@suveren/gateway 0.37.0 → 0.39.0

package/node_modules/@modelcontextprotocol/sdk/node_modules/body-parser/lib/types/json.js

@@ -23,7 +23,7 @@ const { normalizeOptions } = require('../utils')
 module.exports = json
 
 /**
- * RegExp to match the first non-space in a string.
+ * RegExp to match the first non-whitespace character in a string.
  *
  * Allowed whitespace is defined in RFC 7159:
  *
@@ -33,7 +33,7 @@ module.exports = json
  *            %x0A /              ; Line feed or New line
  *            %x0D )              ; Carriage return
  */
-const FIRST_CHAR_REGEXP = /^[\x20\x09\x0a\x0d]*([^\x20\x09\x0a\x0d])/ // eslint-disable-line no-control-regex
+const FIRST_NON_WHITESPACE_REGEXP = /^[\x20\x09\x0a\x0d]*([^\x20\x09\x0a\x0d]|$)/ // eslint-disable-line no-control-regex
 
 const JSON_SYNTAX_CHAR = '#'
 const JSON_SYNTAX_REGEXP = /#+/g
@@ -80,10 +80,12 @@ function createJsonParser (options) {
         return {}
       }
 
-      const first = firstchar(body)
-      if (first !== '{' && first !== '[') {
-        debug('strict violation')
-        throw createStrictSyntaxError(body, first)
+      if (body[0] !== '{' && body[0] !== '[') {
+        const first = firstNonWhitespaceChar(body)
+        if (first !== '{' && first !== '[') {
+          debug('strict violation')
+          throw createStrictSyntaxError(body, first)
+        }
       }
 
       try {
@@ -152,12 +154,10 @@ function createStrictSyntaxError (str, char) {
  * @returns {string|undefined}
  * @private
  */
-function firstchar (str) {
-  const match = FIRST_CHAR_REGEXP.exec(str)
+function firstNonWhitespaceChar (str) {
+  const match = FIRST_NON_WHITESPACE_REGEXP.exec(str)
 
-  return match
-    ? match[1]
-    : undefined
+  return match && match[1] ? match[1] : undefined
 }
 
 /**

package/node_modules/@modelcontextprotocol/sdk/node_modules/body-parser/lib/types/urlencoded.js

@@ -98,12 +98,12 @@ function createQueryParser (options) {
     try {
       return qs.parse(body, {
         allowPrototypes: true,
-        arrayLimit: arrayLimit,
-        depth: depth,
-        charsetSentinel: charsetSentinel,
-        interpretNumericEntities: interpretNumericEntities,
+        arrayLimit,
+        depth,
+        charsetSentinel,
+        interpretNumericEntities,
         charset: encoding,
-        parameterLimit: parameterLimit,
+        parameterLimit,
         strictDepth: true
       })
     } catch (err) {

package/node_modules/@modelcontextprotocol/sdk/node_modules/body-parser/lib/utils.js

@@ -5,31 +5,16 @@
  */
 
 const bytes = require('bytes')
-const contentType = require('content-type')
 const typeis = require('type-is')
 
 /**
  * Module exports.
  */
 module.exports = {
-  getCharset,
   normalizeOptions,
   passthrough
 }
 
-/**
- * Get the charset of a request.
- *
- * @param {Object} req
- * @returns {string | undefined}
- * @private
- */
-function getCharset (req) {
-  const header = req.headers['content-type']
-  if (!header) return undefined
-  return contentType.parse(header).parameters.charset?.toLowerCase()
-}
-
 /**
  * Get the simple type checker.
  *

package/node_modules/@modelcontextprotocol/sdk/node_modules/body-parser/package.json

@@ -1,7 +1,7 @@
 {
   "name": "body-parser",
   "description": "Node.js body parsing middleware",
-  "version": "2.3.0",
+  "version": "2.4.0",
   "contributors": [
     "Douglas Christopher Wilson <doug@somethingdoug.com>",
     "Jonathan Ong <me@jongleberry.com> (http://jongleberry.com)"
@@ -27,26 +27,21 @@
   },
   "dependencies": {
     "bytes": "^3.1.2",
-    "content-type": "^2.0.0",
+    "content-type": "^2.1.0",
     "debug": "^4.4.3",
     "http-errors": "^2.0.1",
-    "iconv-lite": "^0.7.2",
+    "iconv-lite": "^0.7.3",
     "on-finished": "^2.4.1",
-    "qs": "^6.15.2",
+    "qs": "^6.16.1",
     "raw-body": "^3.0.2",
     "type-is": "^2.1.0"
   },
   "devDependencies": {
-    "eslint": "^8.57.1",
-    "eslint-config-standard": "^14.1.1",
-    "eslint-plugin-import": "^2.32.0",
-    "eslint-plugin-markdown": "^3.0.1",
-    "eslint-plugin-node": "^11.1.0",
-    "eslint-plugin-promise": "^6.6.0",
-    "eslint-plugin-standard": "^4.1.0",
+    "eslint": "^9.39.5",
     "mocha": "^11.7.6",
+    "neostandard": "^0.13.0",
     "nyc": "^17.1.0",
-    "supertest": "^7.2.2"
+    "supertest": "7.3.0"
   },
   "files": [
     "lib/",

