hono 4.13.1 → 4.13.3

package/dist/cjs/client/client.js

@@ -74,7 +74,7 @@ class ClientRequestImpl {
         }
         this.rBody = form;
       }
-      if (args.json) {
+      if (args.json !== void 0) {
         this.rBody = JSON.stringify(args.json);
         this.cType = "application/json";
       }
@@ -90,9 +90,9 @@ class ClientRequestImpl {
     if (args?.cookie) {
       const cookies = [];
       for (const [key, value] of Object.entries(args.cookie)) {
-        cookies.push((0, import_cookie.serialize)(key, value, { path: "/" }));
+        cookies.push((0, import_cookie.serialize)(key, value));
       }
-      headerValues["Cookie"] = cookies.join(",");
+      headerValues["Cookie"] = cookies.join("; ");
     }
     if (this.cType) {
       headerValues["Content-Type"] = this.cType;

package/dist/cjs/client/utils.js

@@ -37,7 +37,7 @@ const mergePath = (base, path) => {
 const replaceUrlParam = (urlString, params) => {
   for (const [k, v] of Object.entries(params)) {
     const reg = new RegExp("/:" + k + "(?:{[^/]+})?\\??(?=/|$)");
-    urlString = urlString.replace(reg, v ? `/${v}` : "");
+    urlString = urlString.replace(reg, () => v ? `/${v}` : "");
   }
   return urlString;
 };

package/dist/cjs/context.js

@@ -224,6 +224,10 @@ class Context {
    *   c.header('X-Message', 'Hello!')
    *   c.header('Content-Type', 'text/plain')
    *
+   *   // Append multiple headers using the append option (e.g. Vary)
+   *   c.header('Vary', 'Accept-Encoding', { append: true })
+   *   c.header('Vary', 'User-Agent', { append: true })
+   *
    *   return c.body('Thank you for coming')
    * })
    * ```

package/dist/cjs/jsx/intrinsic-element/components.js

@@ -101,7 +101,7 @@ const documentMetadataTag = (tag, children, props, sort) => {
   const string = new import_base.JSXNode(tag, restProps, (0, import_children.toArray)(children || [])).toString();
   if (string instanceof Promise) {
     return string.then(
-      (resString) => (0, import_html.raw)(string, [
+      (resString) => (0, import_html.raw)(resString, [
         ...resString.callbacks || [],
         insertIntoHead(tag, resString, restProps, precedence)
       ])

package/dist/cjs/middleware/cors/index.js

@@ -28,6 +28,8 @@ const cors = (options) => {
     exposeHeaders: [],
     ...options
   };
+  const exposeHeadersStr = opts.exposeHeaders?.length ? opts.exposeHeaders.join(",") : void 0;
+  const allowHeadersStr = opts.allowHeaders?.length ? opts.allowHeaders.join(",") : void 0;
   const findAllowOrigin = ((optsOrigin) => {
     if (typeof optsOrigin === "string") {
       if (optsOrigin === "*") {
@@ -43,11 +45,12 @@ const cors = (options) => {
   })(opts.origin);
   const findAllowMethods = ((optsAllowMethods) => {
     if (typeof optsAllowMethods === "function") {
-      return optsAllowMethods;
+      return async (origin, c) => (await optsAllowMethods(origin, c)).join(",");
     } else if (Array.isArray(optsAllowMethods)) {
-      return () => optsAllowMethods;
+      const methodsStr = optsAllowMethods.join(",");
+      return () => methodsStr;
     } else {
-      return () => [];
+      return () => "";
     }
   })(opts.allowMethods);
   return async function cors2(c, next) {
@@ -61,29 +64,29 @@ const cors = (options) => {
     if (opts.credentials) {
       set("Access-Control-Allow-Credentials", "true");
     }
-    if (opts.exposeHeaders?.length) {
-      set("Access-Control-Expose-Headers", opts.exposeHeaders.join(","));
+    if (exposeHeadersStr) {
+      set("Access-Control-Expose-Headers", exposeHeadersStr);
     }
     if (c.req.method === "OPTIONS") {
       if (opts.origin !== "*") {
-        set("Vary", "Origin");
+        c.res.headers.append("Vary", "Origin");
       }
       if (opts.maxAge != null) {
         set("Access-Control-Max-Age", opts.maxAge.toString());
       }
       const allowMethods = await findAllowMethods(c.req.header("origin") || "", c);
-      if (allowMethods.length) {
-        set("Access-Control-Allow-Methods", allowMethods.join(","));
+      if (allowMethods) {
+        set("Access-Control-Allow-Methods", allowMethods);
       }
-      let headers = opts.allowHeaders;
-      if (!headers?.length) {
+      let headersStr = allowHeadersStr;
+      if (!headersStr) {
         const requestHeaders = c.req.header("Access-Control-Request-Headers");
         if (requestHeaders) {
-          headers = requestHeaders.split(",").map((h) => h.trim());
+          headersStr = requestHeaders.split(",").map((h) => h.trim()).join(",");
         }
       }
-      if (headers?.length) {
-        set("Access-Control-Allow-Headers", headers.join(","));
+      if (headersStr) {
+        set("Access-Control-Allow-Headers", headersStr);
         c.res.headers.append("Vary", "Access-Control-Request-Headers");
       }
       c.res.headers.delete("Content-Length");

package/dist/cjs/middleware/csrf/index.js

@@ -23,7 +23,7 @@ module.exports = __toCommonJS(csrf_exports);
 var import_http_exception = require("../../http-exception");
 const secFetchSiteValues = ["same-origin", "same-site", "none", "cross-site"];
 const isSecFetchSite = (value) => secFetchSiteValues.includes(value);
-const isSafeMethodRe = /^(GET|HEAD)$/;
+const isSafeMethodRe = /^(GET|HEAD|OPTIONS)$/;
 const isRequestedByFormElementRe = /^\b(application\/x-www-form-urlencoded|multipart\/form-data|text\/plain)\b/i;
 const csrf = (options) => {
   const originHandler = ((optsOrigin) => {

