@zuplo/cli 6.74.10 → 6.74.12

package/node_modules/@zuplo/runtime/out/types/index.d.ts

@@ -3162,6 +3162,168 @@ declare interface Category {
   Attribute: Attribute_2[];
 }
 
+/**
+ * How to combine the configured client policy with a `Cache-Control` the upstream already sent. `strictest` (default) emits the more conservative of the two — the lower `max-age` and the union of restrictive directives. `replace` overwrites whatever upstream sent. `preserve` leaves the upstream header untouched and only adds the CDN headers.
+ * @public
+ */
+declare type CdnCacheControlClientMode = "strictest" | "replace" | "preserve";
+
+/**
+ * The `Cache-Control` sent to the browser or app. Separate from `edge` so the CDN can absorb load without clients holding stale data.
+ * @public
+ */
+declare interface CdnCacheControlClientOptions {
+  /**
+   * Seconds the client may reuse this response. Omit to send no `max-age`.
+   */
+  maxAge?: number;
+  visibility?: CdnCacheControlClientVisibility;
+  /**
+   * Adds `no-cache`, so the client must revalidate before reusing the response. Distinct from `visibility: no-store`, which forbids storing it at all.
+   */
+  noCache?: boolean;
+  /**
+   * Adds `must-revalidate`, so the client may not serve the response once stale.
+   */
+  mustRevalidate?: boolean;
+  mode?: CdnCacheControlClientMode;
+}
+
+/**
+ * `public` allows any cache to store the response, `private` restricts it to the client's own cache, `no-store` forbids client caching entirely. With `strategy: targeted` a `private`/`no-store` client policy still permits edge caching, because the CDN reads its own header.
+ * @public
+ */
+declare type CdnCacheControlClientVisibility =
+  | "public"
+  | "private"
+  | "no-store";
+
+/**
+ * A cache policy for one response: what the static options normalise into, and
+ * what a `cacheConfig` function returns.
+ *
+ * A function's return value **replaces** this wholesale rather than being merged
+ * field by field. Returning nothing falls back to the static options, which is
+ * how a route enforces defaults and overrides them in only the few cases that
+ * need it.
+ */
+export declare interface CdnCacheControlConfig {
+  /** Set to false to emit no edge headers or tags for this response. */
+  cache?: boolean;
+  edge?: EdgeCacheDirectives;
+  client?: ClientCacheDirectives;
+  tags?: string[];
+}
+
+/**
+ * A `cacheConfig` function: returns the CDN cache policy for one response.
+ *
+ * Return `undefined` or `null` to fall back to the static options, which is how
+ * a route enforces defaults and overrides them only where it needs to.
+ *
+ * @public
+ */
+export declare type CdnCacheControlConfigFn = (
+  response: Response,
+  request: ZuploRequest,
+  context: ZuploContext
+) =>
+  | CdnCacheControlConfig
+  | undefined
+  | null
+  | Promise<CdnCacheControlConfig | undefined | null>;
+
+/**
+ * A function that overrides the cache configuration per response, for rules that cannot be expressed statically (per-entity purge tags, a TTL that depends on a response header, or skipping an empty result set). Returning nothing (`undefined` or `null`) falls back to the `edge`, `client` and `tags` options, so those stay the enforced default and the function only handles exceptions. A returned config **replaces** those options wholesale rather than being merged directive by directive, so include every directive the response needs. Return `{ cache: false }` to skip caching a response entirely — note that also sends `Cache-Control: no-store` to the client unless `client.mode` is `preserve`. The function receives the live response: it must not consume the body, and should call `response.clone()` if it needs to read it.
+ * @public
+ */
+declare interface CdnCacheControlConfigFunction {
+  /**
+   * Specifies the export that holds your cache config function, e.g. `default`, `cdnCacheConfig`.
+   */
+  export: string;
+  /**
+   * Specifies the module that holds your cache config function, in the format `$import(./modules/my-module)`.
