@nodefony/http 10.0.0-beta.3 → 10.0.0-beta.5

package/dist/nodefony/service/error-renderer.js

@@ -1,7 +1,7 @@
 import HttpError from "../src/errors/httpError.js";
 import { toWsCloseCode } from "../src/context/websocket/WebsocketContext.js";
 import { Nodefony, nodefonyError } from "nodefony";
-//#region nodefony/service/error-renderer.ts
+// nodefony/service/error-renderer.ts
 /** Une donnée rejetée par la validation n'est pas une requête malformée : 422, pas 400. */
 const VALIDATION_STATUS = 422;
 /**
@@ -74,8 +74,15 @@ const INTERNAL_ERROR_KEYS = [
 * deux tests — un gate qu'on ne peut plus voir mordre.
 */
 const isProduction = () => Nodefony.getKernel()?.environment === "production";
+/** Une propriété d'une anomalie de forme inconnue, lue sans rien supposer. */
+function readIssueProperty(issue, key) {
+	return typeof issue === "object" && issue !== null ? Reflect.get(issue, key) : void 0;
+}
+/** Erreurs de validation reconnues : Zod, et celle des routes à schéma (cœur). */
+const VALIDATION_ERROR_NAMES = /* @__PURE__ */ new Set(["ZodError", "SchemaValidationError"]);
 /**
-* Reconnaît une erreur de validation Zod et en extrait les champs fautifs.
+* Reconnaît une erreur de validation — `ZodError`, ou `SchemaValidationError`
+* d'une route à schéma — et en extrait les champs fautifs.
 *
 * Reconnaissance **structurelle** (`name` + `issues`), pas `instanceof ZodError` :
 * une application peut embarquer sa propre copie de zod (résolutions npm multiples),
@@ -88,13 +95,21 @@ const isProduction = () => Nodefony.getKernel()?.environment === "production";
 * @returns les champs fautifs, ou `null` si ce n'est pas une erreur de validation.
 */
 function toValidationFields(error) {
-	const candidate = error;
-	if (error.name !== "ZodError" || !Array.isArray(candidate.issues)) return null;
-	return candidate.issues.map((issue) => ({
-		field: Array.isArray(issue.path) ? issue.path.join(".") : "",
-		message: issue.message ?? "invalide",
-		rule: issue.code
-	}));
+	const issues = Reflect.get(error, "issues");
+	if (!VALIDATION_ERROR_NAMES.has(error.name) || !Array.isArray(issues)) return null;
+	return issues.map((issue) => {
+		const path = readIssueProperty(issue, "path");
+		const message = readIssueProperty(issue, "message");
+		const code = readIssueProperty(issue, "code");
+		const part = readIssueProperty(issue, "in");
+		const field = {
+			field: Array.isArray(path) ? path.map(String).join(".") : "",
+			message: typeof message === "string" ? message : "invalide",
+			rule: typeof code === "string" ? code : void 0
+		};
+		if (typeof part === "string") field.in = part;
+		return field;
+	});
 }
 /**
 * Construit l'erreur **422** exposée au client à partir des champs fautifs.
@@ -109,7 +124,10 @@ function toValidationFields(error) {
 * reçoit `error.fields` et sait QUEL champ corriger — pas seulement que « ça a échoué ».
