hono 4.12.18 → 4.12.26

package/dist/cjs/middleware/language/language.js

@@ -83,20 +83,12 @@ const normalizeLanguage = (lang, options) => {
   }
 };
 const detectFromQuery = (c, options) => {
-  try {
-    const query = c.req.query(options.lookupQueryString);
-    return normalizeLanguage(query, options);
-  } catch {
-    return void 0;
-  }
+  const query = c.req.query(options.lookupQueryString);
+  return normalizeLanguage(query, options);
 };
 const detectFromCookie = (c, options) => {
-  try {
-    const cookie = (0, import_cookie.getCookie)(c, options.lookupCookie);
-    return normalizeLanguage(cookie, options);
-  } catch {
-    return void 0;
-  }
+  const cookie = (0, import_cookie.getCookie)(c, options.lookupCookie);
+  return normalizeLanguage(cookie, options);
 };
 function detectFromHeader(c, options) {
   try {
@@ -117,14 +109,10 @@ function detectFromHeader(c, options) {
   }
 }
 function detectFromPath(c, options) {
-  try {
-    const url = new URL(c.req.url);
-    const pathSegments = url.pathname.split("/").filter(Boolean);
-    const langSegment = pathSegments[options.lookupFromPathIndex];
-    return normalizeLanguage(langSegment, options);
-  } catch {
-    return void 0;
-  }
+  const url = new URL(c.req.url);
+  const pathSegments = url.pathname.split("/").filter(Boolean);
+  const langSegment = pathSegments[options.lookupFromPathIndex];
+  return normalizeLanguage(langSegment, options);
 }
 const detectors = {
   querystring: detectFromQuery,
@@ -159,9 +147,6 @@ const detectLanguage = (c, options) => {
   let detectedLang;
   for (const detectorName of options.order) {
     const detector = detectors[detectorName];
-    if (!detector) {
-      continue;
-    }
     try {
       detectedLang = detector(c, options);
       if (detectedLang) {
@@ -194,15 +179,8 @@ const languageDetector = (userOptions) => {
   };
   validateOptions(options);
   return async function languageDetector2(ctx, next) {
-    try {
-      const lang = detectLanguage(ctx, options);
-      ctx.set("language", lang);
-    } catch (error) {
-      if (options.debug) {
-        console.error("Language detection failed:", error);
-      }
-      ctx.set("language", options.fallbackLanguage);
-    }
+    const lang = detectLanguage(ctx, options);
+    ctx.set("language", lang);
     await next();
   };
 };

package/dist/cjs/middleware/serve-static/index.js

@@ -45,7 +45,7 @@ const serveStatic = (options) => {
     } else {
       try {
         filename = (0, import_url.tryDecodeURI)(c.req.path);
-        if (/(?:^|[\/\\])\.{1,2}(?:$|[\/\\])|[\/\\]{2,}/.test(filename)) {
+        if (/(?:^|[\/\\])\.{1,2}(?:$|[\/\\])|[\/\\]{2,}|\\/.test(filename)) {
           throw new Error();
         }
       } catch {

package/dist/cjs/middleware/timing/timing.js

@@ -56,7 +56,9 @@ const timing = (config) => {
       endTime(c, "total");
     }
     if (options.autoEnd) {
-      timers.forEach((_, key) => endTime(c, key));
+      timers.forEach((_, key) => {
+        endTime(c, key);
+      });
     }
     const enabled = typeof options.enabled === "function" ? options.enabled(c) : options.enabled;
     if (enabled) {

package/dist/cjs/request.js

@@ -169,6 +169,21 @@ class HonoRequest {
   arrayBuffer() {
     return this.#cachedBody("arrayBuffer");
   }
+  /**
+   * `.bytes()` parses the request body as a `Uint8Array`.
+   *
+   * @see {@link https://hono.dev/docs/api/request#bytes}
+   *
+   * @example
+   * ```ts
+   * app.post('/entry', async (c) => {
+   *   const body = await c.req.bytes()
+   * })
+   * ```
+   */
+  bytes() {
+    return this.#cachedBody("arrayBuffer").then((buffer) => new Uint8Array(buffer));
+  }
   /**
    * Parses the request body as a `Blob`.
    * @example

