protocol.zip carries two copies of cookie; resolves when @hellocoop/api moves to cookie 2

[dickhardt]

protocol/ moved cookie 1.1.1 → 2.0.1 on chore/deps-latest (ESM-only, Node ≥22; serialize(name, value, opts) → stringifySetCookie({ name, value, ...options }) at both call sites in protocol/index.ts; the emitted CJS loads it via require(esm) on Node 24, output verified identical). @hellocoop/api 2.6.0 still depends on cookie ^1, nested at protocol/node_modules/@hellocoop/api/node_modules/cookie, so dist/protocol.zip carries both 1.1.1 and 2.0.1 (~10 KB).

Resolves when @hellocoop/api moves to cookie 2, which is blocked on the packages-js engines major (hellocoop/packages-js#70). Alternative: protocol/ drops its own cookie dependency and uses a serializer exported by @hellocoop/api, if one is added.

Related: protocol/'s build runs npm i @hellocoop/api@latest inside npm run build, which mutates protocol/package.json and its lockfile at build time (a no-op today because 2.6.0 is latest). Replace with an explicit bump step so builds are reproducible.

Found during the Node 24 / dependency upgrade, 2026-09-06 (see chore/deps-prune branch)