@jongleberry/api-server 1.0.4 → 1.2.0

package/README.md

@@ -48,6 +48,7 @@ app.route("/").get((ctx) => ctx.json({ ok: true }));
 - **Server-Timing** — response latency as a `Server-Timing` header (buffered) or trailer (streaming)
 - **Abort signals** — `ctx.signal` / `ctx.abortController` wired to client disconnect
 - **Request body limits** — `ctx.request.buffer()` and `.json()` use a safe 1 MB default, with per-call overrides
+- **Opt-in hardening** — fallback CSP, close-on-oversize, and strict HTTP method policies without default behavior changes
 - **AsyncLocalStorage** — per-request store via `app.setAsyncLocalStorage(als)`
 - **Cookies** — `ctx.cookies.get()` / `.set()` with full `Set-Cookie` options
 - **Cache-Control** — `ctx.cacheControl(visibility, maxAge)` helper

package/dist/application.d.mts

@@ -15,7 +15,12 @@ export declare class Application extends EventEmitter {
     private contextClass;
     private logger;
     private bodyLimit;
+    private readonly securityHeaders;
     private trustProxy;
+    private strictJsonContentType;
+    private readonly oversizedBodyStrategy;
+    private readonly fallbackContentSecurityPolicy;
+    private readonly strictHttpMethods;
     constructor(options?: ApplicationOptions);
     route(path: string): RouteBuilder;
     errorHandler(fn: ErrorHandler): void;

