@suveren/gateway 0.8.4 → 0.8.5

package/node_modules/qs/test/stringify.js

@@ -136,6 +136,144 @@ test('stringify()', function (t) {
         st.end();
     });
 
+    t.test('encodes dot in key of object with a primitive value when encodeDotInKeys and allowDots is provided', function (st) {
+        st.equal(
+            qs.stringify(
+                { 'name.obj': 'John' },
+                { allowDots: true, encodeDotInKeys: true }
+            ),
+            'name%252Eobj=John',
+            'with allowDots true and encodeDotInKeys true'
+        );
+        st.equal(
+            qs.stringify(
+                { 'name.obj': 'John' },
+                { allowDots: false, encodeDotInKeys: true }
+            ),
+            'name%252Eobj=John',
+            'with allowDots false and encodeDotInKeys true'
+        );
+        st.equal(
+            qs.stringify(
+                { 'name.obj': 'John' },
+                { encodeDotInKeys: true, allowDots: true, encodeValuesOnly: true }
+            ),
+            'name%2Eobj=John',
+            'with encodeValuesOnly true'
+        );
+
+        // With `encodeValuesOnly` the key encoder is skipped, so the dot is encoded once
+        // (`%2E`) rather than twice. That single `%2E` decodes back to a structural dot, so
+        // unlike the default output below this does not round-trip to the original dotted key
+        // (a pre-existing `encodeValuesOnly` + `encodeDotInKeys` limitation, not new here).
+        st.deepEqual(
+            qs.parse(
+                qs.stringify(
+                    { 'name.obj': 'John' },
+                    { encodeDotInKeys: true, allowDots: true, encodeValuesOnly: true }
+                ),
+                { allowDots: true, decodeDotInKeys: true }
+            ),
+            { name: { obj: 'John' } },
+            'with encodeValuesOnly the single-encoded dot decodes structurally (does not round-trip)'
+        );
+
+        st.deepEqual(
+            qs.parse(
+                qs.stringify({ 'name.obj': 'John' }, { allowDots: true, encodeDotInKeys: true }),
+                { allowDots: true, decodeDotInKeys: true }
+            ),
+            { 'name.obj': 'John' },
+            'round-trips a dotted key with a primitive value'
+        );
+
+        st.equal(
+            qs.stringify({ 'a.b': null }, { allowDots: true, encodeDotInKeys: true, strictNullHandling: true }),
+            'a%252Eb',
+            'encodes a dotted key with a null value'
+        );
+        st.equal(
+            qs.stringify({ 'a.b': '1', 'c.d': '2' }, { allowDots: true, encodeDotInKeys: true }),
+            'a%252Eb=1&c%252Ed=2',
+            'encodes dots in every top-level key, not just the first'
+        );
+        st.equal(
+            qs.stringify({ 'a.b.c': 'x' }, { allowDots: true, encodeDotInKeys: true }),
+            'a%252Eb%252Ec=x',
+            'encodes every dot in a key'
+        );
+        var primitiveKey = qs.stringify({ 'a.b': 'c' }, { allowDots: true, encodeDotInKeys: true }).split('=')[0];
+        st.equal(
+            qs.stringify({ 'a.b': { x: 'c' } }, { allowDots: true, encodeDotInKeys: true }).indexOf(primitiveKey + '.'),
+            0,
+            'a top-level dotted key encodes identically for primitive and object values'
+        );
+
+        st.end();
+    });
+
+    // Characterization of the CURRENT (buggy) behavior: with `allowDots` + `encodeDotInKeys`,
+    // `stringify` percent-encodes the structural `.` separators that `allowDots` inserts between
+    // nested keys, not just the literal dots inside a key, which breaks the stringify -> parse
+    // round-trip. These assertions pin that behavior so it cannot change silently: the fix in
+    // https://github.com/ljharb/qs/pull/564 changes every output below, so landing that fix MUST
+    // update this test (that is the point — it forces the behavior change to be explicit).
+    t.test('[characterization] encodeDotInKeys currently over-encodes structural separator dots (pre-#564)', function (st) {
+        st.equal(
+            qs.stringify({ a: { b: { c: 'd' } } }, { allowDots: true, encodeDotInKeys: true }),
+            'a%252Eb.c=d',
+            'over-encodes the a->b separator (#564: should become a.b.c=d)'
+        );
+        st.equal(
+            qs.stringify({ a: { b: { c: { d: 'e' } } } }, { allowDots: true, encodeDotInKeys: true }),
+            'a%252Eb%252Ec.d=e',
+            'clobbers every separator but the last (#564: should become a.b.c.d=e)'
+        );
+        st.equal(
+            qs.stringify({ 'a.b': { c: { d: 'e' } } }, { allowDots: true, encodeDotInKeys: true }),
+            'a%252Eb%252Ec.d=e',
+            'top-level dotted key: deeper separators also get encoded (#564: should become a%252Eb.c.d=e)'
+        );
+        st.equal(
+            qs.stringify({ a: { 'b.c': { d: 'e' } } }, { allowDots: true, encodeDotInKeys: true }),
+            'a%252Eb%252Ec.d=e',
+            'nested dotted key + object value: the separator around it is encoded (#564: should become a.b%252Ec.d=e)'
+        );
+        st.equal(
+            qs.stringify({ a: { b: { 'c.d': { e: 'f' } } } }, { allowDots: true, encodeDotInKeys: true }),
+            'a%252Eb%252Ec%252Ed.e=f',
+            'deeply nested dotted key: all separators encoded (#564: should become a.b.c%252Ed.e=f)'
+        );
+
+        st.equal(
+            qs.stringify({ a: { b: [1, 2] } }, { allowDots: true, encodeDotInKeys: true }),
+            'a%252Eb%5B0%5D=1&a%252Eb%5B1%5D=2',
+            'array value under nested keys: separator encoded (#564: should become a.b%5B0%5D=1&a.b%5B1%5D=2)'
+        );
+        st.equal(
+            qs.stringify({ a: { 'b.c': [1, 2] } }, { allowDots: true, encodeDotInKeys: true }),
+            'a%252Eb%252Ec%5B0%5D=1&a%252Eb%252Ec%5B1%5D=2',
+            'array value under nested dotted key (#564: should become a.b%252Ec%5B0%5D=1&a.b%252Ec%5B1%5D=2)'
+        );
+
+        st.equal(
+            qs.stringify({ a: { 'b.c': { d: 'e' } } }, { allowDots: false, encodeDotInKeys: true }),
+            'a%5Bb%252Ec%5D%5Bd%5D=e',
+            'allowDots:false object value encodes the nested-key dot, unlike the primitive-value case (#564: should become a%5Bb.c%5D%5Bd%5D=e)'
+        );
+
+        st.deepEqual(
+            qs.parse(
+                qs.stringify({ a: { b: { c: 'd' } } }, { allowDots: true, encodeDotInKeys: true }),
+                { allowDots: true, decodeDotInKeys: true }
+            ),
+            { 'a.b': { c: 'd' } },
+            'the over-encoding breaks the round-trip: {a:{b:{c}}} comes back as {"a.b":{c}} (#564 restores it)'
+        );
+
+        st.end();
+    });
+
     t.test('should encode dot in key of object, and automatically set allowDots to `true` when encodeDotInKeys is true and allowDots in undefined', function (st) {
         st.equal(
             qs.stringify(
@@ -328,6 +466,39 @@ test('stringify()', function (t) {
         st.end();
     });
 
