@nodefony/http 10.0.0-beta.4 → 10.0.0-beta.6

package/dist/nodefony/service/http-kernel.js

@@ -1,31 +1,41 @@
 import HttpError from "../src/errors/httpError.js";
+import { isUnsupportedTransferCoding } from "../src/proxy/rules.js";
+import { hasConflictingAuthority } from "../src/context/transport.js";
 import { buildTrustProxy } from "../src/context/trustProxy.js";
 import { resolveForwarded } from "../src/context/forwarded.js";
 import { MemoryRateLimitStore } from "../src/rateLimit/MemoryRateLimitStore.js";
 import { WsConnectionCounter } from "../src/rateLimit/WsConnectionCounter.js";
 import { compileDomainPatterns, compileTrustedHosts, isDomainAllowed } from "../src/context/domainMatcher.js";
+import { isProfiledUrl } from "../src/profiler/aggregate.js";
 import { responseEnded } from "../src/context/responseEnded.js";
-import { parseWebsocketUrl } from "../src/context/websocket/websocketUrl.js";
+import { unsentResponseWarning } from "../src/context/unsentResponse.js";
+import { closeRequestTrace, hasRequestTraceSubscribers, openRequestTrace, runTraced } from "../src/context/requestTrace.js";
 import WebsocketContext, { toHandshakeStatus } from "../src/context/websocket/WebsocketContext.js";
 import { trackPong } from "./servers/wsHeartbeat.js";
+import { parseWebsocketUrl } from "../src/context/websocket/websocketUrl.js";
 import HttpContext from "../src/context/http/HttpContext.js";
 import DefaultErrorRenderer from "./error-renderer.js";
-import JsonAuditLogger from "./audit-logger.js";
 import DefaultRequestLogger from "./request-logger.js";
 import PrettyRequestLogger from "./pretty-request-logger.js";
+import JsonAuditLogger from "./audit-logger.js";
 import { resolveTraceparent } from "./trace.js";
 import { asServersConfig, configuredServerPort } from "../src/servers/kernelServers.js";
-import __decorate from "../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorate.js";
-import { GcScheduler, IDENTITY_CHANGED_EVENT, RequestContext, RevocationWatch, Service, finallyMaybe, injectable, isPromise, logColor, nodefonyError, servedUrl, thenMaybe, writeRuntimeState } from "nodefony";
+import __decorate from "../../_virtual/_@oxc-project_runtime@0.157.0/helpers/esm/decorate.js";
+import { BootConfigurationError, GcScheduler, IDENTITY_CHANGED_EVENT, RequestContext, RevocationWatch, Service, finallyMaybe, injectable, isPromise, logColor, nodefonyError, servedUrl, thenMaybe, writeRuntimeState } from "nodefony";
 import cluster from "node:cluster";
 import http from "node:http";
 // nodefony/service/http-kernel.ts
-const HEALTH_HEADERS = {
-	"content-type": "application/json",
-	"cache-control": "no-store"
-};
+const HEALTH_HEADERS = [
+	"content-type",
+	"application/json",
+	"cache-control",
+	"no-store"
+];
 const HEALTH_BODY_OK = "{\"status\":\"ok\"}";
 const HEALTH_BODY_UNREADY = "{\"status\":\"unready\"}";
+/** Corps du 429 du limiteur de débit — figé, rien à sérialiser par refus. */
+const TOO_MANY_REQUESTS_BODY = "{\"code\":429,\"message\":\"Too Many Requests\"}";
+const TOO_MANY_REQUESTS_LENGTH = Buffer.byteLength(TOO_MANY_REQUESTS_BODY);
 const perfProbe = process.env.NF_PERF_PROBE === "1" ? {
 	count: 0,
 	enterScopeNs: 0,
@@ -104,12 +114,28 @@ let HttpKernel = class HttpKernel extends Service {
 	secContentTypeOptions = null;
 	secFrameOptions = null;
 	secHsts = null;
+	/**
+	* En-têtes du transport, tableau plat `[nom, valeur, …]` aux noms en
+	* minuscules, par famille de serveur (HSTS sur TLS seulement). Figés et
+	* VALIDÉS au calcul : chaque réponse les recopie sans les revalider.
