152.0/helpers/esm/decorateParam.js";
 import { Cli, FileClass, Module, Service, inject } from "nodefony";
 import fs from "node:fs";
 import fsp from "node:fs/promises";
@@ -21,18 +21,19 @@ let upload = class upload extends Service {
 	path;
 	module;
 	constructor(module, httpKernel) {
-		super("upload", httpKernel?.container, httpKernel.notificationsCenter);
+		super("upload", httpKernel.container, httpKernel.notificationsCenter);
 		this.httpKernel = httpKernel;
 		this.module = module;
 		this.kernel?.once("onBoot", async () => {
 			this.options = this.httpKernel.options;
-			if (path.isAbsolute(this.options.upload.uploadDir)) this.path = this.options.upload.uploadDir;
-			else this.path = path.resolve(`${this.kernel?.path}/${this.options.upload.uploadDir}`);
+			const uploadCfg = this.httpKernel.options.upload;
+			if (path.isAbsolute(uploadCfg.uploadDir)) this.path = uploadCfg.uploadDir;
+			else this.path = path.resolve(`${this.kernel?.path}/${uploadCfg.uploadDir}`);
 			try {
 				await fsp.mkdir(this.path, { recursive: true });
 			} catch (e) {
 				this.path = "/tmp";
-				this.options.upload.uploadDir = this.path;
+				uploadCfg.uploadDir = this.path;
 				this.log(e, "DEBUG");
 			}
 		});
@@ -102,8 +103,7 @@ var UploadedFile = class UploadedFile extends FileClass {
 		return this.parsedFile.originalFilename || name || this.parsedFile.newFilename;
 	}
 	getMimeType() {
-		if (this.parsedFile) return this.parsedFile.mimetype || super.getMimeType(this.filename);
-		return super.getMimeType();
+		return this.parsedFile.mimetype || super.getMimeType(this.filename);
 	}
 	/**
 	* Nom de fichier SÛR à poser dans un dossier de destination.
@@ -141,7 +141,8 @@ var UploadedFile = class UploadedFile extends FileClass {
 				return super.move(name);
 			} else return super.move(target);
 		}
-		throw fs.lstatSync(dirname);
+		fs.lstatSync(dirname);
+		throw new Error(`Upload target directory not found: ${dirname}`);
 	}
 	/**
 	* Variante **async** de `move()` — déplace le fichier uploadé sans bloquer

package/dist/nodefony/service/x509.js

@@ -0,0 +1,324 @@
+import { isIPv4, isIPv6 } from "node:net";
+import { createHash, sign } from "node:crypto";
+//#region nodefony/service/x509.ts
+/**
+* Fabrique et lecture de certificats X.509 par `node:crypto` seul — aucune
+* dépendance tierce.
+*
+* `node:crypto` sait LIRE un certificat (`X509Certificate`) et SIGNER, pas
+* en FABRIQUER un : ce module encode le `TBSCertificate` en DER (RFC 5280
+* §4.1), le signe avec `crypto.sign`, puis l'assemble. Seul le sous-ensemble
+* nécessaire à un certificat serveur auto-signé est couvert. Les fonctions
+* sont PURES (aucun disque, aucun kernel) : elles s'éprouvent sans décor.
+*
+* Pourquoi pas node-forge : sa vérification de signature RSA PKCS#1 v1.5
+* accepte des signatures forgées (GHSA-86w9-cpqp-85rv), sans aucune version
+* corrigée. Nous ne vérifions aucune signature, mais `npm audit` signale le
+* paquet pour tous ceux qui installent `@nodefony/http`.