+    t.test('allowEmptyArrays only short-circuits arrays with no own keys', function (st) {
+        st.equal(
+            qs.stringify({ a: [] }, { allowEmptyArrays: true }),
+            'a[]',
+            'a genuinely empty array is still emitted as `[]`'
+        );
+
+        var withKey = [];
+        withKey.extra = 'x';
+        st.equal(
+            qs.stringify({ a: withKey }, { allowEmptyArrays: true }),
+            'a%5Bextra%5D=x',
+            'an own key on an empty array is serialized rather than dropped'
+        );
+        st.equal(
+            qs.stringify({ a: withKey }, { allowEmptyArrays: true }),
+            qs.stringify({ a: withKey }),
+            'the allowEmptyArrays fast path matches the default path when the array has own keys'
+        );
+
+        var container = {};
+        var cyclic = [];
+        cyclic.back = container;
+        container.a = cyclic;
+        st['throws'](
+            function () { qs.stringify(container, { allowEmptyArrays: true }); },
+            RangeError,
+            'a cycle through an empty array with an own key is still detected'
+        );
+
+        st.end();
+    });
+
     t.test('stringifies an array value with one item vs multiple items', function (st) {
         st.test('non-array item', function (s2t) {
             s2t.equal(qs.stringify({ a: 'c' }, { encodeValuesOnly: true, arrayFormat: 'indices' }), 'a=c');
@@ -761,6 +932,33 @@ test('stringify()', function (t) {
         st.end();
     });
 
