@shware/http 2.2.2 → 2.2.3

package/dist/hono/__tests__/csrf.test.mjs

@@ -1,326 +0,0 @@
-// src/hono/__tests__/csrf.test.ts
-import { Hono } from "hono";
-import { csrf } from "../csrf.mjs";
-import { errorHandler } from "../handler.mjs";
-describe("CSRF Protection", () => {
-  let app;
-  beforeEach(() => {
-    app = new Hono();
-    app.onError(errorHandler);
-  });
-  it("should allow GET requests without CSRF token", async () => {
-    app.use(csrf());
-    app.get("/test", (c) => c.text("OK"));
-    const res = await app.request("/test");
-    expect(res.status).toBe(200);
-    expect(await res.text()).toBe("OK");
-  });
-  it("should allow HEAD requests without CSRF token", async () => {
-    app.use(csrf());
-    app.all("/test", (c) => c.text("OK"));
-    const res = await app.request("/test", { method: "HEAD" });
-    expect(res.status).toBe(200);
-  });
-  it("should allow OPTIONS requests without CSRF token", async () => {
-    app.use(csrf());
-    app.options("/test", (c) => c.text("OK"));
-    const res = await app.request("/test", { method: "OPTIONS" });
-    expect(res.status).toBe(200);
-  });
-  it("should reject POST requests without CSRF token", async () => {
-    app.use(csrf());
-    app.post("/test", (c) => c.text("OK"));
-    const res = await app.request("/test", { method: "POST" });
-    expect(res.status).toBe(403);
-  });
-  it("should reject POST requests with mismatched tokens", async () => {
-    app.use(csrf());
-    app.post("/test", (c) => c.text("OK"));
-    const res = await app.request("/test", {
-      method: "POST",
-      headers: { "X-XSRF-TOKEN": "header-token", Cookie: "XSRF-TOKEN=cookie-token" }
-    });
-    expect(res.status).toBe(403);
-  });
-  it("should allow POST requests with matching tokens", async () => {
-    app.use(csrf());
-    app.post("/test", (c) => c.text("OK"));
-    const res = await app.request("/test", {
-      method: "POST",
-      headers: {
-        "X-XSRF-TOKEN": "matching-token",
-        Cookie: "XSRF-TOKEN=matching-token"
-      }
-    });
-    expect(res.status).toBe(200);
-    expect(await res.text()).toBe("OK");
-  });
-  it("should use custom cookie and header names", async () => {
-    app.use(csrf({ cookieName: "csrf-token", headerName: "X-CSRF-Token" }));
-    app.post("/test", (c) => c.text("OK"));
-    const res = await app.request("/test", {
-      method: "POST",
-      headers: {
-        "X-CSRF-Token": "test-token",
-        Cookie: "csrf-token=test-token"
-      }
-    });
-    expect(res.status).toBe(200);
-  });
-  it("should ignore specified paths", async () => {
-    app.use(csrf({ ignores: [{ path: "/webhook/*", methods: ["POST"] }] }));
-    app.post("/webhook/stripe", (c) => c.text("OK"));
-    app.post("/api/data", (c) => c.text("OK"));
-    const webhookRes = await app.request("/webhook/stripe", { method: "POST" });
-    expect(webhookRes.status).toBe(200);
-    const apiRes = await app.request("/api/data", { method: "POST" });
-    expect(apiRes.status).toBe(403);
-  });
-  it("should ignore all methods for a path when methods not specified", async () => {
-    app.use(csrf({ ignores: [{ path: "/auth/apple/callback" }] }));
-    app.post("/auth/apple/callback", (c) => c.text("OK"));
-    app.put("/auth/apple/callback", (c) => c.text("OK"));
-    const postRes = await app.request("/auth/apple/callback", { method: "POST" });
-    expect(postRes.status).toBe(200);
-    const putRes = await app.request("/auth/apple/callback", { method: "PUT" });
-    expect(putRes.status).toBe(200);
-  });
-  it("should handle empty tokens safely", async () => {
-    app.use(csrf());
-    app.post("/test", (c) => c.text("OK"));
-    const res = await app.request("/test", {
-      method: "POST",
-      headers: { "X-XSRF-TOKEN": "", Cookie: "XSRF-TOKEN=" }
-    });
-    expect(res.status).toBe(403);
-  });
-  it("should handle missing cookie", async () => {
-    app.use(csrf());
-    app.post("/test", (c) => c.text("OK"));
-    const res = await app.request("/test", {
-      method: "POST",
-      headers: { "X-XSRF-TOKEN": "token" }
-    });
-    expect(res.status).toBe(403);
-  });
-  it("should handle missing header", async () => {
-    app.use(csrf());
-    app.post("/test", (c) => c.text("OK"));
-    const res = await app.request("/test", {
-      method: "POST",
-      headers: { Cookie: "XSRF-TOKEN=token" }
-    });
-    expect(res.status).toBe(403);
-  });
-  it("should use custom error message", async () => {
-    app.use(csrf({ errorMessage: "Custom CSRF error" }));
-    app.post("/test", (c) => c.text("OK"));
-    const res = await app.request("/test", { method: "POST" });
-    expect(res.status).toBe(403);
-    const body = await res.json();
-    expect(body.error.message).toBe("Custom CSRF error");
-  });