package/dist/cjs/middleware/etag/digest.js

@@ -31,18 +31,64 @@ const mergeBuffers = (buffer1, buffer2) => {
   merged.set(buffer2, buffer1.byteLength);
   return merged;
 };
+const CHUNK_SIZE = 256 * 1024;
 const generateDigest = async (stream, generator) => {
   if (!stream) {
     return null;
   }
   let result = void 0;
+  let chunk;
+  let chunkLength = 0;
+  const digest = async (body) => {
+    result = await generator(mergeBuffers(result, body));
+  };
   const reader = stream.getReader();
   for (; ; ) {
     const { value, done } = await reader.read();
     if (done) {
       break;
     }
-    result = await generator(mergeBuffers(result, value));
+    let offset = 0;
+    while (offset < value.byteLength) {
+      const remaining = value.byteLength - offset;
+      if (chunkLength === 0 && remaining >= CHUNK_SIZE) {
+        await digest(value.subarray(offset, offset + CHUNK_SIZE));
+        offset += CHUNK_SIZE;
+        continue;
+      }
+      const requiredLength = chunkLength + remaining;
+      if (requiredLength < CHUNK_SIZE) {
+        if (!chunk) {
+          chunk = value.slice(offset);
+        } else {
+          if (chunk.byteLength < requiredLength) {
+            const nextChunk = new Uint8Array(
+              new ArrayBuffer(Math.min(CHUNK_SIZE, Math.max(requiredLength, chunk.byteLength * 2)))
+            );
+            nextChunk.set(chunk.subarray(0, chunkLength));
+            chunk = nextChunk;
+          }
+          chunk.set(value.subarray(offset), chunkLength);
+        }
+        chunkLength = requiredLength;
+        break;
+      }
+      const length = CHUNK_SIZE - chunkLength;
+      if (chunk?.byteLength !== CHUNK_SIZE) {
+        const nextChunk = new Uint8Array(new ArrayBuffer(CHUNK_SIZE));
+        if (chunk) {
+          nextChunk.set(chunk.subarray(0, chunkLength));
+        }
+        chunk = nextChunk;
+      }
+      chunk.set(value.subarray(offset, offset + length), chunkLength);
+      await digest(chunk);
+      chunkLength = 0;
+      offset += length;
+    }
+  }
+  if (chunk && chunkLength > 0) {
+    await digest(chunk.subarray(0, chunkLength));
   }
   if (!result) {
     return null;

package/dist/cjs/middleware/etag/index.js

@@ -82,11 +82,11 @@ const etag = (options) => {
           ETag: etag3
         }
       });
-      c.res.headers.forEach((_, key) => {
+      for (const key of Array.from(c.res.headers.keys())) {
         if (retainedHeaders.indexOf(key.toLowerCase()) === -1) {
           c.res.headers.delete(key);
         }
-      });
+      }
     } else {
       c.res.headers.set("ETag", etag3);
     }

package/dist/cjs/middleware/pretty-json/index.js

@@ -20,12 +20,14 @@ __export(pretty_json_exports, {
   prettyJSON: () => prettyJSON
 });
 module.exports = __toCommonJS(pretty_json_exports);
+const jsonContentTypeRegex = /^application\/(?:[a-z0-9._-]+\+)?json(?=$|[;\s])/i;
 const prettyJSON = (options) => {
   const targetQuery = options?.query ?? "pretty";
   return async function prettyJSON2(c, next) {
     const pretty = options?.force || c.req.query(targetQuery) || c.req.query(targetQuery) === "";
     await next();
-    if (pretty && c.res.headers.get("Content-Type")?.startsWith("application/json")) {
+    const contentType = c.res.headers.get("Content-Type");
+    if (pretty && contentType && jsonContentTypeRegex.test(contentType)) {
       const obj = await c.res.json();
       c.res = new Response(JSON.stringify(obj, null, options?.space ?? 2), c.res);
     }

package/dist/cjs/middleware/secure-headers/secure-headers.js

@@ -159,14 +159,17 @@ function getPermissionsPolicyDirectives(policy) {
   return Object.entries(policy).map(([directive, value]) => {
     const kebabDirective = camelToKebab(directive);
     if (typeof value === "boolean") {
-      return `${kebabDirective}=${value ? "*" : "none"}`;
+      return `${kebabDirective}=${value ? "*" : "()"}`;
     }
     if (Array.isArray(value)) {
       if (value.length === 0) {
         return `${kebabDirective}=()`;
       }
-      if (value.length === 1 && (value[0] === "*" || value[0] === "none")) {
-        return `${kebabDirective}=${value[0]}`;
+      if (value.length === 1 && value[0] === "*") {
+        return `${kebabDirective}=*`;
+      }
+      if (value.length === 1 && value[0] === "none") {
+        return `${kebabDirective}=()`;
       }
       const allowlist = value.map((item) => ["self", "src"].includes(item) ? item : `"${item}"`);
       return `${kebabDirective}=(${allowlist.join(" ")})`;

package/dist/cjs/router/linear-router/router.js

@@ -50,7 +50,8 @@ class LinearRouter {
           }
         } else if (hasStar && !hasLabel) {
           const endsWithStar = routePath.charCodeAt(routePath.length - 1) === 42;
-          const parts = (endsWithStar ? routePath.slice(0, -2) : routePath).split(splitByStarRe);
+          const endsWithSlashStar = routePath.endsWith("/*");
+          const parts = (endsWithStar ? routePath.slice(0, endsWithSlashStar ? -2 : -1) : routePath).split(splitByStarRe);
           const lastIndex = parts.length - 1;
           for (let j = 0, pos = 0, len2 = parts.length; j < len2; j++) {
             const part = parts[j];
@@ -60,7 +61,11 @@ class LinearRouter {
             }
             pos += part.length;
             if (j === lastIndex) {
-              if (!endsWithStar && pos !== path.length && !(pos === path.length - 1 && path.charCodeAt(pos) === 47)) {
+              if (endsWithSlashStar) {
+                if (pos !== path.length && path.charCodeAt(pos) !== 47) {
+                  continue ROUTES_LOOP;
+                }
+              } else if (!endsWithStar && pos !== path.length && !(pos === path.length - 1 && path.charCodeAt(pos) === 47)) {
                 continue ROUTES_LOOP;
               }
             } else {