+*/
+const SIGNATURE_OIDS = {
+	sha1: "1.2.840.113549.1.1.5",
+	sha256: "1.2.840.113549.1.1.11",
+	sha384: "1.2.840.113549.1.1.12",
+	sha512: "1.2.840.113549.1.1.13"
+};
+/** OID de la signature RSA-SHA1, que le service régénère. */
+const SHA1_WITH_RSA_OID = SIGNATURE_OIDS.sha1;
+/** Noms lisibles des algorithmes de signature courants (rendu de `describe`). */
+const SIGNATURE_NAMES = Object.assign(Object.create(null), {
+	[SIGNATURE_OIDS.sha1]: "sha1WithRSAEncryption",
+	[SIGNATURE_OIDS.sha256]: "sha256WithRSAEncryption",
+	[SIGNATURE_OIDS.sha384]: "sha384WithRSAEncryption",
+	[SIGNATURE_OIDS.sha512]: "sha512WithRSAEncryption",
+	"1.2.840.113549.1.1.10": "RSASSA-PSS",
+	"1.2.840.10045.4.3.2": "ecdsa-with-SHA256",
+	"1.2.840.10045.4.3.3": "ecdsa-with-SHA384",
+	"1.2.840.10045.4.3.4": "ecdsa-with-SHA512",
+	"1.3.101.112": "Ed25519"
+});
+const ATTRIBUTE_OIDS = Object.assign(Object.create(null), {
+	commonName: "2.5.4.3",
+	CN: "2.5.4.3",
+	surname: "2.5.4.4",
+	SN: "2.5.4.4",
+	serialNumber: "2.5.4.5",
+	countryName: "2.5.4.6",
+	C: "2.5.4.6",
+	localityName: "2.5.4.7",
+	L: "2.5.4.7",
+	stateOrProvinceName: "2.5.4.8",
+	ST: "2.5.4.8",
+	streetAddress: "2.5.4.9",
+	street: "2.5.4.9",
+	organizationName: "2.5.4.10",
+	O: "2.5.4.10",
+	organizationalUnitName: "2.5.4.11",
+	OU: "2.5.4.11",
+	title: "2.5.4.12",
+	givenName: "2.5.4.42",
+	emailAddress: "1.2.840.113549.1.9.1",
+	E: "1.2.840.113549.1.9.1"
+});
+const OID_COUNTRY = "2.5.4.6";
+const OID_EMAIL = "1.2.840.113549.1.9.1";
+const OID_BASIC_CONSTRAINTS = "2.5.29.19";
+const OID_KEY_USAGE = "2.5.29.15";
+const OID_EXT_KEY_USAGE = "2.5.29.37";
+const OID_SUBJECT_ALT_NAME = "2.5.29.17";
+const OID_SUBJECT_KEY_ID = "2.5.29.14";
+const OID_SERVER_AUTH = "1.3.6.1.5.5.7.3.1";
+const OID_CLIENT_AUTH = "1.3.6.1.5.5.7.3.2";
+function derLength(length) {
+	if (length < 128) return Buffer.from([length]);
+	const bytes = [];
+	for (let rest = length; rest > 0; rest = Math.floor(rest / 256)) bytes.unshift(rest & 255);
+	return Buffer.from([128 | bytes.length, ...bytes]);
+}
+function tlv(tag, content) {
+	return Buffer.concat([
+		Buffer.from([tag]),
+		derLength(content.length),
+		content
+	]);
+}
+const sequence = (...items) => tlv(48, Buffer.concat(items));
+const set = (...items) => tlv(49, Buffer.concat(items));
+const explicit = (n, content) => tlv(160 | n, content);
+const octetString = (content) => tlv(4, content);
+const bitString = (content) => tlv(3, Buffer.concat([Buffer.from([0]), content]));
+const DER_NULL = Buffer.from([5, 0]);
+const DER_TRUE = tlv(1, Buffer.from([255]));
+function objectIdentifier(dotted) {
+	const [first = 0, second = 0, ...rest] = dotted.split(".").map(Number);
+	const bytes = [first * 40 + second];
+	for (const arc of rest) {
+		const chunk = [arc & 127];
+		for (let value = Math.floor(arc / 128); value > 0; value = Math.floor(value / 128)) chunk.unshift(value & 127 | 128);
+		bytes.push(...chunk);
+	}
+	return tlv(6, Buffer.from(bytes));
+}
+/** Entier positif depuis sa forme hexadécimale (octet 0x00 ajouté si besoin). */
