@nodefony/http 10.0.0-beta.5 → 10.0.0-beta.7

package/dist/nodefony/service/pretty-request-logger.js

@@ -1,5 +1,6 @@
+import { severityFromStatus, severityOfHttp, statusOf } from "./audit-logger.js";
+import { rpcSegment } from "./request-logger.js";
 import { handshakeRefusalStatus } from "../src/context/websocket/WebsocketContext.js";
-import { severityFromStatus, statusOf } from "./audit-logger.js";
 import { accessStatusFamily, logColor } from "nodefony";
 // nodefony/service/pretty-request-logger.ts
 /**
@@ -27,9 +28,10 @@ var PrettyRequestLogger = class {
 		const status = statusOf(ctx) ?? (err ? 500 : null);
 		const method = ctx.method ?? "?";
 		const duration = ctx.stopClock();
+		const rpc = ctx.rpc ?? null;
 		return {
-			text: `${logColor.cyan(method.padEnd(4))} ${colorizeStatus(status)} ${ctx.url} ${logColor.blackBright(formatDuration(duration))} ${logColor.blackBright(ctx.remoteAddress ?? "-")} ` + logColor.magenta(`[${shortId(ctx.requestId)}]`) + (err ? ` ${logColor.red(err.message)}` : ""),
-			severity: severityFromStatus(status),
+			text: `${logColor.cyan(method.padEnd(4))} ${colorizeStatus(status)} ${ctx.url} ${logColor.blackBright(formatDuration(duration))} ${logColor.blackBright(ctx.remoteAddress ?? "-")} ` + logColor.magenta(`[${shortId(ctx.requestId)}]`) + (rpc === null ? "" : ` ${rpcSegment(rpc)}`) + (err ? ` ${logColor.red(err.message)}` : ""),
+			severity: severityOfHttp(ctx, status),
 			msgid: "req"
 		};
 	}

package/dist/nodefony/service/request-logger.js

@@ -1,5 +1,5 @@
+import { severityFromRpcCode, severityFromStatus } from "./audit-logger.js";
 import { handshakeRefusalStatus } from "../src/context/websocket/WebsocketContext.js";
-import { severityFromStatus } from "./audit-logger.js";
 import { logColor } from "nodefony";
 // nodefony/service/request-logger.ts
 /**
@@ -11,6 +11,18 @@ const statusOf = (context) => {
 	return context.response?.statusCode;
 };
 /**
+* Segment d'un appel RPC sur la ligne d'accès : `RPC : <méthode> <NOM>`
+* (ADR-0026 D10 point 4) — le statut HTTP reste à sa place. Sans code (appel
+* jamais commencé), la méthode seule.
+*
+* @param rpc - le résultat de l'appel.
+* @returns le segment, sans espace de tête.
+*/
+function rpcSegment(rpc) {
+	const name = rpc.codeName;
+	return name === null ? `${logColor.cyan("RPC")} : ${rpc.method}` : `${logColor.cyan("RPC")} : ${rpc.method} ${name}`;
+}
+/**
 * Default Nodefony per-request logger — preserves the legacy colored format.
 *
 * HTTP success: `URL : <url> FROM : <remote> ORIGIN : <host> ID : <uuid>`
@@ -23,21 +35,24 @@ const statusOf = (context) => {
 */
 var DefaultRequestLogger = class {
 	renderHttp(context, error) {
-		const txt = `${logColor.cyan("URL")} : ${context.url} ${logColor.cyan("FROM")} : ${context.remoteAddress} ${logColor.cyan("ORIGIN")} : ${context.originUrl?.host} ${logColor.cyan("ID")} : ${context.requestId}`;
+		const rpc = context.rpc ?? null;
+		const txt = `${logColor.cyan("URL")} : ${context.url} ${logColor.cyan("FROM")} : ${context.remoteAddress} ${logColor.cyan("ORIGIN")} : ${context.originUrl?.host} ${logColor.cyan("ID")} : ${context.requestId}` + (rpc === null ? "" : ` ${rpcSegment(rpc)}`);
+		const code = rpc === null ? null : rpc.code;
 		const err = error ?? context.error;
 		if (err) {
 			const errCode = err.code ?? statusOf(context) ?? 500;
 			const msgid = `${context.serverType} ${logColor.magenta(errCode)} ${logColor.red(context.method ?? "")}`;
 			return {
 				text: context.kernel?.environment === "production" ? `${txt} ${err}` : `${txt}\n          ${err}`,
-				severity: "ERROR",
+				severity: code === null ? "ERROR" : severityFromRpcCode(code),
 				msgid
 			};
 		}
+		const msgid = `${context.serverType} ${logColor.magenta(statusOf(context) ?? "")} ${context.method}`;
 		return {
 			text: txt,
-			severity: "INFO",
-			msgid: `${context.serverType} ${logColor.magenta(statusOf(context) ?? "")} ${context.method}`
+			severity: code === null ? "INFO" : severityFromRpcCode(code),
+			msgid
 		};
 	}
 	renderWebsocket(context, error, acceptedProtocol) {
@@ -59,4 +74,4 @@ var DefaultRequestLogger = class {
 		};
 	}
 };
-export { DefaultRequestLogger as default };
+export { DefaultRequestLogger as default, rpcSegment };