package/dist/application.mjs

@@ -1,10 +1,11 @@
 import { EventEmitter } from "node:events";
 import { Context, createContextClass } from "./context.mjs";
-import { createRouteBuilder } from "./router.mjs";
+import { createRouteBuilder, isSupportedHttpMethod } from "./router.mjs";
 import Router from "find-my-way";
 import { ServerTiming } from "./server-timing.mjs";
 import { Logger } from "./logger.mjs";
-import { ensureFallbackHeaders, getFallbackBody, getFallbackStatus, sendFallback, } from "./fallback-response.mjs";
+import { getRawPath } from "./request-path.mjs";
+import { applySecurityHeaders, ensureFallbackHeaders, getFallbackBody, getFallbackStatus, resolveSecurityHeaders, safeString, sendFallback, } from "./fallback-response.mjs";
 export class Application extends EventEmitter {
     router = Router();
     errorHandlerFn = null;
@@ -14,12 +15,22 @@ export class Application extends EventEmitter {
     contextClass = Context;
     logger;
     bodyLimit;
+    securityHeaders;
     trustProxy;
+    strictJsonContentType;
+    oversizedBodyStrategy;
+    fallbackContentSecurityPolicy;
+    strictHttpMethods;
     constructor(options) {
         super();
         this.logger = new Logger(options?.logger);
         this.bodyLimit = options?.bodyLimit ?? "1mb";
+        this.securityHeaders = resolveSecurityHeaders(options?.securityHeaders);
         this.trustProxy = options?.trustProxy ?? false;
+        this.strictJsonContentType = options?.strictJsonContentType ?? false;
+        this.oversizedBodyStrategy = options?.oversizedBodyStrategy ?? "drain";
+        this.fallbackContentSecurityPolicy = options?.fallbackContentSecurityPolicy ?? false;
+        this.strictHttpMethods = options?.strictHttpMethods ?? false;
     }
     route(path) {
         return createRouteBuilder(this.router, path);
@@ -47,7 +58,7 @@ export class Application extends EventEmitter {
             // Safety net: if runRequest rejects before its own try-catch (e.g. during
             // context/timing setup), ensure the client always gets a response instead
             // of a socket hang-up from an unhandled promise rejection.
-            const error = err instanceof Error ? err : new Error(String(err));
+            const error = err instanceof Error ? err : new Error(safeString(err));
             try {
                 if (this.listenerCount("error") > 0) {
                     this.emit("error", error);
@@ -57,7 +68,7 @@ export class Application extends EventEmitter {
                 // Swallow listener throws so the 500 response still goes out.
             }
             if (!res.headersSent) {
-                ensureFallbackHeaders(res);
+                ensureFallbackHeaders(res, this.securityHeaders, this.fallbackContentSecurityPolicy);
                 res.writeHead(500);
                 res.end("Internal Server Error");
             }
@@ -73,23 +84,21 @@ export class Application extends EventEmitter {
         const abortController = new AbortController();
         const timing = new ServerTiming();
         const ContextClass = this.contextClass;
-        req.on("close", () => {
+        res.once("close", () => {
             if (!res.writableEnded) {
                 abortController.abort();
             }
         });
         const { onWriteHead, onFinish } = this.logger.onRequestStart(req);
-        const ctx = new ContextClass(req, res, {}, timing, this.asyncLocalStorage, abortController, this.bodyLimit, this.trustProxy, onWriteHead);
-        // Security headers
-        res.setHeader("X-XSS-Protection", "0");
-        res.setHeader("X-Frame-Options", "SAMEORIGIN");
-        res.setHeader("X-Content-Type-Options", "nosniff");
+        const ctx = new ContextClass(req, res, {}, timing, this.asyncLocalStorage, abortController, this.bodyLimit, this.trustProxy, onWriteHead, this.strictJsonContentType, this.oversizedBodyStrategy);
+        applySecurityHeaders(res, this.securityHeaders);
         try {
             const method = req.method ?? "GET";
+            if (this.strictHttpMethods && !isSupportedHttpMethod(method)) {
+                throw Object.assign(new Error("Unsupported HTTP method"), { status: 400 });
+            }
             const url = req.url ?? "/";
-            const rawPath = url.startsWith("http://") || url.startsWith("https://")
-                ? new URL(url).pathname
-                : url.split("?")[0];
+            const rawPath = getRawPath(url);
             const routePath = rawPath.replace(/^\/+/, "/") || "/";
             const found = this.router.find(method, routePath);
             if (found) {
@@ -101,7 +110,7 @@ export class Application extends EventEmitter {
                     await this.notFoundHandlerFn(ctx);
                 }
                 else {
-                    ensureFallbackHeaders(res);
+                    ensureFallbackHeaders(res, this.securityHeaders, this.fallbackContentSecurityPolicy);
                     res.writeHead(404);
                     res.end("Not Found");
                 }
@@ -109,7 +118,7 @@ export class Application extends EventEmitter {
             onFinish(res.statusCode);
         }
         catch (err) {
-            const error = err instanceof Error ? err : new Error(String(err));
+            const error = err instanceof Error ? err : new Error(safeString(err));
             if (this.listenerCount("error") > 0) {
                 this.emit("error", error);
             }
@@ -126,12 +135,12 @@ export class Application extends EventEmitter {
                 // registered error handler threw or returned without sending one. Without
                 // this, requests hang until the socket times out (issue #1948).
                 if (!res.headersSent) {
-                    sendFallback(res);
+                    sendFallback(res, this.securityHeaders, this.fallbackContentSecurityPolicy);
                 }
             }
             else if (!res.headersSent) {
                 const status = getFallbackStatus(error);
-                ensureFallbackHeaders(res);
+                ensureFallbackHeaders(res, this.securityHeaders, this.fallbackContentSecurityPolicy);
                 res.writeHead(status);
                 res.end(getFallbackBody(error, status));
             }

package/dist/context.d.mts

@@ -5,6 +5,7 @@ import { Request } from "./request.mts";
 import { Response } from "./response.mts";
 import { Cookies } from "./cookies.mts";
 import type { ServerTiming } from "./server-timing.mts";
+import type { OversizedBodyStrategy } from "./types.mts";
 export declare class Context {
     req: IncomingMessage;
     res: ServerResponse;
@@ -18,7 +19,7 @@ export declare class Context {
     private queryCache;
     private asyncLocalStorage;
     private trustProxy;
-    constructor(req: IncomingMessage, res: ServerResponse, params: Record<string, string | undefined>, timing: ServerTiming, als: AsyncLocalStorage<unknown> | null, abortController: AbortController, bodyLimit: string | number | false, trustProxy: boolean, onWriteHead?: () => void);
+    constructor(req: IncomingMessage, res: ServerResponse, params: Record<string, string | undefined>, timing: ServerTiming, als: AsyncLocalStorage<unknown> | null, abortController: AbortController, bodyLimit: string | number | false, trustProxy: boolean, onWriteHead?: () => void, strictJsonContentType?: boolean, oversizedBodyStrategy?: OversizedBodyStrategy);
     get query(): Record<string, string | string[]>;
     get store(): unknown;
     get ip(): string | undefined;

