hono 4.12.32: cookie

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify hono/cookie in pkg:npm/hono@4.12.32
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:npm/hono@4.12.32
Demonstrate these symbols/APIs:
  - hono/cookie

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:742996b267da3dd65dad88596bad168029689f908a0b907ec4d825cda9087734","contract":["hono package exports hono/cookie entrypoint and version 4.12.32","getCookie reads single cookie or all cookies from Request headers","setCookie sets Set-Cookie response header with options","deleteCookie expires cookie by setting Max-Age=0","setSignedCookie and getSignedCookie sign and verify cookies with HMAC signature"],"goal":"verify hono/cookie in pkg:npm/hono@4.12.32","kind":"HOW","packages":["pkg:npm/hono@4.12.32"],"schemaVersion":1,"symbols":["hono/cookie"]},"contractCommand":["node","test/contract.mjs"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"npm","language":"javascript","libc":"glibc","libcVersion":"2.39","moduleSystem":"esm","os":"linux","osVersionBucket":"24","packageManager":"npm","packageManagerVersion":"10.9.8","runtime":"node","runtimeVersion":"22.23.2","schemaVersion":1},"license":"MIT-0","packages":["pkg:npm/hono@4.12.32"],"schemaVersion":1,"subject":"pkg:npm/hono@4.12.32","symbols":["hono/cookie"],"verifierAdapter":"node-typescript@1"}

{
  "name": "sample-hono-cookie",
  "version": "1.0.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "sample-hono-cookie",
      "version": "1.0.0",
      "license": "MIT-0",
      "dependencies": {
        "hono": "4.12.32"
      }
    },
    "node_modules/hono": {
      "version": "4.12.32",
      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.32.tgz",
      "integrity": "sha512-XcuyW9qE2kJn07PkecMOBd5Vq/hMy7mmGw+idz1yblbg9N17ijJODrvPkn7/dwL3Kulj8LcRJ69DLOWf91dRUg==",
      "license": "MIT",
      "engines": {
        "node": ">=16.9.0"
      }
    }
  }
}

{
  "name": "sample-hono-cookie",
  "version": "1.0.0",
  "type": "module",
  "private": true,
  "license": "MIT-0",
  "dependencies": {
    "hono": "4.12.32"
  }
}

{
  "schemaVersion": 1,
  "goal": "verify hono/cookie in pkg:npm/hono@4.12.32",
  "kind": "HOW",
  "packages": [
    "pkg:npm/hono@4.12.32"
  ],
  "symbols": [
    "hono/cookie"
  ]
}

import assert from 'node:assert/strict';
import fs from 'node:fs';
import { fileURLToPath } from 'node:url';
import { Hono } from 'hono';
import {
  getCookie,
  setCookie,
  deleteCookie,
  getSignedCookie,
  setSignedCookie,
} from 'hono/cookie';

// Contract 1: hono package exports hono/cookie entrypoint and version 4.12.32
{
  const honoEntryUrl = import.meta.resolve('hono');
  const pkgJsonPath = fileURLToPath(new URL('../package.json', honoEntryUrl));
  assert.ok(fs.existsSync(pkgJsonPath));
  const pkgJson = JSON.parse(fs.readFileSync(pkgJsonPath, 'utf8'));
  assert.strictEqual(pkgJson.name, 'hono');
  assert.strictEqual(pkgJson.version, '4.12.32');
  assert.ok(pkgJson.exports['./cookie']);
  assert.strictEqual(typeof getCookie, 'function');
  assert.strictEqual(typeof setCookie, 'function');
  assert.strictEqual(typeof deleteCookie, 'function');
  assert.strictEqual(typeof getSignedCookie, 'function');
  assert.strictEqual(typeof setSignedCookie, 'function');
}

// Contract 2: getCookie reads single cookie or all cookies from Request headers
{
  const app = new Hono();
  app.get('/read', (c) => {
    const session = getCookie(c, 'session');
    const all = getCookie(c);
    return c.json({ session, all });
  });

  const res = await app.request('http://localhost/read', {
    headers: {
      Cookie: 'session=abc123xyz; theme=dark; user=alice',
    },
  });

  assert.strictEqual(res.status, 200);
  const data = await res.json();
  assert.strictEqual(data.session, 'abc123xyz');
  assert.deepStrictEqual(data.all, {
    session: 'abc123xyz',
    theme: 'dark',
    user: 'alice',
  });
}

// Contract 3: setCookie sets Set-Cookie response header with options
{
  const app = new Hono();
  app.get('/set', (c) => {
    setCookie(c, 'theme', 'dark', {
      path: '/',
      secure: true,
      httpOnly: true,
      maxAge: 3600,
      sameSite: 'Strict',
    });
    return c.text('cookie set');
  });

  const res = await app.request('http://localhost/set');
  assert.strictEqual(res.status, 200);
  const setCookieHeader = res.headers.get('set-cookie');
  assert.ok(setCookieHeader);
  assert.ok(setCookieHeader.includes('theme=dark'));
  assert.ok(setCookieHeader.includes('Path=/'));
  assert.ok(setCookieHeader.includes('Max-Age=3600'));
  assert.ok(setCookieHeader.includes('HttpOnly'));
  assert.ok(setCookieHeader.includes('Secure'));
  assert.ok(setCookieHeader.includes('SameSite=Strict'));
}

// Contract 4: deleteCookie expires cookie by setting Max-Age=0
{
  const app = new Hono();
  app.get('/del', (c) => {
    deleteCookie(c, 'session', {
      path: '/',
      secure: true,
    });
    return c.text('cookie deleted');
  });

  const res = await app.request('http://localhost/del');
  assert.strictEqual(res.status, 200);
  const setCookieHeader = res.headers.get('set-cookie');
  assert.ok(setCookieHeader);
  assert.ok(setCookieHeader.includes('session='));
  assert.ok(setCookieHeader.includes('Max-Age=0'));
}

// Contract 5: setSignedCookie and getSignedCookie sign and verify cookies with HMAC signature
{
  const secret = 'super-secret-key-1234567890';
  const app = new Hono();

  app.get('/set-signed', async (c) => {
    await setSignedCookie(c, 'token', 'user-payload-42', secret, {
      path: '/',
      httpOnly: true,
    });
    return c.text('signed cookie set');
  });

  app.get('/verify-signed', async (c) => {
    const token = await getSignedCookie(c, secret, 'token');
    return c.json({ token });
  });

  // 1. Generate signed cookie
  const setRes = await app.request('http://localhost/set-signed');
  assert.strictEqual(setRes.status, 200);
  const setCookieHeader = setRes.headers.get('set-cookie');
  assert.ok(setCookieHeader);
  const rawCookie = setCookieHeader.split(';')[0]; // "token=..."

  // 2. Verify with valid secret
  const verifyRes = await app.request('http://localhost/verify-signed', {
    headers: {
      Cookie: rawCookie,
    },
  });
  assert.strictEqual(verifyRes.status, 200);
  const verifyData = await verifyRes.json();
  assert.strictEqual(verifyData.token, 'user-payload-42');

  // 3. Verify tampering is rejected (returns false)
  const tamperedApp = new Hono();
  tamperedApp.get('/verify-tampered', async (c) => {
    const token = await getSignedCookie(c, 'wrong-secret', 'token');
    return c.json({ token });
  });
  const tamperedRes = await tamperedApp.request('http://localhost/verify-tampered', {
    headers: {
      Cookie: rawCookie,
    },
  });
  const tamperedData = await tamperedRes.json();
  assert.strictEqual(tamperedData.token, false);
}

console.log('All hono/cookie contract tests passed.');