-  it("should work with custom safe methods", async () => {
-    app.use(csrf({ safeMethods: ["GET"] }));
-    app.all("/test", (c) => c.text("OK"));
-    const res = await app.request("/test", { method: "HEAD" });
-    expect(res.status).toBe(403);
-  });
-  it("should handle complex ignore patterns", async () => {
-    app.use(
-      csrf({
-        ignores: [
-          { path: "/api/v1/*", methods: ["GET", "POST"] },
-          { path: "/api/v2/*", methods: ["POST"] },
-          { path: "/public/*" }
-          // All methods
-        ]
-      })
-    );
-    app.get("/api/v1/users", (c) => c.text("OK"));
-    app.post("/api/v1/users", (c) => c.text("OK"));
-    app.put("/api/v1/users", (c) => c.text("OK"));
-    app.post("/api/v2/users", (c) => c.text("OK"));
-    app.get("/api/v2/users", (c) => c.text("OK"));
-    app.post("/public/data", (c) => c.text("OK"));
-    let res = await app.request("/api/v1/users", { method: "GET" });
-    expect(res.status).toBe(200);
-    res = await app.request("/api/v1/users", { method: "POST" });
-    expect(res.status).toBe(200);
-    res = await app.request("/api/v1/users", { method: "PUT" });
-    expect(res.status).toBe(403);
-    res = await app.request("/api/v2/users", { method: "POST" });
-    expect(res.status).toBe(200);
-    res = await app.request("/api/v2/users", { method: "GET" });
-    expect(res.status).toBe(200);
-    res = await app.request("/public/data", { method: "POST" });
-    expect(res.status).toBe(200);
-  });
-  describe("Origin bypass", () => {
-    it("should allow requests from configured origins", async () => {
-      app.use(csrf({ origin: ["https://example.com", "https://trusted.com"] }));
-      app.post("/test", (c) => c.text("OK"));
-      const res = await app.request("/test", {
-        method: "POST",
-        headers: { Origin: "https://example.com" }
-      });
-      expect(res.status).toBe(200);
-      expect(await res.text()).toBe("OK");
-    });
-    it("should allow requests from any configured origin", async () => {
-      app.use(csrf({ origin: ["https://example.com", "https://trusted.com"] }));
-      app.post("/test", (c) => c.text("OK"));
-      const res = await app.request("/test", {
-        method: "POST",
-        headers: { Origin: "https://trusted.com" }
-      });
-      expect(res.status).toBe(200);
-    });
-    it("should reject requests from non-configured origins", async () => {
-      app.use(csrf({ origin: ["https://example.com"] }));
-      app.post("/test", (c) => c.text("OK"));
-      const res = await app.request("/test", {
-        method: "POST",
-        headers: { Origin: "https://malicious.com" }
-      });
-      expect(res.status).toBe(403);
-    });
-    it("should reject requests without origin header", async () => {
-      app.use(csrf({ origin: ["https://example.com"] }));
-      app.post("/test", (c) => c.text("OK"));
-      const res = await app.request("/test", { method: "POST" });
-      expect(res.status).toBe(403);
-    });
-    it("should handle empty origin list", async () => {
-      app.use(csrf({ origin: [] }));
-      app.post("/test", (c) => c.text("OK"));
-      const res = await app.request("/test", {
-        method: "POST",
-        headers: { Origin: "https://example.com" }
-      });
-      expect(res.status).toBe(403);
-    });
-  });
-  describe("Sec-Fetch-Site bypass", () => {
-    it("should allow requests with configured sec-fetch-site values", async () => {
-      app.use(csrf({ secFetchSite: ["same-origin", "same-site"] }));
-      app.post("/test", (c) => c.text("OK"));
-      const res = await app.request("/test", {
-        method: "POST",
-        headers: { "Sec-Fetch-Site": "same-origin" }
-      });
-      expect(res.status).toBe(200);
-      expect(await res.text()).toBe("OK");
-    });
-    it("should allow requests with any configured sec-fetch-site value", async () => {
-      app.use(csrf({ secFetchSite: ["same-origin", "same-site", "cross-origin"] }));
-      app.post("/test", (c) => c.text("OK"));
-      const res = await app.request("/test", {
-        method: "POST",
-        headers: { "Sec-Fetch-Site": "cross-origin" }
-      });
-      expect(res.status).toBe(200);
-    });
-    it("should reject requests with non-configured sec-fetch-site values", async () => {
-      app.use(csrf({ secFetchSite: ["same-origin"] }));
-      app.post("/test", (c) => c.text("OK"));
-      const res = await app.request("/test", {
-        method: "POST",
-        headers: { "Sec-Fetch-Site": "same-site" }
-      });
-      expect(res.status).toBe(403);
-    });
-    it("should reject requests without sec-fetch-site header", async () => {
-      app.use(csrf({ secFetchSite: ["same-origin"] }));
-      app.post("/test", (c) => c.text("OK"));
