@nodefony/http 10.0.0-beta.1 → 10.0.0-beta.2

package/README.md

@@ -6,7 +6,7 @@ pipeline de contexte/controller.
 
 > Docs IA (dans le dépôt) : [`CLAUDE.md`](https://github.com/nodefony/nodefony-core/blob/main/src/packages/@nodefony/http/CLAUDE.md) · [`MEMORY.md`](https://github.com/nodefony/nodefony-core/blob/main/src/packages/@nodefony/http/MEMORY.md) · [`docs/`](./docs).
 > Règle dure : ce module ne peut PAS importer `@nodefony/framework` (cycle) — accès au resolver
-> via `(context as any)?.resolver`.
+> via `context.resolver`, typé par le contrat `IRouteResolver` que ce module définit.
 
 ## Serveurs
 
@@ -26,11 +26,13 @@ serveur → http-kernel.handle() → rate-limit IP → createContext()
    → Router.resolve()                (match avant le parse du body)
    → Firewall.applySecurityHeaders() → fallback statique si aucune route
    → parse du body
-   → handleFrontController() (Resolver.resolve → controller + initialize())
+   → prepareFrontController()        (route + zone armées, AUCUNE instanciation)
    → Firewall.enforceCsrf() → startSession() → Firewall.handleSecurity()
-   → action du controller → Response.send()
+   → @IsGranted → instanciation DI + initialize() → action du controller → Response.send()
 ```
 
+En WebSocket, le contrôleur est instancié au handshake (`handleFrontController()`), avant le pare-feu.
+
 Chaque contexte (HTTP + WS) porte un `requestId` (UUID v4, ou `X-Request-Id` client),
 réinjecté dans la réponse et corrélé dans les logs via AsyncLocalStorage.
 

package/dist/_virtual/{_@oxc-project_runtime@0.151.0 → _@oxc-project_runtime@0.152.0}/helpers/esm/decorate.js

@@ -1,4 +1,4 @@
-//#region \0@oxc-project+runtime@0.151.0/helpers/esm/decorate.js
+//#region \0@oxc-project+runtime@0.152.0/helpers/esm/decorate.js
 function __decorate(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
 	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);

package/dist/_virtual/{_@oxc-project_runtime@0.151.0 → _@oxc-project_runtime@0.152.0}/helpers/esm/decorateMetadata.js

@@ -1,4 +1,4 @@
-//#region \0@oxc-project+runtime@0.151.0/helpers/esm/decorateMetadata.js
+//#region \0@oxc-project+runtime@0.152.0/helpers/esm/decorateMetadata.js
 function __decorateMetadata(k, v) {
 	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }

package/dist/_virtual/{_@oxc-project_runtime@0.151.0 → _@oxc-project_runtime@0.152.0}/helpers/esm/decorateParam.js

@@ -1,4 +1,4 @@
-//#region \0@oxc-project+runtime@0.151.0/helpers/esm/decorateParam.js
+//#region \0@oxc-project+runtime@0.152.0/helpers/esm/decorateParam.js
 function __decorateParam(paramIndex, decorator) {
 	return function(target, key) {
 		decorator(target, key, paramIndex);

package/dist/index.js

@@ -21,8 +21,8 @@ import DefaultErrorRenderer, { schemaMismatchOf } from "./nodefony/service/error
 import DefaultRequestLogger from "./nodefony/service/request-logger.js";
 import JsonAuditLogger from "./nodefony/service/audit-logger.js";
 import PrettyRequestLogger from "./nodefony/service/pretty-request-logger.js";
-import __decorateMetadata from "./_virtual/_@oxc-project_runtime@0.151.0/helpers/esm/decorateMetadata.js";
-import __decorate from "./_virtual/_@oxc-project_runtime@0.151.0/helpers/esm/decorate.js";
+import __decorateMetadata from "./_virtual/_@oxc-project_runtime@0.152.0/helpers/esm/decorateMetadata.js";
+import __decorate from "./_virtual/_@oxc-project_runtime@0.152.0/helpers/esm/decorate.js";
 import http_kernel_default from "./nodefony/service/http-kernel.js";
 import server_http_default from "./nodefony/service/servers/server-http.js";
 import server_https_default from "./nodefony/service/servers/server-https.js";

