@nocobase/plugin-mcp-server 2.4.0-alpha.7 → 2.4.0-alpha.9

package/dist/node_modules/hono/dist/jsx/utils.js

@@ -10,18 +10,166 @@ var normalizeElementKeyMap = /* @__PURE__ */ new Map([
   ["formAction", "formaction"]
 ]);
 var normalizeIntrinsicElementKey = (key) => normalizeElementKeyMap.get(key) || key;
+var invalidAttributeNameCharRe = /[\s"'<>/=`\\\x00-\x1f\x7f-\x9f]/;
+var validAttributeNameCache = /* @__PURE__ */ new Set();
+var validAttributeNameCacheMax = 1024;
+var invalidTagNameCharRe = /^[!?]|[\s"'<>/=`\\\x00-\x1f\x7f-\x9f]/;
+var validTagNameCache = /* @__PURE__ */ new Set();
+var validTagNameCacheMax = 256;
+var cacheValidName = (cache, max, name) => {
+  if (cache.size >= max) {
+    cache.clear();
+  }
+  cache.add(name);
+};
+var isValidTagName = (name) => {
+  if (validTagNameCache.has(name)) {
+    return true;
+  }
+  if (typeof name !== "string") {
+    return false;
+  }
+  if (name.length === 0) {
+    return true;
+  }
+  if (invalidTagNameCharRe.test(name)) {
+    return false;
+  }
+  cacheValidName(validTagNameCache, validTagNameCacheMax, name);
+  return true;
+};
+var isValidAttributeName = (name) => {
+  if (validAttributeNameCache.has(name)) {
+    return true;
+  }
+  const len = name.length;
+  if (len === 0) {
+    return false;
+  }
+  for (let i = 0; i < len; i++) {
+    const c = name.charCodeAt(i);
+    if (!(c >= 97 && c <= 122 || // a-z
+    c >= 65 && c <= 90 || // A-Z
+    c >= 48 && c <= 57 || // 0-9
+    c === 45 || // -
+    c === 95 || // _
+    c === 46 || // .
+    c === 58)) {
+      if (!invalidAttributeNameCharRe.test(name)) {
+        cacheValidName(validAttributeNameCache, validAttributeNameCacheMax, name);
+        return true;
+      } else {
+        return false;
+      }
+    }
+  }
+  cacheValidName(validAttributeNameCache, validAttributeNameCacheMax, name);
+  return true;
+};
+var invalidStylePropertyNameCharRe = /[\s"'():;\\/\[\]{}\x00-\x1f\x7f-\x9f]/;
+var validStylePropertyNameCache = /* @__PURE__ */ new Set();
+var validStylePropertyNameCacheMax = 1024;
+var isValidStylePropertyName = (name) => {
+  if (validStylePropertyNameCache.has(name)) {
+    return true;
+  }
+  const len = name.length;
+  if (len === 0) {
+    return false;
+  }
+  for (let i = 0; i < len; i++) {
+    const c = name.charCodeAt(i);
+    if (!(c >= 97 && c <= 122 || // a-z
+    c >= 65 && c <= 90 || // A-Z
+    c >= 48 && c <= 57 || // 0-9
+    c === 45 || // -
+    c === 95)) {
+      if (!invalidStylePropertyNameCharRe.test(name)) {
+        cacheValidName(validStylePropertyNameCache, validStylePropertyNameCacheMax, name);
+        return true;
+      } else {
+        return false;
+      }
+    }
+  }
+  cacheValidName(validStylePropertyNameCache, validStylePropertyNameCacheMax, name);
+  return true;
+};
+var unsafeStyleValueCharRe = /[;"'\\/\[\](){}]/;
+var hasUnsafeStyleValue = (value) => {
+  if (!unsafeStyleValueCharRe.test(value)) {
+    return false;
+  }
+  let quote = 0;
+  const blockStack = [];
+  for (let i = 0, len = value.length; i < len; i++) {
+    const c = value.charCodeAt(i);
+    if (c === 92) {
+      if (i === len - 1) {
+        return true;
+      }
+      i++;
+    } else if (quote !== 0) {
+      if (c === 10 || c === 12 || c === 13) {
+        return true;
+      }
+      if (c === quote) {
+        quote = 0;
+      }
+    } else if (c === 47 && value.charCodeAt(i + 1) === 42) {
+      const end = value.indexOf("*/", i + 2);
+      if (end === -1) {
+        return true;
+      }
+      i = end + 1;
+    } else if (c === 34 || c === 39) {
+      quote = c;
+    } else if (c === 40) {
+      blockStack.push(41);
+    } else if (c === 91) {
+      blockStack.push(93);
+    } else if (c === 123 || c === 125) {
+      return true;
+    } else if (c === 41 || c === 93) {
+      if (blockStack[blockStack.length - 1] !== c) {
+        return true;
+      }
+      blockStack.pop();
+    } else if (c === 59 && blockStack.length === 0) {
+      return true;
+    }
+  }
+  return quote !== 0 || blockStack.length !== 0;
+};
 var styleObjectForEach = (style, fn) => {
   for (const [k, v] of Object.entries(style)) {
     const key = k[0] === "-" || !/[A-Z]/.test(k) ? k : k.replace(/[A-Z]/g, (m) => `-${m.toLowerCase()}`);
-    fn(
-      key,
-      v == null ? null : typeof v === "number" ? !key.match(
+    if (!isValidStylePropertyName(key)) {
+      continue;
+    }
+    if (v == null) {
+      fn(key, null);
+      continue;
+    }
+    let value;
+    if (typeof v === "number") {
+      value = !key.match(
         /^(?:a|border-im|column(?:-c|s)|flex(?:$|-[^b])|grid-(?:ar|[^a])|font-w|li|or|sca|st|ta|wido|z)|ty$/
-      ) ? `${v}px` : `${v}` : v
-    );
+      ) ? `${v}px` : `${v}`;
+    } else if (typeof v === "string") {
+      if (hasUnsafeStyleValue(v)) {
+        continue;
+      }
+      value = v;
+    } else {
+      continue;
+    }
+    fn(key, value);
   }
 };
 export {
+  isValidAttributeName,
+  isValidTagName,
   normalizeIntrinsicElementKey,
   styleObjectForEach
 };

