@jongleberry/api-server 1.1.0 → 1.2.1

package/README.md

@@ -48,6 +48,7 @@ app.route("/").get((ctx) => ctx.json({ ok: true }));
 - **Server-Timing** — response latency as a `Server-Timing` header (buffered) or trailer (streaming)
 - **Abort signals** — `ctx.signal` / `ctx.abortController` wired to client disconnect
 - **Request body limits** — `ctx.request.buffer()` and `.json()` use a safe 1 MB default, with per-call overrides
+- **Opt-in hardening** — fallback CSP, close-on-oversize, and strict HTTP method policies without default behavior changes
 - **AsyncLocalStorage** — per-request store via `app.setAsyncLocalStorage(als)`
 - **Cookies** — `ctx.cookies.get()` / `.set()` with full `Set-Cookie` options
 - **Cache-Control** — `ctx.cacheControl(visibility, maxAge)` helper

package/dist/application.d.mts

@@ -15,8 +15,12 @@ export declare class Application extends EventEmitter {
     private contextClass;
     private logger;
     private bodyLimit;
+    private readonly securityHeaders;
     private trustProxy;
     private strictJsonContentType;
+    private readonly oversizedBodyStrategy;
+    private readonly fallbackContentSecurityPolicy;
+    private readonly strictHttpMethods;
     constructor(options?: ApplicationOptions);
     route(path: string): RouteBuilder;
     errorHandler(fn: ErrorHandler): void;

