hono 4.13.0 → 4.13.2

package/dist/cjs/client/client.js

@@ -74,7 +74,7 @@ class ClientRequestImpl {
         }
         this.rBody = form;
       }
-      if (args.json) {
+      if (args.json !== void 0) {
         this.rBody = JSON.stringify(args.json);
         this.cType = "application/json";
       }
@@ -90,9 +90,9 @@ class ClientRequestImpl {
     if (args?.cookie) {
       const cookies = [];
       for (const [key, value] of Object.entries(args.cookie)) {
-        cookies.push((0, import_cookie.serialize)(key, value, { path: "/" }));
+        cookies.push((0, import_cookie.serialize)(key, value));
       }
-      headerValues["Cookie"] = cookies.join(",");
+      headerValues["Cookie"] = cookies.join("; ");
     }
     if (this.cType) {
       headerValues["Content-Type"] = this.cType;

package/dist/cjs/jsx/intrinsic-element/components.js

@@ -101,7 +101,7 @@ const documentMetadataTag = (tag, children, props, sort) => {
   const string = new import_base.JSXNode(tag, restProps, (0, import_children.toArray)(children || [])).toString();
   if (string instanceof Promise) {
     return string.then(
-      (resString) => (0, import_html.raw)(string, [
+      (resString) => (0, import_html.raw)(resString, [
         ...resString.callbacks || [],
         insertIntoHead(tag, resString, restProps, precedence)
       ])

package/dist/cjs/middleware/cors/index.js

@@ -28,6 +28,8 @@ const cors = (options) => {
     exposeHeaders: [],
     ...options
   };
+  const exposeHeadersStr = opts.exposeHeaders?.length ? opts.exposeHeaders.join(",") : void 0;
+  const allowHeadersStr = opts.allowHeaders?.length ? opts.allowHeaders.join(",") : void 0;
   const findAllowOrigin = ((optsOrigin) => {
     if (typeof optsOrigin === "string") {
       if (optsOrigin === "*") {
@@ -43,11 +45,12 @@ const cors = (options) => {
   })(opts.origin);
   const findAllowMethods = ((optsAllowMethods) => {
     if (typeof optsAllowMethods === "function") {
-      return optsAllowMethods;
+      return async (origin, c) => (await optsAllowMethods(origin, c)).join(",");
     } else if (Array.isArray(optsAllowMethods)) {
-      return () => optsAllowMethods;
+      const methodsStr = optsAllowMethods.join(",");
+      return () => methodsStr;
     } else {
-      return () => [];
+      return () => "";
     }
   })(opts.allowMethods);
   return async function cors2(c, next) {
@@ -61,8 +64,8 @@ const cors = (options) => {
     if (opts.credentials) {
       set("Access-Control-Allow-Credentials", "true");
     }
-    if (opts.exposeHeaders?.length) {
-      set("Access-Control-Expose-Headers", opts.exposeHeaders.join(","));
+    if (exposeHeadersStr) {
+      set("Access-Control-Expose-Headers", exposeHeadersStr);
     }
     if (c.req.method === "OPTIONS") {
       if (opts.origin !== "*") {
@@ -72,18 +75,18 @@ const cors = (options) => {
         set("Access-Control-Max-Age", opts.maxAge.toString());
       }
       const allowMethods = await findAllowMethods(c.req.header("origin") || "", c);
-      if (allowMethods.length) {
-        set("Access-Control-Allow-Methods", allowMethods.join(","));
+      if (allowMethods) {
+        set("Access-Control-Allow-Methods", allowMethods);
       }
-      let headers = opts.allowHeaders;
-      if (!headers?.length) {
+      let headersStr = allowHeadersStr;
+      if (!headersStr) {
         const requestHeaders = c.req.header("Access-Control-Request-Headers");
         if (requestHeaders) {
-          headers = requestHeaders.split(",").map((h) => h.trim());
+          headersStr = requestHeaders.split(",").map((h) => h.trim()).join(",");
         }
       }
-      if (headers?.length) {
-        set("Access-Control-Allow-Headers", headers.join(","));
+      if (headersStr) {
+        set("Access-Control-Allow-Headers", headersStr);
         c.res.headers.append("Vary", "Access-Control-Request-Headers");
       }
       c.res.headers.delete("Content-Length");

