@nocobase/plugin-mcp-server 2.3.0-beta.11 → 2.3.0-beta.13

package/dist/node_modules/hono/dist/middleware/cache/index.js

@@ -1,30 +1,113 @@
 // src/middleware/cache/index.ts
+import { cloneRawRequest } from "../../request.js";
+import { sha256 } from "../../utils/crypto.js";
 var defaultCacheableStatusCodes = [200];
-var shouldSkipCache = (res) => {
-  const vary = res.headers.get("Vary");
-  if (vary && vary.includes("*")) {
-    return true;
+var defaultMaxQueryBodySize = 64 * 1024;
+var cacheKeyPath = "/.hono/cache";
+var cacheKeyParameter = "__hono_cache_key";
+var cacheMethodKeyParameter = "__hono_cache_method";
+var queryDigestKeyParameter = "__hono_query_digest";
+var cacheVaryKeyParameter = "__hono_cache_vary";
+var queryRepresentationMetadataHeaders = [
+  "content-type",
+  "content-encoding",
+  "content-language",
+  "content-location"
+];
+var shouldSkipCacheControl = (cacheControl) => !!cacheControl && /(?:^|,\s*)(?:private|no-(?:store|cache))(?:\s*(?:=|,|$))/i.test(cacheControl);
+var parseVaryDirectives = (vary) => {
+  if (vary == null) {
+    return [];
   }
-  const cacheControl = res.headers.get("Cache-Control");
-  if (cacheControl && /(?:^|,\s*)(?:private|no-(?:store|cache))(?:\s*(?:=|,|$))/i.test(cacheControl)) {
-    return true;
+  return (Array.isArray(vary) ? vary : vary.split(",")).map((directive) => directive.trim().toLowerCase()).filter(Boolean);
+};
+var createCacheKey = (key, requestUrl, request, varyHeaders) => {
+  const url = new URL(cacheKeyPath, requestUrl);
+  url.searchParams.append(cacheKeyParameter, key);
+  url.searchParams.append(cacheMethodKeyParameter, request.method);
+  if (request.method === "QUERY") {
+    url.searchParams.append(queryDigestKeyParameter, request.digest);
+  }
+  for (const header of varyHeaders) {
+    url.searchParams.append(cacheVaryKeyParameter, JSON.stringify(header));
+  }
+  return url.href;
+};
+var shouldSkipCache = (res, optionsVaryDirectives, responseVary) => responseVary.length && (!optionsVaryDirectives || responseVary.some((name) => !optionsVaryDirectives.has(name))) || shouldSkipCacheControl(res.headers.get("Cache-Control")) || res.headers.has("Set-Cookie");
+var reportCacheNotAvailable = (onCacheNotAvailable, reason) => {
+  if (onCacheNotAvailable === false) {
+  } else if (onCacheNotAvailable) {
+    onCacheNotAvailable(reason);
+  } else {
+    console.log(reason);
+  }
+};
+var createQueryDigest = async (c, maxQueryBodySize) => {
+  if (!globalThis.crypto?.subtle) {
+    return void 0;
+  }
+  if (c.req.raw.bodyUsed && Object.keys(c.req.bodyCache)[0] === "formData") {
+    return void 0;
   }
-  if (res.headers.has("Set-Cookie")) {
-    return true;
+  try {
+    const requestHeaders = c.req.raw.headers;
+    const metadata = new TextEncoder().encode(
+      JSON.stringify(
+        queryRepresentationMetadataHeaders.map((header) => [header, requestHeaders.get(header)])
+      )
+    );
+    const body = (await cloneRawRequest(c.req)).body;
+    const chunks = [];
+    let bodySize = 0;
+    if (body) {
+      const reader = body.getReader();
+      for (; ; ) {
+        const { done, value } = await reader.read();
+        if (done) {
+          break;
+        }
+        bodySize += value.byteLength;
+        if (bodySize > maxQueryBodySize) {
+          void reader.cancel().catch(() => {
+          });
+          return void 0;
+        }
+        chunks.push(value);
+      }
+    }
+    const data = new Uint8Array(metadata.byteLength + bodySize);
+    data.set(metadata);
+    let offset = metadata.byteLength;
+    for (const chunk of chunks) {
+      data.set(chunk, offset);
+      offset += chunk.byteLength;
+    }
+    return await sha256(data) ?? void 0;
+  } catch {
+    return void 0;
   }
-  return false;
 };
 var cache = (options) => {
   if (!globalThis.caches) {
-    console.log("Cache Middleware is not enabled because caches is not defined.");
+    reportCacheNotAvailable(
+      options.onCacheNotAvailable,
+      "Cache Middleware is not enabled because caches is not defined."
+    );
     return async (_c, next) => await next();
