@suveren/gateway 0.7.4 → 0.8.0

package/node_modules/@hap/core/src/gatekeeper.ts

@@ -86,6 +86,28 @@ export async function verify(
   }
 }
 
+/**
+ * Fail closed when there is nothing to verify.
+ *
+ * The attestation loop below is a `for` over `request.attestations`. With an
+ * empty (or missing) array it runs zero times, pushes zero errors, and control
+ * falls through to the bounds check — which happily approves a call whose
+ * signature, bounds_hash, and TTL were never checked. "No errors" is not the
+ * same as "verified"; an absent attestation is the one case where silence must
+ * read as refusal.
+ */
+function noAttestationSupplied(request: GatekeeperRequest): boolean {
+  return !Array.isArray(request.attestations) || request.attestations.length === 0;
+}
+
+/** Built fresh per call so a caller cannot mutate a shared error array. */
+function noAttestationResult(): GatekeeperResult {
+  return {
+    approved: false,
+    errors: [{ code: 'MALFORMED_ATTESTATION', message: 'No attestation supplied — nothing to verify' }],
+  };
+}
+
 // ─── v0.3 Verification ────────────────────────────────────────────────────────
 
 async function verifyV3(
@@ -96,6 +118,8 @@ async function verifyV3(
   executionLog: ExecutionLogQuery | undefined,
   errors: GatekeeperError[],
 ): Promise<GatekeeperResult> {
+  if (noAttestationSupplied(request)) return noAttestationResult();
+
   let expectedFrameHash: string;
   try {
     expectedFrameHash = computeFrameHash(request.frame, profile);
@@ -179,6 +203,8 @@ async function verifyV4(
   now: number,
   executionLog: ExecutionLogQuery | undefined,
 ): Promise<GatekeeperResult> {
+  if (noAttestationSupplied(request)) return noAttestationResult();
+
   const errors: GatekeeperError[] = [];
 
   // In v0.4 the `frame` param carries bounds; `context` carries context params

package/node_modules/@hap/core/src/identity.ts

@@ -8,7 +8,7 @@
  *  - {@link deriveIdentityLine} — the human-readable footer line for a subject.
  */
 
-import type { Subject } from './types';
+import type { OwnerMandate, Subject } from './types';
 
 export interface SubjectValidation {
   valid: boolean;
@@ -19,12 +19,25 @@ export interface SubjectValidation {
  * Enforce the Identity-Assurance invariants on a single subject:
  *  - `self_declared` ⇒ `low` / `self`, no disclosed name.
  *  - `as_vouched`    ⇒ `high` / `as`,  `verifier` required.
- *  - `eudi`          ⇒ `high` / `external`, `verifier` + `owner_signature` required.
+ *  - `eudi`          ⇒ `high` / `external`, `verifier` required — and, when the
+ *    carrying attestation's `owner_mandates` are supplied, a corresponding
+ *    entry with `binding:"eudi"` for this subject's DID.
  *  - `disclose.name` only at `assurance:"high"`.
+ *
+ * v0.6: `Subject.owner_signature` is deprecated and IGNORED here — it signed
+ * the identity claim, not the mandate (see the field's deprecation note). The
+ * signature-bearing object is the attestation's `owner_mandates` entry, which
+ * is payload-level context this per-subject check cannot see on its own; pass
+ * `opts.ownerMandates` to enforce the eudi ⇒ mandate-entry rule, omit it to
+ * validate subject shape alone (pre-0.6 callers keep their behaviour minus
+ * the retired owner_signature requirement).
  */
-export function validateSubject(subject: Subject): SubjectValidation {
+export function validateSubject(
+  subject: Subject,
+  opts?: { ownerMandates?: OwnerMandate[] },
+): SubjectValidation {
   const errors: string[] = [];
-  const { did, assurance, method, trust_root, verifier, disclose, owner_signature } = subject;
+  const { did, assurance, method, trust_root, verifier, disclose } = subject;
 
   if (!did) errors.push('subject.did is required');
 
