@nocobase/plugin-mcp-server 2.4.0-alpha.8 → 2.4.0-alpha.9

package/dist/node_modules/hono/dist/client/utils.js

@@ -8,8 +8,8 @@ var mergePath = (base, path) => {
 };
 var replaceUrlParam = (urlString, params) => {
   for (const [k, v] of Object.entries(params)) {
-    const reg = new RegExp("/:" + k + "(?:{[^/]+})?\\??");
-    urlString = urlString.replace(reg, v ? `/${v}` : "");
+    const reg = new RegExp("/:" + k + "(?:{[^/]+})?\\??(?=/|$)");
+    urlString = urlString.replace(reg, () => v ? `/${v}` : "");
   }
   return urlString;
 };
@@ -21,6 +21,9 @@ var buildSearchParams = (query) => {
     }
     if (Array.isArray(v)) {
       for (const v2 of v) {
+        if (v2 === void 0) {
+          continue;
+        }
         searchParams.append(k, v2);
       }
     } else {

package/dist/node_modules/hono/dist/context.js

@@ -202,6 +202,10 @@ var Context = class {
    *   c.header('X-Message', 'Hello!')
    *   c.header('Content-Type', 'text/plain')
    *
+   *   // Append multiple headers using the append option (e.g. Vary)
+   *   c.header('Vary', 'Accept-Encoding', { append: true })
+   *   c.header('Vary', 'User-Agent', { append: true })
+   *
    *   return c.body('Thank you for coming')
    * })
    * ```
@@ -273,11 +277,11 @@ var Context = class {
     return Object.fromEntries(this.#var);
   }
   #newResponse(data, arg, headers) {
-    const responseHeaders = this.#res ? new Headers(this.#res.headers) : this.#preparedHeaders ?? new Headers();
-    if (typeof arg === "object" && "headers" in arg) {
-      const argHeaders = arg.headers instanceof Headers ? arg.headers : new Headers(arg.headers);
-      for (const [key, value] of argHeaders) {
-        if (key.toLowerCase() === "set-cookie") {
+    let responseHeaders = this.#res ? new Headers(this.#res.headers) : this.#preparedHeaders;
+    if (typeof arg === "object" && arg.headers) {
+      responseHeaders ??= new Headers();
+      for (const [key, value] of new Headers(arg.headers)) {
+        if (key === "set-cookie") {
           responseHeaders.append(key, value);
         } else {
           responseHeaders.set(key, value);
@@ -285,19 +289,34 @@ var Context = class {
       }
     }
     if (headers) {
-      for (const [k, v] of Object.entries(headers)) {
-        if (typeof v === "string") {
-          responseHeaders.set(k, v);
-        } else {
-          responseHeaders.delete(k);
-          for (const v2 of v) {
-            responseHeaders.append(k, v2);
+      if (!responseHeaders) {
+        let count = 0;
+        for (const k in headers) {
+          if (++count > 1 || typeof headers[k] !== "string") {
+            responseHeaders = new Headers();
+            break;
+          }
+        }
+      }
+      if (responseHeaders) {
+        for (const k in headers) {
+          const v = headers[k];
+          if (typeof v === "string") {
+            responseHeaders.set(k, v);
+          } else {
+            responseHeaders.delete(k);
+            for (const v2 of v) {
+              responseHeaders.append(k, v2);
+            }
           }
         }
       }
     }
     const status = typeof arg === "number" ? arg : arg?.status ?? this.#status;
-    return createResponseInstance(data, { status, headers: responseHeaders });
+    return createResponseInstance(data, {
+      status,
+      headers: responseHeaders ?? headers
+    });
   }
   newResponse = (...args) => this.#newResponse(...args);
   /**
@@ -383,7 +402,7 @@ var Context = class {
     const locationString = String(location);
     this.header(
       "Location",
-      // Multibyes should be encoded
+      // Multibytes should be encoded
       // eslint-disable-next-line no-control-regex
       !/[^\x00-\xFF]/.test(locationString) ? locationString : encodeURI(locationString)
     );

