@nocobase/plugin-mcp-server 2.3.0-beta.11 → 2.3.0-beta.13

package/dist/node_modules/hono/dist/types/utils/ipaddr.d.ts

@@ -9,6 +9,10 @@ import type { AddressType } from '../helper/conninfo';
  * @return expanded IPv6 Address
  */
 export declare const expandIPv6: (ipV6: string) => string;
+export declare const INVALID_IP_ADDRESS_ERROR_CODE = "ERR_INVALID_IP_ADDRESS";
+export type InvalidIPAddressError = TypeError & {
+    code: typeof INVALID_IP_ADDRESS_ERROR_CODE;
+};
 /**
  * Distinct Remote Addr
  * @param remoteAddr Remote Addr

package/dist/node_modules/hono/dist/types/utils/mime.d.ts

@@ -16,25 +16,25 @@ declare const _baseMimes: {
     readonly av1: "video/av1";
     readonly bin: "application/octet-stream";
     readonly bmp: "image/bmp";
-    readonly css: "text/css";
-    readonly csv: "text/csv";
+    readonly css: "text/css; charset=utf-8";
+    readonly csv: "text/csv; charset=utf-8";
     readonly eot: "application/vnd.ms-fontobject";
     readonly epub: "application/epub+zip";
     readonly gif: "image/gif";
     readonly gz: "application/gzip";
-    readonly htm: "text/html";
-    readonly html: "text/html";
+    readonly htm: "text/html; charset=utf-8";
+    readonly html: "text/html; charset=utf-8";
     readonly ico: "image/x-icon";
-    readonly ics: "text/calendar";
+    readonly ics: "text/calendar; charset=utf-8";
     readonly jpeg: "image/jpeg";
     readonly jpg: "image/jpeg";
-    readonly js: "text/javascript";
+    readonly js: "text/javascript; charset=utf-8";
     readonly json: "application/json";
     readonly jsonld: "application/ld+json";
     readonly map: "application/json";
     readonly mid: "audio/x-midi";
     readonly midi: "audio/x-midi";
-    readonly mjs: "text/javascript";
+    readonly mjs: "text/javascript; charset=utf-8";
     readonly mp3: "audio/mpeg";
     readonly mp4: "video/mp4";
     readonly mpeg: "video/mpeg";
@@ -46,12 +46,12 @@ declare const _baseMimes: {
     readonly pdf: "application/pdf";
     readonly png: "image/png";
     readonly rtf: "application/rtf";
-    readonly svg: "image/svg+xml";
+    readonly svg: "image/svg+xml; charset=utf-8";
     readonly tif: "image/tiff";
     readonly tiff: "image/tiff";
     readonly ts: "video/mp2t";
     readonly ttf: "font/ttf";
-    readonly txt: "text/plain";
+    readonly txt: "text/plain; charset=utf-8";
     readonly wasm: "application/wasm";
     readonly webm: "video/webm";
     readonly weba: "audio/webm";
@@ -59,8 +59,8 @@ declare const _baseMimes: {
     readonly webp: "image/webp";
     readonly woff: "font/woff";
     readonly woff2: "font/woff2";
-    readonly xhtml: "application/xhtml+xml";
-    readonly xml: "application/xml";
+    readonly xhtml: "application/xhtml+xml; charset=utf-8";
+    readonly xml: "application/xml; charset=utf-8";
     readonly zip: "application/zip";
     readonly '3gp': "video/3gpp";
     readonly '3g2': "video/3gpp2";

package/dist/node_modules/hono/dist/types/utils/types.d.ts

@@ -42,7 +42,7 @@ export type JSONParsed<T, TError = bigint | ReadonlyArray<bigint>> = T extends {
     toJSON(): unknown;
 } ? {} : JSONParsed<J, TError> : T extends JSONPrimitive ? T : T extends InvalidJSONValue ? never : T extends ReadonlyArray<unknown> ? {
     [K in keyof T]: JSONParsed<InvalidToNull<T[K]>, TError>;
-} : T extends Set<unknown> | Map<unknown, unknown> | Record<string, never> ? {} : T extends object ? T[keyof T] extends TError ? never : {
+} extends infer A ? A extends ReadonlyArray<unknown> ? A : JSONParsed<InvalidToNull<T[number]>, TError>[] : never : T extends Set<unknown> | Map<unknown, unknown> | Record<string, never> ? {} : T extends object ? T[keyof T] extends TError ? never : {
     [K in keyof OmitSymbolKeys<T> as IsInvalid<T[K]> extends true ? never : K]: boolean extends IsInvalid<T[K]> ? JSONParsed<T[K], TError> | undefined : JSONParsed<T[K], TError>;
 } : T extends unknown ? T extends TError ? never : JSONValue : never;
 /**

