@soundworks/core 4.0.0-alpha.9 → 5.0.0

package/src/server/Server.js

@@ -1,28 +1,62 @@
+import EventEmitter from 'node:events';
 import fs from 'node:fs';
-import http from 'node:http';
-import https from 'node:https';
 import path from 'node:path';
 import os from 'node:os';
-import { X509Certificate, createPrivateKey } from 'node:crypto';
 
-import { getTime } from '@ircam/sc-gettime';
-import { isPlainObject, idGenerator } from '@ircam/sc-utils';
+
+import {
+  isPlainObject,
+  isString,
+  counter,
+  getTime,
+} from '@ircam/sc-utils';
 import chalk from 'chalk';
-import compression from 'compression';
-import express from 'express';
 import Keyv from 'keyv';
 import { KeyvFile } from 'keyv-file';
-import merge from 'lodash.merge';
-import pem from 'pem';
-import compile from 'template-literal';
-
-import auditSchema from './audit-schema.js';
-import { encryptData, decryptData } from './crypto.js';
-import Client from './Client.js';
-import ContextManager from './ContextManager.js';
-import PluginManager from './PluginManager.js';
-import StateManager from './StateManager.js';
-import Sockets from './Sockets.js';
+import merge from 'lodash/merge.js';
+
+import auditClassDescription from './audit-state-class-description.js';
+import {
+  encryptData,
+  decryptData,
+} from './crypto.js';
+import {
+  createHttpServer,
+} from './create-http-server.js';
+import ServerClient, {
+  kServerClientToken,
+} from './ServerClient.js';
+import ServerContextManager, {
+  kServerContextManagerStart,
+  kServerContextManagerStop,
+  kServerContextManagerAddClient,
+  kServerContextManagerRemoveClient,
+} from './ServerContextManager.js';
+import ServerPluginManager, {
+  kServerPluginManagerCheckRegisteredPlugins,
+  kServerPluginManagerAddClient,
+  kServerPluginManagerRemoveClient,
+} from './ServerPluginManager.js';
+import {
+  kPluginManagerStart,
+  kPluginManagerStop,
+} from '../common/BasePluginManager.js';
+import ServerStateManager, {
+  kServerStateManagerAddClient,
+  kServerStateManagerRemoveClient,
+  kServerStateManagerHasClient,
+} from './ServerStateManager.js';
+import {
+  kStateManagerInit,
+} from '../common/BaseStateManager.js';
+import {
+  kSocketClientId,
+  kSocketTerminate,
+} from './ServerSocket.js';
+import ServerSockets, {
+  kSocketsStart,
+  kSocketsStop,
+} from './ServerSockets.js';
 import logger from '../common/logger.js';
 import {
   SERVER_ID,
@@ -31,43 +65,19 @@ import {
   CLIENT_HANDSHAKE_ERROR,
   AUDIT_STATE_NAME,
 } from '../common/constants.js';
+import VERSION from '../common/version.js';
 
-
-let _dbNamespaces = new Set();
-
-/**
- * Configuration object for the server.
- *
- * @typedef ServerConfig
- * @memberof server
- * @type {object}
- * @property {object} [app] - Application configration object.
- * @property {object} app.clients - Definition of the application clients.
- * @property {string} [app.name=''] - Name of the application.
- * @property {string} [app.author=''] - Name of the author.
- * @property {object} [env] - Environment configration object.
- * @property {boolean} env.port - Port on which the server is listening.
- * @property {boolean} env.useHttps - Define is the server run in http or in https.
- * @property {boolean} [env.httpsInfos={}] - Path to cert files for https.
- * @property {boolean} env.serverAddress - Domain name or IP of the server.
- *  Mandatory if node clients are defined
- * @property {string} [env.websockets={}] - Configuration options for websockets.
- * @property {string} [env.subpath=''] - If running behind a proxy, path to the application.
- */
+const dbNamespaces = new Set();
 
 /** @private */
 const DEFAULT_CONFIG = {
   env: {
     type: 'development',
     port: 8000,
-    serverAddress: null,
-    subpath: '',
-    websockets: {
-      path: 'socket',
-      pingInterval: 5000,
-    },
+    serverAddress: '',
     useHttps: false,
     httpsInfos: null,
+    baseUrl: '',
     crossOriginIsolated: true,
     verbose: true,
   },
@@ -77,36 +87,19 @@ const DEFAULT_CONFIG = {
   },
 };
 
-const TOKEN_VALID_DURATION = 20; // sec
-
-// set terminal title
-/** @private */
-function setTerminalTitle(server) {
-  let title = '';
-
-  if (server._auditState !== null) {
-    const numClients = server._auditState.get('numClients');
-    let numClientStrings = [];
-    for (let name in numClients) {
-      numClientStrings.push(`${name}: ${numClients[name]}`);
-    }
+const TOKEN_VALID_DURATION = 10; // sec
 
-    title = `${server.config.app.name} | ${numClientStrings.join(' - ')}`;
-  } else {
-    title = `${server.config.app.name}`;
-  }
-
-  const msg = String.fromCharCode(27) + ']0;' + title + String.fromCharCode(7);
-  process.stdout.write(msg);
-}
+export const kServerOnSocketConnection = Symbol('soundworks:server-on-socket-connection');
+export const kServerIsValidConnectionToken = Symbol('soundworks:server-is-valid-connection-token');
+// protected and not private for testing purposes
+export const kServerOnStatusChangeCallbacks = Symbol('soundworks:server-on-status-change-callbacks');
 
