@shware/http 1.1.11 → 1.1.12

package/dist/hono/__tests__/csrf.test.mjs

@@ -3,160 +3,158 @@ import { Hono } from "hono";
 import { csrf } from "../csrf.mjs";
 import { errorHandler } from "../handler.mjs";
 describe("CSRF Protection", () => {
-  describe("csrfProtection middleware", () => {
-    let app;
-    beforeEach(() => {
-      app = new Hono();
-      app.onError(errorHandler);
-    });
-    it("should allow GET requests without CSRF token", async () => {
-      app.use(csrf());
-      app.get("/test", (c) => c.text("OK"));
-      const res = await app.request("/test");
-      expect(res.status).toBe(200);
-      expect(await res.text()).toBe("OK");
-    });
-    it("should allow HEAD requests without CSRF token", async () => {
-      app.use(csrf());
-      app.all("/test", (c) => c.text("OK"));
-      const res = await app.request("/test", { method: "HEAD" });
-      expect(res.status).toBe(200);
-    });
-    it("should allow OPTIONS requests without CSRF token", async () => {
-      app.use(csrf());
-      app.options("/test", (c) => c.text("OK"));
-      const res = await app.request("/test", { method: "OPTIONS" });
-      expect(res.status).toBe(200);
-    });
-    it("should reject POST requests without CSRF token", async () => {
-      app.use(csrf());
-      app.post("/test", (c) => c.text("OK"));
-      const res = await app.request("/test", { method: "POST" });
-      expect(res.status).toBe(403);
-    });
-    it("should reject POST requests with mismatched tokens", async () => {
-      app.use(csrf());
-      app.post("/test", (c) => c.text("OK"));
-      const res = await app.request("/test", {
-        method: "POST",
-        headers: { "X-XSRF-TOKEN": "header-token", Cookie: "XSRF-TOKEN=cookie-token" }
-      });
-      expect(res.status).toBe(403);
-    });
-    it("should allow POST requests with matching tokens", async () => {
-      app.use(csrf());
-      app.post("/test", (c) => c.text("OK"));
-      const res = await app.request("/test", {
-        method: "POST",
-        headers: {
-          "X-XSRF-TOKEN": "matching-token",
-          Cookie: "XSRF-TOKEN=matching-token"
-        }
-      });
-      expect(res.status).toBe(200);
-      expect(await res.text()).toBe("OK");
-    });
-    it("should use custom cookie and header names", async () => {
-      app.use(csrf({ cookieName: "csrf-token", headerName: "X-CSRF-Token" }));
-      app.post("/test", (c) => c.text("OK"));
-      const res = await app.request("/test", {
-        method: "POST",
-        headers: {
-          "X-CSRF-Token": "test-token",
-          Cookie: "csrf-token=test-token"
-        }
-      });
-      expect(res.status).toBe(200);
-    });
-    it("should ignore specified paths", async () => {
-      app.use(csrf({ ignores: [{ path: "/webhook/*", methods: ["POST"] }] }));
-      app.post("/webhook/stripe", (c) => c.text("OK"));
-      app.post("/api/data", (c) => c.text("OK"));
-      const webhookRes = await app.request("/webhook/stripe", { method: "POST" });
-      expect(webhookRes.status).toBe(200);
-      const apiRes = await app.request("/api/data", { method: "POST" });
-      expect(apiRes.status).toBe(403);
-    });
-    it("should ignore all methods for a path when methods not specified", async () => {
-      app.use(csrf({ ignores: [{ path: "/auth/apple/callback" }] }));
-      app.post("/auth/apple/callback", (c) => c.text("OK"));
-      app.put("/auth/apple/callback", (c) => c.text("OK"));
-      const postRes = await app.request("/auth/apple/callback", { method: "POST" });
-      expect(postRes.status).toBe(200);
-      const putRes = await app.request("/auth/apple/callback", { method: "PUT" });
-      expect(putRes.status).toBe(200);
-    });
-    it("should handle empty tokens safely", async () => {
-      app.use(csrf());
-      app.post("/test", (c) => c.text("OK"));
-      const res = await app.request("/test", {
-        method: "POST",
-        headers: { "X-XSRF-TOKEN": "", Cookie: "XSRF-TOKEN=" }
-      });
-      expect(res.status).toBe(403);
-    });
-    it("should handle missing cookie", async () => {
-      app.use(csrf());
-      app.post("/test", (c) => c.text("OK"));
-      const res = await app.request("/test", {
-        method: "POST",
-        headers: { "X-XSRF-TOKEN": "token" }
-      });
-      expect(res.status).toBe(403);
-    });
-    it("should handle missing header", async () => {
-      app.use(csrf());
-      app.post("/test", (c) => c.text("OK"));
-      const res = await app.request("/test", {
-        method: "POST",
-        headers: { Cookie: "XSRF-TOKEN=token" }
-      });
-      expect(res.status).toBe(403);
-    });
-    it("should use custom error message", async () => {
-      app.use(csrf({ errorMessage: "Custom CSRF error" }));
-      app.post("/test", (c) => c.text("OK"));
-      const res = await app.request("/test", { method: "POST" });
-      expect(res.status).toBe(403);
-      const body = await res.json();
-      expect(body.error.message).toBe("Custom CSRF error");
-    });
-    it("should work with custom safe methods", async () => {
-      app.use(csrf({ safeMethods: ["GET"] }));
-      app.all("/test", (c) => c.text("OK"));
-      const res = await app.request("/test", { method: "HEAD" });
-      expect(res.status).toBe(403);
-    });
-    it("should handle complex ignore patterns", async () => {
-      app.use(
-        csrf({
-          ignores: [
-            { path: "/api/v1/*", methods: ["GET", "POST"] },
-            { path: "/api/v2/*", methods: ["POST"] },
-            { path: "/public/*" }
-            // All methods
-          ]
-        })
-      );
-      app.get("/api/v1/users", (c) => c.text("OK"));
-      app.post("/api/v1/users", (c) => c.text("OK"));
-      app.put("/api/v1/users", (c) => c.text("OK"));
-      app.post("/api/v2/users", (c) => c.text("OK"));
-      app.get("/api/v2/users", (c) => c.text("OK"));
-      app.post("/public/data", (c) => c.text("OK"));
-      let res = await app.request("/api/v1/users", { method: "GET" });
-      expect(res.status).toBe(200);
-      res = await app.request("/api/v1/users", { method: "POST" });
-      expect(res.status).toBe(200);
-      res = await app.request("/api/v1/users", { method: "PUT" });
-      expect(res.status).toBe(403);
-      res = await app.request("/api/v2/users", { method: "POST" });