package/dist/node_modules/hono/dist/types/utils/url.d.ts

@@ -19,6 +19,10 @@ export declare const tryDecode: (str: string, decoder: Decoder) => string;
  */
 export declare const tryDecodeURI: (str: string) => string;
 export declare const getPath: (request: Request) => string;
+/**
+ * @deprecated
+ * Use the `URL` API instead.
+ */
 export declare const getQueryStrings: (url: string) => string;
 export declare const getPathNoStrict: (request: Request) => string;
 /**
@@ -33,6 +37,7 @@ export declare const getPathNoStrict: (request: Request) => string;
  */
 export declare const mergePath: (...paths: string[]) => string;
 export declare const checkOptionalParameter: (path: string) => string[] | null;
+export declare const tryDecodeURIComponent: (str: string) => string;
 export declare const getQueryParam: (url: string, key?: string) => string | undefined | Record<string, string>;
 export declare const getQueryParams: (url: string, key?: string) => string[] | undefined | Record<string, string[]>;
 export declare const decodeURIComponent_: typeof decodeURIComponent;

package/dist/node_modules/hono/dist/utils/accept.js

@@ -125,7 +125,7 @@ var getNextParam = (acceptHeader, startIndex) => {
 var getNextAcceptValue = (acceptHeader, startIndex) => {
   const accept = {
     type: "",
-    params: {},
+    params: /* @__PURE__ */ Object.create(null),
     q: 1
   };
   startIndex = consumeWhitespace(acceptHeader, startIndex);

package/dist/node_modules/hono/dist/utils/body.js

@@ -1,16 +1,32 @@
 // src/utils/body.ts
-import { HonoRequest } from "../request.js";
+import { bufferToFormData } from "./buffer.js";
+var MAX_NESTING_DEPTH = 32;
+var MAX_NESTED_OBJECTS = 1e4;
+var isRawRequest = (request) => "headers" in request;
 var parseBody = async (request, options = /* @__PURE__ */ Object.create(null)) => {
   const { all = false, dot = false } = options;
-  const headers = request instanceof HonoRequest ? request.raw.headers : request.headers;
+  const headers = isRawRequest(request) ? request.headers : request.raw.headers;
   const contentType = headers.get("Content-Type");
-  if (contentType?.startsWith("multipart/form-data") || contentType?.startsWith("application/x-www-form-urlencoded")) {
+  const mediaType = contentType?.split(";")[0].trim().toLowerCase();
+  if (mediaType === "multipart/form-data" || mediaType === "application/x-www-form-urlencoded") {
     return parseFormData(request, { all, dot });
   }
   return {};
 };
 async function parseFormData(request, options) {
-  const formData = await request.formData();
+  if (!isRawRequest(request) && request.bodyCache.formData) {
+    return convertFormDataToBodyData(
+      await request.bodyCache.formData,
+      options
+    );
+  }
+  const headers = isRawRequest(request) ? request.headers : request.raw.headers;
+  const arrayBuffer = await request.arrayBuffer();
+  const formDataPromise = bufferToFormData(arrayBuffer, headers.get("Content-Type") || "");
+  if (!isRawRequest(request)) {
+    request.bodyCache.formData = formDataPromise;
+  }
+  const formData = await formDataPromise;
   if (formData) {
     return convertFormDataToBodyData(formData, options);
   }
@@ -18,6 +34,7 @@ async function parseFormData(request, options) {
 }
 function convertFormDataToBodyData(formData, options) {
   const form = /* @__PURE__ */ Object.create(null);
+  const nestingState = { count: 0 };
   formData.forEach((value, key) => {
     const shouldParseAllValues = options.all || key.endsWith("[]");
     if (!shouldParseAllValues) {
@@ -30,7 +47,7 @@ function convertFormDataToBodyData(formData, options) {
     Object.entries(form).forEach(([key, value]) => {
       const shouldParseDotValues = key.includes(".");
       if (shouldParseDotValues) {
-        handleParsingNestedValues(form, key, value);
+        handleParsingNestedValues(form, key, value, nestingState);
         delete form[key];
       }
     });
@@ -53,23 +70,32 @@ var handleParsingAllValues = (form, key, value) => {
     }
   }
 };
-var handleParsingNestedValues = (form, key, value) => {
+var handleParsingNestedValues = (form, key, value, state) => {
   if (/(?:^|\.)__proto__\./.test(key)) {
     return;
   }
   let nestedForm = form;
-  const keys = key.split(".");
+  const keys = key.split(".", MAX_NESTING_DEPTH + 2);
+  if (keys.length > MAX_NESTING_DEPTH + 1) {
+    throwNestingLimitExceeded();
+  }
   keys.forEach((key2, index) => {
     if (index === keys.length - 1) {
       nestedForm[key2] = value;
     } else {
       if (!nestedForm[key2] || typeof nestedForm[key2] !== "object" || Array.isArray(nestedForm[key2]) || nestedForm[key2] instanceof File) {
+        if (state.count++ >= MAX_NESTED_OBJECTS) {
+          throwNestingLimitExceeded();
+        }
         nestedForm[key2] = /* @__PURE__ */ Object.create(null);
       }
       nestedForm = nestedForm[key2];
     }
   });
 };
+var throwNestingLimitExceeded = () => {
+  throw new Error("Nesting limit exceeded");
+};
 export {
   parseBody
 };