@@ -39,7 +52,10 @@ export function validateSubject(subject: Subject): SubjectValidation {
     } else if (method === 'eudi') {
       if (trust_root !== 'external') errors.push('eudi requires trust_root "external"');
       if (!verifier) errors.push('eudi requires a verifier');
-      if (!owner_signature) errors.push('eudi requires an owner_signature');
+      if (opts?.ownerMandates !== undefined) {
+        const entry = opts.ownerMandates.find(m => m.did === did && m.binding === 'eudi');
+        if (!entry) errors.push('eudi requires an owner_mandates entry with binding "eudi" for this DID');
+      }
     } else {
       errors.push(`high assurance requires method "as_vouched" or "eudi", got "${method}"`);
     }

package/node_modules/@hap/core/src/index.ts

@@ -13,3 +13,6 @@ export * from './frame';
 export * from './attestation';
 export * from './gatekeeper';
 export * from './profiles';
+export * from './did-key';
+export * from './mandate';
+export * from './receipt';

package/node_modules/@hap/core/src/mandate.ts

@@ -0,0 +1,207 @@
+/**
+ * Owner Mandate Signatures (HAP v0.6) — the `HAP-mandate` projection, the
+ * `HAP-approval` object, and their verification.
+ *
+ * The human signs BEFORE the AS does, so they cannot sign the finished
+ * attestation (`attestation_id`/`issued_at` do not exist yet). They sign a
+ * mandate PROJECTION: a canonical object every field of which is known at
+ * approval time and reconstructible from the finished attestation — so a
+ * verifier rebuilds it from the attestation it already holds and checks the
+ * signature with the key carried in the owner's DID. No side channel, no
+ * second fetch, no key directory. See protocol.md → "Owner Mandate Signatures".
+ *
+ * Verification here requires NO trust in the AS. What it cannot do is tell the
+ * verifier WHOSE key signed — confirming the DID belongs to the expected
+ * person is the out-of-band step (protocol.md → "Identity DIDs vs signing
+ * DIDs"), and it is the honest cost of cold verification.
+ */
+
+import * as ed from '@noble/ed25519';
+import type { Attestation, AttestationPayload, OwnerMandate } from './types';
+import { canonicalize } from './canonicalize';
+import { decodeDidKey } from './did-key';
+
+/** The object the owner signs — a canonical projection of the mandate. */
+export interface MandateProjection {
+  typ: 'HAP-mandate';
+  /** Projection/canonicalization version. A verifier MUST pin it. */
+  version: '0.6';
+  profile_id: string;
+  /** The signing owner's own DID. MUST be a member of `resolved_owners`. */
+  owner_did: string;
+  bounds_hash: string;
+  context_hash: string;
+  execution_context_hash: string;
+  gate_content_hashes: Record<string, string>;
+  /** Included iff the attestation carries one — binds ciphertext AND the
+   * frozen approver set, the swap this mechanism exists to stop. */
+  intent_disclosure_hash?: string;
+  commitment_mode: string;
+  /** The replay defence: the human signs how long the authority lives. */
+  expires_at: number;
+  nonce: string;
+}
+
+/** Per-action approval, signed by the owner in `review` mode. Signing a
+ * `reject` matters as much as a `commit`: a rejection the AS can discard is a
+ * rejection that never happened. */
