@nodefony/http 10.0.0-beta.3 → 10.0.0-beta.5

package/dist/nodefony/service/request-logger.js

@@ -1,5 +1,15 @@
+import { handshakeRefusalStatus } from "../src/context/websocket/WebsocketContext.js";
+import { severityFromStatus } from "./audit-logger.js";
 import { logColor } from "nodefony";
-//#region nodefony/service/request-logger.ts
+// nodefony/service/request-logger.ts
+/**
+* Statut de la réponse : le contrat ne type `response` qu'en `object` ; une
+* annotation (vérifiée, pas une assertion) le lit — le reste passe par le contrat, que le
+* compilateur surveille.
+*/
+const statusOf = (context) => {
+	return context.response?.statusCode;
+};
 /**
 * Default Nodefony per-request logger — preserves the legacy colored format.
 *
@@ -13,14 +23,13 @@ import { logColor } from "nodefony";
 */
 var DefaultRequestLogger = class {
 	renderHttp(context, error) {
-		const ctx = context;
-		const txt = `${logColor.cyan("URL")} : ${ctx.url} ${logColor.cyan("FROM")} : ${ctx.remoteAddress} ${logColor.cyan("ORIGIN")} : ${ctx.originUrl?.host} ${logColor.cyan("ID")} : ${ctx.requestId}`;
-		const err = error ?? ctx.error;
+		const txt = `${logColor.cyan("URL")} : ${context.url} ${logColor.cyan("FROM")} : ${context.remoteAddress} ${logColor.cyan("ORIGIN")} : ${context.originUrl?.host} ${logColor.cyan("ID")} : ${context.requestId}`;
+		const err = error ?? context.error;
 		if (err) {
-			const errCode = err.code ?? ctx.response?.statusCode ?? 500;
-			const msgid = `${ctx.type} ${logColor.magenta(errCode)} ${logColor.red(ctx.method ?? "")}`;
+			const errCode = err.code ?? statusOf(context) ?? 500;
+			const msgid = `${context.serverType} ${logColor.magenta(errCode)} ${logColor.red(context.method ?? "")}`;
 			return {
-				text: ctx.kernel?.environment === "production" ? `${txt} ${err}` : `${txt}\n          ${err}`,
+				text: context.kernel?.environment === "production" ? `${txt} ${err}` : `${txt}\n          ${err}`,
 				severity: "ERROR",
 				msgid
 			};
@@ -28,27 +37,26 @@ var DefaultRequestLogger = class {
 		return {
 			text: txt,
 			severity: "INFO",
-			msgid: `${ctx.type} ${logColor.magenta(ctx.response?.statusCode ?? "")} ${ctx.method}`
+			msgid: `${context.serverType} ${logColor.magenta(statusOf(context) ?? "")} ${context.method}`
 		};
 	}
 	renderWebsocket(context, error, acceptedProtocol) {
-		const ctx = context;
 		if (error) {
-			const errCode = error.code ?? ctx.response?.statusCode ?? 500;
-			const msgid = `${ctx.type} ${logColor.magenta(errCode)} ${logColor.red(ctx.method ?? "")}`;
+			const refused = handshakeRefusalStatus(context, error);
+			const errCode = refused ?? error.code ?? statusOf(context) ?? 500;
+			const msgid = `${context.serverType} ${logColor.magenta(errCode)} ${logColor.red(context.method ?? "")}`;
 			return {
-				text: `${logColor.cyan("URL")} : ${ctx.url}  ${logColor.cyan("FROM")} : ${ctx.remoteAddress} ${logColor.cyan("ORIGIN")} : ${ctx.originUrl?.host} ${logColor.cyan("ID")} : ${ctx.requestId}\n        ` + error.toString(),
-				severity: "ERROR",
+				text: `${logColor.cyan("URL")} : ${context.url}  ${logColor.cyan("FROM")} : ${context.remoteAddress} ${logColor.cyan("ORIGIN")} : ${context.originUrl?.host} ${logColor.cyan("ID")} : ${context.requestId}\n        ` + error.toString(),
+				severity: refused !== null ? severityFromStatus(refused) : "ERROR",
 				msgid
 			};
 		}
-		const msgid = `${ctx.type} ${logColor.magenta(ctx.response?.statusCode ?? "")} ${ctx.method}`;
+		const msgid = `${context.serverType} ${logColor.magenta(statusOf(context) ?? "")} ${context.method}`;
 		return {
-			text: `${logColor.cyan("URL")} : ${ctx.url} ${logColor.cyan("Accept-Protocol")} : ${acceptedProtocol || "*"} ${logColor.cyan("FROM")} : ${ctx.remoteAddress} ${logColor.cyan("ORIGIN")} : ${ctx.originUrl?.host} ${logColor.cyan("ID")} : ${ctx.requestId}`,
+			text: `${logColor.cyan("URL")} : ${context.url} ${logColor.cyan("Accept-Protocol")} : ${acceptedProtocol || "*"} ${logColor.cyan("FROM")} : ${context.remoteAddress} ${logColor.cyan("ORIGIN")} : ${context.originUrl?.host} ${logColor.cyan("ID")} : ${context.requestId}`,
 			severity: "INFO",
 			msgid
 		};
 	}
 };
-//#endregion
 export { DefaultRequestLogger as default };