package/dist/application.mjs

@@ -1,10 +1,12 @@
 import { EventEmitter } from "node:events";
 import { Context, createContextClass } from "./context.mjs";
-import { createRouteBuilder } from "./router.mjs";
+import { createRouteBuilder, isSupportedHttpMethod } from "./router.mjs";
 import Router from "find-my-way";
 import { ServerTiming } from "./server-timing.mjs";
 import { Logger } from "./logger.mjs";
-import { ensureFallbackHeaders, getFallbackBody, getFallbackStatus, safeString, sendFallback, SECURITY_HEADERS, } from "./fallback-response.mjs";
+import { getRawPath } from "./request-path.mjs";
+import { createRequestAbortController } from "./request-abort.mjs";
+import { applySecurityHeaders, ensureFallbackHeaders, getFallbackBody, getFallbackStatus, resolveSecurityHeaders, safeString, sendFallback, } from "./fallback-response.mjs";
 export class Application extends EventEmitter {
     router = Router();
     errorHandlerFn = null;
@@ -14,14 +16,22 @@ export class Application extends EventEmitter {
     contextClass = Context;
     logger;
     bodyLimit;
+    securityHeaders;
     trustProxy;
     strictJsonContentType;
+    oversizedBodyStrategy;
+    fallbackContentSecurityPolicy;
+    strictHttpMethods;
     constructor(options) {
         super();
         this.logger = new Logger(options?.logger);
         this.bodyLimit = options?.bodyLimit ?? "1mb";
+        this.securityHeaders = resolveSecurityHeaders(options?.securityHeaders);
         this.trustProxy = options?.trustProxy ?? false;
         this.strictJsonContentType = options?.strictJsonContentType ?? false;
+        this.oversizedBodyStrategy = options?.oversizedBodyStrategy ?? "drain";
+        this.fallbackContentSecurityPolicy = options?.fallbackContentSecurityPolicy ?? false;
+        this.strictHttpMethods = options?.strictHttpMethods ?? false;
     }
     route(path) {
         return createRouteBuilder(this.router, path);
@@ -59,7 +69,7 @@ export class Application extends EventEmitter {
                 // Swallow listener throws so the 500 response still goes out.
             }
             if (!res.headersSent) {
-                ensureFallbackHeaders(res);
+                ensureFallbackHeaders(res, this.securityHeaders, this.fallbackContentSecurityPolicy);
                 res.writeHead(500);
                 res.end("Internal Server Error");
             }
@@ -72,22 +82,17 @@ export class Application extends EventEmitter {
         }
     }
     async runRequest(req, res) {
-        const abortController = new AbortController();
+        const abortController = createRequestAbortController(res);
         const timing = new ServerTiming();
         const ContextClass = this.contextClass;
-        req.on("close", () => {
-            if (!res.writableEnded) {
-                abortController.abort();
-            }
-        });
         const { onWriteHead, onFinish } = this.logger.onRequestStart(req);
-        const ctx = new ContextClass(req, res, {}, timing, this.asyncLocalStorage, abortController, this.bodyLimit, this.trustProxy, onWriteHead, this.strictJsonContentType);
-        // Security headers
-        for (const [name, value] of Object.entries(SECURITY_HEADERS)) {
-            res.setHeader(name, value);
-        }
+        const ctx = new ContextClass(req, res, {}, timing, this.asyncLocalStorage, abortController, this.bodyLimit, this.trustProxy, onWriteHead, this.strictJsonContentType, this.oversizedBodyStrategy);
+        applySecurityHeaders(res, this.securityHeaders);
         try {
             const method = req.method ?? "GET";
+            if (this.strictHttpMethods && !isSupportedHttpMethod(method)) {
+                throw Object.assign(new Error("Unsupported HTTP method"), { status: 400 });
+            }
             const url = req.url ?? "/";
             const rawPath = getRawPath(url);
             const routePath = rawPath.replace(/^\/+/, "/") || "/";
@@ -101,7 +106,7 @@ export class Application extends EventEmitter {
                     await this.notFoundHandlerFn(ctx);
                 }
                 else {
-                    ensureFallbackHeaders(res);
+                    ensureFallbackHeaders(res, this.securityHeaders, this.fallbackContentSecurityPolicy);
                     res.writeHead(404);
                     res.end("Not Found");
                 }
@@ -126,12 +131,12 @@ export class Application extends EventEmitter {
                 // registered error handler threw or returned without sending one. Without
                 // this, requests hang until the socket times out (issue #1948).
                 if (!res.headersSent) {
-                    sendFallback(res);
+                    sendFallback(res, this.securityHeaders, this.fallbackContentSecurityPolicy);
                 }
             }
             else if (!res.headersSent) {
                 const status = getFallbackStatus(error);
-                ensureFallbackHeaders(res);
+                ensureFallbackHeaders(res, this.securityHeaders, this.fallbackContentSecurityPolicy);
                 res.writeHead(status);
                 res.end(getFallbackBody(error, status));
             }
@@ -139,16 +144,4 @@ export class Application extends EventEmitter {
         }
     }
 }
-function getRawPath(url) {
-    const lower = url.slice(0, 8).toLowerCase();
-    if (lower.startsWith("http://") || lower.startsWith("https://")) {
-        try {
-            return new URL(url).pathname;
-        }
-        catch {
-            throw Object.assign(new Error("Invalid URL"), { status: 400 });
-        }
-    }
-    return url.split("?")[0];
-}
 export const createApp = (options) => new Application(options);

package/dist/context.d.mts

@@ -5,6 +5,7 @@ import { Request } from "./request.mts";
 import { Response } from "./response.mts";
 import { Cookies } from "./cookies.mts";
 import type { ServerTiming } from "./server-timing.mts";
+import type { OversizedBodyStrategy } from "./types.mts";
 export declare class Context {
     req: IncomingMessage;
     res: ServerResponse;
@@ -18,7 +19,7 @@ export declare class Context {
     private queryCache;
     private asyncLocalStorage;
     private trustProxy;
-    constructor(req: IncomingMessage, res: ServerResponse, params: Record<string, string | undefined>, timing: ServerTiming, als: AsyncLocalStorage<unknown> | null, abortController: AbortController, bodyLimit: string | number | false, trustProxy: boolean, onWriteHead?: () => void, strictJsonContentType?: boolean);
+    constructor(req: IncomingMessage, res: ServerResponse, params: Record<string, string | undefined>, timing: ServerTiming, als: AsyncLocalStorage<unknown> | null, abortController: AbortController, bodyLimit: string | number | false, trustProxy: boolean, onWriteHead?: () => void, strictJsonContentType?: boolean, oversizedBodyStrategy?: OversizedBodyStrategy);
     get query(): Record<string, string | string[]>;
     get store(): unknown;
     get ip(): string | undefined;