package/dist/context.mjs

@@ -26,11 +26,11 @@ export class Context {
     queryCache = null;
     asyncLocalStorage;
     trustProxy;
-    constructor(req, res, params, timing, als, abortController, bodyLimit, trustProxy, onWriteHead) {
+    constructor(req, res, params, timing, als, abortController, bodyLimit, trustProxy, onWriteHead, strictJsonContentType, oversizedBodyStrategy) {
         this.req = req;
         this.res = res;
         this.params = params;
-        this.request = new Request(req, res, bodyLimit);
+        this.request = new Request(req, res, bodyLimit, strictJsonContentType ?? false, oversizedBodyStrategy ?? "drain");
         this.response = new Response(req, res, timing, onWriteHead);
         this.cookies = new Cookies(req, res);
         this.abortController = abortController;

package/dist/cookies.mjs

@@ -1,4 +1,4 @@
-import { parse, serialize } from "cookie";
+import { parseCookie, stringifySetCookie } from "cookie";
 export class Cookies {
     req;
     res;
@@ -10,13 +10,13 @@ export class Cookies {
     get(name) {
         if (!this.parsed) {
             const header = this.req.headers.cookie ?? "";
-            this.parsed = parse(header);
+            this.parsed = parseCookie(header);
         }
-        return this.parsed[name];
+        return this.parsed?.[name];
     }
     set(name, value, opts) {
         const existing = this.res.getHeader("Set-Cookie");
-        const serialized = serialize(name, value, opts);
+        const serialized = stringifySetCookie({ name, value, ...opts }, { encode: encodeURIComponent });
         if (Array.isArray(existing)) {
             this.res.setHeader("Set-Cookie", [...existing, serialized]);
         }

package/dist/fallback-response.d.mts

@@ -1,5 +1,11 @@
-import type { ServerResponse } from "node:http";
-export declare function ensureFallbackHeaders(res: ServerResponse): void;
-export declare function sendFallback(res: ServerResponse): void;
+import { type ServerResponse } from "node:http";
+import type { SecurityHeaderName, SecurityHeadersOptions } from "./types.mts";
+export type ResolvedSecurityHeaders = Readonly<Partial<Record<SecurityHeaderName, string>>>;
+export declare const SECURITY_HEADERS: ResolvedSecurityHeaders;
+export declare function resolveSecurityHeaders(options?: SecurityHeadersOptions): ResolvedSecurityHeaders;
+export declare function applySecurityHeaders(res: ServerResponse, securityHeaders: ResolvedSecurityHeaders): void;
+export declare function ensureFallbackHeaders(res: ServerResponse, securityHeaders?: ResolvedSecurityHeaders, contentSecurityPolicy?: string | false): void;
+export declare function sendFallback(res: ServerResponse, securityHeaders?: ResolvedSecurityHeaders, contentSecurityPolicy?: string | false): void;
 export declare function getFallbackStatus(error: unknown): number;
+export declare function safeString(err: unknown): string;
 export declare function getFallbackBody(error: unknown, status: number): string;