 /**
- * The `Server` class is the main entry point for the server-side of a soundworks
- * application.
+ * The `Server` class is the main entry point for soundworks server-side project.
  *
- * The `Server` instance allows to access soundworks components such as {@link server.StateManager},
- * {@link server.PluginManager},{@link server.Socket} or {@link server.ContextManager}.
- * Its is also responsible for handling the initialization lifecycles of the different
+ * The `Server` instance allows to access soundworks components such as {@link ServerStateManager},
+ * {@link ServerPluginManager}, {@link ServerSocket} or {@link ServerContextManager}.
+ * Its is also responsible for handling the initialization lifecycle of the different
  * soundworks components.
  *
  * ```
@@ -116,9 +109,9 @@ function setTerminalTitle(server) {
  *   app: {
  *     name: 'my-example-app',
  *     clients: {
- *       player: { target: 'browser', default: true },
- *       controller: { target: 'browser' },
- *       thing: { target: 'node' }
+ *       player: { runtime: 'browser', default: true },
+ *       controller: { runtime: 'browser' },
+ *       thing: { runtime: 'node' }
  *     },
  *   },
  *   env: {
@@ -128,28 +121,32 @@ function setTerminalTitle(server) {
  *
  * await server.start();
  * ```
- *
- * According to the clients definitions provided in `config.app.clients`, the
- * server will automatically create a dedicated route for each browser client role.
- * For example, given the config object of the example above that defines two
- * different client roles for browser targets (i.e. `player` and `controller`):
- *
- * ```
- * config.app.clients = {
- *   player: { target: 'browser', default: true },
- *   controller: { target: 'browser' },
- * }
- * ```
- *
- * The server will listen to the following URLs:
- * - `http://127.0.0.1:8000/` for the `player` role, which is defined as the default client.
- * - `http://127.0.0.1:8000/controller` for the `controller` role.
- *
- * @memberof server
  */
 class Server {
+  #config = null;
+  #version = null;
+  #status = null;
+  #router = null;
+  #httpServer = null;
+  #db = null;
+
+  #sockets = null;
+  #pluginManager = null;
+  #stateManager = null;
+  #contextManager = null;
+
+  #onClientConnectCallbacks = new Set();
+  #onClientDisconnectCallbacks = new Set();
+  #auditState = null;
+  #tokenIdGenerator = counter();
+  #pendingConnectionTokens = new Set();
+  #trustedClients = new Set();
+
+  // for backward compatibility
+  #useDefaultApplicationTemplate = false;
+
   /**
-   * @param {server.ServerConfig} config - Configuration object for the server.
+   * @param {ServerConfig} config - Configuration object for the server.
    * @throws
    * - If `config.app.clients` is empty.
    * - If a `node` client is defined but `config.env.serverAddress` is not defined.
@@ -159,182 +156,130 @@ class Server {
    */
   constructor(config) {
     if (!isPlainObject(config)) {
-      throw new Error(`[soundworks:Server] Invalid argument for Server constructor, config should be an object`);
+      throw new TypeError(`Cannot construct 'Server': Parameter 1 must be an object`);
+    }
+
+    config = merge({}, DEFAULT_CONFIG, config);
+
+    // ---------------------------------------------------------------------
+    // Deprecation checks for config
+    // ---------------------------------------------------------------------
+
+    // `target` renamed to `runtime`
+    for (let role in config.app.clients) {
+      const clientConfig = config.app.clients[role];
+
+      if (clientConfig.target) {
+        logger.deprecated('ClientDescription#target', 'ClientDescription#runtime (or run `npx soundworks --upgrade-config` to upgrade your config files)', '4.0.0-alpha.29');
+        clientConfig.runtime = clientConfig.target;
+        delete clientConfig.target;
+      }
+    }
+
+    // `env.subpath` to `env.baseUrl`
+    if ('subpath' in config.env) {
+      logger.deprecated('ServerConfig#subpath', 'ServerConfig#baseUrl (or run `npx soundworks --upgrade-config` to upgrade your config files)', '4.0.0-alpha.29');
+      config.env.baseUrl = config.env.subpath;
+      delete config.env.subpath;
     }
-    /**
-     * @description Given config object merged with the following defaults:
-     * @example
-     * {
-     *   env: {
-     *     type: 'development',
-     *     port: 8000,
-     *     serverAddress: null,
-     *     subpath: '',
-     *     websockets: {
-     *       path: 'socket',
-     *       pingInterval: 5000,
-     *     },
-     *     useHttps: false,
-     *     httpsInfos: null,
-     *     crossOriginIsolated: true,
-     *     verbose: true,
-     *   },
-     *   app: {
-     *     name: 'soundworks',
-     *     clients: {},
-     *   }
-     * }
-     */
-    this.config = merge({}, DEFAULT_CONFIG, config);
-
-    // parse config
-    if (Object.keys(this.config.app.clients).length === 0) {
-      throw new Error(`[soundworks:Server] Invalid "app.clients" config, at least one client should be declared`);
+
+    // ---------------------------------------------------------------------
+    // ---------------------------------------------------------------------
+
+    if (Object.keys(config.app.clients).length === 0) {
+      throw new DOMException(`Cannot construct 'Server': At least one ClientDescription must be declared in 'config.app.clients'`, 'NotSupportedError');
     }
 
-    // if a node client is defined, serverAddress should be defined
-    let hasNodeClient = false;
-    for (let name in this.config.app.clients) {
-      if (this.config.app.clients[name].target === 'node') {
-        hasNodeClient = true;
+    for (let name in config.app.clients) {
+      // runtime property is mandatory
+      if (!['node', 'browser'].includes(config.app.clients[name].runtime)) {
+        throw new TypeError(`Cannot construct 'Server': Invalid 'ClientDescription' for client '${name}': 'runtime' property must be either 'node' or 'browser'`);
       }
     }
 
-    if (hasNodeClient && this.config.env.serverAddress === null) {
-      throw new Error(`[soundworks:Server] Invalid "env.serverAddress" config, is mandatory when a node client target is defined`);
+    // @peeka - remove this check
+    // [2024-05-29] Override default `config.env.serverAddress`` provided from
+    // template `loadConfig` to '' so that browser clients can default to
+    // window.location.hostname and node clients to `127.0.0.1`
+    if (process.env.ENV === undefined && config.env.serverAddress === '127.0.0.1') {
+      config.env.serverAddress = '';
     }
 
-    if (this.config.env.useHttps && this.config.env.httpsInfos !== null) {
-      const httpsInfos = this.config.env.httpsInfos;
+    if (config.env.useHttps && config.env.httpsInfos !== null) {
+      const httpsInfos = config.env.httpsInfos;
 
-      if (!isPlainObject(this.config.env.httpsInfos)) {
-        throw new Error(`[soundworks:Server] Invalid "env.httpsInfos" config, should be null or object { cert, key }`);
+      if (!isPlainObject(config.env.httpsInfos)) {
+        throw new TypeError(`Cannot construct 'Server': Invalid 'ServerEnvConfig': 'httpsInfos' must be an object: { cert, key }`);
       }
 
       if (!('cert' in httpsInfos) || !('key' in httpsInfos)) {
-        throw new Error(`[soundworks:Server] Invalid "env.httpsInfos" config, should contain both "cert" and "key" entries`);
+        throw new TypeError(`Cannot construct 'Server':  Invalid 'ServerEnvConfig': 'httpsInfos' must contain both "cert" and "key" entries`);
       }
-      // @todo - move that to constructor
-      if (!fs.existsSync(httpsInfos.cert)) {
-        throw new Error(`[soundworks:Server] Invalid "env.httpsInfos" config, "cert" file not found`);
+
+      if (httpsInfos.cert !== null && !fs.existsSync(httpsInfos.cert)) {
+        throw new DOMException(`Cannot construct 'Server':  Invalid 'ServerEnvConfig': 'httpsInfos.cert' file not found`, 'NotFoundError');
       }
 
-      if (!fs.existsSync(httpsInfos.key)) {
-        throw new Error(`[soundworks:Server] Invalid "env.httpsInfos" config, "key" file not found`);
+      if (httpsInfos.key !== null && !fs.existsSync(httpsInfos.key)) {
+        throw new DOMException(`Cannot construct 'Server':  Invalid 'ServerEnvConfig': 'httpsInfos.key' file not found`, 'NotFoundError');
       }
     }
 
