@nodefony/http 10.0.0-beta.2 → 10.0.0-beta.4

package/dist/nodefony/service/servers/server-https.js

@@ -1,16 +1,14 @@
 import { asServersConfig, configuredServerPort } from "../../src/servers/kernelServers.js";
-import __decorateMetadata from "../../../_virtual/_@oxc-project_runtime@0.152.0/helpers/esm/decorateMetadata.js";
-import __decorate from "../../../_virtual/_@oxc-project_runtime@0.152.0/helpers/esm/decorate.js";
-import http_kernel_default from "../http-kernel.js";
-import { handleClientError } from "./clientError.js";
+import __decorate from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorate.js";
+import { handleClientError, handleSessionError } from "./clientError.js";
 import { createDrainTerminator } from "./serverShutdown.js";
 import { bindWithFallback, buildBindPlan } from "../../src/servers/portBinder.js";
-import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.152.0/helpers/esm/decorateParam.js";
-import { Module, Service, extend, inject, nodefonyError } from "nodefony";
+import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorateParam.js";
+import { http2ServerLimits, setHttp2SessionTimeout } from "../../src/servers/http2Limits.js";
+import { Inject, Service, extend, nodefonyError } from "nodefony";
 import http2 from "node:http2";
 import https from "node:https";
-import { TLSSocket } from "node:tls";
-//#region nodefony/service/servers/server-https.ts
+// nodefony/service/servers/server-https.ts
 let ServerHttps = class ServerHttps extends Service {
 	httpKernel;
 	httpTerminator = null;
@@ -98,7 +96,6 @@ let ServerHttps = class ServerHttps extends Service {
 	createServerH2() {
 		return new Promise((resolve, reject) => {
 			try {
-				const h2Cfg = this.module.options.http2 ?? {};
 				const opt = extend({
 					allowHTTP1: true,
 					rejectUnauthorized: this.options.rejectUnauthorized,
@@ -106,23 +103,14 @@ let ServerHttps = class ServerHttps extends Service {
 					cert: this.httpKernel.serviceCerticats?.cert,
 					ca: this.httpKernel.serviceCerticats?.ca ? this.httpKernel.serviceCerticats.ca : void 0
 				});
-				if (h2Cfg.maxSessionMemory) opt.maxSessionMemory = h2Cfg.maxSessionMemory;
-				if (h2Cfg.maxConcurrentStreams) opt.settings = {
-					...opt.settings,
-					maxConcurrentStreams: h2Cfg.maxConcurrentStreams
-				};
+				Object.assign(opt, http2ServerLimits(this.module.options.http2));
 				this.server = http2.createSecureServer(opt);
 				this.httpTerminator = this.terminator();
-				if (this.options.timeout) this.server.setTimeout(this.options.timeout, () => {
+				setHttp2SessionTimeout(this.server, this.options.timeout, () => {
 					this.fire("onTimeout", this);
 				});
 				this.server.on("request", (request, response) => {
-					let alpnProtocol = false;
-					const sessionSocket = request.stream?.session?.socket;
-					if (sessionSocket instanceof TLSSocket) alpnProtocol = sessionSocket.alpnProtocol;
-					if (request.socket instanceof TLSSocket) alpnProtocol = request.socket.alpnProtocol;
-					if (alpnProtocol === "h2") this.httpKernel.onHttpRequest(request, response, "http2");
-					else this.httpKernel.onHttpRequest(request, response, "https");
+					this.httpKernel.onHttpRequest(request, response, this.type);
 				});
 				this.listenWithPolicy().then(() => resolve(this.server)).catch((e) => {
 					const error = e instanceof Error ? e : new Error(String(e));
@@ -139,7 +127,7 @@ let ServerHttps = class ServerHttps extends Service {
 					}
 				});
 				this.server.on("sessionError", (error) => {
-					this.log(error, "ERROR", "HTTP2 Server sessionError");
+					handleSessionError(error, (e) => this.log(e, "ERROR", "HTTP2 Server sessionError"));
 				});
 				this.server.on("streamError", (error) => {
 					this.log(error, "ERROR", "HTTP2 Server streamError");
@@ -157,6 +145,7 @@ let ServerHttps = class ServerHttps extends Service {
 	* `EADDRINUSE` de repli, qui ne sont pas des pannes).
 	*/
 	async listenWithPolicy() {
+		if (this.server === null) throw new Error("Server https not created");
 		const { address, shiftedFrom } = await bindWithFallback(this.server, this.domain, buildBindPlan("https", asServersConfig(this.module.kernel?.options.servers), this.module.kernel?.environment));
 		this.infos = address;
 		this.port = address.port;
@@ -197,7 +186,6 @@ let ServerHttps = class ServerHttps extends Service {
 		if (this.infos) this.log(`Server Listen on ${this.scheme}://${this.infos.address}:${this.infos.port} Family: ${this.infos.family} Protocol : ${this.protocol}`);
 	}
 };
-ServerHttps = __decorate([__decorateParam(1, inject("HttpKernel")), __decorateMetadata("design:paramtypes", [typeof Module === "undefined" ? Object : Module, typeof http_kernel_default === "undefined" ? Object : http_kernel_default])], ServerHttps);
+ServerHttps = __decorate([__decorateParam(1, Inject("HttpKernel"))], ServerHttps);
 var server_https_default = ServerHttps;
-//#endregion
 export { server_https_default as default };