+export interface ApprovalObject {
+  typ: 'HAP-approval';
+  version: '0.6';
+  proposal_id: string;
+  attestation_id: string;
+  decision: 'commit' | 'reject';
+  /** What was approved: the receipt's contentHash where the profile binds
+   * content; otherwise sha256 over the JCS of the proposal's argument set. */
+  content_hash: string;
+  decided_at: number;
+  nonce: string;
+}
+
+export class MandateError extends Error {
+  constructor(
+    public code:
+      | 'MANDATE_SIGNATURE_INVALID'
+      | 'APPROVAL_SIGNATURE_INVALID'
+      | 'NOT_KEY_BEARING'
+      | 'OWNER_NOT_RESOLVED'
+      | 'MALFORMED_ATTESTATION',
+    message: string,
+  ) {
+    super(`${code}: ${message}`);
+    this.name = 'MandateError';
+  }
+}
+
+/**
+ * Rebuild the projection a given `owner_mandates` entry signed, from the
+ * attestation's own signed fields. Field absence is defined, not incidental:
+ * `intent_disclosure_hash` is included iff the attestation carries one.
+ */
+export function buildMandateProjection(
+  payload: AttestationPayload,
+  entry: Pick<OwnerMandate, 'did' | 'nonce'>,
+): MandateProjection {
+  const { profile_id, bounds_hash, context_hash, execution_context_hash, gate_content_hashes, commitment_mode, expires_at } = payload;
+  if (!bounds_hash || !context_hash || !commitment_mode) {
+    throw new MandateError('MALFORMED_ATTESTATION', 'mandate projection requires bounds_hash, context_hash and commitment_mode');
+  }
+  const projection: MandateProjection = {
+    typ: 'HAP-mandate',
+    version: '0.6',
+    profile_id,
+    owner_did: entry.did,
+    bounds_hash,
+    context_hash,
+    execution_context_hash,
+    gate_content_hashes,
+    commitment_mode,
+    expires_at,
+    nonce: entry.nonce,
+  };
+  if (payload.intent_disclosure_hash !== undefined) {
+    projection.intent_disclosure_hash = payload.intent_disclosure_hash;
+  }
+  return projection;
+}
+
+/** The exact bytes an owner signs: RFC 8785 (JCS) canonical UTF-8. */
+export function mandateSigningBytes(projection: MandateProjection): Uint8Array {
+  return new TextEncoder().encode(canonicalize(projection));
+}
+
+/** The exact bytes an owner signs for a per-action approval. */
+export function approvalSigningBytes(approval: ApprovalObject): Uint8Array {
+  return new TextEncoder().encode(canonicalize(approval));
+}
+
+function base64urlToBytes(s: string): Uint8Array {
+  const base64 = s.replace(/-/g, '+').replace(/_/g, '/');
+  const padding = base64.length % 4 === 0 ? '' : '='.repeat(4 - (base64.length % 4));
+  return new Uint8Array(Buffer.from(base64 + padding, 'base64'));
+}
+
+function bytesToBase64url(bytes: Uint8Array): string {
+  return Buffer.from(bytes).toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+
+/**
+ * Sign a mandate projection with a raw Ed25519 private key — the `raw`
+ * binding: tests and CI only, no custody claim. WebAuthn (`webauthn`) and
+ * wallet (`eudi`) bindings sign the same bytes through their own custody;
+ * they are implemented by the platforms that hold those keys, not here.
+ */
+export async function signMandateProjection(
+  projection: MandateProjection,
+  privateKey: Uint8Array,
+): Promise<string> {
