fix: enforce safe encodeURIComponent/decodeURIComponent across packages

[dinwwwh]

Adds safeEncodeURIComponent and safeDecodeURIComponent to @standard-server/shared, mirroring @orpc/shared, and bans the raw globals in package source with no-restricted-globals. Content-Disposition generation and API Gateway path escaping previously called the raw global and threw a URIError on a filename or path containing a lone surrogate; both now emit U+FFFD instead.

Fixes

• generateContentDisposition no longer throws on a lone surrogate in the filename.
• toStandardUrl in aws-lambda no longer throws on a lone surrogate in a decoded path, and its output matches the WHATWG URL pathname setter for that case.
• Bare function references such as path.replace(re, encodeURIComponent) are now caught by lint. The previous ban/ban entry only matched call expressions, so the aws-lambda case slipped through.

Breaking

• tryDecodeURIComponent in @standard-server/shared is renamed to safeDecodeURIComponent. The package is internal and oRPC does not import the old name.

Testing

• Shared suite covers both helpers, including lone, reversed, and mixed surrogates and malformed percent sequences.
• Lone-surrogate regression cases added to the core and aws-lambda suites.
• pnpm eslint ., pnpm run type:check, and pnpm vitest run (59 files, 1128 tests) all pass.

[pkg-pr-new]

• @standard-server/hono-node-playground
• @standard-server/node-http-playground

@standard-server/aws-lambda

npm i https://pkg.pr.new/@standard-server/aws-lambda@94

@standard-server/core

npm i https://pkg.pr.new/@standard-server/core@94

@standard-server/fastify

npm i https://pkg.pr.new/@standard-server/fastify@94

@standard-server/fetch

npm i https://pkg.pr.new/@standard-server/fetch@94

@standard-server/node

npm i https://pkg.pr.new/@standard-server/node@94

@standard-server/peer

npm i https://pkg.pr.new/@standard-server/peer@94

@standard-server/shared

npm i https://pkg.pr.new/@standard-server/shared@94

commit: 551b579

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[codspeed]

Merging this PR will not alter performance

✅ 26 untouched benchmarks
⏩ 108 skipped benchmarks¹

---

_{Comparing claude/safe-uri-encode-decode-2f74ee (551b579) with main (cddfe52)}

Footnotes

1. 108 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[pullfrog]

✅ No new issues found.

Reviewed changes

• New safeEncodeURIComponent / safeDecodeURIComponent helpers — packages/shared/src/uri.ts replaces the throwing raw globals; safeDecodeURIComponent is the renamed tryDecodeURIComponent with identical behavior, and the encoder falls back to replacing lone surrogates with U+FFFD before re-encoding on URIError.
• Content-Disposition — packages/core/src/utils.ts now uses the helpers, so a lone surrogate in a filename emits %EF%BF%BD instead of throwing.
• AWS Lambda path escaping — packages/aws-lambda/src/url.ts toPathname uses the safe encoder, closing the lone-surrogate throw on a decoded event path.
• Lint enforcement — eslint.config.js drops the old ban/ban decodeURIComponent entry and adds a packages/*/src/**-scoped no-restricted-globals block (re-listing antfu's global/self) that also catches bare references such as path.replace(re, encodeURIComponent); tests/playgrounds opt out.
• Tests — shared suite covers well-formed, lone, reversed, and mixed surrogates plus malformed percent input; lone-surrogate regression cases added to core and aws-lambda, including a cross-check against the WHATWG URL pathname setter.

Verified locally: pnpm run lint clean, tsc -b clean for core/aws-lambda, and the three touched suites pass (85 tests). Confirmed the new no-restricted-globals block flags a bare encodeURIComponent reference in package source, and that no tryDecodeURIComponent references remain.

  ^{｜ View workflow run ｜ Using DeepSeek Flash (default — pick a model for stronger reviews) ｜ 𝕏}