@psnext/slingcli 3.0.20260827-1 → 3.3.20260911-1

package/node_modules/@types/node/zlib.d.ts

@@ -1,4 +1,97 @@
-declare module "node:zlib" {
+/**
+ * The `node:zlib` module provides compression functionality implemented using
+ * Gzip, Deflate/Inflate, and Brotli.
+ *
+ * To access it:
+ *
+ * ```js
+ * import zlib from 'node:zlib';
+ * ```
+ *
+ * Compression and decompression are built around the Node.js
+ * [Streams API](https://nodejs.org/docs/latest-v22.x/api/stream.html).
+ *
+ * Compressing or decompressing a stream (such as a file) can be accomplished by
+ * piping the source stream through a `zlib` `Transform` stream into a destination
+ * stream:
+ *
+ * ```js
+ * import { createGzip } from 'node:zlib';
+ * import { pipeline } from 'node:stream';
+ * import {
+ *   createReadStream,
+ *   createWriteStream,
+ * } from 'node:fs';
+ *
+ * const gzip = createGzip();
+ * const source = createReadStream('input.txt');
+ * const destination = createWriteStream('input.txt.gz');
+ *
+ * pipeline(source, gzip, destination, (err) => {
+ *   if (err) {
+ *     console.error('An error occurred:', err);
+ *     process.exitCode = 1;
+ *   }
+ * });
+ *
+ * // Or, Promisified
+ *
+ * import { promisify } from 'node:util';
+ * const pipe = promisify(pipeline);
+ *
+ * async function do_gzip(input, output) {
+ *   const gzip = createGzip();
+ *   const source = createReadStream(input);
+ *   const destination = createWriteStream(output);
+ *   await pipe(source, gzip, destination);
+ * }
+ *
+ * do_gzip('input.txt', 'input.txt.gz')
+ *   .catch((err) => {
+ *     console.error('An error occurred:', err);
+ *     process.exitCode = 1;
+ *   });
+ * ```
+ *
+ * It is also possible to compress or decompress data in a single step:
+ *
+ * ```js
+ * import { deflate, unzip } from 'node:zlib';
+ *
+ * const input = '.................................';
+ * deflate(input, (err, buffer) => {
+ *   if (err) {
+ *     console.error('An error occurred:', err);
+ *     process.exitCode = 1;
+ *   }
+ *   console.log(buffer.toString('base64'));
+ * });
+ *
+ * const buffer = Buffer.from('eJzT0yMAAGTvBe8=', 'base64');
+ * unzip(buffer, (err, buffer) => {
+ *   if (err) {
+ *     console.error('An error occurred:', err);
+ *     process.exitCode = 1;
+ *   }
+ *   console.log(buffer.toString());
+ * });
+ *
+ * // Or, Promisified
+ *
+ * import { promisify } from 'node:util';
+ * const do_unzip = promisify(unzip);
+ *
+ * do_unzip(buffer)
+ *   .then((buf) => console.log(buf.toString()))
+ *   .catch((err) => {
+ *     console.error('An error occurred:', err);
+ *     process.exitCode = 1;
+ *   });
+ * ```
+ * @since v0.5.8
+ * @see [source](https://github.com/nodejs/node/blob/v22.x/lib/zlib.js)
+ */
+declare module "zlib" {
     import { NonSharedBuffer } from "node:buffer";
     import * as stream from "node:stream";
     interface ZlibOptions {
@@ -55,7 +148,7 @@ declare module "node:zlib" {
             }
             | undefined;
         /**
-         * Limits output size when using [convenience methods](https://nodejs.org/docs/latest-v26.x/api/zlib.html#convenience-methods).
+         * Limits output size when using [convenience methods](https://nodejs.org/docs/latest-v22.x/api/zlib.html#convenience-methods).
          * @default buffer.kMaxLength
          */
         maxOutputLength?: number | undefined;
@@ -79,12 +172,12 @@ declare module "node:zlib" {
         chunkSize?: number | undefined;
         /**
          * Key-value object containing indexed
-         * [Zstd parameters](https://nodejs.org/docs/latest-v26.x/api/zlib.html#zstd-constants).
+         * [Zstd parameters](https://nodejs.org/docs/latest-v22.x/api/zlib.html#zstd-constants).
          */
         params?: { [key: number]: number | boolean } | undefined;
         /**