+  const sig = await ed.signAsync(mandateSigningBytes(projection), privateKey);
+  return bytesToBase64url(sig);
+}
+
+/** Sign an approval object with a raw Ed25519 private key (`raw` binding). */
+export async function signApproval(approval: ApprovalObject, privateKey: Uint8Array): Promise<string> {
+  const sig = await ed.signAsync(approvalSigningBytes(approval), privateKey);
+  return bytesToBase64url(sig);
+}
+
+/**
+ * Verify ONE `owner_mandates` entry against the attestation that carries it.
+ *
+ * Steps (protocol.md → "Verification procedure", steps 4 of 6): membership in
+ * `resolved_owners`, key-bearing DID, projection reconstruction, Ed25519 over
+ * JCS bytes. The DID is authoritative over `alg` — a disagreement is
+ * MANDATE_SIGNATURE_INVALID, never a fallback to the claimed algorithm.
+ *
+ * What this deliberately does NOT verify: that the DID belongs to the person
+ * the verifier expects (out-of-band, step 5) and the AS's own signature over
+ * the attestation (verifyAttestationSignature, step 1).
+ */
+export async function verifyOwnerMandate(attestation: Attestation, entry: OwnerMandate): Promise<void> {
+  const owners = attestation.payload.resolved_owners ?? [];
+  if (!owners.includes(entry.did)) {
+    throw new MandateError('OWNER_NOT_RESOLVED', `signing DID ${entry.did} is not in resolved_owners`);
+  }
+  if (entry.alg !== 'EdDSA') {
+    // The only key type a did:key carries in this protocol version is Ed25519;
+    // an entry claiming otherwise disagrees with its own DID.
+    throw new MandateError('MANDATE_SIGNATURE_INVALID', `alg ${entry.alg} disagrees with the DID's key type (DID is authoritative)`);
+  }
+  let publicKey: Uint8Array;
+  try {
+    publicKey = decodeDidKey(entry.did);
+  } catch (err) {
+    throw new MandateError('NOT_KEY_BEARING', (err as Error).message);
+  }
+
+  const projection = buildMandateProjection(attestation.payload, entry);
+  const ok = await ed.verifyAsync(base64urlToBytes(entry.signature), mandateSigningBytes(projection), publicKey);
+  if (!ok) {
+    throw new MandateError('MANDATE_SIGNATURE_INVALID', `owner mandate signature by ${entry.did} does not verify`);
+  }
+}
+
+/** Verify every `owner_mandates` entry an attestation carries. Resolves to the
+ * verified entries; an attestation with none resolves to `[]` (the v0.5
+ * posture — nothing to check, and nothing claimed). */
+export async function verifyOwnerMandates(attestation: Attestation): Promise<OwnerMandate[]> {
+  const entries = attestation.payload.owner_mandates ?? [];
+  for (const entry of entries) {
+    await verifyOwnerMandate(attestation, entry);
+  }
+  return entries;
+}
+
+/** Verify an approval signature against a signer's key-bearing DID. */
+export async function verifyApproval(approval: ApprovalObject, signature: string, signerDid: string): Promise<void> {
+  let publicKey: Uint8Array;
+  try {
+    publicKey = decodeDidKey(signerDid);
+  } catch (err) {
+    throw new MandateError('NOT_KEY_BEARING', (err as Error).message);
+  }
+  const ok = await ed.verifyAsync(base64urlToBytes(signature), approvalSigningBytes(approval), publicKey);
+  if (!ok) {
+    throw new MandateError('APPROVAL_SIGNATURE_INVALID', `approval signature by ${signerDid} does not verify`);
+  }
+}

