@nodefony/security 10.0.0-alpha.9 → 10.0.0-beta.1

package/dist/nodefony/service/webhooks.js

@@ -104,7 +104,7 @@ var WebhookService = class extends Service {
 			return;
 		}
 		this.#audit = audit;
-		this.#dispatcher = new WebhookDispatcher({
+		const dispatcher = new WebhookDispatcher({
 			endpointCount: () => this.endpointCount(),
 			getSnapshot: () => this.getSnapshot(),
 			secretOf: (ep) => this.decryptEndpointSecret(ep).toString("utf8"),
@@ -122,7 +122,8 @@ var WebhookService = class extends Service {
 			},
 			log: (m) => this.log(m, "ERROR")
 		});
-		this.#unsubscribe = audit.subscribe((e) => this.#dispatcher.onAuditEvent(e));
+		this.#dispatcher = dispatcher;
+		this.#unsubscribe = audit.subscribe((e) => dispatcher.onAuditEvent(e));
 		this.log("webhooks dispatcher abonné à l'audit", "DEBUG");
 	}
 	/** Arrêt propre : désabonnement audit + annulation des retries en vol. */
@@ -262,14 +263,14 @@ var WebhookService = class extends Service {
 	* @throws SsrfError si l'URL est invalide / cible non publique.
 	*/
 	async register(input) {
-		this.#assertReady();
-		await this.#assertSafeUrl(input.url);
+		const { store, key, config } = this.#assertReady();
+		await this.#assertSafeUrl(config, input.url);
 		const secret = generateSecret();
 		const now = Date.now();
 		const endpoint = {
 			id: generateId(),
 			url: input.url,
-			secretEnc: encryptSecret(Buffer.from(secret, "utf8"), this.#key),
+			secretEnc: encryptSecret(Buffer.from(secret, "utf8"), key),
 			events: [...input.events],
 			enabled: input.enabled ?? true,
 			description: input.description ?? null,
@@ -283,7 +284,7 @@ var WebhookService = class extends Service {
 			failureCount: 0,
 			metadata: input.metadata ?? {}
 		};
-		await this.#store.save(endpoint);
+		await store.save(endpoint);
 		this.#endpoints?.set(endpoint.id, endpoint);
 		return {
 			endpoint: toSummary(endpoint),
@@ -298,8 +299,7 @@ var WebhookService = class extends Service {
 	* @returns la page, chaque endpoint réduit à sa vue publique.
 	*/
 	async listPage(query) {
-		this.#assertReady();
-		const page = await this.#store.listPage(query);
+		const page = await this.#assertReady().store.listPage(query);
 		return {
 			...page,
 			items: page.items.map(toSummary)
@@ -312,8 +312,7 @@ var WebhookService = class extends Service {
 	* @returns le compte exact, ou `-1` si le backend ne sait pas compter.
 	*/
 	async countEndpoints(query) {
-		this.#assertReady();
-		return this.#store.countEndpoints(query);
+		return this.#assertReady().store.countEndpoints(query);
 	}
 	/**
 	* Les compteurs de tête de la console — posés sur la collection ENTIÈRE, pas
@@ -326,16 +325,15 @@ var WebhookService = class extends Service {
 	* @param query - filtres à appliquer avant comptage (sans fenêtre).
 	*/
 	async countWebhookFacets(query) {
-		this.#assertReady();
-		return countFacets(WEBHOOK_FACETS, (facet) => this.#store.countEndpoints({
+		const { store } = this.#assertReady();
+		return countFacets(WEBHOOK_FACETS, (facet) => store.countEndpoints({
 			...query,
 			...facet
 		}));
 	}
 	/** Un endpoint par id (vue publique), ou `null`. */
 	async getEndpoint(id) {
-		this.#assertReady();
-		const found = await this.#store.findById(id);
+		const found = await this.#assertReady().store.findById(id);
 		return found ? toSummary(found) : null;
 	}
 	/**
@@ -344,15 +342,15 @@ var WebhookService = class extends Service {
 	* ou `null` si absent.
 	*/
 	async update(id, patch) {
-		this.#assertReady();
-		const current = await this.#store.findById(id);
+		const { store, config } = this.#assertReady();
+		const current = await store.findById(id);
 		if (!current) return null;
-		if (patch.url !== void 0 && patch.url !== current.url) await this.#assertSafeUrl(patch.url);
+		if (patch.url !== void 0 && patch.url !== current.url) await this.#assertSafeUrl(config, patch.url);
 		const applied = {
 			...patch,
 			updatedAt: Date.now()
 		};
-		await this.#store.update(id, applied);
+		await store.update(id, applied);
 		const next = {
 			...current,
 			...applied
@@ -369,15 +367,15 @@ var WebhookService = class extends Service {
 	* L'ancien cesse immédiatement d'être valide. `null` si l'endpoint est absent.
 	*/
 	async rotateSecret(id) {
-		this.#assertReady();
-		const current = await this.#store.findById(id);
+		const { store, key } = this.#assertReady();
+		const current = await store.findById(id);
 		if (!current) return null;
 		const secret = generateSecret();
 		const patch = {