+   */
+  module: string;
+}
+
+/**
+ * How long the CDN may serve this response. These directives are sent only to the CDN, never to the browser (unless `strategy` is `s-maxage`).
+ * @public
+ */
+declare interface CdnCacheControlEdgeOptions {
+  /**
+   * Seconds the CDN may serve this response without revalidating.
+   */
+  maxAge: number;
+  /**
+   * Seconds the CDN may keep serving a stale response while it revalidates in the background. Not expressible in Akamai's `Edge-Control` — configure it in Property Manager, or use `strategy: s-maxage`.
+   */
+  staleWhileRevalidate?: number;
+  /**
+   * Seconds the CDN may serve a stale response when the gateway returns an error. Not expressible in Akamai's `Edge-Control` — configure it in Property Manager, or use `strategy: s-maxage`.
+   */
+  staleIfError?: number;
+}
+
+/**
+ * Sets the response headers that tell a CDN how long it may cache a response and
+ * which purge tags it belongs to, separately from what the browser is told.
+ *
+ * @title CDN Cache Control
+ * @product api-gateway
+ * @public
+ * @param response - The Response
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Response
+ */
+export declare const CdnCacheControlOutboundPolicy: OutboundPolicyHandler<CdnCacheControlOutboundPolicyOptions>;
+
+/**
+ * The options for this policy.
+ * @public
+ */
+export declare interface CdnCacheControlOutboundPolicyOptions {
+  cdn: CdnCacheControlVendor;
+  strategy?: CdnCacheControlStrategy;
+  edge?: CdnCacheControlEdgeOptions;
+  client?: CdnCacheControlClientOptions;
+  /**
+   * Purge tags, rendered in the target CDN's format: comma-joined `Edge-Cache-Tag` (Akamai), space-joined `Surrogate-Key` (Fastly), comma-joined `Cache-Tag` (Cloudflare). CloudFront has no tag purge and rejects this option. Tags are validated against the CDN's length and character limits, because an over-long tag header is silently truncated rather than rejected.
+   */
+  tags?: string[];
+  /**
+   * Request headers that vary this response, unioned with any `Vary` the upstream already sent and emitted as `Vary`. The union is deliberate: replacing an upstream `Vary: Authorization` would stop a shared cache keying on it and let it serve one user's response to another. Off by default: Akamai skips caching any response carrying `Vary` until Cache ID Modification is configured, so enabling this can silently disable edge caching entirely.
+   */
+  vary?: string[];
+  /**
+   * When true (default), an upstream `Cache-Control` of `no-store`/`no-cache`/`private`, or a `Set-Cookie` on the response, suppresses all edge headers and purge tags. This keeps the application's ability to mark a response uncacheable. Set to false to override it — on Akamai this emits `Edge-Control: !no-store`.
+   */
+  respectUpstream?: boolean;
+  cacheConfig?: CdnCacheControlConfigFunction;
+}
+
+/**
+ * How the edge TTL is carried. `targeted` uses the CDN's own header (`Edge-Control`, `Surrogate-Control`, `CDN-Cache-Control`) and is the only way to cache at the edge without also caching in the browser. `s-maxage` folds the edge TTL into `Cache-Control` instead, for a property that honors origin `Cache-Control` but not the targeted header. Defaults to `targeted`, except on a CDN that reads no targeted header — CloudFront defaults to `s-maxage`, which is the only thing it supports.
+ * @public
+ */
+declare type CdnCacheControlStrategy = "targeted" | "s-maxage";
+
+/**
+ * The CDN in front of this gateway. Required, with no default — each CDN reads a different header for shared-cache TTL and purge tags, and a wrong guess fails silently. Use `generic` for an RFC 9213 CDN that is not listed.
+ * @public
+ */
+declare type CdnCacheControlVendor =
+  | "akamai"
+  | "fastly"
+  | "cloudflare"
+  | "cloudfront"
+  | "generic";
+
 /**
  * Changes the HTTP method of the incoming request.
  *
@@ -3388,6 +3550,14 @@ export declare interface ClerkJwtInboundPolicyOptions {
   oAuthResourceMetadataEnabled?: boolean;
 }
 