package/dist/context.mjs

@@ -26,11 +26,11 @@ export class Context {
     queryCache = null;
     asyncLocalStorage;
     trustProxy;
-    constructor(req, res, params, timing, als, abortController, bodyLimit, trustProxy, onWriteHead, strictJsonContentType) {
+    constructor(req, res, params, timing, als, abortController, bodyLimit, trustProxy, onWriteHead, strictJsonContentType, oversizedBodyStrategy) {
         this.req = req;
         this.res = res;
         this.params = params;
-        this.request = new Request(req, res, bodyLimit, strictJsonContentType ?? false);
+        this.request = new Request(req, res, bodyLimit, strictJsonContentType ?? false, oversizedBodyStrategy ?? "drain");
         this.response = new Response(req, res, timing, onWriteHead);
         this.cookies = new Cookies(req, res);
         this.abortController = abortController;

package/dist/cookies.mjs

@@ -1,4 +1,4 @@
-import { parse, serialize } from "cookie";
+import { parseCookie, stringifySetCookie } from "cookie";
 export class Cookies {
     req;
     res;
@@ -10,13 +10,13 @@ export class Cookies {
     get(name) {
         if (!this.parsed) {
             const header = this.req.headers.cookie ?? "";
-            this.parsed = parse(header);
+            this.parsed = parseCookie(header);
         }
-        return this.parsed[name];
+        return this.parsed?.[name];
     }
     set(name, value, opts) {
         const existing = this.res.getHeader("Set-Cookie");
-        const serialized = serialize(name, value, opts);
+        const serialized = stringifySetCookie({ name, value, ...opts }, { encode: encodeURIComponent });
         if (Array.isArray(existing)) {
             this.res.setHeader("Set-Cookie", [...existing, serialized]);
         }

package/dist/fallback-response.d.mts

@@ -1,16 +1,11 @@
 import { type ServerResponse } from "node:http";
-export declare const SECURITY_HEADERS: {
-    readonly "X-XSS-Protection": "0";
-    readonly "X-Frame-Options": "SAMEORIGIN";
-    readonly "X-Content-Type-Options": "nosniff";
-    readonly "Strict-Transport-Security": "max-age=15552000; includeSubDomains";
-    readonly "Referrer-Policy": "no-referrer";
-    readonly "X-DNS-Prefetch-Control": "off";
-    readonly "X-Download-Options": "noopen";
-    readonly "X-Permitted-Cross-Domain-Policies": "none";
-};
-export declare function ensureFallbackHeaders(res: ServerResponse): void;
-export declare function sendFallback(res: ServerResponse): void;
+import type { SecurityHeaderName, SecurityHeadersOptions } from "./types.mts";
+export type ResolvedSecurityHeaders = Readonly<Partial<Record<SecurityHeaderName, string>>>;
+export declare const SECURITY_HEADERS: ResolvedSecurityHeaders;
+export declare function resolveSecurityHeaders(options?: SecurityHeadersOptions): ResolvedSecurityHeaders;
+export declare function applySecurityHeaders(res: ServerResponse, securityHeaders: ResolvedSecurityHeaders): void;
+export declare function ensureFallbackHeaders(res: ServerResponse, securityHeaders?: ResolvedSecurityHeaders, contentSecurityPolicy?: string | false): void;
+export declare function sendFallback(res: ServerResponse, securityHeaders?: ResolvedSecurityHeaders, contentSecurityPolicy?: string | false): void;
 export declare function getFallbackStatus(error: unknown): number;
 export declare function safeString(err: unknown): string;
 export declare function getFallbackBody(error: unknown, status: number): string;

