mandala-computer-mcp 0.1.1 → 0.4.0

package/dist/api.js

@@ -1,5 +1,5 @@
-import { Agent, fetch as undiciFetch } from 'undici';
-import { CancelledError, ConnectivityError, ConnectivityInterruptedError, errorForStatus, MandalaError, RangeNotSatisfiableError, RateLimitError, } from './errors.js';
+import { Agent, Headers as UndiciHeaders, fetch as undiciFetch } from 'undici';
+import { CancelledError, ConnectivityError, ConnectivityInterruptedError, errorForStatus, MandalaError, RangeNotSatisfiableError, RedirectError, } from './errors.js';
 export const DEFAULT_BASE_URL = 'https://app.mandala.computer/api/v1';
 /** Anthropic's own key, forwarded for the one route that runs a model. */
 export const MODEL_KEY_HEADER = 'X-Model-Key';
@@ -11,14 +11,28 @@ export const MODEL_KEY_HEADER = 'X-Model-Key';
  * until the process runs out of memory.
  */
 const MAX_SSE_BUFFER = 8 * 1024 * 1024;
-/** Finite response-body ceilings for the two paths that decode text. */
-const MAX_JSON_BODY_BYTES = 16 * 1024 * 1024;
+/**
+ * Finite response-body ceilings for the two paths that decode text.
+ *
+ * The JSON one is sized off the largest legitimate response on any route, which
+ * is an exec answer (OPL-4542). The guest agent caps its capture at 16 MiB PER
+ * STREAM, and both streams now travel as base64 — four characters for every
+ * three bytes — so a foreground command that filled both arrives as about
+ * 42.7 MiB of JSON. This used to be 16 MiB, sized when those fields were JSON
+ * strings of the decoded bytes, and a body over it is not truncated but
+ * REFUSED: the model would have lost the whole answer, truncation sentence
+ * included, somewhere north of 12 MiB of output. Under the platform's own
+ * 64 MiB transfer cap, and still finite, which is the only thing this guard is
+ * for — it exists to refuse an unbounded body, not to set a policy on a large
+ * one.
+ */
+const MAX_JSON_BODY_BYTES = 48 * 1024 * 1024;
 const MAX_ERROR_BODY_BYTES = 1024 * 1024;
 /**
- * The longest guest exec waits 300 seconds before it answers. Node's bundled
- * fetch also gives response headers 300 seconds by default, so the client can
- * lose that race while the command is still finishing in the guest. Keep the
- * public exec limit and give the platform enough time to report its timeout.
+ * The longest foreground guest exec waits 600 seconds before it answers.
+ * Node's bundled fetch gives response headers 300 seconds by default, so the
+ * client can lose that race while the command is still finishing in the guest.
+ * Allow 30 seconds beyond the public exec limit for the timeout response.
  *
  * The body is a different clock. undici's default `bodyTimeout` is 300 seconds
  * of silence *between chunks*, and `run_agent` SSE (or a long exec that has
@@ -27,10 +41,10 @@ const MAX_ERROR_BODY_BYTES = 1024 * 1024;
  * disables it: a quiet gap is not a dead connection, and the caller's
  * AbortSignal is what ends a request nobody is waiting for.
  */
-export const PLATFORM_HEADERS_TIMEOUT_MS = 330_000;
+export const PLATFORM_HEADERS_TIMEOUT_MS = 630_000;
 /** Disabled. A finite idle limit is what used to kill a quiet SSE stream. */
 export const PLATFORM_BODY_TIMEOUT_MS = 0;
-const PLATFORM_DISPATCHER = new Agent({
+export const PLATFORM_DISPATCHER = new Agent({
     headersTimeout: PLATFORM_HEADERS_TIMEOUT_MS,
     bodyTimeout: PLATFORM_BODY_TIMEOUT_MS,
 });
@@ -105,7 +119,7 @@ export class Api {
             parsed = new URL(baseUrl);
         }
         catch {
-            throw new MandalaError(`not a valid base URL: ${baseUrl}. Set MANDALA_BASE_URL to an absolute http(s) URL, e.g. ${DEFAULT_BASE_URL}`);
+            throw new MandalaError(`not a valid base URL. Set MANDALA_BASE_URL to an absolute http(s) URL, e.g. ${DEFAULT_BASE_URL}`);
         }
         // The scheme the message already promised. `new URL` alone accepts
         // `file:`, `ftp:` and anything else with a colon in it, so a typo that
@@ -113,7 +127,7 @@ export class Api {
         // the protocol — a message about the request, in a place that was supposed
         // to be about the setting.
