@nodefony/http 10.0.0-beta.5 → 10.0.0-beta.6

package/dist/nodefony/service/servers/server-http.js

@@ -1,9 +1,10 @@
-import { asServersConfig, configuredServerPort } from "../../src/servers/kernelServers.js";
-import __decorate from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorate.js";
 import { handleClientError } from "./clientError.js";
+import { routeSocketTimeout } from "../../src/context/http/HttpContext.js";
 import { createDrainTerminator } from "./serverShutdown.js";
 import { bindWithFallback, buildBindPlan } from "../../src/servers/portBinder.js";
-import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorateParam.js";
+import { asServersConfig, configuredServerPort } from "../../src/servers/kernelServers.js";
+import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.157.0/helpers/esm/decorateParam.js";
+import __decorate from "../../../_virtual/_@oxc-project_runtime@0.157.0/helpers/esm/decorate.js";
 import { Inject, Service, extend, nodefonyError } from "nodefony";
 import http from "node:http";
 // nodefony/service/servers/server-http.ts
@@ -41,6 +42,7 @@ let ServerHttp = class ServerHttp extends Service {
 				this.server = http.createServer(opt);
 				this.httpTerminator = createDrainTerminator(this.server, this.options.shutdownTimeout);
 				if (this.options.maxHeadersCount) this.server.maxHeadersCount = this.options.maxHeadersCount;
+				this.server.on("timeout", routeSocketTimeout);
 				if (this.options.timeout) {
 					this.server.setTimeout(this.options.timeout, () => {
 						this.fire("onTimeout", this);

package/dist/nodefony/service/servers/server-https.js

@@ -1,10 +1,11 @@
-import { asServersConfig, configuredServerPort } from "../../src/servers/kernelServers.js";
-import __decorate from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorate.js";
-import { handleClientError, handleSessionError } from "./clientError.js";
 import { createDrainTerminator } from "./serverShutdown.js";
-import { bindWithFallback, buildBindPlan } from "../../src/servers/portBinder.js";
-import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorateParam.js";
 import { http2ServerLimits, setHttp2SessionTimeout } from "../../src/servers/http2Limits.js";
+import { handleClientError, handleSessionError } from "./clientError.js";
+import { routeSocketTimeout } from "../../src/context/http/HttpContext.js";
+import { bindWithFallback, buildBindPlan } from "../../src/servers/portBinder.js";
+import { asServersConfig, configuredServerPort } from "../../src/servers/kernelServers.js";
+import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.157.0/helpers/esm/decorateParam.js";
+import __decorate from "../../../_virtual/_@oxc-project_runtime@0.157.0/helpers/esm/decorate.js";
 import { Inject, Service, extend, nodefonyError } from "nodefony";
 import http2 from "node:http2";
 import https from "node:https";
@@ -57,6 +58,7 @@ let ServerHttps = class ServerHttps extends Service {
 				const server = https.createServer(opt);
 				this.server = server;
 				this.httpTerminator = this.terminator();
+				server.on("timeout", routeSocketTimeout);
 				if (this.options.timeout) {
 					server.setTimeout(this.options.timeout, () => {
 						this.fire("onTimeout", this);
@@ -106,6 +108,7 @@ let ServerHttps = class ServerHttps extends Service {
 				Object.assign(opt, http2ServerLimits(this.module.options.http2));
 				this.server = http2.createSecureServer(opt);
 				this.httpTerminator = this.terminator();
+				this.server.on("timeout", routeSocketTimeout);
 				setHttp2SessionTimeout(this.server, this.options.timeout, () => {
 					this.fire("onTimeout", this);
 				});
@@ -129,6 +132,10 @@ let ServerHttps = class ServerHttps extends Service {
 				this.server.on("sessionError", (error) => {
 					handleSessionError(error, (e) => this.log(e, "ERROR", "HTTP2 Server sessionError"));
 				});
+				this.server.on("clientError", (e, socket) => {
+					this.fire("onClientError", e, socket);
+					handleClientError(e, socket);
+				});
 				this.server.on("streamError", (error) => {
 					this.log(error, "ERROR", "HTTP2 Server streamError");
 				});

package/dist/nodefony/service/servers/server-static.js

@@ -6,7 +6,6 @@ import http2 from "node:http2";
 import { URL } from "node:url";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
-import mime from "mime-types";
 import tls from "node:tls";
 import serveStatic from "serve-static";
 // nodefony/service/servers/server-static.ts
@@ -174,11 +173,7 @@ var Statics = class extends Service {
 				break;
 			}
 		}
-		for (const ele of Object.values(this.servers)) {
-			await this.getStatic(ele, request, response);
-			const type = mime.lookup(pathname);
-			response.setHeader("Content-Type", type);
-		}
+		for (const ele of Object.values(this.servers)) await this.getStatic(ele, request, response);
 		return Promise.resolve(response);
 	}
 };