package/dist/nodefony/command/certificatesCommand.js

@@ -26,7 +26,6 @@ var Certificates = class extends Command {
 			this.log("Service 'certificates' introuvable (module @nodefony/http non chargé).", "ERROR");
 			return this;
 		}
-		await service.loadForge();
 		await service.generateServerCertificates(Boolean(opts.force));
 		const info = await service.describe();
 		if (opts.json) process.stdout.write(`${JSON.stringify(info, void 0, 2)}\n`);

package/dist/nodefony/config/config.js

@@ -159,8 +159,9 @@ const http3Schema = z.looseObject({});
 const selfSignedAttrSchema = z.looseObject({
 	name: z.string().optional(),
 	value: z.string().optional(),
-	shortName: z.string().optional()
-}).describe("Champ de sujet/issuer node-forge (CertificateField).");
+	shortName: z.string().optional(),
+	type: z.string().optional()
+}).describe("Attribut du sujet/émetteur : `name` (commonName…), `shortName` (CN…) ou `type` (OID), et `value`.");
 const selfSignedSchema = z.strictObject({
 	size: z.number().int().positive().default(2048).describe("Taille de la clé RSA (bits). 2048 minimum, 4096 recommandé en prod."),
 	hash: z.enum([
@@ -174,7 +175,7 @@ const selfSignedSchema = z.strictObject({
 		kernelDerived: true,
 		description: "Attributs du certificat (commonName, organizationName…). Vide (défaut) = dérivés du kernel par le builder (commonName ← domain)."
 	})
-}).describe("Génération du certificat AUTO-SIGNÉ (node-forge, JavaScript pur — aucun binaire externe n'est invoqué). Ces réglages ne valent QUE pour la stratégie `selfsigned` : sous `mkcert` (défaut en développement) ils sont ignorés — mkcert ne reçoit que les noms d'hôtes — et sous `strategy: \"explicit\"` le certificat est fourni, donc rien n'est généré.");
+}).describe("Génération du certificat AUTO-SIGNÉ (node:crypto — aucun binaire externe ni dépendance tierce). Ces réglages ne valent QUE pour la stratégie `selfsigned` : sous `mkcert` (défaut en développement) ils sont ignorés — mkcert ne reçoit que les noms d'hôtes — et sous `strategy: \"explicit\"` le certificat est fourni, donc rien n'est généré.");
 const sanSchema = z.strictObject({
 	dns: z.array(z.string()).default([]).meta({
 		kernelDerived: true,

package/dist/nodefony/service/certificates.js

@@ -1,12 +1,14 @@
 import { asServersConfig } from "../src/servers/kernelServers.js";
+import { SHA1_WITH_RSA_OID, createSelfSignedCertificate, distinguishedNameField, parseSubjectAltName, signatureAlgorithmName, signatureAlgorithmOid } from "./x509.js";
 import { Service, extend } from "nodefony";
-import { randomBytes } from "node:crypto";
+import { X509Certificate, generateKeyPair, randomBytes } from "node:crypto";
 import fsp from "node:fs/promises";
 import path, { resolve } from "node:path";
 import { promisify } from "node:util";
 import { execFile } from "node:child_process";
 //#region nodefony/service/certificates.ts
 const execFileAsync = promisify(execFile);
+const generateKeyPairAsync = promisify(generateKeyPair);
 /**
 * Vrai si `host` est une IP littérale (IPv4 `n.n.n.n` ou IPv6 — contient `:`).
 * Une IP doit aller en SAN `iPAddress`, jamais en `dNSName` (RFC 6125).
@@ -32,20 +34,11 @@ const defaultOptions = {
 	}
 };
 /**
-* Valeur texte d'un champ de certificat node-forge (`getField` rend `any`),
-* ou `null` si le champ est absent.
-*/
-function certFieldValue(field) {
-	if (field === null || typeof field !== "object") return null;
-	const value = field.value;
-	return typeof value === "string" ? value : String(value);
-}
-/**
 * Service de fourniture du certificat TLS du serveur HTTPS/WSS.