package/dist/node_modules/hono/dist/helper/accepts/accepts.js

@@ -1,9 +1,45 @@
 // src/helper/accepts/accepts.ts
 import { parseAccept } from "../../utils/accept.js";
+var matchType = (acceptType, supportedType) => {
+  const accept = acceptType.toLowerCase();
+  const supported = supportedType.toLowerCase();
+  if (accept === supported) {
+    return true;
+  }
+  if (accept === "*/*" || accept === "*") {
+    return false;
+  }
+  if (accept.endsWith("/*")) {
+    const [acceptMain] = accept.split("/");
+    const [supportedMain] = supported.split("/");
+    return acceptMain === supportedMain;
+  }
+  return false;
+};
+var getSpecificity = (type) => {
+  if (type === "*/*" || type === "*") {
+    return 1;
+  }
+  if (type.endsWith("/*")) {
+    return 2;
+  }
+  return 3;
+};
 var defaultMatch = (accepts2, config) => {
   const { supports, default: defaultSupport } = config;
-  const accept = accepts2.sort((a, b) => b.q - a.q).find((accept2) => supports.includes(accept2.type));
-  return accept ? accept.type : defaultSupport;
+  const sortedAccepts = accepts2.filter((accept) => accept.q > 0).sort((a, b) => {
+    if (b.q !== a.q) {
+      return b.q - a.q;
+    }
+    return getSpecificity(b.type) - getSpecificity(a.type);
+  });
+  for (const accept of sortedAccepts) {
+    const matched = supports.find((supported) => matchType(accept.type, supported));
+    if (matched) {
+      return matched;
+    }
+  }
+  return defaultSupport;
 };
 var accepts = (c, options) => {
   const acceptHeader = c.req.header(options.header);

package/dist/node_modules/hono/dist/helper/css/common.js

@@ -25,6 +25,7 @@ var normalizeLabel = (label) => {
   return label.trim().replace(/\s+/g, "-");
 };
 var isValidClassName = (name) => /^-?[_a-zA-Z][_a-zA-Z0-9-]*$/.test(name);
+var hasUnsafeSelectorChar = (name) => /[<{}]/.test(name);
 var RESERVED_KEYFRAME_NAMES = /* @__PURE__ */ new Set([
   "default",
   "inherit",
@@ -162,7 +163,8 @@ var cxCommon = (args) => {
         [CLASS_NAME]: "",
         [STYLE_STRING]: "",
         [SELECTORS]: [],
-        [EXTERNAL_CLASS_NAMES]: [arg]
+        // drop names that are unsafe to emit as a selector
+        [EXTERNAL_CLASS_NAMES]: hasUnsafeSelectorChar(arg) ? [] : [arg]
       };
     }
   }

package/dist/node_modules/hono/dist/helper/css/index.js

@@ -2,6 +2,7 @@
 import { raw } from "../../helper/html/index.js";
 import { DOM_RENDERER } from "../../jsx/constants.js";
 import { createCssJsxDomObjects } from "../../jsx/dom/css.js";
+import { escapeToBuffer } from "../../utils/html.js";
 import {
   CLASS_NAME,
   DEFAULT_STYLE_ID,
@@ -72,7 +73,14 @@ var createCssContext = ({
       }
       return Promise.resolve(raw("", [appendStyle]));
     };
-    const className = new String(cssClassName[CLASS_NAME]);
+    const rawClassName = cssClassName[CLASS_NAME];
+    let escapedClassName = rawClassName;
+    if (/[&<>'"]/.test(rawClassName)) {
+      const escapedBuffer = [""];
+      escapeToBuffer(rawClassName, escapedBuffer);
+      escapedClassName = escapedBuffer[0];
+    }
+    const className = new String(escapedClassName);
     Object.assign(className, cssClassName);
     className.isEscaped = true;
     className.callbacks = [addClassNameToContext];

package/dist/node_modules/hono/dist/helper/proxy/index.js

@@ -71,6 +71,10 @@ var proxy = async (input, proxyInit) => {
   req.headers.delete("accept-encoding");
   const res = await (customFetch || fetch)(req);
   const resHeaders = new Headers(res.headers);
+  const connectionValue = resHeaders.get("connection");
+  if (connectionValue) {
+    connectionValue.split(",").map((h) => h.trim()).filter((h) => ALLOWED_TOKEN_PATTERN.test(h)).forEach((h) => resHeaders.delete(h));
+  }
   hopByHopHeaders.forEach((header) => {
     resHeaders.delete(header);
   });