package/dist/nodefony/service/reverse-proxy.js

@@ -1,6 +1,6 @@
+import { forwardRequest, forwardUpgrade, refuseMalformedHandshake, refuseUpgrade } from "../src/proxy/forward.js";
 import { isAmbiguousPath, normalizePrefix, parseProxyOrigin, proxyMountProblems, websocketHandshakeProblem } from "../src/proxy/rules.js";
 import { requestAuthority } from "../src/context/transport.js";
-import { forwardRequest, forwardUpgrade, refuseUpgrade } from "../src/proxy/forward.js";
 import { Service } from "nodefony";
 import http from "node:http";
 import { randomBytes } from "node:crypto";
@@ -67,7 +67,7 @@ var ReverseProxy = class extends Service {
 		this.defaultTimeoutMs = section?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
 		this.connectTimeoutMs = section?.connectTimeoutMs ?? DEFAULT_CONNECT_TIMEOUT_MS;
 		this.maxSockets = section?.maxSockets ?? DEFAULT_MAX_SOCKETS;
-		this.kernel?.prependOnceListener("onTerminate", () => this.closeAll());
+		this.kernel?.once("onTerminate", () => this.closeAll());
 		for (const [prefix, mount] of Object.entries(section?.mounts ?? {})) this.#add(prefix, mount, "config");
 	}
 	/**
@@ -275,10 +275,15 @@ var ReverseProxy = class extends Service {
 			refuseUpgrade(socket, 421, "Misdirected Request");
 			return true;
 		}
-		if (hostname === null || isAmbiguousPath(req.url ?? "/") || websocketHandshakeProblem(req.method, req.headers) !== null) {
+		if (hostname === null || isAmbiguousPath(req.url ?? "/")) {
 			refuseUpgrade(socket, 400, "Bad Request");
 			return true;
 		}
+		const problem = websocketHandshakeProblem(req.method, req.headers);
+		if (problem !== null) {
+			refuseMalformedHandshake(socket, problem);
+			return true;
+		}
 		const secure = req.socket instanceof TLSSocket;
 		if (rules !== void 0 && !rules.isWebsocketOriginAllowed(req.headers.origin, hostname, secure)) {
 			refuseUpgrade(socket, 403, "Forbidden");