+	*/
+	#transportHeaders = {
+		http: [],
+		https: []
+	};
+	/** Réponse d'une sonde de santé : le transport, puis type et cache. */
+	#healthHeaders = {
+		http: [],
+		https: []
+	};
 	sessionService;
 	router;
 	firewall;
 	errorRenderer = new DefaultErrorRenderer();
 	requestLogger = new DefaultRequestLogger();
 	profiler = null;
+	/** `timing.tooling` : profiler aussi l'outillage (lu une fois, à onReady). */
+	profileTooling = false;
 	_trustProxyChecker = null;
 	_wsOriginPolicy = Object.create(null);
 	rateLimiter = null;
@@ -152,12 +178,49 @@ let HttpKernel = class HttpKernel extends Service {
 			if (hsts.preload) v += "; preload";
 			this.secHsts = v;
 		} else this.secHsts = null;
+		const headerServer = this.options.headerServer;
+		const http1 = [];
+		if (headerServer != null && headerServer !== "") http1.push("server", headerServer);
+		if (this.secContentTypeOptions !== null) http1.push("x-content-type-options", this.secContentTypeOptions);
+		if (this.secFrameOptions !== null) http1.push("x-frame-options", this.secFrameOptions);
+		const tls = this.secHsts === null ? http1 : [
+			...http1,
+			"strict-transport-security",
+			this.secHsts
+		];
+		for (let i = 0; i + 1 < tls.length; i += 2) {
+			const name = tls[i] ?? "";
+			try {
+				http.validateHeaderValue(name, tls[i + 1] ?? "");
+			} catch (error) {
+				throw new BootConfigurationError(`[@nodefony/http] en-tête « ${name} » refusé : ${error instanceof Error ? error.message : String(error)}`);
+			}
+		}
+		this.#transportHeaders = {
+			http: http1,
+			https: tls
+		};
+		this.#healthHeaders = {
+			http: [...http1, ...HEALTH_HEADERS],
+			https: [...tls, ...HEALTH_HEADERS]
+		};
+	}
+	/**
+	* En-têtes du transport d'une réponse, figés au démarrage — ce que
+	* `HttpResponse` place en tête de sa réserve.
+	*
+	* @param type - famille du serveur qui a reçu la requête.
+	* @returns la liste plate `[nom, valeur, …]`, noms en minuscules.
+	*/
+	transportHeaders(type) {
+		return type === "https" ? this.#transportHeaders.https : this.#transportHeaders.http;
 	}
 	/**
 	* Ce que ce kernel ÉMET réellement comme en-têtes de sécurité transport.
 	*
 	* Ces trois en-têtes (HSTS, X-Frame-Options, X-Content-Type-Options) sont posés
-	* ici, à l'entrée brute, pour couvrir aussi les statiques et les pages d'erreur
+	* par `@nodefony/http` sur TOUTE réponse (en tête de la réserve de `HttpResponse`),
+	* statiques et pages d'erreur comprises
 	* — pas par `@nodefony/security`, dont les clés homonymes sont inertes. Toute
 	* console d'administration doit donc lire CE point, sinon elle affiche une
 	* intention de configuration au lieu de l'état appliqué.
@@ -184,6 +247,7 @@ let HttpKernel = class HttpKernel extends Service {
 	*/
 	onConfigChanged() {
 		this.computeSecurityHeaderCaches();
+		this.firewall?.onTransportHeadersChanged?.();
 		this._trustProxyChecker = null;
 		this._wsOriginPolicy = Object.create(null);
 		this.trustedHosts = this.options.trustedHosts;
@@ -207,6 +271,36 @@ let HttpKernel = class HttpKernel extends Service {
 	get rateLimitStore() {
 		return this.rateLimiter;
 	}
+	/**
+	* Cette requête — ou cette frame du pont — se profile-t-elle ? Jamais sans
+	* profileur (production). L'outillage (console, profileur, journaux, Vite :
+	* `isProfiledUrl`, sur la règle `isConsolePath` du cœur) seulement sous
+	* `timing.tooling` — on ne
+	* mesure pas la façon dont on mesure : ni tampon SQL, ni instantané, ni place
+	* dans les anneaux du profileur.
+	*
+	* @param url - URL ou chemin de la requête
+	* @returns `true` quand le profil doit être pris
+	*/
+	shouldProfile(url) {
+		return this.profiler !== null && isProfiledUrl(url, this.profileTooling);
+	}
+	/**
+	* En développement, signale une action qui a rendu une valeur que le
+	* Resolver ne sait pas envoyer (`null`, `undefined`, instance de classe)
+	* et n'a rien envoyé elle-même : la requête attend son délai d'expiration.
+	* Le message nomme l'action, ce qu'elle a rendu et le geste qui convient
+	* (`unsentResponseWarning`).