package/dist/node_modules/hono/dist/helper/ssg/ssg.js

@@ -47,6 +47,8 @@ var defaultExtensionMap = {
   "text/html": "html",
   "text/xml": "xml",
   "application/xml": "xml",
+  "application/atom+xml": "xml",
+  "application/rss+xml": "xml",
   "application/yaml": "yaml"
 };
 var determineExtension = (mimeType, userExtensionMap) => {
@@ -182,7 +184,7 @@ var saveContentToFile = async (data, fsModule, outDir, extensionMap) => {
   const { routePath, content, mimeType } = awaitedData;
   const filePath = generateFilePath(routePath, outDir, mimeType, extensionMap);
   const dirPath = dirname(filePath);
-  if (!createdDirs.has(dirPath)) {
+  if (dirPath !== "" && !createdDirs.has(dirPath)) {
     await fsModule.mkdir(dirPath, { recursive: true });
     createdDirs.add(dirPath);
   }

package/dist/node_modules/hono/dist/helper/ssg/utils.js

@@ -8,8 +8,14 @@ var dirname = (path) => {
 var normalizePath = (path) => {
   return path.replace(/(\\)/g, "/").replace(/\/$/g, "");
 };
-var handleParent = (resultPaths, beforeParentFlag) => {
-  if (resultPaths.length === 0 || beforeParentFlag) {
+var getUncRoot = (path) => {
+  const uncRoot = path.replace(/\\/g, "/").match(/^\/\/([^/]+)\/([^/]+)/);
+  if (uncRoot) {
+    return `${uncRoot[1].toLowerCase()}/${uncRoot[2].toLowerCase()}`;
+  }
+};
+var handleParent = (resultPaths) => {
+  if (resultPaths.length === 0 || resultPaths[resultPaths.length - 1] === "..") {
     resultPaths.push("..");
   } else {
     resultPaths.pop();
@@ -22,22 +28,20 @@ var handleNonDot = (path, resultPaths) => {
   }
 };
 var handleSegments = (paths, resultPaths) => {
-  let beforeParentFlag = false;
   for (const path of paths) {
     if (path === "..") {
-      handleParent(resultPaths, beforeParentFlag);
-      beforeParentFlag = true;
+      handleParent(resultPaths);
     } else {
       handleNonDot(path, resultPaths);
-      beforeParentFlag = false;
     }
   }
 };
 var joinPaths = (...paths) => {
+  const hasUncPrefix = getUncRoot(paths[0]) !== void 0;
   paths = paths.map(normalizePath);
   const resultPaths = [];
   handleSegments(paths.join("/").split("/"), resultPaths);
-  return (paths[0][0] === "/" ? "/" : "") + resultPaths.join("/");
+  return (hasUncPrefix ? "//" : paths[0][0] === "/" ? "/" : "") + resultPaths.join("/");
 };
 var filterStaticGenerateRoutes = (hono) => {
   return hono.routes.reduce((acc, { method, handler, path }) => {
@@ -51,10 +55,26 @@ var filterStaticGenerateRoutes = (hono) => {
 var isDynamicRoute = (path) => {
   return path.split("/").some((segment) => segment.startsWith(":") || segment.includes("*"));
 };
+var toSegments = (path) => path === "" ? [] : path.split("/");
+var getPathRoot = (path) => {
+  const normalizedPath = path.replace(/\\/g, "/");
+  const uncRoot = getUncRoot(normalizedPath);
+  if (uncRoot) {
+    return `unc:${uncRoot}`;
+  }
+  const driveRoot = normalizedPath.match(/^([A-Za-z]):/);
+  if (driveRoot) {
+    const kind = normalizedPath[2] === "/" ? "drive-absolute" : "drive-relative";
+    return `${kind}:${driveRoot[1].toLowerCase()}`;
+  }
+  return normalizedPath.startsWith("/") ? "absolute" : "relative";
+};
 var ensureWithinOutDir = (outDir, filePath) => {
-  const normalizedOutDir = joinPaths("/", outDir);
-  const normalizedFilePath = joinPaths("/", filePath);
-  if (normalizedFilePath !== normalizedOutDir && !normalizedFilePath.startsWith(`${normalizedOutDir}/`)) {
+  const outDirSegments = toSegments(joinPaths(outDir));
+  const filePathSegments = toSegments(joinPaths(filePath));
+  const hasMismatchedPathRoot = getPathRoot(outDir) !== getPathRoot(filePath);
+  const climbsAboveOutDir = filePathSegments[outDirSegments.length] === "..";
+  if (hasMismatchedPathRoot || filePathSegments.length <= outDirSegments.length || !outDirSegments.every((segment, i) => segment === filePathSegments[i]) || climbsAboveOutDir) {
     throw new Error(`Path traversal detected: "${filePath}" is outside the output directory`);
   }
 };