 */
 function toValidationError(error, fields) {
-	const summary = fields.map((f) => f.field ? `${f.field}: ${f.message}` : f.message).join(" · ");
+	const summary = fields.map((f) => {
+		const where = f.in && f.field ? `${f.in}.${f.field}` : f.in || f.field;
+		return where ? `${where}: ${f.message}` : f.message;
+	}).join(" · ");
 	const validation = new nodefonyError(`Validation failed — ${summary}`, VALIDATION_STATUS);
 	if (error.stack !== void 0) validation.stack = error.stack;
 	validation.fields = fields;
@@ -429,5 +447,4 @@ var DefaultErrorRenderer = class {
 		return code;
 	}
 };
-//#endregion
-export { DefaultErrorRenderer as default, malformedIdentifierOf, schemaMismatchOf };
+export { DefaultErrorRenderer as default, malformedIdentifierOf, schemaMismatchOf, toValidationFields };

package/dist/nodefony/service/http-kernel.js

@@ -1,3 +1,4 @@
+import { isProfiledUrl } from "../src/profiler/aggregate.js";
 import HttpError from "../src/errors/httpError.js";
 import { buildTrustProxy } from "../src/context/trustProxy.js";
 import { resolveForwarded } from "../src/context/forwarded.js";
@@ -5,22 +6,23 @@ import { MemoryRateLimitStore } from "../src/rateLimit/MemoryRateLimitStore.js";
 import { WsConnectionCounter } from "../src/rateLimit/WsConnectionCounter.js";
 import { compileDomainPatterns, compileTrustedHosts, isDomainAllowed } from "../src/context/domainMatcher.js";
 import { responseEnded } from "../src/context/responseEnded.js";
+import { unsentResponseWarning } from "../src/context/unsentResponse.js";
+import { closeRequestTrace, hasRequestTraceSubscribers, openRequestTrace, runTraced } from "../src/context/requestTrace.js";
 import { parseWebsocketUrl } from "../src/context/websocket/websocketUrl.js";
-import WebsocketContext from "../src/context/websocket/WebsocketContext.js";
+import WebsocketContext, { toHandshakeStatus } from "../src/context/websocket/WebsocketContext.js";
+import { trackPong } from "./servers/wsHeartbeat.js";
 import HttpContext from "../src/context/http/HttpContext.js";
 import DefaultErrorRenderer from "./error-renderer.js";
-import DefaultRequestLogger from "./request-logger.js";
 import JsonAuditLogger from "./audit-logger.js";
+import DefaultRequestLogger from "./request-logger.js";
 import PrettyRequestLogger from "./pretty-request-logger.js";
 import { resolveTraceparent } from "./trace.js";
 import { asServersConfig, configuredServerPort } from "../src/servers/kernelServers.js";
-import __decorateMetadata from "../../_virtual/_@oxc-project_runtime@0.153.0/helpers/esm/decorateMetadata.js";
-import __decorate from "../../_virtual/_@oxc-project_runtime@0.153.0/helpers/esm/decorate.js";
-import { GcScheduler, IDENTITY_CHANGED_EVENT, Module, RequestContext, RevocationWatch, Service, finallyMaybe, injectable, isPromise, logColor, nodefonyError, servedUrl, thenMaybe, writeRuntimeState } from "nodefony";
+import __decorate from "../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorate.js";
+import { GcScheduler, IDENTITY_CHANGED_EVENT, RequestContext, RevocationWatch, Service, finallyMaybe, injectable, isPromise, logColor, nodefonyError, servedUrl, thenMaybe, writeRuntimeState } from "nodefony";
 import cluster from "node:cluster";
 import http from "node:http";
-import Ws from "ws";
-//#region nodefony/service/http-kernel.ts
+// nodefony/service/http-kernel.ts
 const HEALTH_HEADERS = {
 	"content-type": "application/json",
 	"cache-control": "no-store"
@@ -111,6 +113,8 @@ let HttpKernel = class HttpKernel extends Service {
 	errorRenderer = new DefaultErrorRenderer();
 	requestLogger = new DefaultRequestLogger();
 	profiler = null;
+	/** `timing.tooling` : profiler aussi l'outillage (lu une fois, à onReady). */
+	profileTooling = false;
 	_trustProxyChecker = null;
 	_wsOriginPolicy = Object.create(null);
 	rateLimiter = null;
@@ -126,9 +130,7 @@ let HttpKernel = class HttpKernel extends Service {
 		this.container?.addScope("request");
 		this.responseTimeout = {
 			http: this.options.http.responseTimeout,
-			https: this.options.https.responseTimeout,
-			http2: this.options.https.responseTimeout,
-			http3: this.options.https.responseTimeout
+			https: this.options.https.responseTimeout
 		};
 		this.closeTimeOutWs = {
 			ws: this.options.websocket.closeTimeout,
@@ -210,6 +212,36 @@ let HttpKernel = class HttpKernel extends Service {
 	get rateLimitStore() {
 		return this.rateLimiter;
 	}
+	/**
+	* Cette requête — ou cette frame du pont — se profile-t-elle ? Jamais sans
+	* profileur (production). L'outillage (console, profileur, journaux, Vite :
+	* `isProfiledUrl`, sur la règle `isConsolePath` du cœur) seulement sous
+	* `timing.tooling` — on ne
+	* mesure pas la façon dont on mesure : ni tampon SQL, ni instantané, ni place
+	* dans les anneaux du profileur.