package/dist/node_modules/hono/dist/utils/buffer.js

@@ -64,7 +64,8 @@ var bufferToString = (buffer) => {
 var bufferToFormData = (arrayBuffer, contentType) => {
   const response = new Response(arrayBuffer, {
     headers: {
-      "Content-Type": contentType
+      // Normalize the media type (case-insensitive) while keeping parameters like the boundary
+      "Content-Type": contentType.replace(/^[^;]+/, (mediaType) => mediaType.toLowerCase())
     }
   });
   return response.formData();

package/dist/node_modules/hono/dist/utils/compress.js

@@ -1,5 +1,5 @@
 // src/utils/compress.ts
-var COMPRESSIBLE_CONTENT_TYPE_REGEX = /^\s*(?:text\/(?!event-stream(?:[;\s]|$))[^;\s]+|application\/(?:javascript|json|xml|xml-dtd|ecmascript|dart|postscript|rtf|tar|toml|vnd\.dart|vnd\.ms-fontobject|vnd\.ms-opentype|wasm|x-httpd-php|x-javascript|x-ns-proxy-autoconfig|x-sh|x-tar|x-virtualbox-hdd|x-virtualbox-ova|x-virtualbox-ovf|x-virtualbox-vbox|x-virtualbox-vdi|x-virtualbox-vhd|x-virtualbox-vmdk|x-www-form-urlencoded)|font\/(?:otf|ttf)|image\/(?:bmp|vnd\.adobe\.photoshop|vnd\.microsoft\.icon|vnd\.ms-dds|x-icon|x-ms-bmp)|message\/rfc822|model\/gltf-binary|x-shader\/x-fragment|x-shader\/x-vertex|[^;\s]+?\+(?:json|text|xml|yaml))(?:[;\s]|$)/i;
+var COMPRESSIBLE_CONTENT_TYPE_REGEX = /^\s*(?:text\/(?!event-stream(?:[;\s]|$))[^;\s]+|application\/(?:javascript|json|xml|xml-dtd|ecmascript|dart|msgpack|postscript|rtf|tar|toml|vnd\.dart|vnd\.ms-fontobject|vnd\.ms-opentype|vnd\.msgpack|wasm|x-httpd-php|x-javascript|x-msgpack|x-ns-proxy-autoconfig|x-sh|x-tar|x-virtualbox-hdd|x-virtualbox-ova|x-virtualbox-ovf|x-virtualbox-vbox|x-virtualbox-vdi|x-virtualbox-vhd|x-virtualbox-vmdk|x-www-form-urlencoded)|font\/(?:otf|ttf)|image\/(?:bmp|vnd\.adobe\.photoshop|vnd\.microsoft\.icon|vnd\.ms-dds|x-icon|x-ms-bmp)|message\/rfc822|model\/gltf-binary|x-shader\/x-fragment|x-shader\/x-vertex|[^;\s]+?\+(?:json|text|xml|yaml|msgpack))(?:[;\s]|$)/i;
 export {
   COMPRESSIBLE_CONTENT_TYPE_REGEX
 };

