@nodefony/security 10.0.0-alpha.9 → 10.0.0-beta.1

package/dist/nodefony/command/security-token.js

@@ -223,7 +223,7 @@ var SecurityToken = class extends Command {
 				identifier = await this.prompts.select({
 					message: "Compte porteur du jeton :",
 					choices: page.items.map((u) => ({
-						name: `${u.identifier}${(u.roles ?? []).length ? ` ${DIM}(${(u.roles ?? []).join(", ")})${RESET}` : ""}`,
+						name: `${u.identifier}${u.roles.length ? ` ${DIM}(${u.roles.join(", ")})${RESET}` : ""}`,
 						value: u.identifier
 					}))
 				});
@@ -269,7 +269,7 @@ var SecurityToken = class extends Command {
 			throw e;
 		}
 		const token = issued.access_token;
-		const accordes = (issued.scope ?? "").split(/\s+/u).filter(Boolean);
+		const accordes = issued.scope.split(/\s+/u).filter(Boolean);
 		const nonAccordes = scopes.filter((s) => !accordes.includes(s));
 		if (opts.json) {
 			process.stdout.write(`${JSON.stringify({
@@ -285,7 +285,7 @@ var SecurityToken = class extends Command {
 			process.stdout.write(s);
 		};
 		let write = opts.write === true;
-		if (!write && process.stdin.isTTY && !opts.json) {
+		if (!write && process.stdin.isTTY) {
 			await this.loadPrompts();
 			write = await this.prompts.confirm({
 				message: `Poser ${MCP_TOKEN_ENV} dans la configuration des agents présents ?`,
@@ -293,7 +293,7 @@ var SecurityToken = class extends Command {
 			});
 		}
 		if (this.#ephemeralKey()) w(`\n${YELLOW}⚠ Clé de signature ÉPHÉMÈRE — ce jeton sera REFUSÉ.${RESET}\n${DIM}  Cette application n'a pas de clé persistante : chaque process en génère\n  une au démarrage. Le jeton ci-dessous n'est vérifiable que par le process\n  qui vient de le signer — pas par le serveur en marche, qui a la sienne.\n  → déclare une source de clés dans nodefony.config.ts :\n      use("@nodefony/security", { jwt: { keystore: { dir: "var/keys" } } })\n    ou, en production, keySetJson depuis l'environnement.${RESET}\n`);
-		const minutes = Math.round((issued.expires_in ?? 0) / 60);
+		const minutes = Math.round(issued.expires_in / 60);
 		w(`\n${BOLD}🔑 Jeton d'accès${RESET} ${DIM}— compte ${identifier}, audience ${resource}${RESET}\n${DIM}   valable ${minutes} min${accordes.length ? `, scopes : ${accordes.join(" ")}` : ", aucun scope"}${RESET}\n\n`);
 		if (nonAccordes.length > 0) w(`${DIM}   ⚠️  non accordé(s) : ${nonAccordes.join(" ")} — réservé(s) au rôle d'administration, que le compte « ${identifier} » ne porte pas.${RESET}\n\n`);
 		if (write) {

package/dist/nodefony/command/security-user-delete.js

@@ -64,7 +64,7 @@ var SecurityUserDelete = class extends Command {
 			process.exitCode = 1;
 			return this;
 		}
-		if ((user.roles ?? []).includes(ADMIN_ROLE)) {
+		if (user.roles.includes(ADMIN_ROLE)) {
 			if (await users.countActiveAdmins(ADMIN_ROLE) <= 1) {
 				this.log(`« ${identifier} » est le DERNIER administrateur actif — refus.\n  Sans lui, plus personne n'administre cette application.\n  Crée d'abord un autre admin : nodefony security:user:add <id> --admin`, "ERROR");
 				process.exitCode = 1;
@@ -74,7 +74,7 @@ var SecurityUserDelete = class extends Command {
 		const w = (t) => {
 			process.stdout.write(t);
 		};
-		w(`\n${BOLD}Compte à supprimer${RESET}\n  identifiant : ${BOLD}${user.identifier}${RESET}\n  rôles       : ${(user.roles ?? []).join(", ") || "—"}\n  id interne  : ${DIM}${user.id}${RESET}\n\n`);
+		w(`\n${BOLD}Compte à supprimer${RESET}\n  identifiant : ${BOLD}${user.identifier}${RESET}\n  rôles       : ${user.roles.join(", ") || "—"}\n  id interne  : ${DIM}${user.id}${RESET}\n\n`);
 		if (!opts.yes) {
 			if (!process.stdin.isTTY) {
 				this.log("confirmation impossible sans terminal — relance avec --yes si c'est voulu.", "ERROR");

