@nocobase/plugin-mcp-server 2.4.0-alpha.7 → 2.4.0-alpha.9

package/dist/node_modules/hono/dist/cjs/adapter/aws-lambda/handler.js

@@ -29,6 +29,7 @@ __export(handler_exports, {
   streamHandle: () => streamHandle
 });
 module.exports = __toCommonJS(handler_exports);
+var import_promises = require("node:stream/promises");
 var import_encode = require("../../utils/encode");
 function sanitizeHeaderValue(value) {
   const hasNonAscii = /[^\x00-\x7F]/.test(value);
@@ -40,14 +41,14 @@ function sanitizeHeaderValue(value) {
 const getRequestContext = (event) => {
   return event.requestContext;
 };
-const streamToNodeStream = async (reader, writer) => {
+async function* readWebStream(reader) {
   let readResult = await reader.read();
   while (!readResult.done) {
-    writer.write(readResult.value);
+    yield readResult.value;
     readResult = await reader.read();
   }
-  writer.end();
-};
+}
+const streamToNodeStream = (reader, writer) => (0, import_promises.pipeline)(readWebStream(reader), writer);
 const streamHandle = (app) => {
   return awslambda.streamifyResponse(
     async (event, responseStream, context) => {
@@ -92,8 +93,15 @@ const streamHandle = (app) => {
 const handle = (app, { isContentTypeBinary } = { isContentTypeBinary: void 0 }) => {
   return async (event, lambdaContext) => {
     const processor = getProcessor(event);
-    const req = processor.createRequest(event);
-    const requestContext = getRequestContext(event);
+    let req, requestContext;
+    try {
+      req = processor.createRequest(event);
+      requestContext = getRequestContext(event);
+    } catch (error) {
+      console.error("Error processing request:", error);
+      const errorResponse = error instanceof TypeError ? new Response("Invalid request", { status: 400 }) : new Response("Internal Server Error", { status: 500 });
+      return processor.createResult(event, errorResponse, { isContentTypeBinary });
+    }
     const res = await app.fetch(req, {
       event,
       requestContext,
@@ -132,7 +140,9 @@ class EventProcessor {
       method
     };
     if (event.body) {
-      requestInit.body = event.isBase64Encoded ? (0, import_encode.decodeBase64)(event.body) : event.body;
+      const body = event.isBase64Encoded ? (0, import_encode.decodeBase64)(event.body) : new TextEncoder().encode(event.body);
+      requestInit.body = body;
+      headers.set("content-length", body.length.toString());
     }
     return new Request(url, requestInit);
   }
@@ -222,7 +232,7 @@ class EventV1Processor extends EventProcessor {
         ([key, values]) => values.map((value) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`).join("&")
       ).join("&");
     } else {
-      return Object.entries(event.queryStringParameters || {}).filter(([, value]) => value).map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value || "")}`).join("&");
+      return Object.entries(event.queryStringParameters || {}).filter(([, value]) => value !== void 0).map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value || "")}`).join("&");
     }
   }
   getCookies(_event, _headers) {
@@ -230,21 +240,17 @@ class EventV1Processor extends EventProcessor {
   getHeaders(event) {
     const headers = new Headers();
     this.getCookies(event, headers);
-    if (event.headers) {
-      for (const [k, v] of Object.entries(event.headers)) {
-        if (v) {
-          headers.set(k, sanitizeHeaderValue(v));
-        }
-      }
-    }
     if (event.multiValueHeaders) {
