@suveren/gateway 0.17.0 → 0.18.1

package/node_modules/htmlparser2/src/WebWritableStream.ts

@@ -0,0 +1,47 @@
+import { type Handler, Parser, type ParserOptions } from "./Parser.js";
+
+/**
+ * WebWritableStream makes the `Parser` interface available as a Web Streams API WritableStream.
+ *
+ * This is useful for piping `fetch()` response bodies directly into the parser.
+ * @see Parser
+ * @example
+ * ```typescript
+ * import { WebWritableStream } from "htmlparser2/WebWritableStream";
+ *
+ * const stream = new WebWritableStream({
+ *     onopentag(name, attribs) {
+ *         console.log("Opened:", name);
+ *     },
+ * });
+ *
+ * const response = await fetch("https://example.com");
+ * await response.body.pipeTo(stream);
+ * ```
+ */
+// eslint-disable-next-line n/no-unsupported-features/node-builtins -- Web Streams API; requires a runtime with WritableStream (browsers, Deno, Node ≥18.0)
+export class WebWritableStream extends WritableStream<string | Uint8Array> {
+    constructor(cbs: Partial<Handler>, options?: ParserOptions) {
+        const parser = new Parser(cbs, options);
+        const decoder = new TextDecoder();
+        const streamOption: TextDecodeOptions = { stream: true };
+
+        super({
+            write(chunk) {
+                parser.write(
+                    typeof chunk === "string"
+                        ? chunk
+                        : decoder.decode(chunk, streamOption),
+                );
+            },
+            close() {
+                // Flush any remaining bytes in the decoder
+                const remaining = decoder.decode();
+                if (remaining) {
+                    parser.write(remaining);
+                }
+                parser.end();
+            },
+        });
+    }
+}

package/node_modules/htmlparser2/src/WritableStream.ts

@@ -0,0 +1,42 @@
+/*
+ * NOTE: If either of these two imports produces a type error,
+ * please update your @types/node dependency!
+ */
+import { Writable } from "node:stream";
+import { StringDecoder } from "node:string_decoder";
+import { type Handler, Parser, type ParserOptions } from "./Parser.js";
+
+// Following the example in https://nodejs.org/api/stream.html#stream_decoding_buffers_in_a_writable_stream
+function isBuffer(_chunk: string | Buffer, encoding: string): _chunk is Buffer {
+    return encoding === "buffer";
+}
+
+/**
+ * WritableStream makes the `Parser` interface available as a NodeJS stream.
+ * @see Parser
+ */
+export class WritableStream extends Writable {
+    private readonly _parser: Parser;
+    private readonly _decoder = new StringDecoder();
+
+    constructor(cbs: Partial<Handler>, options?: ParserOptions) {
+        super({ decodeStrings: false });
+        this._parser = new Parser(cbs, options);
+    }
+
+    override _write(
+        chunk: string | Buffer,
+        encoding: string,
+        callback: () => void,
+    ): void {
+        this._parser.write(
+            isBuffer(chunk, encoding) ? this._decoder.write(chunk) : chunk,
+        );
+        callback();
+    }
+
+    override _final(callback: () => void): void {
+        this._parser.end(this._decoder.end());
+        callback();
+    }
+}

package/node_modules/htmlparser2/src/index.ts

@@ -0,0 +1,86 @@
+import { Parser, type ParserOptions } from "./Parser.js";
+
+export type { Handler, ParserOptions } from "./Parser.js";
+export { Parser } from "./Parser.js";
+
+import {
+    type Document,
+    DomHandler,
+    type DomHandlerOptions,
+    type Element,
+} from "domhandler";
+
+export {
+    DomHandler,
+    // Old name for DomHandler
+    DomHandler as DefaultHandler,
+    type DomHandlerOptions,
+} from "domhandler";
+
+/**
+ * Combined parser and handler options.
+ */
+export type Options = ParserOptions & DomHandlerOptions;
+
+// Helper methods
+
+/**
+ * Parses the data, returns the resulting document.
+ * @param data The data that should be parsed.
+ * @param options Optional options for the parser and DOM handler.
+ */
+export function parseDocument(data: string, options?: Options): Document {
+    const handler = new DomHandler(undefined, options);
+    new Parser(handler, options).end(data);
+    return handler.root;
+}
+
+/**
+ * Creates a parser instance, with an attached DOM handler.
+ * @param callback A callback that will be called once parsing has been completed, with the resulting document.
+ * @param options Optional options for the parser and DOM handler.
+ * @param elementCallback An optional callback that will be called every time a tag has been completed inside of the DOM.
+ */
+export function createDocumentStream(
+    callback: (error: Error | null, document: Document) => void,
+    options?: Options,
+    elementCallback?: (element: Element) => void,
+): Parser {
+    const handler: DomHandler = new DomHandler(
+        (error: Error | null) => callback(error, handler.root),
+        options,
+        elementCallback,
+    );
+    return new Parser(handler, options);
+}
+
+/*
+ * All of the following exports exist for backwards-compatibility.
+ * They should probably be removed eventually.
+ */
+export * as ElementType from "domelementtype";
+export {
+    type Callbacks as TokenizerCallbacks,
+    default as Tokenizer,
+    QuoteType,
+} from "./Tokenizer.js";
+
+import { type Feed, getFeed } from "domutils";
+
+export { type Feed, getFeed } from "domutils";
+
+const parseFeedDefaultOptions = { xmlMode: true };
+
+/**
+ * Parse a feed.
+ * @param feed The feed that should be parsed, as a string.
+ * @param options Optionally, options for parsing. When using this, you should set `xmlMode` to `true`.
+ */
+export function parseFeed(
+    feed: string,
+    options: Options = parseFeedDefaultOptions,
+): Feed | null {
+    return getFeed(parseDocument(feed, options).children);
+}
+
+export * as DomUtils from "domutils";