+/** The client (browser/app) half of the policy. */
+export declare interface ClientCacheDirectives {
+  maxAge?: number;
+  visibility?: CdnCacheControlClientVisibility;
+  mustRevalidate?: boolean;
+  noCache?: boolean;
+}
+
 /**
  * Authentication options for OIDC authentication.
  * @public
@@ -4603,6 +4773,13 @@ export declare class DynatraceMetricsPlugin extends MetricsPlugin {
   static setContext(context: ZuploContext, data: DynatraceMetricsContext): void;
 }
 
+/** The edge (shared cache) half of the policy. */
+export declare interface EdgeCacheDirectives {
+  maxAge: number;
+  staleWhileRevalidate?: number;
+  staleIfError?: number;
+}
+
 declare interface EmbeddingsFallbacks {
   fallback?: FallbackModel;
   quotaFallback?: QuotaFallbackModel;

package/node_modules/@zuplo/runtime/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zuplo/runtime",
   "type": "module",
-  "version": "6.74.10",
+  "version": "6.74.12",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "exports": {

package/node_modules/hono/dist/cjs/context.js

@@ -295,11 +295,11 @@ class Context {
     return Object.fromEntries(this.#var);
   }
   #newResponse(data, arg, headers) {
-    const responseHeaders = this.#res ? new Headers(this.#res.headers) : this.#preparedHeaders ?? new Headers();
-    if (typeof arg === "object" && "headers" in arg) {
-      const argHeaders = arg.headers instanceof Headers ? arg.headers : new Headers(arg.headers);
-      for (const [key, value] of argHeaders) {
-        if (key.toLowerCase() === "set-cookie") {
+    let responseHeaders = this.#res ? new Headers(this.#res.headers) : this.#preparedHeaders;
+    if (typeof arg === "object" && arg.headers) {
+      responseHeaders ??= new Headers();
+      for (const [key, value] of new Headers(arg.headers)) {
+        if (key === "set-cookie") {
           responseHeaders.append(key, value);
         } else {
           responseHeaders.set(key, value);
@@ -307,19 +307,34 @@ class Context {
       }
     }
     if (headers) {
-      for (const [k, v] of Object.entries(headers)) {
-        if (typeof v === "string") {
-          responseHeaders.set(k, v);
-        } else {
-          responseHeaders.delete(k);
-          for (const v2 of v) {
-            responseHeaders.append(k, v2);
+      if (!responseHeaders) {
+        let count = 0;
+        for (const k in headers) {
+          if (++count > 1 || typeof headers[k] !== "string") {
+            responseHeaders = new Headers();
+            break;
+          }
+        }
+      }
+      if (responseHeaders) {
+        for (const k in headers) {
+          const v = headers[k];
+          if (typeof v === "string") {
+            responseHeaders.set(k, v);
+          } else {
+            responseHeaders.delete(k);
+            for (const v2 of v) {
+              responseHeaders.append(k, v2);
+            }
           }
         }
       }
     }
     const status = typeof arg === "number" ? arg : arg?.status ?? this.#status;
-    return createResponseInstance(data, { status, headers: responseHeaders });
+    return createResponseInstance(data, {
+      status,
+      headers: responseHeaders ?? headers
+    });
   }
   newResponse = (...args) => this.#newResponse(...args);
   /**

package/node_modules/hono/dist/cjs/hono-base.js

@@ -43,6 +43,7 @@ class Hono {
   delete;
   options;
   patch;
+  query;
   all;
   on;
   use;
@@ -342,8 +343,8 @@ class Hono {
    * @see {@link https://hono.dev/docs/api/hono#fetch}
    *
    * @param {Request} request - request Object of request
-   * @param {Env} Env - env Object
-   * @param {ExecutionContext} - context of execution
+   * @param {Env} env - env Object
+   * @param {ExecutionContext} executionCtx - context of execution
    * @returns {Response | Promise<Response>} response of request
    *
    */