package/dist/nodefony/service/servers/server-websocket-secure.js

@@ -1,10 +1,10 @@
-import { startHeartbeat } from "./wsHeartbeat.js";
 import { asServersConfig, configuredServerPort } from "../../src/servers/kernelServers.js";
-import __decorate from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorate.js";
-import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorateParam.js";
-import { attachUpgradeDispatch } from "../../src/servers/upgradeDispatch.js";
+import { startHeartbeat } from "./wsHeartbeat.js";
+import { attachUpgradeDispatch, createNodefonyWebSocketServer } from "../../src/servers/upgradeDispatch.js";
+import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.157.0/helpers/esm/decorateParam.js";
+import __decorate from "../../../_virtual/_@oxc-project_runtime@0.157.0/helpers/esm/decorate.js";
 import { Inject, Service } from "nodefony";
-import Ws, { WebSocketServer } from "ws";
+import Ws from "ws";
 // nodefony/service/servers/server-websocket-secure.ts
 let WebsocketSecure = class WebsocketSecure extends Service {
 	httpKernel;
@@ -45,11 +45,7 @@ let WebsocketSecure = class WebsocketSecure extends Service {
 					this.family = this.infos.family;
 					this.protocol = serverHttps.protocol;
 				}
-				this.server = new WebSocketServer({
-					...this.options,
-					noServer: true,
-					clientTracking: true
-				});
+				this.server = createNodefonyWebSocketServer(this.options);
 				this.#detachUpgrade = attachUpgradeDispatch(serverHttps.server, this.server, () => this.httpKernel.reverseProxy, (req) => this.httpKernel.websocketUpgradeRefusal(req), (req, admission) => {
 					this.httpKernel.onWebsocketUpgrade(req, admission, this.type).catch(() => {});
 				});

package/dist/nodefony/service/servers/server-websocket.js

@@ -1,10 +1,10 @@
-import { startHeartbeat } from "./wsHeartbeat.js";
 import { asServersConfig, configuredServerPort } from "../../src/servers/kernelServers.js";
-import __decorate from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorate.js";
-import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorateParam.js";
-import { attachUpgradeDispatch } from "../../src/servers/upgradeDispatch.js";
+import { startHeartbeat } from "./wsHeartbeat.js";
+import { attachUpgradeDispatch, createNodefonyWebSocketServer } from "../../src/servers/upgradeDispatch.js";
+import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.157.0/helpers/esm/decorateParam.js";
+import __decorate from "../../../_virtual/_@oxc-project_runtime@0.157.0/helpers/esm/decorate.js";
 import { Inject, Service } from "nodefony";
-import Ws, { WebSocketServer } from "ws";
+import Ws from "ws";
 // nodefony/service/servers/server-websocket.ts
 let Websocket = class Websocket extends Service {
 	httpKernel;
@@ -45,11 +45,7 @@ let Websocket = class Websocket extends Service {
 					this.family = this.infos.family;
 					this.protocol = serverHttp.protocol;
 				}
-				this.server = new WebSocketServer({
-					...this.options,
-					noServer: true,
-					clientTracking: true
-				});
+				this.server = createNodefonyWebSocketServer(this.options);
 				this.#detachUpgrade = attachUpgradeDispatch(serverHttp.server, this.server, () => this.httpKernel.reverseProxy, (req) => this.httpKernel.websocketUpgradeRefusal(req), (req, admission) => {
 					this.httpKernel.onWebsocketUpgrade(req, admission, this.type).catch(() => {});
 				});

