@suveren/gateway 0.7.6 → 0.8.0

package/node_modules/@types/node/net.d.ts

@@ -25,6 +25,7 @@ declare module "node:net" {
         keepAliveInitialDelay?: number | undefined;
         blockList?: BlockList | undefined;
         typeOfService?: number | undefined;
+        handle?: BoundSocket | undefined;
     }
     interface OnReadOpts {
         buffer: Uint8Array | (() => Uint8Array);
@@ -57,6 +58,12 @@ declare module "node:net" {
     }
     type SocketConnectOpts = TcpSocketConnectOpts | IpcSocketConnectOpts;
     type SocketReadyState = "opening" | "open" | "readOnly" | "writeOnly" | "closed";
+    interface SetKeepAliveOptions {
+        enable?: boolean | undefined;
+        initialDelay?: number | undefined;
+        interval?: number | undefined;
+        count?: number | undefined;
+    }
     interface SocketEventMap extends Omit<stream.DuplexEventMap, "close"> {
         "close": [hadError: boolean];
         "connect": [];
@@ -199,25 +206,27 @@ declare module "node:net" {
          */
         setNoDelay(noDelay?: boolean): this;
         /**
-         * Enable/disable keep-alive functionality, and optionally set the initial
-         * delay before the first keepalive probe is sent on an idle socket.
-         *
-         * Set `initialDelay` (in milliseconds) to set the delay between the last
-         * data packet received and the first keepalive probe. Setting `0` for`initialDelay` will leave the value unchanged from the default
-         * (or previous) setting.
-         *
-         * Enabling the keep-alive functionality will set the following socket options:
+         * Configure keep-alive using an options object. See `socket.setKeepAlive()`
+         * for a description of each property.
          *
-         * * `SO_KEEPALIVE=1`
-         * * `TCP_KEEPIDLE=initialDelay`
-         * * `TCP_KEEPCNT=10`
-         * * `TCP_KEEPINTVL=1`
+         * ```js
+         * socket.setKeepAlive({ enable: true, initialDelay: 1000, interval: 1000, count: 10 });
+         * ```
+         * @since v26.4.0
+         * @returns The socket itself.
+         */
+        setKeepAlive(options: SetKeepAliveOptions): this;
+        /**
+         * Configure keep-alive using positional arguments. See
+         * `socket.setKeepAlive()` for a description of each argument.
          * @since v0.1.92
-         * @param [enable=false]
-         * @param [initialDelay=0]
-         * @return The socket itself.
+         * @param enable **Default:** `false`
+         * @param initialDelay **Default:** `0`
+         * @param interval **Default:** `1000`
+         * @param count **Default:** `10`
+         * @returns The socket itself.
          */
-        setKeepAlive(enable?: boolean, initialDelay?: number): this;
+        setKeepAlive(enable?: boolean, initialDelay?: number, interval?: number, count?: number): this;
         /**
          * Returns the current Type of Service (TOS) field for IPv4 packets or Traffic
          * Class for IPv6 packets for this socket.
@@ -442,9 +451,92 @@ declare module "node:net" {
         removeListener(eventName: string | symbol, listener: (...args: any[]) => void): this;
         // #endregion
     }
+    interface BoundSocketOptions {
+        /**
+         * Local address to bind. Must be a numeric IP literal; no DNS
+         * resolution is performed. **Default:** `'0.0.0.0'`, or `'::'` when
+         * `ipv6Only` is `true`.
+         */
+        host?: string | undefined;
+        /**
+         * Local port. `0` requests an OS-assigned ephemeral port.
+         * **Default:** `0`.
+         */
+        port?: number | undefined;
+        /**
+         * Sets `IPV6_V6ONLY`, disabling dual-stack support so the
+         * socket binds IPv6 only. Only meaningful for IPv6 binds. **Default:**
+         * `false`.
+         */
+        ipv6Only?: boolean | undefined;
+        /**
+         * Sets `SO_REUSEPORT`, allowing multiple sockets to bind
+         * the same address and port for kernel-level load balancing. Support is
+         * platform-dependent. **Default:** `false`.
+         */
+        reusePort?: boolean | undefined;
+    }
+    /**
+     * Allows for the synchronous creation of a pre-bound socket, that can be passed
+     * to `listen()` or `new net.Socket()` later on. For `listen()` this enables
+     * synchronous port reservation, while for `new net.Socket()`, it allows control
+     * over the local egress port/IP, via `bind(2)` semantics.
+     *
+     * Adoption transfers ownership of the socket; afterwards `address()` and `close()`
+     * throw `ERR_SOCKET_HANDLE_ADOPTED`. A handle that is never adopted must be
+     * closed to avoid leaking the socket.
+     *
+     * ```js
+     * import net from 'node:net';
+     *
+     * const bound = new net.BoundSocket();
+     * const { port } = bound.address();
+     * console.log(`Reserved port ${port} for server`);
+     *
+     * const server = net.createServer();
+     * server.listen(bound); // Adopt as a server, or pass to new net.Socket() instead.
+     * ```
+     * @since v26.4.0
+     */
+    class BoundSocket {
+        /**
+         * @since v26.4.0
+         */
+        constructor(options?: BoundSocketOptions);
+        /**
+         * Returns the bound local address. When bound with `port: 0`, `port` is the
+         * OS-assigned ephemeral port.
+         * @since v26.4.0
+         * @returns An object with `address`, `family`, and `port` properties,
+         * as `server.address()` returns.
+         */
+        address(): AddressInfo;
+        /**
+         * Returns the file descriptor of the bound socket. Ownership remains with the
+         * `BoundSocket`, so the descriptor must not be closed by the caller. The
+         * descriptor is only available before the handle is adopted; afterwards it belongs
+         * to the adopting `net.Server` or `net.Socket` and `fd()` throws
+         * `ERR_SOCKET_HANDLE_ADOPTED`.
+         * @since v26.4.0
+         * @returns The underlying OS file descriptor, or `-1` on platforms
+         * that do not expose one for sockets (such as Windows).
+         */
+        fd(): number;
+        /**
+         * Releases the bound socket. Only needed when the handle is never adopted.
+         * @since v26.4.0
+         */
+        close(): void;
+        /**
+         * Closes the handle if it has not been adopted or closed; otherwise a no-op.
+         * @since v26.4.0
+         */
+        [Symbol.dispose](): void;
+    }
     interface ListenOptions extends Abortable {
         backlog?: number | undefined;
         exclusive?: boolean | undefined;
+        handle?: BoundSocket | undefined;
         host?: string | undefined;
         /**
          * @default false