package/node_modules/hono/dist/cjs/jsx/base.js

@@ -100,6 +100,18 @@ const booleanAttributes = [
   "reversed",
   "selected"
 ];
+const resolveFunctionComponentResult = (result, suspendedContext) => result.then((resolved) => {
+  if (!Array.isArray(resolved) && !(resolved instanceof JSXNode)) {
+    return resolved;
+  }
+  const children = Array.isArray(resolved) ? resolved : [resolved];
+  const render = () => {
+    const buffer = [""];
+    childrenToStringToBuffer(children, buffer);
+    return buffer.length === 1 ? (0, import_html.raw)(buffer[0], buffer.callbacks) : (0, import_html2.stringBufferToString)(buffer, buffer.callbacks);
+  };
+  return suspendedContext ? suspendedContext(render) : (0, import_context.runWithRenderContext)(render);
+});
 const childrenToStringToBuffer = (children, buffer) => {
   for (let i = 0, len = children.length; i < len; i++) {
     const child = children[i];
@@ -109,9 +121,17 @@ const childrenToStringToBuffer = (children, buffer) => {
       continue;
     } else if (child instanceof JSXNode) {
       child.toStringToBuffer(buffer);
-    } else if (typeof child === "number" || child.isEscaped) {
+    } else if (typeof child === "number") {
       ;
       buffer[0] += child;
+    } else if (child.isEscaped) {
+      ;
+      buffer[0] += child;
+      const callbacks = child.callbacks;
+      if (callbacks) {
+        buffer.callbacks ||= [];
+        buffer.callbacks.push(...callbacks);
+      }
     } else if (child instanceof Promise) {
       buffer.unshift("", child);
     } else {
@@ -125,7 +145,6 @@ class JSXNode {
   key;
   children;
   isEscaped = true;
-  suspendedContext;
   constructor(tag, props, children) {
     if (typeof tag !== "function" && !(0, import_utils.isValidTagName)(tag)) {
       throw new Error(`Invalid JSX tag name: ${tag}`);
@@ -148,7 +167,7 @@ class JSXNode {
       this.toStringToBuffer(buffer);
       return buffer.length === 1 ? "callbacks" in buffer ? (0, import_html2.resolveCallbackSync)((0, import_html.raw)(buffer[0], buffer.callbacks)).toString() : buffer[0] : (0, import_html2.stringBufferToString)(buffer, buffer.callbacks);
     };
-    return this.suspendedContext ? this.suspendedContext(render) : (0, import_context.runWithRenderContext)(render);
+    return (0, import_context.runWithRenderContext)(render);
   }
   toStringToBuffer(buffer) {
     const tag = this.tag;
@@ -222,21 +241,14 @@ class JSXFunctionNode extends JSXNode {
       return;
     } else if (res instanceof Promise) {
       if (import_context.globalContexts.length === 0) {
-        buffer.unshift("", res);
+        buffer.unshift("", resolveFunctionComponentResult(res));
       } else {
-        const suspendedContext = (0, import_context.captureRenderContext)();
-        buffer.unshift(
-          "",
-          res.then((childRes) => {
-            if (childRes instanceof JSXNode) {
-              childRes.suspendedContext = suspendedContext;
-            }
-            return childRes;
-          })
-        );
+        buffer.unshift("", resolveFunctionComponentResult(res, (0, import_context.captureRenderContext)()));
       }
     } else if (res instanceof JSXNode) {
       res.toStringToBuffer(buffer);
+    } else if (Array.isArray(res)) {
+      childrenToStringToBuffer(res, buffer);
     } else if (typeof res === "number" || res.isEscaped) {
       buffer[0] += res;
       if (res.callbacks) {

package/node_modules/hono/dist/cjs/jsx/hooks/index.js

@@ -263,7 +263,7 @@ const useCallback = (callback, deps) => {
   }
   return callback;
 };
-const useRef = (initialValue) => {
+function useRef(initialValue) {
   const buildData = import_render.buildDataStack.at(-1);
   if (!buildData) {
     return { current: initialValue };
@@ -272,7 +272,7 @@ const useRef = (initialValue) => {
   const refArray = node[import_constants.DOM_STASH][1][STASH_REF] ||= [];
   const hookIndex = node[import_constants.DOM_STASH][0]++;
   return refArray[hookIndex] ||= { current: initialValue };
-};
+}
 const use = (promise) => {
   const cachedRes = resolvedPromiseValueMap.get(promise);
   if (cachedRes) {

