->withMiddleware(function (Middleware $middleware) {
    $middleware->statefulApi();
})

/**
 * Indicate that Sanctum's frontend state middleware should be enabled.
 *
 * @return $this
 */
public function statefulApi()
{
    $this->statefulApi = true;

    return $this;
}

/**
 * Get the middleware groups.
 *
 * @return array
 */
public function getMiddlewareGroups()
{
    $middleware = [
        'web' => array_values(array_filter([
            \Illuminate\Cookie\Middleware\EncryptCookies::class,
            \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
            \Illuminate\Session\Middleware\StartSession::class,
            \Illuminate\View\Middleware\ShareErrorsFromSession::class,
            \Illuminate\Foundation\Http\Middleware\ValidateCsrfToken::class,
            \Illuminate\Routing\Middleware\SubstituteBindings::class,
            $this->authenticatedSessions ? 'auth.session' : null,
        ])),
        'api' => array_values(array_filter([
            $this->statefulApi ? \Laravel\Sanctum\Http\Middleware\EnsureFrontendRequestsAreStateful::class : null,
            $this->apiLimiter ? 'throttle:'.$this->apiLimiter : null,
            \Illuminate\Routing\Middleware\SubstituteBindings::class,
        ])),
    ];
(省略)
}

/**
 * Handle the incoming requests.
 *
 * @param  \Illuminate\Http\Request  $request
 * @param  callable  $next
 * @return \Illuminate\Http\Response
 */
public function handle($request, $next)
{
    $this->configureSecureCookieSessions();

    return (new Pipeline(app()))->send($request)->through(
        static::fromFrontend($request) ? $this->frontendMiddleware() : []
    )->then(function ($request) use ($next) {
        return $next($request);
    });
}

(省略)

/**
 * Get the middleware that should be applied to requests from the "frontend".
 *
 * @return array
 */
protected function frontendMiddleware()
{
    $middleware = array_values(array_filter(array_unique([
        config('sanctum.middleware.encrypt_cookies', \Illuminate\Cookie\Middleware\EncryptCookies::class),
        \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
        \Illuminate\Session\Middleware\StartSession::class,
        config('sanctum.middleware.validate_csrf_token', config('sanctum.middleware.verify_csrf_token', \Illuminate\Foundation\Http\Middleware\VerifyCsrfToken::class)),
        config('sanctum.middleware.authenticate_session'),
    ])));

    array_unshift($middleware, function ($request, $next) {
        $request->attributes->set('sanctum', true);

        return $next($request);
    });

    return $middleware;
}

/**
 * Handle an incoming request.
 *
 * @param  \Illuminate\Http\Request  $request
 * @param  \Closure  $next
 * @return mixed
 *
 * @throws \Illuminate\Session\TokenMismatchException
 */
public function handle($request, Closure $next)
{
    if (
        $this->isReading($request) ||
        $this->runningUnitTests() ||
        $this->inExceptArray($request) ||
        $this->tokensMatch($request)
    ) {
        return tap($next($request), function ($response) use ($request) {
            if ($this->shouldAddXsrfTokenCookie()) {
                $this->addCookieToResponse($request, $response);
            }
        });
    }

    throw new TokenMismatchException('CSRF token mismatch.');
}

/**
 * Determine if the session and input CSRF tokens match.
 *
 * @param  \Illuminate\Http\Request  $request
 * @return bool
 */
protected function tokensMatch($request)
{
    $token = $this->getTokenFromRequest($request);

    return is_string($request->session()->token()) &&
            is_string($token) &&
            hash_equals($request->session()->token(), $token);
}

/**
 * Handle an incoming request.
 *
 * @param  \Illuminate\Http\Request  $request
 * @param  \Closure  $next
 * @return mixed
 *
 * @throws \Illuminate\Session\TokenMismatchException
 */
public function handle($request, Closure $next)
{
    if (
        $this->isReading($request) ||
        $this->runningUnitTests() ||
        $this->inExceptArray($request) ||
        $this->tokensMatch($request)
    ) {
        return tap($next($request), function ($response) use ($request) {
            if ($this->shouldAddXsrfTokenCookie()) {
                $this->addCookieToResponse($request, $response);
            }
        });
    }

    throw new TokenMismatchException('CSRF token mismatch.');
}

(省略)