-			secretEnc: encryptSecret(Buffer.from(secret, "utf8"), this.#key),
+			secretEnc: encryptSecret(Buffer.from(secret, "utf8"), key),
 			updatedAt: Date.now()
 		};
-		await this.#store.update(id, patch);
+		await store.update(id, patch);
 		const next = {
 			...current,
 			...patch
@@ -393,16 +391,16 @@ var WebhookService = class extends Service {
 	* par l'appelant). `null` si absent.
 	*/
 	async revealSecret(id) {
-		this.#assertReady();
-		const current = await this.#store.findById(id);
+		const { store, key } = this.#assertReady();
+		const current = await store.findById(id);
 		if (!current) return null;
-		return decryptSecret(current.secretEnc, this.#key).toString("utf8");
+		return decryptSecret(current.secretEnc, key).toString("utf8");
 	}
 	/** Supprime un endpoint. Retourne `false` si absent. */
 	async delete(id) {
-		this.#assertReady();
-		if (!await this.#store.findById(id)) return false;
-		await this.#store.delete(id);
+		const { store } = this.#assertReady();
+		if (!await store.findById(id)) return false;
+		await store.delete(id);
 		this.#endpoints?.delete(id);
 		this.#deliveries?.delete(id);
 		return true;
@@ -422,7 +420,7 @@ var WebhookService = class extends Service {
 	* sur l'issue FINALE d'une livraison.
 	*/
 	#recordDelivery(id, rec) {
-		if (this.#deliveries === null) this.#deliveries = /* @__PURE__ */ new Map();
+		this.#deliveries ??= /* @__PURE__ */ new Map();
 		let ring = this.#deliveries.get(id);
 		if (ring === void 0) {
 			ring = [];
@@ -461,13 +459,11 @@ var WebhookService = class extends Service {
 	}
 	/** Déchiffre le secret de signature d'un endpoint (pour signer une livraison). */
 	decryptEndpointSecret(endpoint) {
-		this.#assertReady();
-		return decryptSecret(endpoint.secretEnc, this.#key);
+		return decryptSecret(endpoint.secretEnc, this.#assertReady().key);
 	}
 	/** Politique de livraison (tolérance/retries/timeout…) issue de la config. */
 	getDeliveryPolicy() {
-		this.#assertReady();
-		const w = this.#config.webhooks;
+		const w = this.#assertReady().config.webhooks;
 		return {
 			timestampToleranceS: w.timestampToleranceS,
 			maxRetries: w.maxRetries,
@@ -485,12 +481,14 @@ var WebhookService = class extends Service {
 	* l'endpoint au-delà du seuil (façon GitHub). Le succès remet le compteur à 0.
 	*/
 	async markDelivery(id, result) {
-		if (!this.#ready || !this.#store) return;
-		const current = await this.#store.findById(id);
+		const config = this.#config;
+		const store = this.#store;
+		if (!this.#ready || !store || !config) return;
+		const current = await store.findById(id);
 		if (!current) return;
 		const failureCount = result.ok ? 0 : current.failureCount + 1;
 		const now = Date.now();
-		const threshold = this.#config.webhooks.autoDisableThreshold;
+		const threshold = config.webhooks.autoDisableThreshold;
 		const disable = !result.ok && threshold > 0 && failureCount >= threshold;
 		const patch = {
 			lastDeliveryAt: now,
@@ -511,17 +509,28 @@ var WebhookService = class extends Service {
 				reason: "max_failures"
 			});
 		}
-		await this.#store.update(id, patch);
+		await store.update(id, patch);
 		this.#endpoints?.set(id, {
 			...current,
 			...patch
 		});
 	}
+	/**
+	* Garde d'initialisation : lève si le service n'est pas prêt, sinon rend le
+	* store, la clé de chiffrement et la config typés non nuls. Les quatre champs
+	* sont posés ensemble au boot et jamais réassignés — tester aussi `#config`
+	* ne change donc rien au verdict.
+	*/
 	#assertReady() {
-		if (!this.#ready || !this.#store || !this.#key) throw new Error("webhooks indisponibles (désactivés ou mal configurés)");
+		if (!this.#ready || !this.#store || !this.#key || !this.#config) throw new Error("webhooks indisponibles (désactivés ou mal configurés)");
+		return {
+			store: this.#store,
+			key: this.#key,
+			config: this.#config
+		};
 	}
-	async #assertSafeUrl(url) {
-		const w = this.#config.webhooks;
+	async #assertSafeUrl(config, url) {
+		const w = config.webhooks;
 		await assertPublicUrl(url, {
 			allowPrivate: !w.denyPrivateIps,
 			allowHttp: w.allowHttp
@@ -529,7 +538,7 @@ var WebhookService = class extends Service {
 	}
 	/** Re-contrôle SSRF avant livraison → IP validées à pinner (anti-rebinding). */
 	async #resolveTarget(url) {
-		const w = this.#config.webhooks;
+		const w = this.#assertReady().config.webhooks;
 		const { addresses } = await assertPublicUrl(url, {
 			allowPrivate: !w.denyPrivateIps,
 			allowHttp: w.allowHttp

