@suveren/gateway 0.20.2 → 0.22.0

package/dist/ui/index.html

@@ -14,8 +14,8 @@
     <meta name="apple-mobile-web-app-title" content="Suveren" />
     <meta name="theme-color" content="#111111" />
     <title>Suveren</title>
-    <script type="module" crossorigin src="/assets/index-1s1q-XLL.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-blnpvM2g.css">
+    <script type="module" crossorigin src="/assets/index-CBoGbefI.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-BSAkn_Of.css">
   </head>
   <body>
     <div id="root"></div>

package/node_modules/@modelcontextprotocol/sdk/node_modules/content-disposition/README.md

@@ -17,17 +17,17 @@ $ npm install content-disposition
 ## API
 
 ```js
-const contentDisposition = require('content-disposition')
+import { create, parse, format } from 'content-disposition';
 ```
 
-### contentDisposition(filename, options)
+### create(filename, options)
 
 Create an attachment `Content-Disposition` header value using the given file name,
 if supplied. The `filename` is optional and if no file name is desired, but you
 want to specify `options`, set `filename` to `undefined`.
 
 ```js
-res.setHeader('Content-Disposition', contentDisposition('∫ maths.pdf'))
+res.setHeader('Content-Disposition', create('∫ maths.pdf'));
 ```
 
 **note** HTTP headers are of the ISO-8859-1 character set. If you are writing this
@@ -40,73 +40,139 @@ the `'binary'` encoding in Node.js.
 
 ##### fallback
 
-If the `filename` option is outside ISO-8859-1, then the file name is actually
+If the `filename` option is outside US-ASCII, then the file name is actually
 stored in a supplemental field for clients that support Unicode file names and
-a ISO-8859-1 version of the file name is automatically generated.
+a US-ASCII version of the file name is automatically generated.
 
-This specifies the ISO-8859-1 file name to override the automatic generation or
+This specifies the US-ASCII file name to override the automatic generation or
 disables the generation all together, defaults to `true`.
 
-  - A string will specify the ISO-8859-1 file name to use in place of automatic
-    generation.
-  - `false` will disable including a ISO-8859-1 file name and only include the
-    Unicode version (unless the file name is already ISO-8859-1).
-  - `true` will enable automatic generation if the file name is outside ISO-8859-1.
+- A string will specify the US-ASCII file name to use in place of automatic
+  generation.
+- `false` will disable including a US-ASCII file name and only include the
+  Unicode version (unless the file name is already US-ASCII).
+- `true` will enable automatic generation if the file name is outside US-ASCII.
 
-If the `filename` option is ISO-8859-1 and this option is specified and has a
+If the `filename` option is US-ASCII and this option is specified and has a
 different value, then the `filename` option is encoded in the extended field
-and this set as the fallback field, even though they are both ISO-8859-1.
+and this set as the fallback field, even though they are both US-ASCII.
 
 ##### type
 
 Specifies the disposition type, defaults to `"attachment"`. This can also be
 `"inline"`, or any other value (all values except inline are treated like
 `attachment`, but can convey additional information if both parties agree to
-it). The type is normalized to lower-case.
+it).
 
-### contentDisposition.parse(string)
+### parse(string, options)
 
 ```js
-const disposition = contentDisposition.parse('attachment; filename="EURO rates.txt"; filename*=UTF-8\'\'%e2%82%ac%20rates.txt')
+const disposition = parse(
+  'attachment; filename="EURO rates.txt"; filename*=UTF-8\'\'%e2%82%ac%20rates.txt',
+);
 ```
 
 Parse a `Content-Disposition` header string. This automatically handles extended
 ("Unicode") parameters by decoding them and providing them under the standard
-parameter name. This will return an object with the following properties (examples
-are shown for the string `'attachment; filename="EURO rates.txt"; filename*=UTF-8\'\'%e2%82%ac%20rates.txt'`):
+parameter name. This will return an object with the following properties:
 
- - `type`: The disposition type (always lower case). Example: `'attachment'`
+- `type`: The disposition type (always lower case). Example: `'attachment'`
 