package/dist/node_modules/hono/dist/middleware/bearer-auth/index.js

@@ -6,7 +6,7 @@ var PREFIX = "Bearer";
 var HEADER = "Authorization";
 var bearerAuth = (options) => {
   if (!("token" in options || "verifyToken" in options)) {
-    throw new Error('bearer auth middleware requires options for "token"');
+    throw new Error('bearer auth middleware requires options for "token" or "verifyToken"');
   }
   if (!options.realm) {
     options.realm = "";

package/dist/node_modules/hono/dist/middleware/body-limit/index.js

@@ -1,12 +1,6 @@
 // src/middleware/body-limit/index.ts
 import { HTTPException } from "../../http-exception.js";
 var ERROR_MESSAGE = "Payload Too Large";
-var BodyLimitError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "BodyLimitError";
-  }
-};
 var bodyLimit = (options) => {
   const onError = options.onError || (() => {
     const res = new Response(ERROR_MESSAGE, {
@@ -21,40 +15,37 @@ var bodyLimit = (options) => {
     }
     const hasTransferEncoding = c.req.raw.headers.has("transfer-encoding");
     const hasContentLength = c.req.raw.headers.has("content-length");
-    if (hasTransferEncoding && hasContentLength) {
-    }
     if (hasContentLength && !hasTransferEncoding) {
       const contentLength = parseInt(c.req.raw.headers.get("content-length") || "0", 10);
       return contentLength > maxSize ? onError(c) : next();
     }
     let size = 0;
+    const chunks = [];
     const rawReader = c.req.raw.body.getReader();
-    const reader = new ReadableStream({
-      async start(controller) {
-        try {
-          for (; ; ) {
-            const { done, value } = await rawReader.read();
-            if (done) {
-              break;
-            }
-            size += value.length;
-            if (size > maxSize) {
-              controller.error(new BodyLimitError(ERROR_MESSAGE));
-              break;
-            }
-            controller.enqueue(value);
+    for (; ; ) {
+      const { done, value } = await rawReader.read();
+      if (done) {
+        break;
+      }
+      size += value.length;
+      if (size > maxSize) {
+        return onError(c);
+      }
+      chunks.push(value);
+    }
+    const requestInit = {
+      body: new ReadableStream({
+        start(controller) {
+          for (const chunk of chunks) {
+            controller.enqueue(chunk);
           }
-        } finally {
           controller.close();
         }
-      }
-    });
-    const requestInit = { body: reader, duplex: "half" };
+      }),
+      duplex: "half"
+    };
     c.req.raw = new Request(c.req.raw, requestInit);
-    await next();
-    if (c.error instanceof BodyLimitError) {
-      c.res = await onError(c);
-    }
+    return next();
   };
 };
 export {