/**
 * Add the CSRF token to the response cookies.
 *
 * @param  \Illuminate\Http\Request  $request
 * @param  \Symfony\Component\HttpFoundation\Response  $response
 * @return \Symfony\Component\HttpFoundation\Response
 */
protected function addCookieToResponse($request, $response)
{
    $config = config('session');

    if ($response instanceof Responsable) {
        $response = $response->toResponse($request);
    }

    $response->headers->setCookie($this->newCookie($request, $config));

    return $response;
}

(省略)

/**
 * Create a new "XSRF-TOKEN" cookie that contains the CSRF token.
 *
 * @param  \Illuminate\Http\Request  $request
 * @param  array  $config
 * @return \Symfony\Component\HttpFoundation\Cookie
 */
protected function newCookie($request, $config)
{
    return new Cookie(
        'XSRF-TOKEN',
        $request->session()->token(),
        $this->availableAt(60 * $config['lifetime']),
        $config['path'],
        $config['domain'],
        $config['secure'],
        false,
        false,
        $config['same_site'] ?? null,
        $config['partitioned'] ?? false
    );
}

getAjaxData: function (params) {
  // vars
  var ajaxData = {
    action: this.get('ajaxAction'),
    s: params.term || '',
    paged: params.page || 1
  };

  // field helper
  var field = this.get('field');
  if (field) {
    ajaxData.field_key = field.get('key');
    if (field.get('nonce')) {
      ajaxData.nonce = field.get('nonce');
    }
  }

  // callback
  var callback = this.get('ajaxData');
  if (callback) {
    ajaxData = callback.apply(this, [ajaxData, params]);
  }

  // filter
  ajaxData = acf.applyFilters('select2_ajax_data', ajaxData, this.data, this.$el, field || false, this);

  // return
  return acf.prepareForAjax(ajaxData);
},

// 素の JS
acf.add_filter('select2_ajax_data', function (data, args, $input, field, instance) {
    if ('field_667d1d6343e57' !== data.field_key) {
        // 投稿のプルダウンでなければ何もしない
        return data;
    }

    // カテゴリーのラジオボタンで選択された value を取得する
    const selectedCat = document.querySelector('input[name="acf[field_667d1f74494c8]"]:checked');
    if (selectedCat) {
        data.cat = selectedCat.value;
    }
    return data;
});

// jQuery
jQuery(document).ready(function ($) {
    acf.add_filter('select2_ajax_data', function (data, args, $input, field, instance) {
        if ('field_667d1d6343e57' !== data.field_key) {
            return data;
        }
        const $selectedCat = $('input[name="acf[field_667d1f74494c8]"]:checked');
        if ($selectedCat) {
            data.cat = $selectedCat.val();
        }
        return data;
    });
});

add_action('admin_enqueue_scripts', function ($hook_suffix) {
    if ('post.php' === $hook_suffix || 'post-new.php' === $hook_suffix) {
        wp_register_script('acf-js-api-usage', plugin_dir_url(__FILE__) . '/acf-js-api-usage.js', ['acf-input']);
        wp_enqueue_script('acf-js-api-usage');
    }
});

add_filter('acf/fields/post_object/query/key=field_667d1d6343e57', function($args, $field, $post_id) {
    $args['cat'] = $_POST['cat'];
    return $args;
}, 10, 3);

$ composer create-project laravel/laravel .
$ composer require nwidart/laravel-modules

"extra": {
    "laravel": {
        "dont-discover": []
    },
    "merge-plugin": {
        "include": [
            "Modules/*/composer.json"
        ]
    }
},

$ php artisan module:make Posts
$ php artisan module:make-middleware PostsMiddleware Posts

