@nocobase/plugin-mcp-server 2.1.0-alpha.13 → 2.1.0-alpha.15

package/dist/node_modules/hono/dist/helper/css/common.js

@@ -21,6 +21,23 @@ var toHash = (str) => {
   }
   return "css-" + out;
 };
+var normalizeLabel = (label) => {
+  return label.trim().replace(/\s+/g, "-");
+};
+var isValidClassName = (name) => /^-?[_a-zA-Z][_a-zA-Z0-9-]*$/.test(name);
+var RESERVED_KEYFRAME_NAMES = /* @__PURE__ */ new Set([
+  "default",
+  "inherit",
+  "initial",
+  "none",
+  "revert",
+  "revert-layer",
+  "unset"
+]);
+var isValidKeyframeName = (name) => isValidClassName(name) && !RESERVED_KEYFRAME_NAMES.has(name.toLowerCase());
+var defaultOnInvalidSlug = (slug) => {
+  console.warn(`Invalid slug: ${slug}`);
+};
 var cssStringReStr = [
   '"(?:(?:\\\\[\\s\\S]|[^"\\\\])*)"',
   // double quoted string
@@ -107,13 +124,26 @@ var buildStyleString = (strings, values) => {
   }
   return [label, minify(styleString), selectors, externalClassNames];
 };
-var cssCommon = (strings, values) => {
+var cssCommon = (strings, values, classNameSlug, onInvalidSlug) => {
   let [label, thisStyleString, selectors, externalClassNames] = buildStyleString(strings, values);
   const isPseudoGlobal = isPseudoGlobalSelectorRe.exec(thisStyleString);
   if (isPseudoGlobal) {
     thisStyleString = isPseudoGlobal[1];
   }
-  const selector = (isPseudoGlobal ? PSEUDO_GLOBAL_SELECTOR : "") + toHash(label + thisStyleString);
+  const hash = toHash(label + thisStyleString);
+  let customSlug;
+  if (classNameSlug) {
+    const slug = classNameSlug(hash, normalizeLabel(label), thisStyleString);
+    if (slug) {
+      if (isValidClassName(slug)) {
+        customSlug = slug;
+      } else {
+        ;
+        (onInvalidSlug || defaultOnInvalidSlug)(slug);
+      }
+    }
+  }
+  const selector = (isPseudoGlobal ? PSEUDO_GLOBAL_SELECTOR : "") + (customSlug || hash);
   const className = (isPseudoGlobal ? selectors.map((s) => s[CLASS_NAME]) : [selector, ...externalClassNames]).join(" ");
   return {
     [SELECTOR]: selector,
@@ -138,24 +168,43 @@ var cxCommon = (args) => {
   }
   return args;
 };
-var keyframesCommon = (strings, ...values) => {
+var keyframesCommon = (strings, values, classNameSlug, onInvalidSlug) => {
   const [label, styleString] = buildStyleString(strings, values);
+  const hash = toHash(label + styleString);
+  let customSlug;
+  if (classNameSlug) {
+    const slug = classNameSlug(hash, normalizeLabel(label), styleString);
+    if (slug) {
+      if (isValidKeyframeName(slug)) {
+        customSlug = slug;
+      } else {
+        ;
+        (onInvalidSlug || defaultOnInvalidSlug)(slug);
+      }
+    }
+  }
   return {
     [SELECTOR]: "",
-    [CLASS_NAME]: `@keyframes ${toHash(label + styleString)}`,
+    [CLASS_NAME]: `@keyframes ${customSlug || hash}`,
     [STYLE_STRING]: styleString,
     [SELECTORS]: [],
     [EXTERNAL_CLASS_NAMES]: []
   };
 };
 var viewTransitionNameIndex = 0;
-var viewTransitionCommon = ((strings, values) => {
+var viewTransitionCommon = ((strings, values, classNameSlug, onInvalidSlug) => {
   if (!strings) {
     strings = [`/* h-v-t ${viewTransitionNameIndex++} */`];
   }
-  const content = Array.isArray(strings) ? cssCommon(strings, values) : strings;
+  const content = Array.isArray(strings) ? cssCommon(strings, values, classNameSlug, onInvalidSlug) : strings;
   const transitionName = content[CLASS_NAME];
-  const res = cssCommon(["view-transition-name:", ""], [transitionName]);
+  const res = cssCommon(
+    ["view-transition-name:", ""],
+    // eslint-disable-line @typescript-eslint/no-explicit-any
+    [transitionName],
+    classNameSlug,
+    onInvalidSlug
+  );
   content[CLASS_NAME] = PSEUDO_GLOBAL_SELECTOR + content[CLASS_NAME];
   content[STYLE_STRING] = content[STYLE_STRING].replace(
     /(?<=::view-transition(?:[a-z-]*)\()(?=\))/g,