package/dist/cjs/router/pattern-router/router.js

@@ -26,10 +26,8 @@ class PatternRouter {
   name = "PatternRouter";
   #routes = [];
   add(method, path, handler) {
-    const endsWithWildcard = path.at(-1) === "*";
-    if (endsWithWildcard) {
-      path = path.slice(0, -2);
-    }
+    const suffix = path.endsWith("/*") ? "(?:$|/)" : path.endsWith("*") ? "" : "/?$";
+    path = path.replace(/\*$/, "");
     if (path.at(-1) === "?") {
       path = path.slice(0, -1);
       this.add(method, path.replace(/\/[^/]+$/, ""), handler);
@@ -41,11 +39,7 @@ class PatternRouter {
       }
     );
     try {
-      this.#routes.push([
-        new RegExp(`^${parts.join("")}${endsWithWildcard ? "" : "/?$"}`),
-        method,
-        handler
-      ]);
+      this.#routes.push([new RegExp(`^${parts.join("")}${suffix}`), method, handler]);
     } catch {
       throw new import_router.UnsupportedPathError();
     }

package/dist/cjs/router/trie-router/node.js

@@ -23,76 +23,51 @@ module.exports = __toCommonJS(node_exports);
 var import_router = require("../../router");
 var import_url = require("../../utils/url");
 const emptyParams = /* @__PURE__ */ Object.create(null);
-const hasChildren = (children) => {
-  for (const _ in children) {
-    return true;
-  }
-  return false;
-};
+let order = 0;
 class Node {
-  #methods;
-  #children;
-  #patterns;
-  #order = 0;
+  #methods = [];
+  #children = /* @__PURE__ */ Object.create(null);
+  #patterns = [];
+  #pattern;
   #params = emptyParams;
-  constructor(method, handler, children) {
-    this.#children = children || /* @__PURE__ */ Object.create(null);
-    this.#methods = [];
-    if (method && handler) {
-      const m = /* @__PURE__ */ Object.create(null);
-      m[method] = { handler, possibleKeys: [], score: 0 };
-      this.#methods = [m];
-    }
-    this.#patterns = [];
-  }
   insert(method, path, handler) {
-    this.#order = ++this.#order;
     let curNode = this;
     const parts = (0, import_url.splitRoutingPath)(path);
-    const possibleKeys = [];
-    for (let i = 0, len = parts.length; i < len; i++) {
-      const p = parts[i];
-      const nextP = parts[i + 1];
-      const pattern = (0, import_url.getPattern)(p, nextP);
-      const key = Array.isArray(pattern) ? pattern[0] : p;
-      if (key in curNode.#children) {
-        curNode = curNode.#children[key];
-        if (pattern) {
-          possibleKeys.push(pattern[1]);
-        }
-        continue;
+    const possibleKeys = /* @__PURE__ */ new Set();
+    let i = 0;
+    for (const p of parts) {
+      const nextP = parts[++i];
+      const pattern = (0, import_url.getPattern)(p, nextP) || (nextP === void 0 && p && p.indexOf("*") === p.length - 1 ? p : null);
+      const isParam = Array.isArray(pattern);
+      const key = isParam ? pattern[0] : pattern || p;
+      const child = curNode.#children[key] ||= new Node();
+      if (pattern && !child.#pattern) {
+        child.#pattern = pattern;
+        curNode.#patterns.push(child);
       }
-      curNode.#children[key] = new Node();
-      if (pattern) {
-        curNode.#patterns.push(pattern);
-        possibleKeys.push(pattern[1]);
+      curNode = child;
+      if (isParam) {
+        possibleKeys.add(pattern[1]);
       }
-      curNode = curNode.#children[key];
     }
     curNode.#methods.push({
       [method]: {
         handler,
-        possibleKeys: possibleKeys.filter((v, i, a) => a.indexOf(v) === i),
-        score: this.#order
+        possibleKeys: [...possibleKeys],
+        score: ++order
       }
     });
-    return curNode;
   }
   #pushHandlerSets(handlerSets, node, method, nodeParams, params) {
     for (let i = 0, len = node.#methods.length; i < len; i++) {
       const m = node.#methods[i];
       const handlerSet = m[method] || m[import_router.METHOD_NAME_ALL];
-      const processedSet = {};
-      if (handlerSet !== void 0) {
+      if (handlerSet) {
         handlerSet.params = /* @__PURE__ */ Object.create(null);
         handlerSets.push(handlerSet);
-        if (nodeParams !== emptyParams || params && params !== emptyParams) {
-          for (let i2 = 0, len2 = handlerSet.possibleKeys.length; i2 < len2; i2++) {
-            const key = handlerSet.possibleKeys[i2];
-            const processed = processedSet[handlerSet.score];
-            handlerSet.params[key] = params?.[key] && !processed ? params[key] : nodeParams[key] ?? params?.[key];
-            processedSet[handlerSet.score] = true;
-          }
+        for (let i2 = 0, len2 = handlerSet.possibleKeys.length; i2 < len2; i2++) {
+          const key = handlerSet.possibleKeys[i2];
+          handlerSet.params[key] = params?.[key] && !i2 ? params[key] : nodeParams[key] ?? params?.[key];
         }
       }
     }
@@ -124,33 +99,33 @@ class Node {
             tempNodes.push(nextNode);
           }
         }
-        for (let k = 0, len3 = node.#patterns.length; k < len3; k++) {
-          const pattern = node.#patterns[k];
+        for (const child of node.#patterns) {
+          const pattern = child.#pattern;
           const params = node.#params === emptyParams ? {} : { ...node.#params };
-          if (pattern === "*") {
-            const astNode = node.#children["*"];
-            if (astNode) {
-              this.#pushHandlerSets(handlerSets, astNode, method, node.#params);
-              astNode.#params = params;
-              tempNodes.push(astNode);
+          if (typeof pattern === "string") {
+            if (pattern === "*" || part.startsWith(pattern.slice(0, -1))) {
+              this.#pushHandlerSets(handlerSets, child, method, node.#params);
+              if (pattern === "*") {
+                child.#params = params;
+                tempNodes.push(child);
+              }
             }
             continue;
           }
-          const [key, name, matcher] = pattern;
-          if (!part && !(matcher instanceof RegExp)) {
+          const [, name, matcher] = pattern;
+          if (!part && matcher === true) {
             continue;
           }
-          const child = node.#children[key];
-          if (matcher instanceof RegExp) {
-            if (partOffsets === null) {
-              partOffsets = new Array(len);
+          if (matcher !== true) {
+            if (!partOffsets) {
+              partOffsets = [];
               let offset = path[0] === "/" ? 1 : 0;
               for (let p = 0; p < len; p++) {
                 partOffsets[p] = offset;
                 offset += parts[p].length + 1;
               }
             }
-            const restPathString = path.substring(partOffsets[i]);
+            const restPathString = path.slice(partOffsets[i]);
             const m = matcher.exec(restPathString);
             if (m) {
               params[name] = m[0];
@@ -164,11 +139,12 @@ class Node {
                   params
                 );
               }
-              if (hasChildren(child.#children)) {
+              for (const _ in child.#children) {
                 child.#params = params;
                 const componentCount = m[0].match(/\//g)?.length ?? 0;
                 const targetCurNodes = curNodesQueue[componentCount] ||= [];
                 targetCurNodes.push(child);
+                break;
               }
               continue;
             }
@@ -196,7 +172,7 @@ class Node {
       const shifted = curNodesQueue.shift();
       curNodes = shifted ? tempNodes.concat(shifted) : tempNodes;
     }
-    if (handlerSets.length > 1) {
+    if (handlerSets[1]) {
       handlerSets.sort((a, b) => {
         return a.score - b.score;
       });