package/dist/node_modules/hono/dist/middleware/cache/index.js

@@ -1,30 +1,113 @@
 // src/middleware/cache/index.ts
+import { cloneRawRequest } from "../../request.js";
+import { sha256 } from "../../utils/crypto.js";
 var defaultCacheableStatusCodes = [200];
-var shouldSkipCache = (res) => {
-  const vary = res.headers.get("Vary");
-  if (vary && vary.includes("*")) {
-    return true;
+var defaultMaxQueryBodySize = 64 * 1024;
+var cacheKeyPath = "/.hono/cache";
+var cacheKeyParameter = "__hono_cache_key";
+var cacheMethodKeyParameter = "__hono_cache_method";
+var queryDigestKeyParameter = "__hono_query_digest";
+var cacheVaryKeyParameter = "__hono_cache_vary";
+var queryRepresentationMetadataHeaders = [
+  "content-type",
+  "content-encoding",
+  "content-language",
+  "content-location"
+];
+var shouldSkipCacheControl = (cacheControl) => !!cacheControl && /(?:^|,\s*)(?:private|no-(?:store|cache))(?:\s*(?:=|,|$))/i.test(cacheControl);
+var parseVaryDirectives = (vary) => {
+  if (vary == null) {
+    return [];
   }
-  const cacheControl = res.headers.get("Cache-Control");
-  if (cacheControl && /(?:^|,\s*)(?:private|no-(?:store|cache))(?:\s*(?:=|,|$))/i.test(cacheControl)) {
-    return true;
+  return (Array.isArray(vary) ? vary : vary.split(",")).map((directive) => directive.trim().toLowerCase()).filter(Boolean);
+};
+var createCacheKey = (key, requestUrl, request, varyHeaders) => {
+  const url = new URL(cacheKeyPath, requestUrl);
+  url.searchParams.append(cacheKeyParameter, key);
+  url.searchParams.append(cacheMethodKeyParameter, request.method);
+  if (request.method === "QUERY") {
+    url.searchParams.append(queryDigestKeyParameter, request.digest);
+  }
+  for (const header of varyHeaders) {
+    url.searchParams.append(cacheVaryKeyParameter, JSON.stringify(header));
+  }
+  return url.href;
+};
+var shouldSkipCache = (res, optionsVaryDirectives, responseVary) => responseVary.length && (!optionsVaryDirectives || responseVary.some((name) => !optionsVaryDirectives.has(name))) || shouldSkipCacheControl(res.headers.get("Cache-Control")) || res.headers.has("Set-Cookie");
+var reportCacheNotAvailable = (onCacheNotAvailable, reason) => {
+  if (onCacheNotAvailable === false) {
+  } else if (onCacheNotAvailable) {
+    onCacheNotAvailable(reason);
+  } else {
+    console.log(reason);
+  }
+};
+var createQueryDigest = async (c, maxQueryBodySize) => {
+  if (!globalThis.crypto?.subtle) {
+    return void 0;
+  }
+  if (c.req.raw.bodyUsed && Object.keys(c.req.bodyCache)[0] === "formData") {
+    return void 0;
   }
-  if (res.headers.has("Set-Cookie")) {
-    return true;
+  try {
+    const requestHeaders = c.req.raw.headers;
+    const metadata = new TextEncoder().encode(
+      JSON.stringify(
+        queryRepresentationMetadataHeaders.map((header) => [header, requestHeaders.get(header)])
+      )
+    );
+    const body = (await cloneRawRequest(c.req)).body;
+    const chunks = [];
+    let bodySize = 0;
+    if (body) {
+      const reader = body.getReader();
+      for (; ; ) {
+        const { done, value } = await reader.read();
+        if (done) {
+          break;
+        }
+        bodySize += value.byteLength;
+        if (bodySize > maxQueryBodySize) {
+          void reader.cancel().catch(() => {
+          });
+          return void 0;
+        }
+        chunks.push(value);
+      }
+    }
+    const data = new Uint8Array(metadata.byteLength + bodySize);
+    data.set(metadata);
+    let offset = metadata.byteLength;
+    for (const chunk of chunks) {
+      data.set(chunk, offset);
+      offset += chunk.byteLength;
+    }
+    return await sha256(data) ?? void 0;
+  } catch {
+    return void 0;
   }
-  return false;
 };
 var cache = (options) => {
   if (!globalThis.caches) {
-    console.log("Cache Middleware is not enabled because caches is not defined.");
+    reportCacheNotAvailable(
+      options.onCacheNotAvailable,
+      "Cache Middleware is not enabled because caches is not defined."
+    );
     return async (_c, next) => await next();
   }
