@shware/http 1.2.1 → 1.2.3

package/dist/hono/__tests__/csrf.test.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/hono/__tests__/csrf.test.ts"],"sourcesContent":["import { Hono } from 'hono';\nimport { csrf } from '../csrf';\nimport { errorHandler, type Env } from '../handler';\n\ndescribe('CSRF Protection', () => {\n  let app: Hono<Env>;\n\n  beforeEach(() => {\n    app = new Hono();\n    app.onError(errorHandler);\n  });\n\n  it('should allow GET requests without CSRF token', async () => {\n    app.use(csrf());\n    app.get('/test', (c) => c.text('OK'));\n\n    const res = await app.request('/test');\n    expect(res.status).toBe(200);\n    expect(await res.text()).toBe('OK');\n  });\n\n  it('should allow HEAD requests without CSRF token', async () => {\n    app.use(csrf());\n    app.all('/test', (c) => c.text('OK'));\n\n    const res = await app.request('/test', { method: 'HEAD' });\n    expect(res.status).toBe(200);\n  });\n\n  it('should allow OPTIONS requests without CSRF token', async () => {\n    app.use(csrf());\n    app.options('/test', (c) => c.text('OK'));\n\n    const res = await app.request('/test', { method: 'OPTIONS' });\n    expect(res.status).toBe(200);\n  });\n\n  it('should reject POST requests without CSRF token', async () => {\n    app.use(csrf());\n    app.post('/test', (c) => c.text('OK'));\n\n    const res = await app.request('/test', { method: 'POST' });\n    expect(res.status).toBe(403);\n  });\n\n  it('should reject POST requests with mismatched tokens', async () => {\n    app.use(csrf());\n    app.post('/test', (c) => c.text('OK'));\n\n    const res = await app.request('/test', {\n      method: 'POST',\n      headers: { 'X-XSRF-TOKEN': 'header-token', Cookie: 'XSRF-TOKEN=cookie-token' },\n    });\n    expect(res.status).toBe(403);\n  });\n\n  it('should allow POST requests with matching tokens', async () => {\n    app.use(csrf());\n    app.post('/test', (c) => c.text('OK'));\n\n    const res = await app.request('/test', {\n      method: 'POST',\n      headers: {\n        'X-XSRF-TOKEN': 'matching-token',\n        Cookie: 'XSRF-TOKEN=matching-token',\n      },\n    });\n    expect(res.status).toBe(200);\n    expect(await res.text()).toBe('OK');\n  });\n\n  it('should use custom cookie and header names', async () => {\n    app.use(csrf({ cookieName: 'csrf-token', headerName: 'X-CSRF-Token' }));\n    app.post('/test', (c) => c.text('OK'));\n\n    const res = await app.request('/test', {\n      method: 'POST',\n      headers: {\n        'X-CSRF-Token': 'test-token',\n        Cookie: 'csrf-token=test-token',\n      },\n    });\n    expect(res.status).toBe(200);\n  });\n\n  it('should ignore specified paths', async () => {\n    app.use(csrf({ ignores: [{ path: '/webhook/*', methods: ['POST'] }] }));\n    app.post('/webhook/stripe', (c) => c.text('OK'));\n    app.post('/api/data', (c) => c.text('OK'));\n\n    // Ignored path should work without CSRF token\n    const webhookRes = await app.request('/webhook/stripe', { method: 'POST' });\n    expect(webhookRes.status).toBe(200);\n\n    // Non-ignored path should require CSRF token\n    const apiRes = await app.request('/api/data', { method: 'POST' });\n    expect(apiRes.status).toBe(403);\n  });\n\n  it('should ignore all methods for a path when methods not specified', async () => {\n    app.use(csrf({ ignores: [{ path: '/auth/apple/callback' }] }));\n    app.post('/auth/apple/callback', (c) => c.text('OK'));\n    app.put('/auth/apple/callback', (c) => c.text('OK'));\n\n    const postRes = await app.request('/auth/apple/callback', { method: 'POST' });\n    expect(postRes.status).toBe(200);\n\n    const putRes = await app.request('/auth/apple/callback', { method: 'PUT' });\n    expect(putRes.status).toBe(200);\n  });\n\n  it('should handle empty tokens safely', async () => {\n    app.use(csrf());\n    app.post('/test', (c) => c.text('OK'));\n\n    const res = await app.request('/test', {\n      method: 'POST',\n      headers: { 'X-XSRF-TOKEN': '', Cookie: 'XSRF-TOKEN=' },\n    });\n    expect(res.status).toBe(403);\n  });\n\n  it('should handle missing cookie', async () => {\n    app.use(csrf());\n    app.post('/test', (c) => c.text('OK'));\n\n    const res = await app.request('/test', {\n      method: 'POST',\n      headers: { 'X-XSRF-TOKEN': 'token' },\n    });\n    expect(res.status).toBe(403);\n  });\n\n  it('should handle missing header', async () => {\n    app.use(csrf());\n    app.post('/test', (c) => c.text('OK'));\n\n    const res = await app.request('/test', {\n      method: 'POST',\n      headers: { Cookie: 'XSRF-TOKEN=token' },\n    });\n    expect(res.status).toBe(403);\n  });\n\n  it('should use custom error message', async () => {\n    app.use(csrf({ errorMessage: 'Custom CSRF error' }));\n    app.post('/test', (c) => c.text('OK'));\n\n    const res = await app.request('/test', { method: 'POST' });\n    expect(res.status).toBe(403);\n    const body = await res.json();\n    expect(body.error.message).toBe('Custom CSRF error');\n  });\n\n  it('should work with custom safe methods', async () => {\n    app.use(csrf({ safeMethods: ['GET'] }));\n    app.all('/test', (c) => c.text('OK'));\n\n    // HEAD is no longer safe, should require CSRF token\n    const res = await app.request('/test', { method: 'HEAD' });\n    expect(res.status).toBe(403);\n  });\n\n  it('should handle complex ignore patterns', async () => {\n    app.use(\n      csrf({\n        ignores: [\n          { path: '/api/v1/*', methods: ['GET', 'POST'] },\n          { path: '/api/v2/*', methods: ['POST'] },\n          { path: '/public/*' }, // All methods\n        ],\n      })\n    );\n\n    app.get('/api/v1/users', (c) => c.text('OK'));\n    app.post('/api/v1/users', (c) => c.text('OK'));\n    app.put('/api/v1/users', (c) => c.text('OK'));\n    app.post('/api/v2/users', (c) => c.text('OK'));\n    app.get('/api/v2/users', (c) => c.text('OK'));\n    app.post('/public/data', (c) => c.text('OK'));\n\n    // Ignored GET and POST for /api/v1/*\n    let res = await app.request('/api/v1/users', { method: 'GET' });\n    expect(res.status).toBe(200);\n\n    res = await app.request('/api/v1/users', { method: 'POST' });\n    expect(res.status).toBe(200);\n\n    // PUT not ignored for /api/v1/*\n    res = await app.request('/api/v1/users', { method: 'PUT' });\n    expect(res.status).toBe(403);\n\n    // Only POST ignored for /api/v2/*\n    res = await app.request('/api/v2/users', { method: 'POST' });\n    expect(res.status).toBe(200);\n\n    // GET not ignored for /api/v2/* (but GET is safe by default)\n    res = await app.request('/api/v2/users', { method: 'GET' });\n    expect(res.status).toBe(200);\n\n    // All methods ignored for /public/*\n    res = await app.request('/public/data', { method: 'POST' });\n    expect(res.status).toBe(200);\n  });\n});\n"],"mappings":";AAAA,SAAS,YAAY;AACrB,SAAS,YAAY;AACrB,SAAS,oBAA8B;AAEvC,SAAS,mBAAmB,MAAM;AAChC,MAAI;AAEJ,aAAW,MAAM;AACf,UAAM,IAAI,KAAK;AACf,QAAI,QAAQ,YAAY;AAAA,EAC1B,CAAC;AAED,KAAG,gDAAgD,YAAY;AAC7D,QAAI,IAAI,KAAK,CAAC;AACd,QAAI,IAAI,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAEpC,UAAM,MAAM,MAAM,IAAI,QAAQ,OAAO;AACrC,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAC3B,WAAO,MAAM,IAAI,KAAK,CAAC,EAAE,KAAK,IAAI;AAAA,EACpC,CAAC;AAED,KAAG,iDAAiD,YAAY;AAC9D,QAAI,IAAI,KAAK,CAAC;AACd,QAAI,IAAI,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAEpC,UAAM,MAAM,MAAM,IAAI,QAAQ,SAAS,EAAE,QAAQ,OAAO,CAAC;AACzD,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,EAC7B,CAAC;AAED,KAAG,oDAAoD,YAAY;AACjE,QAAI,IAAI,KAAK,CAAC;AACd,QAAI,QAAQ,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAExC,UAAM,MAAM,MAAM,IAAI,QAAQ,SAAS,EAAE,QAAQ,UAAU,CAAC;AAC5D,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,EAC7B,CAAC;AAED,KAAG,kDAAkD,YAAY;AAC/D,QAAI,IAAI,KAAK,CAAC;AACd,QAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,UAAM,MAAM,MAAM,IAAI,QAAQ,SAAS,EAAE,QAAQ,OAAO,CAAC;AACzD,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,EAC7B,CAAC;AAED,KAAG,sDAAsD,YAAY;AACnE,QAAI,IAAI,KAAK,CAAC;AACd,QAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,UAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,MACrC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,gBAAgB,QAAQ,0BAA0B;AAAA,IAC/E,CAAC;AACD,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,EAC7B,CAAC;AAED,KAAG,mDAAmD,YAAY;AAChE,QAAI,IAAI,KAAK,CAAC;AACd,QAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,UAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,MACrC,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,QAAQ;AAAA,MACV;AAAA,IACF,CAAC;AACD,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAC3B,WAAO,MAAM,IAAI,KAAK,CAAC,EAAE,KAAK,IAAI;AAAA,EACpC,CAAC;AAED,KAAG,6CAA6C,YAAY;AAC1D,QAAI,IAAI,KAAK,EAAE,YAAY,cAAc,YAAY,eAAe,CAAC,CAAC;AACtE,QAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,UAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,MACrC,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,QAAQ;AAAA,MACV;AAAA,IACF,CAAC;AACD,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,EAC7B,CAAC;AAED,KAAG,iCAAiC,YAAY;AAC9C,QAAI,IAAI,KAAK,EAAE,SAAS,CAAC,EAAE,MAAM,cAAc,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;AACtE,QAAI,KAAK,mBAAmB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAC/C,QAAI,KAAK,aAAa,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAGzC,UAAM,aAAa,MAAM,IAAI,QAAQ,mBAAmB,EAAE,QAAQ,OAAO,CAAC;AAC1E,WAAO,WAAW,MAAM,EAAE,KAAK,GAAG;AAGlC,UAAM,SAAS,MAAM,IAAI,QAAQ,aAAa,EAAE,QAAQ,OAAO,CAAC;AAChE,WAAO,OAAO,MAAM,EAAE,KAAK,GAAG;AAAA,EAChC,CAAC;AAED,KAAG,mEAAmE,YAAY;AAChF,QAAI,IAAI,KAAK,EAAE,SAAS,CAAC,EAAE,MAAM,uBAAuB,CAAC,EAAE,CAAC,CAAC;AAC7D,QAAI,KAAK,wBAAwB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AACpD,QAAI,IAAI,wBAAwB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAEnD,UAAM,UAAU,MAAM,IAAI,QAAQ,wBAAwB,EAAE,QAAQ,OAAO,CAAC;AAC5E,WAAO,QAAQ,MAAM,EAAE,KAAK,GAAG;AAE/B,UAAM,SAAS,MAAM,IAAI,QAAQ,wBAAwB,EAAE,QAAQ,MAAM,CAAC;AAC1E,WAAO,OAAO,MAAM,EAAE,KAAK,GAAG;AAAA,EAChC,CAAC;AAED,KAAG,qCAAqC,YAAY;AAClD,QAAI,IAAI,KAAK,CAAC;AACd,QAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,UAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,MACrC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,IAAI,QAAQ,cAAc;AAAA,IACvD,CAAC;AACD,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,EAC7B,CAAC;AAED,KAAG,gCAAgC,YAAY;AAC7C,QAAI,IAAI,KAAK,CAAC;AACd,QAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,UAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,MACrC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,QAAQ;AAAA,IACrC,CAAC;AACD,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,EAC7B,CAAC;AAED,KAAG,gCAAgC,YAAY;AAC7C,QAAI,IAAI,KAAK,CAAC;AACd,QAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,UAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,MACrC,QAAQ;AAAA,MACR,SAAS,EAAE,QAAQ,mBAAmB;AAAA,IACxC,CAAC;AACD,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,EAC7B,CAAC;AAED,KAAG,mCAAmC,YAAY;AAChD,QAAI,IAAI,KAAK,EAAE,cAAc,oBAAoB,CAAC,CAAC;AACnD,QAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,UAAM,MAAM,MAAM,IAAI,QAAQ,SAAS,EAAE,QAAQ,OAAO,CAAC;AACzD,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAC3B,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,WAAO,KAAK,MAAM,OAAO,EAAE,KAAK,mBAAmB;AAAA,EACrD,CAAC;AAED,KAAG,wCAAwC,YAAY;AACrD,QAAI,IAAI,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC;AACtC,QAAI,IAAI,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAGpC,UAAM,MAAM,MAAM,IAAI,QAAQ,SAAS,EAAE,QAAQ,OAAO,CAAC;AACzD,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,EAC7B,CAAC;AAED,KAAG,yCAAyC,YAAY;AACtD,QAAI;AAAA,MACF,KAAK;AAAA,QACH,SAAS;AAAA,UACP,EAAE,MAAM,aAAa,SAAS,CAAC,OAAO,MAAM,EAAE;AAAA,UAC9C,EAAE,MAAM,aAAa,SAAS,CAAC,MAAM,EAAE;AAAA,UACvC,EAAE,MAAM,YAAY;AAAA;AAAA,QACtB;AAAA,MACF,CAAC;AAAA,IACH;AAEA,QAAI,IAAI,iBAAiB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAC5C,QAAI,KAAK,iBAAiB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAC7C,QAAI,IAAI,iBAAiB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAC5C,QAAI,KAAK,iBAAiB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAC7C,QAAI,IAAI,iBAAiB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAC5C,QAAI,KAAK,gBAAgB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAG5C,QAAI,MAAM,MAAM,IAAI,QAAQ,iBAAiB,EAAE,QAAQ,MAAM,CAAC;AAC9D,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAE3B,UAAM,MAAM,IAAI,QAAQ,iBAAiB,EAAE,QAAQ,OAAO,CAAC;AAC3D,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAG3B,UAAM,MAAM,IAAI,QAAQ,iBAAiB,EAAE,QAAQ,MAAM,CAAC;AAC1D,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAG3B,UAAM,MAAM,IAAI,QAAQ,iBAAiB,EAAE,QAAQ,OAAO,CAAC;AAC3D,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAG3B,UAAM,MAAM,IAAI,QAAQ,iBAAiB,EAAE,QAAQ,MAAM,CAAC;AAC1D,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAG3B,UAAM,MAAM,IAAI,QAAQ,gBAAgB,EAAE,QAAQ,OAAO,CAAC;AAC1D,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,EAC7B,CAAC;AACH,CAAC;","names":[]}
+{"version":3,"sources":["../../../src/hono/__tests__/csrf.test.ts"],"sourcesContent":["import { Hono } from 'hono';\nimport { csrf } from '../csrf';\nimport { type Env, errorHandler } from '../handler';\n\ndescribe('CSRF Protection', () => {\n  let app: Hono<Env>;\n\n  beforeEach(() => {\n    app = new Hono();\n    app.onError(errorHandler);\n  });\n\n  it('should allow GET requests without CSRF token', async () => {\n    app.use(csrf());\n    app.get('/test', (c) => c.text('OK'));\n\n    const res = await app.request('/test');\n    expect(res.status).toBe(200);\n    expect(await res.text()).toBe('OK');\n  });\n\n  it('should allow HEAD requests without CSRF token', async () => {\n    app.use(csrf());\n    app.all('/test', (c) => c.text('OK'));\n\n    const res = await app.request('/test', { method: 'HEAD' });\n    expect(res.status).toBe(200);\n  });\n\n  it('should allow OPTIONS requests without CSRF token', async () => {\n    app.use(csrf());\n    app.options('/test', (c) => c.text('OK'));\n\n    const res = await app.request('/test', { method: 'OPTIONS' });\n    expect(res.status).toBe(200);\n  });\n\n  it('should reject POST requests without CSRF token', async () => {\n    app.use(csrf());\n    app.post('/test', (c) => c.text('OK'));\n\n    const res = await app.request('/test', { method: 'POST' });\n    expect(res.status).toBe(403);\n  });\n\n  it('should reject POST requests with mismatched tokens', async () => {\n    app.use(csrf());\n    app.post('/test', (c) => c.text('OK'));\n\n    const res = await app.request('/test', {\n      method: 'POST',\n      headers: { 'X-XSRF-TOKEN': 'header-token', Cookie: 'XSRF-TOKEN=cookie-token' },\n    });\n    expect(res.status).toBe(403);\n  });\n\n  it('should allow POST requests with matching tokens', async () => {\n    app.use(csrf());\n    app.post('/test', (c) => c.text('OK'));\n\n    const res = await app.request('/test', {\n      method: 'POST',\n      headers: {\n        'X-XSRF-TOKEN': 'matching-token',\n        Cookie: 'XSRF-TOKEN=matching-token',\n      },\n    });\n    expect(res.status).toBe(200);\n    expect(await res.text()).toBe('OK');\n  });\n\n  it('should use custom cookie and header names', async () => {\n    app.use(csrf({ cookieName: 'csrf-token', headerName: 'X-CSRF-Token' }));\n    app.post('/test', (c) => c.text('OK'));\n\n    const res = await app.request('/test', {\n      method: 'POST',\n      headers: {\n        'X-CSRF-Token': 'test-token',\n        Cookie: 'csrf-token=test-token',\n      },\n    });\n    expect(res.status).toBe(200);\n  });\n\n  it('should ignore specified paths', async () => {\n    app.use(csrf({ ignores: [{ path: '/webhook/*', methods: ['POST'] }] }));\n    app.post('/webhook/stripe', (c) => c.text('OK'));\n    app.post('/api/data', (c) => c.text('OK'));\n\n    // Ignored path should work without CSRF token\n    const webhookRes = await app.request('/webhook/stripe', { method: 'POST' });\n    expect(webhookRes.status).toBe(200);\n\n    // Non-ignored path should require CSRF token\n    const apiRes = await app.request('/api/data', { method: 'POST' });\n    expect(apiRes.status).toBe(403);\n  });\n\n  it('should ignore all methods for a path when methods not specified', async () => {\n    app.use(csrf({ ignores: [{ path: '/auth/apple/callback' }] }));\n    app.post('/auth/apple/callback', (c) => c.text('OK'));\n    app.put('/auth/apple/callback', (c) => c.text('OK'));\n\n    const postRes = await app.request('/auth/apple/callback', { method: 'POST' });\n    expect(postRes.status).toBe(200);\n\n    const putRes = await app.request('/auth/apple/callback', { method: 'PUT' });\n    expect(putRes.status).toBe(200);\n  });\n\n  it('should handle empty tokens safely', async () => {\n    app.use(csrf());\n    app.post('/test', (c) => c.text('OK'));\n\n    const res = await app.request('/test', {\n      method: 'POST',\n      headers: { 'X-XSRF-TOKEN': '', Cookie: 'XSRF-TOKEN=' },\n    });\n    expect(res.status).toBe(403);\n  });\n\n  it('should handle missing cookie', async () => {\n    app.use(csrf());\n    app.post('/test', (c) => c.text('OK'));\n\n    const res = await app.request('/test', {\n      method: 'POST',\n      headers: { 'X-XSRF-TOKEN': 'token' },\n    });\n    expect(res.status).toBe(403);\n  });\n\n  it('should handle missing header', async () => {\n    app.use(csrf());\n    app.post('/test', (c) => c.text('OK'));\n\n    const res = await app.request('/test', {\n      method: 'POST',\n      headers: { Cookie: 'XSRF-TOKEN=token' },\n    });\n    expect(res.status).toBe(403);\n  });\n\n  it('should use custom error message', async () => {\n    app.use(csrf({ errorMessage: 'Custom CSRF error' }));\n    app.post('/test', (c) => c.text('OK'));\n\n    const res = await app.request('/test', { method: 'POST' });\n    expect(res.status).toBe(403);\n    const body = await res.json();\n    expect(body.error.message).toBe('Custom CSRF error');\n  });\n\n  it('should work with custom safe methods', async () => {\n    app.use(csrf({ safeMethods: ['GET'] }));\n    app.all('/test', (c) => c.text('OK'));\n\n    // HEAD is no longer safe, should require CSRF token\n    const res = await app.request('/test', { method: 'HEAD' });\n    expect(res.status).toBe(403);\n  });\n\n  it('should handle complex ignore patterns', async () => {\n    app.use(\n      csrf({\n        ignores: [\n          { path: '/api/v1/*', methods: ['GET', 'POST'] },\n          { path: '/api/v2/*', methods: ['POST'] },\n          { path: '/public/*' }, // All methods\n        ],\n      })\n    );\n\n    app.get('/api/v1/users', (c) => c.text('OK'));\n    app.post('/api/v1/users', (c) => c.text('OK'));\n    app.put('/api/v1/users', (c) => c.text('OK'));\n    app.post('/api/v2/users', (c) => c.text('OK'));\n    app.get('/api/v2/users', (c) => c.text('OK'));\n    app.post('/public/data', (c) => c.text('OK'));\n\n    // Ignored GET and POST for /api/v1/*\n    let res = await app.request('/api/v1/users', { method: 'GET' });\n    expect(res.status).toBe(200);\n\n    res = await app.request('/api/v1/users', { method: 'POST' });\n    expect(res.status).toBe(200);\n\n    // PUT not ignored for /api/v1/*\n    res = await app.request('/api/v1/users', { method: 'PUT' });\n    expect(res.status).toBe(403);\n\n    // Only POST ignored