package/node_modules/@types/node/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@types/node",
-    "version": "26.3.0",
+    "version": "26.4.1",
     "description": "TypeScript definitions for node",
     "homepage": "https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node",
     "license": "MIT",
@@ -150,6 +150,6 @@
         "undici-types": "~8.3.0"
     },
     "peerDependencies": {},
-    "typesPublisherContentHash": "125032099e1f7132c95bf327b36f694c396de965952f7cb9632ac916bbad47e9",
+    "typesPublisherContentHash": "463ff626c280fc7ad82097e8ff9ab6bd4a19fb2b4c56c8d56c2b8148cd872d0c",
     "typeScriptVersion": "5.6"
 }

package/node_modules/@types/node/quic.d.ts

@@ -1,10 +1,10 @@
 declare module "node:quic" {
     import { NonSharedBuffer } from "node:buffer";
-    import { KeyObject } from "node:crypto";
+    import { KeyObject, X509Certificate } from "node:crypto";
     import { FileHandle } from "node:fs/promises";
     import { BlockList, SocketAddress } from "node:net";
     import { Writer } from "node:stream/iter";
-    import { EphemeralKeyInfo, PeerCertificate } from "node:tls";
+    import { EphemeralKeyInfo } from "node:tls";
     /**
      * @since v23.8.0
      */
@@ -25,6 +25,10 @@ declare module "node:quic" {
         id: bigint,
         status: "acknowledged" | "lost" | "abandoned",
     ) => void;
+    /**
+     * @since v23.8.0
+     */
+    type OnApplicationCallback = (this: QuicSession, applicationoptions: SessionApplicationOptions) => void;
     /**
      * @since v23.8.0
      */
@@ -235,6 +239,7 @@ declare module "node:quic" {
          */
         enableDatagrams?: boolean | undefined;
     }
+    type SessionApplicationOptions = { [K in keyof ApplicationOptions]-?: ApplicationOptions[K] & (bigint | boolean) };
     /**
      * @since v23.8.0
      */
@@ -539,6 +544,7 @@ declare module "node:quic" {
         ongoaway?: QuicSession["ongoaway"] | undefined;
         onkeylog?: QuicSession["onkeylog"] | undefined;
         onqlog?: QuicSession["onqlog"] | undefined;
+        onapplication?: QuicSession["onapplication"] | undefined;
         onheaders?: QuicStream["onheaders"] | undefined;
         ontrailers?: QuicStream["ontrailers"] | undefined;
         oninfo?: QuicStream["oninfo"] | undefined;
@@ -608,6 +614,20 @@ declare module "node:quic" {
      * @since v23.8.0
      */
     function listen(onsession: OnSessionCallback, options?: SessionOptions): Promise<QuicEndpoint>;
+    interface ListEndpointsOptions {
+        /**
+         * If `true` (the default), only returns endpoints that are
+         * active (not destroyed, not closing, and not busy). If `false` returns all
+         * endpoints.
+         */
+        active?: boolean | undefined;
+    }
+    /**
+     * Returns the list of all `QuicEndpoint` instances. By default, only active
+     * endpoints are returned.
+     * @since v26.4.0
+     */
+    function listEndpoints(options?: ListEndpointsOptions): QuicEndpoint[];
     /**
      * The endpoint configuration options passed when constructing a new `QuicEndpoint` instance.
      * @since v23.8.0
@@ -1172,7 +1192,7 @@ declare module "node:quic" {
          * be negotiated separately from the transport parameters. Read only.
          * @since v26.3.0
          */
-        readonly applicationOptions: { [K in keyof ApplicationOptions]-?: ApplicationOptions[K] & (bigint | boolean) };
+        readonly applicationOptions: SessionApplicationOptions;
         /**
          * Initiate a graceful close of the session. Existing streams will be allowed
          * to complete but no new streams will be opened. Once all streams have closed,
@@ -1226,6 +1246,11 @@ declare module "node:quic" {
          * @since v23.8.0
          */
         readonly endpoint: QuicEndpoint | null;
+        /**
+         * The callback to invoke when new application options, e.g. HTTP/3 settings arrived.
+         * @since v26.4
+         */
+        onapplication: OnApplicationCallback | undefined;
         /**
          * An optional callback invoked when the session is destroyed with an error.
          * This includes errors caused by user callbacks that throw or reject (see
@@ -1412,19 +1437,20 @@ declare module "node:quic" {
             encoding?: BufferEncoding,
         ): Promise<bigint>;
         /**
-         * The local certificate as an object with properties such as `subject`,
-         * `issuer`, `valid_from`, `valid_to`, `fingerprint`, etc. Returns `undefined`
-         * if the session is destroyed or no certificate is available.
+         * The local certificate as a `crypto.X509Certificate` instance. Server
+         * sessions return the certificate configured for the negotiated SNI host.
+         * Client sessions return `undefined` unless a client certificate was sent.
+         * Returns `undefined` if the session is destroyed.
          * @since v26.2.0
          */
-        readonly certificate: PeerCertificate | undefined;
+        readonly certificate: X509Certificate | undefined;
         /**
-         * The peer's certificate as an object with properties such as `subject`,
-         * `issuer`, `valid_from`, `valid_to`, `fingerprint`, etc. Returns `undefined`
-         * if the session is destroyed or the peer did not present a certificate.
+         * The peer's certificate as a `crypto.X509Certificate` instance. Returns
+         * `undefined` if the peer did not present a certificate or the session is
+         * destroyed.
          * @since v26.2.0
          */
-        readonly peerCertificate: PeerCertificate | undefined;
+        readonly peerCertificate: X509Certificate | undefined;
         /**
          * The ephemeral key information for the session, with properties such as
          * `type`, `name`, and `size`. Only available on client sessions. Returns