<?php

namespace Modules\Posts\Http\Middleware;

use Closure;
use Illuminate\Http\Request;

class PostsMiddleware
{
    /**
     * Handle an incoming request.
     */
    public function handle(Request $request, Closure $next)
    {
        echo 'Hello, world!! ';
        return $next($request);
    }
}

<?php

use Illuminate\Foundation\Application;
use Illuminate\Foundation\Configuration\Exceptions;
use Illuminate\Foundation\Configuration\Middleware;

return Application::configure(basePath: dirname(__DIR__))
    ->withRouting(
        web: __DIR__.'/../routes/web.php',
        commands: __DIR__.'/../routes/console.php',
        health: '/up',
    )
    ->withMiddleware(function (Middleware $middleware) {
        // グローバルミドルウェアで登録
        $middleware->append(\Modules\Posts\Http\Middleware\PostsMiddleware::class);

        // ミドルウェアグループに登録
        $middleware->appendToGroup('group', [\Modules\Posts\Http\Middleware\PostsMiddleware::class]);

        // エイリアスとして登録
        $middleware->alias(['post' => \Modules\Posts\Http\Middleware\PostsMiddleware::class ]);
    })
    ->withExceptions(function (Exceptions $exceptions) {
        //
    })->create();

<?php

use Illuminate\Support\Facades\Route;

Route::get('/posts/global', function() {
    return '(global)';
});

Route::get( '/posts/alias', function() {
    return '(alias)';
})->middleware('post');

Route::middleware(['group'])->group(function() {
    Route::get( '/posts/group', function() {
        return '(group)';
    });
});

$ curl http://localhost:8000/posts/global
Hello, world!! (global)%

$ curl http://localhost:8000/posts/alias 
Hello, world!! Hello, world!! (alias)%

$ curl http://localhost:8000/posts/group
Hello, world!! Hello, world!! (group)%

<?php

use Illuminate\Support\Facades\Route;

Route::get('/global', function() {
    return '(global common)';
});

$ curl http://localhost:8000/global     
Hello, world!! (global common)%

/**
 * Register any application services.
 *
 * @return void
 */
public function register()
{
    $this->booted(function () {
        $this->setRootControllerNamespace();

        if ($this->routesAreCached()) {
            $this->loadCachedRoutes();
        } else {
            $this->loadRoutes();

            $this->app->booted(function () {
                $this->app['router']->getRoutes()->refreshNameLookups();
                $this->app['router']->getRoutes()->refreshActionLookups();
            });
        }
    });
}

/**
 * Load the application routes.
 *
 * @return void
 */
protected function loadRoutes()
{
    if (! is_null(self::$alwaysLoadRoutesUsing)) {
        $this->app->call(self::$alwaysLoadRoutesUsing);
    }

    if (! is_null($this->loadRoutesUsing)) {
        $this->app->call($this->loadRoutesUsing);
    } elseif (method_exists($this, 'map')) {
        $this->app->call([$this, 'map']);
    }
}

<?php

namespace Modules\Posts\Providers;

use Illuminate\Support\Facades\Route;
use Illuminate\Foundation\Support\Providers\RouteServiceProvider as ServiceProvider;
use Modules\Posts\Http\Middleware\PostsMiddleware;

class RouteServiceProvider extends ServiceProvider
{
    /**
     * Called before routes are registered.
     *
     * Register any model bindings or pattern based filters.
     */
    public function boot(): void
    {
        parent::boot();
    }

    /**
     * Define the routes for the application.
     */
    public function map(): void
    {
        Route::aliasMiddleware('post', PostsMiddleware::class);
        $this->mapApiRoutes();

        $this->mapWebRoutes();
    }

    /**
     * Define the "web" routes for the application.
     *
     * These routes all receive session state, CSRF protection, etc.
     */
    protected function mapWebRoutes(): void
    {
        Route::middleware(['web', 'post'])->group(module_path('Posts', '/routes/web.php'));
    }

