@fastify/cookie 11.0.2 → 11.1.1

package/.github/dependabot.yml

@@ -2,12 +2,52 @@ version: 2
 updates:
   - package-ecosystem: "github-actions"
     directory: "/"
+    commit-message:
+      # Prefix all commit messages with "chore: "
+      prefix: "chore"
     schedule:
-      interval: "monthly"
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+    allow:
+      - dependency-name: "*"
+        update-types:
+          - "version-update:semver-major"
     open-pull-requests-limit: 10
 
   - package-ecosystem: "npm"
     directory: "/"
+    commit-message:
+      # Prefix all commit messages with "chore: "
+      prefix: "chore"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
+    versioning-strategy: "increase-if-necessary"
+    allow:
+      - dependency-name: "*"
+        update-types:
+          - "version-update:semver-major"
+    ignore:
+      # TODO: remove ignore until neostandard support ESLint 10
+      - dependency-name: "eslint"
+      - dependency-name: "neostandard"
+      - dependency-name: "@stylistic/*"
     open-pull-requests-limit: 10
+    groups:
+      # Production dependencies with breaking changes
+      dependencies:
+        dependency-type: "production"
+      # ESLint related dependencies
+      dev-dependencies-eslint:
+        patterns:
+          - "eslint"
+          - "neostandard"
+          - "@stylistic/*"
+      # TypeScript related dependencies
+      dev-dependencies-typescript:
+        patterns:
+          - "@types/*"
+          - "tstyche"
+          - "typescript"

package/.github/workflows/ci.yml

@@ -4,7 +4,6 @@ on:
   push:
     branches:
      - main
-     - master
      - next
      - 'v*'
     paths-ignore:
@@ -15,9 +14,20 @@ on:
       - 'docs/**'
       - '*.md'
 
+# This allows a subsequently queued workflow run to interrupt previous runs
+concurrency:
+    group: "${{ github.workflow }}-${{ github.event.pull_request.head.label || github.head_ref || github.ref }}"
+    cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   test:
-    uses: fastify/workflows/.github/workflows/plugins-ci.yml@v5
+    permissions:
+      contents: write
+      pull-requests: write
+    uses: fastify/workflows/.github/workflows/plugins-ci.yml@v6
     with:
       license-check: true
       lint: true

package/.github/workflows/lock-threads.yml

@@ -0,0 +1,19 @@
+name: Lock Threads
+
+on:
+  schedule:
+    - cron: '0 0 1 * *'
+  workflow_dispatch:
+
+concurrency:
+  group: lock
+
+permissions:
+  contents: read
+
+jobs:
+  lock-threads:
+    permissions:
+      issues: write
+      pull-requests: write
+    uses: fastify/workflows/.github/workflows/lock-threads.yml@v6

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) Fastify
+Copyright (c) 2017-present The Fastify team <https://github.com/fastify/fastify#team>
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -1,10 +1,10 @@
 # @fastify/cookie
 
-[![CI](https://github.com/fastify/fastify-cookie/actions/workflows/ci.yml/badge.svg?branch=master)](https://github.com/fastify/fastify-cookie/actions/workflows/ci.yml)
+[![CI](https://github.com/fastify/fastify-cookie/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/fastify/fastify-cookie/actions/workflows/ci.yml)
 [![NPM version](https://img.shields.io/npm/v/@fastify/cookie.svg?style=flat)](https://www.npmjs.com/package/@fastify/cookie)
 [![neostandard javascript style](https://img.shields.io/badge/code_style-neostandard-brightgreen?style=flat)](https://github.com/neostandard/neostandard)
 
-A plugin for [Fastify](http://fastify.dev/) that adds support for reading and
+A plugin for [Fastify](https://fastify.dev/) that adds support for reading and
 setting cookies.
 