package/node_modules/@types/node/stream/iter.d.ts

@@ -271,8 +271,8 @@ declare module "node:stream/iter" {
      *
      * If the object implements the `toAsyncStreamable` protocol (as
      * `stream.Readable` does), that protocol is used. Otherwise, the function
-     * duck-types on `read()` and `on()` (EventEmitter) and wraps the stream with
-     * a batched async iterator.
+     * duck-types on `read()`, `on()`, and `off()` (EventEmitter) and wraps the
+     * stream with a batched async iterator.
      *
      * The result is cached per instance -- calling `fromReadable()` twice with the
      * same stream returns the same iterable.
@@ -294,7 +294,7 @@ declare module "node:stream/iter" {
      * @since v26.1.0
      * @experimental
      * @param readable A classic Readable stream or any object
-     * with `read()` and `on()` methods.
+     * with `read()`, `on()` and `off()` methods.
      * @returns A stream/iter async iterable source.
      */
     function fromReadable(readable: NodeJS.ReadableStream): ByteReadableStream;
@@ -389,7 +389,7 @@ declare module "node:stream/iter" {
      *
      * Each `_write()` / `_writev()` call attempts the Writer's synchronous method
      * first (`writeSync` / `writevSync`), falling back to the async method if the
-     * sync path returns `false` or throws. Similarly, `_final()` tries `endSync()`
+     * sync path returns `false`. Similarly, `_final()` tries `endSync()`
      * before `end()`. When the sync path succeeds, the callback is deferred via
      * `queueMicrotask` to preserve the async resolution contract.
      *

package/node_modules/@types/node/tls.d.ts

@@ -746,6 +746,7 @@ declare module "node:tls" {
         // #endregion
     }
     type SecureVersion = "TLSv1.3" | "TLSv1.2" | "TLSv1.1" | "TLSv1";
+    type CertificateCompressionAlgorithm = "zlib" | "brotli" | "zstd";
     interface SecureContextOptions {
         /**
          * If set, this will be called when a client opens a connection using the ALPN extension.
@@ -782,6 +783,15 @@ declare module "node:tls" {
          *  able to validate the certificate, and the handshake will fail.
          */
         cert?: string | Buffer | Array<string | Buffer> | undefined;
+        /**
+         * An array of supported certificate
+         * compression algorithm names, in preference order. Supported values are
+         * `'zlib'`, `'brotli'`, and `'zstd'`. When set, enables TLS certificate
+         * compression ([RFC 8879](https://tools.ietf.org/html/rfc8879)) which compresses certificates during the TLS
+         * handshake, reducing handshake size. Only effective with TLSv1.3.
+         * **Default:** `[]` (disabled).
+         */
+        certificateCompression?: readonly CertificateCompressionAlgorithm[] | undefined;
         /**
          *  Colon-separated list of supported signature algorithms. The list
          *  can contain digest algorithms (SHA256, MD5 etc.), public key
@@ -1110,6 +1120,20 @@ declare module "node:tls" {
      * @since v0.10.2
      */
     function getCiphers(): string[];
+    /**
+     * Returns an array with the names of the RFC 8879 certificate compression
+     * algorithms supported by the current OpenSSL build, suitable for use in the
+     * `certificateCompression` option of `tls.createSecureContext()`. Possible
+     * values include `'zlib'`, `'brotli'`, and `'zstd'`.
+     *
+     * The array is empty when certificate compression is unavailable.
+     *
+     * ```js
+     * console.log(tls.getCertificateCompressionAlgorithms()); // ['zlib', 'brotli', 'zstd']
+     * ```
+     * @since v26.4.0
+     */
+    function getCertificateCompressionAlgorithms(): CertificateCompressionAlgorithm[];
     /**
      * Sets the default CA certificates used by Node.js TLS clients. If the provided
      * certificates are parsed successfully, they will become the default CA

