hono 4.6.1 → 4.6.3

package/dist/jsx/dom/hooks/index.js

@@ -1,8 +1,8 @@
 // src/jsx/dom/hooks/index.ts
+import { PERMALINK } from "../../constants.js";
 import { useContext } from "../../context.js";
-import { createContext } from "../context.js";
 import { useCallback, useState } from "../../hooks/index.js";
-import { PERMALINK } from "../../constants.js";
+import { createContext } from "../context.js";
 var FormContext = createContext({
   pending: false,
   data: null,

package/dist/jsx/dom/index.js

@@ -24,9 +24,9 @@ import {
   useTransition,
   useViewTransition
 } from "../hooks/index.js";
-import { useActionState, useFormStatus, useOptimistic } from "./hooks/index.js";
 import { ErrorBoundary, Suspense } from "./components.js";
 import { createContext } from "./context.js";
+import { useActionState, useFormStatus, useOptimistic } from "./hooks/index.js";
 import { Fragment, jsx } from "./jsx-runtime.js";
 import { createPortal, flushSync } from "./render.js";
 import { render } from "./render.js";

package/dist/jsx/dom/intrinsic-element/components.js

@@ -1,9 +1,9 @@
 // src/jsx/dom/intrinsic-element/components.ts
-import { createPortal, getNameSpaceContext } from "../render.js";
 import { useContext } from "../../context.js";
 import { use, useCallback, useMemo, useState } from "../../hooks/index.js";
-import { FormContext, registerAction } from "../hooks/index.js";
 import { dataPrecedenceAttr, deDupeKeyMap, domRenderers } from "../../intrinsic-element/common.js";
+import { FormContext, registerAction } from "../hooks/index.js";
+import { createPortal, getNameSpaceContext } from "../render.js";
 var clearCache = () => {
   blockingPromiseMap = /* @__PURE__ */ Object.create(null);
   createdElements = /* @__PURE__ */ Object.create(null);

package/dist/jsx/dom/render.js

@@ -479,7 +479,7 @@ var updateSync = (context, node) => {
   });
   try {
     build(context, node, void 0);
-  } catch (e) {
+  } catch {
     return;
   }
   if (node.a) {

package/dist/jsx/index.js

@@ -3,6 +3,7 @@ import { Fragment, cloneElement, isValidElement, jsx, memo, reactAPICompatVersio
 import { Children } from "./children.js";
 import { ErrorBoundary } from "./components.js";
 import { createContext, useContext } from "./context.js";
+import { useActionState, useOptimistic } from "./dom/hooks/index.js";
 import {
   createRef,
   forwardRef,
@@ -25,7 +26,6 @@ import {
   useTransition,
   useViewTransition
 } from "./hooks/index.js";
-import { useActionState, useOptimistic } from "./dom/hooks/index.js";
 import { Suspense } from "./streaming.js";
 var jsx_default = {
   version: reactAPICompatVersion,

package/dist/jsx/intrinsic-element/components.js

@@ -1,10 +1,10 @@
 // src/jsx/intrinsic-element/components.ts
+import { raw } from "../../helper/html/index.js";
 import { JSXNode, getNameSpaceContext } from "../base.js";
+import { toArray } from "../children.js";
+import { PERMALINK } from "../constants.js";
 import { useContext } from "../context.js";
-import { raw } from "../../helper/html/index.js";
 import { dataPrecedenceAttr, deDupeKeyMap } from "./common.js";
-import { PERMALINK } from "../constants.js";
-import { toArray } from "../children.js";
 var metaTagMap = /* @__PURE__ */ new WeakMap();
 var insertIntoHead = (tagName, tag, props, precedence) => ({ buffer, context }) => {
   if (!buffer) {