package/dist/nodefony/service/servers/clientError.js

@@ -1,7 +1,29 @@
 import { isPeerGoneError } from "../../src/context/websocket/Response.js";
+import { STATUS_CODES } from "node:http";
 // nodefony/service/servers/clientError.ts
 /**
-* Gère l'event `clientError` d'un `http.Server` / `https.Server`.
+* Le statut que Node lui-même aurait répondu (`_http_server.js#socketOnError`),
+* hors débordement d'en-têtes ({@link overflowStatusLine}) ; 400 sinon.
+* Brancher un écouteur `clientError` retire cette réponse par défaut : sans
+* cette table, un délai de réception dépassé partait en `400 Bad Request` —
+* le client lisait sa requête malformée alors qu'elle était seulement lente.
+*/
+const CLIENT_ERROR_STATUS = /* @__PURE__ */ new Map([["ERR_HTTP_REQUEST_TIMEOUT", 408], ["HPE_CHUNK_EXTENSIONS_OVERFLOW", 413]]);
+function statusLineOf(status) {
+	return `${status} ${STATUS_CODES[status] ?? ""}`;
+}
+/**
+* La réponse en vol sur cette socket a-t-elle déjà écrit ses en-têtes ? La
+* garde même de Node (`socketOnError` : `_httpMessage._headerSent`), lue par
+* réflexion — deux champs internes, sans équivalent public sur la socket.
+*/
+function inFlightHeaderSent(socket) {
+	const message = Reflect.get(socket, "_httpMessage");
+	return message !== null && typeof message === "object" && Reflect.get(message, "_headerSent") === true;
+}
+/**
+* Gère l'event `clientError` d'un `http.Server` / `https.Server`, et des connexions
+* HTTP/1.1 d'un serveur HTTP/2 à `allowHTTP1`.
 *
 * ⚠️ Doc Node (`http.Server` event `'clientError'`) : dès qu'un listener
 * `clientError` est attaché, Node **cesse de fermer le socket automatiquement**
@@ -13,9 +35,36 @@ import { isPeerGoneError } from "../../src/context/websocket/Response.js";
 * @param socket - flux client brut (l'event `clientError` fournit un `Duplex`).
 */
 function handleClientError(error, socket) {
-	if (error.code === "ECONNRESET" || !socket.writable) return;
-	const statusLine = error.code === "HPE_HEADER_OVERFLOW" ? "431 Request Header Fields Too Large" : "400 Bad Request";
-	socket.end(`HTTP/1.1 ${statusLine}\r\nConnection: close\r\n\r\n`);
+	const code = "code" in error ? error.code : void 0;
+	if (code === "ECONNRESET" || !socket.writable) return;
+	if (inFlightHeaderSent(socket)) {
+		socket.destroy();
+		return;
+	}
+	const statusLine = code === "HPE_HEADER_OVERFLOW" ? overflowStatusLine(error) : statusLineOf(CLIENT_ERROR_STATUS.get(code) ?? 400);
+	socket.end(`HTTP/1.1 ${statusLine}\r\nConnection: close\r\nContent-Length: 0\r\n\r\n`);
+}
+/**
+* Le statut d'un `HPE_HEADER_OVERFLOW` : Node lève la même erreur pour une
+* cible trop longue et pour des en-têtes trop longs, alors que la norme les
+* distingue — 414 pour la cible (RFC 9112 §3), 431 pour les en-têtes
+* (RFC 6585 §5).
+*
+* Le parseur ne constate le débordement qu'à la FIN d'un élément (la cible,
+* une valeur d'en-tête), au point `bytesParsed` du paquet reçu (`rawPacket`).
+* Si la ligne de requête était finie, son `CRLF` — ou celui d'un en-tête —
+* précède ce point : ce sont les en-têtes qui débordent. Sinon, c'est la cible.
+* Constaté sur Node 26, en un paquet comme en plusieurs. Faute de ces deux
+* champs, 431 : le statut d'avant.
+*/
+function overflowStatusLine(error) {
+	const raw = "rawPacket" in error ? error.rawPacket : void 0;
+	const parsed = "bytesParsed" in error ? error.bytesParsed : void 0;
+	if (Buffer.isBuffer(raw) && typeof parsed === "number") {
+		const eol = raw.indexOf("\r\n");
+		if (eol === -1 || eol >= parsed) return "414 URI Too Long";
+	}
+	return "431 Request Header Fields Too Large";
 }
 /**
 * Gère l'event `sessionError` d'un serveur HTTP/2 (h2c ou TLS) : un pair PARTI

package/dist/nodefony/service/servers/server-h2c.js

@@ -1,10 +1,10 @@
-import { asServersConfig, configuredServerPort, isH2cEnabled } from "../../src/servers/kernelServers.js";
-import __decorate from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorate.js";
-import { handleSessionError } from "./clientError.js";
 import { createDrainTerminator } from "./serverShutdown.js";
-import { bindWithFallback, buildBindPlan, h2cPortConflict } from "../../src/servers/portBinder.js";
-import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorateParam.js";
+import { handleSessionError } from "./clientError.js";
 import { http2ServerLimits, setHttp2SessionTimeout } from "../../src/servers/http2Limits.js";
+import { bindWithFallback, buildBindPlan, h2cPortConflict } from "../../src/servers/portBinder.js";
+import { asServersConfig, configuredServerPort, isH2cEnabled } from "../../src/servers/kernelServers.js";
+import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.158.0/helpers/esm/decorateParam.js";
+import __decorate from "../../../_virtual/_@oxc-project_runtime@0.158.0/helpers/esm/decorate.js";
 import { BootConfigurationError, Inject, Service, nodefonyError } from "nodefony";
 import http2 from "node:http2";
 // nodefony/service/servers/server-h2c.ts
@@ -98,7 +98,7 @@ let ServerH2c = class ServerH2c extends Service {
 					server.close();
 					reject(error);
 				});
-				this.kernel?.once("onTerminate", async () => {
+				this.httpKernel.addShutdownStep("drain", async () => {
 					if (!this.server) return;
 					try {
 						await this.httpTerminator?.terminate();