          * Limits output size when using
-         * [convenience methods](https://nodejs.org/docs/latest-v26.x/api/zlib.html#convenience-methods).
+         * [convenience methods](https://nodejs.org/docs/latest-v22.x/api/zlib.html#convenience-methods).
          * @default buffer.kMaxLength
          */
         maxOutputLength?: number | undefined;
@@ -95,11 +188,13 @@ declare module "node:zlib" {
         /**
          * Optional dictionary used to improve compression efficiency when compressing or decompressing data that
          * shares common patterns with the dictionary.
-         * @since v24.6.0
+         * @since v22.19.0
          */
         dictionary?: NodeJS.ArrayBufferView | undefined;
     }
     interface Zlib {
+        /** @deprecated Use bytesWritten instead. */
+        readonly bytesRead: number;
         readonly bytesWritten: number;
         shell?: boolean | string | undefined;
         close(callback?: () => void): void;
@@ -583,7 +678,70 @@ declare module "node:zlib" {
         const Z_SYNC_FLUSH: number;
         const Z_VERSION_ERROR: number;
     }
+    // Allowed flush values.
+    /** @deprecated Use `constants.Z_NO_FLUSH` */
+    const Z_NO_FLUSH: number;
+    /** @deprecated Use `constants.Z_PARTIAL_FLUSH` */
+    const Z_PARTIAL_FLUSH: number;
+    /** @deprecated Use `constants.Z_SYNC_FLUSH` */
+    const Z_SYNC_FLUSH: number;
+    /** @deprecated Use `constants.Z_FULL_FLUSH` */
+    const Z_FULL_FLUSH: number;
+    /** @deprecated Use `constants.Z_FINISH` */
+    const Z_FINISH: number;
+    /** @deprecated Use `constants.Z_BLOCK` */
+    const Z_BLOCK: number;
+    // Return codes for the compression/decompression functions.
+    // Negative values are errors, positive values are used for special but normal events.
+    /** @deprecated Use `constants.Z_OK` */
+    const Z_OK: number;
+    /** @deprecated Use `constants.Z_STREAM_END` */
+    const Z_STREAM_END: number;
+    /** @deprecated Use `constants.Z_NEED_DICT` */
+    const Z_NEED_DICT: number;
+    /** @deprecated Use `constants.Z_ERRNO` */
+    const Z_ERRNO: number;
+    /** @deprecated Use `constants.Z_STREAM_ERROR` */
+    const Z_STREAM_ERROR: number;
+    /** @deprecated Use `constants.Z_DATA_ERROR` */
+    const Z_DATA_ERROR: number;
+    /** @deprecated Use `constants.Z_MEM_ERROR` */
+    const Z_MEM_ERROR: number;
+    /** @deprecated Use `constants.Z_BUF_ERROR` */
+    const Z_BUF_ERROR: number;
+    /** @deprecated Use `constants.Z_VERSION_ERROR` */
+    const Z_VERSION_ERROR: number;
+    // Compression levels.
+    /** @deprecated Use `constants.Z_NO_COMPRESSION` */
+    const Z_NO_COMPRESSION: number;
+    /** @deprecated Use `constants.Z_BEST_SPEED` */
+    const Z_BEST_SPEED: number;
+    /** @deprecated Use `constants.Z_BEST_COMPRESSION` */
+    const Z_BEST_COMPRESSION: number;
+    /** @deprecated Use `constants.Z_DEFAULT_COMPRESSION` */
+    const Z_DEFAULT_COMPRESSION: number;
+    // Compression strategy.
+    /** @deprecated Use `constants.Z_FILTERED` */
+    const Z_FILTERED: number;
+    /** @deprecated Use `constants.Z_HUFFMAN_ONLY` */
+    const Z_HUFFMAN_ONLY: number;
+    /** @deprecated Use `constants.Z_RLE` */
+    const Z_RLE: number;
+    /** @deprecated Use `constants.Z_FIXED` */
+    const Z_FIXED: number;
+    /** @deprecated Use `constants.Z_DEFAULT_STRATEGY` */
+    const Z_DEFAULT_STRATEGY: number;
+    /** @deprecated */
+    const Z_BINARY: number;
+    /** @deprecated */
+    const Z_TEXT: number;
+    /** @deprecated */
+    const Z_ASCII: number;
+    /** @deprecated  */
+    const Z_UNKNOWN: number;
+    /** @deprecated */
+    const Z_DEFLATED: number;
 }
-declare module "zlib" {
-    export * from "node:zlib";
+declare module "node:zlib" {
+    export * from "zlib";
 }