+    t.test('does not throw on a non-callable `constructor.isBuffer` key', function (st) {
+        var input = { a: { constructor: { isBuffer: 'x' } } };
+        st.doesNotThrow(function () { qs.stringify(input); });
+        st.equal(qs.stringify(input), 'a%5Bconstructor%5D%5BisBuffer%5D=x');
+        st.equal(qs.stringify({ a: { constructor: { isBuffer: { b: 'c' } } } }), 'a%5Bconstructor%5D%5BisBuffer%5D%5Bb%5D=c');
+        st.equal(qs.stringify({ a: { constructor: { isBuffer: ['b'] } } }), 'a%5Bconstructor%5D%5BisBuffer%5D%5B0%5D=b');
+        st.equal(qs.stringify({ a: { constructor: { isBuffer: true } } }), 'a%5Bconstructor%5D%5BisBuffer%5D=true');
+        st.end();
+    });
+
+    t.test('round-trips a parsed `constructor[isBuffer]` key', function (st) {
+        var str = 'x%5Bconstructor%5D%5BisBuffer%5D=y';
+
+        var plain = qs.parse(str, { plainObjects: true });
+        st.deepEqual(plain, { __proto__: null, x: { __proto__: null, constructor: { __proto__: null, isBuffer: 'y' } } }, 'plainObjects keeps the key');
+        st.doesNotThrow(function () { qs.stringify(plain); });
+        st.equal(qs.stringify(plain), str, 'plainObjects round-trips');
+
+        var proto = qs.parse(str, { allowPrototypes: true });
+        st.deepEqual(proto, { x: { constructor: { isBuffer: 'y' } } }, 'allowPrototypes keeps the key');
+        st.doesNotThrow(function () { qs.stringify(proto); });
+        st.equal(qs.stringify(proto), str, 'allowPrototypes round-trips');
+
+        st.equal(qs.stringify(qs.parse(str)), '', 'default options drop the key');
+        st.end();
+    });
+
     t.test('stringifies an object using an alternative delimiter', function (st) {
         st.equal(qs.stringify({ a: 'b', c: 'd' }, { delimiter: ';' }), 'a=b;c=d');
         st.end();
@@ -919,6 +1117,66 @@ test('stringify()', function (t) {
         st.end();
     });
 