       for (const [k, values] of Object.entries(event.multiValueHeaders)) {
         if (values) {
-          const foundK = headers.get(k);
-          values.forEach((v) => {
-            const sanitizedValue = sanitizeHeaderValue(v);
-            return (!foundK || !foundK.includes(sanitizedValue)) && headers.append(k, sanitizedValue);
-          });
+          values.forEach((v) => headers.append(k, sanitizeHeaderValue(v)));
+        }
+      }
+    }
+    if (event.headers) {
+      for (const [k, v] of Object.entries(event.headers)) {
+        if (v && !headers.has(k)) {
+          headers.set(k, sanitizeHeaderValue(v));
         }
       }
     }
@@ -286,7 +292,7 @@ class ALBProcessor extends EventProcessor {
     if (event.multiValueQueryStringParameters) {
       return Object.entries(event.multiValueQueryStringParameters || {}).filter(([, value]) => value).map(([key, value]) => `${key}=${value.join(`&${key}=`)}`).join("&");
     } else {
-      return Object.entries(event.queryStringParameters || {}).filter(([, value]) => value).map(([key, value]) => `${key}=${value}`).join("&");
+      return Object.entries(event.queryStringParameters || {}).filter(([, value]) => value !== void 0).map(([key, value]) => `${key}=${value}`).join("&");
     }
   }
   getCookies(event, headers) {
@@ -304,7 +310,7 @@ class ALBProcessor extends EventProcessor {
     if (result.multiValueHeaders) {
       result.multiValueHeaders["set-cookie"] = cookies;
     } else {
-      result.headers["set-cookie"] = cookies.join(", ");
+      result.headers["set-cookie"] = cookies[0];
     }
   }
 }
@@ -324,11 +330,7 @@ class LatticeV2Processor extends EventProcessor {
     if (event.headers) {
       for (const [k, values] of Object.entries(event.headers)) {
         if (values) {
-          const foundK = headers.get(k);
-          values.forEach((v) => {
-            const sanitizedValue = sanitizeHeaderValue(v);
-            return (!foundK || !foundK.includes(sanitizedValue)) && headers.append(k, sanitizedValue);
-          });
+          values.forEach((v) => headers.append(k, sanitizeHeaderValue(v)));
         }
       }
     }
@@ -339,7 +341,7 @@ class LatticeV2Processor extends EventProcessor {
   setCookiesToResult(result, cookies) {
     result.headers = {
       ...result.headers,
-      "set-cookie": cookies.join(", ")
+      "set-cookie": cookies
     };
   }
 }
@@ -363,7 +365,7 @@ const isProxyEventALB = (event) => {
   return false;
 };
 const isProxyEventV2 = (event) => {
-  return Object.hasOwn(event, "rawPath");
+  return Object.hasOwn(event, "rawPath") && Object.hasOwn(event.requestContext ?? {}, "http");
 };
 const isLatticeEventV2 = (event) => {
   if (event.requestContext) {
@@ -372,15 +374,15 @@ const isLatticeEventV2 = (event) => {
   return false;
 };
 const defaultIsContentTypeBinary = (contentType) => {
-  return !/^text\/(?:plain|html|css|javascript|csv)|(?:\/|\+)(?:json|xml)\s*(?:;|$)/.test(
+  if (/^application\/vnd\.(?:apple\.installer|mozilla\.xul)\+xml\s*(?:;|$)/i.test(contentType)) {
+    return true;
+  }
+  return !/^text\/(?:plain|html|css|javascript|csv)|(?:\/|\+)(?:json|xml)\s*(?:;|$)/i.test(
     contentType
   );
 };
 const isContentEncodingBinary = (contentEncoding) => {
-  if (contentEncoding === null) {
-    return false;
-  }
-  return /^(gzip|deflate|compress|br)/.test(contentEncoding);
+  return !!contentEncoding && !/^identity$/i.test(contentEncoding);
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/node_modules/hono/dist/cjs/adapter/bun/serve-static.js