   }
+  if (!globalThis.crypto?.subtle) {
+    reportCacheNotAvailable(
+      options.onCacheNotAvailable,
+      "Cache Middleware cannot cache QUERY requests because Web Crypto is not available."
+    );
+  }
   if (options.wait === void 0) {
     options.wait = false;
   }
   const cacheControlDirectives = options.cacheControl?.split(",").map((directive) => directive.toLowerCase());
-  const varyDirectives = Array.isArray(options.vary) ? options.vary : options.vary?.split(",").map((directive) => directive.trim());
-  if (options.vary?.includes("*")) {
+  const optionsVaryList = parseVaryDirectives(options.vary);
+  const varyDirectives = optionsVaryList.length ? new Set(optionsVaryList) : void 0;
+  if (varyDirectives?.has("*")) {
     throw new Error(
       'Middleware vary configuration cannot include "*", as it disallows effective caching.'
     );
@@ -32,9 +115,10 @@ var cache = (options) => {
   const cacheableStatusCodes = new Set(
     options.cacheableStatusCodes ?? defaultCacheableStatusCodes
   );
-  const addHeader = (c) => {
+  const maxQueryBodySize = options.maxQueryBodySize ?? defaultMaxQueryBodySize;
+  const addHeader = (c, responseVary) => {
     if (cacheControlDirectives) {
-      const existingDirectives = c.res.headers.get("Cache-Control")?.split(",").map((d) => d.trim().split("=", 1)[0]) ?? [];
+      const existingDirectives = c.res.headers.get("Cache-Control")?.split(",").map((d) => d.trim().split("=", 1)[0].toLowerCase()) ?? [];
       for (const directive of cacheControlDirectives) {
         let [name, value] = directive.trim().split("=", 2);
         name = name.toLowerCase();
@@ -44,24 +128,47 @@ var cache = (options) => {
       }
     }
     if (varyDirectives) {
-      const existingDirectives = c.res.headers.get("Vary")?.split(",").map((d) => d.trim()) ?? [];
-      const vary = Array.from(
-        new Set(
-          [...existingDirectives, ...varyDirectives].map((directive) => directive.toLowerCase())
-        )
-      ).sort();
-      if (vary.includes("*")) {
-        c.header("Vary", "*");
+      if (responseVary.length === 0) {
+        c.header("Vary", Array.from(varyDirectives).join(", "));
       } else {
-        c.header("Vary", vary.join(", "));
+        const merged = new Set(varyDirectives);
+        for (const directive of responseVary) {
+          merged.add(directive);
+        }
+        if (merged.has("*")) {
+          c.header("Vary", "*");
+        } else {
+          c.header("Vary", Array.from(merged).join(", "));
+        }
       }
     }
   };
   return async function cache2(c, next) {
+    if (c.req.method !== "GET" && c.req.method !== "QUERY" || c.req.raw.headers.has("Authorization")) {
+      await next();
+      return;
+    }
+    let cacheKeyRequest = { method: "GET" };
+    if (c.req.method === "QUERY") {
+      const digest = await createQueryDigest(c, maxQueryBodySize);
+      if (digest === void 0) {
+        await next();
+        return;
+      }
+      cacheKeyRequest = { method: "QUERY", digest };
+    }
     let key = c.req.url;
     if (options.keyGenerator) {
       key = await options.keyGenerator(c);
     }
+    const varyHeaders = [];
+    if (varyDirectives) {
+      for (const directive of varyDirectives) {
+        const value = c.req.raw.headers.get(directive) ?? "";
+        varyHeaders.push([directive, value]);
+      }
+    }
+    key = createCacheKey(key, c.req.url, cacheKeyRequest, varyHeaders);
     const cacheName = typeof options.cacheName === "function" ? await options.cacheName(c) : options.cacheName;
     const cache3 = await caches.open(cacheName);
     const response = await cache3.match(key);
@@ -72,8 +179,9 @@ var cache = (options) => {
     if (!cacheableStatusCodes.has(c.res.status)) {
       return;
     }
-    addHeader(c);
-    if (shouldSkipCache(c.res)) {
+    const responseVary = parseVaryDirectives(c.res.headers.get("Vary"));
+    addHeader(c, responseVary);
+    if (shouldSkipCache(c.res, varyDirectives, responseVary)) {
       return;
     }
     const res = c.res.clone();