package/dist/nodefony/service/reverse-proxy.js

@@ -1,11 +1,12 @@
 import { isAmbiguousPath, normalizePrefix, parseProxyOrigin, proxyMountProblems, websocketHandshakeProblem } from "../src/proxy/rules.js";
+import { requestAuthority } from "../src/context/transport.js";
 import { forwardRequest, forwardUpgrade, refuseUpgrade } from "../src/proxy/forward.js";
 import { Service } from "nodefony";
 import http from "node:http";
 import { randomBytes } from "node:crypto";
 import https from "node:https";
 import { TLSSocket } from "node:tls";
-//#region nodefony/service/reverse-proxy.ts
+// nodefony/service/reverse-proxy.ts
 /** Replis si la section `proxy` manque (module construit hors configuration). */
 const DEFAULT_TIMEOUT_MS = 3e4;
 const DEFAULT_CONNECT_TIMEOUT_MS = 5e3;
@@ -240,7 +241,7 @@ var ReverseProxy = class extends Service {
 		const target = this.targetOf(mount);
 		if (target === void 0) return answerPlain(res, 503, "Service Unavailable", "1");
 		if (isAmbiguousPath(req.url ?? "/")) return answerPlain(res, 400, "Bad Request");
-		const host = req.headers.host ?? req.headers[":authority"];
+		const host = requestAuthority(req.headers);
 		return forwardRequest(req, res, mount, target, this.fromOf(req, scheme, host), this.relayFor(mount, target));
 	}
 	/**
@@ -332,5 +333,4 @@ function hostnameOf(host) {
 		return null;
 	}
 }
-//#endregion
 export { ReverseProxy as default };

package/dist/nodefony/service/servers/clientError.js

@@ -1,4 +1,5 @@
-//#region nodefony/service/servers/clientError.ts
+import { isPeerGoneError } from "../../src/context/websocket/Response.js";
+// nodefony/service/servers/clientError.ts
 /**
 * Gère l'event `clientError` d'un `http.Server` / `https.Server`.
 *
@@ -16,5 +17,23 @@ function handleClientError(error, socket) {
 	const statusLine = error.code === "HPE_HEADER_OVERFLOW" ? "431 Request Header Fields Too Large" : "400 Bad Request";
 	socket.end(`HTTP/1.1 ${statusLine}\r\nConnection: close\r\n\r\n`);
 }
-//#endregion
-export { handleClientError };
+/**
+* Gère l'event `sessionError` d'un serveur HTTP/2 (h2c ou TLS) : un pair PARTI
+* se tait, toute autre erreur est rapportée.
+*
+* Une session réinitialisée par le pair n'a rien à diagnostiquer. C'est la
+* signature d'une sonde de port — `nodefony status`, `doctor`, le superviseur
+* de développement, la sonde `tcpSocket` d'un orchestrateur — qui se connecte
+* puis ferme sans lire le `SETTINGS` que le serveur envoie dès l'ouverture : le
+* système ferme alors par un RST plutôt qu'un FIN, et Node lève `ECONNRESET`.
+* La rapporter imprimait une pile entière par sonde. La règle « client parti »
+* est celle des frames WebSocket ({@link isPeerGoneError}), pas une copie.
+*
+* @param error - erreur de session émise par `node:http2`
+* @param report - rapporte une erreur réelle, à la sévérité choisie par le serveur
+*/
+function handleSessionError(error, report) {
+	if (isPeerGoneError(error)) return;
+	report(error);
+}
+export { handleClientError, handleSessionError };