package/dist/nodefony/command/security-user-list.js

@@ -52,7 +52,7 @@ var SecurityUserList = class extends Command {
 		});
 		const rows = page.items.map((u) => ({
 			identifiant: u.identifier,
-			rôles: (u.roles ?? []).join(", ") || "—",
+			rôles: u.roles.join(", ") || "—",
 			actif: u.isActive() ? "oui" : "non",
 			verrouillé: u.isLocked() ? "OUI" : "—",
 			id: u.id

package/dist/nodefony/service/apiKeys.js

@@ -199,7 +199,7 @@ var ApiKeyService = class extends Service {
 	async revokeAnyPat(id, actorId) {
 		const store = this.#resolveStore();
 		const record = await store.findById(id);
-		if (!record || record.kind !== "pat") return null;
+		if (record?.kind !== "pat") return null;
 		await store.revoke(id, "manual");
 		this.log(`api key revoked by admin — id=${id} actor=${actorId} subject=${record.subjectId}`, "INFO");
 		recordAudit(this.container, {
@@ -240,7 +240,7 @@ var ApiKeyService = class extends Service {
 	async revokeForSubject(subjectId, id) {
 		const store = this.#resolveStore();
 		const record = await store.findById(id);
-		if (!record || record.kind !== "pat" || record.subjectId !== subjectId) return false;
+		if (record?.kind !== "pat" || record.subjectId !== subjectId) return false;
 		await store.revoke(id, "manual");
 		this.log(`api key revoked — id=${id} subject=${subjectId}`, "INFO");
 		recordAudit(this.container, {

package/dist/nodefony/service/auditService.js

@@ -108,14 +108,14 @@ var AuditService = class extends Service {
 			ts: Date.now()
 		};
 		this.#store.append(event).catch((error) => this.log(error, "ERROR"));
-		if (this.#listeners !== null) for (let i = 0; i < this.#listeners.length; i++) try {
-			this.#listeners[i](event);
+		if (this.#listeners !== null) for (const listener of this.#listeners) try {
+			listener(event);
 		} catch (error) {
 			this.log(error, "ERROR");
 		}
 	}
 	subscribe(listener) {
-		if (this.#listeners === null) this.#listeners = [];
+		this.#listeners ??= [];
 		this.#listeners.push(listener);
 		let active = true;
 		return () => {

package/dist/nodefony/service/authFlow.js

@@ -238,7 +238,7 @@ var AuthFlow = class extends Service {
 	*/
 	async logout(context) {
 		const session = context.session;
-		if (!session || session.status !== "active") return false;
+		if (session?.status !== "active") return false;
 		const actor = typeof session.user === "string" ? session.user : null;
 		await session.destroy(true);
 		context.session = null;
@@ -315,7 +315,7 @@ var AuthFlow = class extends Service {
 	#resolveTotp() {
 		if (!this.#totpResolved) {
 			const svc = this.get("totp") ?? null;
-			this.#totp = svc && svc.isEnabled() ? svc : null;
+			this.#totp = svc?.isEnabled() ? svc : null;
 			this.#totpResolved = true;
 		}
 		return this.#totp;