package/dist/node_modules/hono/dist/helper/css/index.js

@@ -15,7 +15,11 @@ import {
   viewTransitionCommon
 } from "./common.js";
 import { rawCssString } from "./common.js";
-var createCssContext = ({ id }) => {
+var createCssContext = ({
+  id,
+  classNameSlug,
+  onInvalidSlug
+}) => {
   const [cssJsxDomObject, StyleRenderToDom] = createCssJsxDomObjects({ id });
   const contextMap = /* @__PURE__ */ new WeakMap();
   const nonceMap = /* @__PURE__ */ new WeakMap();
@@ -78,15 +82,18 @@ var createCssContext = ({ id }) => {
     return promise;
   };
   const css2 = (strings, ...values) => {
-    return newCssClassNameObject(cssCommon(strings, values));
+    return newCssClassNameObject(cssCommon(strings, values, classNameSlug, onInvalidSlug));
   };
   const cx2 = (...args) => {
     args = cxCommon(args);
     return css2(Array(args.length).fill(""), ...args);
   };
-  const keyframes2 = keyframesCommon;
+  const keyframes2 = (strings, ...values) => keyframesCommon(strings, values, classNameSlug, onInvalidSlug);
   const viewTransition2 = ((strings, ...values) => {
-    return newCssClassNameObject(viewTransitionCommon(strings, values));
+    return newCssClassNameObject(
+      viewTransitionCommon(strings, values, classNameSlug, onInvalidSlug)
+      // eslint-disable-line @typescript-eslint/no-explicit-any
+    );
   });
   const Style2 = ({ children, nonce } = {}) => raw(
     `<style id="${id}"${nonce ? ` nonce="${nonce}"` : ""}>${children ? children[STYLE_STRING] : ""}</style>`,

package/dist/node_modules/hono/dist/helper/ssg/ssg.js

@@ -4,22 +4,30 @@ import { createPool } from "../../utils/concurrent.js";
 import { getExtension } from "../../utils/mime.js";
 import { SSG_CONTEXT, X_HONO_DISABLE_SSG_HEADER_KEY } from "./middleware.js";
 import { defaultPlugin } from "./plugins.js";
-import { dirname, filterStaticGenerateRoutes, isDynamicRoute, joinPaths } from "./utils.js";
+import {
+  dirname,
+  ensureWithinOutDir,
+  filterStaticGenerateRoutes,
+  isDynamicRoute,
+  joinPaths
+} from "./utils.js";
 var DEFAULT_CONCURRENCY = 2;
 var DEFAULT_CONTENT_TYPE = "text/plain";
 var DEFAULT_OUTPUT_DIR = "./static";
 var generateFilePath = (routePath, outDir, mimeType, extensionMap) => {
   const extension = determineExtension(mimeType, extensionMap);
+  let filePath;
   if (routePath.endsWith(`.${extension}`)) {
-    return joinPaths(outDir, routePath);
+    filePath = joinPaths(outDir, routePath);
+  } else if (routePath === "/") {
+    filePath = joinPaths(outDir, `index.${extension}`);
+  } else if (routePath.endsWith("/")) {
+    filePath = joinPaths(outDir, routePath, `index.${extension}`);
+  } else {
+    filePath = joinPaths(outDir, `${routePath}.${extension}`);
   }
-  if (routePath === "/") {
-    return joinPaths(outDir, `index.${extension}`);
-  }
-  if (routePath.endsWith("/")) {
-    return joinPaths(outDir, routePath, `index.${extension}`);
-  }
-  return joinPaths(outDir, `${routePath}.${extension}`);
+  ensureWithinOutDir(outDir, filePath);
+  return filePath;
 };
 var parseResponseContent = async (response) => {
   const contentType = response.headers.get("Content-Type");
@@ -110,7 +118,7 @@ var fetchRoutesContent = function* (app, beforeRequestHook, afterResponseHook, c
           }
           forGetInfoURLRequest = maybeRequest;
         }
-        await pool.run(() => app.fetch(forGetInfoURLRequest));
+        await pool.run(() => app.fetch(forGetInfoURLRequest, { [SSG_CONTEXT]: true }));
         if (!forGetInfoURLRequest.ssgParams) {
           if (isDynamicRoute(route.path)) {
             resolveGetInfo(void 0);