package/dist/nodefony/service/servers/server-h2c.js

@@ -0,0 +1,126 @@
+import { asServersConfig, configuredServerPort, isH2cEnabled } from "../../src/servers/kernelServers.js";
+import __decorate from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorate.js";
+import { handleSessionError } from "./clientError.js";
+import { createDrainTerminator } from "./serverShutdown.js";
+import { bindWithFallback, buildBindPlan, h2cPortConflict } from "../../src/servers/portBinder.js";
+import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorateParam.js";
+import { http2ServerLimits, setHttp2SessionTimeout } from "../../src/servers/http2Limits.js";
+import { BootConfigurationError, Inject, Service, nodefonyError } from "nodefony";
+import http2 from "node:http2";
+// nodefony/service/servers/server-h2c.ts
+/**
+* Serveur HTTP/2 en clair (h2c, connaissance préalable — RFC 9113 §3.3), sur un
+* port DÉDIÉ (`servers.h2c`, 5153 par défaut), pour un proxy inverse qui parle
+* HTTP/2 à ses amonts.
+*
+* Il partage le chemin HTTP/2 du 5152 — même `onHttpRequest`, mêmes limites
+* anti-DoS (`http2ServerLimits`), même drain par GOAWAY — sans TLS : `serverType`
+* vaut `"http"`, le schéma vient du transport ou d'un proxy de confiance, jamais
+* du pseudo-en-tête `:scheme`. Le protocole du saut (`"h2c"`) se constate sur la
+* requête (`transport.ts#alpnProtocolOf`).
+*
+* Hors de son périmètre, délibérément : HTTP/1.1 (refusé par la préface HTTP/2 —
+* sondes et clients HTTP/1.1 restent sur le port HTTP), WebSocket (aucun CONNECT
+* étendu, RFC 8441 : un proxy route `Upgrade: websocket` vers le port HTTP) et la
+* bascule `Upgrade: h2c` (retirée par RFC 9113 §3.1).
+*/
+let ServerH2c = class ServerH2c extends Service {
+	httpKernel;
+	module;
+	server = null;
+	httpTerminator = null;
+	port;
+	protocol = "2.0";
+	ready = false;
+	type = "http";
+	domain;
+	scheme = "http";
+	address = null;
+	family = null;
+	active = false;
+	infos = null;
+	constructor(module, httpKernel) {
+		super("server-h2c", module.container ?? void 0, module.notificationsCenter, module.config.http);
+		this.httpKernel = httpKernel;
+		this.module = module;
+		this.active = isH2cEnabled(asServersConfig(module.kernel?.options.servers)?.h2c);
+		this.port = configuredServerPort(asServersConfig(module.kernel?.options.servers), "h2c") ?? 0;
+		this.domain = this.module.kernel?.domain ?? null;
+	}
+	/**
+	* Crée et met en écoute le serveur h2c.
+	*
+	* @returns le serveur à l'écoute
+	* @throws BootConfigurationError si `servers.h2c.port` est celui du serveur
+	*   HTTP ou HTTPS — un port partagé n'est pas un conflit à contourner
+	*/
+	createServer() {
+		return new Promise((resolve, reject) => {
+			try {
+				if (!this.active) return reject(/* @__PURE__ */ new Error(`Server h2c is not allowed in config file`));
+				const domain = this.domain;
+				if (domain === null) return reject(/* @__PURE__ */ new Error(`Server h2c : aucun domaine d'écoute (kernel absent)`));
+				const servers = asServersConfig(this.module.kernel?.options.servers);
+				const conflict = h2cPortConflict(servers);
+				if (conflict !== null) return reject(new BootConfigurationError(`servers.h2c.port (${this.port}) est aussi celui de servers.${conflict}.port : HTTP/1.1 et h2c ne partagent pas un port. Choisir un port distinct pour servers.h2c.port.`));
+				if (!servers?.http) this.log("servers.h2c actif sans servers.http : les sondes de santé et les WebSocket (HTTP/1.1) n'ont plus de port où arriver.", "WARNING");
+				const server = http2.createServer(http2ServerLimits(this.module.config.http2));
+				this.server = server;
+				this.httpTerminator = createDrainTerminator(server, this.options.shutdownTimeout);
+				setHttp2SessionTimeout(server, this.options.timeout, () => {
+					this.fire("onTimeout", this);
+				});
+				server.on("request", (request, response) => {
+					this.httpKernel.onHttpRequest(request, response, this.type);
+				});
+				server.on("sessionError", (error) => {
+					handleSessionError(error, (e) => this.log(e, "DEBUG", "H2C sessionError"));
+				});
+				server.on("streamError", (error) => {
+					this.log(error, "ERROR", "H2C streamError");
+				});
+				this.module.fire("onCreateServer", this.type, this);
+				bindWithFallback(server, domain, buildBindPlan("h2c", servers, this.module.kernel?.environment)).then(({ address, shiftedFrom }) => {
+					this.infos = address;
+					this.port = address.port;
+					this.address = address.address;
+					this.family = familyOf(address);
+					if (shiftedFrom !== null) this.log(`Port ${shiftedFrom} déjà occupé → h2c écoute sur ${this.port}. Figer le port : servers.h2c.port ; échouer au lieu de glisser : servers.portPolicy = "strict".`, "WARNING");
+					this.ready = true;
+					this.module.fire("onServersReady", this.type, this);
+					server.on("error", (error) => {
+						this.log(new nodefonyError(error), "CRITIC");
+					});
+					resolve(server);
+				}).catch((e) => {
+					const error = e instanceof Error ? e : new Error(String(e));
+					this.log(new nodefonyError(error), "CRITIC");
+					server.close();
+					reject(error);
+				});
+				this.kernel?.once("onTerminate", async () => {
+					if (!this.server) return;
+					try {
+						await this.httpTerminator?.terminate();
+						this.log(`h2c SHUTDOWN PORT : ${this.port}`, "INFO");
+					} catch (e) {
+						this.log(e, "ERROR", "TERMINATE");
+					}
+				});
+			} catch (e) {
+				this.log(e, "CRITIC");
+				return reject(e instanceof Error ? e : new Error(String(e)));
+			}
+		});
+	}
+	showBanner() {
+		if (this.infos) this.log(`Server Listen on h2c://${this.infos.address}:${this.infos.port} Family: ${this.infos.family} Protocol : ${this.protocol}`);
+	}
+};
+ServerH2c = __decorate([__decorateParam(1, Inject("HttpKernel"))], ServerH2c);
+/** Famille d'une adresse d'écoute, lue sans conversion (`AddressInfo.family` est une chaîne). */
+function familyOf(address) {
+	return address.family === "IPv6" ? "IPv6" : "IPv4";
+}
+var server_h2c_default = ServerH2c;
+export { server_h2c_default as default };