         if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
-            throw new MandalaError(`not an http(s) base URL: ${baseUrl}. Set MANDALA_BASE_URL to an absolute http(s) URL, e.g. ${DEFAULT_BASE_URL}`);
+            throw new MandalaError(`not an http(s) base URL. Set MANDALA_BASE_URL to an absolute http(s) URL, e.g. ${DEFAULT_BASE_URL}`);
         }
         // Normalised as a URL rather than as a string. `${base}/${path}` looked
         // equivalent and is not, because a base may carry a query — a tenant or an
@@ -126,9 +140,8 @@ export class Api {
         parsed.pathname = parsed.pathname.replace(/\/+$/, '');
         this.#base = parsed;
         // Still the string that was given, minus the trailing slashes it was always
-        // stripped of — this is what error messages name and what `with` re-parses,
-        // and changing its spelling would change what a reader is told they
-        // configured.
+        // stripped of — this is what `with` re-parses, and changing its spelling
+        // would change the configured destination.
         this.baseUrl = baseUrl.replace(/\/+$/, '');
         this.#apiKey = apiKey;
         this.#signal = signal;
@@ -194,6 +207,8 @@ export class Api {
             body = JSON.stringify(opts.body);
         }
         const signal = opts.signal ?? this.#signal;
+        const requested = this.#url(path, opts.query);
+        const fetchRequest = platformFetch();
         let resp;
         try {
             // `dispatcher` is Node/undici's extension to RequestInit. It is kept on
@@ -203,9 +218,16 @@ export class Api {
                 headers,
                 body,
                 signal,
+                // Answered, not followed. `isTransientForPoll` has always documented
+                // this client as one that does not follow redirects — the `>= 500` rule
+                // is argued from it — and the default `'follow'` quietly made that
+                // false: up to twenty hops, with the bearer still attached on the
+                // same-origin ones, and an operator whose MANDALA_BASE_URL is wrong
+                // never finding out. See {@link RedirectError}.
+                redirect: 'manual',
                 dispatcher: PLATFORM_DISPATCHER,
             };
-            resp = await platformFetch()(this.#url(path, opts.query), init);
+            resp = await fetchRequest(requested, init);
         }
         catch (cause) {
             // Cancellation first, because it is not a connectivity failure and the
@@ -219,6 +241,11 @@ export class Api {
             if (isCancellation(cause, signal)) {
                 throw cancellationError(method, path, 'before the platform answered');
             }
+            if (fetchRequest === undiciFetch &&
+                undiciRejectsLocally(requested, headers)) {
+                throw new MandalaError(`${method} /${path.replace(/^\/+/, '')} was rejected locally before it could be sent. ` +
+                    'Check the configured URL and request headers.');
+            }
             // Rewritten, because the raw one names the host and the failure a model
             // can act on is "the platform is not reachable", not a DNS error string.
             //
@@ -228,14 +255,44 @@ export class Api {
             // wire means the platform may have acted and the answer was lost. The
             // second says so, and the wording follows the class rather than the other
             // way round (OPL-3855).
-            const detail = cause instanceof Error ? cause.message : String(cause);
             if (neverDispatched(cause)) {
-                throw new ConnectivityError(`could not reach ${this.#base.origin}: ${detail}`);
+                throw new ConnectivityError(`could not reach ${this.#base.origin}`);
             }
             throw new ConnectivityInterruptedError(`${method} /${path.replace(/^\/+/, '')} to ${this.#base.origin} failed after the request ` +
-                `was sent: ${detail}. It may have been received, so treat anything it would have ` +
+                `was sent. It may have been received, so treat anything it would have ` +
                 'changed as unknown rather than undone.');
         }
+        // Before the general mapping, because a 3xx carries no error body to read
+        // and its one useful field is a HEADER. Left to `#error` it would arrive as
+        // a bare `HTTP 301`, which says nothing about the configuration to inspect.