package/dist/nodefony/service/servers/serverShutdown.js

@@ -1,4 +1,5 @@
 import http from "node:http";
+import { constants } from "node:http2";
 import https from "node:https";
 import tls from "node:tls";
 // nodefony/service/servers/serverShutdown.ts
@@ -6,9 +7,11 @@ import tls from "node:tls";
 * Fabrique l'arrêt gracieux d'un serveur HTTP/1.1, HTTPS, HTTP/2 sur TLS ou h2c.
 *
 * Au `terminate()` (SIGTERM, `docker stop`), le serveur cesse d'accepter, puis :
-* - **HTTP/2** : chaque session reçoit un GOAWAY (`session.close()`) — les flux
-*   en vol se terminent, les nouveaux sont refusés, et le client sait qu'il doit
-*   rouvrir ailleurs au lieu de constater une coupure ;
+* - **HTTP/2** : chaque session reçoit un GOAWAY en deux temps — d'abord à
+*   `2^31-1` ({@link announceShutdown}), puis, un aller-retour plus tard, le
+*   définitif (`session.close()`). Les flux en vol se terminent, les nouveaux
+*   sont refusés, et le client sait qu'il doit rouvrir ailleurs au lieu de
+*   constater une coupure ;
 * - **HTTP/1.1** : la réponse en vol part avec `Connection: close`, la socket
 *   inactive est fermée tout de suite, une requête qui arrive encore sur une
 *   socket gardée ouverte reçoit aussi `Connection: close`.
@@ -59,6 +62,9 @@ function createDrainTerminator(server, shutdownTimeout) {
 			if (sessions !== null) for (const s of sessions) s.destroy();
 			for (const socket of sockets) socket.destroy();
 		}, timeout);
+		announceShutdown(sessions, Math.min(timeout, ANNOUNCE_CAP_MS), () => closeAll(resolve, deadline));
+	});
+	const closeAll = (resolve, deadline) => {
 		server.close(() => {
 			clearTimeout(deadline);
 			resolve();
@@ -72,12 +78,65 @@ function createDrainTerminator(server, shutdownTimeout) {
 				else if (!response.headersSent) response.setHeader("connection", "close");
 			}
 		}
-	});
+	};
 	return { terminate() {
 		terminating ??= drain();
 		return terminating;
 	} };
 }
+/** Plus long délai d'annonce (ms) : un pair qui ne répond pas au PING ne retient pas l'arrêt. */
+const ANNOUNCE_CAP_MS = 1e3;
+/** Plus grand identifiant de flux (RFC 9113 §6.8) : « aucun flux n'est encore écarté ». */
+const LAST_POSSIBLE_STREAM = 2 ** 31 - 1;
+/**
+* Annonce l'arrêt à chaque session HTTP/2 SANS écarter un flux déjà en route :
+* un PING mesure l'aller-retour, puis GOAWAY à `2^31-1`, puis l'attente de cet
+* aller-retour — après elle, tout flux ouvert par le client avant l'annonce est
+* arrivé. Le GOAWAY définitif (`session.close()`, dernier flux traité) suit
+* dans `done`. Un pair qui ne répond pas au PING est réglé au délai `cap`.
+* RFC 9113 §6.8 : « SHOULD send an initial GOAWAY frame with the last stream
+* identifier set to 2^31-1 […] After allowing time for any in-flight stream
+* creation (at least one round-trip time) ». Sans annonce, un flux croisé avec
+* le GOAWAY est refusé alors qu'il aurait pu être servi.
+*
+* @param sessions - sessions HTTP/2 ouvertes, `null` pour un serveur HTTP/1.1
+* @param cap - délai maximal d'attente des échos (ms)
+* @param done - appelé UNE fois, quand tous les échos sont revenus ou au délai
+*/
+function announceShutdown(sessions, cap, done) {
+	let pending = 0;
+	let finished = false;
+	const finish = () => {
+		if (finished) return;
+		finished = true;
+		clearTimeout(timer);
+		done();
+	};
+	const timer = setTimeout(finish, cap);
+	if (sessions !== null) for (const session of sessions) {
+		if (session.closed || session.destroyed) continue;
+		let settled = false;
+		let wait = null;
+		const settle = () => {
+			if (settled) return;
+			settled = true;
+			if (wait !== null) clearTimeout(wait);
+			session.removeListener("close", settle);
+			if (--pending === 0) finish();
+		};
+		pending++;
+		session.once("close", settle);
+		if (!session.ping((error, rttMs) => {
+			if (error !== null || settled || session.closed) return settle();
+			session.goaway(constants.NGHTTP2_NO_ERROR, LAST_POSSIBLE_STREAM);
+			wait = setTimeout(settle, Math.max(1, Math.ceil(rttMs)));
+		})) {
+			session.goaway(constants.NGHTTP2_NO_ERROR, LAST_POSSIBLE_STREAM);
+			settle();
+		}
+	}
+	if (pending === 0) finish();
+}
 function track(set, socket) {
 	set.add(socket);
 	socket.once("close", () => set.delete(socket));