package/dist/cjs/middleware/etag/digest.js

@@ -31,18 +31,64 @@ const mergeBuffers = (buffer1, buffer2) => {
   merged.set(buffer2, buffer1.byteLength);
   return merged;
 };
+const CHUNK_SIZE = 256 * 1024;
 const generateDigest = async (stream, generator) => {
   if (!stream) {
     return null;
   }
   let result = void 0;
+  let chunk;
+  let chunkLength = 0;
+  const digest = async (body) => {
+    result = await generator(mergeBuffers(result, body));
+  };
   const reader = stream.getReader();
   for (; ; ) {
     const { value, done } = await reader.read();
     if (done) {
       break;
     }
-    result = await generator(mergeBuffers(result, value));
+    let offset = 0;
+    while (offset < value.byteLength) {
+      const remaining = value.byteLength - offset;
+      if (chunkLength === 0 && remaining >= CHUNK_SIZE) {
+        await digest(value.subarray(offset, offset + CHUNK_SIZE));
+        offset += CHUNK_SIZE;
+        continue;
+      }
+      const requiredLength = chunkLength + remaining;
+      if (requiredLength < CHUNK_SIZE) {
+        if (!chunk) {
+          chunk = value.subarray(offset);
+        } else {
+          if (chunk.byteLength < requiredLength) {
+            const nextChunk = new Uint8Array(
+              new ArrayBuffer(Math.min(CHUNK_SIZE, Math.max(requiredLength, chunk.byteLength * 2)))
+            );
+            nextChunk.set(chunk.subarray(0, chunkLength));
+            chunk = nextChunk;
+          }
+          chunk.set(value.subarray(offset), chunkLength);
+        }
+        chunkLength = requiredLength;
+        break;
+      }
+      const length = CHUNK_SIZE - chunkLength;
+      if (chunk?.byteLength !== CHUNK_SIZE) {
+        const nextChunk = new Uint8Array(new ArrayBuffer(CHUNK_SIZE));
+        if (chunk) {
+          nextChunk.set(chunk.subarray(0, chunkLength));
+        }
+        chunk = nextChunk;
+      }
+      chunk.set(value.subarray(offset, offset + length), chunkLength);
+      await digest(chunk);
+      chunkLength = 0;
+      offset += length;
+    }
+  }
+  if (chunk && chunkLength > 0) {
+    await digest(chunk.subarray(0, chunkLength));
   }
   if (!result) {
     return null;

package/dist/cjs/middleware/etag/index.js

@@ -54,6 +54,9 @@ const etag = (options) => {
   return async function etag2(c, next) {
     const ifNoneMatch = c.req.header("If-None-Match") ?? null;
     await next();
+    if (!(c.req.method === "GET" || c.req.method === "HEAD" || c.req.method === "QUERY") || !c.res.ok) {
+      return;
+    }
     const res = c.res;
     let etag3 = res.headers.get("ETag");
     if (!etag3) {
@@ -70,7 +73,7 @@ const etag = (options) => {
       }
       etag3 = weak ? `W/"${hash}"` : `"${hash}"`;
     }
-    const matched = ifNoneMatch === "*" ? (c.req.method === "GET" || c.req.method === "HEAD" || c.req.method === "QUERY") && res.ok : etagMatches(etag3, ifNoneMatch);
+    const matched = ifNoneMatch === "*" || etagMatches(etag3, ifNoneMatch);
     if (matched) {
       c.res = new Response(null, {
         status: 304,

package/dist/cjs/middleware/secure-headers/secure-headers.js

@@ -159,14 +159,17 @@ function getPermissionsPolicyDirectives(policy) {
   return Object.entries(policy).map(([directive, value]) => {
     const kebabDirective = camelToKebab(directive);
     if (typeof value === "boolean") {
-      return `${kebabDirective}=${value ? "*" : "none"}`;
+      return `${kebabDirective}=${value ? "*" : "()"}`;
     }
     if (Array.isArray(value)) {
       if (value.length === 0) {
         return `${kebabDirective}=()`;
       }
-      if (value.length === 1 && (value[0] === "*" || value[0] === "none")) {
-        return `${kebabDirective}=${value[0]}`;
+      if (value.length === 1 && value[0] === "*") {
+        return `${kebabDirective}=*`;
+      }
+      if (value.length === 1 && value[0] === "none") {
+        return `${kebabDirective}=()`;
       }
       const allowlist = value.map((item) => ["self", "src"].includes(item) ? item : `"${item}"`);
       return `${kebabDirective}=(${allowlist.join(" ")})`;

