hono 4.12.18 → 4.12.26

package/dist/middleware/cache/index.js

@@ -1,18 +1,13 @@
 // src/middleware/cache/index.ts
 var defaultCacheableStatusCodes = [200];
-var shouldSkipCache = (res) => {
-  if (res.headers.has("Vary")) {
-    return true;
+var shouldSkipCacheControl = (cacheControl) => !!cacheControl && /(?:^|,\s*)(?:private|no-(?:store|cache))(?:\s*(?:=|,|$))/i.test(cacheControl);
+var parseVaryDirectives = (vary) => {
+  if (vary == null) {
+    return [];
   }
-  const cacheControl = res.headers.get("Cache-Control");
-  if (cacheControl && /(?:^|,\s*)(?:private|no-(?:store|cache))(?:\s*(?:=|,|$))/i.test(cacheControl)) {
-    return true;
-  }
-  if (res.headers.has("Set-Cookie")) {
-    return true;
-  }
-  return false;
+  return (Array.isArray(vary) ? vary : vary.split(",")).map((directive) => directive.trim().toLowerCase()).filter(Boolean);
 };
+var shouldSkipCache = (res, optionsVaryDirectives, responseVary) => responseVary.length && (!optionsVaryDirectives || responseVary.some((name) => !optionsVaryDirectives.has(name))) || shouldSkipCacheControl(res.headers.get("Cache-Control")) || res.headers.has("Set-Cookie");
 var cache = (options) => {
   if (!globalThis.caches) {
     if (options.onCacheNotAvailable === false) {
@@ -27,8 +22,9 @@ var cache = (options) => {
     options.wait = false;
   }
   const cacheControlDirectives = options.cacheControl?.split(",").map((directive) => directive.toLowerCase());
-  const varyDirectives = Array.isArray(options.vary) ? options.vary : options.vary?.split(",").map((directive) => directive.trim());
-  if (options.vary?.includes("*")) {
+  const optionsVaryList = parseVaryDirectives(options.vary);
+  const varyDirectives = optionsVaryList.length ? new Set(optionsVaryList) : void 0;
+  if (varyDirectives?.has("*")) {
     throw new Error(
       'Middleware vary configuration cannot include "*", as it disallows effective caching.'
     );
@@ -36,7 +32,7 @@ var cache = (options) => {
   const cacheableStatusCodes = new Set(
     options.cacheableStatusCodes ?? defaultCacheableStatusCodes
   );
-  const addHeader = (c) => {
+  const addHeader = (c, responseVary) => {
     if (cacheControlDirectives) {
       const existingDirectives = c.res.headers.get("Cache-Control")?.split(",").map((d) => d.trim().split("=", 1)[0]) ?? [];
       for (const directive of cacheControlDirectives) {
@@ -48,16 +44,18 @@ var cache = (options) => {
       }
     }
     if (varyDirectives) {
-      const existingDirectives = c.res.headers.get("Vary")?.split(",").map((d) => d.trim()) ?? [];
-      const vary = Array.from(
-        new Set(
-          [...existingDirectives, ...varyDirectives].map((directive) => directive.toLowerCase())
-        )
-      ).sort();
-      if (vary.includes("*")) {
-        c.header("Vary", "*");
+      if (responseVary.length === 0) {
+        c.header("Vary", Array.from(varyDirectives).join(", "));
       } else {
-        c.header("Vary", vary.join(", "));
+        const merged = new Set(varyDirectives);
+        for (const directive of responseVary) {
+          merged.add(directive);
+        }
+        if (merged.has("*")) {
+          c.header("Vary", "*");
+        } else {
+          c.header("Vary", Array.from(merged).join(", "));
+        }
       }
     }
   };
@@ -70,6 +68,12 @@ var cache = (options) => {
     if (options.keyGenerator) {
       key = await options.keyGenerator(c);
     }
+    if (varyDirectives) {
+      for (const directive of varyDirectives) {
+        const value = c.req.raw.headers.get(directive) ?? "";
+        key += `::${directive}=${encodeURIComponent(value)}`;
+      }
+    }
     const cacheName = typeof options.cacheName === "function" ? await options.cacheName(c) : options.cacheName;
     const cache3 = await caches.open(cacheName);
     const response = await cache3.match(key);
@@ -80,8 +84,9 @@ var cache = (options) => {
     if (!cacheableStatusCodes.has(c.res.status)) {
       return;
     }
-    addHeader(c);
-    if (shouldSkipCache(c.res)) {
+    const responseVary = parseVaryDirectives(c.res.headers.get("Vary"));
+    addHeader(c, responseVary);
+    if (shouldSkipCache(c.res, varyDirectives, responseVary)) {
       return;
     }
     const res = c.res.clone();