package/dist/fallback-response.mjs

@@ -3,22 +3,44 @@ const FALLBACK_BODY = "Not Found";
 const ERROR_STATUS = 500;
 const ERROR_BODY = "Internal Server Error";
 const TEXT_PLAIN_CONTENT_TYPE = "text/plain; charset=utf-8";
+const SECURITY_HEADER_NAMES = [
+    "X-XSS-Protection",
+    "X-Frame-Options",
+    "X-Content-Type-Options",
+    "Strict-Transport-Security",
+    "Referrer-Policy",
+    "X-DNS-Prefetch-Control",
+    "X-Download-Options",
+    "X-Permitted-Cross-Domain-Policies",
+];
 export const SECURITY_HEADERS = {
     "X-XSS-Protection": "0",
     "X-Frame-Options": "SAMEORIGIN",
     "X-Content-Type-Options": "nosniff",
-    "Strict-Transport-Security": "max-age=15552000; includeSubDomains",
-    "Referrer-Policy": "no-referrer",
-    "X-DNS-Prefetch-Control": "off",
-    "X-Download-Options": "noopen",
-    "X-Permitted-Cross-Domain-Policies": "none",
 };
-const FALLBACK_HEADERS = {
-    "Content-Type": TEXT_PLAIN_CONTENT_TYPE,
-    ...SECURITY_HEADERS,
-};
-export function ensureFallbackHeaders(res) {
-    for (const [name, value] of Object.entries(FALLBACK_HEADERS)) {
+export function resolveSecurityHeaders(options) {
+    const resolved = { ...SECURITY_HEADERS };
+    for (const name of SECURITY_HEADER_NAMES) {
+        const value = options?.[name];
+        if (value === false) {
+            delete resolved[name];
+        }
+        else if (typeof value === "string") {
+            resolved[name] = value;
+        }
+    }
+    return resolved;
+}
+export function applySecurityHeaders(res, securityHeaders) {
+    for (const [name, value] of Object.entries(securityHeaders)) {
+        res.setHeader(name, value);
+    }
+}
+export function ensureFallbackHeaders(res, securityHeaders = SECURITY_HEADERS, contentSecurityPolicy = false) {
+    for (const [name, value] of Object.entries({
+        "Content-Type": TEXT_PLAIN_CONTENT_TYPE,
+        ...securityHeaders,
+    })) {
         try {
             if (typeof res.hasHeader !== "function" || !res.hasHeader(name)) {
                 res.setHeader(name, value);
@@ -28,10 +50,20 @@ export function ensureFallbackHeaders(res) {
             // Header mutation can fail on destroyed sockets or non-standard responses.
         }
     }
+    if (contentSecurityPolicy !== false) {
+        try {
+            if (typeof res.hasHeader !== "function" || !res.hasHeader("Content-Security-Policy")) {
+                res.setHeader("Content-Security-Policy", contentSecurityPolicy);
+            }
+        }
+        catch {
+            // Header mutation can fail on destroyed sockets or non-standard responses.
+        }
+    }
 }
-export function sendFallback(res) {
+export function sendFallback(res, securityHeaders = SECURITY_HEADERS, contentSecurityPolicy = false) {
     try {
-        ensureFallbackHeaders(res);
+        ensureFallbackHeaders(res, securityHeaders, contentSecurityPolicy);
         res.writeHead(ERROR_STATUS);
         res.end(ERROR_BODY);
     }

package/dist/index.d.mts

@@ -11,4 +11,4 @@ export * from "./etag.mts";
 export * from "./cache-control.mts";
 export * from "./compression.mts";
 export type { Handler, RouteBuilder } from "./router.mts";
-export type { CookieOptions, ApplicationOptions } from "./types.mts";
+export type { CookieOptions, ApplicationOptions, OversizedBodyStrategy, SecurityHeaderName, SecurityHeadersOptions, } from "./types.mts";