package/node_modules/launder/.travis.yml

@@ -0,0 +1,4 @@
+language: node_js
+node_js:
+  - "stable"
+  - "lts/*"

package/node_modules/launder/CHANGELOG.md

@@ -0,0 +1,80 @@
+# Changelog
+
+## 1.7.2 (2026-09-30)
+
+### Fixes
+
+- The `launder` package was missing its LICENSE.md file. The license type was always correctly stated as MIT.
+  Thanks to Leonardo Cardozo Vargas for pointing out the omission.
+
+## 1.7.1
+
+### Security
+
+- `launder` now uses and exports the best available naughtyHref function for detecting malicious URLs. sanitize-html now depends on it, and apostrophe now uses type: 'url' for the link URL field of image widgets, which leverages it. Prior to this fix, it was possible for any user with editing privileges, including a contributor, to trigger arbitrary JavaScript via a javascript: URL in the link URL field of an image widget. A migration has been included to strip any such malicious URLs already present in the database. All users of apostrophe are encouraged to upgrade to get this security fix. Thanks to [Muhammad Uwais](https://github.com/MuhammadUwais) for reporting the issue.
+
+## 1.7.0 - 2023-05-03
+
+- Modernize dependencies to correct installation warnings, and eliminate use of `var`.
+
+## 1.6.0 - 2023-03-06
+
+- `sms:` urls are now accepted. Thanks to [Ruben](https://github.com/reubendsouza) for this change.
+
+## 1.5.1 - 2021-10-28
+
+- The `date` method now correctly returns `null` if the date argument is unparseable and the `def` parameter is explicitly `null`. As was always documented, a default of `undefined` still returns the current date.
+
+## 1.5.0
+
+- The `url` method now accepts a third argument, `httpsFix`. If it is `true` and the URL passed in has no protocol, the URL will be prepended with `https://` rather than `http://`.
+
+## 1.4.0
+
+- `tel:` urls are now accepted.
+
+## 1.3.0
+
+- `booleanOrNull` accepts the string `'null'` as a synonym for `null`. Note that `'any'` was already accepted. `'null'` can be an attractive choice when the user will not see it in the query string and conflict with other uses of `'any'` is a concern.
+
+## 1.2.0
+
+- `idRegExp` option may be passed to change the rules for `launder.id`.
+
+## 1.1.2
+
+- linting.
+
+## 1.1.1
+
+- for improved bc, `launder.select` does not crash if some of the choices given to `select` are null or undefined. Although this is a developer error rather than a sanitization issue, versions prior to 1.1.0 did tolerate this situation, so 1.1.1 does so as well. Thanks to Anthony Tarlao for his code contributions, and to Michelin for making this fix possible via [Apostrophe Enterprise Support](https://apostrophecms.com/support/enterprise-support).
+
+## 1.1.0
+
+- `launder.select` now handles numeric values for choices gracefully. Specifically, if the value passed in is a string, it will be validated as a match for a choice that is a number, as long as they have the same string representation, and the number (not the string) will be returned. Previously there was no match in this situation.
+
+Thanks to Michelin for making this possible via [Apostrophe Enterprise Support](https://apostrophecms.com/support/enterprise-support).
+
+## 1.0.1
+
+- `launder.time` will now also accept a `.` (dot) as the separator (until now only `:` colon was recognized). Thanks to Lars Houmark.
+
+## 1.0.0
+
+- switched to a maintained, secure fork of lodash 3, declared 1.0.0 as this has been a stable part of Apostrophe for years.
+
+## 0.1.3
+
+- `launder.booleanOrNull` broken out from `launder.addBooleanFilterCriteria` so that you can get the tri-state value without modifying a criteria object.
+
+## 0.1.2
+
+- `launder.tags` also accepts a comma-separated string.
+
+## 0.1.1
+
+- removed never-used and undocumented `parseTime` method.
+
+## 0.1.0
+
+- initial release. Based on stable code recently refactored from Apostrophe 0.5.x.

