@hyperspan/framework 0.4.4 → 0.4.5

package/dist/middleware.js

@@ -78,7 +78,7 @@ var mergeBuffers = (buffer1, buffer2) => {
   if (!buffer1) {
     return buffer2;
   }
-  const merged = new Uint8Array(buffer1.byteLength + buffer2.byteLength);
+  const merged = new Uint8Array(new ArrayBuffer(buffer1.byteLength + buffer2.byteLength));
   merged.set(new Uint8Array(buffer1), 0);
   merged.set(buffer2, buffer1.byteLength);
   return merged;
@@ -111,8 +111,9 @@ var RETAINED_304_HEADERS = [
   "expires",
   "vary"
 ];
+var stripWeak = (tag) => tag.replace(/^W\//, "");
 function etagMatches(etag2, ifNoneMatch) {
-  return ifNoneMatch != null && ifNoneMatch.split(/,\s*/).indexOf(etag2) > -1;
+  return ifNoneMatch != null && ifNoneMatch.split(/,\s*/).some((t) => stripWeak(t) === stripWeak(etag2));
 }
 function initializeGenerator(generator) {
   if (!generator) {

package/dist/server.js

@@ -74,10 +74,10 @@ export const __CLIENT_JS = {
 // src/server.ts
 import { html, isHSHtml, renderStream, renderAsync, render } from "@hyperspan/html";
 import { readdir } from "node:fs/promises";
-import { basename, extname, join } from "node:path";
+import { basename, extname, join as join2 } from "node:path";
 
 // ../../node_modules/isbot/index.mjs
-var fullPattern = " daum[ /]| deusu/| yadirectfetcher|(?:^|[^g])news(?!sapphire)|(?<! (?:channel/|google/))google(?!(app|/google| pixel))|(?<! cu)bots?(?:\\b|_)|(?<!(?:lib))http|(?<![hg]m)score|(?<!cam)scan|@[a-z][\\w-]+\\.|\\(\\)|\\.com\\b|\\btime/|\\||^<|^[\\w \\.\\-\\(?:\\):%]+(?:/v?\\d+(?:\\.\\d+)?(?:\\.\\d{1,10})*?)?(?:,|$)|^[^ ]{50,}$|^\\d+\\b|^\\w*search\\b|^\\w+/[\\w\\(\\)]*$|^active|^ad muncher|^amaya|^avsdevicesdk/|^biglotron|^bot|^bw/|^clamav[ /]|^client/|^cobweb/|^custom|^ddg[_-]android|^discourse|^dispatch/\\d|^downcast/|^duckduckgo|^email|^facebook|^getright/|^gozilla/|^hobbit|^hotzonu|^hwcdn/|^igetter/|^jeode/|^jetty/|^jigsaw|^microsoft bits|^movabletype|^mozilla/\\d\\.\\d\\s[\\w\\.-]+$|^mozilla/\\d\\.\\d\\s\\(compatible;?(?:\\s\\w+\\/\\d+\\.\\d+)?\\)$|^navermailapp|^netsurf|^offline|^openai/|^owler|^php|^postman|^python|^rank|^read|^reed|^rest|^rss|^snapchat|^space bison|^svn|^swcd |^taringa|^thumbor/|^track|^w3c|^webbandit/|^webcopier|^wget|^whatsapp|^wordpress|^xenu link sleuth|^yahoo|^yandex|^zdm/\\d|^zoom marketplace/|^{{.*}}$|analyzer|archive|ask jeeves/teoma|audit|bit\\.ly/|bluecoat drtr|browsex|burpcollaborator|capture|catch|check\\b|checker|chrome-lighthouse|chromeframe|classifier|cloudflare|convertify|crawl|cypress/|dareboost|datanyze|dejaclick|detect|dmbrowser|download|evc-batch/|exaleadcloudview|feed|firephp|functionize|gomezagent|grab|headless|httrack|hubspot marketing grader|hydra|ibisbrowser|infrawatch|insight|inspect|iplabel|ips-agent|java(?!;)|library|linkcheck|mail\\.ru/|manager|measure|neustar wpm|node|nutch|offbyone|onetrust|optimize|pageburst|pagespeed|parser|perl|phantomjs|pingdom|powermarks|preview|proxy|ptst[ /]\\d|retriever|rexx;|rigor|rss\\b|scrape|server|sogou|sparkler/|speedcurve|spider|splash|statuscake|supercleaner|synapse|synthetic|tools|torrent|transcoder|url|validator|virtuoso|wappalyzer|webglance|webkit2png|whatcms/|xtate/";
+var fullPattern = " daum[ /]| deusu/|(?:^|[^g])news(?!sapphire)|(?<! (?:channel/|google/))google(?!(app|/google| pixel))|(?<! cu)bots?(?:\\b|_)|(?<!(?:lib))http|(?<![hg]m)score|(?<!cam)scan|@[a-z][\\w-]+\\.|\\(\\)|\\.com\\b|\\btime/|\\||^<|^[\\w \\.\\-\\(?:\\):%]+(?:/v?\\d+(?:\\.\\d+)?(?:\\.\\d{1,10})*?)?(?:,|$)|^[^ ]{50,}$|^\\d+\\b|^\\w*search\\b|^\\w+/[\\w\\(\\)]*$|^active|^ad muncher|^amaya|^avsdevicesdk/|^azure|^biglotron|^bot|^bw/|^clamav[ /]|^client/|^cobweb/|^custom|^ddg[_-]android|^discourse|^dispatch/\\d|^downcast/|^duckduckgo|^email|^facebook|^getright/|^gozilla/|^hobbit|^hotzonu|^hwcdn/|^igetter/|^jeode/|^jetty/|^jigsaw|^microsoft bits|^movabletype|^mozilla/\\d\\.