fulmine.js 5.12.2 → 5.13.0

package/src/cli.js

@@ -31,6 +31,13 @@ limitations under the License.
 //
 // Whether this machine and this project can run it at all: the node version, the C library, the
 // µWebSockets.js binary, the base image a Dockerfile names. See src/verify.js.
+//
+// npx fulmine override [dir]
+// npx fulmine angular [dir]
+//
+// The two things a project needs that are a line in a JSON file rather than a specifier in a source
+// file: the package manager substitution, for a framework that requires express in its own code,
+// and angular.json's externalDependencies. See src/adopt.js.
 
 const fs = require("fs");
 const path = require("path");
@@ -38,6 +45,7 @@ const acorn = require("acorn");
 // the same walk express.testing asserts on, so the command and the assertions cannot drift
 const { collectRoutes } = require("./testing.js");
 const { verify } = require("./verify.js");
+const { override, angular } = require("./adopt.js");
 
 const FROM = "express";
 const TO = "fulmine.js";
@@ -85,11 +93,12 @@ const DIFFERENCES = [
         'Express sends X-Powered-By: Express unless told not to. Set app.set("x-powered-by", true) to send it.'
     ],
     [
-        "a compiled route is framed differently and keeps its connection header",
-        "A handler simple enough to be read at registration time is answered natively: chunked framing\n" +
-            "with no Content-Length, and a client that sent Connection: close is still told keep-alive,\n" +
-            "though the socket does close. A response that would carry a validator is never compiled, so\n" +
-            'conditional requests behave as on Express. app.set("declarative responses", false) turns it off.'
+        "a compiled route keeps its connection header",
+        "A handler simple enough to be read at registration time is answered natively, and a client\n" +
+            "that sent Connection: close is still told keep-alive, though the socket does close. A body\n" +
+            "with a piece of the query in it is framed chunked, since its length is not known until the\n" +
+            "request arrives. A response that would carry a validator is never compiled, so conditional\n" +
+            'requests behave as on Express. app.set("declarative responses", false) turns it off.'
     ],
     [
         "headers are capped at 4096 bytes by default",
@@ -822,9 +831,19 @@ function main(argv) {
     if (command === "explain") {
         return explain(argv.slice(1));
     }
+    if (command === "override") {
+        return override(argv.slice(1));
+    }
+    if (command === "angular") {
+        return angular(argv.slice(1));
+    }
     if (command !== "migrate") {
         console.log(`Usage:
   npx ${TO} migrate [dir]      rewrite require("${FROM}") and import from "${FROM}" to "${TO}"
+  npx ${TO} override [dir]     answer ${FROM} with this package for the whole dependency tree, for
+                               when a framework requires ${FROM} in its own code and not in yours
+  npx ${TO} angular [dir]      declare this package external in angular.json's server build, which
+                               esbuild otherwise tries to inline a native binary into
   npx ${TO} profile [entry]    load an application without listening and print what compiling
                                its routes decided, route by route
   npx ${TO} explain <route>    what happens when a request for that route arrives
@@ -832,7 +851,7 @@ function main(argv) {
   npx ${TO} differences        print what behaves differently, without changing anything
 
 Options:
-  --dry-run                    migrate: say what would change and change nothing`);
+  --dry-run                    migrate, override, angular: say what would change and change nothing`);
         return command ? 1 : 0;
     }
 

package/src/declarative.js

@@ -54,6 +54,11 @@ const MAX_INSTRUCTION_LENGTH = 65535;
 // so it cannot honour one, and a handler that sets one has to stay on the ordinary path.
 const VALIDATOR_HEADERS = new Set(["etag", "last-modified"]);
 
+// The statuses whose message carries no content. 205 is here for node's reason rather than
+// express's: express strips the body for 204 and 304, and node answers a 205 with a lone
+// Content-Length of zero, so all three come out of the ordinary path with no body at all.
+const BODILESS_STATUSES = new Set([204, 205, 304]);
+
 const bodyMethods = new Set(["send", "json", "end"]);
 // and the four that finish the response, after which nothing a handler does is observable
 const terminalMethods = new Set(["send", "json", "end", "sendStatus"]);
@@ -710,6 +715,14 @@ module.exports = function compileDeclarative(cb, app) {
             return false;
         }
 