package/dist/node_modules/hono/dist/middleware/compress/index.js

@@ -1,13 +1,43 @@
 // src/middleware/compress/index.ts
+import { parseAccept } from "../../utils/accept.js";
 import { COMPRESSIBLE_CONTENT_TYPE_REGEX } from "../../utils/compress.js";
 var ENCODING_TYPES = ["gzip", "deflate"];
 var cacheControlNoTransformRegExp = /(?:^|,)\s*?no-transform\s*?(?:,|$)/i;
+var selectEncoding = (header, candidates) => {
+  if (header === void 0) {
+    return void 0;
+  }
+  const accepts = parseAccept(header);
+  const wildcardQ = accepts.find((a) => a.type === "*")?.q;
+  let best;
+  for (const enc of candidates) {
+    const explicit = accepts.find((a) => a.type.toLowerCase() === enc);
+    const q = explicit ? explicit.q : wildcardQ ?? 0;
+    if (q === 1) {
+      return enc;
+    } else if (q > 0 && (!best || q > best.q)) {
+      best = { encoding: enc, q };
+    }
+  }
+  return best?.encoding;
+};
+var varyAcceptEncodingRegExp = /(?:^|,)\s*accept-encoding\s*(?:,|$)/i;
 var compress = (options) => {
   const threshold = options?.threshold ?? 1024;
+  const candidates = options?.encoding ? [options.encoding] : ENCODING_TYPES;
+  const contentTypeFilter = options?.contentTypeFilter ?? COMPRESSIBLE_CONTENT_TYPE_REGEX;
+  const shouldCompress = typeof contentTypeFilter === "function" ? (res) => {
+    const type = res.headers.get("Content-Type");
+    return type && contentTypeFilter(type);
+  } : (res) => {
+    const type = res.headers.get("Content-Type");
+    return type && contentTypeFilter.test(type);
+  };
   return async function compress2(ctx, next) {
     await next();
     const contentLength = ctx.res.headers.get("Content-Length");
-    if (ctx.res.headers.has("Content-Encoding") || // already encoded
+    if (ctx.res.status === 206 || // partial content, Content-Range refers to the uncompressed bytes
+    ctx.res.headers.has("Content-Encoding") || // already encoded
     ctx.res.headers.has("Transfer-Encoding") || // already encoded or chunked
     ctx.req.method === "HEAD" || // HEAD request
     contentLength && Number(contentLength) < threshold || // content-length below threshold
@@ -15,8 +45,12 @@ var compress = (options) => {
     !shouldTransform(ctx.res)) {
       return;
     }
+    const current = ctx.res.headers.get("Vary");
+    if (current !== "*" && !(current && varyAcceptEncodingRegExp.test(current))) {
+      ctx.header("Vary", current ? `${current}, Accept-Encoding` : "Accept-Encoding");
+    }
     const accepted = ctx.req.header("Accept-Encoding");
-    const encoding = options?.encoding ?? ENCODING_TYPES.find((encoding2) => accepted?.includes(encoding2));
+    const encoding = selectEncoding(accepted, candidates);
     if (!encoding || !ctx.res.body) {
       return;
     }
@@ -30,14 +64,11 @@ var compress = (options) => {
     }
   };
 };
-var shouldCompress = (res) => {
-  const type = res.headers.get("Content-Type");
-  return type && COMPRESSIBLE_CONTENT_TYPE_REGEX.test(type);
-};
 var shouldTransform = (res) => {
   const cacheControl = res.headers.get("Cache-Control");
   return !cacheControl || !cacheControlNoTransformRegExp.test(cacheControl);
 };
 export {
+  COMPRESSIBLE_CONTENT_TYPE_REGEX,
   compress
 };