\\d\\s[\\w\\.-]+$|^mozilla/\\d\\.\\d\\s\\(compatible;?(?:\\s\\w+\\/\\d+\\.\\d+)?\\)$|^navermailapp|^netsurf|^offline|^openai/|^owler|^php|^postman|^python|^rank|^read|^reed|^rest|^rss|^snapchat|^space bison|^svn|^swcd |^taringa|^thumbor/|^track|^w3c|^webbandit/|^webcopier|^wget|^whatsapp|^wordpress|^xenu link sleuth|^yahoo|^yandex|^zdm/\\d|^zoom marketplace/|agent|analyzer|archive|ask jeeves/teoma|audit|bit\\.ly/|bluecoat drtr|browsex|burpcollaborator|capture|catch|check\\b|checker|chrome-lighthouse|chromeframe|classifier|cloudflare|convertify|crawl|cypress/|dareboost|datanyze|dejaclick|detect|dmbrowser|download|evc-batch/|exaleadcloudview|feed|fetcher|firephp|functionize|grab|headless|httrack|hubspot marketing grader|hydra|ibisbrowser|infrawatch|insight|inspect|iplabel|java(?!;)|library|linkcheck|mail\\.ru/|manager|measure|neustar wpm|node|nutch|offbyone|onetrust|optimize|pageburst|pagespeed|parser|perl|phantomjs|pingdom|powermarks|preview|proxy|ptst[ /]\\d|retriever|rexx;|rigor|rss\\b|scrape|server|sogou|sparkler/|speedcurve|spider|splash|statuscake|supercleaner|synapse|synthetic|tools|torrent|transcoder|url|validator|virtuoso|wappalyzer|webglance|webkit2png|whatcms/|xtate/";
 var naivePattern = /bot|crawl|http|lighthouse|scan|search|spider/i;
 var pattern;
 function getPattern() {
@@ -139,6 +139,9 @@ var compose = (middleware, onError, onNotFound) => {
   };
 };
 
+// ../../node_modules/hono/dist/request/constants.js
+var GET_MATCH_RESULT = Symbol();
+
 // ../../node_modules/hono/dist/utils/body.js
 var parseBody = async (request, options = /* @__PURE__ */ Object.create(null)) => {
   const { all = false, dot = false } = options;
@@ -185,7 +188,11 @@ var handleParsingAllValues = (form, key, value) => {
       form[key] = [form[key], value];
     }
   } else {
-    form[key] = value;
+    if (!key.endsWith("[]")) {
+      form[key] = value;
+    } else {
+      form[key] = [value];
+    }
   }
 };
 var handleParsingNestedValues = (form, key, value) => {
@@ -272,7 +279,7 @@ var tryDecode = (str, decoder) => {
 var tryDecodeURI = (str) => tryDecode(str, decodeURI);
 var getPath = (request) => {
   const url = request.url;
-  const start = url.indexOf("/", 8);
+  const start = url.indexOf("/", url.charCodeAt(9) === 58 ? 13 : 8);
   let i = start;
   for (;i < url.length; i++) {
     const charCode = url.charCodeAt(i);
@@ -330,7 +337,7 @@ var _decodeURI = (value) => {
   if (value.indexOf("+") !== -1) {
     value = value.replace(/\+/g, " ");
   }
-  return value.indexOf("%") !== -1 ? decodeURIComponent_(value) : value;
+  return value.indexOf("%") !== -1 ? tryDecode(value, decodeURIComponent_) : value;
 };
 var _getQueryParam = (url, key, multiple) => {
   let encoded;
@@ -472,7 +479,7 @@ var HonoRequest = class {
     return bodyCache[key] = raw[key]();
   };
   json() {
-    return this.#cachedBody("json");
+    return this.#cachedBody("text").then((text) => JSON.parse(text));
   }
   text() {
     return this.#cachedBody("text");
@@ -498,6 +505,9 @@ var HonoRequest = class {
   get method() {
     return this.raw.method;
   }
+  get [GET_MATCH_RESULT]() {
+    return this.#matchResult;
+  }
   get matchedRoutes() {
     return this.#matchResult[0].map(([[, route]]) => route);
   }
@@ -546,11 +556,11 @@ var resolveCallback = async (str, phase, preserveCallbacks, context, buffer) =>
 
 // ../../node_modules/hono/dist/context.js
 var TEXT_PLAIN = "text/plain; charset=UTF-8";
-var setHeaders = (headers, map = {}) => {
-  for (const key of Object.keys(map)) {
-    headers.set(key, map[key]);
-  }
-  return headers;
+var setDefaultContentType = (contentType, headers) => {