package/dist/nodefony/service/servers/server-static.js

@@ -1,13 +1,15 @@
+import { normalizePrefix } from "../../src/proxy/rules.js";
+import { requestAuthority } from "../../src/context/transport.js";
 import { Service, extend } from "nodefony";
 import http from "node:http";
+import http2 from "node:http2";
 import { URL } from "node:url";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import mime from "mime-types";
-import http2 from "node:http2";
 import tls from "node:tls";
 import serveStatic from "serve-static";
-//#region nodefony/service/servers/server-static.ts
+// nodefony/service/servers/server-static.ts
 const defaultOptions = {
 	cacheControl: true,
 	maxAge: 345600
@@ -109,14 +111,10 @@ var Statics = class extends Service {
 	* @param dir dossier absolu à servir
 	*/
 	addMount(prefix, dir) {
-		let p = prefix.trim();
-		if (!p.startsWith("/")) p = `/${p}`;
-		if (!p.endsWith("/")) p = `${p}/`;
-		p = p.replace(/\/{2,}/g, "/");
-		const server = serveStatic(dir, extend({}, this.defaultOptions));
+		const p = normalizePrefix(prefix);
 		const entry = {
 			prefix: p,
-			server,
+			server: serveStatic(dir, extend({}, this.defaultOptions)),
 			dir
 		};
 		const i = this.mounts.findIndex((m) => m.prefix === p);
@@ -151,7 +149,7 @@ var Statics = class extends Service {
 			return scheme + "://" + host;
 		} else if (request instanceof http2.Http2ServerRequest) {
 			scheme = request.socket instanceof tls.TLSSocket ? "https" : "http";
-			host = request.headers[":authority"];
+			host = requestAuthority(request.headers);
 			return scheme + "://" + host;
 		}
 		throw new Error(`Bad request type`);
@@ -184,5 +182,4 @@ var Statics = class extends Service {
 		return Promise.resolve(response);
 	}
 };
-//#endregion
 export { Statics as default };