-    /**
-     * Instance of the express router.
-     *
-     * The router can be used to open new route, for example to expose a directory
-     * of static assets (in default soundworks applications only the `public` is exposed).
-     *
-     * @see {@link https://github.com/expressjs/express}
-     * @example
-     * import { Server } from '@soundworks/core/server.js';
-     * import express from 'express';
-     *
-     * // create the soundworks server instance
-     * const server = new Server(config);
-     *
-     * // expose assets located in the `soundfiles` directory on the network
-     * server.router.use('/soundfiles', express.static('soundfiles')));
-     */
-    // @note: we use express() instead of express.Router() because all 404 and
-    // error stuff is handled by default
-    this.router = express();
-    // compression (must be set before express.static())
-    this.router.use(compression());
-
-    /**
-     * Raw Node.js `http` or `https` instance
-     *
-     * @see {@link https://nodejs.org/api/http.html}
-     * @see {@link https://nodejs.org/api/https.html}
-     */
-    this.httpServer = null;
-
-    /**
-     * Instance of the {@link server.Sockets} class.
-     *
-     * @see {@link server.Sockets}
-     * @type {server.Sockets}
-     */
-    this.sockets = new Sockets();
-
-    /**
-     * Instance of the {@link server.PluginManager} class.
-     *
-     * @see {@link server.PluginManager}
-     * @type {server.PluginManager}
-     */
-    this.pluginManager = new PluginManager(this);
-
-    /**
-     * Instance of the {@link server.StateManager} class.
-     *
-     * @see {@link server.StateManager}
-     * @type {server.StateManager}
-     */
-    this.stateManager = new StateManager();
-
-    /**
-     * Instance of the {@link server.ContextManager} class.
-     *
-     * @see {@link server.ContextManager}
-     * @type {server.ContextManager}
-     */
-    this.contextManager = new ContextManager(this);
-
-    /**
-     * If `https` is required, hold informations about the certificates, e.g. if
-     * self-signed, the dates of validity of the certificates, etc.
-     */
-    this.httpsInfos = null;
-
-    /**
-     * Status of the server, 'idle', 'inited', 'started' or 'errored'.
-     *
-     * @type {string}
-     */
-    this.status = 'idle';
-
-    /**
-     * Simple key / value database with Promise based Map API store on filesystem,
-     * basically a tiny wrapper around the `kvey` package.
-     *
-     * @private
-     * @see {@link https://github.com/lukechilds/keyv}
-     */
-    this.db = this.createNamespacedDb('core');
-
+    // private
+    this.#config = config;
+    this.#version = VERSION;
+    this.#sockets = new ServerSockets(this, { path: 'socket' });
+    this.#pluginManager = new ServerPluginManager(this);
+    this.#stateManager = new ServerStateManager();
+    this.#contextManager = new ServerContextManager(this);
+    this.#status = 'idle';
+    this.#db = this.createNamespacedDb('core');
     /** @private */
-    this._applicationTemplateOptions = {
-      templateEngine: null,
-      templatePath: null,
-      clientConfigFunction: null,
-    };
-
-    /** @private */
-    this._onStatusChangeCallbacks = new Set();
-    /** @private */
-    this._auditState = null;
-    /** @private */
-    this._pendingConnectionTokens = new Set();
-    /** @private */
-    this._trustedClients = new Set();
+    this[kServerOnStatusChangeCallbacks] = new Set();
 
     // register audit state schema
-    this.stateManager.registerSchema(AUDIT_STATE_NAME, auditSchema);
+    this.#stateManager.defineClass(AUDIT_STATE_NAME, auditClassDescription);
+
+    logger.configure(this.#config.env.verbose);
+  }
 
-    logger.configure(this.config.env.verbose);
-    setTerminalTitle(this);
+  /**
+   * Given config object merged with the following defaults:
+   * @example
+   * {
+   *   env: {
+   *     type: 'development',
+   *     port: 8000,
+   *     serverAddress: null,
+   *     baseUrl: '',
+   *     useHttps: false,
+   *     httpsInfos: null,
+   *     crossOriginIsolated: true,
+   *     verbose: true,
+   *   },
+   *   app: {
+   *     name: 'soundworks',
+   *     clients: {},
+   *   }
+   * }
+   * @type {ServerConfig}
+   */
+  get config() {
+    return this.#config;
   }
 
   /**
-   * Id of the server, a constant set to -1
-   * @type {Number}
+   * Package version.
+   *
+   * @type {string}
+   */
+  get version() {
+    return this.#version;
+  }
+
+  /**
+   * Id of the server, a constant set to `-1`
+   * @type {number}
    * @readonly
    */
   get id() {
@@ -342,271 +287,248 @@ class Server {
   }
 
   /**
-   * The `init` method is part of the initialization lifecycle of the `soundworks`
-   * server. Most of the time, the `init` method will be implicitly called by the
-   * {@link server.Server#start} method.
+   * Status of the server.
    *
-   * In some situations you might want to call this method manually, in such cases
-   * the method should be called before the {@link server.Server#start} method.
-   *
-   * What it does:
-   * - create the audit state
-   * - prepapre http(s) server and routing according to the informations
-   * declared in `config.app.clients`
-   * - initialize all registered plugins
+   * @type {'idle'|'inited'|'started'|'errored'}
+   */
+  get status() {
+    return this.#status;
+  }
+
+  /**
+   * Instance of the router if any.
    *
-   * After `await server.init()` is fulfilled, the {@link server.Server#stateManager}
-   * and all registered plugins can be safely used.
+   * The router can be used to open new route, for example to expose a directory
+   * of static assets (in default soundworks applications only the `public` is exposed).
    *
    * @example
-   * const server = new Server(config);
-   * await server.init();
-   * await server.start();
-   * // or implicitly called by start
-   * const server = new Server(config);
-   * await server.start(); // init is called implicitely
+   * import { Server } from '@soundworks/core/server.js';
+   * import { loadConfig, configureHttpRouter } from '@soundworks/helpers/server.js';
+   *
+   * // create the server instance
+   * const server = new Server(loadConfig());
+   * // configure the express router provided by the helpers
+   * configureHttpRouter(server);
+   *
+   * // expose assets located in the `soundfiles` directory on the network
+   * server.router.use('/soundfiles', express.static('soundfiles')));
    */
-  async init() {
-    const numClients = {};
-    for (let name in this.config.app.clients) {
-      numClients[name] = 0;
-    }
-    /** @private */
-    this._auditState = await this.stateManager.create(AUDIT_STATE_NAME, { numClients });
-    this._auditState.onUpdate(() => setTerminalTitle(this));
-
-    // basic http authentication
-    if (this.config.env.auth) {
-      const ids = idGenerator();
-
-      const soundworksAuth = (req, res, next) => {
-        let role = null;
+  get router() {
+    return this.#router;
+  }
 
-        for (let [_role, config] of Object.entries(this.config.app.clients)) {
-          if (req.path === config.route) {
-            role = _role;
-          }
-        }
+  set router(router) {
+    this.#router = router;
 
-        // route that are not client entry points just pass through the middleware
-        if (role === null) {
-          next();
-          return;
+    if (this.httpServer) {
+      this.httpServer.on('request', router);
+    } else {
+      // register router on HTTP server when ready
+      this.onStatusChange(status => {
+        if (status === 'http-server-ready') {
+          this.httpServer.on('request', router);
         }
+      });
+    }
+  }
 
-        const isProtected  = this.isProtected(role);
-
-        if (isProtected) {
-          // authentication middleware
-          const auth = this.config.env.auth;
-          // parse login and password from headers
-          const b64auth = (req.headers.authorization || '').split(' ')[1] || '';
-          const [login, password] = Buffer.from(b64auth, 'base64').toString().split(':');
-
-          // verify login and password are set and correct
-          if (login && password && login === auth.login && password === auth.password) {
-            // -> access granted...
-            // generate token for web socket to check connections
-            const id = ids.next().value;
-            const ip = req.ip;
-            const time = getTime();
-            const token = { id, ip, time };
-            const encryptedToken = encryptData(token);
+  /**
+   * Instance of the Node.js `http.Server` or `https.Server`
+   *
+   * @see {@link https://nodejs.org/api/http.html#class-httpserver}
+   * @see {@link https://nodejs.org/api/https.html#class-httpsserver}
+   */
+  get httpServer() {
+    return this.#httpServer;
+  }
 