package/dist/node_modules/hono/dist/helper/ssg/utils.js

@@ -51,8 +51,16 @@ var filterStaticGenerateRoutes = (hono) => {
 var isDynamicRoute = (path) => {
   return path.split("/").some((segment) => segment.startsWith(":") || segment.includes("*"));
 };
+var ensureWithinOutDir = (outDir, filePath) => {
+  const normalizedOutDir = joinPaths("/", outDir);
+  const normalizedFilePath = joinPaths("/", filePath);
+  if (normalizedFilePath !== normalizedOutDir && !normalizedFilePath.startsWith(`${normalizedOutDir}/`)) {
+    throw new Error(`Path traversal detected: "${filePath}" is outside the output directory`);
+  }
+};
 export {
   dirname,
+  ensureWithinOutDir,
   filterStaticGenerateRoutes,
   isDynamicRoute,
   joinPaths

package/dist/node_modules/hono/dist/jsx/dom/css.js

@@ -100,22 +100,29 @@ var createCssJsxDomObjects = ({ id }) => {
   });
   return [cssObject, Style2];
 };
-var createCssContext = ({ id }) => {
+var createCssContext = ({
+  id,
+  classNameSlug,
+  onInvalidSlug
+}) => {
   const [cssObject, Style2] = createCssJsxDomObjects({ id });
   const newCssClassNameObject = (cssClassName) => {
     cssClassName.toString = cssObject.toString;
     return cssClassName;
   };
   const css2 = (strings, ...values) => {
-    return newCssClassNameObject(cssCommon(strings, values));
+    return newCssClassNameObject(cssCommon(strings, values, classNameSlug, onInvalidSlug));
   };
   const cx2 = (...args) => {
     args = cxCommon(args);
     return css2(Array(args.length).fill(""), ...args);
   };
-  const keyframes2 = keyframesCommon;
+  const keyframes2 = (strings, ...values) => keyframesCommon(strings, values, classNameSlug, onInvalidSlug);
   const viewTransition2 = ((strings, ...values) => {
-    return newCssClassNameObject(viewTransitionCommon(strings, values));
+    return newCssClassNameObject(
+      viewTransitionCommon(strings, values, classNameSlug, onInvalidSlug)
+      // eslint-disable-line @typescript-eslint/no-explicit-any
+    );
   });
   return {
     css: css2,