@@ -23,7 +23,7 @@ module.exports = __toCommonJS(serve_static_exports);
 var import_promises = require("node:fs/promises");
 var import_node_path = require("node:path");
 var import_serve_static = require("../../middleware/serve-static");
-const serveStatic = (options) => {
+const serveStatic = (options = {}) => {
   return async function serveStatic2(c, next) {
     const getContent = async (path) => {
       const file = Bun.file(path);

package/dist/node_modules/hono/dist/cjs/adapter/bun/websocket.js

@@ -48,7 +48,9 @@ const upgradeWebSocket = (0, import_websocket.defineWebSocketHelper)((c, events)
     data: {
       events,
       url: new URL(c.req.url),
-      protocol: c.req.url
+      // The first requested subprotocol, exposed via WSContext.protocol to
+      // match the deno and cloudflare adapters.
+      protocol: c.req.header("sec-websocket-protocol")?.split(",")[0]?.trim() ?? ""
     }
   });
   if (upgradeResult) {

package/dist/node_modules/hono/dist/cjs/adapter/cloudflare-workers/serve-static.js

@@ -22,7 +22,7 @@ __export(serve_static_exports, {
 module.exports = __toCommonJS(serve_static_exports);
 var import_serve_static = require("../../middleware/serve-static");
 var import_utils = require("./utils");
-const serveStatic = (options) => {
+const serveStatic = (options = {}) => {
   return async function serveStatic2(c, next) {
     const getContent = async (path) => {
       return (0, import_utils.getContentFromKVAsset)(path, {

package/dist/node_modules/hono/dist/cjs/adapter/deno/serve-static.js

@@ -23,7 +23,7 @@ module.exports = __toCommonJS(serve_static_exports);
 var import_node_path = require("node:path");
 var import_serve_static = require("../../middleware/serve-static");
 const { open, lstatSync, errors } = Deno;
-const serveStatic = (options) => {
+const serveStatic = (options = {}) => {
   return async function serveStatic2(c, next) {
     const getContent = async (path) => {
       try {

package/dist/node_modules/hono/dist/cjs/adapter/deno/websocket.js

@@ -25,7 +25,11 @@ const upgradeWebSocket = (0, import_websocket.defineWebSocketHelper)(async (c, e
   if (c.req.header("upgrade") !== "websocket") {
     return;
   }
-  const { response, socket } = Deno.upgradeWebSocket(c.req.raw, options ?? {});
+  const subprotocol = c.req.header("sec-websocket-protocol")?.split(",")[0]?.trim();
+  const { response, socket } = Deno.upgradeWebSocket(c.req.raw, {
+    ...subprotocol ? { protocol: subprotocol } : {},
+    ...options
+  });
   const wsContext = new import_websocket.WSContext({
     close: (code, reason) => socket.close(code, reason),
     get protocol() {

package/dist/node_modules/hono/dist/cjs/adapter/lambda-edge/handler.js

@@ -48,21 +48,32 @@ const convertHeaders = (headers) => {
 const handle = (app) => {
   return async (event, ...args) => {
     const [context, callback] = args;
-    const res = await app.fetch(createRequest(event), {
+    let callbackError = null;
+    let callbackResult;
+    const cf = getCloudFrontRecord(event);
+    const res = await app.fetch(createRequest(cf), {
       event,
       context,
       callback: (err, result) => {
+        if (!callbackError && !callbackResult) {
+          callbackError = err;
+          callbackResult = result;
+        }