-            this._pendingConnectionTokens.add(encryptedToken);
+  /**
+   * Simple key / value filesystem database with Promise based Map API.
+   *
+   * Basically a tiny wrapper around the {@link https://github.com/lukechilds/keyv} package.
+   */
+  get db() {
+    return this.#db;
+  }
 
-            setTimeout(() => {
-              this._pendingConnectionTokens.delete(encryptedToken);
-            }, TOKEN_VALID_DURATION * 1000);
+  /**
+   * Instance of the {@link ServerSockets} class.
+   *
+   * @type {ServerSockets}
+   */
+  get sockets() {
+    return this.#sockets;
+  }
 
-            // pass to the response object to be send to the client
-            res.swToken = encryptedToken;
+  /**
+   * Instance of the {@link ServerPluginManager} class.
+   *
+   * @type {ServerPluginManager}
+   */
+  get pluginManager() {
+    return this.#pluginManager;
+  }
 
-            return next();
-          }
+  /**
+   * Instance of the {@link ServerStateManager} class.
+   *
+   * @type {ServerStateManager}
+   */
+  get stateManager() {
+    return this.#stateManager;
+  }
 
-          // show login / password modal
-          res.writeHead(401, {
-            'WWW-Authenticate':'Basic',
-            'Content-Type':'text/plain',
-          });
+  /**
+   * Instance of the {@link ServerContextManager} class.
+   *
+   * @type {ServerContextManager}
+   */
+  get contextManager() {
+    return this.#contextManager;
+  }
 
-          res.end('Authentication required.');
-        } else {
-          // route is not protected
-          return next();
-        }
-      };
+  /** @private */
+  async #dispatchStatus(status) {
+    this.#status = status;
 
-      this.router.use(soundworksAuth);
+    // if launched in a child process, forward status to parent process
+    if (process.send !== undefined) {
+      process.send(`soundworks:server:${status}`);
     }
 
-    // start http server
-    const useHttps = this.config.env.useHttps || false;
-
-    // ------------------------------------------------------------
-    // create HTTP(S) SERVER
-    // ------------------------------------------------------------
-    if (!useHttps) {
-      this.httpServer = http.createServer(this.router);
-    } else {
-      const httpsInfos = this.config.env.httpsInfos;
+    // execute all callbacks in parallel
+    const promises = [];
 
-      // if certs have been given in config
-      if (httpsInfos !== null) {
-        try {
-          // existance of file is checked in contructor
-          let cert = fs.readFileSync(httpsInfos.cert);
-          let key = fs.readFileSync(httpsInfos.key);
-
-          let x509 = null;
-          // this fails with self-signed certificates for whatever reason...
-          try {
-            x509 = new X509Certificate(cert);
-          } catch (err) {
-            this._dispatchStatus('errored');
-            throw new Error(`[soundworks:Server] Invalid https cert file`);
-          }
+    for (let callback of this[kServerOnStatusChangeCallbacks]) {
+      promises.push(callback(status));
+    }
 
-          try {
-            const keyObj = createPrivateKey(key);
+    await Promise.all(promises);
+  }
 
-            if (!x509.checkPrivateKey(keyObj)) {
-              this._dispatchStatus('errored');
-              throw new Error(`[soundworks:Server] Invalid https key file`);
-            }
-          } catch (err) {
-            this._dispatchStatus('errored');
-            throw new Error(`[soundworks:Server] Invalid https key file`);
-          }
+  /**
+   * Register a callback to execute when status change.
+   *
+   * Status are dispatched in the following order:
+   * - 'http-server-ready'
+   * - 'inited'
+   * - 'started'
+   * - 'stopped'
+   * during the lifecycle of the server. If an error occurs the 'errored' status is propagated.
+   *
+   * @param {function} callback
+   */
+  onStatusChange(callback) {
+    this[kServerOnStatusChangeCallbacks].add(callback);
+    return () => this[kServerOnStatusChangeCallbacks].delete(callback);
+  }
 
-          // check is certificate is still valid
-          const now = Date.now();
-          const certExpire = Date.parse(x509.validTo);
-          const isValid = now < certExpire;
-
-          const diff = certExpire - now;
-          const daysRemaining = Math.round(diff / 1000 / 60 / 60 / 24);
-
-          this.httpsInfos = {
-            selfSigned: false,
-            CN: x509.subject.split('=')[1],
-            altNames: x509.subjectAltName.split(',').map(e => e.trim().split(':')[1]),
-            validFrom: x509.validFrom,
-            validTo: x509.validTo,
-            isValid: isValid,
-            daysRemaining: daysRemaining,
-          };
-
-          this.httpServer = https.createServer({ key, cert }, this.router);
-        } catch (err) {
-          logger.error(`
-Invalid certificate files, please check your:
-- key file: ${httpsInfos.key}
-- cert file: ${httpsInfos.cert}
-          `);
-
-          this._dispatchStatus('errored');
-          throw err;
-        }
-      } else {
-        // generate certs
-        // --------------------------------------------------------
-        const cert = await this.db.get('httpsCert');
-        const key = await this.db.get('httpsKey');
-
-        if (key && cert) {
-          this.httpsInfos = { selfSigned: true };
-          this.httpServer = https.createServer({ cert, key }, this.router);
-        } else {
-          this.httpServer = await new Promise((resolve, reject) => {
-            // generate certificate on the fly (for development purposes)
-            pem.createCertificate({ days: 1, selfSigned: true }, async (err, keys) => {
-              if (err) {
-                logger.error(err.stack);
-                this._dispatchStatus('errored');
-
-                reject(err);
-                return;
-              }
-
-              const cert = keys.certificate;
-              const key = keys.serviceKey;
-
-              this.httpsInfos = { selfSigned: true };
-              // we store the generated cert so that we don't have to re-accept
-              // the cert each time the server restarts in development
-              await this.db.set('httpsCert', cert);
-              await this.db.set('httpsKey', key);
-
-              const httpsServer = https.createServer({ cert, key }, this.router);
-
-              resolve(httpsServer);
-            });
-          });
-        }
-      }
+  /**
+   * Attach and retrieve the global audit state of the application.
+   *
+   * The audit state is a {@link SharedState} instance that keeps track of
+   * global information about the application such as, the number of connected
+   * clients, network latency estimation, etc.
+   *
+   * The audit state is created by the server on start up.
+   *
+   * @returns {Promise<SharedState>}
+   * @throws Will throw if called before `server.init()`
+   *
+   * @example
+   * const auditState = await server.getAuditState();
+   * auditState.onUpdate(() => console.log(auditState.getValues()), true);
+   */
+  async getAuditState() {
+    if (this.#status === 'idle') {
+      throw new DOMException(`Cannot execute 'getAuditState' on Server: 'init' must be called first`, 'InvalidAccessError');
     }
 
-    let nodeOnly = true;
-    // do not throw if no browser clients are defined, very usefull for
-    // cleaning tests in particular
-    for (let role in this.config.app.clients) {
-      if (this.config.app.clients[role].target === 'browser') {
-        nodeOnly = false;
-      }
-    }
+    return this.#auditState;
+  }
 