package/dist/middleware/compress/index.js

@@ -1,9 +1,37 @@
 // src/middleware/compress/index.ts
+import { parseAccept } from "../../utils/accept.js";
 import { COMPRESSIBLE_CONTENT_TYPE_REGEX } from "../../utils/compress.js";
 var ENCODING_TYPES = ["gzip", "deflate"];
 var cacheControlNoTransformRegExp = /(?:^|,)\s*?no-transform\s*?(?:,|$)/i;
+var selectEncoding = (header, candidates) => {
+  if (header === void 0) {
+    return void 0;
+  }
+  const accepts = parseAccept(header);
+  const wildcardQ = accepts.find((a) => a.type === "*")?.q;
+  let best;
+  for (const enc of candidates) {
+    const explicit = accepts.find((a) => a.type.toLowerCase() === enc);
+    const q = explicit ? explicit.q : wildcardQ ?? 0;
+    if (q === 1) {
+      return enc;
+    } else if (q > 0 && (!best || q > best.q)) {
+      best = { encoding: enc, q };
+    }
+  }
+  return best?.encoding;
+};
 var compress = (options) => {
   const threshold = options?.threshold ?? 1024;
+  const candidates = options?.encoding ? [options.encoding] : ENCODING_TYPES;
+  const contentTypeFilter = options?.contentTypeFilter ?? COMPRESSIBLE_CONTENT_TYPE_REGEX;
+  const shouldCompress = typeof contentTypeFilter === "function" ? (res) => {
+    const type = res.headers.get("Content-Type");
+    return type && contentTypeFilter(type);
+  } : (res) => {
+    const type = res.headers.get("Content-Type");
+    return type && contentTypeFilter.test(type);
+  };
   return async function compress2(ctx, next) {
     await next();
     const contentLength = ctx.res.headers.get("Content-Length");
@@ -16,7 +44,7 @@ var compress = (options) => {
       return;
     }
     const accepted = ctx.req.header("Accept-Encoding");
-    const encoding = options?.encoding ?? ENCODING_TYPES.find((encoding2) => accepted?.includes(encoding2));
+    const encoding = selectEncoding(accepted, candidates);
     if (!encoding || !ctx.res.body) {
       return;
     }
@@ -30,14 +58,11 @@ var compress = (options) => {
     }
   };
 };
-var shouldCompress = (res) => {
-  const type = res.headers.get("Content-Type");
-  return type && COMPRESSIBLE_CONTENT_TYPE_REGEX.test(type);
-};
 var shouldTransform = (res) => {
   const cacheControl = res.headers.get("Cache-Control");
   return !cacheControl || !cacheControlNoTransformRegExp.test(cacheControl);
 };
 export {
+  COMPRESSIBLE_CONTENT_TYPE_REGEX,
   compress
 };