package/dist/cjs/router/trie-router/router.js

@@ -24,19 +24,11 @@ var import_url = require("../../utils/url");
 var import_node = require("./node");
 class TrieRouter {
   name = "TrieRouter";
-  #node;
-  constructor() {
-    this.#node = new import_node.Node();
-  }
+  #node = new import_node.Node();
   add(method, path, handler) {
-    const results = (0, import_url.checkOptionalParameter)(path);
-    if (results) {
-      for (let i = 0, len = results.length; i < len; i++) {
-        this.#node.insert(method, results[i], handler);
-      }
-      return;
+    for (const result of (0, import_url.checkOptionalParameter)(path) || [path]) {
+      this.#node.insert(method, result, handler);
     }
-    this.#node.insert(method, path, handler);
   }
   match(method, path) {
     return this.#node.search(method, path);

package/dist/cjs/utils/ipaddr.js

@@ -30,12 +30,14 @@ __export(ipaddr_exports, {
 module.exports = __toCommonJS(ipaddr_exports);
 const expandIPv6 = (ipV6) => {
   const sections = ipV6.split(":");
-  if (IPV4_REGEX.test(sections.at(-1))) {
+  const lastSection = sections.at(-1);
+  if (IPV4_REGEX.test(lastSection)) {
+    const octets = lastSection.split(".").map(Number);
     sections.splice(
       -1,
       1,
-      ...convertIPv6BinaryToString(convertIPv4ToBinary(sections.at(-1))).substring(2).split(":")
-      // => ['7f00', '0001']
+      (octets[0] << 8 | octets[1]).toString(16),
+      (octets[2] << 8 | octets[3]).toString(16)
     );
   }
   for (let i = 0; i < sections.length; i++) {

package/dist/cjs/utils/url.js

@@ -142,13 +142,13 @@ const checkOptionalParameter = (path) => {
     if (segment !== "" && !/\:/.test(segment)) {
       basePath += "/" + segment;
     } else if (/\:/.test(segment)) {
-      if (/\?/.test(segment)) {
+      if (segment.charCodeAt(segment.length - 1) === 63) {
         if (results.length === 0 && basePath === "") {
           results.push("/");
         } else {
           results.push(basePath);
         }
-        const optionalSegment = segment.replace("?", "");
+        const optionalSegment = segment.slice(0, -1);
         basePath += "/" + optionalSegment;
         results.push(basePath);
       } else {

package/dist/client/client.js

@@ -60,7 +60,7 @@ var ClientRequestImpl = class {
         }
         this.rBody = form;
       }
-      if (args.json) {
+      if (args.json !== void 0) {
         this.rBody = JSON.stringify(args.json);
         this.cType = "application/json";
       }
@@ -76,9 +76,9 @@ var ClientRequestImpl = class {
     if (args?.cookie) {
       const cookies = [];
       for (const [key, value] of Object.entries(args.cookie)) {
-        cookies.push(serialize(key, value, { path: "/" }));
+        cookies.push(serialize(key, value));
       }
-      headerValues["Cookie"] = cookies.join(",");
+      headerValues["Cookie"] = cookies.join("; ");
     }
     if (this.cType) {
       headerValues["Content-Type"] = this.cType;

package/dist/client/utils.js

@@ -9,7 +9,7 @@ var mergePath = (base, path) => {
 var replaceUrlParam = (urlString, params) => {
   for (const [k, v] of Object.entries(params)) {
     const reg = new RegExp("/:" + k + "(?:{[^/]+})?\\??(?=/|$)");
-    urlString = urlString.replace(reg, v ? `/${v}` : "");
+    urlString = urlString.replace(reg, () => v ? `/${v}` : "");
   }
   return urlString;
 };

package/dist/context.js

@@ -202,6 +202,10 @@ var Context = class {
    *   c.header('X-Message', 'Hello!')
    *   c.header('Content-Type', 'text/plain')
    *
+   *   // Append multiple headers using the append option (e.g. Vary)
+   *   c.header('Vary', 'Accept-Encoding', { append: true })
+   *   c.header('Vary', 'User-Agent', { append: true })
+   *
    *   return c.body('Thank you for coming')
    * })
    * ```

package/dist/jsx/intrinsic-element/components.js

@@ -78,7 +78,7 @@ var documentMetadataTag = (tag, children, props, sort) => {
   const string = new JSXNode(tag, restProps, toArray(children || [])).toString();
   if (string instanceof Promise) {
     return string.then(
-      (resString) => raw(string, [
+      (resString) => raw(resString, [
         ...resString.callbacks || [],
         insertIntoHead(tag, resString, restProps, precedence)
       ])