         callback?.(err, result);
       },
-      config: event.Records[0].cf.config,
-      request: event.Records[0].cf.request,
-      response: event.Records[0].cf.response
+      config: cf.config,
+      request: cf.request,
+      response: cf.response
     });
-    return createResult(res);
+    if (callbackError) {
+      throw callbackError;
+    }
+    return callbackResult ?? createResult(res);
   };
 };
 const createResult = async (res) => {
-  const isBase64Encoded = isContentTypeBinary(res.headers.get("content-type") || "");
+  const contentEncoding = res.headers.get("content-encoding");
+  const isBase64Encoded = isContentTypeBinary(res.headers.get("content-type") || "") || !!contentEncoding && !/^identity$/i.test(contentEncoding);
   const body = isBase64Encoded ? (0, import_encode.encodeBase64)(await res.arrayBuffer()) : await res.text();
   return {
     status: res.status.toString(),
@@ -71,18 +82,34 @@ const createResult = async (res) => {
     ...isBase64Encoded && { bodyEncoding: "base64" }
   };
 };
-const createRequest = (event) => {
-  const queryString = event.Records[0].cf.request.querystring;
-  const host = event.Records[0].cf.request.headers?.host?.[0]?.value || event.Records[0].cf.config.distributionDomainName;
-  const urlPath = `https://${host}${event.Records[0].cf.request.uri}`;
+const getCloudFrontRecord = (event) => {
+  const cf = event?.Records?.[0]?.cf;
+  if (!cf?.request) {
+    throw new TypeError(
+      "Unable to map the CloudFront event to a Request: expected `Records[0].cf.request` in the Lambda@Edge event."
+    );
+  }
+  return cf;
+};
+const createRequest = (cf) => {
+  const request = cf.request;
+  const queryString = request.querystring;
+  const host = request.headers?.host?.[0]?.value || cf.config?.distributionDomainName;
+  const urlPath = `https://${host}${request.uri}`;
   const url = queryString ? `${urlPath}?${queryString}` : urlPath;
   const headers = new Headers();
-  Object.entries(event.Records[0].cf.request.headers).forEach(([k, v]) => {
-    v.forEach((header) => headers.set(k, header.value));
+  Object.entries(request.headers ?? {}).forEach(([k, v]) => {
+    v.forEach((header) => headers.append(k, header.value));
   });
-  const requestBody = event.Records[0].cf.request.body;
-  const method = event.Records[0].cf.request.method;
-  const body = createBody(method, requestBody);
+  const requestBody = request.body;
+  const method = request.method;
+  const rawBody = createBody(method, requestBody);
+  let body = rawBody;
+  if (rawBody !== void 0) {
+    const bytes = typeof rawBody === "string" ? new TextEncoder().encode(rawBody) : rawBody;
+    body = bytes;
+    headers.set("content-length", bytes.length.toString());
+  }
   return new Request(url, {
     headers,
     method,
@@ -102,7 +129,10 @@ const createBody = (method, requestBody) => {
   return requestBody.data;
 };
 const isContentTypeBinary = (contentType) => {
-  return !/^(text\/(plain|html|css|javascript|csv).*|application\/(.*json|.*xml).*|image\/svg\+xml.*)$/.test(
+  if (/^application\/vnd\.(?:apple\.installer|mozilla\.xul)\+xml\s*(?:;|$)/i.test(contentType)) {
+    return true;
+  }
+  return !/^text\/(?:plain|html|css|javascript|csv)|(?:\/|\+)(?:json|xml)\s*(?:;|$)/i.test(
     contentType
   );
 };