package/dist/node_modules/hono/dist/jsx/dom/intrinsic-element/components.js

@@ -1,7 +1,13 @@
 // src/jsx/dom/intrinsic-element/components.ts
 import { useContext } from "../../context.js";
 import { use, useCallback, useMemo, useState } from "../../hooks/index.js";
-import { dataPrecedenceAttr, deDupeKeyMap, domRenderers } from "../../intrinsic-element/common.js";
+import {
+  dataPrecedenceAttr,
+  deDupeKeyMap,
+  domRenderers,
+  isStylesheetLinkWithPrecedence,
+  shouldDeDupeByKey
+} from "../../intrinsic-element/common.js";
 import { FormContext, registerAction } from "../hooks/index.js";
 import { createPortal, getNameSpaceContext } from "../render.js";
 var clearCache = () => {
@@ -49,11 +55,16 @@ var documentMetadataTag = (tag, props, preserveNodeType, supportSort, supportBlo
   let element = null;
   let created = false;
   const deDupeKeys = deDupeKeyMap[tag];
+  const deDupeByKey = shouldDeDupeByKey(tag, supportSort);
+  const isDeDupeCandidateLink = (e) => e.getAttribute("rel") === "stylesheet" && e.getAttribute(dataPrecedenceAttr) !== null;
   let existingElements = void 0;
-  if (deDupeKeys.length > 0) {
+  if (deDupeByKey) {
     const tags = head.querySelectorAll(tag);
     LOOP: for (const e of tags) {
-      for (const key of deDupeKeyMap[tag]) {
+      if (tag === "link" && !isDeDupeCandidateLink(e)) {
+        continue;
+      }
+      for (const key of deDupeKeys) {
         if (e.getAttribute(key) === props[key]) {
           element = e;
           break LOOP;
@@ -72,9 +83,9 @@ var documentMetadataTag = (tag, props, preserveNodeType, supportSort, supportBlo
           if (props[key] !== void 0) {
             e.setAttribute(key, props[key]);
           }
-          if (props.rel) {
-            e.setAttribute("rel", props.rel);
-          }
+        }
+        if (props.rel) {
+          e.setAttribute("rel", props.rel);
         }
         return e;
       })();
@@ -88,7 +99,26 @@ var documentMetadataTag = (tag, props, preserveNodeType, supportSort, supportBlo
   }
   const insert = useCallback(
     (e) => {
-      if (deDupeKeys.length > 0) {
+      if (deDupeByKey) {
+        if (tag === "link" && precedence !== void 0) {
+          let found2 = false;
+          for (const existingElement of head.querySelectorAll(tag)) {
+            const existingPrecedence = existingElement.getAttribute(dataPrecedenceAttr);
+            if (existingPrecedence === null) {
+              head.insertBefore(e, existingElement);
+              return;
+            }
+            if (found2 && existingPrecedence !== precedence) {
+              head.insertBefore(e, existingElement);
+              return;
+            }
+            if (existingPrecedence === precedence) {
+              found2 = true;
+            }
+          }
+          head.appendChild(e);
+          return;
+        }
         let found = false;
         for (const existingElement of head.querySelectorAll(tag)) {
           if (found && existingElement.getAttribute(dataPrecedenceAttr) !== precedence) {
@@ -100,6 +130,10 @@ var documentMetadataTag = (tag, props, preserveNodeType, supportSort, supportBlo
           }
         }
         head.appendChild(e);
+      } else if (tag === "link") {
+        if (!head.contains(e)) {
+          head.appendChild(e);
+        }
       } else if (existingElements) {
         let found = false;
         for (const existingElement of existingElements) {
@@ -117,7 +151,7 @@ var documentMetadataTag = (tag, props, preserveNodeType, supportSort, supportBlo
         existingElements = void 0;
       }
     },
-    [precedence]
+    [deDupeByKey, precedence, tag]
   );
   const ref = composeRef(props.ref, (e) => {
     const key = deDupeKeys[0];
@@ -130,6 +164,9 @@ var documentMetadataTag = (tag, props, preserveNodeType, supportSort, supportBlo
     if (!onError && !onLoad) {
       return;
     }
+    if (!key) {
+      return;
+    }
     let promise = blockingPromiseMap[e.getAttribute(key)] ||= new Promise(
       (resolve, reject) => {
         e.addEventListener("load", resolve);
@@ -147,7 +184,7 @@ var documentMetadataTag = (tag, props, preserveNodeType, supportSort, supportBlo
   });
   if (supportBlocking && blocking === "render") {
     const key = deDupeKeyMap[tag][0];
-    if (props[key]) {
+    if (key && props[key]) {
       const value = props[key];
       const promise = blockingPromiseMap[value] ||= new Promise((resolve, reject) => {
         insert(element);
@@ -223,7 +260,7 @@ var link = (props) => {
       ref: props.ref
     };
   }
-  return documentMetadataTag("link", props, 1, "precedence" in props, true);
+  return documentMetadataTag("link", props, 1, isStylesheetLinkWithPrecedence(props), true);
 };
 var meta = (props) => {
   return documentMetadataTag("meta", props, void 0, false, false);