package/node_modules/hono/dist/cjs/middleware/cache/index.js

@@ -20,7 +20,21 @@ __export(cache_exports, {
   cache: () => cache
 });
 module.exports = __toCommonJS(cache_exports);
+var import_request = require("../../request");
+var import_crypto = require("../../utils/crypto");
 const defaultCacheableStatusCodes = [200];
+const defaultMaxQueryBodySize = 64 * 1024;
+const cacheKeyPath = "/.hono/cache";
+const cacheKeyParameter = "__hono_cache_key";
+const cacheMethodKeyParameter = "__hono_cache_method";
+const queryDigestKeyParameter = "__hono_query_digest";
+const cacheVaryKeyParameter = "__hono_cache_vary";
+const queryRepresentationMetadataHeaders = [
+  "content-type",
+  "content-encoding",
+  "content-language",
+  "content-location"
+];
 const shouldSkipCacheControl = (cacheControl) => !!cacheControl && /(?:^|,\s*)(?:private|no-(?:store|cache))(?:\s*(?:=|,|$))/i.test(cacheControl);
 const parseVaryDirectives = (vary) => {
   if (vary == null) {
@@ -28,17 +42,86 @@ const parseVaryDirectives = (vary) => {
   }
   return (Array.isArray(vary) ? vary : vary.split(",")).map((directive) => directive.trim().toLowerCase()).filter(Boolean);
 };
+const createCacheKey = (key, requestUrl, request, varyHeaders) => {
+  const url = new URL(cacheKeyPath, requestUrl);
+  url.searchParams.append(cacheKeyParameter, key.split("#", 1)[0]);
+  url.searchParams.append(cacheMethodKeyParameter, request.method);
+  if (request.method === "QUERY") {
+    url.searchParams.append(queryDigestKeyParameter, request.digest);
+  }
+  for (const header of varyHeaders) {
+    url.searchParams.append(cacheVaryKeyParameter, JSON.stringify(header));
+  }
+  return url.href;
+};
 const shouldSkipCache = (res, optionsVaryDirectives, responseVary) => responseVary.length && (!optionsVaryDirectives || responseVary.some((name) => !optionsVaryDirectives.has(name))) || shouldSkipCacheControl(res.headers.get("Cache-Control")) || res.headers.has("Set-Cookie");
+const reportCacheNotAvailable = (onCacheNotAvailable, reason) => {
+  if (onCacheNotAvailable === false) {
+  } else if (onCacheNotAvailable) {
+    onCacheNotAvailable(reason);
+  } else {
+    console.log(reason);
+  }
+};
+const createQueryDigest = async (c, maxQueryBodySize) => {
+  if (!globalThis.crypto?.subtle) {
+    return void 0;
+  }
+  if (c.req.raw.bodyUsed && Object.keys(c.req.bodyCache)[0] === "formData") {
+    return void 0;
+  }
+  try {
+    const requestHeaders = c.req.raw.headers;
+    const metadata = new TextEncoder().encode(
+      JSON.stringify(
+        queryRepresentationMetadataHeaders.map((header) => [header, requestHeaders.get(header)])
+      )
+    );
+    const body = (await (0, import_request.cloneRawRequest)(c.req)).body;
+    const chunks = [];
+    let bodySize = 0;
+    if (body) {
+      const reader = body.getReader();
+      for (; ; ) {
+        const { done, value } = await reader.read();
+        if (done) {
+          break;
+        }
+        bodySize += value.byteLength;
+        if (bodySize > maxQueryBodySize) {