    /**
     * Define the "api" routes for the application.
     *
     * These routes are typically stateless.
     */
    protected function mapApiRoutes(): void
    {
        Route::middleware('api')->prefix('api')->name('api.')->group(module_path('Posts', '/routes/api.php'));
    }
}

$ curl http://localhost:8000/posts/global
Hello, world!! (global)%

<?php

use Illuminate\Support\Facades\Route;

Route::get('/global', function() {
    return '(global common)';
})->middleware('post');

{
    "Posts": false
}

$ curl -I  http://localhost:8000/global
HTTP/1.1 500 Internal Server Error

$user = User::find(1);

// App\Models\User {
//    id: 5,
//    name: "kiichiro",
//    email: "kiichiro@example.com",
//    email_verified_at: "2024-05-28 06:44:34",
//    password: "$2y$12$jJuJzdMPZ/gSwVSp3DzNE.1SwACJGqPLsWLWP3HGUZRhP1Q/9zJs2",
//    remember_token: "KjmFVc1rUZ",
//    created_at: "2024-05-28 06:44:35",
//    updated_at: "2024-05-28 06:51:32",
// }

$user = User::select(['id', 'name'])->find(1);

// App\Models\User {
//     id: 1,
//     name: "kiichiro",
// }

$user->email; // null

public function boot(): void
{
    Model::preventAccessingMissingAttributes();
}

$user = User::select(['id', 'name'])->find(1);
$user->email;

// Illuminate\Database\Eloquent\MissingAttributeException  The attribute [email] either does not exist or was not retrieved for model [App\Models\User].

$user = User::select(['id', 'name'])->find(1);
$user->email = 'kiichiro@example.com';
$user->email;
// 'kiichiro@example.com'

$user = User::select(['id', 'name'])->find(1);
$user->fill(['email' => 'kiichiro@example.com']);
$user->email;
// 'kiichiro@example.com'

/**
 * Dynamically retrieve attributes on the model.
 *
 * @param  string  $key
 * @return mixed
 */
public function __get($key)
{
    return $this->getAttribute($key);
}

/**
 * Get an attribute from the model.
 *
 * @param  string  $key
 * @return mixed
 */
public function getAttribute($key)
{
    if (! $key) {
        return;
    }

    // If the attribute exists in the attribute array or has a "get" mutator we will
    // get the attribute's value. Otherwise, we will proceed as if the developers
    // are asking for a relationship's value. This covers both types of values.
    if ($this->hasAttribute($key)) {
        return $this->getAttributeValue($key);
    }

    // Here we will determine if the model base class itself contains this given key
    // since we don't want to treat any of those methods as relationships because
    // they are all intended as helper methods and none of these are relations.
    if (method_exists(self::class, $key)) {
        return $this->throwMissingAttributeExceptionIfApplicable($key);
    }

    return $this->isRelation($key) || $this->relationLoaded($key)
                ? $this->getRelationValue($key)
                : $this->throwMissingAttributeExceptionIfApplicable($key);
}

/**
 * Determine whether an attribute exists on the model.
 *
 * @param  string  $key
 * @return bool
 */
public function hasAttribute($key)
{
    if (! $key) {
        return false;
    }

    return array_key_exists($key, $this->attributes) ||
        array_key_exists($key, $this->casts) ||
        $this->hasGetMutator($key) ||
        $this->hasAttributeMutator($key) ||
        $this->isClassCastable($key);
}

public function boot()
{
    Collection::macro('foo', function() {
        $this->map(function($value) {
            // 処理
        });
    });
}

// __callを宣言していないクラス
class Bar {}

$bar = new Bar();
$bar->bar(); // PHP Fatal error:  Uncaught Error: Call to undefined method Bar::bar()

// __callを宣言したクラス
class Foo {
    public function __call($method, $parameters) {
        echo 'Method: ' . $method;
    }
}

$foo = new Foo();
$foo->foo(); // Method: foo

/**
 * The registered string macros.
 *
 * @var array
 */
protected static $macros = [];