 *
 * Trois stratégies : `explicit` (certificat fourni en config — le cas de
 * PRODUCTION), `mkcert` (CA locale trustée, confort de dev) et `selfsigned`
-* (auto-signé node-forge, secours). La génération est réservée au
+* (auto-signé, secours). La génération est réservée au
 * DÉVELOPPEMENT : en production sans certificat fourni, le service crie un
 * avertissement (Nodefony n'est pas une autorité de certification).
 *
@@ -58,7 +51,6 @@ var Certificate = class Certificate extends Service {
 	module;
 	files = [];
 	keysPair = null;
-	certForge = null;
 	ca = "";
 	key = "";
 	cert = "";
@@ -68,13 +60,6 @@ var Certificate = class Certificate extends Service {
 	intermediateCertPem = "";
 	/** CAROOT résolu de mkcert (null tant que non détecté / indisponible). */
 	mkcertCaRoot = null;
-	/**
-	* Backend crypto node-forge, chargé PARESSEUSEMENT. La génération de
-	* certificat est un confort de DÉVELOPPEMENT : en production avec un
-	* certificat fourni (`strategy: "explicit"`), cette grosse dépendance n'est
-	* jamais importée (règle perf-mémoire — pas de dep chargée « au cas où »).
-	*/
-	forge = null;
 	path = resolve(".", "nodefony", "config", "certificates");
 	serverPath = resolve(this.path, "server");
 	caPath = resolve(this.path, "ca", "nodefony-root-ca.crt.pem");
@@ -95,20 +80,6 @@ var Certificate = class Certificate extends Service {
 		return this.kernel?.environment === "development";
 	}
 	/**
-	* Charge node-forge à la demande (idempotent) — uniquement sur le chemin de
-	* GÉNÉRATION (selfsigned / mkcert / inspection). Le chemin `explicit` (prod)
-	* ne l'appelle jamais.
-	*/
-	async loadForge() {
-		this.forge ??= (await import("node-forge")).default;
-		return this.forge;
-	}
-	/** Accès au backend forge déjà chargé (lève si `loadForge` n'a pas été appelé). */
-	get forgeLib() {
-		if (!this.forge) throw new Error("node-forge non chargé — appeler loadForge() avant toute génération.");
-		return this.forge;
-	}
-	/**
 	* Fabrique-t-on un certificat au démarrage ?
 	*
 	* 🔴 Seulement si un serveur TLS est ACTIF. Sans cette question, le hook
@@ -199,7 +170,7 @@ var Certificate = class Certificate extends Service {
 	/**
 	* Génère (ou recharge) le certificat serveur selon la stratégie résolue :
 	* `explicit` (fourni en config / prod), `mkcert` (dev, CA trustée) ou
-	* `selfsigned` (auto-signé node-forge, secours). Régénère automatiquement si
+	* `selfsigned` (auto-signé, secours). Régénère automatiquement si
 	* le certificat présent sur disque n'est pas adéquat pour la stratégie active
 	* (expiré, SHA-1, SAN incomplet).
 	*
@@ -210,17 +181,13 @@ var Certificate = class Certificate extends Service {
 		await this.ensureDirectoriesExist();
 		const strategy = await this.resolveStrategy();
 		if (strategy === "explicit") return this.loadExplicitCert();
-		await this.loadForge();
 		if (await this.checkCertificates() && !force && await this.isCertAdequate(strategy)) return this.readCerticates();
 		if (strategy === "mkcert") await this.generateWithMkcert();
 		else {
-			this.keysPair = this.generateKeys();
-			this.certForge = this.createCertificate();
-			this.setExtension();
-			this.sign();
+			this.keysPair = await this.generateKeys();
 			this.key = this.generatePrivateKeyPem();
 			this.publicKeyPem = this.generatePublickeyPem();
-			const certPem = this.generateCertPem();
+			const certPem = await this.createCertificate();
 			this.cert = certPem;
 			this.ca = certPem;
 			this.fullchainPem = this.createFullChain();
@@ -236,7 +203,7 @@ var Certificate = class Certificate extends Service {
 	*   erreur si absents.