package/dist/nodefony/service/servers/server-websocket-secure.js

@@ -1,24 +1,25 @@
+import { startHeartbeat } from "./wsHeartbeat.js";
 import { asServersConfig, configuredServerPort } from "../../src/servers/kernelServers.js";
-import __decorateMetadata from "../../../_virtual/_@oxc-project_runtime@0.152.0/helpers/esm/decorateMetadata.js";
-import __decorate from "../../../_virtual/_@oxc-project_runtime@0.152.0/helpers/esm/decorate.js";
-import http_kernel_default from "../http-kernel.js";
-import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.152.0/helpers/esm/decorateParam.js";
-import { startHeartbeat, trackPong } from "./wsHeartbeat.js";
-import { Module, Service, inject } from "nodefony";
+import __decorate from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorate.js";
+import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorateParam.js";
+import { attachUpgradeDispatch } from "../../src/servers/upgradeDispatch.js";
+import { Inject, Service } from "nodefony";
 import Ws, { WebSocketServer } from "ws";
-//#region nodefony/service/servers/server-websocket-secure.ts
+// nodefony/service/servers/server-websocket-secure.ts
 let WebsocketSecure = class WebsocketSecure extends Service {
 	httpKernel;
 	module;
 	ready = false;
 	server = null;
+	/** Retire l'écouteur `upgrade` posé par {@link attachUpgradeDispatch}. */
+	#detachUpgrade = null;
 	port;
 	domain;
 	protocol = "1.1";
 	family = null;
 	scheme = "wss";
 	address = null;
-	type = "websocket-secure";
+	type = "wss";
 	infos = null;
 	/** Timer keep-alive (UN par serveur). `null` si désactivé ou pas démarré. */
 	heartbeatTimer = null;
@@ -46,10 +47,12 @@ let WebsocketSecure = class WebsocketSecure extends Service {
 				}
 				this.server = new WebSocketServer({
 					...this.options,
-					server: serverHttps.server,
+					noServer: true,
 					clientTracking: true
 				});
-				this.server.on("connection", this.onConnection.bind(this));
+				this.#detachUpgrade = attachUpgradeDispatch(serverHttps.server, this.server, () => this.httpKernel.reverseProxy, (req) => this.httpKernel.websocketUpgradeRefusal(req), (req, admission) => {
+					this.httpKernel.onWebsocketUpgrade(req, admission, this.type).catch(() => {});
+				});
 				this.heartbeatTimer = startHeartbeat(this.server, this.options);
 				this.kernel?.prependOnceListener("onTerminate", this.terminate.bind(this));
 				this.ready = true;
@@ -61,12 +64,6 @@ let WebsocketSecure = class WebsocketSecure extends Service {
 			}
 		});
 	}
-	onConnection(ws, req) {
-		trackPong(ws);
-		this.httpKernel.onWebsocketRequest(ws, req, this.type).catch(() => {
-			process.nextTick(() => {});
-		});
-	}
 	terminate() {
 		return new Promise((resolve, reject) => {
 			if (this.heartbeatTimer) {
@@ -83,6 +80,8 @@ let WebsocketSecure = class WebsocketSecure extends Service {
 				});
 				setTimeout(() => {
 					try {
+						this.#detachUpgrade?.();
+						this.#detachUpgrade = null;
 						this.server?.close();
 						this.log(` SHUTDOWN WEBSOCKET Server is listening on DOMAIN : ${this.domain}    PORT : ${this.port}`, "INFO");
 						return resolve(true);
@@ -92,6 +91,8 @@ let WebsocketSecure = class WebsocketSecure extends Service {
 				}, 300);
 				return;
 			}
+			this.#detachUpgrade?.();
+			this.#detachUpgrade = null;
 			return resolve(true);
 		});
 	}
@@ -99,7 +100,6 @@ let WebsocketSecure = class WebsocketSecure extends Service {
 		if (this.infos) this.log(`Server Listen on ${this.scheme}://${this.infos.address}:${this.infos.port} Family: ${this.infos.family} Protocol : ${this.protocol}`);
 	}
 };
-WebsocketSecure = __decorate([__decorateParam(1, inject("HttpKernel")), __decorateMetadata("design:paramtypes", [typeof Module === "undefined" ? Object : Module, typeof http_kernel_default === "undefined" ? Object : http_kernel_default])], WebsocketSecure);
+WebsocketSecure = __decorate([__decorateParam(1, Inject("HttpKernel"))], WebsocketSecure);
 var server_websocket_secure_default = WebsocketSecure;
-//#endregion
 export { server_websocket_secure_default as default };