package/node_modules/@types/node/ts5.6/buffer.buffer.d.ts

@@ -459,4 +459,9 @@ declare module "node:buffer" {
          */
         type AllowSharedBuffer = Buffer;
     }
+    /**
+     * @deprecated This is intended for internal use, and will be removed once `@types/node` no longer supports
+     * TypeScript versions earlier than 5.7.
+     */
+    type BufferView<T extends NodeJS.ArrayBufferView> = Buffer;
 }

package/node_modules/@types/node/ts5.6/index.d.ts

@@ -110,6 +110,7 @@
 /// <reference path="../util.d.ts" />
 /// <reference path="../util/types.d.ts" />
 /// <reference path="../v8.d.ts" />
+/// <reference path="../vfs.d.ts" />
 /// <reference path="../vm.d.ts" />
 /// <reference path="../wasi.d.ts" />
 /// <reference path="../worker_threads.d.ts" />

package/node_modules/@types/node/ts5.7/index.d.ts

@@ -110,6 +110,7 @@
 /// <reference path="../util.d.ts" />
 /// <reference path="../util/types.d.ts" />
 /// <reference path="../v8.d.ts" />
+/// <reference path="../vfs.d.ts" />
 /// <reference path="../vm.d.ts" />
 /// <reference path="../wasi.d.ts" />
 /// <reference path="../worker_threads.d.ts" />

package/node_modules/@types/node/tty.d.ts

@@ -28,10 +28,11 @@ declare module "node:tty" {
          * Allows configuration of `tty.ReadStream` so that it operates as a raw device.
          *
          * When in raw mode, input is always available character-by-character, not
-         * including modifiers. Additionally, all special processing of characters by the
-         * terminal is disabled, including echoing input
+         * including modifiers. Additionally, all special processing of input characters
+         * by the terminal is disabled, including echoing input
          * characters. Ctrl+C will no longer cause a `SIGINT` when
-         * in this mode.
+         * in this mode. This mode does not affect terminal output processing, such as
+         * newline translation on Unix terminals.
          * @since v0.7.7
          * @param mode If `true`, configures the `tty.ReadStream` to operate as a raw device. If `false`, configures the `tty.ReadStream` to operate in its default mode. The `readStream.isRaw`
          * property will be set to the resulting mode.