package/node_modules/express-rate-limit/dist/index.cjs

@@ -297,9 +297,9 @@ var setDraft8Headers = (response, info, windowMs, name, key) => {
   response.append("RateLimit", `"${name}"; ${header}`);
   response.append("RateLimit-Policy", `"${name}"; ${policy}`);
 };
-var setRetryAfterHeader = (response, info, windowMs) => {
+var setRetryAfterHeader = (response, info, windowMs, retryAfter) => {
   if (response.headersSent) return;
-  const resetSeconds = getResetSeconds(windowMs, info.resetTime);
+  const resetSeconds = retryAfter ?? getResetSeconds(windowMs, info.resetTime);
   response.setHeader("Retry-After", resetSeconds.toString());
 };
 
@@ -566,6 +566,7 @@ var validations = {
       legacyHeaders: true,
       standardHeaders: true,
       identifier: true,
+      retryAfter: true,
       requestPropertyName: true,
       skipFailedRequests: true,
       skipSuccessfulRequests: true,
@@ -1050,7 +1051,9 @@ var rateLimit = (passedOptions) => {
         debug("limit exceeded");
         if (config.legacyHeaders || config.standardHeaders) {
           debug("set retry-after header");
-          setRetryAfterHeader(response, info, config.windowMs);
+          const retrieveRetryAfter = typeof config.retryAfter === "function" ? config.retryAfter(request, response) : config.retryAfter;
+          const retryAfter = await retrieveRetryAfter;
+          setRetryAfterHeader(response, info, config.windowMs, retryAfter);
         }
         config.handler(request, response, next, options);
         return;

package/node_modules/express-rate-limit/dist/index.d.cts

@@ -408,6 +408,17 @@ export type Options = {
 	 * Defaults to `{limit}-in-{window}`.
 	 */
 	identifier: string | ValueDeterminingMiddleware<string>;
+	/**
+	 * Method to generate a custom `Retry-After` header value (in seconds) when
+	 * a client is rate limited.
+	 *
+	 * This is advisory only, it customizes what the header says, it does not
+	 * change how long the limiter actually keeps blocking the client for.
+	 * That is still controlled by `windowMs`.
+	 *
+	 * By default, the number of seconds remaining until the window resets.
+	 */
+	retryAfter?: number | ValueDeterminingMiddleware<number>;
 	/**
 	 * The name of the property on the request object to store the rate limit info.
 	 *

package/node_modules/express-rate-limit/dist/index.d.mts

@@ -408,6 +408,17 @@ export type Options = {
 	 * Defaults to `{limit}-in-{window}`.
 	 */
 	identifier: string | ValueDeterminingMiddleware<string>;
+	/**
+	 * Method to generate a custom `Retry-After` header value (in seconds) when
+	 * a client is rate limited.
+	 *
+	 * This is advisory only, it customizes what the header says, it does not
+	 * change how long the limiter actually keeps blocking the client for.
+	 * That is still controlled by `windowMs`.
+	 *
+	 * By default, the number of seconds remaining until the window resets.
+	 */
+	retryAfter?: number | ValueDeterminingMiddleware<number>;
 	/**
 	 * The name of the property on the request object to store the rate limit info.
 	 *