package/dist/nodefony/src/admin/SecurityAdminApi.js

@@ -21,6 +21,7 @@ function tokenStoreDriver(className) {
 		case "DrizzleTokenStore":
 		case "MongooseTokenStore": return "orm";
 		case "RedisTokenStore": return "redis";
+		case void 0:
 		default: return null;
 	}
 }
@@ -65,7 +66,7 @@ function parseTokenListQuery(query, sortable) {
 function one(query, key) {
 	const value = query[key];
 	if (value === void 0) return void 0;
-	return Array.isArray(value) ? value[0] : value;
+	return Array.isArray(value) ? value.at(0) : value;
 }
 /** Taille de page du journal d'audit quand l'appelant n'en demande pas. */
 const AUDIT_DEFAULT_LIMIT = 100;

package/dist/nodefony/src/admin/WebhookAdminApi.js

@@ -17,6 +17,7 @@ function webhookStoreDriver(className) {
 		case "MemoryWebhookStore": return "memory";
 		case "DrizzleWebhookStore":
 		case "MongooseWebhookStore": return "orm";
+		case void 0:
 		default: return null;
 	}
 }

package/dist/nodefony/src/admin/userRevocationCascade.js

@@ -19,7 +19,7 @@ async function cascadeUserRevocation(container, event, now = Date.now()) {
 		await container.get("sessions")?.destroyByUser?.(identifier);
 	} catch {}
 	try {
-		await container.get("tokenStore")?.revokeAllForSubject?.(identifier, now);
+		await container.get("tokenStore")?.revokeAllForSubject(identifier, now);
 	} catch {}
 }
 /**

