@suveren/gateway 0.7.6 → 0.8.1

package/node_modules/express-rate-limit/dist/index.d.mts

@@ -408,6 +408,17 @@ export type Options = {
 	 * Defaults to `{limit}-in-{window}`.
 	 */
 	identifier: string | ValueDeterminingMiddleware<string>;
+	/**
+	 * Method to generate a custom `Retry-After` header value (in seconds) when
+	 * a client is rate limited.
+	 *
+	 * This is advisory only, it customizes what the header says, it does not
+	 * change how long the limiter actually keeps blocking the client for.
+	 * That is still controlled by `windowMs`.
+	 *
+	 * By default, the number of seconds remaining until the window resets.
+	 */
+	retryAfter?: number | ValueDeterminingMiddleware<number>;
 	/**
 	 * The name of the property on the request object to store the rate limit info.
 	 *

package/node_modules/express-rate-limit/dist/index.d.ts

@@ -408,6 +408,17 @@ export type Options = {
 	 * Defaults to `{limit}-in-{window}`.
 	 */
 	identifier: string | ValueDeterminingMiddleware<string>;
+	/**
+	 * Method to generate a custom `Retry-After` header value (in seconds) when
+	 * a client is rate limited.
+	 *
+	 * This is advisory only, it customizes what the header says, it does not
+	 * change how long the limiter actually keeps blocking the client for.
+	 * That is still controlled by `windowMs`.
+	 *
+	 * By default, the number of seconds remaining until the window resets.
+	 */
+	retryAfter?: number | ValueDeterminingMiddleware<number>;
 	/**
 	 * The name of the property on the request object to store the rate limit info.
 	 *

package/node_modules/express-rate-limit/dist/index.mjs

@@ -254,9 +254,9 @@ var setDraft8Headers = (response, info, windowMs, name, key) => {
   response.append("RateLimit", `"${name}"; ${header}`);
   response.append("RateLimit-Policy", `"${name}"; ${policy}`);
 };
-var setRetryAfterHeader = (response, info, windowMs) => {
+var setRetryAfterHeader = (response, info, windowMs, retryAfter) => {
   if (response.headersSent) return;
-  const resetSeconds = getResetSeconds(windowMs, info.resetTime);
+  const resetSeconds = retryAfter ?? getResetSeconds(windowMs, info.resetTime);
   response.setHeader("Retry-After", resetSeconds.toString());
 };
 
@@ -523,6 +523,7 @@ var validations = {
       legacyHeaders: true,
       standardHeaders: true,
       identifier: true,
+      retryAfter: true,
       requestPropertyName: true,
       skipFailedRequests: true,
       skipSuccessfulRequests: true,
@@ -1007,7 +1008,9 @@ var rateLimit = (passedOptions) => {
         debug("limit exceeded");
         if (config.legacyHeaders || config.standardHeaders) {
           debug("set retry-after header");
-          setRetryAfterHeader(response, info, config.windowMs);
+          const retrieveRetryAfter = typeof config.retryAfter === "function" ? config.retryAfter(request, response) : config.retryAfter;
+          const retryAfter = await retrieveRetryAfter;
+          setRetryAfterHeader(response, info, config.windowMs, retryAfter);
         }
         config.handler(request, response, next, options);
         return;

package/node_modules/express-rate-limit/{license.md → license}

@@ -1,4 +1,4 @@
-# MIT License
+MIT License
 
 Copyright 2023 Nathan Friedly, Vedant K
 
@@ -13,8 +13,9 @@ The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
-FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
-COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
-IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
-CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/node_modules/express-rate-limit/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "express-rate-limit",
-	"version": "8.6.2",
+	"version": "8.7.0",
 	"description": "Basic IP rate-limiting middleware for Express. Use to limit repeated requests to public APIs and/or endpoints such as password reset.",
 	"author": {
 		"name": "Nathan Friedly",
@@ -90,16 +90,16 @@
 		"@types/debug": "4.1.13",
 		"@types/express": "5.0.6",
 		"@types/jest": "30.0.0",
-		"@types/node": "26.1.2",
+		"@types/node": "26.2.0",
 		"@types/supertest": "7.2.1",
 		"del-cli": "7.0.0",
 		"dts-bundle-generator": "8.1.2",
-		"esbuild": "0.28.1",
+		"esbuild": "0.28.2",
 		"express": "5.2.1",
 		"husky": "9.1.7",
 		"jest": "30.4.2",
-		"lint-staged": "17.2.0",
-		"mintlify": "4.2.743",
+		"lint-staged": "17.3.0",
+		"mintlify": "4.2.817",
 		"npm-run-all": "4.1.5",
 		"prettier": "3.9.6",
 		"ratelimit-header-parser": "0.1.0",