+        if (resp.status >= 300 && resp.status < 400) {
+            // Resolved against the request, because `Location` is very often relative
+            // and `redirect: 'manual'` hands back the raw header. The resolved value
+            // is diagnostic only: it names the resource that redirected, not
+            // necessarily the API root callers should configure.
+            const raw = resp.headers.get('location');
+            let to = raw ?? undefined;
+            if (raw) {
+                try {
+                    to = new URL(raw, requested).toString();
+                }
+                catch {
+                    // A Location this client cannot parse is still worth repeating
+                    // verbatim: the operator can see what the platform said.
+                    to = raw;
+                }
+            }
+            // Cancelled before the throw, the way every other exit in this file
+            // cancels its reader. A 3xx body is nothing anybody wants, but an unread
+            // one holds its undici connection open until the GC gets to it — and the
+            // whole point of this branch is a misconfigured base URL, which means
+            // EVERY request takes it.
+            await resp.body?.cancel().catch(() => { });
+            throw new RedirectError(`${method} /${path.replace(/^\/+/, '')} was redirected (HTTP ${resp.status}${to ? ` to ${to}` : ', with no Location header'}). This client does not follow redirects. Verify that MANDALA_BASE_URL names the API ` +
+                `root that serves this request; ${to
+                    ? 'the resource URL in Location is not itself a base URL to copy'
+                    : 'the configured API root did not identify the resource directly'}. Retrying this unchanged gets the same answer.`, resp.status);
+        }
         if (!resp.ok)
             throw await this.#error(resp, method, path, signal);
         return resp;
@@ -291,24 +348,13 @@ export class Api {
                 body = text;
             }
         }
-        // The one status whose headers say more than its body does. `Content-Range:
-        // bytes *\/<size>` carries the file's real length, and errorForStatus takes
-        // no headers — deliberately, since every other status it maps is decided by
-        // the number alone. So this one is built here, where the response is still
-        // in hand, and the length rides on the error to whoever asked for the range.
+        const delay = retryAfterMs(resp.headers.get('retry-after'));
+        // Content-Range describes the file length, independently of Retry-After.
         if (resp.status === 416) {
             const total = parseContentRange(resp.headers.get('content-range'))?.total;
-            return new RangeNotSatisfiableError(message, resp.status, body, total);
-        }
-        // The other one, for the same reason: `Retry-After` is a header, and it is
-        // the platform saying how long to wait rather than leaving the wait tools
-        // to guess. Built here while the response is still in hand; the BY_STATUS
-        // entry covers a 429 reaching errorForStatus from anywhere else, without
-        // the number.
-        if (resp.status === 429) {
-            return new RateLimitError(message, resp.status, body, retryAfterMs(resp.headers.get('retry-after')));
+            return new RangeNotSatisfiableError(message, resp.status, body, total, delay);
         }
-        return errorForStatus(resp.status, message, body);
+        return errorForStatus(resp.status, message, body, delay);
     }
     /**
      * A JSON body, or nothing, or a named failure.
@@ -377,7 +423,7 @@ export class Api {
      * short 200 — but a caller that opts in gets the list plus `X-GC-Incomplete`,
      * and a header is only a warning if something reads it.
      *
-     * It is the count of what the placement cache could account for, and it is
+     * It is the count of what the host cache could account for, and it is
      * legitimately `0`: a computer created during the outage was never cached
      * against the host now holding it. So presence is the signal and the number is
      * detail, which is why this returns `null` versus a number rather than a
@@ -415,7 +461,7 @@ export class Api {
         // because assuming is the exact failure the status exists to prevent, and
         // because nothing downstream can tell the difference afterwards.
         //
-        // The platform always sends the header (`bytes %d-%d/%d` in server/api.go).
+        // The platform always sends the header, formatted `bytes %d-%d/%d`.