package/node_modules/body-parser/HISTORY.md

@@ -1,10 +1,15 @@
+1.20.9
+======
+
+* Security fix for [GHSA-27r3-jxmh-p828](https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828) (CVE-2026-111181)
+
 1.20.8
-===================
+======
 
 * Same code base as 1.20.7. This was created to test the new release process.
 
 1.20.7
-===================
+======
 
 * deps: qs@~6.16.0
 

package/node_modules/body-parser/README.md

@@ -98,7 +98,7 @@ argument. You can find more information on this argument
 
 ##### strict
 
-When set to `true`, will only accept arrays and objects; when `false` will
+When set to `true`, it will only accept arrays and objects; when `false`, it will
 accept anything `JSON.parse` accepts. Defaults to `true`.
 
 ##### type
@@ -313,7 +313,7 @@ the entity value that failed parsing.
 ### entity verify failed
 
 This error will occur when the request contained an entity that could not be
-failed verification by the defined `verify` option. The `status` property is
+verified by the defined `verify` option. The `status` property is
 set to `403`, the `type` property is set to `'entity.verify.failed'`, and the
 `body` property is set to the entity value that failed verification.
 
@@ -380,7 +380,7 @@ property is set to the encoding that is unsupported.
 
 ### The input exceeded the depth
 
-This error occurs when using `bodyParser.urlencoded` with the `extended` property set to `true` and the input exceeds the configured `depth` option. The `status` property is set to `400`. It is recommended to review the `depth` option and evaluate if it requires a higher value. When the `depth` option is set to `32` (default value), the error will not be thrown.
+This error occurs when using `bodyParser.urlencoded` with the `extended` property set to `true` and the input exceeds the configured `depth` option. The `status` property is set to `400`. It is recommended to review the `depth` option and evaluate if it requires a higher value. With the default `depth` of `32`, an input with 33 or more levels of nesting gets this error.
 
 ## Examples
 

package/node_modules/body-parser/lib/read.js

@@ -51,6 +51,15 @@ function read (req, res, next, parse, debug, options) {
     : null
   var verify = opts.verify
 
+  // assert charset is supported before creating the decompression stream, so a
+  // 415 cannot leave a decoder piped with no error listener
+  if (verify && encoding !== null && !iconv.encodingExists(encoding)) {
+    return next(createError(415, 'unsupported charset "' + encoding.toUpperCase() + '"', {
+      charset: encoding.toLowerCase(),
+      type: 'charset.unsupported'
+    }))
+  }
+
   try {
     // get the content stream
     stream = contentstream(req, debug, opts.inflate)
@@ -66,14 +75,6 @@ function read (req, res, next, parse, debug, options) {
     ? null
     : encoding
 
-  // assert charset is supported
-  if (opts.encoding === null && encoding !== null && !iconv.encodingExists(encoding)) {
-    return next(createError(415, 'unsupported charset "' + encoding.toUpperCase() + '"', {
-      charset: encoding.toLowerCase(),
-      type: 'charset.unsupported'
-    }))
-  }
-
   // read body
   debug('read body')
   getBody(stream, opts, function (error, body) {
@@ -104,6 +105,23 @@ function read (req, res, next, parse, debug, options) {
       return
     }
 
+    // detach and destroy the decompression stream to avoid
+    // decompression errors on the finished stream
+    if (stream !== req) {
+      // only detach the decompression stream, keep other consumers piped
+      if (typeof req.unpipe === 'function') {
+        req.unpipe(stream)
+      } else {
+        // Node.js 0.8 streams have no unpipe(dest)
+        unpipe(req)
+      }
+      stream.on('error', function () {})
+      destroy(stream, true)
+
+      // consume any remaining bytes so the HTTP request can finish
+      req.resume()
+    }
+
     // verify
     if (verify) {
       try {

package/node_modules/body-parser/package.json

@@ -1,7 +1,7 @@
 {
   "name": "body-parser",
   "description": "Node.js body parsing middleware",
-  "version": "1.20.8",
+  "version": "1.20.9",
   "contributors": [
     "Douglas Christopher Wilson <doug@somethingdoug.com>",
     "Jonathan Ong <me@jongleberry.com> (http://jongleberry.com)"

package/node_modules/on-finished/index.js

@@ -65,10 +65,11 @@ function onFinished (msg, listener) {
 
 function isFinished (msg) {
   var socket = msg.socket
+  var finished = writableEnded(msg)
 