package/dist/jsx/jsx-runtime.js

@@ -2,7 +2,34 @@
 import { jsxDEV, Fragment } from "./jsx-dev-runtime.js";
 import { jsxDEV as jsxDEV2 } from "./jsx-dev-runtime.js";
 import { html, raw } from "../helper/html/index.js";
-var jsxAttr = (name, value) => typeof value === "string" ? raw(name + '="' + html`${value}` + '"') : html`${name}="${value}"`;
+import { escapeToBuffer, stringBufferToString } from "../utils/html.js";
+import { styleObjectForEach } from "./utils.js";
+var jsxAttr = (key, v) => {
+  const buffer = [`${key}="`];
+  if (key === "style" && typeof v === "object") {
+    let styleStr = "";
+    styleObjectForEach(v, (property, value) => {
+      if (value != null) {
+        styleStr += `${styleStr ? ";" : ""}${property}:${value}`;
+      }
+    });
+    escapeToBuffer(styleStr, buffer);
+    buffer[0] += '"';
+  } else if (typeof v === "string") {
+    escapeToBuffer(v, buffer);
+    buffer[0] += '"';
+  } else if (v === null || v === void 0) {
+    return raw("");
+  } else if (typeof v === "number" || v.isEscaped) {
+    buffer[0] += `${v}"`;
+  } else if (v instanceof Promise) {
+    buffer.unshift('"', v);
+  } else {
+    escapeToBuffer(v.toString(), buffer);
+    buffer[0] += '"';
+  }
+  return buffer.length === 1 ? raw(buffer[0]) : stringBufferToString(buffer, void 0);
+};
 var jsxEscape = (value) => value;
 export {
   Fragment,

package/dist/jsx/streaming.js

@@ -1,6 +1,7 @@
 // src/jsx/streaming.ts
 import { raw } from "../helper/html/index.js";
 import { HtmlEscapedCallbackPhase, resolveCallback } from "../utils/html.js";
+import { JSXNode } from "./base.js";
 import { childrenToString } from "./components.js";
 import { DOM_RENDERER, DOM_STASH } from "./constants.js";
 import { Suspense as SuspenseDomRenderer } from "./dom/components.js";
@@ -87,14 +88,16 @@ d.replaceWith(c.content)
 };
 Suspense[DOM_RENDERER] = SuspenseDomRenderer;
 var textEncoder = new TextEncoder();
-var renderToReadableStream = (str, onError = console.trace) => {
+var renderToReadableStream = (content, onError = console.trace) => {
   const reader = new ReadableStream({
     async start(controller) {
       try {
-        const tmp = str instanceof Promise ? await str : await str.toString();
-        const context = typeof tmp === "object" ? tmp : {};
+        if (content instanceof JSXNode) {
+          content = content.toString();
+        }
+        const context = typeof content === "object" ? content : {};
         const resolved = await resolveCallback(
-          tmp,
+          content,
           HtmlEscapedCallbackPhase.BeforeStream,
           true,
           context

package/dist/middleware/combine/index.js

@@ -1,7 +1,7 @@
 // src/middleware/combine/index.ts
-import { TrieRouter } from "../../router/trie-router/index.js";
-import { METHOD_NAME_ALL } from "../../router.js";
 import { compose } from "../../compose.js";
+import { METHOD_NAME_ALL } from "../../router.js";
+import { TrieRouter } from "../../router/trie-router/index.js";
 var some = (...middleware) => {
   return async function some2(c, next) {
     let lastError;
@@ -32,6 +32,7 @@ var every = (...middleware) => {
     if (res === false) {
       throw new Error("Unmet condition");
     }
+    return res;
   });
   const handler = async (c, next) => compose(wrappedMiddleware.map((m) => [[m, void 0], c.req.param()]))(c, next);
   return async function every2(c, next) {

package/dist/middleware/compress/index.js

@@ -1,7 +1,7 @@
 // src/middleware/compress/index.ts
+import { COMPRESSIBLE_CONTENT_TYPE_REGEX } from "../../utils/compress.js";
 var ENCODING_TYPES = ["gzip", "deflate"];
 var cacheControlNoTransformRegExp = /(?:^|,)\s*?no-transform\s*?(?:,|$)/i;
-var compressibleContentTypeRegExp = /^\s*(?:text\/[^;\s]+|application\/(?:javascript|json|xml|xml-dtd|ecmascript|dart|postscript|rtf|tar|toml|vnd\.dart|vnd\.ms-fontobject|vnd\.ms-opentype|wasm|x-httpd-php|x-javascript|x-ns-proxy-autoconfig|x-sh|x-tar|x-virtualbox-hdd|x-virtualbox-ova|x-virtualbox-ovf|x-virtualbox-vbox|x-virtualbox-vdi|x-virtualbox-vhd|x-virtualbox-vmdk|x-www-form-urlencoded)|font\/(?:otf|ttf)|image\/(?:bmp|vnd\.adobe\.photoshop|vnd\.microsoft\.icon|vnd\.ms-dds|x-icon|x-ms-bmp)|message\/rfc822|model\/gltf-binary|x-shader\/x-fragment|x-shader\/x-vertex|[^;\s]+?\+(?:json|text|xml|yaml))(?:[;\s]|$)/i;
 var compress = (options) => {
   const threshold = options?.threshold ?? 1024;
   return async function compress2(ctx, next) {
@@ -23,7 +23,7 @@ var compress = (options) => {
 };
 var shouldCompress = (res) => {
   const type = res.headers.get("Content-Type");
-  return type && compressibleContentTypeRegExp.test(type);
+  return type && COMPRESSIBLE_CONTENT_TYPE_REGEX.test(type);
 };
 var shouldTransform = (res) => {
   const cacheControl = res.headers.get("Cache-Control");