package/dist/nodefony/service/servers/server-websocket.js

@@ -1,24 +1,25 @@
+import { startHeartbeat } from "./wsHeartbeat.js";
 import { asServersConfig, configuredServerPort } from "../../src/servers/kernelServers.js";
-import __decorateMetadata from "../../../_virtual/_@oxc-project_runtime@0.152.0/helpers/esm/decorateMetadata.js";
-import __decorate from "../../../_virtual/_@oxc-project_runtime@0.152.0/helpers/esm/decorate.js";
-import http_kernel_default from "../http-kernel.js";
-import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.152.0/helpers/esm/decorateParam.js";
-import { startHeartbeat, trackPong } from "./wsHeartbeat.js";
-import { Module, Service, inject } from "nodefony";
+import __decorate from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorate.js";
+import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorateParam.js";
+import { attachUpgradeDispatch } from "../../src/servers/upgradeDispatch.js";
+import { Inject, Service } from "nodefony";
 import Ws, { WebSocketServer } from "ws";
-//#region nodefony/service/servers/server-websocket.ts
+// nodefony/service/servers/server-websocket.ts
 let Websocket = class Websocket extends Service {
 	httpKernel;
 	module;
 	ready = false;
 	server = null;
+	/** Retire l'écouteur `upgrade` posé par {@link attachUpgradeDispatch}. */
+	#detachUpgrade = null;
 	port;
 	domain;
 	protocol = "1.1";
 	family = null;
 	scheme = "ws";
 	address = null;
-	type = "websocket";
+	type = "ws";
 	infos = null;
 	/** Timer keep-alive (UN par serveur). `null` si désactivé ou pas démarré. */
 	heartbeatTimer = null;
@@ -46,10 +47,12 @@ let Websocket = class Websocket extends Service {
 				}
 				this.server = new WebSocketServer({
 					...this.options,
-					server: serverHttp.server,
+					noServer: true,
 					clientTracking: true
 				});
-				this.server.on("connection", this.onConnection.bind(this));
+				this.#detachUpgrade = attachUpgradeDispatch(serverHttp.server, this.server, () => this.httpKernel.reverseProxy, (req) => this.httpKernel.websocketUpgradeRefusal(req), (req, admission) => {
+					this.httpKernel.onWebsocketUpgrade(req, admission, this.type).catch(() => {});
+				});
 				this.heartbeatTimer = startHeartbeat(this.server, this.options);
 				this.kernel?.prependOnceListener("onTerminate", this.terminate.bind(this));
 				this.ready = true;
@@ -61,12 +64,6 @@ let Websocket = class Websocket extends Service {
 			}
 		});
 	}
-	onConnection(ws, req) {
-		trackPong(ws);
-		this.httpKernel.onWebsocketRequest(ws, req, this.type).catch(() => {
-			process.nextTick(() => {});
-		});
-	}
 	terminate() {
 		return new Promise((resolve, reject) => {
 			if (this.heartbeatTimer) {
@@ -83,6 +80,8 @@ let Websocket = class Websocket extends Service {
 				});
 				setTimeout(() => {
 					try {
+						this.#detachUpgrade?.();
+						this.#detachUpgrade = null;
 						this.server?.close();
 						this.log(` SHUTDOWN WEBSOCKET Server is listening on DOMAIN : ${this.domain}    PORT : ${this.port}`, "INFO");
 						return resolve(true);
@@ -92,6 +91,8 @@ let Websocket = class Websocket extends Service {
 				}, 300);
 				return;
 			}
+			this.#detachUpgrade?.();
+			this.#detachUpgrade = null;
 			return resolve(true);
 		});
 	}
@@ -99,7 +100,6 @@ let Websocket = class Websocket extends Service {
 		if (this.infos) this.log(`Server Listen on ${this.scheme}://${this.infos.address}:${this.infos.port} Family: ${this.infos.family} Protocol : ${this.protocol}`);
 	}
 };
-Websocket = __decorate([__decorateParam(1, inject("HttpKernel")), __decorateMetadata("design:paramtypes", [typeof Module === "undefined" ? Object : Module, typeof http_kernel_default === "undefined" ? Object : http_kernel_default])], Websocket);
+Websocket = __decorate([__decorateParam(1, Inject("HttpKernel"))], Websocket);
 var server_websocket_default = Websocket;
-//#endregion
 export { server_websocket_default as default };