package/dist/middleware/cors/index.js

@@ -7,6 +7,8 @@ var cors = (options) => {
     exposeHeaders: [],
     ...options
   };
+  const exposeHeadersStr = opts.exposeHeaders?.length ? opts.exposeHeaders.join(",") : void 0;
+  const allowHeadersStr = opts.allowHeaders?.length ? opts.allowHeaders.join(",") : void 0;
   const findAllowOrigin = ((optsOrigin) => {
     if (typeof optsOrigin === "string") {
       if (optsOrigin === "*") {
@@ -22,11 +24,12 @@ var cors = (options) => {
   })(opts.origin);
   const findAllowMethods = ((optsAllowMethods) => {
     if (typeof optsAllowMethods === "function") {
-      return optsAllowMethods;
+      return async (origin, c) => (await optsAllowMethods(origin, c)).join(",");
     } else if (Array.isArray(optsAllowMethods)) {
-      return () => optsAllowMethods;
+      const methodsStr = optsAllowMethods.join(",");
+      return () => methodsStr;
     } else {
-      return () => [];
+      return () => "";
     }
   })(opts.allowMethods);
   return async function cors2(c, next) {
@@ -40,29 +43,29 @@ var cors = (options) => {
     if (opts.credentials) {
       set("Access-Control-Allow-Credentials", "true");
     }
-    if (opts.exposeHeaders?.length) {
-      set("Access-Control-Expose-Headers", opts.exposeHeaders.join(","));
+    if (exposeHeadersStr) {
+      set("Access-Control-Expose-Headers", exposeHeadersStr);
     }
     if (c.req.method === "OPTIONS") {
       if (opts.origin !== "*") {
-        set("Vary", "Origin");
+        c.res.headers.append("Vary", "Origin");
       }
       if (opts.maxAge != null) {
         set("Access-Control-Max-Age", opts.maxAge.toString());
       }
       const allowMethods = await findAllowMethods(c.req.header("origin") || "", c);
-      if (allowMethods.length) {
-        set("Access-Control-Allow-Methods", allowMethods.join(","));
+      if (allowMethods) {
+        set("Access-Control-Allow-Methods", allowMethods);
       }
-      let headers = opts.allowHeaders;
-      if (!headers?.length) {
+      let headersStr = allowHeadersStr;
+      if (!headersStr) {
         const requestHeaders = c.req.header("Access-Control-Request-Headers");
         if (requestHeaders) {
-          headers = requestHeaders.split(",").map((h) => h.trim());
+          headersStr = requestHeaders.split(",").map((h) => h.trim()).join(",");
         }
       }
-      if (headers?.length) {
-        set("Access-Control-Allow-Headers", headers.join(","));
+      if (headersStr) {
+        set("Access-Control-Allow-Headers", headersStr);
         c.res.headers.append("Vary", "Access-Control-Request-Headers");
       }
       c.res.headers.delete("Content-Length");

package/dist/middleware/csrf/index.js

@@ -2,7 +2,7 @@
 import { HTTPException } from "../../http-exception.js";
 var secFetchSiteValues = ["same-origin", "same-site", "none", "cross-site"];
 var isSecFetchSite = (value) => secFetchSiteValues.includes(value);
-var isSafeMethodRe = /^(GET|HEAD)$/;
+var isSafeMethodRe = /^(GET|HEAD|OPTIONS)$/;
 var isRequestedByFormElementRe = /^\b(application\/x-www-form-urlencoded|multipart\/form-data|text\/plain)\b/i;
 var csrf = (options) => {
   const originHandler = ((optsOrigin) => {

package/dist/middleware/etag/digest.js

@@ -10,18 +10,64 @@ var mergeBuffers = (buffer1, buffer2) => {
   merged.set(buffer2, buffer1.byteLength);
   return merged;
 };
+var CHUNK_SIZE = 256 * 1024;
 var generateDigest = async (stream, generator) => {
   if (!stream) {
     return null;
   }
   let result = void 0;
+  let chunk;
+  let chunkLength = 0;
+  const digest = async (body) => {
+    result = await generator(mergeBuffers(result, body));
+  };
   const reader = stream.getReader();
   for (; ; ) {
     const { value, done } = await reader.read();
     if (done) {
       break;
     }
-    result = await generator(mergeBuffers(result, value));
+    let offset = 0;
+    while (offset < value.byteLength) {
+      const remaining = value.byteLength - offset;
+      if (chunkLength === 0 && remaining >= CHUNK_SIZE) {
+        await digest(value.subarray(offset, offset + CHUNK_SIZE));
+        offset += CHUNK_SIZE;
+        continue;
+      }
+      const requiredLength = chunkLength + remaining;
+      if (requiredLength < CHUNK_SIZE) {
+        if (!chunk) {
+          chunk = value.slice(offset);
+        } else {
+          if (chunk.byteLength < requiredLength) {
+            const nextChunk = new Uint8Array(
+              new ArrayBuffer(Math.min(CHUNK_SIZE, Math.max(requiredLength, chunk.byteLength * 2)))
+            );
+            nextChunk.set(chunk.subarray(0, chunkLength));
+            chunk = nextChunk;
+          }
+          chunk.set(value.subarray(offset), chunkLength);
+        }
+        chunkLength = requiredLength;
+        break;
+      }
+      const length = CHUNK_SIZE - chunkLength;
+      if (chunk?.byteLength !== CHUNK_SIZE) {
+        const nextChunk = new Uint8Array(new ArrayBuffer(CHUNK_SIZE));
+        if (chunk) {
+          nextChunk.set(chunk.subarray(0, chunkLength));
+        }
+        chunk = nextChunk;
+      }
+      chunk.set(value.subarray(offset, offset + length), chunkLength);
+      await digest(chunk);
+      chunkLength = 0;
+      offset += length;
+    }
+  }
+  if (chunk && chunkLength > 0) {
+    await digest(chunk.subarray(0, chunkLength));
   }
   if (!result) {
     return null;

package/dist/middleware/etag/index.js

@@ -60,11 +60,11 @@ var etag = (options) => {
           ETag: etag3
         }
       });
-      c.res.headers.forEach((_, key) => {
+      for (const key of Array.from(c.res.headers.keys())) {
         if (retainedHeaders.indexOf(key.toLowerCase()) === -1) {
           c.res.headers.delete(key);
         }
-      });
+      }
     } else {
       c.res.headers.set("ETag", etag3);
     }