package/dist/nodefony/service/servers/server-http.js

@@ -1,14 +1,12 @@
 import { asServersConfig, configuredServerPort } from "../../src/servers/kernelServers.js";
-import __decorateMetadata from "../../../_virtual/_@oxc-project_runtime@0.153.0/helpers/esm/decorateMetadata.js";
-import __decorate from "../../../_virtual/_@oxc-project_runtime@0.153.0/helpers/esm/decorate.js";
-import http_kernel_default from "../http-kernel.js";
+import __decorate from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorate.js";
 import { handleClientError } from "./clientError.js";
 import { createDrainTerminator } from "./serverShutdown.js";
 import { bindWithFallback, buildBindPlan } from "../../src/servers/portBinder.js";
-import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.153.0/helpers/esm/decorateParam.js";
-import { Module, Service, extend, inject, nodefonyError } from "nodefony";
+import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorateParam.js";
+import { Inject, Service, extend, nodefonyError } from "nodefony";
 import http from "node:http";
-//#region nodefony/service/servers/server-http.ts
+// nodefony/service/servers/server-http.ts
 let ServerHttp = class ServerHttp extends Service {
 	httpKernel;
 	module;
@@ -129,7 +127,6 @@ let ServerHttp = class ServerHttp extends Service {
 		if (this.infos) this.log(`Server Listen on ${this.scheme}://${this.infos.address}:${this.infos.port} Family: ${this.infos.family} Protocol : ${this.protocol}`);
 	}
 };
-ServerHttp = __decorate([__decorateParam(1, inject("HttpKernel")), __decorateMetadata("design:paramtypes", [typeof Module === "undefined" ? Object : Module, typeof http_kernel_default === "undefined" ? Object : http_kernel_default])], ServerHttp);
+ServerHttp = __decorate([__decorateParam(1, Inject("HttpKernel"))], ServerHttp);
 var server_http_default = ServerHttp;
-//#endregion
 export { server_http_default as default };