-    if (!nodeOnly) {
-      if (this._applicationTemplateOptions.templateEngine === null
-        || this._applicationTemplateOptions.templatePath === null
-        || this._applicationTemplateOptions.clientConfigFunction === null
-      ) {
-        throw new Error('[soundworks:Server] A browser client has been found in "config.app.clients" but configuration for html templating is missing. You should probably call `server.setDefaultTemplateConfig()` if you use the soundworks-template and/or refer (at your own risks) to the documentation of `setCustomTemplateConfig()`');
-      }
+  /**
+   * The `init` method is part of the initialization lifecycle of the `soundworks`
+   * server. Most of the time, the `init` method will be implicitly called by the
+   * {@link Server#start} method.
+   *
+   * In some situations you might want to call this method manually, in such cases
+   * the method should be called before the {@link Server#start} method.
+   *
+   * What it does:
+   * 1) Create the audit state
+   * 2) Create the HTTP(s) server
+   * 3) Initialize registered plugins
+   *
+   * Between steps 2 and 3, the 'http-server-ready' event status is dispatched so
+   * that consumer code can register its router before plugin initialization:
+   * ```js
+   * server.onStatusChange(status => {
+   *   if (status === 'http-server-ready') {
+   *     server.httpServer.on('request', router);
+   *   }
+   * });
+   * ```
+   *
+   * After `await server.init()` is fulfilled, the {@link Server#stateManager}
+   * and all registered plugins can be safely used.
+   *
+   * @example
+   * const server = new Server(config);
+   * await server.init();
+   * await server.start();
+   * // or implicitly called by start
+   * const server = new Server(config);
+   * await server.start(); // init is called implicitly
+   */
+  async init() {
+    if (this.#status !== 'idle') {
+      throw new DOMException(`Cannot execute 'init' on Server: Lifecycle methods must be called in following order: init, start, stop`, 'InvalidAccessError');
     }
 
-    // ------------------------------------------------------------
-    // INIT ROUTING
-    // ------------------------------------------------------------
-    logger.title(`configured clients and routing`);
+    // init `ServerStateManager` and global "audit" state
+    this.#stateManager[kStateManagerInit](SERVER_ID, new EventEmitter());
 
-    const routes = [];
-    const clientsConfig = [];
-
-    for (let role in this.config.app.clients) {
-      const config = Object.assign({}, this.config.app.clients[role]);
-      config.role = role;
-      clientsConfig.push(config);
+    const numClients = {};
+    for (let name in this.#config.app.clients) {
+      numClients[name] = 0;
     }
 
-    // sort default client last to open the route at the end
-    clientsConfig
-      .sort(a => a.default === true ? 1 : -1)
-      .forEach(config => {
-        const path = this._openClientRoute(this.router, config);
-        routes.push({ role: config.role, path });
-      });
-
-    logger.clientConfigAndRouting(routes, this.config);
+    this.#auditState = await this.#stateManager.create(AUDIT_STATE_NAME, { numClients });
 
-    // ------------------------------------------------------------
-    // START PLUGIN MANAGER
-    // ------------------------------------------------------------
-    await this.pluginManager.start();
+    // backward compatibility for `useDefaultApplicationTemplate`
+    if (this.#useDefaultApplicationTemplate === true) {
+      try {
+        const { configureHttpRouter } = await import('@soundworks/helpers/server.js');
+        configureHttpRouter(this);
+      } catch (err) {
+        logger.warn('Could not apply patch for deprecated `useDefaultApplicationTemplate` method. Please use `configureHttpRouter` from helpers instead.');
+        throw err;
+      }
+    }
 
-    await this._dispatchStatus('inited');
+    // create HTTP(S) SERVER
+    try {
+      this.#httpServer = await createHttpServer(this);
+      await this.#dispatchStatus('http-server-ready');
+    } catch (err) {
+      logger.error(err.message);
+      await this.#dispatchStatus('errored');
+      throw err;
+    }
 
-    return Promise.resolve();
+    // start `ServerPluginManager`
+    await this.#pluginManager[kPluginManagerStart]();
+    await this.#dispatchStatus('inited');
   }
 
   /**
    * The `start` method is part of the initialization lifecycle of the `soundworks`
-   * server. The `start` method will implicitly call the {@link server.Server#init}
+   * server. The `start` method will implicitly call the {@link Server#init}
    * method if it has not been called manually.
    *
    * What it does:
-   * - implicitely call {@link server.Server#init} if not done manually
+   * - implicitly call {@link Server#init} if not done manually
    * - launch the HTTP and WebSocket servers
    * - start all created contexts. To this end, you will have to call `server.init`
    * manually and instantiate the contexts between `server.init()` and `server.start()`
@@ -620,87 +542,39 @@ Invalid certificate files, please check your:
    * await server.start();
    */
   async start() {
-    if (this.status === 'idle') {
+    // lazily call init for convenience
+    if (this.#status === 'idle') {
       await this.init();
     }
 
-    if (this.status === 'started') {
-      throw new Error(`[soundworks:Server] Cannot call "server.start()" twice`);
+    if (this.#status !== 'inited') {
+      throw new DOMException(`Cannot execute 'start' on Server: Lifecycle methods must be called in following order: init, start, stop`, 'InvalidAccessError');
     }
 
-    if (this.status !== 'inited') {
-      throw new Error(`[soundworks:Server] Cannot "server.start()" before "server.init()"`);
-    }
-
-    // ------------------------------------------------------------
-    // START CONTEXT MANAGER
-    // ------------------------------------------------------------
-    await this.contextManager.start();
-
-    // ------------------------------------------------------------
-    // START SOCKET SERVER
-    // ------------------------------------------------------------
-    await this.sockets.start(
-      this,
-      this.config.env.websockets,
-      (...args) => this._onSocketConnection(...args),
-    );
-
-    // ------------------------------------------------------------
-    // START HTTP SERVER
-    // ------------------------------------------------------------
+    // state `ServerContextManager`
+    await this.#contextManager[kServerContextManagerStart]();
+    // start `SocketServer`
+    await this.#sockets[kSocketsStart]();
+    // start httpServer
     return new Promise(resolve => {
-      const port = this.config.env.port;
-      const useHttps = this.config.env.useHttps || false;
-      const protocol = useHttps ? 'https' : 'http';
-      const ifaces = os.networkInterfaces();
+      const port = this.#config.env.port;
+      const protocol = this.#config.env.useHttps ? 'https' : 'http';
+      const interfaces = os.networkInterfaces();
 
-      this.httpServer.listen(port, async () => {
+      this.#httpServer.listen(port, async () => {
         logger.title(`${protocol} server listening on`);
 
-        Object.keys(ifaces).forEach(dev => {
-          ifaces[dev].forEach(details => {
+        Object.keys(interfaces).forEach(dev => {
+          interfaces[dev].forEach(details => {
             if (details.family === 'IPv4') {
               logger.ip(protocol, details.address, port);
             }
           });
         });
 