package/dist/node_modules/hono/dist/middleware/cors/index.js

@@ -1,21 +1,17 @@
 // src/middleware/cors/index.ts
 var cors = (options) => {
-  const defaults = {
+  const opts = {
     origin: "*",
-    allowMethods: ["GET", "HEAD", "PUT", "POST", "DELETE", "PATCH"],
+    allowMethods: ["GET", "HEAD", "PUT", "POST", "DELETE", "PATCH", "QUERY"],
     allowHeaders: [],
-    exposeHeaders: []
-  };
-  const opts = {
-    ...defaults,
+    exposeHeaders: [],
     ...options
   };
+  const exposeHeadersStr = opts.exposeHeaders?.length ? opts.exposeHeaders.join(",") : void 0;
+  const allowHeadersStr = opts.allowHeaders?.length ? opts.allowHeaders.join(",") : void 0;
   const findAllowOrigin = ((optsOrigin) => {
     if (typeof optsOrigin === "string") {
       if (optsOrigin === "*") {
-        if (opts.credentials) {
-          return (origin) => origin || null;
-        }
         return () => optsOrigin;
       } else {
         return (origin) => optsOrigin === origin ? origin : null;
@@ -28,11 +24,12 @@ var cors = (options) => {
   })(opts.origin);
   const findAllowMethods = ((optsAllowMethods) => {
     if (typeof optsAllowMethods === "function") {
-      return optsAllowMethods;
+      return async (origin, c) => (await optsAllowMethods(origin, c)).join(",");
     } else if (Array.isArray(optsAllowMethods)) {
-      return () => optsAllowMethods;
+      const methodsStr = optsAllowMethods.join(",");
+      return () => methodsStr;
     } else {
-      return () => [];
+      return () => "";
     }
   })(opts.allowMethods);
   return async function cors2(c, next) {
@@ -46,29 +43,29 @@ var cors = (options) => {
     if (opts.credentials) {
       set("Access-Control-Allow-Credentials", "true");
     }
-    if (opts.exposeHeaders?.length) {
-      set("Access-Control-Expose-Headers", opts.exposeHeaders.join(","));
+    if (exposeHeadersStr) {
+      set("Access-Control-Expose-Headers", exposeHeadersStr);
     }
     if (c.req.method === "OPTIONS") {
-      if (opts.origin !== "*" || opts.credentials) {
-        set("Vary", "Origin");
+      if (opts.origin !== "*") {
+        c.res.headers.append("Vary", "Origin");
       }
       if (opts.maxAge != null) {
         set("Access-Control-Max-Age", opts.maxAge.toString());
       }
       const allowMethods = await findAllowMethods(c.req.header("origin") || "", c);
-      if (allowMethods.length) {
-        set("Access-Control-Allow-Methods", allowMethods.join(","));
+      if (allowMethods) {
+        set("Access-Control-Allow-Methods", allowMethods);
       }
-      let headers = opts.allowHeaders;
-      if (!headers?.length) {
+      let headersStr = allowHeadersStr;
+      if (!headersStr) {
         const requestHeaders = c.req.header("Access-Control-Request-Headers");
         if (requestHeaders) {
-          headers = requestHeaders.split(/\s*,\s*/);
+          headersStr = requestHeaders.split(",").map((h) => h.trim()).join(",");
         }
       }
-      if (headers?.length) {
-        set("Access-Control-Allow-Headers", headers.join(","));
+      if (headersStr) {
+        set("Access-Control-Allow-Headers", headersStr);
         c.res.headers.append("Vary", "Access-Control-Request-Headers");
       }
       c.res.headers.delete("Content-Length");
@@ -80,7 +77,7 @@ var cors = (options) => {
       });
     }
     await next();
-    if (opts.origin !== "*" || opts.credentials) {
+    if (opts.origin !== "*") {
       c.header("Vary", "Origin", { append: true });
     }
   };

package/dist/node_modules/hono/dist/middleware/csrf/index.js

@@ -2,7 +2,7 @@
 import { HTTPException } from "../../http-exception.js";
 var secFetchSiteValues = ["same-origin", "same-site", "none", "cross-site"];
 var isSecFetchSite = (value) => secFetchSiteValues.includes(value);
-var isSafeMethodRe = /^(GET|HEAD)$/;
+var isSafeMethodRe = /^(GET|HEAD|OPTIONS)$/;
 var isRequestedByFormElementRe = /^\b(application\/x-www-form-urlencoded|multipart\/form-data|text\/plain)\b/i;
 var csrf = (options) => {
   const originHandler = ((optsOrigin) => {