package/dist/request-abort.d.mts

@@ -0,0 +1,2 @@
+import type { ServerResponse } from "node:http";
+export declare function createRequestAbortController(response: ServerResponse): AbortController;

package/dist/request-abort.mjs

@@ -0,0 +1,21 @@
+function isPositiveFinite(limit) {
+    return limit > 0 && Number.isFinite(limit);
+}
+export function createRequestAbortController(response) {
+    const abortController = new AbortController();
+    const initialLimit = response.getMaxListeners();
+    const reservedListenerSlot = isPositiveFinite(initialLimit);
+    if (reservedListenerSlot) {
+        response.setMaxListeners(initialLimit + 1);
+    }
+    response.once("close", () => {
+        const currentLimit = response.getMaxListeners();
+        if (reservedListenerSlot && isPositiveFinite(currentLimit)) {
+            response.setMaxListeners(currentLimit - 1);
+        }
+        if (!response.writableEnded) {
+            abortController.abort();
+        }
+    });
+    return abortController;
+}

package/dist/request-path.d.mts

@@ -0,0 +1 @@
+export declare function getRawPath(url: string): string;

package/dist/request-path.mjs

@@ -0,0 +1,12 @@
+export function getRawPath(url) {
+    const lower = url.slice(0, 8).toLowerCase();
+    if (lower.startsWith("http://") || lower.startsWith("https://")) {
+        try {
+            return new URL(url).pathname;
+        }
+        catch {
+            throw Object.assign(new Error("Invalid URL"), { status: 400 });
+        }
+    }
+    return url.split("?")[0];
+}

package/dist/request.d.mts

@@ -1,11 +1,13 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
+import type { OversizedBodyStrategy } from "./types.mts";
 export declare class Request {
     private req;
     private res;
     private bodyPromise;
     private defaultLimit;
     private strictJsonContentType;
-    constructor(req: IncomingMessage, res: ServerResponse, defaultLimit?: string | number | false, strictJsonContentType?: boolean);
+    private readonly oversizedBodyStrategy;
+    constructor(req: IncomingMessage, res: ServerResponse, defaultLimit?: string | number | false, strictJsonContentType?: boolean, oversizedBodyStrategy?: OversizedBodyStrategy);
     is(type: string | string[]): string | false | null;
     buffer(limit?: string | number | false): Promise<Buffer>;
     json<T = unknown>(limit?: string | number | false): Promise<T>;