-        if (this.httpsInfos !== null) {
-          logger.title(`https certificates infos`);
-
-          // this.httpsInfos.selfSigned = true;
-          if (this.httpsInfos.selfSigned) {
-            logger.log(`    self-signed: ${this.httpsInfos.selfSigned ? 'true' : 'false'}`);
-            logger.log(chalk.yellow`    > INVALID CERTIFICATE (self-signed)`);
-
-          } else {
-            logger.log(`    valid from: ${this.httpsInfos.validFrom}`);
-            logger.log(`    valid to:   ${this.httpsInfos.validTo}`);
-
-            // this.httpsInfos.isValid = false; // for testing
-            if (!this.httpsInfos.isValid) {
-              logger.error(chalk.red`    -------------------------------------------`);
-              logger.error(chalk.red`    > INVALID CERTIFICATE`);
-              logger.error(chalk.red`    i.e. you pretend to be safe but you are not`);
-              logger.error(chalk.red`    -------------------------------------------`);
-            } else {
-              // this.httpsInfos.daysRemaining = 2; // for testing
-              if (this.httpsInfos.daysRemaining < 5) {
-                logger.log(chalk.red`    > CERTIFICATE IS VALID... BUT ONLY ${this.httpsInfos.daysRemaining} DAYS LEFT, PLEASE CONSIDER UPDATING YOUR CERTS!`);
-              } else if (this.httpsInfos.daysRemaining < 15) {
-                logger.log(chalk.yellow`    > CERTIFICATE IS VALID - only ${this.httpsInfos.daysRemaining} days left, be careful...`);
-              } else {
-                logger.log(chalk.green`    > CERTIFICATE IS VALID (${this.httpsInfos.daysRemaining} days left)`);
-              }
-            }
-
-          }
-        }
-
-        await this._dispatchStatus('started');
+        await this.#dispatchStatus('started');
 
-        if (this.config.env.type === 'development') {
+        if (this.#config.env.type === 'development') {
           logger.log(`\n> press "${chalk.bold('Ctrl + C')}" to exit`);
         }
 
@@ -714,7 +588,7 @@ Invalid certificate files, please check your:
    * the http(s) server.
    *
    * In most situations, you might not need to call this method. However, it can
-   * be usefull for unit testing or similar situations where you want to create
+   * be useful for unit testing or similar situations where you want to create
    * and delete several servers in the same process.
    *
    * @example
@@ -727,167 +601,107 @@ Invalid certificate files, please check your:
    * await server.stop();
    */
   async stop() {
-    if (this.status !== 'started') {
-      throw new Error(`[soundworks:Server] Cannot stop() before start()`);
+    if (this.#status !== 'started') {
+      throw new DOMException(`Cannot execute 'stop' on Server: Lifecycle methods must be called in following order: init, start, stop`, 'InvalidAccessError');
     }
 
-    await this.contextManager.stop();
-    await this.pluginManager.stop();
+    await this.#contextManager[kServerContextManagerStop]();
+    await this.#pluginManager[kPluginManagerStop]();
+
+    this.#sockets[kSocketsStop]();
 
-    this.sockets.terminate();
-    this.httpServer.close(err => {
+    this.#httpServer.close(err => {
       if (err) {
         throw new Error(err.message);
       }
     });
 
-    await this._dispatchStatus('stopped');
+    await this.#dispatchStatus('stopped');
   }
 
-  /**
-   * Open the route for a given client.
-   * @private
-   */
-  _openClientRoute(router, config) {
-    const { role, target } = config;
-    const isDefault = (config.default === true);
-    // only browser targets need a route
-    if (target === 'node') {
-      return;
-    }
-
-    let route = '/';
-
-    if (!isDefault) {
-      route += `${role}`;
-    }
-
-    this.config.app.clients[role].route = route;
-
-    // define template filename: `${role}.html` or `default.html`
-    const {
-      templatePath,
-      templateEngine,
-      clientConfigFunction,
-    } = this._applicationTemplateOptions;
-
-    const clientTmpl = path.join(templatePath, `${role}.tmpl`);
-    const defaultTmpl = path.join(templatePath, `default.tmpl`);
-
-    // make it sync
-    let template;
-
-    try {
-      const stats = fs.statSync(clientTmpl);
-      template = stats.isFile() ? clientTmpl : defaultTmpl;
-    } catch (err) {
-      template = defaultTmpl;
-    }
-
-    let tmplString;
-
-    try {
-      tmplString = fs.readFileSync(template, 'utf8');
-    } catch (err) {
-      throw new Error(`[soundworks:Server] html template file "${template}" not found`);
-    }
-
-    const tmpl = templateEngine.compile(tmplString);
-
-    const soundworksClientHandler = (req, res) => {
-      const data = clientConfigFunction(role, this.config, req);
-
-      // if the client has gone through the connection middleware (add succedeed),
-      // add the token to the data object
-      if (res.swToken) {
-        data.token = res.swToken;
-      }
-
-      // CORS / COOP / COEP headers for `crossOriginIsolated pages,
-      // enables `sharedArrayBuffers` and high precision timers
-      // cf. https://web.dev/why-coop-coep/
-      if (this.config.env.crossOriginIsolated) {
-        res.writeHead(200, {
-          'Cross-Origin-Resource-Policy': 'same-origin',
-          'Cross-Origin-Embedder-Policy': 'require-corp',
-          'Cross-Origin-Opener-Policy': 'same-origin',
-        });
-      }
-
-      const appIndex = tmpl(data);
-      res.end(appIndex);
-    };
-
-    // http request
-    router.get(route, soundworksClientHandler);
+  onClientConnect(callback) {
+    this.#onClientConnectCallbacks.add(callback);
+    return () => this.#onClientConnectCallbacks.delete(callback);
+  }
 
-    // return route infos for logging on server start
-    return route;
+  onClientDisconnect(callback) {
+    this.#onClientDisconnectCallbacks.add(callback);
+    return () => this.#onClientDisconnectCallbacks.delete(callback);
   }
 
   /**
    * Socket connection callback.
    * @private
    */
-  _onSocketConnection(role, socket, connectionToken) {
-    const client = new Client(role, socket);
-    const roles = Object.keys(this.config.app.clients);
+  [kServerOnSocketConnection](role, socket, connectionToken) {
+    const client = new ServerClient(role, socket);
+    socket[kSocketClientId] = client.id;
+    const roles = Object.keys(this.#config.app.clients);
 
     // this has been validated
-    if (this.isProtected(role) && this.isValidConnectionToken(connectionToken)) {
+    if (this.isProtectedClientRole(role) && this[kServerIsValidConnectionToken](connectionToken)) {
       const { ip } = decryptData(connectionToken);
-      const newData = {
-        ip: ip,
-        id: client.id,
-      };
-
+      const newData = { ip, id: client.id };
       const newToken = encryptData(newData);
 
-      client.token = newToken;
+      client[kServerClientToken] = newToken;
 
-      this._pendingConnectionTokens.delete(connectionToken);
-      this._trustedClients.add(client);
+      this.#pendingConnectionTokens.delete(connectionToken);
+      this.#trustedClients.add(client);
     }
 
     socket.addListener('close', async () => {
-      // do nothing if client role is invalid
-      if (roles.includes(role)) {
+      // cleanup if role is valid and client finished handshake
+      if (roles.includes(role) && this.#stateManager[kServerStateManagerHasClient](client.id)) {
         // decrement audit state counter
-        const numClients = this._auditState.get('numClients');
+        const numClients = this.#auditState.get('numClients');
         numClients[role] -= 1;
-        this._auditState.set({ numClients });
+        this.#auditState.set({ numClients });
 