         // A hop in front of it that drops the header is the case this is for, and
         // the same one mandala-computer-typescript's toFileChunk refuses.
         if (resp.status === 206 && !window) {
@@ -424,9 +470,22 @@ export class Api {
                 `(${resp.headers.get('content-range') ?? 'header absent'}), so where these bytes ` +
                 'belong in the file is unknown');
         }
+        const span = window ? window.end - window.start + 1 : undefined;
+        if (span !== undefined && declared !== undefined && declared !== span) {
+            await resp.body?.cancel().catch(() => { });
+            throw new MandalaError(`${method} ${path} answered 206 with Content-Range ${resp.headers.get('content-range')} ` +
+                `for ${span} bytes but Content-Length ${declared}; refusing an inconsistent partial response`);
+        }
         const { bytes, truncated } = await readBody(method, path, opts.signal ?? this.#signal, async () => limit === undefined
             ? { bytes: new Uint8Array(await resp.arrayBuffer()), truncated: false }
             : await readAtMost(resp, limit));
+        if (span !== undefined &&
+            ((!truncated && bytes.length !== span) || (truncated && bytes.length >= span))) {
+            throw new MandalaError(`${method} ${path} answered 206 with Content-Range ${resp.headers.get('content-range')} ` +
+                `for ${span} bytes but the body ${truncated
+                    ? `continued after its ${bytes.length}-byte local prefix`
+                    : `ended at ${bytes.length} bytes`}; refusing an inconsistent partial response`);
+        }
         return {
             bytes,
             contentType,
@@ -436,18 +495,13 @@ export class Api {
             // number here is about the window: Content-Length is how long THIS body
             // is, and `bytes.length` is how much of it was kept. Reading either as
             // the file's size is how a caller decides it has the whole thing.
-            totalBytes: window?.total !== undefined
+            totalBytes: window
                 ? window.total
                 : truncated
                     ? declared !== undefined && declared > bytes.length
                         ? declared
                         : undefined
-                    : // A 206 whose Content-Range said `*`: the window arrived in full
-                        // and the file's length is still unknown, so this must not fall
-                        // through to `bytes.length`, which would call the window the file.
-                        window
-                            ? undefined
-                            : bytes.length,
+                    : bytes.length,
             unrangeable: (resp.headers.get('accept-ranges') ?? '').trim().toLowerCase() === 'none',
             window,
         };
@@ -466,6 +520,8 @@ export class Api {
         });
         const contentType = mediaType(resp.headers.get('content-type'));
         if (contentType !== 'text/event-stream') {
+            // No reader owns this body yet; release a rejected response ourselves.
+            await resp.body?.cancel().catch(() => { });
             throw new MandalaError(`${method} ${path} expected text/event-stream, but the platform answered ${contentType}`);
         }
         if (!resp.body)
@@ -473,6 +529,10 @@ export class Api {
         const reader = resp.body.getReader();
         const decoder = new TextDecoder();
         let buffer = '';
+        // A boundary ending in CR is complete immediately. If that CR later gains
+        // an LF in the next network chunk, discard the LF as the optional second
+        // byte of the line ending that was already consumed.
+        let suppressLeadingLf = false;
         try {
             for (;;) {
                 const { done, value } = await readBody(method, path, opts.signal ?? this.#signal, () => reader.read());
@@ -483,21 +543,26 @@ export class Api {
                 // becomes CR-then-LF, each rewritten to its own LF, and the pair reads
                 // as the blank line that ends an event — so a frame gets cut in half at
                 // a boundary that was never in the stream.
-                buffer += decoder.decode(value, { stream: true });
-                // Events are separated by a blank line, in whichever of the three
-                // terminators the sender chose: the spec allows CRLF, LF and lone CR,
-                // and a proxy that reframes the stream is entitled to any of them.
+                let decoded = decoder.decode(value, { stream: true });
+                if (suppressLeadingLf && decoded) {
+                    suppressLeadingLf = false;
+                    if (decoded.startsWith('\n'))
+                        decoded = decoded.slice(1);
+                }
+                buffer += decoded;
+                // Events are separated by a blank line. Each of its two line endings
+                // may be CRLF, LF, or lone CR, and a proxy that reframes the stream is
+                // entitled to mix them.