+	*
+	* Appelé au timeout, AVANT que le 504/408 parte — après, `sended` est vrai et
+	* plus rien ne se signalerait — et au démontage, pour un client parti avant.
+	* Gratuit en production : rien n'est lu au-delà de `waitAsync`.
+	*
+	* @param context - le contexte HTTP de la requête
+	*/
+	warnUnsentResponse(context) {
+		if (context.waitAsync && !context.sended && this.kernel?.environment === "development") this.log(unsentResponseWarning(context.resolver, context.url), "WARNING");
+	}
 	configureRateLimit() {
 		this.rateLimitGc?.stop();
 		this.rateLimitGc = null;
@@ -261,9 +355,9 @@ let HttpKernel = class HttpKernel extends Service {
 	* @param response - réponse serveur brute (HTTP/1 ou H2 compat)
 	* @param ok - `true` → 200, `false` → 503 (readiness pendant boot/shutdown)
 	*/
-	#respondHealth(response, ok) {
+	#respondHealth(response, ok, type) {
 		const res = response;
-		res.writeHead(ok ? 200 : 503, HEALTH_HEADERS);
+		res.writeHead(ok ? 200 : 503, type === "https" ? this.#healthHeaders.https : this.#healthHeaders.http);
 		res.end(ok ? HEALTH_BODY_OK : HEALTH_BODY_UNREADY);
 	}
 	async init() {
@@ -277,6 +371,8 @@ let HttpKernel = class HttpKernel extends Service {
 			this.regAlias = this.compileAlias();
 			this.sessionService = this.get("sessions");
 			this.profiler = this.get("profiler");
+			const timing = this.kernel?.options.timing;
+			this.profileTooling = typeof timing === "object" && timing !== null && "tooling" in timing && timing.tooling === true;
 			this.configureRateLimit();
 			this.configureWsConnectionLimit();
 			this.configureHealth();
@@ -571,7 +667,7 @@ let HttpKernel = class HttpKernel extends Service {
 			if (!context.response.isHeaderSent()) {
 				if (context.isRedirect) {
 					context.isRedirect = false;
-					context.response.response?.removeHeader("Location");
+					context.response.removeHeader("Location");
 				}
 				try {
 					await context.render(result.body);
@@ -641,19 +737,14 @@ let HttpKernel = class HttpKernel extends Service {
 	*   pipeline.
 	*/
 	dispatchHttpRequest(request, response, type) {
-		const headerServer = this.options.headerServer;
-		if (headerServer != null && headerServer !== "") response.setHeader("Server", headerServer);
-		if (this.secContentTypeOptions !== null) response.setHeader("X-Content-Type-Options", this.secContentTypeOptions);
-		if (this.secFrameOptions !== null) response.setHeader("X-Frame-Options", this.secFrameOptions);
-		if (this.secHsts !== null && type === "https") response.setHeader("Strict-Transport-Security", this.secHsts);
 		if (this.#healthPaths !== null) {
 			const url = request.url;
 			if (url === this.#healthPaths.liveness) {
-				this.#respondHealth(response, true);
+				this.#respondHealth(response, true, type);
 				return;
 			}
 			if (url === this.#healthPaths.readiness) {
-				this.#respondHealth(response, !this.#terminating && this.kernel?.servable === true);
+				this.#respondHealth(response, !this.#terminating && this.kernel?.servable === true, type);
 				return;
 			}
 		}
@@ -667,13 +758,19 @@ let HttpKernel = class HttpKernel extends Service {
 				if (verdict.limited) {
 					response.setHeader("Retry-After", verdict.retryAfterS);
 					const res = response;
-					res.writeHead(429);
-					res.end();
+					response.setHeader("Content-Type", "application/json; charset=utf-8");
+					response.setHeader("Content-Length", TOO_MANY_REQUESTS_LENGTH);
+					res.writeHead(429, type === "https" ? this.#transportHeaders.https : this.#transportHeaders.http);
+					res.end(TOO_MANY_REQUESTS_BODY);
 					return;
 				}
 			}
 		}
-		if (this.listenerCount("onServerRequest")) return this.fireAsync("onServerRequest", request, response, type).then(() => this.handle(request, response, type));
+		if (this.listenerCount("onServerRequest")) {
+			const transport = type === "https" ? this.#transportHeaders.https : this.#transportHeaders.http;