package/dist/cjs/router/trie-router/node.js

@@ -166,7 +166,7 @@ class Node {
               }
               if (hasChildren(child.#children)) {
                 child.#params = params;
-                const componentCount = m[0].match(/\//)?.length ?? 0;
+                const componentCount = m[0].match(/\//g)?.length ?? 0;
                 const targetCurNodes = curNodesQueue[componentCount] ||= [];
                 targetCurNodes.push(child);
               }

package/dist/cjs/utils/stream.js

@@ -80,8 +80,11 @@ class StreamingApi {
   }
   async pipe(body) {
     this.writer.releaseLock();
-    await body.pipeTo(this.writable, { preventClose: true });
-    this.writer = this.writable.getWriter();
+    try {
+      await body.pipeTo(this.writable, { preventClose: true, preventAbort: true });
+    } finally {
+      this.writer = this.writable.getWriter();
+    }
   }
   onAbort(listener) {
     this.abortSubscribers.push(listener);

package/dist/cjs/utils/url.js

@@ -142,13 +142,13 @@ const checkOptionalParameter = (path) => {
     if (segment !== "" && !/\:/.test(segment)) {
       basePath += "/" + segment;
     } else if (/\:/.test(segment)) {
-      if (/\?/.test(segment)) {
+      if (segment.charCodeAt(segment.length - 1) === 63) {
         if (results.length === 0 && basePath === "") {
           results.push("/");
         } else {
           results.push(basePath);
         }
-        const optionalSegment = segment.replace("?", "");
+        const optionalSegment = segment.slice(0, -1);
         basePath += "/" + optionalSegment;
         results.push(basePath);
       } else {

package/dist/client/client.js

@@ -60,7 +60,7 @@ var ClientRequestImpl = class {
         }
         this.rBody = form;
       }
-      if (args.json) {
+      if (args.json !== void 0) {
         this.rBody = JSON.stringify(args.json);
         this.cType = "application/json";
       }
@@ -76,9 +76,9 @@ var ClientRequestImpl = class {
     if (args?.cookie) {
       const cookies = [];
       for (const [key, value] of Object.entries(args.cookie)) {
-        cookies.push(serialize(key, value, { path: "/" }));
+        cookies.push(serialize(key, value));
       }
-      headerValues["Cookie"] = cookies.join(",");
+      headerValues["Cookie"] = cookies.join("; ");
     }
     if (this.cType) {
       headerValues["Content-Type"] = this.cType;

package/dist/jsx/intrinsic-element/components.js

@@ -78,7 +78,7 @@ var documentMetadataTag = (tag, children, props, sort) => {
   const string = new JSXNode(tag, restProps, toArray(children || [])).toString();
   if (string instanceof Promise) {
     return string.then(
-      (resString) => raw(string, [
+      (resString) => raw(resString, [
         ...resString.callbacks || [],
         insertIntoHead(tag, resString, restProps, precedence)
       ])