package/dist/cjs/utils/compress.js

@@ -20,7 +20,7 @@ __export(compress_exports, {
   COMPRESSIBLE_CONTENT_TYPE_REGEX: () => COMPRESSIBLE_CONTENT_TYPE_REGEX
 });
 module.exports = __toCommonJS(compress_exports);
-const COMPRESSIBLE_CONTENT_TYPE_REGEX = /^\s*(?:text\/(?!event-stream(?:[;\s]|$))[^;\s]+|application\/(?:javascript|json|xml|xml-dtd|ecmascript|dart|postscript|rtf|tar|toml|vnd\.dart|vnd\.ms-fontobject|vnd\.ms-opentype|wasm|x-httpd-php|x-javascript|x-ns-proxy-autoconfig|x-sh|x-tar|x-virtualbox-hdd|x-virtualbox-ova|x-virtualbox-ovf|x-virtualbox-vbox|x-virtualbox-vdi|x-virtualbox-vhd|x-virtualbox-vmdk|x-www-form-urlencoded)|font\/(?:otf|ttf)|image\/(?:bmp|vnd\.adobe\.photoshop|vnd\.microsoft\.icon|vnd\.ms-dds|x-icon|x-ms-bmp)|message\/rfc822|model\/gltf-binary|x-shader\/x-fragment|x-shader\/x-vertex|[^;\s]+?\+(?:json|text|xml|yaml))(?:[;\s]|$)/i;
+const COMPRESSIBLE_CONTENT_TYPE_REGEX = /^\s*(?:text\/(?!event-stream(?:[;\s]|$))[^;\s]+|application\/(?:javascript|json|xml|xml-dtd|ecmascript|dart|msgpack|postscript|rtf|tar|toml|vnd\.dart|vnd\.ms-fontobject|vnd\.ms-opentype|vnd\.msgpack|wasm|x-httpd-php|x-javascript|x-msgpack|x-ns-proxy-autoconfig|x-sh|x-tar|x-virtualbox-hdd|x-virtualbox-ova|x-virtualbox-ovf|x-virtualbox-vbox|x-virtualbox-vdi|x-virtualbox-vhd|x-virtualbox-vmdk|x-www-form-urlencoded)|font\/(?:otf|ttf)|image\/(?:bmp|vnd\.adobe\.photoshop|vnd\.microsoft\.icon|vnd\.ms-dds|x-icon|x-ms-bmp)|message\/rfc822|model\/gltf-binary|x-shader\/x-fragment|x-shader\/x-vertex|[^;\s]+?\+(?:json|text|xml|yaml|msgpack))(?:[;\s]|$)/i;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   COMPRESSIBLE_CONTENT_TYPE_REGEX

package/dist/cjs/utils/cookie.js

@@ -72,14 +72,14 @@ const parse = (cookie, name) => {
     return {};
   }
   const pairs = cookie.split(";");
-  const parsedCookie = {};
+  const parsedCookie = /* @__PURE__ */ Object.create(null);
   for (const pairStr of pairs) {
     const valueStartPos = pairStr.indexOf("=");
     if (valueStartPos === -1) {
       continue;
     }
     const cookieName = trimCookieWhitespace(pairStr.substring(0, valueStartPos));
-    if (name && name !== cookieName || !validCookieNameRegEx.test(cookieName)) {
+    if (name && name !== cookieName || !validCookieNameRegEx.test(cookieName) || cookieName in parsedCookie) {
       continue;
     }
     let cookieValue = trimCookieWhitespace(pairStr.substring(valueStartPos + 1));
@@ -96,7 +96,7 @@ const parse = (cookie, name) => {
   return parsedCookie;
 };
 const parseSigned = async (cookie, secret, name) => {
-  const parsedCookie = {};
+  const parsedCookie = /* @__PURE__ */ Object.create(null);
   const secretKey = await getCryptoKey(secret);
   for (const [key, value] of Object.entries(parse(cookie, name))) {
     const signatureStartPos = value.lastIndexOf(".");
@@ -132,7 +132,7 @@ const _serialize = (name, value, opt = {}) => {
       throw new Error("__Host- Cookie must not have Domain attributes");
     }
   }
-  for (const key of ["domain", "path"]) {
+  for (const key of ["domain", "path", "sameSite", "priority"]) {
     if (opt[key] && /[;\r\n]/.test(opt[key])) {
       throw new Error(`${key} must not contain ";", "\\r", or "\\n"`);
     }