package/dist/node_modules/hono/dist/helper/streaming/sse.js

@@ -11,16 +11,17 @@ var SSEStreamingApi = class extends StreamingApi {
     const dataLines = data.split(/\r\n|\r|\n/).map((line) => {
       return `data: ${line}`;
     }).join("\n");
-    for (const key of ["event", "id", "retry"]) {
-      if (message[key] && /[\r\n]/.test(message[key])) {
+    for (const key of ["event", "id"]) {
+      const value = message[key];
+      if (value && /[\r\n]/.test(value)) {
         throw new Error(`${key} must not contain "\\r" or "\\n"`);
       }
     }
     const sseData = [
       message.event && `event: ${message.event}`,
       dataLines,
-      message.id && `id: ${message.id}`,
-      message.retry && `retry: ${message.retry}`
+      message.id !== void 0 && `id: ${message.id}`,
+      message.retry !== void 0 && `retry: ${message.retry}`
     ].filter(Boolean).join("\n") + "\n\n";
     await this.write(sseData);
   }

package/dist/node_modules/hono/dist/hono-base.js

@@ -22,6 +22,7 @@ var Hono = class _Hono {
   delete;
   options;
   patch;
+  query;
   all;
   on;
   use;
@@ -39,13 +40,14 @@ var Hono = class _Hono {
     const allMethods = [...METHODS, METHOD_NAME_ALL_LOWERCASE];
     allMethods.forEach((method) => {
       this[method] = (args1, ...args) => {
+        const methodName = method.toUpperCase();
         if (typeof args1 === "string") {
           this.#path = args1;
         } else {
-          this.#addRoute(method, this.#path, args1);
+          this.#addRoute(methodName, this.#path, args1);
         }
         args.forEach((handler) => {
-          this.#addRoute(method, this.#path, handler);
+          this.#addRoute(methodName, this.#path, handler);
         });
         return this;
       };
@@ -54,9 +56,10 @@ var Hono = class _Hono {
       for (const p of [path].flat()) {
         this.#path = p;
         for (const m of [method].flat()) {
-          handlers.map((handler) => {
-            this.#addRoute(m.toUpperCase(), this.#path, handler);
-          });
+          const methodName = m.toUpperCase();
+          for (const handler of handlers) {
+            this.#addRoute(methodName, this.#path, handler);
+          }
         }
       }
       return this;
@@ -118,7 +121,7 @@ var Hono = class _Hono {
         handler = async (c, next) => (await compose([], app.errorHandler)(c, () => r.handler(c, next))).res;
         handler[COMPOSED_HANDLER] = r.handler;
       }
-      subApp.#addRoute(r.method, r.path, handler);
+      subApp.#addRoute(r.method, r.path, handler, r.basePath);
     });
     return this;
   }
@@ -242,7 +245,7 @@ var Hono = class _Hono {
       const pathPrefixLength = mergedPath === "/" ? 0 : mergedPath.length;
       return (request) => {
         const url = new URL(request.url);
-        url.pathname = url.pathname.slice(pathPrefixLength) || "/";
+        url.pathname = this.getPath(request).slice(pathPrefixLength) || "/";
         return new Request(url, request);
       };
     })();
@@ -256,10 +259,14 @@ var Hono = class _Hono {
     this.#addRoute(METHOD_NAME_ALL, mergePath(path, "*"), handler);
     return this;
   }
-  #addRoute(method, path, handler) {
-    method = method.toUpperCase();
+  #addRoute(method, path, handler, baseRoutePath) {
     path = mergePath(this._basePath, path);
-    const r = { basePath: this._basePath, path, method, handler };
+    const r = {
+      basePath: baseRoutePath !== void 0 ? mergePath(this._basePath, baseRoutePath) : this._basePath,
+      path,
+      method,
+      handler
+    };
     this.router.add(method, path, [handler, r]);
     this.routes.push(r);
   }
@@ -316,8 +323,8 @@ var Hono = class _Hono {
    * @see {@link https://hono.dev/docs/api/hono#fetch}
    *
    * @param {Request} request - request Object of request
-   * @param {Env} Env - env Object
-   * @param {ExecutionContext} - context of execution
+   * @param {Env} env - env Object
+   * @param {ExecutionContext} executionCtx - context of execution
    * @returns {Response | Promise<Response>} response of request
    *
    */