- - `parameters`: An object of the parameters in the disposition (name of parameter
-   always lower case and extended versions replace non-extended versions). Example:
-   `{filename: "€ rates.txt"}`
+- `parameters`: An object of the parameters in the disposition (name of parameter
+  always lower case and extended versions replace non-extended versions). Example:
+  `{filename: "€ rates.txt"}`
+
+#### Options
+
+##### multipart
+
+Parse parameters using browser `multipart/form-data` behavior.
+
+```js
+parse('form-data; name="file"; filename="the %22plans%22.pdf"', {
+  multipart: true,
+});
+```
+
+##### extended
+
+Parse RFC 5987 extended header parameters automatically when decoding
+parameters, defaults to `true`.
+
+### format(obj, options)
+
+```js
+const disposition = format({
+  type: 'attachment',
+  parameters: {
+    filename: '€ rates.txt',
+  },
+});
+```
+
+Formats an object to a `Content-Disposition` header string. This automatically
+handles extended ("Unicode") parameters and returns a string. Example:
+`'attachment; filename*=UTF-8''%E2%82%AC%20rates.txt'`
+
+#### Options
+
+##### multipart
+
+Format parameters using browser `multipart/form-data` behavior. This quotes
+parameter values, escapes `"` as `%22`, and writes Unicode values directly
+instead of using extended parameters.
+
+```js
+format(
+  {
+    type: 'form-data',
+    parameters: { name: 'file', filename: '€ rates.txt' },
+  },
+  { multipart: true },
+);
+```
+
+##### extended
+
+Encode Unicode parameter values using RFC 5987 extended header parameters,
+e.g. `filename*=`, defaults to `true`.
 
 ## Examples
 
 ### Send a file for download
 
 ```js
-const contentDisposition = require('content-disposition')
-const fs = require('fs')
-const http = require('http')
-const onFinished = require('on-finished')
+const contentDisposition = require('content-disposition');
+const fs = require('fs');
+const http = require('http');
+const onFinished = require('on-finished');
 
-const filePath = '/path/to/public/plans.pdf'
+const filePath = '/path/to/public/plans.pdf';
 
-http.createServer(function onRequest (req, res) {
+http.createServer(function onRequest(req, res) {
   // set headers
-  res.setHeader('Content-Type', 'application/pdf')
-  res.setHeader('Content-Disposition', contentDisposition(filePath))
+  res.setHeader('Content-Type', 'application/pdf');
+  res.setHeader('Content-Disposition', contentDisposition(filePath));
 
   // send file
-  const stream = fs.createReadStream(filePath)
-  stream.pipe(res)
+  const stream = fs.createReadStream(filePath);
+  stream.pipe(res);
   onFinished(res, function () {
-    stream.destroy()
-  })
-})
+    stream.destroy();
+  });
+});
 ```
 