+function positiveInteger(hex) {
+	let bytes = Buffer.from(hex.length % 2 === 0 ? hex : `0${hex}`, "hex");
+	let start = 0;
+	while (start < bytes.length - 1 && bytes[start] === 0) start++;
+	bytes = bytes.subarray(start);
+	if (bytes.length === 0) bytes = Buffer.from([0]);
+	if ((bytes[0] ?? 0) & 128) bytes = Buffer.concat([Buffer.from([0]), bytes]);
+	return tlv(2, bytes);
+}
+/** RFC 5280 §4.1.2.5 : UTCTime jusqu'en 2049, GeneralizedTime au-delà. */
+function time(date) {
+	const iso = date.toISOString();
+	const digits = `${iso.slice(0, 4)}${iso.slice(5, 7)}${iso.slice(8, 10)}${iso.slice(11, 13)}${iso.slice(14, 16)}${iso.slice(17, 19)}Z`;
+	const year = date.getUTCFullYear();
+	if (year >= 1950 && year < 2050) return tlv(23, Buffer.from(digits.slice(2), "ascii"));
+	return tlv(24, Buffer.from(digits, "ascii"));
+}
+function attributeOid(attribute) {
+	if (attribute.type && /^\d+(\.\d+)+$/.test(attribute.type)) return attribute.type;
+	const key = attribute.name ?? attribute.shortName ?? attribute.type ?? "";
+	const oid = ATTRIBUTE_OIDS[key];
+	if (!oid) throw new Error(`Attribut de certificat inconnu : '${key}'. Noms reconnus : ${Object.keys(ATTRIBUTE_OIDS).join(", ")}.`);
+	return oid;
+}
+/** Nom distinctif : un RDN par attribut (RFC 5280 §4.1.2.4). */
+function distinguishedName(attributes) {
+	const rdns = attributes.map((attribute) => {
+		const oid = attributeOid(attribute);
+		if (typeof attribute.value !== "string") throw new Error(`Attribut de certificat '${oid}' sans valeur.`);
+		const value = Buffer.from(attribute.value, "utf8");
+		const tag = oid === OID_COUNTRY ? 19 : oid === OID_EMAIL ? 22 : 12;
+		return set(sequence(objectIdentifier(oid), tlv(tag, value)));
+	});
+	return sequence(...rdns);
+}
+/** Octets d'une adresse IP pour un SAN `iPAddress` (4 ou 16 octets). */
+function ipAddressBytes(ip) {
+	if (isIPv4(ip)) return Buffer.from(ip.split(".").map(Number));
+	if (!isIPv6(ip) || ip.includes("%")) throw new Error(`Adresse IP invalide pour un SAN : '${ip}'.`);
+	const toGroups = (part) => {
+		if (part === "") return [];
+		const groups = [];
+		for (const piece of part.split(":")) if (piece.includes(".")) {
+			const [a = 0, b = 0, c = 0, d = 0] = piece.split(".").map(Number);
+			groups.push(a << 8 | b, c << 8 | d);
+		} else groups.push(parseInt(piece, 16));
+		return groups;
+	};
+	const [head = "", tail] = ip.split("::");
+	const left = toGroups(head);
+	const right = tail === void 0 ? [] : toGroups(tail);
+	const zeros = new Array(8 - left.length - right.length).fill(0);
+	const out = Buffer.alloc(16);
+	[
+		...left,
+		...zeros,
+		...right
+	].forEach((group, i) => out.writeUInt16BE(group, i * 2));
+	return out;
+}
+/**
+* Octets d'un SAN `dNSName` — IA5String (RFC 5280 §4.2.1.6).
+*
+* 🔴 Jamais `Buffer.from(nom, "ascii")` : Node y garde l'octet BAS de chaque
+* caractère, et `evil\u012Elocalhost` devient `evil.localhost` — un certificat
+* qui couvre un nom que personne n'a configuré. Hors ASCII imprimable, le nom
+* est REFUSÉ (un IDN s'écrit en punycode, `xn--…`).