+			for (let i = 0; i + 1 < transport.length; i += 2) response.setHeader(transport[i] ?? "", transport[i + 1] ?? "");
+			return this.fireAsync("onServerRequest", request, response, type).then(() => this.handle(request, response, type));
+		}
 		return this.handle(request, response, type);
 	}
 	async initServers() {
@@ -816,10 +913,12 @@ let HttpKernel = class HttpKernel extends Service {
 	teardownHttp(context, scope) {
 		if (context.finished) return void 0;
 		try {
-			if (context.waitAsync && !context.sended && this.kernel?.environment === "development") this.log(`Action "${context.resolver?.route?.name ?? context.url}" returned a non-renderable value (void/null/class instance) and never sent a response. Use 'return <object|string|number|boolean|Buffer>' (auto-JSON) or send/stream manually.`, "WARNING");
+			context.stopClock();
+			if (context.waitAsync) this.warnUnsentResponse(context);
 			context.logRequest();
+			if (context.requestTrace !== null) closeRequestTrace(context, context.response.statusCode, context.error);
 			context.logPhasesVerbose();
-			this.profiler?.collect(context);
+			if (this.shouldProfile(context.url)) this.profiler?.collect(context);
 			const afterResponse = context._runAfterResponse();
 			if (afterResponse !== void 0 || context.listenerCount("onFinish")) return this.finishTeardownHttp(context, scope, afterResponse);
 			this.releaseHttpContext(context, scope);
@@ -903,20 +1002,34 @@ let HttpKernel = class HttpKernel extends Service {
 		try {
 			context = this.createHttpContext(scope, request, response, type);
 			const created = context;
-			const served = this.listenerCount("onCreateContext") ? this.fireAsync("onCreateContext", created).then(() => this.serveHttpContext(created, scope, request, response)) : this.serveHttpContext(created, scope, request, response);
+			const served = hasRequestTraceSubscribers() ? runTraced(openRequestTrace(created, "http"), this.dispatchHttpContext, this, created, scope, request, response) : this.dispatchHttpContext(created, scope, request, response);
 			if (!isPromise(served)) return served;
 			return served.catch((e) => this.failHttp(e, created, scope));
 		} catch (e) {
-			return this.failHttp(e, context, scope);
+			return this.failHttp(e, context, scope, response);
 		}
 	}
 	/**
+	* Sert un contexte HTTP fraîchement créé : le crochet `onCreateContext`
+	* s'il a des écouteurs, puis le pipeline.
+	*
+	* Hot path : `fireAsync` est une fonction async → 1 Promise + 1 microtask
+	* MÊME à 0 listener. En prod sans @nodefony/security ces seams
+	* (onCreateContext/beforeResolve/afterAuth) n'ont aucun listener → garde
+	* `listenerCount` (O(1), 0 alloc) pour ne RIEN planifier.
+	*
+	* @returns le contexte servi, ou sa promesse
+	*/
+	dispatchHttpContext(context, scope, request, response) {
+		return this.listenerCount("onCreateContext") ? this.fireAsync("onCreateContext", context).then(() => this.serveHttpContext(context, scope, request, response)) : this.serveHttpContext(context, scope, request, response);
+	}
+	/**
 	* Traceparent, tampon du profileur, puis le pipeline dans la bulle ALS de la
 	* requête (`RequestContext.run`).
 	*/
 	serveHttpContext(context, scope, request, response) {
 		context.traceparent = resolveTraceparent(request.headers.traceparent);
-		const profilerQueries = this.profiler ? [] : null;
+		const profilerQueries = this.shouldProfile(context.url) ? [] : null;
 		context.profilerQueries = profilerQueries;
 		context.profiling = profilerQueries !== null;
 		const store = {
@@ -933,9 +1046,19 @@ let HttpKernel = class HttpKernel extends Service {
 	/**
 	* Chemin d'erreur de {@link handleHttp} : libère le scope d'un contexte qui
 	* n'a pas pu se construire, puis rend l'erreur au client (`onError`).
+	*
+	* Sans contexte, `onError` n'a rien sur quoi écrire : la réponse BRUTE
+	* reçoit alors un 500 nu. Sinon HTTP/1.1 coupait la connexion sans un octet
+	* et HTTP/2 laissait le flux pendu.