package/dist/middleware/cors/index.js

@@ -10,9 +10,6 @@ var cors = (options) => {
   const findAllowOrigin = ((optsOrigin) => {
     if (typeof optsOrigin === "string") {
       if (optsOrigin === "*") {
-        if (opts.credentials) {
-          return (origin) => origin || null;
-        }
         return () => optsOrigin;
       } else {
         return (origin) => optsOrigin === origin ? origin : null;
@@ -47,7 +44,7 @@ var cors = (options) => {
       set("Access-Control-Expose-Headers", opts.exposeHeaders.join(","));
     }
     if (c.req.method === "OPTIONS") {
-      if (opts.origin !== "*" || opts.credentials) {
+      if (opts.origin !== "*") {
         set("Vary", "Origin");
       }
       if (opts.maxAge != null) {
@@ -77,7 +74,7 @@ var cors = (options) => {
       });
     }
     await next();
-    if (opts.origin !== "*" || opts.credentials) {
+    if (opts.origin !== "*") {
       c.header("Vary", "Origin", { append: true });
     }
   };

package/dist/middleware/ip-restriction/index.js

@@ -6,13 +6,48 @@ import {
   convertIPv6BinaryToString,
   convertIPv6ToBinary,
   distinctRemoteAddr,
-  isIPv4MappedIPv6
+  isIPv4MappedIPv6,
+  INVALID_IP_ADDRESS_ERROR_CODE
 } from "../../utils/ipaddr.js";
-var IS_CIDR_NOTATION_REGEX = /\/[0-9]{0,3}$/;
+var IS_CIDR_NOTATION_REGEX = /\/[^/]*$/;
+var parseCidrPrefix = (rule, prefix, max) => {
+  if (!/^[0-9]{1,3}$/.test(prefix)) {
+    throw new TypeError(`Invalid rule: ${rule}`);
+  }
+  const parsedPrefix = parseInt(prefix);
+  if (parsedPrefix > max) {
+    throw new TypeError(`Invalid rule: ${rule}`);
+  }
+  return parsedPrefix;
+};
 var buildMatcher = (rules) => {
   const functionRules = [];
   const staticRules = /* @__PURE__ */ new Set();
+  const staticIPv4Rules = /* @__PURE__ */ new Set();
+  const staticIPv6Rules = /* @__PURE__ */ new Set();
   const cidrRules = [];
+  const registerStaticRule = (rule) => {
+    const type = distinctRemoteAddr(rule);
+    if (type === void 0) {
+      throw new TypeError(`Invalid rule: ${rule}`);
+    }
+    if (type === "IPv4") {
+      const ipv4binary = convertIPv4ToBinary(rule);
+      staticRules.add(rule);
+      staticRules.add(`::ffff:${rule}`);
+      staticIPv4Rules.add(ipv4binary);
+      staticIPv6Rules.add(0xffffn << 32n | ipv4binary);
+    } else {
+      const ipv6binary = convertIPv6ToBinary(rule);
+      const ipv6Addr = convertIPv6BinaryToString(ipv6binary);
+      staticRules.add(ipv6Addr);
+      staticIPv6Rules.add(ipv6binary);
+      if (isIPv4MappedIPv6(ipv6binary)) {
+        staticRules.add(ipv6Addr.substring(7));
+        staticIPv4Rules.add(convertIPv4MappedIPv6ToIPv4(ipv6binary));
+      }
+    }
+  };
   for (let rule of rules) {
     if (rule === "*") {
       return () => true;
@@ -22,17 +57,17 @@ var buildMatcher = (rules) => {
       if (IS_CIDR_NOTATION_REGEX.test(rule)) {
         const separatedRule = rule.split("/");
         const addrStr = separatedRule[0];
-        const type2 = distinctRemoteAddr(addrStr);
-        if (type2 === void 0) {