package/dist/nodefony/service/servers/serverShutdown.js

@@ -1,31 +1,91 @@
-import { createHttpTerminator } from "http-terminator";
-//#region nodefony/service/servers/serverShutdown.ts
+import http from "node:http";
+import https from "node:https";
+import tls from "node:tls";
+// nodefony/service/servers/serverShutdown.ts
 /**
-* Fabrique le terminator de drain graceful d'un serveur HTTP/HTTPS/HTTP2.
+* Fabrique l'arrêt gracieux d'un serveur HTTP/1.1, HTTPS, HTTP/2 sur TLS ou h2c.
 *
-* Au `terminate()` (shutdown SIGTERM/docker stop) : les requêtes in-flight se
-* terminent (header `connection: close` injecté sur les réponses en cours), les
-* sockets idle sont fermées immédiatement, et tout ce qui reste après
-* `shutdownTimeout` ms est détruit de force. Le terminator appelle lui-même
-* `server.close()` — ne pas le rappeler derrière.
+* Au `terminate()` (SIGTERM, `docker stop`), le serveur cesse d'accepter, puis :
+* - **HTTP/2** : chaque session reçoit un GOAWAY (`session.close()`) — les flux
+*   en vol se terminent, les nouveaux sont refusés, et le client sait qu'il doit
+*   rouvrir ailleurs au lieu de constater une coupure ;
+* - **HTTP/1.1** : la réponse en vol part avec `Connection: close`, la socket
+*   inactive est fermée tout de suite, une requête qui arrive encore sur une
+*   socket gardée ouverte reçoit aussi `Connection: close`.
+*
+* Ce qui reste après `shutdownTimeout` ms est détruit. `server.close()` est
+* appelé ici : ne pas le rappeler derrière.
 *
 * ⚠️ Les sockets WebSocket upgradées (sans réponse HTTP en cours) sont détruites
-* SANS frame Close par le terminator → les serveurs WS doivent fermer leurs
-* clients (close 1001) AVANT ce drain. Garanti par l'ordre des listeners
-* `onTerminate` : WS/WSS s'attachent en `prependOnceListener`, les serveurs
-* HTTP en `once`.
+* SANS frame Close → les serveurs WS doivent fermer leurs clients (close 1001)
+* AVANT ce drain. Garanti par l'ordre des listeners `onTerminate` : WS/WSS
+* s'attachent en `prependOnceListener`, les serveurs HTTP en `once`.
 *
-* @param server - serveur Node à drainer (créé, pas forcément listening)
+* @param server - serveur Node à drainer, créé AVANT son `listen` (le suivi des
+*   connexions commence ici)
 * @param shutdownTimeout - délai de drain en ms avant destruction forcée
-* @returns le terminator à invoquer au shutdown
+* @returns l'arrêt à invoquer au shutdown
 */
 function createDrainTerminator(server, shutdownTimeout) {
-	return createHttpTerminator({
-		server,
-		gracefulTerminationTimeout: shutdownTimeout ?? 5e3
+	const timeout = shutdownTimeout ?? 5e3;
+	const emitter = server;
+	const speaksHttp2 = !(server instanceof http.Server || server instanceof https.Server);
+	const overTls = server instanceof tls.Server;
+	const sockets = /* @__PURE__ */ new Set();
+	emitter.on("connection", (socket) => track(sockets, socket));
+	let http1Sockets = null;
+	if (!speaksHttp2) http1Sockets = overTls ? /* @__PURE__ */ new Set() : sockets;
+	else if (overTls) http1Sockets = /* @__PURE__ */ new Set();
+	if (overTls && http1Sockets !== null) {
+		const set = http1Sockets;
+		emitter.on("secureConnection", (socket) => {
+			if (socket.alpnProtocol !== "h2") track(set, socket);
+		});
+	}
+	let draining = false;
+	const sessions = speaksHttp2 ? /* @__PURE__ */ new Set() : null;
+	if (sessions !== null) emitter.on("session", (session) => {
+		if (draining) {
+			session.close();
+			return;
+		}
+		sessions.add(session);
+		session.once("close", () => sessions.delete(session));
+	});
+	let terminating = null;
+	const drain = () => new Promise((resolve) => {
+		draining = true;
+		const deadline = setTimeout(() => {
+			if (sessions !== null) for (const s of sessions) s.destroy();
+			for (const socket of sockets) socket.destroy();
+		}, timeout);
+		server.close(() => {
+			clearTimeout(deadline);
+			resolve();
+		});
+		if (sessions !== null) for (const s of sessions) s.close();
+		if (http1Sockets !== null) {
+			emitter.on("request", closeAfterResponse);
+			for (const socket of http1Sockets) {
+				const response = socket._httpMessage;
+				if (!response) socket.destroy();
+				else if (!response.headersSent) response.setHeader("connection", "close");
+			}
+		}
 	});
+	return { terminate() {
+		terminating ??= drain();
+		return terminating;
+	} };
+}
+function track(set, socket) {
+	set.add(socket);
+	socket.once("close", () => set.delete(socket));
+}
+/** Requête HTTP/1.1 reçue pendant le drain : la connexion ne survivra pas à sa réponse. */
+function closeAfterResponse(request, response) {
+	if (request.httpVersionMajor === 1 && !response.headersSent) response.setHeader("connection", "close");
 }
 /** Drain par défaut (ms) — même valeur que le défaut Zod `servers.*.shutdownTimeout`. */
 const DEFAULT_SHUTDOWN_TIMEOUT = 5e3;
-//#endregion
 export { DEFAULT_SHUTDOWN_TIMEOUT, createDrainTerminator };