package/dist/node_modules/hono/dist/cjs/client/client.js

@@ -40,6 +40,10 @@ const createProxy = (callback, path) => {
   });
   return proxy;
 };
+const appendQueryParams = (url, searchParams) => {
+  const queryString = searchParams.toString();
+  return queryString ? `${url}?${queryString}` : url;
+};
 class ClientRequestImpl {
   url;
   method;
@@ -66,6 +70,9 @@ class ClientRequestImpl {
           }
           if (Array.isArray(v)) {
             for (const v2 of v) {
+              if (v2 === void 0) {
+                continue;
+              }
               form.append(k, v2);
             }
           } else {
@@ -74,7 +81,7 @@ class ClientRequestImpl {
         }
         this.rBody = form;
       }
-      if (args.json) {
+      if (args.json !== void 0) {
         this.rBody = JSON.stringify(args.json);
         this.cType = "application/json";
       }
@@ -90,19 +97,29 @@ class ClientRequestImpl {
     if (args?.cookie) {
       const cookies = [];
       for (const [key, value] of Object.entries(args.cookie)) {
-        cookies.push((0, import_cookie.serialize)(key, value, { path: "/" }));
+        if (value === void 0) {
+          continue;
+        }
+        cookies.push((0, import_cookie.serialize)(key, value));
+      }
+      if (cookies.length > 0) {
+        headerValues["Cookie"] = cookies.join("; ");
       }
-      headerValues["Cookie"] = cookies.join(",");
     }
     if (this.cType) {
       headerValues["Content-Type"] = this.cType;
     }
-    const headers = new Headers(headerValues ?? void 0);
+    const headers = new Headers();
+    for (const [key, value] of Object.entries(headerValues)) {
+      if (value !== void 0) {
+        headers.set(key, value);
+      }
+    }
     let url = this.url;
     url = (0, import_utils.removeIndexString)(url);
     url = (0, import_utils.replaceUrlParam)(url, this.pathParams);
     if (this.queryParams) {
-      url = url + "?" + this.queryParams.toString();
+      url = appendQueryParams(url, this.queryParams);
     }
     methodUpperCase = this.method.toUpperCase();
     const setBody = !(methodUpperCase === "GET" || methodUpperCase === "HEAD");
@@ -140,35 +157,32 @@ const hc = (baseUrl, options) => createProxy(function proxyCallback(opts) {
   const path = parts.join("/");
   const url = (0, import_utils.mergePath)(baseUrl, path);
   if (method === "url" || method === "path") {
-    let result = url;
+    let result = (0, import_utils.removeIndexString)(url);
     if (opts.args[0]) {
       if (opts.args[0].param) {
-        result = (0, import_utils.replaceUrlParam)(url, opts.args[0].param);
+        result = (0, import_utils.replaceUrlParam)(result, opts.args[0].param);
       }
       if (opts.args[0].query) {
-        result = result + "?" + buildSearchParamsOption(opts.args[0].query).toString();
+        result = appendQueryParams(result, buildSearchParamsOption(opts.args[0].query));
       }
     }
-    result = (0, import_utils.removeIndexString)(result);
     if (method === "url") {
       return new URL(result);
     }
     return result.slice(baseUrl.replace(/\/+$/, "").length).replace(/^\/?/, "/");
   }
   if (method === "ws") {
+    const normalizedUrl = (0, import_utils.removeIndexString)(url);
     const webSocketUrl = (0, import_utils.replaceUrlProtocol)(
-      opts.args[0] && opts.args[0].param ? (0, import_utils.replaceUrlParam)(url, opts.args[0].param) : url,
+      opts.args[0]?.param ? (0, import_utils.replaceUrlParam)(normalizedUrl, opts.args[0].param) : normalizedUrl,
       "ws"
     );
     const targetUrl = new URL(webSocketUrl);
     const queryParams = opts.args[0]?.query;
     if (queryParams) {
-      Object.entries(queryParams).forEach(([key, value]) => {
-        if (Array.isArray(value)) {
-          value.forEach((item) => targetUrl.searchParams.append(key, item));
-        } else {
-          targetUrl.searchParams.set(key, value);
-        }
+      const searchParams = buildSearchParamsOption(queryParams);
+      searchParams.forEach((value, key) => {
+        targetUrl.searchParams.append(key, value);
       });
     }
     const establishWebSocket = (...args) => {
@@ -184,7 +198,16 @@ const hc = (baseUrl, options) => createProxy(function proxyCallback(opts) {
   });
   if (method) {
     options ??= {};
-    const args = (0, import_utils.deepMerge)(options, { ...opts.args[1] });
+    const reqOptions = { ...opts.args[1] };
+    const baseHeaders = options.headers;
+    const reqHeaders = reqOptions.headers;
+    if (baseHeaders && reqHeaders) {
+      reqOptions.headers = async () => ({
+        ...typeof baseHeaders === "function" ? await baseHeaders() : baseHeaders,
+        ...typeof reqHeaders === "function" ? await reqHeaders() : reqHeaders
+      });
+    }
+    const args = (0, import_utils.deepMerge)(options, reqOptions);
     return req.fetch(opts.args[0], args);
   }
   return req;

package/dist/node_modules/hono/dist/cjs/client/utils.js

@@ -36,8 +36,8 @@ const mergePath = (base, path) => {
 };
 const replaceUrlParam = (urlString, params) => {
   for (const [k, v] of Object.entries(params)) {
-    const reg = new RegExp("/:" + k + "(?:{[^/]+})?\\??");
-    urlString = urlString.replace(reg, v ? `/${v}` : "");
+    const reg = new RegExp("/:" + k + "(?:{[^/]+})?\\??(?=/|$)");
+    urlString = urlString.replace(reg, () => v ? `/${v}` : "");
   }
   return urlString;
 };
@@ -49,6 +49,9 @@ const buildSearchParams = (query) => {
     }
     if (Array.isArray(v)) {
       for (const v2 of v) {
+        if (v2 === void 0) {
+          continue;
+        }
         searchParams.append(k, v2);
       }
     } else {