package/dist/middleware/pretty-json/index.js

@@ -1,10 +1,12 @@
 // src/middleware/pretty-json/index.ts
+var jsonContentTypeRegex = /^application\/(?:[a-z0-9._-]+\+)?json(?=$|[;\s])/i;
 var prettyJSON = (options) => {
   const targetQuery = options?.query ?? "pretty";
   return async function prettyJSON2(c, next) {
     const pretty = options?.force || c.req.query(targetQuery) || c.req.query(targetQuery) === "";
     await next();
-    if (pretty && c.res.headers.get("Content-Type")?.startsWith("application/json")) {
+    const contentType = c.res.headers.get("Content-Type");
+    if (pretty && contentType && jsonContentTypeRegex.test(contentType)) {
       const obj = await c.res.json();
       c.res = new Response(JSON.stringify(obj, null, options?.space ?? 2), c.res);
     }

package/dist/middleware/secure-headers/secure-headers.js

@@ -137,14 +137,17 @@ function getPermissionsPolicyDirectives(policy) {
   return Object.entries(policy).map(([directive, value]) => {
     const kebabDirective = camelToKebab(directive);
     if (typeof value === "boolean") {
-      return `${kebabDirective}=${value ? "*" : "none"}`;
+      return `${kebabDirective}=${value ? "*" : "()"}`;
     }
     if (Array.isArray(value)) {
       if (value.length === 0) {
         return `${kebabDirective}=()`;
       }
-      if (value.length === 1 && (value[0] === "*" || value[0] === "none")) {
-        return `${kebabDirective}=${value[0]}`;
+      if (value.length === 1 && value[0] === "*") {
+        return `${kebabDirective}=*`;
+      }
+      if (value.length === 1 && value[0] === "none") {
+        return `${kebabDirective}=()`;
       }
       const allowlist = value.map((item) => ["self", "src"].includes(item) ? item : `"${item}"`);
       return `${kebabDirective}=(${allowlist.join(" ")})`;

package/dist/router/linear-router/router.js

@@ -29,7 +29,8 @@ var LinearRouter = class {
           }
         } else if (hasStar && !hasLabel) {
           const endsWithStar = routePath.charCodeAt(routePath.length - 1) === 42;
-          const parts = (endsWithStar ? routePath.slice(0, -2) : routePath).split(splitByStarRe);
+          const endsWithSlashStar = routePath.endsWith("/*");
+          const parts = (endsWithStar ? routePath.slice(0, endsWithSlashStar ? -2 : -1) : routePath).split(splitByStarRe);
           const lastIndex = parts.length - 1;
           for (let j = 0, pos = 0, len2 = parts.length; j < len2; j++) {
             const part = parts[j];
@@ -39,7 +40,11 @@ var LinearRouter = class {
             }
             pos += part.length;
             if (j === lastIndex) {
-              if (!endsWithStar && pos !== path.length && !(pos === path.length - 1 && path.charCodeAt(pos) === 47)) {
+              if (endsWithSlashStar) {
+                if (pos !== path.length && path.charCodeAt(pos) !== 47) {
+                  continue ROUTES_LOOP;
+                }
+              } else if (!endsWithStar && pos !== path.length && !(pos === path.length - 1 && path.charCodeAt(pos) === 47)) {
                 continue ROUTES_LOOP;
               }
             } else {

package/dist/router/pattern-router/router.js

@@ -5,10 +5,8 @@ var PatternRouter = class {
   name = "PatternRouter";
   #routes = [];
   add(method, path, handler) {
-    const endsWithWildcard = path.at(-1) === "*";
-    if (endsWithWildcard) {
-      path = path.slice(0, -2);
-    }
+    const suffix = path.endsWith("/*") ? "(?:$|/)" : path.endsWith("*") ? "" : "/?$";
+    path = path.replace(/\*$/, "");
     if (path.at(-1) === "?") {
       path = path.slice(0, -1);
       this.add(method, path.replace(/\/[^/]+$/, ""), handler);
@@ -20,11 +18,7 @@ var PatternRouter = class {
       }
     );
     try {
-      this.#routes.push([
-        new RegExp(`^${parts.join("")}${endsWithWildcard ? "" : "/?$"}`),
-        method,
-        handler
-      ]);
+      this.#routes.push([new RegExp(`^${parts.join("")}${suffix}`), method, handler]);
     } catch {
       throw new UnsupportedPathError();
     }