package/dist/nodefony/service/servers/server-http.js

@@ -1,9 +1,10 @@
-import { asServersConfig, configuredServerPort } from "../../src/servers/kernelServers.js";
-import __decorate from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorate.js";
 import { handleClientError } from "./clientError.js";
+import { routeSocketTimeout } from "../../src/context/http/HttpContext.js";
 import { createDrainTerminator } from "./serverShutdown.js";
 import { bindWithFallback, buildBindPlan } from "../../src/servers/portBinder.js";
-import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorateParam.js";
+import { asServersConfig, configuredServerPort } from "../../src/servers/kernelServers.js";
+import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.158.0/helpers/esm/decorateParam.js";
+import __decorate from "../../../_virtual/_@oxc-project_runtime@0.158.0/helpers/esm/decorate.js";
 import { Inject, Service, extend, nodefonyError } from "nodefony";
 import http from "node:http";
 // nodefony/service/servers/server-http.ts
@@ -41,6 +42,7 @@ let ServerHttp = class ServerHttp extends Service {
 				this.server = http.createServer(opt);
 				this.httpTerminator = createDrainTerminator(this.server, this.options.shutdownTimeout);
 				if (this.options.maxHeadersCount) this.server.maxHeadersCount = this.options.maxHeadersCount;
+				this.server.on("timeout", routeSocketTimeout);
 				if (this.options.timeout) {
 					this.server.setTimeout(this.options.timeout, () => {
 						this.fire("onTimeout", this);
@@ -67,7 +69,7 @@ let ServerHttp = class ServerHttp extends Service {
 					this.reportBindError(error);
 					reject(error);
 				});
-				this.kernel?.once("onTerminate", async () => {
+				this.httpKernel.addShutdownStep("drain", async () => {
 					if (!this.server) return;
 					try {
 						await this.httpTerminator?.terminate();

package/dist/nodefony/service/servers/server-https.js

@@ -1,10 +1,11 @@
-import { asServersConfig, configuredServerPort } from "../../src/servers/kernelServers.js";
-import __decorate from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorate.js";
-import { handleClientError, handleSessionError } from "./clientError.js";
 import { createDrainTerminator } from "./serverShutdown.js";
-import { bindWithFallback, buildBindPlan } from "../../src/servers/portBinder.js";
-import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorateParam.js";
 import { http2ServerLimits, setHttp2SessionTimeout } from "../../src/servers/http2Limits.js";
+import { handleClientError, handleSessionError } from "./clientError.js";
+import { routeSocketTimeout } from "../../src/context/http/HttpContext.js";
+import { bindWithFallback, buildBindPlan } from "../../src/servers/portBinder.js";
+import { asServersConfig, configuredServerPort } from "../../src/servers/kernelServers.js";
+import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.158.0/helpers/esm/decorateParam.js";
+import __decorate from "../../../_virtual/_@oxc-project_runtime@0.158.0/helpers/esm/decorate.js";
 import { Inject, Service, extend, nodefonyError } from "nodefony";
 import http2 from "node:http2";
 import https from "node:https";
@@ -57,6 +58,7 @@ let ServerHttps = class ServerHttps extends Service {
 				const server = https.createServer(opt);
 				this.server = server;
 				this.httpTerminator = this.terminator();
+				server.on("timeout", routeSocketTimeout);
 				if (this.options.timeout) {
 					server.setTimeout(this.options.timeout, () => {
 						this.fire("onTimeout", this);
@@ -74,7 +76,7 @@ let ServerHttps = class ServerHttps extends Service {
 				this.server.on("request", (request, response) => {
 					this.httpKernel.onHttpRequest(request, response, this.type);
 				});
-				this.kernel?.once("onTerminate", async () => {
+				this.httpKernel.addShutdownStep("drain", async () => {
 					if (!this.server) return;
 					try {
 						await this.httpTerminator?.terminate();
@@ -106,6 +108,7 @@ let ServerHttps = class ServerHttps extends Service {
 				Object.assign(opt, http2ServerLimits(this.module.options.http2));
 				this.server = http2.createSecureServer(opt);
 				this.httpTerminator = this.terminator();
+				this.server.on("timeout", routeSocketTimeout);
 				setHttp2SessionTimeout(this.server, this.options.timeout, () => {
 					this.fire("onTimeout", this);
 				});
@@ -117,7 +120,7 @@ let ServerHttps = class ServerHttps extends Service {
 					this.reportBindError(error);
 					reject(error);
 				});
-				this.kernel?.once("onTerminate", async () => {
+				this.httpKernel.addShutdownStep("drain", async () => {
 					if (!this.server) return;
 					try {
 						await this.httpTerminator?.terminate();
@@ -129,6 +132,10 @@ let ServerHttps = class ServerHttps extends Service {
 				this.server.on("sessionError", (error) => {
 					handleSessionError(error, (e) => this.log(e, "ERROR", "HTTP2 Server sessionError"));
 				});
+				this.server.on("clientError", (e, socket) => {
+					this.fire("onClientError", e, socket);
+					handleClientError(e, socket);
+				});
 				this.server.on("streamError", (error) => {
 					this.log(error, "ERROR", "HTTP2 Server streamError");
 				});

