@overdeck/desktop 0.50.0 → 0.50.1

package/server/node_modules/@types/node/quic.d.ts

@@ -1,10 +1,10 @@
 declare module "node:quic" {
     import { NonSharedBuffer } from "node:buffer";
-    import { KeyObject } from "node:crypto";
+    import { KeyObject, X509Certificate } from "node:crypto";
     import { FileHandle } from "node:fs/promises";
     import { BlockList, SocketAddress } from "node:net";
     import { Writer } from "node:stream/iter";
-    import { EphemeralKeyInfo, PeerCertificate } from "node:tls";
+    import { EphemeralKeyInfo } from "node:tls";
     /**
      * @since v23.8.0
      */
@@ -25,6 +25,10 @@ declare module "node:quic" {
         id: bigint,
         status: "acknowledged" | "lost" | "abandoned",
     ) => void;
+    /**
+     * @since v23.8.0
+     */
+    type OnApplicationCallback = (this: QuicSession, applicationoptions: SessionApplicationOptions) => void;
     /**
      * @since v23.8.0
      */
@@ -235,6 +239,7 @@ declare module "node:quic" {
          */
         enableDatagrams?: boolean | undefined;
     }
+    type SessionApplicationOptions = { [K in keyof ApplicationOptions]-?: ApplicationOptions[K] & (bigint | boolean) };
     /**
      * @since v23.8.0
      */
@@ -539,6 +544,7 @@ declare module "node:quic" {
         ongoaway?: QuicSession["ongoaway"] | undefined;
         onkeylog?: QuicSession["onkeylog"] | undefined;
         onqlog?: QuicSession["onqlog"] | undefined;
+        onapplication?: QuicSession["onapplication"] | undefined;
         onheaders?: QuicStream["onheaders"] | undefined;
         ontrailers?: QuicStream["ontrailers"] | undefined;
         oninfo?: QuicStream["oninfo"] | undefined;
@@ -608,6 +614,20 @@ declare module "node:quic" {
      * @since v23.8.0
      */
     function listen(onsession: OnSessionCallback, options?: SessionOptions): Promise<QuicEndpoint>;
+    interface ListEndpointsOptions {
+        /**
+         * If `true` (the default), only returns endpoints that are
+         * active (not destroyed, not closing, and not busy). If `false` returns all
+         * endpoints.
+         */
+        active?: boolean | undefined;
+    }
+    /**
+     * Returns the list of all `QuicEndpoint` instances. By default, only active
+     * endpoints are returned.
+     * @since v26.4.0
+     */
+    function listEndpoints(options?: ListEndpointsOptions): QuicEndpoint[];
     /**
      * The endpoint configuration options passed when constructing a new `QuicEndpoint` instance.
      * @since v23.8.0
@@ -1039,8 +1059,8 @@ declare module "node:quic" {
     interface CreateStreamOptions {
         /**
          * The outbound body source. See `stream.setBody()` for details on
-         * supported types. When omitted, the stream starts half-closed (writable
-         * side open, no body queued).
+         * supported types. When omitted, the stream's outgoing side remains
+         * writable with no body queued; no FIN is sent immediately.
          */
         body?: StreamBody | undefined;
         /**
@@ -1172,7 +1192,7 @@ declare module "node:quic" {
          * be negotiated separately from the transport parameters. Read only.
          * @since v26.3.0
          */
-        readonly applicationOptions: { [K in keyof ApplicationOptions]-?: ApplicationOptions[K] & (bigint | boolean) };
+        readonly applicationOptions: SessionApplicationOptions;
         /**
          * Initiate a graceful close of the session. Existing streams will be allowed
          * to complete but no new streams will be opened. Once all streams have closed,
@@ -1226,6 +1246,11 @@ declare module "node:quic" {
          * @since v23.8.0
          */
         readonly endpoint: QuicEndpoint | null;
+        /**
+         * The callback to invoke when new application options, e.g. HTTP/3 settings arrived.
+         * @since v26.4
+         */
+        onapplication: OnApplicationCallback | undefined;
         /**
          * An optional callback invoked when the session is destroyed with an error.
          * This includes errors caused by user callbacks that throw or reject (see
@@ -1350,7 +1375,8 @@ declare module "node:quic" {
         onqlog: OnQlogCallback | undefined;
         /**
          * Open a new bidirectional stream. If the `body` option is not specified,
-         * the outgoing stream will be half-closed. The `priority` and `incremental`
+         * the stream's outgoing side remains writable and no FIN is sent
+         * immediately. The `priority` and `incremental`
          * options are only used when the session supports priority (e.g. HTTP/3).
          * The `headers`, `onheaders`, `ontrailers`, `oninfo`, and `onwanttrailers`
          * options are only used when the session supports headers (e.g. HTTP/3).
@@ -1359,7 +1385,8 @@ declare module "node:quic" {
         createBidirectionalStream(options?: CreateStreamOptions): Promise<QuicStream>;
         /**
          * Open a new unidirectional stream. If the `body` option is not specified,
-         * the outgoing stream will be closed. The `priority` and `incremental`
+         * the stream's outgoing side remains writable and no FIN is sent
+         * immediately. The `priority` and `incremental`
          * options are only used when the session supports priority (e.g. HTTP/3).
          * @since v23.8.0
          */
@@ -1412,19 +1439,20 @@ declare module "node:quic" {
             encoding?: BufferEncoding,
         ): Promise<bigint>;
         /**
-         * The local certificate as an object with properties such as `subject`,
-         * `issuer`, `valid_from`, `valid_to`, `fingerprint`, etc. Returns `undefined`
-         * if the session is destroyed or no certificate is available.
+         * The local certificate as a `crypto.X509Certificate` instance. Server
+         * sessions return the certificate configured for the negotiated SNI host.
+         * Client sessions return `undefined` unless a client certificate was sent.
+         * Returns `undefined` if the session is destroyed.
          * @since v26.2.0
          */
-        readonly certificate: PeerCertificate | undefined;
+        readonly certificate: X509Certificate | undefined;
         /**
-         * The peer's certificate as an object with properties such as `subject`,
-         * `issuer`, `valid_from`, `valid_to`, `fingerprint`, etc. Returns `undefined`
-         * if the session is destroyed or the peer did not present a certificate.
+         * The peer's certificate as a `crypto.X509Certificate` instance. Returns
+         * `undefined` if the peer did not present a certificate or the session is
+         * destroyed.
          * @since v26.2.0
          */
-        readonly peerCertificate: PeerCertificate | undefined;
+        readonly peerCertificate: X509Certificate | undefined;
         /**
          * The ephemeral key information for the session, with properties such as
          * `type`, `name`, and `size`. Only available on client sessions. Returns

