Skip to content
ergo

All versions since [0.6.1]

All versions

[0.6.1]

Documentation

  • JSDoc @example blocks updated to 0.6.0 bare compose API. (#161) Replaced explicit {fn, setPath} wrappers with bare function calls for built-in middleware in orchestration examples across http/main.js, http/index.js, http/handler.js, and http/validate.js. Corrected @fileoverview compose reference in http/main.js (stale tuple pattern from pre-v0.4.0).

  • README Quick Start updated to 0.6.0 bare compose API. (#160) Replaced explicit {fn, setPath} wrappers with bare function calls for built-in middleware in both JS and TS examples. Added a note explaining that {fn, setPath} config objects remain available for custom middleware. Expanded the middleware overview table with 4 missing entries: handler, tracing, paginate, idempotency.

[0.7.0]

Changed

  • IdempotencyStore eviction lookup is now O(1) via internal side index. (#239) Added a _completeKeys Set as a secondary index tracking keys with complete status. Eviction in set() now uses _completeKeys.values().next().value instead of scanning the entire _entries Map. Under sustained load where all entries are in-flight (processing), worst-case eviction was previously O(maxKeys); it is now O(1) for the common case (complete entries available) with unchanged fallback behavior (oldest processing entry evicted with warning). Internal optimization only — no public API changes; custom store implementations are unaffected.

  • Prefer header parser normalizes preference names and values to lowercase. (#235) Preference names are lowercased per RFC 7240 §2 (case-insensitive comparison). Preference values are also lowercased as a Postel’s Law leniency for practical interoperability — all IANA-registered preference values are lowercase tokens. A client sending Prefer: Return=Minimal now produces {return: 'minimal'} instead of {Return: 'Minimal'}. Non-breaking for well-behaved clients: standard RFC 7240 inputs already use lowercase.

  • IdempotencyStore eviction is now status-aware with generation token validation. (#225) set() now prunes expired entries before checking capacity, preferentially evicts complete entries over processing entries, and returns a generation token (string). complete(key, response, generation) accepts the generation token and returns boolean (true on success, false when the entry is absent, evicted, or the generation token mismatches). Passing undefined or null as response returns false without mutating the entry. When all entries are processing and a new entry must be stored, the oldest processing entry is evicted and a one-time process.emitWarning is emitted with {type: 'ErgoWarning', code: 'ERGO_IDEMPOTENCY_PROCESSING_EVICTED'}. Custom store implementations must update set() to return a string and complete() to accept a third generation parameter and return boolean.

  • Prefer header parser enforces RFC 7240 token/quoted-string grammar. (#219) Replaced the loose regex with a character-by-character scanner that enforces RFC 9110 §5.6.2 token and §5.6.4 quoted-string grammars. Preference names now accept the full tchar set (digits, !, #, etc. at any position). Quoted values handle backslash escapes (quoted-pair) and reject bare control characters. Commas inside quoted values no longer break parsing. Malformed preferences are silently skipped (graceful degradation). Non-breaking: valid RFC 7240 inputs produce identical output; previously-accepted invalid inputs may now be skipped.

  • formatLinkHeader href validation replaced with RFC 3986 URI-reference character allowlist. (#207) Previously rejected only CR, LF, NUL, and > via a four-character denylist. Now validates against the full RFC 3986 §2 URI-reference character repertoire — only unreserved, reserved, and well-formed percent-encoded triplets (%XX) are accepted. Bare % signs and malformed sequences like %GG or %2 are rejected. Callers passing href values with spaces, <, {, }, \, ^, `, or | will now receive a TypeError. Callers producing IRIs must percent-encode non-ASCII characters before calling formatLinkHeader.

Added

  • keyGenerator option on idempotency() for store key scoping. (#227) Transforms the parsed Idempotency-Key header value into a scoped store key via (parsedKey, req, domainAcc) => string. Enables multi-tenant isolation by binding keys to auth principal, route, or HTTP method — per IETF draft-ietf-httpapi-idempotency-key-header-07 §5 composite key recommendation. Defaults to identity (unscoped), preserving existing behavior. Follows the rateLimit() keyGenerator pattern.

  • redactHeaders option on handler() for onResponse hook header redaction. (#181) Controls which response headers are replaced with '[REDACTED]' in the responseInfo snapshot passed to onResponse hooks. Defaults to authorization, proxy-authorization, cookie, set-cookie — the same set used by logger(). Pass an empty Set to disable redaction.