package/dist/node_modules/hono/dist/cjs/context.js

@@ -224,6 +224,10 @@ class Context {
    *   c.header('X-Message', 'Hello!')
    *   c.header('Content-Type', 'text/plain')
    *
+   *   // Append multiple headers using the append option (e.g. Vary)
+   *   c.header('Vary', 'Accept-Encoding', { append: true })
+   *   c.header('Vary', 'User-Agent', { append: true })
+   *
    *   return c.body('Thank you for coming')
    * })
    * ```
@@ -295,11 +299,11 @@ class Context {
     return Object.fromEntries(this.#var);
   }
   #newResponse(data, arg, headers) {
-    const responseHeaders = this.#res ? new Headers(this.#res.headers) : this.#preparedHeaders ?? new Headers();
-    if (typeof arg === "object" && "headers" in arg) {
-      const argHeaders = arg.headers instanceof Headers ? arg.headers : new Headers(arg.headers);
-      for (const [key, value] of argHeaders) {
-        if (key.toLowerCase() === "set-cookie") {
+    let responseHeaders = this.#res ? new Headers(this.#res.headers) : this.#preparedHeaders;
+    if (typeof arg === "object" && arg.headers) {
+      responseHeaders ??= new Headers();
+      for (const [key, value] of new Headers(arg.headers)) {
+        if (key === "set-cookie") {
           responseHeaders.append(key, value);
         } else {
           responseHeaders.set(key, value);
@@ -307,19 +311,34 @@ class Context {
       }
     }
     if (headers) {
-      for (const [k, v] of Object.entries(headers)) {
-        if (typeof v === "string") {
-          responseHeaders.set(k, v);
-        } else {
-          responseHeaders.delete(k);
-          for (const v2 of v) {
-            responseHeaders.append(k, v2);
+      if (!responseHeaders) {
+        let count = 0;
+        for (const k in headers) {
+          if (++count > 1 || typeof headers[k] !== "string") {
+            responseHeaders = new Headers();
+            break;
+          }
+        }
+      }
+      if (responseHeaders) {
+        for (const k in headers) {
+          const v = headers[k];
+          if (typeof v === "string") {
+            responseHeaders.set(k, v);
+          } else {
+            responseHeaders.delete(k);
+            for (const v2 of v) {
+              responseHeaders.append(k, v2);
+            }
           }
         }
       }
     }
     const status = typeof arg === "number" ? arg : arg?.status ?? this.#status;
-    return createResponseInstance(data, { status, headers: responseHeaders });
+    return createResponseInstance(data, {
+      status,
+      headers: responseHeaders ?? headers
+    });
   }
   newResponse = (...args) => this.#newResponse(...args);
   /**
@@ -405,7 +424,7 @@ class Context {
     const locationString = String(location);
     this.header(
       "Location",
-      // Multibyes should be encoded
+      // Multibytes should be encoded
       // eslint-disable-next-line no-control-regex
       !/[^\x00-\xFF]/.test(locationString) ? locationString : encodeURI(locationString)
     );

package/dist/node_modules/hono/dist/cjs/helper/accepts/accepts.js

@@ -22,10 +22,46 @@ __export(accepts_exports, {
 });
 module.exports = __toCommonJS(accepts_exports);
 var import_accept = require("../../utils/accept");
+const matchType = (acceptType, supportedType) => {
+  const accept = acceptType.toLowerCase();
+  const supported = supportedType.toLowerCase();
+  if (accept === supported) {
+    return true;
+  }
+  if (accept === "*/*" || accept === "*") {
+    return false;
+  }
+  if (accept.endsWith("/*")) {
+    const [acceptMain] = accept.split("/");
+    const [supportedMain] = supported.split("/");
+    return acceptMain === supportedMain;
+  }
+  return false;
+};
+const getSpecificity = (type) => {
+  if (type === "*/*" || type === "*") {
+    return 1;
+  }
+  if (type.endsWith("/*")) {
+    return 2;
+  }
+  return 3;
+};
 const defaultMatch = (accepts2, config) => {
   const { supports, default: defaultSupport } = config;
-  const accept = accepts2.sort((a, b) => b.q - a.q).find((accept2) => supports.includes(accept2.type));
-  return accept ? accept.type : defaultSupport;
+  const sortedAccepts = accepts2.filter((accept) => accept.q > 0).sort((a, b) => {
+    if (b.q !== a.q) {
+      return b.q - a.q;
+    }
+    return getSpecificity(b.type) - getSpecificity(a.type);
+  });
+  for (const accept of sortedAccepts) {
+    const matched = supports.find((supported) => matchType(accept.type, supported));
+    if (matched) {
+      return matched;
+    }
+  }
+  return defaultSupport;
 };
 const accepts = (c, options) => {
   const acceptHeader = c.req.header(options.header);