package/dist/middleware/secure-headers/secure-headers.js

@@ -54,6 +54,13 @@ var secureHeaders = (customOptions) => {
     }
     headersToSet.push(["Content-Security-Policy", value]);
   }
+  if (options.contentSecurityPolicyReportOnly) {
+    const [callback, value] = getCSPDirectives(options.contentSecurityPolicyReportOnly);
+    if (callback) {
+      callbacks.push(callback);
+    }
+    headersToSet.push(["Content-Security-Policy-Report-Only", value]);
+  }
   if (options.permissionsPolicy && Object.keys(options.permissionsPolicy).length > 0) {
     headersToSet.push([
       "Permissions-Policy",
@@ -106,7 +113,7 @@ function getCSPDirectives(contentSecurityPolicy) {
   resultValues.pop();
   return callbacks.length === 0 ? [void 0, resultValues.join("")] : [
     (ctx, headersToSet) => headersToSet.map((values) => {
-      if (values[0] === "Content-Security-Policy") {
+      if (values[0] === "Content-Security-Policy" || values[0] === "Content-Security-Policy-Report-Only") {
         const clone = values[1].slice();
         callbacks.forEach((cb) => {
           cb(ctx, clone);

package/dist/middleware/serve-static/index.js

@@ -1,4 +1,5 @@
 // src/middleware/serve-static/index.ts
+import { COMPRESSIBLE_CONTENT_TYPE_REGEX } from "../../utils/compress.js";
 import { getFilePath, getFilePathWithoutDefaultDocument } from "../../utils/filepath.js";
 import { getMimeType } from "../../utils/mime.js";
 var ENCODINGS = {
@@ -6,9 +7,20 @@ var ENCODINGS = {
   zstd: ".zst",
   gzip: ".gz"
 };
+var ENCODINGS_ORDERED_KEYS = Object.keys(ENCODINGS);
 var DEFAULT_DOCUMENT = "index.html";
 var defaultPathResolve = (path) => path;
 var serveStatic = (options) => {
+  let isAbsoluteRoot = false;
+  let root;
+  if (options.root) {
+    if (options.root.startsWith("/")) {
+      isAbsoluteRoot = true;
+      root = new URL(`file://${options.root}`).pathname;
+    } else {
+      root = options.root;
+    }
+  }
   return async (c, next) => {
     if (c.finalized) {
       await next();
@@ -16,7 +28,6 @@ var serveStatic = (options) => {
     }
     let filename = options.path ?? decodeURI(c.req.path);
     filename = options.rewriteRequestPath ? options.rewriteRequestPath(filename) : filename;
-    const root = options.root;
     if (!filename.endsWith("/") && options.isDir) {
       const path2 = getFilePathWithoutDefaultDocument({
         filename,
@@ -34,6 +45,9 @@ var serveStatic = (options) => {
     if (!path) {
       return await next();
     }
+    if (isAbsoluteRoot) {
+      path = "/" + path;
+    }
     const getContent = options.getContent;
     const pathResolve = options.pathResolve ?? defaultPathResolve;
     path = pathResolve(path);
@@ -57,18 +71,17 @@ var serveStatic = (options) => {
     if (content instanceof Response) {
       return c.newResponse(content.body, content);
     }
-    const mimeType = options.mimes ? getMimeType(path, options.mimes) ?? getMimeType(path) : getMimeType(path);
-    if (mimeType) {
-      c.header("Content-Type", mimeType);
-    }
     if (content) {
-      if (options.precompressed) {
-        const acceptEncodings = c.req.header("Accept-Encoding")?.split(",").map((encoding) => encoding.trim()).filter(
-          (encoding) => Object.hasOwn(ENCODINGS, encoding)
-        ).sort(
-          (a, b) => Object.keys(ENCODINGS).indexOf(a) - Object.keys(ENCODINGS).indexOf(b)
-        ) ?? [];
-        for (const encoding of acceptEncodings) {
+      const mimeType = options.mimes && getMimeType(path, options.mimes) || getMimeType(path);
+      c.header("Content-Type", mimeType || "application/octet-stream");
+      if (options.precompressed && (!mimeType || COMPRESSIBLE_CONTENT_TYPE_REGEX.test(mimeType))) {
+        const acceptEncodingSet = new Set(
+          c.req.header("Accept-Encoding")?.split(",").map((encoding) => encoding.trim())
+        );
+        for (const encoding of ENCODINGS_ORDERED_KEYS) {
+          if (!acceptEncodingSet.has(encoding)) {
+            continue;
+          }
           const compressedContent = await getContent(path + ENCODINGS[encoding], c);
           if (compressedContent) {
             content = compressedContent;