package/dist/fallback-response.mjs

@@ -1,15 +1,46 @@
+import { STATUS_CODES } from "node:http";
 const FALLBACK_BODY = "Not Found";
 const ERROR_STATUS = 500;
 const ERROR_BODY = "Internal Server Error";
 const TEXT_PLAIN_CONTENT_TYPE = "text/plain; charset=utf-8";
-const FALLBACK_HEADERS = {
-    "Content-Type": TEXT_PLAIN_CONTENT_TYPE,
+const SECURITY_HEADER_NAMES = [
+    "X-XSS-Protection",
+    "X-Frame-Options",
+    "X-Content-Type-Options",
+    "Strict-Transport-Security",
+    "Referrer-Policy",
+    "X-DNS-Prefetch-Control",
+    "X-Download-Options",
+    "X-Permitted-Cross-Domain-Policies",
+];
+export const SECURITY_HEADERS = {
     "X-XSS-Protection": "0",
     "X-Frame-Options": "SAMEORIGIN",
     "X-Content-Type-Options": "nosniff",
 };
-export function ensureFallbackHeaders(res) {
-    for (const [name, value] of Object.entries(FALLBACK_HEADERS)) {
+export function resolveSecurityHeaders(options) {
+    const resolved = { ...SECURITY_HEADERS };
+    for (const name of SECURITY_HEADER_NAMES) {
+        const value = options?.[name];
+        if (value === false) {
+            delete resolved[name];
+        }
+        else if (typeof value === "string") {
+            resolved[name] = value;
+        }
+    }
+    return resolved;
+}
+export function applySecurityHeaders(res, securityHeaders) {
+    for (const [name, value] of Object.entries(securityHeaders)) {
+        res.setHeader(name, value);
+    }
+}
+export function ensureFallbackHeaders(res, securityHeaders = SECURITY_HEADERS, contentSecurityPolicy = false) {
+    for (const [name, value] of Object.entries({
+        "Content-Type": TEXT_PLAIN_CONTENT_TYPE,
+        ...securityHeaders,
+    })) {
         try {
             if (typeof res.hasHeader !== "function" || !res.hasHeader(name)) {
                 res.setHeader(name, value);
@@ -19,10 +50,20 @@ export function ensureFallbackHeaders(res) {
             // Header mutation can fail on destroyed sockets or non-standard responses.
         }
     }
+    if (contentSecurityPolicy !== false) {
+        try {
+            if (typeof res.hasHeader !== "function" || !res.hasHeader("Content-Security-Policy")) {
+                res.setHeader("Content-Security-Policy", contentSecurityPolicy);
+            }
+        }
+        catch {
+            // Header mutation can fail on destroyed sockets or non-standard responses.
+        }
+    }
 }
-export function sendFallback(res) {
+export function sendFallback(res, securityHeaders = SECURITY_HEADERS, contentSecurityPolicy = false) {
     try {
-        ensureFallbackHeaders(res);
+        ensureFallbackHeaders(res, securityHeaders, contentSecurityPolicy);
         res.writeHead(ERROR_STATUS);
         res.end(ERROR_BODY);
     }
@@ -37,9 +78,30 @@ export function getFallbackStatus(error) {
     }
     return ERROR_STATUS;
 }
+function escapeHtml(unsafe) {
+    return unsafe
+        .replaceAll("&", "&")
+        .replaceAll("<", "&lt;")
+        .replaceAll(">", "&gt;")
+        .replaceAll('"', "&quot;")
+        .replaceAll("'", "&#039;");
+}
+export function safeString(err) {
+    try {
+        return String(err);
+    }
+    catch {
+        return "[Object null prototype]";
+    }
+}
 export function getFallbackBody(error, status) {
     if (status >= 500)
         return ERROR_BODY;
-    const message = error?.message;
-    return typeof message === "string" && message ? message : FALLBACK_BODY;
+    const err = error;
+    const message = err?.message;
+    if (err?.expose === false) {
+        return STATUS_CODES[status] || FALLBACK_BODY;
+    }
+    const msg = typeof message === "string" && message ? message : STATUS_CODES[status] || FALLBACK_BODY;
+    return escapeHtml(msg);
 }

package/dist/index.d.mts

@@ -11,4 +11,4 @@ export * from "./etag.mts";
 export * from "./cache-control.mts";
 export * from "./compression.mts";
 export type { Handler, RouteBuilder } from "./router.mts";
-export type { CookieOptions, ApplicationOptions } from "./types.mts";
+export type { CookieOptions, ApplicationOptions, OversizedBodyStrategy, SecurityHeaderName, SecurityHeadersOptions, } from "./types.mts";