package/dist/request.mjs

@@ -9,11 +9,13 @@ export class Request {
     bodyPromise = null;
     defaultLimit;
     strictJsonContentType;
-    constructor(req, res, defaultLimit = "1mb", strictJsonContentType = false) {
+    oversizedBodyStrategy;
+    constructor(req, res, defaultLimit = "1mb", strictJsonContentType = false, oversizedBodyStrategy = "drain") {
         this.req = req;
         this.res = res;
         this.defaultLimit = defaultLimit;
         this.strictJsonContentType = strictJsonContentType;
+        this.oversizedBodyStrategy = oversizedBodyStrategy;
     }
     is(type) {
         return typeIs(this.req, Array.isArray(type) ? type : [type]);
@@ -21,10 +23,10 @@ export class Request {
     buffer(limit) {
         if (!this.bodyPromise) {
             const effectiveLimit = limit ?? this.defaultLimit;
-            if (this.req.headers.expect === "100-continue") {
+            if (this.oversizedBodyStrategy === "drain" && this.req.headers.expect === "100-continue") {
                 this.res.writeContinue();
             }
-            this.bodyPromise = readBody(this.req, effectiveLimit);
+            this.bodyPromise = readBody(this.req, this.res, effectiveLimit, this.oversizedBodyStrategy);
         }
         return this.bodyPromise;
     }
@@ -64,9 +66,20 @@ function parseLimit(limit) {
     }
     return parsed;
 }
-function readBody(req, limit) {
+function readBody(req, res, limit, oversizedBodyStrategy) {
     return new Promise((resolve, reject) => {
         const maxBytes = parseLimit(limit);
+        if (oversizedBodyStrategy === "close") {
+            const contentLength = Number(req.headers["content-length"]);
+            if (Number.isFinite(contentLength) && contentLength > maxBytes) {
+                reject(createOversizedBodyError());
+                handleOversizedBody(req, res, oversizedBodyStrategy);
+                return;
+            }
+            if (req.headers.expect === "100-continue" && !res.headersSent) {
+                res.writeContinue();
+            }
+        }
         const chunks = [];
         let totalLength = 0;
         function cleanup() {
@@ -82,10 +95,8 @@ function readBody(req, limit) {
                 req.removeListener("data", onData);
                 req.removeListener("end", onEnd);
                 req.removeListener("error", onError);
-                req.on("error", noop);
-                reject(Object.assign(new Error("Request entity too large"), { status: 413 }));
-                // Drain remaining data so the connection stays reusable (HTTP keep-alive)
-                req.resume();
+                reject(createOversizedBodyError());
+                handleOversizedBody(req, res, oversizedBodyStrategy);
                 return;
             }
             chunks.push(chunk);
@@ -103,3 +114,26 @@ function readBody(req, limit) {
         req.on("error", onError);
     });
 }
+function createOversizedBodyError() {
+    return Object.assign(new Error("Request entity too large"), { status: 413 });
+}
+function handleOversizedBody(req, res, strategy) {
+    req.on("error", noop);
+    if (strategy === "drain") {
+        req.resume();
+        return;
+    }
+    req.pause();
+    if (res.headersSent) {
+        res.destroy();
+        return;
+    }
+    if ((req.httpVersionMajor ?? 1) < 2) {
+        try {
+            res.setHeader("Connection", "close");
+        }
+        catch {
+            res.destroy();
+        }
+    }
+}

package/dist/response.mjs

@@ -1,6 +1,7 @@
 import { pipeline } from "node:stream/promises";
 import { generateETag, isFresh } from "./etag.mjs";
 import { shouldCompress, createCompressStream, compressSync } from "./compression.mjs";
+import { mergeVary } from "./vary.mjs";
 export class Response {
     req;
     res;
@@ -48,7 +49,7 @@ export class Response {
         const encoding = shouldCompress(this.req, this.res, contentType, Infinity);
         if (encoding) {
             this.res.setHeader("Content-Encoding", encoding);
-            this.res.setHeader("Vary", "Accept-Encoding");
+            this.res.setHeader("Vary", mergeVary(this.res.getHeader("Vary")));
         }
         // HEAD requests: send headers only, no body
         if (this.req.method === "HEAD") {
@@ -103,7 +104,7 @@ export class Response {
         if (encoding) {
             finalBody = compressSync(encoding, body);
             this.res.setHeader("Content-Encoding", encoding);
-            this.res.setHeader("Vary", "Accept-Encoding");
+            this.res.setHeader("Vary", mergeVary(this.res.getHeader("Vary")));
         }
         this.res.setHeader("Content-Type", contentType);
         this.res.setHeader("Content-Length", finalBody.length);

package/dist/router.d.mts

@@ -9,5 +9,6 @@ export interface RouteBuilder {
     delete(handler: Handler): RouteBuilder;
     patch(handler: Handler): RouteBuilder;
 }
+export declare function isSupportedHttpMethod(method: string): boolean;
 export declare function createRouteBuilder(router: RouterInstance, path: string): RouteBuilder;
 export {};