package/node_modules/express-rate-limit/dist/index.d.ts

@@ -408,6 +408,17 @@ export type Options = {
 	 * Defaults to `{limit}-in-{window}`.
 	 */
 	identifier: string | ValueDeterminingMiddleware<string>;
+	/**
+	 * Method to generate a custom `Retry-After` header value (in seconds) when
+	 * a client is rate limited.
+	 *
+	 * This is advisory only, it customizes what the header says, it does not
+	 * change how long the limiter actually keeps blocking the client for.
+	 * That is still controlled by `windowMs`.
+	 *
+	 * By default, the number of seconds remaining until the window resets.
+	 */
+	retryAfter?: number | ValueDeterminingMiddleware<number>;
 	/**
 	 * The name of the property on the request object to store the rate limit info.
 	 *

package/node_modules/express-rate-limit/dist/index.mjs

@@ -254,9 +254,9 @@ var setDraft8Headers = (response, info, windowMs, name, key) => {
   response.append("RateLimit", `"${name}"; ${header}`);
   response.append("RateLimit-Policy", `"${name}"; ${policy}`);
 };
-var setRetryAfterHeader = (response, info, windowMs) => {
+var setRetryAfterHeader = (response, info, windowMs, retryAfter) => {
   if (response.headersSent) return;
-  const resetSeconds = getResetSeconds(windowMs, info.resetTime);
+  const resetSeconds = retryAfter ?? getResetSeconds(windowMs, info.resetTime);
   response.setHeader("Retry-After", resetSeconds.toString());
 };
 
@@ -523,6 +523,7 @@ var validations = {
       legacyHeaders: true,
       standardHeaders: true,
       identifier: true,
+      retryAfter: true,
       requestPropertyName: true,
       skipFailedRequests: true,
       skipSuccessfulRequests: true,
@@ -1007,7 +1008,9 @@ var rateLimit = (passedOptions) => {
         debug("limit exceeded");
         if (config.legacyHeaders || config.standardHeaders) {
           debug("set retry-after header");
-          setRetryAfterHeader(response, info, config.windowMs);
+          const retrieveRetryAfter = typeof config.retryAfter === "function" ? config.retryAfter(request, response) : config.retryAfter;
+          const retryAfter = await retrieveRetryAfter;
+          setRetryAfterHeader(response, info, config.windowMs, retryAfter);
         }
         config.handler(request, response, next, options);
         return;

package/node_modules/express-rate-limit/{license.md → license}

@@ -1,4 +1,4 @@
-# MIT License
+MIT License
 
 Copyright 2023 Nathan Friedly, Vedant K
 
@@ -13,8 +13,9 @@ The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
-FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
-COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
-IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
-CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/node_modules/express-rate-limit/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "express-rate-limit",
-	"version": "8.6.2",
+	"version": "8.7.0",
 	"description": "Basic IP rate-limiting middleware for Express. Use to limit repeated requests to public APIs and/or endpoints such as password reset.",
 	"author": {
 		"name": "Nathan Friedly",
@@ -90,16 +90,16 @@
 		"@types/debug": "4.1.13",
 		"@types/express": "5.0.6",
 		"@types/jest": "30.0.0",
-		"@types/node": "26.1.2",
+		"@types/node": "26.2.0",
 		"@types/supertest": "7.2.1",
 		"del-cli": "7.0.0",
 		"dts-bundle-generator": "8.1.2",
-		"esbuild": "0.28.1",
+		"esbuild": "0.28.2",
 		"express": "5.2.1",
 		"husky": "9.1.7",
 		"jest": "30.4.2",
-		"lint-staged": "17.2.0",
-		"mintlify": "4.2.743",
+		"lint-staged": "17.3.0",
+		"mintlify": "4.2.817",
 		"npm-run-all": "4.1.5",
 		"prettier": "3.9.6",
 		"ratelimit-header-parser": "0.1.0",