package/server/node_modules/@types/node/stream/iter.d.ts

@@ -271,8 +271,8 @@ declare module "node:stream/iter" {
      *
      * If the object implements the `toAsyncStreamable` protocol (as
      * `stream.Readable` does), that protocol is used. Otherwise, the function
-     * duck-types on `read()` and `on()` (EventEmitter) and wraps the stream with
-     * a batched async iterator.
+     * duck-types on `read()`, `on()`, and `off()` (EventEmitter) and wraps the
+     * stream with a batched async iterator.
      *
      * The result is cached per instance -- calling `fromReadable()` twice with the
      * same stream returns the same iterable.
@@ -294,7 +294,7 @@ declare module "node:stream/iter" {
      * @since v26.1.0
      * @experimental
      * @param readable A classic Readable stream or any object
-     * with `read()` and `on()` methods.
+     * with `read()`, `on()` and `off()` methods.
      * @returns A stream/iter async iterable source.
      */
     function fromReadable(readable: NodeJS.ReadableStream): ByteReadableStream;
@@ -389,7 +389,7 @@ declare module "node:stream/iter" {
      *
      * Each `_write()` / `_writev()` call attempts the Writer's synchronous method
      * first (`writeSync` / `writevSync`), falling back to the async method if the
-     * sync path returns `false` or throws. Similarly, `_final()` tries `endSync()`
+     * sync path returns `false`. Similarly, `_final()` tries `endSync()`
      * before `end()`. When the sync path succeeds, the callback is deferred via
      * `queueMicrotask` to preserve the async resolution contract.
      *