-  if (typeof msg.finished === 'boolean') {
+  if (typeof finished === 'boolean') {
     // OutgoingMessage
-    return Boolean(msg.finished || (socket && !socket.writable))
+    return Boolean(finished || (socket && !socket.writable))
   }
 
   if (typeof msg.complete === 'boolean') {
@@ -232,3 +233,14 @@ function wrap (fn) {
   // return bound function
   return res.runInAsyncScope.bind(res, fn, null)
 }
+
+/**
+ * Determines if a writable stream has finished.
+ *
+ * @param {Object} res
+ * @returns {boolean}
+ * @private
+ */
+function writableEnded (res) {
+  return typeof res.writableEnded === 'boolean' ? res.writableEnded : res.finished
+}

package/node_modules/on-finished/package.json

@@ -1,38 +1,42 @@
 {
   "name": "on-finished",
   "description": "Execute a callback when a request closes, finishes, or errors",
-  "version": "2.4.1",
+  "version": "2.4.2",
   "contributors": [
     "Douglas Christopher Wilson <doug@somethingdoug.com>",
     "Jonathan Ong <me@jongleberry.com> (http://jongleberry.com)"
   ],
   "license": "MIT",
   "repository": "jshttp/on-finished",
+  "funding": {
+    "type": "opencollective",
+    "url": "https://opencollective.com/express"
+  },
+  "type": "commonjs",
   "dependencies": {
     "ee-first": "1.1.1"
   },
   "devDependencies": {
-    "eslint": "7.32.0",
+    "eslint": "8.17.0",
     "eslint-config-standard": "14.1.1",
-    "eslint-plugin-import": "2.25.4",
+    "eslint-plugin-import": "2.26.0",
     "eslint-plugin-markdown": "2.2.1",
     "eslint-plugin-node": "11.1.0",
-    "eslint-plugin-promise": "5.2.0",
+    "eslint-plugin-promise": "6.0.0",
     "eslint-plugin-standard": "4.1.0",
-    "mocha": "9.2.1",
+    "mocha": "12.0.3",
     "nyc": "15.1.0"
   },
   "engines": {
     "node": ">= 0.8"
   },
   "files": [
-    "HISTORY.md",
     "LICENSE",
     "index.js"
   ],
   "scripts": {
     "lint": "eslint .",
-    "test": "mocha --reporter spec --bail --check-leaks test/",
+    "test": "mocha --reporter spec --check-leaks test/",
     "test-ci": "nyc --reporter=lcovonly --reporter=text npm test",
     "test-cov": "nyc --reporter=html --reporter=text npm test"
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@suveren/gateway",
-  "version": "0.37.0",
+  "version": "0.39.0",
   "description": "Suveren gateway — local agent gateway built in compliance with the Human Agency Protocol (HAP). Runs the UI, control plane, and MCP server in one Node process.",
   "type": "module",
   "main": "server.js",

package/profiles/index.json

@@ -55,6 +55,7 @@
     "github.com/humanagencyprotocol/hap-profiles/invoicing@0.1": "invoicing/0.1.profile.json",
     "github.com/humanagencyprotocol/hap-profiles/charge@0.7": "charge/0.7.profile.json",
     "github.com/humanagencyprotocol/hap-profiles/email@0.9": "email/0.9.profile.json",
-    "github.com/humanagencyprotocol/hap-profiles/delegation@0.6": "delegation/0.6.profile.json"
+    "github.com/humanagencyprotocol/hap-profiles/delegation@0.6": "delegation/0.6.profile.json",
+    "github.com/humanagencyprotocol/hap-profiles/master-data@0.1": "master-data/0.1.profile.json"
   }
 }