+## Local demo
+
+Run the upload inspector locally:
+
+```sh
+npm run demo
+```
+
+Then open `http://127.0.0.1:3000` in your browser. The demo lets you upload files, inspect the multipart upload part headers sent by the browser, and compare them with the download `Content-Disposition` header generated by this package.
+
 ## Testing
 
 ```sh
@@ -118,11 +184,15 @@ $ npm test
 - [RFC 2616: Hypertext Transfer Protocol -- HTTP/1.1][rfc-2616]
 - [RFC 5987: Character Set and Language Encoding for Hypertext Transfer Protocol (HTTP) Header Field Parameters][rfc-5987]
 - [RFC 6266: Use of the Content-Disposition Header Field in the Hypertext Transfer Protocol (HTTP)][rfc-6266]
+- [RFC 8187: Indicating Character Encoding and Language for HTTP Header Field Parameters][rfc-8187]
+- [HTML Living Standard: Multipart form data][html-form]
 - [Test Cases for HTTP Content-Disposition header field (RFC 6266) and the Encodings defined in RFCs 2047, 2231 and 5987][tc-2231]
 
 [rfc-2616]: https://datatracker.ietf.org/doc/html/rfc2616
 [rfc-5987]: https://datatracker.ietf.org/doc/html/rfc5987
 [rfc-6266]: https://datatracker.ietf.org/doc/html/rfc6266
+[rfc-8187]: https://datatracker.ietf.org/doc/html/rfc8187
+[html-form]: https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data
 [tc-2231]: http://greenbytes.de/tech/tc2231/
 
 ## License

package/node_modules/@modelcontextprotocol/sdk/node_modules/content-disposition/dist/index.d.ts

@@ -0,0 +1,72 @@
+/*!
+ * content-disposition
+ * Copyright(c) 2014-2017 Douglas Christopher Wilson
+ * MIT Licensed
+ */
+export interface ContentDisposition {
+    /**
+     * Content-Disposition type, such as "attachment" or "inline"
+     */
+    type: string;
+    /**
+     * Content-Disposition parameters, such as "filename"
+     */
+    parameters: Record<string, string>;
+}
+export interface CreateOptions {
+    /**
+     * Content-Disposition type, defaults to "attachment"
+     * @default "attachment"
+     */
+    type?: string;
+    /**
+     * Fallback filename for non-US-ASCII strings. If true, a fallback will be generated by replacing non-US-ASCII characters with "?". If false, no fallback will be generated.
+     * @default true
+     */
+    fallback?: string | boolean;
+}
+/**
+ * Create an attachment Content-Disposition header.
+ */
+export declare function create(filename?: string, options?: CreateOptions): string;
+export interface ParseOptions {
+    /**
+     * Whether to decode RFC 8187 encoded parameters.
+     * @default true
+     */
+    extended?: boolean;
+    /**
+     * Parse parameters as sent by browsers in `multipart/form-data`.
+     * @default false
+     */
+    multipart?: boolean;
+}
+/**
+ * Parse Content-Disposition header string.
+ */
+export declare function parse(header: string, options?: ParseOptions): ContentDisposition;
+/**
+ * Decode a RFC 8187 field value (gracefully).
+ */
+export declare function decodeExtended(str: string): string | undefined;
+export interface FormatOptions {
+    /**
+     * Whether to use extended parameter encoding for non-ISO-8859-1 strings.
+     * If false, an error will be thrown when formatting such strings.
+     * @default true
+     */
+    extended?: boolean;
+    /**
+     * Format parameters as sent by browsers in `multipart/form-data`.
+     * @default false
+     */
+    multipart?: boolean;
+}
+/**
+ * Format object to Content-Disposition header.
+ */
+export declare function format(obj: Partial<ContentDisposition>, options?: FormatOptions): string;
+/**
+ * Encode a Unicode string for HTTP (RFC 8187).
+ */
+export declare function encodeExtended(str: string): string;

package/node_modules/@modelcontextprotocol/sdk/node_modules/content-disposition/dist/index.js

@@ -0,0 +1,388 @@
+"use strict";
+/*!
+ * content-disposition
+ * Copyright(c) 2014-2017 Douglas Christopher Wilson
+ * MIT Licensed
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.create = create;
+exports.parse = parse;
+exports.decodeExtended = decodeExtended;
+exports.format = format;
+exports.encodeExtended = encodeExtended;
+/**
+ * Null object perf optimization. Faster than `Object.create(null)` and `{ __proto__: null }`.
+ */
+const NullObject = /* @__PURE__ */ (() => {
+    const C = function () { };
+    C.prototype = Object.create(null);