package/server/node_modules/@types/node/stream/web.d.ts

@@ -294,6 +294,26 @@ declare module "node:stream/web" {
         prototype: WritableStreamDefaultWriter;
         new<W = any>(stream: WritableStream<W>): WritableStreamDefaultWriter<W>;
     };
+    // Node.js extensions
+    /**
+     * Runs the WHATWG `ReadableStreamTee` abstract operation on `stream`.
+     *
+     * This differs from `readableStream.tee()` only when `cloneForBranch2` is
+     * `true`. The `tee()` method always passes `false`, while other web platform
+     * specifications, such as Fetch body cloning, pass `true` so that the second
+     * branch receives cloned chunks and consumption of one branch cannot mutate chunks
+     * seen by the other.
+     * @since v26.5.0
+     * @experimental
+     * @param cloneForBranch2 When `true`, chunks enqueued into the second
+     * branch are cloned from chunks enqueued into the first branch. **Default:**
+     * `false`.
+     * @returns Two `ReadableStream` branches.
+     */
+    function ReadableStreamTee<R>(
+        stream: ReadableStream<R>,
+        cloneForBranch2?: boolean,
+    ): [ReadableStream<R>, ReadableStream<R>];
 }
 declare module "stream/web" {
     export * from "node:stream/web";

package/server/node_modules/@types/node/tls.d.ts

@@ -270,11 +270,19 @@ declare module "node:tls" {
          */
         getCipher(): CipherNameAndProtocol;
         /**
-         * Returns an object representing the type, name, and size of parameter of
-         * an ephemeral key exchange in `perfect forward secrecy` on a client
-         * connection. It returns an empty object when the key exchange is not
-         * ephemeral. As this is only supported on a client socket; `null` is returned
-         * if called on a server socket. The supported types are `'DH'` and `'ECDH'`. The `name` property is available only when type is `'ECDH'`.
+         * Returns an object describing ephemeral key agreement in [perfect forward
+         * secrecy](https://nodejs.org/docs/latest-v26.x/api/tls.html#perfect-forward-secrecy) on a client connection. It returns an empty object when the key
+         * agreement is not ephemeral. As this is only supported on a client socket;
+         * `null` is returned if called on a server socket. The supported types are `'DH'`,
+         * `'ECDH'`, and `'TLSGroup'`. For `'DH'` and `'ECDH'`, the object describes peer
+         * temporary key parameters. For `'TLSGroup'`, the object identifies the negotiated
+         * TLS Supported Group used for key agreement when a peer temporary key object is
+         * not available.
+         *
+         * The `name` property is available only when type is `'ECDH'` or `'TLSGroup'`. The
+         * `size` property is not available when type is `'TLSGroup'`. For `'TLSGroup'`,
+         * `name` is the negotiated TLS Supported Group name. Standardized TLS group names
+         * and code points are listed in the [IANA TLS Supported Groups registry](https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8).
          *
          * For example: `{ type: 'ECDH', name: 'prime256v1', size: 256 }`.
          * @since v5.0.0
@@ -746,6 +754,7 @@ declare module "node:tls" {
         // #endregion
     }
     type SecureVersion = "TLSv1.3" | "TLSv1.2" | "TLSv1.1" | "TLSv1";
+    type CertificateCompressionAlgorithm = "zlib" | "brotli" | "zstd";
     interface SecureContextOptions {
         /**
          * If set, this will be called when a client opens a connection using the ALPN extension.
@@ -782,6 +791,15 @@ declare module "node:tls" {
          *  able to validate the certificate, and the handshake will fail.
          */
         cert?: string | Buffer | Array<string | Buffer> | undefined;
+        /**
+         * An array of supported certificate
+         * compression algorithm names, in preference order. Supported values are
+         * `'zlib'`, `'brotli'`, and `'zstd'`. When set, enables TLS certificate
+         * compression ([RFC 8879](https://tools.ietf.org/html/rfc8879)) which compresses certificates during the TLS
+         * handshake, reducing handshake size. Only effective with TLSv1.3.
+         * **Default:** `[]` (disabled).
+         */
+        certificateCompression?: readonly CertificateCompressionAlgorithm[] | undefined;
         /**
          *  Colon-separated list of supported signature algorithms. The list
          *  can contain digest algorithms (SHA256, MD5 etc.), public key
@@ -812,13 +830,16 @@ declare module "node:tls" {
          */
         dhparam?: string | Buffer | undefined;
         /**
-         * A string describing a named curve or a colon separated list of curve
-         * NIDs or names, for example P-521:P-384:P-256, to use for ECDH key
-         * agreement. Set to auto to select the curve automatically. Use
-         * crypto.getCurves() to obtain a list of available curve names. On
-         * recent releases, openssl ecparam -list_curves will also display the
-         * name and description of each available elliptic curve. Default:
-         * tls.DEFAULT_ECDH_CURVE.
+         * A string describing a named curve, TLS group, or
+         * colon-separated list of named curves or TLS groups to use for key agreement,
+         * for example `P-521:P-384:P-256`, `X25519`, or `X25519MLKEM768`. The
+         * historical name of this option refers to ECDH key agreement in TLSv1.2 and
+         * below. In TLSv1.3, this option configures the TLS Supported Groups and
+         * key share groups offered or accepted by the TLS stack. Set to `auto` to
+         * select the group automatically. Use `crypto.getCurves()` to obtain a
+         * list of available elliptic curve names. For TLS group names, use
+         * `openssl list -tls-groups` or consult the [IANA TLS Supported Groups
+         * registry](https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8).
          */
         ecdhCurve?: string | undefined;
         /**
@@ -1110,6 +1131,20 @@ declare module "node:tls" {
      * @since v0.10.2
      */
     function getCiphers(): string[];
+    /**
+     * Returns an array with the names of the RFC 8879 certificate compression
+     * algorithms supported by the current OpenSSL build, suitable for use in the
+     * `certificateCompression` option of `tls.createSecureContext()`. Possible
+     * values include `'zlib'`, `'brotli'`, and `'zstd'`.
+     *
+     * The array is empty when certificate compression is unavailable.
+     *
+     * ```js
+     * console.log(tls.getCertificateCompressionAlgorithms()); // ['zlib', 'brotli', 'zstd']
+     * ```
+     * @since v26.4.0
+     */
+    function getCertificateCompressionAlgorithms(): CertificateCompressionAlgorithm[];
     /**
      * Sets the default CA certificates used by Node.js TLS clients. If the provided
      * certificates are parsed successfully, they will become the default CA
@@ -1143,9 +1178,9 @@ declare module "node:tls" {
      */
     function setDefaultCACertificates(certs: ReadonlyArray<string | NodeJS.ArrayBufferView>): void;
     /**
-     * The default curve name to use for ECDH key agreement in a tls server.
-     * The default value is `'auto'`. See `{@link createSecureContext()}` for further
-     * information.
+     * The default named curve or TLS group list to use for key agreement in a TLS
+     * server. The default value is `'auto'`. See `tls.createSecureContext()` for
+     * further information.
      * @since v0.11.13
      */
     let DEFAULT_ECDH_CURVE: string;