package/dist/nodefony/service/servers/wsHeartbeat.js

@@ -1,5 +1,5 @@
 import Ws from "ws";
-//#region nodefony/service/servers/wsHeartbeat.ts
+// nodefony/service/servers/wsHeartbeat.ts
 /**
 * Arme le suivi keep-alive d'UNE connexion : initialise l'horodatage de vie et
 * attache l'unique listener `pong` qui le rafraîchit.
@@ -19,6 +19,35 @@ const trackPong = (ws) => {
 	});
 };
 /**
+* Un tick du keep-alive : pingue les connexions muettes depuis `interval`, et
+* coupe celles dont le ping attend sa réponse depuis plus de `grace`.
+*
+* Fonction PURE du temps : l'horloge est passée en argument, si bien que la
+* règle se prouve pas à pas, sans minuteur réel — un banc qui la prouverait à
+* l'horloge murale confondrait une boucle d'événements chargée avec un zombie.
+*
+* @param clients - les connexions du serveur
+* @param now - l'instant du tick (`performance.now()` en production)
+* @param interval - délai sans signe de vie avant un ping, ms
+* @param grace - délai accordé au pong avant de couper, ms
+*/
+const heartbeatTick = (clients, now, interval, grace) => {
+	for (const client of clients) {
+		if (client.readyState !== Ws.OPEN) continue;
+		const sock = client;
+		sock._nfLastPong ??= now;
+		const pingedAt = sock._nfPingedAt ?? 0;
+		if (pingedAt > sock._nfLastPong) {
+			if (now - pingedAt > grace) client.terminate();
+			continue;
+		}
+		if (now - sock._nfLastPong >= interval) {
+			sock._nfPingedAt = now;
+			client.ping();
+		}
+	}
+};
+/**
 * Démarre le heartbeat keep-alive du serveur : détecte les connexions zombies
 * (half-open — TCP encore ouvert mais le pair a disparu sans frame Close) et les
 * `terminate()` pour libérer slot mémoire + descripteur de fichier.
@@ -42,23 +71,9 @@ const startHeartbeat = (server, options) => {
 	if (interval <= 0) return null;
 	const grace = options.keepaliveGracePeriod ?? 0;
 	const timer = setInterval(() => {
-		const now = performance.now();
-		for (const client of server.clients) {
-			if (client.readyState !== Ws.OPEN) continue;
-			const sock = client;
-			sock._nfLastPong ??= now;
-			if ((sock._nfPingedAt ?? 0) > sock._nfLastPong) {
-				if (now - sock._nfPingedAt > grace) client.terminate();
-				continue;
-			}
-			if (now - sock._nfLastPong >= interval) {
-				sock._nfPingedAt = now;
-				client.ping();
-			}
-		}
+		heartbeatTick(server.clients, performance.now(), interval, grace);
 	}, Math.max(250, grace > 0 ? Math.min(interval, grace) : interval));
 	timer.unref();
 	return timer;
 };
-//#endregion
-export { startHeartbeat, trackPong };
+export { heartbeatTick, startHeartbeat, trackPong };