package/node_modules/express-rate-limit/readme.md

@@ -5,6 +5,7 @@
 [![tests](https://img.shields.io/github/actions/workflow/status/express-rate-limit/express-rate-limit/ci.yaml)](https://github.com/express-rate-limit/express-rate-limit/actions/workflows/ci.yaml)
 [![npm version](https://img.shields.io/npm/v/express-rate-limit.svg)](https://npmjs.org/package/express-rate-limit 'View this project on NPM')
 [![npm downloads](https://img.shields.io/npm/dm/express-rate-limit)](https://www.npmjs.com/package/express-rate-limit)
+[![inspect.software](https://raw.githubusercontent.com/inspect-software/badges/main/v1/e/express-rate-limit/express-rate-limit.svg)](https://inspect.software/software/express-rate-limit/express-rate-limit)
 [![license](https://img.shields.io/npm/l/express-rate-limit)](license.md)
 
 </div>

package/node_modules/fast-uri/index.js

@@ -324,6 +324,18 @@ function hasMalformedPercentEncoding (component) {
   return false
 }
 
+/**
+ * Whether the host is a bracketed IP literal (RFC 3986 `IP-literal`).
+ * An unterminated `[` is not a literal, so it must still be validated as a
+ * reg-name instead of being waved through as an IP.
+ *
+ * @param {string} host
+ * @returns {boolean}
+ */
+function isIPLiteral (host) {
+  return host[0] === '[' && host[host.length - 1] === ']'
+}
+
 /**
  * @param {RegExpMatchArray} matches
  * @returns {boolean}
@@ -333,7 +345,7 @@ function hasMalformedComponentPercentEncoding (matches) {
   // compatibility. Their parsing is intentionally left to normalizeIPv6.
   const host = matches[4]
   return hasMalformedPercentEncoding(matches[3]) ||
-    (host !== undefined && !(host[0] === '[' && host[host.length - 1] === ']') && hasMalformedPercentEncoding(host)) ||
+    (host !== undefined && !isIPLiteral(host) && hasMalformedPercentEncoding(host)) ||
     hasMalformedPercentEncoding(matches[6]) ||
     hasMalformedPercentEncoding(matches[7]) ||
     hasMalformedPercentEncoding(matches[8])
@@ -351,7 +363,7 @@ function canonicalizeHost (parsed, options, schemeHandler, isIP) {
     !options.unicodeSupport &&
     (!schemeHandler || !schemeHandler.unicodeSupport) &&
     parsed.host &&
-    parsed.host[0] !== '[' &&
+    !isIPLiteral(parsed.host) &&
     (options.domainHost || (schemeHandler && schemeHandler.domainHost)) &&
     isIP === false &&
     nonSimpleDomain(parsed.host)
@@ -476,10 +488,11 @@ function parseWithStatus (uri, opts) {
     if (parsed.host) {
       const ipv4result = isIPv4(parsed.host)
       if (ipv4result === false) {
-        const bracketedIPLiteral = parsed.host[0] === '[' && parsed.host[parsed.host.length - 1] === ']'
+        const bracketedIPLiteral = isIPLiteral(parsed.host)
+        const hasIPLiteralBracket = parsed.host.indexOf('[') !== -1 || parsed.host.indexOf(']') !== -1
         const ipv6result = normalizeIPv6(parsed.host)
         isIP = ipv6result.isIPV6 || ipv6result.isIPVFuture === true
-        malformedIPLiteral = bracketedIPLiteral && ipv6result.error === true
+        malformedIPLiteral = hasIPLiteralBracket && (!bracketedIPLiteral || ipv6result.error === true)
         parsed.host = isIP ? ipv6result.host : ipv6result.host.toLowerCase()
 
         if (malformedIPLiteral) {
@@ -509,7 +522,9 @@ function parseWithStatus (uri, opts) {
     const schemeHandler = getSchemeHandler(options.scheme || parsed.scheme)
 