package/dist/nodefony/service/authorization.js

@@ -45,8 +45,7 @@ var Authorization = class extends Service {
 		const voters = this.#voters ?? this.#build();
 		let granted = false;
 		let considered = 0;
-		for (let i = 0; i < voters.length; i++) {
-			const voter = voters[i];
+		for (const voter of voters) {
 			if (!voter.supports(attribute, subject)) continue;
 			considered++;
 			let vote;
@@ -88,8 +87,8 @@ var Authorization = class extends Service {
 /** Descripteur léger d'un sujet pour l'audit (jamais de JSON.stringify aveugle). */
 function describeSubject(subject) {
 	if (typeof subject === "string") return subject;
-	if (subject === null) return "null";
-	return subject?.constructor?.name ?? typeof subject;
+	if (subject === null || subject === void 0) return String(subject);
+	return subject.constructor?.name ?? typeof subject;
 }
 //#endregion
 export { Authorization, Authorization as default };

package/dist/nodefony/service/firewall.js

@@ -47,6 +47,11 @@ function cookieValue(cookieHeader, name) {
 	}
 }
 /**
+* Défi posé sur un 401 quand aucun authenticator de la zone n'en déclare
+* (RFC 9110 §15.5.2). Schéma inconnu des navigateurs : aucune fenêtre de login.
+*/
+const FALLBACK_CHALLENGE = "Session realm=\"nodefony\"";
+/**
 * Orchestrateur de sécurité Nodefony — refonte 2026 (P6).
 *
 * `isSecure()` (hot-path, court-circuit si aucune zone) ne fait QUE matcher la
@@ -63,8 +68,9 @@ function cookieValue(cookieHeader, name) {
 * d'identité down, câblage manquant) → log ERROR serveur + 401 générique
 * (aucun détail ne fuite au client).
 *
-* Conformité : tout 401 porte un challenge `WWW-Authenticate` (RFC 7235) fourni
-* par le premier authenticator de la zone qui en déclare un.
+* Conformité : tout 401 porte un challenge `WWW-Authenticate` (RFC 9110
+* §15.5.2) — celui du premier authenticator de la zone qui en déclare un, sinon
+* le défi de repli {@link FALLBACK_CHALLENGE}.
 *
 * CORS, CSRF et autorisation par décorateurs viennent se brancher en S4/S5.
 * Toutes les structures sont **lazy** (perf : une app sans zone = zéro alloc).
@@ -109,10 +115,9 @@ var Firewall = class extends Service {
 		if (this.#config.cors.enabled) this.#cors = new Cors(this.#config.cors);
 		if (this.#config.headers.enabled) this.#securityHeaders = new SecurityHeaders(this.#config.headers);
 		const areas = this.#config.areas;
-		const names = Object.keys(areas);
-		if (names.length) {
+		if (Object.keys(areas).length) {
 			const list = [];
-			for (const name of names) list.push(new SecuredArea(name, areas[name]));
+			for (const [name, area] of Object.entries(areas)) list.push(new SecuredArea(name, area));
 			list.sort((a, b) => b.pattern.source.length - a.pattern.source.length);
 			this.#areas = list;
 			this.#instantiateAuthenticators(list);
@@ -333,7 +338,7 @@ var Firewall = class extends Service {
 	describeRoleHierarchy() {
 		const raw = this.#config?.roleHierarchy ?? {};
 		const hierarchy = {};
-		for (const role of Object.keys(raw)) hierarchy[role] = [...raw[role]];
+		for (const [role, inherited] of Object.entries(raw)) hierarchy[role] = [...inherited];
 		const walker = this.roleHierarchy;
 		return {
 			hierarchy,
@@ -565,7 +570,10 @@ var Firewall = class extends Service {
 		if (typeof response?.setHeader !== "function") return void 0;
 		const isPreflight = context.method?.toUpperCase() === "OPTIONS" && headerValue(headers, "access-control-request-method") !== void 0;
 		const corsHeaders = isPreflight ? this.#cors.preflightHeaders(origin) : this.#cors.actualHeaders(origin);
-		if (corsHeaders) for (const name in corsHeaders) response.setHeader(name, corsHeaders[name]);
+		if (corsHeaders) for (const name in corsHeaders) {
+			const value = corsHeaders[name];
+			if (value !== void 0) response.setHeader(name, value);
+		}
 		return isPreflight ? 204 : void 0;
 	}
 	/**
@@ -584,7 +592,10 @@ var Firewall = class extends Service {
 		const response = context.response;
 		if (typeof response?.setHeader !== "function") return;
 		const headers = sh.headers;
-		for (const name in headers) response.setHeader(name, headers[name]);
+		for (const name in headers) {
+			const value = headers[name];
+			if (value !== void 0) response.setHeader(name, value);
+		}
 		const extra = context.cspDirectives;
 		if (sh.hasNonce) {
 			const nonce = context.cspNonce;
@@ -665,7 +676,7 @@ var Firewall = class extends Service {
 					throw error;
 				}
 				if (error instanceof UnverifiableTokenError) {
-					this.log(`token unverifiable (area "${area.name}", authenticator "${name}") — ${error.detail ?? "cause non renseignée"}`, "ERROR");
+					this.log(`token unverifiable (area "${area.name}", authenticator "${name}") — ` + (error.detail ?? "cause non renseignée"), "ERROR");
 					this.log(error, "ERROR");
 					throw error;
 				}
@@ -689,6 +700,7 @@ var Firewall = class extends Service {
 				return;
 			}
 		}
+		response.setHeader("WWW-Authenticate", FALLBACK_CHALLENGE);
 	}
 	log(pci, severity, msgid, msg) {
 		if (!msgid) msgid = logColor.cyan("FIREWALL");