package/node_modules/launder/LICENSE.md

@@ -0,0 +1,7 @@
+Copyright (c) 2021 Apostrophe Technologies, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/node_modules/launder/README.md

@@ -0,0 +1,177 @@
+<a href="https://apostrophecms.com/"><img src="https://raw.github.com/apostrophecms/launder/master/logos/logo-box-madefor.png" align="right" /></a>
+
+A sanitization module for the people. Built for use in the [ApostropheCMS](https://apostrophecms.com), useful for many other things.
+
+## Purpose
+
+Launder can be used to sanitize strings, integers, floats, urls, and more. It's best for cases where you've already used front-end validation to encourage smart input, and now you want to make sure your inputs are reasonable.
+
+Launder does not always assume your data is a string, which makes it highly compatible with the use of JSON to deliver data from browser to server. For instance, `launder.boolean` accepts the actual JavaScript values `true` and `false` as well as various string representations.
+
+Launder's support for dates and times permits users to enter both in colloquial formats like `8/25` or `3pm` and "just does the right thing," converting to `2015-08-25` and `15:00:00` respectively.
+
+In addition to sanitization methods, Launder does contain a few other tools, such as `formatDate` and `formatTime` which simply output a Date object in the `2015-08-25` and `15:00:00` formats.
+
+## Usage
+
+```javascript
+const launder = require('launder')();
+
+app.post('/form', function(req, res) {
+  const units = launder.integer(req.body.units, 0, 0, 100);
+  const birthdate = launder.date(req.body.birthdate);
+});
+```
+
+You can also specify global options:
+
+```javascript
+const launder = require('launder')({
+  filterTag: function(tag) { return tag.toLowerCase(); }
+});
+```
+
+## Frequently used methods
+
+### `launder.string(s, def)`
+
+Converts `s` to a string. `s` is coerced to a string, then leading and trailing whitespace is trimmed. If `def` is provided, it is returned when the string is empty or the value passed is not a string. If `def` is undefined, empty strings are left alone, and values that are not strings become empty strings.
+
+### `launder.strings(arr)`
+
+If `arr` is an array, each element is sanitized with `launder.string`, and a new array containing the result is returned. If `arr` is not an array, an empty array is returned.
+
+### `launder.integer(i, def, min, max)`
+
+Converts `i` to an integer. `i` is first coerced to an integer, if needed; if it is an empty string, undefined or otherwise not convertible, `def` is returned. If `min` is provided, and the result would be less than `min`, `min` is returned. If `max` is provided, and the result would be greater than `max`, `max` is returned. If `def` is not provided, the default is `0`. If a number has a fractional part it is discarded, not rounded.
+
+### `launder.float(f, def, min, max)`
+
+Converts `f` to a floating-point number. `f` is first coerced to a floating-point number, if needed; if it is an empty string, undefined or otherwise not convertible, `def` is returned. If `min` is provided, and the result would be less than `min`, `min` is returned. If `max` is provided, and the result would be greater than `max`, `max` is returned. If `def` is not provided, the default is `0`.
+
+### `launder.url(s, def, httpsFix)`
+
+Attempts to ensure that `s` is a valid URL. This method allows only the `http:`, `https:`, `ftp:`, `mailto:`, `tel:` and `sms:` URL schemes, but does allow relative URLs.
+
+It attempts to automatically fix common user mistakes such as typing: `www.mycompany.com` or `www.mycompany.com/my/page.html`, not supplying the URL protocol. By default it prepends `http://`. If `httpsFix` is `true`, it prepends `https://`.
+
+`s` is first sanitized with `launder.string()`.
+
+`def` is returned if the input is an empty string, not convertible to a URL, or suspicious (such as a `javascript:` URL). Spaces are removed as they are ignored by browsers in a surprising number of situations.
+
+### `launder.select(choice, choices, def)`
+
+Sanitize a choice made via a `select` element. If `choice` is one of the `choices`, it is returned, otherwise `def` is returned. If `choices` is an array of objects, then `choice` is compared to the `value` property of each object to find a match.
+
+Choices can be numbers or strings. The choices and the input value are compared as strings. The matching choice is returned with its original type.
+
+### `launder.boolean(b, def)`