package/server/node_modules/@types/node/ts5.6/buffer.buffer.d.ts

@@ -459,4 +459,9 @@ declare module "node:buffer" {
          */
         type AllowSharedBuffer = Buffer;
     }
+    /**
+     * @deprecated This is intended for internal use, and will be removed once `@types/node` no longer supports
+     * TypeScript versions earlier than 5.7.
+     */
+    type BufferView<T extends NodeJS.ArrayBufferView> = Buffer;
 }

package/server/node_modules/@types/node/ts5.6/index.d.ts

@@ -110,6 +110,7 @@
 /// <reference path="../util.d.ts" />
 /// <reference path="../util/types.d.ts" />
 /// <reference path="../v8.d.ts" />
+/// <reference path="../vfs.d.ts" />
 /// <reference path="../vm.d.ts" />
 /// <reference path="../wasi.d.ts" />
 /// <reference path="../worker_threads.d.ts" />

package/server/node_modules/@types/node/ts5.7/index.d.ts

@@ -110,6 +110,7 @@
 /// <reference path="../util.d.ts" />
 /// <reference path="../util/types.d.ts" />
 /// <reference path="../v8.d.ts" />
+/// <reference path="../vfs.d.ts" />
 /// <reference path="../vm.d.ts" />
 /// <reference path="../wasi.d.ts" />
 /// <reference path="../worker_threads.d.ts" />