/**
 * Register a custom macro.
 *
 * @param  string  $name
 * @param  object|callable  $macro
 * @return void
 */
public static function macro($name, $macro)
{
    static::$macros[$name] = $macro;
}

public function boot()
{
    Collection::macro('foo', function() {
        $this->map(function($value) {
            // 処理
        });
    });
}

// インスタンス化して呼び出す
collect()->foo();

// staticメソッドとして呼び出す
Collection::foo();

/**
 * Dynamically handle calls to the class.
 *
 * @param  string  $method
 * @param  array  $parameters
 * @return mixed
 *
 * @throws \BadMethodCallException
 */
public static function __callStatic($method, $parameters)
{
    if (! static::hasMacro($method)) {
        throw new BadMethodCallException(sprintf(
            'Method %s::%s does not exist.', static::class, $method
        ));
    }

    $macro = static::$macros[$method];

    if ($macro instanceof Closure) {
        $macro = $macro->bindTo(null, static::class);
    }

    return $macro(...$parameters);
}

/**
 * Dynamically handle calls to the class.
 *
 * @param  string  $method
 * @param  array  $parameters
 * @return mixed
 *
 * @throws \BadMethodCallException
 */
public function __call($method, $parameters)
{
    if (! static::hasMacro($method)) {
        throw new BadMethodCallException(sprintf(
            'Method %s::%s does not exist.', static::class, $method
        ));
    }

    $macro = static::$macros[$method];

    if ($macro instanceof Closure) {
        $macro = $macro->bindTo($this, static::class);
    }

    return $macro(...$parameters);
}

$foo = Foo::getModel();

// ①明示的にStringを渡す
$foo->fill([
    'datetime' => Carbon::now()->toDateTimeString(),
    'date'     => Carbon::now()->toDateString(),
])->save();

// ②Carbonオブジェクトのまま渡す
$foo->fill([
    'datetime' => Carbon::now(),
    'date'     => Carbon::now(),
])->save();

$this->attributes[$key] = $value;

    /**
     * Prepare the query bindings for execution.
     *
     * @param  array  $bindings
     * @return array
     */
    public function prepareBindings(array $bindings)
    {
        $grammar = $this->getQueryGrammar();

        foreach ($bindings as $key => $value) {
            // We need to transform all instances of DateTimeInterface into the actual
            // date string. Each query grammar maintains its own date string format
            // so we'll just ask the grammar for the format to get from the date.
            if ($value instanceof DateTimeInterface) {
                $bindings[$key] = $value->format($grammar->getDateFormat());
            } elseif (is_bool($value)) {
                $bindings[$key] = (int) $value;
            }
        }

        return $bindings;
    }

    /**
     * Get the format for database stored dates.
     *
     * @return string
     */
    public function getDateFormat()
    {
        return 'Y-m-d H:i:s';
    }

    /**
     * Update the creation and update timestamps.
     *
     * @return $this
     */
    public function updateTimestamps()
    {
        $time = $this->freshTimestamp();

        $updatedAtColumn = $this->getUpdatedAtColumn();

        if (! is_null($updatedAtColumn) && ! $this->isDirty($updatedAtColumn)) {
            $this->setUpdatedAt($time);
        }

        $createdAtColumn = $this->getCreatedAtColumn();

        if (! $this->exists && ! is_null($createdAtColumn) && ! $this->isDirty($createdAtColumn)) {
            $this->setCreatedAt($time);
        }

        return $this;
    }

    /**
     * Get a fresh timestamp for the model.
     *
     * @return \Illuminate\Support\Carbon
     */
    public function freshTimestamp()
    {
        return Date::now();
    }

$tests['direct']['persistent_object_cache'] = array(
    'label' => __( 'Persistent object cache' ),
    'test'  => 'persistent_object_cache',
);

/**
 * Tests if the site uses persistent object cache and recommends to use it if not.
 *
 * @since 6.1.0
 *
 * @return array The test result.
 */
public function get_test_persistent_object_cache() {
(省略)
    if ( wp_using_ext_object_cache() ) {
        return $result;
    }
(省略)
    return $result;
}