package/dist/node_modules/hono/dist/utils/cookie.js

@@ -1,5 +1,5 @@
 // src/utils/cookie.ts
-import { decodeURIComponent_, tryDecode } from "./url.js";
+import { tryDecodeURIComponent } from "./url.js";
 var algorithm = { name: "HMAC", hash: "SHA-256" };
 var getCryptoKey = async (secret) => {
   const secretBuf = typeof secret === "string" ? new TextEncoder().encode(secret) : secret;
@@ -23,6 +23,7 @@ var verifySignature = async (base64Signature, value, secret) => {
   }
 };
 var validCookieNameRegEx = /^[\w!#$%&'*.^`|~+-]+$/;
+var relaxedCookieNameRegEx = /^[!#-:<>-[\]-~]+$/;
 var validCookieValueRegEx = /^[ !#-:<-[\]-~]*$/;
 var trimCookieWhitespace = (value) => {
   let start = 0;
@@ -48,14 +49,14 @@ var parse = (cookie, name) => {
     return {};
   }
   const pairs = cookie.split(";");
-  const parsedCookie = {};
+  const parsedCookie = /* @__PURE__ */ Object.create(null);
   for (const pairStr of pairs) {
     const valueStartPos = pairStr.indexOf("=");
     if (valueStartPos === -1) {
       continue;
     }
     const cookieName = trimCookieWhitespace(pairStr.substring(0, valueStartPos));
-    if (name && name !== cookieName || !validCookieNameRegEx.test(cookieName)) {
+    if (name && name !== cookieName || !relaxedCookieNameRegEx.test(cookieName) || cookieName in parsedCookie) {
       continue;
     }
     let cookieValue = trimCookieWhitespace(pairStr.substring(valueStartPos + 1));
@@ -63,7 +64,7 @@ var parse = (cookie, name) => {
       cookieValue = cookieValue.slice(1, -1);
     }
     if (validCookieValueRegEx.test(cookieValue)) {
-      parsedCookie[cookieName] = cookieValue.indexOf("%") !== -1 ? tryDecode(cookieValue, decodeURIComponent_) : cookieValue;
+      parsedCookie[cookieName] = tryDecodeURIComponent(cookieValue);
       if (name) {
         break;
       }
@@ -72,11 +73,11 @@ var parse = (cookie, name) => {
   return parsedCookie;
 };
 var parseSigned = async (cookie, secret, name) => {
-  const parsedCookie = {};
+  const parsedCookie = /* @__PURE__ */ Object.create(null);
   const secretKey = await getCryptoKey(secret);
   for (const [key, value] of Object.entries(parse(cookie, name))) {
     const signatureStartPos = value.lastIndexOf(".");
-    if (signatureStartPos < 1) {
+    if (signatureStartPos < 0) {
       continue;
     }
     const signedValue = value.substring(0, signatureStartPos);
@@ -108,7 +109,7 @@ var _serialize = (name, value, opt = {}) => {
       throw new Error("__Host- Cookie must not have Domain attributes");
     }
   }
-  for (const key of ["domain", "path"]) {
+  for (const key of ["domain", "path", "sameSite", "priority"]) {
     if (opt[key] && /[;\r\n]/.test(opt[key])) {
       throw new Error(`${key} must not contain ";", "\\r", or "\\n"`);
     }

package/dist/node_modules/hono/dist/utils/filepath.js

@@ -20,7 +20,7 @@ var getFilePathWithoutDefaultDocument = (options) => {
     return;
   }
   filename = filename.replace(/^\.?[\/\\]/, "");
-  filename = filename.replace(/\\/, "/");
+  filename = filename.replace(/\\/g, "/");
   root = root.replace(/\/$/, "");
   let path = root ? root + "/" + filename : filename;
   path = path.replace(/^\.?\//, "");