package/dist/router/trie-router/node.js

@@ -2,76 +2,51 @@
 import { METHOD_NAME_ALL } from "../../router.js";
 import { getPattern, splitPath, splitRoutingPath } from "../../utils/url.js";
 var emptyParams = /* @__PURE__ */ Object.create(null);
-var hasChildren = (children) => {
-  for (const _ in children) {
-    return true;
-  }
-  return false;
-};
+var order = 0;
 var Node = class _Node {
-  #methods;
-  #children;
-  #patterns;
-  #order = 0;
+  #methods = [];
+  #children = /* @__PURE__ */ Object.create(null);
+  #patterns = [];
+  #pattern;
   #params = emptyParams;
-  constructor(method, handler, children) {
-    this.#children = children || /* @__PURE__ */ Object.create(null);
-    this.#methods = [];
-    if (method && handler) {
-      const m = /* @__PURE__ */ Object.create(null);
-      m[method] = { handler, possibleKeys: [], score: 0 };
-      this.#methods = [m];
-    }
-    this.#patterns = [];
-  }
   insert(method, path, handler) {
-    this.#order = ++this.#order;
     let curNode = this;
     const parts = splitRoutingPath(path);
-    const possibleKeys = [];
-    for (let i = 0, len = parts.length; i < len; i++) {
-      const p = parts[i];
-      const nextP = parts[i + 1];
-      const pattern = getPattern(p, nextP);
-      const key = Array.isArray(pattern) ? pattern[0] : p;
-      if (key in curNode.#children) {
-        curNode = curNode.#children[key];
-        if (pattern) {
-          possibleKeys.push(pattern[1]);
-        }
-        continue;
+    const possibleKeys = /* @__PURE__ */ new Set();
+    let i = 0;
+    for (const p of parts) {
+      const nextP = parts[++i];
+      const pattern = getPattern(p, nextP) || (nextP === void 0 && p && p.indexOf("*") === p.length - 1 ? p : null);
+      const isParam = Array.isArray(pattern);
+      const key = isParam ? pattern[0] : pattern || p;
+      const child = curNode.#children[key] ||= new _Node();
+      if (pattern && !child.#pattern) {
+        child.#pattern = pattern;
+        curNode.#patterns.push(child);
       }
-      curNode.#children[key] = new _Node();
-      if (pattern) {
-        curNode.#patterns.push(pattern);
-        possibleKeys.push(pattern[1]);
+      curNode = child;
+      if (isParam) {
+        possibleKeys.add(pattern[1]);
       }
-      curNode = curNode.#children[key];
     }
     curNode.#methods.push({
       [method]: {
         handler,
-        possibleKeys: possibleKeys.filter((v, i, a) => a.indexOf(v) === i),
-        score: this.#order
+        possibleKeys: [...possibleKeys],
+        score: ++order
       }
     });
-    return curNode;
   }
   #pushHandlerSets(handlerSets, node, method, nodeParams, params) {
     for (let i = 0, len = node.#methods.length; i < len; i++) {
       const m = node.#methods[i];
       const handlerSet = m[method] || m[METHOD_NAME_ALL];
-      const processedSet = {};
-      if (handlerSet !== void 0) {
+      if (handlerSet) {
         handlerSet.params = /* @__PURE__ */ Object.create(null);
         handlerSets.push(handlerSet);
-        if (nodeParams !== emptyParams || params && params !== emptyParams) {
-          for (let i2 = 0, len2 = handlerSet.possibleKeys.length; i2 < len2; i2++) {
-            const key = handlerSet.possibleKeys[i2];
-            const processed = processedSet[handlerSet.score];
-            handlerSet.params[key] = params?.[key] && !processed ? params[key] : nodeParams[key] ?? params?.[key];
-            processedSet[handlerSet.score] = true;
-          }
+        for (let i2 = 0, len2 = handlerSet.possibleKeys.length; i2 < len2; i2++) {
+          const key = handlerSet.possibleKeys[i2];
+          handlerSet.params[key] = params?.[key] && !i2 ? params[key] : nodeParams[key] ?? params?.[key];
         }
       }
     }
@@ -103,33 +78,33 @@ var Node = class _Node {
             tempNodes.push(nextNode);
           }
         }
-        for (let k = 0, len3 = node.#patterns.length; k < len3; k++) {
-          const pattern = node.#patterns[k];
+        for (const child of node.#patterns) {
+          const pattern = child.#pattern;
           const params = node.#params === emptyParams ? {} : { ...node.#params };
-          if (pattern === "*") {
-            const astNode = node.#children["*"];
-            if (astNode) {
-              this.#pushHandlerSets(handlerSets, astNode, method, node.#params);
-              astNode.#params = params;
-              tempNodes.push(astNode);
+          if (typeof pattern === "string") {
+            if (pattern === "*" || part.startsWith(pattern.slice(0, -1))) {
+              this.#pushHandlerSets(handlerSets, child, method, node.#params);
+              if (pattern === "*") {
+                child.#params = params;
+                tempNodes.push(child);
+              }
             }
             continue;
           }
-          const [key, name, matcher] = pattern;
-          if (!part && !(matcher instanceof RegExp)) {
+          const [, name, matcher] = pattern;
+          if (!part && matcher === true) {
             continue;
           }
-          const child = node.#children[key];
-          if (matcher instanceof RegExp) {
-            if (partOffsets === null) {
-              partOffsets = new Array(len);
+          if (matcher !== true) {
+            if (!partOffsets) {
+              partOffsets = [];
               let offset = path[0] === "/" ? 1 : 0;
               for (let p = 0; p < len; p++) {
                 partOffsets[p] = offset;
                 offset += parts[p].length + 1;
               }
             }
-            const restPathString = path.substring(partOffsets[i]);
+            const restPathString = path.slice(partOffsets[i]);
             const m = matcher.exec(restPathString);
             if (m) {
               params[name] = m[0];
@@ -143,11 +118,12 @@ var Node = class _Node {
                   params
                 );
               }
-              if (hasChildren(child.#children)) {
+              for (const _ in child.#children) {
                 child.#params = params;
                 const componentCount = m[0].match(/\//g)?.length ?? 0;
                 const targetCurNodes = curNodesQueue[componentCount] ||= [];
                 targetCurNodes.push(child);
+                break;
               }
               continue;
             }
@@ -175,7 +151,7 @@ var Node = class _Node {
       const shifted = curNodesQueue.shift();
       curNodes = shifted ? tempNodes.concat(shifted) : tempNodes;
     }
-    if (handlerSets.length > 1) {
+    if (handlerSets[1]) {
       handlerSets.sort((a, b) => {
         return a.score - b.score;
       });

package/dist/router/trie-router/router.js

@@ -3,19 +3,11 @@ import { checkOptionalParameter } from "../../utils/url.js";
 import { Node } from "./node.js";
 var TrieRouter = class {
   name = "TrieRouter";
-  #node;
-  constructor() {
-    this.#node = new Node();
-  }
+  #node = new Node();
   add(method, path, handler) {
-    const results = checkOptionalParameter(path);
-    if (results) {
-      for (let i = 0, len = results.length; i < len; i++) {
-        this.#node.insert(method, results[i], handler);
-      }
-      return;
+    for (const result of checkOptionalParameter(path) || [path]) {
+      this.#node.insert(method, result, handler);
     }
-    this.#node.insert(method, path, handler);
   }
   match(method, path) {
     return this.#node.search(method, path);

package/dist/types/context.d.ts

@@ -323,6 +323,10 @@ export declare class Context<E extends Env = any, P extends string = any, I exte
      *   c.header('X-Message', 'Hello!')
      *   c.header('Content-Type', 'text/plain')
      *
+     *   // Append multiple headers using the append option (e.g. Vary)
+     *   c.header('Vary', 'Accept-Encoding', { append: true })
+     *   c.header('Vary', 'User-Agent', { append: true })
+     *
      *   return c.body('Thank you for coming')
      * })
      * ```