 This plugin's cookie parsing works via Fastify's `onRequest` hook. Therefore,
@@ -14,17 +14,19 @@ upon this plugin's actions.
 It is also possible to [import the low-level cookie parsing and serialization functions](#importing-serialize-and-parse).
 
 ## Install
+
 ```sh
 npm i @fastify/cookie
 ```
 
 ### Compatibility
+
 | Plugin version | Fastify version |
 | ---------------|-----------------|
-| `^10.x`        | `^5.x`          |
-| `^7.x`         | `^4.x`          |
-| `^4.x`         | `^3.x`          |
-| `^2.x`         | `^2.x`          |
+| `>=10.x`       | `^5.x`          |
+| `>=7.x <10.x`  | `^4.x`          |
+| `>=4.x <7.x`   | `^3.x`          |
+| `>=2.x <4.x`   | `^2.x`          |
 | `^1.x`         | `^1.x`          |
 
 Please note that if a Fastify version is out of support, then so are the corresponding versions of this plugin
@@ -95,7 +97,7 @@ fastify.get('/', (req, reply) => {
 ## Options
 
 - `secret` (`String` | `Array` | `Buffer` | `Object`):
-  - A `String` or `Buffer` can be passed to use as secret to sign the cookie using [`cookie-signature`](http://npm.im/cookie-signature).
+  - A `String` or `Buffer` can be passed to use as secret to sign the cookie using [`cookie-signature`](https://www.npmjs.com/package/cookie-signature).
   - An `Array` can be passed if key rotation is desired. Read more about it in [Rotating signing secret](#rotating-secret).
   - More sophisticated cookie signing mechanisms can be implemented by supplying an `Object`. Read more about it in [Custom cookie signer](#custom-cookie-signer).
 
@@ -162,17 +164,16 @@ attribute. When truthy, the `Partitioned` attribute is set, otherwise it is not.
 
 More information about this can be found in [the proposal](https://github.com/privacycg/CHIPS).
 
-
 ##### priority
 
-Specifies the `string` to be the value for the [`Priority` `Set-Cookie` attribute](https://tools.ietf.org/html/draft-west-cookie-priority-00#section-4.1).
+Specifies the `string` to be the value for the [`Priority` `Set-Cookie` attribute](https://datatracker.ietf.org/doc/html/draft-west-cookie-priority-00#section-4.1).
 
-  - `'low'` will set the `Priority` attribute to `Low`.
-  - `'medium'` will set the `Priority` attribute to `Medium`, the default priority when not set.
-  - `'high'` will set the `Priority` attribute to `High`.
+- `'low'` will set the `Priority` attribute to `Low`.
+- `'medium'` will set the `Priority` attribute to `Medium`, the default priority when not set.
+- `'high'` will set the `Priority` attribute to `High`.
 
 More information about the different priority levels can be found in
-[the specification](https://tools.ietf.org/html/draft-west-cookie-priority-00#section-4.1).
+[the specification](https://datatracker.ietf.org/doc/html/draft-west-cookie-priority-00#section-4.1).
 
 ⚠️ **Warning:** This is an attribute that has not yet been fully standardized, and may change in the future without reflecting the semver versioning. This also means many clients may ignore the attribute until they understand it.
 
@@ -185,11 +186,11 @@ is considered the ["default path"](https://datatracker.ietf.org/doc/html/rfc6265
 
 Specifies the `boolean` or `string` to be the value for the [`SameSite` `Set-Cookie` attribute](https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-09#section-5.4.7).
 
-  - `true` will set the `SameSite` attribute to `Strict` for strict same site enforcement.
-  - `false` will not set the `SameSite` attribute.
-  - `'lax'` will set the `SameSite` attribute to `Lax` for lax same site enforcement.
-  - `'none'` will set the `SameSite` attribute to `None` for an explicit cross-site cookie.
-  - `'strict'` will set the `SameSite` attribute to `Strict` for strict same site enforcement.
+- `true` will set the `SameSite` attribute to `Strict` for strict same site enforcement.
+- `false` will not set the `SameSite` attribute.
+- `'lax'` will set the `SameSite` attribute to `Lax` for lax same site enforcement.
+- `'none'` will set the `SameSite` attribute to `None` for an explicit cross-site cookie.
+- `'strict'` will set the `SameSite` attribute to `Strict` for strict same site enforcement.
 
