@nocobase/plugin-mcp-server 2.4.0-alpha.7 → 2.4.0-alpha.9

package/dist/node_modules/hono/dist/middleware/etag/digest.js

@@ -10,18 +10,64 @@ var mergeBuffers = (buffer1, buffer2) => {
   merged.set(buffer2, buffer1.byteLength);
   return merged;
 };
+var CHUNK_SIZE = 256 * 1024;
 var generateDigest = async (stream, generator) => {
   if (!stream) {
     return null;
   }
   let result = void 0;
+  let chunk;
+  let chunkLength = 0;
+  const digest = async (body) => {
+    result = await generator(mergeBuffers(result, body));
+  };
   const reader = stream.getReader();
   for (; ; ) {
     const { value, done } = await reader.read();
     if (done) {
       break;
     }
-    result = await generator(mergeBuffers(result, value));
+    let offset = 0;
+    while (offset < value.byteLength) {
+      const remaining = value.byteLength - offset;
+      if (chunkLength === 0 && remaining >= CHUNK_SIZE) {
+        await digest(value.subarray(offset, offset + CHUNK_SIZE));
+        offset += CHUNK_SIZE;
+        continue;
+      }
+      const requiredLength = chunkLength + remaining;
+      if (requiredLength < CHUNK_SIZE) {
+        if (!chunk) {
+          chunk = value.slice(offset);
+        } else {
+          if (chunk.byteLength < requiredLength) {
+            const nextChunk = new Uint8Array(
+              new ArrayBuffer(Math.min(CHUNK_SIZE, Math.max(requiredLength, chunk.byteLength * 2)))
+            );
+            nextChunk.set(chunk.subarray(0, chunkLength));
+            chunk = nextChunk;
+          }
+          chunk.set(value.subarray(offset), chunkLength);
+        }
+        chunkLength = requiredLength;
+        break;
+      }
+      const length = CHUNK_SIZE - chunkLength;
+      if (chunk?.byteLength !== CHUNK_SIZE) {
+        const nextChunk = new Uint8Array(new ArrayBuffer(CHUNK_SIZE));
+        if (chunk) {
+          nextChunk.set(chunk.subarray(0, chunkLength));
+        }
+        chunk = nextChunk;
+      }
+      chunk.set(value.subarray(offset, offset + length), chunkLength);
+      await digest(chunk);
+      chunkLength = 0;
+      offset += length;
+    }
+  }
+  if (chunk && chunkLength > 0) {
+    await digest(chunk.subarray(0, chunkLength));
   }
   if (!result) {
     return null;

package/dist/node_modules/hono/dist/middleware/etag/index.js

@@ -10,7 +10,7 @@ var RETAINED_304_HEADERS = [
 ];
 var stripWeak = (tag) => tag.replace(/^W\//, "");
 function etagMatches(etag2, ifNoneMatch) {
-  return ifNoneMatch != null && ifNoneMatch.split(/,\s*/).some((t) => stripWeak(t) === stripWeak(etag2));
+  return ifNoneMatch != null && ifNoneMatch.split(",").some((t) => stripWeak(t.trim()) === stripWeak(etag2));
 }
 function initializeGenerator(generator) {
   if (!generator) {
@@ -32,6 +32,9 @@ var etag = (options) => {
   return async function etag2(c, next) {
     const ifNoneMatch = c.req.header("If-None-Match") ?? null;
     await next();
+    if (!(c.req.method === "GET" || c.req.method === "HEAD" || c.req.method === "QUERY") || !c.res.ok) {
+      return;
+    }
     const res = c.res;
     let etag3 = res.headers.get("ETag");
     if (!etag3) {
@@ -48,7 +51,8 @@ var etag = (options) => {
       }
       etag3 = weak ? `W/"${hash}"` : `"${hash}"`;
     }
-    if (etagMatches(etag3, ifNoneMatch)) {
+    const matched = ifNoneMatch === "*" || etagMatches(etag3, ifNoneMatch);
+    if (matched) {
       c.res = new Response(null, {
         status: 304,
         statusText: "Not Modified",
@@ -56,11 +60,11 @@ var etag = (options) => {
           ETag: etag3
         }
       });
-      c.res.headers.forEach((_, key) => {
+      for (const key of Array.from(c.res.headers.keys())) {
         if (retainedHeaders.indexOf(key.toLowerCase()) === -1) {
           c.res.headers.delete(key);
         }
-      });
+      }
     } else {
       c.res.headers.set("ETag", etag3);
     }