package/dist/logger.mjs

@@ -27,8 +27,8 @@ export class Logger {
             return this.createErrorLevelLogger(req);
         }
         const slot = this.assignSlot();
-        const method = req.method ?? "GET";
-        const url = req.url ?? "/";
+        const method = sanitize(req.method ?? "GET");
+        const url = sanitize(req.url ?? "/");
         const startTime = process.hrtime.bigint();
         this.print("──‣", "┈┈┈┈┈", method, url, "┬", slot);
         return {
@@ -44,8 +44,8 @@ export class Logger {
         };
     }
     createErrorLevelLogger(req) {
-        const method = req.method ?? "GET";
-        const url = req.url ?? "/";
+        const method = sanitize(req.method ?? "GET");
+        const url = sanitize(req.url ?? "/");
         const startTime = process.hrtime.bigint();
         return {
             onWriteHead: noop,
@@ -109,3 +109,9 @@ export class Logger {
     }
 }
 function noop() { }
+function sanitize(str) {
+    // eslint-disable-next-line no-control-regex
+    return str
+        .replace(/\x1B\[[0-9;]*[a-zA-Z]/g, "")
+        .replace(/[\x00-\x1F\x7F-\x9F\u200E\u200F\u202A-\u202E\u2066-\u2069]/g, "");
+}

package/dist/request-path.d.mts

@@ -0,0 +1 @@
+export declare function getRawPath(url: string): string;

package/dist/request-path.mjs

@@ -0,0 +1,12 @@
+export function getRawPath(url) {
+    const lower = url.slice(0, 8).toLowerCase();
+    if (lower.startsWith("http://") || lower.startsWith("https://")) {
+        try {
+            return new URL(url).pathname;
+        }
+        catch {
+            throw Object.assign(new Error("Invalid URL"), { status: 400 });
+        }
+    }
+    return url.split("?")[0];
+}

package/dist/request.d.mts

@@ -1,10 +1,13 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
+import type { OversizedBodyStrategy } from "./types.mts";
 export declare class Request {
     private req;
     private res;
     private bodyPromise;
     private defaultLimit;
-    constructor(req: IncomingMessage, res: ServerResponse, defaultLimit?: string | number | false);
+    private strictJsonContentType;
+    private readonly oversizedBodyStrategy;
+    constructor(req: IncomingMessage, res: ServerResponse, defaultLimit?: string | number | false, strictJsonContentType?: boolean, oversizedBodyStrategy?: OversizedBodyStrategy);
     is(type: string | string[]): string | false | null;
     buffer(limit?: string | number | false): Promise<Buffer>;
     json<T = unknown>(limit?: string | number | false): Promise<T>;

