@daniel156161/prism 0.2.100 → 0.2.101

package/node_modules/@types/node/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@types/node",
-    "version": "26.2.0",
+    "version": "26.3.0",
     "description": "TypeScript definitions for node",
     "homepage": "https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node",
     "license": "MIT",
@@ -150,6 +150,6 @@
         "undici-types": "~8.3.0"
     },
     "peerDependencies": {},
-    "typesPublisherContentHash": "e8c7e12bafdd8ff8648e4d416be7af2d4373bffe17a7498d815e251898739e7c",
+    "typesPublisherContentHash": "125032099e1f7132c95bf327b36f694c396de965952f7cb9632ac916bbad47e9",
     "typeScriptVersion": "5.6"
 }

package/node_modules/@types/node/process.d.ts

@@ -549,6 +549,58 @@ declare module "node:process" {
                  * @since v20.0.0
                  */
                 has(scope: string, reference?: string): boolean;
+                /**
+                 * Drops the specified permission from the current process. This operation is
+                 * **irreversible** — once a permission is dropped, it cannot be restored through
+                 * any Node.js API.
+                 *
+                 * If no reference is provided, the entire scope is dropped. For example,
+                 * `process.permission.drop('fs.read')` will revoke ALL file system read
+                 * permissions.
+                 *
+                 * When a reference is provided, only the permission for that specific resource
+                 * is dropped. For example, `process.permission.drop('fs.read', '/etc/myapp')`
+                 * will revoke read access to that directory while keeping other read
+                 * permissions intact.
+                 *
+                 * **Important:** You can only drop the exact resource that was explicitly
+                 * granted. The reference passed to `drop()` must match the original grant:
+                 *
+                 * * If a permission was granted using a wildcard (`*`), such as
+                 *   `--allow-fs-read=*`, individual paths cannot be dropped - only the entire
+                 *   scope can be dropped (by calling `drop()` without a reference).
+                 * * If a directory was granted (e.g. `--allow-fs-read=/my/folder`), you cannot
+                 *   drop access to individual files inside it. You must drop the same directory
+                 *   that was granted. Any remaining grants continue to apply.
+                 *
+                 * The available scopes are the same as [`process.permission.has()`][]:
+                 *
+                 *  `fs` - All File System (drops both read and write)
+                 * * `fs.read` - File System read operations
+                 * * `fs.write` - File System write operations
+                 * * `child` - Child process spawning operations
+                 * * `worker` - Worker thread spawning operation
+                 * * `net` - Network operations
+                 * * `inspector` - Inspector operations
+                 * * `wasi` - WASI operations
+                 * * `addon` - Native addon operations
+                 *
+                 * ```js
+                 * const fs = require('node:fs');
+                 *
+                 * // Read configuration during startup
+                 * const config = fs.readFileSync('/etc/myapp/config.json', 'utf8');
+                 *
+                 * // Drop read access to the config directory after initialization
+                 * process.permission.drop('fs.read', '/etc/myapp');
+                 *
+                 * // This will now throw ERR_ACCESS_DENIED
+                 * fs.readFileSync('/etc/myapp/config.json');
+                 * ```
+                 * @since v26.3.0
+                 * @experimental
+                 */
+                drop(scope: string, reference?: string): void;
             }
             interface ProcessReport {
                 /**

