@suveren/gateway 0.2.2 → 0.2.3

package/node_modules/eventsource-parser/dist/stream.d.ts

@@ -2,7 +2,10 @@
  * The type of error that occurred.
  * @public
  */
-export declare type ErrorType = "invalid-retry" | "unknown-field";
+export declare type ErrorType =
+  | "invalid-retry"
+  | "unknown-field"
+  | "max-buffer-size-exceeded";
 
 /**
  * A parsed EventSource message event
@@ -43,7 +46,7 @@ export declare interface EventSourceMessage {
  * const eventStream =
  *  response.body
  *   .pipeThrough(new TextDecoderStream())
- *   .pipeThrough(new EventSourceParserStream({terminateOnError: true}))
+ *   .pipeThrough(new EventSourceParserStream({onError: 'terminate'}))
  * ```
  *
  * @public
@@ -52,7 +55,7 @@ export declare class EventSourceParserStream extends TransformStream<
   string,
   EventSourceMessage
 > {
-  constructor({ onError, onRetry, onComment }?: StreamOptions);
+  constructor({ onError, onRetry, onComment, maxBufferSize }?: StreamOptions);
 }
 
 /**
@@ -116,6 +119,16 @@ export declare interface StreamOptions {
    * @param comment - The comment encountered in the stream.
    */
   onComment?: ((comment: string) => void) | undefined;
+  /**
+   * Maximum number of characters the parser is allowed to buffer across calls to `feed()`.
+   * See {@link ParserConfig.maxBufferSize} for details.
+   *
+   * When the limit is exceeded, the stream is always errored (regardless of the `onError`
+   * setting) since the underlying parser is unrecoverable without a `reset()`.
+   *
+   * @defaultValue `undefined` (unbounded)
+   */
+  maxBufferSize?: number | undefined;
 }
 
 export {};

package/node_modules/eventsource-parser/dist/stream.js

@@ -1,7 +1,7 @@
 import { createParser } from "./index.js";
 import { ParseError } from "./index.js";
 class EventSourceParserStream extends TransformStream {
-  constructor({ onError, onRetry, onComment } = {}) {
+  constructor({ onError, onRetry, onComment, maxBufferSize } = {}) {
     let parser;
     super({
       start(controller) {
@@ -10,10 +10,11 @@ class EventSourceParserStream extends TransformStream {
             controller.enqueue(event);
           },
           onError(error) {
-            onError === "terminate" ? controller.error(error) : typeof onError == "function" && onError(error);
+            typeof onError == "function" && onError(error), (onError === "terminate" || error.type === "max-buffer-size-exceeded") && controller.error(error);
           },
           onRetry,
-          onComment
+          onComment,
+          maxBufferSize
         });
       },
       transform(chunk) {

package/node_modules/eventsource-parser/dist/stream.js.map

@@ -1 +1 @@
-{"version":3,"file":"stream.js","sources":["../src/stream.ts"],"sourcesContent":["import {createParser} from './parse.ts'\nimport type {EventSourceMessage, EventSourceParser} from './types.ts'\n\n/**\n * Options for the EventSourceParserStream.\n *\n * @public\n */\nexport interface StreamOptions {\n  /**\n   * Behavior when a parsing error occurs.\n   *\n   * - A custom function can be provided to handle the error.\n   * - `'terminate'` will error the stream and stop parsing.\n   * - Any other value will ignore the error and continue parsing.\n   *\n   * @defaultValue `undefined`\n   */\n  onError?: ('terminate' | ((error: Error) => void)) | undefined\n\n  /**\n   * Callback for when a reconnection interval is sent from the server.\n   *\n   * @param retry - The number of milliseconds to wait before reconnecting.\n   */\n  onRetry?: ((retry: number) => void) | undefined\n\n  /**\n   * Callback for when a comment is encountered in the stream.