                 // Matching only "\n\n" found no boundary at all in a CRLF stream, which
                 // collapsed a whole run into one unparseable event and lost the result
                 // of a run that had in fact succeeded.
                 for (;;) {
-                    const sep = /\r?\n\r?\n|\r\r/.exec(buffer);
-                    // A tail of "\r\n\r" is deliberately not a boundary yet — the LF that
-                    // would complete it may be in the next read.
+                    const sep = sseBoundary(buffer);
                     if (!sep)
                         break;
                     const chunk = buffer.slice(0, sep.index);
-                    buffer = buffer.slice(sep.index + sep[0].length);
+                    buffer = buffer.slice(sep.index + sep.length);
+                    suppressLeadingLf = sep.suppressLeadingLf;
                     const parsed = parseEvent(chunk);
                     if (parsed)
                         yield parsed;
@@ -518,6 +583,16 @@ export class Api {
             // simply dropped without this, rather than surfacing as the replacement
             // character that says something was lost.
             buffer += decoder.decode();
+            for (;;) {
+                const sep = sseBoundary(buffer);
+                if (!sep)
+                    break;
+                const chunk = buffer.slice(0, sep.index);
+                buffer = buffer.slice(sep.index + sep.length);
+                const parsed = parseEvent(chunk);
+                if (parsed)
+                    yield parsed;
+            }
             const tail = parseEvent(buffer);
             if (tail)
                 yield tail;
@@ -527,6 +602,31 @@ export class Api {
         }
     }
 }
+/**
+ * Does undici refuse this request shape before it can put anything on a wire?
+ *
+ * Its own validation errors quote the rejected header value or full URL. Those
+ * values can contain the credentials this client is responsible for keeping
+ * out of errors, so inspect the inputs instead of the exception text. The
+ * caller checks that undici itself was selected before using this result; a
+ * replacement fetch may support URL userinfo or validate headers differently.
+ *
+ * Kept deliberately narrow. An arbitrary TypeError from fetch does not prove a
+ * request stayed local, and treating one as safe to replay could duplicate a
+ * mutating operation.
+ */
+function undiciRejectsLocally(requested, headers) {
+    const url = new URL(requested);
+    if (url.username || url.password)
+        return true;
+    try {
+        new UndiciHeaders(headers);
+        return false;
+    }
+    catch {
+        return true;
+    }
+}
 /**
  * Was this rejection the caller hanging up, rather than the network?
  *
@@ -551,7 +651,7 @@ function isCancellation(_cause, signal) {
  * links have to be followed. Bounded, because a cause chain is user-reachable
  * data and nothing here needs to be robust to a cycle.
  */
-function* causes(err, depth = 0) {
+export function* causes(err, depth = 0) {
     if (!err || typeof err !== 'object' || depth > 5)
         return;
     const e = err;
@@ -710,7 +810,8 @@ async function readBody(method, path, signal, read) {
         // lost is the answer. That is precisely the case `isTransient` must say no
         // to and the poll predicate must ride out (OPL-3855).
         if (isTransportFailure(cause)) {
-            throw new ConnectivityInterruptedError(`could not finish reading ${method} /${path.replace(/^\/+/, '')}: ${cause instanceof Error ? cause.message : String(cause)}. The request was received, so treat anything it would have changed as ` +
+            throw new ConnectivityInterruptedError(`could not finish reading ${method} /${path.replace(/^\/+/, '')}. ` +
+                `The request was received, so treat anything it would have changed as ` +
                 'unknown rather than undone.');
         }
         throw cause;
@@ -741,9 +842,9 @@ function mediaType(header) {
  * cannot disagree about the grammar, and `*` in either position comes back as
  * `undefined` rather than as a number nothing sent.
  *
- * A malformed header is nothing rather than a throw: it is metadata about a
- * body that already arrived, and failing a download over the label on it would
- * be a worse answer than the one this gives.