package/dist/node_modules/hono/dist/jsx/dom/render.js

@@ -45,6 +45,16 @@ var getEventSpec = (key) => {
 };
 var toAttributeName = (element, key) => nameSpaceContext && element instanceof SVGElement && /[A-Z]/.test(key) && (key in element.style || // Presentation attributes are findable in style object. "clip-path", "font-size", "stroke-width", etc.
 key.match(/^(?:o|pai|str|u|ve)/)) ? key.replace(/([A-Z])/g, "-$1").toLowerCase() : key;
+var normalizeFormValue = (value) => value === null || value === void 0 || value === false ? null : value;
+var applySelectValue = (select, props) => {
+  if (!("value" in props)) {
+    return;
+  }
+  select.value = normalizeFormValue(props["value"]);
+  if (!select.multiple && select.selectedIndex === -1) {
+    select.selectedIndex = 0;
+  }
+};
 var applyProps = (container, attributes, oldAttributes) => {
   attributes ||= {};
   for (let key in attributes) {
@@ -88,18 +98,14 @@ var applyProps = (container, attributes, oldAttributes) => {
       } else {
         if (key === "value") {
           const nodeName = container.nodeName;
-          if (nodeName === "INPUT" || nodeName === "TEXTAREA" || nodeName === "SELECT") {
+          if (nodeName === "SELECT") {
+            continue;
+          } else if (nodeName === "INPUT" || nodeName === "TEXTAREA") {
             ;
-            container.value = value === null || value === void 0 || value === false ? null : value;
+            container.value = normalizeFormValue(value);
             if (nodeName === "TEXTAREA") {
               container.textContent = value;
               continue;
-            } else if (nodeName === "SELECT") {
-              if (container.selectedIndex === -1) {
-                ;
-                container.selectedIndex = 0;
-              }
-              continue;
             }
           }
         } else if (key === "checked" && container.nodeName === "INPUT" || key === "selected" && container.nodeName === "OPTION") {
@@ -268,6 +274,9 @@ var applyNodeObject = (node, container, isNew) => {
         el = child.e ||= child.n ? document.createElementNS(child.n, child.tag) : document.createElement(child.tag);
         applyProps(el, child.props, child.pP);
         applyNodeObject(child, el, isNewLocal);
+        if (child.tag === "select") {
+          applySelectValue(el, child.props);
+        }
       }
     }
     if (child.tag === HONO_PORTAL_ELEMENT) {

package/dist/node_modules/hono/dist/jsx/intrinsic-element/common.js

@@ -8,8 +8,17 @@ var deDupeKeyMap = {
 };
 var domRenderers = {};
 var dataPrecedenceAttr = "data-precedence";
+var isStylesheetLinkWithPrecedence = (props) => props.rel === "stylesheet" && "precedence" in props;
+var shouldDeDupeByKey = (tagName, supportSort) => {
+  if (tagName === "link") {
+    return supportSort;
+  }
+  return deDupeKeyMap[tagName].length > 0;
+};
 export {
   dataPrecedenceAttr,
   deDupeKeyMap,
-  domRenderers
+  domRenderers,
+  isStylesheetLinkWithPrecedence,
+  shouldDeDupeByKey
 };