 More information about the different enforcement levels can be found in
 [the specification](https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-09#section-5.4.7).
@@ -214,7 +215,7 @@ as an object named `cookies`. Thus, if a request contains the header
 `Cookie: foo=foo` then, within your handler, `req.cookies.foo` would equal
 `'foo'`.
 
-You can pass options to the [cookie parse](https://github.com/jshttp/cookie#cookieparsestr-options) by setting an object named `parseOptions` in the plugin config object.
+You can pass options to the [cookie parse](https://github.com/jshttp/cookie#cookieparsecookiestr-options) by setting an object named `parseOptions` in the plugin config object.
 
 ### Sending
 
@@ -223,11 +224,11 @@ via the Fastify `decorateReply` API. Thus, in a request handler,
 `reply.setCookie('foo', 'foo', {path: '/'})` will set a cookie named `foo`
 with a value of `'foo'` on the cookie path `/`.
 
-+ `name`: a string name for the cookie to be set
-+ `value`: a string value for the cookie
-+ `options`: an options object as described in the [cookie serialize][cs] documentation
-+ `options.signed`: the cookie should be signed
-+ `options.secure`: if set to `true` it will set the Secure-flag. If it is set to `"auto"` Secure-flag is set when the connection is using tls.
+- `name`: a string name for the cookie to be set
+- `value`: a string value for the cookie
+- `options`: an options object as described in the [cookie serialize][cs] documentation
+- `options.signed`: the cookie should be signed
+- `options.secure`: if set to `true` it will set the Secure-flag. If it is set to `"auto"` Secure-flag is set when the connection is using tls.
 
 #### Securing the cookie
 
@@ -235,7 +236,7 @@ Following are _some_ of the precautions that should be taken to ensure the integ
 
 - It's important to use `options.httpOnly` cookies to prevent attacks like XSS.
 - Use signed cookies (`options.signed`) to ensure they are not getting tampered wit client-side by an attacker.
-- Use `__Host-` [Cookie Prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#Attributes) to avoid Cookie Tossing attacks.
+- Use `__Host-` [Cookie Prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie#attributes) to avoid Cookie Tossing attacks.
 - It is important to [use HTTPS for your website/app](https://letsencrypt.org/) to avoid a bunch of other potential security issues like [MITM](https://en.wikipedia.org/wiki/Man-in-the-middle_attack) etc.
 
 ### Clearing
@@ -245,8 +246,8 @@ via the Fastify `decorateReply` API. Thus, in a request handler,
 `reply.clearCookie('foo', {path: '/'})` will clear a cookie named `foo`
 on the cookie path `/`.
 
-+ `name`: a string name for the cookie to be cleared
-+ `options`: an options object as described in the [cookie serialize][cs]
+- `name`: a string name for the cookie to be cleared
+- `options`: an options object as described in the [cookie serialize][cs]
 documentation. It is optional to pass an `options` object
 
 ### Manual cookie parsing
@@ -255,14 +256,16 @@ The method `parseCookie(cookieHeader)` is added to the `fastify` instance
 via the Fastify `decorate` API. Thus, `fastify.parseCookie('sessionId=aYb4uTIhdBXC')`
 will parse the raw cookie header and return an object `{ "sessionId": "aYb4uTIhdBXC" }`.
 
-[cs]: https://www.npmjs.com/package/cookie#options-1
+[cs]: https://github.com/jshttp/cookie#cookiestringifysetcookiesetcookieobj-options
 
 <a id="rotating-secret"></a>
+
 ### Rotating signing secret
 
 Key rotation is when an encryption key is retired and replaced by generating a new cryptographic key. To implement rotation, supply an `Array` of keys to `secret` option.
 
