openclaw-multi-auto 1.1.8 → 1.2.2

package/node_modules/.pnpm/protobufjs@7.5.4/node_modules/@types/node/module.d.ts

@@ -383,59 +383,18 @@ declare module "node:module" {
             | "module-typescript"
             | "wasm";
         type ModuleSource = string | ArrayBuffer | NodeJS.TypedArray;
-        /**
-         * The `initialize` hook provides a way to define a custom function that runs in
-         * the hooks thread when the hooks module is initialized. Initialization happens
-         * when the hooks module is registered via {@link register}.
-         *
-         * This hook can receive data from a {@link register} invocation, including
-         * ports and other transferable objects. The return value of `initialize` can be a
-         * `Promise`, in which case it will be awaited before the main application thread
-         * execution resumes.
-         */
         type InitializeHook<Data = any> = (data: Data) => void | Promise<void>;
         interface ResolveHookContext {
-            /**
-             * Export conditions of the relevant `package.json`
-             */
             conditions: string[];
-            /**
-             *  An object whose key-value pairs represent the assertions for the module to import
-             */
             importAttributes: ImportAttributes;
-            /**
-             * The module importing this one, or undefined if this is the Node.js entry point
-             */
             parentURL: string | undefined;
         }
         interface ResolveFnOutput {
-            /**
-             * A hint to the load hook (it might be ignored); can be an intermediary value.
-             */
             format?: string | null | undefined;
-            /**
-             * The import attributes to use when caching the module (optional; if excluded the input will be used)
-             */
             importAttributes?: ImportAttributes | undefined;
-            /**
-             * A signal that this hook intends to terminate the chain of `resolve` hooks.
-             * @default false
-             */
             shortCircuit?: boolean | undefined;
-            /**
-             * The absolute URL to which this input resolves
-             */
             url: string;
         }
-        /**
-         * The `resolve` hook chain is responsible for telling Node.js where to find and
-         * how to cache a given `import` statement or expression, or `require` call. It can
-         * optionally return a format (such as `'module'`) as a hint to the `load` hook. If
-         * a format is specified, the `load` hook is ultimately responsible for providing
-         * the final `format` value (and it is free to ignore the hint provided by
-         * `resolve`); if `resolve` provides a `format`, a custom `load` hook is required
-         * even if only to pass the value to the Node.js default `load` hook.
-         */
         type ResolveHook = (
             specifier: string,
             context: ResolveHookContext,
@@ -453,36 +412,15 @@ declare module "node:module" {
             ) => ResolveFnOutput,
         ) => ResolveFnOutput;
         interface LoadHookContext {
-            /**
-             * Export conditions of the relevant `package.json`
-             */
             conditions: string[];
-            /**
-             * The format optionally supplied by the `resolve` hook chain (can be an intermediary value).
-             */
             format: string | null | undefined;
-            /**
-             *  An object whose key-value pairs represent the assertions for the module to import
-             */
             importAttributes: ImportAttributes;
         }
         interface LoadFnOutput {
             format: string | null | undefined;
-            /**
-             * A signal that this hook intends to terminate the chain of `resolve` hooks.
-             * @default false
-             */
             shortCircuit?: boolean | undefined;
-            /**
-             * The source for Node.js to evaluate
-             */
             source?: ModuleSource | undefined;
         }
-        /**
-         * The `load` hook provides a way to define a custom method of determining how a
-         * URL should be interpreted, retrieved, and parsed. It is also in charge of
-         * validating the import attributes.
-         */
         type LoadHook = (
             url: string,
             context: LoadHookContext,

package/node_modules/.pnpm/protobufjs@7.5.4/node_modules/@types/node/net.d.ts

@@ -34,6 +34,10 @@ declare module "node:net" {
         readable?: boolean | undefined;
         writable?: boolean | undefined;
         signal?: AbortSignal | undefined;
+        noDelay?: boolean | undefined;
+        keepAlive?: boolean | undefined;
+        keepAliveInitialDelay?: number | undefined;
+        blockList?: BlockList | undefined;
     }
     interface OnReadOpts {
         buffer: Uint8Array | (() => Uint8Array);
@@ -52,9 +56,6 @@ declare module "node:net" {
         hints?: number | undefined;
         family?: number | undefined;
         lookup?: LookupFunction | undefined;
-        noDelay?: boolean | undefined;
-        keepAlive?: boolean | undefined;
-        keepAliveInitialDelay?: number | undefined;
         /**
          * @since v18.13.0
          */
@@ -63,7 +64,6 @@ declare module "node:net" {
          * @since v18.13.0
          */
         autoSelectFamilyAttemptTimeout?: number | undefined;
-        blockList?: BlockList | undefined;
     }
     interface IpcSocketConnectOpts {
         path: string;