  • lib/redact-headers.js shared redaction primitive. (#181) Exports DEFAULT_REDACTED_HEADERS and redactHeaders(headers, redactSet). Extracted from http/logger.js’s private implementation. Available via deep import @centralping/ergo/lib/redact-headers.

  • Factory-time warning for CORS wildcard + credentials misconfiguration. (#177) cors({origins: '*', allowCredentials: true}) now emits a one-time process.emitWarning with {type: 'ErgoWarning', code: 'ERGO_CORS_WILDCARD_CREDENTIALS'}. Behavior is unchanged — origin reflection still works. The warning surfaces the OWASP-documented misconfiguration footgun at startup.

  • MemoryStore.reset() method for test isolation. (#165) Clears all tracked keys, restoring the store to its initial state. Enables integration tests that share a single store instance to reset rate-limit counters between test cases without reconstructing the middleware or router.

Fixed

  • MemoryStore constructor validates maxKeys and now parameters. (#230) maxKeys must be a positive integer; now must be a function. Invalid values that previously caused silent misconfiguration (e.g. maxKeys: null coercing to 0 in the eviction guard, making the store behave as a single-entry cache) now throw TypeError at construction time. Default construction is unaffected.

  • IdempotencyStore defensive coding improvements. (#226) Three hardening fixes for the public IdempotencyStore primitive: (1) constructor validates maxKeys (positive integer) and ttlMs (positive finite number), throwing TypeError for invalid types that previously caused silent misconfiguration; (2) get() returns a frozen deep clone instead of the live internal entry, preventing callers from corrupting store state via mutation of any nested field; (3) complete() deep-clones the response object via structuredClone, preventing post-call mutation of the original (including nested objects) from affecting stored replay data. Existing valid usage is unaffected — only previously-invalid constructor arguments now throw.

  • Cookie attribute validation uses per-attribute RFC grammars. (#218) domain validates against RFC 1034/1123 subdomain grammar (alphanumeric labels with hyphens, dot-separated, optional leading dot). path validates against RFC 6265 §4.1.2.4 path-value (any CHAR except CTLs or semicolons). sameSite validates against the RFC 6265bis {Strict, Lax, None} enum (case-insensitive). Previously all three attributes incorrectly used the cookie-octet grammar intended only for cookie values. Domain now rejects injection characters (!, #, $, *) that are invalid in DNS names. Path now accepts spaces and commas that are valid per RFC 6265. SameSite now rejects arbitrary strings that do not match the enum.

  • validateLocation uses RFC 3986 URI-reference character allowlist. (#217) Replaces the three-character denylist (CONTROL_STRIP_RE) that only stripped tab, CR, and LF. Now rejects all characters not permitted in a URI-reference — NUL, C0 controls, DEL, non-ASCII, bare percent signs, and malformed percent-encoding are caught. Follows the same allowlist pattern applied in formatLinkHeader (#207), sanitizeQuotedString (#208), and cookie-octet validation (#206).

  • parseIdempotencyKey uses RFC 8941 sf-string allowlist instead of permissive denylist. (#220) Replaced the SF_STRING_RE regex (permissive negated character class [^"\\]) with a positive allowlist derived from RFC 8941 §3.3.3’s unescaped (%x20-21 / %x23-5B / %x5D-7E) and escaped ("\" ( DQUOTE / "\" )) productions. CTL characters (\x00–\x1F, \x7F), non-ASCII bytes (\x80+), and HTAB (\x09) in the inner string are now correctly rejected. The denylist escape check is eliminated — the regex itself rejects invalid escape sequences at the match stage. Previously-accepted malformed keys will now produce 400 responses (only invalid inputs are affected; all valid RFC 8941 sf-strings continue to parse correctly).

  • Parsed JSON bodies use null-prototype objects at all nesting levels. (#214) acc.body.parsed now returns objects created via Object.create(null) at every depth, aligning with the null-prototype policy enforced by query, cookie, and Prefer parsers. Applies to both the identity-encoded fast path and the compressed-body lazy getter path.

  • JSDoc bare {Buffer} replaced with {import('node:buffer').Buffer}. (#213) Two annotations in lib/idempotency.js (1) and http/body.spec.unit.js (1) used bare Buffer without the import('node:...') form required by JSDoc conventions.