 **Example:**
+
 ```js
 fastify.register(require('@fastify/cookie'), {
   secret: [key1, key2]
@@ -272,11 +275,13 @@ fastify.register(require('@fastify/cookie'), {
 The plugin will **always** use the first key (`key1`) to sign cookies. When parsing incoming cookies, it will iterate over the supplied array to see if any of the available keys are able to decode the given signed cookie. This ensures that any old signed cookies are still valid.
 
 Note:
+
 - Key rotation is **only** achieved by redeploying the server again with the new `secret` array.
 - Iterating through all secrets is an expensive process, so the rotation list should contain as few keys as possible. Ideally, only the current key and the most recently retired key.
 - Although previously signed cookies are valid even after rotation, cookies should be updated with the new key as soon as possible. See the following example for how to accomplish this.
 
 **Example:**
+
 ```js
 fastify.get('/', (req, reply) => {
   const result = reply.unsignCookie(req.cookies.myCookie)
@@ -293,11 +298,13 @@ fastify.get('/', (req, reply) => {
 ```
 
 <a id="custom-cookie-signer"></a>
+
 ### Custom cookie signer
 
 The `secret` option optionally accepts an object with `sign` and `unsign` functions. This allows for implementing a custom cookie signing mechanism. See the following example:
 
 **Example:**
+
 ```js
 fastify.register(require('@fastify/cookie'), {
   secret: {
@@ -382,7 +389,6 @@ const signedValue = fastifyCookie.sign('test', 'secret');
 const unsignedvalue = fastifyCookie.unsign(signedValue, 'secret');
 ```
 
-
 ## License
 
 Licensed under [MIT](./LICENSE).

package/{plugin.js → index.js}

@@ -1,10 +1,14 @@
 'use strict'
 
 const fp = require('fastify-plugin')
-const cookie = require('cookie')
+const { parseCookie: parse, stringifySetCookie } = require('cookie')
 
 const { Signer, sign, unsign } = require('./signer')
 
+function serialize (name, value, options) {
+  return stringifySetCookie(Object.assign({ name, value }, options))
+}
+
 const kReplySetCookies = Symbol('fastify.reply.setCookies')
 const kReplySetCookiesHookRan = Symbol('fastify.reply.setCookiesHookRan')
 
@@ -29,7 +33,11 @@ function fastifyCookieSetCookie (reply, name, value, options) {
     }
   }
 
-  reply[kReplySetCookies].set(`${name};${opts.domain};${opts.path || '/'}`, { name, value, opts })
+  reply[kReplySetCookies].set(`${name};${opts.domain};${opts.path || '/'}`, {
+    name,
+    value,
+    opts
+  })
 
   if (reply[kReplySetCookiesHookRan]) {
     setCookies(reply)
@@ -77,7 +85,7 @@ function setCookies (reply) {
     if (reply[kReplySetCookies].size === 1) {
       // Fast path for single cookie
       const c = reply[kReplySetCookies].values().next().value
-      reply.header('Set-Cookie', cookie.serialize(c.name, c.value, c.opts))
+      reply.header('Set-Cookie', serialize(c.name, c.value, c.opts))
       reply[kReplySetCookies].clear()
       return
     }
@@ -90,7 +98,7 @@ function setCookies (reply) {
   }
 
   for (const c of reply[kReplySetCookies].values()) {
-    cookieValue.push(cookie.serialize(c.name, c.value, c.opts))
+    cookieValue.push(serialize(c.name, c.value, c.opts))
   }
 
   reply.removeHeader('Set-Cookie')
@@ -117,12 +125,20 @@ function plugin (fastify, options, next) {