for /api/v2/*\n    res = await app.request('/api/v2/users', { method: 'POST' });\n    expect(res.status).toBe(200);\n\n    // GET not ignored for /api/v2/* (but GET is safe by default)\n    res = await app.request('/api/v2/users', { method: 'GET' });\n    expect(res.status).toBe(200);\n\n    // All methods ignored for /public/*\n    res = await app.request('/public/data', { method: 'POST' });\n    expect(res.status).toBe(200);\n  });\n\n  describe('Origin bypass', () => {\n    it('should allow requests from configured origins', async () => {\n      app.use(csrf({ origin: ['https://example.com', 'https://trusted.com'] }));\n      app.post('/test', (c) => c.text('OK'));\n\n      // Request from allowed origin should work without CSRF token\n      const res = await app.request('/test', {\n        method: 'POST',\n        headers: { Origin: 'https://example.com' },\n      });\n      expect(res.status).toBe(200);\n      expect(await res.text()).toBe('OK');\n    });\n\n    it('should allow requests from any configured origin', async () => {\n      app.use(csrf({ origin: ['https://example.com', 'https://trusted.com'] }));\n      app.post('/test', (c) => c.text('OK'));\n\n      const res = await app.request('/test', {\n        method: 'POST',\n        headers: { Origin: 'https://trusted.com' },\n      });\n      expect(res.status).toBe(200);\n    });\n\n    it('should reject requests from non-configured origins', async () => {\n      app.use(csrf({ origin: ['https://example.com'] }));\n      app.post('/test', (c) => c.text('OK'));\n\n      const res = await app.request('/test', {\n        method: 'POST',\n        headers: { Origin: 'https://malicious.com' },\n      });\n      expect(res.status).toBe(403);\n    });\n\n    it('should reject requests without origin header', async () => {\n      app.use(csrf({ origin: ['https://example.com'] }));\n      app.post('/test', (c) => c.text('OK'));\n\n      const res = await app.request('/test', { method: 'POST' });\n      expect(res.status).toBe(403);\n    });\n\n    it('should handle empty origin list', async () => {\n      app.use(csrf({ origin: [] }));\n      app.post('/test', (c) => c.text('OK'));\n\n      const res = await app.request('/test', {\n        method: 'POST',\n        headers: { Origin: 'https://example.com' },\n      });\n      expect(res.status).toBe(403);\n    });\n  });\n\n  describe('Sec-Fetch-Site bypass', () => {\n    it('should allow requests with configured sec-fetch-site values', async () => {\n      app.use(csrf({ secFetchSite: ['same-origin', 'same-site'] }));\n      app.post('/test', (c) => c.text('OK'));\n\n      const res = await app.request('/test', {\n        method: 'POST',\n        headers: { 'Sec-Fetch-Site': 'same-origin' },\n      });\n      expect(res.status).toBe(200);\n      expect(await res.text()).toBe('OK');\n    });\n\n    it('should allow requests with any configured sec-fetch-site value', async () => {\n      app.use(csrf({ secFetchSite: ['same-origin', 'same-site', 'cross-origin'] }));\n      app.post('/test', (c) => c.text('OK'));\n\n      const res = await app.request('/test', {\n        method: 'POST',\n        headers: { 'Sec-Fetch-Site': 'cross-origin' },\n      });\n      expect(res.status).toBe(200);\n    });\n\n    it('should reject requests with non-configured sec-fetch-site values', async () => {\n      app.use(csrf({ secFetchSite: ['same-origin'] }));\n      app.post('/test', (c) => c.text('OK'));\n\n      const res = await app.request('/test', {\n        method: 'POST',\n        headers: { 'Sec-Fetch-Site': 'same-site' },\n      });\n      expect(res.status).toBe(403);\n    });\n\n    it('should reject requests without sec-fetch-site header', async () => {\n      app.use(csrf({ secFetchSite: ['same-origin'] }));\n      app.post('/test', (c) => c.text('OK'));\n\n      const res = await app.request('/test', { method: 'POST' });\n      expect(res.status).toBe(403);\n    });\n\n    it('should handle all valid sec-fetch-site values', async () => {\n      app.use(csrf({ secFetchSite: ['same-origin', 'same-site', 'none', 'cross-origin'] }));\n      app.post('/test', (c) => c.text('OK'));\n\n      const validValues = ['same-origin', 'same-site', 'none', 'cross-origin'];\n\n      for (const value of validValues) {\n        const res = await app.request('/test', {\n          method: 'POST',\n          headers: { 'Sec-Fetch-Site': value },\n        });\n        expect(res.status).toBe(200);\n      }\n    });\n\n    it('should handle empty sec-fetch-site list', async () => {\n      app.use(csrf({ secFetchSite: [] }));\n      app.post('/test', (c) => c.text('OK'));\n\n      const res = await app.request('/test', {\n        method: 'POST',\n        headers: { 'Sec-Fetch-Site': 'same-origin' },\n      });\n      expect(res.status).toBe(403);\n    });\n  });\n\n  describe('Combined origin and sec-fetch-site bypass', () => {\n    it('should allow requests matching either origin or sec-fetch-site', async () => {\n      app.use(\n        csrf({\n          origin: ['https://example.com'],\n          secFetchSite: ['same-site'],\n        })\n      );\n      app.post('/test', (c) => c.text('OK'));\n\n      // Should work with matching origin\n      let res = await app.request('/test', {\n        method: 'POST',\n        headers: { Origin: 'https://example.com' },\n      });\n      expect(res.status).toBe(200);\n\n      // Should work with matching sec-fetch-site\n      res = await app.request('/test', {\n        method: 'POST',\n        headers: { 'Sec-Fetch-Site': 'same-site' },\n      });\n      expect(res.status).toBe(200);\n    });\n\n    it('should reject requests matching neither origin nor sec-fetch-site', async () => {\n      app.use(\n        csrf({\n          origin: ['https://example.com'],\n          secFetchSite: ['same-origin'],\n        })\n      );\n      app.post('/test', (c) => c.text('OK'));\n\n      const res = await app.request('/test', {\n        method: 'POST',\n        headers: {\n          Origin: 'https://malicious.com',\n          'Sec-Fetch-Site': 'cross-origin',\n        },\n      });\n      expect(res.status).toBe(403);\n    });\n\n    it('should work with origin, sec-fetch-site and ignore rules combined', async () => {\n      app.use(\n        csrf({\n          origin: ['https://example.com'],\n          secFetchSite: ['same-site'],\n          ignores: [{ path: '/webhook/*', methods: ['POST'] }],\n        })\n      );\n\n      app.post('/test', (c) => c.text('OK'));\n      app.post('/webhook/stripe', (c) => c.text('OK'));\n      app.post('/api/data', (c) => c.text('OK'));\n\n      // Should work with origin bypass\n      let res = await app.request('/test', {\n        method: 'POST',\n        headers: { Origin: 'https://example.com' },\n      });\n      expect(res.status).toBe(200);\n\n      // Should work with sec-fetch-site bypass\n      res = await app.request('/test', {\n        method: 'POST',\n        headers: { 'Sec-Fetch-Site': 'same-site' },\n      });\n      expect(res.status).toBe(200);\n\n      // Should work with ignore rule\n      res = await app.request('/webhook/stripe', { method: 'POST' });\n      expect(res.status).toBe(200);\n\n      // Should fail without any bypass\n      res = await app.request('/api/data', { method: 'POST' });\n      expect(res.status).toBe(403);\n    });\n  });\n});\n"],"mappings":";AAAA,SAAS,YAAY;AACrB,SAAS,YAAY;AACrB,SAAmB,oBAAoB;AAEvC,SAAS,mBAAmB,MAAM;AAChC,MAAI;AAEJ,aAAW,MAAM;AACf,UAAM,IAAI,KAAK;AACf,QAAI,QAAQ,YAAY;AAAA,EAC1B,CAAC;AAED,KAAG,gDAAgD,YAAY;AAC7D,QAAI,IAAI,KAAK,CAAC;AACd,QAAI,IAAI,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAEpC,UAAM,MAAM,MAAM,IAAI,QAAQ,OAAO;AACrC,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAC3B,WAAO,MAAM,IAAI,KAAK,CAAC,EAAE,KAAK,IAAI;AAAA,EACpC,CAAC;AAED,KAAG,iDAAiD,YAAY;AAC9D,QAAI,IAAI,KAAK,CAAC;AACd,QAAI,IAAI,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAEpC,UAAM,MAAM,MAAM,IAAI,QAAQ,SAAS,EAAE,QAAQ,OAAO,CAAC;AACzD,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,EAC7B,CAAC;AAED,KAAG,oDAAoD,YAAY;AACjE,QAAI,IAAI,KAAK,CAAC;AACd,QAAI,QAAQ,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAExC,UAAM,MAAM,MAAM,IAAI,QAAQ,SAAS,EAAE,QAAQ,UAAU,CAAC;AAC5D,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,EAC7B,CAAC;AAED,KAAG,kDAAkD,YAAY;AAC/D,QAAI,IAAI,KAAK,CAAC;AACd,QAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,UAAM,MAAM,MAAM,IAAI,QAAQ,SAAS,EAAE,QAAQ,OAAO,CAAC;AACzD,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,EAC7B,CAAC;AAED,KAAG,sDAAsD,YAAY;AACnE,QAAI,IAAI,KAAK,CAAC;AACd,QAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,UAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,MACrC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,gBAAgB,QAAQ,0BAA0B;AAAA,IAC/E,CAAC;AACD,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,EAC7B,CAAC;AAED,KAAG,mDAAmD,YAAY;AAChE,QAAI,IAAI,KAAK,CAAC;AACd,QAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,UAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,MACrC,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,QAAQ;AAAA,MACV;AAAA,IACF,CAAC;AACD,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAC3B,WAAO,MAAM,IAAI,KAAK,CAAC,EAAE,KAAK,IAAI;AAAA,EACpC,CAAC;AAED,KAAG,6CAA6C,YAAY;AAC1D,QAAI,IAAI,KAAK,EAAE,YAAY,cAAc,YAAY,eAAe,CAAC,CAAC;AACtE,QAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,UAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,MACrC,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,QAAQ;AAAA,MACV;AAAA,IACF,CAAC;AACD,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,EAC7B,CAAC;AAED,KAAG,iCAAiC,YAAY;AAC9C,QAAI,IAAI,KAAK,EAAE,SAAS,CAAC,EAAE,MAAM,cAAc,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;AACtE,QAAI,KAAK,mBAAmB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAC/C,QAAI,KAAK,aAAa,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAGzC,UAAM,aAAa,MAAM,IAAI,QAAQ,mBAAmB,EAAE,QAAQ,OAAO,CAAC;AAC1E,WAAO,WAAW,MAAM,EAAE,KAAK,GAAG;AAGlC,UAAM,SAAS,MAAM,IAAI,QAAQ,aAAa,EAAE,QAAQ,OAAO,CAAC;AAChE,WAAO,OAAO,MAAM,EAAE,KAAK,GAAG;AAAA,EAChC,CAAC;AAED,KAAG,mEAAmE,YAAY;AAChF,QAAI,IAAI,KAAK,EAAE,SAAS,CAAC,EAAE,MAAM,uBAAuB,CAAC,EAAE,CAAC,CAAC;AAC7D,QAAI,KAAK,wBAAwB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AACpD,QAAI,IAAI,wBAAwB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAEnD,UAAM,UAAU,MAAM,IAAI,QAAQ,wBAAwB,EAAE,QAAQ,OAAO,CAAC;AAC5E,WAAO,QAAQ,MAAM,EAAE,KAAK,GAAG;AAE/B,UAAM,SAAS,MAAM,IAAI,QAAQ,wBAAwB,EAAE,QAAQ,MAAM,CAAC;AAC1E,WAAO,OAAO,MAAM,EAAE,KAAK,GAAG;AAAA,EAChC,CAAC;AAED,KAAG,qCAAqC,YAAY;AAClD,QAAI,IAAI,KAAK,CAAC;AACd,QAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,UAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,MACrC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,IAAI,QAAQ,cAAc;AAAA,IACvD,CAAC;AACD,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,EAC7B,CAAC;AAED,KAAG,gCAAgC,YAAY;AAC7C,QAAI,IAAI,KAAK,CAAC;AACd,QAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,UAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,MACrC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,QAAQ;AAAA,IACrC,CAAC;AACD,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,EAC7B,CAAC;AAED,KAAG,gCAAgC,YAAY;AAC7C,QAAI,IAAI,KAAK,CAAC;AACd,QAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,UAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,MACrC,QAAQ;AAAA,MACR,SAAS,EAAE,QAAQ,mBAAmB;AAAA,IACxC,CAAC;AACD,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,EAC7B,CAAC;AAED,KAAG,mCAAmC,YAAY;AAChD,QAAI,IAAI,KAAK,EAAE,cAAc,oBAAoB,CAAC,CAAC;AACnD,QAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,UAAM,MAAM,MAAM,IAAI,QAAQ,SAAS,EAAE,QAAQ,OAAO,CAAC;AACzD,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAC3B,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,WAAO,KAAK,MAAM,OAAO,EAAE,KAAK,mBAAmB;AAAA,EACrD,CAAC;AAED,KAAG,wCAAwC,YAAY;AACrD,QAAI,IAAI,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC;AACtC,QAAI,IAAI,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAGpC,UAAM,MAAM,MAAM,IAAI,QAAQ,SAAS,EAAE,QAAQ,OAAO,CAAC;AACzD,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,EAC7B,CAAC;AAED,KAAG,yCAAyC,YAAY;AACtD,QAAI;AAAA,MACF,KAAK;AAAA,QACH,SAAS;AAAA,UACP,EAAE,MAAM,aAAa,SAAS,CAAC,OAAO,MAAM,EAAE;AAAA,UAC9C,EAAE,MAAM,aAAa,SAAS,CAAC,MAAM,EAAE;AAAA,UACvC,EAAE,MAAM,YAAY;AAAA;AAAA,QACtB;AAAA,MACF,CAAC;AAAA,IACH;AAEA,QAAI,IAAI,iBAAiB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAC5C,QAAI,KAAK,iBAAiB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAC7C,QAAI,IAAI,iBAAiB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAC5C,QAAI,KAAK,iBAAiB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAC7C,QAAI,IAAI,iBAAiB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAC5C,QAAI,KAAK,gBAAgB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAG5C,QAAI,MAAM,MAAM,IAAI,QAAQ,iBAAiB,EAAE,QAAQ,MAAM,CAAC;AAC9D,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAE3B,UAAM,MAAM,IAAI,QAAQ,iBAAiB,EAAE,QAAQ,OAAO,CAAC;AAC3D,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAG3B,UAAM,MAAM,IAAI,QAAQ,iBAAiB,EAAE,QAAQ,MAAM,CAAC;AAC1D,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAG3B,UAAM,MAAM,IAAI,QAAQ,iBAAiB,EAAE,QAAQ,OAAO,CAAC;AAC3D,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAG3B,UAAM,MAAM,IAAI,QAAQ,iBAAiB,EAAE,QAAQ,MAAM,CAAC;AAC1D,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAG3B,UAAM,MAAM,IAAI,QAAQ,gBAAgB,EAAE,QAAQ,OAAO,CAAC;AAC1D,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,EAC7B,CAAC;AAED,WAAS,iBAAiB,MAAM;AAC9B,OAAG,iDAAiD,YAAY;AAC9D,UAAI,IAAI,KAAK,EAAE,QAAQ,CAAC,uBAAuB,qBAAqB,EAAE,CAAC,CAAC;AACxE,UAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAGrC,YAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,QACrC,QAAQ;AAAA,QACR,SAAS,EAAE,QAAQ,sBAAsB;AAAA,MAC3C,CAAC;AACD,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAC3B,aAAO,MAAM,IAAI,KAAK,CAAC,EAAE,KAAK,IAAI;AAAA,IACpC,CAAC;AAED,OAAG,oDAAoD,YAAY;AACjE,UAAI,IAAI,KAAK,EAAE,QAAQ,CAAC,uBAAuB,qBAAqB,EAAE,CAAC,CAAC;AACxE,UAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,YAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,QACrC,QAAQ;AAAA,QACR,SAAS,EAAE,QAAQ,sBAAsB;AAAA,MAC3C,CAAC;AACD,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,IAC7B,CAAC;AAED,OAAG,sDAAsD,YAAY;AACnE,UAAI,IAAI,KAAK,EAAE,QAAQ,CAAC,qBAAqB,EAAE,CAAC,CAAC;AACjD,UAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,YAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,QACrC,QAAQ;AAAA,QACR,SAAS,EAAE,QAAQ,wBAAwB;AAAA,MAC7C,CAAC;AACD,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,IAC7B,CAAC;AAED,OAAG,gDAAgD,YAAY;AAC7D,UAAI,IAAI,KAAK,EAAE,QAAQ,CAAC,qBAAqB,EAAE,CAAC,CAAC;AACjD,UAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,YAAM,MAAM,MAAM,IAAI,QAAQ,SAAS,EAAE,QAAQ,OAAO,CAAC;AACzD,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,IAC7B,CAAC;AAED,OAAG,mCAAmC,YAAY;AAChD,UAAI,IAAI,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;AAC5B,UAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,YAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,QACrC,QAAQ;AAAA,QACR,SAAS,EAAE,QAAQ,sBAAsB;AAAA,MAC3C,CAAC;AACD,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,IAC7B,CAAC;AAAA,EACH,CAAC;AAED,WAAS,yBAAyB,MAAM;AACtC,OAAG,+DAA+D,YAAY;AAC5E,UAAI,IAAI,KAAK,EAAE,cAAc,CAAC,eAAe,WAAW,EAAE,CAAC,CAAC;AAC5D,UAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,YAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,QACrC,QAAQ;AAAA,QACR,SAAS,EAAE,kBAAkB,cAAc;AAAA,MAC7C,CAAC;AACD,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAC3B,aAAO,MAAM,IAAI,KAAK,CAAC,EAAE,KAAK,IAAI;AAAA,IACpC,CAAC;AAED,OAAG,kEAAkE,YAAY;AAC/E,UAAI,IAAI,KAAK,EAAE,cAAc,CAAC,eAAe,aAAa,cAAc,EAAE,CAAC,CAAC;AAC5E,UAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,YAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,QACrC,QAAQ;AAAA,QACR,SAAS,EAAE,kBAAkB,eAAe;AAAA,MAC9C,CAAC;AACD,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,IAC7B,CAAC;AAED,OAAG,oEAAoE,YAAY;AACjF,UAAI,IAAI,KAAK,EAAE,cAAc,CAAC,aAAa,EAAE,CAAC,CAAC;AAC/C,UAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,YAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,QACrC,QAAQ;AAAA,QACR,SAAS,EAAE,kBAAkB,YAAY;AAAA,MAC3C,CAAC;AACD,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,IAC7B,CAAC;AAED,OAAG,wDAAwD,YAAY;AACrE,UAAI,IAAI,KAAK,EAAE,cAAc,CAAC,aAAa,EAAE,CAAC,CAAC;AAC/C,UAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,YAAM,MAAM,MAAM,IAAI,QAAQ,SAAS,EAAE,QAAQ,OAAO,CAAC;AACzD,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,IAC7B,CAAC;AAED,OAAG,iDAAiD,YAAY;AAC9D,UAAI,IAAI,KAAK,EAAE,cAAc,CAAC,eAAe,aAAa,QAAQ,cAAc,EAAE,CAAC,CAAC;AACpF,UAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,YAAM,cAAc,CAAC,eAAe,aAAa,QAAQ,cAAc;AAEvE,iBAAW,SAAS,aAAa;AAC/B,cAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,UACrC,QAAQ;AAAA,UACR,SAAS,EAAE,kBAAkB,MAAM;AAAA,QACrC,CAAC;AACD,eAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,MAC7B;AAAA,IACF,CAAC;AAED,OAAG,2CAA2C,YAAY;AACxD,UAAI,IAAI,KAAK,EAAE,cAAc,CAAC,EAAE,CAAC,CAAC;AAClC,UAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,YAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,QACrC,QAAQ;AAAA,QACR,SAAS,EAAE,kBAAkB,cAAc;AAAA,MAC7C,CAAC;AACD,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,IAC7B,CAAC;AAAA,EACH,CAAC;AAED,WAAS,6CAA6C,MAAM;AAC1D,OAAG,kEAAkE,YAAY;AAC/E,UAAI;AAAA,QACF,KAAK;AAAA,UACH,QAAQ,CAAC,qBAAqB;AAAA,UAC9B,cAAc,CAAC,WAAW;AAAA,QAC5B,CAAC;AAAA,MACH;AACA,UAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAGrC,UAAI,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,QACnC,QAAQ;AAAA,QACR,SAAS,EAAE,QAAQ,sBAAsB;AAAA,MAC3C,CAAC;AACD,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAG3B,YAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,QAC/B,QAAQ;AAAA,QACR,SAAS,EAAE,kBAAkB,YAAY;AAAA,MAC3C,CAAC;AACD,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,IAC7B,CAAC;AAED,OAAG,qEAAqE,YAAY;AAClF,UAAI;AAAA,QACF,KAAK;AAAA,UACH,QAAQ,CAAC,qBAAqB;AAAA,UAC9B,cAAc,CAAC,aAAa;AAAA,QAC9B,CAAC;AAAA,MACH;AACA,UAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,YAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,QACrC,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,QAAQ;AAAA,UACR,kBAAkB;AAAA,QACpB;AAAA,MACF,CAAC;AACD,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,IAC7B,CAAC;AAED,OAAG,qEAAqE,YAAY;AAClF,UAAI;AAAA,QACF,KAAK;AAAA,UACH,QAAQ,CAAC,qBAAqB;AAAA,UAC9B,cAAc,CAAC,WAAW;AAAA,UAC1B,SAAS,CAAC,EAAE,MAAM,cAAc,SAAS,CAAC,MAAM,EAAE,CAAC;AAAA,QACrD,CAAC;AAAA,MACH;AAEA,UAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AACrC,UAAI,KAAK,mBAAmB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAC/C,UAAI,KAAK,aAAa,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAGzC,UAAI,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,QACnC,QAAQ;AAAA,QACR,SAAS,EAAE,QAAQ,sBAAsB;AAAA,MAC3C,CAAC;AACD,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAG3B,YAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,QAC/B,QAAQ;AAAA,QACR,SAAS,EAAE,kBAAkB,YAAY;AAAA,MAC3C,CAAC;AACD,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAG3B,YAAM,MAAM,IAAI,QAAQ,mBAAmB,EAAE,QAAQ,OAAO,CAAC;AAC7D,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAG3B,YAAM,MAAM,IAAI,QAAQ,aAAa,EAAE,QAAQ,OAAO,CAAC;AACvD,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,IAC7B,CAAC;AAAA,EACH,CAAC;AACH,CAAC;","names":[]}