+    return C;
+})();
+/**
+ * Create an attachment Content-Disposition header.
+ */
+function create(filename, options) {
+    const type = options?.type || 'attachment';
+    const parameters = createParameters(filename, options?.fallback);
+    return format({ type, parameters }, { extended: false });
+}
+const SP = 32; // " "
+const HTAB = 9; // "\t"
+const SEMI = 59; // ";"
+const EQ = 61; // "="
+const DQUOTE = 34; // '"'
+const BSLASH = 92; // "\\"
+const ASTERISK = 42; // "*"
+/**
+ * Parse Content-Disposition header string.
+ */
+function parse(header, options) {
+    const len = header.length;
+    const multipart = options?.multipart === true;
+    const extended = options?.extended !== false;
+    let index = skipOWS(header, 0, header.length);
+    const typeStart = index;
+    index = parseToken(header, index, len);
+    const typeEnd = trailingOWS(header, typeStart, index);
+    const type = header.slice(typeStart, typeEnd).toLowerCase();
+    const parameters = new NullObject();
+    parameter: while (index < len) {
+        index = skipOWS(header, index + 1, len); // Skip over semicolon.
+        const keyStart = index;
+        while (index < len) {
+            const char = header.charCodeAt(index);
+            if (char === SEMI)
+                continue parameter;
+            if (char === EQ) {
+                const keyEnd = trailingOWS(header, keyStart, index);
+                const key = header.slice(keyStart, keyEnd).toLowerCase();
+                index = skipOWS(header, index + 1, len);
+                if (index < len && header.charCodeAt(index) === DQUOTE) {
+                    index++;
+                    let value = '';
+                    if (multipart) {
+                        while (index < len) {
+                            const code = header.charCodeAt(index++);
+                            if (code === DQUOTE) {
+                                index = parseToken(header, index, len);
+                                if (parameters[key] === undefined)
+                                    parameters[key] = value;
+                                break;
+                            }
+                            if (code === /* % */ 37 && index + 1 < len) {
+                                const code2 = header.charCodeAt(index);
+                                const code3 = header.charCodeAt(index + 1);
+                                if (code2 === 50 /* "2" */ && code3 === 50 /* "2" */) {
+                                    value += '"';
+                                    index += 2;
+                                    continue;
+                                }
+                                if (code2 === 48 /* "0" */) {
+                                    if (code3 === 100 /* "d" */ || code3 === 68 /* "D" */) {
+                                        value += '\r';
+                                        index += 2;
+                                        continue;
+                                    }
+                                    if (code3 === 97 /* "a" */ || code3 === 65 /* "A" */) {
+                                        value += '\n';
+                                        index += 2;
+                                        continue;
+                                    }
+                                }
+                            }
+                            value += String.fromCharCode(code);
+                        }
+                    }
+                    else {
+                        while (index < len) {
+                            const code = header.charCodeAt(index++);
+                            if (code === DQUOTE) {
+                                index = parseToken(header, index, len);
+                                if (parameters[key] === undefined)
+                                    parameters[key] = value;
+                                break;
+                            }
+                            if (code === BSLASH && index < len) {
+                                value += header[index++];
+                                continue;
+                            }
+                            value += String.fromCharCode(code);
+                        }
+                    }
+                    continue parameter;