  • sanitizeQuotedString uses qdtext allowlist instead of CTL denylist. (#208) Replaced the control-character denylist regex with a positive allowlist derived from the RFC 7230 §3.2.6 qdtext and quoted-pair productions. Behavior is preserved for the previous CTL cases (NUL–BS, LF–US, DEL), and the sanitizer now also strips characters outside the quoted-string latin1 allowlist. Defense-in-depth improvement: any character not explicitly allowed is now stripped rather than relying on enumerating forbidden characters.

  • Cookie value validation uses RFC 6265 cookie-octet allowlist. (#206) Replaces the denylist regex (COOKIE_VALUE_UNSAFE_RE) with an anchored allowlist (COOKIE_VALUE_RE) matching RFC 6265 §4.1.1 cookie-octet grammar. Now correctly rejects non-ASCII bytes (\x80-\xFF) that the denylist missed. Aligns with the allowlist patterns already used by assertSafeName (TOKEN_RE) and the parser (valueRFC6265).

  • Location header rejects dangerous URI schemes. (#188) send() validates responseAcc.location against javascript:, data:, and vbscript: schemes before setting the Location header. Throws TypeError for blocked schemes, providing defense-in-depth against CWE-601 XSS via open redirect.

  • JSDoc bare {Array} annotations replaced with {*[]} shorthand. (#187) Five annotations in lib/paginate.js (4) and utils/flat-array.js (1) used imprecise {Array} without type parameters. Replaced with the {*[]} shorthand for consistency with the codebase’s parameterized {Array<T>} convention.

  • Logger error() callback now redacts sensitive error details by default. (#183) When redactErrors is true (default), the error callback logs generic HTTP status text instead of err.message, and suppresses err.stack and err.originalError. Prevents sensitive error details (database connection strings, file paths, token validation messages) from leaking into structured log output. Mirrors handler()’s redactErrors behavior for HTTP response bodies, applied to the log output boundary.

  • ajv-formats default mode changed from full to fast (ReDoS mitigation). (#182) The default format validation mode now uses simplified regexes that are safe for untrusted input. Full-mode regexes for date, time, date-time, duration, uri, uri-reference, email, and idn-email are vulnerable to ReDoS with crafted payloads. Selective format arrays (e.g. formats: ['email']) continue to use full-mode regexes — ajv-formats does not support per-format mode selection. Opt in to full mode via {mode: 'full'} when strict RFC compliance is required and input sources are trusted.

  • Logger preserves empty-string request IDs (nullish coalescing). (#186) http/logger.js request-ID resolution chain now uses ?? instead of ||. An upstream proxy sending x-request-id: "" is treated as a present value rather than falling through to UUID generation.

  • Validation error path uses RFC 6901 empty string for root-level errors. (#186) lib/validate.js formatError no longer maps AJV’s empty-string instancePath to '/'. Per RFC 6901, the empty string is the correct JSON Pointer representation of the root document. Consumers matching details[].path === '/' for root-level errors should update to === ''.

  • buildResponseInfo now redacts sensitive response headers. (#181) Previously, buildResponseInfo passed res.getHeaders() directly into the response info snapshot without redaction. The onResponse hook could leak set-cookie, authorization, proxy-authorization, and cookie headers even when http/logger.js correctly redacted them. The function now accepts an optional redactSet parameter, and handler() forwards its redactHeaders option (defaulting to the same 4-header set as the logger).

  • handler() send catch block now emits errors for observability. (#179) The send() catch block previously used a bare catch without capturing the error, silently swallowing serialization failures. The error is now emitted on res via the guarded listenerCount('error') > 0 pattern (enabling http/logger.js error callbacks) and recorded on the OTEL span via span.recordException() for distributed tracing visibility. Matches the pipeline catch block’s established observability convention. Additionally, responseAcc.statusCode is now set to 500 in the send catch so the OTEL span finalization reads the correct status instead of the pipeline’s stale value.

  • Pagination prev link clamped to last page when page exceeds total. (#180) paginationLinks now generates prev pointing to lastPage instead of page - 1 when the requested page is beyond the last page, preventing clients from navigating through a chain of non-existent pages.