package/node_modules/express-rate-limit/readme.md

@@ -5,6 +5,7 @@
 [![tests](https://img.shields.io/github/actions/workflow/status/express-rate-limit/express-rate-limit/ci.yaml)](https://github.com/express-rate-limit/express-rate-limit/actions/workflows/ci.yaml)
 [![npm version](https://img.shields.io/npm/v/express-rate-limit.svg)](https://npmjs.org/package/express-rate-limit 'View this project on NPM')
 [![npm downloads](https://img.shields.io/npm/dm/express-rate-limit)](https://www.npmjs.com/package/express-rate-limit)
+[![inspect.software](https://raw.githubusercontent.com/inspect-software/badges/main/v1/e/express-rate-limit/express-rate-limit.svg)](https://inspect.software/software/express-rate-limit/express-rate-limit)
 [![license](https://img.shields.io/npm/l/express-rate-limit)](license.md)
 
 </div>

package/node_modules/fast-uri/index.js

@@ -324,6 +324,18 @@ function hasMalformedPercentEncoding (component) {
   return false
 }
 
+/**
+ * Whether the host is a bracketed IP literal (RFC 3986 `IP-literal`).
+ * An unterminated `[` is not a literal, so it must still be validated as a
+ * reg-name instead of being waved through as an IP.
+ *
+ * @param {string} host
+ * @returns {boolean}
+ */
+function isIPLiteral (host) {
+  return host[0] === '[' && host[host.length - 1] === ']'
+}
+
 /**
  * @param {RegExpMatchArray} matches
  * @returns {boolean}
@@ -333,7 +345,7 @@ function hasMalformedComponentPercentEncoding (matches) {
   // compatibility. Their parsing is intentionally left to normalizeIPv6.
   const host = matches[4]
   return hasMalformedPercentEncoding(matches[3]) ||
-    (host !== undefined && !(host[0] === '[' && host[host.length - 1] === ']') && hasMalformedPercentEncoding(host)) ||
+    (host !== undefined && !isIPLiteral(host) && hasMalformedPercentEncoding(host)) ||
     hasMalformedPercentEncoding(matches[6]) ||
     hasMalformedPercentEncoding(matches[7]) ||
     hasMalformedPercentEncoding(matches[8])
@@ -351,7 +363,7 @@ function canonicalizeHost (parsed, options, schemeHandler, isIP) {
     !options.unicodeSupport &&
     (!schemeHandler || !schemeHandler.unicodeSupport) &&
     parsed.host &&
-    parsed.host[0] !== '[' &&
+    !isIPLiteral(parsed.host) &&
     (options.domainHost || (schemeHandler && schemeHandler.domainHost)) &&
     isIP === false &&
     nonSimpleDomain(parsed.host)
@@ -476,10 +488,11 @@ function parseWithStatus (uri, opts) {
     if (parsed.host) {
       const ipv4result = isIPv4(parsed.host)
       if (ipv4result === false) {
-        const bracketedIPLiteral = parsed.host[0] === '[' && parsed.host[parsed.host.length - 1] === ']'
+        const bracketedIPLiteral = isIPLiteral(parsed.host)
+        const hasIPLiteralBracket = parsed.host.indexOf('[') !== -1 || parsed.host.indexOf(']') !== -1
         const ipv6result = normalizeIPv6(parsed.host)
         isIP = ipv6result.isIPV6 || ipv6result.isIPVFuture === true
-        malformedIPLiteral = bracketedIPLiteral && ipv6result.error === true
+        malformedIPLiteral = hasIPLiteralBracket && (!bracketedIPLiteral || ipv6result.error === true)
         parsed.host = isIP ? ipv6result.host : ipv6result.host.toLowerCase()
 
         if (malformedIPLiteral) {
@@ -509,7 +522,9 @@ function parseWithStatus (uri, opts) {
     const schemeHandler = getSchemeHandler(options.scheme || parsed.scheme)
 