+	*
+	* @param url - URL ou chemin de la requête
+	* @returns `true` quand le profil doit être pris
+	*/
+	shouldProfile(url) {
+		return this.profiler !== null && isProfiledUrl(url, this.profileTooling);
+	}
+	/**
+	* En développement, signale une action qui a rendu une valeur que le
+	* Resolver ne sait pas envoyer (`null`, `undefined`, instance de classe)
+	* et n'a rien envoyé elle-même : la requête attend son délai d'expiration.
+	* Le message nomme l'action, ce qu'elle a rendu et le geste qui convient
+	* (`unsentResponseWarning`).
+	*
+	* Appelé au timeout, AVANT que le 504/408 parte — après, `sended` est vrai et
+	* plus rien ne se signalerait — et au démontage, pour un client parti avant.
+	* Gratuit en production : rien n'est lu au-delà de `waitAsync`.
+	*
+	* @param context - le contexte HTTP de la requête
+	*/
+	warnUnsentResponse(context) {
+		if (context.waitAsync && !context.sended && this.kernel?.environment === "development") this.log(unsentResponseWarning(context.resolver, context.url), "WARNING");
+	}
 	configureRateLimit() {
 		this.rateLimitGc?.stop();
 		this.rateLimitGc = null;
@@ -280,6 +312,8 @@ let HttpKernel = class HttpKernel extends Service {
 			this.regAlias = this.compileAlias();
 			this.sessionService = this.get("sessions");
 			this.profiler = this.get("profiler");
+			const timing = this.kernel?.options.timing;
+			this.profileTooling = typeof timing === "object" && timing !== null && "tooling" in timing && timing.tooling === true;
 			this.configureRateLimit();
 			this.configureWsConnectionLimit();
 			this.configureHealth();
@@ -356,7 +390,7 @@ let HttpKernel = class HttpKernel extends Service {
 		const policy = this.getWsOriginPolicy(secure ? "websocketSecure" : "websocket");
 		if (policy.disabled) return true;
 		if (!origin) return true;
-		let originHost = null;
+		let originHost;
 		try {
 			originHost = new URL(origin).hostname;
 		} catch {
@@ -382,7 +416,7 @@ let HttpKernel = class HttpKernel extends Service {
 	* @throws {HttpError} code WS 1008 (Policy Violation) si l'Origin est refusée.