+          void reader.cancel().catch(() => {
+          });
+          return void 0;
+        }
+        chunks.push(value);
+      }
+    }
+    const data = new Uint8Array(metadata.byteLength + bodySize);
+    data.set(metadata);
+    let offset = metadata.byteLength;
+    for (const chunk of chunks) {
+      data.set(chunk, offset);
+      offset += chunk.byteLength;
+    }
+    return await (0, import_crypto.sha256)(data) ?? void 0;
+  } catch {
+    return void 0;
+  }
+};
 const cache = (options) => {
   if (!globalThis.caches) {
-    if (options.onCacheNotAvailable === false) {
-    } else if (options.onCacheNotAvailable) {
-      options.onCacheNotAvailable();
-    } else {
-      console.log("Cache Middleware is not enabled because caches is not defined.");
-    }
+    reportCacheNotAvailable(
+      options.onCacheNotAvailable,
+      "Cache Middleware is not enabled because caches is not defined."
+    );
     return async (_c, next) => await next();
   }
+  if (!globalThis.crypto?.subtle) {
+    reportCacheNotAvailable(
+      options.onCacheNotAvailable,
+      "Cache Middleware cannot cache QUERY requests because Web Crypto is not available."
+    );
+  }
   if (options.wait === void 0) {
     options.wait = false;
   }
@@ -53,6 +136,7 @@ const cache = (options) => {
   const cacheableStatusCodes = new Set(
     options.cacheableStatusCodes ?? defaultCacheableStatusCodes
   );
+  const maxQueryBodySize = options.maxQueryBodySize ?? defaultMaxQueryBodySize;
   const addHeader = (c, responseVary) => {
     if (cacheControlDirectives) {
       const existingDirectives = c.res.headers.get("Cache-Control")?.split(",").map((d) => d.trim().split("=", 1)[0].toLowerCase()) ?? [];
@@ -81,20 +165,31 @@ const cache = (options) => {
     }
   };
   return async function cache2(c, next) {
-    if (c.req.method !== "GET" || c.req.raw.headers.has("Authorization")) {
+    if (c.req.method !== "GET" && c.req.method !== "QUERY" || c.req.raw.headers.has("Authorization")) {
       await next();
       return;
     }
+    let cacheKeyRequest = { method: "GET" };
+    if (c.req.method === "QUERY") {
+      const digest = await createQueryDigest(c, maxQueryBodySize);
+      if (digest === void 0) {
+        await next();
+        return;
+      }
+      cacheKeyRequest = { method: "QUERY", digest };
+    }
     let key = c.req.url;
     if (options.keyGenerator) {
       key = await options.keyGenerator(c);
     }
+    const varyHeaders = [];
     if (varyDirectives) {
       for (const directive of varyDirectives) {
         const value = c.req.raw.headers.get(directive) ?? "";
-        key += `::${directive}=${encodeURIComponent(value)}`;
+        varyHeaders.push([directive, value]);
       }
     }
+    key = createCacheKey(key, c.req.url, cacheKeyRequest, varyHeaders);
     const cacheName = typeof options.cacheName === "function" ? await options.cacheName(c) : options.cacheName;
     const cache3 = await caches.open(cacheName);
     const response = await cache3.match(key);