package/dist/types/middleware/secure-headers/permissions-policy.d.ts

@@ -2,13 +2,13 @@ export type PermissionsPolicyDirective = StandardizedFeatures | ProposedFeatures
 /**
  * These features have been declared in a published version of the respective specification.
  */
-type StandardizedFeatures = 'accelerometer' | 'ambientLightSensor' | 'attributionReporting' | 'autoplay' | 'battery' | 'bluetooth' | 'camera' | 'chUa' | 'chUaArch' | 'chUaBitness' | 'chUaFullVersion' | 'chUaFullVersionList' | 'chUaMobile' | 'chUaModel' | 'chUaPlatform' | 'chUaPlatformVersion' | 'chUaWow64' | 'computePressure' | 'crossOriginIsolated' | 'directSockets' | 'displayCapture' | 'encryptedMedia' | 'executionWhileNotRendered' | 'executionWhileOutOfViewport' | 'fullscreen' | 'geolocation' | 'gyroscope' | 'hid' | 'identityCredentialsGet' | 'idleDetection' | 'keyboardMap' | 'magnetometer' | 'microphone' | 'midi' | 'navigationOverride' | 'payment' | 'pictureInPicture' | 'publickeyCredentialsGet' | 'screenWakeLock' | 'serial' | 'storageAccess' | 'syncXhr' | 'usb' | 'webShare' | 'windowManagement' | 'xrSpatialTracking';
+type StandardizedFeatures = 'accelerometer' | 'ambientLightSensor' | 'attributionReporting' | 'autoplay' | 'battery' | 'bluetooth' | 'camera' | 'chUa' | 'chUaArch' | 'chUaBitness' | 'chUaFullVersion' | 'chUaFullVersionList' | 'chUaHighEntropyValues' | 'chUaMobile' | 'chUaModel' | 'chUaPlatform' | 'chUaPlatformVersion' | 'chUaWow64' | 'computePressure' | 'crossOriginIsolated' | 'directSockets' | 'displayCapture' | 'encryptedMedia' | 'executionWhileNotRendered' | 'executionWhileOutOfViewport' | 'fullscreen' | 'geolocation' | 'gyroscope' | 'hid' | 'identityCredentialsGet' | 'idleDetection' | 'keyboardMap' | 'magnetometer' | 'mediasession' | 'microphone' | 'midi' | 'navigationOverride' | 'otpCredentials' | 'payment' | 'pictureInPicture' | 'publickeyCredentialsGet' | 'screenWakeLock' | 'serial' | 'storageAccess' | 'syncXhr' | 'tools' | 'usb' | 'webShare' | 'windowManagement' | 'xrSpatialTracking';
 /**
  * These features have been proposed, but the definitions have not yet been integrated into their respective specs.
  */
-type ProposedFeatures = 'clipboardRead' | 'clipboardWrite' | 'gamepad' | 'sharedAutofill' | 'speakerSelection';
+type ProposedFeatures = 'autofill' | 'clipboardRead' | 'clipboardWrite' | 'deferredFetch' | 'gamepad' | 'languageDetector' | 'languageModel' | 'manualText' | 'rewriter' | 'sharedAutofill' | 'speakerSelection' | 'summarizer' | 'translator' | 'writer';
 /**
  * These features generally have an explainer only, but may be available for experimentation by web developers.
  */
-type ExperimentalFeatures = 'allScreensCapture' | 'browsingTopics' | 'capturedSurfaceControl' | 'conversionMeasurement' | 'digitalCredentialsGet' | 'focusWithoutUserActivation' | 'joinAdInterestGroup' | 'localFonts' | 'runAdAuction' | 'smartCard' | 'syncScript' | 'trustTokenRedemption' | 'unload' | 'verticalScroll';
+type ExperimentalFeatures = 'allScreensCapture' | 'browsingTopics' | 'capturedSurfaceControl' | 'conversionMeasurement' | 'digitalCredentialsCreate' | 'digitalCredentialsGet' | 'focusWithoutUserActivation' | 'joinAdInterestGroup' | 'localFonts' | 'monetization' | 'runAdAuction' | 'smartCard' | 'syncScript' | 'trustTokenRedemption' | 'unload' | 'verticalScroll';
 export {};

package/dist/types/router/trie-router/node.d.ts

@@ -1,7 +1,6 @@
 import type { Params } from '../../router';
 export declare class Node<T> {
              
-    constructor(method?: string, handler?: T, children?: Record<string, Node<T>>);
-    insert(method: string, path: string, handler: T): Node<T>;
+    insert(method: string, path: string, handler: T): void;
     search(method: string, path: string): [[T, Params][]];
 }

package/dist/types/router/trie-router/router.d.ts

@@ -2,7 +2,6 @@ import type { Result, Router } from '../../router';
 export declare class TrieRouter<T> implements Router<T> {
              
     name: string;
-    constructor();
     add(method: string, path: string, handler: T): void;
     match(method: string, path: string): Result<T>;
 }

package/dist/utils/ipaddr.js

@@ -1,12 +1,14 @@
 // src/utils/ipaddr.ts
 var expandIPv6 = (ipV6) => {
   const sections = ipV6.split(":");
-  if (IPV4_REGEX.test(sections.at(-1))) {
+  const lastSection = sections.at(-1);
+  if (IPV4_REGEX.test(lastSection)) {
+    const octets = lastSection.split(".").map(Number);
     sections.splice(
       -1,
       1,
-      ...convertIPv6BinaryToString(convertIPv4ToBinary(sections.at(-1))).substring(2).split(":")
-      // => ['7f00', '0001']
+      (octets[0] << 8 | octets[1]).toString(16),
+      (octets[2] << 8 | octets[3]).toString(16)
     );
   }
   for (let i = 0; i < sections.length; i++) {

package/dist/utils/url.js

@@ -108,13 +108,13 @@ var checkOptionalParameter = (path) => {
     if (segment !== "" && !/\:/.test(segment)) {
       basePath += "/" + segment;
     } else if (/\:/.test(segment)) {
-      if (/\?/.test(segment)) {
+      if (segment.charCodeAt(segment.length - 1) === 63) {
         if (results.length === 0 && basePath === "") {
           results.push("/");
         } else {
           results.push(basePath);
         }
-        const optionalSegment = segment.replace("?", "");
+        const optionalSegment = segment.slice(0, -1);
         basePath += "/" + optionalSegment;
         results.push(basePath);
       } else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hono",
-  "version": "4.13.1",
+  "version": "4.13.3",
   "description": "Web framework built on Web Standards",
   "main": "dist/cjs/index.js",
   "type": "module",