+    t.test('serializes Date values unless filter transforms them', function (st) {
+        var obj = {
+            a: new Date(Date.UTC(2023, 2, 7, 9, 2, 41, 260)),
+            b: [new Date(Date.UTC(2023, 2, 7, 9, 2, 41, 260))]
+        };
+        var iso = '2023-03-07T09%3A02%3A41.260Z';
+        st.equal(
+            qs.stringify(obj, { filter: function (prefix, value) { return value; } }),
+            'a=' + iso + '&b%5B0%5D=' + iso,
+            'Dates returned unchanged by a filter are serialized'
+        );
+        st.equal(
+            qs.stringify({ a: new Date(0) }, { filter: function (prefix, value) { return value instanceof Date ? 'kept' : value; } }),
+            'a=kept',
+            'a filter that transforms a Date wins over default serialization'
+        );
+        st.end();
+    });
+
+    t.test('applies default Date handling to whatever a filter function returns', function (st) {
+        var date = new Date(Date.UTC(2023, 2, 7, 9, 2, 41, 260));
+        var iso = '2023-03-07T09%3A02%3A41.260Z';
+        var identity = function (prefix, value) { return value; };
+
+        st.equal(
+            qs.stringify({ a: { b: date } }, { filter: identity }),
+            'a%5Bb%5D=' + iso,
+            'a nested Date is serialized through a filter'
+        );
+        st.equal(
+            qs.stringify(
+                { a: date },
+                { filter: identity, serializeDate: function (d) { return String(d.getTime()); } }
+            ),
+            'a=1678179761260',
+            '`serializeDate` is honored after a filter'
+        );
+        st.equal(
+            qs.stringify({ a: [date, 'x'] }, { filter: identity, arrayFormat: 'comma' }),
+            'a=' + iso + '%2Cx',
+            'Dates inside a comma array are serialized through a filter, not stringified as locale text'
+        );
+        st.equal(
+            qs.stringify({ a: 'x' }, { filter: function (prefix, value) { return prefix === 'a' ? date : value; } }),
+            'a=' + iso,
+            'a Date produced by the filter is serialized'
+        );
+        st.equal(
+            qs.stringify({ a: date, b: 1 }, { filter: ['a'] }),
+            'a=' + iso,
+            'an array filter still serializes Dates'
+        );
+        st['throws'](
+            function () { qs.stringify({ a: new Date(NaN) }, { filter: identity }); },
+            RangeError,
+            'an invalid Date through a filter throws like the no-filter path'
+        );
+        st.end();
+    });
+
     t.test('can disable uri encoding', function (st) {
         st.equal(qs.stringify({ a: 'b' }, { encode: false }), 'a=b');
         st.equal(qs.stringify({ a: { b: 'c' } }, { encode: false }), 'a[b]=c');
@@ -1445,4 +1703,63 @@ test('stringifies empty keys', function (t) {
 
         st.end();
     });
+
+    t.test('limits nesting depth with the `depth` option', function (st) {
+        st.equal(
+            qs.stringify({ a: { b: { c: 'd' } } }),
+            'a%5Bb%5D%5Bc%5D=d',
+            'the default depth is unlimited and does not alter output'
+        );
+        st.equal(
+            qs.stringify({ a: { b: { c: 'd' } } }, { depth: 2 }),
+            'a%5Bb%5D%5Bc%5D=d',
+            'does not throw when nesting is within the depth limit'
+        );
+        st.equal(
+            qs.stringify({ a: { b: 'c' } }, { depth: Infinity }),
+            'a%5Bb%5D=c',
+            'an explicit Infinity depth is unlimited'
+        );
+        st.equal(
+            qs.stringify({ a: { b: { c: { d: 'e' } } } }, { depth: null }),
+            qs.stringify({ a: { b: { c: { d: 'e' } } } }),
+            'a non-number depth is ignored and treated as unlimited'
+        );
+        st.equal(
+            qs.stringify({ a: 'b' }, { depth: 0 }),
+            'a=b',
+            'a flat object serializes with a depth of 0'
+        );
+
+        var deep = {};
+        var cursor = deep;
+        for (var i = 0; i < 250; i++) {
+            cursor.a = {};
+            cursor = cursor.a;
+        }
+        cursor.b = 'c';
+        st.equal(typeof qs.stringify(deep), 'string', 'the default depth serializes deeply nested objects without throwing');
+
+        st['throws'](
+            function () { qs.stringify({ a: { b: { c: { d: 'e' } } } }, { depth: 2 }); },
+            RangeError,
+            'throws a RangeError when nesting exceeds the depth limit'
+        );
+        st['throws'](
+            function () { qs.stringify({ a: { b: 'c' } }, { depth: 0 }); },
+            RangeError,
+            'a depth of 0 throws for any nested object'
+        );
+
+        var caught;
+        try {
+            qs.stringify({ a: { b: { c: { d: 'e' } } } }, { depth: 2 });
+        } catch (e) {
+            caught = e;
+        }
+        st.ok(caught instanceof RangeError, 'the thrown value is a RangeError');
+        st.equal(caught.message, 'Input depth exceeded depth option of 2', 'the RangeError names the exceeded depth');
+
+        st.end();
+    });
 });

package/node_modules/qs/test/utils.js

@@ -604,6 +604,18 @@ test('isBuffer()', function (t) {
     var fakeBuffer = { constructor: Buffer };
     t.equal(utils.isBuffer(fakeBuffer), false, 'fake buffer is not a buffer');
 