package/dist/request.mjs

@@ -8,10 +8,14 @@ export class Request {
     res;
     bodyPromise = null;
     defaultLimit;
-    constructor(req, res, defaultLimit = "1mb") {
+    strictJsonContentType;
+    oversizedBodyStrategy;
+    constructor(req, res, defaultLimit = "1mb", strictJsonContentType = false, oversizedBodyStrategy = "drain") {
         this.req = req;
         this.res = res;
         this.defaultLimit = defaultLimit;
+        this.strictJsonContentType = strictJsonContentType;
+        this.oversizedBodyStrategy = oversizedBodyStrategy;
     }
     is(type) {
         return typeIs(this.req, Array.isArray(type) ? type : [type]);
@@ -19,14 +23,31 @@ export class Request {
     buffer(limit) {
         if (!this.bodyPromise) {
             const effectiveLimit = limit ?? this.defaultLimit;
-            if (this.req.headers.expect === "100-continue") {
+            if (this.oversizedBodyStrategy === "drain" && this.req.headers.expect === "100-continue") {
                 this.res.writeContinue();
             }
-            this.bodyPromise = readBody(this.req, effectiveLimit);
+            this.bodyPromise = readBody(this.req, this.res, effectiveLimit, this.oversizedBodyStrategy);
         }
         return this.bodyPromise;
     }
     async json(limit) {
+        if (this.strictJsonContentType) {
+            // type-is semantics:
+            //   null  → no body (no Content-Length / Transfer-Encoding header);
+            //           skip the content-type check — buffer() will return an empty
+            //           buffer that JSON.parse rejects with 400 as usual.
+            //   false → a body is indicated but Content-Type is not a JSON type.
+            //           We 415 only when the body actually has content (CL > 0 or
+            //           Transfer-Encoding is set without CL). A Content-Length: 0
+            //           body has nothing to read, so let it fall through to 400.
+            //   truthy → recognised JSON type; proceed normally.
+            const mediaType = this.is(["json", "application/*+json"]);
+            const cl = this.req.headers["content-length"];
+            const emptyBody = cl !== undefined && Number(cl) === 0;
+            if (mediaType === false && !emptyBody) {
+                throw Object.assign(new Error("Unsupported Media Type"), { status: 415 });
+            }
+        }
         const buf = await this.buffer(limit);
         try {
             return JSON.parse(buf.toString("utf8"));
@@ -45,9 +66,20 @@ function parseLimit(limit) {
     }
     return parsed;
 }
-function readBody(req, limit) {
+function readBody(req, res, limit, oversizedBodyStrategy) {
     return new Promise((resolve, reject) => {
         const maxBytes = parseLimit(limit);
+        if (oversizedBodyStrategy === "close") {
+            const contentLength = Number(req.headers["content-length"]);
+            if (Number.isFinite(contentLength) && contentLength > maxBytes) {
+                reject(createOversizedBodyError());
+                handleOversizedBody(req, res, oversizedBodyStrategy);
+                return;
+            }
+            if (req.headers.expect === "100-continue" && !res.headersSent) {
+                res.writeContinue();
+            }
+        }
         const chunks = [];
         let totalLength = 0;
         function cleanup() {
@@ -63,10 +95,8 @@ function readBody(req, limit) {
                 req.removeListener("data", onData);
                 req.removeListener("end", onEnd);
                 req.removeListener("error", onError);
-                req.on("error", noop);
-                reject(Object.assign(new Error("Request entity too large"), { status: 413 }));
-                // Drain remaining data so the connection stays reusable (HTTP keep-alive)
-                req.resume();
+                reject(createOversizedBodyError());
+                handleOversizedBody(req, res, oversizedBodyStrategy);
                 return;
             }
             chunks.push(chunk);
@@ -84,3 +114,26 @@ function readBody(req, limit) {
         req.on("error", onError);
     });
 }
+function createOversizedBodyError() {
+    return Object.assign(new Error("Request entity too large"), { status: 413 });
+}
+function handleOversizedBody(req, res, strategy) {
+    req.on("error", noop);
+    if (strategy === "drain") {
+        req.resume();
+        return;
+    }
+    req.pause();
+    if (res.headersSent) {
+        res.destroy();
+        return;
+    }
+    if ((req.httpVersionMajor ?? 1) < 2) {
+        try {
+            res.setHeader("Connection", "close");
+        }
+        catch {
+            res.destroy();
+        }
+    }
+}

package/dist/response.mjs

@@ -1,6 +1,7 @@
 import { pipeline } from "node:stream/promises";
 import { generateETag, isFresh } from "./etag.mjs";
 import { shouldCompress, createCompressStream, compressSync } from "./compression.mjs";
+import { mergeVary } from "./vary.mjs";
 export class Response {
     req;
     res;
@@ -48,7 +49,7 @@ export class Response {
         const encoding = shouldCompress(this.req, this.res, contentType, Infinity);
         if (encoding) {
             this.res.setHeader("Content-Encoding", encoding);
-            this.res.setHeader("Vary", "Accept-Encoding");
+            this.res.setHeader("Vary", mergeVary(this.res.getHeader("Vary")));
         }
         // HEAD requests: send headers only, no body
         if (this.req.method === "HEAD") {
@@ -103,7 +104,7 @@ export class Response {
         if (encoding) {
             finalBody = compressSync(encoding, body);
             this.res.setHeader("Content-Encoding", encoding);
-            this.res.setHeader("Vary", "Accept-Encoding");
+            this.res.setHeader("Vary", mergeVary(this.res.getHeader("Vary")));
         }
         this.res.setHeader("Content-Type", contentType);
         this.res.setHeader("Content-Length", finalBody.length);

package/dist/router.d.mts

@@ -9,5 +9,6 @@ export interface RouteBuilder {
     delete(handler: Handler): RouteBuilder;
     patch(handler: Handler): RouteBuilder;
 }
+export declare function isSupportedHttpMethod(method: string): boolean;
 export declare function createRouteBuilder(router: RouterInstance, path: string): RouteBuilder;
 export {};