+                }
+                const valueStart = index;
+                index = parseToken(header, index, len);
+                const valueEnd = trailingOWS(header, valueStart, index);
+                const value = header.slice(valueStart, valueEnd);
+                if (parameters[key] === undefined) {
+                    parameters[key] = value;
+                    if (extended && key.charCodeAt(key.length - 1) === ASTERISK) {
+                        const normalizedKey = key.slice(0, -1);
+                        const decoded = decodeExtended(value);
+                        if (decoded !== undefined)
+                            parameters[normalizedKey] = decoded;
+                    }
+                }
+                continue parameter;
+            }
+            index++;
+        }
+    }
+    return { type, parameters };
+}
+/**
+ * RegExp to match non attr-char, *after* encodeURIComponent (i.e. not including "%")
+ */
+const ENCODE_URL_ATTR_CHAR_REGEXP = /[\x00-\x20"'()*,/:;<=>?@[\\\]{}\x7f]/g; // eslint-disable-line no-control-regex
+/**
+ * RegExp to match non-US-ASCII characters.
+ */
+const NON_ASCII_REGEXP = /[^\x20-\x7e]/g;
+/**
+ * RegExp to match chars that must be quoted-pair in RFC 2616
+ */
+const QUOTE_REGEXP = /[\\"]/g;
+/**
+ * Match chars that can't be used in the filename for compatibility.
+ */
+const INVALID_FILENAME_REGEXP = /%[0-9A-Fa-f]{2}/;
+/**
+ * RegExp for various RFC 2616 grammar
+ *
+ * parameter     = token "=" ( token | quoted-string )
+ * token         = 1*<any CHAR except CTLs or separators>
+ * separators    = "(" | ")" | "<" | ">" | "@"
+ *               | "," | ";" | ":" | "\" | <">
+ *               | "/" | "[" | "]" | "?" | "="
+ *               | "{" | "}" | SP | HT
+ * quoted-string = ( <"> *(qdtext | quoted-pair ) <"> )
+ * qdtext        = <any TEXT except <">>
+ * quoted-pair   = "\" CHAR
+ * CHAR          = <any US-ASCII character (octets 0 - 127)>
+ * TEXT          = <any OCTET except CTLs, but including LWS>
+ * LWS           = [CRLF] 1*( SP | HT )
+ * CRLF          = CR LF
+ * CR            = <US-ASCII CR, carriage return (13)>
+ * LF            = <US-ASCII LF, linefeed (10)>
+ * SP            = <US-ASCII SP, space (32)>
+ * HT            = <US-ASCII HT, horizontal-tab (9)>
+ * CTL           = <any US-ASCII control character (octets 0 - 31) and DEL (127)>
+ * OCTET         = <any 8-bit sequence of data>
+ */
+const TEXT_REGEXP = /^[\x20-\x7e\x80-\xff]*$/;
+const ASCII_TEXT_REGEXP = /^[\x20-\x7e]*$/;
+const TOKEN_REGEXP = /^[!#$%&'*+.0-9A-Z^_`a-z|~-]+$/;
+/**
+ * Create parameters object from filename and fallback.
+ */
+function createParameters(filename, fallback = true) {
+    if (filename === undefined)
+        return;
+    if (typeof fallback === 'string') {
+        if (!ASCII_TEXT_REGEXP.test(fallback)) {
+            throw new TypeError('Fallback must be valid US-ASCII: ' + fallback);
+        }
+        if (fallback === filename)
+            return { filename };
+        return { filename: fallback, 'filename*': encodeExtended(filename) };
+    }
+    // Use `filename` when possible, otherwise use `filename*`.
+    if (ASCII_TEXT_REGEXP.test(filename) &&
+        !INVALID_FILENAME_REGEXP.test(filename)) {
+        return { filename };
+    }
+    if (fallback === false) {
+        return { 'filename*': encodeExtended(filename) };
+    }
+    return {
+        filename: getAscii(filename),
+        'filename*': encodeExtended(filename),
+    };
+}
+/**
+ * Decode a RFC 8187 field value (gracefully).
+ */
+function decodeExtended(str) {
+    const charsetEnd = str.indexOf("'");
+    if (charsetEnd <= 0) {
+        return undefined;
+    }
+    const languageEnd = str.indexOf("'", charsetEnd + 1);
+    if (languageEnd === -1) {
+        return undefined;
+    }
+    const charset = str.slice(0, charsetEnd).toLowerCase();
+    const encoded = str.slice(languageEnd + 1);
+    switch (charset) {
+        case 'iso-8859-1': {
+            return decodeHexEscapes(encoded);
+        }
+        case 'utf-8':
+        case 'utf8': {
+            return tryDecodeURIComponent(encoded);
+        }
+    }
+    return undefined;
+}
+/**
+ * Decode URI component but return `undefined` on error.
+ */
+function tryDecodeURIComponent(str) {
+    try {