package/dist/nodefony/src/apikey/apiKeyFormat.js

@@ -41,7 +41,7 @@ const CRC_TABLE = (() => {
 /** CRC32 (IEEE) d'une chaîne ASCII — entier non signé 32 bits. */
 function crc32(input) {
 	let crc = 4294967295;
-	for (let i = 0; i < input.length; i++) crc = CRC_TABLE[(crc ^ input.charCodeAt(i)) & 255] ^ crc >>> 8;
+	for (let i = 0; i < input.length; i++) crc = (CRC_TABLE[(crc ^ input.charCodeAt(i)) & 255] ?? 0) ^ crc >>> 8;
 	return (crc ^ 4294967295) >>> 0;
 }
 /** Chunk de checksum (6 car. base64url) du payload `prefix_pubid_secret`. */

package/dist/nodefony/src/audit/MemoryAuditStore.js

@@ -1,7 +1,6 @@
 import { assertPageQuery } from "nodefony";
 //#region nodefony/src/audit/MemoryAuditStore.ts
 const DEFAULT_MAX_ENTRIES = 1e4;
-const DEFAULT_LIMIT = 100;
 const MAX_LIMIT = 500;
 /**
 * Sépare les deux composantes du curseur. Le curseur est **composite**
@@ -44,12 +43,9 @@ var MemoryAuditStore = class {
 	}
 	listPage(query) {
 		assertPageQuery(query, "cursor");
-		const limit = Math.min(Math.max(1, query.limit ?? DEFAULT_LIMIT), MAX_LIMIT);
+		const limit = Math.min(Math.max(1, query.limit), MAX_LIMIT);
 		const matched = [];
-		for (let i = 0; i < this.#events.length; i++) {
-			const event = this.#events[i];
-			if (this.#matches(event, query)) matched.push(event);
-		}
+		for (const event of this.#events) if (this.#matches(event, query)) matched.push(event);
 		const total = matched.length;
 		matched.sort((a, b) => a.ts !== b.ts ? b.ts - a.ts : a.id < b.id ? 1 : -1);
 		let page = matched;
@@ -60,7 +56,7 @@ var MemoryAuditStore = class {
 		}
 		const hasNext = page.length > limit;
 		const items = hasNext ? page.slice(0, limit) : page;
-		const last = items[items.length - 1];
+		const last = items.at(-1);
 		return Promise.resolve({
 			items,
 			limit,
@@ -87,7 +83,7 @@ var MemoryAuditStore = class {
 	gc(now = this.#now()) {
 		const threshold = now - this.#retentionMs;
 		let purged = 0;
-		while (this.#events.length > 0 && this.#events[0].ts < threshold) {
+		while ((this.#events[0]?.ts ?? threshold) < threshold) {
 			this.#events.shift();
 			purged++;
 		}

package/dist/nodefony/src/audit/auditBridge.js

@@ -39,11 +39,15 @@ function createAuditBridge(source, publish, channel, opts = {}) {
 	let timer = null;
 	const flush = () => {
 		timer = null;
-		if (count === 0 && dropped === 0) return;
-		const events = new Array(count);
-		for (let i = 0; i < count; i++) events[i] = ring[(head + i) % maxBatch];
+		const buf = ring;
+		if (buf === null || count === 0 && dropped === 0) return;
+		const events = [];
+		for (let i = 0; i < count; i++) {
+			const event = buf[(head + i) % maxBatch];
+			if (event !== void 0) events.push(event);
+		}
 		const d = dropped;
-		for (let i = 0; i < maxBatch; i++) ring[i] = void 0;
+		for (let i = 0; i < maxBatch; i++) buf[i] = void 0;
 		head = 0;
 		count = 0;
 		dropped = 0;
@@ -53,7 +57,7 @@ function createAuditBridge(source, publish, channel, opts = {}) {
 		});
 	};
 	const onEvent = (event) => {
-		if (ring === null) ring = new Array(maxBatch);
+		ring ??= new Array(maxBatch);
 		if (count === maxBatch) {
 			ring[head] = event;
 			head = (head + 1) % maxBatch;

