@tickernelz/paperclip-pro-server 2026.1014.1 → 2026.1015.0

package/node_modules/qs/test/stringify.js

@@ -212,63 +212,94 @@ test('stringify()', function (t) {
         st.end();
     });
 
-    // Characterization of the CURRENT (buggy) behavior: with `allowDots` + `encodeDotInKeys`,
-    // `stringify` percent-encodes the structural `.` separators that `allowDots` inserts between
-    // nested keys, not just the literal dots inside a key, which breaks the stringify -> parse
-    // round-trip. These assertions pin that behavior so it cannot change silently: the fix in
-    // https://github.com/ljharb/qs/pull/564 changes every output below, so landing that fix MUST
-    // update this test (that is the point — it forces the behavior change to be explicit).
-    t.test('[characterization] encodeDotInKeys currently over-encodes structural separator dots (pre-#564)', function (st) {
+    t.test('does not encode the structural separator dots between nested keys when encodeDotInKeys and allowDots are provided', function (st) {
         st.equal(
-            qs.stringify({ a: { b: { c: 'd' } } }, { allowDots: true, encodeDotInKeys: true }),
-            'a%252Eb.c=d',
-            'over-encodes the a->b separator (#564: should become a.b.c=d)'
+            qs.stringify(
+                { a: { b: { c: 'd' } } },
+                { allowDots: true, encodeDotInKeys: true }
+            ),
+            'a.b.c=d',
+            'no key contains a literal dot, so encodeDotInKeys is a no-op on the separators'
         );
         st.equal(
-            qs.stringify({ a: { b: { c: { d: 'e' } } } }, { allowDots: true, encodeDotInKeys: true }),
-            'a%252Eb%252Ec.d=e',
-            'clobbers every separator but the last (#564: should become a.b.c.d=e)'
+            qs.stringify(
+                { a: { b: { c: { d: 'e' } } } },
+                { allowDots: true, encodeDotInKeys: true }
+            ),
+            'a.b.c.d=e',
+            'every nesting separator is preserved, not just the last one'
         );
-        st.equal(
-            qs.stringify({ 'a.b': { c: { d: 'e' } } }, { allowDots: true, encodeDotInKeys: true }),
-            'a%252Eb%252Ec.d=e',
-            'top-level dotted key: deeper separators also get encoded (#564: should become a%252Eb.c.d=e)'
+
+        st.deepEqual(
+            qs.parse(
+                qs.stringify({ a: { b: { c: 'd' } } }, { allowDots: true, encodeDotInKeys: true }),
+                { allowDots: true, decodeDotInKeys: true }
+            ),
+            { a: { b: { c: 'd' } } },
+            'stringify -> parse round-trips a deeply nested object'
         );
+
+        st.end();
+    });
+
+    t.test('encodeDotInKeys encodes only literal dots inside nested keys, never the structural separators, at any depth', function (st) {
         st.equal(
             qs.stringify({ a: { 'b.c': { d: 'e' } } }, { allowDots: true, encodeDotInKeys: true }),
-            'a%252Eb%252Ec.d=e',
-            'nested dotted key + object value: the separator around it is encoded (#564: should become a.b%252Ec.d=e)'
+            'a.b%252Ec.d=e',
+            'a nested key with a literal dot and an object value encodes only its own dot'
+        );
+        st.equal(
+            qs.stringify({ 'a.b': { c: { d: 'e' } } }, { allowDots: true, encodeDotInKeys: true }),
+            'a%252Eb.c.d=e',
+            'a top-level dotted key stays encoded while deeper separators stay literal'
         );
         st.equal(
             qs.stringify({ a: { b: { 'c.d': { e: 'f' } } } }, { allowDots: true, encodeDotInKeys: true }),
-            'a%252Eb%252Ec%252Ed.e=f',
-            'deeply nested dotted key: all separators encoded (#564: should become a.b.c%252Ed.e=f)'