package/dist/router.mjs

@@ -1,4 +1,8 @@
+import { METHODS } from "node:http";
 import Router from "find-my-way";
+export function isSupportedHttpMethod(method) {
+    return METHODS.includes(method);
+}
 export function createRouteBuilder(router, path) {
     const builder = {
         get(handler) {

package/dist/types.d.mts

@@ -1,4 +1,7 @@
 import type { LoggerOptions } from "./logger.mts";
+export type SecurityHeaderName = "X-XSS-Protection" | "X-Frame-Options" | "X-Content-Type-Options" | "Strict-Transport-Security" | "Referrer-Policy" | "X-DNS-Prefetch-Control" | "X-Download-Options" | "X-Permitted-Cross-Domain-Policies";
+export type SecurityHeadersOptions = Partial<Record<SecurityHeaderName, string | false>>;
+export type OversizedBodyStrategy = "drain" | "close";
 export interface CookieOptions {
     httpOnly?: boolean;
     secure?: boolean;
@@ -10,8 +13,15 @@ export interface CookieOptions {
 }
 export interface ApplicationOptions {
     bodyLimit?: string | number | false;
+    /** Defaults to "drain", preserving HTTP keep-alive after a 413 response. */
+    oversizedBodyStrategy?: OversizedBodyStrategy;
+    /** Applied only to framework-generated fallback responses. Defaults to false. */
+    fallbackContentSecurityPolicy?: string | false;
     logger?: LoggerOptions;
+    securityHeaders?: SecurityHeadersOptions;
     trustProxy?: boolean;
+    /** Reject methods outside node:http.METHODS with 400. Defaults to false. */
+    strictHttpMethods?: boolean;
     /**
      * When true, ctx.request.json() rejects requests whose Content-Type is not
      * application/json (or a compatible JSON subtype such as application/merge-patch+json)

package/dist/vary.d.mts

@@ -0,0 +1,3 @@
+type VaryHeader = undefined | string | number | readonly string[];
+export declare function mergeVary(header: VaryHeader): string;
+export {};

package/dist/vary.mjs

@@ -0,0 +1,20 @@
+export function mergeVary(header) {
+    const members = (Array.isArray(header) ? header : [header])
+        .flatMap((value) => String(value ?? "").split(","))
+        .map((value) => value.trim())
+        .filter(Boolean);
+    const merged = [];
+    const seen = new Set();
+    for (const member of members) {
+        const normalized = member.toLowerCase();
+        if (normalized === "*")
+            return "*";
+        if (seen.has(normalized))
+            continue;
+        seen.add(normalized);
+        merged.push(member);
+    }
+    if (!seen.has("accept-encoding"))
+        merged.push("Accept-Encoding");
+    return merged.join(", ");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jongleberry/api-server",
-  "version": "1.1.0",
+  "version": "1.2.1",
   "description": "A Node.js HTTP server library",
   "license": "MIT",
   "author": "Jonathan Ong",
@@ -26,7 +26,7 @@
   "dependencies": {
     "bytes": "^3.1.2",
     "compressible": "^2.0.18",
-    "cookie": "^1.1.1",
+    "cookie": "^2.0.1",
     "find-my-way": "^9.6.0",
     "http-assert": "^1.5.0",
     "http-errors": "^2.0.1",
@@ -39,15 +39,15 @@
     "@types/http-assert": "^1.5.6",
     "@types/http-errors": "^2.0.5",
     "@types/negotiator": "^0.6.4",
-    "@types/node": "^25.8.0",
+    "@types/node": "^26.0.1",
     "@types/supertest": "^7.2.0",
     "@types/type-is": "^1.6.7",
     "@vitest/coverage-v8": "^4.1.6",
     "husky": "^9.1.7",
-    "oxfmt": "^0.51.0",
+    "oxfmt": "^0.59.0",
     "oxlint": "^1.65.0",
     "supertest": "^7.2.2",
-    "typescript": "^6.0.3",
+    "typescript": "^7.0.2",
     "vitest": "^4.1.6"
   },
   "scripts": {