package/server/node_modules/@types/node/tty.d.ts

@@ -28,10 +28,11 @@ declare module "node:tty" {
          * Allows configuration of `tty.ReadStream` so that it operates as a raw device.
          *
          * When in raw mode, input is always available character-by-character, not
-         * including modifiers. Additionally, all special processing of characters by the
-         * terminal is disabled, including echoing input
+         * including modifiers. Additionally, all special processing of input characters
+         * by the terminal is disabled, including echoing input
          * characters. Ctrl+C will no longer cause a `SIGINT` when
-         * in this mode.
+         * in this mode. This mode does not affect terminal output processing, such as
+         * newline translation on Unix terminals.
          * @since v0.7.7
          * @param mode If `true`, configures the `tty.ReadStream` to operate as a raw device. If `false`, configures the `tty.ReadStream` to operate in its default mode. The `readStream.isRaw`
          * property will be set to the resulting mode.

package/server/node_modules/@types/node/vfs.d.ts

@@ -0,0 +1,211 @@
+declare module "node:vfs" {
+    /**
+     * Convenience factory equivalent to `new VirtualFileSystem(provider, options)`.
+     *
+     * ```js
+     * const vfs = require('node:vfs');
+     *
+     * // Default in-memory provider
+     * const memoryVfs = vfs.create();
+     *
+     * // Explicit provider
+     * const realVfs = vfs.create(new vfs.RealFSProvider('/tmp/sandbox'));
+     * ```
+     * @since v26.4.0
+     * @param provider The provider to use. **Default:** `new MemoryProvider()`.
+     */
+    function create(provider?: VirtualProvider, options?: VirtualFileSystemOptions): VirtualFileSystem;
+    function create(options: VirtualFileSystemOptions): VirtualFileSystem;
+    interface VirtualFileSystemOptions {
+        /**
+         * Whether to emit the experimental warning. **Default:** `true`.
+         */
+        emitExperimentalWarning?: boolean | undefined;
+    }
+    /**
+     * A `VirtualFileSystem` wraps a {@link VirtualProvider} and exposes a
+     * `node:fs`-like API. Each instance maintains its own file tree.
+     * @since v26.4.0
+     */
+    class VirtualFileSystem {
+        /**
+         * @param provider The provider to use. **Default:** `new MemoryProvider()`.
+         */
+        constructor(provider?: VirtualProvider, options?: VirtualFileSystemOptions);
+        constructor(options: VirtualFileSystemOptions);
+        /**
+         * The provider backing this VFS instance.
+         * @since v26.4.0
+         */
+        readonly provider: VirtualProvider;
+        /**
+         * `true` when the underlying provider is read-only.
+         * @since v26.4.0
+         */
+        readonly readonly: boolean;
+    }
+    interface VirtualFileSystem extends
+        // Synchronous API
+        Pick<
+            typeof import("node:fs"),
+            | "existsSync"
+            | "statSync"
+            | "lstatSync"
+            | "readFileSync"
+            | "writeFileSync"
+            | "appendFileSync"
+            | "readdirSync"
+            | "mkdirSync"
+            | "rmdirSync"
+            | "unlinkSync"
+            | "renameSync"
+            | "copyFileSync"
+            | "realpathSync"
+            | "readlinkSync"
+            | "symlinkSync"
+            | "accessSync"
+            | "rmSync"
+            | "truncateSync"
+            | "ftruncateSync"
+            | "linkSync"
+            | "chmodSync"
+            | "chownSync"
+            | "utimesSync"
+            | "lutimesSync"
+            | "mkdtempSync"
+            | "opendirSync"
+            | "openAsBlob"
+            | "openSync"
+            | "closeSync"
+            | "readSync"
+            | "writeSync"
+            | "fstatSync"
+            | "createReadStream"
+            | "createWriteStream"
+            | "watch"
+            | "watchFile"
+            | "unwatchFile"
+        >,
+        // Callback API
+        Pick<
+            typeof import("node:fs"),
+            | "readFile"
+            | "writeFile"
+            | "stat"
+            | "lstat"
+            | "readdir"
+            | "realpath"
+            | "readlink"
+            | "access"
+            | "open"
+            | "close"