package/dist/hono/csrf.cjs

@@ -59,21 +59,23 @@ function csrf(config = {}) {
       }
     }
   }
-  function shouldIgnore(method, path) {
-    if (safeMethods.has(method)) {
-      return true;
-    }
-    const [matchedAll] = router.match(import_router.METHOD_NAME_ALL, path);
-    if (matchedAll.length > 0) {
-      return true;
-    }
-    const [matchedMethod] = router.match(method, path);
-    return matchedMethod.length > 0;
-  }
   return async (c, next) => {
     const method = c.req.method;
     const path = c.req.path;
-    if (shouldIgnore(method, path)) {
+    if (safeMethods.has(method)) {
+      await next();
+      return;
+    }
+    if (config.origin && config.origin.includes(c.req.header("origin") ?? "")) {
+      await next();
+      return;
+    }
+    if (config.secFetchSite && config.secFetchSite.includes(c.req.header("sec-fetch-site") ?? "")) {
+      await next();
+      return;
+    }
+    const [matched] = router.match(method, path);
+    if (matched.length > 0) {
       await next();
       return;
     }

package/dist/hono/csrf.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/hono/csrf.ts"],"sourcesContent":["import { timingSafeEqual } from 'crypto';\nimport { getCookie } from 'hono/cookie';\nimport { METHOD_NAME_ALL } from 'hono/router';\nimport { RegExpRouter } from 'hono/router/reg-exp-router';\nimport { SmartRouter } from 'hono/router/smart-router';\nimport { TrieRouter } from 'hono/router/trie-router';\nimport { Status } from '../error/status';\nimport type { MiddlewareHandler } from 'hono';\n\ntype HTTPMethod = 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH' | 'HEAD' | 'OPTIONS';\n\nexport type CSRFIgnoreRule = string | { path: string; methods?: [HTTPMethod, ...HTTPMethod[]] };\n\nexport interface CSRFConfig {\n  /**\n   * Cookie name for CSRF token\n   * @default 'XSRF-TOKEN'\n   */\n  cookieName?: string;\n\n  /**\n   * Header name for CSRF token\n   * @default 'X-XSRF-TOKEN'\n   */\n  headerName?: string;\n\n  /**\n   * Ignore rules for specific paths and methods\n   * @example\n   * [\n   *   { path: '/api/webhook/*', methods: ['POST'] },\n   *   { path: '/auth/apple/callback' }, // ignores all methods\n   * ]\n   */\n  ignores?: CSRFIgnoreRule[];\n\n  /**\n   * Skip CSRF check for these methods\n   * @default ['GET', 'HEAD', 'OPTIONS']\n   */\n  safeMethods?: HTTPMethod[];\n\n  /**\n   * Custom error message\n   * @default 'CSRF token validation failed'\n   */\n  errorMessage?: string;\n}\n\n/** use timing safe compare to prevent timing attack */\nfunction safeCompare(a: string, b: string): boolean {\n  if (typeof a !== 'string' || typeof b !== 'string') return false;\n  if (a.length === 0 || b.length === 0) return false;\n\n  const bufferA = Buffer.from(a, 'utf-8');\n  const bufferB = Buffer.from(b, 'utf-8');\n  if (bufferA.length !== bufferB.length) return false;\n  return timingSafeEqual(bufferA, bufferB);\n}\n\n/**\n * Create CSRF protection middleware\n *\n * @example\n * ```ts\n * import { Hono } from 'hono';\n * import { csrf } from '@shware/http/hono';\n *\n * const app = new Hono();\n *\n * // basic usage\n * app.use(csrf());\n *\n * // with configuration\n * app.use(csrf({\n *   cookieName: 'csrf-token',\n *   headerName: 'X-CSRF-Token',\n *   ignores: [\n *     { path: '/api/webhook/*', methods: ['POST'] },\n *     { path: '/auth/apple/callback' },\n *   ]\n * }));\n * ```\n */\nexport function csrf(config: CSRFConfig = {}): MiddlewareHandler {\n  const cookieName = config.cookieName ?? 'XSRF-TOKEN';\n  const headerName = config.headerName ?? 'X-XSRF-TOKEN';\n  const safeMethods = new Set(config.safeMethods ?? ['GET', 'HEAD', 'OPTIONS']);\n  const errorMessage = config.errorMessage ?? 'CSRF token validation failed';\n\n  // initialize router for matching ignore rules\n  const router = new SmartRouter<boolean>({\n    routers: [new RegExpRouter(), new TrieRouter()],\n  });\n\n  // register ignore rules\n  if (config.ignores) {\n    for (const rule of config.ignores) {\n      if (typeof rule === 'string') {\n        router.add(METHOD_NAME_ALL, rule, true);\n      } else if (rule.methods && rule.methods.length > 0) {\n        for (const method of rule.methods) {\n          router.add(method, rule.path, true);\n        }\n      } else {\n        // if no methods are specified, ignore all methods\n        router.add(METHOD_NAME_ALL, rule.path, true);\n      }\n    }\n  }\n\n  // check if the request should be ignored\n  function shouldIgnore(method: string, path: string): boolean {\n    if (safeMethods.has(method)) {\n      return true;\n    }\n    const [matchedAll] = router.match(METHOD_NAME_ALL, path);\n    if (matchedAll.length > 0) {\n      return true;\n    }\n    const [matchedMethod] = router.match(method, path);\n    return matchedMethod.length > 0;\n  }\n\n  // return middleware\n  return async (c, next) => {\n    const method = c.req.method;\n    const path = c.req.path;\n\n    if (shouldIgnore(method, path)) {\n      await next();\n      return;\n    }\n\n    const cookieToken = getCookie(c, cookieName);\n    const headerToken = c.req.header(headerName);\n\n    if (!cookieToken || !headerToken) {\n      throw Status.permissionDenied(errorMessage).error();\n    }\n\n    if (!safeCompare(cookieToken, headerToken)) {\n      throw Status.permissionDenied(errorMessage).error();\n    }\n\n    await next();\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oBAAgC;AAChC,oBAA0B;AAC1B,oBAAgC;AAChC,4BAA6B;AAC7B,0BAA4B;AAC5B,yBAA2B;AAC3B,oBAAuB;AA4CvB,SAAS,YAAY,GAAW,GAAoB;AAClD,MAAI,OAAO,MAAM,YAAY,OAAO,MAAM,SAAU,QAAO;AAC3D,MAAI,EAAE,WAAW,KAAK,EAAE,WAAW,EAAG,QAAO;AAE7C,QAAM,UAAU,OAAO,KAAK,GAAG,OAAO;AACtC,QAAM,UAAU,OAAO,KAAK,GAAG,OAAO;AACtC,MAAI,QAAQ,WAAW,QAAQ,OAAQ,QAAO;AAC9C,aAAO,+BAAgB,SAAS,OAAO;AACzC;AA0BO,SAAS,KAAK,SAAqB,CAAC,GAAsB;AAC/D,QAAM,aAAa,OAAO,cAAc;AACxC,QAAM,aAAa,OAAO,cAAc;AACxC,QAAM,cAAc,IAAI,IAAI,OAAO,eAAe,CAAC,OAAO,QAAQ,SAAS,CAAC;AAC5E,QAAM,eAAe,OAAO,gBAAgB;AAG5C,QAAM,SAAS,IAAI,gCAAqB;AAAA,IACtC,SAAS,CAAC,IAAI,mCAAa,GAAG,IAAI,8BAAW,CAAC;AAAA,EAChD,CAAC;AAGD,MAAI,OAAO,SAAS;AAClB,eAAW,QAAQ,OAAO,SAAS;AACjC,UAAI,OAAO,SAAS,UAAU;AAC5B,eAAO,IAAI,+BAAiB,MAAM,IAAI;AAAA,MACxC,WAAW,KAAK,WAAW,KAAK,QAAQ,SAAS,GAAG;AAClD,mBAAW,UAAU,KAAK,SAAS;AACjC,iBAAO,IAAI,QAAQ,KAAK,MAAM,IAAI;AAAA,QACpC;AAAA,MACF,OAAO;AAEL,eAAO,IAAI,+BAAiB,KAAK,MAAM,IAAI;AAAA,MAC7C;AAAA,IACF;AAAA,EACF;AAGA,WAAS,aAAa,QAAgB,MAAuB;AAC3D,QAAI,YAAY,IAAI,MAAM,GAAG;AAC3B,aAAO;AAAA,IACT;AACA,UAAM,CAAC,UAAU,IAAI,OAAO,MAAM,+BAAiB,IAAI;AACvD,QAAI,WAAW,SAAS,GAAG;AACzB,aAAO;AAAA,IACT;AACA,UAAM,CAAC,aAAa,IAAI,OAAO,MAAM,QAAQ,IAAI;AACjD,WAAO,cAAc,SAAS;AAAA,EAChC;AAGA,SAAO,OAAO,GAAG,SAAS;AACxB,UAAM,SAAS,EAAE,IAAI;AACrB,UAAM,OAAO,EAAE,IAAI;AAEnB,QAAI,aAAa,QAAQ,IAAI,GAAG;AAC9B,YAAM,KAAK;AACX;AAAA,IACF;AAEA,UAAM,kBAAc,yBAAU,GAAG,UAAU;AAC3C,UAAM,cAAc,EAAE,IAAI,OAAO,UAAU;AAE3C,QAAI,CAAC,eAAe,CAAC,aAAa;AAChC,YAAM,qBAAO,iBAAiB,YAAY,EAAE,MAAM;AAAA,IACpD;AAEA,QAAI,CAAC,YAAY,aAAa,WAAW,GAAG;AAC1C,YAAM,qBAAO,iBAAiB,YAAY,EAAE,MAAM;AAAA,IACpD;AAEA,UAAM,KAAK;AAAA,EACb;AACF;","names":[]}
+{"version":3,"sources":["../../src/hono/csrf.ts"],"sourcesContent":["import { timingSafeEqual } from 'crypto';\nimport { getCookie } from 'hono/cookie';\nimport { METHOD_NAME_ALL } from 'hono/router';\nimport { RegExpRouter } from 'hono/router/reg-exp-router';\nimport { SmartRouter } from 'hono/router/smart-router';\nimport { TrieRouter } from 'hono/router/trie-router';\nimport { Status } from '../error/status';\nimport type { MiddlewareHandler } from 'hono';\n\ntype HTTPMethod = 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH' | 'HEAD' | 'OPTIONS';\n\nexport type CSRFIgnoreRule = string | { path: string; methods?: [HTTPMethod, ...HTTPMethod[]] };\n\nexport interface CSRFConfig {\n  /**\n   * Cookie name for CSRF token\n   * @default 'XSRF-TOKEN'\n   */\n  cookieName?: string;\n\n  /**\n   * Header name for CSRF token\n   * @default 'X-XSRF-TOKEN'\n   */\n  headerName?: string;\n\n  /**\n   * Ignore rules for specific paths and methods\n   * @example\n   * [\n   *   { path: '/api/webhook/*', methods: ['POST'] },\n   *   { path: '/auth/apple/callback' }, // ignores all methods\n   * ]\n   */\n  ignores?: CSRFIgnoreRule[];\n\n  /**\n   * Skip CSRF check for these methods\n   * @default ['GET', 'HEAD', 'OPTIONS']\n   */\n  safeMethods?: HTTPMethod[];\n\n  /**\n   * Origin allowed to bypass CSRF check\n   * @default undefined\n   */\n  origin?: string[];\n\n  /**\n   * Sec-Fetch-Site allowed to bypass CSRF check\n   * @default undefined\n   */\n  secFetchSite?: Array<'same-origin' | 'same-site' | 'none' | 'cross-origin'>;\n\n  /**\n   * Custom error message\n   * @default 'CSRF token validation failed'\n   */\n  errorMessage?: string;\n}\n\n/** use timing safe compare to prevent timing attack */\nfunction safeCompare(a: string, b: string): boolean {\n  if (typeof a !== 'string' || typeof b !== 'string') return false;\n  if (a.length === 0 || b.length === 0) return false;\n\n  const bufferA = Buffer.from(a, 'utf-8');\n  const bufferB = Buffer.from(b, 'utf-8');\n  if (bufferA.length !== bufferB.length) return false;\n  return timingSafeEqual(bufferA, bufferB);\n}\n\n/**\n * Create CSRF protection middleware\n *\n * @example\n * ```ts\n * import { Hono } from 'hono';\n * import { csrf } from '@shware/http/hono';\n *\n * const app = new Hono();\n *\n * // basic usage\n * app.use(csrf());\n *\n * // with configuration\n * app.use(csrf({\n *   cookieName: 'csrf-token',\n *   headerName: 'X-CSRF-Token',\n *   ignores: [\n *     { path: '/api/webhook/*', methods: ['POST'] },\n *     { path: '/auth/apple/callback' },\n *   ]\n * }));\n * ```\n */\nexport function csrf(config: CSRFConfig = {}): MiddlewareHandler {\n  const cookieName = config.cookieName ?? 'XSRF-TOKEN';\n  const headerName = config.headerName ?? 'X-XSRF-TOKEN';\n  const safeMethods = new Set(config.safeMethods ?? ['GET', 'HEAD', 'OPTIONS']);\n  const errorMessage = config.errorMessage ?? 'CSRF token validation failed';\n\n  // initialize router for matching ignore rules\n  const router = new SmartRouter<boolean>({\n    routers: [new RegExpRouter(), new TrieRouter()],\n  });\n\n  // register ignore rules\n  if (config.ignores) {\n    for (const rule of config.ignores) {\n      if (typeof rule === 'string') {\n        router.add(METHOD_NAME_ALL, rule, true);\n      } else if (rule.methods && rule.methods.length > 0) {\n        for (const method of rule.methods) {\n          router.add(method, rule.path, true);\n        }\n      } else {\n        // if no methods are specified, ignore all methods\n        router.add(METHOD_NAME_ALL, rule.path, true);\n      }\n    }\n  }\n\n  // return middleware\n  return async (c, next) => {\n    const method = c.req.method;\n    const path = c.req.path;\n\n    // check if the request should be ignored\n    // 1. ignore safe methods\n    if (safeMethods.has(method)) {\n      await next();\n      return;\n    }\n\n    // 2. ignore configured origin\n    if (config.origin && config.origin.includes(c.req.header('origin') ?? '')) {\n      await next();\n      return;\n    }\n\n    // 3. ignore configured secFetchSite\n    if (\n      config.secFetchSite &&\n      config.secFetchSite.includes((c.req.header('sec-fetch-site') ?? '') as never)\n    ) {\n      await next();\n      return;\n    }\n\n    // 4. ignore configured ignore rules\n    const [matched] = router.match(method, path);\n    if (matched.length > 0) {\n      await next();\n      return;\n    }\n\n    const cookieToken = getCookie(c, cookieName);\n    const headerToken = c.req.header(headerName);\n\n    if (!cookieToken || !headerToken) {\n      throw Status.permissionDenied(errorMessage).error();\n    }\n\n    if (!safeCompare(cookieToken, headerToken)) {\n      throw Status.permissionDenied(errorMessage).error();\n    }\n\n    await next();\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oBAAgC;AAChC,oBAA0B;AAC1B,oBAAgC;AAChC,4BAA6B;AAC7B,0BAA4B;AAC5B,yBAA2B;AAC3B,oBAAuB;AAwDvB,SAAS,YAAY,GAAW,GAAoB;AAClD,MAAI,OAAO,MAAM,YAAY,OAAO,MAAM,SAAU,QAAO;AAC3D,MAAI,EAAE,WAAW,KAAK,EAAE,WAAW,EAAG,QAAO;AAE7C,QAAM,UAAU,OAAO,KAAK,GAAG,OAAO;AACtC,QAAM,UAAU,OAAO,KAAK,GAAG,OAAO;AACtC,MAAI,QAAQ,WAAW,QAAQ,OAAQ,QAAO;AAC9C,aAAO,+BAAgB,SAAS,OAAO;AACzC;AA0BO,SAAS,KAAK,SAAqB,CAAC,GAAsB;AAC/D,QAAM,aAAa,OAAO,cAAc;AACxC,QAAM,aAAa,OAAO,cAAc;AACxC,QAAM,cAAc,IAAI,IAAI,OAAO,eAAe,CAAC,OAAO,QAAQ,SAAS,CAAC;AAC5E,QAAM,eAAe,OAAO,gBAAgB;AAG5C,QAAM,SAAS,IAAI,gCAAqB;AAAA,IACtC,SAAS,CAAC,IAAI,mCAAa,GAAG,IAAI,8BAAW,CAAC;AAAA,EAChD,CAAC;AAGD,MAAI,OAAO,SAAS;AAClB,eAAW,QAAQ,OAAO,SAAS;AACjC,UAAI,OAAO,SAAS,UAAU;AAC5B,eAAO,IAAI,+BAAiB,MAAM,IAAI;AAAA,MACxC,WAAW,KAAK,WAAW,KAAK,QAAQ,SAAS,GAAG;AAClD,mBAAW,UAAU,KAAK,SAAS;AACjC,iBAAO,IAAI,QAAQ,KAAK,MAAM,IAAI;AAAA,QACpC;AAAA,MACF,OAAO;AAEL,eAAO,IAAI,+BAAiB,KAAK,MAAM,IAAI;AAAA,MAC7C;AAAA,IACF;AAAA,EACF;AAGA,SAAO,OAAO,GAAG,SAAS;AACxB,UAAM,SAAS,EAAE,IAAI;AACrB,UAAM,OAAO,EAAE,IAAI;AAInB,QAAI,YAAY,IAAI,MAAM,GAAG;AAC3B,YAAM,KAAK;AACX;AAAA,IACF;AAGA,QAAI,OAAO,UAAU,OAAO,OAAO,SAAS,EAAE,IAAI,OAAO,QAAQ,KAAK,EAAE,GAAG;AACzE,YAAM,KAAK;AACX;AAAA,IACF;AAGA,QACE,OAAO,gBACP,OAAO,aAAa,SAAU,EAAE,IAAI,OAAO,gBAAgB,KAAK,EAAY,GAC5E;AACA,YAAM,KAAK;AACX;AAAA,IACF;AAGA,UAAM,CAAC,OAAO,IAAI,OAAO,MAAM,QAAQ,IAAI;AAC3C,QAAI,QAAQ,SAAS,GAAG;AACtB,YAAM,KAAK;AACX;AAAA,IACF;AAEA,UAAM,kBAAc,yBAAU,GAAG,UAAU;AAC3C,UAAM,cAAc,EAAE,IAAI,OAAO,UAAU;AAE3C,QAAI,CAAC,eAAe,CAAC,aAAa;AAChC,YAAM,qBAAO,iBAAiB,YAAY,EAAE,MAAM;AAAA,IACpD;AAEA,QAAI,CAAC,YAAY,aAAa,WAAW,GAAG;AAC1C,YAAM,qBAAO,iBAAiB,YAAY,EAAE,MAAM;AAAA,IACpD;AAEA,UAAM,KAAK;AAAA,EACb;AACF;","names":[]}