+*/
+function dnsNameBytes(dns) {
+	if (!/^[\x20-\x7e]+$/u.test(dns)) throw new Error(`Nom DNS invalide pour un SAN : ${JSON.stringify(dns)} — ASCII imprimable seulement (un nom international s'écrit en punycode, xn--…).`);
+	return Buffer.from(dns, "ascii");
+}
+function extension(oid, critical, value) {
+	return critical ? sequence(objectIdentifier(oid), DER_TRUE, octetString(value)) : sequence(objectIdentifier(oid), octetString(value));
+}
+function readNode(der, offset) {
+	const tag = der[offset];
+	let length = der[offset + 1];
+	if (tag === void 0 || length === void 0) throw new Error("DER tronqué.");
+	let start = offset + 2;
+	if (length & 128) {
+		const count = length & 127;
+		length = 0;
+		for (let i = 0; i < count; i++) length = length * 256 + (der[start + i] ?? 0);
+		start += count;
+	}
+	const end = start + length;
+	if (end > der.length) throw new Error("DER tronqué.");
+	return {
+		tag,
+		start,
+		end
+	};
+}
+function children(der, node) {
+	const out = [];
+	for (let offset = node.start; offset < node.end;) {
+		const child = readNode(der, offset);
+		out.push(child);
+		offset = child.end;
+	}
+	return out;
+}
+function decodeObjectIdentifier(bytes) {
+	const first = bytes[0] ?? 0;
+	const arcs = [Math.min(Math.floor(first / 40), 2), first - Math.min(Math.floor(first / 40), 2) * 40];
+	let value = 0;
+	for (let i = 1; i < bytes.length; i++) {
+		const byte = bytes[i] ?? 0;
+		value = value * 128 + (byte & 127);
+		if (!(byte & 128)) {
+			arcs.push(value);
+			value = 0;
+		}
+	}
+	return arcs.join(".");
+}
+/**
+* OID de l'algorithme de signature d'un certificat DER (champ
+* `signatureAlgorithm`, RFC 5280 §4.1.1.2). Lu dans le DER plutôt que par
+* `X509Certificate.signatureAlgorithmOid`, absent des Node du plancher.
+*
+* @param der - certificat encodé DER (`X509Certificate.raw`)
+* @throws Si le DER n'a pas la forme d'un certificat
+*/
+function signatureAlgorithmOid(der) {
+	const [, algorithm] = children(der, readNode(der, 0));
+	const oid = algorithm ? children(der, algorithm)[0] : void 0;
+	if (oid?.tag !== 6) throw new Error("Certificat DER sans algorithme de signature.");
+	return decodeObjectIdentifier(der.subarray(oid.start, oid.end));
+}
+/** Nom lisible d'un OID de signature (l'OID lui-même s'il est inconnu). */
+function signatureAlgorithmName(oid) {
+	return SIGNATURE_NAMES[oid] ?? oid;
+}
+/**
+* Entrées DNS et IP d'un `subjectAltName` tel que le rend
+* `X509Certificate.subjectAltName` (`DNS:a, IP Address:1.2.3.4`).
+*/
+function parseSubjectAltName(value) {
+	const dns = [];
+	const ip = [];
+	if (!value) return {
+		dns,
+		ip
+	};
+	for (const raw of value.split(/,\s*/)) {
+		const colon = raw.indexOf(":");
+		if (colon < 0) continue;
+		const kind = raw.slice(0, colon);
+		let entry = raw.slice(colon + 1);
+		if (entry.startsWith("\"")) try {
+			entry = String(JSON.parse(entry));
+		} catch {
+			continue;
+		}
+		if (kind === "DNS") dns.push(entry);
+		else if (kind === "IP Address") ip.push(entry);
+	}
+	return {
+		dns,
+		ip
+	};
+}
+/**
+* Valeur d'un champ d'un nom distinctif tel que le rend
+* `X509Certificate.subject` / `.issuer` (une ligne `CLÉ=valeur` par champ).