 	*/
 	checkWebsocketOrigin(context) {
-		const secure = context.type === "websocket-secure";
+		const secure = context.serverType === "wss";
 		const raw = context.origin;
 		if (this.isWebsocketOriginAllowed(raw, context.domain, secure)) return;
 		const error = new HttpError(`WebSocket Origin "${raw}" not allowed (CSWSH protection)`, 1008, context);
@@ -481,7 +515,14 @@ let HttpKernel = class HttpKernel extends Service {
 			context.resolver = resolver;
 			return resolver;
 		}
-		if (resolver.exception) throw resolver.exception;
+		if (resolver.exception) {
+			const exception = resolver.exception;
+			if (context.secure && "code" in exception && exception.code === 426) {
+				context.resolver = resolver;
+				return resolver;
+			}
+			throw resolver.exception;
+		}
 		throw new HttpError("Not Found", 404, context);
 	}
 	/**
@@ -580,18 +621,26 @@ let HttpKernel = class HttpKernel extends Service {
 			await context.close();
 			return context;
 		}
-		if (context instanceof WebsocketContext) try {
-			const wsResult = this.errorRenderer.renderWebsocket(error, context);
-			if (context.response?.connection) {
-				context.close(wsResult.code, wsResult.reason);
+		if (context instanceof WebsocketContext) {
+			if (context.admission !== null) {
+				const status = toHandshakeStatus("code" in error && typeof error.code === "number" ? error.code : void 0);
+				context.refuseHandshake(status);
+				if (this.kernel?.debug) this.log(`${status} ${error.message}`, "DEBUG", "WEBSOCKET REFUSED");
 				return context;
 			}
-			if (context.request && !context.rejected) {
-				context.reject(wsResult.code, wsResult.reason);
-				return context;
+			try {
+				const wsResult = this.errorRenderer.renderWebsocket(error, context);
+				if (context.response?.connection) {
+					context.close(wsResult.code, wsResult.reason);
+					return context;
+				}
+				if (context.request && !context.rejected) {
+					context.reject(wsResult.code, wsResult.reason);
+					return context;
+				}
+			} catch {
+				throw error;
 			}
-		} catch {
-			throw error;
 		}
 		throw error;
 	}
@@ -633,7 +682,7 @@ let HttpKernel = class HttpKernel extends Service {
 		if (headerServer != null && headerServer !== "") response.setHeader("Server", headerServer);
 		if (this.secContentTypeOptions !== null) response.setHeader("X-Content-Type-Options", this.secContentTypeOptions);
 		if (this.secFrameOptions !== null) response.setHeader("X-Frame-Options", this.secFrameOptions);
-		if (this.secHsts !== null && (type === "https" || type === "http2")) response.setHeader("Strict-Transport-Security", this.secHsts);
+		if (this.secHsts !== null && type === "https") response.setHeader("Strict-Transport-Security", this.secHsts);
 		if (this.#healthPaths !== null) {
 			const url = request.url;
 			if (url === this.#healthPaths.liveness) {
@@ -676,6 +725,11 @@ let HttpKernel = class HttpKernel extends Service {
 			await serverHttps.createServer();
 			servers.push(serverHttps);
 		}
+		const serverH2c = this.get("server-h2c");
+		if (serverH2c?.active) {
+			await serverH2c.createServer();
+			servers.push(serverH2c);
+		}
 		const serverWebsocket = this.get("server-websocket");
 		if (serverWebsocket && serverHttp?.active) {
 			await serverWebsocket.createServer(serverHttp);
@@ -686,7 +740,7 @@ let HttpKernel = class HttpKernel extends Service {
 			await serverWebsocketSecure.createServer(serverHttps);
 			servers.push(serverWebsocketSecure);
 		}
-		this.publishRuntimePorts(serverHttp, serverHttps);
+		this.publishRuntimePorts(serverHttp, serverHttps, serverH2c);
 		return servers;
 	}
 	/**
@@ -720,7 +774,7 @@ let HttpKernel = class HttpKernel extends Service {
 	* {@link readRuntimeState} — `status`/`stop` redeviendraient aveugles alors que
 	* l'app écoute toujours. Le master, lui, est le propriétaire du runtime.