 	*/
-	failHttp(e, context, scope) {
-		if (context === null) this.container?.leaveScope(scope);
+	failHttp(e, context, scope, response) {
+		if (context === null) {
+			this.container?.leaveScope(scope);
+			if (response && !response.headersSent) {
+				response.statusCode = 500;
+				response.end();
+			}
+		}
 		return this.onError(e, context);
 	}
 	/**
@@ -967,16 +1090,24 @@ let HttpKernel = class HttpKernel extends Service {
 	*/
 	routeHttpRequest(httpContext, request, response) {
 		if (this.reverseProxy !== null && this.reverseProxy.mounts !== null && (httpContext.validDomain || !this.domainCheck)) {
+			if (this.reverseProxy.match(request.url) !== void 0) httpContext.response.commitHeaders();
 			const relayed = this.reverseProxy.forward(request, response, httpContext.scheme);
-			if (relayed !== void 0) return relayed.then(() => httpContext);
+			if (relayed !== void 0) {
+				httpContext.relayAccessLog = this.reverseProxy.match(request.url)?.accessLog ?? "all";
+				return relayed.then(() => httpContext);
+			}
 		}
 		httpContext.phaseStart("resolve");
 		httpContext.resolver = this.router ? this.router.resolve(httpContext) : null;
 		httpContext.phaseEnd("resolve");
-		this.firewall?.applySecurityHeaders(httpContext);
+		if (this.firewall) httpContext.response.headerPolicy = this.firewall;
 		if (this.serverStatic && httpContext.resolver?.resolve !== true && !httpContext.resolver?.exception && (asServersConfig(this.kernel?.options.servers)?.statics || this.kernel?.options.statics || this.serverStatic.hasMounts())) {
-			response.removeHeader("Content-Type");
-			return this.serverStatic.handle(request, response).catch(() => void 0).then(() => this.serveHttpRequest(httpContext));
+			httpContext.response.removeHeader("Content-Type");
+			httpContext.response.commitBeforeNativeWrite();
+			return this.serverStatic.handle(request, response).catch(() => void 0).then(() => {
+				httpContext.response.disarmNativeWrite();
+				return this.serveHttpRequest(httpContext);
+			});
 		}
 		return this.serveHttpRequest(httpContext);
 	}
@@ -985,6 +1116,9 @@ let HttpKernel = class HttpKernel extends Service {
 	* ({@link onRequestEnd}) et l'action. Chacun n'est attendu que s'il attend.
 	*/
 	serveHttpRequest(httpContext) {
+		const headers = httpContext.request.headers;
+		if (isUnsupportedTransferCoding(headers["transfer-encoding"])) return Promise.reject(new HttpError("Transfer-Encoding not implemented", 501, httpContext));
+		if (hasConflictingAuthority(headers)) return Promise.reject(new HttpError("Host differs from :authority", 400, httpContext));
 		const streamBody = httpContext.resolver?.resolve === true && httpContext.resolver.route?.bodyStream === true;
 		httpContext.phaseStart("parse");
 		const parsed = finallyMaybe(() => streamBody ? void 0 : httpContext.request.initialize(), () => httpContext.phaseEnd("parse"));
@@ -1042,8 +1176,8 @@ let HttpKernel = class HttpKernel extends Service {
 				if (this.listenerCount("afterAuth")) await this.fireAsync("afterAuth", context);
 			} catch (authError) {
 				if (context.resolver?.exception) {
-					context.response.response?.removeHeader("Upgrade");
-					context.response.response?.removeHeader("Connection");
+					context.response.removeHeader("Upgrade");
+					context.response.removeHeader("Connection");
 				}
 				await this.fireAsync("onAuthFailure", context, authError).catch((e) => this.log(e, "ERROR", "onAuthFailure"));
 				throw authError;
@@ -1146,7 +1280,7 @@ let HttpKernel = class HttpKernel extends Service {
 				scope
 			};
 			context?.holdRequestStore(store);
-			return await RequestContext.run(store, async () => {
+			const pipeline = async () => {
 				await this.onConnect(context, error);
 				if (this.firewall && context?.secure) {
 					context.phaseStart("firewall");
@@ -1168,6 +1302,7 @@ let HttpKernel = class HttpKernel extends Service {
 				const accepted = admission.accept();
 				const ws = accepted instanceof Promise ? await accepted : accepted;
 				if (ws === null) {
+					if (context.requestTrace !== null) closeRequestTrace(context, null, null);
 					this.releaseOrphanWsScope(scope, context);
 					return;
 				}
@@ -1180,20 +1315,36 @@ let HttpKernel = class HttpKernel extends Service {
 				} finally {
 					context.phaseEnd("action");
 				}
-			});
+			};
+			return await (context !== null && hasRequestTraceSubscribers() ? runTraced(openRequestTrace(context, "websocket"), RequestContext.run, RequestContext, store, pipeline) : RequestContext.run(store, pipeline));
 		} catch (e) {
 			try {
 				await this.onError(e, context);
 			} catch (errorHandlingError) {
 				admission.refuse(500);
+				this.closeFailedWebsocketTrace(context, e);
 				this.releaseOrphanWsScope(scope, context);
 				throw errorHandlingError;
 			}
 			admission.refuse(500);
+			this.closeFailedWebsocketTrace(context, e);
 			this.releaseOrphanWsScope(scope, context);
 			throw e;
 		}
 	}
+	/**
+	* Fin du canal `nodefony.http.request` pour un handshake interrompu par une
+	* exception — sans effet si un refus l'a déjà publiée (`refuseHandshake`).