\n   *\n   * @param comment - The comment encountered in the stream.\n   */\n  onComment?: ((comment: string) => void) | undefined\n}\n\n/**\n * A TransformStream that ingests a stream of strings and produces a stream of `EventSourceMessage`.\n *\n * @example Basic usage\n * ```\n * const eventStream =\n *   response.body\n *     .pipeThrough(new TextDecoderStream())\n *     .pipeThrough(new EventSourceParserStream())\n * ```\n *\n * @example Terminate stream on parsing errors\n * ```\n * const eventStream =\n *  response.body\n *   .pipeThrough(new TextDecoderStream())\n *   .pipeThrough(new EventSourceParserStream({terminateOnError: true}))\n * ```\n *\n * @public\n */\nexport class EventSourceParserStream extends TransformStream<string, EventSourceMessage> {\n  constructor({onError, onRetry, onComment}: StreamOptions = {}) {\n    let parser!: EventSourceParser\n\n    super({\n      start(controller) {\n        parser = createParser({\n          onEvent: (event) => {\n            controller.enqueue(event)\n          },\n          onError(error) {\n            if (onError === 'terminate') {\n              controller.error(error)\n            } else if (typeof onError === 'function') {\n              onError(error)\n            }\n\n            // Ignore by default\n          },\n          onRetry,\n          onComment,\n        })\n      },\n      transform(chunk) {\n        parser.feed(chunk)\n      },\n    })\n  }\n}\n\nexport {type ErrorType, ParseError} from './errors.ts'\nexport type {EventSourceMessage} from './types.ts'\n"],"names":[],"mappings":";;AAwDO,MAAM,gCAAgC,gBAA4C;AAAA,EACvF,YAAY,EAAC,SAAS,SAAS,UAAA,IAA4B,CAAA,GAAI;AAC7D,QAAI;AAEJ,UAAM;AAAA,MACJ,MAAM,YAAY;AAChB,iBAAS,aAAa;AAAA,UACpB,SAAS,CAAC,UAAU;AAClB,uBAAW,QAAQ,KAAK;AAAA,UAC1B;AAAA,UACA,QAAQ,OAAO;AACT,wBAAY,cACd,WAAW,MAAM,KAAK,IACb,OAAO,WAAY,cAC5B,QAAQ,KAAK;AAAA,UAIjB;AAAA,UACA;AAAA,UACA;AAAA,QAAA,CACD;AAAA,MACH;AAAA,MACA,UAAU,OAAO;AACf,eAAO,KAAK,KAAK;AAAA,MACnB;AAAA,IAAA,CACD;AAAA,EACH;AACF;"}
+{"version":3,"file":"stream.js","sources":["../src/stream.ts"],"sourcesContent":["import {createParser} from './parse.ts'\nimport type {EventSourceMessage, EventSourceParser} from './types.ts'\n\n/**\n * Options for the EventSourceParserStream.\n *\n * @public\n */\nexport interface StreamOptions {\n  /**\n   * Behavior when a parsing error occurs.\n   *\n   * - A custom function can be provided to handle the error.\n   * - `'terminate'` will error the stream and stop parsing.\n   * - Any other value will ignore the error and continue parsing.\n   *\n   * @defaultValue `undefined`\n   */\n  onError?: ('terminate' | ((error: Error) => void)) | undefined\n\n  /**\n   * Callback for when a reconnection interval is sent from the server.\n   *\n   * @param retry - The number of milliseconds to wait before reconnecting.\n   */\n  onRetry?: ((retry: number) => void) | undefined\n\n  /**\n   * Callback for when a comment is encountered in the stream.\n   *\n   * @param comment - The comment encountered in the stream.\n   */\n  onComment?: ((comment: string) => void) | undefined\n\n  /**\n   * Maximum number of characters the parser is allowed to buffer across calls to `feed()`.\n   * See {@link ParserConfig.maxBufferSize} for details.\n   *\n   * When the limit is exceeded, the stream is always errored (regardless of the `onError`\n   * setting) since the underlying parser is unrecoverable without a `reset()`.\n   *\n   * @defaultValue `undefined` (unbounded)\n   */\n  maxBufferSize?: number | undefined\n}\n\n/**\n * A TransformStream that ingests a stream of strings and produces a stream of `EventSourceMessage`.