  • Logger redact() uses null-prototype object. (#178) The redact() helper in http/logger.js now uses Object.create(null) instead of {} for the header copy, aligning with the null-prototype policy for user-input-derived objects.

  • BodyResult.parsed type narrowed from optional to required. (#174) The parsed field was incorrectly declared as parsed?: T despite the body() middleware guaranteeing its presence on every success path (both the fast JSON path and the lazy-getter path). Consumers no longer need non-null assertions or optional chaining to access acc.body.parsed.

Documentation

  • README: elevate benchmark discoverability. (#166) Adds a “Benchmarked” bullet to the “Why ergo?” section, surfacing the published benchmarks page link within the first screenful of the README.

[0.8.0]

Added

  • validate() now validates option keys at factory time. (#320) The options parameter (second argument) is validated against the recognized keys (formats, allErrors, coerceTypes, ajv) using the shared lib/validate-options.js utility. Typos like {format: ['email']} now emit an ERGO_VALIDATE_UNKNOWN_OPTION warning with a “did you mean?” suggestion, matching the behavior of all other middleware factories. The ValidateOptions TypeScript interface is tightened to list all four accepted fields explicitly (index signature removed).

Changed

  • OTEL span attributes use stable HTTP semantic conventions. (#324) Replaced deprecated pre-v1.20 attribute names with the stable conventions declared in November 2023: http.method → http.request.method, http.url → url.path + url.query, http.status_code → http.response.status_code. The url.query attribute is set conditionally (only when the request URL contains a ?). Named constants are defined in a new lib/otel-attributes.js module to avoid a runtime dependency on @opentelemetry/semantic-conventions.

  • Wire-format primitives delegated to @centralping/ergo-wire. (#369) Link header formatting, pagination parse/serialize, idempotency key parse/format, and quoted-string sanitization now re-export from @centralping/ergo-wire for symmetric client/server alignment. Server-only code (IdempotencyStore, generateFingerprint, offsetResponse, cursorResponse) remains in ergo. Existing @centralping/ergo/lib/* import paths are unchanged.

  • csrf() validates secret at construction time. (#313) The required secret parameter is now validated at factory time (typeof + length check). Missing or invalid secret throws TypeError immediately instead of deferring the error to the first request. This is the first http/ middleware factory with factory-time required-parameter validation.

Fixed

  • csrf() encoding option now forwarded to verify(). (#308) The encoding factory option was forwarded to issue() but omitted from verify(), causing unconditional CSRF verification failure when a non-default encoding (e.g. 'hex') was configured. verify() now receives the same encoding used at issuance time.

  • Body middleware now eagerly parses all content types within its error boundary. (#323) Compressed JSON, form-urlencoded, and multipart bodies previously used a self-replacing lazy getter on result.parsed that deferred parse execution outside the body middleware’s try/catch scope. When a compressed JSON body was malformed, the parse error propagated to handler.js’s catch-all, producing a 500 Internal Server Error for what is semantically a 400 Bad Request. All paths now parse eagerly within the middleware — malformed compressed JSON correctly returns 400.

  • Authorization middleware now uses explicit {value: info} return wrapping. (#288) Previously, http/authorization.js returned the opaque info object directly on authorization success. If the user’s authorizer returned an object containing value or response keys, extractReturn() in compose-with.js would misinterpret the return as a compose protocol-form object — extracting info.value as the domain result or merging info.response into the response accumulator. The fix wraps the return as {value: info}, consistent with other domain-producing middleware that handle user-controlled data (paginate.js, tracing.js, idempotency.js). No change to composed pipeline behavior — acc.auth still receives the full info object.

  • createDispatcher() prototype poisoning vulnerability. (#254) The scheme-to-handler map in lib/authorization.js used a plain {} reduce accumulator, inheriting Object.prototype. Crafted Authorization headers with scheme names matching prototype properties (e.g., Constructor, __proto__) would bypass the strategy-not-found guard and crash with TypeError — a denial-of-service vector. Replaced with Object.create(null) to align with the project-wide null-prototype policy enforced in all other user-input-keyed parsers.

  • Response compression now recognizes RFC 6838 structured syntax suffixes (+json, +xml). (#307) application/problem+json (ergo’s error format), application/vnd.api+json (JSON:API), and other structured suffix types are now correctly identified as compressible. Previously, only exact application/json and application/xml subtypes triggered compression. The \b word boundary also prevents false matches on types like application/jsonp.