package/node_modules/.pnpm/protobufjs@7.5.4/node_modules/@types/node/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@types/node",
-    "version": "25.3.3",
+    "version": "25.4.0",
     "description": "TypeScript definitions for node",
     "homepage": "https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node",
     "license": "MIT",
@@ -150,6 +150,6 @@
         "undici-types": "~7.18.0"
     },
     "peerDependencies": {},
-    "typesPublisherContentHash": "6c6cbe69ae05494de79d9c121e6d089d78ce104f31505de1c79c523dfcbeba42",
+    "typesPublisherContentHash": "1e76219e2880c49d08637c8e24009f811139066d7fbe688992e8d39f76ecab42",
     "typeScriptVersion": "5.2"
 }

package/node_modules/.pnpm/protobufjs@7.5.4/node_modules/@types/node/process.d.ts

@@ -1861,6 +1861,24 @@ declare module "node:process" {
                  */
                 readonly release: ProcessRelease;
                 readonly features: ProcessFeatures;
+                /**
+                 * The `process.traceProcessWarnings` property indicates whether the `--trace-warnings` flag
+                 * is set on the current Node.js process. This property allows programmatic control over the
+                 * tracing of warnings, enabling or disabling stack traces for warnings at runtime.
+                 *
+                 * ```js
+                 * // Enable trace warnings
+                 * process.traceProcessWarnings = true;
+                 *
+                 * // Emit a warning with a stack trace
+                 * process.emitWarning('Warning with stack trace');
+                 *
+                 * // Disable trace warnings
+                 * process.traceProcessWarnings = false;
+                 * ```
+                 * @since v6.10.0
+                 */
+                traceProcessWarnings: boolean;
                 /**
                  * `process.umask()` returns the Node.js process's file mode creation mask. Child
                  * processes inherit the mask from the parent process.

package/node_modules/.pnpm/protobufjs@7.5.4/node_modules/@types/node/readline.d.ts

@@ -44,6 +44,7 @@ declare module "node:readline" {
     }
     interface InterfaceEventMap {
         "close": [];
+        "error": [error: Error];
         "history": [history: string[]];
         "line": [input: string];
         "pause": [];