package/dist/cjs/utils/filepath.js

@@ -42,7 +42,7 @@ const getFilePathWithoutDefaultDocument = (options) => {
     return;
   }
   filename = filename.replace(/^\.?[\/\\]/, "");
-  filename = filename.replace(/\\/, "/");
+  filename = filename.replace(/\\/g, "/");
   root = root.replace(/\/$/, "");
   let path = root ? root + "/" + filename : filename;
   path = path.replace(/^\.?\//, "");

package/dist/cjs/utils/ipaddr.js

@@ -17,6 +17,7 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var ipaddr_exports = {};
 __export(ipaddr_exports, {
+  INVALID_IP_ADDRESS_ERROR_CODE: () => INVALID_IP_ADDRESS_ERROR_CODE,
   convertIPv4BinaryToString: () => convertIPv4BinaryToString,
   convertIPv4MappedIPv6ToIPv4: () => convertIPv4MappedIPv6ToIPv4,
   convertIPv4ToBinary: () => convertIPv4ToBinary,
@@ -42,7 +43,9 @@ const expandIPv6 = (ipV6) => {
     if (node !== "") {
       sections[i] = node.padStart(4, "0");
     } else {
-      sections[i + 1] === "" && sections.splice(i + 1, 1);
+      while (sections[i + 1] === "") {
+        sections.splice(i + 1, 1);
+      }
       sections[i] = new Array(8 - sections.length + 1).fill("0000").join(":");
     }
   }
@@ -50,6 +53,16 @@ const expandIPv6 = (ipV6) => {
 };
 const IPV4_OCTET_PART = "(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])";
 const IPV4_REGEX = new RegExp(`^(?:${IPV4_OCTET_PART}\\.){3}${IPV4_OCTET_PART}$`);
+const INVALID_IP_ADDRESS_ERROR_CODE = "ERR_INVALID_IP_ADDRESS";
+const CHAR_CODE_0 = 48;
+const CHAR_CODE_9 = 57;
+const CHAR_CODE_A = 65;
+const CHAR_CODE_F = 70;
+const CHAR_CODE_a = 97;
+const CHAR_CODE_f = 102;
+const CHAR_CODE_DOT = 46;
+const CHAR_CODE_COLON = 58;
+const CHAR_CODE_PERCENT = 37;
 const distinctRemoteAddr = (remoteAddr) => {
   if (IPV4_REGEX.test(remoteAddr)) {
     return "IPv4";
@@ -58,21 +71,187 @@ const distinctRemoteAddr = (remoteAddr) => {
     return "IPv6";
   }
 };
-const convertIPv4ToBinary = (ipv4) => {
-  const parts = ipv4.split(".");
+const createInvalidIPAddressError = (message) => {
+  const error = new TypeError(message);
+  error.code = INVALID_IP_ADDRESS_ERROR_CODE;
+  return error;
+};
+const throwInvalidIPv4Address = (ipv4) => {
+  throw createInvalidIPAddressError(`Invalid IPv4 address: ${ipv4}`);
+};
+const throwInvalidIPv6Address = (ipv6) => {
+  throw createInvalidIPAddressError(`Invalid IPv6 address: ${ipv6}`);
+};
+const parseIPv4ToBinary = (ipv4, start, end, onInvalid) => {
   let result = 0n;
-  for (let i = 0; i < 4; i++) {
-    result <<= 8n;
-    result += BigInt(parts[i]);
+  let octets = 0;
+  let octet = 0;
+  let digits = 0;
+  let firstDigit = 0;
+  for (let i = start; i <= end; i++) {
+    const code = i < end ? ipv4.charCodeAt(i) : CHAR_CODE_DOT;
+    if (code >= CHAR_CODE_0 && code <= CHAR_CODE_9) {
+      if (digits === 0) {
+        firstDigit = code;
+      } else if (firstDigit === CHAR_CODE_0) {
+        onInvalid();
+      }
+      octet = octet * 10 + code - CHAR_CODE_0;
+      if (octet > 255) {
+        onInvalid();
+      }
+      digits++;
+      continue;
+    }
+    if (code !== CHAR_CODE_DOT || digits === 0 || octets === 4) {
+      onInvalid();
+    }
+    result = (result << 8n) + BigInt(octet);
+    octets++;
+    octet = 0;
+    digits = 0;
+  }
+  if (octets !== 4) {
+    onInvalid();
   }
   return result;
 };
+const parseIPv6HexCode = (code) => {
+  if (code >= CHAR_CODE_0 && code <= CHAR_CODE_9) {
+    return code - CHAR_CODE_0;
+  }
+  if (code >= CHAR_CODE_A && code <= CHAR_CODE_F) {
+    return code - CHAR_CODE_A + 10;
+  }
+  if (code >= CHAR_CODE_a && code <= CHAR_CODE_f) {
+    return code - CHAR_CODE_a + 10;
+  }
+  return -1;
+};
+const isIPv6LinkLocal = (ipv6binary) => ipv6binary >> 118n === 0x3fan;
+const convertIPv4ToBinary = (ipv4) => {
+  return parseIPv4ToBinary(ipv4, 0, ipv4.length, () => throwInvalidIPv4Address(ipv4));
+};
 const convertIPv6ToBinary = (ipv6) => {
-  const sections = expandIPv6(ipv6).split(":");
+  const length = ipv6.length;
+  const sections = [];
+  let hasZoneId = false;
+  let compressAt = -1;
+  let index = 0;
+  if (length === 0) {
+    throwInvalidIPv6Address(ipv6);
+  }