-      const res = await app.request("/test", { method: "POST" });
-      expect(res.status).toBe(403);
-    });
-    it("should handle all valid sec-fetch-site values", async () => {
-      app.use(csrf({ secFetchSite: ["same-origin", "same-site", "none", "cross-origin"] }));
-      app.post("/test", (c) => c.text("OK"));
-      const validValues = ["same-origin", "same-site", "none", "cross-origin"];
-      for (const value of validValues) {
-        const res = await app.request("/test", {
-          method: "POST",
-          headers: { "Sec-Fetch-Site": value }
-        });
-        expect(res.status).toBe(200);
-      }
-    });
-    it("should handle empty sec-fetch-site list", async () => {
-      app.use(csrf({ secFetchSite: [] }));
-      app.post("/test", (c) => c.text("OK"));
-      const res = await app.request("/test", {
-        method: "POST",
-        headers: { "Sec-Fetch-Site": "same-origin" }
-      });
-      expect(res.status).toBe(403);
-    });
-  });
-  describe("Combined origin and sec-fetch-site bypass", () => {
-    it("should allow requests matching either origin or sec-fetch-site", async () => {
-      app.use(
-        csrf({
-          origin: ["https://example.com"],
-          secFetchSite: ["same-site"]
-        })
-      );
-      app.post("/test", (c) => c.text("OK"));
-      let res = await app.request("/test", {
-        method: "POST",
-        headers: { Origin: "https://example.com" }
-      });
-      expect(res.status).toBe(200);
-      res = await app.request("/test", {
-        method: "POST",
-        headers: { "Sec-Fetch-Site": "same-site" }
-      });
-      expect(res.status).toBe(200);
-    });
-    it("should reject requests matching neither origin nor sec-fetch-site", async () => {
-      app.use(
-        csrf({
-          origin: ["https://example.com"],
-          secFetchSite: ["same-origin"]
-        })
-      );
-      app.post("/test", (c) => c.text("OK"));
-      const res = await app.request("/test", {
-        method: "POST",
-        headers: {
-          Origin: "https://malicious.com",
-          "Sec-Fetch-Site": "cross-origin"
-        }
-      });
-      expect(res.status).toBe(403);
-    });
-    it("should work with origin, sec-fetch-site and ignore rules combined", async () => {
-      app.use(
-        csrf({
-          origin: ["https://example.com"],
-          secFetchSite: ["same-site"],
-          ignores: [{ path: "/webhook/*", methods: ["POST"] }]
-        })
-      );
-      app.post("/test", (c) => c.text("OK"));
-      app.post("/webhook/stripe", (c) => c.text("OK"));
-      app.post("/api/data", (c) => c.text("OK"));
-      let res = await app.request("/test", {
-        method: "POST",
-        headers: { Origin: "https://example.com" }
-      });
-      expect(res.status).toBe(200);
-      res = await app.request("/test", {
-        method: "POST",
-        headers: { "Sec-Fetch-Site": "same-site" }
-      });
-      expect(res.status).toBe(200);
-      res = await app.request("/webhook/stripe", { method: "POST" });
-      expect(res.status).toBe(200);
-      res = await app.request("/api/data", { method: "POST" });
-      expect(res.status).toBe(403);
-    });
-  });
-});
-//# sourceMappingURL=csrf.test.mjs.map

package/dist/hono/__tests__/csrf.test.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../src/hono/__tests__/csrf.test.ts"],"sourcesContent":["import { Hono } from 'hono';\nimport { csrf } from '../csrf';\nimport { type Env, errorHandler } from '../handler';\n\ndescribe('CSRF Protection', () => {\n  let app: Hono<Env>;\n\n  beforeEach(() => {\n    app = new Hono();\n    app.onError(errorHandler);\n  });\n\n  it('should allow GET requests without CSRF token', async () => {\n    app.use(csrf());\n    app.get('/test', (c) => c.text('OK'));\n\n    const res = await app.request('/test');\n    expect(res.status).toBe(200);\n    expect(await res.text()).toBe('OK');\n  });\n\n  it('should allow HEAD requests without CSRF token', async () => {\n    app.use(csrf());\n    app.all('/test', (c) => c.text('OK'));\n\n    const res = await app.request('/test', { method: 'HEAD' });\n    expect(res.status).toBe(200);\n  });\n\n  it('should allow OPTIONS requests without CSRF token', async () => {\n    app.use(csrf());\n    app.options('/test', (c) => c.text('OK'));\n\n    const res = await app.request('/test', { method: 'OPTIONS' });\n    expect(res.status).toBe(200);\n  });\n\n  it('should reject POST requests without CSRF token', async () => {\n    app.use(csrf());\n    app.post('/test', (c) => c.text('OK'));\n\n    const res = await app.request('/test', { method: 'POST' });\n    expect(res.status).toBe(403);\n  });\n\n  it('should reject POST requests with mismatched tokens', async () => {\n    app.use(csrf());\n    app.post('/test', (c) => c.text('OK'));\n\n    