 	*/
-	publishRuntimePorts(serverHttp, serverHttps) {
+	publishRuntimePorts(serverHttp, serverHttps, serverH2c) {
 		const ports = [];
 		const desired = [];
 		const urls = [];
@@ -736,6 +790,11 @@ let HttpKernel = class HttpKernel extends Service {
 			const port = configuredServerPort(asServersConfig(this.kernel?.options.servers), "https");
 			if (port) desired.push(port);
 		}
+		if (serverH2c?.active && serverH2c.port > 0) {
+			ports.push(serverH2c.port);
+			const port = configuredServerPort(asServersConfig(this.kernel?.options.servers), "h2c");
+			if (port) desired.push(port);
+		}
 		if (ports.length === 0) return;
 		writeRuntimeState(process.cwd(), {
 			pid: cluster.isWorker ? process.ppid : process.pid,
@@ -794,10 +853,12 @@ let HttpKernel = class HttpKernel extends Service {
 	teardownHttp(context, scope) {
 		if (context.finished) return void 0;
 		try {
-			if (context.waitAsync && !context.sended && this.kernel?.environment === "development") this.log(`Action "${context.resolver?.route?.name ?? context.url}" returned a non-renderable value (void/null/class instance) and never sent a response. Use 'return <object|string|number|boolean|Buffer>' (auto-JSON) or send/stream manually.`, "WARNING");
+			context.stopClock();
+			if (context.waitAsync) this.warnUnsentResponse(context);
 			context.logRequest();
+			if (context.requestTrace !== null) closeRequestTrace(context, context.response.statusCode, context.error);
 			context.logPhasesVerbose();
-			this.profiler?.collect(context);
+			if (this.shouldProfile(context.url)) this.profiler?.collect(context);
 			const afterResponse = context._runAfterResponse();
 			if (afterResponse !== void 0 || context.listenerCount("onFinish")) return this.finishTeardownHttp(context, scope, afterResponse);
 			this.releaseHttpContext(context, scope);
@@ -856,7 +917,7 @@ let HttpKernel = class HttpKernel extends Service {
 			response.on("close", () => {
 				if (!responseEnded(response)) {
 					context._abortIfPending("Connection closed before response finished");
-					if (!context.sended) context.response.statusCode = 499;
+					if (context.response.statusCode < 400) context.response.statusCode = 499;
 				}
 				this.teardownHttp(context, scope);
 			});
@@ -881,7 +942,7 @@ let HttpKernel = class HttpKernel extends Service {
 		try {
 			context = this.createHttpContext(scope, request, response, type);
 			const created = context;
-			const served = this.listenerCount("onCreateContext") ? this.fireAsync("onCreateContext", created).then(() => this.serveHttpContext(created, scope, request, response)) : this.serveHttpContext(created, scope, request, response);
+			const served = hasRequestTraceSubscribers() ? runTraced(openRequestTrace(created, "http"), this.dispatchHttpContext, this, created, scope, request, response) : this.dispatchHttpContext(created, scope, request, response);
 			if (!isPromise(served)) return served;
 			return served.catch((e) => this.failHttp(e, created, scope));
 		} catch (e) {
@@ -889,12 +950,26 @@ let HttpKernel = class HttpKernel extends Service {
 		}
 	}
 	/**
+	* Sert un contexte HTTP fraîchement créé : le crochet `onCreateContext`
+	* s'il a des écouteurs, puis le pipeline.
+	*
+	* Hot path : `fireAsync` est une fonction async → 1 Promise + 1 microtask
+	* MÊME à 0 listener. En prod sans @nodefony/security ces seams
+	* (onCreateContext/beforeResolve/afterAuth) n'ont aucun listener → garde
+	* `listenerCount` (O(1), 0 alloc) pour ne RIEN planifier.
+	*
+	* @returns le contexte servi, ou sa promesse
+	*/
+	dispatchHttpContext(context, scope, request, response) {
+		return this.listenerCount("onCreateContext") ? this.fireAsync("onCreateContext", context).then(() => this.serveHttpContext(context, scope, request, response)) : this.serveHttpContext(context, scope, request, response);
+	}
+	/**
 	* Traceparent, tampon du profileur, puis le pipeline dans la bulle ALS de la
 	* requête (`RequestContext.run`).