   const secret = options.secret
   const hook = getHook(options.hook)
   if (hook === undefined) {
-    return next(new Error('@fastify/cookie: Invalid value provided for the hook-option. You can set the hook-option only to false, \'onRequest\' , \'preParsing\' , \'preValidation\' or \'preHandler\''))
-  }
-  const isSigner = !secret || (typeof secret.sign === 'function' && typeof secret.unsign === 'function')
-  const signer = isSigner ? secret : new Signer(secret, options.algorithm || 'sha256')
-
-  fastify.decorate('serializeCookie', cookie.serialize)
+    return next(
+      new Error(
+        "@fastify/cookie: Invalid value provided for the hook-option. You can set the hook-option only to false, 'onRequest' , 'preParsing' , 'preValidation' or 'preHandler'"
+      )
+    )
+  }
+  const isSigner =
+    !secret ||
+    (typeof secret.sign === 'function' && typeof secret.unsign === 'function')
+  const signer = isSigner
+    ? secret
+    : new Signer(secret, options.algorithm || 'sha256')
+
+  fastify.decorate('serializeCookie', serialize)
   fastify.decorate('parseCookie', parseCookie)
 
   if (secret !== undefined) {
@@ -146,14 +162,16 @@ function plugin (fastify, options, next) {
 
   if (hook) {
     fastify.addHook(hook, onReqHandlerWrapper(fastify, hook))
-    fastify.addHook('onSend', fastifyCookieOnSendHandler)
   }
+  // The onSend writer is independent of the parsing hook: `hook: false` only
+  // disables cookie autoparsing, not the ability to set cookies on the reply.
+  fastify.addHook('onSend', fastifyCookieOnSendHandler)
 
   next()
 
   // ***************************
   function parseCookie (cookieHeader) {
-    return cookie.parse(cookieHeader, options.parseOptions)
+    return parse(cookieHeader, options.parseOptions)
   }
 
   function signCookie (value) {
@@ -206,8 +224,8 @@ module.exports = fastifyCookie
 module.exports.default = fastifyCookie // supersedes fastifyCookie.default = fastifyCookie
 module.exports.fastifyCookie = fastifyCookie // supersedes fastifyCookie.fastifyCookie = fastifyCookie
 
-module.exports.serialize = cookie.serialize
-module.exports.parse = cookie.parse
+module.exports.serialize = serialize
+module.exports.parse = parse
 
 module.exports.signerFactory = Signer
 module.exports.Signer = Signer

package/package.json

@@ -1,26 +1,22 @@
 {
   "name": "@fastify/cookie",
-  "version": "11.0.2",
+  "version": "11.1.1",
   "description": "Plugin for fastify to add support for cookies",
-  "main": "plugin.js",
+  "main": "index.js",
   "type": "commonjs",
-  "types": "types/plugin.d.ts",
+  "types": "types/index.d.ts",
   "scripts": {
     "coverage": "npm run test:unit -- --coverage-report=html",
     "lint": "eslint",
     "lint:fix": "eslint --fix",
     "test": "npm run test:unit && npm run test:typescript",
-    "test:typescript": "tsd",
+    "test:typescript": "tstyche",
     "test:unit": "c8 --100 node --test",
     "test:unit:verbose": "npm run test:unit -- -Rspec"
   },
-  "precommit": [
-    "lint",
-    "test"
-  ],
   "repository": {
     "type": "git",
-    "url": "git+ssh://git@github.com/fastify/fastify-cookie.git"
+    "url": "git+https://github.com/fastify/fastify-cookie.git"
   },
   "keywords": [
     "fastify",
@@ -62,22 +58,18 @@