package/node_modules/.pnpm/protobufjs@7.5.4/node_modules/@types/node/sqlite.d.ts

@@ -429,15 +429,68 @@ declare module "node:sqlite" {
          */
         prepare(sql: string): StatementSync;
         /**
-         * Creates a new `SQLTagStore`, which is an LRU (Least Recently Used) cache for
-         * storing prepared statements. This allows for the efficient reuse of prepared
-         * statements by tagging them with a unique identifier.
+         * Creates a new {@link SQLTagStore}, which is a Least Recently Used (LRU) cache
+         * for storing prepared statements. This allows for the efficient reuse of
+         * prepared statements by tagging them with a unique identifier.
          *
          * When a tagged SQL literal is executed, the `SQLTagStore` checks if a prepared
-         * statement for that specific SQL string already exists in the cache. If it does,
-         * the cached statement is used. If not, a new prepared statement is created,
-         * executed, and then stored in the cache for future use. This mechanism helps to
-         * avoid the overhead of repeatedly parsing and preparing the same SQL statements.
+         * statement for the corresponding SQL query string already exists in the cache.
+         * If it does, the cached statement is used. If not, a new prepared statement is
+         * created, executed, and then stored in the cache for future use. This mechanism
+         * helps to avoid the overhead of repeatedly parsing and preparing the same SQL
+         * statements.
+         *
+         * Tagged statements bind the placeholder values from the template literal as
+         * parameters to the underlying prepared statement. For example:
+         *
+         * ```js
+         * sqlTagStore.get`SELECT ${value}`;
+         * ```
+         *
+         * is equivalent to:
+         *
+         * ```js
+         * db.prepare('SELECT ?').get(value);
+         * ```
+         *
+         * However, in the first example, the tag store will cache the underlying prepared
+         * statement for future use.
+         *
+         * > **Note:** The `${value}` syntax in tagged statements _binds_ a parameter to
+         * > the prepared statement. This differs from its behavior in _untagged_ template
+         * > literals, where it performs string interpolation.
+         * >
+         * > ```js
+         * > // This a safe example of binding a parameter to a tagged statement.
+         * > sqlTagStore.run`INSERT INTO t1 (id) VALUES (${id})`;
+         * >
+         * > // This is an *unsafe* example of an untagged template string.
+         * > // `id` is interpolated into the query text as a string.
+         * > // This can lead to SQL injection and data corruption.
+         * > db.run(`INSERT INTO t1 (id) VALUES (${id})`);
+         * > ```
+         *
+         * The tag store will match a statement from the cache if the query strings
+         * (including the positions of any bound placeholders) are identical.
+         *
+         * ```js
+         * // The following statements will match in the cache:
+         * sqlTagStore.get`SELECT * FROM t1 WHERE id = ${id} AND active = 1`;
+         * sqlTagStore.get`SELECT * FROM t1 WHERE id = ${12345} AND active = 1`;
+         *
+         * // The following statements will not match, as the query strings
+         * // and bound placeholders differ:
+         * sqlTagStore.get`SELECT * FROM t1 WHERE id = ${id} AND active = 1`;
+         * sqlTagStore.get`SELECT * FROM t1 WHERE id = 12345 AND active = 1`;
+         *
+         * // The following statements will not match, as matches are case-sensitive:
+         * sqlTagStore.get`SELECT * FROM t1 WHERE id = ${id} AND active = 1`;
+         * sqlTagStore.get`select * from t1 where id = ${id} and active = 1`;
+         * ```
+         *
+         * The only way of binding parameters in tagged statements is with the `${value}`
+         * syntax. Do not add parameter binding placeholders (`?` etc.) to the SQL query
+         * string itself.
          *
          * ```js
          * import { DatabaseSync } from 'node:sqlite';
@@ -453,8 +506,8 @@ declare module "node:sqlite" {
          * sql.run`INSERT INTO users VALUES (2, 'Bob')`;
          *
          * // Using the 'get' method to retrieve a single row.
-         * const id = 1;
-         * const user = sql.get`SELECT * FROM users WHERE id = ${id}`;
+         * const name = 'Alice';
+         * const user = sql.get`SELECT * FROM users WHERE name = ${name}`;
          * console.log(user); // { id: 1, name: 'Alice' }
          *
          * // Using the 'all' method to retrieve all rows.
@@ -543,26 +596,39 @@ declare module "node:sqlite" {
          * [`sqlite3session_delete()`](https://www.sqlite.org/session/sqlite3session_delete.html).
          */
         close(): void;
+        /**
+         * Closes the session. If the session is already closed, does nothing.
+         * @since v24.9.0
+         */
+        [Symbol.dispose](): void;
     }
     /**
      * This class represents a single LRU (Least Recently Used) cache for storing
      * prepared statements.
      *
-     * Instances of this class are created via the database.createSQLTagStore() method,
-     * not by using a constructor. The store caches prepared statements based on the
-     * provided SQL query string. When the same query is seen again, the store
+     * Instances of this class are created via the `database.createTagStore()`
+     * method, not by using a constructor. The store caches prepared statements based
+     * on the provided SQL query string. When the same query is seen again, the store
      * retrieves the cached statement and safely applies the new values through
      * parameter binding, thereby preventing attacks like SQL injection.
      *
      * The cache has a maxSize that defaults to 1000 statements, but a custom size can
-     * be provided (e.g., database.createSQLTagStore(100)). All APIs exposed by this
+     * be provided (e.g., `database.createTagStore(100)`). All APIs exposed by this
      * class execute synchronously.
      * @since v24.9.0
      */
     interface SQLTagStore {
         /**
-         * Executes the given SQL query and returns all resulting rows as an array of objects.
+         * Executes the given SQL query and returns all resulting rows as an array of
+         * objects.
+         *
+         * This function is intended to be used as a template literal tag, not to be
+         * called directly.
          * @since v24.9.0
+         * @param stringElements Template literal elements containing the SQL
+         * query.
+         * @param boundParameters Parameter values to be bound to placeholders in the template string.
+         * @returns An array of objects representing the rows returned by the query.
          */
         all(
             stringElements: TemplateStringsArray,
@@ -570,7 +636,15 @@ declare module "node:sqlite" {
         ): Record<string, SQLOutputValue>[];
         /**
          * Executes the given SQL query and returns the first resulting row as an object.
+         *
+         * This function is intended to be used as a template literal tag, not to be
+         * called directly.
          * @since v24.9.0
+         * @param stringElements Template literal elements containing the SQL
+         * query.
+         * @param boundParameters Parameter values to be bound to placeholders in the template string.
+         * @returns An object representing the first row returned by
+         * the query, or `undefined` if no rows are returned.
          */
         get(
             stringElements: TemplateStringsArray,
@@ -578,7 +652,14 @@ declare module "node:sqlite" {
         ): Record<string, SQLOutputValue> | undefined;
         /**
          * Executes the given SQL query and returns an iterator over the resulting rows.
+         *
+         * This function is intended to be used as a template literal tag, not to be
+         * called directly.
          * @since v24.9.0
+         * @param stringElements Template literal elements containing the SQL
+         * query.
+         * @param boundParameters Parameter values to be bound to placeholders in the template string.
+         * @returns An iterator that yields objects representing the rows returned by the query.
          */
         iterate(
             stringElements: TemplateStringsArray,
@@ -586,15 +667,21 @@ declare module "node:sqlite" {
         ): NodeJS.Iterator<Record<string, SQLOutputValue>>;
         /**
          * Executes the given SQL query, which is expected to not return any rows (e.g., INSERT, UPDATE, DELETE).
+         *
+         * This function is intended to be used as a template literal tag, not to be
+         * called directly.
          * @since v24.9.0
+         * @param stringElements Template literal elements containing the SQL
+         * query.
+         * @param boundParameters Parameter values to be bound to placeholders in the template string.
+         * @returns An object containing information about the execution, including `changes` and `lastInsertRowid`.
          */
         run(stringElements: TemplateStringsArray, ...boundParameters: SQLInputValue[]): StatementResultingChanges;
         /**
          * A read-only property that returns the number of prepared statements currently in the cache.
          * @since v24.9.0
-         * @returns The maximum number of prepared statements the cache can hold.
          */
-        size(): number;
+        readonly size: number;
         /**
          * A read-only property that returns the maximum number of prepared statements the cache can hold.
          * @since v24.9.0