+    forEach(['x', 1, true, {}, [], { isBuffer: true }], function (notCallable) {
+        var obj = { constructor: { isBuffer: notCallable } };
+        t.doesNotThrow(function () { utils.isBuffer(obj); }, 'non-callable `constructor.isBuffer` (' + inspect(notCallable) + ') does not throw');
+        t.equal(utils.isBuffer(obj), false, 'non-callable `constructor.isBuffer` (' + inspect(notCallable) + ') is not a buffer');
+    });
+
+    var nullObject = { __proto__: null, constructor: { __proto__: null, isBuffer: 'y' } };
+    t.equal(utils.isBuffer(nullObject), false, 'null object with non-callable `constructor.isBuffer` is not a buffer');
+
+    var duckBuffer = { constructor: { isBuffer: function () { return true; } } };
+    t.equal(utils.isBuffer(duckBuffer), true, 'callable `constructor.isBuffer` is still honored');
+
     var saferBuffer = SaferBuffer.from('abc');
     t.equal(utils.isBuffer(saferBuffer), true, 'SaferBuffer instance is a buffer');
 

package/node_modules/undici-types/client.d.ts

@@ -33,7 +33,7 @@ export declare namespace Client {
   export interface Options {
     /** The maximum length of request headers in bytes. Default: Node.js' `--max-http-header-size` or `16384` (16KiB). */
     maxHeaderSize?: number;
-    /** The amount of time, in milliseconds, the parser will wait to receive the complete HTTP headers (Node 14 and above only). Default: `300e3` milliseconds (300s). */
+    /** The amount of time, in milliseconds, the parser will wait to receive the complete HTTP headers (Node 14 and above only). Default: `300e3` milliseconds (300s). HTTP/1.1 parser timeouts are not guaranteed to fire with exact millisecond precision: delays up to 1000ms use native timers, while larger delays use lower-overhead fast timers with a target resolution around 500ms. */
     headersTimeout?: number;
     /** @deprecated unsupported socketTimeout, use headersTimeout & bodyTimeout instead */
     socketTimeout?: never;
@@ -41,7 +41,7 @@ export declare namespace Client {
     requestTimeout?: never;
     /** The timeout for establishing a socket connection, in milliseconds. Use `0` to disable it entirely. Default: `10e3` milliseconds (10s). */
     connectTimeout?: number;
-    /** The timeout after which a request will time out, in milliseconds. Monitors time between receiving body data. Use `0` to disable it entirely. Default: `300e3` milliseconds (300s). */
+    /** The timeout after which a request will time out, in milliseconds. Monitors time between receiving body data. Use `0` to disable it entirely. Default: `300e3` milliseconds (300s). HTTP/1.1 parser timeouts are not guaranteed to fire with exact millisecond precision: delays up to 1000ms use native timers, while larger delays use lower-overhead fast timers with a target resolution around 500ms. */
     bodyTimeout?: number;
     /** @deprecated unsupported idleTimeout, use keepAliveTimeout instead */
     idleTimeout?: never;
@@ -57,7 +57,7 @@ export declare namespace Client {
     keepAliveTimeoutThreshold?: number;
     /** An IPC endpoint, either a Unix domain socket or Windows named pipe. Default: `null`. */
     socketPath?: string;
-    /** The amount of concurrent requests to be sent over the single TCP/TLS connection according to [RFC7230](https://tools.ietf.org/html/rfc7230#section-6.3.2). Default: `1`. */
+    /** The amount of concurrent requests to be sent over the single TCP/TLS connection according to [RFC7230](https://tools.ietf.org/html/rfc7230#section-6.3.2). Only enable values greater than `1` when the remote server is trusted. Default: `1`. */
     pipelining?: number;
     /** @deprecated use the connect option instead */
     tls?: never;
@@ -116,6 +116,11 @@ export declare namespace Client {
     bytesRead?: number
   }
   export interface WebSocketOptions {
+    /**
+     * Maximum number of fragments in a message. Set to 0 to disable the limit.
+     * @default 131072
+     */
+    maxFragments?: number;
     /**
      * Maximum allowed payload size in bytes for WebSocket messages.
      * Applied to uncompressed messages, compressed frame payloads, and decompressed (permessage-deflate) messages.