package/dist/node_modules/hono/dist/index.js

@@ -1,5 +1,7 @@
 // src/index.ts
 import { Hono } from "./hono.js";
+import { Context } from "./context.js";
 export {
+  Context,
   Hono
 };

package/dist/node_modules/hono/dist/jsx/base.js

@@ -2,10 +2,21 @@
 import { raw } from "../helper/html/index.js";
 import { escapeToBuffer, resolveCallbackSync, stringBufferToString } from "../utils/html.js";
 import { DOM_RENDERER, DOM_MEMO } from "./constants.js";
-import { createContext, globalContexts, useContext } from "./context.js";
+import {
+  captureRenderContext,
+  createContext,
+  globalContexts,
+  runWithRenderContext,
+  useContext
+} from "./context.js";
 import { domRenderers } from "./intrinsic-element/common.js";
 import * as intrinsicElementTags from "./intrinsic-element/components.js";
-import { normalizeIntrinsicElementKey, styleObjectForEach } from "./utils.js";
+import {
+  isValidAttributeName,
+  isValidTagName,
+  normalizeIntrinsicElementKey,
+  styleObjectForEach
+} from "./utils.js";
 var nameSpaceContext = void 0;
 var getNameSpaceContext = () => nameSpaceContext;
 var toSVGAttributeName = (key) => /[A-Z]/.test(key) && // Presentation attributes are findable in style object. "clip-path", "font-size", "stroke-width", etc.
@@ -58,6 +69,18 @@ var booleanAttributes = [
   "reversed",
   "selected"
 ];
+var resolveFunctionComponentResult = (result, suspendedContext) => result.then((resolved) => {
+  if (typeof resolved !== "string" && !Array.isArray(resolved) && !(resolved instanceof JSXNode)) {
+    return resolved;
+  }
+  const children = Array.isArray(resolved) ? resolved : [resolved];
+  const render = () => {
+    const buffer = [""];
+    childrenToStringToBuffer(children, buffer);
+    return buffer.length === 1 ? raw(buffer[0], buffer.callbacks) : stringBufferToString(buffer, buffer.callbacks);
+  };
+  return suspendedContext ? suspendedContext(render) : runWithRenderContext(render);
+});
 var childrenToStringToBuffer = (children, buffer) => {
   for (let i = 0, len = children.length; i < len; i++) {
     const child = children[i];
@@ -67,9 +90,17 @@ var childrenToStringToBuffer = (children, buffer) => {
       continue;
     } else if (child instanceof JSXNode) {
       child.toStringToBuffer(buffer);
-    } else if (typeof child === "number" || child.isEscaped) {
+    } else if (typeof child === "number") {
       ;
       buffer[0] += child;
+    } else if (child.isEscaped) {
+      ;
+      buffer[0] += child;
+      const callbacks = child.callbacks;
+      if (callbacks) {
+        buffer.callbacks ||= [];
+        buffer.callbacks.push(...callbacks);
+      }
     } else if (child instanceof Promise) {
       buffer.unshift("", child);
     } else {
@@ -77,14 +108,27 @@ var childrenToStringToBuffer = (children, buffer) => {
     }
   }
 };
+var renderChildren = (children) => runWithRenderContext(() => {
+  const buffer = [""];
+  childrenToStringToBuffer(children, buffer);
+  return buffer.length === 1 ? raw(buffer[0], buffer.callbacks) : stringBufferToString(buffer, buffer.callbacks);
+});
+var isUntrustedObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && !(value instanceof JSXNode) && !(value instanceof Promise) && !value.isEscaped && typeof value.toString === "function";
+var renderUntrustedObject = (value) => {
+  const stringified = value.toString();
+  const escape = (result) => renderChildren([String(result)]);
+  return stringified instanceof Promise ? stringified.then(escape) : escape(stringified);
+};
 var JSXNode = class {
   tag;
   props;
   key;
   children;
   isEscaped = true;
-  localContexts;
   constructor(tag, props, children) {