+        return decodeURIComponent(str);
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Parse a token starting at the provided index.
+ */
+function parseToken(str, index, len) {
+    while (index < len) {
+        const char = str.charCodeAt(index);
+        if (char === SEMI)
+            break;
+        index++;
+    }
+    return index;
+}
+/**
+ * Skip RFC 2616 linear whitespace (space / tab).
+ */
+function skipOWS(str, index, len) {
+    while (index < len) {
+        const char = str.charCodeAt(index);
+        if (char !== SP && char !== HTAB)
+            break;
+        index++;
+    }
+    return index;
+}
+/**
+ * Skip RFC 2616 linear whitespace (space / tab) from the end of a string.
+ */
+function trailingOWS(str, start, end) {
+    while (end > start) {
+        const char = str.charCodeAt(end - 1);
+        if (char !== SP && char !== HTAB)
+            break;
+        end--;
+    }
+    return end;
+}
+/**
+ * Format object to Content-Disposition header.
+ */
+function format(obj, options) {
+    const { type, parameters } = obj;
+    const multipart = options?.multipart === true;
+    const extended = options?.extended !== false;
+    if (!type || !TOKEN_REGEXP.test(type)) {
+        throw new TypeError('Invalid type: ' + type);
+    }
+    let result = type;
+    if (parameters) {
+        for (const param of Object.keys(parameters)) {
+            const value = parameters[param];
+            if (!TOKEN_REGEXP.test(param)) {
+                throw new TypeError('Invalid parameter name: ' + param);
+            }
+            if (multipart) {
+                result += '; ' + param + '=' + qmultipart(value);
+                continue;
+            }
+            if (TOKEN_REGEXP.test(value)) {
+                result += '; ' + param + '=' + value;
+                continue;
+            }
+            if (TEXT_REGEXP.test(value)) {
+                result += '; ' + param + '=' + qstring(value);
+                continue;
+            }
+            if (!extended) {
+                throw new TypeError('Invalid parameter value: ' + value);
+            }
+            result += '; ' + param + '*=' + encodeExtended(value);
+        }
+    }
+    return result;
+}
+/**
+ * Get US-ASCII version of string.
+ */
+function getAscii(val) {
+    // simple Unicode -> US-ASCII transformation
+    return val.replace(NON_ASCII_REGEXP, '?');
+}
+/**
+ * Percent encode a single character.
+ */
+function pencode(char) {
+    return '%' + char.charCodeAt(0).toString(16).toUpperCase();
+}
+/**
+ * Quote a string for HTTP.
+ */
+function qstring(str) {
+    return '"' + str.replace(QUOTE_REGEXP, '\\$&') + '"';
+}
+/**
+ * Quote a string for multipart/form-data.
+ *
+ * @see https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data
+ */
+function qmultipart(str) {
+    return '"' + str.replace(/[\n\r"]/g, multipartEscape) + '"';
+}
+/**
+ * Escape a multipart/form-data string character.
+ */
+function multipartEscape(char) {
+    if (char === '\n')
+        return '%0A';
+    if (char === '\r')
+        return '%0D';
+    return '%22';
+}
+/**
+ * Encode a Unicode string for HTTP (RFC 8187).
+ */
+function encodeExtended(str) {
+    const encoded = encodeURIComponent(str).replace(ENCODE_URL_ATTR_CHAR_REGEXP, pencode);
+    return "UTF-8''" + encoded;
+}
+/**
+ * Check if a character is a hex digit [0-9A-Fa-f]
+ */
+function isHexDigit(char) {
+    const code = char.charCodeAt(0);
+    return ((code >= 48 && code <= 57) || // 0-9
+        (code >= 65 && code <= 70) || // A-F
+        (code >= 97 && code <= 102) // a-f
+    );
+}
+/**
+ * Decode hex escapes in a string (e.g., %20 -> space)
+ */
+function decodeHexEscapes(str) {
+    const firstEscape = str.indexOf('%');
+    if (firstEscape === -1)
+        return str;
+    let result = str.slice(0, firstEscape);
+    for (let idx = firstEscape; idx < str.length; idx++) {
+        if (str[idx] === '%' &&
+            idx + 2 < str.length &&
+            isHexDigit(str[idx + 1]) &&
+            isHexDigit(str[idx + 2])) {
+            result += String.fromCharCode(Number.parseInt(str[idx + 1] + str[idx + 2], 16));
+            idx += 2;
+        }
+        else {
+            result += str[idx];
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=index.js.map