package/node_modules/@types/node/vfs.d.ts

@@ -0,0 +1,210 @@
+declare module "node:vfs" {
+    /**
+     * Convenience factory equivalent to `new VirtualFileSystem(provider, options)`.
+     *
+     * ```js
+     * const vfs = require('node:vfs');
+     *
+     * // Default in-memory provider
+     * const memoryVfs = vfs.create();
+     *
+     * // Explicit provider
+     * const realVfs = vfs.create(new vfs.RealFSProvider('/tmp/sandbox'));
+     * ```
+     * @since v26.4.0
+     * @param provider The provider to use. **Default:** `new MemoryProvider()`.
+     */
+    function create(provider?: VirtualProvider, options?: VirtualFileSystemOptions): VirtualFileSystem;
+    function create(options: VirtualFileSystemOptions): VirtualFileSystem;
+    interface VirtualFileSystemOptions {
+        /**
+         * Whether to emit the experimental warning. **Default:** `true`.
+         */
+        emitExperimentalWarning?: boolean | undefined;
+    }
+    /**
+     * A `VirtualFileSystem` wraps a {@link VirtualProvider} and exposes a
+     * `node:fs`-like API. Each instance maintains its own file tree.
+     * @since v26.4.0
+     */
+    class VirtualFileSystem {
+        /**
+         * @param provider The provider to use. **Default:** `new MemoryProvider()`.
+         */
+        constructor(provider?: VirtualProvider, options?: VirtualFileSystemOptions);
+        constructor(options: VirtualFileSystemOptions);
+        /**
+         * The provider backing this VFS instance.
+         * @since v26.4.0
+         */
+        readonly provider: VirtualProvider;
+        /**
+         * `true` when the underlying provider is read-only.
+         * @since v26.4.0
+         */
+        readonly readonly: boolean;
+    }
+    interface VirtualFileSystem extends
+        // Synchronous API
+        Pick<
+            typeof import("node:fs"),
+            | "existsSync"
+            | "statSync"
+            | "lstatSync"
+            | "readFileSync"
+            | "writeFileSync"
+            | "appendFileSync"
+            | "readdirSync"
+            | "mkdirSync"
+            | "rmdirSync"
+            | "unlinkSync"
+            | "renameSync"
+            | "copyFileSync"
+            | "realpathSync"
+            | "readlinkSync"
+            | "symlinkSync"
+            | "accessSync"
+            | "rmSync"
+            | "truncateSync"
+            | "ftruncateSync"
+            | "linkSync"
+            | "chmodSync"
+            | "chownSync"
+            | "utimesSync"
+            | "lutimesSync"
+            | "mkdtempSync"
+            | "opendirSync"
+            | "openAsBlob"
+            | "openSync"
+            | "closeSync"
+            | "readSync"
+            | "writeSync"
+            | "fstatSync"
+            | "createReadStream"
+            | "createWriteStream"
+            | "watch"
+            | "watchFile"
+            | "unwatchFile"
+        >,
+        // Callback API
+        Pick<
+            typeof import("node:fs"),
+            | "readFile"
+            | "writeFile"
+            | "stat"
+            | "lstat"
+            | "readdir"
+            | "realpath"
+            | "readlink"
+            | "access"
+            | "open"
+            | "close"
+            | "read"
+            | "write"
+            | "rm"
+            | "fstat"
+            | "truncate"
+            | "ftruncate"
+            | "link"