const res = await app.request('/test', {\n      method: 'POST',\n      headers: { 'X-XSRF-TOKEN': 'header-token', Cookie: 'XSRF-TOKEN=cookie-token' },\n    });\n    expect(res.status).toBe(403);\n  });\n\n  it('should allow POST requests with matching tokens', async () => {\n    app.use(csrf());\n    app.post('/test', (c) => c.text('OK'));\n\n    const res = await app.request('/test', {\n      method: 'POST',\n      headers: {\n        'X-XSRF-TOKEN': 'matching-token',\n        Cookie: 'XSRF-TOKEN=matching-token',\n      },\n    });\n    expect(res.status).toBe(200);\n    expect(await res.text()).toBe('OK');\n  });\n\n  it('should use custom cookie and header names', async () => {\n    app.use(csrf({ cookieName: 'csrf-token', headerName: 'X-CSRF-Token' }));\n    app.post('/test', (c) => c.text('OK'));\n\n    const res = await app.request('/test', {\n      method: 'POST',\n      headers: {\n        'X-CSRF-Token': 'test-token',\n        Cookie: 'csrf-token=test-token',\n      },\n    });\n    expect(res.status).toBe(200);\n  });\n\n  it('should ignore specified paths', async () => {\n    app.use(csrf({ ignores: [{ path: '/webhook/*', methods: ['POST'] }] }));\n    app.post('/webhook/stripe', (c) => c.text('OK'));\n    app.post('/api/data', (c) => c.text('OK'));\n\n    // Ignored path should work without CSRF token\n    const webhookRes = await app.request('/webhook/stripe', { method: 'POST' });\n    expect(webhookRes.status).toBe(200);\n\n    // Non-ignored path should require CSRF token\n    const apiRes = await app.request('/api/data', { method: 'POST' });\n    expect(apiRes.status).toBe(403);\n  });\n\n  it('should ignore all methods for a path when methods not specified', async () => {\n    app.use(csrf({ ignores: [{ path: '/auth/apple/callback' }] }));\n    app.post('/auth/apple/callback', (c) => c.text('OK'));\n    app.put('/auth/apple/callback', (c) => c.text('OK'));\n\n    const postRes = await app.request('/auth/apple/callback', { method: 'POST' });\n    expect(postRes.status).toBe(200);\n\n    const putRes = await app.request('/auth/apple/callback', { method: 'PUT' });\n    expect(putRes.status).toBe(200);\n  });\n\n  it('should handle empty tokens safely', async () => {\n    app.use(csrf());\n    app.post('/test', (c) => c.text('OK'));\n\n    const res = await app.request('/test', {\n      method: 'POST',\n      headers: { 'X-XSRF-TOKEN': '', Cookie: 'XSRF-TOKEN=' },\n    });\n    expect(res.status).toBe(403);\n  });\n\n  it('should handle missing cookie', async () => {\n    app.use(csrf());\n    app.post('/test', (c) => c.text('OK'));\n\n    const res = await app.request('/test', {\n      method: 'POST',\n      headers: { 'X-XSRF-TOKEN': 'token' },\n    });\n    expect(res.status).toBe(403);\n  });\n\n  it('should handle missing header', async () => {\n    app.use(csrf());\n    app.post('/test', (c) => c.text('OK'));\n\n    const res = await app.request('/test', {\n      method: 'POST',\n      headers: { Cookie: 'XSRF-TOKEN=token' },\n    });\n    expect(res.status).toBe(403);\n  });\n\n  it('should use custom error message', async () => {\n    app.use(csrf({ errorMessage: 'Custom CSRF error' }));\n    app.post('/test', (c) => c.text('OK'));\n\n    const res = await app.request('/test', { method: 'POST' });\n    expect(res.status).toBe(403);\n    const body = await res.json();\n    expect(body.error.message).toBe('Custom CSRF error');\n  });\n\n  it('should work with custom safe methods', async () => {\n    app.use(csrf({ safeMethods: ['GET'] }));\n    app.all('/test', (c) => c.text('OK'));\n\n    // HEAD is no longer safe, should require CSRF token\n    const res = await app.request('/test', { method: 'HEAD' });\n    expect(res.status).toBe(403);\n  });\n\n  it('should handle complex ignore patterns', async () => {\n    app.use(\n      csrf({\n        ignores: [\n          { path: '/api/v1/*', methods: ['GET', 'POST'] },\n          { path: '/api/v2/*', methods: ['POST'] },\n          { path: '/public/*' }, // All methods\n        ],\n      })\n    );\n\n    app.get('/api/v1/users', (c) => c.text('OK'));\n    app.post('/api/v1/users', (c) => c.text('OK'));\n    app.put('/api/v1/users', (c) => c.text('OK'));\n    app.post('/api/v2/users', (c) => c.text('OK'));\n    app.get('/api/v2/users', (c) => c.text('OK'));\n    app.post('/public/data', (c) => c.text('OK'));\n\n    // Ignored GET and POST for /api/v1/*\n    let res = await app.request('/api/v1/users', { method: 'GET' });\n    expect(res.status).toBe(200);\n\n    res = await app.request('/api/v1/users', { method: 'POST' });\n    expect(res.status).toBe(200);\n\n    // PUT not ignored for /api/v1/*\n    res = await app.request('/api/v1/users', { method: 'PUT' });\n    expect(res.status).toBe(403);\n\n    // Only POST ignored