+        // A status that carries no content. Compiled, the body went out with it, and a client
+        // frames these as bodiless whatever the headers say, so those bytes were read as the start
+        // of the next answer on the connection. The ordinary path already writes all three the way
+        // express does.
+        if (BODILESS_STATUSES.has(statusCode) || statusCode < 200) {
+            return false;
+        }
+
         let decRes = new uWSAny.DeclarativeResponse();
 
         if (statusCode !== 200) {
@@ -755,15 +768,10 @@ module.exports = function compileDeclarative(cb, app) {
             body.push({ type: "text", value: statuses.message[statusCode] || String(statusCode) });
         }
 
-        // A response that would carry a validator is not compiled at all.
-        //
-        // µWS answers a declarative response without reading the request, so it cannot answer a
-        // conditional GET: it used to write an ETag computed over the compiled body at listen and
-        // then ignore it, so every revalidation got 200 and the whole body where Express answers
-        // 304 with none. Dropping the ETag instead would have kept the route compiled, at the
-        // price of no validator at all on the simplest routes of every application. Refusing
-        // keeps Express's answer, and `etag` false is how a route that does not need one stays
-        // compiled, which is what both benchmarks here already set.
+        // A response that would carry a validator is not compiled at all: µWS answers it without
+        // reading the request, so it could never turn a conditional GET into the 304 the validator
+        // invites. Dropping the ETag instead would leave the simplest routes of an application
+        // without one, so `etag` false is how a route stays compiled.
         if (headers.some((header) => VALIDATOR_HEADERS.has(header[0].toLowerCase()))) {
             return false;
         }

package/src/middlewares.js

@@ -810,13 +810,20 @@ function createBodyParser(defaultType, beforeReturn, checkOptions, charsetPolicy
                 return next();
             }
 
+            // The property goes on the request before anything is decided, and its value stays
+            // undefined: body-parser's read() does exactly this, and the two halves both matter.
+            // Undefined, so a handler can still tell "nothing parsed this" from "the body was
+            // empty", which seeding an empty object would lose. Present, because `"body" in req`
+            // is how a library asks whether a parser has run at all: Apollo's express middleware
+            // refuses the request with a 500 when the property is missing, and tRPC's adapter
+            // reads the body itself when it is, so getting either half wrong breaks one of them.
+            if (!("body" in req)) {
+                req.body = undefined;
+            }
+
             // straight from the raw entries: three headers do not justify building the object
             const type = req._rawHeader("content-type");
 
-            // req.body is deliberately left undefined until a parser claims the request. That is
-            // what lets a handler tell "nothing parsed this" apart from "the body was empty",
-            // so it must not be seeded with an empty object first.
-
             // skip reading body for no content type
             // a function decides for itself, and body-parser lets it see a request that carries no
             // content-type at all. Only the string and array forms need one to match against

package/src/nest.d.ts

@@ -0,0 +1,39 @@
+/*
+Copyright 2026 Nigro Simone
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { ExpressAdapter } from "@nestjs/platform-express";
+
+/**
+ * Nest's Express adapter, listening on uWebSockets.js instead of on node.
+ *
+ * ```ts
+ * import { NestFactory } from "@nestjs/core";
+ * import { FulmineExpressAdapter } from "fulmine.js/nest";
+ *
+ * const app = await NestFactory.create(AppModule, new FulmineExpressAdapter());
+ * await app.listen(3000);
+ * ```
+ *
+ * `@nestjs/platform-express` is an optional peer dependency: this entry point is the only thing
+ * that needs it, and nothing loads it unless you import this.
+ */
+export declare class FulmineExpressAdapter extends ExpressAdapter {
+    /**
+     * @param instance an application from `fulmine()`; one is created when omitted. Pass your own
+     * when it needs options, TLS being the usual reason: `fulmine({ uwsOptions })`.
+     */
+    constructor(instance?: any);
+}