package/dist/node_modules/hono/dist/middleware/etag/digest.js

@@ -10,18 +10,64 @@ var mergeBuffers = (buffer1, buffer2) => {
   merged.set(buffer2, buffer1.byteLength);
   return merged;
 };
+var CHUNK_SIZE = 256 * 1024;
 var generateDigest = async (stream, generator) => {
   if (!stream) {
     return null;
   }
   let result = void 0;
+  let chunk;
+  let chunkLength = 0;
+  const digest = async (body) => {
+    result = await generator(mergeBuffers(result, body));
+  };
   const reader = stream.getReader();
   for (; ; ) {
     const { value, done } = await reader.read();
     if (done) {
       break;
     }
-    result = await generator(mergeBuffers(result, value));
+    let offset = 0;
+    while (offset < value.byteLength) {
+      const remaining = value.byteLength - offset;
+      if (chunkLength === 0 && remaining >= CHUNK_SIZE) {
+        await digest(value.subarray(offset, offset + CHUNK_SIZE));
+        offset += CHUNK_SIZE;
+        continue;
+      }
+      const requiredLength = chunkLength + remaining;
+      if (requiredLength < CHUNK_SIZE) {
+        if (!chunk) {
+          chunk = value.slice(offset);
+        } else {
+          if (chunk.byteLength < requiredLength) {
+            const nextChunk = new Uint8Array(
+              new ArrayBuffer(Math.min(CHUNK_SIZE, Math.max(requiredLength, chunk.byteLength * 2)))
+            );
+            nextChunk.set(chunk.subarray(0, chunkLength));
+            chunk = nextChunk;
+          }
+          chunk.set(value.subarray(offset), chunkLength);
+        }
+        chunkLength = requiredLength;
+        break;
+      }
+      const length = CHUNK_SIZE - chunkLength;
+      if (chunk?.byteLength !== CHUNK_SIZE) {
+        const nextChunk = new Uint8Array(new ArrayBuffer(CHUNK_SIZE));
+        if (chunk) {
+          nextChunk.set(chunk.subarray(0, chunkLength));
+        }
+        chunk = nextChunk;
+      }
+      chunk.set(value.subarray(offset, offset + length), chunkLength);
+      await digest(chunk);
+      chunkLength = 0;
+      offset += length;
+    }
+  }
+  if (chunk && chunkLength > 0) {
+    await digest(chunk.subarray(0, chunkLength));
   }
   if (!result) {
     return null;

package/dist/node_modules/hono/dist/middleware/etag/index.js

@@ -10,7 +10,7 @@ var RETAINED_304_HEADERS = [
 ];
 var stripWeak = (tag) => tag.replace(/^W\//, "");
 function etagMatches(etag2, ifNoneMatch) {
-  return ifNoneMatch != null && ifNoneMatch.split(/,\s*/).some((t) => stripWeak(t) === stripWeak(etag2));
+  return ifNoneMatch != null && ifNoneMatch.split(",").some((t) => stripWeak(t.trim()) === stripWeak(etag2));
 }
 function initializeGenerator(generator) {
   if (!generator) {
@@ -32,6 +32,9 @@ var etag = (options) => {
   return async function etag2(c, next) {
     const ifNoneMatch = c.req.header("If-None-Match") ?? null;
     await next();
+    if (!(c.req.method === "GET" || c.req.method === "HEAD" || c.req.method === "QUERY") || !c.res.ok) {
+      return;
+    }
     const res = c.res;
     let etag3 = res.headers.get("ETag");
     if (!etag3) {
@@ -48,7 +51,8 @@ var etag = (options) => {
       }
       etag3 = weak ? `W/"${hash}"` : `"${hash}"`;
     }
-    if (etagMatches(etag3, ifNoneMatch)) {
+    const matched = ifNoneMatch === "*" || etagMatches(etag3, ifNoneMatch);
+    if (matched) {
       c.res = new Response(null, {
         status: 304,
         statusText: "Not Modified",
@@ -56,11 +60,11 @@ var etag = (options) => {
           ETag: etag3
         }
       });
-      c.res.headers.forEach((_, key) => {
+      for (const key of Array.from(c.res.headers.keys())) {
         if (retainedHeaders.indexOf(key.toLowerCase()) === -1) {
           c.res.headers.delete(key);
         }
-      });
+      }
     } else {
       c.res.headers.set("ETag", etag3);
     }