+ * A malformed header is nothing rather than a throw so each status can decide
+ * what absence means. A 206 is rejected because its byte positions would be
+ * unknown; a 416 remains useful even when it cannot report the optional size.
  */
 function parseContentRange(header) {
     if (!header)
@@ -759,12 +860,29 @@ function parseContentRange(header) {
     };
     const start = num(m[1]);
     const end = num(m[2]);
+    const total = num(m[3]);
+    // Numeric fields that do not fit safely cannot be treated as wildcards.
+    // Doing so would turn a precise but unusable claim into an unknown one and
+    // let callers continue with offsets JavaScript cannot represent exactly.
+    if ((m[1] && start === undefined) ||
+        (m[2] && end === undefined) ||
+        (m[3] !== '*' && total === undefined)) {
+        return undefined;
+    }
     // A window whose end precedes its start describes no bytes. Dropping the pair
     // rather than passing it on keeps `end - start + 1` from being negative in
     // every caller that trusts this.
     if (start !== undefined && end !== undefined && end < start)
         return undefined;
-    return { start, end, total: num(m[3]) };
+    if (start !== undefined && end !== undefined) {
+        const span = end - start + 1;
+        if (!Number.isSafeInteger(span))
+            return undefined;
+        // A satisfied range cannot name bytes at or beyond the complete length.
+        if (total !== undefined && end >= total)
+            return undefined;
+    }
+    return { start, end, total };
 }
 /**
  * The longest delay `setTimeout` takes without wrapping.
@@ -795,14 +913,28 @@ const MAX_TIMER_MS = 2_147_483_647;
  * delta-seconds is not malformed enough to stop there: `Date.parse('-5')` is a
  * date in 2001, so it falls through to the branch below and lands on 0, which
  * is the same answer a date in the past gets and is why nothing worse happens.
+ *
+ * DECIMAL DIGITS for the first branch, not whatever `Number()` will take. The
+ * header's grammar is delta-seconds or an HTTP-date, and `0x10` and `1e3` are
+ * neither — but `Number()` reads them as 16 and 1000, so a broken or hostile
+ * intermediary could spell a sixteen-minute sleep in three characters and have
+ * a poll loop honour it as if the platform had asked. Gated the way
+ * {@link contentLength} below and `port()` in cli.ts already gate the same
+ * `Number()` footgun; anything else falls through to the date branch, which
+ * refuses it, and the loop keeps its own interval.
  */
 function retryAfterMs(header) {
     if (!header)
         return undefined;
-    const seconds = Number(header);
+    const seconds = /^\d+$/.test(header.trim()) ? Number(header) : Number.NaN;
     if (Number.isFinite(seconds) && seconds >= 0)
         return Math.min(seconds * 1_000, MAX_TIMER_MS);
-    const at = Date.parse(header);
+    const value = header.trim();
+    const httpDate = /^(?:[A-Za-z]{3}, \d{2} [A-Za-z]{3} \d{4} \d{2}:\d{2}:\d{2} GMT|[A-Za-z]+, \d{2}-[A-Za-z]{3}-\d{2} \d{2}:\d{2}:\d{2} GMT|[A-Za-z]{3} [A-Za-z]{3} {1,2}\d{1,2} \d{2}:\d{2}:\d{2} \d{4})$/;
+    if (!httpDate.test(value))
+        return undefined;
+    // HTTP dates are always UTC, including asctime's timezone-free spelling.