 	*/
 	serveHttpContext(context, scope, request, response) {
 		context.traceparent = resolveTraceparent(request.headers.traceparent);
-		const profilerQueries = this.profiler ? [] : null;
+		const profilerQueries = this.shouldProfile(context.url) ? [] : null;
 		context.profilerQueries = profilerQueries;
 		context.profiling = profilerQueries !== null;
 		const store = {
@@ -946,7 +1021,10 @@ let HttpKernel = class HttpKernel extends Service {
 	routeHttpRequest(httpContext, request, response) {
 		if (this.reverseProxy !== null && this.reverseProxy.mounts !== null && (httpContext.validDomain || !this.domainCheck)) {
 			const relayed = this.reverseProxy.forward(request, response, httpContext.scheme);
-			if (relayed !== void 0) return relayed.then(() => httpContext);
+			if (relayed !== void 0) {
+				httpContext.relayAccessLog = this.reverseProxy.match(request.url)?.accessLog ?? "all";
+				return relayed.then(() => httpContext);
+			}
 		}
 		httpContext.phaseStart("resolve");
 		httpContext.resolver = this.router ? this.router.resolve(httpContext) : null;
@@ -1019,9 +1097,15 @@ let HttpKernel = class HttpKernel extends Service {
 				await this.firewall?.handleSecurity(context);
 				if (this.listenerCount("afterAuth")) await this.fireAsync("afterAuth", context);
 			} catch (authError) {
+				if (context.resolver?.exception) {
+					context.response.response?.removeHeader("Upgrade");
+					context.response.response?.removeHeader("Connection");
+				}
 				await this.fireAsync("onAuthFailure", context, authError).catch((e) => this.log(e, "ERROR", "onAuthFailure"));
 				throw authError;
 			}
+			const pending = context.resolver?.exception;
+			if (pending) throw pending;
 		} finally {
 			context.phaseEnd("firewall");
 		}
@@ -1057,21 +1141,48 @@ let HttpKernel = class HttpKernel extends Service {
 			this.log(e, "ERROR", "WS onFinish");
 		}
 	}
-	async onWebsocketRequest(ws, req, type) {
-		const refusal = this.websocketQuotaRefusal(req, ws);
-		if (refusal !== null) {
-			if (ws.readyState === Ws.OPEN) ws.close(1013, refusal);
+	/**
+	* Point d'entrée d'un upgrade vers une route WebSocket de Nodefony, appelé
+	* par le répartiteur d'upgrade AVANT le `101` (#596) : rien ne s'ouvre tant
+	* que le pipeline n'a pas dit oui.
+	*
+	* Les bornes par IP passent en premier, avant tout scope, ALS ou pipeline
+	* (symétrie avec le 429 HTTP et avec le proxy inverse) : le vrai vecteur DoS
+	* est d'accumuler des sockets ouvertes. La place est rendue à la fermeture du
+	* socket du client — même règle que pour un tunnel relayé.
+	*
+	* @param req - requête d'upgrade
+	* @param admission - le verdict à rendre : accepter (`101`) ou refuser (HTTP)
+	* @param type - serveur qui a reçu l'upgrade
+	* @returns la promesse du traitement de la connexion
+	*/
+	async onWebsocketUpgrade(req, admission, type) {
+		if (this.websocketQuotaRefusal(req, req.socket) !== null) {
+			admission.refuse(429);
 			return;
 		}
 		await this.fireAsync("onServerRequest", req, null, type);
 		const scope = this.container?.enterScope("request");
-		return this.handleWebsocket(scope, ws, req, type);
+		return this.handleWebsocket(scope, req, admission, type);
 	}
-	async handleWebsocket(scope, ws, req, type) {
+	/**
+	* Pipeline d'un handshake WebSocket, dans la bulle ALS de la connexion :
+	* jugement (`onConnect`), pare-feu, gardes de l'action — PUIS seulement
+	* l'acceptation, la socket et l'action de handshake. Tout refus antérieur à
+	* l'acceptation part en statut HTTP (`onError` → `refuseHandshake`).