package/dist/nodefony/service/oauth2.js

@@ -135,7 +135,7 @@ var OAuth2Service = class extends Service {
 	listDisplayProviders() {
 		if (this.#config === null) return [];
 		const configured = this.#config.oauth2.providers;
-		return this.listProviders().filter((name) => configured[name]?.hidden !== true).map((name) => ({
+		return this.listProviders().filter((name) => !configured[name]?.hidden).map((name) => ({
 			name,
 			label: configured[name]?.label ?? oauthDisplayLabel(name)
 		}));
@@ -192,7 +192,7 @@ var OAuth2Service = class extends Service {
 			codeVerifier
 		});
 		const profile = await p.fetchProfile(tokens);
-		const cfg = this.#config.oauth2;
+		const cfg = this.#ensureReady().oauth2;
 		const defaultRoles = cfg.providers[provider]?.defaultRoles ?? cfg.defaultRoles;
 		return { identifier: (await this.#resolveProvisioner().provisionOAuthUser(profile, {
 			defaultRoles: [...defaultRoles],
@@ -210,7 +210,8 @@ var OAuth2Service = class extends Service {
 		return pending;
 	}
 	async #buildProvider(name) {
-		const cfg = this.#config.oauth2.providers[name];
+		const providers = this.#ensureReady().oauth2.providers;
+		const cfg = Object.hasOwn(providers, name) ? providers[name] : void 0;
 		if (!cfg) throw new AuthenticationError(`OAuth provider "${name}" non configuré`);
 		const factory = getOAuthProviderFactory(name);
 		if (!factory) throw new AuthenticationError(`OAuth provider "${name}" inconnu du registre`);
@@ -233,6 +234,7 @@ var OAuth2Service = class extends Service {
 	}
 	#ensureReady() {
 		if (!this.#ready || this.#config === null) throw new Error("OAuth2Service: non initialisé (social login désactivé ou boot échoué)");
+		return this.#config;
 	}
 };
 //#endregion

package/dist/nodefony/service/securityHeaders.js

@@ -39,7 +39,7 @@ var SecurityHeaders = class {
 		if (o.permissionsPolicy) h["Permissions-Policy"] = o.permissionsPolicy;
 		this.#headers = Object.freeze(h);
 		this.#cspParts = cspParts ? Object.freeze(cspParts) : null;
-		this.#cspRaw = o.csp ?? "";
+		this.#cspRaw = o.csp;
 	}
 	/** Table d'en-têtes applicatifs CONSTANTS (figée), posée telle quelle par le firewall. */
 	get headers() {