     // convert Unicode IDN -> ASCII IDN when the effective scheme uses domain hosts
-    malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP)
+    if (!malformedIPLiteral) {
+      malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP)
+    }
 
     if (!schemeHandler || (schemeHandler && !schemeHandler.skipNormalize)) {
       if (uri.indexOf('%') !== -1) {

package/node_modules/fast-uri/lib/utils.js

@@ -6,6 +6,9 @@ const isUUID = RegExp.prototype.test.bind(/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\d
 /** @type {(value: string) => boolean} */
 const isIPv4 = RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u)
 
+/** @type {(value: string) => boolean} */
+const isPort = RegExp.prototype.test.bind(/^\d*$/u)
+
 /** @type {(value: string) => boolean} */
 const isHexPair = RegExp.prototype.test.bind(/^[\da-f]{2}$/iu)
 
@@ -713,8 +716,12 @@ function recomposeAuthority (component) {
   }
 
   if (typeof component.port === 'number' || typeof component.port === 'string') {
+    const port = String(component.port)
+    if (!isPort(port)) {
+      throw new TypeError('URI port is malformed.')
+    }
     uriTokens.push(':')
-    uriTokens.push(String(component.port))
+    uriTokens.push(port)
   }
 
   return uriTokens.length ? uriTokens.join('') : undefined

package/node_modules/fast-uri/package.json

@@ -1,7 +1,7 @@
 {
   "name": "fast-uri",
   "description": "Dependency-free RFC 3986 URI toolbox",
-  "version": "3.1.6",
+  "version": "3.1.7",
   "main": "index.js",
   "type": "commonjs",
   "types": "types/index.d.ts",

package/node_modules/fast-uri/test/component-safe-serialization.test.js

@@ -24,6 +24,64 @@ test('userinfo serialization cannot terminate the authority', (t) => {
   t.end()
 })
 
+test('port serialization rejects non-digit values', (t) => {
+  const malformedPorts = [
+    '@127.0.0.1:8124',
+    '8080@evil.example',
+    '8080/path',
+    '8080?query',
+    '8080#fragment',
+    '8080:9000',
+    '-1',
+    '1.5',
+    1.5,
+    NaN,
+    Infinity,
+    '\u0661'
+  ]
+
+  for (const port of malformedPorts) {
+    t.throws(
+      () => fastURI.serialize({ scheme: 'http', host: 'trusted.example', port, path: '/app' }),
+      /URI port is malformed\./,
+      String(port)
+    )
+  }
+
+  t.throws(
+    () => fastURI.normalize({ scheme: 'http', host: 'trusted.example', port: '@evil.example' }),
+    /URI port is malformed\./,
+    'object normalization rejects a malformed port'
+  )
+  t.equal(
+    fastURI.equal(
+      { scheme: 'http', host: 'trusted.example', port: '@evil.example' },
+      { scheme: 'http', host: 'trusted.example', port: '@evil.example' }
+    ),
+    false,
+    'object equality fails closed for a malformed port'
+  )
+  t.end()
+})
+
+test('port serialization preserves RFC 3986 digit values', (t) => {
+  const validPorts = [
+    [8080, '8080'],
+    ['8080', '8080'],
+    ['00080', '00080'],
+    ['', '']
+  ]
+
+  for (const [port, expected] of validPorts) {
+    t.equal(
+      fastURI.serialize({ scheme: 'uri', host: 'example.test', port }),
+      `uri://example.test:${expected}`,
+      JSON.stringify(port)
+    )
+  }
+  t.end()
+})
+
 test('query and fragment serialization cannot inject component delimiters', (t) => {
   const uri = fastURI.serialize({
     scheme: 'x',