package/node_modules/hono/dist/cjs/middleware/compress/index.js

@@ -43,6 +43,7 @@ const selectEncoding = (header, candidates) => {
   }
   return best?.encoding;
 };
+const varyAcceptEncodingRegExp = /(?:^|,)\s*accept-encoding\s*(?:,|$)/i;
 const compress = (options) => {
   const threshold = options?.threshold ?? 1024;
   const candidates = options?.encoding ? [options.encoding] : ENCODING_TYPES;
@@ -66,6 +67,10 @@ const compress = (options) => {
     !shouldTransform(ctx.res)) {
       return;
     }
+    const current = ctx.res.headers.get("Vary");
+    if (current !== "*" && !(current && varyAcceptEncodingRegExp.test(current))) {
+      ctx.header("Vary", current ? `${current}, Accept-Encoding` : "Accept-Encoding");
+    }
     const accepted = ctx.req.header("Accept-Encoding");
     const encoding = selectEncoding(accepted, candidates);
     if (!encoding || !ctx.res.body) {

package/node_modules/hono/dist/cjs/middleware/cors/index.js

@@ -23,7 +23,7 @@ module.exports = __toCommonJS(cors_exports);
 const cors = (options) => {
   const opts = {
     origin: "*",
-    allowMethods: ["GET", "HEAD", "PUT", "POST", "DELETE", "PATCH"],
+    allowMethods: ["GET", "HEAD", "PUT", "POST", "DELETE", "PATCH", "QUERY"],
     allowHeaders: [],
     exposeHeaders: [],
     ...options

package/node_modules/hono/dist/cjs/middleware/etag/index.js

@@ -70,7 +70,7 @@ const etag = (options) => {
       }
       etag3 = weak ? `W/"${hash}"` : `"${hash}"`;
     }
-    const matched = ifNoneMatch === "*" ? (c.req.method === "GET" || c.req.method === "HEAD") && res.ok : etagMatches(etag3, ifNoneMatch);
+    const matched = ifNoneMatch === "*" ? (c.req.method === "GET" || c.req.method === "HEAD" || c.req.method === "QUERY") && res.ok : etagMatches(etag3, ifNoneMatch);
     if (matched) {
       c.res = new Response(null, {
         status: 304,

package/node_modules/hono/dist/cjs/middleware/jwk/jwk.js

@@ -45,7 +45,8 @@ const jwk = (options, init) => {
           res: unauthorizedResponse({
             ctx,
             error: "invalid_request",
-            errDescription
+            errDescription,
+            realm: options.realm
           })
         });
       } else {
@@ -83,7 +84,8 @@ const jwk = (options, init) => {
         res: unauthorizedResponse({
           ctx,
           error: "invalid_request",
-          errDescription
+          errDescription,
+          realm: options.realm
         })
       });
     }
@@ -110,7 +112,8 @@ const jwk = (options, init) => {
           ctx,
           error: "invalid_token",
           statusText: "Unauthorized",
-          errDescription: "token verification failure"
+          errDescription: "token verification failure",
+          realm: options.realm
         }),
         cause
       });
@@ -120,11 +123,13 @@ const jwk = (options, init) => {
   };
 };
 function unauthorizedResponse(opts) {
+  const realm = (opts.realm ?? opts.ctx.req.url).replace(/"/g, '\\"');
+  const errDescription = opts.errDescription.replace(/"/g, '\\"');
   return new Response("Unauthorized", {
     status: 401,
     statusText: opts.statusText,
     headers: {
-      "WWW-Authenticate": `Bearer realm="${opts.ctx.req.url}",error="${opts.error}",error_description="${opts.errDescription}"`
+      "WWW-Authenticate": `Bearer realm="${realm}",error="${opts.error}",error_description="${errDescription}"`
     }
   });
 }

package/node_modules/hono/dist/cjs/middleware/jwt/jwt.js

@@ -52,7 +52,8 @@ const jwt = (options) => {
           res: unauthorizedResponse({
             ctx,
             error: "invalid_request",
-            errDescription
+            errDescription,
+            realm: options.realm
           })
         });
       } else {
@@ -87,7 +88,8 @@ const jwt = (options) => {
         res: unauthorizedResponse({
           ctx,
           error: "invalid_request",
-          errDescription
+          errDescription,
+          realm: options.realm
         })
       });
     }
@@ -108,7 +110,8 @@ const jwt = (options) => {
           ctx,
           error: "invalid_token",
           statusText: "Unauthorized",
-          errDescription: "token verification failure"
+          errDescription: "token verification failure",
+          realm: options.realm
         }),
         cause
       });
@@ -118,11 +121,13 @@ const jwt = (options) => {
   };
 };
 function unauthorizedResponse(opts) {
+  const realm = (opts.realm ?? opts.ctx.req.url).replace(/"/g, '\\"');
+  const errDescription = opts.errDescription.replace(/"/g, '\\"');
   return new Response("Unauthorized", {
     status: 401,
     statusText: opts.statusText,
     headers: {
-      "WWW-Authenticate": `Bearer realm="${opts.ctx.req.url}",error="${opts.error}",error_description="${opts.errDescription}"`
+      "WWW-Authenticate": `Bearer realm="${realm}",error="${opts.error}",error_description="${errDescription}"`
     }
   });
 }