         // delete token
-        if (this._trustedClients.has(client)) {
-          this._trustedClients.delete(client);
+        if (this.#trustedClients.has(client)) {
+          this.#trustedClients.delete(client);
+        }
+
+        // if something goes wrong here, the 'close' event is called again and
+        // again and again... let's just log the error and terminate the socket
+        try {
+          // clean context manager, await before cleaning state manager
+          await this.#contextManager[kServerContextManagerRemoveClient](client);
+          // remove client from pluginManager
+          await this.#pluginManager[kServerPluginManagerRemoveClient](client);
+          // clean state manager
+          await this.#stateManager[kServerStateManagerRemoveClient](client.id);
+
+          this.#onClientDisconnectCallbacks.forEach(callback => callback(client));
+        } catch (err) {
+          console.error(err);
         }
-        // clean context manager, await before cleaning state manager
-        await this.contextManager.removeClient(client);
-        // remove client from pluginManager
-        await this.pluginManager.removeClient(client);
-        // clean state manager
-        await this.stateManager.removeClient(client.id);
       }
 
       // clean sockets
-      socket.terminate();
+      socket[kSocketTerminate]();
     });
 
     socket.addListener(CLIENT_HANDSHAKE_REQUEST, async payload => {
-      const { role, registeredPlugins } = payload;
+      const { role, version, registeredPlugins } = payload;
 
       if (!roles.includes(role)) {
-        console.error(`[soundworks.Server] A client with invalid type ("${role}") attempted to connect`);
+        console.error(`A client with undefined role ("${role}") attempted to connect`);
 
         socket.send(CLIENT_HANDSHAKE_ERROR, {
           type: 'invalid-client-type',
-          message: `Invalid client type, please check server configuration (valid client types are: ${roles.join(', ')})`,
+          message: `Invalid client role, please check server configuration (valid client roles are: ${roles.join(', ')})`,
         });
         return;
       }
 
+      if (version !== this.#version) {
+        logger.warnVersionDiscrepancies(role, version, this.#version);
+      }
+
       try {
-        this.pluginManager.checkRegisteredPlugins(registeredPlugins);
+        this.#pluginManager[kServerPluginManagerCheckRegisteredPlugins](registeredPlugins);
       } catch (err) {
         socket.send(CLIENT_HANDSHAKE_ERROR, {
           type: 'invalid-plugin-list',
@@ -897,192 +711,71 @@ Invalid certificate files, please check your:
       }
 
       // increment audit state
-      const numClients = this._auditState.get('numClients');
+      const numClients = this.#auditState.get('numClients');
       numClients[role] += 1;
-      this._auditState.set({ numClients });
+      this.#auditState.set({ numClients });
 
-      // add client to state manager
-      await this.stateManager.addClient(client.id, {
+      const transport = {
         emit: client.socket.send.bind(client.socket),
         addListener: client.socket.addListener.bind(client.socket),
         removeAllListeners: client.socket.removeAllListeners.bind(client.socket),
-      });
+      };
+      // add client to state manager
+      await this.#stateManager[kServerStateManagerAddClient](client.id, transport);
       // add client to plugin manager
       // server-side, all plugins are active for the lifetime of the client
-      await this.pluginManager.addClient(client, registeredPlugins);
+      await this.#pluginManager[kServerPluginManagerAddClient](client, registeredPlugins);
       // add client to context manager
-      await this.contextManager.addClient(client);
-
-      const { id, uuid, token } = client;
-      socket.send(CLIENT_HANDSHAKE_RESPONSE, { id, uuid, token });
-    });
-  }
-
-  /**
-   * Create namespaced databases for core and plugins
-   * (kind of experimental API do not expose in doc for now)
-   *
-   * @note - introduced in v3.1.0-beta.1
-   * @note - used by core and plugin-audio-streams
-   * @private
-   */
-  createNamespacedDb(namespace = null) {
-    if (namespace === null || !(typeof namespace === 'string')) {
-      throw new Error(`[soundworks:Server] Invalid namespace for ".createNamespacedDb(namespace)", namespace is mandatory and should be a string`);
-    }
+      await this.#contextManager[kServerContextManagerAddClient](client);
 
-    if (_dbNamespaces.has(namespace)) {
-      throw new Error(`[soundworks:Server] Invalid namespace for ".createNamespacedDb(namespace)", namespace "${namespace}" already exists`);
-    }
+      this.#onClientConnectCallbacks.forEach(callback => callback(client));
 
-    // KeyvFile uses fs-extra.outputFile internally so we don't need to create
-    // the directory, it will be lazily created if something is written in the db
-    // @see https://github.com/zaaack/keyv-file/blob/52502077c78226b3d69a615c80b88e53be096979/index.ts#L157
-    const filename = path.join(process.cwd(), '.data', `soundworks-${namespace}.db`);
-    // @note - keyv-file doesn't seems to works
-    const store = new KeyvFile({ filename });
-    const db = new Keyv({ namespace, store });
-    db.on('error', err => logger.error(`[soundworks:Server] db ${namespace} error: ${err}`));
-
-    return db;
-  }
-
-  onStatusChange(callback) {
-    this._onStatusChangeCallbacks.add(callback);
-
-    return () => this._onStatusChangeCallbacks.delete(callback);
+      socket.send(CLIENT_HANDSHAKE_RESPONSE, {
+        id: client.id,
+        uuid: client.uuid,
+        token: client[kServerClientToken],
+        version: this.#version,
+      });
+    });
   }
 
+  // make public
   /** @private */
-  async _dispatchStatus(status) {
-    this.status = status;
-
-    // if launched in a child process, forward status to parent process
-    if (process.send !== undefined) {
-      process.send(`soundworks:server:${status}`);
+  isProtectedClientRole(role) {
+    if (this.#config.env.auth && Array.isArray(this.#config.env.auth.clients)) {
+      return this.#config.env.auth.clients.includes(role);
     }
 
-    // execute all callbacks in parallel
-    const promises = [];
-
-    for (let callback of this._onStatusChangeCallbacks) {
-      promises.push(callback(status));
-    }
-
-    await Promise.all(promises);
+    return false;
   }
 
   /**
-   * Configure the server to work _out-of-the-box_ within the soundworks application
-   * template provided by `@soundworks/create.
-   *
-   * - uses [template-literal](https://www.npmjs.com/package/template-literal) package
-   * as html templateEngine
-   * - define `.build/server/tmpl` as the directory in which html template can be
-   * found
-   * - define the `clientConfigFunction` function that return client compliant
-   * config object to be injected in the html template.
-   *
-   * Also expose two public directory:
-   * - the `public` directory which is exposed behind the root path
-   * - the `./.build/public` directory which is exposed behind the `build` path
+   * Generate a token to secure client connection.
    *
-   * _Note: except in very rare cases (so rare that they are quite difficult to imagine),
-   * you should rely on these defaults._
+   * The token should be passed to the client-side `Client` config object, it will
+   * be internally used to check the WebSocket connection and reject it if the
+   * token is invalid.
    */
-  useDefaultApplicationTemplate() {
-    const buildDirectory = path.join('.build', 'public');
+  generateAuthToken(req) {
+    const id = this.#tokenIdGenerator;
+    const ip = req.ip;
+    const time = getTime();
+    const token = { id, ip, time };
+    const encryptedToken = encryptData(token);
 