package/src/nest.js

@@ -0,0 +1,119 @@
+/*
+Copyright 2026 Nigro Simone
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// require("fulmine.js/nest"): the Nest HTTP adapter, so a Nest application runs on µWS without
+// anyone having to write this file themselves.
+//
+//     import { NestFactory } from "@nestjs/core";
+//     import { FulmineExpressAdapter } from "fulmine.js/nest";
+//
+//     const app = await NestFactory.create(AppModule, new FulmineExpressAdapter());
+//     await app.listen(3000);
+//
+// @nestjs/platform-express takes any Express instance, and this is one, so everything above the
+// adapter - controllers, pipes, guards, interceptors - is untouched. Three things below it are not,
+// and they are the whole reason this file exists:
+//
+//   - initHttpServer wraps the instance in http.createServer() and listens on that. Every request
+//     would then arrive through node's parser and be replayed into µWS's shapes by node-shim.js,
+//     which is the slow path that exists for supertest. The app already answers as an http.Server,
+//     so it is the server instead of being put inside one.
+//   - registerParserMiddleware decides whether Nest's body parsers are already in the chain by
+//     scanning app.router.stack for them. There is no layer array here to scan, routes are compiled
+//     rather than kept as layers, so the answer was always "no" and a second call added a second
+//     pair. It is remembered here instead, which is the same answer by a different route.
+//   - httpsOptions asks node to make a TLS server out of the instance. TLS here belongs to µWS and
+//     is configured when the app is built, so that combination is refused with the line to write
+//     rather than silently starting a plaintext server.
+//
+// @nestjs/platform-express is an optional peer dependency: this file is the only one that requires
+// it, and nothing loads this file unless you ask for it by name.
+
+"use strict";
+
+const { ExpressAdapter } = require("@nestjs/platform-express");
+const fulmine = require("./index.js");
+
+/**
+ * Nest's Express adapter, listening on µWebSockets.js instead of on node.
+ *
+ * Pass a configured app when you need one, `new FulmineExpressAdapter(fulmine({ uwsOptions }))`;
+ * with no argument it builds a default one, the same as `new ExpressAdapter()` does.
+ */
+class FulmineExpressAdapter extends ExpressAdapter {
+    /**
+     * @param {any} [instance] an application from `fulmine()`; one is created when omitted
+     */
+    constructor(instance) {
+        super(instance || fulmine());
+        /**
+         * Whether Nest's body parsers are in the chain, standing in for the layer array Express
+         * has and this does not. See registerParserMiddleware below.
+         * @type {boolean}
+         */
+        this._parsersRegistered = false;
+    }
+
+    /**
+     * The app is the server. Nest calls this once, from NestApplication's constructor.
+     *
+     * @param {any} [options] the options NestFactory.create was given
+     * @returns {void}
+     */
+    initHttpServer(options) {
+        if (options?.httpsOptions) {
+            throw new Error(
+                "fulmine.js: httpsOptions cannot be used here, since there is no node server to give " +
+                    "them to. TLS belongs to µWS and is configured when the app is built:\n" +
+                    '  new FulmineExpressAdapter(fulmine({ uwsOptions: { key_file_name: "key.pem", cert_file_name: "cert.pem" } }))'
+            );
+        }
+        this.httpServer = this.getInstance();
+        if (options?.forceCloseConnections) {
+            // trackOpenConnections() listens for 'connection', which nothing emits: the sockets
+            // belong to µWS and never become node ones. Said out loud, because a shutdown that
+            // quietly waits forever for what it thinks it can destroy is worse than one that does
+            // not offer to. Through Nest's own logger, so the line arrives where every other line
+            // from the framework does; it is private in the typings and inherited all the same
+            /** @type {any} */ (this).logger.warn(
+                "forceCloseConnections has no effect on fulmine.js: the sockets belong to µWS. " +
+                    "app.close() stops accepting and waits for the requests in flight; an idle keep-alive " +
+                    "connection is closed by µWS through uwsOptions.idleTimeout, not by node."
+            );
+        }
+    }
+
+    /**
+     * Nest's json and urlencoded parsers, added once however often this is called.
+     *
+     * Express answers "are they there already" by scanning `app.router.stack` for a layer whose
+     * handler is named `jsonParser` or `urlencodedParser`. There is no such array here, so the scan
+     * answered no every time and a second call put a second pair in front of every request.
+     *
+     * @param {string} [prefix]
+     * @param {boolean} [rawBody]
+     * @returns {void}
+     */
+    registerParserMiddleware(prefix, rawBody) {
+        if (this._parsersRegistered) return;
+        this._parsersRegistered = true;
+        super.registerParserMiddleware(prefix, rawBody);
+    }
+}
+
+// a named export and nothing else: `import { FulmineExpressAdapter } from "fulmine.js/nest"`, which
+// is how @nestjs/platform-express exports ExpressAdapter too
+module.exports = { FulmineExpressAdapter };