package/dist/nodefony/service/sessions/sessions-service.js

@@ -1,14 +1,12 @@
 import { SESSION_FACETS } from "../../src/session/storage/sessionFilters.js";
-import __decorateMetadata from "../../../_virtual/_@oxc-project_runtime@0.152.0/helpers/esm/decorateMetadata.js";
-import __decorate from "../../../_virtual/_@oxc-project_runtime@0.152.0/helpers/esm/decorate.js";
-import http_kernel_default from "../http-kernel.js";
-import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.152.0/helpers/esm/decorateParam.js";
+import __decorate from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorate.js";
+import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorateParam.js";
 import Session from "../../src/session/session.js";
 import MemorySessionStorage from "../../src/session/storage/MemorySessionStorage.js";
 import RevocationGuardStorage from "../../src/session/storage/RevocationGuardStorage.js";
-import { AUTO_STORE, EMPTY_INFRA, GcScheduler, Module, Nodefony, RequestContext, Service, countFacets, extend, inject, injectable, readStoreConnector, readStoreLocation, resolveAutoStore, runNeedsExternalServices } from "nodefony";
+import { AUTO_STORE, EMPTY_INFRA, GcScheduler, Inject, Nodefony, RequestContext, Service, countFacets, extend, injectable, readStoreConnector, readStoreLocation, resolveAutoStore, storeConnectivity } from "nodefony";
 import { createHash, createHmac } from "node:crypto";
-//#region nodefony/service/sessions/sessions-service.ts
+// nodefony/service/sessions/sessions-service.ts
 var _SessionsService;
 /**
 * Convertit un timestamp de session (`Date` en mémoire, **string ISO** après
@@ -143,7 +141,7 @@ let SessionsService = class SessionsService extends Service {
 		const configured = storeName;
 		let reason = `store explicitement configuré ("${configured}")`;
 		if (storeName === AUTO_STORE) {
-			const auto = resolveAutoStore("session", this.kernel?.infra ?? EMPTY_INFRA, _SessionsService.storageHandlers(), "memory", runNeedsExternalServices(this.kernel));
+			const auto = resolveAutoStore("session", this.kernel?.infra ?? EMPTY_INFRA, _SessionsService.storageHandlers(), "memory", storeConnectivity(this.kernel));
 			storeName = auto.store;
 			reason = auto.reason;
 			this.log(`session.store "auto" → "${storeName}" (${auto.reason})`, "INFO");
@@ -219,7 +217,7 @@ let SessionsService = class SessionsService extends Service {
 					return resolve(context.session);
 				}
 			}
-			let inst = null;
+			let inst;
 			try {
 				context.sessionStarting = true;
 				inst = this.createSession(this.defaultSessionName);
@@ -481,23 +479,44 @@ let SessionsService = class SessionsService extends Service {
 		return destroyed;
 	}
 	/**
-	* « Déconnexion partout » : détruit TOUTES les sessions d'un utilisateur (scan
-	* O(N) — pas d'index inverse, acceptable en admin). Renvoie le nombre détruit.
+	* Détruit TOUTES les sessions dont le contenu satisfait `match` — la primitive
+	* des révocations groupées (« déconnecter partout », déconnexion demandée par
+	* un fournisseur d'identité). Ni journal ni audit : l'appelant, qui connaît le
+	* motif, les émet.
+	*
+	* @remarks Quand la méthode rend la main, il ne reste AUCUNE session qui
+	* satisfait `match` (au plus `MAX_LOGOUT_PASSES` passages). Une révocation qui
+	* en laisse une seule n'est pas une imprécision, c'est une faille.
+	*
+	* @param filter - restriction poussée au store (`user` : WHERE indexable) ;
+	*   `undefined` parcourt tout le parc.
+	* @param match - prédicat sur la session sérialisée — il doit RE-VÉRIFIER ce
+	*   que `filter` exprime, un store pouvant l'ignorer.
+	* @returns le nombre de sessions détruites.
+	* @throws Error si le store actif ne sait pas énumérer ses sessions.
 	*/
-	async destroyByUser(identifier, actor) {
+	async destroyWhere(filter, match) {
 		const storage = this.enumerable();
 		let destroyed = 0;
 		for (let pass = 0; pass < MAX_LOGOUT_PASSES; pass += 1) {
 			let destroyedThisPass = 0;
-			await this.eachSessionRecord({ user: identifier }, async (rec) => {
-				if (rec.data.user !== identifier) return false;
+			await this.eachSessionRecord(filter, async (rec) => {
+				if (!match(rec.data)) return false;
 				if (await storage.destroy(rec.id)) destroyedThisPass += 1;
 				return false;
 			});
 			destroyed += destroyedThisPass;
 			if (destroyedThisPass === 0) break;
-			if (pass === 9) this.log(`sessions: logout-all interrompu après ${MAX_LOGOUT_PASSES} passages — user=${identifier} (révocation potentiellement incomplète)`, "WARNING");
+			if (pass === 9) this.log(`sessions: révocation groupée interrompue après ${MAX_LOGOUT_PASSES} passages — filtre=${JSON.stringify(filter ?? {})} (révocation potentiellement incomplète)`, "WARNING");
 		}
+		return destroyed;
+	}
+	/**
+	* « Déconnexion partout » : détruit TOUTES les sessions d'un utilisateur (scan
+	* O(N) — pas d'index inverse, acceptable en admin). Renvoie le nombre détruit.
+	*/
+	async destroyByUser(identifier, actor) {
+		const destroyed = await this.destroyWhere({ user: identifier }, (data) => data.user === identifier);
 		if (destroyed > 0) {
 			this.log(`sessions revoked by admin (logout-all) — user=${identifier} count=${destroyed} actor=${actor ?? "admin"}`, "INFO");
 			this.emitAudit({
@@ -577,12 +596,7 @@ let SessionsService = class SessionsService extends Service {
 		this.get("auditService")?.record(event);
 	}
 };
-SessionsService = _SessionsService = __decorate([
-	injectable(),
-	__decorateParam(1, inject("HttpKernel")),
-	__decorateMetadata("design:paramtypes", [typeof Module === "undefined" ? Object : Module, typeof http_kernel_default === "undefined" ? Object : http_kernel_default])
-], SessionsService);
+SessionsService = _SessionsService = __decorate([injectable(), __decorateParam(1, Inject("HttpKernel"))], SessionsService);
 SessionsService.registerStorage("memory", MemorySessionStorage);
 var sessions_service_default = SessionsService;
-//#endregion
 export { computeSessionRef, sessions_service_default as default, toSessionSummary };