-    const useMinifiedFile = {};
-    const roles = Object.keys(this.config.app.clients);
+    this.#pendingConnectionTokens.add(encryptedToken);
 
-    roles.forEach(role => {
-      if (this.config.env.type === 'production') {
-        // check if minified file exists
-        const minifiedFilePath = path.join(buildDirectory, `${role}.min.js`);
+    setTimeout(() => {
+      this.#pendingConnectionTokens.delete(encryptedToken);
+    }, TOKEN_VALID_DURATION * 1000);
 
-        if (fs.existsSync(minifiedFilePath)) {
-          useMinifiedFile[role] = true;
-        } else {
-          console.log(chalk.yellow(`    > Minified file not found for client "${role}", falling back to normal build file (use \`npm run build:production && npm start\` to use minified files)`));
-          useMinifiedFile[role] = false;
-        }
-      } else {
-        useMinifiedFile[role] = false;
-      }
-    });
-
-    this._applicationTemplateOptions = {
-      templateEngine: { compile },
-      templatePath: path.join('.build', 'server', 'tmpl'),
-      clientConfigFunction: (role, config, _httpRequest) => {
-        return {
-          role: role,
-          app: {
-            name: config.app.name,
-            author: config.app.author,
-          },
-          env: {
-            type: config.env.type,
-            websockets: config.env.websockets,
-            subpath: config.env.subpath,
-            useMinifiedFile: useMinifiedFile[role],
-          },
-        };
-      },
-    };
-
-    this.router.use(express.static('public'));
-    this.router.use('/build', express.static(buildDirectory));
-  }
-
-  /**
-   * Define custom template path, template engine, and clientConfig function.
-   * This method is proposed for very advanced use-cases and should very probably
-   * be improved. If you consider using this for some reason, please get in touch
-   * first to explain your use-case :)
-   */
-  setCustomApplicationTemplateOptions(options) {
-    Object.assign(this._applicationTemplateOptions, options);
-  }
-
-  /**
-   * Attach and retrieve the global audit state of the application.
-   *
-   * The audit state is a {@link server.SharedState} instance that keeps track of
-   * global informations about the application such as, the number of connected
-   * clients, network latency estimation, etc.
-   *
-   * The audit state is created by the server on start up.
-   *
-   * @returns {Promise<server.SharedState>}
-   * @throws Will throw if called before `server.init()`
-   * @see {@link server.SharedState}
-   * @example
-   * const auditState = await server.getAuditState();
-   * auditState.onUpdate(() => console.log(auditState.getValues()), true);
-   */
-  async getAuditState() {
-    if (this.status === 'idle') {
-      throw new Error(`[soundworks.Server] Cannot access audit state before init`);
-    }
-
-    return this._auditState;
-  }
-
-  /** @private */
-  isProtected(role) {
-    if (this.config.env.auth && Array.isArray(this.config.env.auth.clients)) {
-      return this.config.env.auth.clients.includes(role);
-    }
-
-    return false;
+    return encryptedToken;
   }
 
   /** @private */
-  isValidConnectionToken(token) {
+  [kServerIsValidConnectionToken](token) {
     // token should be in pending token list
-    if (!this._pendingConnectionTokens.has(token)) {
+    if (!this.#pendingConnectionTokens.has(token)) {
       return false;
     }
 
@@ -1090,10 +783,8 @@ Invalid certificate files, please check your:
     const data = decryptData(token);
     const now = getTime();
 
-    // token is valid only for 30 seconds (this is arbitrary)
     if (now > data.time + TOKEN_VALID_DURATION) {
-      // delete the token, is too old
-      this._pendingConnectionTokens.delete(token);
+      this.#pendingConnectionTokens.delete(token);
       return false;
     } else {
       return true;
@@ -1104,14 +795,14 @@ Invalid certificate files, please check your:
    * Check if the given client is trusted, i.e. config.env.type == 'production'
    * and the client is protected behind a password.
    *
-   * @param {server.Client} client - Client to be tested
-   * @returns {Boolean}
+   * @param {ServerClient} client - Client to be tested
+   * @returns {boolean}
    */
   isTrustedClient(client) {
-    if (this.config.env.type !== 'production') {
+    if (this.#config.env.type !== 'production') {
       return true;
     } else {
-      return this._trustedClients.has(client);
+      return this.#trustedClients.has(client);
     }
   }
 
@@ -1119,20 +810,20 @@ Invalid certificate files, please check your:
    * Check if the token from a client is trusted, i.e. config.env.type == 'production'
    * and the client is protected behind a password.
    *
-   * @param {Number} clientId - Id of the client
-   * @param {Number} clientIp - Ip of the client
-   * @param {String} token - Token to be tested
-   * @returns {Boolean}
+   * @param {number} clientId - Id of the client
+   * @param {string} clientIp - Ip of the client
+   * @param {string} token - Token to be tested
+   * @returns {boolean}
    */
   // for stateless interactions, e.g. POST files
   isTrustedToken(clientId, clientIp, token) {
-    if (this.config.env.type !== 'production') {
+    if (this.#config.env.type !== 'production') {
       return true;
     } else {
-      for (let client of this._trustedClients) {
-        if (client.id === clientId && client.token === token) {
+      for (let client of this.#trustedClients) {
+        if (client.id === clientId && client[kServerClientToken] === token) {
           // check that given token is consistent with client ip and id
-          const { id, ip } = decryptData(client.token);
+          const { id, ip } = decryptData(client[kServerClientToken]);
 
           if (clientId === id && clientIp === ip) {
             return true;
@@ -1144,6 +835,43 @@ Invalid certificate files, please check your:
       return false;
     }
   }
+
+  /**
+   * Create namespaced databases for core and plugins
+   * (kind of experimental API do not expose in doc for now)
+   *
+   * @note - introduced in v3.1.0-beta.1
+   * @note - used by core and plugin-audio-streams
+   * @private
+   */
+  createNamespacedDb(namespace = null) {
+    if (!isString(namespace)) {
+      throw new TypeError(`Cannot execute "createNamespacedDb(namespace)" on Server: argument 1 must be a string`);
+    }
+
+    if (dbNamespaces.has(namespace)) {
+      throw new DOMException(`Cannot execute "createNamespacedDb(namespace)" on Server: namespace "${namespace}" already exists`, 'NotSupportedError');
+    }
+
+    // KeyvFile uses fs-extra.outputFile internally so we don't need to create
+    // the directory, it will be lazily created if something is written in the db
+    // @see https://github.com/zaaack/keyv-file/blob/52502077c78226b3d69a615c80b88e53be096979/index.ts#L157
+    const filename = path.join(process.cwd(), '.data', `soundworks-${namespace}.db`);
+    // @note - keyv-file doesn't seems to works
+    const store = new KeyvFile({ filename });
+    const db = new Keyv({ namespace, store });
+    db.on('error', err => logger.error(`[soundworks:Server] db ${namespace} error: ${err}`));
+
+    return db;
+  }
+
+  /**
+   * @deprecated
+   */
+  useDefaultApplicationTemplate() {
+    logger.deprecated('Server#useDefaultApplicationTemplate', '`configureHttpRouter(server)` from the `@soundworks/helpers/server.js` package', '4.0.0-alpha.29');
+    this.#useDefaultApplicationTemplate = true;
+  }
 }
 
 export default Server;