package/node_modules/@types/node/quic.d.ts

@@ -2,7 +2,7 @@ declare module "node:quic" {
     import { NonSharedBuffer } from "node:buffer";
     import { KeyObject } from "node:crypto";
     import { FileHandle } from "node:fs/promises";
-    import { SocketAddress } from "node:net";
+    import { BlockList, SocketAddress } from "node:net";
     import { Writer } from "node:stream/iter";
     import { EphemeralKeyInfo, PeerCertificate } from "node:tls";
     /**
@@ -192,34 +192,40 @@ declare module "node:quic" {
          */
         authoritative?: boolean | undefined;
     }
+    /**
+     * @since v26.3.0
+     */
     interface ApplicationOptions {
         /**
-         * Maximum number of header name-value pairs accepted per header block. Headers beyond this limit are silently
-         * dropped. **Default:** `128`
+         * Maximum number of header name-value pairs accepted per header block.
+         * Headers beyond this limit are silently dropped. **Default:** `128`
          */
-        maxHeaderPairs?: number | undefined;
+        maxHeaderPairs?: bigint | number | undefined;
         /**
-         * Maximum total byte length of all header names and values combined per header block. Headers that would push
-         * the total over this limit are silently dropped. **Default:** `8192`
+         * Maximum total byte length of all header names and values combined per header
+         * block. Headers that would push the total over this limit are silently
+         * dropped. **Default:** `8192`
          */
-        maxHeaderLength?: number | undefined;
+        maxHeaderLength?: bigint | number | undefined;
         /**
-         * Maximum size of a compressed header field section (QPACK). `0` means unlimited. **Default:** `0`
+         * Maximum size of a compressed header field section (QPACK). `0` means
+         * unlimited. **Default:** `0`
          */
-        maxFieldSectionSize?: number | undefined;
+        maxFieldSectionSize?: bigint | number | undefined;
         /**
-         * QPACK dynamic table capacity in bytes. Set to `0` to disable the dynamic table. **Default:** `4096`
+         * QPACK dynamic table capacity in bytes. Set to `0` to disable the dynamic
+         * table. **Default:** `4096`
          */
-        qpackMaxDTableCapacity?: number | undefined;
+        qpackMaxDTableCapacity?: bigint | number | undefined;
         /**
          * QPACK encoder maximum dynamic table capacity. **Default:** `4096`
          */
-        qpackEncoderMaxDTableCapacity?: number | undefined;
+        qpackEncoderMaxDTableCapacity?: bigint | number | undefined;
         /**
-         * Maximum number of streams that can be blocked waiting for QPACK dynamic table updates.
-         * **Default:** `100`
+         * Maximum number of streams that can e blocked waiting for QPACK dynamic table
+         * updates. **Default:** `100`
          */
-        qpackBlockedStreams?: number | undefined;
+        qpackBlockedStreams?: bigint | number | undefined;
         /**
          * Enable the extended CONNECT protocol (RFC 9220). **Default:** `false`
          */
@@ -256,8 +262,7 @@ declare module "node:quic" {
          */
         alpn?: string | readonly string[] | undefined;
         /**
-         * HTTP/3 application-specific options. These only apply when the negotiated
-         * ALPN selects the HTTP/3 application (`'h3'`).
+         * Application-specific options.
          * @since v26.2.0
          */
         application?: ApplicationOptions | undefined;
@@ -342,7 +347,12 @@ declare module "node:quic" {
         minVersion?: number | undefined;
         /**
          * When the remote peer advertises a preferred address, this option specifies whether
-         * to use it or ignore it.
+         * to use it or ignore it. The default is `'ignore'` because honoring a server's
+         * preferred address causes the client to migrate its connection to a different IP
+         * address, which can be exploited for data exfiltration attacks that are
+         * indistinguishable from legitimate QUIC connection migration at the network level.
+         * Set to `'use'` only when connecting to trusted servers that require preferred
+         * address migration.
          * @since v23.8.0
          */
         preferredAddressPolicy?: "use" | "ignore" | "default" | undefined;
@@ -370,6 +380,21 @@ declare module "node:quic" {
          * @since v26.2.0
          */
         datagramDropPolicy?: "drop-oldest" | "drop-newest" | undefined;
+        /**
+         * The maximum time in milliseconds that a peer-initiated stream can be idle
+         * (no data received) before it is automatically destroyed. This protects
+         * against slowloris-style attacks where a remote peer opens streams but never
+         * sends data, holding server resources indefinitely. Only peer-initiated
+         * streams are checked — locally-initiated streams are the application's
+         * responsibility. Set to `0` to disable.
+         *
+         * The idle check runs as part of the normal send processing loop, so it adds
+         * no additional timers or event loop overhead. The
+         * `session.stats.streamsIdleTimedOut` counter tracks how many streams have been
+         * destroyed by this mechanism.
+         * @since v26.3.0
+         */
+        streamIdleTimeout?: bigint | number | undefined;
         /**
          * The maximum number of `SendPendingData` cycles a datagram can survive