+            | "read"
+            | "write"
+            | "rm"
+            | "fstat"
+            | "truncate"
+            | "ftruncate"
+            | "link"
+            | "mkdtemp"
+            | "opendir"
+        >
+    {
+        // Promise API
+        readonly promises: Pick<
+            typeof import("node:fs/promises"),
+            | "readFile"
+            | "writeFile"
+            | "appendFile"
+            | "stat"
+            | "lstat"
+            | "readdir"
+            | "mkdir"
+            | "rmdir"
+            | "unlink"
+            | "rename"
+            | "copyFile"
+            | "realpath"
+            | "readlink"
+            | "symlink"
+            | "access"
+            | "rm"
+            | "truncate"
+            | "link"
+            | "mkdtemp"
+            | "chmod"
+            | "chown"
+            | "lchown"
+            | "utimes"
+            | "lutimes"
+            | "open"
+            | "lchmod"
+            | "watch"
+        >;
+    }
+    /**
+     * The base class for all VFS providers. Subclasses implement the essential
+     * primitives (such as `open`, `stat`, `readdir`, `mkdir`, `rmdir`, `unlink`,
+     * `rename`, etc.) and inherit default implementations of the derived
+     * methods (such as `readFile`, `writeFile`, `exists`, `copyFile`, `access`, etc.).
+     * @since v26.4.0
+     */
+    abstract class VirtualProvider {
+        get readonly(): boolean;
+        get supportsSymlinks(): boolean;
+        get supportsWatch(): boolean;
+    }
+    /**
+     * The default in-memory provider. Stores files, directories, and symbolic
+     * links in a `Map`-backed tree, supports symlinks (`supportsSymlinks ===
+     * true`), and supports watching (`supportsWatch === true`).
+     * @since v26.4.0
+     */
+    class MemoryProvider extends VirtualProvider {
+        /**
+         * Locks the provider into read-only mode. Subsequent writes through any
+         * `VirtualFileSystem` using this provider throw `EROFS`. There is no
+         * way to revert the provider to writable.
+         *
+         * ```js
+         * const vfs = require('node:vfs');
+         *
+         * const provider = new vfs.MemoryProvider();
+         * const myVfs = vfs.create(provider);
+         * myVfs.writeFileSync('/seed.txt', 'initial');
+         *
+         * provider.setReadOnly();
+         *
+         * myVfs.writeFileSync('/x.txt', 'fail'); // throws EROFS
+         * ```
+         * @since v26.4.0
+         */
+        setReadOnly(): void;
+    }
+    /**
+     * A provider that wraps a directory (i.e. one on the actual file system) and
+     * exposes its contents through the VFS API. All VFS paths are resolved relative to
+     * the root and verified to stay inside it; symbolic links resolving outside the
+     * root are rejected. This path mapping is not a sandbox or access-control
+     * mechanism.
+     * @since v26.4.0
+     */
+    class RealFSProvider extends VirtualProvider {
+        /**
+         * ```js
+         * const vfs = require('node:vfs');
+         *
+         * const realVfs = vfs.create(new vfs.RealFSProvider('/tmp/vfs-root'));
+         * realVfs.writeFileSync('/file.txt', 'hello'); // writes /tmp/vfs-root/file.txt
+         * ```
+         * @since v26.4.0
+         * @param rootPath The absolute file-system path to use as the root.
+         * Must be a non-empty string.
+         */
+        constructor(rootPath: string);
+        /**
+         * The resolved absolute path used as the root.
+         * @since v26.4.0
+         */
+        readonly rootPath: string;
+    }
+}

package/server/node_modules/@types/node/vm.d.ts

@@ -741,7 +741,7 @@ declare module "node:vm" {
          */
         status: ModuleStatus;
         /**
-         * Evaluate the module and its depenendencies. Corresponds to the [Evaluate() concrete method](https://tc39.es/ecma262/#sec-moduleevaluation) field of
+         * Evaluate the module and its dependencies. Corresponds to the [Evaluate() concrete method](https://tc39.es/ecma262/#sec-moduleevaluation) field of
          * [Cyclic Module Record](https://tc39.es/ecma262/#sec-cyclic-module-records)s in the ECMAScript specification.
          *
          * If the module is a `vm.SourceTextModule`, `evaluate()` must be called after the module has been instantiated;