+    if (typeof tag !== "function" && !isValidTagName(tag)) {
+      throw new Error(`Invalid JSX tag name: ${tag}`);
+    }
     this.tag = tag;
     this.props = props;
     this.children = children;
@@ -98,27 +142,24 @@ var JSXNode = class {
     return this.props.ref || null;
   }
   toString() {
-    const buffer = [""];
-    this.localContexts?.forEach(([context, value]) => {
-      context.values.push(value);
-    });
-    try {
+    const render = () => {
+      const buffer = [""];
       this.toStringToBuffer(buffer);
-    } finally {
-      this.localContexts?.forEach(([context]) => {
-        context.values.pop();
-      });
-    }
-    return buffer.length === 1 ? "callbacks" in buffer ? resolveCallbackSync(raw(buffer[0], buffer.callbacks)).toString() : buffer[0] : stringBufferToString(buffer, buffer.callbacks);
+      return buffer.length === 1 ? "callbacks" in buffer ? resolveCallbackSync(raw(buffer[0], buffer.callbacks)).toString() : buffer[0] : stringBufferToString(buffer, buffer.callbacks);
+    };
+    return runWithRenderContext(render);
   }
   toStringToBuffer(buffer) {
     const tag = this.tag;
     const props = this.props;
     let { children } = this;
     buffer[0] += `<${tag}`;
-    const normalizeKey = nameSpaceContext && useContext(nameSpaceContext) === "svg" ? (key) => toSVGAttributeName(normalizeIntrinsicElementKey(key)) : (key) => normalizeIntrinsicElementKey(key);
+    const normalizeKey = tag === "svg" || nameSpaceContext && useContext(nameSpaceContext) === "svg" ? (key) => toSVGAttributeName(normalizeIntrinsicElementKey(key)) : (key) => normalizeIntrinsicElementKey(key);
     for (let [key, v] of Object.entries(props)) {
       key = normalizeKey(key);
+      if (!isValidAttributeName(key)) {
+        continue;
+      }
       if (key === "children") {
       } else if (key === "style" && typeof v === "object") {
         let styleStr = "";
@@ -180,21 +221,14 @@ var JSXFunctionNode = class extends JSXNode {
       return;
     } else if (res instanceof Promise) {
       if (globalContexts.length === 0) {
-        buffer.unshift("", res);
+        buffer.unshift("", resolveFunctionComponentResult(res));
       } else {
-        const currentContexts = globalContexts.map((c) => [c, c.values.at(-1)]);
-        buffer.unshift(
-          "",
-          res.then((childRes) => {
-            if (childRes instanceof JSXNode) {
-              childRes.localContexts = currentContexts;
-            }
-            return childRes;
-          })
-        );
+        buffer.unshift("", resolveFunctionComponentResult(res, captureRenderContext()));
       }
     } else if (res instanceof JSXNode) {
       res.toStringToBuffer(buffer);
+    } else if (Array.isArray(res)) {
+      childrenToStringToBuffer(res, buffer);
     } else if (typeof res === "number" || res.isEscaped) {
       buffer[0] += res;
       if (res.callbacks) {
@@ -273,15 +307,7 @@ var shallowEqual = (a, b) => {
   return true;
 };
 var memo = (component, propsAreEqual = shallowEqual) => {
-  let computed = null;
-  let prevProps = void 0;
-  const wrapper = ((props) => {
-    if (prevProps && !propsAreEqual(prevProps, props)) {
-      computed = null;
-    }
-    prevProps = props;
-    return computed ||= component(props);
-  });
+  const wrapper = ((props) => component(props));
   wrapper[DOM_MEMO] = propsAreEqual;
   wrapper[DOM_RENDERER] = component;
   return wrapper;
@@ -322,10 +348,13 @@ export {
   booleanAttributes,
   cloneElement,
   getNameSpaceContext,
+  isUntrustedObject,
   isValidElement,
   jsx,
   jsxFn,
   memo,
   reactAPICompatVersion,
+  renderChildren,
+  renderUntrustedObject,
   shallowEqual
 };