package/dist/node_modules/hono/dist/middleware/ip-restriction/index.js

@@ -6,13 +6,48 @@ import {
   convertIPv6BinaryToString,
   convertIPv6ToBinary,
   distinctRemoteAddr,
-  isIPv4MappedIPv6
+  isIPv4MappedIPv6,
+  INVALID_IP_ADDRESS_ERROR_CODE
 } from "../../utils/ipaddr.js";
-var IS_CIDR_NOTATION_REGEX = /\/[0-9]{0,3}$/;
+var IS_CIDR_NOTATION_REGEX = /\/[^/]*$/;
+var parseCidrPrefix = (rule, prefix, max) => {
+  if (!/^[0-9]{1,3}$/.test(prefix)) {
+    throw new TypeError(`Invalid rule: ${rule}`);
+  }
+  const parsedPrefix = parseInt(prefix);
+  if (parsedPrefix > max) {
+    throw new TypeError(`Invalid rule: ${rule}`);
+  }
+  return parsedPrefix;
+};
 var buildMatcher = (rules) => {
   const functionRules = [];
   const staticRules = /* @__PURE__ */ new Set();
+  const staticIPv4Rules = /* @__PURE__ */ new Set();
+  const staticIPv6Rules = /* @__PURE__ */ new Set();
   const cidrRules = [];
+  const registerStaticRule = (rule) => {
+    const type = distinctRemoteAddr(rule);
+    if (type === void 0) {
+      throw new TypeError(`Invalid rule: ${rule}`);
+    }
+    if (type === "IPv4") {
+      const ipv4binary = convertIPv4ToBinary(rule);
+      staticRules.add(rule);
+      staticRules.add(`::ffff:${rule}`);
+      staticIPv4Rules.add(ipv4binary);
+      staticIPv6Rules.add(0xffffn << 32n | ipv4binary);
+    } else {
+      const ipv6binary = convertIPv6ToBinary(rule);
+      const ipv6Addr = convertIPv6BinaryToString(ipv6binary);
+      staticRules.add(ipv6Addr);
+      staticIPv6Rules.add(ipv6binary);
+      if (isIPv4MappedIPv6(ipv6binary)) {
+        staticRules.add(ipv6Addr.substring(7));
+        staticIPv4Rules.add(convertIPv4MappedIPv6ToIPv4(ipv6binary));
+      }
+    }
+  };
   for (let rule of rules) {
     if (rule === "*") {
       return () => true;
@@ -22,17 +57,17 @@ var buildMatcher = (rules) => {
       if (IS_CIDR_NOTATION_REGEX.test(rule)) {
         const separatedRule = rule.split("/");
         const addrStr = separatedRule[0];
-        const type2 = distinctRemoteAddr(addrStr);
-        if (type2 === void 0) {
+        const type = distinctRemoteAddr(addrStr);
+        if (type === void 0) {
           throw new TypeError(`Invalid rule: ${rule}`);
         }
-        let isIPv4 = type2 === "IPv4";
-        let prefix = parseInt(separatedRule[1]);
+        let isIPv4 = type === "IPv4";
+        let prefix = parseCidrPrefix(rule, separatedRule[1], isIPv4 ? 32 : 128);
         if (isIPv4 ? prefix === 32 : prefix === 128) {
           rule = addrStr;
         } else {
           let addr = (isIPv4 ? convertIPv4ToBinary : convertIPv6ToBinary)(addrStr);
-          if (type2 === "IPv6" && isIPv4MappedIPv6(addr) && prefix >= 96) {
+          if (type === "IPv6" && isIPv4MappedIPv6(addr) && prefix >= 96) {
             isIPv4 = true;
             addr = convertIPv4MappedIPv6ToIPv4(addr);
             prefix -= 96;
@@ -42,21 +77,7 @@ var buildMatcher = (rules) => {
           continue;
         }
       }
-      const type = distinctRemoteAddr(rule);
-      if (type === void 0) {
-        throw new TypeError(`Invalid rule: ${rule}`);
-      }
-      if (type === "IPv4") {
-        staticRules.add(rule);
-        staticRules.add(`::ffff:${rule}`);
-      } else {
-        const ipv6binary = convertIPv6ToBinary(rule);
-        const ipv6Addr = convertIPv6BinaryToString(ipv6binary);
-        staticRules.add(ipv6Addr);
-        if (isIPv4MappedIPv6(ipv6binary)) {
-          staticRules.add(ipv6Addr.substring(7));
-        }
-      }
+      registerStaticRule(rule);
     }
   }
   return (remote) => {
@@ -65,6 +86,9 @@ var buildMatcher = (rules) => {
     }
     const remoteAddr = remote.binaryAddr ||= (remote.isIPv4 ? convertIPv4ToBinary : convertIPv6ToBinary)(remote.addr);
     const remoteIPv4Addr = remote.isIPv4 || isIPv4MappedIPv6(remoteAddr) ? remote.isIPv4 ? remoteAddr : convertIPv4MappedIPv6ToIPv4(remoteAddr) : void 0;
+    if ((remote.isIPv4 ? staticIPv4Rules : staticIPv6Rules).has(remoteAddr)) {
+      return true;
+    }
     for (const [isIPv4, addr, mask] of cidrRules) {
       if (isIPv4) {
         if (remoteIPv4Addr === void 0) {
@@ -107,14 +131,21 @@ var ipRestriction = (getIP, { denyList = [], allowList = [] }, onError) => {
     }
     const type = typeof connInfo !== "string" && connInfo.remote.addressType || distinctRemoteAddr(addr);
     const remoteData = { addr, type, isIPv4: type === "IPv4" };
-    if (denyMatcher(remoteData)) {
-      if (onError) {
-        return onError({ addr, type }, c);
+    try {
+      if (denyMatcher(remoteData)) {
+        if (onError) {
+          return onError({ addr, type }, c);
+        }
+        throw blockError(c);
       }
-      throw blockError(c);
-    }
-    if (allowMatcher(remoteData)) {
-      return await next();
+      if (allowMatcher(remoteData)) {
+        return await next();
+      }
+    } catch (e) {
+      if (e instanceof TypeError && e.code === INVALID_IP_ADDRESS_ERROR_CODE) {
+        throw blockError(c);
+      }
+      throw e;
     }
     if (allowLength === 0) {
       return await next();