-      expect(res.status).toBe(200);
-      res = await app.request("/api/v2/users", { method: "GET" });
-      expect(res.status).toBe(200);
-      res = await app.request("/public/data", { method: "POST" });
-      expect(res.status).toBe(200);
-    });
+  let app;
+  beforeEach(() => {
+    app = new Hono();
+    app.onError(errorHandler);
+  });
+  it("should allow GET requests without CSRF token", async () => {
+    app.use(csrf());
+    app.get("/test", (c) => c.text("OK"));
+    const res = await app.request("/test");
+    expect(res.status).toBe(200);
+    expect(await res.text()).toBe("OK");
+  });
+  it("should allow HEAD requests without CSRF token", async () => {
+    app.use(csrf());
+    app.all("/test", (c) => c.text("OK"));
+    const res = await app.request("/test", { method: "HEAD" });
+    expect(res.status).toBe(200);
+  });
+  it("should allow OPTIONS requests without CSRF token", async () => {
+    app.use(csrf());
+    app.options("/test", (c) => c.text("OK"));
+    const res = await app.request("/test", { method: "OPTIONS" });
+    expect(res.status).toBe(200);
+  });
+  it("should reject POST requests without CSRF token", async () => {
+    app.use(csrf());
+    app.post("/test", (c) => c.text("OK"));
+    const res = await app.request("/test", { method: "POST" });
+    expect(res.status).toBe(403);
+  });
+  it("should reject POST requests with mismatched tokens", async () => {
+    app.use(csrf());
+    app.post("/test", (c) => c.text("OK"));
+    const res = await app.request("/test", {
+      method: "POST",
+      headers: { "X-XSRF-TOKEN": "header-token", Cookie: "XSRF-TOKEN=cookie-token" }
+    });
+    expect(res.status).toBe(403);
+  });
+  it("should allow POST requests with matching tokens", async () => {
+    app.use(csrf());
+    app.post("/test", (c) => c.text("OK"));
+    const res = await app.request("/test", {
+      method: "POST",
+      headers: {
+        "X-XSRF-TOKEN": "matching-token",
+        Cookie: "XSRF-TOKEN=matching-token"
+      }
+    });
+    expect(res.status).toBe(200);
+    expect(await res.text()).toBe("OK");
+  });
+  it("should use custom cookie and header names", async () => {
+    app.use(csrf({ cookieName: "csrf-token", headerName: "X-CSRF-Token" }));
+    app.post("/test", (c) => c.text("OK"));
+    const res = await app.request("/test", {
+      method: "POST",
+      headers: {
+        "X-CSRF-Token": "test-token",
+        Cookie: "csrf-token=test-token"
+      }
+    });
+    expect(res.status).toBe(200);
+  });
+  it("should ignore specified paths", async () => {
+    app.use(csrf({ ignores: [{ path: "/webhook/*", methods: ["POST"] }] }));
+    app.post("/webhook/stripe", (c) => c.text("OK"));
+    app.post("/api/data", (c) => c.text("OK"));
+    const webhookRes = await app.request("/webhook/stripe", { method: "POST" });
+    expect(webhookRes.status).toBe(200);
+    const apiRes = await app.request("/api/data", { method: "POST" });
+    expect(apiRes.status).toBe(403);
+  });
+  it("should ignore all methods for a path when methods not specified", async () => {
+    app.use(csrf({ ignores: [{ path: "/auth/apple/callback" }] }));
+    app.post("/auth/apple/callback", (c) => c.text("OK"));
+    app.put("/auth/apple/callback", (c) => c.text("OK"));
+    const postRes = await app.request("/auth/apple/callback", { method: "POST" });
+    expect(postRes.status).toBe(200);
+    const putRes = await app.request("/auth/apple/callback", { method: "PUT" });
+    expect(putRes.status).toBe(200);
+  });
+  it("should handle empty tokens safely", async () => {
+    app.use(csrf());
+    app.post("/test", (c) => c.text("OK"));
+    const res = await app.request("/test", {
+      method: "POST",
+      headers: { "X-XSRF-TOKEN": "", Cookie: "XSRF-TOKEN=" }
+    });
+    expect(res.status).toBe(403);
+  });
+  it("should handle missing cookie", async () => {
+    app.use(csrf());
+    app.post("/test", (c) => c.text("OK"));
+    const res = await app.request("/test", {
+      method: "POST",
+      headers: { "X-XSRF-TOKEN": "token" }
+    });
+    expect(res.status).toBe(403);
+  });
+  it("should handle missing header", async () => {
+    app.use(csrf());
+    app.post("/test", (c) => c.text("OK"));
+    const res = await app.request("/test", {
+      method: "POST",
+      headers: { Cookie: "XSRF-TOKEN=token" }
+    });
+    expect(res.status).toBe(403);
+  });
+  it("should use custom error message", async () => {
+    app.use(csrf({ errorMessage: "Custom CSRF error" }));
+    app.post("/test", (c) => c.text("OK"));
+    const res = await app.request("/test", { method: "POST" });
+    expect(res.status).toBe(403);
+    const body = await res.json();
+    expect(body.error.message).toBe("Custom CSRF error");
+  });
+  it("should work with custom safe methods", async () => {
+    app.use(csrf({ safeMethods: ["GET"] }));
+    app.all("/test", (c) => c.text("OK"));
+    const res = await app.request("/test", { method: "HEAD" });
+    expect(res.status).toBe(403);
+  });
+  it("should handle complex ignore patterns", async () => {
+    app.use(
+      csrf({
+        ignores: [
+          { path: "/api/v1/*", methods: ["GET", "POST"] },
+          { path: "/api/v2/*", methods: ["POST"] },
+          { path: "/public/*" }
+          // All methods
+        ]
+      })
+    );
+    app.get("/api/v1/users", (c) => c.text("OK"));
+    app.post("/api/v1/users", (c) => c.text("OK"));
+    app.put("/api/v1/users", (c) => c.text("OK"));
+    app.post("/api/v2/users", (c) => c.text("OK"));
+    app.get("/api/v2/users", (c) => c.text("OK"));
+    app.post("/public/data", (c) => c.text("OK"));
+    let res = await app.request("/api/v1/users", { method: "GET" });
+    expect(res.status).toBe(200);
+    res = await app.request("/api/v1/users", { method: "POST" });
+    expect(res.status).toBe(200);
+    res = await app.request("/api/v1/users", { method: "PUT" });
+    expect(res.status).toBe(403);
+    res = await app.request("/api/v2/users", { method: "POST" });
+    expect(res.status).toBe(200);
+    res = await app.request("/api/v2/users", { method: "GET" });
+    expect(res.status).toBe(200);
+    res = await app.request("/public/data", { method: "POST" });
+    expect(res.status).toBe(200);
   });
 });
 //# sourceMappingURL=csrf.test.mjs.map