\n *\n * @example Basic usage\n * ```\n * const eventStream =\n *   response.body\n *     .pipeThrough(new TextDecoderStream())\n *     .pipeThrough(new EventSourceParserStream())\n * ```\n *\n * @example Terminate stream on parsing errors\n * ```\n * const eventStream =\n *  response.body\n *   .pipeThrough(new TextDecoderStream())\n *   .pipeThrough(new EventSourceParserStream({onError: 'terminate'}))\n * ```\n *\n * @public\n */\nexport class EventSourceParserStream extends TransformStream<string, EventSourceMessage> {\n  constructor({onError, onRetry, onComment, maxBufferSize}: StreamOptions = {}) {\n    let parser!: EventSourceParser\n\n    super({\n      start(controller) {\n        parser = createParser({\n          onEvent: (event) => {\n            controller.enqueue(event)\n          },\n          onError(error) {\n            if (typeof onError === 'function') {\n              onError(error)\n            }\n\n            // `max-buffer-size-exceeded` is fatal — the parser is unusable until\n            // `reset()`, which the stream wrapper has no way to call. Always\n            // terminate the stream in that case so consumers see the meaningful\n            // `ParseError` instead of an opaque \"cannot feed terminated parser\"\n            // throw from the next chunk.\n            if (onError === 'terminate' || error.type === 'max-buffer-size-exceeded') {\n              controller.error(error)\n            }\n\n            // Ignore by default\n          },\n          onRetry,\n          onComment,\n          maxBufferSize,\n        })\n      },\n      transform(chunk) {\n        parser.feed(chunk)\n      },\n    })\n  }\n}\n\nexport {type ErrorType, ParseError} from './errors.ts'\nexport type {EventSourceMessage} from './types.ts'\n"],"names":[],"mappings":";;AAmEO,MAAM,gCAAgC,gBAA4C;AAAA,EACvF,YAAY,EAAC,SAAS,SAAS,WAAW,cAAA,IAAgC,IAAI;AAC5E,QAAI;AAEJ,UAAM;AAAA,MACJ,MAAM,YAAY;AAChB,iBAAS,aAAa;AAAA,UACpB,SAAS,CAAC,UAAU;AAClB,uBAAW,QAAQ,KAAK;AAAA,UAC1B;AAAA,UACA,QAAQ,OAAO;AACT,mBAAO,WAAY,cACrB,QAAQ,KAAK,IAQX,YAAY,eAAe,MAAM,SAAS,+BAC5C,WAAW,MAAM,KAAK;AAAA,UAI1B;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QAAA,CACD;AAAA,MACH;AAAA,MACA,UAAU,OAAO;AACf,eAAO,KAAK,KAAK;AAAA,MACnB;AAAA,IAAA,CACD;AAAA,EACH;AACF;"}

package/node_modules/eventsource-parser/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eventsource-parser",
-  "version": "3.0.8",
+  "version": "3.1.0",
   "description": "Streaming, source-agnostic EventSource/Server-Sent Events parser",
   "keywords": [
     "eventsource",
@@ -63,21 +63,21 @@
     "test:node": "vitest --reporter=verbose"
   },
   "devDependencies": {
-    "@sanity/pkg-utils": "^10.4.15",
+    "@sanity/pkg-utils": "^10.4.18",
     "@sanity/semantic-release-preset": "^6.0.0",
     "@sanity/tsconfig": "^2.1.0",
     "@types/node": "^20.19.0",
-    "eventsource-encoder": "^1.0.1",
-    "knip": "^6.4.1",
+    "eventsource-encoder": "^1.0.2",
+    "knip": "^6.7.0",
     "mitata": "^1.0.34",
-    "oxfmt": "^0.45.0",
-    "oxlint": "^1.60.0",
+    "oxfmt": "^0.47.0",
+    "oxlint": "^1.62.0",
     "rimraf": "^6.1.3",
     "rollup-plugin-visualizer": "^6.0.3",
     "semantic-release": "^25.0.3",
-    "terser": "^5.46.1",
+    "terser": "^5.46.2",
     "typescript": "^5.9.3",
-    "vitest": "^4.1.4"
+    "vitest": "^4.1.5"
   },
   "browserslist": [
     "node >= 18",

package/node_modules/eventsource-parser/src/errors.ts

@@ -2,7 +2,7 @@
  * The type of error that occurred.
  * @public
  */
-export type ErrorType = 'invalid-retry' | 'unknown-field'
+export type ErrorType = 'invalid-retry' | 'unknown-field' | 'max-buffer-size-exceeded'
 