package/node_modules/@hap/core/src/receipt.ts

@@ -0,0 +1,74 @@
+/**
+ * Execution receipts (HAP v0.5/v0.6) — the wire type and holder-side
+ * verification. Until v0.6 this library had no receipt surface at all; every
+ * verifier hand-assembled the strip→canonicalize→verify dance. This module is
+ * that dance, once.
+ *
+ * Receipt payloads are camelCase on the wire (unlike the snake_case
+ * attestation payload) — a shipped inconsistency v0.6 chose to document
+ * rather than break (changelog.md → "Renames and terminology").
+ */
+
+import * as ed from '@noble/ed25519';
+import type { ContentBinding, Subject } from './types';
+import { canonicalize } from './canonicalize';
+
+/** Signed execution receipt — protocol.md → "Receipt Payload Schema". */
+export interface ReceiptPayload {
+  id: string;
+  groupId?: string | null;
+  userId?: string;
+  boundsHash: string;
+  profileId: string;
+  /** Downstream tool name. Audit metadata only — never a dispatch key. */
+  action: string;
+  /** Semantic category — drives cumulative bucketing and bounds dispatch. */
+  actionType: string;
+  executionContext: Record<string, unknown>;
+  cumulativeState?: Record<string, unknown>;
+  limits?: Record<string, unknown>;
+  timestamp: number;
+  /** v0.6 — hash of the bound content, computed by the Gatekeeper, copied
+   * verbatim by the AS. The AS never sees the content. */
+  contentHash?: string;
+  /** v0.6 — the binding declaration echoed into the signed receipt, so a
+   * verifier knows exactly what `contentHash` covers. */
+  contentBinding?: Pick<ContentBinding, 'version' | 'kind' | 'fields' | 'required_fields' | 'appliesTo'>;
+  /** v0.6 — disclosed subset of the attestation's identity overlay. */
+  subjects?: Subject[];
+  /** v0.6 — review path: the proposal this receipt executed. */
+  proposalId?: string;
+  /** v0.6 — review path: the owner's HAP-approval signature (or its sha256)
+   * for the executed proposal. */
+  approvalSignature?: string;
+  /** Ed25519 over the JCS-canonical payload (this field excluded), base64url. */
+  signature: string;
+}
+
+/**
+ * Verify a receipt's AS signature: strip `signature`, JCS-canonicalize the
+ * rest, Ed25519-verify against the AS public key (hex). This is holder-side
+ * verification — it needs the COMPLETE receipt; a redacted public view cannot
+ * be re-verified this way (protocol.md → "Receipt Verification").
+ *
+ * Content is checked separately: where `contentHash` is present, recompute it
+ * from the held artifact via the content-binding module and compare.
+ *
+ * @throws Error prefixed `INVALID_SIGNATURE:` when verification fails.
+ */
+export async function verifyReceiptSignature(receipt: ReceiptPayload, publicKeyHex: string): Promise<void> {
+  const { signature, ...unsigned } = receipt;
+  if (!signature) {
+    throw new Error('INVALID_SIGNATURE: receipt carries no signature');
+  }
+  const bytes = new TextEncoder().encode(canonicalize(unsigned));
+  const base64 = signature.replace(/-/g, '+').replace(/_/g, '/');
+  const padding = base64.length % 4 === 0 ? '' : '='.repeat(4 - (base64.length % 4));
+  const sigBytes = new Uint8Array(Buffer.from(base64 + padding, 'base64'));
+  const publicKeyBytes = new Uint8Array(Buffer.from(publicKeyHex, 'hex'));
+
+  const ok = await ed.verifyAsync(sigBytes, bytes, publicKeyBytes).catch(() => false);
+  if (!ok) {
+    throw new Error('INVALID_SIGNATURE: receipt signature verification failed');
+  }
+}

package/node_modules/@hap/core/src/types.ts

@@ -19,7 +19,7 @@ export interface ResolvedDomain {
 
 export interface AttestationPayload {
   attestation_id: string;
-  version: '0.3' | '0.4' | '0.5';
+  version: '0.3' | '0.4' | '0.5' | '0.6';
   profile_id: string;
   /** v0.3 (deprecated) — hash of the authorization frame */
   frame_hash?: string;
@@ -67,12 +67,55 @@ export interface AttestationPayload {
    *
    * Cryptographically bound in the signed payload so a compromised SP cannot
    * silently flip 'review' → 'automatic'. Absent on v0.3 attestations.
+   * `review_above_cap` (v0.5): automatic below the signed caps, proposal above.
    */
-  commitment_mode?: 'automatic' | 'review';
+  commitment_mode?: 'automatic' | 'review' | 'review_above_cap';
+  /**
+   * v0.6 (Owner Mandate Signatures) — the Decision Owner's own signature(s)
+   * over the mandate projection ({@link MandateProjection}), one entry per
+   * co-signing owner. Carried INSIDE the AS-signed payload, so the AS attests
+   * to having received it and cannot strip it without invalidating its own
+   * signature. Optional and additive: an attestation without it behaves as
+   * before (the v0.5 posture — the AS asserts, nobody co-signs).
+   */
+  owner_mandates?: OwnerMandate[];
   issued_at: number;
   expires_at: number;
 }
 