     // convert Unicode IDN -> ASCII IDN when the effective scheme uses domain hosts
-    malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP)
+    if (!malformedIPLiteral) {
+      malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP)
+    }
 
     if (!schemeHandler || (schemeHandler && !schemeHandler.skipNormalize)) {
       if (uri.indexOf('%') !== -1) {

package/node_modules/fast-uri/lib/utils.js

@@ -6,6 +6,9 @@ const isUUID = RegExp.prototype.test.bind(/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\d
 /** @type {(value: string) => boolean} */
 const isIPv4 = RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u)
 
+/** @type {(value: string) => boolean} */
+const isPort = RegExp.prototype.test.bind(/^\d*$/u)
+
 /** @type {(value: string) => boolean} */
 const isHexPair = RegExp.prototype.test.bind(/^[\da-f]{2}$/iu)
 
@@ -713,8 +716,12 @@ function recomposeAuthority (component) {
   }
 
   if (typeof component.port === 'number' || typeof component.port === 'string') {
+    const port = String(component.port)
+    if (!isPort(port)) {
+      throw new TypeError('URI port is malformed.')
+    }
     uriTokens.push(':')
-    uriTokens.push(String(component.port))
+    uriTokens.push(port)
   }
 
   return uriTokens.length ? uriTokens.join('') : undefined

package/node_modules/fast-uri/package.json

@@ -1,7 +1,7 @@
 {
   "name": "fast-uri",
   "description": "Dependency-free RFC 3986 URI toolbox",
-  "version": "3.1.6",
+  "version": "3.1.7",
   "main": "index.js",
   "type": "commonjs",
   "types": "types/index.d.ts",

package/node_modules/fast-uri/test/component-safe-serialization.test.js

@@ -24,6 +24,64 @@ test('userinfo serialization cannot terminate the authority', (t) => {
   t.end()
 })
 
+test('port serialization rejects non-digit values', (t) => {
+  const malformedPorts = [
+    '@127.0.0.1:8124',
+    '8080@evil.example',
+    '8080/path',
+    '8080?query',
+    '8080#fragment',
+    '8080:9000',
+    '-1',
+    '1.5',
+    1.5,
+    NaN,
+    Infinity,
+    '\u0661'
+  ]
+
+  for (const port of malformedPorts) {
+    t.throws(
+      () => fastURI.serialize({ scheme: 'http', host: 'trusted.example', port, path: '/app' }),
+      /URI port is malformed\./,
+      String(port)
+    )
+  }
+
+  t.throws(
+    () => fastURI.normalize({ scheme: 'http', host: 'trusted.example', port: '@evil.example' }),
+    /URI port is malformed\./,
+    'object normalization rejects a malformed port'
+  )
+  t.equal(
+    fastURI.equal(
+      { scheme: 'http', host: 'trusted.example', port: '@evil.example' },
+      { scheme: 'http', host: 'trusted.example', port: '@evil.example' }
+    ),
+    false,
+    'object equality fails closed for a malformed port'
+  )
+  t.end()
+})
+
+test('port serialization preserves RFC 3986 digit values', (t) => {
+  const validPorts = [
+    [8080, '8080'],
+    ['8080', '8080'],
+    ['00080', '00080'],
+    ['', '']
+  ]
+
+  for (const [port, expected] of validPorts) {
+    t.equal(
+      fastURI.serialize({ scheme: 'uri', host: 'example.test', port }),
+      `uri://example.test:${expected}`,
+      JSON.stringify(port)
+    )
+  }
+  t.end()
+})
+
 test('query and fragment serialization cannot inject component delimiters', (t) => {
   const uri = fastURI.serialize({
     scheme: 'x',