          * without being sent before it is abandoned. When a datagram cannot be
@@ -397,6 +422,30 @@ declare module "node:quic" {
          * @since v23.8.0
          */
         handshakeTimeout?: bigint | number | undefined;
+        /**
+         * Controls how the client handles server certificate validation:
+         *
+         * * `'strict'` — OpenSSL aborts the TLS handshake immediately if the server's
+         *   certificate fails validation. The `session.opened` promise rejects with a
+         *   TLS error. The application cannot inspect the certificate or the error
+         *   details. This is the most secure mode.
+         *
+         * * `'auto'` — The TLS handshake completes regardless of validation result.
+         *   If validation fails, the `session.opened` promise is rejected with an error
+         *   containing the validation reason, and the session is destroyed. The
+         *   `onhandshake` callback (if set) fires before rejection, allowing diagnostic
+         *   logging. This is the default and matches the behavior of `tls.connect()`
+         *   with `rejectUnauthorized: true`.
+         *
+         * * `'manual'` — The TLS handshake completes regardless of validation result.
+         *   The `session.opened` promise resolves with the handshake info, which includes
+         *   `validationErrorReason` and `validationErrorCode` if validation failed. The
+         *   application is responsible for checking these values and deciding whether to
+         *   continue. Use this mode for custom validation logic, certificate pinning, or
+         *   intentionally accepting self-signed certificates.
+         * @since v26.3.0
+         */
+        verifyPeer?: "strict" | "auto" | "manual" | undefined;
         /**
          * The peer server name to target (SNI). Defaults to `'localhost'`.
          * @since v26.1.0
@@ -569,6 +618,31 @@ declare module "node:quic" {
          * @since v23.8.0
          */
         address?: SocketAddress | string | undefined;
+        /**
+         * An optional `net.BlockList` instance for filtering incoming packets by
+         * source address. When configured, every received UDP packet is checked against
+         * the block list before any QUIC processing occurs, minimizing resource
+         * expenditure on blocked sources. The block list is evaluated live — rules
+         * added to the `BlockList` object after the endpoint is created take effect
+         * immediately.
+         *
+         * See `endpointOptions.blockListPolicy` for how matches are interpreted.
+         * @since v26.3.0
+         */
+        blockList?: BlockList | undefined;
+        /**
+         * Controls how the `endpointOptions.blockList` is interpreted:
+         *
+         * * `'deny'` — Packets from addresses matching the block list are dropped.
+         *   All other addresses are accepted. This is the typical blocklist mode.
+         * * `'allow'` — Only packets from addresses matching the block list are
+         *   accepted. All other addresses are dropped. This is an allowlist mode
+         *   for restricting access to known clients.
+         *
+         * If no block list is configured, this option has no effect.
+         * @since v26.3.0
+         */
+        blockListPolicy?: "deny" | "allow" | undefined;
         /**
          * The endpoint maintains an internal cache of validated socket addresses as a
          * performance optimization. This option sets the maximum number of addresses
@@ -625,15 +699,69 @@ declare module "node:quic" {
          */
         maxConnectionsTotal?: number | undefined;
         /**
-         * Specifies the maximum number of QUIC retry attempts allowed per remote peer address.
-         * @since v23.8.0
+         * The maximum number of QUIC retry packets the endpoint will send per second.
+         * This is a global rate limit (not per-host) that caps the total server-wide
+         * retry response rate, preventing spoofed-source floods from consuming unbounded
+         * resources.
+         * @since v26.3.0
          */
-        maxRetries?: bigint | number | undefined;
+        retryRate?: number | undefined;
         /**
-         * Specifies the maximum number of stateless resets that are allowed per remote peer address.
-         * @since v23.8.0
+         * The maximum burst of retry packets allowed before rate limiting takes effect.
+         * @since v26.3.0
          */
-        maxStatelessResetsPerHost?: bigint | number | undefined;
+        retryBurst?: number | undefined;
+        /**
+         * The maximum number of stateless reset packets the endpoint will send per second.
+         * @since v26.3.0
+         */
+        statelessResetRate?: number | undefined;
+        /**
+         * The maximum burst of stateless reset packets allowed before rate limiting
+         * takes effect.
+         * @since v26.3.0
+         */
+        statelessResetBurst?: number | undefined;
+        /**
+         * The maximum number of version negotiation packets the endpoint will send per
+         * second.
+         * @since v26.3.0
+         */
+        versionNegotiationRate?: number | undefined;
+        /**
+         * The maximum number of immediate connection close packets the endpoint will
+         * send per second.
+         * @since v26.3.0
+         */
+        versionNegotiationBurst?: number | undefined;
+        /**
+         * The maximum number of immediate connection close packets the endpoint will
+         * send per second.
+         * @since v26.3.0