package/dist/hono/__tests__/csrf.test.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/hono/__tests__/csrf.test.ts"],"sourcesContent":["import { Hono } from 'hono';\nimport { csrf } from '../csrf';\nimport { errorHandler, type Env } from '../handler';\n\ndescribe('CSRF Protection', () => {\n  describe('csrfProtection middleware', () => {\n    let app: Hono<Env>;\n\n    beforeEach(() => {\n      app = new Hono();\n      app.onError(errorHandler);\n    });\n\n    it('should allow GET requests without CSRF token', async () => {\n      app.use(csrf());\n      app.get('/test', (c) => c.text('OK'));\n\n      const res = await app.request('/test');\n      expect(res.status).toBe(200);\n      expect(await res.text()).toBe('OK');\n    });\n\n    it('should allow HEAD requests without CSRF token', async () => {\n      app.use(csrf());\n      app.all('/test', (c) => c.text('OK'));\n\n      const res = await app.request('/test', { method: 'HEAD' });\n      expect(res.status).toBe(200);\n    });\n\n    it('should allow OPTIONS requests without CSRF token', async () => {\n      app.use(csrf());\n      app.options('/test', (c) => c.text('OK'));\n\n      const res = await app.request('/test', { method: 'OPTIONS' });\n      expect(res.status).toBe(200);\n    });\n\n    it('should reject POST requests without CSRF token', async () => {\n      app.use(csrf());\n      app.post('/test', (c) => c.text('OK'));\n\n      const res = await app.request('/test', { method: 'POST' });\n      expect(res.status).toBe(403);\n    });\n\n    it('should reject POST requests with mismatched tokens', async () => {\n      app.use(csrf());\n      app.post('/test', (c) => c.text('OK'));\n\n      const res = await app.request('/test', {\n        method: 'POST',\n        headers: { 'X-XSRF-TOKEN': 'header-token', Cookie: 'XSRF-TOKEN=cookie-token' },\n      });\n      expect(res.status).toBe(403);\n    });\n\n    it('should allow POST requests with matching tokens', async () => {\n      app.use(csrf());\n      app.post('/test', (c) => c.text('OK'));\n\n      const res = await app.request('/test', {\n        method: 'POST',\n        headers: {\n          'X-XSRF-TOKEN': 'matching-token',\n          Cookie: 'XSRF-TOKEN=matching-token',\n        },\n      });\n      expect(res.status).toBe(200);\n      expect(await res.text()).toBe('OK');\n    });\n\n    it('should use custom cookie and header names', async () => {\n      app.use(csrf({ cookieName: 'csrf-token', headerName: 'X-CSRF-Token' }));\n      app.post('/test', (c) => c.text('OK'));\n\n      const res = await app.request('/test', {\n        method: 'POST',\n        headers: {\n          'X-CSRF-Token': 'test-token',\n          Cookie: 'csrf-token=test-token',\n        },\n      });\n      expect(res.status).toBe(200);\n    });\n\n    it('should ignore specified paths', async () => {\n      app.use(csrf({ ignores: [{ path: '/webhook/*', methods: ['POST'] }] }));\n      app.post('/webhook/stripe', (c) => c.text('OK'));\n      app.post('/api/data', (c) => c.text('OK'));\n\n      // Ignored path should work without CSRF token\n      const webhookRes = await app.request('/webhook/stripe', { method: 'POST' });\n      expect(webhookRes.status).toBe(200);\n\n      // Non-ignored path should require CSRF token\n      const apiRes = await app.request('/api/data', { method: 'POST' });\n      expect(apiRes.status).toBe(403);\n    });\n\n    it('should ignore all methods for a path when methods not specified', async () => {\n      app.use(csrf({ ignores: [{ path: '/auth/apple/callback' }] }));\n      app.post('/auth/apple/callback', (c) => c.text('OK'));\n      app.put('/auth/apple/callback', (c) => c.text('OK'));\n\n      const postRes = await app.request('/auth/apple/callback', { method: 'POST' });\n      expect(postRes.status).toBe(200);\n\n      const putRes = await app.request('/auth/apple/callback', { method: 'PUT' });\n      expect(putRes.status).toBe(200);\n    });\n\n    it('should handle empty tokens safely', async () => {\n      app.use(csrf());\n      app.post('/test', (c) => c.text('OK'));\n\n      const res = await app.request('/test', {\n        method: 'POST',\n        headers: { 'X-XSRF-TOKEN': '', Cookie: 'XSRF-TOKEN=' },\n      });\n      expect(res.status).toBe(403);\n    });\n\n    it('should handle missing cookie', async () => {\n      app.use(csrf());\n      app.post('/test', (c) => c.text('OK'));\n\n      const res = await app.request('/test', {\n        method: 'POST',\n        headers: { 'X-XSRF-TOKEN': 'token' },\n      });\n      expect(res.status).toBe(403);\n    });\n\n    it('should handle missing header', async () => {\n      app.use(csrf());\n      app.post('/test', (c) => c.text('OK'));\n\n      const res = await app.request('/test', {\n        method: 'POST',\n        headers: { Cookie: 'XSRF-TOKEN=token' },\n      });\n      expect(res.status).toBe(403);\n    });\n\n    it('should use custom error message', async () => {\n      app.use(csrf({ errorMessage: 'Custom CSRF error' }));\n      app.post('/test', (c) => c.text('OK'));\n\n      const res = await app.request('/test', { method: 'POST' });\n      expect(res.status).toBe(403);\n      const body = await res.json();\n      expect(body.error.message).toBe('Custom CSRF error');\n    });\n\n    it('should work with custom safe methods', async () => {\n      app.use(csrf({ safeMethods: ['GET'] }));\n      app.all('/test', (c) => c.text('OK'));\n\n      // HEAD is no longer safe, should require CSRF token\n      const res = await app.request('/test', { method: 'HEAD' });\n      expect(res.status).toBe(403);\n    });\n\n    it('should handle complex ignore patterns', async () => {\n      app.use(\n        csrf({\n          ignores: [\n            { path: '/api/v1/*', methods: ['GET', 'POST'] },\n            { path: '/api/v2/*', methods: ['POST'] },\n            { path: '/public/*' }, // All methods\n          ],\n        })\n      );\n\n      app.get('/api/v1/users', (c) => c.text('OK'));\n      app.post('/api/v1/users', (c) => c.text('OK'));\n      app.put('/api/v1/users', (c) => c.text('OK'));\n      app.post('/api/v2/users', (c) => c.text('OK'));\n      app.get('/api/v2/users', (c) => c.text('OK'));\n      app.post('/public/data', (c) => c.text('OK'));\n\n      // Ignored GET and POST for /api/v1/*\n      let res = await app.request('/api/v1/users', { method: 'GET' });\n      expect(res.status).toBe(200);\n\n      res = await app.request('/api/v1/users', { method: 'POST' });\n      expect(res.status).toBe(200);\n\n      // PUT