+	* Le statut est un fait, pas une déduction : une socket rattachée dit que
+	* le `101` est parti ; sinon c'est le `500` du filet qui a été rendu.
+	*
+	* @param context - le contexte du handshake, `null` s'il n'a pu être construit
+	* @param error - l'exception qui a interrompu le pipeline
+	*/
+	closeFailedWebsocketTrace(context, error) {
+		if (!context?.requestTrace) return;
+		closeRequestTrace(context, context.connection !== null ? 101 : 500, error);
+	}
 	releaseOrphanWsScope(scope, context) {
 		if (!context) {
 			this.container?.leaveScope(scope);
@@ -1351,12 +1502,12 @@ let HttpKernel = class HttpKernel extends Service {
 		return true;
 	}
 	/**
-	* Inscrit un flux SSE à identité révocable : il sera fermé dans la fenêtre de
+	* Inscrit un flux (événements ou octets) à identité révocable : il sera fermé dans la fenêtre de
 	* re-validation qui suit la mort de son identité (déconnexion, session
 	* révoquée, jeton expiré ou annulé) — le même registre et la même règle que
 	* les sockets WebSocket.
 	*
-	* @internal — appelé par le flux lui-même.
+	* @internal — appelé par le cycle de vie du flux (`StreamLifecycle`).
 	*/
 	watchStream(stream) {
 		(this.#streams ??= new RevocationWatch({
@@ -1370,7 +1521,7 @@ let HttpKernel = class HttpKernel extends Service {
 		this.#streams?.unregister(stream);
 	}
 	/**
-	* Re-valide tous les flux SSE et ferme ceux dont l'identité est morte.
+	* Re-valide tous les flux en cours et ferme ceux dont l'identité est morte.
 	* Publique pour qu'un banc la déclenche sans attendre le tick.
 	*/
 	revalidateStreams() {

package/dist/nodefony/service/pretty-request-logger.js

@@ -1,6 +1,6 @@
+import { severityFromStatus, statusOf } from "./audit-logger.js";
 import { handshakeRefusalStatus } from "../src/context/websocket/WebsocketContext.js";
-import { computeDurationMs, severityFromStatus } from "./audit-logger.js";
-import { logColor } from "nodefony";
+import { accessStatusFamily, logColor } from "nodefony";
 // nodefony/service/pretty-request-logger.ts
 /**
 * Pretty single-line logger for dev (P3.2) — the biggest gain for humans.
@@ -24,9 +24,9 @@ var PrettyRequestLogger = class {
 	renderHttp(context, error) {
 		const ctx = context;
 		const err = error ?? ctx.error ?? null;
-		const status = ctx.response?.statusCode ?? (err ? 500 : null);
+		const status = statusOf(ctx) ?? (err ? 500 : null);
 		const method = ctx.method ?? "?";
-		const duration = computeDurationMs(ctx.phases);
+		const duration = ctx.stopClock();
 		return {
 			text: `${logColor.cyan(method.padEnd(4))} ${colorizeStatus(status)} ${ctx.url} ${logColor.blackBright(formatDuration(duration))} ${logColor.blackBright(ctx.remoteAddress ?? "-")} ` + logColor.magenta(`[${shortId(ctx.requestId)}]`) + (err ? ` ${logColor.red(err.message)}` : ""),
 			severity: severityFromStatus(status),
@@ -36,8 +36,8 @@ var PrettyRequestLogger = class {
 	renderWebsocket(context, error, acceptedProtocol) {
 		const ctx = context;
 		const refused = error ? handshakeRefusalStatus(context, error) : null;
-		const status = refused ?? ctx.response?.statusCode ?? (error ? 500 : null);
-		const duration = computeDurationMs(ctx.phases);
+		const status = refused ?? statusOf(ctx) ?? (error ? 500 : null);
+		const duration = ctx.stopClock();
 		const proto = acceptedProtocol ? `[${acceptedProtocol}]` : "";
 		return {