package/dist/node_modules/hono/dist/jsx/intrinsic-element/components.js

@@ -4,7 +4,12 @@ import { JSXNode, getNameSpaceContext } from "../base.js";
 import { toArray } from "../children.js";
 import { PERMALINK } from "../constants.js";
 import { useContext } from "../context.js";
-import { dataPrecedenceAttr, deDupeKeyMap } from "./common.js";
+import {
+  dataPrecedenceAttr,
+  deDupeKeyMap,
+  isStylesheetLinkWithPrecedence,
+  shouldDeDupeByKey
+} from "./common.js";
 var metaTagMap = /* @__PURE__ */ new WeakMap();
 var insertIntoHead = (tagName, tag, props, precedence) => ({ buffer, context }) => {
   if (!buffer) {
@@ -15,8 +20,12 @@ var insertIntoHead = (tagName, tag, props, precedence) => ({ buffer, context })
   const tags = map[tagName] ||= [];
   let duped = false;
   const deDupeKeys = deDupeKeyMap[tagName];
-  if (deDupeKeys.length > 0) {
+  const deDupeByKey = shouldDeDupeByKey(tagName, precedence !== void 0);
+  if (deDupeByKey) {
     LOOP: for (const [, tagProps] of tags) {
+      if (tagName === "link" && !(tagProps.rel === "stylesheet" && tagProps[dataPrecedenceAttr] !== void 0)) {
+        continue;
+      }
       for (const key of deDupeKeys) {
         if ((tagProps?.[key] ?? null) === props?.[key]) {
           duped = true;
@@ -27,25 +36,28 @@ var insertIntoHead = (tagName, tag, props, precedence) => ({ buffer, context })
   }
   if (duped) {
     buffer[0] = buffer[0].replaceAll(tag, "");
-  } else if (deDupeKeys.length > 0) {
+  } else if (deDupeByKey || tagName === "link") {
     tags.push([tag, props, precedence]);
   } else {
     tags.unshift([tag, props, precedence]);
   }
   if (buffer[0].indexOf("</head>") !== -1) {
     let insertTags;
-    if (precedence === void 0) {
-      insertTags = tags.map(([tag2]) => tag2);
-    } else {
+    if (tagName === "link" || precedence !== void 0) {
       const precedences = [];
-      insertTags = tags.map(([tag2, , precedence2]) => {
-        let order = precedences.indexOf(precedence2);
+      insertTags = tags.map(([tag2, , tagPrecedence], index) => {
+        if (tagPrecedence === void 0) {
+          return [tag2, Number.MAX_SAFE_INTEGER, index];
+        }
+        let order = precedences.indexOf(tagPrecedence);
         if (order === -1) {
-          precedences.push(precedence2);
+          precedences.push(tagPrecedence);
           order = precedences.length - 1;
         }
-        return [tag2, order];
-      }).sort((a, b) => a[1] - b[1]).map(([tag2]) => tag2);
+        return [tag2, order, index];
+      }).sort((a, b) => a[1] - b[1] || a[2] - b[2]).map(([tag2]) => tag2);
+    } else {
+      insertTags = tags.map(([tag2]) => tag2);
     }
     insertTags.forEach((tag2) => {
       buffer[0] = buffer[0].replaceAll(tag2, "");
@@ -114,7 +126,7 @@ var link = ({ children, ...props }) => {
   if (["onLoad", "onError"].some((k) => k in props) || props.rel === "stylesheet" && (!("precedence" in props) || "disabled" in props)) {
     return returnWithoutSpecialBehavior("link", children, props);
   }
-  return documentMetadataTag("link", children, props, "precedence" in props);
+  return documentMetadataTag("link", children, props, isStylesheetLinkWithPrecedence(props));
 };
 var meta = ({ children, ...props }) => {
   const nameSpaceContext = getNameSpaceContext();