     }
   ],
   "devDependencies": {
-    "@fastify/pre-commit": "^2.1.0",
-    "@types/node": "^22.0.0",
+    "@types/node": "^26.0.1",
     "benchmark": "^2.1.4",
-    "c8": "^10.1.2",
+    "c8": "^11.0.0",
     "eslint": "^9.17.0",
     "fastify": "^5.0.0",
-    "neostandard": "^0.12.0",
-    "sinon": "^19.0.2",
-    "tsd": "^0.31.1"
+    "neostandard": "^0.13.0",
+    "sinon": "^22.0.0",
+    "tstyche": "^7.0.0"
   },
   "dependencies": {
-    "cookie": "^1.0.0",
-    "fastify-plugin": "^5.0.0"
-  },
-  "tsd": {
-    "directory": "test"
+    "cookie": "^2.0.0",
+    "fastify-plugin": "^6.0.0"
   },
   "publishConfig": {
     "access": "public"

package/test/cookie.test.js

@@ -929,6 +929,25 @@ test('dont add auto cookie parsing to onRequest-hook if hook-option is set to fa
   t.assert.strictEqual(res.statusCode, 200)
 })
 
+test('setCookie writes Set-Cookie even when hook-option is set to false', async (t) => {
+  t.plan(2)
+
+  const fastify = Fastify()
+  fastify.register(plugin, { hook: false })
+
+  fastify.get('/', (req, reply) => {
+    reply.setCookie('foo', 'bar', { path: '/' }).send({ hello: 'world' })
+  })
+
+  const res = await fastify.inject({
+    method: 'GET',
+    url: '/'
+  })
+
+  t.assert.strictEqual(res.statusCode, 200)
+  t.assert.ok(res.headers['set-cookie'], 'Set-Cookie should be written even with hook:false')
+})
+
 test('result in an error if hook-option is set to an invalid value', async (t) => {
   t.plan(1)
 

package/types/{plugin.test-d.ts → index.tst.ts}

@@ -1,8 +1,12 @@
-import { expectError, expectType } from 'tsd'
+import { expect } from 'tstyche'
 import * as fastifyCookieStar from '..'
 import fastifyCookieCjsImport = require('..')
 import cookie, { fastifyCookie as fastifyCookieNamed, Signer } from '..'
-import fastify, { FastifyInstance, FastifyReply, setCookieWrapper } from 'fastify'
+import fastify, {
+  type FastifyInstance,
+  type FastifyReply,
+  type setCookieWrapper
+} from 'fastify'
 
 const fastifyCookieCjs = require('..')
 
@@ -15,61 +19,72 @@ app.register(fastifyCookieCjsImport.fastifyCookie)
 app.register(fastifyCookieStar.default)
 app.register(fastifyCookieStar.fastifyCookie)
 
-expectType<fastifyCookieStar.FastifyCookie>(fastifyCookieNamed)
-expectType<fastifyCookieStar.FastifyCookie>(cookie)
-expectType<fastifyCookieStar.FastifyCookie>(fastifyCookieCjsImport.default)
-expectType<fastifyCookieStar.FastifyCookie>(fastifyCookieCjsImport.fastifyCookie)
-expectType<fastifyCookieStar.FastifyCookie>(fastifyCookieStar.default)
-expectType<fastifyCookieStar.FastifyCookie>(
+expect(fastifyCookieNamed).type.toBe<fastifyCookieStar.FastifyCookie>()
+expect(cookie).type.toBe<fastifyCookieStar.FastifyCookie>()
+expect(
+  fastifyCookieCjsImport.default
+).type.toBe<fastifyCookieStar.FastifyCookie>()
+expect(
+  fastifyCookieCjsImport.fastifyCookie
+).type.toBe<fastifyCookieStar.FastifyCookie>()
+expect(fastifyCookieStar.default).type.toBe<fastifyCookieStar.FastifyCookie>()
+expect(
   fastifyCookieStar.fastifyCookie
-)
-expectType<any>(fastifyCookieCjs)
+).type.toBe<fastifyCookieStar.FastifyCookie>()
+expect(fastifyCookieCjs).type.toBe<any>()
 
-expectType<fastifyCookieStar.Sign>(cookie.sign)
-expectType<fastifyCookieStar.Unsign>(cookie.unsign)