+*/
+function distinguishedNameField(dn, key) {
+	for (const line of dn.split("\n")) if (line.startsWith(`${key}=`)) return line.slice(key.length + 1);
+	return null;
+}
+/** Contenu de la BIT STRING `subjectPublicKey` d'une SPKI DER. */
+function subjectPublicKeyBits(spki) {
+	const [, key] = children(spki, readNode(spki, 0));
+	if (key?.tag !== 3) throw new Error("Clé publique SPKI sans subjectPublicKey.");
+	return spki.subarray(key.start + 1, key.end);
+}
+function signAsync(hash, data, key) {
+	return new Promise((resolve, reject) => {
+		sign(hash, data, key, (error, signature) => {
+			if (error) reject(error);
+			else resolve(signature);
+		});
+	});
+}
+function toPem(der) {
+	return `-----BEGIN CERTIFICATE-----\n${der.toString("base64").replace(/(.{64})/g, "$1\n").replace(/\n$/, "")}\n-----END CERTIFICATE-----\n`;
+}
+/**
+* Fabrique un certificat serveur auto-signé et le rend en PEM.
+*
+* Contenu : version 3, sujet = émetteur, `basicConstraints` cA=false,
+* `keyUsage` (digitalSignature, keyEncipherment — critique),
+* `extKeyUsage` (serverAuth, clientAuth), `subjectAltName` (critique si le
+* sujet est vide, RFC 5280 §4.2.1.6) et `subjectKeyIdentifier` (SHA-1 de la
+* clé publique, méthode 1 de RFC 5280 §4.2.1.2).
+*
+* @param spec - clés, série, validité, noms et hachage
+* @returns le certificat encodé PEM
+* @throws Si un attribut ou une adresse IP est invalide
+*/
+async function createSelfSignedCertificate(spec) {
+	const spki = spec.publicKey.export({
+		type: "spki",
+		format: "der"
+	});
+	const algorithm = sequence(objectIdentifier(SIGNATURE_OIDS[spec.hash]), DER_NULL);
+	const name = distinguishedName(spec.attributes);
+	const altNames = [...spec.dns.map((dns) => tlv(130, dnsNameBytes(dns))), ...spec.ip.map((ip) => tlv(135, ipAddressBytes(ip)))];
+	const extensions = [
+		extension(OID_BASIC_CONSTRAINTS, false, sequence()),
+		extension(OID_KEY_USAGE, true, tlv(3, Buffer.from([5, 160]))),
+		extension(OID_EXT_KEY_USAGE, false, sequence(objectIdentifier(OID_SERVER_AUTH), objectIdentifier(OID_CLIENT_AUTH)))
+	];
+	if (altNames.length > 0) extensions.push(extension(OID_SUBJECT_ALT_NAME, spec.attributes.length === 0, sequence(...altNames)));
+	extensions.push(extension(OID_SUBJECT_KEY_ID, false, octetString(createHash("sha1").update(subjectPublicKeyBits(spki)).digest())));
+	const tbs = sequence(explicit(0, tlv(2, Buffer.from([2]))), positiveInteger(spec.serialHex), algorithm, name, sequence(time(spec.notBefore), time(spec.notAfter)), name, spki, explicit(3, sequence(...extensions)));
+	const signature = await signAsync(spec.hash, tbs, spec.privateKey);
+	return toPem(sequence(tbs, algorithm, bitString(signature)));
+}
+//#endregion
+export { SHA1_WITH_RSA_OID, createSelfSignedCertificate, distinguishedNameField, ipAddressBytes, parseSubjectAltName, signatureAlgorithmName, signatureAlgorithmOid };

package/dist/nodefony/src/assets/prebuiltUi.js

