fix(core): parse spec-legal content-disposition filename forms

[dinwwwh]

getFilenameFromContentDisposition previously returned undefined for the unquoted token form, matched param names as substrings, and only understood a literal utf-8'' prefix. Spec-compliant peers sending plain filename=report.pdf had their uploads fall back to the name "blob" in every adapter, and ext-values with a charset or language tag came back garbled. generateContentDisposition also gains an optional 'inline' | 'attachment' type parameter (default 'inline', so existing output is unchanged).

Fixes

• attachment; filename=report.pdf now yields report.pdf instead of undefined — fetch/node/aws-lambda/peer adapters no longer fall back to blob for these headers.
• Param names are anchored to the header start or ;, so xfilename*=evil no longer matches and can no longer shadow a legitimate filename="good.txt"; same for creation-filename= in the quoted branch.
• The RFC 8187 ext-value is parsed as charset'lang'value: filename*=utf-8'en'%E2%82%AC.txt decodes to €.txt instead of keeping the utf-8'en' prefix. Only utf-8/us-ascii values are percent-decoded; unsupported charsets fall through to the plain filename param.
• Charset-less filename*=%XX... values still percent-decode (lenient path pinned by an existing test).

Notes for reviewers

• A ; inside a quoted filename value is still treated as a param delimiter (pre-existing, also affects generate→parse round-trips of filenames containing "; ); left for a follow-up since fixing it conflicts with the malformed-input expectation tested at utils.test.ts:35.

Testing

• 15 new assertions covering the token form, anchoring/shadowing, charset+language prefixes, unsupported-charset fallback, and both disposition types.
• Full workspace suite passes: 909 tests across 59 files; typecheck and eslint clean.

[pkg-pr-new]

• @standardserver/hono-node-playground
• @standardserver/node-http-playground

@standardserver/aws-lambda

npm i https://pkg.pr.new/@standardserver/aws-lambda@52

@standardserver/bun

npm i https://pkg.pr.new/@standardserver/bun@52

@standardserver/core

npm i https://pkg.pr.new/@standardserver/core@52

@standardserver/deno

npm i https://pkg.pr.new/@standardserver/deno@52

@standardserver/fastify

npm i https://pkg.pr.new/@standardserver/fastify@52

@standardserver/fetch

npm i https://pkg.pr.new/@standardserver/fetch@52

@standardserver/node

npm i https://pkg.pr.new/@standardserver/node@52

@standardserver/peer

npm i https://pkg.pr.new/@standardserver/peer@52

@standardserver/shared

npm i https://pkg.pr.new/@standardserver/shared@52

commit: 33d9c6e

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[codspeed-hq]

Merging this PR will not alter performance

✅ 26 untouched benchmarks
⏩ 108 skipped benchmarks¹

---

_{Comparing claude/filename-content-disposition-parse-a470f6 (33d9c6e) with main (db2dd09)}

Footnotes

1. 108 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