 			text: `${logColor.cyan("WS  ")} ${colorizeStatus(status)} ${ctx.url} ${logColor.blackBright(proto)} ${logColor.blackBright(formatDuration(duration))} ${logColor.blackBright(ctx.remoteAddress ?? "-")} ` + logColor.magenta(`[${shortId(ctx.requestId)}]`) + (error ? ` ${logColor.red(error.message)}` : ""),
@@ -47,11 +47,12 @@ var PrettyRequestLogger = class {
 	}
 };
 function colorizeStatus(status) {
-	if (status === null) return logColor.blackBright("---");
+	const family = accessStatusFamily(status);
+	if (status === null || family === null) return logColor.blackBright("---");
 	const s = String(status);
-	if (status >= 500) return logColor.red(s);
-	if (status >= 400) return logColor.yellowBold(s);
-	if (status >= 300) return logColor.yellow(s);
+	if (family >= 5) return logColor.red(s);
+	if (family === 4) return logColor.yellowBold(s);
+	if (family === 3) return logColor.yellow(s);
 	return logColor.green(s);
 }
 function formatDuration(ms) {

package/dist/nodefony/service/request-logger.js

@@ -1,5 +1,5 @@
-import { handshakeRefusalStatus } from "../src/context/websocket/WebsocketContext.js";
 import { severityFromStatus } from "./audit-logger.js";
+import { handshakeRefusalStatus } from "../src/context/websocket/WebsocketContext.js";
 import { logColor } from "nodefony";
 // nodefony/service/request-logger.ts
 /**

package/dist/nodefony/service/reverse-proxy.js

@@ -1,6 +1,6 @@
+import { forwardRequest, forwardUpgrade, refuseMalformedHandshake, refuseUpgrade } from "../src/proxy/forward.js";
 import { isAmbiguousPath, normalizePrefix, parseProxyOrigin, proxyMountProblems, websocketHandshakeProblem } from "../src/proxy/rules.js";
 import { requestAuthority } from "../src/context/transport.js";
-import { forwardRequest, forwardUpgrade, refuseUpgrade } from "../src/proxy/forward.js";
 import { Service } from "nodefony";
 import http from "node:http";
 import { randomBytes } from "node:crypto";
@@ -275,10 +275,15 @@ var ReverseProxy = class extends Service {
 			refuseUpgrade(socket, 421, "Misdirected Request");
 			return true;
 		}
-		if (hostname === null || isAmbiguousPath(req.url ?? "/") || websocketHandshakeProblem(req.method, req.headers) !== null) {
+		if (hostname === null || isAmbiguousPath(req.url ?? "/")) {
 			refuseUpgrade(socket, 400, "Bad Request");
 			return true;
 		}
+		const problem = websocketHandshakeProblem(req.method, req.headers);
+		if (problem !== null) {
+			refuseMalformedHandshake(socket, problem);
+			return true;
+		}
 		const secure = req.socket instanceof TLSSocket;
 		if (rules !== void 0 && !rules.isWebsocketOriginAllowed(req.headers.origin, hostname, secure)) {
 			refuseUpgrade(socket, 403, "Forbidden");

package/dist/nodefony/service/servers/clientError.js

@@ -1,7 +1,8 @@
 import { isPeerGoneError } from "../../src/context/websocket/Response.js";
 // nodefony/service/servers/clientError.ts
 /**
-* Gère l'event `clientError` d'un `http.Server` / `https.Server`.
+* Gère l'event `clientError` d'un `http.Server` / `https.Server`, et des connexions
+* HTTP/1.1 d'un serveur HTTP/2 à `allowHTTP1`.
 *
 * ⚠️ Doc Node (`http.Server` event `'clientError'`) : dès qu'un listener
 * `clientError` est attaché, Node **cesse de fermer le socket automatiquement**
@@ -13,9 +14,32 @@ import { isPeerGoneError } from "../../src/context/websocket/Response.js";
 * @param socket - flux client brut (l'event `clientError` fournit un `Duplex`).