+         */
+        immediateCloseRate?: number | undefined;
+        /**
+         * The maximum burst of immediate connection close packets allowed before rate
+         * limiting takes effect.
+         * @since v26.3.0
+         */
+        immediateCloseBurst?: number | undefined;
+        /**
+         * The maximum number of new sessions that a single remote address can create per
+         * second. This is a per-host rate limit tracked in the address validation LRU
+         * cache. It prevents a validated remote address from churning through sessions
+         * (rapidly opening and abandoning connections) faster than the server can handle.
+         * For benchmarking where traffic comes from a single source, set this to a high
+         * value.
+         * @since v26.3.0
+         */
+        sessionCreationRate?: number | undefined;
+        /**
+         * The maximum burst of new session creations allowed from a single remote address
+         * before rate limiting takes effect.
+         * @since v26.3.0
+         */
+        sessionCreationBurst?: number | undefined;
         /**
          * Specifies the length of time a QUIC retry token is considered valid.
          * @since v23.8.0
@@ -846,25 +974,66 @@ declare module "node:quic" {
              */
             readonly serverBusyCount: bigint;
             /**
-             * The total number of QUIC retry attempts on this endpoint. Read only.
+             * The total number of retry packets sent by this endpoint. Read only.
              * @since v23.8.0
              */
             readonly retryCount: bigint;
             /**
-             * The total number of sessions rejected due to QUIC version mismatch. Read only.
+             * The total number of retry packets dropped by the global rate
+             * limiter. Read only. A non-zero value indicates the endpoint is under retry
+             * flood pressure.
+             * @since v26.3.0
+             */
+            readonly retryRateLimited: bigint;
+            /**
+             * The total number of version negotiation packets sent by this
+             * endpoint. Read only.
              * @since v23.8.0
              */
             readonly versionNegotiationCount: bigint;
             /**
-             * The total number of stateless resets handled by this endpoint. Read only.
+             * The total number of version negotiation packets dropped by
+             * the global rate limiter. Read only.
+             * @since v26.3.0
+             */
+            readonly versionNegotiationRateLimited: bigint;
+            /**
+             * The total number of stateless reset packets sent by this
+             * endpoint. Read only.
              * @since v23.8.0
              */
             readonly statelessResetCount: bigint;
             /**
-             * The total number of sessions that were closed before handshake completed. Read only.
+             * The total number of stateless reset packets dropped by the
+             * global rate limiter. Read only.
+             * @since v26.3.0
+             */
+            readonly statelessResetRateLimited: bigint;
+            /**
+             * The total number of immediate connection close packets sent
+             * by this endpoint. Read only.
              * @since v23.8.0
              */
             readonly immediateCloseCount: bigint;
+            /**
+             * The total number of immediate connection close packets
+             * dropped by the global rate limiter. Read only.
+             * @since v26.3.0
+             */
+            readonly immediateCloseRateLimited: bigint;
+            /**
+             * The total number of session creation attempts dropped by the
+             * per-host rate limiter. Read only. A non-zero value indicates one or more
+             * remote addresses are creating sessions faster than the configured rate allows.
+             * @since v26.3.0
+             */
+            readonly sessionCreationRateLimited: bigint;
+            /**
+             * The total number of incoming packets dropped by the
+             * block list filter. Read only.
+             * @since v26.3.0
+             */
+            readonly packetsBlocked: bigint;
         }
     }
     interface CreateStreamOptions {
@@ -997,6 +1166,13 @@ declare module "node:quic" {
      */
     class QuicSession implements AsyncDisposable {
         private constructor();
+        /**
+         * The current application-level options for this session. These include settings
+         * that are specific to the negotiated application protocol (e.g. HTTP/3) and may
+         * be negotiated separately from the transport parameters. Read only.
+         * @since v26.3.0
+         */
+        readonly applicationOptions: { [K in keyof ApplicationOptions]-?: ApplicationOptions[K] & (bigint | boolean) };
         /**
          * Initiate a graceful close of the session. Existing streams will be allowed
          * to complete but no new streams will be opened. Once all streams have closed,
@@ -1395,6 +1571,12 @@ declare module "node:quic" {
              * @since v23.8.0
              */
             readonly datagramsLost: bigint;
+            /**
+             * The total number of peer-initiated streams destroyed by the
+             * stream idle timeout. Read only.
+             * @since v26.3.0
+             */
+            readonly streamsIdleTimedOut: bigint;
         }
     }
     interface QuicErrorOptions {