package/src/request.js

@@ -152,6 +152,51 @@ const discardedDuplicates = new Set([
 // 128 KB of body buffered before uWS is asked to pause
 const READABLE_OPTIONS = { highWaterMark: 128 * 1024 };
 
+// The methods node's parser accepts, which is the set a request can arrive with behind Express and
+// the set a route can be registered for here. µWS accepts any token, so without this a line like
+// `{"a":1}GET /path HTTP/1.1` is a request to it, with `{"A":1}GET` as the method. See _mustRefuse.
+const KNOWN_METHODS = new Set(require("http").METHODS);
+
+/**
+ * Whether a transfer-encoding leaves the body's length knowable, which is RFC 9112's rule that
+ * `chunked` comes last. `gzip, chunked` is fine and `chunked, gzip` is not: with a coding applied
+ * after the framing one, nothing can say where the body ends, and node answers 400 rather than
+ * guess. µWS guesses, and what it guesses wrong becomes the next request on the connection.
+ *
+ * Read per header rather than over the joined value, so a request splitting the list across two
+ * transfer-encoding headers is refused even when the codings would be legal joined up. That is
+ * stricter than node by a hair, on a shape nothing sends, and stricter is the safe direction here.
+ *
+ * @param {string} value one transfer-encoding header, as uWS hands it over
+ * @returns {boolean}
+ */
+function endsWithChunked(value) {
+    const last = value.slice(value.lastIndexOf(",") + 1).trim();
+    // a coding may carry parameters, which are not part of its name
+    const semicolon = last.indexOf(";");
+    return (semicolon === -1 ? last : last.slice(0, semicolon)).trim().toLowerCase() === "chunked";
+}
+
+/**
+ * The path of the url a request carries right now, without the query.
+ *
+ * Express reads it off req.url on every access, so a middleware that assigns req.url is seen by
+ * whatever runs next, the callback after it in the same route included: the router only takes a
+ * rewrite over at its next hop. The cached field answers while the two agree, which is every read
+ * of a request nobody rewrote.
+ *
+ * @param {any} req
+ * @returns {string}
+ */
+function currentPath(req) {
+    const url = req.url;
+    if (url === req._lastUrl) {
+        return req._path;
+    }
+    const query = url.indexOf("?");
+    return query === -1 ? url : url.slice(0, query);
+}
+
 /**
  * Whether a content-length is a plain count of bytes, which is the only thing RFC 9112 allows.
  *
@@ -173,6 +218,12 @@ function isByteCount(value) {
             return false;
         }
     }
+    // A count nothing can represent is not a count. Node refuses one that overflows, and µWS framed
+    // the request as if it had said something else, which put the bytes after it in a request of
+    // their own. The length test first, so an ordinary value never parses.
+    if (value.length > 15 && Number(value) > Number.MAX_SAFE_INTEGER) {
+        return false;
+    }
     return true;
 }
 
@@ -317,11 +368,12 @@ module.exports = class Request extends LazyReadable {
     /** A bodyless request whose empty end has not been delivered yet, see the constructor. */
     #emptyBody = false;
 
-    /**
-     * What a body parser left behind, and undefined until one claims the request.
-     * @type {any}
-     */
-    body;
+    // `body` is deliberately not declared here. A class field would put the property on every
+    // request, and on Express there is none until a body parser assigns one. `"body" in req` is how
+    // a library asks whether the body has already been read, and tRPC's express adapter asks
+    // exactly that: answering yes on a request nobody had parsed handed it an undefined body and
+    // turned every mutation into "Unexpected end of JSON input". Its type lives in types.d.ts,
+    // where the rest of the public request surface is described.
 