  • Logger double-logging when response stream emits error followed by close. (#312) The error event handler now calls cleanup() before logging, deregistering sibling listeners (finish, close) to prevent the subsequent close event from triggering a spurious “aborted” log entry. All three terminal event handlers (finish, abort via close, error) now follow the same pattern: deregister first, then log. Ensures exactly one structured log entry per request lifecycle outcome.

  • Corrected Vary token typo in CORS preflight responses: Access-Control-Request-Methods (plural) → Access-Control-Request-Method (singular). The previous value referenced a non-existent HTTP header, preventing correct cache-key variance for preflight method negotiation. (#259)

Removed

  • Removed utils/observables module and ./utils/observables export. (#333, #334, #336) The push-based generator coroutine module had zero internal or external consumers. The multipart body parser uses the pull-based utils/iterables/buffer-split instead. Resolves three design findings: dead infrastructure (#333), chain/buffer-split protocol incompatibility (#334), and incorrect “Observable” terminology (#336).

[0.9.0]

Added

  • resolveTimingConfig export from lib/response-time. (#304) Pure factory-time resolver for the timing option (boolean | {header?, precision?}). Returns {header, precision} or undefined when disabled. Consumed by http/handler.js and ergo-router auto-wrap.js so option interpretation lives with the timing primitive.

  • DEFAULT_HSTS_MAX_AGE_SECONDS export from lib/security-headers. (#284) Named constant for the default HSTS max-age (one year = 31_536_000 seconds). buildHstsDirective and JSDoc reference the constant; ergo-router transport should import it instead of duplicating the magic number.

  • STATUS_PROCESSING / STATUS_COMPLETE exports from lib/idempotency. (#271) Named lifecycle constants for IdempotencyStore entry status. Middleware and custom store consumers should compare against these instead of raw string literals. Wire values remain 'processing' / 'complete' (additive, non-breaking).

Changed

  • BREAKING: buildSecurityHeaderTuples validates option values at construction. (#283, #331) Constrained headers (xFrameOptions, referrerPolicy, xContentTypeOptions, xXssProtection) reject non-enum values with TypeError. Free-form directives (CSP, Permissions-Policy, HSTS string) require a non-empty string without CTL characters. HSTS object form requires a non-negative integer maxAge (empty {} no longer silently defaults). Enable guards are unified to Pattern A (value !== false && value); String() coercion on xXssProtection is removed. Invalid undocumented inputs ('', 0, null) throw instead of emitting or omitting.

  • BREAKING: Rate-limit store hit() must return absolute resetAt. (#263) Pluggable stores now return {count, resetMs, resetAt} where resetAt is the absolute window-reset time in milliseconds in the store’s own clock domain. checkRateLimit uses resetAt for X-RateLimit-Reset and no longer calls Date.now(). Custom stores that previously returned only {count, resetMs} must add resetAt (typically now + resetMs using the same clock that produced resetMs). Non-finite resetAt/resetMs fail fast with TypeError.

  • BREAKING: Bearer authorizer failure info uses RFC 6750 property names. (#256) type / desc / uri are renamed to error / error_description / error_uri. The internal errorPropMap translation layer is removed — wire attribute names match the authorizer contract. Update Bearer authorizers accordingly.

  • lib/authorization multi-strategy authenticate is always a string. (#290) When no matching scheme is found, challenges are joined with a comma and space (RFC 7235 §4.1) instead of returning string[]. Aligns with http/authorization header tuples ([string, string][]) and send.js setHeader semantics.

  • lib/authorization scheme dispatch uses a null-prototype map instead of Proxy. (#255) Fixed {basic, bearer, $default} lookup via ?? — same defaulting as the former Proxy Object.hasOwn trap, without Proxy overhead.

  • lib/csrf validates secret/uuid with direct typeof checks. (#269) Replaces TypeError-as-default-parameter sentinels and the utils/type.js import with the same typeof x !== 'string' → throw new TypeError(...) pattern used by http/csrf and other lib/ constructors. Error messages for missing parameters are unchanged. Non-string values that previously reached createHmac now fail with the same TypeError. Empty-string secrets remain allowed at the lib primitive (the HTTP factory still rejects them at construction).