-expectType<fastifyCookieStar.SignerFactory >(cookie.signerFactory)
+expect(cookie.sign).type.toBe<fastifyCookieStar.Sign>()
+expect(cookie.unsign).type.toBe<fastifyCookieStar.Unsign>()
+expect(cookie.signerFactory).type.toBe<fastifyCookieStar.SignerFactory>()
 
-expectType<fastifyCookieStar.Sign>(fastifyCookieNamed.sign)
-expectType<fastifyCookieStar.Unsign>(fastifyCookieNamed.unsign)
-expectType<fastifyCookieStar.SignerFactory >(fastifyCookieNamed.signerFactory)
+expect(fastifyCookieNamed.sign).type.toBe<fastifyCookieStar.Sign>()
+expect(fastifyCookieNamed.unsign).type.toBe<fastifyCookieStar.Unsign>()
+expect(
+  fastifyCookieNamed.signerFactory
+).type.toBe<fastifyCookieStar.SignerFactory>()
 
 const server = fastify()
 
 server.register(cookie)
 
 server.after((_err) => {
-  expectType< string >(
+  expect(
     server.serializeCookie('sessionId', 'aYb4uTIhdBXC')
-  )
+  ).type.toBe<string>()
 
-  expectType<{ [key: string]: string }>(
-    // See https://github.com/fastify/fastify-cookie#manual-cookie-parsing
-    server.parseCookie('sessionId=aYb4uTIhdBXC')
-  )
+  expect(server.parseCookie('sessionId=aYb4uTIhdBXC')).type.toBe<{
+    [key: string]: string;
+  }>()
 
   server.get('/', (request, reply) => {
     const test = request.cookies.test
-    expectType<string | undefined>(test)
+    expect(test).type.toBe<string | undefined>()
 
-    expectType<setCookieWrapper>(reply.cookie)
-    expectType<setCookieWrapper>(reply.setCookie)
+    expect(reply.cookie).type.toBe<setCookieWrapper>()
+    expect(reply.setCookie).type.toBe<setCookieWrapper>()
 
-    expectType<FastifyReply>(
+    expect(
       reply
         .setCookie('test', test!, { domain: 'example.com', path: '/' })
         .clearCookie('foo')
         .send({ hello: 'world' })
-    )
+    ).type.toBe<FastifyReply>()
   })
 
-  expectType<(value: string) => string>(server.signCookie)
-  expectType<(value: string) => fastifyCookieStar.UnsignResult>(server.unsignCookie)
+  expect(server.signCookie).type.toBe<(value: string) => string>()
+  expect(server.unsignCookie).type.toBe<
+    (value: string) => fastifyCookieStar.UnsignResult
+  >()
 
   server.get('/', (request, reply) => {
-    expectType<(value: string) => string>(request.signCookie)
-    expectType<(value: string) => string>(reply.signCookie)
-    expectType<(value: string) => fastifyCookieStar.UnsignResult>(request.unsignCookie)
-    expectType<(value: string) => fastifyCookieStar.UnsignResult>(reply.unsignCookie)
+    expect(request.signCookie).type.toBe<(value: string) => string>()
+    expect(reply.signCookie).type.toBe<(value: string) => string>()
+    expect(request.unsignCookie).type.toBe<
+      (value: string) => fastifyCookieStar.UnsignResult
+    >()
+    expect(reply.unsignCookie).type.toBe<
+      (value: string) => fastifyCookieStar.UnsignResult
+    >()
   })
 })
 
@@ -97,11 +112,15 @@ testSamesiteOptionsApp.after(() => {
   })
   server.get('/test-samesite-option-false', (request, reply) => {
     const test = request.cookies.test
-    reply.setCookie('test', test!, { sameSite: false }).send({ hello: 'world' })
+    reply
+      .setCookie('test', test!, { sameSite: false })
+      .send({ hello: 'world' })
   })
   server.get('/test-samesite-option-lax', (request, reply) => {