 /**
  * Error thrown when encountering an issue during parsing.

package/node_modules/eventsource-parser/src/index.ts

@@ -1,3 +1,8 @@
 export {type ErrorType, ParseError} from './errors.ts'
 export {createParser} from './parse.ts'
-export type {EventSourceMessage, EventSourceParser, ParserCallbacks} from './types.ts'
+export type {
+  EventSourceMessage,
+  EventSourceParser,
+  ParserCallbacks,
+  ParserConfig,
+} from './types.ts'

package/node_modules/eventsource-parser/src/parse.ts

@@ -3,7 +3,7 @@
  * @see https://html.spec.whatwg.org/multipage/server-sent-events.html
  */
 import {ParseError} from './errors.ts'
-import type {EventSourceParser, ParserCallbacks} from './types.ts'
+import type {EventSourceParser, ParserConfig} from './types.ts'
 
 // ASCII codes used in the hot parsing paths.
 const LF = 10
@@ -18,23 +18,20 @@ function noop(_arg: unknown) {
 /**
  * Creates a new EventSource parser.
  *
- * @param callbacks - Callbacks to invoke on different parsing events:
- *   - `onEvent` when a new event is parsed
- *   - `onError` when an error occurs
- *   - `onRetry` when a new reconnection interval has been sent from the server
- *   - `onComment` when a comment is encountered in the stream
+ * @param config - Parser configuration. Accepts callbacks (see {@link ParserCallbacks})
+ *   and options like `maxBufferSize` (see {@link ParserConfig}).
  *
- * @returns A new EventSource parser, with `parse` and `reset` methods.
+ * @returns A new EventSource parser, with `feed` and `reset` methods.
  * @public
  */
-export function createParser(callbacks: ParserCallbacks): EventSourceParser {
-  if (typeof callbacks === 'function') {
+export function createParser(config: ParserConfig): EventSourceParser {
+  if (typeof config === 'function') {
     throw new TypeError(
-      '`callbacks` must be an object, got a function instead. Did you mean `{onEvent: fn}`?',
+      '`config` must be an object, got a function instead. Did you mean `createParser({onEvent: fn})`?',
     )
   }
 
-  const {onEvent = noop, onError = noop, onRetry = noop, onComment} = callbacks
+  const {onEvent = noop, onError = noop, onRetry = noop, onComment, maxBufferSize} = config
 
   // Trailing bytes from prior `feed()` calls that did not yet form a complete line.
   // Stored as an array of fragments and only joined when a line terminator arrives.
@@ -44,12 +41,20 @@ export function createParser(callbacks: ParserCallbacks): EventSourceParser {
   // makes the same workload linear.
   const pendingFragments: string[] = []
 
+  // Running total of `pendingFragments` lengths, kept in sync with the array so the
+  // `maxBufferSize` check doesn't have to walk the fragment list on every feed.
+  let pendingFragmentsLength = 0
+
   let isFirstChunk = true
   let id: string | undefined
   let data = ''
   let dataLines = 0
   let eventType: string | undefined
 
+  // Set after a `maxBufferSize` overflow. Once tripped, `feed()` throws until
+  // `reset()` is called — see the comment on `maxBufferSize` in `ParserConfig`.
+  let terminated = false
+
   /**
    * Feeds a chunk of the SSE stream to the parser. Any trailing bytes that do
    * not yet form a complete line are held back and prepended to the next chunk,
@@ -62,6 +67,12 @@ export function createParser(callbacks: ParserCallbacks): EventSourceParser {
    * @see https://html.spec.whatwg.org/multipage/server-sent-events.html#parsing-an-event-stream
    */
   function feed(chunk: string) {
+    if (terminated) {
+      throw new Error(