package/dist/node_modules/hono/dist/middleware/jwk/jwk.js

@@ -17,14 +17,15 @@ var jwk = (options, init) => {
     let token;
     if (credentials) {
       const parts = credentials.split(/\s+/);
-      if (parts.length !== 2) {
+      if (parts.length !== 2 || parts[0].toLowerCase() !== "bearer") {
         const errDescription = "invalid credentials structure";
         throw new HTTPException(401, {
           message: errDescription,
           res: unauthorizedResponse({
             ctx,
             error: "invalid_request",
-            errDescription
+            errDescription,
+            realm: options.realm
           })
         });
       } else {
@@ -62,7 +63,8 @@ var jwk = (options, init) => {
         res: unauthorizedResponse({
           ctx,
           error: "invalid_request",
-          errDescription
+          errDescription,
+          realm: options.realm
         })
       });
     }
@@ -89,7 +91,8 @@ var jwk = (options, init) => {
           ctx,
           error: "invalid_token",
           statusText: "Unauthorized",
-          errDescription: "token verification failure"
+          errDescription: "token verification failure",
+          realm: options.realm
         }),
         cause
       });
@@ -99,11 +102,13 @@ var jwk = (options, init) => {
   };
 };
 function unauthorizedResponse(opts) {
+  const realm = (opts.realm ?? opts.ctx.req.url).replace(/"/g, '\\"');
+  const errDescription = opts.errDescription.replace(/"/g, '\\"');
   return new Response("Unauthorized", {
     status: 401,
     statusText: opts.statusText,
     headers: {
-      "WWW-Authenticate": `Bearer realm="${opts.ctx.req.url}",error="${opts.error}",error_description="${opts.errDescription}"`
+      "WWW-Authenticate": `Bearer realm="${realm}",error="${opts.error}",error_description="${errDescription}"`
     }
   });
 }