 */
 function handleClientError(error, socket) {
-	if (error.code === "ECONNRESET" || !socket.writable) return;
-	const statusLine = error.code === "HPE_HEADER_OVERFLOW" ? "431 Request Header Fields Too Large" : "400 Bad Request";
-	socket.end(`HTTP/1.1 ${statusLine}\r\nConnection: close\r\n\r\n`);
+	const code = "code" in error ? error.code : void 0;
+	if (code === "ECONNRESET" || !socket.writable) return;
+	const statusLine = code === "HPE_HEADER_OVERFLOW" ? overflowStatusLine(error) : "400 Bad Request";
+	socket.end(`HTTP/1.1 ${statusLine}\r\nConnection: close\r\nContent-Length: 0\r\n\r\n`);
+}
+/**
+* Le statut d'un `HPE_HEADER_OVERFLOW` : Node lève la même erreur pour une
+* cible trop longue et pour des en-têtes trop longs, alors que la norme les
+* distingue — 414 pour la cible (RFC 9112 §3), 431 pour les en-têtes
+* (RFC 6585 §5).
+*
+* Le parseur ne constate le débordement qu'à la FIN d'un élément (la cible,
+* une valeur d'en-tête), au point `bytesParsed` du paquet reçu (`rawPacket`).
+* Si la ligne de requête était finie, son `CRLF` — ou celui d'un en-tête —
+* précède ce point : ce sont les en-têtes qui débordent. Sinon, c'est la cible.
+* Constaté sur Node 26, en un paquet comme en plusieurs. Faute de ces deux
+* champs, 431 : le statut d'avant.
+*/
+function overflowStatusLine(error) {
+	const raw = "rawPacket" in error ? error.rawPacket : void 0;
+	const parsed = "bytesParsed" in error ? error.bytesParsed : void 0;
+	if (Buffer.isBuffer(raw) && typeof parsed === "number") {
+		const eol = raw.indexOf("\r\n");
+		if (eol === -1 || eol >= parsed) return "414 URI Too Long";
+	}
+	return "431 Request Header Fields Too Large";
 }
 /**
 * Gère l'event `sessionError` d'un serveur HTTP/2 (h2c ou TLS) : un pair PARTI

package/dist/nodefony/service/servers/server-h2c.js

@@ -1,10 +1,10 @@
-import { asServersConfig, configuredServerPort, isH2cEnabled } from "../../src/servers/kernelServers.js";
-import __decorate from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorate.js";
-import { handleSessionError } from "./clientError.js";
 import { createDrainTerminator } from "./serverShutdown.js";
-import { bindWithFallback, buildBindPlan, h2cPortConflict } from "../../src/servers/portBinder.js";
-import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorateParam.js";
+import { handleSessionError } from "./clientError.js";
 import { http2ServerLimits, setHttp2SessionTimeout } from "../../src/servers/http2Limits.js";
+import { bindWithFallback, buildBindPlan, h2cPortConflict } from "../../src/servers/portBinder.js";
+import { asServersConfig, configuredServerPort, isH2cEnabled } from "../../src/servers/kernelServers.js";
+import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.157.0/helpers/esm/decorateParam.js";
+import __decorate from "../../../_virtual/_@oxc-project_runtime@0.157.0/helpers/esm/decorate.js";
 import { BootConfigurationError, Inject, Service, nodefonyError } from "nodefony";
 import http2 from "node:http2";
 // nodefony/service/servers/server-h2c.ts

package/dist/nodefony/service/servers/server-http.js

@@ -1,9 +1,10 @@
-import { asServersConfig, configuredServerPort } from "../../src/servers/kernelServers.js";
-import __decorate from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorate.js";
 import { handleClientError } from "./clientError.js";
+import { routeSocketTimeout } from "../../src/context/http/HttpContext.js";
 import { createDrainTerminator } from "./serverShutdown.js";
 import { bindWithFallback, buildBindPlan } from "../../src/servers/portBinder.js";
-import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorateParam.js";
+import { asServersConfig, configuredServerPort } from "../../src/servers/kernelServers.js";
+import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.157.0/helpers/esm/decorateParam.js";
+import __decorate from "../../../_virtual/_@oxc-project_runtime@0.157.0/helpers/esm/decorate.js";
 import { Inject, Service, extend, nodefonyError } from "nodefony";
 import http from "node:http";
 // nodefony/service/servers/server-http.ts
@@ -41,6 +42,7 @@ let ServerHttp = class ServerHttp extends Service {
 				this.server = http.createServer(opt);
 				this.httpTerminator = createDrainTerminator(this.server, this.options.shutdownTimeout);
 				if (this.options.maxHeadersCount) this.server.maxHeadersCount = this.options.maxHeadersCount;
+				this.server.on("timeout", routeSocketTimeout);
 				if (this.options.timeout) {
 					this.server.setTimeout(this.options.timeout, () => {
 						this.fire("onTimeout", this);