package/dist/node_modules/hono/dist/utils/ipaddr.js

@@ -1,12 +1,14 @@
 // src/utils/ipaddr.ts
 var expandIPv6 = (ipV6) => {
   const sections = ipV6.split(":");
-  if (IPV4_REGEX.test(sections.at(-1))) {
+  const lastSection = sections.at(-1);
+  if (IPV4_REGEX.test(lastSection)) {
+    const octets = lastSection.split(".").map(Number);
     sections.splice(
       -1,
       1,
-      ...convertIPv6BinaryToString(convertIPv4ToBinary(sections.at(-1))).substring(2).split(":")
-      // => ['7f00', '0001']
+      (octets[0] << 8 | octets[1]).toString(16),
+      (octets[2] << 8 | octets[3]).toString(16)
     );
   }
   for (let i = 0; i < sections.length; i++) {
@@ -14,7 +16,9 @@ var expandIPv6 = (ipV6) => {
     if (node !== "") {
       sections[i] = node.padStart(4, "0");
     } else {
-      sections[i + 1] === "" && sections.splice(i + 1, 1);
+      while (sections[i + 1] === "") {
+        sections.splice(i + 1, 1);
+      }
       sections[i] = new Array(8 - sections.length + 1).fill("0000").join(":");
     }
   }
@@ -22,6 +26,16 @@ var expandIPv6 = (ipV6) => {
 };
 var IPV4_OCTET_PART = "(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])";
 var IPV4_REGEX = new RegExp(`^(?:${IPV4_OCTET_PART}\\.){3}${IPV4_OCTET_PART}$`);
+var INVALID_IP_ADDRESS_ERROR_CODE = "ERR_INVALID_IP_ADDRESS";
+var CHAR_CODE_0 = 48;
+var CHAR_CODE_9 = 57;
+var CHAR_CODE_A = 65;
+var CHAR_CODE_F = 70;
+var CHAR_CODE_a = 97;
+var CHAR_CODE_f = 102;
+var CHAR_CODE_DOT = 46;
+var CHAR_CODE_COLON = 58;
+var CHAR_CODE_PERCENT = 37;
 var distinctRemoteAddr = (remoteAddr) => {
   if (IPV4_REGEX.test(remoteAddr)) {
     return "IPv4";
@@ -30,21 +44,187 @@ var distinctRemoteAddr = (remoteAddr) => {
     return "IPv6";
   }
 };
-var convertIPv4ToBinary = (ipv4) => {
-  const parts = ipv4.split(".");
+var createInvalidIPAddressError = (message) => {
+  const error = new TypeError(message);
+  error.code = INVALID_IP_ADDRESS_ERROR_CODE;
+  return error;
+};
+var throwInvalidIPv4Address = (ipv4) => {
+  throw createInvalidIPAddressError(`Invalid IPv4 address: ${ipv4}`);
+};
+var throwInvalidIPv6Address = (ipv6) => {
+  throw createInvalidIPAddressError(`Invalid IPv6 address: ${ipv6}`);
+};
+var parseIPv4ToBinary = (ipv4, start, end, onInvalid) => {
   let result = 0n;
-  for (let i = 0; i < 4; i++) {
-    result <<= 8n;
-    result += BigInt(parts[i]);
+  let octets = 0;
+  let octet = 0;
+  let digits = 0;
+  let firstDigit = 0;
+  for (let i = start; i <= end; i++) {
+    const code = i < end ? ipv4.charCodeAt(i) : CHAR_CODE_DOT;
+    if (code >= CHAR_CODE_0 && code <= CHAR_CODE_9) {
+      if (digits === 0) {
+        firstDigit = code;
+      } else if (firstDigit === CHAR_CODE_0) {
+        onInvalid();
+      }
+      octet = octet * 10 + code - CHAR_CODE_0;
+      if (octet > 255) {
+        onInvalid();
+      }
+      digits++;
+      continue;
+    }
+    if (code !== CHAR_CODE_DOT || digits === 0 || octets === 4) {
+      onInvalid();
+    }
+    result = (result << 8n) + BigInt(octet);
+    octets++;
+    octet = 0;
+    digits = 0;
+  }
+  if (octets !== 4) {
+    onInvalid();
   }
   return result;
 };
+var parseIPv6HexCode = (code) => {
+  if (code >= CHAR_CODE_0 && code <= CHAR_CODE_9) {
+    return code - CHAR_CODE_0;
+  }
+  if (code >= CHAR_CODE_A && code <= CHAR_CODE_F) {
+    return code - CHAR_CODE_A + 10;
+  }
+  if (code >= CHAR_CODE_a && code <= CHAR_CODE_f) {
+    return code - CHAR_CODE_a + 10;
+  }
+  return -1;
+};
+var isIPv6LinkLocal = (ipv6binary) => ipv6binary >> 118n === 0x3fan;
+var convertIPv4ToBinary = (ipv4) => {
+  return parseIPv4ToBinary(ipv4, 0, ipv4.length, () => throwInvalidIPv4Address(ipv4));
+};
 var convertIPv6ToBinary = (ipv6) => {
-  const sections = expandIPv6(ipv6).split(":");
+  const length = ipv6.length;
+  const sections = [];
+  let hasZoneId = false;
+  let compressAt = -1;
+  let index = 0;
+  if (length === 0) {
+    throwInvalidIPv6Address(ipv6);
+  }
+  while (index < length) {
+    if (sections.length > 8) {