+  if (!globalThis.crypto?.subtle) {
+    reportCacheNotAvailable(
+      options.onCacheNotAvailable,
+      "Cache Middleware cannot cache QUERY requests because Web Crypto is not available."
+    );
+  }
   if (options.wait === void 0) {
     options.wait = false;
   }
   const cacheControlDirectives = options.cacheControl?.split(",").map((directive) => directive.toLowerCase());
-  const varyDirectives = Array.isArray(options.vary) ? options.vary : options.vary?.split(",").map((directive) => directive.trim());
-  if (options.vary?.includes("*")) {
+  const optionsVaryList = parseVaryDirectives(options.vary);
+  const varyDirectives = optionsVaryList.length ? new Set(optionsVaryList) : void 0;
+  if (varyDirectives?.has("*")) {
     throw new Error(
       'Middleware vary configuration cannot include "*", as it disallows effective caching.'
     );
@@ -32,9 +115,10 @@ var cache = (options) => {
   const cacheableStatusCodes = new Set(
     options.cacheableStatusCodes ?? defaultCacheableStatusCodes
   );
-  const addHeader = (c) => {
+  const maxQueryBodySize = options.maxQueryBodySize ?? defaultMaxQueryBodySize;
+  const addHeader = (c, responseVary) => {
     if (cacheControlDirectives) {
-      const existingDirectives = c.res.headers.get("Cache-Control")?.split(",").map((d) => d.trim().split("=", 1)[0]) ?? [];
+      const existingDirectives = c.res.headers.get("Cache-Control")?.split(",").map((d) => d.trim().split("=", 1)[0].toLowerCase()) ?? [];
       for (const directive of cacheControlDirectives) {
         let [name, value] = directive.trim().split("=", 2);
         name = name.toLowerCase();
@@ -44,24 +128,47 @@ var cache = (options) => {
       }
     }
     if (varyDirectives) {
-      const existingDirectives = c.res.headers.get("Vary")?.split(",").map((d) => d.trim()) ?? [];
-      const vary = Array.from(
-        new Set(
-          [...existingDirectives, ...varyDirectives].map((directive) => directive.toLowerCase())
-        )
-      ).sort();
-      if (vary.includes("*")) {
-        c.header("Vary", "*");
+      if (responseVary.length === 0) {
+        c.header("Vary", Array.from(varyDirectives).join(", "));
       } else {
-        c.header("Vary", vary.join(", "));
+        const merged = new Set(varyDirectives);
+        for (const directive of responseVary) {
+          merged.add(directive);
+        }
+        if (merged.has("*")) {
+          c.header("Vary", "*");
+        } else {
+          c.header("Vary", Array.from(merged).join(", "));
+        }
       }
     }
   };
   return async function cache2(c, next) {
+    if (c.req.method !== "GET" && c.req.method !== "QUERY" || c.req.raw.headers.has("Authorization")) {
+      await next();
+      return;
+    }
+    let cacheKeyRequest = { method: "GET" };
+    if (c.req.method === "QUERY") {
+      const digest = await createQueryDigest(c, maxQueryBodySize);
+      if (digest === void 0) {
+        await next();
+        return;
+      }
+      cacheKeyRequest = { method: "QUERY", digest };
+    }
     let key = c.req.url;
     if (options.keyGenerator) {
       key = await options.keyGenerator(c);
     }
+    const varyHeaders = [];
+    if (varyDirectives) {
+      for (const directive of varyDirectives) {
+        const value = c.req.raw.headers.get(directive) ?? "";
+        varyHeaders.push([directive, value]);
+      }
+    }
+    key = createCacheKey(key, c.req.url, cacheKeyRequest, varyHeaders);
     const cacheName = typeof options.cacheName === "function" ? await options.cacheName(c) : options.cacheName;
     const cache3 = await caches.open(cacheName);
     const response = await cache3.match(key);
@@ -72,8 +179,9 @@ var cache = (options) => {
     if (!cacheableStatusCodes.has(c.res.status)) {
       return;
     }
-    addHeader(c);
-    if (shouldSkipCache(c.res)) {
+    const responseVary = parseVaryDirectives(c.res.headers.get("Vary"));
+    addHeader(c, responseVary);
+    if (shouldSkipCache(c.res, varyDirectives, responseVary)) {
       return;
     }
     const res = c.res.clone();