not ignored for /api/v1/*\n      res = await app.request('/api/v1/users', { method: 'PUT' });\n      expect(res.status).toBe(403);\n\n      // Only POST ignored for /api/v2/*\n      res = await app.request('/api/v2/users', { method: 'POST' });\n      expect(res.status).toBe(200);\n\n      // GET not ignored for /api/v2/* (but GET is safe by default)\n      res = await app.request('/api/v2/users', { method: 'GET' });\n      expect(res.status).toBe(200);\n\n      // All methods ignored for /public/*\n      res = await app.request('/public/data', { method: 'POST' });\n      expect(res.status).toBe(200);\n    });\n  });\n});\n"],"mappings":";AAAA,SAAS,YAAY;AACrB,SAAS,YAAY;AACrB,SAAS,oBAA8B;AAEvC,SAAS,mBAAmB,MAAM;AAChC,WAAS,6BAA6B,MAAM;AAC1C,QAAI;AAEJ,eAAW,MAAM;AACf,YAAM,IAAI,KAAK;AACf,UAAI,QAAQ,YAAY;AAAA,IAC1B,CAAC;AAED,OAAG,gDAAgD,YAAY;AAC7D,UAAI,IAAI,KAAK,CAAC;AACd,UAAI,IAAI,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAEpC,YAAM,MAAM,MAAM,IAAI,QAAQ,OAAO;AACrC,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAC3B,aAAO,MAAM,IAAI,KAAK,CAAC,EAAE,KAAK,IAAI;AAAA,IACpC,CAAC;AAED,OAAG,iDAAiD,YAAY;AAC9D,UAAI,IAAI,KAAK,CAAC;AACd,UAAI,IAAI,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAEpC,YAAM,MAAM,MAAM,IAAI,QAAQ,SAAS,EAAE,QAAQ,OAAO,CAAC;AACzD,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,IAC7B,CAAC;AAED,OAAG,oDAAoD,YAAY;AACjE,UAAI,IAAI,KAAK,CAAC;AACd,UAAI,QAAQ,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAExC,YAAM,MAAM,MAAM,IAAI,QAAQ,SAAS,EAAE,QAAQ,UAAU,CAAC;AAC5D,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,IAC7B,CAAC;AAED,OAAG,kDAAkD,YAAY;AAC/D,UAAI,IAAI,KAAK,CAAC;AACd,UAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,YAAM,MAAM,MAAM,IAAI,QAAQ,SAAS,EAAE,QAAQ,OAAO,CAAC;AACzD,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,IAC7B,CAAC;AAED,OAAG,sDAAsD,YAAY;AACnE,UAAI,IAAI,KAAK,CAAC;AACd,UAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,YAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,QACrC,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,gBAAgB,QAAQ,0BAA0B;AAAA,MAC/E,CAAC;AACD,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,IAC7B,CAAC;AAED,OAAG,mDAAmD,YAAY;AAChE,UAAI,IAAI,KAAK,CAAC;AACd,UAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,YAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,QACrC,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,gBAAgB;AAAA,UAChB,QAAQ;AAAA,QACV;AAAA,MACF,CAAC;AACD,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAC3B,aAAO,MAAM,IAAI,KAAK,CAAC,EAAE,KAAK,IAAI;AAAA,IACpC,CAAC;AAED,OAAG,6CAA6C,YAAY;AAC1D,UAAI,IAAI,KAAK,EAAE,YAAY,cAAc,YAAY,eAAe,CAAC,CAAC;AACtE,UAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,YAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,QACrC,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,gBAAgB;AAAA,UAChB,QAAQ;AAAA,QACV;AAAA,MACF,CAAC;AACD,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,IAC7B,CAAC;AAED,OAAG,iCAAiC,YAAY;AAC9C,UAAI,IAAI,KAAK,EAAE,SAAS,CAAC,EAAE,MAAM,cAAc,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;AACtE,UAAI,KAAK,mBAAmB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAC/C,UAAI,KAAK,aAAa,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAGzC,YAAM,aAAa,MAAM,IAAI,QAAQ,mBAAmB,EAAE,QAAQ,OAAO,CAAC;AAC1E,aAAO,WAAW,MAAM,EAAE,KAAK,GAAG;AAGlC,YAAM,SAAS,MAAM,IAAI,QAAQ,aAAa,EAAE,QAAQ,OAAO,CAAC;AAChE,aAAO,OAAO,MAAM,EAAE,KAAK,GAAG;AAAA,IAChC,CAAC;AAED,OAAG,mEAAmE,YAAY;AAChF,UAAI,IAAI,KAAK,EAAE,SAAS,CAAC,EAAE,MAAM,uBAAuB,CAAC,EAAE,CAAC,CAAC;AAC7D,UAAI,KAAK,wBAAwB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AACpD,UAAI,IAAI,wBAAwB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAEnD,YAAM,UAAU,MAAM,IAAI,QAAQ,wBAAwB,EAAE,QAAQ,OAAO,CAAC;AAC5E,aAAO,QAAQ,MAAM,EAAE,KAAK,GAAG;AAE/B,YAAM,SAAS,MAAM,IAAI,QAAQ,wBAAwB,EAAE,QAAQ,MAAM,CAAC;AAC1E,aAAO,OAAO,MAAM,EAAE,KAAK,GAAG;AAAA,IAChC,CAAC;AAED,OAAG,qCAAqC,YAAY;AAClD,UAAI,IAAI,KAAK,CAAC;AACd,UAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,YAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,QACrC,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,IAAI,QAAQ,cAAc;AAAA,MACvD,CAAC;AACD,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,IAC7B,CAAC;AAED,OAAG,gCAAgC,YAAY;AAC7C,UAAI,IAAI,KAAK,CAAC;AACd,UAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,YAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,QACrC,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,QAAQ;AAAA,MACrC,CAAC;AACD,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,IAC7B,CAAC;AAED,OAAG,gCAAgC,YAAY;AAC7C,UAAI,IAAI,KAAK,CAAC;AACd,UAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,YAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,QACrC,QAAQ;AAAA,QACR,SAAS,EAAE,QAAQ,mBAAmB;AAAA,MACxC,CAAC;AACD,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,IAC7B,CAAC;AAED,OAAG,mCAAmC,YAAY;AAChD,UAAI,IAAI,KAAK,EAAE,cAAc,oBAAoB,CAAC,CAAC;AACnD,UAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,YAAM,MAAM,MAAM,IAAI,QAAQ,SAAS,EAAE,QAAQ,OAAO,CAAC;AACzD,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAC3B,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,KAAK,MAAM,OAAO,EAAE,KAAK,mBAAmB;AAAA,IACrD,CAAC;AAED,OAAG,wCAAwC,YAAY;AACrD,UAAI,IAAI,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC;AACtC,UAAI,IAAI,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAGpC,YAAM,MAAM,MAAM,IAAI,QAAQ,SAAS,EAAE,QAAQ,OAAO,CAAC;AACzD,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,IAC7B,CAAC;AAED,OAAG,yCAAyC,YAAY;AACtD,UAAI;AAAA,QACF,KAAK;AAAA,UACH,SAAS;AAAA,YACP,EAAE,MAAM,aAAa,SAAS,CAAC,OAAO,MAAM,EAAE;AAAA,YAC9C,EAAE,MAAM,aAAa,SAAS,CAAC,MAAM,EAAE;AAAA,YACvC,EAAE,MAAM,YAAY;AAAA;AAAA,UACtB;AAAA,QACF,CAAC;AAAA,MACH;AAEA,UAAI,IAAI,iBAAiB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAC5C,UAAI,KAAK,iBAAiB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAC7C,UAAI,IAAI,iBAAiB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAC5C,UAAI,KAAK,iBAAiB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAC7C,UAAI,IAAI,iBAAiB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAC5C,UAAI,KAAK,gBAAgB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAG5C,UAAI,MAAM,MAAM,IAAI,QAAQ,iBAAiB,EAAE,QAAQ,MAAM,CAAC;AAC9D,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAE3B,YAAM,MAAM,IAAI,QAAQ,iBAAiB,EAAE,QAAQ,OAAO,CAAC;AAC3D,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAG3B,YAAM,MAAM,IAAI,QAAQ,iBAAiB,EAAE,QAAQ,MAAM,CAAC;AAC1D,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAG3B,YAAM,MAAM,IAAI,QAAQ,iBAAiB,EAAE,QAAQ,OAAO,CAAC;AAC3D,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAG3B,YAAM,MAAM,IAAI,QAAQ,iBAAiB,EAAE,QAAQ,MAAM,CAAC;AAC1D,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAG3B,YAAM,MAAM,IAAI,QAAQ,gBAAgB,EAAE,QAAQ,OAAO,CAAC;AAC1D,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,IAC7B,CAAC;AAAA,EACH,CAAC;AACH,CAAC;","names":[]}