+        'Cannot feed parser: it was terminated after exceeding the configured max buffer size. Call `reset()` to resume parsing.',
+      )
+    }
+
     if (isFirstChunk) {
       isFirstChunk = false
       // Match and strip UTF-8 BOM from the start of the stream, if present.
@@ -80,7 +91,11 @@ export function createParser(callbacks: ParserCallbacks): EventSourceParser {
     // Zero new work in the common case (every chunk ends with `\n\n`).
     if (pendingFragments.length === 0) {
       const trailing = processLines(chunk)
-      if (trailing !== '') pendingFragments.push(trailing)
+      if (trailing !== '') {
+        pendingFragments.push(trailing)
+        pendingFragmentsLength = trailing.length
+      }
+      checkBufferSize()
       return
     }
 
@@ -89,6 +104,8 @@ export function createParser(callbacks: ParserCallbacks): EventSourceParser {
     // avoiding (large single `data:` payload split across many tiny chunks).
     if (chunk.indexOf('\n') === -1 && chunk.indexOf('\r') === -1) {
       pendingFragments.push(chunk)
+      pendingFragmentsLength += chunk.length
+      checkBufferSize()
       return
     }
 
@@ -97,8 +114,31 @@ export function createParser(callbacks: ParserCallbacks): EventSourceParser {
     pendingFragments.push(chunk)
     const input = pendingFragments.join('')
     pendingFragments.length = 0
+    pendingFragmentsLength = 0
     const trailing = processLines(input)
-    if (trailing !== '') pendingFragments.push(trailing)
+    if (trailing !== '') {
+      pendingFragments.push(trailing)
+      pendingFragmentsLength = trailing.length
+    }
+    checkBufferSize()
+  }
+
+  function checkBufferSize() {
+    if (maxBufferSize === undefined) return
+    if (pendingFragmentsLength + data.length <= maxBufferSize) return
+
+    terminated = true
+    pendingFragments.length = 0
+    pendingFragmentsLength = 0
+    id = undefined
+    data = ''
+    dataLines = 0
+    eventType = undefined
+    onError(
+      new ParseError(`Buffered data exceeded max buffer size of ${maxBufferSize} characters`, {
+        type: 'max-buffer-size-exceeded',
+      }),
+    )
   }
 
   /**
@@ -350,6 +390,8 @@ export function createParser(callbacks: ParserCallbacks): EventSourceParser {
     dataLines = 0
     eventType = undefined
     pendingFragments.length = 0
+    pendingFragmentsLength = 0
+    terminated = false
   }
 
   return {feed, reset}

package/node_modules/eventsource-parser/src/stream.ts

@@ -31,6 +31,17 @@ export interface StreamOptions {
    * @param comment - The comment encountered in the stream.
    */
   onComment?: ((comment: string) => void) | undefined
+
+  /**
+   * Maximum number of characters the parser is allowed to buffer across calls to `feed()`.
+   * See {@link ParserConfig.maxBufferSize} for details.
+   *
+   * When the limit is exceeded, the stream is always errored (regardless of the `onError`
+   * setting) since the underlying parser is unrecoverable without a `reset()`.
+   *
+   * @defaultValue `undefined` (unbounded)
+   */
+  maxBufferSize?: number | undefined
 }
 
 /**
@@ -49,13 +60,13 @@ export interface StreamOptions {
  * const eventStream =
  *  response.body
  *   .pipeThrough(new TextDecoderStream())
- *   .pipeThrough(new EventSourceParserStream({terminateOnError: true}))
+ *   .pipeThrough(new EventSourceParserStream({onError: 'terminate'}))
  * ```
  *
  * @public
  */
 export class EventSourceParserStream extends TransformStream<string, EventSourceMessage> {
-  constructor({onError, onRetry, onComment}: StreamOptions = {}) {
+  constructor({onError, onRetry, onComment, maxBufferSize}: StreamOptions = {}) {
     let parser!: EventSourceParser
 