for /api/v2/*\n    res = await app.request('/api/v2/users', { method: 'POST' });\n    expect(res.status).toBe(200);\n\n    // GET not ignored for /api/v2/* (but GET is safe by default)\n    res = await app.request('/api/v2/users', { method: 'GET' });\n    expect(res.status).toBe(200);\n\n    // All methods ignored for /public/*\n    res = await app.request('/public/data', { method: 'POST' });\n    expect(res.status).toBe(200);\n  });\n\n  describe('Origin bypass', () => {\n    it('should allow requests from configured origins', async () => {\n      app.use(csrf({ origin: ['https://example.com', 'https://trusted.com'] }));\n      app.post('/test', (c) => c.text('OK'));\n\n      // Request from allowed origin should work without CSRF token\n      const res = await app.request('/test', {\n        method: 'POST',\n        headers: { Origin: 'https://example.com' },\n      });\n      expect(res.status).toBe(200);\n      expect(await res.text()).toBe('OK');\n    });\n\n    it('should allow requests from any configured origin', async () => {\n      app.use(csrf({ origin: ['https://example.com', 'https://trusted.com'] }));\n      app.post('/test', (c) => c.text('OK'));\n\n      const res = await app.request('/test', {\n        method: 'POST',\n        headers: { Origin: 'https://trusted.com' },\n      });\n      expect(res.status).toBe(200);\n    });\n\n    it('should reject requests from non-configured origins', async () => {\n      app.use(csrf({ origin: ['https://example.com'] }));\n      app.post('/test', (c) => c.text('OK'));\n\n      const res = await app.request('/test', {\n        method: 'POST',\n        headers: { Origin: 'https://malicious.com' },\n      });\n      expect(res.status).toBe(403);\n    });\n\n    it('should reject requests without origin header', async () => {\n      app.use(csrf({ origin: ['https://example.com'] }));\n      app.post('/test', (c) => c.text('OK'));\n\n      const res = await app.request('/test', { method: 'POST' });\n      expect(res.status).toBe(403);\n    });\n\n    it('should handle empty origin list', async () => {\n      app.use(csrf({ origin: [] }));\n      app.post('/test', (c) => c.text('OK'));\n\n      const res = await app.request('/test', {\n        method: 'POST',\n        headers: { Origin: 'https://example.com' },\n      });\n      expect(res.status).toBe(403);\n    });\n  });\n\n  describe('Sec-Fetch-Site bypass', () => {\n    it('should allow requests with configured sec-fetch-site values', async () => {\n      app.use(csrf({ secFetchSite: ['same-origin', 'same-site'] }));\n      app.post('/test', (c) => c.text('OK'));\n\n      const res = await app.request('/test', {\n        method: 'POST',\n        headers: { 'Sec-Fetch-Site': 'same-origin' },\n      });\n      expect(res.status).toBe(200);\n      expect(await res.text()).toBe('OK');\n    });\n\n    it('should allow requests with any configured sec-fetch-site value', async () => {\n      app.use(csrf({ secFetchSite: ['same-origin', 'same-site', 'cross-origin'] }));\n      app.post('/test', (c) => c.text('OK'));\n\n      const res = await app.request('/test', {\n        method: 'POST',\n        headers: { 'Sec-Fetch-Site': 'cross-origin' },\n      });\n      expect(res.status).toBe(200);\n    });\n\n    it('should reject requests with non-configured sec-fetch-site values', async () => {\n      app.use(csrf({ secFetchSite: ['same-origin'] }));\n      app.post('/test', (c) => c.text('OK'));\n\n      const res = await app.request('/test', {\n        method: 'POST',\n        headers: { 'Sec-Fetch-Site': 'same-site' },\n      });\n      expect(res.status).toBe(403);\n    });\n\n    it('should reject requests without sec-fetch-site header', async () => {\n      app.use(csrf({ secFetchSite: ['same-origin'] }));\n      app.post('/test', (c) => c.text('OK'));\n\n      const res = await app.request('/test', { method: 'POST' });\n      expect(res.status).toBe(403);\n    });\n\n    it('should handle all valid sec-fetch-site values', async () => {\n      app.use(csrf({ secFetchSite: ['same-origin', 'same-site', 'none', 'cross-origin'] }));\n      app.post('/test', (c) => c.text('OK'));\n\n      const validValues = ['same-origin', 'same-site', 'none', 'cross-origin'];\n\n      for (const value of validValues) {\n        const res = await app.request('/test', {\n          method: 'POST',\n          headers: { 'Sec-Fetch-Site': value },\n        });\n        expect(res.status).toBe(200);\n      }\n    });\n\n    it('should handle empty sec-fetch-site list', async () => {\n      app.use(csrf({ secFetchSite: [] }));\n      app.post('/test', (c) => c.text('OK'));\n\n      const res = await app.request('/test', {\n        method: 'POST',\n        headers: { 'Sec-Fetch-Site': 'same-origin' },\n      });\n      