package/node_modules/fast-uri/test/ipv6-validation.test.js

@@ -88,3 +88,37 @@ test('valid IPv6, IPvFuture, embedded IPv4, and zone forms normalize safely', (t
   }
   t.end()
 })
+
+test('hosts with unbalanced or misplaced IP-literal brackets are rejected', (t) => {
+  const malformed = [
+    'http://[fe80',
+    'http://[',
+    'http://[not-an-ip',
+    'http://[\u65e5\u672c',
+    'http://user@[@127.0.0.1:8123/admin',
+    'http://user@]127.0.0.1:8123/admin',
+    'http://user@prefix[@127.0.0.1:8123/admin',
+    'http://user@prefix]@127.0.0.1:8123/admin'
+  ]
+  const modes = [
+    ['default', undefined],
+    ['Unicode', { unicodeSupport: true }]
+  ]
+
+  for (const [mode, options] of modes) {
+    for (const uri of malformed) {
+      const parsed = fastURI.parse(uri, options)
+      const message = `${mode} mode rejects ${uri}`
+
+      t.equal(parsed.error, HOST_ERROR, `parse ${message}`)
+      t.equal(fastURI.normalize(uri, options), uri, `normalize preserves ${uri} in ${mode} mode`)
+      t.equal(fastURI.equal(uri, uri, options), false, `equal ${message}`)
+      t.throws(
+        () => fastURI.resolve('http://example.com/', uri, options),
+        /URI host is malformed\./,
+        `resolve ${message}`
+      )
+    }
+  }
+  t.end()
+})

package/node_modules/hono/dist/cjs/client/client.js

@@ -157,24 +157,24 @@ const hc = (baseUrl, options) => createProxy(function proxyCallback(opts) {
   const path = parts.join("/");
   const url = (0, import_utils.mergePath)(baseUrl, path);
   if (method === "url" || method === "path") {
-    let result = url;
+    let result = (0, import_utils.removeIndexString)(url);
     if (opts.args[0]) {
       if (opts.args[0].param) {
-        result = (0, import_utils.replaceUrlParam)(url, opts.args[0].param);
+        result = (0, import_utils.replaceUrlParam)(result, opts.args[0].param);
       }
       if (opts.args[0].query) {
         result = appendQueryParams(result, buildSearchParamsOption(opts.args[0].query));
       }
     }
-    result = (0, import_utils.removeIndexString)(result);
     if (method === "url") {
       return new URL(result);
     }
     return result.slice(baseUrl.replace(/\/+$/, "").length).replace(/^\/?/, "/");
   }
   if (method === "ws") {
+    const normalizedUrl = (0, import_utils.removeIndexString)(url);
     const webSocketUrl = (0, import_utils.replaceUrlProtocol)(
-      opts.args[0]?.param ? (0, import_utils.replaceUrlParam)(url, opts.args[0].param) : url,
+      opts.args[0]?.param ? (0, import_utils.replaceUrlParam)(normalizedUrl, opts.args[0].param) : normalizedUrl,
       "ws"
     );
     const targetUrl = new URL(webSocketUrl);

package/node_modules/hono/dist/cjs/hono-base.js

@@ -61,13 +61,14 @@ class Hono {
     const allMethods = [...import_router.METHODS, import_router.METHOD_NAME_ALL_LOWERCASE];
     allMethods.forEach((method) => {
       this[method] = (args1, ...args) => {
+        const methodName = method.toUpperCase();
         if (typeof args1 === "string") {
           this.#path = args1;
         } else {
-          this.#addRoute(method, this.#path, args1);
+          this.#addRoute(methodName, this.#path, args1);
         }
         args.forEach((handler) => {
-          this.#addRoute(method, this.#path, handler);
+          this.#addRoute(methodName, this.#path, handler);
         });
         return this;
       };
@@ -76,9 +77,10 @@ class Hono {
       for (const p of [path].flat()) {
         this.#path = p;
         for (const m of [method].flat()) {
-          handlers.map((handler) => {
-            this.#addRoute(m.toUpperCase(), this.#path, handler);
-          });
+          const methodName = m.toUpperCase();
+          for (const handler of handlers) {
+            this.#addRoute(methodName, this.#path, handler);
+          }
         }
       }
       return this;
@@ -279,7 +281,6 @@ class Hono {
     return this;
   }
   #addRoute(method, path, handler, baseRoutePath) {
-    method = method.toUpperCase();
     path = (0, import_url.mergePath)(this._basePath, path);
     const r = {
       basePath: baseRoutePath !== void 0 ? (0, import_url.mergePath)(this._basePath, baseRoutePath) : this._basePath,