+            'a.b.c%252Ed.e=f',
+            'a literal dot in a deeply nested key is encoded without touching the separators around it'
         );
 
         st.equal(
             qs.stringify({ a: { b: [1, 2] } }, { allowDots: true, encodeDotInKeys: true }),
-            'a%252Eb%5B0%5D=1&a%252Eb%5B1%5D=2',
-            'array value under nested keys: separator encoded (#564: should become a.b%5B0%5D=1&a.b%5B1%5D=2)'
+            'a.b%5B0%5D=1&a.b%5B1%5D=2',
+            'separator dots are preserved for an array value nested under keys'
         );
         st.equal(
             qs.stringify({ a: { 'b.c': [1, 2] } }, { allowDots: true, encodeDotInKeys: true }),
-            'a%252Eb%252Ec%5B0%5D=1&a%252Eb%252Ec%5B1%5D=2',
-            'array value under nested dotted key (#564: should become a.b%252Ec%5B0%5D=1&a.b%252Ec%5B1%5D=2)'
+            'a.b%252Ec%5B0%5D=1&a.b%252Ec%5B1%5D=2',
+            'a nested dotted key with an array value encodes only its own dot'
         );
 
-        st.equal(
-            qs.stringify({ a: { 'b.c': { d: 'e' } } }, { allowDots: false, encodeDotInKeys: true }),
-            'a%5Bb%252Ec%5D%5Bd%5D=e',
-            'allowDots:false object value encodes the nested-key dot, unlike the primitive-value case (#564: should become a%5Bb.c%5D%5Bd%5D=e)'
+        st.deepEqual(
+            qs.parse(
+                qs.stringify({ a: { 'b.c': { d: 'e' } } }, { allowDots: true, encodeDotInKeys: true }),
+                { allowDots: true, decodeDotInKeys: true }
+            ),
+            { a: { 'b.c': { d: 'e' } } },
+            'stringify -> parse round-trips a nested dotted key with an object value'
         );
-
         st.deepEqual(
             qs.parse(
-                qs.stringify({ a: { b: { c: 'd' } } }, { allowDots: true, encodeDotInKeys: true }),
+                qs.stringify({ 'a.b': { c: { d: 'e' } } }, { allowDots: true, encodeDotInKeys: true }),
                 { allowDots: true, decodeDotInKeys: true }
             ),
-            { 'a.b': { c: 'd' } },
-            'the over-encoding breaks the round-trip: {a:{b:{c}}} comes back as {"a.b":{c}} (#564 restores it)'
+            { 'a.b': { c: { d: 'e' } } },
+            'stringify -> parse round-trips a top-level dotted key with deep nesting'
+        );
+
+        st.end();
+    });
+
+    t.test('with allowDots false, encodeDotInKeys leaves nested-key dots literal, consistently for object and primitive values', function (st) {
+        st.equal(
+            qs.stringify({ a: { 'b.c': { d: 'e' } } }, { allowDots: false, encodeDotInKeys: true }),
+            'a%5Bb.c%5D%5Bd%5D=e',
+            'nested dotted key with an object value'
+        );
+        st.equal(
+            qs.stringify({ a: { 'b.c': 'e' } }, { allowDots: false, encodeDotInKeys: true }),
+            'a%5Bb.c%5D=e',
+            'nested dotted key with a primitive value matches the object-value case'
         );
 
         st.end();
@@ -394,6 +425,41 @@ test('stringify()', function (t) {
         st.end();
     });
 
+    t.test('ignores inherited array format names', function (st) {
+        var array = { a: ['b', 'c'] };
+        var indices = 'a%5B0%5D=b&a%5B1%5D=c';
+        var repeat = 'a=b&a=c';
+
+        st.equal(qs.stringify(array, { arrayFormat: 'unsupported' }), indices, 'unknown format falls back to `indices`');
+
+        var names = [
+            'constructor',
+            'toString',
+            '__proto__',
+            'valueOf',
+            'hasOwnProperty',
+            'isPrototypeOf',
+            'propertyIsEnumerable',
+            'toLocaleString'
+        ];
+        for (var i = 0; i < names.length; i++) {
+            var name = names[i];