+{"version":3,"sources":["../../../src/hono/__tests__/csrf.test.ts"],"sourcesContent":["import { Hono } from 'hono';\nimport { csrf } from '../csrf';\nimport { errorHandler, type Env } from '../handler';\n\ndescribe('CSRF Protection', () => {\n  let app: Hono<Env>;\n\n  beforeEach(() => {\n    app = new Hono();\n    app.onError(errorHandler);\n  });\n\n  it('should allow GET requests without CSRF token', async () => {\n    app.use(csrf());\n    app.get('/test', (c) => c.text('OK'));\n\n    const res = await app.request('/test');\n    expect(res.status).toBe(200);\n    expect(await res.text()).toBe('OK');\n  });\n\n  it('should allow HEAD requests without CSRF token', async () => {\n    app.use(csrf());\n    app.all('/test', (c) => c.text('OK'));\n\n    const res = await app.request('/test', { method: 'HEAD' });\n    expect(res.status).toBe(200);\n  });\n\n  it('should allow OPTIONS requests without CSRF token', async () => {\n    app.use(csrf());\n    app.options('/test', (c) => c.text('OK'));\n\n    const res = await app.request('/test', { method: 'OPTIONS' });\n    expect(res.status).toBe(200);\n  });\n\n  it('should reject POST requests without CSRF token', async () => {\n    app.use(csrf());\n    app.post('/test', (c) => c.text('OK'));\n\n    const res = await app.request('/test', { method: 'POST' });\n    expect(res.status).toBe(403);\n  });\n\n  it('should reject POST requests with mismatched tokens', async () => {\n    app.use(csrf());\n    app.post('/test', (c) => c.text('OK'));\n\n    const res = await app.request('/test', {\n      method: 'POST',\n      headers: { 'X-XSRF-TOKEN': 'header-token', Cookie: 'XSRF-TOKEN=cookie-token' },\n    });\n    expect(res.status).toBe(403);\n  });\n\n  it('should allow POST requests with matching tokens', async () => {\n    app.use(csrf());\n    app.post('/test', (c) => c.text('OK'));\n\n    const res = await app.request('/test', {\n      method: 'POST',\n      headers: {\n        'X-XSRF-TOKEN': 'matching-token',\n        Cookie: 'XSRF-TOKEN=matching-token',\n      },\n    });\n    expect(res.status).toBe(200);\n    expect(await res.text()).toBe('OK');\n  });\n\n  it('should use custom cookie and header names', async () => {\n    app.use(csrf({ cookieName: 'csrf-token', headerName: 'X-CSRF-Token' }));\n    app.post('/test', (c) => c.text('OK'));\n\n    const res = await app.request('/test', {\n      method: 'POST',\n      headers: {\n        'X-CSRF-Token': 'test-token',\n        Cookie: 'csrf-token=test-token',\n      },\n    });\n    expect(res.status).toBe(200);\n  });\n\n  it('should ignore specified paths', async () => {\n    app.use(csrf({ ignores: [{ path: '/webhook/*', methods: ['POST'] }] }));\n    app.post('/webhook/stripe', (c) => c.text('OK'));\n    app.post('/api/data', (c) => c.text('OK'));\n\n    // Ignored path should work without CSRF token\n    const webhookRes = await app.request('/webhook/stripe', { method: 'POST' });\n    expect(webhookRes.status).toBe(200);\n\n    // Non-ignored path should require CSRF token\n    const apiRes = await app.request('/api/data', { method: 'POST' });\n    expect(apiRes.status).toBe(403);\n  });\n\n  it('should ignore all methods for a path when methods not specified', async () => {\n    app.use(csrf({ ignores: [{ path: '/auth/apple/callback' }] }));\n    app.post('/auth/apple/callback', (c) => c.text('OK'));\n    app.put('/auth/apple/callback', (c) => c.text('OK'));\n\n    const postRes = await app.request('/auth/apple/callback', { method: 'POST' });\n    expect(postRes.status).toBe(200);\n\n    const putRes = await app.request('/auth/apple/callback', { method: 'PUT' });\n    expect(putRes.status).toBe(200);\n  });\n\n  it('should handle empty tokens safely', async () => {\n    app.use(csrf());\n    app.post('/test', (c) => c.text('OK'));\n\n    const res = await app.request('/test', {\n      method: 'POST',\n      headers: { 'X-XSRF-TOKEN': '', Cookie: 'XSRF-TOKEN=' },\n    });\n    expect(res.status).toBe(403);\n  });\n\n  it('should handle missing cookie', async () => {\n    app.use(csrf());\n    app.post('/test', (c) => c.text('OK'));\n\n    const res = await app.request('/test', {\n      method: 'POST',\n      headers: { 'X-XSRF-TOKEN': 'token' },\n    });\n    expect(res.status).toBe(403);\n  });\n\n  it('should handle missing header', async () => {\n    app.use(csrf());\n    app.post('/test', (c) => c.text('OK'));\n\n    const res = await app.request('/test', {\n      method: 'POST',\n      headers: { Cookie: 'XSRF-TOKEN=token' },\n    });\n    expect(res.status).toBe(403);\n  });\n\n  it('should use custom error message', async () => {\n    app.use(csrf({ errorMessage: 'Custom CSRF error' }));\n    app.post('/test', (c) => c.text('OK'));\n\n    const res = await app.request('/test', { method: 'POST' });\n    expect(res.status).toBe(403);\n    const body = await res.json();\n    expect(body.error.message).toBe('Custom CSRF error');\n  });\n\n  it('should work with custom safe methods', async () => {\n    app.use(csrf({ safeMethods: ['GET'] }));\n    app.all('/test', (c) => c.text('OK'));\n\n    // HEAD is no longer safe, should require CSRF token\n    const res = await app.request('/test', { method: 'HEAD' });\n    expect(res.status).toBe(403);\n  });\n\n  it('should handle complex ignore patterns', async () => {\n    app.use(\n      csrf({\n        ignores: [\n          { path: '/api/v1/*', methods: ['GET', 'POST'] },\n          { path: '/api/v2/*', methods: ['POST'] },\n          { path: '/public/*' }, // All methods\n        ],\n      })\n    );\n\n    app.get('/api/v1/users', (c) => c.text('OK'));\n    app.post('/api/v1/users', (c) => c.text('OK'));\n    app.put('/api/v1/users', (c) => c.text('OK'));\n    app.post('/api/v2/users', (c) => c.text('OK'));\n    app.get('/api/v2/users', (c) => c.text('OK'));\n    app.post('/public/data', (c) => c.text('OK'));\n\n    // Ignored GET and POST for /api/v1/*\n    let res = await app.request('/api/v1/users', { method: 'GET' });\n    expect(res.status).toBe(200);\n\n    res = await app.request('/api/v1/users', { method: 'POST' });\n    expect(res.status).toBe(200);\n\n    // PUT not ignored for /api/v1/*\n    res = await app.request('/api/v1/users', { method: 'PUT' });\n    expect(res.status).toBe(403);\n\n    // Only POST