+            | "mkdtemp"
+            | "opendir"
+        >
+    {
+        // Promise API
+        readonly promises: Pick<
+            typeof import("node:fs/promises"),
+            | "readFile"
+            | "writeFile"
+            | "appendFile"
+            | "stat"
+            | "lstat"
+            | "readdir"
+            | "mkdir"
+            | "rmdir"
+            | "unlink"
+            | "rename"
+            | "copyFile"
+            | "realpath"
+            | "readlink"
+            | "symlink"
+            | "access"
+            | "rm"
+            | "truncate"
+            | "link"
+            | "mkdtemp"
+            | "chmod"
+            | "chown"
+            | "lchown"
+            | "utimes"
+            | "lutimes"
+            | "open"
+            | "lchmod"
+            | "watch"
+        >;
+    }
+    /**
+     * The base class for all VFS providers. Subclasses implement the essential
+     * primitives (such as `open`, `stat`, `readdir`, `mkdir`, `rmdir`, `unlink`,
+     * `rename`, etc.) and inherit default implementations of the derived
+     * methods (such as `readFile`, `writeFile`, `exists`, `copyFile`, `access`, etc.).
+     * @since v26.4.0
+     */
+    abstract class VirtualProvider {
+        get readonly(): boolean;
+        get supportsSymlinks(): boolean;
+        get supportsWatch(): boolean;
+    }
+    /**
+     * The default in-memory provider. Stores files, directories, and symbolic
+     * links in a `Map`-backed tree, supports symlinks (`supportsSymlinks ===
+     * true`), and supports watching (`supportsWatch === true`).
+     * @since v26.4.0
+     */
+    class MemoryProvider extends VirtualProvider {
+        /**
+         * Locks the provider into read-only mode. Subsequent writes through any
+         * `VirtualFileSystem` using this provider throw `EROFS`. There is no
+         * way to revert the provider to writable.
+         *
+         * ```js
+         * const vfs = require('node:vfs');
+         *
+         * const provider = new vfs.MemoryProvider();
+         * const myVfs = vfs.create(provider);
+         * myVfs.writeFileSync('/seed.txt', 'initial');
+         *
+         * provider.setReadOnly();
+         *
+         * myVfs.writeFileSync('/x.txt', 'fail'); // throws EROFS
+         * ```
+         * @since v26.4.0
+         */
+        setReadOnly(): void;
+    }
+    /**
+     * A provider that wraps a directory (i.e. one on the actual file system) and exposes its
+     * contents through the VFS API. All VFS paths are resolved relative to
+     * the root and verified to stay inside it; symbolic links resolving
+     * outside the root are rejected.
+     * @since v26.4.0
+     */
+    class RealFSProvider extends VirtualProvider {
+        /**
+         * ```js
+         * const vfs = require('node:vfs');
+         *
+         * const realVfs = vfs.create(new vfs.RealFSProvider('/tmp/sandbox'));
+         * realVfs.writeFileSync('/file.txt', 'hello'); // writes /tmp/sandbox/file.txt
+         * ```
+         * @since v26.4.0
+         * @param rootPath The absolute file-system path to use as the root.
+         * Must be a non-empty string.
+         */
+        constructor(rootPath: string);
+        /**
+         * The resolved absolute path used as the root.
+         * @since v26.4.0
+         */
+        readonly rootPath: string;
+    }
+}