+      throwInvalidIPv6Address(ipv6);
+    }
+    let code = ipv6.charCodeAt(index);
+    if (code === CHAR_CODE_PERCENT) {
+      if (index + 1 === length) {
+        throwInvalidIPv6Address(ipv6);
+      }
+      hasZoneId = true;
+      break;
+    }
+    if (code === CHAR_CODE_COLON) {
+      if (index + 1 < length && ipv6.charCodeAt(index + 1) === CHAR_CODE_COLON) {
+        if (compressAt !== -1) {
+          throwInvalidIPv6Address(ipv6);
+        }
+        compressAt = sections.length;
+        index += 2;
+        continue;
+      }
+      throwInvalidIPv6Address(ipv6);
+    }
+    let value = 0;
+    let digits = 0;
+    const sectionStart = index;
+    while (index < length) {
+      code = ipv6.charCodeAt(index);
+      const hex = parseIPv6HexCode(code);
+      if (hex === -1) {
+        break;
+      }
+      if (digits === 4) {
+        throwInvalidIPv6Address(ipv6);
+      }
+      value = value << 4 | hex;
+      digits++;
+      index++;
+    }
+    if (index < length && ipv6.charCodeAt(index) === CHAR_CODE_DOT) {
+      let ipv4End = length;
+      for (let i = index; i < length; i++) {
+        if (ipv6.charCodeAt(i) === CHAR_CODE_PERCENT) {
+          if (i + 1 === length) {
+            throwInvalidIPv6Address(ipv6);
+          }
+          hasZoneId = true;
+          ipv4End = i;
+          break;
+        }
+      }
+      const ipv4 = parseIPv4ToBinary(
+        ipv6,
+        sectionStart,
+        ipv4End,
+        () => throwInvalidIPv6Address(ipv6)
+      );
+      sections.push(Number(ipv4 >> 16n & 0xffffn), Number(ipv4 & 0xffffn));
+      index = length;
+      break;
+    }
+    if (digits === 0) {
+      throwInvalidIPv6Address(ipv6);
+    }
+    sections.push(value);
+    if (index === length) {
+      break;
+    }
+    code = ipv6.charCodeAt(index);
+    if (code === CHAR_CODE_PERCENT) {
+      if (index + 1 === length) {
+        throwInvalidIPv6Address(ipv6);
+      }
+      hasZoneId = true;
+      break;
+    }
+    if (code !== CHAR_CODE_COLON) {
+      throwInvalidIPv6Address(ipv6);
+    }
+    if (index + 1 < length && ipv6.charCodeAt(index + 1) === CHAR_CODE_COLON) {
+      if (compressAt !== -1) {
+        throwInvalidIPv6Address(ipv6);
+      }
+      compressAt = sections.length;
+      index += 2;
+      continue;
+    }
+    index++;
+    if (index === length) {
+      throwInvalidIPv6Address(ipv6);
+    }
+  }
+  if (compressAt === -1 ? sections.length !== 8 : sections.length >= 8) {
+    throwInvalidIPv6Address(ipv6);
+  }
   let result = 0n;
-  for (let i = 0; i < 8; i++) {
+  const zeros = compressAt === -1 ? 0 : 8 - sections.length;
+  const firstSectionEnd = compressAt === -1 ? sections.length : compressAt;
+  for (let i = 0; i < firstSectionEnd; i++) {
     result <<= 16n;
-    result += BigInt(parseInt(sections[i], 16));
+    result += BigInt(sections[i]);
+  }
+  for (let i = 0; i < zeros; i++) {
+    result <<= 16n;
+  }
+  for (let i = firstSectionEnd; i < sections.length; i++) {
+    result <<= 16n;
+    result += BigInt(sections[i]);
+  }
+  if (hasZoneId && !isIPv6LinkLocal(result)) {
+    throwInvalidIPv6Address(ipv6);
   }
   return result;
 };
@@ -58,6 +238,9 @@ var convertIPv4BinaryToString = (ipV4) => {
 var isIPv4MappedIPv6 = (ipv6binary) => ipv6binary >> 32n === 0xffffn;
 var convertIPv4MappedIPv6ToIPv4 = (ipv6binary) => ipv6binary & 0xffffffffn;
 var convertIPv6BinaryToString = (ipV6) => {
+  if (ipV6 === 0n) {
+    return "::";
+  }
   if (isIPv4MappedIPv6(ipV6)) {
     return `::ffff:${convertIPv4BinaryToString(convertIPv4MappedIPv6ToIPv4(ipV6))}`;
   }
@@ -89,12 +272,13 @@ var convertIPv6BinaryToString = (ipV6) => {
       maxZeroEnd = 8;
     }
   }
-  if (maxZeroStart !== -1) {
+  if (maxZeroStart !== -1 && maxZeroEnd - maxZeroStart > 1) {
     sections.splice(maxZeroStart, maxZeroEnd - maxZeroStart, ":");
   }
   return sections.join(":").replace(/:{2,}/g, "::");
 };
 export {
+  INVALID_IP_ADDRESS_ERROR_CODE,
   convertIPv4BinaryToString,
   convertIPv4MappedIPv6ToIPv4,
   convertIPv4ToBinary,