package/node_modules/.pnpm/protobufjs@7.5.4/node_modules/@types/node/stream.d.ts

@@ -81,6 +81,7 @@ declare module "node:stream" {
         interface ArrayOptions extends ReadableOperatorOptions {}
         interface ReadableToWebOptions {
             strategy?: web.QueuingStrategy | undefined;
+            type?: web.ReadableStreamType | undefined;
         }
         interface ReadableEventMap {
             "close": [];
@@ -485,13 +486,18 @@ declare module "node:stream" {
              *   }
              * }
              *
-             * const wordsStream = Readable.from(['this is', 'compose as operator']).compose(splitToWords);
+             * const wordsStream = Readable.from(['text passed through', 'composed stream']).compose(splitToWords);
              * const words = await wordsStream.toArray();
              *
-             * console.log(words); // prints ['this', 'is', 'compose', 'as', 'operator']
+             * console.log(words); // prints ['text', 'passed', 'through', 'composed', 'stream']
              * ```
              *
-             * See [`stream.compose`](https://nodejs.org/docs/latest-v25.x/api/stream.html#streamcomposestreams) for more information.
+             * `readable.compose(s)` is equivalent to `stream.compose(readable, s)`.
+             *
+             * This method also allows for an `AbortSignal` to be provided, which will destroy
+             * the composed stream when aborted.
+             *
+             * See [`stream.compose(...streams)`](https://nodejs.org/docs/latest-v25.x/api/stream.html#streamcomposestreams) for more information.
              * @since v19.1.0, v18.13.0
              * @returns a stream composed with the stream `stream`.
              */
@@ -1056,6 +1062,9 @@ declare module "node:stream" {
             writableHighWaterMark?: number | undefined;
             writableCorked?: number | undefined;
         }
+        interface DuplexToWebOptions {
+            type?: web.ReadableStreamType | undefined;
+        }
         interface DuplexEventMap extends ReadableEventMap, WritableEventMap {}
         /**
          * Duplex streams are streams that implement both the `Readable` and `Writable` interfaces.
@@ -1109,7 +1118,7 @@ declare module "node:stream" {
              * A utility method for creating a web `ReadableStream` and `WritableStream` from a `Duplex`.
              * @since v17.0.0
              */
-            static toWeb(streamDuplex: NodeJS.ReadWriteStream): web.ReadableWritablePair;
+            static toWeb(streamDuplex: NodeJS.ReadWriteStream, options?: DuplexToWebOptions): web.ReadableWritablePair;
             /**
              * A utility method for creating a `Duplex` from a web `ReadableStream` and `WritableStream`.
              * @since v17.0.0
@@ -1653,7 +1662,8 @@ declare module "node:stream" {
          * console.log(res); // prints 'HELLOWORLD'
          * ```
          *
-         * See [`readable.compose(stream)`](https://nodejs.org/docs/latest-v25.x/api/stream.html#readablecomposestream-options) for `stream.compose` as operator.
+         * For convenience, the `readable.compose(stream)` method is available on
+         * `Readable` and `Duplex` streams as a wrapper for this function.
          * @since v16.9.0
          * @experimental
          */