package/dist/nodefony/service/trace.js

@@ -1,5 +1,5 @@
 import { randomFillSync } from "node:crypto";
-//#region nodefony/service/trace.ts
+// nodefony/service/trace.ts
 /**
 * W3C Trace Context — parse + generate `traceparent` headers (P2.7).
 *
@@ -69,5 +69,4 @@ function resolveTraceparent(header) {
 	const hex = randomHex(24);
 	return `00-${hex.slice(0, 32)}-${hex.slice(32)}-01`;
 }
-//#endregion
 export { parseTraceparent, resolveTraceparent };

package/dist/nodefony/service/upload/upload-service.js

@@ -1,12 +1,10 @@
-import __decorateMetadata from "../../../_virtual/_@oxc-project_runtime@0.152.0/helpers/esm/decorateMetadata.js";
-import __decorate from "../../../_virtual/_@oxc-project_runtime@0.152.0/helpers/esm/decorate.js";
-import http_kernel_default from "../http-kernel.js";
-import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.152.0/helpers/esm/decorateParam.js";
-import { Cli, FileClass, Module, Service, inject } from "nodefony";
+import __decorate from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorate.js";
+import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorateParam.js";
+import { Cli, FileClass, Inject, Service } from "nodefony";
 import fs from "node:fs";
 import fsp from "node:fs/promises";
 import path from "node:path";
-//#region nodefony/service/upload/upload-service.ts
+// nodefony/service/upload/upload-service.ts
 /** Test d'existence non bloquant (`fsp.access`) — remplace `existsSync`. */
 const existsAsync = async (p) => {
 	try {
@@ -58,7 +56,7 @@ let upload = class upload extends Service {
 		throw new Error(`Syslog not ready`);
 	}
 };
-upload = __decorate([__decorateParam(1, inject("HttpKernel")), __decorateMetadata("design:paramtypes", [typeof Module === "undefined" ? Object : Module, typeof http_kernel_default === "undefined" ? Object : http_kernel_default])], upload);
+upload = __decorate([__decorateParam(1, Inject("HttpKernel"))], upload);
 var UploadedFile = class UploadedFile extends FileClass {
 	parsedFile;
 	size;
@@ -168,5 +166,4 @@ var UploadedFile = class UploadedFile extends FileClass {
 	}
 };
 var upload_service_default = upload;
-//#endregion
 export { UploadedFile, upload_service_default as default, upload };

package/dist/nodefony/service/x509.js

@@ -1,6 +1,6 @@
 import { isIPv4, isIPv6 } from "node:net";
 import { createHash, sign } from "node:crypto";
-//#region nodefony/service/x509.ts
+// nodefony/service/x509.ts
 /**
 * Fabrique et lecture de certificats X.509 par `node:crypto` seul — aucune
 * dépendance tierce.
@@ -320,5 +320,4 @@ async function createSelfSignedCertificate(spec) {
 	const signature = await signAsync(spec.hash, tbs, spec.privateKey);
 	return toPem(sequence(tbs, algorithm, bitString(signature)));
 }
-//#endregion
 export { SHA1_WITH_RSA_OID, createSelfSignedCertificate, distinguishedNameField, ipAddressBytes, parseSubjectAltName, signatureAlgorithmName, signatureAlgorithmOid };