package/node_modules/fast-uri/test/ipv6-validation.test.js

@@ -88,3 +88,37 @@ test('valid IPv6, IPvFuture, embedded IPv4, and zone forms normalize safely', (t
   }
   t.end()
 })
+
+test('hosts with unbalanced or misplaced IP-literal brackets are rejected', (t) => {
+  const malformed = [
+    'http://[fe80',
+    'http://[',
+    'http://[not-an-ip',
+    'http://[\u65e5\u672c',
+    'http://user@[@127.0.0.1:8123/admin',
+    'http://user@]127.0.0.1:8123/admin',
+    'http://user@prefix[@127.0.0.1:8123/admin',
+    'http://user@prefix]@127.0.0.1:8123/admin'
+  ]
+  const modes = [
+    ['default', undefined],
+    ['Unicode', { unicodeSupport: true }]
+  ]
+
+  for (const [mode, options] of modes) {
+    for (const uri of malformed) {
+      const parsed = fastURI.parse(uri, options)
+      const message = `${mode} mode rejects ${uri}`
+
+      t.equal(parsed.error, HOST_ERROR, `parse ${message}`)
+      t.equal(fastURI.normalize(uri, options), uri, `normalize preserves ${uri} in ${mode} mode`)
+      t.equal(fastURI.equal(uri, uri, options), false, `equal ${message}`)
+      t.throws(
+        () => fastURI.resolve('http://example.com/', uri, options),
+        /URI host is malformed\./,
+        `resolve ${message}`
+      )
+    }
+  }
+  t.end()
+})

package/node_modules/hono/dist/cjs/client/client.js

@@ -157,24 +157,24 @@ const hc = (baseUrl, options) => createProxy(function proxyCallback(opts) {
   const path = parts.join("/");
   const url = (0, import_utils.mergePath)(baseUrl, path);
   if (method === "url" || method === "path") {
-    let result = url;
+    let result = (0, import_utils.removeIndexString)(url);
     if (opts.args[0]) {
       if (opts.args[0].param) {
-        result = (0, import_utils.replaceUrlParam)(url, opts.args[0].param);
+        result = (0, import_utils.replaceUrlParam)(result, opts.args[0].param);
       }
       if (opts.args[0].query) {
         result = appendQueryParams(result, buildSearchParamsOption(opts.args[0].query));
       }
     }
-    result = (0, import_utils.removeIndexString)(result);
     if (method === "url") {
       return new URL(result);
     }
     return result.slice(baseUrl.replace(/\/+$/, "").length).replace(/^\/?/, "/");
   }
   if (method === "ws") {
+    const normalizedUrl = (0, import_utils.removeIndexString)(url);
     const webSocketUrl = (0, import_utils.replaceUrlProtocol)(
-      opts.args[0]?.param ? (0, import_utils.replaceUrlParam)(url, opts.args[0].param) : url,
+      opts.args[0]?.param ? (0, import_utils.replaceUrlParam)(normalizedUrl, opts.args[0].param) : normalizedUrl,
       "ws"
     );
     const targetUrl = new URL(webSocketUrl);

package/node_modules/hono/dist/cjs/hono-base.js

@@ -61,13 +61,14 @@ class Hono {
     const allMethods = [...import_router.METHODS, import_router.METHOD_NAME_ALL_LOWERCASE];
     allMethods.forEach((method) => {
       this[method] = (args1, ...args) => {
+        const methodName = method.toUpperCase();
         if (typeof args1 === "string") {
           this.#path = args1;
         } else {
-          this.#addRoute(method, this.#path, args1);
+          this.#addRoute(methodName, this.#path, args1);
         }
         args.forEach((handler) => {
-          this.#addRoute(method, this.#path, handler);
+          this.#addRoute(methodName, this.#path, handler);
         });
         return this;
       };
@@ -76,9 +77,10 @@ class Hono {
       for (const p of [path].flat()) {
         this.#path = p;
         for (const m of [method].flat()) {
-          handlers.map((handler) => {
-            this.#addRoute(m.toUpperCase(), this.#path, handler);
-          });
+          const methodName = m.toUpperCase();
+          for (const handler of handlers) {
+            this.#addRoute(methodName, this.#path, handler);
+          }
         }
       }
       return this;
@@ -279,7 +281,6 @@ class Hono {
     return this;
   }
   #addRoute(method, path, handler, baseRoutePath) {
-    method = method.toUpperCase();
     path = (0, import_url.mergePath)(this._basePath, path);
     const r = {
       basePath: baseRoutePath !== void 0 ? (0, import_url.mergePath)(this._basePath, baseRoutePath) : this._basePath,