package/dist/nodefony/src/authenticator/ApiKeyAuthenticator.js

@@ -50,14 +50,14 @@ var ApiKeyAuthenticator = class {
 	}
 	/** La requête porte-t-elle un `Authorization: Bearer <prefix>_…` ? (test bon marché) */
 	supports(context) {
-		const auth = context.request?.headers?.authorization;
+		const auth = context.request?.headers.authorization;
 		if (typeof auth !== "string") return false;
 		const token = bearerToken(auth);
 		return token !== null && looksLikeApiKey(token, this.#prefix);
 	}
 	/** Extrait la valeur brute (non vérifiée) → portée par un `UserToken` type `"apikey"`. */
 	createToken(context) {
-		const auth = context.request?.headers?.authorization;
+		const auth = context.request?.headers.authorization;
 		return Promise.resolve(new UserToken("apikey", bearerToken(auth) ?? ""));
 	}
 	/**
@@ -77,7 +77,7 @@ var ApiKeyAuthenticator = class {
 		const store = this.#resolveStore();
 		const record = await store.findByHash(parsed.secretHash);
 		const now = Date.now();
-		if (!record || record.kind !== "pat" || record.revokedAt !== null || record.expiresAt !== null && record.expiresAt <= now) throw new AuthenticationError(INVALID_TOKEN);
+		if (record?.kind !== "pat" || record.revokedAt !== null || record.expiresAt !== null && record.expiresAt <= now) throw new AuthenticationError(INVALID_TOKEN);
 		const invalidBefore = await store.getInvalidBefore(record.subjectId);
 		if (invalidBefore !== null && record.createdAt < invalidBefore) throw new AuthenticationError(INVALID_TOKEN);
 		const user = await this.#resolveUserOrReject(record.subjectId);

package/dist/nodefony/src/authenticator/ExternalJwtAuthenticator.js

@@ -83,7 +83,7 @@ var ExternalJwtAuthenticator = class {
 	* un jeton d'un émetteur inconnu n'a pas à provoquer le moindre travail.
 	*/
 	supports(context) {
-		const auth = context.request?.headers?.authorization;
+		const auth = context.request?.headers.authorization;
 		if (typeof auth !== "string") return false;
 		const raw = bearerToken(auth);
 		if (raw === null) return false;
@@ -104,7 +104,7 @@ var ExternalJwtAuthenticator = class {
 	* visée.
 	*/
 	createToken(context) {
-		const auth = context.request?.headers?.authorization;
+		const auth = context.request?.headers.authorization;
 		const token = new UserToken("external-jwt", bearerToken(auth) ?? "");
 		const area = context.security;
 		if (area?.resource) token.setAttribute(AUDIENCE, area.resource);

package/dist/nodefony/src/authenticator/FirewallRealtimeAuthenticator.js

@@ -100,7 +100,7 @@ var FirewallRealtimeAuthenticator = class {
 		const jti = issued.getAttribute("jti") ?? (typeof claims.jti === "string" ? claims.jti : null);
 		const resolveStore = this.#resolveStore;
 		if (expMs === null && (resolveStore === null || jti === null && iatMs === null)) {
-			Nodefony.getKernel()?.log?.(`Realtime ${type} token "${identifier}" carries neither an expiry nor any revocation handle ("jti"/"iat") — connection will be revoked (fail-closed). Ensure the authenticator forwards the token claims.`, "WARNING");
+			Nodefony.getKernel()?.log(`Realtime ${type} token "${identifier}" carries neither an expiry nor any revocation handle ("jti"/"iat") — connection will be revoked (fail-closed). Ensure the authenticator forwards the token claims.`, "WARNING");
 			return () => Promise.resolve(false);
 		}
 		return async (nowMs = Date.now()) => {
@@ -149,7 +149,7 @@ function buildSessionRevalidator(identifier) {
 	const id = session?.id;
 	const storage = session?.storage;
 	if (typeof id !== "string" || !storage || typeof storage.read !== "function") {
-		Nodefony.getKernel()?.log?.(`Realtime session token "${identifier}" has no revalidatable session at handshake — connection will be revoked (fail-closed). Ensure the realtime zone runs after startSession.`, "WARNING");
+		Nodefony.getKernel()?.log(`Realtime session token "${identifier}" has no revalidatable session at handshake — connection will be revoked (fail-closed). Ensure the realtime zone runs after startSession.`, "WARNING");
 		return () => Promise.resolve(false);
 	}
 	return async () => {