@@ -99,7 +99,7 @@ var PrebuiltUi = class {
 			return true;
 		}
 		kernel?.once("onReady", () => {
-			(container?.get?.("server-static"))?.addMount?.(this.publicPath, this.distDir);
+			(container?.get?.("server-static"))?.addMount(this.publicPath, this.distDir);
 		});
 		return false;
 	}

package/dist/nodefony/src/context/Context.js

@@ -141,7 +141,7 @@ var Context = class extends Service {
 	scheme;
 	webSocketState = null;
 	constructor(container, type) {
-		super(`${type}`, container);
+		super(type, container);
 		if (PERF_PROBE_SUB) {
 			const p = globalThis.__nfPerfProbe;
 			if (p && p.t0 !== 0n) p.svcNs += Number(process.hrtime.bigint() - p.t0);
@@ -227,7 +227,7 @@ var Context = class extends Service {
 	}
 	phaseStart(name) {
 		if (!this._timingEnabled) return;
-		if (this._phaseIndex === null) this._phaseIndex = /* @__PURE__ */ new Map();
+		this._phaseIndex ??= /* @__PURE__ */ new Map();
 		const idx = this.phases.length;
 		this.phases.push({
 			name,
@@ -239,8 +239,8 @@ var Context = class extends Service {
 		if (!this._timingEnabled || this._phaseIndex === null) return;
 		const idx = this._phaseIndex.get(name);
 		if (idx === void 0) return;
-		const p = this.phases[idx];
-		if (p.endMs !== void 0) return;
+		const p = this.phases.at(idx);
+		if (p === void 0 || p.endMs !== void 0) return;
 		p.endMs = performance.now();
 		p.durationMs = p.endMs - p.startMs;
 	}
@@ -250,15 +250,28 @@ var Context = class extends Service {
 			Promise.resolve().then(() => boundFn(this)).catch((e) => this.log(e, "ERROR", "onAfterResponse(late)"));
 			return;
 		}
-		if (this._afterResponseFns === null) this._afterResponseFns = [];
+		this._afterResponseFns ??= [];
 		this._afterResponseFns.push(boundFn);
 	}
-	async _runAfterResponse() {
-		if (this._afterResponseFired) return;
+	/**
+	* Exécute les hooks `onAfterResponse`, une seule fois, dans l'ordre
+	* d'enregistrement ; un hook qui lève est journalisé sans arrêter les suivants.
+	*
+	* @returns `undefined` quand aucun hook n'est enregistré (le cas nominal) ou
+	*   qu'ils ont déjà tourné : rien à attendre, le démontage continue sans
+	*   suspension. Une `Promise` sinon, réglée quand le dernier hook a fini — elle
+	*   ne rejette jamais.
+	*/
+	_runAfterResponse() {
+		if (this._afterResponseFired) return void 0;
 		this._afterResponseFired = true;
 		const fns = this._afterResponseFns;
-		if (fns === null || fns.length === 0) return;
+		if (fns === null || fns.length === 0) return void 0;
 		this._afterResponseFns = null;
+		return this.runAfterResponseHooks(fns);
+	}
+	/** Boucle des hooks `onAfterResponse` — séquentielle, erreurs journalisées. */
+	async runAfterResponseHooks(fns) {
 		for (const fn of fns) try {
 			await fn(this);
 		} catch (e) {
@@ -298,7 +311,7 @@ var Context = class extends Service {
 	* notable → INFO (EVENT_SEVERITY), event technique → DEBUG.