ignored for /api/v2/*\n    res = await app.request('/api/v2/users', { method: 'POST' });\n    expect(res.status).toBe(200);\n\n    // GET not ignored for /api/v2/* (but GET is safe by default)\n    res = await app.request('/api/v2/users', { method: 'GET' });\n    expect(res.status).toBe(200);\n\n    // All methods ignored for /public/*\n    res = await app.request('/public/data', { method: 'POST' });\n    expect(res.status).toBe(200);\n  });\n});\n"],"mappings":";AAAA,SAAS,YAAY;AACrB,SAAS,YAAY;AACrB,SAAS,oBAA8B;AAEvC,SAAS,mBAAmB,MAAM;AAChC,MAAI;AAEJ,aAAW,MAAM;AACf,UAAM,IAAI,KAAK;AACf,QAAI,QAAQ,YAAY;AAAA,EAC1B,CAAC;AAED,KAAG,gDAAgD,YAAY;AAC7D,QAAI,IAAI,KAAK,CAAC;AACd,QAAI,IAAI,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAEpC,UAAM,MAAM,MAAM,IAAI,QAAQ,OAAO;AACrC,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAC3B,WAAO,MAAM,IAAI,KAAK,CAAC,EAAE,KAAK,IAAI;AAAA,EACpC,CAAC;AAED,KAAG,iDAAiD,YAAY;AAC9D,QAAI,IAAI,KAAK,CAAC;AACd,QAAI,IAAI,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAEpC,UAAM,MAAM,MAAM,IAAI,QAAQ,SAAS,EAAE,QAAQ,OAAO,CAAC;AACzD,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,EAC7B,CAAC;AAED,KAAG,oDAAoD,YAAY;AACjE,QAAI,IAAI,KAAK,CAAC;AACd,QAAI,QAAQ,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAExC,UAAM,MAAM,MAAM,IAAI,QAAQ,SAAS,EAAE,QAAQ,UAAU,CAAC;AAC5D,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,EAC7B,CAAC;AAED,KAAG,kDAAkD,YAAY;AAC/D,QAAI,IAAI,KAAK,CAAC;AACd,QAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,UAAM,MAAM,MAAM,IAAI,QAAQ,SAAS,EAAE,QAAQ,OAAO,CAAC;AACzD,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,EAC7B,CAAC;AAED,KAAG,sDAAsD,YAAY;AACnE,QAAI,IAAI,KAAK,CAAC;AACd,QAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,UAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,MACrC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,gBAAgB,QAAQ,0BAA0B;AAAA,IAC/E,CAAC;AACD,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,EAC7B,CAAC;AAED,KAAG,mDAAmD,YAAY;AAChE,QAAI,IAAI,KAAK,CAAC;AACd,QAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,UAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,MACrC,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,QAAQ;AAAA,MACV;AAAA,IACF,CAAC;AACD,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAC3B,WAAO,MAAM,IAAI,KAAK,CAAC,EAAE,KAAK,IAAI;AAAA,EACpC,CAAC;AAED,KAAG,6CAA6C,YAAY;AAC1D,QAAI,IAAI,KAAK,EAAE,YAAY,cAAc,YAAY,eAAe,CAAC,CAAC;AACtE,QAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,UAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,MACrC,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,QAAQ;AAAA,MACV;AAAA,IACF,CAAC;AACD,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,EAC7B,CAAC;AAED,KAAG,iCAAiC,YAAY;AAC9C,QAAI,IAAI,KAAK,EAAE,SAAS,CAAC,EAAE,MAAM,cAAc,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;AACtE,QAAI,KAAK,mBAAmB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAC/C,QAAI,KAAK,aAAa,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAGzC,UAAM,aAAa,MAAM,IAAI,QAAQ,mBAAmB,EAAE,QAAQ,OAAO,CAAC;AAC1E,WAAO,WAAW,MAAM,EAAE,KAAK,GAAG;AAGlC,UAAM,SAAS,MAAM,IAAI,QAAQ,aAAa,EAAE,QAAQ,OAAO,CAAC;AAChE,WAAO,OAAO,MAAM,EAAE,KAAK,GAAG;AAAA,EAChC,CAAC;AAED,KAAG,mEAAmE,YAAY;AAChF,QAAI,IAAI,KAAK,EAAE,SAAS,CAAC,EAAE,MAAM,uBAAuB,CAAC,EAAE,CAAC,CAAC;AAC7D,QAAI,KAAK,wBAAwB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AACpD,QAAI,IAAI,wBAAwB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAEnD,UAAM,UAAU,MAAM,IAAI,QAAQ,wBAAwB,EAAE,QAAQ,OAAO,CAAC;AAC5E,WAAO,QAAQ,MAAM,EAAE,KAAK,GAAG;AAE/B,UAAM,SAAS,MAAM,IAAI,QAAQ,wBAAwB,EAAE,QAAQ,MAAM,CAAC;AAC1E,WAAO,OAAO,MAAM,EAAE,KAAK,GAAG;AAAA,EAChC,CAAC;AAED,KAAG,qCAAqC,YAAY;AAClD,QAAI,IAAI,KAAK,CAAC;AACd,QAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,UAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,MACrC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,IAAI,QAAQ,cAAc;AAAA,IACvD,CAAC;AACD,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,EAC7B,CAAC;AAED,KAAG,gCAAgC,YAAY;AAC7C,QAAI,IAAI,KAAK,CAAC;AACd,QAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,UAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,MACrC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,QAAQ;AAAA,IACrC,CAAC;AACD,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,EAC7B,CAAC;AAED,KAAG,gCAAgC,YAAY;AAC7C,QAAI,IAAI,KAAK,CAAC;AACd,QAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,UAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,MACrC,QAAQ;AAAA,MACR,SAAS,EAAE,QAAQ,mBAAmB;AAAA,IACxC,CAAC;AACD,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,EAC7B,CAAC;AAED,KAAG,mCAAmC,YAAY;AAChD,QAAI,IAAI,KAAK,EAAE,cAAc,oBAAoB,CAAC,CAAC;AACnD,QAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,UAAM,MAAM,MAAM,IAAI,QAAQ,SAAS,EAAE,QAAQ,OAAO,CAAC;AACzD,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAC3B,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,WAAO,KAAK,MAAM,OAAO,EAAE,KAAK,mBAAmB;AAAA,EACrD,CAAC;AAED,KAAG,wCAAwC,YAAY;AACrD,QAAI,IAAI,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC;AACtC,QAAI,IAAI,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAGpC,UAAM,MAAM,MAAM,IAAI,QAAQ,SAAS,EAAE,QAAQ,OAAO,CAAC;AACzD,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,EAC7B,CAAC;AAED,KAAG,yCAAyC,YAAY;AACtD,QAAI;AAAA,MACF,KAAK;AAAA,QACH,SAAS;AAAA,UACP,EAAE,MAAM,aAAa,SAAS,CAAC,OAAO,MAAM,EAAE;AAAA,UAC9C,EAAE,MAAM,aAAa,SAAS,CAAC,MAAM,EAAE;AAAA,UACvC,EAAE,MAAM,YAAY;AAAA;AAAA,QACtB;AAAA,MACF,CAAC;AAAA,IACH;AAEA,QAAI,IAAI,iBAAiB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAC5C,QAAI,KAAK,iBAAiB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAC7C,QAAI,IAAI,iBAAiB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAC5C,QAAI,KAAK,iBAAiB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAC7C,QAAI,IAAI,iBAAiB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAC5C,QAAI,KAAK,gBAAgB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAG5C,QAAI,MAAM,MAAM,IAAI,QAAQ,iBAAiB,EAAE,QAAQ,MAAM,CAAC;AAC9D,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAE3B,UAAM,MAAM,IAAI,QAAQ,iBAAiB,EAAE,QAAQ,OAAO,CAAC;AAC3D,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAG3B,UAAM,MAAM,IAAI,QAAQ,iBAAiB,EAAE,QAAQ,MAAM,CAAC;AAC1D,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAG3B,UAAM,MAAM,IAAI,QAAQ,iBAAiB,EAAE,QAAQ,OAAO,CAAC;AAC3D,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAG3B,UAAM,MAAM,IAAI,QAAQ,iBAAiB,EAAE,QAAQ,MAAM,CAAC;AAC1D,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAG3B,UAAM,MAAM,IAAI,QAAQ,gBAAgB,EAAE,QAAQ,OAAO,CAAC;AAC1D,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,EAC7B,CAAC;AACH,CAAC;","names":[]}