+            st.equal(qs.stringify(array, { arrayFormat: name }), indices, '`' + name + '` falls back to `indices`');
+            st.equal(
+                qs.stringify(array, { arrayFormat: name, indices: true }),
+                indices,
+                '`' + name + '` with `indices: true` falls back to `indices`'
+            );
+            st.equal(
+                qs.stringify(array, { arrayFormat: name, indices: false }),
+                repeat,
+                '`' + name + '` with `indices: false` falls back to `repeat`'
+            );
+        }
+
+        st.end();
+    });
+
     t.test('`skipNulls` option', function (st) {
         st.equal(
             qs.stringify({ a: 'b', c: null }, { skipNulls: true }),
@@ -569,6 +635,53 @@ test('stringify()', function (t) {
         st.end();
     });
 
+    t.test('encodes comma array values with the same encoder arguments as other values, with encodeValuesOnly', function (st) {
+        var commaValuesOnly = { arrayFormat: 'comma', encodeValuesOnly: true };
+
+        st.equal(
+            qs.stringify({ a: ['é', 'x'], b: 'é' }, utils.assign({ charset: 'iso-8859-1' }, commaValuesOnly)),
+            'a=%E9,x&b=%E9',
+            'respects charset iso-8859-1'
+        );
+        st.deepEqual(
+            qs.parse(qs.stringify({ a: ['é', 'x'] }, utils.assign({ charset: 'iso-8859-1' }, commaValuesOnly)), { charset: 'iso-8859-1', comma: true }),
+            { a: ['é', 'x'] },
+            'round-trips in iso-8859-1'
+        );
+        st.equal(
+            qs.stringify({ a: ['☺'] }, utils.assign({ charset: 'iso-8859-1' }, commaValuesOnly)),
+            'a=%26%239786%3B',
+            'encodes unrepresentable chars as numeric entities in iso-8859-1'
+        );
+        st.equal(
+            qs.stringify({ a: ['(x)', 'y z'], b: '(x)' }, utils.assign({ format: qs.formats.RFC1738 }, commaValuesOnly)),
+            'a=(x),y+z&b=(x)',
+            'respects format RFC1738'
+        );
+
+        var calls = [];
+        st.equal(
+            qs.stringify({ a: ['b', 'c'] }, utils.assign({
+                encoder: function (str, defaultEncoder, charset, kind, format) {
+                    calls[calls.length] = [str, typeof defaultEncoder, charset, kind, format];
+                    return defaultEncoder(str, defaultEncoder, charset, kind, format).toUpperCase();
+                }
+            }, commaValuesOnly)),
+            'a=B,C',
+            'a custom encoder can call defaultEncoder'
+        );
+        st.deepEqual(
+            calls,
+            [
+                ['b', 'function', 'utf-8', 'value', qs.formats.RFC3986],
+                ['c', 'function', 'utf-8', 'value', qs.formats.RFC3986]
+            ],
+            'a custom encoder receives defaultEncoder, charset, kind, and format'
+        );
+
+        st.end();
+    });
+
     t.test('stringifies comma and empty non-array values', function (st) {
         st.equal(qs.stringify({ a: ',', b: '', c: 'c,d%' }, { encode: false, arrayFormat: 'indices' }), 'a=,&b=&c=c,d%');
         st.equal(qs.stringify({ a: ',', b: '', c: 'c,d%' }, { encode: false, arrayFormat: 'brackets' }), 'a=,&b=&c=c,d%');
@@ -865,6 +978,112 @@ test('stringify()', function (t) {
         st.end();
     });
 
+    t.test('arrayFormat=comma: does not crash on entries with no callable `toString`', function (st) {
+        var json = JSON.parse('{ "a": ["b", { "toString": "x" }, "c"] }');
+        st.equal(qs.stringify(json, { arrayFormat: 'comma' }), 'a=b%2C%5Bobject%20Object%5D%2Cc', 'JSON own `toString`');
+        st.equal(qs.stringify(json, { arrayFormat: 'comma', encode: false }), 'a=b,[object Object],c', 'with encode: false');
+        st.equal(
+            qs.stringify(json, { arrayFormat: 'comma', encodeValuesOnly: true }),