 	* - `mkcert` : dev + binaire mkcert + CA locale présents. Forcé hors dev →
 	*   retombe sur `selfsigned` avec avertissement.
-	* - `selfsigned` : auto-signé node-forge (fallback). En PRODUCTION, crie un
+	* - `selfsigned` : auto-signé (fallback). En PRODUCTION, crie un
 	*   avertissement : la génération n'est pas le rôle d'un serveur de prod.
 	*/
 	async resolveStrategy() {
@@ -253,7 +220,7 @@ var Certificate = class Certificate extends Service {
 					this.mkcertCaRoot = caRoot;
 					return "mkcert";
 				}
-				this.log((requested === "mkcert" ? "strategy='mkcert' mais mkcert introuvable — " : "mkcert introuvable — ") + "fallback certificat auto-signé node-forge (non trusté). `brew install mkcert nss && mkcert -install` pour un HTTPS dev sans erreur (HMR cross-origin/WSS).", "WARNING");
+				this.log((requested === "mkcert" ? "strategy='mkcert' mais mkcert introuvable — " : "mkcert introuvable — ") + "fallback certificat auto-signé (non trusté). `brew install mkcert nss && mkcert -install` pour un HTTPS dev sans erreur (HMR cross-origin/WSS).", "WARNING");
 			} else if (requested === "mkcert") this.log("strategy='mkcert' ignoré hors development → certificat auto-signé.", "WARNING");
 		}
 		if (!this.isDev()) this.log("Aucun certificat TLS fourni en PRODUCTION : génération d'un auto-signé NON trusté (secours). Nodefony n'est PAS une autorité de certification de production — fournissez un vrai certificat (Let's Encrypt, ingress k8s, reverse-proxy edge) via certificates.{ key, cert, ca } (strategy='explicit').", "WARNING");
@@ -330,8 +297,10 @@ var Certificate = class Certificate extends Service {
 		await this.restrictPrivateKey();
 		const rootCaPem = await fsp.readFile(path.join(caRoot, "rootCA.pem"), "utf8");
 		const certPem = await fsp.readFile(this.certPath, "utf8");
-		const { pki } = this.forgeLib;
-		const publicKeyPem = pki.publicKeyToPem(pki.certificateFromPem(certPem).publicKey);
+		const publicKeyPem = new X509Certificate(certPem).publicKey.export({
+			type: "spki",
+			format: "pem"
+		});
 		await fsp.writeFile(this.publicKeyPath, publicKeyPem, "utf8");
 		await fsp.writeFile(this.fullchainPath, `${certPem}${rootCaPem}`, "utf8");
 		await fsp.writeFile(this.caPath, rootCaPem, "utf8");
@@ -348,25 +317,21 @@ var Certificate = class Certificate extends Service {
 	*/
 	async isCertAdequate(strategy) {
 		try {
-			const { pki } = this.forgeLib;
-			const certPem = await fsp.readFile(this.certPath, "utf8");
-			const cert = pki.certificateFromPem(certPem);
-			if (cert.validity.notAfter.getTime() <= Date.now()) return false;
-			const ext = cert.getExtension("subjectAltName");
-			if (!ext || !this.sanCovers(ext.altNames ?? [])) return false;
+			const cert = new X509Certificate(await fsp.readFile(this.certPath));
+			if (cert.validToDate.getTime() <= Date.now()) return false;
+			if (!this.sanCovers(parseSubjectAltName(cert.subjectAltName).dns)) return false;
 			if (strategy === "mkcert") {
-				const org = certFieldValue(cert.issuer.getField("O"));
+				const org = distinguishedNameField(cert.issuer, "O");
 				return org !== null && /mkcert/i.test(org);
 			}
-			return cert.signatureOid !== pki.oids.sha1WithRSAEncryption;
+			return signatureAlgorithmOid(cert.raw) !== SHA1_WITH_RSA_OID;
 		} catch {
 			return false;
 		}
 	}
 	/** Le SAN présent couvre-t-il tous les noms DNS requis (RFC 6125) ? */
-	sanCovers(present) {
-		const presentDns = new Set(present.filter((p) => p.type === 2 && p.value).map((p) => p.value));
-		return this.sanDnsNames().every((name) => presentDns.has(name));
+	sanCovers(presentDns) {
+		return this.sanDnsNames().every((name) => presentDns.includes(name));
 	}
 	/** Charge un certificat fourni en config (chemin fichier ou Buffer). */