package/node_modules/hono/dist/cjs/jsx/base.js

@@ -33,11 +33,14 @@ __export(base_exports, {
   booleanAttributes: () => booleanAttributes,
   cloneElement: () => cloneElement,
   getNameSpaceContext: () => getNameSpaceContext,
+  isUntrustedObject: () => isUntrustedObject,
   isValidElement: () => isValidElement,
   jsx: () => jsx,
   jsxFn: () => jsxFn,
   memo: () => memo,
   reactAPICompatVersion: () => reactAPICompatVersion,
+  renderChildren: () => renderChildren,
+  renderUntrustedObject: () => renderUntrustedObject,
   shallowEqual: () => shallowEqual
 });
 module.exports = __toCommonJS(base_exports);
@@ -101,7 +104,7 @@ const booleanAttributes = [
   "selected"
 ];
 const resolveFunctionComponentResult = (result, suspendedContext) => result.then((resolved) => {
-  if (!Array.isArray(resolved) && !(resolved instanceof JSXNode)) {
+  if (typeof resolved !== "string" && !Array.isArray(resolved) && !(resolved instanceof JSXNode)) {
     return resolved;
   }
   const children = Array.isArray(resolved) ? resolved : [resolved];
@@ -139,6 +142,17 @@ const childrenToStringToBuffer = (children, buffer) => {
     }
   }
 };
+const renderChildren = (children) => (0, import_context.runWithRenderContext)(() => {
+  const buffer = [""];
+  childrenToStringToBuffer(children, buffer);
+  return buffer.length === 1 ? (0, import_html.raw)(buffer[0], buffer.callbacks) : (0, import_html2.stringBufferToString)(buffer, buffer.callbacks);
+});
+const isUntrustedObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && !(value instanceof JSXNode) && !(value instanceof Promise) && !value.isEscaped && typeof value.toString === "function";
+const renderUntrustedObject = (value) => {
+  const stringified = value.toString();
+  const escape = (result) => renderChildren([String(result)]);
+  return stringified instanceof Promise ? stringified.then(escape) : escape(stringified);
+};
 class JSXNode {
   tag;
   props;
@@ -369,10 +383,13 @@ const reactAPICompatVersion = "19.0.0-hono-jsx";
   booleanAttributes,
   cloneElement,
   getNameSpaceContext,
+  isUntrustedObject,
   isValidElement,
   jsx,
   jsxFn,
   memo,
   reactAPICompatVersion,
+  renderChildren,
+  renderUntrustedObject,
   shallowEqual
 });