package/dist/nodefony/service/servers/server-https.js

@@ -1,16 +1,14 @@
 import { asServersConfig, configuredServerPort } from "../../src/servers/kernelServers.js";
-import __decorateMetadata from "../../../_virtual/_@oxc-project_runtime@0.153.0/helpers/esm/decorateMetadata.js";
-import __decorate from "../../../_virtual/_@oxc-project_runtime@0.153.0/helpers/esm/decorate.js";
-import http_kernel_default from "../http-kernel.js";
-import { handleClientError } from "./clientError.js";
+import __decorate from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorate.js";
+import { handleClientError, handleSessionError } from "./clientError.js";
 import { createDrainTerminator } from "./serverShutdown.js";
 import { bindWithFallback, buildBindPlan } from "../../src/servers/portBinder.js";
-import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.153.0/helpers/esm/decorateParam.js";
-import { Module, Service, extend, inject, nodefonyError } from "nodefony";
+import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorateParam.js";
+import { http2ServerLimits, setHttp2SessionTimeout } from "../../src/servers/http2Limits.js";
+import { Inject, Service, extend, nodefonyError } from "nodefony";
 import http2 from "node:http2";
 import https from "node:https";
-import { TLSSocket } from "node:tls";
-//#region nodefony/service/servers/server-https.ts
+// nodefony/service/servers/server-https.ts
 let ServerHttps = class ServerHttps extends Service {
 	httpKernel;
 	httpTerminator = null;
@@ -98,7 +96,6 @@ let ServerHttps = class ServerHttps extends Service {
 	createServerH2() {
 		return new Promise((resolve, reject) => {
 			try {
-				const h2Cfg = this.module.options.http2 ?? {};
 				const opt = extend({
 					allowHTTP1: true,
 					rejectUnauthorized: this.options.rejectUnauthorized,
@@ -106,23 +103,14 @@ let ServerHttps = class ServerHttps extends Service {
 					cert: this.httpKernel.serviceCerticats?.cert,
 					ca: this.httpKernel.serviceCerticats?.ca ? this.httpKernel.serviceCerticats.ca : void 0
 				});
-				if (h2Cfg.maxSessionMemory) opt.maxSessionMemory = h2Cfg.maxSessionMemory;
-				if (h2Cfg.maxConcurrentStreams) opt.settings = {
-					...opt.settings,
-					maxConcurrentStreams: h2Cfg.maxConcurrentStreams
-				};
+				Object.assign(opt, http2ServerLimits(this.module.options.http2));
 				this.server = http2.createSecureServer(opt);
 				this.httpTerminator = this.terminator();
-				if (this.options.timeout) this.server.setTimeout(this.options.timeout, () => {
+				setHttp2SessionTimeout(this.server, this.options.timeout, () => {
 					this.fire("onTimeout", this);
 				});
 				this.server.on("request", (request, response) => {
-					let alpnProtocol = false;
-					const sessionSocket = request.stream?.session?.socket;
-					if (sessionSocket instanceof TLSSocket) alpnProtocol = sessionSocket.alpnProtocol;
-					if (request.socket instanceof TLSSocket) alpnProtocol = request.socket.alpnProtocol;
-					if (alpnProtocol === "h2") this.httpKernel.onHttpRequest(request, response, "http2");
-					else this.httpKernel.onHttpRequest(request, response, "https");
+					this.httpKernel.onHttpRequest(request, response, this.type);
 				});
 				this.listenWithPolicy().then(() => resolve(this.server)).catch((e) => {
 					const error = e instanceof Error ? e : new Error(String(e));
@@ -139,7 +127,7 @@ let ServerHttps = class ServerHttps extends Service {
 					}
 				});
 				this.server.on("sessionError", (error) => {
-					this.log(error, "ERROR", "HTTP2 Server sessionError");
+					handleSessionError(error, (e) => this.log(e, "ERROR", "HTTP2 Server sessionError"));
 				});
 				this.server.on("streamError", (error) => {
 					this.log(error, "ERROR", "HTTP2 Server streamError");
@@ -157,6 +145,7 @@ let ServerHttps = class ServerHttps extends Service {
 	* `EADDRINUSE` de repli, qui ne sont pas des pannes).
 	*/
 	async listenWithPolicy() {
+		if (this.server === null) throw new Error("Server https not created");
 		const { address, shiftedFrom } = await bindWithFallback(this.server, this.domain, buildBindPlan("https", asServersConfig(this.module.kernel?.options.servers), this.module.kernel?.environment));
 		this.infos = address;
 		this.port = address.port;
@@ -197,7 +186,6 @@ let ServerHttps = class ServerHttps extends Service {
 		if (this.infos) this.log(`Server Listen on ${this.scheme}://${this.infos.address}:${this.infos.port} Family: ${this.infos.family} Protocol : ${this.protocol}`);
 	}
 };
-ServerHttps = __decorate([__decorateParam(1, inject("HttpKernel")), __decorateMetadata("design:paramtypes", [typeof Module === "undefined" ? Object : Module, typeof http_kernel_default === "undefined" ? Object : http_kernel_default])], ServerHttps);
+ServerHttps = __decorate([__decorateParam(1, Inject("HttpKernel"))], ServerHttps);
 var server_https_default = ServerHttps;
-//#endregion
 export { server_https_default as default };