package/dist/middleware/cors/index.js

@@ -7,6 +7,8 @@ var cors = (options) => {
     exposeHeaders: [],
     ...options
   };
+  const exposeHeadersStr = opts.exposeHeaders?.length ? opts.exposeHeaders.join(",") : void 0;
+  const allowHeadersStr = opts.allowHeaders?.length ? opts.allowHeaders.join(",") : void 0;
   const findAllowOrigin = ((optsOrigin) => {
     if (typeof optsOrigin === "string") {
       if (optsOrigin === "*") {
@@ -22,11 +24,12 @@ var cors = (options) => {
   })(opts.origin);
   const findAllowMethods = ((optsAllowMethods) => {
     if (typeof optsAllowMethods === "function") {
-      return optsAllowMethods;
+      return async (origin, c) => (await optsAllowMethods(origin, c)).join(",");
     } else if (Array.isArray(optsAllowMethods)) {
-      return () => optsAllowMethods;
+      const methodsStr = optsAllowMethods.join(",");
+      return () => methodsStr;
     } else {
-      return () => [];
+      return () => "";
     }
   })(opts.allowMethods);
   return async function cors2(c, next) {
@@ -40,8 +43,8 @@ var cors = (options) => {
     if (opts.credentials) {
       set("Access-Control-Allow-Credentials", "true");
     }
-    if (opts.exposeHeaders?.length) {
-      set("Access-Control-Expose-Headers", opts.exposeHeaders.join(","));
+    if (exposeHeadersStr) {
+      set("Access-Control-Expose-Headers", exposeHeadersStr);
     }
     if (c.req.method === "OPTIONS") {
       if (opts.origin !== "*") {
@@ -51,18 +54,18 @@ var cors = (options) => {
         set("Access-Control-Max-Age", opts.maxAge.toString());
       }
       const allowMethods = await findAllowMethods(c.req.header("origin") || "", c);
-      if (allowMethods.length) {
-        set("Access-Control-Allow-Methods", allowMethods.join(","));
+      if (allowMethods) {
+        set("Access-Control-Allow-Methods", allowMethods);
       }
-      let headers = opts.allowHeaders;
-      if (!headers?.length) {
+      let headersStr = allowHeadersStr;
+      if (!headersStr) {
         const requestHeaders = c.req.header("Access-Control-Request-Headers");
         if (requestHeaders) {
-          headers = requestHeaders.split(",").map((h) => h.trim());
+          headersStr = requestHeaders.split(",").map((h) => h.trim()).join(",");
         }
       }
-      if (headers?.length) {
-        set("Access-Control-Allow-Headers", headers.join(","));
+      if (headersStr) {
+        set("Access-Control-Allow-Headers", headersStr);
         c.res.headers.append("Vary", "Access-Control-Request-Headers");
       }
       c.res.headers.delete("Content-Length");

package/dist/middleware/etag/digest.js

@@ -10,18 +10,64 @@ var mergeBuffers = (buffer1, buffer2) => {
   merged.set(buffer2, buffer1.byteLength);
   return merged;
 };
+var CHUNK_SIZE = 256 * 1024;
 var generateDigest = async (stream, generator) => {
   if (!stream) {
     return null;
   }
   let result = void 0;
+  let chunk;
+  let chunkLength = 0;
+  const digest = async (body) => {
+    result = await generator(mergeBuffers(result, body));
+  };
   const reader = stream.getReader();
   for (; ; ) {
     const { value, done } = await reader.read();
     if (done) {
       break;
     }
-    result = await generator(mergeBuffers(result, value));
+    let offset = 0;
+    while (offset < value.byteLength) {
+      const remaining = value.byteLength - offset;
+      if (chunkLength === 0 && remaining >= CHUNK_SIZE) {
+        await digest(value.subarray(offset, offset + CHUNK_SIZE));
+        offset += CHUNK_SIZE;
+        continue;
+      }
+      const requiredLength = chunkLength + remaining;
+      if (requiredLength < CHUNK_SIZE) {
+        if (!chunk) {
+          chunk = value.subarray(offset);
+        } else {
+          if (chunk.byteLength < requiredLength) {
+            const nextChunk = new Uint8Array(
+              new ArrayBuffer(Math.min(CHUNK_SIZE, Math.max(requiredLength, chunk.byteLength * 2)))
+            );
+            nextChunk.set(chunk.subarray(0, chunkLength));
+            chunk = nextChunk;
+          }
+          chunk.set(value.subarray(offset), chunkLength);
+        }
+        chunkLength = requiredLength;
+        break;
+      }
+      const length = CHUNK_SIZE - chunkLength;
+      if (chunk?.byteLength !== CHUNK_SIZE) {
+        const nextChunk = new Uint8Array(new ArrayBuffer(CHUNK_SIZE));
+        if (chunk) {
+          nextChunk.set(chunk.subarray(0, chunkLength));
+        }
+        chunk = nextChunk;
+      }
+      chunk.set(value.subarray(offset, offset + length), chunkLength);
+      await digest(chunk);
+      chunkLength = 0;
+      offset += length;
+    }
+  }
+  if (chunk && chunkLength > 0) {
+    await digest(chunk.subarray(0, chunkLength));
   }
   if (!result) {
     return null;