package/dist/nodefony/service/servers/server-static.js

@@ -6,7 +6,6 @@ import http2 from "node:http2";
 import { URL } from "node:url";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
-import mime from "mime-types";
 import tls from "node:tls";
 import serveStatic from "serve-static";
 // nodefony/service/servers/server-static.ts
@@ -174,11 +173,7 @@ var Statics = class extends Service {
 				break;
 			}
 		}
-		for (const ele of Object.values(this.servers)) {
-			await this.getStatic(ele, request, response);
-			const type = mime.lookup(pathname);
-			response.setHeader("Content-Type", type);
-		}
+		for (const ele of Object.values(this.servers)) await this.getStatic(ele, request, response);
 		return Promise.resolve(response);
 	}
 };

package/dist/nodefony/service/servers/server-websocket-secure.js

@@ -1,10 +1,10 @@
-import { startHeartbeat } from "./wsHeartbeat.js";
 import { asServersConfig, configuredServerPort } from "../../src/servers/kernelServers.js";
-import __decorate from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorate.js";
-import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorateParam.js";
-import { attachUpgradeDispatch } from "../../src/servers/upgradeDispatch.js";
+import { startHeartbeat } from "./wsHeartbeat.js";
+import { attachUpgradeDispatch, createNodefonyWebSocketServer } from "../../src/servers/upgradeDispatch.js";
+import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.158.0/helpers/esm/decorateParam.js";
+import __decorate from "../../../_virtual/_@oxc-project_runtime@0.158.0/helpers/esm/decorate.js";
 import { Inject, Service } from "nodefony";
-import Ws, { WebSocketServer } from "ws";
+import Ws from "ws";
 // nodefony/service/servers/server-websocket-secure.ts
 let WebsocketSecure = class WebsocketSecure extends Service {
 	httpKernel;
@@ -45,16 +45,12 @@ let WebsocketSecure = class WebsocketSecure extends Service {
 					this.family = this.infos.family;
 					this.protocol = serverHttps.protocol;
 				}
-				this.server = new WebSocketServer({
-					...this.options,
-					noServer: true,
-					clientTracking: true
-				});
+				this.server = createNodefonyWebSocketServer(this.options);
 				this.#detachUpgrade = attachUpgradeDispatch(serverHttps.server, this.server, () => this.httpKernel.reverseProxy, (req) => this.httpKernel.websocketUpgradeRefusal(req), (req, admission) => {
 					this.httpKernel.onWebsocketUpgrade(req, admission, this.type).catch(() => {});
 				});
 				this.heartbeatTimer = startHeartbeat(this.server, this.options);
-				this.kernel?.prependOnceListener("onTerminate", this.terminate.bind(this));
+				this.httpKernel.addShutdownStep("dismiss", () => this.terminate());
 				this.ready = true;
 				this.module.fire("onServersReady", this.type, this);
 				return resolve(this.server);