package/dist/hono/csrf.d.cts

@@ -30,6 +30,16 @@ interface CSRFConfig {
      * @default ['GET', 'HEAD', 'OPTIONS']
      */
     safeMethods?: HTTPMethod[];
+    /**
+     * Origin allowed to bypass CSRF check
+     * @default undefined
+     */
+    origin?: string[];
+    /**
+     * Sec-Fetch-Site allowed to bypass CSRF check
+     * @default undefined
+     */
+    secFetchSite?: Array<'same-origin' | 'same-site' | 'none' | 'cross-origin'>;
     /**
      * Custom error message
      * @default 'CSRF token validation failed'

package/dist/hono/csrf.d.ts

@@ -30,6 +30,16 @@ interface CSRFConfig {
      * @default ['GET', 'HEAD', 'OPTIONS']
      */
     safeMethods?: HTTPMethod[];
+    /**
+     * Origin allowed to bypass CSRF check
+     * @default undefined
+     */
+    origin?: string[];
+    /**
+     * Sec-Fetch-Site allowed to bypass CSRF check
+     * @default undefined
+     */
+    secFetchSite?: Array<'same-origin' | 'same-site' | 'none' | 'cross-origin'>;
     /**
      * Custom error message
      * @default 'CSRF token validation failed'

package/dist/hono/csrf.mjs

@@ -35,21 +35,23 @@ function csrf(config = {}) {
       }
     }
   }
-  function shouldIgnore(method, path) {
-    if (safeMethods.has(method)) {
-      return true;
-    }
-    const [matchedAll] = router.match(METHOD_NAME_ALL, path);
-    if (matchedAll.length > 0) {
-      return true;
-    }
-    const [matchedMethod] = router.match(method, path);
-    return matchedMethod.length > 0;
-  }
   return async (c, next) => {
     const method = c.req.method;
     const path = c.req.path;
-    if (shouldIgnore(method, path)) {
+    if (safeMethods.has(method)) {
+      await next();
+      return;
+    }
+    if (config.origin && config.origin.includes(c.req.header("origin") ?? "")) {
+      await next();
+      return;
+    }
+    if (config.secFetchSite && config.secFetchSite.includes(c.req.header("sec-fetch-site") ?? "")) {
+      await next();
+      return;
+    }
+    const [matched] = router.match(method, path);
+    if (matched.length > 0) {
       await next();
       return;
     }

package/dist/hono/csrf.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/hono/csrf.ts"],"sourcesContent":["import { timingSafeEqual } from 'crypto';\nimport { getCookie } from 'hono/cookie';\nimport { METHOD_NAME_ALL } from 'hono/router';\nimport { RegExpRouter } from 'hono/router/reg-exp-router';\nimport { SmartRouter } from 'hono/router/smart-router';\nimport { TrieRouter } from 'hono/router/trie-router';\nimport { Status } from '../error/status';\nimport type { MiddlewareHandler } from 'hono';\n\ntype HTTPMethod = 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH' | 'HEAD' | 'OPTIONS';\n\nexport type CSRFIgnoreRule = string | { path: string; methods?: [HTTPMethod, ...HTTPMethod[]] };\n\nexport interface CSRFConfig {\n  /**\n   * Cookie name for CSRF token\n   * @default 'XSRF-TOKEN'\n   */\n  cookieName?: string;\n\n  /**\n   * Header name for CSRF token\n   * @default 'X-XSRF-TOKEN'\n   */\n  headerName?: string;\n\n  /**\n   * Ignore rules for specific paths and methods\n   * @example\n   * [\n   *   { path: '/api/webhook/*', methods: ['POST'] },\n   *   { path: '/auth/apple/callback' }, // ignores all methods\n   * ]\n   */\n  ignores?: CSRFIgnoreRule[];\n\n  /**\n   * Skip CSRF check for these methods\n   * @default ['GET', 'HEAD', 'OPTIONS']\n   */\n  safeMethods?: HTTPMethod[];\n\n  /**\n   * Custom error message\n   * @default 'CSRF token validation failed'\n   */\n  errorMessage?: string;\n}\n\n/** use timing safe compare to prevent timing attack */\nfunction safeCompare(a: string, b: string): boolean {\n  if (typeof a !== 'string' || typeof b !== 'string') return false;\n  if (a.length === 0 || b.length === 0) return false;\n\n  const bufferA = Buffer.from(a, 'utf-8');\n  const bufferB = Buffer.from(b, 'utf-8');\n  if (bufferA.length !== bufferB.length) return false;\n  return timingSafeEqual(bufferA, bufferB);\n}\n\n/**\n * Create CSRF protection middleware\n *\n * @example\n * ```ts\n * import { Hono } from 'hono';\n * import { csrf } from '@shware/http/hono';\n *\n * const app = new Hono();\n *\n * // basic usage\n * app.use(csrf());\n *\n * // with configuration\n * app.use(csrf({\n *   cookieName: 'csrf-token',\n *   headerName: 'X-CSRF-Token',\n *   ignores: [\n *     { path: '/api/webhook/*', methods: ['POST'] },\n *     { path: '/auth/apple/callback' },\n *   ]\n * }));\n * ```\n */\nexport function csrf(config: CSRFConfig = {}): MiddlewareHandler {\n  const cookieName = config.cookieName ?? 'XSRF-TOKEN';\n  const headerName = config.headerName ?? 'X-XSRF-TOKEN';\n  const safeMethods = new Set(config.safeMethods ?? ['GET', 'HEAD', 'OPTIONS']);\n  const errorMessage = config.errorMessage ?? 'CSRF token validation failed';\n\n  // initialize router for matching ignore rules\n  const router = new SmartRouter<boolean>({\n    routers: [new RegExpRouter(), new TrieRouter()],\n  });\n\n  // register ignore rules\n  if (config.ignores) {\n    for (const rule of config.ignores) {\n      if (typeof rule === 'string') {\n        router.add(METHOD_NAME_ALL, rule, true);\n      } else if (rule.methods && rule.methods.length > 0) {\n        for (const method of rule.methods) {\n          router.add(method, rule.path, true);\n        }\n      } else {\n        // if no methods are specified, ignore all methods\n        router.add(METHOD_NAME_ALL, rule.path, true);\n      }\n    }\n  }\n\n  // check if the request should be ignored\n  function shouldIgnore(method: string, path: string): boolean {\n    if (safeMethods.has(method)) {\n      return true;\n    }\n    const [matchedAll] = router.match(METHOD_NAME_ALL, path);\n    if (matchedAll.length > 0) {\n      return true;\n    }\n    const [matchedMethod] = router.match(method, path);\n    return matchedMethod.length > 0;\n  }\n\n  // return middleware\n  return async (c, next) => {\n    const method = c.req.method;\n    const path = c.req.path;\n\n    if (shouldIgnore(method, path)) {\n      await next();\n      return;\n    }\n\n    const cookieToken = getCookie(c, cookieName);\n    const headerToken = c.req.header(headerName);\n\n    if (!cookieToken || !headerToken) {\n      throw Status.permissionDenied(errorMessage).error();\n    }\n\n    if (!safeCompare(cookieToken, headerToken)) {\n      throw Status.permissionDenied(errorMessage).error();\n    }\n\n    await next();\n  };\n}\n"],"mappings":";AAAA,SAAS,uBAAuB;AAChC,SAAS,iBAAiB;AAC1B,SAAS,uBAAuB;AAChC,SAAS,oBAAoB;AAC7B,SAAS,mBAAmB;AAC5B,SAAS,kBAAkB;AAC3B,SAAS,cAAc;AA4CvB,SAAS,YAAY,GAAW,GAAoB;AAClD,MAAI,OAAO,MAAM,YAAY,OAAO,MAAM,SAAU,QAAO;AAC3D,MAAI,EAAE,WAAW,KAAK,EAAE,WAAW,EAAG,QAAO;AAE7C,QAAM,UAAU,OAAO,KAAK,GAAG,OAAO;AACtC,QAAM,UAAU,OAAO,KAAK,GAAG,OAAO;AACtC,MAAI,QAAQ,WAAW,QAAQ,OAAQ,QAAO;AAC9C,SAAO,gBAAgB,SAAS,OAAO;AACzC;AA0BO,SAAS,KAAK,SAAqB,CAAC,GAAsB;AAC/D,QAAM,aAAa,OAAO,cAAc;AACxC,QAAM,aAAa,OAAO,cAAc;AACxC,QAAM,cAAc,IAAI,IAAI,OAAO,eAAe,CAAC,OAAO,QAAQ,SAAS,CAAC;AAC5E,QAAM,eAAe,OAAO,gBAAgB;AAG5C,QAAM,SAAS,IAAI,YAAqB;AAAA,IACtC,SAAS,CAAC,IAAI,aAAa,GAAG,IAAI,WAAW,CAAC;AAAA,EAChD,CAAC;AAGD,MAAI,OAAO,SAAS;AAClB,eAAW,QAAQ,OAAO,SAAS;AACjC,UAAI,OAAO,SAAS,UAAU;AAC5B,eAAO,IAAI,iBAAiB,MAAM,IAAI;AAAA,MACxC,WAAW,KAAK,WAAW,KAAK,QAAQ,SAAS,GAAG;AAClD,mBAAW,UAAU,KAAK,SAAS;AACjC,iBAAO,IAAI,QAAQ,KAAK,MAAM,IAAI;AAAA,QACpC;AAAA,MACF,OAAO;AAEL,eAAO,IAAI,iBAAiB,KAAK,MAAM,IAAI;AAAA,MAC7C;AAAA,IACF;AAAA,EACF;AAGA,WAAS,aAAa,QAAgB,MAAuB;AAC3D,QAAI,YAAY,IAAI,MAAM,GAAG;AAC3B,aAAO;AAAA,IACT;AACA,UAAM,CAAC,UAAU,IAAI,OAAO,MAAM,iBAAiB,IAAI;AACvD,QAAI,WAAW,SAAS,GAAG;AACzB,aAAO;AAAA,IACT;AACA,UAAM,CAAC,aAAa,IAAI,OAAO,MAAM,QAAQ,IAAI;AACjD,WAAO,cAAc,SAAS;AAAA,EAChC;AAGA,SAAO,OAAO,GAAG,SAAS;AACxB,UAAM,SAAS,EAAE,IAAI;AACrB,UAAM,OAAO,EAAE,IAAI;AAEnB,QAAI,aAAa,QAAQ,IAAI,GAAG;AAC9B,YAAM,KAAK;AACX;AAAA,IACF;AAEA,UAAM,cAAc,UAAU,GAAG,UAAU;AAC3C,UAAM,cAAc,EAAE,IAAI,OAAO,UAAU;AAE3C,QAAI,CAAC,eAAe,CAAC,aAAa;AAChC,YAAM,OAAO,iBAAiB,YAAY,EAAE,MAAM;AAAA,IACpD;AAEA,QAAI,CAAC,YAAY,aAAa,WAAW,GAAG;AAC1C,YAAM,OAAO,iBAAiB,YAAY,EAAE,MAAM;AAAA,IACpD;AAEA,UAAM,KAAK;AAAA,EACb;AACF;","names":[]}
+{"version":3,"sources":["../../src/hono/csrf.ts"],"sourcesContent":["import { timingSafeEqual } from 'crypto';\nimport { getCookie } from 'hono/cookie';\nimport { METHOD_NAME_ALL } from 'hono/router';\nimport { RegExpRouter } from 'hono/router/reg-exp-router';\nimport { SmartRouter } from 'hono/router/smart-router';\nimport { TrieRouter } from 'hono/router/trie-router';\nimport { Status } from '../error/status';\nimport type { MiddlewareHandler } from 'hono';\n\ntype HTTPMethod = 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH' | 'HEAD' | 'OPTIONS';\n\nexport type CSRFIgnoreRule = string | { path: string; methods?: [HTTPMethod, ...HTTPMethod[]] };\n\nexport interface CSRFConfig {\n  /**\n   * Cookie name for CSRF token\n   * @default 'XSRF-TOKEN'\n   */\n  cookieName?: string;\n\n  /**\n   * Header name for CSRF token\n   * @default 'X-XSRF-TOKEN'\n   */\n  headerName?: string;\n\n  /**\n   * Ignore rules for specific paths and methods\n   * @example\n   * [\n   *   { path: '/api/webhook/*', methods: ['POST'] },\n   *   { path: '/auth/apple/callback' }, // ignores all methods\n   * ]\n   */\n  ignores?: CSRFIgnoreRule[];\n\n  /**\n   * Skip CSRF check for these methods\n   * @default ['GET', 'HEAD', 'OPTIONS']\n   */\n  safeMethods?: HTTPMethod[];\n\n  /**\n   * Origin allowed to bypass CSRF check\n   * @default undefined\n   */\n  origin?: string[];\n\n  /**\n   * Sec-Fetch-Site allowed to bypass CSRF check\n   * @default undefined\n   */\n  secFetchSite?: Array<'same-origin' | 'same-site' | 'none' | 'cross-origin'>;\n\n  /**\n   * Custom error message\n   * @default 'CSRF token validation failed'\n   */\n  errorMessage?: string;\n}\n\n/** use timing safe compare to prevent timing attack */\nfunction safeCompare(a: string, b: string): boolean {\n  if (typeof a !== 'string' || typeof b !== 'string') return false;\n  if (a.length === 0 || b.length === 0) return false;\n\n  const bufferA = Buffer.from(a, 'utf-8');\n  const bufferB = Buffer.from(b, 'utf-8');\n  if (bufferA.length !== bufferB.length) return false;\n  return timingSafeEqual(bufferA, bufferB);\n}\n\n/**\n * Create CSRF protection middleware\n *\n * @example\n * ```ts\n * import { Hono } from 'hono';\n * import { csrf } from '@shware/http/hono';\n *\n * const app = new Hono();\n *\n * // basic usage\n * app.use(csrf());\n *\n * // with configuration\n * app.use(csrf({\n *   cookieName: 'csrf-token',\n *   headerName: 'X-CSRF-Token',\n *   ignores: [\n *     { path: '/api/webhook/*', methods: ['POST'] },\n *     { path: '/auth/apple/callback' },\n *   ]\n * }));\n * ```\n */\nexport function csrf(config: CSRFConfig = {}): MiddlewareHandler {\n  const cookieName = config.cookieName ?? 'XSRF-TOKEN';\n  const headerName = config.headerName ?? 'X-XSRF-TOKEN';\n  const safeMethods = new Set(config.safeMethods ?? ['GET', 'HEAD', 'OPTIONS']);\n  const errorMessage = config.errorMessage ?? 'CSRF token validation failed';\n\n  // initialize router for matching ignore rules\n  const router = new SmartRouter<boolean>({\n    routers: [new RegExpRouter(), new TrieRouter()],\n  });\n\n  // register ignore rules\n  if (config.ignores) {\n    for (const rule of config.ignores) {\n      if (typeof rule === 'string') {\n        router.add(METHOD_NAME_ALL, rule, true);\n      } else if (rule.methods && rule.methods.length > 0) {\n        for (const method of rule.methods) {\n          router.add(method, rule.path, true);\n        }\n      } else {\n        // if no methods are specified, ignore all methods\n        router.add(METHOD_NAME_ALL, rule.path, true);\n      }\n    }\n  }\n\n  // return middleware\n  return async (c, next) => {\n    const method = c.req.method;\n    const path = c.req.path;\n\n    // check if the request should be ignored\n    // 1. ignore safe methods\n    if (safeMethods.has(method)) {\n      await next();\n      return;\n    }\n\n    // 2. ignore configured origin\n    if (config.origin && config.origin.includes(c.req.header('origin') ?? '')) {\n      await next();\n      return;\n    }\n\n    // 3. ignore configured secFetchSite\n    if (\n      config.secFetchSite &&\n      config.secFetchSite.includes((c.req.header('sec-fetch-site') ?? '') as never)\n    ) {\n      await next();\n      return;\n    }\n\n    // 4. ignore configured ignore rules\n    const [matched] = router.match(method, path);\n    if (matched.length > 0) {\n      await next();\n      return;\n    }\n\n    const cookieToken = getCookie(c, cookieName);\n    const headerToken = c.req.header(headerName);\n\n    if (!cookieToken || !headerToken) {\n      throw Status.permissionDenied(errorMessage).error();\n    }\n\n    if (!safeCompare(cookieToken, headerToken)) {\n      throw Status.permissionDenied(errorMessage).error();\n    }\n\n    await next();\n  };\n}\n"],"mappings":";AAAA,SAAS,uBAAuB;AAChC,SAAS,iBAAiB;AAC1B,SAAS,uBAAuB;AAChC,SAAS,oBAAoB;AAC7B,SAAS,mBAAmB;AAC5B,SAAS,kBAAkB;AAC3B,SAAS,cAAc;AAwDvB,SAAS,YAAY,GAAW,GAAoB;AAClD,MAAI,OAAO,MAAM,YAAY,OAAO,MAAM,SAAU,QAAO;AAC3D,MAAI,EAAE,WAAW,KAAK,EAAE,WAAW,EAAG,QAAO;AAE7C,QAAM,UAAU,OAAO,KAAK,GAAG,OAAO;AACtC,QAAM,UAAU,OAAO,KAAK,GAAG,OAAO;AACtC,MAAI,QAAQ,WAAW,QAAQ,OAAQ,QAAO;AAC9C,SAAO,gBAAgB,SAAS,OAAO;AACzC;AA0BO,SAAS,KAAK,SAAqB,CAAC,GAAsB;AAC/D,QAAM,aAAa,OAAO,cAAc;AACxC,QAAM,aAAa,OAAO,cAAc;AACxC,QAAM,cAAc,IAAI,IAAI,OAAO,eAAe,CAAC,OAAO,QAAQ,SAAS,CAAC;AAC5E,QAAM,eAAe,OAAO,gBAAgB;AAG5C,QAAM,SAAS,IAAI,YAAqB;AAAA,IACtC,SAAS,CAAC,IAAI,aAAa,GAAG,IAAI,WAAW,CAAC;AAAA,EAChD,CAAC;AAGD,MAAI,OAAO,SAAS;AAClB,eAAW,QAAQ,OAAO,SAAS;AACjC,UAAI,OAAO,SAAS,UAAU;AAC5B,eAAO,IAAI,iBAAiB,MAAM,IAAI;AAAA,MACxC,WAAW,KAAK,WAAW,KAAK,QAAQ,SAAS,GAAG;AAClD,mBAAW,UAAU,KAAK,SAAS;AACjC,iBAAO,IAAI,QAAQ,KAAK,MAAM,IAAI;AAAA,QACpC;AAAA,MACF,OAAO;AAEL,eAAO,IAAI,iBAAiB,KAAK,MAAM,IAAI;AAAA,MAC7C;AAAA,IACF;AAAA,EACF;AAGA,SAAO,OAAO,GAAG,SAAS;AACxB,UAAM,SAAS,EAAE,IAAI;AACrB,UAAM,OAAO,EAAE,IAAI;AAInB,QAAI,YAAY,IAAI,MAAM,GAAG;AAC3B,YAAM,KAAK;AACX;AAAA,IACF;AAGA,QAAI,OAAO,UAAU,OAAO,OAAO,SAAS,EAAE,IAAI,OAAO,QAAQ,KAAK,EAAE,GAAG;AACzE,YAAM,KAAK;AACX;AAAA,IACF;AAGA,QACE,OAAO,gBACP,OAAO,aAAa,SAAU,EAAE,IAAI,OAAO,gBAAgB,KAAK,EAAY,GAC5E;AACA,YAAM,KAAK;AACX;AAAA,IACF;AAGA,UAAM,CAAC,OAAO,IAAI,OAAO,MAAM,QAAQ,IAAI;AAC3C,QAAI,QAAQ,SAAS,GAAG;AACtB,YAAM,KAAK;AACX;AAAA,IACF;AAEA,UAAM,cAAc,UAAU,GAAG,UAAU;AAC3C,UAAM,cAAc,EAAE,IAAI,OAAO,UAAU;AAE3C,QAAI,CAAC,eAAe,CAAC,aAAa;AAChC,YAAM,OAAO,iBAAiB,YAAY,EAAE,MAAM;AAAA,IACpD;AAEA,QAAI,CAAC,YAAY,aAAa,WAAW,GAAG;AAC1C,YAAM,OAAO,iBAAiB,YAAY,EAAE,MAAM;AAAA,IACpD;AAEA,UAAM,KAAK;AAAA,EACb;AACF;","names":[]}