package/dist/middleware/etag/index.js

@@ -32,6 +32,9 @@ var etag = (options) => {
   return async function etag2(c, next) {
     const ifNoneMatch = c.req.header("If-None-Match") ?? null;
     await next();
+    if (!(c.req.method === "GET" || c.req.method === "HEAD" || c.req.method === "QUERY") || !c.res.ok) {
+      return;
+    }
     const res = c.res;
     let etag3 = res.headers.get("ETag");
     if (!etag3) {
@@ -48,7 +51,7 @@ var etag = (options) => {
       }
       etag3 = weak ? `W/"${hash}"` : `"${hash}"`;
     }
-    const matched = ifNoneMatch === "*" ? (c.req.method === "GET" || c.req.method === "HEAD" || c.req.method === "QUERY") && res.ok : etagMatches(etag3, ifNoneMatch);
+    const matched = ifNoneMatch === "*" || etagMatches(etag3, ifNoneMatch);
     if (matched) {
       c.res = new Response(null, {
         status: 304,

package/dist/middleware/secure-headers/secure-headers.js

@@ -137,14 +137,17 @@ function getPermissionsPolicyDirectives(policy) {
   return Object.entries(policy).map(([directive, value]) => {
     const kebabDirective = camelToKebab(directive);
     if (typeof value === "boolean") {
-      return `${kebabDirective}=${value ? "*" : "none"}`;
+      return `${kebabDirective}=${value ? "*" : "()"}`;
     }
     if (Array.isArray(value)) {
       if (value.length === 0) {
         return `${kebabDirective}=()`;
       }
-      if (value.length === 1 && (value[0] === "*" || value[0] === "none")) {
-        return `${kebabDirective}=${value[0]}`;
+      if (value.length === 1 && value[0] === "*") {
+        return `${kebabDirective}=*`;
+      }
+      if (value.length === 1 && value[0] === "none") {
+        return `${kebabDirective}=()`;
       }
       const allowlist = value.map((item) => ["self", "src"].includes(item) ? item : `"${item}"`);
       return `${kebabDirective}=(${allowlist.join(" ")})`;

package/dist/router/trie-router/node.js

@@ -145,7 +145,7 @@ var Node = class _Node {
               }
               if (hasChildren(child.#children)) {
                 child.#params = params;
-                const componentCount = m[0].match(/\//)?.length ?? 0;
+                const componentCount = m[0].match(/\//g)?.length ?? 0;
                 const targetCurNodes = curNodesQueue[componentCount] ||= [];
                 targetCurNodes.push(child);
               }