package/dist/nodefony/service/servers/server-static.js

@@ -1,4 +1,5 @@
 import { normalizePrefix } from "../../src/proxy/rules.js";
+import { requestAuthority } from "../../src/context/transport.js";
 import { Service, extend } from "nodefony";
 import http from "node:http";
 import http2 from "node:http2";
@@ -8,7 +9,7 @@ import { join } from "node:path";
 import mime from "mime-types";
 import tls from "node:tls";
 import serveStatic from "serve-static";
-//#region nodefony/service/servers/server-static.ts
+// nodefony/service/servers/server-static.ts
 const defaultOptions = {
 	cacheControl: true,
 	maxAge: 345600
@@ -148,7 +149,7 @@ var Statics = class extends Service {
 			return scheme + "://" + host;
 		} else if (request instanceof http2.Http2ServerRequest) {
 			scheme = request.socket instanceof tls.TLSSocket ? "https" : "http";
-			host = request.headers[":authority"];
+			host = requestAuthority(request.headers);
 			return scheme + "://" + host;
 		}
 		throw new Error(`Bad request type`);
@@ -181,5 +182,4 @@ var Statics = class extends Service {
 		return Promise.resolve(response);
 	}
 };
-//#endregion
 export { Statics as default };

package/dist/nodefony/service/servers/server-websocket-secure.js

@@ -1,13 +1,11 @@
+import { startHeartbeat } from "./wsHeartbeat.js";
 import { asServersConfig, configuredServerPort } from "../../src/servers/kernelServers.js";
-import __decorateMetadata from "../../../_virtual/_@oxc-project_runtime@0.153.0/helpers/esm/decorateMetadata.js";
-import __decorate from "../../../_virtual/_@oxc-project_runtime@0.153.0/helpers/esm/decorate.js";
-import http_kernel_default from "../http-kernel.js";
-import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.153.0/helpers/esm/decorateParam.js";
-import { startHeartbeat, trackPong } from "./wsHeartbeat.js";
+import __decorate from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorate.js";
+import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorateParam.js";
 import { attachUpgradeDispatch } from "../../src/servers/upgradeDispatch.js";
-import { Module, Service, inject } from "nodefony";
+import { Inject, Service } from "nodefony";
 import Ws, { WebSocketServer } from "ws";
-//#region nodefony/service/servers/server-websocket-secure.ts
+// nodefony/service/servers/server-websocket-secure.ts
 let WebsocketSecure = class WebsocketSecure extends Service {
 	httpKernel;
 	module;
@@ -21,7 +19,7 @@ let WebsocketSecure = class WebsocketSecure extends Service {
 	family = null;
 	scheme = "wss";
 	address = null;
-	type = "websocket-secure";
+	type = "wss";
 	infos = null;
 	/** Timer keep-alive (UN par serveur). `null` si désactivé ou pas démarré. */
 	heartbeatTimer = null;
@@ -52,8 +50,9 @@ let WebsocketSecure = class WebsocketSecure extends Service {
 					noServer: true,
 					clientTracking: true
 				});
-				this.#detachUpgrade = attachUpgradeDispatch(serverHttps.server, this.server, () => this.httpKernel.reverseProxy, (req) => this.httpKernel.websocketUpgradeRefusal(req));
-				this.server.on("connection", this.onConnection.bind(this));
+				this.#detachUpgrade = attachUpgradeDispatch(serverHttps.server, this.server, () => this.httpKernel.reverseProxy, (req) => this.httpKernel.websocketUpgradeRefusal(req), (req, admission) => {
+					this.httpKernel.onWebsocketUpgrade(req, admission, this.type).catch(() => {});
+				});
 				this.heartbeatTimer = startHeartbeat(this.server, this.options);
 				this.kernel?.prependOnceListener("onTerminate", this.terminate.bind(this));
 				this.ready = true;
@@ -65,12 +64,6 @@ let WebsocketSecure = class WebsocketSecure extends Service {
 			}
 		});
 	}
-	onConnection(ws, req) {
-		trackPong(ws);
-		this.httpKernel.onWebsocketRequest(ws, req, this.type).catch(() => {
-			process.nextTick(() => {});
-		});
-	}
 	terminate() {
 		return new Promise((resolve, reject) => {
 			if (this.heartbeatTimer) {
@@ -107,7 +100,6 @@ let WebsocketSecure = class WebsocketSecure extends Service {
 		if (this.infos) this.log(`Server Listen on ${this.scheme}://${this.infos.address}:${this.infos.port} Family: ${this.infos.family} Protocol : ${this.protocol}`);
 	}
 };
-WebsocketSecure = __decorate([__decorateParam(1, inject("HttpKernel")), __decorateMetadata("design:paramtypes", [typeof Module === "undefined" ? Object : Module, typeof http_kernel_default === "undefined" ? Object : http_kernel_default])], WebsocketSecure);
+WebsocketSecure = __decorate([__decorateParam(1, Inject("HttpKernel"))], WebsocketSecure);
 var server_websocket_secure_default = WebsocketSecure;
-//#endregion
 export { server_websocket_secure_default as default };