package/dist/node_modules/hono/dist/middleware/bearer-auth/index.js

@@ -15,9 +15,9 @@ var bearerAuth = (options) => {
     options.prefix = PREFIX;
   }
   const realm = options.realm?.replace(/"/g, '\\"');
-  const prefixRegexStr = options.prefix === "" ? "" : `${options.prefix} +`;
-  const regexp = new RegExp(`^${prefixRegexStr}(${TOKEN_STRINGS}) *$`, "i");
-  const wwwAuthenticatePrefix = options.prefix === "" ? "" : `${options.prefix} `;
+  const prefix = options.prefix;
+  const tokenRegexp = new RegExp(`^${TOKEN_STRINGS}$`);
+  const wwwAuthenticatePrefix = prefix === "" ? "" : `${prefix} `;
   const throwHTTPException = async (c, status, wwwAuthenticateHeader, messageOption) => {
     const wwwAuthenticateHeaderValue = typeof wwwAuthenticateHeader === "function" ? await wwwAuthenticateHeader(c) : wwwAuthenticateHeader;
     const headers = {
@@ -43,8 +43,17 @@ var bearerAuth = (options) => {
         options.noAuthenticationHeader?.message || options.noAuthenticationHeaderMessage || "Unauthorized"
       );
     } else {
-      const match = regexp.exec(headerToken);
-      if (!match) {
+      let tokenValue;
+      if (prefix === "") {
+        tokenValue = headerToken;
+      } else {
+        const headerLower = headerToken.toLowerCase();
+        const prefixLower = prefix.toLowerCase();
+        if (headerLower.startsWith(prefixLower) && headerToken[prefix.length] === " ") {
+          tokenValue = headerToken.slice(prefix.length).trimStart();
+        }
+      }
+      if (!tokenValue || !tokenRegexp.test(tokenValue)) {
         await throwHTTPException(
           c,
           400,
@@ -54,12 +63,12 @@ var bearerAuth = (options) => {
       } else {
         let equal = false;
         if ("verifyToken" in options) {
-          equal = await options.verifyToken(match[1], c);
+          equal = await options.verifyToken(tokenValue, c);
         } else if (typeof options.token === "string") {
-          equal = await timingSafeEqual(options.token, match[1], options.hashFunction);
+          equal = await timingSafeEqual(options.token, tokenValue, options.hashFunction);
         } else if (Array.isArray(options.token) && options.token.length > 0) {
           for (const token of options.token) {
-            if (await timingSafeEqual(token, match[1], options.hashFunction)) {
+            if (await timingSafeEqual(token, tokenValue, options.hashFunction)) {
               equal = true;
               break;
             }

package/dist/node_modules/hono/dist/middleware/compress/index.js

@@ -24,6 +24,10 @@ var compress = (options) => {
     ctx.res = new Response(ctx.res.body.pipeThrough(stream), ctx.res);
     ctx.res.headers.delete("Content-Length");
     ctx.res.headers.set("Content-Encoding", encoding);
+    const etag = ctx.res.headers.get("ETag");
+    if (etag && !etag.startsWith("W/")) {
+      ctx.res.headers.set("ETag", `W/${etag}`);
+    }
   };
 };
 var shouldCompress = (res) => {

package/dist/node_modules/hono/dist/middleware/cors/index.js

@@ -13,6 +13,9 @@ var cors = (options) => {
   const findAllowOrigin = ((optsOrigin) => {
     if (typeof optsOrigin === "string") {
       if (optsOrigin === "*") {
+        if (opts.credentials) {
+          return (origin) => origin || null;
+        }
         return () => optsOrigin;
       } else {
         return (origin) => optsOrigin === origin ? origin : null;
@@ -47,7 +50,7 @@ var cors = (options) => {
       set("Access-Control-Expose-Headers", opts.exposeHeaders.join(","));
     }
     if (c.req.method === "OPTIONS") {
-      if (opts.origin !== "*") {
+      if (opts.origin !== "*" || opts.credentials) {
         set("Vary", "Origin");
       }
       if (opts.maxAge != null) {
@@ -77,7 +80,7 @@ var cors = (options) => {
       });
     }
     await next();
-    if (opts.origin !== "*") {
+    if (opts.origin !== "*" || opts.credentials) {
       c.header("Vary", "Origin", { append: true });
     }
   };