package/node_modules/@types/node/vm.d.ts

@@ -741,7 +741,7 @@ declare module "node:vm" {
          */
         status: ModuleStatus;
         /**
-         * Evaluate the module and its depenendencies. Corresponds to the [Evaluate() concrete method](https://tc39.es/ecma262/#sec-moduleevaluation) field of
+         * Evaluate the module and its dependencies. Corresponds to the [Evaluate() concrete method](https://tc39.es/ecma262/#sec-moduleevaluation) field of
          * [Cyclic Module Record](https://tc39.es/ecma262/#sec-cyclic-module-records)s in the ECMAScript specification.
          *
          * If the module is a `vm.SourceTextModule`, `evaluate()` must be called after the module has been instantiated;

package/node_modules/express-rate-limit/dist/index.cjs

@@ -297,9 +297,9 @@ var setDraft8Headers = (response, info, windowMs, name, key) => {
   response.append("RateLimit", `"${name}"; ${header}`);
   response.append("RateLimit-Policy", `"${name}"; ${policy}`);
 };
-var setRetryAfterHeader = (response, info, windowMs) => {
+var setRetryAfterHeader = (response, info, windowMs, retryAfter) => {
   if (response.headersSent) return;
-  const resetSeconds = getResetSeconds(windowMs, info.resetTime);
+  const resetSeconds = retryAfter ?? getResetSeconds(windowMs, info.resetTime);
   response.setHeader("Retry-After", resetSeconds.toString());
 };
 
@@ -566,6 +566,7 @@ var validations = {
       legacyHeaders: true,
       standardHeaders: true,
       identifier: true,
+      retryAfter: true,
       requestPropertyName: true,
       skipFailedRequests: true,
       skipSuccessfulRequests: true,
@@ -1050,7 +1051,9 @@ var rateLimit = (passedOptions) => {
         debug("limit exceeded");
         if (config.legacyHeaders || config.standardHeaders) {
           debug("set retry-after header");
-          setRetryAfterHeader(response, info, config.windowMs);
+          const retrieveRetryAfter = typeof config.retryAfter === "function" ? config.retryAfter(request, response) : config.retryAfter;
+          const retryAfter = await retrieveRetryAfter;
+          setRetryAfterHeader(response, info, config.windowMs, retryAfter);
         }
         config.handler(request, response, next, options);
         return;

package/node_modules/express-rate-limit/dist/index.d.cts

@@ -408,6 +408,17 @@ export type Options = {
 	 * Defaults to `{limit}-in-{window}`.
 	 */
 	identifier: string | ValueDeterminingMiddleware<string>;
+	/**
+	 * Method to generate a custom `Retry-After` header value (in seconds) when
+	 * a client is rate limited.
+	 *
+	 * This is advisory only, it customizes what the header says, it does not
+	 * change how long the limiter actually keeps blocking the client for.
+	 * That is still controlled by `windowMs`.
+	 *
+	 * By default, the number of seconds remaining until the window resets.
+	 */
+	retryAfter?: number | ValueDeterminingMiddleware<number>;
 	/**
 	 * The name of the property on the request object to store the rate limit info.
 	 *