package/dist/node_modules/hono/dist/cjs/helper/css/common.js

@@ -61,6 +61,7 @@ const normalizeLabel = (label) => {
   return label.trim().replace(/\s+/g, "-");
 };
 const isValidClassName = (name) => /^-?[_a-zA-Z][_a-zA-Z0-9-]*$/.test(name);
+const hasUnsafeSelectorChar = (name) => /[<{}]/.test(name);
 const RESERVED_KEYFRAME_NAMES = /* @__PURE__ */ new Set([
   "default",
   "inherit",
@@ -198,7 +199,8 @@ const cxCommon = (args) => {
         [CLASS_NAME]: "",
         [STYLE_STRING]: "",
         [SELECTORS]: [],
-        [EXTERNAL_CLASS_NAMES]: [arg]
+        // drop names that are unsafe to emit as a selector
+        [EXTERNAL_CLASS_NAMES]: hasUnsafeSelectorChar(arg) ? [] : [arg]
       };
     }
   }

package/dist/node_modules/hono/dist/cjs/helper/css/index.js

@@ -29,6 +29,7 @@ module.exports = __toCommonJS(css_exports);
 var import_html = require("../../helper/html");
 var import_constants = require("../../jsx/constants");
 var import_css = require("../../jsx/dom/css");
+var import_html2 = require("../../utils/html");
 var import_common = require("./common");
 var import_common2 = require("./common");
 const createCssContext = ({
@@ -88,7 +89,14 @@ const createCssContext = ({
       }
       return Promise.resolve((0, import_html.raw)("", [appendStyle]));
     };
-    const className = new String(cssClassName[import_common.CLASS_NAME]);
+    const rawClassName = cssClassName[import_common.CLASS_NAME];
+    let escapedClassName = rawClassName;
+    if (/[&<>'"]/.test(rawClassName)) {
+      const escapedBuffer = [""];
+      (0, import_html2.escapeToBuffer)(rawClassName, escapedBuffer);
+      escapedClassName = escapedBuffer[0];
+    }
+    const className = new String(escapedClassName);
     Object.assign(className, cssClassName);
     className.isEscaped = true;
     className.callbacks = [addClassNameToContext];

package/dist/node_modules/hono/dist/cjs/helper/proxy/index.js

@@ -92,6 +92,10 @@ const proxy = async (input, proxyInit) => {
   req.headers.delete("accept-encoding");
   const res = await (customFetch || fetch)(req);
   const resHeaders = new Headers(res.headers);
+  const connectionValue = resHeaders.get("connection");
+  if (connectionValue) {
+    connectionValue.split(",").map((h) => h.trim()).filter((h) => ALLOWED_TOKEN_PATTERN.test(h)).forEach((h) => resHeaders.delete(h));
+  }
   hopByHopHeaders.forEach((header) => {
     resHeaders.delete(header);
   });

package/dist/node_modules/hono/dist/cjs/helper/ssg/ssg.js

@@ -69,6 +69,8 @@ const defaultExtensionMap = {
   "text/html": "html",
   "text/xml": "xml",
   "application/xml": "xml",
+  "application/atom+xml": "xml",
+  "application/rss+xml": "xml",
   "application/yaml": "yaml"
 };
 const determineExtension = (mimeType, userExtensionMap) => {
@@ -204,7 +206,7 @@ const saveContentToFile = async (data, fsModule, outDir, extensionMap) => {
   const { routePath, content, mimeType } = awaitedData;
   const filePath = generateFilePath(routePath, outDir, mimeType, extensionMap);
   const dirPath = (0, import_utils2.dirname)(filePath);
-  if (!createdDirs.has(dirPath)) {
+  if (dirPath !== "" && !createdDirs.has(dirPath)) {
     await fsModule.mkdir(dirPath, { recursive: true });
     createdDirs.add(dirPath);
   }