expect(res.status).toBe(403);\n    });\n  });\n\n  describe('Combined origin and sec-fetch-site bypass', () => {\n    it('should allow requests matching either origin or sec-fetch-site', async () => {\n      app.use(\n        csrf({\n          origin: ['https://example.com'],\n          secFetchSite: ['same-site'],\n        })\n      );\n      app.post('/test', (c) => c.text('OK'));\n\n      // Should work with matching origin\n      let res = await app.request('/test', {\n        method: 'POST',\n        headers: { Origin: 'https://example.com' },\n      });\n      expect(res.status).toBe(200);\n\n      // Should work with matching sec-fetch-site\n      res = await app.request('/test', {\n        method: 'POST',\n        headers: { 'Sec-Fetch-Site': 'same-site' },\n      });\n      expect(res.status).toBe(200);\n    });\n\n    it('should reject requests matching neither origin nor sec-fetch-site', async () => {\n      app.use(\n        csrf({\n          origin: ['https://example.com'],\n          secFetchSite: ['same-origin'],\n        })\n      );\n      app.post('/test', (c) => c.text('OK'));\n\n      const res = await app.request('/test', {\n        method: 'POST',\n        headers: {\n          Origin: 'https://malicious.com',\n          'Sec-Fetch-Site': 'cross-origin',\n        },\n      });\n      expect(res.status).toBe(403);\n    });\n\n    it('should work with origin, sec-fetch-site and ignore rules combined', async () => {\n      app.use(\n        csrf({\n          origin: ['https://example.com'],\n          secFetchSite: ['same-site'],\n          ignores: [{ path: '/webhook/*', methods: ['POST'] }],\n        })\n      );\n\n      app.post('/test', (c) => c.text('OK'));\n      app.post('/webhook/stripe', (c) => c.text('OK'));\n      app.post('/api/data', (c) => c.text('OK'));\n\n      // Should work with origin bypass\n      let res = await app.request('/test', {\n        method: 'POST',\n        headers: { Origin: 'https://example.com' },\n      });\n      expect(res.status).toBe(200);\n\n      // Should work with sec-fetch-site bypass\n      res = await app.request('/test', {\n        method: 'POST',\n        headers: { 'Sec-Fetch-Site': 'same-site' },\n      });\n      expect(res.status).toBe(200);\n\n      // Should work with ignore rule\n      res = await app.request('/webhook/stripe', { method: 'POST' });\n      expect(res.status).toBe(200);\n\n      // Should fail without any bypass\n      res = await app.request('/api/data', { method: 'POST' });\n      expect(res.status).toBe(403);\n    });\n  });\n});\n"],"mappings":";AAAA,SAAS,YAAY;AACrB,SAAS,YAAY;AACrB,SAAmB,oBAAoB;AAEvC,SAAS,mBAAmB,MAAM;AAChC,MAAI;AAEJ,aAAW,MAAM;AACf,UAAM,IAAI,KAAK;AACf,QAAI,QAAQ,YAAY;AAAA,EAC1B,CAAC;AAED,KAAG,gDAAgD,YAAY;AAC7D,QAAI,IAAI,KAAK,CAAC;AACd,QAAI,IAAI,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAEpC,UAAM,MAAM,MAAM,IAAI,QAAQ,OAAO;AACrC,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAC3B,WAAO,MAAM,IAAI,KAAK,CAAC,EAAE,KAAK,IAAI;AAAA,EACpC,CAAC;AAED,KAAG,iDAAiD,YAAY;AAC9D,QAAI,IAAI,KAAK,CAAC;AACd,QAAI,IAAI,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAEpC,UAAM,MAAM,MAAM,IAAI,QAAQ,SAAS,EAAE,QAAQ,OAAO,CAAC;AACzD,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,EAC7B,CAAC;AAED,KAAG,oDAAoD,YAAY;AACjE,QAAI,IAAI,KAAK,CAAC;AACd,QAAI,QAAQ,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAExC,UAAM,MAAM,MAAM,IAAI,QAAQ,SAAS,EAAE,QAAQ,UAAU,CAAC;AAC5D,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,EAC7B,CAAC;AAED,KAAG,kDAAkD,YAAY;AAC/D,QAAI,IAAI,KAAK,CAAC;AACd,QAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,UAAM,MAAM,MAAM,IAAI,QAAQ,SAAS,EAAE,QAAQ,OAAO,CAAC;AACzD,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,EAC7B,CAAC;AAED,KAAG,sDAAsD,YAAY;AACnE,QAAI,IAAI,KAAK,CAAC;AACd,QAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,UAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,MACrC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,gBAAgB,QAAQ,0BAA0B;AAAA,IAC/E,CAAC;AACD,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,EAC7B,CAAC;AAED,KAAG,mDAAmD,YAAY;AAChE,QAAI,IAAI,KAAK,CAAC;AACd,QAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,UAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,MACrC,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,QAAQ;AAAA,MACV;AAAA,IACF,CAAC;AACD,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAC3B,WAAO,MAAM,IAAI,KAAK,CAAC,EAAE,KAAK,IAAI;AAAA,EACpC,CAAC;AAED,KAAG,6CAA6C,YAAY;AAC1D,QAAI,IAAI,KAAK,EAAE,YAAY,cAAc,YAAY,eAAe,CAAC,CAAC;AACtE,QAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,UAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,MACrC,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,QAAQ;AAAA,MACV;AAAA,IACF,CAAC;AACD,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,EAC7B,CAAC;AAED,KAAG,iCAAiC,YAAY;AAC9C,QAAI,IAAI,KAAK,EAAE,SAAS,CAAC,EAAE,MAAM,cAAc,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;AACtE,QAAI,KAAK,mBAAmB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAC/C,QAAI,KAAK,aAAa,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAGzC,UAAM,aAAa,MAAM,IAAI,QAAQ,mBAAmB,EAAE,QAAQ,OAAO,CAAC;AAC1E,WAAO,WAAW,MAAM,EAAE,KAAK,GAAG;AAGlC,UAAM,SAAS,MAAM,IAAI,QAAQ,aAAa,EAAE,QAAQ,OAAO,CAAC;AAChE,WAAO,OAAO,MAAM,EAAE,KAAK,GAAG;AAAA,EAChC,CAAC;AAED,KAAG,mEAAmE,YAAY;AAChF,QAAI,IAAI,KAAK,EAAE,SAAS,CAAC,EAAE,MAAM,uBAAuB,CAAC,EAAE,CAAC,CAAC;AAC7D,QAAI,KAAK,wBAAwB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AACpD,QAAI,IAAI,wBAAwB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAEnD,UAAM,UAAU,MAAM,IAAI,QAAQ,wBAAwB,EAAE,QAAQ,OAAO,CAAC;AAC5E,WAAO,QAAQ,MAAM,EAAE,KAAK,GAAG;AAE/B,UAAM,SAAS,MAAM,IAAI,QAAQ,wBAAwB,EAAE,QAAQ,MAAM,CAAC;AAC1E,WAAO,OAAO,MAAM,EAAE,KAAK,GAAG;AAAA,EAChC,CAAC;AAED,KAAG,qCAAqC,YAAY;AAClD,QAAI,IAAI,KAAK,CAAC;AACd,QAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,UAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,MACrC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,IAAI,QAAQ,cAAc;AAAA,IACvD,CAAC;AACD,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,EAC7B,CAAC;AAED,KAAG,gCAAgC,YAAY;AAC7C,QAAI,IAAI,KAAK,CAAC;AACd,QAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,UAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,MACrC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,QAAQ;AAAA,IACrC,CAAC;AACD,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,EAC7B,CAAC;AAED,KAAG,gCAAgC,YAAY;AAC7C,QAAI,IAAI,KAAK,CAAC;AACd,QAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,UAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,MACrC,QAAQ;AAAA,MACR,SAAS,EAAE,QAAQ,mBAAmB;AAAA,IACxC,CAAC;AACD,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,EAC7B,CAAC;AAED,KAAG,mCAAmC,YAAY;AAChD,QAAI,IAAI,KAAK,EAAE,cAAc,oBAAoB,CAAC,CAAC;AACnD,QAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,UAAM,MAAM,MAAM,IAAI,QAAQ,SAAS,EAAE,QAAQ,OAAO,CAAC;AACzD,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAC3B,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,WAAO,KAAK,MAAM,OAAO,EAAE,KAAK,mBAAmB;AAAA,EACrD,CAAC;AAED,KAAG,wCAAwC,YAAY;AACrD,QAAI,IAAI,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC;AACtC,QAAI,IAAI,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAGpC,UAAM,MAAM,MAAM,IAAI,QAAQ,SAAS,EAAE,QAAQ,OAAO,CAAC;AACzD,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,EAC7B,CAAC;AAED,KAAG,yCAAyC,YAAY;AACtD,QAAI;AAAA,MACF,KAAK;AAAA,QACH,SAAS;AAAA,UACP,EAAE,MAAM,aAAa,SAAS,CAAC,OAAO,MAAM,EAAE;AAAA,UAC9C,EAAE,MAAM,aAAa,SAAS,CAAC,MAAM,EAAE;AAAA,UACvC,EAAE,MAAM,YAAY;AAAA;AAAA,QACtB;AAAA,MACF,CAAC;AAAA,IACH;AAEA,QAAI,IAAI,iBAAiB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAC5C,QAAI,KAAK,iBAAiB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAC7C,QAAI,IAAI,iBAAiB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAC5C,QAAI,KAAK,iBAAiB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAC7C,QAAI,IAAI,iBAAiB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAC5C,QAAI,KAAK,gBAAgB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAG5C,QAAI,MAAM,MAAM,IAAI,QAAQ,iBAAiB,EAAE,QAAQ,MAAM,CAAC;AAC9D,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAE3B,UAAM,MAAM,IAAI,QAAQ,iBAAiB,EAAE,QAAQ,OAAO,CAAC;AAC3D,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAG3B,UAAM,MAAM,IAAI,QAAQ,iBAAiB,EAAE,QAAQ,MAAM,CAAC;AAC1D,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAG3B,UAAM,MAAM,IAAI,QAAQ,iBAAiB,EAAE,QAAQ,OAAO,CAAC;AAC3D,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAG3B,UAAM,MAAM,IAAI,QAAQ,iBAAiB,EAAE,QAAQ,MAAM,CAAC;AAC1D,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAG3B,UAAM,MAAM,IAAI,QAAQ,gBAAgB,EAAE,QAAQ,OAAO,CAAC;AAC1D,WAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,EAC7B,CAAC;AAED,WAAS,iBAAiB,MAAM;AAC9B,OAAG,iDAAiD,YAAY;AAC9D,UAAI,IAAI,KAAK,EAAE,QAAQ,CAAC,uBAAuB,qBAAqB,EAAE,CAAC,CAAC;AACxE,UAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAGrC,YAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,QACrC,QAAQ;AAAA,QACR,SAAS,EAAE,QAAQ,sBAAsB;AAAA,MAC3C,CAAC;AACD,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAC3B,aAAO,MAAM,IAAI,KAAK,CAAC,EAAE,KAAK,IAAI;AAAA,IACpC,CAAC;AAED,OAAG,oDAAoD,YAAY;AACjE,UAAI,IAAI,KAAK,EAAE,QAAQ,CAAC,uBAAuB,qBAAqB,EAAE,CAAC,CAAC;AACxE,UAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,YAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,QACrC,QAAQ;AAAA,QACR,SAAS,EAAE,QAAQ,sBAAsB;AAAA,MAC3C,CAAC;AACD,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,IAC7B,CAAC;AAED,OAAG,sDAAsD,YAAY;AACnE,UAAI,IAAI,KAAK,EAAE,QAAQ,CAAC,qBAAqB,EAAE,CAAC,CAAC;AACjD,UAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,YAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,QACrC,QAAQ;AAAA,QACR