package/dist/node_modules/hono/dist/middleware/ip-restriction/index.js

@@ -6,13 +6,48 @@ import {
   convertIPv6BinaryToString,
   convertIPv6ToBinary,
   distinctRemoteAddr,
-  isIPv4MappedIPv6
+  isIPv4MappedIPv6,
+  INVALID_IP_ADDRESS_ERROR_CODE
 } from "../../utils/ipaddr.js";
-var IS_CIDR_NOTATION_REGEX = /\/[0-9]{0,3}$/;
+var IS_CIDR_NOTATION_REGEX = /\/[^/]*$/;
+var parseCidrPrefix = (rule, prefix, max) => {
+  if (!/^[0-9]{1,3}$/.test(prefix)) {
+    throw new TypeError(`Invalid rule: ${rule}`);
+  }
+  const parsedPrefix = parseInt(prefix);
+  if (parsedPrefix > max) {
+    throw new TypeError(`Invalid rule: ${rule}`);
+  }
+  return parsedPrefix;
+};
 var buildMatcher = (rules) => {
   const functionRules = [];
   const staticRules = /* @__PURE__ */ new Set();
+  const staticIPv4Rules = /* @__PURE__ */ new Set();
+  const staticIPv6Rules = /* @__PURE__ */ new Set();
   const cidrRules = [];
+  const registerStaticRule = (rule) => {
+    const type = distinctRemoteAddr(rule);
+    if (type === void 0) {
+      throw new TypeError(`Invalid rule: ${rule}`);
+    }
+    if (type === "IPv4") {
+      const ipv4binary = convertIPv4ToBinary(rule);
+      staticRules.add(rule);
+      staticRules.add(`::ffff:${rule}`);
+      staticIPv4Rules.add(ipv4binary);
+      staticIPv6Rules.add(0xffffn << 32n | ipv4binary);
+    } else {
+      const ipv6binary = convertIPv6ToBinary(rule);
+      const ipv6Addr = convertIPv6BinaryToString(ipv6binary);
+      staticRules.add(ipv6Addr);
+      staticIPv6Rules.add(ipv6binary);
+      if (isIPv4MappedIPv6(ipv6binary)) {
+        staticRules.add(ipv6Addr.substring(7));
+        staticIPv4Rules.add(convertIPv4MappedIPv6ToIPv4(ipv6binary));
+      }
+    }
+  };
   for (let rule of rules) {
     if (rule === "*") {
       return () => true;
@@ -22,17 +57,17 @@ var buildMatcher = (rules) => {
       if (IS_CIDR_NOTATION_REGEX.test(rule)) {
         const separatedRule = rule.split("/");
         const addrStr = separatedRule[0];
-        const type2 = distinctRemoteAddr(addrStr);
-        if (type2 === void 0) {
+        const type = distinctRemoteAddr(addrStr);
+        if (type === void 0) {
           throw new TypeError(`Invalid rule: ${rule}`);
         }
-        let isIPv4 = type2 === "IPv4";
-        let prefix = parseInt(separatedRule[1]);
+        let isIPv4 = type === "IPv4";
+        let prefix = parseCidrPrefix(rule, separatedRule[1], isIPv4 ? 32 : 128);
         if (isIPv4 ? prefix === 32 : prefix === 128) {
           rule = addrStr;
         } else {
           let addr = (isIPv4 ? convertIPv4ToBinary : convertIPv6ToBinary)(addrStr);
-          if (type2 === "IPv6" && isIPv4MappedIPv6(addr) && prefix >= 96) {
+          if (type === "IPv6" && isIPv4MappedIPv6(addr) && prefix >= 96) {
             isIPv4 = true;
             addr = convertIPv4MappedIPv6ToIPv4(addr);
             prefix -= 96;
@@ -42,21 +77,7 @@ var buildMatcher = (rules) => {
           continue;
         }
       }
-      const type = distinctRemoteAddr(rule);
-      if (type === void 0) {
-        throw new TypeError(`Invalid rule: ${rule}`);
-      }
-      if (type === "IPv4") {
-        staticRules.add(rule);
-        staticRules.add(`::ffff:${rule}`);
-      } else {
-        const ipv6binary = convertIPv6ToBinary(rule);
-        const ipv6Addr = convertIPv6BinaryToString(ipv6binary);
-        staticRules.add(ipv6Addr);
-        if (isIPv4MappedIPv6(ipv6binary)) {
-          staticRules.add(ipv6Addr.substring(7));
-        }
-      }
+      registerStaticRule(rule);
     }
   }
   return (remote) => {
@@ -65,6 +86,9 @@ var buildMatcher = (rules) => {
     }
     const remoteAddr = remote.binaryAddr ||= (remote.isIPv4 ? convertIPv4ToBinary : convertIPv6ToBinary)(remote.addr);
     const remoteIPv4Addr = remote.isIPv4 || isIPv4MappedIPv6(remoteAddr) ? remote.isIPv4 ? remoteAddr : convertIPv4MappedIPv6ToIPv4(remoteAddr) : void 0;
+    if ((remote.isIPv4 ? staticIPv4Rules : staticIPv6Rules).has(remoteAddr)) {
+      return true;
+    }
     for (const [isIPv4, addr, mask] of cidrRules) {
       if (isIPv4) {
         if (remoteIPv4Addr === void 0) {
@@ -107,14 +131,21 @@ var ipRestriction = (getIP, { denyList = [], allowList = [] }, onError) => {
     }
     const type = typeof connInfo !== "string" && connInfo.remote.addressType || distinctRemoteAddr(addr);
     const remoteData = { addr, type, isIPv4: type === "IPv4" };
-    if (denyMatcher(remoteData)) {
-      if (onError) {
-        return onError({ addr, type }, c);
+    try {
+      if (denyMatcher(remoteData)) {
+        if (onError) {
+          return onError({ addr, type }, c);
+        }
+        throw blockError(c);
       }
-      throw blockError(c);
-    }
-    if (allowMatcher(remoteData)) {
-      return await next();
+      if (allowMatcher(remoteData)) {
+        return await next();
+      }
+    } catch (e) {
+      if (e instanceof TypeError && e.code === INVALID_IP_ADDRESS_ERROR_CODE) {
+        throw blockError(c);
+      }
+      throw e;
     }
     if (allowLength === 0) {
       return await next();