package/dist/nodefony/service/servers/server-websocket.js

@@ -1,10 +1,10 @@
-import { startHeartbeat } from "./wsHeartbeat.js";
 import { asServersConfig, configuredServerPort } from "../../src/servers/kernelServers.js";
-import __decorate from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorate.js";
-import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorateParam.js";
-import { attachUpgradeDispatch } from "../../src/servers/upgradeDispatch.js";
+import { startHeartbeat } from "./wsHeartbeat.js";
+import { attachUpgradeDispatch, createNodefonyWebSocketServer } from "../../src/servers/upgradeDispatch.js";
+import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.158.0/helpers/esm/decorateParam.js";
+import __decorate from "../../../_virtual/_@oxc-project_runtime@0.158.0/helpers/esm/decorate.js";
 import { Inject, Service } from "nodefony";
-import Ws, { WebSocketServer } from "ws";
+import Ws from "ws";
 // nodefony/service/servers/server-websocket.ts
 let Websocket = class Websocket extends Service {
 	httpKernel;
@@ -45,16 +45,12 @@ let Websocket = class Websocket extends Service {
 					this.family = this.infos.family;
 					this.protocol = serverHttp.protocol;
 				}
-				this.server = new WebSocketServer({
-					...this.options,
-					noServer: true,
-					clientTracking: true
-				});
+				this.server = createNodefonyWebSocketServer(this.options);
 				this.#detachUpgrade = attachUpgradeDispatch(serverHttp.server, this.server, () => this.httpKernel.reverseProxy, (req) => this.httpKernel.websocketUpgradeRefusal(req), (req, admission) => {
 					this.httpKernel.onWebsocketUpgrade(req, admission, this.type).catch(() => {});
 				});
 				this.heartbeatTimer = startHeartbeat(this.server, this.options);
-				this.kernel?.prependOnceListener("onTerminate", this.terminate.bind(this));
+				this.httpKernel.addShutdownStep("dismiss", () => this.terminate());
 				this.ready = true;
 				this.module.fire("onServersReady", this.type, this);
 				return resolve(this.server);

package/dist/nodefony/service/servers/serverShutdown.js

@@ -1,3 +1,4 @@
+import { ANNOUNCE_CAP_MS, announceSessionClose } from "../../src/servers/http2Goaway.js";
 import http from "node:http";
 import https from "node:https";
 import tls from "node:tls";
@@ -6,9 +7,11 @@ import tls from "node:tls";
 * Fabrique l'arrêt gracieux d'un serveur HTTP/1.1, HTTPS, HTTP/2 sur TLS ou h2c.
 *
 * Au `terminate()` (SIGTERM, `docker stop`), le serveur cesse d'accepter, puis :
-* - **HTTP/2** : chaque session reçoit un GOAWAY (`session.close()`) — les flux
-*   en vol se terminent, les nouveaux sont refusés, et le client sait qu'il doit
-*   rouvrir ailleurs au lieu de constater une coupure ;
+* - **HTTP/2** : chaque session reçoit un GOAWAY en deux temps — d'abord à
+*   `2^31-1` ({@link announceShutdown}), puis, un aller-retour plus tard, le
+*   définitif (`session.close()`). Les flux en vol se terminent, les nouveaux
+*   sont refusés, et le client sait qu'il doit rouvrir ailleurs au lieu de
+*   constater une coupure ;
 * - **HTTP/1.1** : la réponse en vol part avec `Connection: close`, la socket
 *   inactive est fermée tout de suite, une requête qui arrive encore sur une
 *   socket gardée ouverte reçoit aussi `Connection: close`.
@@ -18,8 +21,8 @@ import tls from "node:tls";
 *
 * ⚠️ Les sockets WebSocket upgradées (sans réponse HTTP en cours) sont détruites
 * SANS frame Close → les serveurs WS doivent fermer leurs clients (close 1001)
-* AVANT ce drain. Garanti par l'ordre des listeners `onTerminate` : WS/WSS
-* s'attachent en `prependOnceListener`, les serveurs HTTP en `once`.
+* AVANT ce drain. Garanti par `HttpKernel.drainTraffic` (ADR-0027 D2) : l'étape
+* `dismiss` (1001) est attendue avant l'étape `drain`.
 *
 * @param server - serveur Node à drainer, créé AVANT son `listen` (le suivi des
 *   connexions commence ici)
@@ -59,6 +62,9 @@ function createDrainTerminator(server, shutdownTimeout) {
 			if (sessions !== null) for (const s of sessions) s.destroy();
 			for (const socket of sockets) socket.destroy();
 		}, timeout);
+		announceShutdown(sessions, Math.min(timeout, ANNOUNCE_CAP_MS), () => closeAll(resolve, deadline));
+	});
+	const closeAll = (resolve, deadline) => {
 		server.close(() => {
 			clearTimeout(deadline);
 			resolve();
@@ -72,12 +78,43 @@ function createDrainTerminator(server, shutdownTimeout) {
 				else if (!response.headersSent) response.setHeader("connection", "close");
 			}
 		}
-	});
+	};
 	return { terminate() {
 		terminating ??= drain();
 		return terminating;
 	} };
 }
+/**
+* Annonce l'arrêt à chaque session HTTP/2 SANS écarter un flux déjà en route —
+* l'annonce en deux temps de RFC 9113 §6.8, session par session
+* ({@link announceSessionClose}, la même règle que la fermeture d'une session
+* inactive). Le GOAWAY définitif (`session.close()`) suit dans `done`. Un pair
+* qui ne répond pas au PING est réglé au délai `cap`.
+*
+* @param sessions - sessions HTTP/2 ouvertes, `null` pour un serveur HTTP/1.1
+* @param cap - délai maximal d'attente des échos (ms)
+* @param done - appelé UNE fois, quand tous les échos sont revenus ou au délai
+*/
+function announceShutdown(sessions, cap, done) {
+	let pending = 1;
+	let finished = false;
+	const finish = () => {
+		if (finished) return;
+		finished = true;
+		clearTimeout(timer);
+		done();
+	};
+	const settle = () => {
+		if (--pending === 0) finish();
+	};
+	const timer = setTimeout(finish, cap);
+	if (sessions !== null) for (const session of sessions) {
+		if (session.closed || session.destroyed) continue;
+		pending++;
+		announceSessionClose(session, settle);
+	}
+	settle();
+}
 function track(set, socket) {
 	set.add(socket);
 	socket.once("close", () => set.delete(socket));