package/dist/router/pattern-router/router.js

@@ -21,7 +21,7 @@ var PatternRouter = class {
     let re;
     try {
       re = new RegExp(`^${parts.join("")}${endsWithWildcard ? "" : "/?$"}`);
-    } catch (e) {
+    } catch {
       throw new UnsupportedPathError();
     }
     this.routes.push([re, method, handler]);

package/dist/types/context.d.ts

@@ -2,8 +2,8 @@ import { HonoRequest } from './request';
 import type { Result } from './router';
 import type { Env, FetchEventLike, H, Input, NotFoundHandler, RouterRoute, TypedResponse } from './types';
 import type { RedirectStatusCode, StatusCode } from './utils/http-status';
-import type { InvalidJSONValue, IsAny, JSONParsed, JSONValue, SimplifyDeepArray } from './utils/types';
 import type { BaseMime } from './utils/mime';
+import type { InvalidJSONValue, IsAny, JSONParsed, JSONValue, SimplifyDeepArray } from './utils/types';
 type HeaderRecord = Record<'Content-Type', BaseMime> | Record<ResponseHeader, string | string[]> | Record<string, string | string[]>;
 /**
  * Data type can be a string, ArrayBuffer, or ReadableStream.

package/dist/types/jsx/base.d.ts

@@ -18,6 +18,7 @@ export declare namespace JSX {
     }
 }
 export declare const getNameSpaceContext: () => Context<string> | undefined;
+export declare const booleanAttributes: string[];
 type LocalContexts = [Context<unknown>, unknown][];
 export type Child = string | Promise<string> | number | JSXNode | null | undefined | boolean | Child[];
 export declare class JSXNode implements HtmlEscaped {

package/dist/types/jsx/dom/index.d.ts

@@ -7,9 +7,9 @@ import type { Child, DOMAttributes, JSX, JSXNode, Props } from '../base';
 import { Children } from '../children';
 import { useContext } from '../context';
 import { createRef, forwardRef, startTransition, startViewTransition, use, useCallback, useDebugValue, useDeferredValue, useEffect, useId, useImperativeHandle, useInsertionEffect, useLayoutEffect, useMemo, useReducer, useRef, useState, useSyncExternalStore, useTransition, useViewTransition } from '../hooks';
-import { useActionState, useFormStatus, useOptimistic } from './hooks';
 import { ErrorBoundary, Suspense } from './components';
 import { createContext } from './context';
+import { useActionState, useFormStatus, useOptimistic } from './hooks';
 import { Fragment } from './jsx-runtime';
 import { createPortal, flushSync } from './render';
 export { render } from './render';
@@ -42,7 +42,7 @@ declare const _default: {
         ref?: import("../hooks").RefObject<T_9> | undefined;
     }) => JSX.Element;
     useImperativeHandle: <T_10>(ref: import("../hooks").RefObject<T_10>, createHandle: () => T_10, deps: readonly unknown[]) => void;
-    useSyncExternalStore: <T_11>(subscribe: (callback: (value: T_11) => void) => () => void, getSnapshot: () => T_11, getServerSnapshot?: (() => T_11) | undefined) => T_11;
+    useSyncExternalStore: <T_11>(subscribe: (callback: () => void) => () => void, getSnapshot: () => T_11, getServerSnapshot?: (() => T_11) | undefined) => T_11;
     useFormStatus: () => {
         pending: false;
         data: null;