package/node_modules/@types/node/sqlite.d.ts

@@ -127,8 +127,12 @@ declare module "node:sqlite" {
     }
     interface ApplyChangesetOptions {
         /**
-         * Skip changes that, when targeted table name is supplied to this function, return a truthy value.
-         * By default, all changes are attempted.
+         * for each table affected by at least
+         * one change in the changeset, the `filter` callback is invoked with the
+         * table name as the first argument. If the return value is falsy, then no
+         * attempt is made to apply any changes to the table.
+         * Otherwise, if the return value is truthy or no `filter` callback is provided,
+         * all changes related to the table are attempted.
          * @since v22.12.0
          */
         filter?: ((tableName: string) => boolean) | undefined;

package/node_modules/@types/node/test.d.ts

@@ -677,6 +677,12 @@ declare module "node:test" {
                  * The nesting level of the test.
                  */
                 nesting: number;
+                /**
+                 * The `testId` of the enclosing test, or
+                 * `undefined` for top-level tests. Lets custom reporters track lineage
+                 * when concurrent siblings at the same nesting level interleave.
+                 */
+                parentId: number | undefined;
                 /**
                  * The flattened lowercased tags declared on the test
                  * and its ancestor suites, in declaration order. Empty for untagged tests.
@@ -711,6 +717,12 @@ declare module "node:test" {
                  * The nesting level of the test.
                  */
                 nesting: number;
+                /**
+                 * The `testId` of the enclosing test, or
+                 * `undefined` for top-level tests. Lets custom reporters track lineage
+                 * when concurrent siblings at the same nesting level interleave.
+                 */
+                parentId: number | undefined;
                 /**
                  * The flattened lowercased tags declared on the test
                  * and its ancestor suites, in declaration order. Empty for untagged tests.
@@ -738,6 +750,12 @@ declare module "node:test" {
                  * The nesting level of the test.
                  */
                 nesting: number;
+                /**
+                 * The `testId` of the enclosing test, or
+                 * `undefined` for top-level tests. Lets custom reporters track lineage
+                 * when concurrent siblings at the same nesting level interleave.
+                 */
+                parentId: number | undefined;
                 /**
                  * The flattened lowercased tags declared on the test
                  * and its ancestor suites, in declaration order. Empty for untagged tests.
@@ -789,6 +807,12 @@ declare module "node:test" {
                  * The nesting level of the test.
                  */
                 nesting: number;
+                /**
+                 * The `testId` of the enclosing test, or
+                 * `undefined` for top-level tests. Lets custom reporters track lineage
+                 * when concurrent siblings at the same nesting level interleave.
+                 */
+                parentId: number | undefined;
                 /**
                  * The flattened lowercased tags declared on the test
                  * and its ancestor suites, in declaration order. Empty for untagged tests.
@@ -856,6 +880,12 @@ declare module "node:test" {
                  * The nesting level of the test.
                  */
                 nesting: number;
+                /**
+                 * The `testId` of the enclosing test, or
+                 * `undefined` for top-level tests. Lets custom reporters track lineage
+                 * when concurrent siblings at the same nesting level interleave.
+                 */
+                parentId: number | undefined;
                 /**
                  * The flattened lowercased tags declared on the test
                  * and its ancestor suites, in declaration order. Empty for untagged tests.
@@ -900,6 +930,12 @@ declare module "node:test" {
                  * The nesting level of the test.
                  */
                 nesting: number;
+                /**
+                 * The `testId` of the enclosing test, or
+                 * `undefined` for top-level tests. Lets custom reporters track lineage
+                 * when concurrent siblings at the same nesting level interleave.
+                 */
+                parentId: number | undefined;
                 /**
                  * The flattened lowercased tags declared on the test
                  * and its ancestor suites, in declaration order. Empty for untagged tests.