package/dist/node_modules/hono/dist/middleware/compress/index.js

@@ -1,13 +1,43 @@
 // src/middleware/compress/index.ts
+import { parseAccept } from "../../utils/accept.js";
 import { COMPRESSIBLE_CONTENT_TYPE_REGEX } from "../../utils/compress.js";
 var ENCODING_TYPES = ["gzip", "deflate"];
 var cacheControlNoTransformRegExp = /(?:^|,)\s*?no-transform\s*?(?:,|$)/i;
+var selectEncoding = (header, candidates) => {
+  if (header === void 0) {
+    return void 0;
+  }
+  const accepts = parseAccept(header);
+  const wildcardQ = accepts.find((a) => a.type === "*")?.q;
+  let best;
+  for (const enc of candidates) {
+    const explicit = accepts.find((a) => a.type.toLowerCase() === enc);
+    const q = explicit ? explicit.q : wildcardQ ?? 0;
+    if (q === 1) {
+      return enc;
+    } else if (q > 0 && (!best || q > best.q)) {
+      best = { encoding: enc, q };
+    }
+  }
+  return best?.encoding;
+};
+var varyAcceptEncodingRegExp = /(?:^|,)\s*accept-encoding\s*(?:,|$)/i;
 var compress = (options) => {
   const threshold = options?.threshold ?? 1024;
+  const candidates = options?.encoding ? [options.encoding] : ENCODING_TYPES;
+  const contentTypeFilter = options?.contentTypeFilter ?? COMPRESSIBLE_CONTENT_TYPE_REGEX;
+  const shouldCompress = typeof contentTypeFilter === "function" ? (res) => {
+    const type = res.headers.get("Content-Type");
+    return type && contentTypeFilter(type);
+  } : (res) => {
+    const type = res.headers.get("Content-Type");
+    return type && contentTypeFilter.test(type);
+  };
   return async function compress2(ctx, next) {
     await next();
     const contentLength = ctx.res.headers.get("Content-Length");
-    if (ctx.res.headers.has("Content-Encoding") || // already encoded
+    if (ctx.res.status === 206 || // partial content, Content-Range refers to the uncompressed bytes
+    ctx.res.headers.has("Content-Encoding") || // already encoded
     ctx.res.headers.has("Transfer-Encoding") || // already encoded or chunked
     ctx.req.method === "HEAD" || // HEAD request
     contentLength && Number(contentLength) < threshold || // content-length below threshold
@@ -15,8 +45,12 @@ var compress = (options) => {
     !shouldTransform(ctx.res)) {
       return;
     }
+    const current = ctx.res.headers.get("Vary");
+    if (current !== "*" && !(current && varyAcceptEncodingRegExp.test(current))) {
+      ctx.header("Vary", current ? `${current}, Accept-Encoding` : "Accept-Encoding");
+    }
     const accepted = ctx.req.header("Accept-Encoding");
-    const encoding = options?.encoding ?? ENCODING_TYPES.find((encoding2) => accepted?.includes(encoding2));
+    const encoding = selectEncoding(accepted, candidates);
     if (!encoding || !ctx.res.body) {
       return;
     }
@@ -30,14 +64,11 @@ var compress = (options) => {
     }
   };
 };
-var shouldCompress = (res) => {
-  const type = res.headers.get("Content-Type");
-  return type && COMPRESSIBLE_CONTENT_TYPE_REGEX.test(type);
-};
 var shouldTransform = (res) => {
   const cacheControl = res.headers.get("Cache-Control");
   return !cacheControl || !cacheControlNoTransformRegExp.test(cacheControl);
 };
 export {
+  COMPRESSIBLE_CONTENT_TYPE_REGEX,
   compress
 };