package/dist/nodefony/service/servers/server-websocket.js

@@ -1,13 +1,11 @@
+import { startHeartbeat } from "./wsHeartbeat.js";
 import { asServersConfig, configuredServerPort } from "../../src/servers/kernelServers.js";
-import __decorateMetadata from "../../../_virtual/_@oxc-project_runtime@0.153.0/helpers/esm/decorateMetadata.js";
-import __decorate from "../../../_virtual/_@oxc-project_runtime@0.153.0/helpers/esm/decorate.js";
-import http_kernel_default from "../http-kernel.js";
-import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.153.0/helpers/esm/decorateParam.js";
-import { startHeartbeat, trackPong } from "./wsHeartbeat.js";
+import __decorate from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorate.js";
+import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorateParam.js";
 import { attachUpgradeDispatch } from "../../src/servers/upgradeDispatch.js";
-import { Module, Service, inject } from "nodefony";
+import { Inject, Service } from "nodefony";
 import Ws, { WebSocketServer } from "ws";
-//#region nodefony/service/servers/server-websocket.ts
+// nodefony/service/servers/server-websocket.ts
 let Websocket = class Websocket extends Service {
 	httpKernel;
 	module;
@@ -21,7 +19,7 @@ let Websocket = class Websocket extends Service {
 	family = null;
 	scheme = "ws";
 	address = null;
-	type = "websocket";
+	type = "ws";
 	infos = null;
 	/** Timer keep-alive (UN par serveur). `null` si désactivé ou pas démarré. */
 	heartbeatTimer = null;
@@ -52,8 +50,9 @@ let Websocket = class Websocket extends Service {
 					noServer: true,
 					clientTracking: true
 				});
-				this.#detachUpgrade = attachUpgradeDispatch(serverHttp.server, this.server, () => this.httpKernel.reverseProxy, (req) => this.httpKernel.websocketUpgradeRefusal(req));
-				this.server.on("connection", this.onConnection.bind(this));
+				this.#detachUpgrade = attachUpgradeDispatch(serverHttp.server, this.server, () => this.httpKernel.reverseProxy, (req) => this.httpKernel.websocketUpgradeRefusal(req), (req, admission) => {
+					this.httpKernel.onWebsocketUpgrade(req, admission, this.type).catch(() => {});
+				});
 				this.heartbeatTimer = startHeartbeat(this.server, this.options);
 				this.kernel?.prependOnceListener("onTerminate", this.terminate.bind(this));
 				this.ready = true;
@@ -65,12 +64,6 @@ let Websocket = class Websocket extends Service {
 			}
 		});
 	}
-	onConnection(ws, req) {
-		trackPong(ws);
-		this.httpKernel.onWebsocketRequest(ws, req, this.type).catch(() => {
-			process.nextTick(() => {});
-		});
-	}
 	terminate() {
 		return new Promise((resolve, reject) => {
 			if (this.heartbeatTimer) {
@@ -107,7 +100,6 @@ let Websocket = class Websocket extends Service {
 		if (this.infos) this.log(`Server Listen on ${this.scheme}://${this.infos.address}:${this.infos.port} Family: ${this.infos.family} Protocol : ${this.protocol}`);
 	}
 };
-Websocket = __decorate([__decorateParam(1, inject("HttpKernel")), __decorateMetadata("design:paramtypes", [typeof Module === "undefined" ? Object : Module, typeof http_kernel_default === "undefined" ? Object : http_kernel_default])], Websocket);
+Websocket = __decorate([__decorateParam(1, Inject("HttpKernel"))], Websocket);
 var server_websocket_default = Websocket;
-//#endregion
 export { server_websocket_default as default };