 	async loadExplicitCert() {
@@ -452,86 +417,58 @@ var Certificate = class Certificate extends Service {
 			this.log(err, "DEBUG");
 		}
 	}
-	generateKeys() {
-		return this.forgeLib.pki.rsa.generateKeyPair(this.certOptions.selfSigned.size);
+	/** Génère la paire RSA (taille configurée) hors de la boucle d'événements. */
+	async generateKeys() {
+		return generateKeyPairAsync("rsa", { modulusLength: this.certOptions.selfSigned.size });
 	}
+	/** Clé privée en PEM PKCS#1 (`BEGIN RSA PRIVATE KEY`). */
 	generatePrivateKeyPem() {
-		if (this.keysPair) return Buffer.from(this.forgeLib.pki.privateKeyToPem(this.keysPair.privateKey));
-		throw new Error(`pki.rsa.KeyPair  not found`);
+		if (this.keysPair) return Buffer.from(this.keysPair.privateKey.export({
+			type: "pkcs1",
+			format: "pem"
+		}));
+		throw new Error(`KeyPair not found`);
 	}
+	/** Clé publique en PEM SPKI (`BEGIN PUBLIC KEY`). */
 	generatePublickeyPem() {
-		if (this.keysPair) return Buffer.from(this.forgeLib.pki.publicKeyToPem(this.keysPair.publicKey));
-		throw new Error(`pki.rsa.KeyPair  not found`);
+		if (this.keysPair) return Buffer.from(this.keysPair.publicKey.export({
+			type: "spki",
+			format: "pem"
+		}));
+		throw new Error(`KeyPair not found`);
 	}
-	generateCertPem() {
-		if (this.certForge) return Buffer.from(this.forgeLib.pki.certificateToPem(this.certForge));
-		throw new Error(`pki.Certificate  not found`);
-	}
-	createCertificate() {
+	/**
+	* Fabrique et signe le certificat auto-signé avec la paire courante.
+	*
+	* Série aléatoire unique (RFC 5280 §4.1.2.2), `notBefore` reculé (décalage
+	* d'horloge du client), SAN DNS + IP (config explicite sinon dérivé), signé
+	* avec le hachage configuré — jamais SHA-1 (collision SHAttered 2017,
+	* CA/Browser Forum depuis 2016).
+	*
+	* @returns le certificat en PEM
+	* @throws Si la paire de clés n'a pas été générée
+	*/
+	async createCertificate() {
 		if (!this.keysPair) throw new Error(`KeyPair  not found`);
 		const o = this.certOptions.selfSigned;
-		const cert = this.forgeLib.pki.createCertificate();
-		cert.publicKey = this.keysPair.publicKey;
-		cert.serialNumber = Certificate.generateSerialHex();
-		const backdateMs = o.backdateMinutes * 6e4;
-		const start = Date.now() - backdateMs;
-		cert.validity.notBefore = new Date(start);
-		cert.validity.notAfter = new Date(start + o.validityDays * 864e5);
-		cert.setSubject(o.attrs);
-		cert.setIssuer(o.attrs);
-		return cert;
-	}
-	/** subjectAltName de l'auto-signé : DNS + IP (config explicite sinon dérivé). */
-	altNames() {
-		const out = [];
-		for (const dns of this.sanDnsNames()) out.push({
-			type: 2,
-			value: dns
+		const start = Date.now() - o.backdateMinutes * 6e4;
+		const pem = await createSelfSignedCertificate({
+			privateKey: this.keysPair.privateKey,
+			publicKey: this.keysPair.publicKey,
+			serialHex: Certificate.generateSerialHex(),
+			notBefore: new Date(start),
+			notAfter: new Date(start + o.validityDays * 864e5),
+			attributes: o.attrs,
+			dns: this.sanDnsNames(),
+			ip: this.sanIps(),
+			hash: this.allowedHash(o.hash)
 		});
-		for (const ip of this.sanIps()) out.push({
-			type: 7,
-			ip
-		});
-		return out;
-	}
-	setExtension() {
-		if (!this.certForge) throw new Error(`pki.Certificate  not found`);
-		this.certForge.setExtensions([
-			{
-				name: "basicConstraints",
-				cA: false
-			},
-			{
-				name: "keyUsage",
-				digitalSignature: true,
-				keyEncipherment: true
-			},
-			{
-				name: "extKeyUsage",
-				serverAuth: true,
-				clientAuth: true
-			},
-			{
-				name: "subjectAltName",
-				altNames: this.altNames()
-			},
-			{ name: "subjectKeyIdentifier" }
-		]);
-	}
-	/**
-	* Signe le certificat avec le hachage configuré (SHA-256 par défaut).