+  return {
+    "Content-Type": contentType,
+    ...headers
+  };
 };
 var Context = class {
   #rawRequest;
@@ -559,15 +569,13 @@ var Context = class {
   #var;
   finalized = false;
   error;
-  #status = 200;
+  #status;
   #executionCtx;
-  #headers;
-  #preparedHeaders;
   #res;
-  #isFresh = true;
   #layout;
   #renderer;
   #notFoundHandler;
+  #preparedHeaders;
   #matchResult;
   #path;
   constructor(req, options) {
@@ -599,11 +607,11 @@ var Context = class {
     }
   }
   get res() {
-    this.#isFresh = false;
-    return this.#res ||= new Response("404 Not Found", { status: 404 });
+    return this.#res ||= new Response(null, {
+      headers: this.#preparedHeaders ??= new Headers
+    });
   }
   set res(_res) {
-    this.#isFresh = false;
     if (this.#res && _res) {
       _res = new Response(_res.body, _res);
       for (const [k, v] of this.#res.headers.entries()) {
@@ -637,42 +645,16 @@ var Context = class {
     if (this.finalized) {
       this.#res = new Response(this.#res.body, this.#res);
     }
+    const headers = this.#res ? this.#res.headers : this.#preparedHeaders ??= new Headers;
     if (value === undefined) {
-      if (this.#headers) {
-        this.#headers.delete(name);
-      } else if (this.#preparedHeaders) {
-        delete this.#preparedHeaders[name.toLocaleLowerCase()];
-      }
-      if (this.finalized) {
-        this.res.headers.delete(name);
-      }
-      return;
-    }
-    if (options?.append) {
-      if (!this.#headers) {
-        this.#isFresh = false;
-        this.#headers = new Headers(this.#preparedHeaders);
-        this.#preparedHeaders = {};
-      }
-      this.#headers.append(name, value);
+      headers.delete(name);
+    } else if (options?.append) {
+      headers.append(name, value);
     } else {
-      if (this.#headers) {
-        this.#headers.set(name, value);
-      } else {
-        this.#preparedHeaders ??= {};
-        this.#preparedHeaders[name.toLowerCase()] = value;
-      }
-    }
-    if (this.finalized) {
-      if (options?.append) {
-        this.res.headers.append(name, value);
-      } else {
-        this.res.headers.set(name, value);
-      }
+      headers.set(name, value);
     }
   };
   status = (status) => {
-    this.#isFresh = false;
     this.#status = status;
   };
   set = (key, value) => {
@@ -689,94 +671,47 @@ var Context = class {
     return Object.fromEntries(this.#var);
   }
   #newResponse(data, arg, headers) {
-    if (this.#isFresh && !headers && !arg && this.#status === 200) {
-      return new Response(data, {
-        headers: this.#preparedHeaders
-      });
-    }
-    if (arg && typeof arg !== "number") {
-      const header = new Headers(arg.headers);
-      if (this.#headers) {
-        this.#headers.forEach((v, k) => {
-          if (k === "set-cookie") {
-            header.append(k, v);
-          } else {
-            header.set(k, v);
-          }
-        });
-      }
-      const headers2 = setHeaders(header, this.#preparedHeaders);
-      return new Response(data, {
-        headers: headers2,
-        status: arg.status ?? this.#status
-      });
-    }
-    const status = typeof arg === "number" ? arg : this.#status;
-    this.#preparedHeaders ??= {};
-    this.#headers ??= new Headers;
-    setHeaders(this.#headers, this.#preparedHeaders);
-    if (this.#res) {
-      this.#res.headers.forEach((v, k) => {
-        if (k === "set-cookie") {
-          this.#headers?.append(k, v);
+    const responseHeaders = this.#res ? new Headers(this.#res.headers) : this.#preparedHeaders ?? new Headers;
+    if (typeof arg === "object" && "headers" in arg) {
+      const argHeaders = arg.headers instanceof Headers ? arg.headers : new Headers(arg.headers);