/**
 * Toggle `$_wp_using_ext_object_cache` on and off without directly
 * touching global.
 *
 * @since 3.7.0
 *
 * @global bool $_wp_using_ext_object_cache
 *
 * @param bool $using Whether external object cache is being used.
 * @return bool The current 'using' setting.
 */
function wp_using_ext_object_cache( $using = null ) {
	global $_wp_using_ext_object_cache;
	$current_using = $_wp_using_ext_object_cache;
	if ( null !== $using ) {
		$_wp_using_ext_object_cache = $using;
	}
	return $current_using;
}

/**
 * Start the WordPress object cache.
 *
 * If an object-cache.php file exists in the wp-content directory,
 * it uses that drop-in as an external object cache.
 *
 * @since 3.0.0
 * @access private
 *
 * @global array $wp_filter Stores all of the filters.
 */
function wp_start_object_cache() {
	global $wp_filter;
	static $first_init = true;

	// Only perform the following checks once.

	/**
	 * Filters whether to enable loading of the object-cache.php drop-in.
	 *
	 * This filter runs before it can be used by plugins. It is designed for non-web
	 * runtimes. If false is returned, object-cache.php will never be loaded.
	 *
	 * @since 5.8.0
	 *
	 * @param bool $enable_object_cache Whether to enable loading object-cache.php (if present).
	 *                                  Default true.
	 */
	if ( $first_init && apply_filters( 'enable_loading_object_cache_dropin', true ) ) {
		if ( ! function_exists( 'wp_cache_init' ) ) {
			/*
			 * This is the normal situation. First-run of this function. No
			 * caching backend has been loaded.
			 *
			 * We try to load a custom caching backend, and then, if it
			 * results in a wp_cache_init() function existing, we note
			 * that an external object cache is being used.
			 */
			if ( file_exists( WP_CONTENT_DIR . '/object-cache.php' ) ) {
				require_once WP_CONTENT_DIR . '/object-cache.php';
				if ( function_exists( 'wp_cache_init' ) ) {
					wp_using_ext_object_cache( true );
				}
(省略)
}

/**
 * Init cache
 *
 * @return void
 */
function wp_cache_init() {
    $GLOBALS['wp_object_cache'] =
        \W3TC\Dispatcher::component( 'ObjectCache_WpObjectCache' );
}

/**
 * Generate a time-ordered UUID (version 4).
 *
 * @return \Ramsey\Uuid\UuidInterface
 */
public static function orderedUuid()
{
    if (static::$uuidFactory) {
        return call_user_func(static::$uuidFactory);
    }

    $factory = new UuidFactory;

    $factory->setRandomGenerator(new CombGenerator(
        $factory->getRandomGenerator(),
        $factory->getNumberConverter()
    ));

    $factory->setCodec(new TimestampFirstCombCodec(
        $factory->getUuidBuilder()
    ));

    return $factory->uuid4();
}

public function uuid4(): UuidInterface
{
    $bytes = $this->randomGenerator->generate(16);

    return $this->uuidFromBytesAndVersion($bytes, 4);
}

/**
 * Returns an RFC 4122 variant Uuid, created from the provided bytes and version
 *
 * @param string $bytes The byte string to convert to a UUID
 * @param int $version The RFC 4122 version to apply to the UUID
 *
 * @return UuidInterface An instance of UuidInterface, created from the
 *     byte string and version
 *
 * @psalm-pure
 */
private function uuidFromBytesAndVersion(string $bytes, int $version): UuidInterface
{
    /** @var array $unpackedTime */
    $unpackedTime = unpack('n*', substr($bytes, 6, 2));
    $timeHi = (int) $unpackedTime[1];
    $timeHiAndVersion = pack('n*', BinaryUtils::applyVersion($timeHi, $version));

    /** @var array $unpackedClockSeq */
    $unpackedClockSeq = unpack('n*', substr($bytes, 8, 2));
    $clockSeqHi = (int) $unpackedClockSeq[1];
    $clockSeqHiAndReserved = pack('n*', BinaryUtils::applyVariant($clockSeqHi));