package/dist/node_modules/hono/dist/middleware/jwt/jwt.js

@@ -20,14 +20,15 @@ var jwt = (options) => {
     let token;
     if (credentials) {
       const parts = credentials.split(/\s+/);
-      if (parts.length !== 2) {
+      if (parts.length !== 2 || parts[0].toLowerCase() !== "bearer") {
         const errDescription = "invalid credentials structure";
         throw new HTTPException(401, {
           message: errDescription,
           res: unauthorizedResponse({
             ctx,
             error: "invalid_request",
-            errDescription
+            errDescription,
+            realm: options.realm
           })
         });
       } else {
@@ -62,7 +63,8 @@ var jwt = (options) => {
         res: unauthorizedResponse({
           ctx,
           error: "invalid_request",
-          errDescription
+          errDescription,
+          realm: options.realm
         })
       });
     }
@@ -83,7 +85,8 @@ var jwt = (options) => {
           ctx,
           error: "invalid_token",
           statusText: "Unauthorized",
-          errDescription: "token verification failure"
+          errDescription: "token verification failure",
+          realm: options.realm
         }),
         cause
       });
@@ -93,11 +96,13 @@ var jwt = (options) => {
   };
 };
 function unauthorizedResponse(opts) {
+  const realm = (opts.realm ?? opts.ctx.req.url).replace(/"/g, '\\"');
+  const errDescription = opts.errDescription.replace(/"/g, '\\"');
   return new Response("Unauthorized", {
     status: 401,
     statusText: opts.statusText,
     headers: {
-      "WWW-Authenticate": `Bearer realm="${opts.ctx.req.url}",error="${opts.error}",error_description="${opts.errDescription}"`
+      "WWW-Authenticate": `Bearer realm="${realm}",error="${opts.error}",error_description="${errDescription}"`
     }
   });
 }