+            'a=b,%5Bobject%20Object%5D,c',
+            'with encodeValuesOnly'
+        );
+        st.equal(
+            qs.stringify(JSON.parse('{ "a": [{ "toString": "x" }] }'), { arrayFormat: 'comma', commaRoundTrip: true }),
+            'a%5B%5D=%5Bobject%20Object%5D',
+            'with commaRoundTrip'
+        );
+        st.equal(
+            qs.stringify(JSON.parse('{ "a": [{ "toString": "x" }] }'), { arrayFormat: 'comma' }),
+            qs.stringify({ a: [{ b: 1 }] }, { arrayFormat: 'comma' }),
+            'renders the same as a plain object entry'
+        );
+
+        st.equal(
+            qs.stringify(qs.parse('a[][b]=c', { plainObjects: true }), { arrayFormat: 'comma' }),
+            'a=%5Bobject%20Object%5D',
+            'null-prototype entry from `parse` with plainObjects'
+        );
+        st.equal(
+            qs.stringify(qs.parse('a[][b]=c', { plainObjects: true }), { arrayFormat: 'comma', encodeValuesOnly: true }),
+            'a=%5Bobject%20Object%5D',
+            'null-prototype entry from `parse` with plainObjects, with encodeValuesOnly'
+        );
+        st.equal(
+            qs.stringify(qs.parse('a[0][toString]=x', { allowPrototypes: true }), { arrayFormat: 'comma' }),
+            'a=%5Bobject%20Object%5D',
+            'own `toString` entry from `parse` with allowPrototypes'
+        );
+
+        var nested = JSON.parse('{ "a": [[1, [{ "toString": "x" }]], "y"] }');
+        st.equal(qs.stringify(nested, { arrayFormat: 'comma', encode: false }), 'a=1,[object Object],y', 'nested array');
+        st.equal(
+            qs.stringify(nested, { arrayFormat: 'comma', encodeValuesOnly: true }),
+            'a=1%2C%5Bobject%20Object%5D,y',
+            'nested array, with encodeValuesOnly'
+        );
+        st.equal(qs.stringify({ a: [[1, 2], 3] }, { arrayFormat: 'comma', encode: false }), 'a=1,2,3', 'nested array is still flattened');
+
+        var cyclic = [{ toString: 'x' }];
+        cyclic[cyclic.length] = cyclic;
+        st.equal(
+            qs.stringify({ a: cyclic }, { arrayFormat: 'comma', encode: false }),
+            'a=[object Object],[object Object],',
+            'cyclic nested array joins its cycle as empty'
+        );
+
+        var customJoin = [{ toString: 'x' }];
+        customJoin.join = function () { return 'j'; };
+        st.equal(qs.stringify({ a: [customJoin, 'y'] }, { arrayFormat: 'comma', encode: false }), 'a=j,y', 'own `join` is still used');
+
+        st.equal(
+            qs.stringify({ a: [{ toString: 'x', valueOf: function () { return 7; } }] }, { arrayFormat: 'comma' }),
+            'a=7',
+            'primitive `valueOf` is still used'
+        );
+        st.equal(
+            qs.stringify({ a: [{ toString: 'x', valueOf: function () { return null; } }] }, { arrayFormat: 'comma' }),
+            'a=null',
+            'null `valueOf` is still used'
+        );
+        st.equal(
+            qs.stringify({ a: [{ toString: 'x', valueOf: function () { return {}; } }] }, { arrayFormat: 'comma' }),
+            'a=%5Bobject%20Object%5D',
+            'non-primitive `valueOf` falls back'
+        );
+
+        st.equal(
+            qs.stringify({ a: [{ toString: function () { return 't'; } }, new Date(0)] }, { arrayFormat: 'comma', encode: false }),
+            'a=t,1970-01-01T00:00:00.000Z',
+            'callable `toString` and dates are unaffected'
+        );
+
+        st['throws'](
+            function () {
+                qs.stringify({ a: [{ toString: function () { throw new SyntaxError('mine'); } }] }, { arrayFormat: 'comma' });
+            },
+            SyntaxError,
+            'a throwing `toString` still throws'
+        );
+        st['throws'](
+            function () {