package/dist/types/jsx/dom/intrinsic-element/components.d.ts

@@ -1,5 +1,5 @@
-import type { FC, PropsWithChildren, RefObject } from '../../types';
 import type { IntrinsicElements } from '../../intrinsic-elements';
+import type { FC, PropsWithChildren, RefObject } from '../../types';
 export declare const clearCache: () => void;
 export declare const composeRef: <T>(ref: Function | RefObject<T> | undefined, cb: (e: T) => void | (() => void)) => (e: T) => () => void;
 export declare const title: FC<PropsWithChildren>;

package/dist/types/jsx/dom/server.d.ts

@@ -62,7 +62,7 @@ declare const _default: {
             ref?: import("./").RefObject<T_9> | undefined;
         }) => import("../base").JSX.Element;
         useImperativeHandle: <T_10>(ref: import("./").RefObject<T_10>, createHandle: () => T_10, deps: readonly unknown[]) => void;
-        useSyncExternalStore: <T_11>(subscribe: (callback: (value: T_11) => void) => () => void, getSnapshot: () => T_11, getServerSnapshot?: (() => T_11) | undefined) => T_11;
+        useSyncExternalStore: <T_11>(subscribe: (callback: () => void) => () => void, getSnapshot: () => T_11, getServerSnapshot?: (() => T_11) | undefined) => T_11;
         useFormStatus: () => {
             pending: false;
             data: null;

package/dist/types/jsx/hooks/index.d.ts

@@ -41,5 +41,5 @@ export declare const forwardRef: <T, P = {}>(Component: (props: P, ref?: RefObje
     ref?: RefObject<T> | undefined;
 }) => JSX.Element;
 export declare const useImperativeHandle: <T>(ref: RefObject<T>, createHandle: () => T, deps: readonly unknown[]) => void;
-export declare const useSyncExternalStore: <T>(subscribe: (callback: (value: T) => void) => () => void, getSnapshot: () => T, getServerSnapshot?: (() => T) | undefined) => T;
+export declare const useSyncExternalStore: <T>(subscribe: (callback: () => void) => () => void, getSnapshot: () => T, getServerSnapshot?: (() => T) | undefined) => T;
 export {};

package/dist/types/jsx/index.d.ts

@@ -7,8 +7,8 @@ import type { DOMAttributes } from './base';
 import { Children } from './children';
 import { ErrorBoundary } from './components';
 import { createContext, useContext } from './context';
-import { createRef, forwardRef, startTransition, startViewTransition, use, useCallback, useDebugValue, useDeferredValue, useEffect, useId, useImperativeHandle, useInsertionEffect, useLayoutEffect, useMemo, useReducer, useRef, useState, useSyncExternalStore, useTransition, useViewTransition } from './hooks';
 import { useActionState, useOptimistic } from './dom/hooks';
+import { createRef, forwardRef, startTransition, startViewTransition, use, useCallback, useDebugValue, useDeferredValue, useEffect, useId, useImperativeHandle, useInsertionEffect, useLayoutEffect, useMemo, useReducer, useRef, useState, useSyncExternalStore, useTransition, useViewTransition } from './hooks';
 import { Suspense } from './streaming';
 export { reactAPICompatVersion as version, jsx, memo, Fragment, Fragment as StrictMode, isValidElement, jsx as createElement, cloneElement, ErrorBoundary, createContext, useContext, useState, useEffect, useRef, useCallback, useReducer, useId, useDebugValue, use, startTransition, useTransition, useDeferredValue, startViewTransition, useViewTransition, useMemo, useLayoutEffect, useInsertionEffect, createRef, forwardRef, useImperativeHandle, useSyncExternalStore, useActionState, useOptimistic, Suspense, Children, DOMAttributes, };
 declare const _default: {
@@ -56,7 +56,7 @@ declare const _default: {
         ref?: import("./hooks").RefObject<T_13> | undefined;
     }) => import("./base").JSX.Element;
     useImperativeHandle: <T_14>(ref: import("./hooks").RefObject<T_14>, createHandle: () => T_14, deps: readonly unknown[]) => void;
-    useSyncExternalStore: <T_15>(subscribe: (callback: (value: T_15) => void) => () => void, getSnapshot: () => T_15, getServerSnapshot?: (() => T_15) | undefined) => T_15;
+    useSyncExternalStore: <T_15>(subscribe: (callback: () => void) => () => void, getSnapshot: () => T_15, getServerSnapshot?: (() => T_15) | undefined) => T_15;
     useActionState: <T_16>(fn: Function, initialState: T_16, permalink?: string | undefined) => [T_16, Function];
     useOptimistic: <T_17, N>(state: T_17, updateState: (currentState: T_17, action: N) => T_17) => [T_17, (action: N) => void];
     Suspense: import("./base").FC<import("./types").PropsWithChildren<{