+    const at = Date.parse(value.endsWith('GMT') ? value : `${value} GMT`);
     if (!Number.isFinite(at))
         return undefined;
     return Math.min(Math.max(at - Date.now(), 0), MAX_TIMER_MS);
@@ -877,6 +1009,38 @@ async function readTextAtMost(resp, limit) {
     const { bytes, truncated } = await readAtMost(resp, limit);
     return { text: new TextDecoder().decode(bytes), truncated };
 }
+/** Find the next SSE blank line without confusing a split CRLF for two lines. */
+function sseBoundary(text) {
+    const endingAt = (index, trailingCrCompletesBoundary = false) => {
+        const char = text[index];
+        if (char === '\n')
+            return { length: 1, suppressLeadingLf: false };
+        if (char !== '\r')
+            return undefined;
+        if (index + 1 === text.length) {
+            return trailingCrCompletesBoundary ? { length: 1, suppressLeadingLf: true } : undefined;
+        }
+        return {
+            length: text[index + 1] === '\n' ? 2 : 1,
+            suppressLeadingLf: false,
+        };
+    };
+    for (let index = 0; index < text.length; index++) {
+        const first = endingAt(index);
+        if (first === undefined)
+            continue;
+        const second = endingAt(index + first.length, true);
+        if (second !== undefined) {
+            return {
+                index,
+                length: first.length + second.length,
+                suppressLeadingLf: second.suppressLeadingLf,
+            };
+        }
+        index += first.length - 1;
+    }
+    return undefined;
+}
 function parseEvent(chunk) {
     let event = 'message';
     const data = [];
@@ -902,31 +1066,146 @@ function parseEvent(chunk) {
         return { event, data: joined };
     }
 }
+/**
+ * Split a `Content-Disposition` header into its parameters, per the grammar in
+ * RFC 6266 §4.1 and RFC 7230 §3.2.6 rather than by regex.
+ *
+ * Two attempts at this shipped a worse bug than the one they fixed, and both
+ * failed at the same place: deciding what a `"` means without tracking where in
+ * the grammar the reader is. A `"` is only a delimiter where a value begins.
+ * Anywhere else — `note=a"b` — it is an ordinary character of a token, and a
+ * reader that toggles on every quote it meets turns the rest of the header into
+ * one run and loses the real `filename` after it.
+ *
+ * Inside a quoted string, `\` escapes the next character (`quoted-pair`), so a
+ * `\"` does NOT close the value. A reader that stops at the first `"` it sees
+ * lets a trailing `\"` smuggle a `; filename=` out of a value the sender
+ * controls and into the parameter list.
+ *
+ * An unterminated quoted value runs to the end of the header. That is the one
+ * decision here that is a judgment rather than the grammar — see the comment on
+ * `filenameFrom` — and it is what keeps such a value's contents from being read
+ * as parameters at all.
+ */
+function dispositionParams(header) {
+    const params = [];
+    // The disposition-type comes first and is a bare token; parameters begin at
+    // the first `;`. A header with no `;` has no parameters and no filename.
+    let i = header.indexOf(';');
+    if (i === -1)
+        return params;
+    while (i < header.length) {
+        i += 1; // past the ';' that begins this parameter
+        while (i < header.length && /\s/.test(header[i]))
+            i += 1;
+        const nameFrom = i;
+        while (i < header.length && header[i] !== '=' && header[i] !== ';')
+            i += 1;
+        const name = header.slice(nameFrom, i).trim().toLowerCase();
+        if (header[i] !== '=') {
+            // A parameter with no `=` at all. Recorded so it cannot be mistaken for
+            // the next one, and skipped.
+            if (name)
+                params.push({ name, value: '' });
+            continue;
+        }
+        i += 1; // past the '='
+        // BWS: RFC 7230 allows whitespace either side of the `=`, and a value that
+        // begins after it is still that parameter's value.
+        while (i < header.length && /[ \t]/.test(header[i]))
+            i += 1;
+        let value = '';
+        if (header[i] === '"') {
+            i += 1;
+            let out = '';
+            for (; i < header.length; i += 1) {
+                const ch = header[i];
+                if (ch === '\\' && i + 1 < header.length) {
+                    out += header[i + 1];
+                    i += 1;
+                }
+                else if (ch === '"') {
+                    i += 1;
+                    break;
+                }
+                else
+                    out += ch;
+            }
+            value = out;
+            // Anything between the closing quote and the next `;` is not part of the
+            // value and is not a parameter either.
+            while (i < header.length && header[i] !== ';')
+                i += 1;
+        }
+        else {
+            const from = i;
+            while (i < header.length && header[i] !== ';')
+                i += 1;
+            // A token value carries no delimiters, so the whitespace around it is the
+            // header's formatting rather than the name: `filename=real.txt ; x=1`
+            // named a file with a trailing space on it.