package/dist/nodefony/service/tokenService.js

@@ -1,7 +1,7 @@
 import { AuthenticationError } from "../errors/AuthenticationError.js";
 import { ThrottledError } from "../errors/ThrottledError.js";
 import { defineSecurityConfig } from "../config/defineModuleConfig.js";
-import { resolveJwtRuntime } from "../src/token/jwtRuntime.js";
+import { defaultAudience, resolveJwtRuntime } from "../src/token/jwtRuntime.js";
 import { recordAudit } from "../src/audit/recordAudit.js";
 import { InvalidTargetError } from "../errors/InvalidTargetError.js";
 import { getTokenStoreFactory, listTokenStores } from "../src/token/tokenStoreRegistry.js";
@@ -250,8 +250,8 @@ var TokenService = class extends Service {
 	* @throws InvalidTargetError (400) si la ressource est multiple, malformée ou
 	*         non déclarée
 	*/
-	#resolveAudience(requested) {
-		const fallback = this.#runtime.audiences[0];
+	#resolveAudience(runtime, requested) {
+		const fallback = defaultAudience(runtime);
 		if (requested === void 0 || requested === null) return fallback;
 		if (Array.isArray(requested)) throw new InvalidTargetError("A single `resource` is accepted — a token valid at several resources lets each of them act at the others (RFC 8707 §3).");
 		if (typeof requested !== "string" || requested.length === 0) throw new InvalidTargetError("`resource` must be an absolute URI.");
@@ -262,7 +262,7 @@ var TokenService = class extends Service {
 			throw new InvalidTargetError("`resource` must be an absolute URI (RFC 8707 §2).", requested);
 		}
 		if (url.hash) throw new InvalidTargetError("`resource` must not include a fragment (RFC 8707 §2).", requested);
-		if (!this.#runtime.audiences.includes(requested)) throw new InvalidTargetError("The requested resource is not available to this application.", requested);
+		if (!runtime.audiences.includes(requested)) throw new InvalidTargetError("The requested resource is not available to this application.", requested);
 		return requested;
 	}
 	/**
@@ -304,12 +304,12 @@ var TokenService = class extends Service {
 		return requested.filter((scope) => !refuses.includes(scope));
 	}
 	async issueTokens(user, requestedScopes, resource, accessTtlS) {
-		this.#ensureReady();
+		const { store, runtime } = this.#ensureReady();
 		const scopes = this.#grantableScopes(user, requestedScopes && requestedScopes.length > 0 ? [...requestedScopes] : []);
-		const audience = this.#resolveAudience(resource);
+		const audience = this.#resolveAudience(runtime, resource);
 		const access = await this.#signAccess(user.identifier, scopes, audience, accessTtlS);
 		const { record, raw } = this.#buildRefresh(user.identifier, scopes, this.#randomId(), audience);
-		await this.#store.put(record);
+		await store.put(record);
 		recordAudit(this.container, {
 			category: "token",
 			action: "token.issued",
@@ -324,7 +324,7 @@ var TokenService = class extends Service {
 			access_token: access,
 			refresh_token: raw,
 			token_type: "Bearer",
-			expires_in: accessTtlS ?? this.#runtime.accessTtlS,
+			expires_in: accessTtlS ?? runtime.accessTtlS,
 			scope: scopes.join(" ")
 		};
 	}
@@ -345,11 +345,10 @@ var TokenService = class extends Service {
 	* @throws InvalidTargetError (400) — `resource` demandée ≠ celle accordée
 	*/
 	async refresh(rawRefresh, resource) {
-		this.#ensureReady();