package/dist/types/jsx/intrinsic-element/components.d.ts

@@ -1,5 +1,5 @@
-import type { FC, PropsWithChildren } from '../types';
 import type { IntrinsicElements } from '../intrinsic-elements';
+import type { FC, PropsWithChildren } from '../types';
 export declare const title: FC<PropsWithChildren>;
 export declare const script: FC<PropsWithChildren<IntrinsicElements['script']>>;
 export declare const style: FC<PropsWithChildren<IntrinsicElements['style']>>;

package/dist/types/jsx/jsx-runtime.d.ts

@@ -8,5 +8,5 @@ export type { JSX } from './jsx-dev-runtime';
 import { html } from '../helper/html';
 import type { HtmlEscapedString } from '../utils/html';
 export { html as jsxTemplate };
-export declare const jsxAttr: (name: string, value: string | Promise<string>) => HtmlEscapedString | Promise<HtmlEscapedString>;
+export declare const jsxAttr: (key: string, v: string | Promise<string> | Record<string, string | number | null | undefined | boolean>) => HtmlEscapedString | Promise<HtmlEscapedString>;
 export declare const jsxEscape: (value: string) => string;

package/dist/types/jsx/streaming.d.ts

@@ -3,6 +3,7 @@
  * This module enables JSX to supports streaming Response.
  */
 import type { HtmlEscapedString } from '../utils/html';
+import { JSXNode } from './base';
 import type { FC, PropsWithChildren } from './';
 /**
  * @experimental
@@ -17,4 +18,4 @@ export declare const Suspense: FC<PropsWithChildren<{
  * `renderToReadableStream()` is an experimental feature.
  * The API might be changed.
  */
-export declare const renderToReadableStream: (str: HtmlEscapedString | Promise<HtmlEscapedString>, onError?: (e: unknown) => string | void) => ReadableStream<Uint8Array>;
+export declare const renderToReadableStream: (content: HtmlEscapedString | JSXNode | Promise<HtmlEscapedString>, onError?: (e: unknown) => string | void) => ReadableStream<Uint8Array>;

package/dist/types/middleware/jwt/jwt.d.ts

@@ -7,8 +7,8 @@ import type { CookiePrefixOptions } from '../../utils/cookie';
 import '../../context';
 import type { SignatureAlgorithm } from '../../utils/jwt/jwa';
 import type { SignatureKey } from '../../utils/jwt/jws';
-export type JwtVariables = {
-    jwtPayload: any;
+export type JwtVariables<T = any> = {
+    jwtPayload: T;
 };
 /**
  * JWT Auth Middleware for Hono.

package/dist/types/middleware/secure-headers/secure-headers.d.ts

@@ -51,6 +51,7 @@ type PermissionsPolicyOptions = Partial<Record<PermissionsPolicyDirective, Permi
 type overridableHeader = boolean | string;
 interface SecureHeadersOptions {
     contentSecurityPolicy?: ContentSecurityPolicyOptions;
+    contentSecurityPolicyReportOnly?: ContentSecurityPolicyOptions;
     crossOriginEmbedderPolicy?: overridableHeader;
     crossOriginResourcePolicy?: overridableHeader;
     crossOriginOpenerPolicy?: overridableHeader;
@@ -76,6 +77,7 @@ export declare const NONCE: ContentSecurityPolicyOptionHandler;
  *
  * @param {Partial<SecureHeadersOptions>} [customOptions] - The options for the secure headers middleware.
  * @param {ContentSecurityPolicyOptions} [customOptions.contentSecurityPolicy] - Settings for the Content-Security-Policy header.
+ * @param {ContentSecurityPolicyOptions} [customOptions.contentSecurityPolicyReportOnly] - Settings for the Content-Security-Policy-Report-Only header.
  * @param {overridableHeader} [customOptions.crossOriginEmbedderPolicy=false] - Settings for the Cross-Origin-Embedder-Policy header.
  * @param {overridableHeader} [customOptions.crossOriginResourcePolicy=true] - Settings for the Cross-Origin-Resource-Policy header.
  * @param {overridableHeader} [customOptions.crossOriginOpenerPolicy=true] - Settings for the Cross-Origin-Opener-Policy header.