 	*/
 	logEvent(event) {
-		if (lifecycleEventLogging === null) lifecycleEventLogging = this.kernel?.environment !== "production";
+		lifecycleEventLogging ??= this.kernel?.environment !== "production";
 		if (!lifecycleEventLogging) return;
 		this.log(`${colorLogEvent()} ${event}`, EVENT_SEVERITY[event] || "DEBUG");
 	}
@@ -327,7 +340,9 @@ var Context = class extends Service {
 			if (logger.shouldSample && !logger.shouldSample(this, err)) return;
 			const entry = logger.renderHttp(this, err);
 			return this.log(entry.text, entry.severity, entry.msgid);
-		} catch {}
+		} catch {
+			return;
+		}
 	}
 	/**
 	* P3.7 — Émet au teardown un log DEBUG détaillant la durée de chaque phase du
@@ -339,18 +354,18 @@ var Context = class extends Service {
 	logPhasesVerbose() {
 		if (!this._timingVerbose) return;
 		const phases = this.phases;
-		const n = phases.length;
-		if (n === 0) return;
+		if (phases.length === 0) return;
 		let line = "";
 		let total = 0;
-		for (let i = 0; i < n; i++) {
-			const p = phases[i];
+		let i = 0;
+		for (const p of phases) {
 			const d = p.durationMs ?? (p.endMs !== void 0 ? p.endMs - p.startMs : void 0);
 			if (i > 0) line += " · ";
 			if (d !== void 0) {
 				line += `${p.name}=${d.toFixed(2)}ms`;
 				total += d;
 			} else line += `${p.name}=…`;
+			i++;
 		}
 		this.log(`TRACE phases [Σ ${total.toFixed(2)}ms] ${line}`, "DEBUG", `${this.type} TIMING`);
 	}
@@ -363,11 +378,12 @@ var Context = class extends Service {
 		}
 	}
 	getRequestCookies(name) {
-		if (name) return this.cookies[name] || null;
+		if (name) return Object.hasOwn(this.cookies, name) ? this.cookies[name] ?? null : null;
 		return this.cookies;
 	}
 	setCookie(cookie) {
-		if (cookie) return this.response?.addCookie(cookie);
+		const received = cookie;
+		if (received) return this.response?.addCookie(received);
 	}
 	getRequest() {
 		return this.request;
@@ -387,8 +403,7 @@ var Context = class extends Service {
 		return Boolean(this.cookieSession);
 	}
 	getCookieSession(name) {
-		if (this.cookies[name]) return this.cookies[name];
-		return null;
+		return Object.hasOwn(this.cookies, name) ? this.cookies[name] ?? null : null;
 	}
 	/**
 	* Nom effectif du cookie de session pour CE transport. Sur TLS (https/wss) on
@@ -401,7 +416,7 @@ var Context = class extends Service {
 	*/
 	getSessionCookieName() {
 		const base = this.sessionService?.defaultSessionName ?? "nodefony";
-		const mode = (this.sessionService?.options?.cookie)?.hostPrefix ?? "auto";
+		const mode = (this.sessionService?.options.cookie)?.hostPrefix ?? "auto";
 		const tls = this.scheme === "https" || this.scheme === "wss";
 		return mode === true || mode === "auto" && tls ? `__Host-${base}` : base;
 	}

package/dist/nodefony/src/context/forwarded.js

@@ -8,7 +8,7 @@ import { isIPv4 } from "node:net";
 * un point de coupe. Les `\"` échappés à l'intérieur des guillemets sont préservés.
 */
 function splitTopLevel(input, sep) {
-	if (input.indexOf("\"") === -1) return input.split(sep);
+	if (!input.includes("\"")) return input.split(sep);
 	const out = [];
 	let buf = "";
 	let inQuote = false;
@@ -43,7 +43,7 @@ function splitTopLevel(input, sep) {
 /** Retire les guillemets d'une `quoted-string` et déséchappe `\x` (RFC 7230 §3.2.6). */
 function unquote(value) {
 	const v = value.trim();
-	if (v.length >= 2 && v[0] === "\"" && v[v.length - 1] === "\"") return v.slice(1, -1).replace(/\\(.)/gu, "$1");
+	if (v.length >= 2 && v.startsWith("\"") && v.endsWith("\"")) return v.slice(1, -1).replace(/\\(.)/gu, "$1");
 	return v;
 }
 /**
@@ -104,11 +104,11 @@ function forwardedNodeIp(node) {
 	if (!node) return null;
 	const n = node.trim();
 	if (!n) return null;
-	if (n[0] === "[") {
+	if (n.startsWith("[")) {
 		const end = n.indexOf("]");
 		return end > 1 ? n.slice(1, end) : null;
 	}
-	if (n === "unknown" || n[0] === "_") return null;
+	if (n === "unknown" || n.startsWith("_")) return null;
 	const colon = n.indexOf(":");
 	const host = colon === -1 ? n : n.slice(0, colon);
 	return isIPv4(host) ? host : host || null;