+            value = header.slice(from, i).trim();
+        }
+        if (name)
+            params.push({ name, value });
+    }
+    return params;
+}
 /** The filename the platform put on a download, if it put one there. */
 export function filenameFrom(disposition) {
     if (!disposition)
         return undefined;
-    // Any charset and any language, not only `UTF-8''`. RFC 5987 writes this
-    // value as charset, language, then the text, with the language ordinarily
-    // empty — and matching only the empty spelling meant that both
-    // `filename*=ISO-8859-1''…` and `filename*=UTF-8'en'…` were read by neither
-    // branch — the plain form below cannot match either, since there is no
-    // `filename=` in them — so a download the platform had named came back with
-    // no name at all. Three groups, not two: the middle one is the language tag,
-    // present or empty.
-    const star = /filename\*=([^']*)'([^']*)'([^;]+)/i.exec(disposition);
-    if (star) {
-        // A stray `%` in a guest filename is legal on disk and makes this throw.
-        // Letting it out would turn a download whose bytes already arrived intact
-        // into a failure, over the label on it.
+    // Parsed rather than matched. Every previous spelling of this read the header
+    // with one regex, and each one in turn found a `filename=` that belonged to
+    // some other parameter's value — `inline; x-filename=q.txt` through a missing
+    // parameter boundary, then `note="a; filename=evil.txt"` through a `;` inside
+    // a quoted string. What the sender controls should not be able to add a
+    // parameter the sender did not send.
+    //
+    // The judgment call, stated because the grammar does not make it: an
+    // unterminated quoted value consumes the rest of the header. It is what the
+    // WHATWG "collect an HTTP quoted string" algorithm does, and it is the only
+    // reading under which `note="a; filename=evil.txt\"` — where the `\"` escapes
+    // the quote that would have closed the value — yields no filename at all. The
+    // cost is that a sloppy sender's unterminated value swallows a real
+    // `filename` after it; the benefit is that a hostile one cannot smuggle a
+    // fake one out. `filename="report.pdf` still works, because there the
+    // unterminated value IS the filename.
+    const params = dispositionParams(disposition);
+    // RFC 8187: charset, language, then the text, with the language ordinarily
+    // empty. Any charset and any language, not only `UTF-8''` — matching the
+    // empty spelling alone meant `ISO-8859-1''…` and `UTF-8'en'…` were read by
+    // neither branch, and a download the platform had named came back unnamed.
+    // The FIRST USABLE one of each name, not the first one. A repeated parameter
+    // is malformed and the platform never sends one, but the regex this replaced
+    // walked on from an occurrence it could not read — `[^";]+` cannot match an
+    // empty value — and answered from the next. Stopping at the first occurrence
+    // instead means `filename=""; filename=real.txt` loses a name that was there,
+    // which is a regression on an already-invalid header rather than a defence:
+    // every parameter in this list is one the sender genuinely wrote at the top
+    // level, since a smuggled one never becomes a parameter at all.
+    for (const p of params) {
+        if (p.name !== 'filename*')
+            continue;
+        const ext = /^[^']*'[^']*'([\s\S]*)$/.exec(p.value);
+        // An empty `filename*` names nothing, so keep looking — at another
+        // `filename*`, and then at the plain `filename` beside it. Either beats
+        // answering with the empty string.
+        if (!ext?.[1])
+            continue;
         try {
-            return decodeURIComponent(star[3]);
+            return decodeURIComponent(ext[1]);
         }
         catch {
-            return star[3];
+            // A stray `%` in a guest filename is legal on disk and makes this throw.
+            // Letting it out would turn a download whose bytes already arrived intact
+            // into a failure, over the label on it.
+            return ext[1];
         }
     }
-    const plain = /filename="?([^";]+)"?/i.exec(disposition);
-    return plain ? plain[1] : undefined;
+    for (const p of params)
+        if (p.name === 'filename' && p.value)
+            return p.value;
+    return undefined;
 }
 //# sourceMappingURL=api.js.map