+      for (const [key, value] of argHeaders) {
+        if (key.toLowerCase() === "set-cookie") {
+          responseHeaders.append(key, value);
         } else {
-          this.#headers?.set(k, v);
+          responseHeaders.set(key, value);
         }
-      });
-      setHeaders(this.#headers, this.#preparedHeaders);
+      }
     }
-    headers ??= {};
-    for (const [k, v] of Object.entries(headers)) {
-      if (typeof v === "string") {
-        this.#headers.set(k, v);
-      } else {
-        this.#headers.delete(k);
-        for (const v2 of v) {
-          this.#headers.append(k, v2);
+    if (headers) {
+      for (const [k, v] of Object.entries(headers)) {
+        if (typeof v === "string") {
+          responseHeaders.set(k, v);
+        } else {
+          responseHeaders.delete(k);
+          for (const v2 of v) {
+            responseHeaders.append(k, v2);
+          }
         }
       }
     }
-    return new Response(data, {
-      status,
-      headers: this.#headers
-    });
+    const status = typeof arg === "number" ? arg : arg?.status ?? this.#status;
+    return new Response(data, { status, headers: responseHeaders });
   }
   newResponse = (...args) => this.#newResponse(...args);
-  body = (data, arg, headers) => {
-    return typeof arg === "number" ? this.#newResponse(data, arg, headers) : this.#newResponse(data, arg);
-  };
+  body = (data, arg, headers) => this.#newResponse(data, arg, headers);
   text = (text, arg, headers) => {
-    if (!this.#preparedHeaders) {
-      if (this.#isFresh && !headers && !arg) {
-        return new Response(text);
-      }
-      this.#preparedHeaders = {};
-    }
-    this.#preparedHeaders["content-type"] = TEXT_PLAIN;
-    if (typeof arg === "number") {
-      return this.#newResponse(text, arg, headers);
-    }
-    return this.#newResponse(text, arg);
+    return !this.#preparedHeaders && !this.#status && !arg && !headers && !this.finalized ? new Response(text) : this.#newResponse(text, arg, setDefaultContentType(TEXT_PLAIN, headers));
   };
   json = (object, arg, headers) => {
-    const body = JSON.stringify(object);
-    this.#preparedHeaders ??= {};
-    this.#preparedHeaders["content-type"] = "application/json";
-    return typeof arg === "number" ? this.#newResponse(body, arg, headers) : this.#newResponse(body, arg);
+    return this.#newResponse(JSON.stringify(object), arg, setDefaultContentType("application/json", headers));
   };
   html = (html, arg, headers) => {
-    this.#preparedHeaders ??= {};
-    this.#preparedHeaders["content-type"] = "text/html; charset=UTF-8";
-    if (typeof html === "object") {
-      return resolveCallback(html, HtmlEscapedCallbackPhase.Stringify, false, {}).then((html2) => {
-        return typeof arg === "number" ? this.#newResponse(html2, arg, headers) : this.#newResponse(html2, arg);
-      });
-    }
-    return typeof arg === "number" ? this.#newResponse(html, arg, headers) : this.#newResponse(html, arg);
+    const res = (html2) => this.#newResponse(html2, arg, setDefaultContentType("text/html; charset=UTF-8", headers));
+    return typeof html === "object" ? resolveCallback(html, HtmlEscapedCallbackPhase.Stringify, false, {}).then(res) : res(html);
   };
   redirect = (location, status) => {
-    this.#headers ??= new Headers;
-    this.#headers.set("Location", String(location));
+    const locationString = String(location);
+    this.header("Location", !/[^\x00-\xFF]/.test(locationString) ? locationString : encodeURI(locationString));
     return this.newResponse(null, status ?? 302);
   };
   notFound = () => {
@@ -802,7 +737,8 @@ var notFoundHandler = (c) => {
 };
 var errorHandler = (err, c) => {
   if ("getResponse" in err) {
-    return err.getResponse();