package/dist/hono/handler.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/hono/handler.ts"],"sourcesContent":["import { Details, DetailType } from '../error/detail';\nimport { Status, StatusError } from '../error/status';\nimport type { AxiosError } from 'axios';\nimport type { Context } from 'hono';\nimport type { RequestIdVariables } from 'hono/request-id';\nimport type { HTTPResponseError, Bindings } from 'hono/types';\nimport type { ContentfulStatusCode } from 'hono/utils/http-status';\n\nexport type Env = {\n  Variables: RequestIdVariables;\n  Bindings?: Bindings;\n};\n\nexport function isAxiosError(payload: unknown): payload is AxiosError {\n  return (\n    payload !== null &&\n    typeof payload === 'object' &&\n    'isAxiosError' in payload &&\n    payload.isAxiosError === true\n  );\n}\n\nexport function errorHandler<E extends Env = never>(\n  error: Error | HTTPResponseError,\n  c: Context<E>\n): Response | Promise<Response> {\n  const requestId = c.get('requestId');\n  const servingData = `${c.req.method}: ${c.req.path}`;\n  const details = Details.new().requestInfo({ requestId, servingData });\n\n  if (error instanceof StatusError) {\n    error.body?.error?.details?.push(...details.list);\n    const badRequest = error.body?.error?.details.find((d) => d.type === DetailType.BAD_REQUEST);\n    if (badRequest) console.warn(servingData, badRequest);\n    return c.json(error.body, error.status as ContentfulStatusCode);\n  }\n\n  if (error instanceof SyntaxError) {\n    if (/^Cannot convert .* to a BigInt$/.test(error.message)) {\n      return Status.invalidArgument(`Invalid number. ${error.message}`).response(details);\n    }\n  }\n\n  if (isAxiosError(error)) {\n    console.error({\n      status: error.status,\n      message: error.message,\n      request: {\n        method: error.config?.method,\n        url: error.config?.url,\n        data: error.config?.data,\n      },\n      response: { data: error.response?.data },\n    });\n    return Status.internal('Axios error').response(details);\n  }\n\n  console.error(`Unknown error: ${servingData}`, error);\n  return Status.internal('Unknown error').response(details);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oBAAoC;AACpC,oBAAoC;AAY7B,SAAS,aAAa,SAAyC;AACpE,SACE,YAAY,QACZ,OAAO,YAAY,YACnB,kBAAkB,WAClB,QAAQ,iBAAiB;AAE7B;AAEO,SAAS,aACd,OACA,GAC8B;AAC9B,QAAM,YAAY,EAAE,IAAI,WAAW;AACnC,QAAM,cAAc,GAAG,EAAE,IAAI,MAAM,KAAK,EAAE,IAAI,IAAI;AAClD,QAAM,UAAU,sBAAQ,IAAI,EAAE,YAAY,EAAE,WAAW,YAAY,CAAC;AAEpE,MAAI,iBAAiB,2BAAa;AAChC,UAAM,MAAM,OAAO,SAAS,KAAK,GAAG,QAAQ,IAAI;AAChD,UAAM,aAAa,MAAM,MAAM,OAAO,QAAQ,KAAK,CAAC,MAAM,EAAE,SAAS,yBAAW,WAAW;AAC3F,QAAI,WAAY,SAAQ,KAAK,aAAa,UAAU;AACpD,WAAO,EAAE,KAAK,MAAM,MAAM,MAAM,MAA8B;AAAA,EAChE;AAEA,MAAI,iBAAiB,aAAa;AAChC,QAAI,kCAAkC,KAAK,MAAM,OAAO,GAAG;AACzD,aAAO,qBAAO,gBAAgB,mBAAmB,MAAM,OAAO,EAAE,EAAE,SAAS,OAAO;AAAA,IACpF;AAAA,EACF;AAEA,MAAI,aAAa,KAAK,GAAG;AACvB,YAAQ,MAAM;AAAA,MACZ,QAAQ,MAAM;AAAA,MACd,SAAS,MAAM;AAAA,MACf,SAAS;AAAA,QACP,QAAQ,MAAM,QAAQ;AAAA,QACtB,KAAK,MAAM,QAAQ;AAAA,QACnB,MAAM,MAAM,QAAQ;AAAA,MACtB;AAAA,MACA,UAAU,EAAE,MAAM,MAAM,UAAU,KAAK;AAAA,IACzC,CAAC;AACD,WAAO,qBAAO,SAAS,aAAa,EAAE,SAAS,OAAO;AAAA,EACxD;AAEA,UAAQ,MAAM,kBAAkB,WAAW,IAAI,KAAK;AACpD,SAAO,qBAAO,SAAS,eAAe,EAAE,SAAS,OAAO;AAC1D;","names":[]}
+{"version":3,"sources":["../../src/hono/handler.ts"],"sourcesContent":["import { DetailType, Details } from '../error/detail';\nimport { Status, StatusError } from '../error/status';\nimport type { AxiosError } from 'axios';\nimport type { Context } from 'hono';\nimport type { RequestIdVariables } from 'hono/request-id';\nimport type { Bindings, HTTPResponseError } from 'hono/types';\nimport type { ContentfulStatusCode } from 'hono/utils/http-status';\n\nexport type Env = {\n  Variables: RequestIdVariables;\n  Bindings?: Bindings;\n};\n\nexport function isAxiosError(payload: unknown): payload is AxiosError {\n  return (\n    payload !== null &&\n    typeof payload === 'object' &&\n    'isAxiosError' in payload &&\n    payload.isAxiosError === true\n  );\n}\n\nexport function errorHandler<E extends Env = never>(\n  error: Error | HTTPResponseError,\n  c: Context<E>\n): Response | Promise<Response> {\n  const requestId = c.get('requestId');\n  const servingData = `${c.req.method}: ${c.req.path}`;\n  const details = Details.new().requestInfo({ requestId, servingData });\n\n  if (error instanceof StatusError) {\n    error.body?.error?.details?.push(...details.list);\n    const badRequest = error.body?.error?.details.find((d) => d.type === DetailType.BAD_REQUEST);\n    if (badRequest) console.warn(servingData, badRequest);\n    return c.json(error.body, error.status as ContentfulStatusCode);\n  }\n\n  if (error instanceof SyntaxError) {\n    if (/^Cannot convert .* to a BigInt$/.test(error.message)) {\n      return Status.invalidArgument(`Invalid number. ${error.message}`).response(details);\n    }\n  }\n\n  if (isAxiosError(error)) {\n    console.error({\n      status: error.status,\n      message: error.message,\n      request: {\n        method: error.config?.method,\n        url: error.config?.url,\n        data: error.config?.data,\n      },\n      response: { data: error.response?.data },\n    });\n    return Status.internal('Axios error').response(details);\n  }\n\n  console.error(`Unknown error: ${servingData}`, error);\n  return Status.internal('Unknown error').response(details);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oBAAoC;AACpC,oBAAoC;AAY7B,SAAS,aAAa,SAAyC;AACpE,SACE,YAAY,QACZ,OAAO,YAAY,YACnB,kBAAkB,WAClB,QAAQ,iBAAiB;AAE7B;AAEO,SAAS,aACd,OACA,GAC8B;AAC9B,QAAM,YAAY,EAAE,IAAI,WAAW;AACnC,QAAM,cAAc,GAAG,EAAE,IAAI,MAAM,KAAK,EAAE,IAAI,IAAI;AAClD,QAAM,UAAU,sBAAQ,IAAI,EAAE,YAAY,EAAE,WAAW,YAAY,CAAC;AAEpE,MAAI,iBAAiB,2BAAa;AAChC,UAAM,MAAM,OAAO,SAAS,KAAK,GAAG,QAAQ,IAAI;AAChD,UAAM,aAAa,MAAM,MAAM,OAAO,QAAQ,KAAK,CAAC,MAAM,EAAE,SAAS,yBAAW,WAAW;AAC3F,QAAI,WAAY,SAAQ,KAAK,aAAa,UAAU;AACpD,WAAO,EAAE,KAAK,MAAM,MAAM,MAAM,MAA8B;AAAA,EAChE;AAEA,MAAI,iBAAiB,aAAa;AAChC,QAAI,kCAAkC,KAAK,MAAM,OAAO,GAAG;AACzD,aAAO,qBAAO,gBAAgB,mBAAmB,MAAM,OAAO,EAAE,EAAE,SAAS,OAAO;AAAA,IACpF;AAAA,EACF;AAEA,MAAI,aAAa,KAAK,GAAG;AACvB,YAAQ,MAAM;AAAA,MACZ,QAAQ,MAAM;AAAA,MACd,SAAS,MAAM;AAAA,MACf,SAAS;AAAA,QACP,QAAQ,MAAM,QAAQ;AAAA,QACtB,KAAK,MAAM,QAAQ;AAAA,QACnB,MAAM,MAAM,QAAQ;AAAA,MACtB;AAAA,MACA,UAAU,EAAE,MAAM,MAAM,UAAU,KAAK;AAAA,IACzC,CAAC;AACD,WAAO,qBAAO,SAAS,aAAa,EAAE,SAAS,OAAO;AAAA,EACxD;AAEA,UAAQ,MAAM,kBAAkB,WAAW,IAAI,KAAK;AACpD,SAAO,qBAAO,SAAS,eAAe,EAAE,SAAS,OAAO;AAC1D;","names":[]}

package/dist/hono/handler.mjs

@@ -1,5 +1,5 @@
 // src/hono/handler.ts
-import { Details, DetailType } from "../error/detail.mjs";
+import { DetailType, Details } from "../error/detail.mjs";
 import { Status, StatusError } from "../error/status.mjs";
 function isAxiosError(payload) {
   return payload !== null && typeof payload === "object" && "isAxiosError" in payload && payload.isAxiosError === true;