package/dist/types/middleware/secure-headers/permissions-policy.d.ts

@@ -2,13 +2,13 @@ export type PermissionsPolicyDirective = StandardizedFeatures | ProposedFeatures
 /**
  * These features have been declared in a published version of the respective specification.
  */
-type StandardizedFeatures = 'accelerometer' | 'ambientLightSensor' | 'attributionReporting' | 'autoplay' | 'battery' | 'bluetooth' | 'camera' | 'chUa' | 'chUaArch' | 'chUaBitness' | 'chUaFullVersion' | 'chUaFullVersionList' | 'chUaMobile' | 'chUaModel' | 'chUaPlatform' | 'chUaPlatformVersion' | 'chUaWow64' | 'computePressure' | 'crossOriginIsolated' | 'directSockets' | 'displayCapture' | 'encryptedMedia' | 'executionWhileNotRendered' | 'executionWhileOutOfViewport' | 'fullscreen' | 'geolocation' | 'gyroscope' | 'hid' | 'identityCredentialsGet' | 'idleDetection' | 'keyboardMap' | 'magnetometer' | 'microphone' | 'midi' | 'navigationOverride' | 'payment' | 'pictureInPicture' | 'publickeyCredentialsGet' | 'screenWakeLock' | 'serial' | 'storageAccess' | 'syncXhr' | 'usb' | 'webShare' | 'windowManagement' | 'xrSpatialTracking';
+type StandardizedFeatures = 'accelerometer' | 'ambientLightSensor' | 'attributionReporting' | 'autoplay' | 'battery' | 'bluetooth' | 'camera' | 'chUa' | 'chUaArch' | 'chUaBitness' | 'chUaFullVersion' | 'chUaFullVersionList' | 'chUaHighEntropyValues' | 'chUaMobile' | 'chUaModel' | 'chUaPlatform' | 'chUaPlatformVersion' | 'chUaWow64' | 'computePressure' | 'crossOriginIsolated' | 'directSockets' | 'displayCapture' | 'encryptedMedia' | 'executionWhileNotRendered' | 'executionWhileOutOfViewport' | 'fullscreen' | 'geolocation' | 'gyroscope' | 'hid' | 'identityCredentialsGet' | 'idleDetection' | 'keyboardMap' | 'magnetometer' | 'mediasession' | 'microphone' | 'midi' | 'navigationOverride' | 'otpCredentials' | 'payment' | 'pictureInPicture' | 'publickeyCredentialsGet' | 'screenWakeLock' | 'serial' | 'storageAccess' | 'syncXhr' | 'tools' | 'usb' | 'webShare' | 'windowManagement' | 'xrSpatialTracking';
 /**
  * These features have been proposed, but the definitions have not yet been integrated into their respective specs.
  */
-type ProposedFeatures = 'clipboardRead' | 'clipboardWrite' | 'gamepad' | 'sharedAutofill' | 'speakerSelection';
+type ProposedFeatures = 'autofill' | 'clipboardRead' | 'clipboardWrite' | 'deferredFetch' | 'gamepad' | 'languageDetector' | 'languageModel' | 'manualText' | 'rewriter' | 'sharedAutofill' | 'speakerSelection' | 'summarizer' | 'translator' | 'writer';
 /**
  * These features generally have an explainer only, but may be available for experimentation by web developers.
  */
-type ExperimentalFeatures = 'allScreensCapture' | 'browsingTopics' | 'capturedSurfaceControl' | 'conversionMeasurement' | 'digitalCredentialsGet' | 'focusWithoutUserActivation' | 'joinAdInterestGroup' | 'localFonts' | 'runAdAuction' | 'smartCard' | 'syncScript' | 'trustTokenRedemption' | 'unload' | 'verticalScroll';
+type ExperimentalFeatures = 'allScreensCapture' | 'browsingTopics' | 'capturedSurfaceControl' | 'conversionMeasurement' | 'digitalCredentialsCreate' | 'digitalCredentialsGet' | 'focusWithoutUserActivation' | 'joinAdInterestGroup' | 'localFonts' | 'monetization' | 'runAdAuction' | 'smartCard' | 'syncScript' | 'trustTokenRedemption' | 'unload' | 'verticalScroll';
 export {};

package/dist/utils/stream.js

@@ -59,8 +59,11 @@ var StreamingApi = class {
   }
   async pipe(body) {
     this.writer.releaseLock();
-    await body.pipeTo(this.writable, { preventClose: true });
-    this.writer = this.writable.getWriter();
+    try {
+      await body.pipeTo(this.writable, { preventClose: true, preventAbort: true });
+    } finally {
+      this.writer = this.writable.getWriter();
+    }
   }
   onAbort(listener) {
     this.abortSubscribers.push(listener);

package/dist/utils/url.js

@@ -108,13 +108,13 @@ var checkOptionalParameter = (path) => {
     if (segment !== "" && !/\:/.test(segment)) {
       basePath += "/" + segment;
     } else if (/\:/.test(segment)) {
-      if (/\?/.test(segment)) {
+      if (segment.charCodeAt(segment.length - 1) === 63) {
         if (results.length === 0 && basePath === "") {
           results.push("/");
         } else {
           results.push(basePath);
         }
-        const optionalSegment = segment.replace("?", "");
+        const optionalSegment = segment.slice(0, -1);
         basePath += "/" + optionalSegment;
         results.push(basePath);
       } else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hono",
-  "version": "4.13.0",
+  "version": "4.13.2",
   "description": "Web framework built on Web Standards",
   "main": "dist/cjs/index.js",
   "type": "module",