    $bytes = substr_replace($bytes, $timeHiAndVersion, 6, 2);
    $bytes = substr_replace($bytes, $clockSeqHiAndReserved, 8, 2);

    if ($this->isDefaultFeatureSet) {
        return LazyUuidFromString::fromBytes($bytes);
    }

    return $this->uuid($bytes);
}

/**
 * CombGenerator generates COMBs (combined UUID/timestamp)
 *
 * The CombGenerator, when used with the StringCodec (and, by proxy, the
 * TimestampLastCombCodec) or the TimestampFirstCombCodec, combines the current
 * timestamp with a UUID (hence the name "COMB"). The timestamp either appears
 * as the first or last 48 bits of the COMB, depending on the codec used.
 *
 * By default, COMBs will have the timestamp set as the last 48 bits of the
 * identifier.
 * (略)
 */

/**
 * @throws InvalidArgumentException if $length is not a positive integer
 *     greater than or equal to CombGenerator::TIMESTAMP_BYTES
 *
 * @inheritDoc
 */
public function generate(int $length): string
{
    if ($length < self::TIMESTAMP_BYTES) {
        throw new InvalidArgumentException(
            'Length must be a positive integer greater than or equal to ' . self::TIMESTAMP_BYTES
        );
    }

    $hash = '';
    if (self::TIMESTAMP_BYTES > 0 && $length > self::TIMESTAMP_BYTES) {
        $hash = $this->randomGenerator->generate($length - self::TIMESTAMP_BYTES);
    }

    $lsbTime = str_pad(
        $this->converter->toHex($this->timestamp()),
        self::TIMESTAMP_BYTES * 2,
        '0',
        STR_PAD_LEFT
    );

    return (string) hex2bin(
        str_pad(
            bin2hex($hash),
            $length - self::TIMESTAMP_BYTES,
            '0'
        )
        . $lsbTime
    );
}

/**
 * @psalm-return non-empty-string
 */
public function toString(): string
{
    return $this->codec->encode($this);
}

/**
 * @psalm-return non-empty-string
 * @psalm-suppress MoreSpecificReturnType we know that the retrieved `string` is never empty
 * @psalm-suppress LessSpecificReturnStatement we know that the retrieved `string` is never empty
 */
public function encode(UuidInterface $uuid): string
{
    $bytes = $this->swapBytes($uuid->getFields()->getBytes());

    return sprintf(
        '%08s-%04s-%04s-%04s-%012s',
        bin2hex(substr($bytes, 0, 4)),
        bin2hex(substr($bytes, 4, 2)),
        bin2hex(substr($bytes, 6, 2)),
        bin2hex(substr($bytes, 8, 2)),
        bin2hex(substr($bytes, 10))
    );
}

/**
 * Swaps bytes according to the timestamp-first COMB rules
 */
private function swapBytes(string $bytes): string
{
    $first48Bits = substr($bytes, 0, 6);
    $last48Bits = substr($bytes, -6);

    $bytes = substr_replace($bytes, $last48Bits, 0, 6);
    $bytes = substr_replace($bytes, $first48Bits, -6);

    return $bytes;
}

location = /xmlrpc.php {
      deny all;
}

add_filter( 'xmlrpc_enabled', '__return_false' );

$url             = get_site_url() . '/xmlrpc.php';

// First check if the xmlrpc.php file returns a 405 code.
$is_available      = wp_remote_get( $url, array( 'timeout' => 5 ) );
$is_available_code = wp_remote_retrieve_response_code( $is_available );

if ( 405 !== $is_available_code ) return;

// Try an authenticated request.
$authenticated_body     = '<?xml version="1.0" encoding="iso-8859-1"?><methodCall><methodName>wp.getUsers</methodName><params><param><value>1</value></param><param><value>username</value></param><param><value>password</value></param></params></methodCall>';
$authenticated_response = wp_remote_post( $url, array( 'body' => $authenticated_body ) );