+    const res = err.getResponse();
+    return c.newResponse(res.body, res);
   }
   console.error(err);
   return c.text("Internal Server Error", 500);
@@ -950,7 +886,7 @@ var Hono = class {
   #addRoute(method, path, handler) {
     method = method.toUpperCase();
     path = mergePath(this._basePath, path);
-    const r = { path, method, handler };
+    const r = { basePath: this._basePath, path, method, handler };
     this.router.add(method, path, [handler, r]);
     this.routes.push(r);
   }
@@ -1061,6 +997,9 @@ var Node = class {
       const name = pattern2[1];
       let regexpStr = pattern2[2] || LABEL_REG_EXP_STR;
       if (name && pattern2[2]) {
+        if (regexpStr === ".*") {
+          throw PATH_ERROR;
+        }
         regexpStr = regexpStr.replace(/^\((?!\?:)(?=[^)]+\)$)/, "(?:");
         if (/\((?!\?:)/.test(regexpStr)) {
           throw PATH_ERROR;
@@ -1436,11 +1375,10 @@ var Node2 = class {
       const nextP = parts[i + 1];
       const pattern2 = getPattern2(p, nextP);
       const key = Array.isArray(pattern2) ? pattern2[0] : p;
-      if (Object.keys(curNode.#children).includes(key)) {
+      if (key in curNode.#children) {
         curNode = curNode.#children[key];
-        const pattern22 = getPattern2(p, nextP);
-        if (pattern22) {
-          possibleKeys.push(pattern22[1]);
+        if (pattern2) {
+          possibleKeys.push(pattern2[1]);
         }
         continue;
       }
@@ -1451,14 +1389,13 @@ var Node2 = class {
       }
       curNode = curNode.#children[key];
     }
-    const m = /* @__PURE__ */ Object.create(null);
-    const handlerSet = {
-      handler,
-      possibleKeys: possibleKeys.filter((v, i, a) => a.indexOf(v) === i),
-      score: this.#order
-    };
-    m[method] = handlerSet;
-    curNode.#methods.push(m);
+    curNode.#methods.push({
+      [method]: {
+        handler,
+        possibleKeys: possibleKeys.filter((v, i, a) => a.indexOf(v) === i),
+        score: this.#order
+      }
+    });
     return curNode;
   }
   #getHandlerSets(node, method, nodeParams, params) {
@@ -1519,10 +1456,10 @@ var Node2 = class {
             }
             continue;
           }
-          if (part === "") {
+          const [key, name, matcher] = pattern2;
+          if (!part && !(matcher instanceof RegExp)) {
             continue;
           }
-          const [key, name, matcher] = pattern2;
           const child = node.#children[key];
           const restPathString = parts.slice(i).join("/");
           if (matcher instanceof RegExp) {
@@ -1598,42 +1535,11 @@ var Hono2 = class extends Hono {
 
 // ../../node_modules/hono/dist/adapter/bun/serve-static.js
 import { stat } from "node:fs/promises";
+import { join } from "node:path";
 
 // ../../node_modules/hono/dist/utils/compress.js
 var COMPRESSIBLE_CONTENT_TYPE_REGEX = /^\s*(?:text\/(?!event-stream(?:[;\s]|$))[^;\s]+|application\/(?:javascript|json|xml|xml-dtd|ecmascript|dart|postscript|rtf|tar|toml|vnd\.dart|vnd\.ms-fontobject|vnd\.ms-opentype|wasm|x-httpd-php|x-javascript|x-ns-proxy-autoconfig|x-sh|x-tar|x-virtualbox-hdd|x-virtualbox-ova|x-virtualbox-ovf|x-virtualbox-vbox|x-virtualbox-vdi|x-virtualbox-vhd|x-virtualbox-vmdk|x-www-form-urlencoded)|font\/(?:otf|ttf)|image\/(?:bmp|vnd\.adobe\.photoshop|vnd\.microsoft\.icon|vnd\.ms-dds|x-icon|x-ms-bmp)|message\/rfc822|model\/gltf-binary|x-shader\/x-fragment|x-shader\/x-vertex|[^;\s]+?\+(?:json|text|xml|yaml))(?:[;\s]|$)/i;
 
-// ../../node_modules/hono/dist/utils/filepath.js
-var getFilePath = (options) => {
-  let filename = options.filename;
-  const defaultDocument = options.defaultDocument || "index.html";
-  if (filename.endsWith("/")) {
-    filename = filename.concat(defaultDocument);