     super({
@@ -65,16 +76,24 @@ export class EventSourceParserStream extends TransformStream<string, EventSource
             controller.enqueue(event)
           },
           onError(error) {
-            if (onError === 'terminate') {
-              controller.error(error)
-            } else if (typeof onError === 'function') {
+            if (typeof onError === 'function') {
               onError(error)
             }
 
+            // `max-buffer-size-exceeded` is fatal — the parser is unusable until
+            // `reset()`, which the stream wrapper has no way to call. Always
+            // terminate the stream in that case so consumers see the meaningful
+            // `ParseError` instead of an opaque "cannot feed terminated parser"
+            // throw from the next chunk.
+            if (onError === 'terminate' || error.type === 'max-buffer-size-exceeded') {
+              controller.error(error)
+            }
+
             // Ignore by default
           },
           onRetry,
           onComment,
+          maxBufferSize,
         })
       },
       transform(chunk) {

package/node_modules/eventsource-parser/src/types.ts

@@ -95,3 +95,28 @@ export interface ParserCallbacks {
    */
   onError?: ((error: ParseError) => void) | undefined
 }
+
+/**
+ * Configuration accepted by {@link createParser}. Extends {@link ParserCallbacks} with
+ * additional options that control parser behavior.
+ *
+ * @public
+ */
+export interface ParserConfig extends ParserCallbacks {
+  /**
+   * Maximum number of characters the parser is allowed to buffer across calls to `feed()`.
+   *
+   * Two unbounded surfaces exist in a streaming SSE parser:
+   * - A partial line that has not yet been terminated by `\n`, `\r`, or `\r\n`.
+   * - A multi-line event whose terminating blank line has not yet arrived (each `data:`
+   *   field gets appended to the buffered event).
+   *
+   * When the combined size of these buffers exceeds `maxBufferSize`, the parser emits a
+   * `ParseError` with `type: 'max-buffer-size-exceeded'` to `onError` and becomes
+   * terminated — subsequent calls to `feed()` will throw until `reset()` is called.
+   * This protects against unbounded memory growth from malformed or malicious streams.
+   *
+   * @defaultValue `undefined` (unbounded)
+   */
+  maxBufferSize?: number | undefined
+}

package/node_modules/hasown/CHANGELOG.md

@@ -5,6 +5,13 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [v2.0.4](https://github.com/inspect-js/hasOwn/compare/v2.0.3...v2.0.4) - 2026-05-28
+
+### Commits
+
+- [types] drop the dead key-narrowing overload [`fdab00e`](https://github.com/inspect-js/hasOwn/commit/fdab00e2703e65411424e19bf86a7e72a8f10da9)
+- [Dev Deps] update `@ljharb/eslint-config`, `auto-changelog`, `eslint` [`91f6247`](https://github.com/inspect-js/hasOwn/commit/91f624768dd0f7db0d019b89d4d86bd66e20ec30)
+
 ## [v2.0.3](https://github.com/inspect-js/hasOwn/compare/v2.0.2...v2.0.3) - 2026-04-17
 
 ### Commits

package/node_modules/hasown/index.d.ts

@@ -1,4 +1,3 @@
-declare function hasOwn<O, K extends PropertyKey>(o: O, p: K): p is K & keyof O;
 declare function hasOwn<O, K extends PropertyKey, V = unknown>(o: O, p: K): o is O & Record<K, V>;
 
 export = hasOwn;

package/node_modules/hasown/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "hasown",
-	"version": "2.0.3",
+	"version": "2.0.4",
 	"description": "A robust, ES3 compatible, \"has own property\" predicate.",
 	"main": "index.js",
 	"exports": {
@@ -52,13 +52,12 @@
 	},
 	"devDependencies": {
 		"@arethetypeswrong/cli": "^0.18.2",
-		"@ljharb/eslint-config": "^22.2.2",
+		"@ljharb/eslint-config": "^22.2.3",
 		"@ljharb/tsconfig": "^0.3.2",
 		"@types/function-bind": "^1.1.10",
 		"@types/tape": "^5.8.1",
-		"auto-changelog": "^2.5.0",
-		"encoding": "^0.1.13",
-		"eslint": "^10.2.0",
+		"auto-changelog": "^2.5.1",
+		"eslint": "^10.4.0",
 		"evalmd": "^0.0.19",
 		"in-publish": "^2.0.1",
 		"jiti": "^0.0.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@suveren/gateway",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "Suveren gateway — local agent gateway built in compliance with the Human Agency Protocol (HAP). Runs the UI, control plane, and MCP server in one Node process.",
   "type": "module",
   "main": "server.js",