package/profiles/master-data/0.1.profile.json

@@ -0,0 +1,311 @@
+{
+  "id": "github.com/humanagencyprotocol/hap-profiles/master-data@0.1",
+  "name": "Master data",
+  "version": "0.1",
+  "description": "Master data authority — governs the customer records and the catalogue that quotes and invoices are built from: creating and changing customers, and creating and changing catalogue items. A change to a customer's tax data (name, address, country, VAT ID) and a change to an item's price or VAT rate are each a decision of their own. Kept apart from invoicing and sales so that the people who issue documents are not the ones who change the data behind them. A change to a customer's payment data (bank account / IBAN, payment terms, credit limit, dunning or payment method) is its own decision too — the classic entry point for payment fraud; it is governed here wherever a connector offers such a change (ERP Local offers none). Every action in this area is reviewed by a person. No invoices, quotes or payments.",
+  "whatsNew": "New area. Customers and catalogue items are created and changed here, each kind of change with its own daily limit; changes to a customer's bank and payment data (for connectors that offer them) have their own daily limit and a cap on the credit limit. Every action is reviewed by a person (no automatic mode).",
+  "commitment_modes": [
+    "review"
+  ],
+  "boundsSchema": {
+    "actionTypes": [
+      "customer_create",
+      "customer_update",
+      "customer_tax",
+      "customer_payment",
+      "item_create",
+      "item_update",
+      "item_price"
+    ],
+    "keyOrder": [
+      "profile",
+      "read_access",
+      "customer_create_daily_max",
+      "customer_update_daily_max",
+      "customer_tax_daily_max",
+      "customer_payment_daily_max",
+      "item_create_daily_max",
+      "item_update_daily_max",
+      "item_price_daily_max",
+      "list_price_max",
+      "credit_limit_max"
+    ],
+    "fields": {
+      "profile": {
+        "type": "string",
+        "required": true
+      },
+      "read_access": {
+        "type": "string",
+        "required": true,
+        "displayName": "Read access",
+        "description": "Allow the agent to look up customers and catalogue items.",
+        "boundType": {
+          "kind": "enum",
+          "values": [
+            "unlimited",
+            "none"
+          ]
+        },
+        "toolsDescription": "find_customers, get_customer, list_items, get_item",
+        "default": "unlimited"
+      },
+      "customer_create_daily_max": {
+        "type": "number",
+        "required": true,
+        "displayName": "New customers per day",
+        "description": "Maximum customers created per day. A new customer's name, address, country and VAT ID decide how invoices to them are taxed.",
+        "unit": "count",
+        "boundType": {
+          "kind": "cumulative_count",
+          "window": "daily"
+        },
+        "appliesTo": [
+          "customer_create"
+        ]
+      },
+      "customer_update_daily_max": {
+        "type": "number",
+        "required": true,
+        "displayName": "Customer contact changes per day",
+        "description": "Maximum changes per day to a customer's contact data (email, CRM link). Tax data is its own limit.",
+        "unit": "count",
+        "boundType": {
+          "kind": "cumulative_count",
+          "window": "daily"
+        },
+        "appliesTo": [
+          "customer_update"
+        ]
+      },
+      "customer_tax_daily_max": {
+        "type": "number",
+        "required": true,
+        "displayName": "Customer tax-data changes per day",
+        "description": "Maximum changes per day to a customer's tax data: name, address, country or VAT ID. These decide how future invoices to that customer are taxed.",
+        "unit": "count",
+        "boundType": {
+          "kind": "cumulative_count",
+          "window": "daily"
+        },
+        "appliesTo": [
+          "customer_tax"
+        ]
+      },
+      "customer_payment_daily_max": {
+        "type": "number",
+        "required": true,
+        "displayName": "Customer payment-data changes per day",
+        "description": "Maximum changes per day to a customer's payment data: bank account / IBAN, payment terms, credit limit, dunning or payment method. A changed bank account is the classic way payments are diverted.",
+        "unit": "count",
+        "boundType": {
+          "kind": "cumulative_count",
+          "window": "daily"
+        },
+        "appliesTo": [
+          "customer_payment"
+        ]
+      },
+      "item_create_daily_max": {
+        "type": "number",
+        "required": true,
+        "displayName": "New items per day",
+        "description": "Maximum catalogue items created per day.",
+        "unit": "count",
+        "boundType": {
+          "kind": "cumulative_count",
+          "window": "daily"
+        },
+        "appliesTo": [
+          "item_create"
+        ]
+      },
+      "item_update_daily_max": {
+        "type": "number",
+        "required": true,
+        "displayName": "Item changes per day",
+        "description": "Maximum changes per day to catalogue items other than price and VAT rate (name, SKU, unit, kind, description, active).",