package/node_modules/undici-types/connector.d.ts

@@ -7,6 +7,7 @@ declare function buildConnector (options?: buildConnector.BuildOptions): buildCo
 declare namespace buildConnector {
   export type BuildOptions = (ConnectionOptions | TcpNetConnectOpts | IpcNetConnectOpts) & {
     allowH2?: boolean;
+    preferH2?: boolean;
     maxCachedSessions?: number | null;
     socketPath?: string | null;
     timeout?: number | null;

package/node_modules/undici-types/cookies.d.ts

@@ -18,7 +18,7 @@ export interface Cookie {
 export function deleteCookie (
   headers: Headers,
   name: string,
-  attributes?: { name?: string, domain?: string }
+  attributes?: { path?: string, domain?: string }
 ): void
 
 export function getCookies (headers: Headers): Record<string, string>

package/node_modules/undici-types/dispatcher.d.ts

@@ -111,13 +111,13 @@ declare namespace Dispatcher {
     idempotent?: boolean;
     /** Whether the response is expected to take a long time and would end up blocking the pipeline. When this is set to `true` further pipelining will be avoided on the same connection until headers have been received. Defaults to `method !== 'HEAD'`. */
     blocking?: boolean;
-    /** The IP Type of Service (ToS) value for the request socket. Must be an integer between 0 and 255. Default: `0` */
+    /** The IP Type of Service (ToS) value for the request socket. Must be an integer between 0 and 255. */
     typeOfService?: number | null;
     /** Upgrade the request. Should be used to specify the kind of upgrade i.e. `'Websocket'`. Default: `method === 'CONNECT' || null`. */
     upgrade?: boolean | string | null;
-    /** The amount of time, in milliseconds, the parser will wait to receive the complete HTTP headers. Defaults to 300 seconds. */
+    /** The amount of time, in milliseconds, the parser will wait to receive the complete HTTP headers. Defaults to 300 seconds. HTTP/1.1 parser timeouts are not guaranteed to fire with exact millisecond precision: delays up to 1000ms use native timers, while larger delays use lower-overhead fast timers with a target resolution around 500ms. */
     headersTimeout?: number | null;
-    /** The timeout after which a request will time out, in milliseconds. Monitors time between receiving body data. Use 0 to disable it entirely. Defaults to 300 seconds. */
+    /** The timeout after which a request will time out, in milliseconds. Monitors time between receiving body data. Use 0 to disable it entirely. Defaults to 300 seconds. HTTP/1.1 parser timeouts are not guaranteed to fire with exact millisecond precision: delays up to 1000ms use native timers, while larger delays use lower-overhead fast timers with a target resolution around 500ms. */
     bodyTimeout?: number | null;
     /** Whether the request should stablish a keep-alive or not. Default `false` */
     reset?: boolean;

package/node_modules/undici-types/errors.d.ts

@@ -154,6 +154,16 @@ declare namespace Errors {
     code: 'UND_ERR_PRX_TLS'
   }
 
+  export class ProxyConnectionError extends UndiciError {
+    constructor (
+      cause?: Error,
+      message?: string,
+      options?: Record<any, any>
+    )
+    name: 'ProxyConnectionError'
+    code: 'UND_ERR_PRX_CONN'
+  }
+
   export class MaxOriginsReachedError extends UndiciError {
     name: 'MaxOriginsReachedError'
     code: 'UND_ERR_MAX_ORIGINS_REACHED'