package/dist/hono/handler.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/hono/handler.ts"],"sourcesContent":["import { Details, DetailType } from '../error/detail';\nimport { Status, StatusError } from '../error/status';\nimport type { AxiosError } from 'axios';\nimport type { Context } from 'hono';\nimport type { RequestIdVariables } from 'hono/request-id';\nimport type { HTTPResponseError, Bindings } from 'hono/types';\nimport type { ContentfulStatusCode } from 'hono/utils/http-status';\n\nexport type Env = {\n  Variables: RequestIdVariables;\n  Bindings?: Bindings;\n};\n\nexport function isAxiosError(payload: unknown): payload is AxiosError {\n  return (\n    payload !== null &&\n    typeof payload === 'object' &&\n    'isAxiosError' in payload &&\n    payload.isAxiosError === true\n  );\n}\n\nexport function errorHandler<E extends Env = never>(\n  error: Error | HTTPResponseError,\n  c: Context<E>\n): Response | Promise<Response> {\n  const requestId = c.get('requestId');\n  const servingData = `${c.req.method}: ${c.req.path}`;\n  const details = Details.new().requestInfo({ requestId, servingData });\n\n  if (error instanceof StatusError) {\n    error.body?.error?.details?.push(...details.list);\n    const badRequest = error.body?.error?.details.find((d) => d.type === DetailType.BAD_REQUEST);\n    if (badRequest) console.warn(servingData, badRequest);\n    return c.json(error.body, error.status as ContentfulStatusCode);\n  }\n\n  if (error instanceof SyntaxError) {\n    if (/^Cannot convert .* to a BigInt$/.test(error.message)) {\n      return Status.invalidArgument(`Invalid number. ${error.message}`).response(details);\n    }\n  }\n\n  if (isAxiosError(error)) {\n    console.error({\n      status: error.status,\n      message: error.message,\n      request: {\n        method: error.config?.method,\n        url: error.config?.url,\n        data: error.config?.data,\n      },\n      response: { data: error.response?.data },\n    });\n    return Status.internal('Axios error').response(details);\n  }\n\n  console.error(`Unknown error: ${servingData}`, error);\n  return Status.internal('Unknown error').response(details);\n}\n"],"mappings":";AAAA,SAAS,SAAS,kBAAkB;AACpC,SAAS,QAAQ,mBAAmB;AAY7B,SAAS,aAAa,SAAyC;AACpE,SACE,YAAY,QACZ,OAAO,YAAY,YACnB,kBAAkB,WAClB,QAAQ,iBAAiB;AAE7B;AAEO,SAAS,aACd,OACA,GAC8B;AAC9B,QAAM,YAAY,EAAE,IAAI,WAAW;AACnC,QAAM,cAAc,GAAG,EAAE,IAAI,MAAM,KAAK,EAAE,IAAI,IAAI;AAClD,QAAM,UAAU,QAAQ,IAAI,EAAE,YAAY,EAAE,WAAW,YAAY,CAAC;AAEpE,MAAI,iBAAiB,aAAa;AAChC,UAAM,MAAM,OAAO,SAAS,KAAK,GAAG,QAAQ,IAAI;AAChD,UAAM,aAAa,MAAM,MAAM,OAAO,QAAQ,KAAK,CAAC,MAAM,EAAE,SAAS,WAAW,WAAW;AAC3F,QAAI,WAAY,SAAQ,KAAK,aAAa,UAAU;AACpD,WAAO,EAAE,KAAK,MAAM,MAAM,MAAM,MAA8B;AAAA,EAChE;AAEA,MAAI,iBAAiB,aAAa;AAChC,QAAI,kCAAkC,KAAK,MAAM,OAAO,GAAG;AACzD,aAAO,OAAO,gBAAgB,mBAAmB,MAAM,OAAO,EAAE,EAAE,SAAS,OAAO;AAAA,IACpF;AAAA,EACF;AAEA,MAAI,aAAa,KAAK,GAAG;AACvB,YAAQ,MAAM;AAAA,MACZ,QAAQ,MAAM;AAAA,MACd,SAAS,MAAM;AAAA,MACf,SAAS;AAAA,QACP,QAAQ,MAAM,QAAQ;AAAA,QACtB,KAAK,MAAM,QAAQ;AAAA,QACnB,MAAM,MAAM,QAAQ;AAAA,MACtB;AAAA,MACA,UAAU,EAAE,MAAM,MAAM,UAAU,KAAK;AAAA,IACzC,CAAC;AACD,WAAO,OAAO,SAAS,aAAa,EAAE,SAAS,OAAO;AAAA,EACxD;AAEA,UAAQ,MAAM,kBAAkB,WAAW,IAAI,KAAK;AACpD,SAAO,OAAO,SAAS,eAAe,EAAE,SAAS,OAAO;AAC1D;","names":[]}
+{"version":3,"sources":["../../src/hono/handler.ts"],"sourcesContent":["import { DetailType, Details } from '../error/detail';\nimport { Status, StatusError } from '../error/status';\nimport type { AxiosError } from 'axios';\nimport type { Context } from 'hono';\nimport type { RequestIdVariables } from 'hono/request-id';\nimport type { Bindings, HTTPResponseError } from 'hono/types';\nimport type { ContentfulStatusCode } from 'hono/utils/http-status';\n\nexport type Env = {\n  Variables: RequestIdVariables;\n  Bindings?: Bindings;\n};\n\nexport function isAxiosError(payload: unknown): payload is AxiosError {\n  return (\n    payload !== null &&\n    typeof payload === 'object' &&\n    'isAxiosError' in payload &&\n    payload.isAxiosError === true\n  );\n}\n\nexport function errorHandler<E extends Env = never>(\n  error: Error | HTTPResponseError,\n  c: Context<E>\n): Response | Promise<Response> {\n  const requestId = c.get('requestId');\n  const servingData = `${c.req.method}: ${c.req.path}`;\n  const details = Details.new().requestInfo({ requestId, servingData });\n\n  if (error instanceof StatusError) {\n    error.body?.error?.details?.push(...details.list);\n    const badRequest = error.body?.error?.details.find((d) => d.type === DetailType.BAD_REQUEST);\n    if (badRequest) console.warn(servingData, badRequest);\n    return c.json(error.body, error.status as ContentfulStatusCode);\n  }\n\n  if (error instanceof SyntaxError) {\n    if (/^Cannot convert .* to a BigInt$/.test(error.message)) {\n      return Status.invalidArgument(`Invalid number. ${error.message}`).response(details);\n    }\n  }\n\n  if (isAxiosError(error)) {\n    console.error({\n      status: error.status,\n      message: error.message,\n      request: {\n        method: error.config?.method,\n        url: error.config?.url,\n        data: error.config?.data,\n      },\n      response: { data: error.response?.data },\n    });\n    return Status.internal('Axios error').response(details);\n  }\n\n  console.error(`Unknown error: ${servingData}`, error);\n  return Status.internal('Unknown error').response(details);\n}\n"],"mappings":";AAAA,SAAS,YAAY,eAAe;AACpC,SAAS,QAAQ,mBAAmB;AAY7B,SAAS,aAAa,SAAyC;AACpE,SACE,YAAY,QACZ,OAAO,YAAY,YACnB,kBAAkB,WAClB,QAAQ,iBAAiB;AAE7B;AAEO,SAAS,aACd,OACA,GAC8B;AAC9B,QAAM,YAAY,EAAE,IAAI,WAAW;AACnC,QAAM,cAAc,GAAG,EAAE,IAAI,MAAM,KAAK,EAAE,IAAI,IAAI;AAClD,QAAM,UAAU,QAAQ,IAAI,EAAE,YAAY,EAAE,WAAW,YAAY,CAAC;AAEpE,MAAI,iBAAiB,aAAa;AAChC,UAAM,MAAM,OAAO,SAAS,KAAK,GAAG,QAAQ,IAAI;AAChD,UAAM,aAAa,MAAM,MAAM,OAAO,QAAQ,KAAK,CAAC,MAAM,EAAE,SAAS,WAAW,WAAW;AAC3F,QAAI,WAAY,SAAQ,KAAK,aAAa,UAAU;AACpD,WAAO,EAAE,KAAK,MAAM,MAAM,MAAM,MAA8B;AAAA,EAChE;AAEA,MAAI,iBAAiB,aAAa;AAChC,QAAI,kCAAkC,KAAK,MAAM,OAAO,GAAG;AACzD,aAAO,OAAO,gBAAgB,mBAAmB,MAAM,OAAO,EAAE,EAAE,SAAS,OAAO;AAAA,IACpF;AAAA,EACF;AAEA,MAAI,aAAa,KAAK,GAAG;AACvB,YAAQ,MAAM;AAAA,MACZ,QAAQ,MAAM;AAAA,MACd,SAAS,MAAM;AAAA,MACf,SAAS;AAAA,QACP,QAAQ,MAAM,QAAQ;AAAA,QACtB,KAAK,MAAM,QAAQ;AAAA,QACnB,MAAM,MAAM,QAAQ;AAAA,MACtB;AAAA,MACA,UAAU,EAAE,MAAM,MAAM,UAAU,KAAK;AAAA,IACzC,CAAC;AACD,WAAO,OAAO,SAAS,aAAa,EAAE,SAAS,OAAO;AAAA,EACxD;AAEA,UAAQ,MAAM,kBAAkB,WAAW,IAAI,KAAK;AACpD,SAAO,OAAO,SAAS,eAAe,EAAE,SAAS,OAAO;AAC1D;","names":[]}

package/dist/hono/validator.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/hono/validator.ts"],"sourcesContent":["import { validator } from 'hono/validator';\nimport { transform, pipe, string, NEVER } from 'zod/mini';\nimport { Details } from '../error/detail';\nimport { Status } from '../error/status';\nimport type { BadRequest } from '../error/detail';\nimport type { ValidationTargets } from 'hono';\nimport type { output as outputV4, ZodType } from 'zod';\nimport type { output as outputMini, ZodMiniType } from 'zod/mini';\n\nexport function zValidator<S extends ZodType | ZodMiniType>(\n  target: keyof ValidationTargets,\n  schema: S\n) {\n  return validator(target, async (value) => {\n    const result = await schema.safeParseAsync(value);\n    if (result.success) return result.data as S extends ZodType ? outputV4<S> : outputMini<S>;\n\n    const fieldViolations: BadRequest['fieldViolations'] = result.error.issues.map(\n      ({ path, message }) => ({ field: path.join('.'), description: message })\n    );\n    const details = Details.new().badRequest({ fieldViolations });\n    throw Status.invalidArgument().error(details);\n  });\n}\n\nexport const bigintId = pipe(\n  string(),\n  transform((input, ctx) => {\n    if (!/^(0|[1-9]\\d{0,19})$/.test(input)) {\n      const message = `Invalid bigint id: ${input}`;\n      ctx.issues.push({ code: 'custom', input, message });\n      return NEVER;\n    }\n    try {\n      return BigInt(input);\n    } catch {\n      const message = `Parse bigint id: ${input} failed`;\n      ctx.issues.push({ code: 'custom', input, message });\n      return NEVER;\n    }\n  })\n);\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,uBAA0B;AAC1B,kBAA+C;AAC/C,oBAAwB;AACxB,oBAAuB;AAMhB,SAAS,WACd,QACA,QACA;AACA,aAAO,4BAAU,QAAQ,OAAO,UAAU;AACxC,UAAM,SAAS,MAAM,OAAO,eAAe,KAAK;AAChD,QAAI,OAAO,QAAS,QAAO,OAAO;AAElC,UAAM,kBAAiD,OAAO,MAAM,OAAO;AAAA,MACzE,CAAC,EAAE,MAAM,QAAQ,OAAO,EAAE,OAAO,KAAK,KAAK,GAAG,GAAG,aAAa,QAAQ;AAAA,IACxE;AACA,UAAM,UAAU,sBAAQ,IAAI,EAAE,WAAW,EAAE,gBAAgB,CAAC;AAC5D,UAAM,qBAAO,gBAAgB,EAAE,MAAM,OAAO;AAAA,EAC9C,CAAC;AACH;AAEO,IAAM,eAAW;AAAA,MACtB,oBAAO;AAAA,MACP,uBAAU,CAAC,OAAO,QAAQ;AACxB,QAAI,CAAC,sBAAsB,KAAK,KAAK,GAAG;AACtC,YAAM,UAAU,sBAAsB,KAAK;AAC3C,UAAI,OAAO,KAAK,EAAE,MAAM,UAAU,OAAO,QAAQ,CAAC;AAClD,aAAO;AAAA,IACT;AACA,QAAI;AACF,aAAO,OAAO,KAAK;AAAA,IACrB,QAAQ;AACN,YAAM,UAAU,oBAAoB,KAAK;AACzC,UAAI,OAAO,KAAK,EAAE,MAAM,UAAU,OAAO,QAAQ,CAAC;AAClD,aAAO;AAAA,IACT;AAAA,EACF,CAAC;AACH;","names":[]}
+{"version":3,"sources":["../../src/hono/validator.ts"],"sourcesContent":["import { validator } from 'hono/validator';\nimport { NEVER, pipe, string, transform } from 'zod/mini';\nimport { Details } from '../error/detail';\nimport { Status } from '../error/status';\nimport type { BadRequest } from '../error/detail';\nimport type { ValidationTargets } from 'hono';\nimport type { ZodType, output as outputV4 } from 'zod';\nimport type { ZodMiniType, output as outputMini } from 'zod/mini';\n\nexport function zValidator<S extends ZodType | ZodMiniType>(\n  target: keyof ValidationTargets,\n  schema: S\n) {\n  return validator(target, async (value) => {\n    const result = await schema.safeParseAsync(value);\n    if (result.success) return result.data as S extends ZodType ? outputV4<S> : outputMini<S>;\n\n    const fieldViolations: BadRequest['fieldViolations'] = result.error.issues.map(\n      ({ path, message }) => ({ field: path.join('.'), description: message })\n    );\n    const details = Details.new().badRequest({ fieldViolations });\n    throw Status.invalidArgument().error(details);\n  });\n}\n\nexport const bigintId = pipe(\n  string(),\n  transform((input, ctx) => {\n    if (!/^(0|[1-9]\\d{0,19})$/.test(input)) {\n      const message = `Invalid bigint id: ${input}`;\n      ctx.issues.push({ code: 'custom', input, message });\n      return NEVER;\n    }\n    try {\n      return BigInt(input);\n    } catch {\n      const message = `Parse bigint id: ${input} failed`;\n      ctx.issues.push({ code: 'custom', input, message });\n      return NEVER;\n    }\n  })\n);\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,uBAA0B;AAC1B,kBAA+C;AAC/C,oBAAwB;AACxB,oBAAuB;AAMhB,SAAS,WACd,QACA,QACA;AACA,aAAO,4BAAU,QAAQ,OAAO,UAAU;AACxC,UAAM,SAAS,MAAM,OAAO,eAAe,KAAK;AAChD,QAAI,OAAO,QAAS,QAAO,OAAO;AAElC,UAAM,kBAAiD,OAAO,MAAM,OAAO;AAAA,MACzE,CAAC,EAAE,MAAM,QAAQ,OAAO,EAAE,OAAO,KAAK,KAAK,GAAG,GAAG,aAAa,QAAQ;AAAA,IACxE;AACA,UAAM,UAAU,sBAAQ,IAAI,EAAE,WAAW,EAAE,gBAAgB,CAAC;AAC5D,UAAM,qBAAO,gBAAgB,EAAE,MAAM,OAAO;AAAA,EAC9C,CAAC;AACH;AAEO,IAAM,eAAW;AAAA,MACtB,oBAAO;AAAA,MACP,uBAAU,CAAC,OAAO,QAAQ;AACxB,QAAI,CAAC,sBAAsB,KAAK,KAAK,GAAG;AACtC,YAAM,UAAU,sBAAsB,KAAK;AAC3C,UAAI,OAAO,KAAK,EAAE,MAAM,UAAU,OAAO,QAAQ,CAAC;AAClD,aAAO;AAAA,IACT;AACA,QAAI;AACF,aAAO,OAAO,KAAK;AAAA,IACrB,QAAQ;AACN,YAAM,UAAU,oBAAoB,KAAK;AACzC,UAAI,OAAO,KAAK,EAAE,MAAM,UAAU,OAAO,QAAQ,CAAC;AAClD,aAAO;AAAA,IACT;AAAA,EACF,CAAC;AACH;","names":[]}

package/dist/hono/validator.mjs

@@ -1,6 +1,6 @@
 // src/hono/validator.ts
 import { validator } from "hono/validator";
-import { transform, pipe, string, NEVER } from "zod/mini";
+import { NEVER, pipe, string, transform } from "zod/mini";
 import { Details } from "../error/detail.mjs";
 import { Status } from "../error/status.mjs";
 function zValidator(target, schema) {

package/dist/hono/validator.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/hono/validator.ts"],"sourcesContent":["import { validator } from 'hono/validator';\nimport { transform, pipe, string, NEVER } from 'zod/mini';\nimport { Details } from '../error/detail';\nimport { Status } from '../error/status';\nimport type { BadRequest } from '../error/detail';\nimport type { ValidationTargets } from 'hono';\nimport type { output as outputV4, ZodType } from 'zod';\nimport type { output as outputMini, ZodMiniType } from 'zod/mini';\n\nexport function zValidator<S extends ZodType | ZodMiniType>(\n  target: keyof ValidationTargets,\n  schema: S\n) {\n  return validator(target, async (value) => {\n    const result = await schema.safeParseAsync(value);\n    if (result.success) return result.data as S extends ZodType ? outputV4<S> : outputMini<S>;\n\n    const fieldViolations: BadRequest['fieldViolations'] = result.error.issues.map(\n      ({ path, message }) => ({ field: path.join('.'), description: message })\n    );\n    const details = Details.new().badRequest({ fieldViolations });\n    throw Status.invalidArgument().error(details);\n  });\n}\n\nexport const bigintId = pipe(\n  string(),\n  transform((input, ctx) => {\n    if (!/^(0|[1-9]\\d{0,19})$/.test(input)) {\n      const message = `Invalid bigint id: ${input}`;\n      ctx.issues.push({ code: 'custom', input, message });\n      return NEVER;\n    }\n    try {\n      return BigInt(input);\n    } catch {\n      const message = `Parse bigint id: ${input} failed`;\n      ctx.issues.push({ code: 'custom', input, message });\n      return NEVER;\n    }\n  })\n);\n"],"mappings":";AAAA,SAAS,iBAAiB;AAC1B,SAAS,WAAW,MAAM,QAAQ,aAAa;AAC/C,SAAS,eAAe;AACxB,SAAS,cAAc;AAMhB,SAAS,WACd,QACA,QACA;AACA,SAAO,UAAU,QAAQ,OAAO,UAAU;AACxC,UAAM,SAAS,MAAM,OAAO,eAAe,KAAK;AAChD,QAAI,OAAO,QAAS,QAAO,OAAO;AAElC,UAAM,kBAAiD,OAAO,MAAM,OAAO;AAAA,MACzE,CAAC,EAAE,MAAM,QAAQ,OAAO,EAAE,OAAO,KAAK,KAAK,GAAG,GAAG,aAAa,QAAQ;AAAA,IACxE;AACA,UAAM,UAAU,QAAQ,IAAI,EAAE,WAAW,EAAE,gBAAgB,CAAC;AAC5D,UAAM,OAAO,gBAAgB,EAAE,MAAM,OAAO;AAAA,EAC9C,CAAC;AACH;AAEO,IAAM,WAAW;AAAA,EACtB,OAAO;AAAA,EACP,UAAU,CAAC,OAAO,QAAQ;AACxB,QAAI,CAAC,sBAAsB,KAAK,KAAK,GAAG;AACtC,YAAM,UAAU,sBAAsB,KAAK;AAC3C,UAAI,OAAO,KAAK,EAAE,MAAM,UAAU,OAAO,QAAQ,CAAC;AAClD,aAAO;AAAA,IACT;AACA,QAAI;AACF,aAAO,OAAO,KAAK;AAAA,IACrB,QAAQ;AACN,YAAM,UAAU,oBAAoB,KAAK;AACzC,UAAI,OAAO,KAAK,EAAE,MAAM,UAAU,OAAO,QAAQ,CAAC;AAClD,aAAO;AAAA,IACT;AAAA,EACF,CAAC;AACH;","names":[]}
+{"version":3,"sources":["../../src/hono/validator.ts"],"sourcesContent":["import { validator } from 'hono/validator';\nimport { NEVER, pipe, string, transform } from 'zod/mini';\nimport { Details } from '../error/detail';\nimport { Status } from '../error/status';\nimport type { BadRequest } from '../error/detail';\nimport type { ValidationTargets } from 'hono';\nimport type { ZodType, output as outputV4 } from 'zod';\nimport type { ZodMiniType, output as outputMini } from 'zod/mini';\n\nexport function zValidator<S extends ZodType | ZodMiniType>(\n  target: keyof ValidationTargets,\n  schema: S\n) {\n  return validator(target, async (value) => {\n    const result = await schema.safeParseAsync(value);\n    if (result.success) return result.data as S extends ZodType ? outputV4<S> : outputMini<S>;\n\n    const fieldViolations: BadRequest['fieldViolations'] = result.error.issues.map(\n      ({ path, message }) => ({ field: path.join('.'), description: message })\n    );\n    const details = Details.new().badRequest({ fieldViolations });\n    throw Status.invalidArgument().error(details);\n  });\n}\n\nexport const bigintId = pipe(\n  string(),\n  transform((input, ctx) => {\n    if (!/^(0|[1-9]\\d{0,19})$/.test(input)) {\n      const message = `Invalid bigint id: ${input}`;\n      ctx.issues.push({ code: 'custom', input, message });\n      return NEVER;\n    }\n    try {\n      return BigInt(input);\n    } catch {\n      const message = `Parse bigint id: ${input} failed`;\n      ctx.issues.push({ code: 'custom', input, message });\n      return NEVER;\n    }\n  })\n);\n"],"mappings":";AAAA,SAAS,iBAAiB;AAC1B,SAAS,OAAO,MAAM,QAAQ,iBAAiB;AAC/C,SAAS,eAAe;AACxB,SAAS,cAAc;AAMhB,SAAS,WACd,QACA,QACA;AACA,SAAO,UAAU,QAAQ,OAAO,UAAU;AACxC,UAAM,SAAS,MAAM,OAAO,eAAe,KAAK;AAChD,QAAI,OAAO,QAAS,QAAO,OAAO;AAElC,UAAM,kBAAiD,OAAO,MAAM,OAAO;AAAA,MACzE,CAAC,EAAE,MAAM,QAAQ,OAAO,EAAE,OAAO,KAAK,KAAK,GAAG,GAAG,aAAa,QAAQ;AAAA,IACxE;AACA,UAAM,UAAU,QAAQ,IAAI,EAAE,WAAW,EAAE,gBAAgB,CAAC;AAC5D,UAAM,OAAO,gBAAgB,EAAE,MAAM,OAAO;AAAA,EAC9C,CAAC;AACH;AAEO,IAAM,WAAW;AAAA,EACtB,OAAO;AAAA,EACP,UAAU,CAAC,OAAO,QAAQ;AACxB,QAAI,CAAC,sBAAsB,KAAK,KAAK,GAAG;AACtC,YAAM,UAAU,sBAAsB,KAAK;AAC3C,UAAI,OAAO,KAAK,EAAE,MAAM,UAAU,OAAO,QAAQ,CAAC;AAClD,aAAO;AAAA,IACT;AACA,QAAI;AACF,aAAO,OAAO,KAAK;AAAA,IACrB,QAAQ;AACN,YAAM,UAAU,oBAAoB,KAAK;AACzC,UAAI,OAAO,KAAK,EAAE,MAAM,UAAU,OAAO,QAAQ,CAAC;AAClD,aAAO;AAAA,IACT;AAAA,EACF,CAAC;AACH;","names":[]}