+        const type = distinctRemoteAddr(addrStr);
+        if (type === void 0) {
           throw new TypeError(`Invalid rule: ${rule}`);
         }
-        let isIPv4 = type2 === "IPv4";
-        let prefix = parseInt(separatedRule[1]);
+        let isIPv4 = type === "IPv4";
+        let prefix = parseCidrPrefix(rule, separatedRule[1], isIPv4 ? 32 : 128);
         if (isIPv4 ? prefix === 32 : prefix === 128) {
           rule = addrStr;
         } else {
           let addr = (isIPv4 ? convertIPv4ToBinary : convertIPv6ToBinary)(addrStr);
-          if (type2 === "IPv6" && isIPv4MappedIPv6(addr) && prefix >= 96) {
+          if (type === "IPv6" && isIPv4MappedIPv6(addr) && prefix >= 96) {
             isIPv4 = true;
             addr = convertIPv4MappedIPv6ToIPv4(addr);
             prefix -= 96;
@@ -42,21 +77,7 @@ var buildMatcher = (rules) => {
           continue;
         }
       }
-      const type = distinctRemoteAddr(rule);
-      if (type === void 0) {
-        throw new TypeError(`Invalid rule: ${rule}`);
-      }
-      if (type === "IPv4") {
-        staticRules.add(rule);
-        staticRules.add(`::ffff:${rule}`);
-      } else {
-        const ipv6binary = convertIPv6ToBinary(rule);
-        const ipv6Addr = convertIPv6BinaryToString(ipv6binary);
-        staticRules.add(ipv6Addr);
-        if (isIPv4MappedIPv6(ipv6binary)) {
-          staticRules.add(ipv6Addr.substring(7));
-        }
-      }
+      registerStaticRule(rule);
     }
   }
   return (remote) => {
@@ -65,6 +86,9 @@ var buildMatcher = (rules) => {
     }
     const remoteAddr = remote.binaryAddr ||= (remote.isIPv4 ? convertIPv4ToBinary : convertIPv6ToBinary)(remote.addr);
     const remoteIPv4Addr = remote.isIPv4 || isIPv4MappedIPv6(remoteAddr) ? remote.isIPv4 ? remoteAddr : convertIPv4MappedIPv6ToIPv4(remoteAddr) : void 0;
+    if ((remote.isIPv4 ? staticIPv4Rules : staticIPv6Rules).has(remoteAddr)) {
+      return true;
+    }
     for (const [isIPv4, addr, mask] of cidrRules) {
       if (isIPv4) {
         if (remoteIPv4Addr === void 0) {
@@ -107,14 +131,21 @@ var ipRestriction = (getIP, { denyList = [], allowList = [] }, onError) => {
     }
     const type = typeof connInfo !== "string" && connInfo.remote.addressType || distinctRemoteAddr(addr);
     const remoteData = { addr, type, isIPv4: type === "IPv4" };
-    if (denyMatcher(remoteData)) {
-      if (onError) {
-        return onError({ addr, type }, c);
+    try {
+      if (denyMatcher(remoteData)) {
+        if (onError) {
+          return onError({ addr, type }, c);
+        }
+        throw blockError(c);
       }
-      throw blockError(c);
-    }
-    if (allowMatcher(remoteData)) {
-      return await next();
+      if (allowMatcher(remoteData)) {
+        return await next();
+      }
+    } catch (e) {
+      if (e instanceof TypeError && e.code === INVALID_IP_ADDRESS_ERROR_CODE) {
+        throw blockError(c);
+      }
+      throw e;
     }
     if (allowLength === 0) {
       return await next();