package/dist/nodefony/src/authenticator/JwtAuthenticator.js

@@ -58,7 +58,7 @@ var JwtAuthenticator = class {
 	* qu'un credential qui disparaîtrait sans laisser de trace.
 	*/
 	supports(context) {
-		const auth = context.request?.headers?.authorization;
+		const auth = context.request?.headers.authorization;
 		if (typeof auth !== "string") return false;
 		const token = bearerToken(auth);
 		if (token === null || !COMPACT_JWS.test(token)) return false;
@@ -67,7 +67,7 @@ var JwtAuthenticator = class {
 	}
 	/** Extrait le token brut (non vérifié) → porté par un `UserToken` type `"jwt"`. */
 	createToken(context) {
-		const auth = context.request?.headers?.authorization;
+		const auth = context.request?.headers.authorization;
 		return Promise.resolve(new UserToken("jwt", bearerToken(auth) ?? ""));
 	}
 	/**

package/dist/nodefony/src/authenticator/SessionAuthenticator.js

@@ -13,9 +13,11 @@ import { UserToken } from "../token/UserToken.js";
 * démarre jamais rien lui-même. L'identité est re-résolue à CHAQUE requête
 * via {@link resolveSessionIdentity} (rôles frais, révocation immédiate).
 *
-* Pas de `challenge()` : une session absente/expirée donne un 401 nu — le
-* client web redirige vers son écran de login, jamais de popup Basic. Si la
-* zone liste aussi `userpassword`, le firewall pose SON challenge (RFC 7235).
+* Pas de `challenge()` : sur une zone à session seule, le firewall pose son
+* défi de repli `Session realm="nodefony"` (RFC 9110 §15.5.2 : tout 401 en
+* porte un) — schéma inconnu des navigateurs, donc jamais de popup Basic ; le
+* client web redirige vers son écran de login. Si la zone liste aussi
+* `userpassword`, le firewall pose SON challenge.
 */
 var SessionAuthenticator = class {
 	name = "session";

package/dist/nodefony/src/authenticator/UserPasswordAuthenticator.js

@@ -35,12 +35,12 @@ var UserPasswordAuthenticator = class {
 	}
 	/** La requête porte-t-elle un en-tête `Authorization: Basic ...` ? */
 	supports(context) {
-		const auth = context.request?.headers?.authorization;
+		const auth = context.request?.headers.authorization;
 		return typeof auth === "string" && BASIC_SCHEME.test(auth);
 	}
 	/** Décode l'enveloppe Basic — un contenu malformé donne un credential vide (échec uniforme). */
 	createToken(context) {
-		const auth = context.request?.headers?.authorization;
+		const auth = context.request?.headers.authorization;
 		const decoded = Buffer.from(auth.replace(BASIC_SCHEME, ""), "base64").toString("utf8");
 		const sep = decoded.indexOf(":");
 		const credentials = sep > 0 ? {