package/dist/index.cjs

@@ -45,6 +45,7 @@ __export(index_exports, {
   hasText: () => import_string.hasText,
   initialPageParam: () => import_response.initialPageParam,
   invariant: () => import_invariant.invariant,
+  once: () => import_promise.once,
   pageParamsSchema: () => import_response.pageParamsSchema,
   timing: () => import_timing.timing
 });
@@ -59,6 +60,7 @@ __reExport(index_exports, require("./snowflake.cjs"), module.exports);
 var MAX_LENGTH = __toESM(require("./max-length/index.cjs"), 1);
 var import_string = require("./utils/string.cjs");
 var import_timing = require("./utils/timing.cjs");
+var import_promise = require("./utils/promise.cjs");
 var import_invariant = require("./utils/invariant.cjs");
 var import_token_bucket = require("./utils/token-bucket.cjs");
 var import_iso_3601_1 = require("./iso/iso_3601_1.cjs");
@@ -78,6 +80,7 @@ var import_iso_3601_1 = require("./iso/iso_3601_1.cjs");
   hasText,
   initialPageParam,
   invariant,
+  once,
   pageParamsSchema,
   timing,
   ...require("./error/detail.cjs"),

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["/**\n * @example\n * import { Details, Status } from '@repo/error';\n *\n * Status.adapter = () => new Error('Error');\n *\n * const details = Details.new()\n *  .requestInfo({ requestId: '1234567890', servingData: '/v1/tests' })\n *  .errorInfo({ reason: 'ACCOUNT_LOCKED' });\n *\n * throw Status.alreadyExists('xxx').error(details);\n */\n\nexport {\n  LoginTimeoutError,\n  LoginCanceledError,\n  CheckoutCreateError,\n  PurchaseError,\n} from './error/index';\nexport type {\n  NetworkErrorReason,\n  StatusErrorReason,\n  AuthenticationErrorReason,\n  ModerationErrorReason,\n  MultipartErrorReason,\n  AppErrorReason,\n  ErrorReason,\n} from './error/reason';\nexport * from './error/detail';\nexport * from './error/status';\nexport { getErrorMessage } from './error/parse';\nexport {\n  pageParamsSchema,\n  Cursor,\n  initialPageParam,\n  getPreviousPageParam,\n  getNextPageParam,\n} from './response';\nexport type {\n  Empty,\n  EntityId,\n  Entity,\n  Response,\n  InitParams,\n  NextParams,\n  PrevParams,\n  PageParams,\n  ParentPageParams,\n  Page,\n} from './response';\n\nexport * from './vaild';\nexport * from './snowflake';\n\nexport * as MAX_LENGTH from './max-length/index';\nexport { hasText } from './utils/string';\nexport { timing } from './utils/timing';\nexport { invariant } from './utils/invariant';\nexport { TokenBucket, type TokenBucketOptions } from './utils/token-bucket';\n\nexport { ISO_3601_1, type ISO3166CountryCode } from './iso/iso_3601_1';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAaA,mBAKO;AAUP,0BAAc,+BA5Bd;AA6BA,0BAAc,+BA7Bd;AA8BA,mBAAgC;AAChC,sBAMO;AAcP,0BAAc,wBAnDd;AAoDA,0BAAc,4BApDd;AAsDA,iBAA4B;AAC5B,oBAAwB;AACxB,oBAAuB;AACvB,uBAA0B;AAC1B,0BAAqD;AAErD,wBAAoD;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["/**\n * @example\n * import { Details, Status } from '@repo/error';\n *\n * Status.adapter = () => new Error('Error');\n *\n * const details = Details.new()\n *  .requestInfo({ requestId: '1234567890', servingData: '/v1/tests' })\n *  .errorInfo({ reason: 'ACCOUNT_LOCKED' });\n *\n * throw Status.alreadyExists('xxx').error(details);\n */\n\nexport {\n  LoginTimeoutError,\n  LoginCanceledError,\n  CheckoutCreateError,\n  PurchaseError,\n} from './error/index';\nexport type {\n  NetworkErrorReason,\n  StatusErrorReason,\n  AuthenticationErrorReason,\n  ModerationErrorReason,\n  MultipartErrorReason,\n  AppErrorReason,\n  ErrorReason,\n} from './error/reason';\nexport * from './error/detail';\nexport * from './error/status';\nexport { getErrorMessage } from './error/parse';\nexport {\n  pageParamsSchema,\n  Cursor,\n  initialPageParam,\n  getPreviousPageParam,\n  getNextPageParam,\n} from './response';\nexport type {\n  Empty,\n  EntityId,\n  Entity,\n  Response,\n  InitParams,\n  NextParams,\n  PrevParams,\n  PageParams,\n  ParentPageParams,\n  Page,\n} from './response';\n\nexport * from './vaild';\nexport * from './snowflake';\n\nexport * as MAX_LENGTH from './max-length/index';\nexport { hasText } from './utils/string';\nexport { timing } from './utils/timing';\nexport { once } from './utils/promise';\nexport { invariant } from './utils/invariant';\nexport { TokenBucket, type TokenBucketOptions } from './utils/token-bucket';\n\nexport { ISO_3601_1, type ISO3166CountryCode } from './iso/iso_3601_1';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAaA,mBAKO;AAUP,0BAAc,+BA5Bd;AA6BA,0BAAc,+BA7Bd;AA8BA,mBAAgC;AAChC,sBAMO;AAcP,0BAAc,wBAnDd;AAoDA,0BAAc,4BApDd;AAsDA,iBAA4B;AAC5B,oBAAwB;AACxB,oBAAuB;AACvB,qBAAqB;AACrB,uBAA0B;AAC1B,0BAAqD;AAErD,wBAAoD;","names":[]}

package/dist/index.d.cts

@@ -9,6 +9,7 @@ export { UidGenerator, uid } from './snowflake.cjs';
 export { i as MAX_LENGTH } from './index-BnPgRQDl.cjs';
 export { hasText } from './utils/string.cjs';
 export { timing } from './utils/timing.cjs';
+export { once } from './utils/promise.cjs';
 export { invariant } from './utils/invariant.cjs';
 export { TokenBucket, TokenBucketOptions } from './utils/token-bucket.cjs';
 export { ISO3166CountryCode, ISO_3601_1 } from './iso/iso_3601_1.cjs';

package/dist/index.d.ts

@@ -9,6 +9,7 @@ export { UidGenerator, uid } from './snowflake.js';
 export { i as MAX_LENGTH } from './index-BnPgRQDl.js';
 export { hasText } from './utils/string.js';
 export { timing } from './utils/timing.js';
+export { once } from './utils/promise.js';
 export { invariant } from './utils/invariant.js';
 export { TokenBucket, TokenBucketOptions } from './utils/token-bucket.js';
 export { ISO3166CountryCode, ISO_3601_1 } from './iso/iso_3601_1.js';

package/dist/index.mjs

@@ -20,6 +20,7 @@ export * from "./snowflake.mjs";
 import * as MAX_LENGTH from "./max-length/index.mjs";
 import { hasText } from "./utils/string.mjs";
 import { timing } from "./utils/timing.mjs";
+import { once } from "./utils/promise.mjs";
 import { invariant } from "./utils/invariant.mjs";
 import { TokenBucket } from "./utils/token-bucket.mjs";
 import { ISO_3601_1 } from "./iso/iso_3601_1.mjs";
@@ -38,6 +39,7 @@ export {
   hasText,
   initialPageParam,
   invariant,
+  once,
   pageParamsSchema,
   timing
 };