+                qs.stringify({ a: [{ toString: 'x', valueOf: function () { throw new EvalError('mine'); } }] }, { arrayFormat: 'comma' });
+            },
+            EvalError,
+            'a throwing `valueOf` still throws'
+        );
+
+        st.end();
+    });
+
+    t.test('arrayFormat=comma: entries with `Symbol.toPrimitive` are unaffected', { skip: !hasSymbols() || typeof Symbol.toPrimitive !== 'symbol' }, function (st) {
+        var entry = { toString: 'x' };
+        entry[Symbol.toPrimitive] = function () { return 'p'; };
+        st.equal(qs.stringify({ a: [entry] }, { arrayFormat: 'comma' }), 'a=p');
+        st.equal(qs.stringify({ a: [entry] }, { arrayFormat: 'comma', encodeValuesOnly: true }), 'a=p');
+
+        st.end();
+    });
+
     t.test('stringifies a null object', { skip: !hasProto }, function (st) {
         st.equal(qs.stringify({ __proto__: null, a: 'b' }), 'a=b');
         st.end();
@@ -1480,6 +1699,17 @@ test('stringify()', function (t) {
         st.end();
     });
 
+    t.test('encodes a literal `+` as `%2B` in iso-8859-1 mode so it round-trips', function (st) {
+        st.equal(qs.stringify({ a: 'b+c' }, { charset: 'iso-8859-1' }), 'a=b%2Bc', 'a `+` in a value is percent-encoded');
+        st.equal(qs.stringify({ 'a+b': 'c' }, { charset: 'iso-8859-1' }), 'a%2Bb=c', 'a `+` in a key is percent-encoded');
+        st.deepEqual(
+            qs.parse(qs.stringify({ a: 'b+c' }, { charset: 'iso-8859-1' }), { charset: 'iso-8859-1' }),
+            { a: 'b+c' },
+            'the `+` survives a round-trip instead of decoding to a space'
+        );
+        st.end();
+    });
+
     t.test('respects an explicit charset of utf-8 (the default)', function (st) {
         st.equal(qs.stringify({ a: 'æ' }, { charset: 'utf-8' }), 'a=%C3%A6');
         st.end();

package/node_modules/qs/test/utils.js

@@ -106,6 +106,146 @@ test('merge()', function (t) {
             s2t.end();
         });
 
+        st.test('with strictMerge, repeated conflicts append instead of nesting a new wrapper', function (s2t) {
+            var opts = { strictMerge: true };
+            var wrapped = utils.merge({ foo: 'bar' }, 'baz', opts);
+            s2t.deepEqual(wrapped, [{ foo: 'bar' }, 'baz'], 'first conflict wraps in an array');
+
+            var withObject = utils.merge(wrapped, { qux: 'quux' }, opts);
+            s2t.deepEqual(
+                withObject,
+                { 0: { foo: 'bar' }, 1: 'baz', qux: 'quux' },
+                'merging an object converts the wrapper to an object'
+            );
+
+            var second = utils.merge(withObject, 'corge', opts);
+            s2t.deepEqual(
+                second,
+                { 0: { foo: 'bar' }, 1: 'baz', 2: 'corge', qux: 'quux' },
+                'a second conflict appends at the next index'
+            );
+
+            var third = utils.merge(second, 'grault', opts);
+            s2t.deepEqual(
+                third,
+                { 0: { foo: 'bar' }, 1: 'baz', 2: 'corge', 3: 'grault', qux: 'quux' },
+                'a third conflict appends again, so nesting depth stays constant'
+            );
+
+            s2t.end();
+        });
+
+        st.test('with strictMerge, a caller-supplied array is still wrapped, not appended to', function (s2t) {
+            var merged = utils.merge({ 0: 'a', 1: 'b' }, 'c', { strictMerge: true });
+            s2t.deepEqual(merged, [{ 0: 'a', 1: 'b' }, 'c'], 'an unmarked object with numeric keys is wrapped');
+            s2t.end();
+        });
+
+        st.test('with strictMerge, throws instead of appending a conflict past arrayLimit with throwOnLimitExceeded', function (s2t) {
+            var appendConflict = function (options) {