Removed

  • http/main.js no longer provides a default export object. (#297) The manually mirrored export default { ... } had drifted from named exports (createResponseAcc, mergeResponse were named-only) and was already unreachable from the package entry (export * does not re-export default). Named exports are unchanged. Affects only the ./http/main subpath for any consumer of import x from '@centralping/ergo/http/main'.

  • http/main.js no longer declares @module @centralping/ergo. (#299) Canonical package module identity remains on http/index.js only; main.js now uses @module http/main like other internal http/ modules.

Fixed

  • http/cache-control validates structured options at construction and exports DEFAULT_DIRECTIVES. (#296, #300, #302) Named constant DEFAULT_DIRECTIVES ('private, no-cache') replaces the magic-string fallback. Factory throws TypeError when a delta-seconds option (maxAge, sMaxAge, staleWhileRevalidate, staleIfError) is not a non-negative integer, when public and private are both set, or when noStore is combined with freshness directives. Raw directives strings remain unvalidated. Matches the csrf / rate-limit factory-time value-validation pattern.

  • http/rate-limit validates option values at construction and includes X-RateLimit-* on 429. (#264, #265, #327) Named defaults DEFAULT_MAX_REQUESTS / DEFAULT_WINDOW_MS replace magic-number destructuring. Factory throws TypeError for invalid max, windowMs, store, or keyGenerator (keys-only validateOptions was previously the only check). Limited responses now return the same three X-RateLimit-* header tuples as allowed responses (parity with transport rate-limit).

  • http/idempotency skip paths return undefined instead of {}. (#319) Method-not-applicable and optional missing-key paths now use bare return so compose-with leaves acc.idempotency unset (DECISIONS: undefined/null skip all merges). Previously return {} wrote an empty object via extractReturn. IdempotencyResult no longer includes Record<string, never>.

  • http/idempotency validates methods and keyGenerator at construction. (#321) Throws TypeError when methods is not a non-empty Set or Array of non-empty strings (rejects the new Set('POST') string footgun) or when keyGenerator is provided but not a function. Matches the csrf / IdempotencyStore factory-time value-validation pattern. Validated methods are always copied into a new Set so caller mutation after construction cannot change middleware behavior.

  • http/compress forwards the Writable.end callback on the compression path. (#314) Previously compressedEnd dropped cb when piping through zlib and the compressor 'end'/'error' handlers called origEnd() with no callback. The patched res.end now normalizes Node overloads, captures the callback, invokes it on compressor finish, and passes the error to the callback on compressor failure.

  • http/compress threshold uses the string encoding argument for byte length. (#317) Buffer.byteLength(chunk) always measured UTF-8; res.end(str, 'latin1') (and other non-UTF-8 encodings) could compress or skip incorrectly. Size is now Buffer.byteLength(chunk, encodingArg).

  • CSRF UUID cookie locks httpOnly: true after cookieOptions spread. (#318) The token cookie already forced httpOnly: false and sameSite: 'Strict' after the spread; the UUID cookie only forced sameSite. Callers passing cookieOptions: {httpOnly: false} could make the UUID cookie JavaScript-readable. Both cookies now lock their httpOnly/sameSite attributes symmetrically. Regression tests cover UUID httpOnly and both cookies’ sameSite locks.

  • utils/set uses strict digit-only array-index detection. (#353) Intermediate nodes are Arrays only when the next path segment matches /^\d+$/. Previously, permissive Number() coercion treated '', -1, Infinity, 0x1, and 1e2 as numeric and created Arrays with non-index properties (reachable via query paths like fields[a..b]=x).

  • utils/set throws a descriptive path-conflict TypeError. (#354) Reusing a primitive or null intermediate now throws with message context and stable code: 'ERGO_SET_PATH_TRAVERSE' instead of an opaque engine assignment error. New trySet() returns false for library-minted path conflicts only (identity-branded errors; rethrows unexpected errors including code-spoofed TypeErrors); lib/query.js uses it for first-wins skip so inputs like a=42&a[b]=99 no longer 500 through url() middleware. First-wins is bidirectional over path containers (#379, #380, #381, #382): nested-then-scalar preserves earlier nests; Array↔object shape is locked (non-index under Array and index under plain object both skip) while numeric indices under Arrays (role[0]=user&role[1]=admin) and sibling object keys remain allowed; scalar-then-[] also first-wins.