package/dist/nodefony/service/sessions/sessions-service.js

@@ -1,9 +1,9 @@
-import { SESSION_FACETS } from "../../src/session/storage/sessionFilters.js";
-import __decorate from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorate.js";
-import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorateParam.js";
 import Session from "../../src/session/session.js";
 import MemorySessionStorage from "../../src/session/storage/MemorySessionStorage.js";
 import RevocationGuardStorage from "../../src/session/storage/RevocationGuardStorage.js";
+import { SESSION_FACETS } from "../../src/session/storage/sessionFilters.js";
+import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.158.0/helpers/esm/decorateParam.js";
+import __decorate from "../../../_virtual/_@oxc-project_runtime@0.158.0/helpers/esm/decorate.js";
 import { AUTO_STORE, EMPTY_INFRA, GcScheduler, Inject, Nodefony, RequestContext, Service, countFacets, extend, injectable, readStoreConnector, readStoreLocation, resolveAutoStore, storeConnectivity } from "nodefony";
 import { createHash, createHmac } from "node:crypto";
 // nodefony/service/sessions/sessions-service.ts
@@ -125,10 +125,6 @@ let SessionsService = class SessionsService extends Service {
 		this.module = module;
 		this.certificates = this.get("certificates");
 		this.defaultSessionName = this.options.name;
-		this.once("onTerminate", () => {
-			this.gcScheduler?.stop();
-			if (this.storage) this.storage.close();
-		});
 	}
 	async init() {
 		this.secret = this.createSecret();
@@ -184,6 +180,10 @@ let SessionsService = class SessionsService extends Service {
 				onError: (e) => this.log(e, "WARNING", "SESSION-GC")
 			});
 			this.gcScheduler.start();
+			this.kernel?.once("onTerminate", () => {
+				this.gcScheduler?.stop();
+				this.storage?.close();
+			});
 		});
 		return this.storage;
 	}

package/dist/nodefony/service/upload/upload-service.js

@@ -1,5 +1,5 @@
-import __decorate from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorate.js";
-import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorateParam.js";
+import __decorateParam from "../../../_virtual/_@oxc-project_runtime@0.158.0/helpers/esm/decorateParam.js";
+import __decorate from "../../../_virtual/_@oxc-project_runtime@0.158.0/helpers/esm/decorate.js";
 import { Cli, FileClass, Inject, Service } from "nodefony";
 import fs from "node:fs";
 import fsp from "node:fs/promises";