package/dist/nodefony/service/sessions/sessions-service.js

@@ -1,9 +1,9 @@
-import { SESSION_FACETS } from "../../src/session/storage/sessionFilters.js";
-import __decorate from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorate.js";
-import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorateParam.js";
 import Session from "../../src/session/session.js";
 import MemorySessionStorage from "../../src/session/storage/MemorySessionStorage.js";
 import RevocationGuardStorage from "../../src/session/storage/RevocationGuardStorage.js";
+import { SESSION_FACETS } from "../../src/session/storage/sessionFilters.js";
+import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.157.0/helpers/esm/decorateParam.js";
+import __decorate from "../../../_virtual/_@oxc-project_runtime@0.157.0/helpers/esm/decorate.js";
 import { AUTO_STORE, EMPTY_INFRA, GcScheduler, Inject, Nodefony, RequestContext, Service, countFacets, extend, injectable, readStoreConnector, readStoreLocation, resolveAutoStore, storeConnectivity } from "nodefony";
 import { createHash, createHmac } from "node:crypto";
 // nodefony/service/sessions/sessions-service.ts

package/dist/nodefony/service/upload/upload-service.js

@@ -1,5 +1,5 @@
-import __decorate from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorate.js";
-import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorateParam.js";
+import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.157.0/helpers/esm/decorateParam.js";
+import __decorate from "../../../_virtual/_@oxc-project_runtime@0.157.0/helpers/esm/decorate.js";
 import { Cli, FileClass, Inject, Service } from "nodefony";
 import fs from "node:fs";
 import fsp from "node:fs/promises";

package/dist/nodefony/src/assets/prebuiltUi.js

@@ -1,3 +1,4 @@
+import { cspNonceMetaTag } from "nodefony";
 import fs from "node:fs";
 import path from "node:path";
 // nodefony/src/assets/prebuiltUi.ts
@@ -67,8 +68,8 @@ function resolveUiDelivery(opts) {
 *     requête. Le SPA fallback reste au controller du module (routes littérales,
 *     cf. StudioController).
 *
-* Perf : l'index est lu UNE fois (lazy, caché) ; seule l'injection du nonce
-* coûte un `replaceAll` par rendu — route d'entrée UI, jamais un hot path.
+* Perf : l'index est lu UNE fois (lazy, caché) et découpé UNE fois autour des
+* emplacements du nonce ; un rendu ne coûte qu'un `join`.
 */
 var PrebuiltUi = class {
 	publicPath;
@@ -76,6 +77,8 @@ var PrebuiltUi = class {
 	indexPath;
 	/** Template HTML caché — `null` tant que non lu (lazy). */
 	template = null;
+	/** Index découpé autour des emplacements du nonce — `null` tant que non calculé. */
+	nonceParts = null;
 	constructor(opts) {
 		let p = opts.publicPath.trim();
 		if (!p.startsWith("/")) p = `/${p}`;
@@ -107,8 +110,11 @@ var PrebuiltUi = class {
 	* Document HTML d'entrée de l'UI (index pré-buildé par Vite).
 	*
 	* @param nonce nonce CSP de la requête (`Context.cspNonce`) — injecté sur
-	*              chaque `<script>` ; les assets `src` same-origin passent déjà
-	*              par `'self'`, le nonce couvre un éventuel inline Vite.
+	*              chaque `<script>`, `src` compris : sous `'strict-dynamic'`
+	*              (ADR-0024 §C1), `'self'` est ignoré et seul le nonce autorise
+	*              une balise ; ce qu'elle importe ensuite hérite de la confiance.
+	*              Annoncé aussi par `<meta property="csp-nonce">` en tête de
+	*              `<head>` (ADR-0024 §C2) : les `<style>` créés à l'exécution.
 	* @returns le HTML, ou un commentaire HTML fail-loud si l'index est absent
 	*/
 	renderIndex(nonce) {
@@ -118,7 +124,19 @@ var PrebuiltUi = class {
 			return `<!DOCTYPE html><!-- prebuilt UI index missing: ${this.indexPath} -->`;
 		}
 		if (!nonce) return this.template;
-		return this.template.replaceAll("<script", `<script nonce="${nonce}"`);
+		this.nonceParts ??= splitAroundNonce(this.template);
+		return this.nonceParts.join(nonce);
 	}
 };
+/** Repère des emplacements du nonce : un octet nul ne figure dans aucun HTML. */
+const NONCE_SLOT = "\0";
+/**
+* Découpe un index HTML autour des emplacements du nonce : l'attribut de chaque
+* `<script>` et la balise meta posée juste après l'ouverture de `<head>` (rien
+* si le document n'en a pas — les `<script>` restent signés).
+*/
+function splitAroundNonce(template) {
+	const marked = template.replaceAll("<script", `<script nonce="${NONCE_SLOT}"`).replace(/<head\b[^>]*>/i, (open) => open + cspNonceMetaTag(NONCE_SLOT));
+	return Object.freeze(marked.split(NONCE_SLOT));
+}
 export { PrebuiltUi, resolveUiDelivery };