package/dist/nodefony/src/csp.js

@@ -7,10 +7,9 @@
 function parseCsp(csp) {
 	const out = [];
 	for (const part of csp.split(";")) {
-		const tokens = part.trim().split(/\s+/).filter(Boolean);
-		if (tokens.length === 0) continue;
-		const name = tokens[0];
-		out.push([name, tokens.slice(1)]);
+		const [name, ...sources] = part.trim().split(/\s+/).filter(Boolean);
+		if (name === void 0) continue;
+		out.push([name, sources]);
 	}
 	return out;
 }
@@ -39,7 +38,7 @@ function mergeCspFragments(base, fragments) {
 	for (const [name, src] of directives) index.set(name, src);
 	for (const fragment of fragments) for (const name in fragment) {
 		const additions = fragment[name];
-		if (additions.length === 0) continue;
+		if (additions === void 0 || additions.length === 0) continue;
 		let sources = index.get(name);
 		if (!sources) {
 			sources = [];

package/dist/nodefony/src/oauth/providers/github.js

@@ -69,7 +69,7 @@ function createGithubProvider(ctx) {
 			let emailVerified = email !== null;
 			if (email === null) {
 				const list = await ghGet(`${API}/user/emails`, accessToken);
-				const primary = list.find((e) => e.primary === true) ?? list[0] ?? null;
+				const primary = list.find((e) => e.primary === true) ?? list.at(0) ?? null;
 				if (primary && typeof primary.email === "string") {
 					email = primary.email;
 					emailVerified = primary.verified === true;

package/dist/nodefony/src/realtime/frameAuthorizer.js

@@ -161,7 +161,7 @@ function containsCI(s, needle) {
 * pas en altérant la casse du namespace.
 */
 function matchSystemPolicy(channel, rules) {
-	for (let i = 0; i < rules.length; i++) if (startsWithCI(channel, rules[i].prefix)) return floorReserved(channel, rules[i].policy);
+	for (const rule of rules) if (startsWithCI(channel, rule.prefix)) return floorReserved(channel, rule.policy);
 	if (containsCI(channel, ":health") || containsCI(channel, ":stats")) return SYSTEM_CHANNEL_POLICY;
 	return null;
 }
@@ -178,7 +178,7 @@ function matchSystemPolicy(channel, rules) {
 */
 function floorReserved(channel, policy) {
 	if (policy.authenticated) return policy;
-	for (let i = 0; i < RESERVED_FLOOR_PREFIXES.length; i++) if (startsWithCI(channel, RESERVED_FLOOR_PREFIXES[i])) return {
+	for (const prefix of RESERVED_FLOOR_PREFIXES) if (startsWithCI(channel, prefix)) return {
 		...policy,
 		authenticated: true
 	};
@@ -197,7 +197,7 @@ function satisfies(policy, token, firewall) {
 	if (policy.roles && policy.roles.length > 0) {
 		const userRoles = token.getRoles();
 		let granted = false;
-		for (let i = 0; i < policy.roles.length; i++) if (firewall.hasRole(userRoles, policy.roles[i])) {
+		for (const role of policy.roles) if (firewall.hasRole(userRoles, role)) {
 			granted = true;
 			break;
 		}
@@ -206,7 +206,7 @@ function satisfies(policy, token, firewall) {
 	if (policy.scopes && policy.scopes.length > 0) {
 		const userScopes = token.getScopes();
 		let granted = false;
-		for (let i = 0; i < policy.scopes.length; i++) if (userScopes.includes(policy.scopes[i])) {
+		for (const scope of policy.scopes) if (userScopes.includes(scope)) {
 			granted = true;
 			break;
 		}
@@ -279,9 +279,9 @@ function buildFrameAuthorizer(firewall, options) {
 	return (frame, token) => {
 		const f = frame;
 		const method = f?.method;
-		if (method === "api.request") return authorizeApiRequest(firewall, f.params, token, onDeny);
+		if (method === "api.request") return authorizeApiRequest(firewall, f?.params, token, onDeny);
 		if (method === "subscribe") {
-			const channel = f.params?.channel;
+			const channel = (f?.params)?.channel;
 			if (typeof channel !== "string") return true;
 			return authorizeChannel(channel, token, firewall, resolver, systemRules, onDeny);
 		}