+  while (index < length) {
+    if (sections.length > 8) {
+      throwInvalidIPv6Address(ipv6);
+    }
+    let code = ipv6.charCodeAt(index);
+    if (code === CHAR_CODE_PERCENT) {
+      if (index + 1 === length) {
+        throwInvalidIPv6Address(ipv6);
+      }
+      hasZoneId = true;
+      break;
+    }
+    if (code === CHAR_CODE_COLON) {
+      if (index + 1 < length && ipv6.charCodeAt(index + 1) === CHAR_CODE_COLON) {
+        if (compressAt !== -1) {
+          throwInvalidIPv6Address(ipv6);
+        }
+        compressAt = sections.length;
+        index += 2;
+        continue;
+      }
+      throwInvalidIPv6Address(ipv6);
+    }
+    let value = 0;
+    let digits = 0;
+    const sectionStart = index;
+    while (index < length) {
+      code = ipv6.charCodeAt(index);
+      const hex = parseIPv6HexCode(code);
+      if (hex === -1) {
+        break;
+      }
+      if (digits === 4) {
+        throwInvalidIPv6Address(ipv6);
+      }
+      value = value << 4 | hex;
+      digits++;
+      index++;
+    }
+    if (index < length && ipv6.charCodeAt(index) === CHAR_CODE_DOT) {
+      let ipv4End = length;
+      for (let i = index; i < length; i++) {
+        if (ipv6.charCodeAt(i) === CHAR_CODE_PERCENT) {
+          if (i + 1 === length) {
+            throwInvalidIPv6Address(ipv6);
+          }
+          hasZoneId = true;
+          ipv4End = i;
+          break;
+        }
+      }
+      const ipv4 = parseIPv4ToBinary(
+        ipv6,
+        sectionStart,
+        ipv4End,
+        () => throwInvalidIPv6Address(ipv6)
+      );
+      sections.push(Number(ipv4 >> 16n & 0xffffn), Number(ipv4 & 0xffffn));
+      index = length;
+      break;
+    }
+    if (digits === 0) {
+      throwInvalidIPv6Address(ipv6);
+    }
+    sections.push(value);
+    if (index === length) {
+      break;
+    }
+    code = ipv6.charCodeAt(index);
+    if (code === CHAR_CODE_PERCENT) {
+      if (index + 1 === length) {
+        throwInvalidIPv6Address(ipv6);
+      }
+      hasZoneId = true;
+      break;
+    }
+    if (code !== CHAR_CODE_COLON) {
+      throwInvalidIPv6Address(ipv6);
+    }
+    if (index + 1 < length && ipv6.charCodeAt(index + 1) === CHAR_CODE_COLON) {
+      if (compressAt !== -1) {
+        throwInvalidIPv6Address(ipv6);
+      }
+      compressAt = sections.length;
+      index += 2;
+      continue;
+    }
+    index++;
+    if (index === length) {
+      throwInvalidIPv6Address(ipv6);
+    }
+  }
+  if (compressAt === -1 ? sections.length !== 8 : sections.length >= 8) {
+    throwInvalidIPv6Address(ipv6);
+  }
   let result = 0n;
-  for (let i = 0; i < 8; i++) {
+  const zeros = compressAt === -1 ? 0 : 8 - sections.length;
+  const firstSectionEnd = compressAt === -1 ? sections.length : compressAt;
+  for (let i = 0; i < firstSectionEnd; i++) {
     result <<= 16n;
-    result += BigInt(parseInt(sections[i], 16));
+    result += BigInt(sections[i]);
+  }
+  for (let i = 0; i < zeros; i++) {
+    result <<= 16n;
+  }
+  for (let i = firstSectionEnd; i < sections.length; i++) {
+    result <<= 16n;
+    result += BigInt(sections[i]);
+  }
+  if (hasZoneId && !isIPv6LinkLocal(result)) {
+    throwInvalidIPv6Address(ipv6);
   }
   return result;
 };
@@ -86,6 +265,9 @@ const convertIPv4BinaryToString = (ipV4) => {
 const isIPv4MappedIPv6 = (ipv6binary) => ipv6binary >> 32n === 0xffffn;
 const convertIPv4MappedIPv6ToIPv4 = (ipv6binary) => ipv6binary & 0xffffffffn;
 const convertIPv6BinaryToString = (ipV6) => {
+  if (ipV6 === 0n) {
+    return "::";
+  }
   if (isIPv4MappedIPv6(ipV6)) {
     return `::ffff:${convertIPv4BinaryToString(convertIPv4MappedIPv6ToIPv4(ipV6))}`;
   }
@@ -117,13 +299,14 @@ const convertIPv6BinaryToString = (ipV6) => {
       maxZeroEnd = 8;
     }
   }
-  if (maxZeroStart !== -1) {
+  if (maxZeroStart !== -1 && maxZeroEnd - maxZeroStart > 1) {
     sections.splice(maxZeroStart, maxZeroEnd - maxZeroStart, ":");
   }
   return sections.join(":").replace(/:{2,}/g, "::");
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  INVALID_IP_ADDRESS_ERROR_CODE,
   convertIPv4BinaryToString,
   convertIPv4MappedIPv6ToIPv4,
   convertIPv4ToBinary,