package/dist/response.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/response.ts"],"sourcesContent":["import { object, string, coerce, optional, int, minimum, maximum, _default } from 'zod/mini';\nimport { hasText } from './utils/string';\n\n// eslint-disable-next-line @typescript-eslint/no-empty-object-type\nexport type Empty = {};\nexport type EntityId = string | number;\nexport type Entity = { id: EntityId };\n\nexport type Response<T = never> = { data: T };\n\nexport type InitParams = { limit: number; parent?: string };\nexport type NextParams = { limit: number; parent?: string; next: string };\nexport type PrevParams = { limit: number; parent?: string; prev: string };\nexport type PageParams = { limit: number; prev?: string; next?: string };\nexport type ParentPageParams = { limit: number; parent: string; prev?: string; next?: string };\nexport type Page<T = never> = { data: T[]; paging: { next: string; prev: string } };\n\nexport function pageParamsSchema(max: number = 100, defaultLimit: number = 20) {\n  return object({\n    limit: _default(coerce.number().check(int(), minimum(1), maximum(max)), defaultLimit),\n    prev: optional(string()),\n    next: optional(string()),\n  });\n}\n\nexport const Cursor = {\n  of(prev: bigint | number | string | undefined, next: bigint | number | string | undefined) {\n    return { prev: prev ? this.encode(prev) : '', next: next ? this.encode(next) : '' };\n  },\n  empty() {\n    return { prev: '', next: '' };\n  },\n  encode(id: bigint | number | string): string {\n    return Buffer.from(id.toString(), 'utf-8').toString('base64');\n  },\n  decode<T extends 'bigint' | 'number' | 'string' = 'bigint'>(\n    token: string,\n    type: T = 'bigint' as T\n  ): T extends 'bigint' ? bigint : T extends 'number' ? number : string {\n    const value = Buffer.from(token, 'base64').toString('utf-8');\n    if (type === 'bigint')\n      return BigInt(value) as T extends 'bigint' ? bigint : T extends 'number' ? number : string;\n    if (type === 'number')\n      return Number(value) as T extends 'bigint' ? bigint : T extends 'number' ? number : string;\n    return value as T extends 'bigint' ? bigint : T extends 'number' ? number : string;\n  },\n};\n\nexport const initialPageParam: Omit<PageParams, 'limit'> = { next: '', prev: '' };\n\nexport function getPreviousPageParam<T = never>(first: Page<T>): Omit<PageParams, 'limit'> | null {\n  return hasText(first.paging.prev) ? { next: '', prev: first.paging.prev } : null;\n}\n\nexport function getNextPageParam<T = never>(last: Page<T>): Omit<PageParams, 'limit'> | null {\n  return hasText(last.paging.next) ? { next: last.paging.next, prev: '' } : null;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kBAAkF;AAClF,oBAAwB;AAgBjB,SAAS,iBAAiB,MAAc,KAAK,eAAuB,IAAI;AAC7E,aAAO,oBAAO;AAAA,IACZ,WAAO,sBAAS,mBAAO,OAAO,EAAE,UAAM,iBAAI,OAAG,qBAAQ,CAAC,OAAG,qBAAQ,GAAG,CAAC,GAAG,YAAY;AAAA,IACpF,UAAM,0BAAS,oBAAO,CAAC;AAAA,IACvB,UAAM,0BAAS,oBAAO,CAAC;AAAA,EACzB,CAAC;AACH;AAEO,IAAM,SAAS;AAAA,EACpB,GAAG,MAA4C,MAA4C;AACzF,WAAO,EAAE,MAAM,OAAO,KAAK,OAAO,IAAI,IAAI,IAAI,MAAM,OAAO,KAAK,OAAO,IAAI,IAAI,GAAG;AAAA,EACpF;AAAA,EACA,QAAQ;AACN,WAAO,EAAE,MAAM,IAAI,MAAM,GAAG;AAAA,EAC9B;AAAA,EACA,OAAO,IAAsC;AAC3C,WAAO,OAAO,KAAK,GAAG,SAAS,GAAG,OAAO,EAAE,SAAS,QAAQ;AAAA,EAC9D;AAAA,EACA,OACE,OACA,OAAU,UAC0D;AACpE,UAAM,QAAQ,OAAO,KAAK,OAAO,QAAQ,EAAE,SAAS,OAAO;AAC3D,QAAI,SAAS;AACX,aAAO,OAAO,KAAK;AACrB,QAAI,SAAS;AACX,aAAO,OAAO,KAAK;AACrB,WAAO;AAAA,EACT;AACF;AAEO,IAAM,mBAA8C,EAAE,MAAM,IAAI,MAAM,GAAG;AAEzE,SAAS,qBAAgC,OAAkD;AAChG,aAAO,uBAAQ,MAAM,OAAO,IAAI,IAAI,EAAE,MAAM,IAAI,MAAM,MAAM,OAAO,KAAK,IAAI;AAC9E;AAEO,SAAS,iBAA4B,MAAiD;AAC3F,aAAO,uBAAQ,KAAK,OAAO,IAAI,IAAI,EAAE,MAAM,KAAK,OAAO,MAAM,MAAM,GAAG,IAAI;AAC5E;","names":[]}
+{"version":3,"sources":["../src/response.ts"],"sourcesContent":["import { _default, coerce, int, maximum, minimum, object, optional, string } from 'zod/mini';\nimport { hasText } from './utils/string';\n\n// eslint-disable-next-line @typescript-eslint/no-empty-object-type\nexport type Empty = {};\nexport type EntityId = string | number;\nexport type Entity = { id: EntityId };\n\nexport type Response<T = never> = { data: T };\n\nexport type InitParams = { limit: number; parent?: string };\nexport type NextParams = { limit: number; parent?: string; next: string };\nexport type PrevParams = { limit: number; parent?: string; prev: string };\nexport type PageParams = { limit: number; prev?: string; next?: string };\nexport type ParentPageParams = { limit: number; parent: string; prev?: string; next?: string };\nexport type Page<T = never> = { data: T[]; paging: { next: string; prev: string } };\n\nexport function pageParamsSchema(max: number = 100, defaultLimit: number = 20) {\n  return object({\n    limit: _default(coerce.number().check(int(), minimum(1), maximum(max)), defaultLimit),\n    prev: optional(string()),\n    next: optional(string()),\n  });\n}\n\nexport const Cursor = {\n  of(prev: bigint | number | string | undefined, next: bigint | number | string | undefined) {\n    return { prev: prev ? this.encode(prev) : '', next: next ? this.encode(next) : '' };\n  },\n  empty() {\n    return { prev: '', next: '' };\n  },\n  encode(id: bigint | number | string): string {\n    return Buffer.from(id.toString(), 'utf-8').toString('base64');\n  },\n  decode<T extends 'bigint' | 'number' | 'string' = 'bigint'>(\n    token: string,\n    type: T = 'bigint' as T\n  ): T extends 'bigint' ? bigint : T extends 'number' ? number : string {\n    const value = Buffer.from(token, 'base64').toString('utf-8');\n    if (type === 'bigint')\n      return BigInt(value) as T extends 'bigint' ? bigint : T extends 'number' ? number : string;\n    if (type === 'number')\n      return Number(value) as T extends 'bigint' ? bigint : T extends 'number' ? number : string;\n    return value as T extends 'bigint' ? bigint : T extends 'number' ? number : string;\n  },\n};\n\nexport const initialPageParam: Omit<PageParams, 'limit'> = { next: '', prev: '' };\n\nexport function getPreviousPageParam<T = never>(first: Page<T>): Omit<PageParams, 'limit'> | null {\n  return hasText(first.paging.prev) ? { next: '', prev: first.paging.prev } : null;\n}\n\nexport function getNextPageParam<T = never>(last: Page<T>): Omit<PageParams, 'limit'> | null {\n  return hasText(last.paging.next) ? { next: last.paging.next, prev: '' } : null;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kBAAkF;AAClF,oBAAwB;AAgBjB,SAAS,iBAAiB,MAAc,KAAK,eAAuB,IAAI;AAC7E,aAAO,oBAAO;AAAA,IACZ,WAAO,sBAAS,mBAAO,OAAO,EAAE,UAAM,iBAAI,OAAG,qBAAQ,CAAC,OAAG,qBAAQ,GAAG,CAAC,GAAG,YAAY;AAAA,IACpF,UAAM,0BAAS,oBAAO,CAAC;AAAA,IACvB,UAAM,0BAAS,oBAAO,CAAC;AAAA,EACzB,CAAC;AACH;AAEO,IAAM,SAAS;AAAA,EACpB,GAAG,MAA4C,MAA4C;AACzF,WAAO,EAAE,MAAM,OAAO,KAAK,OAAO,IAAI,IAAI,IAAI,MAAM,OAAO,KAAK,OAAO,IAAI,IAAI,GAAG;AAAA,EACpF;AAAA,EACA,QAAQ;AACN,WAAO,EAAE,MAAM,IAAI,MAAM,GAAG;AAAA,EAC9B;AAAA,EACA,OAAO,IAAsC;AAC3C,WAAO,OAAO,KAAK,GAAG,SAAS,GAAG,OAAO,EAAE,SAAS,QAAQ;AAAA,EAC9D;AAAA,EACA,OACE,OACA,OAAU,UAC0D;AACpE,UAAM,QAAQ,OAAO,KAAK,OAAO,QAAQ,EAAE,SAAS,OAAO;AAC3D,QAAI,SAAS;AACX,aAAO,OAAO,KAAK;AACrB,QAAI,SAAS;AACX,aAAO,OAAO,KAAK;AACrB,WAAO;AAAA,EACT;AACF;AAEO,IAAM,mBAA8C,EAAE,MAAM,IAAI,MAAM,GAAG;AAEzE,SAAS,qBAAgC,OAAkD;AAChG,aAAO,uBAAQ,MAAM,OAAO,IAAI,IAAI,EAAE,MAAM,IAAI,MAAM,MAAM,OAAO,KAAK,IAAI;AAC9E;AAEO,SAAS,iBAA4B,MAAiD;AAC3F,aAAO,uBAAQ,KAAK,OAAO,IAAI,IAAI,EAAE,MAAM,KAAK,OAAO,MAAM,MAAM,GAAG,IAAI;AAC5E;","names":[]}

package/dist/response.mjs

@@ -1,5 +1,5 @@
 // src/response.ts
-import { object, string, coerce, optional, int, minimum, maximum, _default } from "zod/mini";
+import { _default, coerce, int, maximum, minimum, object, optional, string } from "zod/mini";
 import { hasText } from "./utils/string.mjs";
 function pageParamsSchema(max = 100, defaultLimit = 20) {
   return object({

package/dist/response.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/response.ts"],"sourcesContent":["import { object, string, coerce, optional, int, minimum, maximum, _default } from 'zod/mini';\nimport { hasText } from './utils/string';\n\n// eslint-disable-next-line @typescript-eslint/no-empty-object-type\nexport type Empty = {};\nexport type EntityId = string | number;\nexport type Entity = { id: EntityId };\n\nexport type Response<T = never> = { data: T };\n\nexport type InitParams = { limit: number; parent?: string };\nexport type NextParams = { limit: number; parent?: string; next: string };\nexport type PrevParams = { limit: number; parent?: string; prev: string };\nexport type PageParams = { limit: number; prev?: string; next?: string };\nexport type ParentPageParams = { limit: number; parent: string; prev?: string; next?: string };\nexport type Page<T = never> = { data: T[]; paging: { next: string; prev: string } };\n\nexport function pageParamsSchema(max: number = 100, defaultLimit: number = 20) {\n  return object({\n    limit: _default(coerce.number().check(int(), minimum(1), maximum(max)), defaultLimit),\n    prev: optional(string()),\n    next: optional(string()),\n  });\n}\n\nexport const Cursor = {\n  of(prev: bigint | number | string | undefined, next: bigint | number | string | undefined) {\n    return { prev: prev ? this.encode(prev) : '', next: next ? this.encode(next) : '' };\n  },\n  empty() {\n    return { prev: '', next: '' };\n  },\n  encode(id: bigint | number | string): string {\n    return Buffer.from(id.toString(), 'utf-8').toString('base64');\n  },\n  decode<T extends 'bigint' | 'number' | 'string' = 'bigint'>(\n    token: string,\n    type: T = 'bigint' as T\n  ): T extends 'bigint' ? bigint : T extends 'number' ? number : string {\n    const value = Buffer.from(token, 'base64').toString('utf-8');\n    if (type === 'bigint')\n      return BigInt(value) as T extends 'bigint' ? bigint : T extends 'number' ? number : string;\n    if (type === 'number')\n      return Number(value) as T extends 'bigint' ? bigint : T extends 'number' ? number : string;\n    return value as T extends 'bigint' ? bigint : T extends 'number' ? number : string;\n  },\n};\n\nexport const initialPageParam: Omit<PageParams, 'limit'> = { next: '', prev: '' };\n\nexport function getPreviousPageParam<T = never>(first: Page<T>): Omit<PageParams, 'limit'> | null {\n  return hasText(first.paging.prev) ? { next: '', prev: first.paging.prev } : null;\n}\n\nexport function getNextPageParam<T = never>(last: Page<T>): Omit<PageParams, 'limit'> | null {\n  return hasText(last.paging.next) ? { next: last.paging.next, prev: '' } : null;\n}\n"],"mappings":";AAAA,SAAS,QAAQ,QAAQ,QAAQ,UAAU,KAAK,SAAS,SAAS,gBAAgB;AAClF,SAAS,eAAe;AAgBjB,SAAS,iBAAiB,MAAc,KAAK,eAAuB,IAAI;AAC7E,SAAO,OAAO;AAAA,IACZ,OAAO,SAAS,OAAO,OAAO,EAAE,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,QAAQ,GAAG,CAAC,GAAG,YAAY;AAAA,IACpF,MAAM,SAAS,OAAO,CAAC;AAAA,IACvB,MAAM,SAAS,OAAO,CAAC;AAAA,EACzB,CAAC;AACH;AAEO,IAAM,SAAS;AAAA,EACpB,GAAG,MAA4C,MAA4C;AACzF,WAAO,EAAE,MAAM,OAAO,KAAK,OAAO,IAAI,IAAI,IAAI,MAAM,OAAO,KAAK,OAAO,IAAI,IAAI,GAAG;AAAA,EACpF;AAAA,EACA,QAAQ;AACN,WAAO,EAAE,MAAM,IAAI,MAAM,GAAG;AAAA,EAC9B;AAAA,EACA,OAAO,IAAsC;AAC3C,WAAO,OAAO,KAAK,GAAG,SAAS,GAAG,OAAO,EAAE,SAAS,QAAQ;AAAA,EAC9D;AAAA,EACA,OACE,OACA,OAAU,UAC0D;AACpE,UAAM,QAAQ,OAAO,KAAK,OAAO,QAAQ,EAAE,SAAS,OAAO;AAC3D,QAAI,SAAS;AACX,aAAO,OAAO,KAAK;AACrB,QAAI,SAAS;AACX,aAAO,OAAO,KAAK;AACrB,WAAO;AAAA,EACT;AACF;AAEO,IAAM,mBAA8C,EAAE,MAAM,IAAI,MAAM,GAAG;AAEzE,SAAS,qBAAgC,OAAkD;AAChG,SAAO,QAAQ,MAAM,OAAO,IAAI,IAAI,EAAE,MAAM,IAAI,MAAM,MAAM,OAAO,KAAK,IAAI;AAC9E;AAEO,SAAS,iBAA4B,MAAiD;AAC3F,SAAO,QAAQ,KAAK,OAAO,IAAI,IAAI,EAAE,MAAM,KAAK,OAAO,MAAM,MAAM,GAAG,IAAI;AAC5E;","names":[]}
+{"version":3,"sources":["../src/response.ts"],"sourcesContent":["import { _default, coerce, int, maximum, minimum, object, optional, string } from 'zod/mini';\nimport { hasText } from './utils/string';\n\n// eslint-disable-next-line @typescript-eslint/no-empty-object-type\nexport type Empty = {};\nexport type EntityId = string | number;\nexport type Entity = { id: EntityId };\n\nexport type Response<T = never> = { data: T };\n\nexport type InitParams = { limit: number; parent?: string };\nexport type NextParams = { limit: number; parent?: string; next: string };\nexport type PrevParams = { limit: number; parent?: string; prev: string };\nexport type PageParams = { limit: number; prev?: string; next?: string };\nexport type ParentPageParams = { limit: number; parent: string; prev?: string; next?: string };\nexport type Page<T = never> = { data: T[]; paging: { next: string; prev: string } };\n\nexport function pageParamsSchema(max: number = 100, defaultLimit: number = 20) {\n  return object({\n    limit: _default(coerce.number().check(int(), minimum(1), maximum(max)), defaultLimit),\n    prev: optional(string()),\n    next: optional(string()),\n  });\n}\n\nexport const Cursor = {\n  of(prev: bigint | number | string | undefined, next: bigint | number | string | undefined) {\n    return { prev: prev ? this.encode(prev) : '', next: next ? this.encode(next) : '' };\n  },\n  empty() {\n    return { prev: '', next: '' };\n  },\n  encode(id: bigint | number | string): string {\n    return Buffer.from(id.toString(), 'utf-8').toString('base64');\n  },\n  decode<T extends 'bigint' | 'number' | 'string' = 'bigint'>(\n    token: string,\n    type: T = 'bigint' as T\n  ): T extends 'bigint' ? bigint : T extends 'number' ? number : string {\n    const value = Buffer.from(token, 'base64').toString('utf-8');\n    if (type === 'bigint')\n      return BigInt(value) as T extends 'bigint' ? bigint : T extends 'number' ? number : string;\n    if (type === 'number')\n      return Number(value) as T extends 'bigint' ? bigint : T extends 'number' ? number : string;\n    return value as T extends 'bigint' ? bigint : T extends 'number' ? number : string;\n  },\n};\n\nexport const initialPageParam: Omit<PageParams, 'limit'> = { next: '', prev: '' };\n\nexport function getPreviousPageParam<T = never>(first: Page<T>): Omit<PageParams, 'limit'> | null {\n  return hasText(first.paging.prev) ? { next: '', prev: first.paging.prev } : null;\n}\n\nexport function getNextPageParam<T = never>(last: Page<T>): Omit<PageParams, 'limit'> | null {\n  return hasText(last.paging.next) ? { next: last.paging.next, prev: '' } : null;\n}\n"],"mappings":";AAAA,SAAS,UAAU,QAAQ,KAAK,SAAS,SAAS,QAAQ,UAAU,cAAc;AAClF,SAAS,eAAe;AAgBjB,SAAS,iBAAiB,MAAc,KAAK,eAAuB,IAAI;AAC7E,SAAO,OAAO;AAAA,IACZ,OAAO,SAAS,OAAO,OAAO,EAAE,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,QAAQ,GAAG,CAAC,GAAG,YAAY;AAAA,IACpF,MAAM,SAAS,OAAO,CAAC;AAAA,IACvB,MAAM,SAAS,OAAO,CAAC;AAAA,EACzB,CAAC;AACH;AAEO,IAAM,SAAS;AAAA,EACpB,GAAG,MAA4C,MAA4C;AACzF,WAAO,EAAE,MAAM,OAAO,KAAK,OAAO,IAAI,IAAI,IAAI,MAAM,OAAO,KAAK,OAAO,IAAI,IAAI,GAAG;AAAA,EACpF;AAAA,EACA,QAAQ;AACN,WAAO,EAAE,MAAM,IAAI,MAAM,GAAG;AAAA,EAC9B;AAAA,EACA,OAAO,IAAsC;AAC3C,WAAO,OAAO,KAAK,GAAG,SAAS,GAAG,OAAO,EAAE,SAAS,QAAQ;AAAA,EAC9D;AAAA,EACA,OACE,OACA,OAAU,UAC0D;AACpE,UAAM,QAAQ,OAAO,KAAK,OAAO,QAAQ,EAAE,SAAS,OAAO;AAC3D,QAAI,SAAS;AACX,aAAO,OAAO,KAAK;AACrB,QAAI,SAAS;AACX,aAAO,OAAO,KAAK;AACrB,WAAO;AAAA,EACT;AACF;AAEO,IAAM,mBAA8C,EAAE,MAAM,IAAI,MAAM,GAAG;AAEzE,SAAS,qBAAgC,OAAkD;AAChG,SAAO,QAAQ,MAAM,OAAO,IAAI,IAAI,EAAE,MAAM,IAAI,MAAM,MAAM,OAAO,KAAK,IAAI;AAC9E;AAEO,SAAS,iBAA4B,MAAiD;AAC3F,SAAO,QAAQ,KAAK,OAAO,IAAI,IAAI,EAAE,MAAM,KAAK,OAAO,MAAM,MAAM,GAAG,IAAI;AAC5E;","names":[]}