package/dist/node_modules/hono/dist/middleware/jwk/jwk.js

@@ -17,14 +17,15 @@ var jwk = (options, init) => {
     let token;
     if (credentials) {
       const parts = credentials.split(/\s+/);
-      if (parts.length !== 2) {
+      if (parts.length !== 2 || parts[0].toLowerCase() !== "bearer") {
         const errDescription = "invalid credentials structure";
         throw new HTTPException(401, {
           message: errDescription,
           res: unauthorizedResponse({
             ctx,
             error: "invalid_request",
-            errDescription
+            errDescription,
+            realm: options.realm
           })
         });
       } else {
@@ -62,7 +63,8 @@ var jwk = (options, init) => {
         res: unauthorizedResponse({
           ctx,
           error: "invalid_request",
-          errDescription
+          errDescription,
+          realm: options.realm
         })
       });
     }
@@ -89,7 +91,8 @@ var jwk = (options, init) => {
           ctx,
           error: "invalid_token",
           statusText: "Unauthorized",
-          errDescription: "token verification failure"
+          errDescription: "token verification failure",
+          realm: options.realm
         }),
         cause
       });
@@ -99,11 +102,13 @@ var jwk = (options, init) => {
   };
 };
 function unauthorizedResponse(opts) {
+  const realm = (opts.realm ?? opts.ctx.req.url).replace(/"/g, '\\"');
+  const errDescription = opts.errDescription.replace(/"/g, '\\"');
   return new Response("Unauthorized", {
     status: 401,
     statusText: opts.statusText,
     headers: {
-      "WWW-Authenticate": `Bearer realm="${opts.ctx.req.url}",error="${opts.error}",error_description="${opts.errDescription}"`
+      "WWW-Authenticate": `Bearer realm="${realm}",error="${opts.error}",error_description="${errDescription}"`
     }
   });
 }