+                var wrapped = utils.merge({ foo: 'bar' }, 'baz', { strictMerge: true });
+                var container = utils.merge(wrapped, { qux: 'quux' }, { strictMerge: true });
+                return utils.merge(container, 'corge', options);
+            };
+
+            s2t['throws'](
+                function () { appendConflict({ strictMerge: true, arrayLimit: 1, throwOnLimitExceeded: true }); },
+                new RangeError('Array limit exceeded. Only 1 element allowed in an array.'),
+                'appending to a two-element container past arrayLimit throws'
+            );
+            s2t['throws'](
+                function () { appendConflict({ strictMerge: true, arrayLimit: 2, throwOnLimitExceeded: true }); },
+                new RangeError('Array limit exceeded. Only 2 elements allowed in an array.'),
+                'uses the plural message when arrayLimit is not 1'
+            );
+            s2t.deepEqual(
+                appendConflict({ strictMerge: true, arrayLimit: 3, throwOnLimitExceeded: true }),
+                { 0: { foo: 'bar' }, 1: 'baz', 2: 'corge', qux: 'quux' },
+                'appends while the container stays within arrayLimit'
+            );
+            s2t.deepEqual(
+                appendConflict({ strictMerge: true, arrayLimit: 1 }),
+                { 0: { foo: 'bar' }, 1: 'baz', 2: 'corge', qux: 'quux' },
+                'still appends past arrayLimit without throwOnLimitExceeded, since the container is already an object'
+            );
+
+            s2t.end();
+        });
+
+        st.test('with strictMerge, a conflict appends after numeric keys already in its container', function (s2t) {
+            var opts = { strictMerge: true };
+
+            var container = utils.merge(utils.merge({ foo: 'bar' }, 'baz', opts), { qux: 'quux' }, opts);
+            var withIndex = utils.merge(container, { 2: 'keep' }, opts);
+            s2t.deepEqual(
+                utils.merge(withIndex, 'corge', opts),
+                { 0: { foo: 'bar' }, 1: 'baz', 2: 'keep', 3: 'corge', qux: 'quux' },
+                'a numeric key merged into the container is not overwritten'
+            );
+
+            var sparse = [];
+            sparse[2] = 'keep';
+            var extended = utils.merge(utils.merge({ foo: 'bar' }, 'baz', opts), sparse, opts);
+            s2t.deepEqual(extended, [{ foo: 'bar' }, 'baz', 'keep'], 'an indexed value extends the container while it is an array');
+            var converted = utils.merge(extended, { qux: 'quux' }, opts);
+            s2t.deepEqual(
+                utils.merge(converted, 'corge', opts),
+                { 0: { foo: 'bar' }, 1: 'baz', 2: 'keep', 3: 'corge', qux: 'quux' },
+                'converting the container to an object keeps its last index'
+            );
+
+            s2t.end();
+        });
+
+        st.test('enforces arrayLimit on the two-element array built for colliding values', function (s2t) {
+            s2t['throws'](
+                function () { utils.merge({ foo: 'bar' }, 'baz', { strictMerge: true, arrayLimit: 1, throwOnLimitExceeded: true }); },
+                new RangeError('Array limit exceeded. Only 1 element allowed in an array.'),
+                'a strictMerge conflict throws at arrayLimit 1'
+            );
+            s2t['throws'](
+                function () { utils.merge('a', 'b', { arrayLimit: 0, throwOnLimitExceeded: true }); },
+                new RangeError('Array limit exceeded. Only 0 elements allowed in an array.'),
+                'two colliding primitives throw at arrayLimit 0'
+            );
+
+            var conflict = utils.merge({ foo: 'bar' }, 'baz', { strictMerge: true, arrayLimit: 1 });