package/dist/utils/invariant.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utils/invariant.ts"],"sourcesContent":["const prefix = 'Invariant failed';\n\nexport function invariant(condition: any, message?: string | (() => string)): asserts condition {\n  if (condition) return;\n  const provided: string | undefined = typeof message === 'function' ? message() : message;\n  const value: string = provided ? `${prefix}: ${provided}` : prefix;\n  throw new Error(value);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAAM,SAAS;AAER,SAAS,UAAU,WAAgB,SAAsD;AAC9F,MAAI,UAAW;AACf,QAAM,WAA+B,OAAO,YAAY,aAAa,QAAQ,IAAI;AACjF,QAAM,QAAgB,WAAW,GAAG,MAAM,KAAK,QAAQ,KAAK;AAC5D,QAAM,IAAI,MAAM,KAAK;AACvB;","names":[]}
+{"version":3,"sources":["../../src/utils/invariant.ts"],"sourcesContent":["const prefix = 'Invariant failed';\n\nexport function invariant(\n  condition: unknown,\n  message?: string | (() => string)\n): asserts condition {\n  if (condition) return;\n  const provided: string | undefined = typeof message === 'function' ? message() : message;\n  const value: string = provided ? `${prefix}: ${provided}` : prefix;\n  throw new Error(value);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAAM,SAAS;AAER,SAAS,UACd,WACA,SACmB;AACnB,MAAI,UAAW;AACf,QAAM,WAA+B,OAAO,YAAY,aAAa,QAAQ,IAAI;AACjF,QAAM,QAAgB,WAAW,GAAG,MAAM,KAAK,QAAQ,KAAK;AAC5D,QAAM,IAAI,MAAM,KAAK;AACvB;","names":[]}

package/dist/utils/invariant.d.cts

@@ -1,3 +1,3 @@
-declare function invariant(condition: any, message?: string | (() => string)): asserts condition;
+declare function invariant(condition: unknown, message?: string | (() => string)): asserts condition;
 
 export { invariant };

package/dist/utils/invariant.d.ts

@@ -1,3 +1,3 @@
-declare function invariant(condition: any, message?: string | (() => string)): asserts condition;
+declare function invariant(condition: unknown, message?: string | (() => string)): asserts condition;
 
 export { invariant };

package/dist/utils/invariant.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utils/invariant.ts"],"sourcesContent":["const prefix = 'Invariant failed';\n\nexport function invariant(condition: any, message?: string | (() => string)): asserts condition {\n  if (condition) return;\n  const provided: string | undefined = typeof message === 'function' ? message() : message;\n  const value: string = provided ? `${prefix}: ${provided}` : prefix;\n  throw new Error(value);\n}\n"],"mappings":";AAAA,IAAM,SAAS;AAER,SAAS,UAAU,WAAgB,SAAsD;AAC9F,MAAI,UAAW;AACf,QAAM,WAA+B,OAAO,YAAY,aAAa,QAAQ,IAAI;AACjF,QAAM,QAAgB,WAAW,GAAG,MAAM,KAAK,QAAQ,KAAK;AAC5D,QAAM,IAAI,MAAM,KAAK;AACvB;","names":[]}
+{"version":3,"sources":["../../src/utils/invariant.ts"],"sourcesContent":["const prefix = 'Invariant failed';\n\nexport function invariant(\n  condition: unknown,\n  message?: string | (() => string)\n): asserts condition {\n  if (condition) return;\n  const provided: string | undefined = typeof message === 'function' ? message() : message;\n  const value: string = provided ? `${prefix}: ${provided}` : prefix;\n  throw new Error(value);\n}\n"],"mappings":";AAAA,IAAM,SAAS;AAER,SAAS,UACd,WACA,SACmB;AACnB,MAAI,UAAW;AACf,QAAM,WAA+B,OAAO,YAAY,aAAa,QAAQ,IAAI;AACjF,QAAM,QAAgB,WAAW,GAAG,MAAM,KAAK,QAAQ,KAAK;AAC5D,QAAM,IAAI,MAAM,KAAK;AACvB;","names":[]}

package/dist/vaild.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/vaild.ts"],"sourcesContent":["import { Details, BadRequest } from './error/detail';\nimport { Status } from './error/status';\nimport type { z, ZodMiniType } from 'zod/mini';\n\nexport type Result<S extends ZodMiniType> =\n  | { data: z.infer<S>; error: null }\n  | { data: null; error: Response };\n\ntype Target = 'json' | 'form' | 'query' | 'param' | 'header' | 'cookie';\n\nasync function getTarget(request: Request, target: Target): Promise<any> {\n  switch (target) {\n    case 'json':\n      return request.json();\n    default:\n      throw new Error(`Unsupported target: ${target}`);\n  }\n}\n\nexport async function valid<S extends ZodMiniType>(\n  request: Request,\n  target: Target,\n  schema: S\n): Promise<Result<S>> {\n  const value = await getTarget(request, target);\n  const validator = await schema.safeParseAsync(value);\n  if (validator.success) return { data: validator.data, error: null };\n  const fieldViolations: BadRequest['fieldViolations'] = validator.error.issues.map(\n    ({ path, message }) => ({ field: path.join('.'), description: message })\n  );\n  const details = Details.new().badRequest({ fieldViolations });\n  const error = Status.invalidArgument().response(details);\n  return { data: null, error };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oBAAoC;AACpC,oBAAuB;AASvB,eAAe,UAAU,SAAkB,QAA8B;AACvE,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO,QAAQ,KAAK;AAAA,IACtB;AACE,YAAM,IAAI,MAAM,uBAAuB,MAAM,EAAE;AAAA,EACnD;AACF;AAEA,eAAsB,MACpB,SACA,QACA,QACoB;AACpB,QAAM,QAAQ,MAAM,UAAU,SAAS,MAAM;AAC7C,QAAM,YAAY,MAAM,OAAO,eAAe,KAAK;AACnD,MAAI,UAAU,QAAS,QAAO,EAAE,MAAM,UAAU,MAAM,OAAO,KAAK;AAClE,QAAM,kBAAiD,UAAU,MAAM,OAAO;AAAA,IAC5E,CAAC,EAAE,MAAM,QAAQ,OAAO,EAAE,OAAO,KAAK,KAAK,GAAG,GAAG,aAAa,QAAQ;AAAA,EACxE;AACA,QAAM,UAAU,sBAAQ,IAAI,EAAE,WAAW,EAAE,gBAAgB,CAAC;AAC5D,QAAM,QAAQ,qBAAO,gBAAgB,EAAE,SAAS,OAAO;AACvD,SAAO,EAAE,MAAM,MAAM,MAAM;AAC7B;","names":[]}
+{"version":3,"sources":["../src/vaild.ts"],"sourcesContent":["import { BadRequest, Details } from './error/detail';\nimport { Status } from './error/status';\nimport type { ZodMiniType, z } from 'zod/mini';\n\nexport type Result<S extends ZodMiniType> =\n  | { data: z.infer<S>; error: null }\n  | { data: null; error: Response };\n\ntype Target = 'json' | 'form' | 'query' | 'param' | 'header' | 'cookie';\n\nasync function getTarget(request: Request, target: Target): Promise<unknown> {\n  switch (target) {\n    case 'json':\n      return request.json();\n    default:\n      throw new Error(`Unsupported target: ${target}`);\n  }\n}\n\nexport async function valid<S extends ZodMiniType>(\n  request: Request,\n  target: Target,\n  schema: S\n): Promise<Result<S>> {\n  const value = await getTarget(request, target);\n  const validator = await schema.safeParseAsync(value);\n  if (validator.success) return { data: validator.data, error: null };\n  const fieldViolations: BadRequest['fieldViolations'] = validator.error.issues.map(\n    ({ path, message }) => ({ field: path.join('.'), description: message })\n  );\n  const details = Details.new().badRequest({ fieldViolations });\n  const error = Status.invalidArgument().response(details);\n  return { data: null, error };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oBAAoC;AACpC,oBAAuB;AASvB,eAAe,UAAU,SAAkB,QAAkC;AAC3E,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO,QAAQ,KAAK;AAAA,IACtB;AACE,YAAM,IAAI,MAAM,uBAAuB,MAAM,EAAE;AAAA,EACnD;AACF;AAEA,eAAsB,MACpB,SACA,QACA,QACoB;AACpB,QAAM,QAAQ,MAAM,UAAU,SAAS,MAAM;AAC7C,QAAM,YAAY,MAAM,OAAO,eAAe,KAAK;AACnD,MAAI,UAAU,QAAS,QAAO,EAAE,MAAM,UAAU,MAAM,OAAO,KAAK;AAClE,QAAM,kBAAiD,UAAU,MAAM,OAAO;AAAA,IAC5E,CAAC,EAAE,MAAM,QAAQ,OAAO,EAAE,OAAO,KAAK,KAAK,GAAG,GAAG,aAAa,QAAQ;AAAA,EACxE;AACA,QAAM,UAAU,sBAAQ,IAAI,EAAE,WAAW,EAAE,gBAAgB,CAAC;AAC5D,QAAM,QAAQ,qBAAO,gBAAgB,EAAE,SAAS,OAAO;AACvD,SAAO,EAAE,MAAM,MAAM,MAAM;AAC7B;","names":[]}

package/dist/vaild.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/vaild.ts"],"sourcesContent":["import { Details, BadRequest } from './error/detail';\nimport { Status } from './error/status';\nimport type { z, ZodMiniType } from 'zod/mini';\n\nexport type Result<S extends ZodMiniType> =\n  | { data: z.infer<S>; error: null }\n  | { data: null; error: Response };\n\ntype Target = 'json' | 'form' | 'query' | 'param' | 'header' | 'cookie';\n\nasync function getTarget(request: Request, target: Target): Promise<any> {\n  switch (target) {\n    case 'json':\n      return request.json();\n    default:\n      throw new Error(`Unsupported target: ${target}`);\n  }\n}\n\nexport async function valid<S extends ZodMiniType>(\n  request: Request,\n  target: Target,\n  schema: S\n): Promise<Result<S>> {\n  const value = await getTarget(request, target);\n  const validator = await schema.safeParseAsync(value);\n  if (validator.success) return { data: validator.data, error: null };\n  const fieldViolations: BadRequest['fieldViolations'] = validator.error.issues.map(\n    ({ path, message }) => ({ field: path.join('.'), description: message })\n  );\n  const details = Details.new().badRequest({ fieldViolations });\n  const error = Status.invalidArgument().response(details);\n  return { data: null, error };\n}\n"],"mappings":";AAAA,SAAS,eAA2B;AACpC,SAAS,cAAc;AASvB,eAAe,UAAU,SAAkB,QAA8B;AACvE,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO,QAAQ,KAAK;AAAA,IACtB;AACE,YAAM,IAAI,MAAM,uBAAuB,MAAM,EAAE;AAAA,EACnD;AACF;AAEA,eAAsB,MACpB,SACA,QACA,QACoB;AACpB,QAAM,QAAQ,MAAM,UAAU,SAAS,MAAM;AAC7C,QAAM,YAAY,MAAM,OAAO,eAAe,KAAK;AACnD,MAAI,UAAU,QAAS,QAAO,EAAE,MAAM,UAAU,MAAM,OAAO,KAAK;AAClE,QAAM,kBAAiD,UAAU,MAAM,OAAO;AAAA,IAC5E,CAAC,EAAE,MAAM,QAAQ,OAAO,EAAE,OAAO,KAAK,KAAK,GAAG,GAAG,aAAa,QAAQ;AAAA,EACxE;AACA,QAAM,UAAU,QAAQ,IAAI,EAAE,WAAW,EAAE,gBAAgB,CAAC;AAC5D,QAAM,QAAQ,OAAO,gBAAgB,EAAE,SAAS,OAAO;AACvD,SAAO,EAAE,MAAM,MAAM,MAAM;AAC7B;","names":[]}
+{"version":3,"sources":["../src/vaild.ts"],"sourcesContent":["import { BadRequest, Details } from './error/detail';\nimport { Status } from './error/status';\nimport type { ZodMiniType, z } from 'zod/mini';\n\nexport type Result<S extends ZodMiniType> =\n  | { data: z.infer<S>; error: null }\n  | { data: null; error: Response };\n\ntype Target = 'json' | 'form' | 'query' | 'param' | 'header' | 'cookie';\n\nasync function getTarget(request: Request, target: Target): Promise<unknown> {\n  switch (target) {\n    case 'json':\n      return request.json();\n    default:\n      throw new Error(`Unsupported target: ${target}`);\n  }\n}\n\nexport async function valid<S extends ZodMiniType>(\n  request: Request,\n  target: Target,\n  schema: S\n): Promise<Result<S>> {\n  const value = await getTarget(request, target);\n  const validator = await schema.safeParseAsync(value);\n  if (validator.success) return { data: validator.data, error: null };\n  const fieldViolations: BadRequest['fieldViolations'] = validator.error.issues.map(\n    ({ path, message }) => ({ field: path.join('.'), description: message })\n  );\n  const details = Details.new().badRequest({ fieldViolations });\n  const error = Status.invalidArgument().response(details);\n  return { data: null, error };\n}\n"],"mappings":";AAAA,SAAqB,eAAe;AACpC,SAAS,cAAc;AASvB,eAAe,UAAU,SAAkB,QAAkC;AAC3E,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO,QAAQ,KAAK;AAAA,IACtB;AACE,YAAM,IAAI,MAAM,uBAAuB,MAAM,EAAE;AAAA,EACnD;AACF;AAEA,eAAsB,MACpB,SACA,QACA,QACoB;AACpB,QAAM,QAAQ,MAAM,UAAU,SAAS,MAAM;AAC7C,QAAM,YAAY,MAAM,OAAO,eAAe,KAAK;AACnD,MAAI,UAAU,QAAS,QAAO,EAAE,MAAM,UAAU,MAAM,OAAO,KAAK;AAClE,QAAM,kBAAiD,UAAU,MAAM,OAAO;AAAA,IAC5E,CAAC,EAAE,MAAM,QAAQ,OAAO,EAAE,OAAO,KAAK,KAAK,GAAG,GAAG,aAAa,QAAQ;AAAA,EACxE;AACA,QAAM,UAAU,QAAQ,IAAI,EAAE,WAAW,EAAE,gBAAgB,CAAC;AAC5D,QAAM,QAAQ,OAAO,gBAAgB,EAAE,SAAS,OAAO;AACvD,SAAO,EAAE,MAAM,MAAM,MAAM;AAC7B;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shware/http",
-  "version": "1.2.1",
+  "version": "1.2.3",
   "private": false,
   "type": "module",
   "repository": {
@@ -44,8 +44,8 @@
     "jest": "^30.1.3",
     "ts-jest": "^29.4.1",
     "typescript": "^5.9.2",
-    "@repo/typescript-config": "0.0.0",
-    "@repo/eslint-config": "0.0.4"
+    "@repo/eslint-config": "0.0.4",
+    "@repo/typescript-config": "0.0.0"
   },
   "dependencies": {
     "zod": "^4.1.8"