package/node_modules/.pnpm/protobufjs@7.5.4/node_modules/@types/node/test.d.ts

@@ -237,7 +237,7 @@ declare module "node:test" {
         }
         interface RunOptions {
             /**
-             * If a number is provided, then that many test processes would run in parallel, where each process corresponds to one test file.
+             * If a number is provided, then that many tests would run asynchronously (they are still managed by the single-threaded event loop).
              * If `true`, it would run `os.availableParallelism() - 1` test files in parallel. If `false`, it would only run one test file at a time.
              * @default false
              */
@@ -480,7 +480,7 @@ declare module "node:test" {
         }
         namespace EventData {
             interface Error extends globalThis.Error {
-                cause: globalThis.Error;
+                cause: unknown;
             }
             interface LocationInfo {
                 /**
@@ -969,7 +969,6 @@ declare module "node:test" {
              * @since v22.2.0, v20.15.0
              */
             readonly assert: TestContextAssert;
-            readonly attempt: number;
             /**
              * This function is used to create a hook running before subtest of the current test.
              * @param fn The hook function. The first argument to this function is a `TestContext` object.
@@ -1032,6 +1031,21 @@ declare module "node:test" {
              * @since v18.8.0, v16.18.0
              */
             readonly name: string;
+            /**
+             * Indicated whether the test succeeded.
+             * @since v21.7.0, v20.12.0
+             */
+            readonly passed: boolean;
+            /**
+             * The failure reason for the test/case; wrapped and available via `context.error.cause`.
+             * @since v21.7.0, v20.12.0
+             */
+            readonly error: EventData.Error | null;
+            /**
+             * Number of times the test has been attempted.
+             * @since v21.7.0, v20.12.0
+             */
+            readonly attempt: number;
             /**
              * This function is used to set the number of assertions and subtests that are expected to run
              * within the test. If the number of assertions and subtests that run does not match the
@@ -1286,6 +1300,11 @@ declare module "node:test" {
              * @since v22.6.0
              */
             readonly filePath: string | undefined;
+            /**
+             * The name of the suite and each of its ancestors, separated by `>`.
+             * @since v22.3.0, v20.16.0
+             */
+            readonly fullName: string;
             /**
              * The name of the suite.
              * @since v18.8.0, v16.18.0
@@ -1353,7 +1372,7 @@ declare module "node:test" {
          * describe('tests', async () => {
          *   before(() => console.log('about to run some test'));
          *   it('is a subtest', () => {
-         *     assert.ok('some relevant assertion here');
+         *     // Some relevant assertion here
          *   });
          * });
          * ```
@@ -1369,7 +1388,7 @@ declare module "node:test" {
          * describe('tests', async () => {
          *   after(() => console.log('finished running tests'));
          *   it('is a subtest', () => {
-         *     assert.ok('some relevant assertion here');
+         *     // Some relevant assertion here
          *   });
          * });
          * ```
@@ -1385,7 +1404,7 @@ declare module "node:test" {
          * describe('tests', async () => {
          *   beforeEach(() => console.log('about to run a test'));
          *   it('is a subtest', () => {
-         *     assert.ok('some relevant assertion here');
+         *     // Some relevant assertion here
          *   });
          * });
          * ```
@@ -1402,7 +1421,7 @@ declare module "node:test" {
          * describe('tests', async () => {
          *   afterEach(() => console.log('finished running a test'));
          *   it('is a subtest', () => {
-         *     assert.ok('some relevant assertion here');
+         *     // Some relevant assertion here
          *   });
          * });
          * ```
@@ -2034,24 +2053,28 @@ declare module "node:test" {
              */
             enable(options?: MockTimersOptions): void;
             /**
-             * You can use the `.setTime()` method to manually move the mocked date to another time. This method only accepts a positive integer.
-             * Note: This method will execute any mocked timers that are in the past from the new time.
-             * In the below example we are setting a new time for the mocked date.
+             * Sets the current Unix timestamp that will be used as reference for any mocked
+             * `Date` objects.
+             *
              * ```js
              * import assert from 'node:assert';
              * import { test } from 'node:test';
-             * test('sets the time of a date object', (context) => {
-             *   // Optionally choose what to mock
-             *   context.mock.timers.enable({ apis: ['Date'], now: 100 });
-             *   assert.strictEqual(Date.now(), 100);
-             *   // Advance in time will also advance the date
-             *   context.mock.timers.setTime(1000);
-             *   context.mock.timers.tick(200);
-             *   assert.strictEqual(Date.now(), 1200);
+             *
+             * test('runAll functions following the given order', (context) => {
+             *   const now = Date.now();
+             *   const setTime = 1000;
+             *   // Date.now is not mocked
+             *   assert.deepStrictEqual(Date.now(), now);
+             *
+             *   context.mock.timers.enable({ apis: ['Date'] });
+             *   context.mock.timers.setTime(setTime);
+             *   // Date.now is now 1000
+             *   assert.strictEqual(Date.now(), setTime);
              * });
              * ```
+             * @since v21.2.0, v20.11.0
              */
-            setTime(time: number): void;
+            setTime(milliseconds: number): void;
             /**
              * This function restores the default behavior of all mocks that were previously
              * created by this `MockTimers` instance and disassociates the mocks