package/dist/middleware/jwk/jwk.js

@@ -17,7 +17,7 @@ var jwk = (options, init) => {
     let token;
     if (credentials) {
       const parts = credentials.split(/\s+/);
-      if (parts.length !== 2) {
+      if (parts.length !== 2 || parts[0].toLowerCase() !== "bearer") {
         const errDescription = "invalid credentials structure";
         throw new HTTPException(401, {
           message: errDescription,

package/dist/middleware/jwt/jwt.js

@@ -20,7 +20,7 @@ var jwt = (options) => {
     let token;
     if (credentials) {
       const parts = credentials.split(/\s+/);
-      if (parts.length !== 2) {
+      if (parts.length !== 2 || parts[0].toLowerCase() !== "bearer") {
         const errDescription = "invalid credentials structure";
         throw new HTTPException(401, {
           message: errDescription,

package/dist/middleware/language/language.js

@@ -53,20 +53,12 @@ var normalizeLanguage = (lang, options) => {
   }
 };
 var detectFromQuery = (c, options) => {
-  try {
-    const query = c.req.query(options.lookupQueryString);
-    return normalizeLanguage(query, options);
-  } catch {
-    return void 0;
-  }
+  const query = c.req.query(options.lookupQueryString);
+  return normalizeLanguage(query, options);
 };
 var detectFromCookie = (c, options) => {
-  try {
-    const cookie = getCookie(c, options.lookupCookie);
-    return normalizeLanguage(cookie, options);
-  } catch {
-    return void 0;
-  }
+  const cookie = getCookie(c, options.lookupCookie);
+  return normalizeLanguage(cookie, options);
 };
 function detectFromHeader(c, options) {
   try {
@@ -87,14 +79,10 @@ function detectFromHeader(c, options) {
   }
 }
 function detectFromPath(c, options) {
-  try {
-    const url = new URL(c.req.url);
-    const pathSegments = url.pathname.split("/").filter(Boolean);
-    const langSegment = pathSegments[options.lookupFromPathIndex];
-    return normalizeLanguage(langSegment, options);
-  } catch {
-    return void 0;
-  }
+  const url = new URL(c.req.url);
+  const pathSegments = url.pathname.split("/").filter(Boolean);
+  const langSegment = pathSegments[options.lookupFromPathIndex];
+  return normalizeLanguage(langSegment, options);
 }
 var detectors = {
   querystring: detectFromQuery,
@@ -129,9 +117,6 @@ var detectLanguage = (c, options) => {
   let detectedLang;
   for (const detectorName of options.order) {
     const detector = detectors[detectorName];
-    if (!detector) {
-      continue;
-    }
     try {
       detectedLang = detector(c, options);
       if (detectedLang) {
@@ -164,15 +149,8 @@ var languageDetector = (userOptions) => {
   };
   validateOptions(options);
   return async function languageDetector2(ctx, next) {
-    try {
-      const lang = detectLanguage(ctx, options);
-      ctx.set("language", lang);
-    } catch (error) {
-      if (options.debug) {
-        console.error("Language detection failed:", error);
-      }
-      ctx.set("language", options.fallbackLanguage);
-    }
+    const lang = detectLanguage(ctx, options);
+    ctx.set("language", lang);
     await next();
   };
 };

package/dist/middleware/serve-static/index.js

@@ -24,7 +24,7 @@ var serveStatic = (options) => {
     } else {
       try {
         filename = tryDecodeURI(c.req.path);
-        if (/(?:^|[\/\\])\.{1,2}(?:$|[\/\\])|[\/\\]{2,}/.test(filename)) {
+        if (/(?:^|[\/\\])\.{1,2}(?:$|[\/\\])|[\/\\]{2,}|\\/.test(filename)) {
           throw new Error();
         }
       } catch {

package/dist/middleware/timing/timing.js

@@ -31,7 +31,9 @@ var timing = (config) => {
       endTime(c, "total");
     }
     if (options.autoEnd) {
-      timers.forEach((_, key) => endTime(c, key));
+      timers.forEach((_, key) => {
+        endTime(c, key);
+      });
     }
     const enabled = typeof options.enabled === "function" ? options.enabled(c) : options.enabled;
     if (enabled) {

package/dist/request.js

@@ -147,6 +147,21 @@ var HonoRequest = class {
   arrayBuffer() {
     return this.#cachedBody("arrayBuffer");
   }
+  /**
+   * `.bytes()` parses the request body as a `Uint8Array`.
+   *
+   * @see {@link https://hono.dev/docs/api/request#bytes}
+   *
+   * @example
+   * ```ts
+   * app.post('/entry', async (c) => {
+   *   const body = await c.req.bytes()
+   * })
+   * ```
+   */
+  bytes() {
+    return this.#cachedBody("arrayBuffer").then((buffer) => new Uint8Array(buffer));
+  }
   /**
    * Parses the request body as a `Blob`.
    * @example