-	* SHA-1 est INTERDIT (collision SHAttered 2017, CA/Browser Forum depuis 2016) :
-	* `node-forge` signe en SHA-1 par défaut si on ne passe pas de digest → on en
-	* passe toujours un.
-	*/
-	sign() {
-		if (!this.certForge || !this.keysPair) throw new Error(`pki.rsa.KeyPair or pki.Certificate  not found`);
-		this.certForge.sign(this.keysPair.privateKey, this.digestFor(this.certOptions.selfSigned.hash));
+		return Buffer.from(pem);
 	}
 	/**
 	* Résumé introspectable du certificat serveur courant — réutilisé par la
 	* commande CLI `certificates` et un futur endpoint d'admin Studio (parité
-	* CLI ↔ Web). Parse le certificat chargé (charge node-forge à la demande).
+	* CLI ↔ Web).
 	*/
 	async describe() {
 		const info = {
@@ -545,35 +482,29 @@ var Certificate = class Certificate extends Service {
 			info.caPath = this.caPath;
 		} catch {}
 		if (!this.cert) return info;
-		const { pki } = await this.loadForge();
 		try {
-			const cert = pki.certificateFromPem(this.cert.toString());
-			info.serial = cert.serialNumber;
-			info.validFrom = cert.validity.notBefore.toISOString();
-			info.validTo = cert.validity.notAfter.toISOString();
-			info.signatureAlgorithm = this.oidName(cert.signatureOid, pki);
-			const cn = certFieldValue(cert.subject.getField("CN"));
+			const cert = new X509Certificate(this.cert);
+			info.serial = cert.serialNumber.toLowerCase();
+			info.validFrom = cert.validFromDate.toISOString();
+			info.validTo = cert.validToDate.toISOString();
+			info.signatureAlgorithm = signatureAlgorithmName(signatureAlgorithmOid(cert.raw));
+			const cn = cert.subject ? distinguishedNameField(cert.subject, "CN") : null;
 			if (cn !== null) info.commonName = cn;
-			const ext = cert.getExtension("subjectAltName");
-			if (ext?.altNames) info.san = ext.altNames.map((a) => a.type === 7 ? a.ip ?? "" : a.value ?? "");
+			const san = parseSubjectAltName(cert.subjectAltName);
+			if (san.dns.length > 0 || san.ip.length > 0) info.san = [...san.dns, ...san.ip];
 		} catch {}
 		return info;
 	}
-	/** Nom lisible de l'OID d'algorithme de signature. */
-	oidName(oid, pki) {
-		return pki.oids[oid] ?? oid;
-	}
-	/** Digest node-forge correspondant au hachage configuré (jamais SHA-1). */
-	digestFor(hash) {
-		const { md } = this.forgeLib;
+	/** Hachage configuré, ramené à SHA-256 s'il sort du contrat (jamais SHA-1). */
+	allowedHash(hash) {
 		switch (hash) {
-			case "sha512": return md.sha512.create();
-			case "sha384": return md.sha384.create();
-			case "sha256": return md.sha256.create();
+			case "sha512":
+			case "sha384":
+			case "sha256": return hash;
 			default: {
 				const refused = hash;
 				this.log(`Hachage '${refused}' refusé (SHA-1 interdit) → SHA-256.`, "WARNING");
-				return md.sha256.create();
+				return "sha256";
 			}
 		}
 	}

package/dist/nodefony/service/http-kernel.js

@@ -12,8 +12,8 @@ import JsonAuditLogger from "./audit-logger.js";
 import PrettyRequestLogger from "./pretty-request-logger.js";
 import { resolveTraceparent } from "./trace.js";
 import { asServersConfig, configuredServerPort } from "../src/servers/kernelServers.js";
-import __decorateMetadata from "../../_virtual/_@oxc-project_runtime@0.151.0/helpers/esm/decorateMetadata.js";
-import __decorate from "../../_virtual/_@oxc-project_runtime@0.151.0/helpers/esm/decorate.js";
+import __decorateMetadata from "../../_virtual/_@oxc-project_runtime@0.152.0/helpers/esm/decorateMetadata.js";
+import __decorate from "../../_virtual/_@oxc-project_runtime@0.152.0/helpers/esm/decorate.js";