+/** Mandate-assurance axis — what custody signed the mandate. Independent of
+ * identity assurance ({@link Subject.method}). */
+export type MandateBinding = 'raw' | 'webauthn' | 'eudi';
+
+/** Which surface showed the owner what they signed. A DECLARATION, not a proof
+ * — no verifier can check it; see protocol.md → Owner Mandate Signatures. */
+export type SigningSurface = 'gatekeeper_local' | 'as_web' | 'wallet_display';
+
+/**
+ * v0.6 — one owner's signature over the mandate projection.
+ *
+ * There is deliberately NO `public_key` field, and it MUST NOT be added: the
+ * verification key is carried in the DID itself (key-bearing `did:key`), so a
+ * non-key-bearing DID fails STRUCTURALLY instead of validating against a key
+ * the AS could have substituted. `alg` is kept only as curve-confusion
+ * hygiene; if it disagrees with the DID's key type, the DID is authoritative.
+ */
+export interface OwnerMandate {
+  /** The signing owner's key-bearing DID. MUST be a member of `resolved_owners`. */
+  did: string;
+  /** Signature algorithm hint. The DID's multicodec wins on any disagreement. */
+  alg: 'EdDSA' | 'ES256';
+  /** base64url (no padding) signature over the JCS bytes of the mandate projection. */
+  signature: string;
+  /** When the owner signed (unix seconds). */
+  signed_at: number;
+  /** Defence-in-depth against duplicate issuance by an HONEST AS only —
+   * AS-side nonce enforcement is no defence against the AS itself. */
+  nonce: string;
+  binding: MandateBinding;
+  signing_surface?: SigningSurface;
+}
+
 /**
  * v0.6 Identity Assurance — a signed overlay binding a Decision Owner's verified
  * real-world identity to the attestation, gated by HOW the identity was verified.
@@ -98,8 +141,11 @@ export interface Subject {
   /** When the underlying verification was performed (unix seconds). */
   verified_at?: number;
   /**
-   * eudi only (Phase 2) — the owner's per-event wallet signature, making the
-   * identity claim non-repudiable independent of the AS. Null/absent otherwise.
+   * @deprecated v0.6 — replaced by {@link AttestationPayload.owner_mandates}.
+   * This field signed the wrong object (the identity claim, not what was
+   * committed to) and was welded to one method. Implementations MUST NOT emit
+   * it; verifiers MAY ignore it on artifacts that carry it. Kept readable for
+   * audit of pre-0.6 artifacts only.
    */
   owner_signature?: string | null;
 }
@@ -340,6 +386,15 @@ export interface ProfileContextField {
   description?: string;
   displayName?: string;
   format?: 'email' | 'domain' | 'url' | 'currency';
+  /**
+   * v0.6 — what this field NAMES on the read path. `counterparty` = the other
+   * party to a communication (matched against an item's participants);
+   * `resource` = the container an item belongs to (a direct attribute match —
+   * and a resource scope enforced on writes MUST also bind reads). Absent →
+   * implementations MAY infer `counterparty` from `format: email|domain`
+   * (transitional; the explicit declaration is normative).
+   */
+  scopeKind?: 'counterparty' | 'resource';
   constraint?: FieldConstraint;
   enum?: string[];
 }
@@ -636,7 +691,34 @@ export interface GatekeeperRequest {
  * Structured error from Gatekeeper verification.
  */
 export interface GatekeeperError {
-  code: 'BOUND_EXCEEDED' | 'CUMULATIVE_LIMIT_EXCEEDED' | 'INVALID_SIGNATURE' | 'TTL_EXPIRED' | 'FRAME_MISMATCH' | 'BOUNDS_MISMATCH' | 'CONTEXT_MISMATCH' | 'DOMAIN_NOT_COVERED' | 'INVALID_PROFILE' | 'MALFORMED_ATTESTATION';
+  code:
+    | 'BOUND_EXCEEDED'
+    | 'CUMULATIVE_LIMIT_EXCEEDED'
+    | 'INVALID_SIGNATURE'
+    | 'TTL_EXPIRED'
+    | 'FRAME_MISMATCH'
+    | 'BOUNDS_MISMATCH'
+    | 'CONTEXT_MISMATCH'
+    | 'DOMAIN_NOT_COVERED'
+    | 'INVALID_PROFILE'
+    | 'MALFORMED_ATTESTATION'
+    // v0.5/v0.6 receipt-path codes a Gatekeeper must recognize as definitive
+    // rejections (protocol.md → Pre-flight Receipt Request):
+    | 'INVALID_ACTION_TYPE'
+    | 'ATTESTATION_REVOKED'
+    | 'APPROVAL_REQUIRED'
+    | 'IDEMPOTENCY_MISMATCH'
+    // v0.6 owner-mandate codes (protocol.md → Owner Mandate Signatures):
+    | 'MANDATE_SIGNATURE_REQUIRED'
+    | 'MANDATE_SIGNATURE_INVALID'
+    | 'APPROVAL_SIGNATURE_REQUIRED'
+    | 'APPROVAL_SIGNATURE_INVALID'
+    // Canonicalization refusals (protocol.md → Bounds & Scope Canonicalization
+    // → Value encoding). Raised when a value cannot be canonicalized at all —
+    // a raw LF/CR, or a profile `constraint.pattern` violation. Distinct from
+    // BOUNDS_MISMATCH / CONTEXT_MISMATCH, which mean the hashes disagree.
+    | 'BOUNDS_INVALID_VALUE'
+    | 'CONTEXT_INVALID_VALUE';
   field?: string;
   message: string;
   bound?: string | number;