-  } else if (!filename.match(/\.[a-zA-Z0-9_-]+$/)) {
-    filename = filename.concat("/" + defaultDocument);
-  }
-  const path = getFilePathWithoutDefaultDocument({
-    root: options.root,
-    filename
-  });
-  return path;
-};
-var getFilePathWithoutDefaultDocument = (options) => {
-  let root = options.root || "";
-  let filename = options.filename;
-  if (/(?:^|[\/\\])\.\.(?:$|[\/\\])/.test(filename)) {
-    return;
-  }
-  filename = filename.replace(/^\.?[\/\\]/, "");
-  filename = filename.replace(/\\/, "/");
-  root = root.replace(/\/$/, "");
-  let path = root ? root + "/" + filename : filename;
-  path = path.replace(/^\.?\//, "");
-  if (root[0] !== "/" && path[0] === "/") {
-    return;
-  }
-  return path;
-};
-
 // ../../node_modules/hono/dist/utils/mime.js
 var getMimeType = (filename, mimes = baseMimes) => {
   const regexp = /\.([a-zA-Z0-9]+?)$/;
@@ -1693,6 +1599,7 @@ var _baseMimes = {
   wasm: "application/wasm",
   webm: "video/webm",
   weba: "audio/webm",
+  webmanifest: "application/manifest+json",
   webp: "image/webp",
   woff: "font/woff",
   woff2: "font/woff2",
@@ -1706,6 +1613,22 @@ var _baseMimes = {
 };
 var baseMimes = _baseMimes;
 
+// ../../node_modules/hono/dist/middleware/serve-static/path.js
+var defaultJoin = (...paths) => {
+  let result = paths.filter((p) => p !== "").join("/");
+  result = result.replace(/(?<=\/)\/+/g, "");
+  const segments = result.split("/");
+  const resolved = [];
+  for (const segment of segments) {
+    if (segment === ".." && resolved.length > 0 && resolved.at(-1) !== "..") {
+      resolved.pop();
+    } else if (segment !== ".") {
+      resolved.push(segment);
+    }
+  }
+  return resolved.join("/") || ".";
+};
+
 // ../../node_modules/hono/dist/middleware/serve-static/index.js
 var ENCODINGS = {
   br: ".br",
@@ -1714,65 +1637,34 @@ var ENCODINGS = {
 };
 var ENCODINGS_ORDERED_KEYS = Object.keys(ENCODINGS);
 var DEFAULT_DOCUMENT = "index.html";
-var defaultPathResolve = (path) => path;
 var serveStatic = (options) => {
-  let isAbsoluteRoot = false;
-  let root;
-  if (options.root) {
-    if (options.root.startsWith("/")) {
-      isAbsoluteRoot = true;
-      root = new URL(`file://${options.root}`).pathname;
-    } else {
-      root = options.root;
-    }
-  }
+  const root = options.root ?? "./";
+  const optionPath = options.path;
+  const join = options.join ?? defaultJoin;
   return async (c, next) => {
     if (c.finalized) {
-      await next();
-      return;
+      return next();
     }
-    let filename = options.path ?? decodeURI(c.req.path);
-    filename = options.rewriteRequestPath ? options.rewriteRequestPath(filename) : filename;
-    if (!filename.endsWith("/") && options.isDir) {
-      const path2 = getFilePathWithoutDefaultDocument({
-        filename,
-        root
-      });
-      if (path2 && await options.isDir(path2)) {
-        filename += "/";
+    let filename;
+    if (options.path) {
+      filename = options.path;
+    } else {
+      try {
+        filename = decodeURIComponent(c.req.path);
+        if (/(?:^|[\/\\])\.\.(?:$|[\/\\])/.test(filename)) {
+          throw new Error;
+        }
+      } catch {
+        await options.onNotFound?.(c.req.path, c);
+        return next();
       }
     }
-    let path = getFilePath({
-      filename,
-      root,
-      defaultDocument: DEFAULT_DOCUMENT
-    });
-    if (!path) {
-      return await next();
-    }
-    if (isAbsoluteRoot) {
-      path = "/" + path;
+    let path = join(root, !optionPath && options.rewriteRequestPath ? options.rewriteRequestPath(filename) : filename);
+    if (options.isDir && await options.isDir(path)) {
+      path = join(path, DEFAULT_DOCUMENT);
     }
     const getContent = options.getContent;