  • utils/set rejects __proto__ / prototype / constructor path segments. (#383) Function intermediates remain valid for ordinary own properties (handler.timeout), but those three segments always throw ERGO_SET_PATH_TRAVERSE so callers cannot write through .prototype onto shared builtins.

  • lib/query.js accumulates pairs in a Map so first-wins follows source order. (#384) Intermediate accumulation previously used a null-prototype object + Object.entries, which reorders integer-like keys (V8 integer-index order). That inverted 1[a]=x&1=y into a scalar win. Pair iteration now preserves insertion order; the returned accumulator remains Object.create(null).

  • lib/query.js first-wins covers path aliases and occupied leaves. (#385) Distinct wire forms that normalize to the same dotted path (a.b=1&a[b]=2) no longer last-write via trySet. Any own value already at the destination path wins (scalars, containers, and array slots), so a[]=1&a[0]=2 also keeps the first slot value.

  • utils/set rejects unsafe intrinsic intermediates and Array length assignment. (#386–#389) Path root and reuse reject constructor .prototype objects, host objects reachable from globalThis at module load (depth-limited graph of own keys / prototype accessors — Intl, Proxy, crypto.subtle, process._events, Array.prototype.push, Intl.NumberFormat.prototype.format, …), and Proxies. Proxy and host checks run before Array/null-proto shortcuts so Proxy(Array.prototype) and null-proto hosts cannot write through. Ordinary functions (including per-instance bound methods created after module load), non-host null-proto objects, Arrays, and user class instances remain valid intermediates. Host matching is identity-based within the JavaScript realm where the module initializes; callers must not pass host-owned globals or intrinsics from another realm (for example, a node:vm context) as roots or intermediates (#395). Assigning or creating length on an Array, TypedArray, DataView, Buffer, or arguments (leaf or intermediate — TypedArray/Buffer/DataView expose non-own length, so intermediate create must reject before shadowing) is forbidden (#393); digit indices above MAX_ARRAY_INDEX (1024) are rejected by numeric value only when indexing an Array (leading zeros allowed when in range; plain-object / top-level digit keys unconstrained; sparse DoS bound; full numeric-bracket design remains #280). Missing intermediates are defined as own data properties so inherited setters cannot hijack traversal; existing own leaves keep ordinary assignment semantics. Path planning snapshots accessor results once so stateful getters cannot flip container type between Array-index bounds checks and writes. Plain-object .length remains allowed.

  • lib/query.js options use own properties only. (#392) Parser options are copied into a null-prototype via Object.assign so polluted Object.prototype.maxPairs / maxLength / split cannot disable DoS caps or alter comma-split defaults.

  • utils/set clarity refactor preserves return value. (#355) The dense parenthesized assignment body is split into explicit statements while still returning the assigned value (public @centralping/ergo/utils/set export — non-breaking).

[Unreleased] Latest

Fixed

  • logger() lowercases header name options at construction. (#316) headerRequestIdName / headerRequestIpName are normalized with .toLowerCase() so req.headers[...] lookups match Node’s lowercased incoming header keys (RFC 9110 §5.1). Mixed-case values such as 'X-Request-Id' no longer silently miss the proxy header and fall through to UUID / missing IP. Non-string values throw TypeError at construction (logger(): "…" option must be a string), matching the rate-limit / timeout / handler factory-time value-validation pattern.

  • http/timeout validates option values at construction and names default constants. (#303, #306) Named defaults DEFAULT_TIMEOUT_MS / DEFAULT_STATUS_CODE (via STATUS_CODE_REQUEST_TIMEOUT / STATUS_CODE_GATEWAY_TIMEOUT) replace magic-number destructuring. Factory throws TypeError when ms is not a positive finite number, when ms exceeds MAX_TIMEOUT_MS (Node setTimeout signed 32-bit max — larger values clamp to 1 ms), or when statusCode is not 408 or 504 (keys-only validateOptions was previously the only check). Matches the rate-limit factory-time value-validation pattern.

  • handler() throws TypeError at construction when pipeline or onResponse is not a function. (#309) Factory previously accepted invalid types and deferred failure to the first request (pipeline → perpetual 500; truthy non-function onResponse → silently swallowed). Matches the rate-limit / idempotency construction-time value-validation pattern.