+		const { store, runtime } = this.#ensureReady();
 		if (typeof rawRefresh !== "string" || rawRefresh.length === 0) throw new AuthenticationError("Invalid token");
-		const store = this.#store;
 		const record = await store.findByHash(this.#hash(rawRefresh));
-		if (!record || record.kind !== "refresh") throw new AuthenticationError("Invalid token");
+		if (record?.kind !== "refresh") throw new AuthenticationError("Invalid token");
 		if (record.revokedAt !== null) {
 			if (record.family) await store.revokeFamily(record.family, "reuse_detected");
 			recordAudit(this.container, {
@@ -369,14 +368,14 @@ var TokenService = class extends Service {
 		if (record.expiresAt !== null && record.expiresAt <= now) throw new AuthenticationError("Invalid token");
 		const user = await this.#resolveUserForRefresh(record.subjectId);
 		const scopes = [...record.scopes];
-		const audience = record.audience?.[0] ?? this.#runtime.audiences[0];
+		const audience = record.audience?.at(0) ?? defaultAudience(runtime);
 		if (resource !== void 0 && resource !== null && resource !== audience) throw new InvalidTargetError("The requested resource does not match the one granted to this token (RFC 8707 §2.2).", typeof resource === "string" ? resource : void 0);
 		const access = await this.#signAccess(user.identifier, scopes, audience);
-		if (!this.#runtime.rotateRefresh) return {
+		if (!runtime.rotateRefresh) return {
 			access_token: access,
 			refresh_token: rawRefresh,
 			token_type: "Bearer",
-			expires_in: this.#runtime.accessTtlS,
+			expires_in: runtime.accessTtlS,
 			scope: scopes.join(" ")
 		};
 		const family = record.family ?? this.#randomId();
@@ -390,14 +389,14 @@ var TokenService = class extends Service {
 			access_token: access,
 			refresh_token: next.raw,
 			token_type: "Bearer",
-			expires_in: this.#runtime.accessTtlS,
+			expires_in: runtime.accessTtlS,
 			scope: scopes.join(" ")
 		};
 	}
 	async #signAccess(subject, scopes, audience, ttlS) {
+		const { keystore, runtime: rt } = this.#ensureReady();
 		const jose = await this.#ensureJose();
-		const { key, kid } = await this.#keystore.getSigningKey();
-		const rt = this.#runtime;
+		const { key, kid } = await keystore.getSigningKey();
 		return new jose.SignJWT({ scope: scopes.join(" ") }).setProtectedHeader({
 			alg: "EdDSA",
 			kid,
@@ -434,7 +433,7 @@ var TokenService = class extends Service {
 				family,
 				replacedBy: null,
 				createdAt: now,
-				expiresAt: now + this.#runtime.refreshTtlS * 1e3,
+				expiresAt: now + this.#ensureReady().runtime.refreshTtlS * 1e3,
 				lastUsedAt: null,
 				lastUsedIp: null,
 				lastUsedUserAgent: null,
@@ -445,8 +444,18 @@ var TokenService = class extends Service {
 			raw
 		};
 	}
+	/**
+	* Garde d'initialisation : lève si le service n'est pas prêt, sinon rend le
+	* store, le keystore et le runtime typés non nuls. Aucun des trois n'est
+	* réassigné après le boot — les capturer équivaut à les relire plus tard.
+	*/
 	#ensureReady() {
 		if (!this.#store || !this.#keystore || !this.#runtime) throw new Error("TokenService: non initialisé (JWT désactivé ou store indisponible)");
+		return {
+			store: this.#store,
+			keystore: this.#keystore,
+			runtime: this.#runtime
+		};
 	}
 	async #ensureJose() {
 		return this.#jose ??= await import("jose");