+	*
+	* @param scope - scope DI de la connexion
+	* @param req - requête d'upgrade
+	* @param admission - le verdict à rendre
+	* @param type - serveur qui a reçu l'upgrade
+	* @returns ce que rend l'action de handshake
+	*/
+	async handleWebsocket(scope, req, admission, type) {
 		let context = null;
 		let error = null;
 		try {
-			context = this.createWebsocketContext(scope, req, ws, type);
+			context = this.createWebsocketContext(scope, req, null, type);
+			context.admission = admission;
 		} catch (e) {
 			error = e;
 		}
@@ -1091,7 +1202,7 @@ let HttpKernel = class HttpKernel extends Service {
 				scope
 			};
 			context?.holdRequestStore(store);
-			return await RequestContext.run(store, async () => {
+			const pipeline = async () => {
 				await this.onConnect(context, error);
 				if (this.firewall && context?.secure) {
 					context.phaseStart("firewall");
@@ -1107,26 +1218,55 @@ let HttpKernel = class HttpKernel extends Service {
 						context.phaseEnd("firewall");
 					}
 				}
-				if (context) {
-					context.phaseStart("action");
-					try {
-						return await context.handle();
-					} finally {
-						context.phaseEnd("action");
-					}
+				if (!context) return;
+				const guarded = context.resolver?.authorizeAction();
+				if (guarded !== void 0) await guarded;
+				const accepted = admission.accept();
+				const ws = accepted instanceof Promise ? await accepted : accepted;
+				if (ws === null) {
+					if (context.requestTrace !== null) closeRequestTrace(context, null, null);
+					this.releaseOrphanWsScope(scope, context);
+					return;
 				}
-			});
+				trackPong(ws);
+				context.acceptConnection(ws);
+				await context.connect();
+				context.phaseStart("action");
+				try {
+					return await context.handle();
+				} finally {
+					context.phaseEnd("action");
+				}
+			};
+			return await (context !== null && hasRequestTraceSubscribers() ? runTraced(openRequestTrace(context, "websocket"), RequestContext.run, RequestContext, store, pipeline) : RequestContext.run(store, pipeline));
 		} catch (e) {
 			try {
 				await this.onError(e, context);
 			} catch (errorHandlingError) {
+				admission.refuse(500);
+				this.closeFailedWebsocketTrace(context, e);
 				this.releaseOrphanWsScope(scope, context);
 				throw errorHandlingError;
 			}
+			admission.refuse(500);
+			this.closeFailedWebsocketTrace(context, e);
 			this.releaseOrphanWsScope(scope, context);
 			throw e;
 		}
 	}
+	/**
+	* Fin du canal `nodefony.http.request` pour un handshake interrompu par une
+	* exception — sans effet si un refus l'a déjà publiée (`refuseHandshake`).
+	* Le statut est un fait, pas une déduction : une socket rattachée dit que
+	* le `101` est parti ; sinon c'est le `500` du filet qui a été rendu.
+	*
+	* @param context - le contexte du handshake, `null` s'il n'a pu être construit
+	* @param error - l'exception qui a interrompu le pipeline
+	*/
+	closeFailedWebsocketTrace(context, error) {
+		if (!context?.requestTrace) return;
+		closeRequestTrace(context, context.connection !== null ? 101 : 500, error);
+	}
 	releaseOrphanWsScope(scope, context) {
 		if (!context) {
 			this.container?.leaveScope(scope);
@@ -1137,6 +1277,16 @@ let HttpKernel = class HttpKernel extends Service {
 		this.container?.leaveScope(scope);
 		context.clean();
 	}
+	/**
+	* Juge un handshake WebSocket AVANT son acceptation : hôte, origine,
+	* `beforeResolve`, contrôleur (protocole négocié), session. N'ouvre rien —
+	* l'acceptation n'a lieu qu'après le pare-feu et les gardes de l'action
+	* (cf {@link handleWebsocket}).