-    const pathResolve = options.pathResolve ?? defaultPathResolve;
-    path = pathResolve(path);
     let content = await getContent(path, c);
-    if (!content) {
-      let pathWithoutDefaultDocument = getFilePathWithoutDefaultDocument({
-        filename,
-        root
-      });
-      if (!pathWithoutDefaultDocument) {
-        return await next();
-      }
-      pathWithoutDefaultDocument = pathResolve(pathWithoutDefaultDocument);
-      if (pathWithoutDefaultDocument !== path) {
-        content = await getContent(pathWithoutDefaultDocument, c);
-        if (content) {
-          path = pathWithoutDefaultDocument;
-        }
-      }
-    }
     if (content instanceof Response) {
       return c.newResponse(content.body, content);
     }
@@ -1807,13 +1699,9 @@ var serveStatic = (options) => {
 var serveStatic2 = (options) => {
   return async function serveStatic2(c, next) {
     const getContent = async (path) => {
-      path = path.startsWith("/") ? path : `./${path}`;
       const file = Bun.file(path);
       return await file.exists() ? file : null;
     };
-    const pathResolve = (path) => {
-      return path.startsWith("/") ? path : `./${path}`;
-    };
     const isDir = async (path) => {
       let isDir2;
       try {
@@ -1825,7 +1713,7 @@ var serveStatic2 = (options) => {
     return serveStatic({
       ...options,
       getContent,
-      pathResolve,
+      join,
       isDir
     })(c, next);
   };
@@ -1869,6 +1757,52 @@ var WSContext = class {
     this.#init.close(code, reason);
   }
 };
+var defineWebSocketHelper = (handler) => {
+  return (...args) => {
+    if (typeof args[0] === "function") {
+      const [createEvents, options] = args;
+      return async function upgradeWebSocket(c, next) {
+        const events = await createEvents(c);
+        const result = await handler(c, events, options);
+        if (result) {
+          return result;
+        }
+        await next();
+      };
+    } else {
+      const [c, events, options] = args;
+      return (async () => {
+        const upgraded = await handler(c, events, options);
+        if (!upgraded) {
+          throw new Error("Failed to upgrade WebSocket");
+        }
+        return upgraded;
+      })();
+    }
+  };
+};
+
+// ../../node_modules/hono/dist/adapter/bun/server.js
+var getBunServer = (c) => ("server" in c.env) ? c.env.server : c.env;
+
+// ../../node_modules/hono/dist/adapter/bun/websocket.js
+var upgradeWebSocket = defineWebSocketHelper((c, events) => {
+  const server = getBunServer(c);
+  if (!server) {
+    throw new TypeError("env has to include the 2nd argument of fetch.");
+  }
+  const upgradeResult = server.upgrade(c.req.raw, {
+    data: {
+      events,
+      url: new URL(c.req.url),
+      protocol: c.req.url
+    }
+  });
+  if (upgradeResult) {
+    return new Response(null);
+  }
+  return;
+});
 
 // ../../node_modules/hono/dist/http-exception.js
 var HTTPException = class extends Error {
@@ -1894,10 +1828,12 @@ var HTTPException = class extends Error {
 };
 
 // ../../node_modules/hono/dist/middleware/csrf/index.js
+var secFetchSiteValues = ["same-origin", "same-site", "none", "cross-site"];
+var isSecFetchSite = (value) => secFetchSiteValues.includes(value);
 var isSafeMethodRe = /^(GET|HEAD)$/;
 var isRequestedByFormElementRe = /^\b(application\/x-www-form-urlencoded|multipart\/form-data|text\/plain)\b/i;
 var csrf = (options) => {
-  const handler = ((optsOrigin) => {
+  const originHandler = ((optsOrigin) => {
     if (!optsOrigin) {
       return (origin, c) => origin === new URL(c.req.url).origin;
     } else if (typeof optsOrigin === "string") {
@@ -1912,13 +1848,31 @@ var csrf = (options) => {
     if (origin === undefined) {
       return false;