package/node_modules/hono/dist/cjs/jsx/components.js

@@ -31,7 +31,7 @@ var import_streaming = require("./streaming");
 let errorBoundaryCounter = 0;
 const childrenToString = async (children) => {
   try {
-    return children.flat().map((c) => c == null || typeof c === "boolean" ? "" : c.toString());
+    return children.flat().map(resolveChildEarly);
   } catch (e) {
     if (e instanceof Promise) {
       const resume = (0, import_context.captureRenderContext)();
@@ -42,18 +42,16 @@ const childrenToString = async (children) => {
     }
   }
 };
-const resolveChildEarly = (c) => {
-  if (c == null || typeof c === "boolean") {
+const resolveChildEarly = (child) => {
+  if (child == null || typeof child === "boolean") {
     return "";
-  } else if (typeof c === "string") {
-    return c;
+  } else if (typeof child === "string" || Array.isArray(child)) {
+    return (0, import_base.renderChildren)([child]);
+  } else if ((0, import_base.isUntrustedObject)(child)) {
+    return (0, import_base.renderUntrustedObject)(child);
   } else {
-    const str = c.toString();
-    if (!(str instanceof Promise)) {
-      return (0, import_html.raw)(str);
-    } else {
-      return str;
-    }
+    const str = child.toString();
+    return str instanceof Promise ? str : (0, import_html.raw)(str);
   }
 };
 const ErrorBoundary = async ({ children, fallback, fallbackRender, onError }) => {
@@ -69,26 +67,27 @@ const ErrorBoundary = async ({ children, fallback, fallbackRender, onError }) =>
   let fallbackStrPromise;
   const resolveFallbackStr = () => fallbackStrPromise ||= (async () => {
     const awaitedFallback = await fallback;
-    if (typeof awaitedFallback === "string") {
-      return awaitedFallback;
-    } else {
-      const fallbackResult = await getResume()(() => awaitedFallback?.toString());
-      if (typeof fallbackResult === "string") {
-        return (0, import_html.raw)(
-          fallbackResult,
-          fallbackResult.callbacks || awaitedFallback?.callbacks
-        );
-      }
+    if (awaitedFallback === null || awaitedFallback === void 0) {
+      return;
+    }
+    if (typeof awaitedFallback === "string" || Array.isArray(awaitedFallback)) {
+      return getResume()(() => (0, import_base.renderChildren)([awaitedFallback]));
+    }
+    if ((0, import_base.isUntrustedObject)(awaitedFallback)) {
+      return getResume()(() => (0, import_base.renderUntrustedObject)(awaitedFallback));
     }
+    const fallbackResult = await getResume()(() => awaitedFallback.toString());
+    return (0, import_html.raw)(
+      fallbackResult,
+      fallbackResult.callbacks || awaitedFallback.callbacks
+    );
   })();
   const renderFallback = async (error) => {
     const fallbackStr = await resolveFallbackStr();
     return getResume()(async () => {
       onError?.(error);
       const fallbackRes = fallbackStr !== void 0 ? fallbackStr : fallbackRender && (0, import_base.jsx)(import_base.Fragment, {}, fallbackRender(error)) || "";
-      const fallbackResString = await (0, import_base.Fragment)({
-        children: fallbackRes
-      }).toString();
+      const fallbackResString = await (0, import_base.Fragment)({ children: fallbackRes }).toString();
       return (0, import_html.raw)(
         fallbackResString,
         fallbackResString.callbacks || fallbackRes.callbacks
@@ -121,7 +120,7 @@ const ErrorBoundary = async ({ children, fallback, fallbackRender, onError }) =>
       const fallbackResString = await renderFallback(error2);
       const fallbackCallbacks = fallbackResString.callbacks;
       if (buffer) {
-        buffer[0] = buffer[0].replace(replaceRe, fallbackResString);
+        buffer[0] = buffer[0].replace(replaceRe, () => fallbackResString);
         return fallbackCallbacks?.length ? (0, import_html.raw)("", fallbackCallbacks) : "";
       }
       return (0, import_html.raw)(
@@ -160,7 +159,7 @@ d.parentElement.insertBefore(c.content,d.nextSibling)
 </script>`;
           if (htmlArray.every((html2) => !html2.callbacks?.length)) {
             if (buffer) {
-              buffer[0] = buffer[0].replace(replaceRe, content);
+              buffer[0] = buffer[0].replace(replaceRe, () => content);
             }
             return html;
           }

package/node_modules/hono/dist/cjs/jsx/context.js

@@ -155,18 +155,18 @@ const createContext = (defaultValue) => {
   const context = ((props) => {
     const contextValues = getContextValuesIn(getCurrentStore(), context);
     contextValues.push(props.value);
-    let string;
+    let rendered;
     try {
-      string = props.children ? (Array.isArray(props.children) ? new import_base.JSXFragmentNode("", {}, props.children) : props.children).toString() : "";
+      rendered = typeof props.children === "string" ? (0, import_base.renderChildren)([props.children]) : (0, import_base.isUntrustedObject)(props.children) ? (0, import_base.renderUntrustedObject)(props.children) : props.children ? (Array.isArray(props.children) ? new import_base.JSXFragmentNode("", {}, props.children) : props.children).toString() : (0, import_html.raw)("");
     } catch (e) {
       contextValues.pop();
       throw e;
     }
-    if (string instanceof Promise) {
-      return string.finally(() => contextValues.pop()).then((resString) => (0, import_html.raw)(resString, resString.callbacks));
+    if (rendered instanceof Promise) {
+      return rendered.finally(() => contextValues.pop()).then((resString) => (0, import_html.raw)(resString, resString.callbacks));
     } else {
       contextValues.pop();
-      return (0, import_html.raw)(string);
+      return (0, import_html.raw)(rendered);
     }
   });
   context.values = values;