package/dist/node_modules/hono/dist/middleware/language/language.js

@@ -39,34 +39,30 @@ var normalizeLanguage = (lang, options) => {
     if (exactIndex !== -1) {
       return options.supportedLanguages[exactIndex];
     }
-    const parts = compLang.split("-");
-    for (let i = parts.length - 1; i > 0; i--) {
-      const candidate = parts.slice(0, i).join("-");
-      const prefixIndex = compSupported.indexOf(candidate);
-      if (prefixIndex !== -1) {
-        return options.supportedLanguages[prefixIndex];
+    let longestMatchIndex = -1;
+    let longestMatchLength = -1;
+    for (let i = 0; i < compSupported.length; i++) {
+      const candidate = compSupported[i];
+      if (candidate.length < compLang.length && candidate.length > longestMatchLength && compLang.startsWith(candidate) && compLang[candidate.length] === "-") {
+        longestMatchIndex = i;
+        longestMatchLength = candidate.length;
       }
     }
+    if (longestMatchIndex !== -1) {
+      return options.supportedLanguages[longestMatchIndex];
+    }
     return void 0;
   } catch {
     return void 0;
   }
 };
 var detectFromQuery = (c, options) => {
-  try {
-    const query = c.req.query(options.lookupQueryString);
-    return normalizeLanguage(query, options);
-  } catch {
-    return void 0;
-  }
+  const query = c.req.query(options.lookupQueryString);
+  return normalizeLanguage(query, options);
 };
 var detectFromCookie = (c, options) => {
-  try {
-    const cookie = getCookie(c, options.lookupCookie);
-    return normalizeLanguage(cookie, options);
-  } catch {
-    return void 0;
-  }
+  const cookie = getCookie(c, options.lookupCookie);
+  return normalizeLanguage(cookie, options);
 };
 function detectFromHeader(c, options) {
   try {
@@ -75,7 +71,10 @@ function detectFromHeader(c, options) {
       return void 0;
     }
     const languages = parseAcceptLanguage(acceptLanguage);
-    for (const { lang } of languages) {
+    for (const { lang, q } of languages) {
+      if (q === 0) {
+        continue;
+      }
       const normalizedLang = normalizeLanguage(lang, options);
       if (normalizedLang) {
         return normalizedLang;
@@ -87,14 +86,10 @@ function detectFromHeader(c, options) {
   }
 }
 function detectFromPath(c, options) {
-  try {
-    const url = new URL(c.req.url);
-    const pathSegments = url.pathname.split("/").filter(Boolean);
-    const langSegment = pathSegments[options.lookupFromPathIndex];
-    return normalizeLanguage(langSegment, options);
-  } catch {
-    return void 0;
-  }
+  const url = new URL(c.req.url);
+  const pathSegments = url.pathname.split("/").filter(Boolean);
+  const langSegment = pathSegments[options.lookupFromPathIndex];
+  return normalizeLanguage(langSegment, options);
 }
 var detectors = {
   querystring: detectFromQuery,
@@ -129,9 +124,6 @@ var detectLanguage = (c, options) => {
   let detectedLang;
   for (const detectorName of options.order) {
     const detector = detectors[detectorName];
-    if (!detector) {
-      continue;
-    }
     try {
       detectedLang = detector(c, options);
       if (detectedLang) {
@@ -164,15 +156,8 @@ var languageDetector = (userOptions) => {
   };
   validateOptions(options);
   return async function languageDetector2(ctx, next) {
-    try {
-      const lang = detectLanguage(ctx, options);
-      ctx.set("language", lang);
-    } catch (error) {
-      if (options.debug) {
-        console.error("Language detection failed:", error);
-      }
-      ctx.set("language", options.fallbackLanguage);
-    }
+    const lang = detectLanguage(ctx, options);
+    ctx.set("language", lang);
     await next();
   };
 };

package/dist/node_modules/hono/dist/middleware/method-not-allowed/index.js

@@ -0,0 +1,68 @@
+// src/middleware/method-not-allowed/index.ts
+import { basePath, matchedRoutes } from "../../helper/route/index.js";
+import { METHOD_NAME_ALL } from "../../router.js";
+import { TrieRouter } from "../../router/trie-router/index.js";
+var methodNotAllowed = (options) => {
+  let methodRouter;
+  return async function methodNotAllowed2(c, next) {
+    const routeIndex = c.req.routeIndex;
+    await next();
+    if (c.res.status !== 404) {
+      return;
+    }
+    if (c.error) {
+      return;
+    }
+    if (!methodRouter) {
+      const methodsByPath = /* @__PURE__ */ new Map();
+      for (const route of options.app.routes) {
+        if (route.method === METHOD_NAME_ALL || route.method === "HEAD") {
+          continue;
+        }
+        const methods2 = methodsByPath.get(route.path) ?? /* @__PURE__ */ new Set();
+        methods2.add(route.method);
+        if (route.method === "GET") {
+          methods2.add("HEAD");
+        }
+        methodsByPath.set(route.path, methods2);
+      }
+      methodRouter = new TrieRouter();
+      for (const [path, methods2] of methodsByPath) {
+        methodRouter.add(METHOD_NAME_ALL, path, [...methods2]);
+      }
+    }
+    let requestPath = c.req.path;
+    const routes = matchedRoutes(c);
+    const currentRoute = routes[routeIndex];
+    const sourceRoute = options.app.routes.find((route) => route.handler === methodNotAllowed2);
+    if (currentRoute && sourceRoute) {
+      const currentBasePathParts = basePath(c, routeIndex).split("/").filter(Boolean);
+      const sourceBasePathLength = sourceRoute.basePath.split("/").filter(Boolean).length;
+      const mountBasePathParts = currentBasePathParts.slice(
+        0,
+        currentBasePathParts.length - sourceBasePathLength
+      );
+      if (mountBasePathParts.length > 0) {
+        const mountBasePath = `/${mountBasePathParts.join("/")}`;
+        requestPath = c.req.path.slice(mountBasePath.length) || "/";
+      }
+    }
+    const allowedMethods = /* @__PURE__ */ new Set();
+    for (const [methods2] of methodRouter.match(METHOD_NAME_ALL, requestPath)[0]) {
+      for (const method of methods2) {
+        allowedMethods.add(method);
+      }
+    }
+    if (allowedMethods.size === 0 || allowedMethods.has(c.req.method)) {
+      return;
+    }
+    c.res.headers.delete("Allow");
+    c.res.headers.delete("Content-Length");
+    const methods = [...allowedMethods];
+    const allow = methods.join(", ");
+    c.res = options.onMethodNotAllowed ? await options.onMethodNotAllowed(c, methods) : c.text("Method Not Allowed", 405, { Allow: allow });
+  };
+};
+export {
+  methodNotAllowed
+};