+
+Sanitize a boolean value.
+
+If the value is any of the following, `true` is returned:
+
+`true`
+`'true'`
+`'True'`
+`'t'`
+`'yes'`
+`'Yes'`
+`'y'`
+`'1'`
+*Any other string starting with `t`, `y`, `T`, `Y`, or `1`)*
+`1`
+
+Note that both the string `'1'` and the number `1` are accepted.
+
+If `b` is not `true` or `false`, and `launder.string(b)` returns the empty string, then `false` is returned unless `def` is defined, in which case `def` is returned.
+
+### `launder.date(d, def, now)`
+
+Converts `d` to a date string in `YYYY-MM-DD` format, such as `2015-02-20`.
+
+`d` must be either a string or a `Date` object, otherwise `def` is returned. *If `def` is undefined, the current date is returned. If `def` is `null`, `null` is returned.*
+
+`now` can be the current date object for resolving ambiguous dates. If it is not provided, a new `Date` object is created.
+
+The following date string formats are supported:
+
+`YYYY-MM-DD`
+`MM/DD/YYYY`
+`MM/DD/YY` (*)
+`MM/DD` (implies current year)
+
+(*) Implies the current century, unless the result would be more than 50 years in the future, in which case it implies the previous century. This works well for the popular usage of two-digit years. If it bothers you, use four-digit years!
+
+### `launder.time(t, def)`
+
+Converts `t` to a time string in `HH:MM:SS` format, such as `16:30:00`.
+
+The following formats are accepted:
+
+`16:30:00`
+`16:30`
+`16`
+`1pm`
+`2:37am`
+`2:37:12am`
+`2PM` (case insensitive, in general)
+`2p` (`m` is optional)
+`2 pm` (spaces don't matter)
+`4:30a`
+
+If `launder.string(t)` returns the empty string, `def` is returned. *If `def` is not provided, the current time is returned.*
+
+### `launder.tags(arr, filter)`
+
+Sanitize an array of tags. All strings and numbers in the supplied array are passed through `launder.string`, then through `filter`. If `filter` is not passed, the `filterTag` function provided as an option when configuring `launder` is used. If that option is not passed, the default `filterTag` function is used.
+
+The default `filterTag` function trims whitespace and converts to lowercase.
+
+Any elements which have been laundered to the empty string are discarded.
+
+### `launder.id(s, def)`
+
+Sanitize an ID. For our purposes an ID is made up of the characters `A-Z`, `a-z`, `0-9` and `_`. An ID may begin with any of these characters. An ID must contain at least one character. `launder.string` is first used to coerce `s` to a string.
+
+If any of these criteria are not met, `def` is returned.
+
+### `launder.ids(ids)`
+
+Sanitize an array of IDs. Each element is passed through `launder.id`. Any IDs that do not meet the criteria are omitted from the returned array.
+
+## Miscellaneous methods
+
+We use these a lot in Apostrophe, but they might not feel as relevant for other applications. Use them if you wish!
+
+### `launder.addBooleanFilterCriteria(options, name, criteria, def)`
+
+Use a tri-state filter value such as `'true'`, `'false'`, or `'any'` to build a MongoDB-style query criteria object.
+
+`options[name]` should be a string such as `'true'`, `'false'` or `'any'`.
+
+`criteria[name]` will then be set to `true`, `{ $ne: true }`, or left entirely unset.
+
+Any value accepted by `launder.boolean` is acceptable to specify `true` and `false`. Also, `null` is accepted as a synonym for `'any'`.
+
+If `def` is not specified, the default behavior is `any`.
+
+### `launder.formatDate(date)`
+
+Output the given `Date` object in `YYYY-MM-DD` format. This is the canonical date format for Apostrophe.
+
+### `launder.formatTime(date)`
+
+Output the given `Date` object in `HH:mm:ss` format. This is the canonical time format for Apostrophe.
+
+### `launder.padInteger(i, places)`
+
+Pads the specified integer with leading zeroes to ensure it has at least `places` digits and returns the resulting string.
+
+## About ApostropheCMS
+
+`launder` was created for use in ApostropheCMS, an open-source content management system built on Node.js. If you like `launder` you should definitely [check out apostrophecms.org](https://apostrophecms.com). Also be sure to visit us on [github](http://github.com/apostrophecms).
+
+## Support
+
+Feel free to open issues on [github](http://github.com/apostrophecms/launder).

package/node_modules/launder/eslint.config.js

@@ -0,0 +1,6 @@
+const apostrophe = require('eslint-config-apostrophe/strict').default;
+const { defineConfig } = require('eslint/config');
+
+module.exports = defineConfig([
+  apostrophe
+]);