package/node_modules/.pnpm/protobufjs@7.5.4/node_modules/@types/node/tls.d.ts

@@ -551,8 +551,12 @@ declare module "node:tls" {
          */
         requestCert?: boolean | undefined;
         /**
-         * An array of strings or a Buffer naming possible ALPN protocols.
-         * (Protocols should be ordered by their priority.)
+         * An array of strings, or a single `Buffer`, `TypedArray`, or `DataView` containing the supported
+         * ALPN protocols. Buffers should have the format `[len][name][len][name]...`
+         * e.g. `'\x08http/1.1\x08http/1.0'`, where the `len` byte is the length of the
+         * next protocol name. Passing an array is usually much simpler, e.g.
+         * `['http/1.1', 'http/1.0']`. Protocols earlier in the list have higher
+         * preference than those later.
          */
         ALPNProtocols?: readonly string[] | NodeJS.ArrayBufferView | undefined;
         /**

package/node_modules/.pnpm/protobufjs@7.5.4/node_modules/@types/node/url.d.ts

@@ -334,6 +334,19 @@ declare module "node:url" {
      * new URL('file:///hello world').pathname;   // Incorrect: /hello%20world
      * fileURLToPath('file:///hello world');      // Correct:   /hello world (POSIX)
      * ```
+     *
+     * **Security Considerations:**
+     *
+     * This function decodes percent-encoded characters, including encoded dot-segments
+     * (`%2e` as `.` and `%2e%2e` as `..`), and then normalizes the resulting path.
+     * This means that encoded directory traversal sequences (such as `%2e%2e`) are
+     * decoded and processed as actual path traversal, even though encoded slashes
+     * (`%2F`, `%5C`) are correctly rejected.
+     *
+     * **Applications must not rely on `fileURLToPath()` alone to prevent directory
+     * traversal attacks.** Always perform explicit path validation and security checks
+     * on the returned path value to ensure it remains within expected boundaries
+     * before using it for file system operations.
      * @since v10.12.0
      * @param url The file URL string or URL object to convert to a path.
      * @return The fully-resolved platform-specific Node.js file path.
@@ -344,6 +357,15 @@ declare module "node:url" {
      * representation of the path, a `Buffer` is returned. This conversion is
      * helpful when the input URL contains percent-encoded segments that are
      * not valid UTF-8 / Unicode sequences.
+     *
+     * **Security Considerations:**
+     *
+     * This function has the same security considerations as `url.fileURLToPath()`.
+     * It decodes percent-encoded characters, including encoded dot-segments
+     * (`%2e` as `.` and `%2e%2e` as `..`), and normalizes the path. **Applications
+     * must not rely on this function alone to prevent directory traversal attacks.**
+     * Always perform explicit path validation on the returned buffer value before
+     * using it for file system operations.
      * @since v24.3.0
      * @param url The file URL string or URL object to convert to a path.
      * @returns The fully-resolved platform-specific Node.js file path