     }
-    return handler(origin, c);
+    return originHandler(origin, c);
+  };
+  const secFetchSiteHandler = ((optsSecFetchSite) => {
+    if (!optsSecFetchSite) {
+      return (secFetchSite) => secFetchSite === "same-origin";
+    } else if (typeof optsSecFetchSite === "string") {
+      return (secFetchSite) => secFetchSite === optsSecFetchSite;
+    } else if (typeof optsSecFetchSite === "function") {
+      return optsSecFetchSite;
+    } else {
+      return (secFetchSite) => optsSecFetchSite.includes(secFetchSite);
+    }
+  })(options?.secFetchSite);
+  const isAllowedSecFetchSite = (secFetchSite, c) => {
+    if (secFetchSite === undefined) {
+      return false;
+    }
+    if (!isSecFetchSite(secFetchSite)) {
+      return false;
+    }
+    return secFetchSiteHandler(secFetchSite, c);
   };
   return async function csrf2(c, next) {
-    if (!isSafeMethodRe.test(c.req.method) && isRequestedByFormElementRe.test(c.req.header("content-type") || "text/plain") && !isAllowedOrigin(c.req.header("origin"), c)) {
-      const res = new Response("Forbidden", {
-        status: 403
-      });
+    if (!isSafeMethodRe.test(c.req.method) && isRequestedByFormElementRe.test(c.req.header("content-type") || "text/plain") && !isAllowedSecFetchSite(c.req.header("sec-fetch-site"), c) && !isAllowedOrigin(c.req.header("origin"), c)) {
+      const res = new Response("Forbidden", { status: 403 });
       throw new HTTPException(403, { res });
     }
     await next();
@@ -2159,7 +2113,7 @@ async function showErrorReponse(context, err, responseOptions) {
 }
 var ROUTE_SEGMENT = /(\[[a-zA-Z_\.]+\])/g;
 async function buildRoutes(config) {
-  const routesDir = join(config.appDir, "routes");
+  const routesDir = join2(config.appDir, "routes");
   const files = await readdir(routesDir, { recursive: true });
   const routes = [];
   for (const file of files) {
@@ -2186,18 +2140,18 @@ async function buildRoutes(config) {
       });
     }
     routes.push({
-      file: join("./", routesDir, file),
+      file: join2("./", routesDir, file),
       route: normalizePath(route || "/"),
       params
     });
   }
   return await Promise.all(routes.map(async (route) => {
-    route.module = (await import(join(CWD, route.file))).default;
+    route.module = (await import(join2(CWD, route.file))).default;
     return route;
   }));
 }
 async function buildActions(config) {
-  const routesDir = join(config.appDir, "actions");
+  const routesDir = join2(config.appDir, "actions");
   const files = await readdir(routesDir, { recursive: true });
   const routes = [];
   for (const file of files) {
@@ -2206,13 +2160,13 @@ async function buildActions(config) {
     }
     let route = assetHash("/" + file.replace(extname(file), ""));
     routes.push({
-      file: join("./", routesDir, file),
+      file: join2("./", routesDir, file),
       route: `/__actions/${route}`,
       params: []
     });
   }
   return await Promise.all(routes.map(async (route) => {
-    route.module = (await import(join(CWD, route.file))).default;
+    route.module = (await import(join2(CWD, route.file))).default;
     route.route = route.module._route;
     return route;
   }));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hyperspan/framework",
-  "version": "0.4.4",
+  "version": "0.4.5",
   "description": "Hyperspan Web Framework",
   "main": "dist/server.ts",
   "types": "src/server.ts",
@@ -65,10 +65,10 @@
     "typescript": "^5.8.3"
   },
   "dependencies": {
-    "@hyperspan/html": "workspace:^",
-    "hono": "^4.7.10",
-    "isbot": "^5.1.28",
+    "@hyperspan/html": "0.1.7",
+    "hono": "^4.9.4",
+    "isbot": "^5.1.30",
     "timestring": "^7.0.0",
-    "zod": "^3.25.67"
+    "zod": "^4.1.5"
   }
 }