package/dist/node_modules/hono/dist/utils/jwt/jws.js

@@ -14,7 +14,7 @@ async function verifying(publicKey, alg, signature, data) {
   return await crypto.subtle.verify(algorithm, cryptoKey, signature, data);
 }
 function pemToBinary(pem) {
-  return decodeBase64(pem.replace(/-+(BEGIN|END).*/g, "").replace(/\s/g, ""));
+  return decodeBase64(pem.replace(/-+(BEGIN|END).*?-+/g, "").replace(/\s/g, ""));
 }
 async function importPrivateKey(key, alg) {
   if (!crypto.subtle || !crypto.subtle.importKey) {

package/dist/node_modules/hono/dist/utils/jwt/jwt.js

@@ -70,14 +70,20 @@ var verify = async (token, publicKey, algOrOptions) => {
     throw new JwtAlgorithmMismatch(alg, header.alg);
   }
   const now = Math.floor(Date.now() / 1e3);
-  if (nbf && payload.nbf && payload.nbf > now) {
-    throw new JwtTokenNotBefore(token);
+  if (nbf && payload.nbf !== void 0) {
+    if (typeof payload.nbf !== "number" || !Number.isFinite(payload.nbf) || payload.nbf > now) {
+      throw new JwtTokenNotBefore(token);
+    }
   }
-  if (exp && payload.exp && payload.exp <= now) {
-    throw new JwtTokenExpired(token);
+  if (exp && payload.exp !== void 0) {
+    if (typeof payload.exp !== "number" || !Number.isFinite(payload.exp) || payload.exp <= now) {
+      throw new JwtTokenExpired(token);
+    }
   }
-  if (iat && payload.iat && now < payload.iat) {
-    throw new JwtTokenIssuedAt(now, payload.iat);
+  if (iat && payload.iat !== void 0) {
+    if (typeof payload.iat !== "number" || !Number.isFinite(payload.iat) || now < payload.iat) {
+      throw new JwtTokenIssuedAt(now, payload.iat);
+    }
   }
   if (iss) {
     if (!payload.iss) {