package/dist/node_modules/hono/dist/middleware/ip-restriction/index.js

@@ -1,10 +1,12 @@
 // src/middleware/ip-restriction/index.ts
 import { HTTPException } from "../../http-exception.js";
 import {
+  convertIPv4MappedIPv6ToIPv4,
   convertIPv4ToBinary,
   convertIPv6BinaryToString,
   convertIPv6ToBinary,
-  distinctRemoteAddr
+  distinctRemoteAddr,
+  isIPv4MappedIPv6
 } from "../../utils/ipaddr.js";
 var IS_CIDR_NOTATION_REGEX = /\/[0-9]{0,3}$/;
 var buildMatcher = (rules) => {
@@ -24,12 +26,17 @@ var buildMatcher = (rules) => {
         if (type2 === void 0) {
           throw new TypeError(`Invalid rule: ${rule}`);
         }
-        const isIPv4 = type2 === "IPv4";
-        const prefix = parseInt(separatedRule[1]);
+        let isIPv4 = type2 === "IPv4";
+        let prefix = parseInt(separatedRule[1]);
         if (isIPv4 ? prefix === 32 : prefix === 128) {
           rule = addrStr;
         } else {
-          const addr = (isIPv4 ? convertIPv4ToBinary : convertIPv6ToBinary)(addrStr);
+          let addr = (isIPv4 ? convertIPv4ToBinary : convertIPv6ToBinary)(addrStr);
+          if (type2 === "IPv6" && isIPv4MappedIPv6(addr) && prefix >= 96) {
+            isIPv4 = true;
+            addr = convertIPv4MappedIPv6ToIPv4(addr);
+            prefix -= 96;
+          }
           const mask = (1n << BigInt(prefix)) - 1n << BigInt((isIPv4 ? 32 : 128) - prefix);
           cidrRules.push([isIPv4, addr & mask, mask]);
           continue;
@@ -39,21 +46,38 @@ var buildMatcher = (rules) => {
       if (type === void 0) {
         throw new TypeError(`Invalid rule: ${rule}`);
       }
-      staticRules.add(
-        type === "IPv4" ? rule : convertIPv6BinaryToString(convertIPv6ToBinary(rule))
-        // normalize IPv6 address (e.g. 0000:0000:0000:0000:0000:0000:0000:0001 => ::1)
-      );
+      if (type === "IPv4") {
+        staticRules.add(rule);
+        staticRules.add(`::ffff:${rule}`);
+      } else {
+        const ipv6binary = convertIPv6ToBinary(rule);
+        const ipv6Addr = convertIPv6BinaryToString(ipv6binary);
+        staticRules.add(ipv6Addr);
+        if (isIPv4MappedIPv6(ipv6binary)) {
+          staticRules.add(ipv6Addr.substring(7));
+        }
+      }
     }
   }
   return (remote) => {
     if (staticRules.has(remote.addr)) {
       return true;
     }
+    const remoteAddr = remote.binaryAddr ||= (remote.isIPv4 ? convertIPv4ToBinary : convertIPv6ToBinary)(remote.addr);
+    const remoteIPv4Addr = remote.isIPv4 || isIPv4MappedIPv6(remoteAddr) ? remote.isIPv4 ? remoteAddr : convertIPv4MappedIPv6ToIPv4(remoteAddr) : void 0;
     for (const [isIPv4, addr, mask] of cidrRules) {
-      if (isIPv4 !== remote.isIPv4) {
+      if (isIPv4) {
+        if (remoteIPv4Addr === void 0) {
+          continue;
+        }
+        if ((remoteIPv4Addr & mask) === addr) {
+          return true;
+        }
+        continue;
+      }
+      if (remote.isIPv4) {
         continue;
       }
-      const remoteAddr = remote.binaryAddr ||= (isIPv4 ? convertIPv4ToBinary : convertIPv6ToBinary)(remote.addr);
       if ((remoteAddr & mask) === addr) {
         return true;
       }