+            s2t.ok(utils.isOverflow(conflict), 'without throwOnLimitExceeded, a strictMerge conflict converts to an overflow object');
+            s2t.deepEqual(conflict, { 0: { foo: 'bar' }, 1: 'baz' }, 'holding both values');
+
+            var pair = utils.merge('a', 'b', { arrayLimit: 1 });
+            s2t.ok(utils.isOverflow(pair), 'without throwOnLimitExceeded, two colliding primitives convert to an overflow object');
+            s2t.deepEqual(pair, { 0: 'a', 1: 'b' }, 'holding both values');
+
+            s2t.deepEqual(
+                utils.merge({ foo: 'bar' }, 'baz', { strictMerge: true, arrayLimit: 2, throwOnLimitExceeded: true }),
+                [{ foo: 'bar' }, 'baz'],
+                'a strictMerge conflict within arrayLimit is still an array'
+            );
+            s2t.deepEqual(
+                utils.merge('a', 'b', { arrayLimit: 2, throwOnLimitExceeded: true }),
+                ['a', 'b'],
+                'two colliding primitives within arrayLimit are still an array'
+            );
+
+            s2t.end();
+        });
+
+        st.test('seeds an overflow container index from the keys it already holds', function (s2t) {
+            var overflow = utils.combine(['a'], 'b', 0, false);
+            s2t.ok(utils.isOverflow(overflow), 'the source is an overflow object');
+
+            var merged = utils.merge({ 2: 'keep', z: 'zz' }, overflow);
+            s2t.ok(utils.isOverflow(merged), 'the result is marked as overflow');
+            s2t.deepEqual(
+                utils.merge(merged, 'c'),
+                { 0: 'a', 1: 'b', 2: 'keep', 3: 'c', z: 'zz' },
+                'the next value lands after the highest numeric key the container already held'
+            );
+
+            s2t.end();
+        });
+
         st.test('merges overflow object into primitive', function (s2t) {
             // Create an overflow object via combine: 2 elements (indices 0-1) with limit 0
             var overflow = utils.combine(['a'], 'b', 0, false);
@@ -441,6 +581,50 @@ test('decode', function (t) {
         'decodes a string in iso-8859-1'
     );
 
+    t.test('strings with no percent sign', function (st) {
+        st.equal(utils.decode(''), '', 'empty string');
+        st.equal(utils.decode('abc'), 'abc', 'returns a plain string unchanged');
+        st.equal(utils.decode('abc', null, 'iso-8859-1'), 'abc', 'returns a plain string unchanged in iso-8859-1');
+        st.equal(utils.decode('a++b+'), 'a  b ', 'decodes every + to a space');
+        st.equal(utils.decode('a++b+', null, 'iso-8859-1'), 'a  b ', 'decodes every + to a space in iso-8859-1');
+        st.equal(utils.decode('\uD800x\uDC00'), '\uD800x\uDC00', 'leaves lone surrogates unchanged');
+        st.equal(utils.decode('😀+'), '😀 ', 'leaves surrogate pairs unchanged');
+        st.equal(utils.decode('a=b&c'), 'a=b&c', 'leaves delimiters unchanged');
+
+        st.end();
+    });
+
+    t.test('strings with a percent sign', function (st) {
+        st.equal(utils.decode('a+%20b'), 'a  b', 'decodes both + and an escape');
+        st.equal(utils.decode('%E9+x', null, 'iso-8859-1'), 'é x', 'decodes both + and an escape in iso-8859-1');
+        st.equal(utils.decode('a+%'), 'a %', 'decodes + even when the escape is malformed');
+        st.equal(utils.decode('a+%E0%A4%A'), 'a %E0%A4%A', 'decodes + even when the escape is truncated');
+
+        st.end();
+    });
+
+    t.test('non-strings', function (st) {
+        forEach(v.nullPrimitives, function (nullish) {
+            st['throws'](
+                function () { utils.decode(nullish); },
+                TypeError,
+                inspect(nullish) + ' is not a string'
+            );
+        });
+        st['throws'](
+            function () { utils.decode(['a']); },
+            TypeError,