+        "unit": "count",
+        "boundType": {
+          "kind": "cumulative_count",
+          "window": "daily"
+        },
+        "appliesTo": [
+          "item_update"
+        ]
+      },
+      "item_price_daily_max": {
+        "type": "number",
+        "required": true,
+        "displayName": "Price changes per day",
+        "description": "Maximum price or VAT-rate changes to existing catalogue items per day.",
+        "unit": "count",
+        "boundType": {
+          "kind": "cumulative_count",
+          "window": "daily"
+        },
+        "appliesTo": [
+          "item_price"
+        ]
+      },
+      "list_price_max": {
+        "type": "number",
+        "required": true,
+        "displayName": "Max list price per item",
+        "description": "Highest net list price a catalogue item may be given, when it is created or its price is changed, in currency units.",
+        "unit": "currency:EUR",
+        "boundType": {
+          "kind": "per_transaction",
+          "of": "list_price",
+          "requiredFor": [
+            "item_create",
+            "item_price"
+          ]
+        }
+      },
+      "credit_limit_max": {
+        "type": "number",
+        "required": true,
+        "displayName": "Max credit limit per customer",
+        "description": "Highest credit limit a customer may be given in one payment-data change, in currency units. Applies whenever the change sets a credit limit; a bank or payment-terms change that sets none is limited by the daily count only.",
+        "unit": "currency:EUR",
+        "boundType": {
+          "kind": "per_transaction",
+          "of": "credit_limit"
+        }
+      }
+    }
+  },
+  "executionContextSchema": {
+    "fields": {
+      "list_price": {
+        "source": "declared",
+        "description": "Net list price of the item in currency units (create_item, update_item_price)",
+        "required": false,
+        "constraint": {
+          "type": "number",
+          "enforceable": [
+            "max"
+          ]
+        }
+      },
+      "credit_limit": {
+        "source": "declared",
+        "description": "Credit limit a payment-data change sets for the customer, in currency units (only when the change sets one)",
+        "required": false,
+        "constraint": {
+          "type": "number",
+          "enforceable": [
+            "max"
+          ]
+        }
+      },
+      "customer_create_count_daily": {
+        "source": "cumulative",
+        "description": "Running daily count of customers created",
+        "required": true,
+        "constraint": {
+          "type": "number",
+          "enforceable": [
+            "max"
+          ]
+        },
+        "cumulativeField": "_count",
+        "window": "daily"
+      },
+      "customer_update_count_daily": {
+        "source": "cumulative",
+        "description": "Running daily count of customer contact-data changes",
+        "required": true,
+        "constraint": {
+          "type": "number",
+          "enforceable": [
+            "max"
+          ]
+        },
+        "cumulativeField": "_count",
+        "window": "daily"
+      },
+      "customer_tax_count_daily": {
+        "source": "cumulative",
+        "description": "Running daily count of customer tax-data changes",
+        "required": true,
+        "constraint": {
+          "type": "number",
+          "enforceable": [
+            "max"
+          ]
+        },
+        "cumulativeField": "_count",
+        "window": "daily"
+      },
+      "customer_payment_count_daily": {
+        "source": "cumulative",
+        "description": "Running daily count of customer payment-data changes",
+        "required": true,
+        "constraint": {
+          "type": "number",
+          "enforceable": [
+            "max"
+          ]
+        },
+        "cumulativeField": "_count",
+        "window": "daily"
+      },
+      "item_create_count_daily": {
+        "source": "cumulative",
+        "description": "Running daily count of catalogue items created",
+        "required": true,
+        "constraint": {
+          "type": "number",
+          "enforceable": [
+            "max"
+          ]
+        },
+        "cumulativeField": "_count",
+        "window": "daily"
+      },
+      "item_update_count_daily": {
+        "source": "cumulative",
+        "description": "Running daily count of catalogue item changes (not price)",
+        "required": true,
+        "constraint": {
+          "type": "number",
+          "enforceable": [
+            "max"
+          ]
+        },
+        "cumulativeField": "_count",
+        "window": "daily"
+      },
+      "item_price_count_daily": {
+        "source": "cumulative",
+        "description": "Running daily count of item price or VAT-rate changes",
+        "required": true,
+        "constraint": {
+          "type": "number",
+          "enforceable": [
+            "max"
+          ]
+        },
+        "cumulativeField": "_count",
+        "window": "daily"
+      }
+    }
+  },
+  "requiredGates": [
+    "bounds",
+    "intent",
+    "commitment",
+    "mandate_owner"
+  ],
+  "ttl": {
+    "default": 86400,
+    "max": 2592000
+  },
+  "retention_minimum": 7776000,
+  "content_binding": {
+    "version": "1",
+    "kind": "jcs"
+  }
+}