package/dist/nodefony/src/token/JwtKeystore.js

@@ -31,7 +31,7 @@ const CLEANED_DIRS = ["var", "tmp"];
 function keystoreLeaksIntoImage(dir) {
 	const normalized = dir.replace(/\\/gu, "/").replace(/^\.\//u, "");
 	if (normalized.startsWith("/") || /^[A-Za-z]:/u.test(normalized)) return null;
-	const first = normalized.split("/")[0];
+	const [first = ""] = normalized.split("/");
 	if (CLEANED_DIRS.includes(first)) return null;
 	return `JWT keystore: « ${dir} » n'est PAS sous ${CLEANED_DIRS.map((d) => `\`${d}/\``).join(" ni ")}, les seuls dossiers que le Dockerfile généré efface avant de fabriquer l'image. La clé privée de signature partira donc dans ton image de conteneur, où elle reste lisible par quiconque la télécharge — même effacée par une couche suivante. Deux issues : déplacer le dossier sous \`var/\` (ex. \`var/keys\`), ou injecter la clé par jwt.keystore.keySetJson depuis l'environnement, ce qui est la voie de production.`;
 }
@@ -138,9 +138,9 @@ var JwtKeystore = class {
 				kid: stored.kid,
 				privateKey: imported,
 				publicJwk: {
-					kty: stored.kty,
-					crv: stored.crv,
-					x: stored.x,
+					...stored.kty !== void 0 && { kty: stored.kty },
+					...stored.crv !== void 0 && { crv: stored.crv },
+					...stored.x !== void 0 && { x: stored.x },
 					kid: stored.kid,
 					use: "sig",
 					alg: "EdDSA"
@@ -148,9 +148,10 @@ var JwtKeystore = class {
 				createdAt: stored.createdAt ?? Date.now()
 			});
 		}
-		if (loaded.length === 0) throw new Error("JwtKeystore: keyset vide");
+		const [firstKey] = loaded;
+		if (firstKey === void 0) throw new Error("JwtKeystore: keyset vide");
 		this.#keys = loaded;
-		this.#activeKid = keyset.active && loaded.some((k) => k.kid === keyset.active) ? keyset.active : loaded[0].kid;
+		this.#activeKid = keyset.active && loaded.some((k) => k.kid === keyset.active) ? keyset.active : firstKey.kid;
 	}
 	#parseKeyset(json) {
 		let parsed;

package/dist/nodefony/src/token/MemoryTokenStore.js

@@ -219,7 +219,7 @@ var MemoryTokenStore = class {
 		set.add(id);
 	}
 	#revokeRecord(record, reason) {
-		if (record && record.revokedAt === null) {
+		if (record?.revokedAt === null) {
 			record.revokedAt = this.#now();
 			record.revokedReason = reason;
 		}

package/dist/nodefony/src/token/jwtRuntime.js

@@ -15,5 +15,17 @@ function resolveJwtRuntime(jwt) {
 		alg: "EdDSA"
 	};
 }
+/**
+* Audience inscrite dans un jeton quand aucune ressource n'est demandée : la
+* première de la liste blanche. La liste n'est jamais vide après
+* {@link resolveJwtRuntime} ; un runtime construit à la main qui la laisserait
+* vide retombe sur la même règle — l'application est sa propre audience.
+*
+* @param runtime - paramètres JWT résolus
+* @returns l'audience par défaut
+*/
+function defaultAudience(runtime) {
+	return runtime.audiences[0] ?? runtime.issuer;
+}
 //#endregion
-export { resolveJwtRuntime };
+export { defaultAudience, resolveJwtRuntime };

package/dist/nodefony/src/token/tokenCriteria.js

@@ -28,6 +28,7 @@ function tokenStatusCriteria(status, now) {
 			revokedAt: { $null: true },
 			$or: [{ expiresAt: { $null: true } }, { expiresAt: { $gt: now } }]
 		};
+		case void 0:
 		default: return {};
 	}
 }