package/dist/nodefony/src/assets/prebuiltUi.js

@@ -1,3 +1,4 @@
+import { cspNonceMetaTag } from "nodefony";
 import fs from "node:fs";
 import path from "node:path";
 // nodefony/src/assets/prebuiltUi.ts
@@ -67,8 +68,8 @@ function resolveUiDelivery(opts) {
 *     requête. Le SPA fallback reste au controller du module (routes littérales,
 *     cf. StudioController).
 *
-* Perf : l'index est lu UNE fois (lazy, caché) ; seule l'injection du nonce
-* coûte un `replaceAll` par rendu — route d'entrée UI, jamais un hot path.
+* Perf : l'index est lu UNE fois (lazy, caché) et découpé UNE fois autour des
+* emplacements du nonce ; un rendu ne coûte qu'un `join`.
 */
 var PrebuiltUi = class {
 	publicPath;
@@ -76,6 +77,8 @@ var PrebuiltUi = class {
 	indexPath;
 	/** Template HTML caché — `null` tant que non lu (lazy). */
 	template = null;
+	/** Index découpé autour des emplacements du nonce — `null` tant que non calculé. */
+	nonceParts = null;
 	constructor(opts) {
 		let p = opts.publicPath.trim();
 		if (!p.startsWith("/")) p = `/${p}`;
@@ -107,8 +110,11 @@ var PrebuiltUi = class {
 	* Document HTML d'entrée de l'UI (index pré-buildé par Vite).
 	*
 	* @param nonce nonce CSP de la requête (`Context.cspNonce`) — injecté sur
-	*              chaque `<script>` ; les assets `src` same-origin passent déjà
-	*              par `'self'`, le nonce couvre un éventuel inline Vite.
+	*              chaque `<script>`, `src` compris : sous `'strict-dynamic'`
+	*              (ADR-0024 §C1), `'self'` est ignoré et seul le nonce autorise
+	*              une balise ; ce qu'elle importe ensuite hérite de la confiance.
+	*              Annoncé aussi par `<meta property="csp-nonce">` en tête de
+	*              `<head>` (ADR-0024 §C2) : les `<style>` créés à l'exécution.
 	* @returns le HTML, ou un commentaire HTML fail-loud si l'index est absent
 	*/
 	renderIndex(nonce) {
@@ -118,7 +124,19 @@ var PrebuiltUi = class {
 			return `<!DOCTYPE html><!-- prebuilt UI index missing: ${this.indexPath} -->`;
 		}
 		if (!nonce) return this.template;
-		return this.template.replaceAll("<script", `<script nonce="${nonce}"`);
+		this.nonceParts ??= splitAroundNonce(this.template);
+		return this.nonceParts.join(nonce);
 	}
 };
+/** Repère des emplacements du nonce : un octet nul ne figure dans aucun HTML. */
+const NONCE_SLOT = "\0";
+/**
+* Découpe un index HTML autour des emplacements du nonce : l'attribut de chaque
+* `<script>` et la balise meta posée juste après l'ouverture de `<head>` (rien
+* si le document n'en a pas — les `<script>` restent signés).
+*/
+function splitAroundNonce(template) {
+	const marked = template.replaceAll("<script", `<script nonce="${NONCE_SLOT}"`).replace(/<head\b[^>]*>/i, (open) => open + cspNonceMetaTag(NONCE_SLOT));
+	return Object.freeze(marked.split(NONCE_SLOT));
+}
 export { PrebuiltUi, resolveUiDelivery };

package/dist/nodefony/src/context/Context.js

@@ -3,9 +3,9 @@ import { protocolNameOf } from "./transport.js";
 import { resolveTimingMode } from "./timingMode.js";
 import Cookie, { cookiesParser } from "../cookies/cookie.js";
 import { RequestContext, Service, logColor } from "nodefony";
+import { AsyncResource } from "node:async_hooks";
 import { randomFillSync, randomUUID } from "node:crypto";
 import { performance } from "node:perf_hooks";
-import { AsyncResource } from "node:async_hooks";
 // nodefony/src/context/Context.ts
 const colorLogEvent = () => logColor.cyanBgBlack("EVENT CONTEXT");
 const PERF_PROBE_SUB = process.env.NF_PERF_PROBE === "1";
@@ -356,6 +356,17 @@ var Context = class extends Service {
 	holdRequestStore(store) {
 		this.requestStore = store;
 	}
+	/**
+	* L'utilisateur authentifié de l'unité de travail, lu sur son magasin et
+	* non sur l'ALS : valable là où la bulle n'est plus active (rendu d'une
+	* erreur, démontage). Même règle que `RequestContext.getAuthenticatedUser`.
+	*
+	* @returns l'utilisateur connecté, ou `null` (anonyme, hors zone, nettoyé).
+	*/
+	authenticatedUser() {
+		const store = this.requestStore;
+		return store === null ? null : RequestContext.authenticatedUserOf(store);
+	}
 	clean() {
 		this.cleaned = true;
 		this.httpKernel = null;