package/server/node_modules/@types/node/zlib.d.ts

@@ -32,6 +32,13 @@ declare module "node:zlib" {
          * @default buffer.kMaxLength
          */
         maxOutputLength?: number | undefined;
+        /**
+         * If `true`, decompression fails when
+         * trailing input is detected after the end of the compressed stream. This
+         * includes unreadable bytes and, when decompressing gzip, additional gzip
+         * members following the first member. **Default:** `false`
+         */
+        rejectGarbageAfterEnd?: boolean | undefined;
     }
     interface BrotliOptions {
         /**
@@ -63,6 +70,11 @@ declare module "node:zlib" {
          * If `true`, returns an object with `buffer` and `engine`.
          */
         info?: boolean | undefined;
+        /**
+         * If `true`, decompression fails when
+         * input remains after the first complete compressed stream. **Default:** `false`
+         */
+        rejectGarbageAfterEnd?: boolean | undefined;
     }
     interface ZstdOptions {
         /**
@@ -98,6 +110,11 @@ declare module "node:zlib" {
          * @since v24.6.0
          */
         dictionary?: NodeJS.ArrayBufferView | undefined;
+        /**
+         * If `true`, decompression fails when
+         * input remains after the first complete compressed stream. **Default:** `false`
+         */
+        rejectGarbageAfterEnd?: boolean | undefined;
     }
     interface Zlib {
         readonly bytesWritten: number;

package/server/node_modules/msgpackr/README.md

@@ -173,6 +173,7 @@ The following options properties can be provided to the Packr or Unpackr constru
 * `useRecords` - Setting this to `false` disables the record extension and stores JavaScript objects as MessagePack maps, and unpacks maps as JavaScript `Object`s, which ensures compatibilty with other decoders. Setting this to a function will use records for objects where `useRecords(object)` returns `true`.
 * `structures` - Provides the array of structures that is to be used for record extension, if you want the structures saved and used again. This array will be modified in place with new record structures that are serialized (if less than 32 structures are in the array).
 * `moreTypes` - Enable serialization of additional built-in types/classes including typed arrays, `Set`s, `Map`s, and `Error`s.
+* `useToJSON` - Setting this to `false` stops the encoder from calling an object's `toJSON()` method to decide how to serialize it; the object's own properties are encoded instead. This defaults to `true`, and is worth disabling when the encoded form is durable state rather than a message: `toJSON()` is a serialization convention shared with `JSON.stringify`, so a class that defines it for its API/response shape would otherwise have that shape written to storage. (Note that cbor-x has the same option with the opposite default.)
 * `structuredClone` - This enables the structured cloning extensions that will encode object/cyclic references. `moreTypes` is enabled by default when this is enabled.
 * `mapsAsObjects` - If `true`, this will decode MessagePack maps and JS `Object`s with the map entries decoded to object properties. If `false`, maps are decoded as JavaScript `Map`s. This is disabled by default if `useRecords` is enabled (which allows `Map`s to be preserved), and is enabled by default if `useRecords` is disabled.
 * `useFloat32` - This will enable msgpackr to encode non-integer numbers as `float32`. See next section for possible values.

package/server/node_modules/msgpackr/dist/index-no-eval.cjs

@@ -1330,7 +1330,7 @@
 						if (value.constructor === Object) writeStruct(value); // simple object
 						else if (value.constructor !== Map && !Array.isArray(value) && !extensionClasses.some(extClass => value instanceof extClass)) {
 							// allow user classes, if they don't need special handling (but do use toJSON if available)
-							writeStruct(value.toJSON ? value.toJSON() : value);
+							writeStruct(packr.useToJSON !== false && value.toJSON ? value.toJSON() : value);
 						} else pack(value);
 					} else
 						pack(value);
@@ -1718,7 +1718,7 @@
 								packArray(value);
 							} else {
 								// use this as an alternate mechanism for expressing how to serialize
-								if (value.toJSON) {
+								if (packr.useToJSON !== false && value.toJSON) {
 									const json = value.toJSON();
 									// if for some reason value.toJSON returns itself it'll loop forever
 									if (json !== value)