     /**
      * The response this request arrived with, linked so either reaches the other.
@@ -363,11 +415,15 @@ module.exports = class Request extends LazyReadable {
             if (headerKey.length === 14) {
                 // a second content-length whatever it says, and one that is not a count of bytes:
                 // both make uWS frame the request differently from what is on the wire, see
-                // _badFraming and isByteCount
+                // _mustRefuse and isByteCount
                 if (r._sawContentLength || !isByteCount(value)) {
-                    r._badFraming = true;
+                    r._mustRefuse = true;
                 }
                 r._sawContentLength = true;
+            } else if (!endsWithChunked(value)) {
+                // chunked has to be the last coding: anything after it and the length of the body
+                // is not knowable, which node answers 400 to and µWS served. See endsWithChunked
+                r._mustRefuse = true;
             }
             // saying anything about framing at all, "0" included. A parser that can see a
             // content-length answers about the body it describes, even an empty one: a zero length
@@ -480,9 +536,9 @@ module.exports = class Request extends LazyReadable {
     _sawContentLength;
 
     /**
-     * Whether the request said two different things about how long its body is, so uWS may have
-     * framed it differently from the client that sent it and the proxy that forwarded it. Two
-     * shapes reach this, and node's parser refuses both outright:
+     * Whether this request must not be routed at all. Node's parser refuses each of these outright
+     * and answers 400; every one of them is a way for bytes the client did not send as a request to
+     * be served as one, which is request smuggling.
      *
      *   a repeated content-length     uWS frames on the first and drops the rest, so a proxy in
      *                                 front reading the last one instead forwards bytes uWS then
@@ -491,13 +547,17 @@ module.exports = class Request extends LazyReadable {
      *                                 included, and frames the request as carrying no body at all,
      *                                 which turns the body the client sent into that same second
      *                                 request. See isByteCount
+     *   a method nobody defines       uWS takes any token as the method, so anything at all
+     *                                 followed by a space and a path is a request line to it. A
+     *                                 request with no content-length and no transfer-encoding has
+     *                                 no body, so the bytes after it are the next request: node
+     *                                 reads them and answers 400, uWS served them. See KNOWN_METHODS
      *
-     * Either way it is request smuggling, and the request is refused rather than routed. Declared
-     * for the same reason as rawIp.
+     * Declared for the same reason as rawIp.
      *
      * @type {boolean|undefined}
      */
-    _badFraming;
+    _mustRefuse;
 
     /**
      * Whether the client asked for the connection to be closed. Declared for the same reason.
@@ -567,7 +627,7 @@ module.exports = class Request extends LazyReadable {
             // A content-length of "0" declares no body and used to stay on the cheap side, but
             // getHeader only ever returns the first of a repeated header, so a duplicate cannot be
             // seen from here, and a duplicate has to be refused rather than routed: see
-            // _badFraming. Anything that says a word about framing takes the full copy instead.
+            // _mustRefuse. Anything that says a word about framing takes the full copy instead.
             //
             // One shape stays invisible here, a content-length present with an empty value: uWS
             // answers "" for that and for a header that was never sent, and nothing in its API
@@ -632,7 +692,7 @@ module.exports = class Request extends LazyReadable {
         }
         if (preset) {
             // the registration's constants: two native crossings and their strings not asked for
-            this.path = preset.path;
+            this._path = preset.path;
             this.originalUrl = preset.path + this.urlQuery;
             this.url = this.originalUrl;
             this._lastUrl = this.originalUrl;
@@ -646,17 +706,27 @@ module.exports = class Request extends LazyReadable {
             // getUrl() is the path already, so the query is joined on and then not split off
             // again. Building originalUrl and picking the path back out of it with indexOf and
             // substring was a search and a second string for something uWS had just handed over.
-            this.path = req.getUrl();
-            this.originalUrl = this.path + this.urlQuery;
+            this._path = req.getUrl();
+            this.originalUrl = this._path + this.urlQuery;
             this.url = this.originalUrl;
             // what the router last wrote to req.url. A middleware assigning something else is a
             // rewrite, which express honours, and dispatch compares against this to notice it
             this._lastUrl = this.originalUrl;
             // charCodeAt rather than indexing: s[i] builds a one character string to throw away
-            this.endsWithSlash = this.path.charCodeAt(this.path.length - 1) === 0x2f;
-            this._opPath = this.path;
-            this._originalPath = this.path;
-            this.method = req.getCaseSensitiveMethod().toUpperCase();
+            this.endsWithSlash = this._path.charCodeAt(this._path.length - 1) === 0x2f;
+            this._opPath = this._path;
+            this._originalPath = this._path;
+            const rawMethod = req.getCaseSensitiveMethod();
+            this.method = rawMethod.toUpperCase();
+            // node's parser knows a fixed set and refuses everything else; µWS takes the token as
+            // it finds it, so a request line is anything with a space in it. Compared before the
+            // uppercasing on purpose: a method is case sensitive, node refuses "post", and µWS
+            // folds it to POST and serves it. Only asked of a method the framework cannot route
+            // anyway, since a route can only be registered for one of these, see the loop that
+            // builds the verb methods at the end of router.js
+            if (!KNOWN_METHODS.has(rawMethod)) {
+                this._mustRefuse = true;
+            }
             this._isOptions = this.method === "OPTIONS";
             this._isHead = this.method === "HEAD";
         }
@@ -1004,6 +1074,17 @@ module.exports = class Request extends LazyReadable {
         return index !== -1 ? header.slice(0, index).trim() : header.trim();
     }
 