package/dist/nodefony/service/webAuthn.js

@@ -135,10 +135,10 @@ var WebAuthnService = class extends Service {
 	* pour empêcher un double enregistrement sur le même authenticator (§7.1).
 	*/
 	async generateRegistrationOptions(user) {
-		this.#ensureReady();
+		const { store, config } = this.#ensureReady();
 		const lib = await this.#ensureLib();
-		const pk = this.#config.passkeys;
-		const existing = await this.#store.findByUser(user.id);
+		const pk = config.passkeys;
+		const existing = await store.findByUser(user.id);
 		return lib.generateRegistrationOptions({
 			rpName: this.#rpName,
 			rpID: this.#rpID,
@@ -169,23 +169,23 @@ var WebAuthnService = class extends Service {
 	* @throws WebAuthnError (409) — plafond `passkeys.maxPerUser` atteint.
 	*/
 	async verifyRegistration(response, expectedChallenge, userId, requestOrigin) {
-		this.#ensureReady();
+		const { store, config } = this.#ensureReady();
 		const lib = await this.#ensureLib();
-		const pk = this.#config.passkeys;
+		const pk = config.passkeys;
 		let verification;
 		try {
 			verification = await lib.verifyRegistrationResponse({
 				response,
 				expectedChallenge,
-				expectedOrigin: this.#expectedOrigin(requestOrigin),
+				expectedOrigin: this.#expectedOrigin(pk.origins, requestOrigin),
 				expectedRPID: this.#rpID,
 				requireUserVerification: pk.userVerification === "required"
 			});
 		} catch {
 			throw new AuthenticationError("WebAuthn registration failed");
 		}
-		if (!verification.verified || !verification.registrationInfo) throw new AuthenticationError("WebAuthn registration failed");
-		if (await this.#store.countByUser(userId) >= pk.maxPerUser) throw new WebAuthnError(`passkey limit reached (${pk.maxPerUser})`, 409);
+		if (!verification.verified) throw new AuthenticationError("WebAuthn registration failed");
+		if (await store.countByUser(userId) >= pk.maxPerUser) throw new WebAuthnError(`passkey limit reached (${pk.maxPerUser})`, 409);
 		const info = verification.registrationInfo;
 		const credential = {
 			id: info.credential.id,
@@ -199,7 +199,7 @@ var WebAuthnService = class extends Service {
 			createdAt: Date.now(),
 			lastUsedAt: null
 		};
-		await this.#store.save(credential);
+		await store.save(credential);
 		return credential;
 	}
 	/**
@@ -216,17 +216,17 @@ var WebAuthnService = class extends Service {
 	*   `WebAuthnController.loginOptions()` ne cible que depuis la session.
 	*/
 	async generateAuthenticationOptions(userId) {
-		this.#ensureReady();
+		const { store, config } = this.#ensureReady();
 		const lib = await this.#ensureLib();
-		const pk = this.#config.passkeys;
+		const pk = config.passkeys;
 		let allowCredentials;
-		if (userId) allowCredentials = (await this.#store.findByUser(userId)).map((c) => ({
+		if (userId) allowCredentials = (await store.findByUser(userId)).map((c) => ({
 			id: c.id,
 			transports: [...c.transports]
 		}));
 		return lib.generateAuthenticationOptions({
 			rpID: this.#rpID,
-			allowCredentials,
+			...allowCredentials !== void 0 && { allowCredentials },
 			userVerification: pk.userVerification,
 			timeout: pk.timeoutMs
 		});
@@ -240,17 +240,17 @@ var WebAuthnService = class extends Service {
 	* @throws AuthenticationError (401) — credential inconnu ou vérification échouée.
 	*/
 	async verifyAuthentication(response, expectedChallenge, requestOrigin) {
-		this.#ensureReady();
+		const { store, config } = this.#ensureReady();
 		const lib = await this.#ensureLib();
-		const pk = this.#config.passkeys;
-		const stored = await this.#store.findById(response.id);
+		const pk = config.passkeys;
+		const stored = await store.findById(response.id);
 		if (!stored) throw new AuthenticationError("WebAuthn authentication failed");
 		let verification;
 		try {
 			verification = await lib.verifyAuthenticationResponse({