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["/**\n * @example\n * import { Details, Status } from '@repo/error';\n *\n * Status.adapter = () => new Error('Error');\n *\n * const details = Details.new()\n *  .requestInfo({ requestId: '1234567890', servingData: '/v1/tests' })\n *  .errorInfo({ reason: 'ACCOUNT_LOCKED' });\n *\n * throw Status.alreadyExists('xxx').error(details);\n */\n\nexport {\n  LoginTimeoutError,\n  LoginCanceledError,\n  CheckoutCreateError,\n  PurchaseError,\n} from './error/index';\nexport type {\n  NetworkErrorReason,\n  StatusErrorReason,\n  AuthenticationErrorReason,\n  ModerationErrorReason,\n  MultipartErrorReason,\n  AppErrorReason,\n  ErrorReason,\n} from './error/reason';\nexport * from './error/detail';\nexport * from './error/status';\nexport { getErrorMessage } from './error/parse';\nexport {\n  pageParamsSchema,\n  Cursor,\n  initialPageParam,\n  getPreviousPageParam,\n  getNextPageParam,\n} from './response';\nexport type {\n  Empty,\n  EntityId,\n  Entity,\n  Response,\n  InitParams,\n  NextParams,\n  PrevParams,\n  PageParams,\n  ParentPageParams,\n  Page,\n} from './response';\n\nexport * from './vaild';\nexport * from './snowflake';\n\nexport * as MAX_LENGTH from './max-length/index';\nexport { hasText } from './utils/string';\nexport { timing } from './utils/timing';\nexport { invariant } from './utils/invariant';\nexport { TokenBucket, type TokenBucketOptions } from './utils/token-bucket';\n\nexport { ISO_3601_1, type ISO3166CountryCode } from './iso/iso_3601_1';\n"],"mappings":";AAaA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAUP,cAAc;AACd,cAAc;AACd,SAAS,uBAAuB;AAChC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAcP,cAAc;AACd,cAAc;AAEd,YAAY,gBAAgB;AAC5B,SAAS,eAAe;AACxB,SAAS,cAAc;AACvB,SAAS,iBAAiB;AAC1B,SAAS,mBAA4C;AAErD,SAAS,kBAA2C;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["/**\n * @example\n * import { Details, Status } from '@repo/error';\n *\n * Status.adapter = () => new Error('Error');\n *\n * const details = Details.new()\n *  .requestInfo({ requestId: '1234567890', servingData: '/v1/tests' })\n *  .errorInfo({ reason: 'ACCOUNT_LOCKED' });\n *\n * throw Status.alreadyExists('xxx').error(details);\n */\n\nexport {\n  LoginTimeoutError,\n  LoginCanceledError,\n  CheckoutCreateError,\n  PurchaseError,\n} from './error/index';\nexport type {\n  NetworkErrorReason,\n  StatusErrorReason,\n  AuthenticationErrorReason,\n  ModerationErrorReason,\n  MultipartErrorReason,\n  AppErrorReason,\n  ErrorReason,\n} from './error/reason';\nexport * from './error/detail';\nexport * from './error/status';\nexport { getErrorMessage } from './error/parse';\nexport {\n  pageParamsSchema,\n  Cursor,\n  initialPageParam,\n  getPreviousPageParam,\n  getNextPageParam,\n} from './response';\nexport type {\n  Empty,\n  EntityId,\n  Entity,\n  Response,\n  InitParams,\n  NextParams,\n  PrevParams,\n  PageParams,\n  ParentPageParams,\n  Page,\n} from './response';\n\nexport * from './vaild';\nexport * from './snowflake';\n\nexport * as MAX_LENGTH from './max-length/index';\nexport { hasText } from './utils/string';\nexport { timing } from './utils/timing';\nexport { once } from './utils/promise';\nexport { invariant } from './utils/invariant';\nexport { TokenBucket, type TokenBucketOptions } from './utils/token-bucket';\n\nexport { ISO_3601_1, type ISO3166CountryCode } from './iso/iso_3601_1';\n"],"mappings":";AAaA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAUP,cAAc;AACd,cAAc;AACd,SAAS,uBAAuB;AAChC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAcP,cAAc;AACd,cAAc;AAEd,YAAY,gBAAgB;AAC5B,SAAS,eAAe;AACxB,SAAS,cAAc;AACvB,SAAS,YAAY;AACrB,SAAS,iBAAiB;AAC1B,SAAS,mBAA4C;AAErD,SAAS,kBAA2C;","names":[]}

package/dist/utils/promise.cjs

@@ -0,0 +1,47 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/utils/promise.ts
+var promise_exports = {};
+__export(promise_exports, {
+  once: () => once
+});
+module.exports = __toCommonJS(promise_exports);
+function once(fn) {
+  let cache = null;
+  let promise = null;
+  return async (...args) => {
+    if (cache) return cache;
+    if (!promise) {
+      promise = fn(...args).then((result) => {
+        cache = result;
+        return result;
+      }).catch((error) => {
+        promise = null;
+        throw error;
+      });
+    }
+    return promise;
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  once
+});
+//# sourceMappingURL=promise.cjs.map

package/dist/utils/promise.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utils/promise.ts"],"sourcesContent":["export function once<A extends unknown[], T>(fn: (...args: A) => Promise<T>) {\n  let cache: T | null = null;\n  let promise: Promise<T> | null = null;\n\n  return async (...args: A) => {\n    if (cache) return cache;\n    if (!promise) {\n      promise = fn(...args)\n        .then((result) => {\n          cache = result;\n          return result;\n        })\n        .catch((error) => {\n          promise = null;\n          throw error;\n        });\n    }\n\n    return promise;\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAO,SAAS,KAA6B,IAAgC;AAC3E,MAAI,QAAkB;AACtB,MAAI,UAA6B;AAEjC,SAAO,UAAU,SAAY;AAC3B,QAAI,MAAO,QAAO;AAClB,QAAI,CAAC,SAAS;AACZ,gBAAU,GAAG,GAAG,IAAI,EACjB,KAAK,CAAC,WAAW;AAChB,gBAAQ;AACR,eAAO;AAAA,MACT,CAAC,EACA,MAAM,CAAC,UAAU;AAChB,kBAAU;AACV,cAAM;AAAA,MACR,CAAC;AAAA,IACL;AAEA,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/utils/promise.d.cts

@@ -0,0 +1,3 @@
+declare function once<A extends unknown[], T>(fn: (...args: A) => Promise<T>): (...args: A) => Promise<T>;
+
+export { once };

package/dist/utils/promise.d.ts

@@ -0,0 +1,3 @@
+declare function once<A extends unknown[], T>(fn: (...args: A) => Promise<T>): (...args: A) => Promise<T>;
+
+export { once };

package/dist/utils/promise.mjs

@@ -0,0 +1,22 @@
+// src/utils/promise.ts
+function once(fn) {
+  let cache = null;
+  let promise = null;
+  return async (...args) => {
+    if (cache) return cache;
+    if (!promise) {
+      promise = fn(...args).then((result) => {
+        cache = result;
+        return result;
+      }).catch((error) => {
+        promise = null;
+        throw error;
+      });
+    }
+    return promise;
+  };
+}
+export {
+  once
+};
+//# sourceMappingURL=promise.mjs.map

package/dist/utils/promise.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utils/promise.ts"],"sourcesContent":["export function once<A extends unknown[], T>(fn: (...args: A) => Promise<T>) {\n  let cache: T | null = null;\n  let promise: Promise<T> | null = null;\n\n  return async (...args: A) => {\n    if (cache) return cache;\n    if (!promise) {\n      promise = fn(...args)\n        .then((result) => {\n          cache = result;\n          return result;\n        })\n        .catch((error) => {\n          promise = null;\n          throw error;\n        });\n    }\n\n    return promise;\n  };\n}\n"],"mappings":";AAAO,SAAS,KAA6B,IAAgC;AAC3E,MAAI,QAAkB;AACtB,MAAI,UAA6B;AAEjC,SAAO,UAAU,SAAY;AAC3B,QAAI,MAAO,QAAO;AAClB,QAAI,CAAC,SAAS;AACZ,gBAAU,GAAG,GAAG,IAAI,EACjB,KAAK,CAAC,WAAW;AAChB,gBAAQ;AACR,eAAO;AAAA,MACT,CAAC,EACA,MAAM,CAAC,UAAU;AAChB,kBAAU;AACV,cAAM;AAAA,MACR,CAAC;AAAA,IACL;AAEA,WAAO;AAAA,EACT;AACF;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shware/http",
-  "version": "1.1.11",
+  "version": "1.1.12",
   "private": false,
   "type": "module",
   "repository": {
@@ -44,7 +44,7 @@
     "jest": "^30.1.3",
     "ts-jest": "^29.4.1",
     "typescript": "^5.9.2",
-    "@repo/eslint-config": "0.0.2",
+    "@repo/eslint-config": "0.0.3",
     "@repo/typescript-config": "0.0.0"
   },
   "dependencies": {