package/dist/node_modules/hono/dist/middleware/method-override/index.js

@@ -28,7 +28,7 @@ var methodOverride = (options) => async function methodOverride2(c, next) {
         return app.fetch(request, c.env, getExecutionCtx(c));
       }
     }
-    if (contentType === "application/x-www-form-urlencoded") {
+    if (contentType?.startsWith("application/x-www-form-urlencoded")) {
       const params = await parseBody(clonedRequest);
       const method = params[methodFormName];
       if (method) {
@@ -59,11 +59,13 @@ var methodOverride = (options) => async function methodOverride2(c, next) {
     if (method) {
       const url = new URL(c.req.url);
       url.searchParams.delete(queryName);
-      const request = new Request(url.toString(), {
+      const requestInit = {
         body: c.req.raw.body,
         headers: c.req.raw.headers,
-        method
-      });
+        method,
+        duplex: c.req.raw.body ? "half" : void 0
+      };
+      const request = new Request(url.toString(), requestInit);
       return app.fetch(request, c.env, getExecutionCtx(c));
     }
   }

package/dist/node_modules/hono/dist/middleware/pretty-json/index.js

@@ -1,12 +1,20 @@
 // src/middleware/pretty-json/index.ts
+var jsonContentTypeRegex = /^application\/(?:[a-z0-9._-]+\+)?json(?=$|[;\s])/i;
 var prettyJSON = (options) => {
   const targetQuery = options?.query ?? "pretty";
   return async function prettyJSON2(c, next) {
     const pretty = options?.force || c.req.query(targetQuery) || c.req.query(targetQuery) === "";
     await next();
-    if (pretty && c.res.headers.get("Content-Type")?.startsWith("application/json")) {
-      const obj = await c.res.json();
+    const contentType = c.res.headers.get("Content-Type");
+    if (pretty && contentType && jsonContentTypeRegex.test(contentType)) {
+      let obj;
+      try {
+        obj = await c.res.clone().json();
+      } catch {
+        return;
+      }
       c.res = new Response(JSON.stringify(obj, null, options?.space ?? 2), c.res);
+      c.res.headers.delete("Content-Length");
     }
   };
 };