package/dist/router.mjs

@@ -1,4 +1,8 @@
+import { METHODS } from "node:http";
 import Router from "find-my-way";
+export function isSupportedHttpMethod(method) {
+    return METHODS.includes(method);
+}
 export function createRouteBuilder(router, path) {
     const builder = {
         get(handler) {

package/dist/types.d.mts

@@ -1,4 +1,7 @@
 import type { LoggerOptions } from "./logger.mts";
+export type SecurityHeaderName = "X-XSS-Protection" | "X-Frame-Options" | "X-Content-Type-Options" | "Strict-Transport-Security" | "Referrer-Policy" | "X-DNS-Prefetch-Control" | "X-Download-Options" | "X-Permitted-Cross-Domain-Policies";
+export type SecurityHeadersOptions = Partial<Record<SecurityHeaderName, string | false>>;
+export type OversizedBodyStrategy = "drain" | "close";
 export interface CookieOptions {
     httpOnly?: boolean;
     secure?: boolean;
@@ -10,6 +13,22 @@ export interface CookieOptions {
 }
 export interface ApplicationOptions {
     bodyLimit?: string | number | false;
+    /** Defaults to "drain", preserving HTTP keep-alive after a 413 response. */
+    oversizedBodyStrategy?: OversizedBodyStrategy;
+    /** Applied only to framework-generated fallback responses. Defaults to false. */
+    fallbackContentSecurityPolicy?: string | false;
     logger?: LoggerOptions;
+    securityHeaders?: SecurityHeadersOptions;
     trustProxy?: boolean;
+    /** Reject methods outside node:http.METHODS with 400. Defaults to false. */
+    strictHttpMethods?: boolean;
+    /**
+     * When true, ctx.request.json() rejects requests whose Content-Type is not
+     * application/json (or a compatible JSON subtype such as application/merge-patch+json)
+     * with a 415 Unsupported Media Type error. Requests with no body are unaffected.
+     *
+     * Defaults to false (lenient: any Content-Type is accepted, preserving
+     * backward-compatible behavior).
+     */
+    strictJsonContentType?: boolean;
 }

package/dist/vary.d.mts

@@ -0,0 +1,3 @@
+type VaryHeader = undefined | string | number | readonly string[];
+export declare function mergeVary(header: VaryHeader): string;
+export {};

package/dist/vary.mjs

@@ -0,0 +1,20 @@
+export function mergeVary(header) {
+    const members = (Array.isArray(header) ? header : [header])
+        .flatMap((value) => String(value ?? "").split(","))
+        .map((value) => value.trim())
+        .filter(Boolean);
+    const merged = [];
+    const seen = new Set();
+    for (const member of members) {
+        const normalized = member.toLowerCase();
+        if (normalized === "*")
+            return "*";
+        if (seen.has(normalized))
+            continue;
+        seen.add(normalized);
+        merged.push(member);
+    }
+    if (!seen.has("accept-encoding"))
+        merged.push("Accept-Encoding");
+    return merged.join(", ");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jongleberry/api-server",
-  "version": "1.0.4",
+  "version": "1.2.0",
   "description": "A Node.js HTTP server library",
   "license": "MIT",
   "author": "Jonathan Ong",
@@ -26,7 +26,7 @@
   "dependencies": {
     "bytes": "^3.1.2",
     "compressible": "^2.0.18",
-    "cookie": "^1.1.1",
+    "cookie": "^2.0.1",
     "find-my-way": "^9.6.0",
     "http-assert": "^1.5.0",
     "http-errors": "^2.0.1",
@@ -39,12 +39,12 @@
     "@types/http-assert": "^1.5.6",
     "@types/http-errors": "^2.0.5",
     "@types/negotiator": "^0.6.4",
-    "@types/node": "^25.8.0",
+    "@types/node": "^26.0.1",
     "@types/supertest": "^7.2.0",
     "@types/type-is": "^1.6.7",
     "@vitest/coverage-v8": "^4.1.6",
     "husky": "^9.1.7",
-    "oxfmt": "^0.50.0",
+    "oxfmt": "^0.56.0",
     "oxlint": "^1.65.0",
     "supertest": "^7.2.2",
     "typescript": "^6.0.3",