package/node_modules/brace-expansion/README.md

@@ -71,9 +71,8 @@ result count stays under `max` while each result grows very long.
 
 ```js
 const expansions = expand('{a,b}'.repeat(1500), {
-  maxLength: 100,
+  maxLength: 10_000,
 })
-// the combined length of expansions will not exceed 100 characters
 ```
 
 Valid expansions are:

package/node_modules/brace-expansion/dist/commonjs/index.js

@@ -130,7 +130,7 @@ function combine(acc, pre, values, max, maxLength, dropEmpties) {
 }
 // The expansion values of a single numeric (`1..5`) or alphabetic (`a..e..2`)
 // sequence body.
-function expandSequence(body, isAlphaSequence, max) {
+function expandSequence(body, isAlphaSequence, max, maxLength) {
     const n = body.split(/\.\./);
     const N = [];
     // A sequence body always splits into two or three parts, but the compiler
@@ -153,6 +153,7 @@ function expandSequence(body, isAlphaSequence, max) {
         test = gte;
     }
     const pad = n.some(isPadded);
+    let length = 0;
     for (let i = x; test(i, y) && N.length < max; i += incr) {
         let c;
         if (isAlphaSequence) {
@@ -176,7 +177,10 @@ function expandSequence(body, isAlphaSequence, max) {
                 }
             }
         }
+        if (length + c.length > maxLength)
+            break;
         N.push(c);
+        length += c.length;
     }
     return N;
 }
@@ -230,7 +234,7 @@ function expand_(str, max, maxLength, isTop) {
         }
         let values;
         if (isSequence) {
-            values = expandSequence(m.body, isAlphaSequence, max);
+            values = expandSequence(m.body, isAlphaSequence, max, maxLength);
         }
         else {
             let n = parseCommaParts(m.body);
@@ -248,9 +252,31 @@ function expand_(str, max, maxLength, isTop) {
                 }
                 /* c8 ignore stop */
             }
+            // Values that `combine` is going to drop as empty produce no result, so
+            // they must not count against `max` - otherwise `{a,,b}` with `max: 2`
+            // would stop at `['a', '']` and yield one result instead of two. Skipping
+            // them outright keeps `values` bounded while leaving `max` a bound on
+            // *kept* results.
+            let dropsEmpties = dropEmpties && !m.post.length && !pre;
+            for (let d = 0; dropsEmpties && d < acc.length; d++) {
+                if (acc[d]) {
+                    dropsEmpties = false;
+                }
+            }
             values = [];
-            for (let j = 0; j < n.length; j++) {
-                values.push.apply(values, expand_(n[j], max, maxLength, false));
+            let valuesLength = 0;
+            outer: for (let j = 0; j < n.length; j++) {
+                const expanded = expand_(n[j], max, maxLength, false);
+                for (let k = 0; k < expanded.length; k++) {
+                    const v = expanded[k];
+                    if (dropsEmpties && !v)
+                        continue;
+                    if (values.length >= max || valuesLength + v.length > maxLength) {
+                        break outer;
+                    }
+                    values.push(v);
+                    valuesLength += v.length;
+                }
             }
         }
         acc = combine(acc, pre, values, max, maxLength, dropEmpties && !m.post.length);