,SAAS,EAAE,QAAQ,wBAAwB;AAAA,MAC7C,CAAC;AACD,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,IAC7B,CAAC;AAED,OAAG,gDAAgD,YAAY;AAC7D,UAAI,IAAI,KAAK,EAAE,QAAQ,CAAC,qBAAqB,EAAE,CAAC,CAAC;AACjD,UAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,YAAM,MAAM,MAAM,IAAI,QAAQ,SAAS,EAAE,QAAQ,OAAO,CAAC;AACzD,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,IAC7B,CAAC;AAED,OAAG,mCAAmC,YAAY;AAChD,UAAI,IAAI,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;AAC5B,UAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,YAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,QACrC,QAAQ;AAAA,QACR,SAAS,EAAE,QAAQ,sBAAsB;AAAA,MAC3C,CAAC;AACD,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,IAC7B,CAAC;AAAA,EACH,CAAC;AAED,WAAS,yBAAyB,MAAM;AACtC,OAAG,+DAA+D,YAAY;AAC5E,UAAI,IAAI,KAAK,EAAE,cAAc,CAAC,eAAe,WAAW,EAAE,CAAC,CAAC;AAC5D,UAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,YAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,QACrC,QAAQ;AAAA,QACR,SAAS,EAAE,kBAAkB,cAAc;AAAA,MAC7C,CAAC;AACD,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAC3B,aAAO,MAAM,IAAI,KAAK,CAAC,EAAE,KAAK,IAAI;AAAA,IACpC,CAAC;AAED,OAAG,kEAAkE,YAAY;AAC/E,UAAI,IAAI,KAAK,EAAE,cAAc,CAAC,eAAe,aAAa,cAAc,EAAE,CAAC,CAAC;AAC5E,UAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,YAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,QACrC,QAAQ;AAAA,QACR,SAAS,EAAE,kBAAkB,eAAe;AAAA,MAC9C,CAAC;AACD,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,IAC7B,CAAC;AAED,OAAG,oEAAoE,YAAY;AACjF,UAAI,IAAI,KAAK,EAAE,cAAc,CAAC,aAAa,EAAE,CAAC,CAAC;AAC/C,UAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,YAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,QACrC,QAAQ;AAAA,QACR,SAAS,EAAE,kBAAkB,YAAY;AAAA,MAC3C,CAAC;AACD,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,IAC7B,CAAC;AAED,OAAG,wDAAwD,YAAY;AACrE,UAAI,IAAI,KAAK,EAAE,cAAc,CAAC,aAAa,EAAE,CAAC,CAAC;AAC/C,UAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,YAAM,MAAM,MAAM,IAAI,QAAQ,SAAS,EAAE,QAAQ,OAAO,CAAC;AACzD,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,IAC7B,CAAC;AAED,OAAG,iDAAiD,YAAY;AAC9D,UAAI,IAAI,KAAK,EAAE,cAAc,CAAC,eAAe,aAAa,QAAQ,cAAc,EAAE,CAAC,CAAC;AACpF,UAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,YAAM,cAAc,CAAC,eAAe,aAAa,QAAQ,cAAc;AAEvE,iBAAW,SAAS,aAAa;AAC/B,cAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,UACrC,QAAQ;AAAA,UACR,SAAS,EAAE,kBAAkB,MAAM;AAAA,QACrC,CAAC;AACD,eAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,MAC7B;AAAA,IACF,CAAC;AAED,OAAG,2CAA2C,YAAY;AACxD,UAAI,IAAI,KAAK,EAAE,cAAc,CAAC,EAAE,CAAC,CAAC;AAClC,UAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,YAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,QACrC,QAAQ;AAAA,QACR,SAAS,EAAE,kBAAkB,cAAc;AAAA,MAC7C,CAAC;AACD,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,IAC7B,CAAC;AAAA,EACH,CAAC;AAED,WAAS,6CAA6C,MAAM;AAC1D,OAAG,kEAAkE,YAAY;AAC/E,UAAI;AAAA,QACF,KAAK;AAAA,UACH,QAAQ,CAAC,qBAAqB;AAAA,UAC9B,cAAc,CAAC,WAAW;AAAA,QAC5B,CAAC;AAAA,MACH;AACA,UAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAGrC,UAAI,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,QACnC,QAAQ;AAAA,QACR,SAAS,EAAE,QAAQ,sBAAsB;AAAA,MAC3C,CAAC;AACD,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAG3B,YAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,QAC/B,QAAQ;AAAA,QACR,SAAS,EAAE,kBAAkB,YAAY;AAAA,MAC3C,CAAC;AACD,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,IAC7B,CAAC;AAED,OAAG,qEAAqE,YAAY;AAClF,UAAI;AAAA,QACF,KAAK;AAAA,UACH,QAAQ,CAAC,qBAAqB;AAAA,UAC9B,cAAc,CAAC,aAAa;AAAA,QAC9B,CAAC;AAAA,MACH;AACA,UAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAErC,YAAM,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,QACrC,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,QAAQ;AAAA,UACR,kBAAkB;AAAA,QACpB;AAAA,MACF,CAAC;AACD,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,IAC7B,CAAC;AAED,OAAG,qEAAqE,YAAY;AAClF,UAAI;AAAA,QACF,KAAK;AAAA,UACH,QAAQ,CAAC,qBAAqB;AAAA,UAC9B,cAAc,CAAC,WAAW;AAAA,UAC1B,SAAS,CAAC,EAAE,MAAM,cAAc,SAAS,CAAC,MAAM,EAAE,CAAC;AAAA,QACrD,CAAC;AAAA,MACH;AAEA,UAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AACrC,UAAI,KAAK,mBAAmB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAC/C,UAAI,KAAK,aAAa,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;AAGzC,UAAI,MAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,QACnC,QAAQ;AAAA,QACR,SAAS,EAAE,QAAQ,sBAAsB;AAAA,MAC3C,CAAC;AACD,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAG3B,YAAM,MAAM,IAAI,QAAQ,SAAS;AAAA,QAC/B,QAAQ;AAAA,QACR,SAAS,EAAE,kBAAkB,YAAY;AAAA,MAC3C,CAAC;AACD,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAG3B,YAAM,MAAM,IAAI,QAAQ,mBAAmB,EAAE,QAAQ,OAAO,CAAC;AAC7D,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAG3B,YAAM,MAAM,IAAI,QAAQ,aAAa,EAAE,QAAQ,OAAO,CAAC;AACvD,aAAO,IAAI,MAAM,EAAE,KAAK,GAAG;AAAA,IAC7B,CAAC;AAAA,EACH,CAAC;AACH,CAAC;","names":[]}