package/dist/node_modules/hono/dist/middleware/cors/index.js

@@ -1,21 +1,17 @@
 // src/middleware/cors/index.ts
 var cors = (options) => {
-  const defaults = {
+  const opts = {
     origin: "*",
-    allowMethods: ["GET", "HEAD", "PUT", "POST", "DELETE", "PATCH"],
+    allowMethods: ["GET", "HEAD", "PUT", "POST", "DELETE", "PATCH", "QUERY"],
     allowHeaders: [],
-    exposeHeaders: []
-  };
-  const opts = {
-    ...defaults,
+    exposeHeaders: [],
     ...options
   };
+  const exposeHeadersStr = opts.exposeHeaders?.length ? opts.exposeHeaders.join(",") : void 0;
+  const allowHeadersStr = opts.allowHeaders?.length ? opts.allowHeaders.join(",") : void 0;
   const findAllowOrigin = ((optsOrigin) => {
     if (typeof optsOrigin === "string") {
       if (optsOrigin === "*") {
-        if (opts.credentials) {
-          return (origin) => origin || null;
-        }
         return () => optsOrigin;
       } else {
         return (origin) => optsOrigin === origin ? origin : null;
@@ -28,11 +24,12 @@ var cors = (options) => {
   })(opts.origin);
   const findAllowMethods = ((optsAllowMethods) => {
     if (typeof optsAllowMethods === "function") {
-      return optsAllowMethods;
+      return async (origin, c) => (await optsAllowMethods(origin, c)).join(",");
     } else if (Array.isArray(optsAllowMethods)) {
-      return () => optsAllowMethods;
+      const methodsStr = optsAllowMethods.join(",");
+      return () => methodsStr;
     } else {
-      return () => [];
+      return () => "";
     }
   })(opts.allowMethods);
   return async function cors2(c, next) {
@@ -46,29 +43,29 @@ var cors = (options) => {
     if (opts.credentials) {
       set("Access-Control-Allow-Credentials", "true");
     }
-    if (opts.exposeHeaders?.length) {
-      set("Access-Control-Expose-Headers", opts.exposeHeaders.join(","));
+    if (exposeHeadersStr) {
+      set("Access-Control-Expose-Headers", exposeHeadersStr);
     }
     if (c.req.method === "OPTIONS") {
-      if (opts.origin !== "*" || opts.credentials) {
-        set("Vary", "Origin");
+      if (opts.origin !== "*") {
+        c.res.headers.append("Vary", "Origin");
       }
       if (opts.maxAge != null) {
         set("Access-Control-Max-Age", opts.maxAge.toString());
       }
       const allowMethods = await findAllowMethods(c.req.header("origin") || "", c);
-      if (allowMethods.length) {
-        set("Access-Control-Allow-Methods", allowMethods.join(","));
+      if (allowMethods) {
+        set("Access-Control-Allow-Methods", allowMethods);
       }
-      let headers = opts.allowHeaders;
-      if (!headers?.length) {
+      let headersStr = allowHeadersStr;
+      if (!headersStr) {
         const requestHeaders = c.req.header("Access-Control-Request-Headers");
         if (requestHeaders) {
-          headers = requestHeaders.split(/\s*,\s*/);
+          headersStr = requestHeaders.split(",").map((h) => h.trim()).join(",");
         }
       }
-      if (headers?.length) {
-        set("Access-Control-Allow-Headers", headers.join(","));
+      if (headersStr) {
+        set("Access-Control-Allow-Headers", headersStr);
         c.res.headers.append("Vary", "Access-Control-Request-Headers");
       }
       c.res.headers.delete("Content-Length");
@@ -80,7 +77,7 @@ var cors = (options) => {
       });
     }
     await next();
-    if (opts.origin !== "*" || opts.credentials) {
+    if (opts.origin !== "*") {
       c.header("Vary", "Origin", { append: true });
     }
   };

package/dist/node_modules/hono/dist/middleware/csrf/index.js

@@ -2,7 +2,7 @@
 import { HTTPException } from "../../http-exception.js";
 var secFetchSiteValues = ["same-origin", "same-site", "none", "cross-site"];
 var isSecFetchSite = (value) => secFetchSiteValues.includes(value);
-var isSafeMethodRe = /^(GET|HEAD)$/;
+var isSafeMethodRe = /^(GET|HEAD|OPTIONS)$/;
 var isRequestedByFormElementRe = /^\b(application\/x-www-form-urlencoded|multipart\/form-data|text\/plain)\b/i;
 var csrf = (options) => {
   const originHandler = ((optsOrigin) => {