'demo.sayHello'                    => 'this:sayHello',
'demo.addTwoNumbers'               => 'this:addTwoNumbers',

// Try an unauthenticated request.
$unauthenticated_body     = '<?xml version="1.0" encoding="iso-8859-1"?><methodCall><methodName>demo.sayHello</methodName><params><param></param></params></methodCall>';
$unauthenticated_response = wp_remote_post( $url, array( 'body' => $unauthenticated_body ) );

if ( preg_match( '/<string>Hello!<\/string>/', $unauthenticated_response['body'] ) ) {
			$this->add_vulnerability( __( 'The XML-RPC interface is partly disabled, but still allows unauthenticated requests.', 'wpscan' ), 'low', sanitize_title( $url ) );
}

add_filter( 'xmlrpc_methods', 'remove_demo_method', 10 );
public function remove_demo_method( $methods ) {
	unset( $methods['demo.sayHello'] );
	return $methods;
}

add_filter( 'determine_current_user', 'wp_validate_application_password', 20 );

/**
 * Validates the application password credentials passed via Basic Authentication.
 *
 * @since 5.6.0
 *
 * @param int|bool $input_user User ID if one has been determined, false otherwise.
 * @return int|bool The authenticated user ID if successful, false otherwise.
 */
function wp_validate_application_password( $input_user ) {
	// Don't authenticate twice.
	if ( ! empty( $input_user ) ) {
		return $input_user;
	}

	if ( ! wp_is_application_passwords_available() ) {
		return $input_user;
	}

	// Check that we're trying to authenticate
	if ( ! isset( $_SERVER['PHP_AUTH_USER'] ) ) {
		return $input_user;
	}

	$authenticated = wp_authenticate_application_password( null, $_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW'] );

	if ( $authenticated instanceof WP_User ) {
		return $authenticated->ID;
	}

	// If it wasn't a user what got returned, just pass on what we had received originally.
	return $input_user;
}

		<?php if ( wp_is_application_passwords_available_for_user( $user_id ) ) : ?>
	<div class="application-passwords hide-if-no-js" id="application-passwords-section">
		<h2><?php _e( 'Application Passwords' ); ?></h2>
		<p><?php _e( 'Application passwords allow authentication via non-interactive systems, such as XML-RPC or the REST API, without providing your actual password. Application passwords can be easily revoked. They cannot be used for traditional logins to your website.' ); ?></p>
		<div class="create-application-password">
			<label for="new_application_password_name" class="screen-reader-text"><?php _e( 'New Application Password Name' ); ?></label>
			<input type="text" size="30" id="new_application_password_name" name="new_application_password_name" placeholder="<?php esc_attr_e( 'New Application Password Name' ); ?>" class="input" />

			<?php
			/**
			 * Fires in the create Application Passwords form.
			 *
			 * @since 5.6.0
			 *
			 * @param WP_User $profileuser The current WP_User object.
			 */
			do_action( 'wp_create_application_password_form', $profileuser );
			?>

			<?php submit_button( __( 'Add New' ), 'secondary', 'do_new_application_password', false ); ?>
		</div>

		<div class="application-passwords-list-table-wrapper">
			<?php
			$application_passwords_list_table = _get_list_table( 'WP_Application_Passwords_List_Table', array( 'screen' => 'application-passwords-user' ) );
			$application_passwords_list_table->prepare_items();
			$application_passwords_list_table->display();
			?>
		</div>
	</div>

define('WP_ENVIRONMENT_TYPE', 'local');

または

add_filter('wp_is_application_passwords_available', '__return_true');

// 正しい場合
$ curl -Iu USER:PASS http://localhost/wp-json/wp/v2/posts
HTTP/1.1 200 OK

// 誤っている場合
$ curl -Iu USER:PASS http://localhost/wp-json/wp/v2/posts
HTTP/1.1 401 Unauthorized

$ curl -I http://localhost/wp-json/wp/v2/posts
HTTP/1.1 200 OK