 import { GcScheduler, Module, RequestContext, Service, finallyMaybe, injectable, isPromise, logColor, nodefonyError, servedUrl, thenMaybe, writeRuntimeState } from "nodefony";
 import cluster from "node:cluster";
 import http from "node:http";

package/dist/nodefony/service/servers/server-http.js

@@ -1,11 +1,11 @@
 import { asServersConfig, configuredServerPort } from "../../src/servers/kernelServers.js";
-import __decorateMetadata from "../../../_virtual/_@oxc-project_runtime@0.151.0/helpers/esm/decorateMetadata.js";
-import __decorate from "../../../_virtual/_@oxc-project_runtime@0.151.0/helpers/esm/decorate.js";
+import __decorateMetadata from "../../../_virtual/_@oxc-project_runtime@0.152.0/helpers/esm/decorateMetadata.js";
+import __decorate from "../../../_virtual/_@oxc-project_runtime@0.152.0/helpers/esm/decorate.js";
 import http_kernel_default from "../http-kernel.js";
 import { handleClientError } from "./clientError.js";
 import { createDrainTerminator } from "./serverShutdown.js";
 import { bindWithFallback, buildBindPlan } from "../../src/servers/portBinder.js";
-import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.151.0/helpers/esm/decorateParam.js";
+import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.152.0/helpers/esm/decorateParam.js";
 import { Module, Service, extend, inject, nodefonyError } from "nodefony";
 import http from "node:http";
 //#region nodefony/service/servers/server-http.ts

package/dist/nodefony/service/servers/server-https.js

@@ -1,11 +1,11 @@
 import { asServersConfig, configuredServerPort } from "../../src/servers/kernelServers.js";
-import __decorateMetadata from "../../../_virtual/_@oxc-project_runtime@0.151.0/helpers/esm/decorateMetadata.js";
-import __decorate from "../../../_virtual/_@oxc-project_runtime@0.151.0/helpers/esm/decorate.js";
+import __decorateMetadata from "../../../_virtual/_@oxc-project_runtime@0.152.0/helpers/esm/decorateMetadata.js";
+import __decorate from "../../../_virtual/_@oxc-project_runtime@0.152.0/helpers/esm/decorate.js";
 import http_kernel_default from "../http-kernel.js";
 import { handleClientError } from "./clientError.js";
 import { createDrainTerminator } from "./serverShutdown.js";
 import { bindWithFallback, buildBindPlan } from "../../src/servers/portBinder.js";
-import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.151.0/helpers/esm/decorateParam.js";
+import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.152.0/helpers/esm/decorateParam.js";
 import { Module, Service, extend, inject, nodefonyError } from "nodefony";
 import http2 from "node:http2";
 import https from "node:https";

package/dist/nodefony/service/servers/server-websocket-secure.js

@@ -1,8 +1,8 @@
 import { asServersConfig, configuredServerPort } from "../../src/servers/kernelServers.js";
-import __decorateMetadata from "../../../_virtual/_@oxc-project_runtime@0.151.0/helpers/esm/decorateMetadata.js";
-import __decorate from "../../../_virtual/_@oxc-project_runtime@0.151.0/helpers/esm/decorate.js";
+import __decorateMetadata from "../../../_virtual/_@oxc-project_runtime@0.152.0/helpers/esm/decorateMetadata.js";
+import __decorate from "../../../_virtual/_@oxc-project_runtime@0.152.0/helpers/esm/decorate.js";
 import http_kernel_default from "../http-kernel.js";
-import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.151.0/helpers/esm/decorateParam.js";
+import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.152.0/helpers/esm/decorateParam.js";