package/node_modules/hono/dist/cjs/jsx/dom/server.js

@@ -33,13 +33,16 @@ __export(server_exports, {
   version: () => import__.default
 });
 module.exports = __toCommonJS(server_exports);
+var import_base = require("../base");
 var import_streaming = require("../streaming");
 var import__ = __toESM(require("./"), 1);
+const prepareRoot = (element) => typeof element === "string" || Array.isArray(element) ? (0, import_base.renderChildren)([element]) : element;
 const renderToString = (element, options = {}) => {
   if (Object.keys(options).length > 0) {
     console.warn("options are not supported yet");
   }
-  const res = element?.toString() ?? "";
+  element = prepareRoot(element);
+  const res = element instanceof Promise ? element : element?.toString() ?? "";
   if (typeof res !== "string") {
     throw new Error("Async component is not supported in renderToString");
   }
@@ -49,6 +52,7 @@ const renderToReadableStream = async (element, options = {}) => {
   if (Object.keys(options).some((key) => key !== "onError")) {
     console.warn("options are not supported yet, except onError");
   }
+  element = prepareRoot(element);
   if (!element || typeof element !== "object") {
     element = element?.toString() ?? "";
   }

package/node_modules/hono/dist/cjs/jsx/intrinsic-element/components.js

@@ -85,10 +85,10 @@ const insertIntoHead = (tagName, tag, props, precedence) => ({ buffer, context }
     insertTags.forEach((tag2) => {
       buffer[0] = buffer[0].replaceAll(tag2, "");
     });
-    buffer[0] = buffer[0].replace(/(?=<\/head>)/, insertTags.join(""));
+    buffer[0] = buffer[0].replace(/(?=<\/head>)/, () => insertTags.join(""));
   }
 };
-const returnWithoutSpecialBehavior = (tag, children, props) => (0, import_html.raw)(new import_base.JSXNode(tag, props, (0, import_children.toArray)(children ?? [])).toString());
+const returnWithoutSpecialBehavior = (tag, children, props) => (0, import_base.renderChildren)([new import_base.JSXNode(tag, props, (0, import_children.toArray)(children ?? []))]);
 const documentMetadataTag = (tag, children, props, sort) => {
   if ("itemProp" in props) {
     return returnWithoutSpecialBehavior(tag, children, props);

package/node_modules/hono/dist/cjs/jsx/streaming.js

@@ -32,6 +32,7 @@ var import_components2 = require("./dom/components");
 var import_render = require("./dom/render");
 const StreamingContext = (0, import_context.createContext)(null);
 let suspenseCounter = 0;
+const serializeBoundaryChild = (child) => typeof child === "string" || Array.isArray(child) ? (0, import_base.renderChildren)([child]) : child == null || typeof child === "boolean" ? "" : (0, import_base.isUntrustedObject)(child) ? (0, import_base.renderUntrustedObject)(child) : child.toString();
 const Suspense = async ({
   children,
   fallback
@@ -48,9 +49,7 @@ const Suspense = async ({
   try {
     stackNode[import_constants.DOM_STASH][0] = 0;
     import_render.buildDataStack.push([[], stackNode]);
-    resArray = children.map(
-      (c) => c == null || typeof c === "boolean" ? "" : c.toString()
-    );
+    resArray = children.map(serializeBoundaryChild);
   } catch (e) {
     if (e instanceof Promise) {
       const resume = (0, import_context.captureRenderContext)();
@@ -71,7 +70,7 @@ const Suspense = async ({
   }
   if (resArray.some((res) => res instanceof Promise)) {
     const index = suspenseCounter++;
-    const fallbackStr = await fallback.toString();
+    const fallbackStr = await (typeof fallback === "string" || Array.isArray(fallback) ? (0, import_base.renderChildren)([fallback]) : (0, import_base.isUntrustedObject)(fallback) ? (0, import_base.renderUntrustedObject)(fallback) : fallback.toString());
     return (0, import_html.raw)(`<template id="H:${index}"></template>${fallbackStr}<!--/$-->`, [
       ...fallbackStr.callbacks || [],
       ({ phase, buffer, context }) => {
@@ -84,7 +83,7 @@ const Suspense = async ({
           if (buffer) {
             buffer[0] = buffer[0].replace(
               new RegExp(`<template id="H:${index}"></template>.*?<!--/\\$-->`),
-              content
+              () => content
             );
           }
           let html = buffer ? "" : `<template data-hono-target="H:${index}">${content}</template><script${nonce ? ` nonce="${nonce}"` : ""}>