package/dist/cjs/utils/mime.js

@@ -28,15 +28,13 @@ const getMimeType = (filename, mimes = baseMimes) => {
   if (!match) {
     return;
   }
-  let mimeType = mimes[match[1].toLowerCase()];
-  if (mimeType && mimeType.startsWith("text")) {
-    mimeType += "; charset=utf-8";
-  }
-  return mimeType;
+  return mimes[match[1].toLowerCase()];
 };
 const getExtension = (mimeType) => {
+  const baseType = mimeType.split(";", 1)[0].trim();
   for (const ext in baseMimes) {
-    if (baseMimes[ext] === mimeType) {
+    const stored = baseMimes[ext];
+    if (stored === mimeType || stored.split(";", 1)[0].trim() === baseType) {
       return ext;
     }
   }
@@ -48,25 +46,25 @@ const _baseMimes = {
   av1: "video/av1",
   bin: "application/octet-stream",
   bmp: "image/bmp",
-  css: "text/css",
-  csv: "text/csv",
+  css: "text/css; charset=utf-8",
+  csv: "text/csv; charset=utf-8",
   eot: "application/vnd.ms-fontobject",
   epub: "application/epub+zip",
   gif: "image/gif",
   gz: "application/gzip",
-  htm: "text/html",
-  html: "text/html",
+  htm: "text/html; charset=utf-8",
+  html: "text/html; charset=utf-8",
   ico: "image/x-icon",
-  ics: "text/calendar",
+  ics: "text/calendar; charset=utf-8",
   jpeg: "image/jpeg",
   jpg: "image/jpeg",
-  js: "text/javascript",
+  js: "text/javascript; charset=utf-8",
   json: "application/json",
   jsonld: "application/ld+json",
   map: "application/json",
   mid: "audio/x-midi",
   midi: "audio/x-midi",
-  mjs: "text/javascript",
+  mjs: "text/javascript; charset=utf-8",
   mp3: "audio/mpeg",
   mp4: "video/mp4",
   mpeg: "video/mpeg",
@@ -78,12 +76,12 @@ const _baseMimes = {
   pdf: "application/pdf",
   png: "image/png",
   rtf: "application/rtf",
-  svg: "image/svg+xml",
+  svg: "image/svg+xml; charset=utf-8",
   tif: "image/tiff",
   tiff: "image/tiff",
   ts: "video/mp2t",
   ttf: "font/ttf",
-  txt: "text/plain",
+  txt: "text/plain; charset=utf-8",
   wasm: "application/wasm",
   webm: "video/webm",
   weba: "audio/webm",
@@ -91,8 +89,8 @@ const _baseMimes = {
   webp: "image/webp",
   woff: "font/woff",
   woff2: "font/woff2",
-  xhtml: "application/xhtml+xml",
-  xml: "application/xml",
+  xhtml: "application/xhtml+xml; charset=utf-8",
+  xml: "application/xml; charset=utf-8",
   zip: "application/zip",
   "3gp": "video/3gpp",
   "3g2": "video/3gpp2",