package/node_modules/undici-types/fetch.d.ts

@@ -36,7 +36,10 @@ export class BodyMixin {
   readonly bytes: () => Promise<Uint8Array>
   /**
    * @deprecated This method is not recommended for parsing multipart/form-data bodies in server environments.
-   * It is recommended to use a library such as [@fastify/busboy](https://www.npmjs.com/package/@fastify/busboy) as follows:
+   * Calling body.formData() buffers and parses the entire body. Since this is dictated by the spec,
+   * this method must only be called on responses from trusted servers.
+   * For responses from untrusted or user-controlled servers, use a dedicated streaming parser such as
+   * [@fastify/busboy](https://www.npmjs.com/package/@fastify/busboy) and apply application-specific limits as follows:
    *
    * @example
    * ```js
@@ -54,6 +57,7 @@ export class BodyMixin {
   readonly formData: () => Promise<FormData>
   readonly json: () => Promise<unknown>
   readonly text: () => Promise<string>
+  readonly textStream: () => ReadableStream<string>
 }
 
 export interface SpecIterator<T, TReturn = any, TNext = undefined> {

package/node_modules/undici-types/handlers.d.ts

@@ -1,6 +1,8 @@
 import Dispatcher from './dispatcher'
 
 export declare class RedirectHandler implements Dispatcher.DispatchHandler {
+  static buildDispatch (dispatcher: Dispatcher, maxRedirections: number): Dispatcher.Dispatch
+
   constructor (
     dispatch: Dispatcher.Dispatch,
     maxRedirections: number,

package/node_modules/undici-types/interceptors.d.ts

@@ -8,7 +8,7 @@ export default Interceptors
 declare namespace Interceptors {
   export type DumpInterceptorOpts = { maxSize?: number }
   export type RetryInterceptorOpts = RetryHandler.RetryOptions
-  export type RedirectInterceptorOpts = { maxRedirections?: number, throwOnMaxRedirect?: boolean }
+  export type RedirectInterceptorOpts = { maxRedirections?: number, throwOnMaxRedirect?: boolean, stripHeadersOnRedirect?: string[], stripHeadersOnCrossOriginRedirect?: string[] }
   export type DecompressInterceptorOpts = {
     skipErrorResponses?: boolean
     skipStatusCodes?: number[]

package/node_modules/undici-types/mock-interceptor.d.ts

@@ -75,9 +75,13 @@ declare namespace MockInterceptor {
     opts: MockResponseCallbackOptions
   ) => TData | Buffer | string
 
+  export type MockReplyOptions<TData extends object = object> = {
+    statusCode: number, data?: TData | Buffer | string, responseOptions?: MockResponseOptions
+  }
+
   export type MockReplyOptionsCallback<TData extends object = object> = (
     opts: MockResponseCallbackOptions
-  ) => { statusCode: number, data?: TData | Buffer | string, responseOptions?: MockResponseOptions }
+  ) => MockReplyOptions<TData> | Promise<MockReplyOptions<TData>>
 }
 
 interface Interceptable extends Dispatcher {

package/node_modules/undici-types/package.json

@@ -1,6 +1,6 @@
 {
   "name": "undici-types",
-  "version": "8.3.0",
+  "version": "8.9.0",
   "description": "A stand-alone types package for Undici",
   "homepage": "https://undici.nodejs.org",
   "bugs": {

package/node_modules/undici-types/proxy-agent.d.ts

@@ -24,6 +24,13 @@ declare namespace ProxyAgent {
     requestTls?: buildConnector.BuildOptions;
     proxyTls?: buildConnector.BuildOptions;
     clientFactory?(origin: URL, opts: object): Dispatcher;
+    /**
+     * Undici tunnels via CONNECT when the target endpoint uses HTTPS, and
+     * forwards (HTTP/1.1 absolute-form request-target, per RFC 9112 §3.2.2)
+     * otherwise, regardless of whether the proxy URL is HTTP or HTTPS. The
+     * non-tunneled forwarding path does not negotiate HTTP/2 with the proxy.
+     * Set to true to force tunneling for plain HTTP requests as well.
+     */
     proxyTunnel?: boolean;
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@suveren/gateway",
-  "version": "0.8.4",
+  "version": "0.8.5",
   "description": "Suveren gateway — local agent gateway built in compliance with the Human Agency Protocol (HAP). Runs the UI, control plane, and MCP server in one Node process.",
   "type": "module",
   "main": "server.js",