+    /**
+     * The path of the current url, without the query and relative to the mount the request is in.
+     * A getter rather than a field, because express recomputes it from req.url on every read, see
+     * currentPath.
+     *
+     * @returns {string}
+     */
+    get path() {
+        return currentPath(this);
+    }
+
     /**
      * Takes over what a middleware assigned to req.url: the remaining routing matches the new
      * path, and req.query reflects the new query string. The assigned url is relative to the
@@ -1025,7 +1106,7 @@ module.exports = class Request extends LazyReadable {
         // a rewrite to "/a?" keeps its "?", as one arriving that way does
         this.urlQuery = queryIndex === -1 ? "" : "?" + this._rawQuery;
         this._originalPath = prefix + newPath;
-        this.path = newPath;
+        this._path = newPath;
         this.endsWithSlash = newPath.charCodeAt(newPath.length - 1) === 0x2f;
         this._opPath = newPath;
         this._opPathLower = null;

package/src/response.js

@@ -589,9 +589,16 @@ module.exports = class Response extends LazyWritable {
      *
      * Nothing is written here despite the name: the headers go out when the body does.
      *
+     * Every header goes through setHeader and not through set. This is node's method, not
+     * Express's: Express does not override it, so a content-type given here keeps the value it was
+     * given, where `res.set("content-type", "text/html")` would have a charset appended to it. A
+     * handler that builds its own response and writes it with writeHead is how every meta-framework
+     * on top of Express answers, @astrojs/node and @sveltejs/adapter-node included, so the charset
+     * was being added to pages nobody asked it for.
+     *
      * @param {number} statusCode
-     * @param {string|Record<string, any>} [statusMessage] the reason phrase, or the headers
-     * @param {Record<string, any>} [headers]
+     * @param {string|Record<string, any>|any[]} [statusMessage] the reason phrase, or the headers
+     * @param {Record<string, any>|any[]} [headers]
      * @returns {this}
      */
     writeHead(statusCode, statusMessage, headers) {
@@ -605,8 +612,22 @@ module.exports = class Response extends LazyWritable {
             // string reaching here was already taken as the phrase above and simply has no keys.
             headers = /** @type {Record<string, any>} */ (statusMessage);
         }
+        if (Array.isArray(headers)) {
+            // node takes a flat list here, name then value, and not a list of pairs. An odd length
+            // is the caller's mistake and node names the argument in what it throws
+            if (headers.length % 2 !== 0) {
+                /** @type {NodeJS.ErrnoException} */
+                const err = new TypeError(`The argument 'headers' is invalid. Received ${JSON.stringify(headers)}`);
+                err.code = "ERR_INVALID_ARG_VALUE";
+                throw err;
+            }
+            for (let i = 0; i < headers.length; i += 2) {
+                this.setHeader(headers[i], headers[i + 1]);
+            }
+            return this;
+        }
         for (const header in headers) {
-            this.set(header, headers[header]);
+            this.setHeader(header, headers[header]);
         }
         return this;
     }