+            'an array is not a string'
+        );
+
+        /* eslint no-new-wrappers: 0 */
+        st.equal(utils.decode(new String('ab')), 'ab', 'a boxed string decodes to a primitive');
+        st.equal(utils.decode(new String('a+b')), 'a b', 'a boxed string with + decodes to a primitive');
+        st.equal(utils.decode(new String('a%20b')), 'a b', 'a boxed string with an escape decodes to a primitive');
+
+        st.end();
+    });
+
     t.end();
 });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tickernelz/paperclip-pro-server",
-  "version": "2026.1014.1",
+  "version": "2026.1015.0",
   "license": "MIT",
   "homepage": "https://github.com/tickernelz/paperclip-pro",
   "bugs": {
@@ -54,25 +54,25 @@
     "@openrouter/ai-sdk-provider": "3.1.0",
     "@opentelemetry/api": "^1.9.0",
     "@photon-ai/advanced-imessage": "2.1.0",
-    "@tickernelz/paperclip-pro-adapter-claude-local": "2026.1014.1",
-    "@tickernelz/paperclip-pro-adapter-codex-local": "2026.1014.1",
-    "@tickernelz/paperclip-pro-adapter-cursor-cloud": "2026.1014.1",
-    "@tickernelz/paperclip-pro-adapter-cursor-local": "2026.1014.1",
-    "@tickernelz/paperclip-pro-adapter-gemini-local": "2026.1014.1",
-    "@tickernelz/paperclip-pro-adapter-grok-local": "2026.1014.1",
-    "@tickernelz/paperclip-pro-adapter-kimi-local": "2026.1014.1",
-    "@tickernelz/paperclip-pro-adapter-omp-local": "2026.1014.1",
-    "@tickernelz/paperclip-pro-adapter-openclaw-gateway": "2026.1014.1",
-    "@tickernelz/paperclip-pro-adapter-opencode-local": "2026.1014.1",
-    "@tickernelz/paperclip-pro-adapter-pi-local": "2026.1014.1",
-    "@tickernelz/paperclip-pro-adapter-utils": "2026.1014.1",
-    "@tickernelz/paperclip-pro-db": "2026.1014.1",
-    "@tickernelz/paperclip-pro-hermes-paperclip-adapter": "2026.1014.1",
-    "@tickernelz/paperclip-pro-mcp-server": "2026.1014.1",
-    "@tickernelz/paperclip-pro-plugin-sdk": "2026.1014.1",
-    "@tickernelz/paperclip-pro-shared": "2026.1014.1",
-    "@tickernelz/paperclip-pro-skills-catalog": "2026.1014.1",
-    "@tickernelz/paperclip-pro-teams-catalog": "2026.1014.1",
+    "@tickernelz/paperclip-pro-adapter-claude-local": "2026.1015.0",
+    "@tickernelz/paperclip-pro-adapter-codex-local": "2026.1015.0",
+    "@tickernelz/paperclip-pro-adapter-cursor-cloud": "2026.1015.0",
+    "@tickernelz/paperclip-pro-adapter-cursor-local": "2026.1015.0",
+    "@tickernelz/paperclip-pro-adapter-gemini-local": "2026.1015.0",
+    "@tickernelz/paperclip-pro-adapter-grok-local": "2026.1015.0",
+    "@tickernelz/paperclip-pro-adapter-kimi-local": "2026.1015.0",
+    "@tickernelz/paperclip-pro-adapter-omp-local": "2026.1015.0",
+    "@tickernelz/paperclip-pro-adapter-openclaw-gateway": "2026.1015.0",
+    "@tickernelz/paperclip-pro-adapter-opencode-local": "2026.1015.0",
+    "@tickernelz/paperclip-pro-adapter-pi-local": "2026.1015.0",
+    "@tickernelz/paperclip-pro-adapter-utils": "2026.1015.0",
+    "@tickernelz/paperclip-pro-db": "2026.1015.0",
+    "@tickernelz/paperclip-pro-hermes-paperclip-adapter": "2026.1015.0",
+    "@tickernelz/paperclip-pro-mcp-server": "2026.1015.0",
+    "@tickernelz/paperclip-pro-plugin-sdk": "2026.1015.0",
+    "@tickernelz/paperclip-pro-shared": "2026.1015.0",
+    "@tickernelz/paperclip-pro-skills-catalog": "2026.1015.0",
+    "@tickernelz/paperclip-pro-teams-catalog": "2026.1015.0",
     "@vercel/connect": "2.3.3",
     "acorn": "8.18.0",
     "acpx": "0.13.1",
@@ -128,7 +128,7 @@
     "acpx"
   ],
   "devDependencies": {
-    "@tickernelz/paperclip-pro-paperclip-runner": "2026.1014.1",
+    "@tickernelz/paperclip-pro-paperclip-runner": "2026.1015.0",
     "@types/compression": "^1.8.1",
     "@types/express": "^5.0.0",
     "@types/express-serve-static-core": "^5.1.3",