 import { startHeartbeat, trackPong } from "./wsHeartbeat.js";
 import { Module, Service, inject } from "nodefony";
 import Ws, { WebSocketServer } from "ws";

package/dist/nodefony/service/servers/server-websocket.js

@@ -1,8 +1,8 @@
 import { asServersConfig, configuredServerPort } from "../../src/servers/kernelServers.js";
-import __decorateMetadata from "../../../_virtual/_@oxc-project_runtime@0.151.0/helpers/esm/decorateMetadata.js";
-import __decorate from "../../../_virtual/_@oxc-project_runtime@0.151.0/helpers/esm/decorate.js";
+import __decorateMetadata from "../../../_virtual/_@oxc-project_runtime@0.152.0/helpers/esm/decorateMetadata.js";
+import __decorate from "../../../_virtual/_@oxc-project_runtime@0.152.0/helpers/esm/decorate.js";
 import http_kernel_default from "../http-kernel.js";
-import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.151.0/helpers/esm/decorateParam.js";
+import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.152.0/helpers/esm/decorateParam.js";
 import { startHeartbeat, trackPong } from "./wsHeartbeat.js";
 import { Module, Service, inject } from "nodefony";
 import Ws, { WebSocketServer } from "ws";

package/dist/nodefony/service/sessions/sessions-service.js

@@ -1,8 +1,8 @@
 import { SESSION_FACETS } from "../../src/session/storage/sessionFilters.js";
-import __decorateMetadata from "../../../_virtual/_@oxc-project_runtime@0.151.0/helpers/esm/decorateMetadata.js";
-import __decorate from "../../../_virtual/_@oxc-project_runtime@0.151.0/helpers/esm/decorate.js";
+import __decorateMetadata from "../../../_virtual/_@oxc-project_runtime@0.152.0/helpers/esm/decorateMetadata.js";
+import __decorate from "../../../_virtual/_@oxc-project_runtime@0.152.0/helpers/esm/decorate.js";
 import http_kernel_default from "../http-kernel.js";
-import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.151.0/helpers/esm/decorateParam.js";
+import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.152.0/helpers/esm/decorateParam.js";
 import Session from "../../src/session/session.js";
 import MemorySessionStorage from "../../src/session/storage/MemorySessionStorage.js";
 import RevocationGuardStorage from "../../src/session/storage/RevocationGuardStorage.js";

package/dist/nodefony/service/trace.js

@@ -66,7 +66,8 @@ function resolveTraceparent(header) {
 		const newSpanId = randomHex(8);
 		return `${parsed.version}-${parsed.traceId}-${newSpanId}-${parsed.flags}`;
 	}
-	return `00-${randomHex(16)}-${randomHex(8)}-01`;
+	const hex = randomHex(24);
+	return `00-${hex.slice(0, 32)}-${hex.slice(32)}-01`;
 }
 //#endregion
 export { parseTraceparent, resolveTraceparent };

package/dist/nodefony/service/upload/upload-service.js

@@ -1,7 +1,7 @@
-import __decorateMetadata from "../../../_virtual/_@oxc-project_runtime@0.151.0/helpers/esm/decorateMetadata.js";
-import __decorate from "../../../_virtual/_@oxc-project_runtime@0.151.0/helpers/esm/decorate.js";
+import __decorateMetadata from "../../../_virtual/_@oxc-project_runtime@0.152.0/helpers/esm/decorateMetadata.js";
+import __decorate from "../../../_virtual/_@oxc-project_runtime@0.152.0/helpers/esm/decorate.js";
 import http_kernel_default from "../http-kernel.js";
-import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.151.0/helpers/esm/decorateParam.js";
+import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.152.0/helpers/esm/decorateParam.js";
 import { Cli, FileClass, Module, Service, inject } from "nodefony";
 import fs from "node:fs";
 import fsp from "node:fs/promises";