package/dist/cjs/utils/stream.js

@@ -48,7 +48,9 @@ class StreamingApi {
         done ? controller.close() : controller.enqueue(value);
       },
       cancel: () => {
-        this.abort();
+        if (!this.closed) {
+          this.abort();
+        }
       }
     });
   }
@@ -70,11 +72,11 @@ class StreamingApi {
     return new Promise((res) => setTimeout(res, ms));
   }
   async close() {
+    this.closed = true;
     try {
       await this.writer.close();
     } catch {
     }
-    this.closed = true;
   }
   async pipe(body) {
     this.writer.releaseLock();

package/dist/hono-base.js

@@ -118,7 +118,7 @@ var Hono = class _Hono {
         handler = async (c, next) => (await compose([], app.errorHandler)(c, () => r.handler(c, next))).res;
         handler[COMPOSED_HANDLER] = r.handler;
       }
-      subApp.#addRoute(r.method, r.path, handler);
+      subApp.#addRoute(r.method, r.path, handler, r.basePath);
     });
     return this;
   }
@@ -242,7 +242,7 @@ var Hono = class _Hono {
       const pathPrefixLength = mergedPath === "/" ? 0 : mergedPath.length;
       return (request) => {
         const url = new URL(request.url);
-        url.pathname = url.pathname.slice(pathPrefixLength) || "/";
+        url.pathname = this.getPath(request).slice(pathPrefixLength) || "/";
         return new Request(url, request);
       };
     })();
@@ -256,10 +256,15 @@ var Hono = class _Hono {
     this.#addRoute(METHOD_NAME_ALL, mergePath(path, "*"), handler);
     return this;
   }
-  #addRoute(method, path, handler) {
+  #addRoute(method, path, handler, baseRoutePath) {
     method = method.toUpperCase();
     path = mergePath(this._basePath, path);
-    const r = { basePath: this._basePath, path, method, handler };
+    const r = {
+      basePath: baseRoutePath !== void 0 ? mergePath(this._basePath, baseRoutePath) : this._basePath,
+      path,
+      method,
+      handler
+    };
     this.router.add(method, path, [handler, r]);
     this.routes.push(r);
   }

package/dist/index.js

@@ -1,5 +1,7 @@
 // src/index.ts
 import { Hono } from "./hono.js";
+import { Context } from "./context.js";
 export {
+  Context,
   Hono
 };

package/dist/middleware/bearer-auth/index.js

@@ -6,7 +6,7 @@ var PREFIX = "Bearer";
 var HEADER = "Authorization";
 var bearerAuth = (options) => {
   if (!("token" in options || "verifyToken" in options)) {
-    throw new Error('bearer auth middleware requires options for "token"');
+    throw new Error('bearer auth middleware requires options for "token" or "verifyToken"');
   }
   if (!options.realm) {
     options.realm = "";