package/dist/node_modules/hono/dist/middleware/secure-headers/secure-headers.js

@@ -49,14 +49,20 @@ var secureHeaders = (customOptions) => {
   const headersToSet = getFilteredHeaders(options);
   const callbacks = [];
   if (options.contentSecurityPolicy) {
-    const [callback, value] = getCSPDirectives(options.contentSecurityPolicy);
+    const [callback, value] = getCSPDirectives(
+      options.contentSecurityPolicy,
+      "Content-Security-Policy"
+    );
     if (callback) {
       callbacks.push(callback);
     }
     headersToSet.push(["Content-Security-Policy", value]);
   }
   if (options.contentSecurityPolicyReportOnly) {
-    const [callback, value] = getCSPDirectives(options.contentSecurityPolicyReportOnly);
+    const [callback, value] = getCSPDirectives(
+      options.contentSecurityPolicyReportOnly,
+      "Content-Security-Policy-Report-Only"
+    );
     if (callback) {
       callbacks.push(callback);
     }
@@ -89,7 +95,7 @@ function getFilteredHeaders(options) {
     return typeof overrideValue === "string" ? [defaultValue[0], overrideValue] : defaultValue;
   });
 }
-function getCSPDirectives(contentSecurityPolicy) {
+function getCSPDirectives(contentSecurityPolicy, headerName) {
   const callbacks = [];
   const resultValues = [];
   for (const [directive, value] of Object.entries(contentSecurityPolicy)) {
@@ -114,7 +120,7 @@ function getCSPDirectives(contentSecurityPolicy) {
   resultValues.pop();
   return callbacks.length === 0 ? [void 0, resultValues.join("")] : [
     (ctx, headersToSet) => headersToSet.map((values) => {
-      if (values[0] === "Content-Security-Policy" || values[0] === "Content-Security-Policy-Report-Only") {
+      if (values[0] === headerName) {
         const clone = values[1].slice();
         callbacks.forEach((cb) => {
           cb(ctx, clone);
@@ -131,14 +137,17 @@ function getPermissionsPolicyDirectives(policy) {
   return Object.entries(policy).map(([directive, value]) => {
     const kebabDirective = camelToKebab(directive);
     if (typeof value === "boolean") {
-      return `${kebabDirective}=${value ? "*" : "none"}`;
+      return `${kebabDirective}=${value ? "*" : "()"}`;
     }
     if (Array.isArray(value)) {
       if (value.length === 0) {
         return `${kebabDirective}=()`;
       }
-      if (value.length === 1 && (value[0] === "*" || value[0] === "none")) {
-        return `${kebabDirective}=${value[0]}`;
+      if (value.length === 1 && value[0] === "*") {
+        return `${kebabDirective}=*`;
+      }
+      if (value.length === 1 && value[0] === "none") {
+        return `${kebabDirective}=()`;
       }
       const allowlist = value.map((item) => ["self", "src"].includes(item) ? item : `"${item}"`);
       return `${kebabDirective}=(${allowlist.join(" ")})`;

package/dist/node_modules/hono/dist/middleware/serve-static/index.js

@@ -24,7 +24,7 @@ var serveStatic = (options) => {
     } else {
       try {
         filename = tryDecodeURI(c.req.path);
-        if (/(?:^|[\/\\])\.{1,2}(?:$|[\/\\])|[\/\\]{2,}/.test(filename)) {
+        if (/(?:^|[\/\\])\.{1,2}(?:$|[\/\\])|[\/\\]{2,}|\\/.test(filename)) {
           throw new Error();
         }
       } catch {
@@ -44,7 +44,7 @@ var serveStatic = (options) => {
     if (content instanceof Response) {
       return c.newResponse(content.body, content);
     }
-    if (content) {
+    if (content != null) {
       const mimeType = options.mimes && getMimeType(path, options.mimes) || getMimeType(path);
       c.header("Content-Type", mimeType || "application/octet-stream");
       if (options.precompressed && (!mimeType || COMPRESSIBLE_CONTENT_TYPE_REGEX.test(mimeType))) {

package/dist/node_modules/hono/dist/middleware/timing/timing.js

@@ -31,7 +31,9 @@ var timing = (config) => {
       endTime(c, "total");
     }
     if (options.autoEnd) {
-      timers.forEach((_, key) => endTime(c, key));
+      timers.forEach((_, key) => {
+        endTime(c, key);
+      });
     }
     const enabled = typeof options.enabled === "function" ? options.enabled(c) : options.enabled;
     if (enabled) {