package/dist/nodefony/service/servers/serverShutdown.js

@@ -1,31 +1,91 @@
-import { createHttpTerminator } from "http-terminator";
-//#region nodefony/service/servers/serverShutdown.ts
+import http from "node:http";
+import https from "node:https";
+import tls from "node:tls";
+// nodefony/service/servers/serverShutdown.ts
 /**
-* Fabrique le terminator de drain graceful d'un serveur HTTP/HTTPS/HTTP2.
+* Fabrique l'arrêt gracieux d'un serveur HTTP/1.1, HTTPS, HTTP/2 sur TLS ou h2c.
 *
-* Au `terminate()` (shutdown SIGTERM/docker stop) : les requêtes in-flight se
-* terminent (header `connection: close` injecté sur les réponses en cours), les
-* sockets idle sont fermées immédiatement, et tout ce qui reste après
-* `shutdownTimeout` ms est détruit de force. Le terminator appelle lui-même
-* `server.close()` — ne pas le rappeler derrière.
+* Au `terminate()` (SIGTERM, `docker stop`), le serveur cesse d'accepter, puis :
+* - **HTTP/2** : chaque session reçoit un GOAWAY (`session.close()`) — les flux
+*   en vol se terminent, les nouveaux sont refusés, et le client sait qu'il doit
+*   rouvrir ailleurs au lieu de constater une coupure ;
+* - **HTTP/1.1** : la réponse en vol part avec `Connection: close`, la socket
+*   inactive est fermée tout de suite, une requête qui arrive encore sur une
+*   socket gardée ouverte reçoit aussi `Connection: close`.
+*
+* Ce qui reste après `shutdownTimeout` ms est détruit. `server.close()` est
+* appelé ici : ne pas le rappeler derrière.
 *
 * ⚠️ Les sockets WebSocket upgradées (sans réponse HTTP en cours) sont détruites
-* SANS frame Close par le terminator → les serveurs WS doivent fermer leurs
-* clients (close 1001) AVANT ce drain. Garanti par l'ordre des listeners
-* `onTerminate` : WS/WSS s'attachent en `prependOnceListener`, les serveurs
-* HTTP en `once`.
+* SANS frame Close → les serveurs WS doivent fermer leurs clients (close 1001)
+* AVANT ce drain. Garanti par l'ordre des listeners `onTerminate` : WS/WSS
+* s'attachent en `prependOnceListener`, les serveurs HTTP en `once`.
 *
-* @param server - serveur Node à drainer (créé, pas forcément listening)
+* @param server - serveur Node à drainer, créé AVANT son `listen` (le suivi des
+*   connexions commence ici)
 * @param shutdownTimeout - délai de drain en ms avant destruction forcée
-* @returns le terminator à invoquer au shutdown
+* @returns l'arrêt à invoquer au shutdown
 */
 function createDrainTerminator(server, shutdownTimeout) {
-	return createHttpTerminator({
-		server,
-		gracefulTerminationTimeout: shutdownTimeout ?? 5e3
+	const timeout = shutdownTimeout ?? 5e3;
+	const emitter = server;
+	const speaksHttp2 = !(server instanceof http.Server || server instanceof https.Server);
+	const overTls = server instanceof tls.Server;
+	const sockets = /* @__PURE__ */ new Set();
+	emitter.on("connection", (socket) => track(sockets, socket));
+	let http1Sockets = null;
+	if (!speaksHttp2) http1Sockets = overTls ? /* @__PURE__ */ new Set() : sockets;
+	else if (overTls) http1Sockets = /* @__PURE__ */ new Set();
+	if (overTls && http1Sockets !== null) {
+		const set = http1Sockets;
+		emitter.on("secureConnection", (socket) => {
+			if (socket.alpnProtocol !== "h2") track(set, socket);
+		});
+	}
+	let draining = false;
+	const sessions = speaksHttp2 ? /* @__PURE__ */ new Set() : null;
+	if (sessions !== null) emitter.on("session", (session) => {
+		if (draining) {
+			session.close();
+			return;
+		}
+		sessions.add(session);
+		session.once("close", () => sessions.delete(session));
+	});
+	let terminating = null;
+	const drain = () => new Promise((resolve) => {
+		draining = true;
+		const deadline = setTimeout(() => {
+			if (sessions !== null) for (const s of sessions) s.destroy();
+			for (const socket of sockets) socket.destroy();
+		}, timeout);
+		server.close(() => {
+			clearTimeout(deadline);
+			resolve();
+		});
+		if (sessions !== null) for (const s of sessions) s.close();
+		if (http1Sockets !== null) {
+			emitter.on("request", closeAfterResponse);
+			for (const socket of http1Sockets) {
+				const response = socket._httpMessage;
+				if (!response) socket.destroy();
+				else if (!response.headersSent) response.setHeader("connection", "close");
+			}
+		}
 	});
+	return { terminate() {
+		terminating ??= drain();
+		return terminating;
+	} };
+}
+function track(set, socket) {
+	set.add(socket);
+	socket.once("close", () => set.delete(socket));
+}
+/** Requête HTTP/1.1 reçue pendant le drain : la connexion ne survivra pas à sa réponse. */
+function closeAfterResponse(request, response) {
+	if (request.httpVersionMajor === 1 && !response.headersSent) response.setHeader("connection", "close");
 }
 /** Drain par défaut (ms) — même valeur que le défaut Zod `servers.*.shutdownTimeout`. */
 const DEFAULT_SHUTDOWN_TIMEOUT = 5e3;
-//#endregion
 export { DEFAULT_SHUTDOWN_TIMEOUT, createDrainTerminator };