+	*
+	* @param context - contexte du handshake, encore sans socket
+	* @param error - erreur levée à la construction du contexte, relancée telle quelle
+	* @throws la première erreur du jugement — rendue en statut HTTP par `onError`
+	*/
 	async onConnect(context, error = null) {
 		if (error) throw error;
 		if (!context) throw new nodefonyError("Bad context", 500);
@@ -1150,7 +1300,6 @@ let HttpKernel = class HttpKernel extends Service {
 			throw e;
 		}
 		if (!context.sessionStarting) await this.startSession(context);
-		return context.connect();
 	}
 	checkValidDomain(context) {
 		if (context.validDomain) return 200;
@@ -1301,7 +1450,6 @@ let HttpKernel = class HttpKernel extends Service {
 		return this.#streams?.revalidate() ?? Promise.resolve();
 	}
 };
-HttpKernel = __decorate([injectable(), __decorateMetadata("design:paramtypes", [typeof Module === "undefined" ? Object : Module])], HttpKernel);
+HttpKernel = __decorate([injectable()], HttpKernel);
 var http_kernel_default = HttpKernel;
-//#endregion
 export { http_kernel_default as default, responseEnded };

package/dist/nodefony/service/pretty-request-logger.js

@@ -1,6 +1,7 @@
-import { computeDurationMs, severityFromStatus } from "./audit-logger.js";
-import { logColor } from "nodefony";
-//#region nodefony/service/pretty-request-logger.ts
+import { handshakeRefusalStatus } from "../src/context/websocket/WebsocketContext.js";
+import { severityFromStatus, statusOf } from "./audit-logger.js";
+import { accessStatusFamily, logColor } from "nodefony";
+// nodefony/service/pretty-request-logger.ts
 /**
 * Pretty single-line logger for dev (P3.2) — the biggest gain for humans.
 *
@@ -23,9 +24,9 @@ var PrettyRequestLogger = class {
 	renderHttp(context, error) {
 		const ctx = context;
 		const err = error ?? ctx.error ?? null;
-		const status = ctx.response?.statusCode ?? (err ? 500 : null);
+		const status = statusOf(ctx) ?? (err ? 500 : null);
 		const method = ctx.method ?? "?";
-		const duration = computeDurationMs(ctx.phases);
+		const duration = ctx.stopClock();
 		return {
 			text: `${logColor.cyan(method.padEnd(4))} ${colorizeStatus(status)} ${ctx.url} ${logColor.blackBright(formatDuration(duration))} ${logColor.blackBright(ctx.remoteAddress ?? "-")} ` + logColor.magenta(`[${shortId(ctx.requestId)}]`) + (err ? ` ${logColor.red(err.message)}` : ""),
 			severity: severityFromStatus(status),
@@ -34,22 +35,24 @@ var PrettyRequestLogger = class {
 	}
 	renderWebsocket(context, error, acceptedProtocol) {
 		const ctx = context;
-		const status = ctx.response?.statusCode ?? (error ? 500 : null);
-		const duration = computeDurationMs(ctx.phases);
+		const refused = error ? handshakeRefusalStatus(context, error) : null;
+		const status = refused ?? statusOf(ctx) ?? (error ? 500 : null);
+		const duration = ctx.stopClock();
 		const proto = acceptedProtocol ? `[${acceptedProtocol}]` : "";
 		return {
 			text: `${logColor.cyan("WS  ")} ${colorizeStatus(status)} ${ctx.url} ${logColor.blackBright(proto)} ${logColor.blackBright(formatDuration(duration))} ${logColor.blackBright(ctx.remoteAddress ?? "-")} ` + logColor.magenta(`[${shortId(ctx.requestId)}]`) + (error ? ` ${logColor.red(error.message)}` : ""),
-			severity: error ? "ERROR" : "INFO",
+			severity: refused !== null ? severityFromStatus(refused) : error ? "ERROR" : "INFO",
 			msgid: "req"
 		};
 	}
 };
 function colorizeStatus(status) {
-	if (status === null) return logColor.blackBright("---");
+	const family = accessStatusFamily(status);
+	if (status === null || family === null) return logColor.blackBright("---");
 	const s = String(status);
-	if (status >= 500) return logColor.red(s);
-	if (status >= 400) return logColor.yellowBold(s);
-	if (status >= 300) return logColor.yellow(s);
+	if (family >= 5) return logColor.red(s);
+	if (family === 4) return logColor.yellowBold(s);
+	if (family === 3) return logColor.yellow(s);
 	return logColor.green(s);
 }
 function formatDuration(ms) {
@@ -61,5 +64,4 @@ function formatDuration(ms) {
 function shortId(id) {
 	return id.length > 8 ? id.slice(0, 8) : id;
 }
-//#endregion
 export { PrettyRequestLogger as default };