 				response,
 				expectedChallenge,
-				expectedOrigin: this.#expectedOrigin(requestOrigin),
+				expectedOrigin: this.#expectedOrigin(pk.origins, requestOrigin),
 				expectedRPID: this.#rpID,
 				credential: {
 					id: stored.id,
@@ -265,7 +265,7 @@ var WebAuthnService = class extends Service {
 		}
 		if (!verification.verified) throw new AuthenticationError("WebAuthn authentication failed");
 		const info = verification.authenticationInfo;
-		await this.#store.update(stored.id, {
+		await store.update(stored.id, {
 			signCount: info.newCounter,
 			backupState: info.credentialBackedUp,
 			uvInitialized: stored.uvInitialized || info.userVerified,
@@ -278,8 +278,7 @@ var WebAuthnService = class extends Service {
 	}
 	/** Liste les credentials d'un utilisateur (UX « mes appareils »). */
 	listUserCredentials(userId) {
-		this.#ensureReady();
-		return this.#store.findByUser(userId);
+		return this.#ensureReady().store.findByUser(userId);
 	}
 	/**
 	* Page de passkeys pour le data plane admin (vue TRANSVERSE : « quels appareils
@@ -290,21 +289,18 @@ var WebAuthnService = class extends Service {
 	* du store exclut la clé publique.
 	*/
 	listCredentialsPage(query) {
-		this.#ensureReady();
-		return this.#store.listPage(query);
+		return this.#ensureReady().store.listPage(query);
 	}
 	/**
 	* Nombre de passkeys correspondant aux filtres, ou `-1` si le backend ne sait
 	* pas compter à coût raisonnable (Redis).
 	*/
 	countCredentials(query) {
-		this.#ensureReady();
-		return this.#store.countCredentials(query);
+		return this.#ensureReady().store.countCredentials(query);
 	}
 	/** Révoque un credential (retrait d'un appareil). */
 	removeCredential(credentialId) {
-		this.#ensureReady();
-		return this.#store.delete(credentialId);
+		return this.#ensureReady().store.delete(credentialId);
 	}
 	/**
 	* Supprime un credential **du propriétaire** (self-service, anti-IDOR) : la
@@ -313,10 +309,10 @@ var WebAuthnService = class extends Service {
 	* credential d'autrui).
 	*/
 	async removeUserCredential(userId, credentialId) {
-		this.#ensureReady();
-		const cred = await this.#store.findById(credentialId);
+		const { store } = this.#ensureReady();
+		const cred = await store.findById(credentialId);
 		if (!cred || cred.userId !== userId) return false;
-		await this.#store.delete(credentialId);
+		await store.delete(credentialId);
 		return true;
 	}
 	/**
@@ -324,9 +320,11 @@ var WebAuthnService = class extends Service {
 	* priorité (prod). À défaut : l'origine de la requête est acceptée **seulement
 	* si son hostname == rpID** (dev : `localhost:port` quel que soit le port, sans
 	* jamais ouvrir à un domaine tiers). Dernier recours : `https://{rpID}`.
+	*
+	* @param origins - liste blanche `passkeys.origins` de la config prête.
+	* @param requestOrigin - origine HTTP de la requête, si connue.
 	*/
-	#expectedOrigin(requestOrigin) {
-		const origins = this.#config.passkeys.origins;
+	#expectedOrigin(origins, requestOrigin) {
 		if (origins.length > 0) return [...origins];
 		if (requestOrigin) try {
 			if (new URL(requestOrigin).hostname === this.#rpID) return requestOrigin;
@@ -336,8 +334,17 @@ var WebAuthnService = class extends Service {
 	async #ensureLib() {
 		return this.#lib ??= await import("@simplewebauthn/server");
 	}
+	/**
+	* Garde d'initialisation : lève si le service n'est pas prêt, sinon rend le
+	* store et la config typés non nuls (ni l'un ni l'autre ne sont réassignés
+	* après le boot — les capturer ici équivaut à les relire plus tard).
+	*/
 	#ensureReady() {
 		if (!this.#ready || !this.#store || !this.#config) throw new Error("WebAuthnService: non initialisé (passkeys désactivés ou boot échoué)");
+		return {
+			store: this.#store,
+			config: this.#config
+		};
 	}
 };
 //#endregion