package/node_modules/@modelcontextprotocol/sdk/node_modules/negotiator/lib/accept.js

@@ -0,0 +1,54 @@
+/*!
+ * negotiator
+ * Copyright(c) 2026 Blake Embrey
+ * MIT Licensed
+ */
+
+'use strict';
+
+var contentType = require('content-type');
+
+/**
+ * Module exports.
+ * @private
+ */
+
+module.exports = parseAccept;
+
+/**
+ * Parse an Accept-style header.
+ * @private
+ */
+
+function parseAccept(header) {
+  var values = [];
+  var index = 0;
+
+  while (index < header.length) {
+    var start = skipOptionalWhitespace(header, index);
+    var parsed = contentType.parse(header, { comma: true, start: start });
+
+    // `content-type` normalizes the type, but accept methods return original casing.
+    parsed.type = header.slice(start, start + parsed.type.length);
+    values.push(parsed);
+
+    index = parsed.index + 1;
+  }
+
+  return values;
+}
+
+/**
+ * Skip optional whitespace.
+ * @private
+ */
+
+function skipOptionalWhitespace(header, index) {
+  var cursor = index;
+
+  while (header.charCodeAt(cursor) === 0x20 || header.charCodeAt(cursor) === 0x09) {
+    cursor++;
+  }
+
+  return cursor;
+}

package/node_modules/@modelcontextprotocol/sdk/node_modules/negotiator/lib/charset.js

@@ -8,6 +8,8 @@
 
 'use strict';
 
+var parseAccept = require('./accept');
+
 /**
  * Module exports.
  * @public
@@ -21,55 +23,29 @@ module.exports.preferredCharsets = preferredCharsets;
  * @private
  */
 
-var simpleCharsetRegExp = /^\s*([^\s;]+)\s*(?:;(.*))?$/;
-
-/**
- * Parse the Accept-Charset header.
- * @private
- */
-
 function parseAcceptCharset(accept) {
-  var accepts = accept.split(',');
+  var accepts = parseAccept(accept);
 
   for (var i = 0, j = 0; i < accepts.length; i++) {
-    var charset = parseCharset(accepts[i].trim(), i);
-
-    if (charset) {
-      accepts[j++] = charset;
-    }
+    var charset = formatCharset(accepts[i], i);
+    if (charset) accepts[j++] = charset;
   }
 
-  // trim accepts
   accepts.length = j;
-
   return accepts;
 }
 
 /**
- * Parse a charset from the Accept-Charset header.
+ * Format a parsed charset for negotiation.
  * @private
  */
 
-function parseCharset(str, i) {
-  var match = simpleCharsetRegExp.exec(str);
-  if (!match) return null;
-
-  var charset = match[1];
-  var q = 1;
-  if (match[2]) {
-    var params = match[2].split(';')
-    for (var j = 0; j < params.length; j++) {
-      var p = params[j].trim().split('=');
-      if (p[0] === 'q') {
-        q = parseFloat(p[1]);
-        break;
-      }
-    }
-  }
+function formatCharset(parsed, i) {
+  if (!parsed.type) return null;
 
   return {
-    charset: charset,
-    q: q,
+    charset: parsed.type,
+    q: parsed.parameters.q ? parseFloat(parsed.parameters.q) : 1,
     i: i
   };
 }