     const test = request.cookies.test
-    reply.setCookie('test', test!, { sameSite: 'lax' }).send({ hello: 'world' })
+    reply
+      .setCookie('test', test!, { sameSite: 'lax' })
+      .send({ hello: 'world' })
   })
   server.get('/test-samesite-option-strict', (request, reply) => {
     const test = request.cookies.test
@@ -120,7 +139,7 @@ testSamesiteOptionsApp.after(() => {
 const appWithImplicitHttpSigned = fastify()
 
 appWithImplicitHttpSigned.register(cookie, {
-  secret: 'testsecret',
+  secret: 'testsecret'
 })
 appWithImplicitHttpSigned.register(cookie, {
   secret: 'testsecret',
@@ -144,20 +163,20 @@ appWithImplicitHttpSigned.after(() => {
 const appWithRotationSecret = fastify()
 
 appWithRotationSecret.register(cookie, {
-  secret: ['testsecret'],
+  secret: ['testsecret']
 })
 appWithRotationSecret.after(() => {
   server.get('/', (request, reply) => {
     reply.unsignCookie(request.cookies.test!)
     const unsigned = reply.unsignCookie('test')
 
-    expectType<boolean>(unsigned.valid)
+    expect(unsigned.valid).type.toBe<boolean>()
     if (unsigned.valid) {
-      expectType<string>(unsigned.value)
+      expect(unsigned.value).type.toBe<string>()
     } else {
-      expectType<null>(unsigned.value)
+      expect(unsigned.value).type.toBe<null>()
     }
-    expectType<boolean>(unsigned.renew)
+    expect(unsigned.renew).type.toBe<boolean>()
 
     reply.send({ hello: 'world' })
   })
@@ -175,25 +194,25 @@ const parseOptions: fastifyCookieStar.CookieSerializeOptions = {
   sameSite: 'lax',
   secure: true,
   signed: true,
-  partitioned: false,
+  partitioned: false
 }
-expectType<fastifyCookieStar.CookieSerializeOptions>(parseOptions)
+expect(parseOptions).type.toBe<fastifyCookieStar.CookieSerializeOptions>()
 
 appWithParseOptions.register(cookie, {
   secret: 'testsecret',
-  parseOptions,
+  parseOptions
 })
 appWithParseOptions.after(() => {
   server.get('/', (request, reply) => {
     const unsigned = reply.unsignCookie(request.cookies.test!)
 
-    expectType<boolean>(unsigned.valid)
+    expect(unsigned.valid).type.toBe<boolean>()
     if (unsigned.valid) {
-      expectType<string>(unsigned.value)
+      expect(unsigned.value).type.toBe<string>()
     } else {
-      expectType<null>(unsigned.value)
+      expect(unsigned.value).type.toBe<null>()
     }
-    expectType<boolean>(unsigned.renew)
+    expect(unsigned.renew).type.toBe<boolean>()
   })
 })
 
@@ -203,7 +222,9 @@ appWithCustomSigner.register(cookie, {
   secret: {
     sign: (x) => x + '.signed',
     unsign: (x) => {
-      if (x.endsWith('.signed')) { return { renew: false, valid: true, value: x.slice(0, -7) } }
+      if (x.endsWith('.signed')) {
+        return { renew: false, valid: true, value: x.slice(0, -7) }
+      }
       return { renew: false, valid: false, value: null }
     }
   }
@@ -213,22 +234,28 @@ appWithCustomSigner.after(() => {
     reply.unsignCookie(request.cookies.test!)
     const unsigned = reply.unsignCookie('test')
 
-    expectType<boolean>(unsigned.valid)
+    expect(unsigned.valid).type.toBe<boolean>()
     if (unsigned.valid) {
-      expectType<string>(unsigned.value)
+      expect(unsigned.value).type.toBe<string>()
     } else {
-      expectType<null>(unsigned.value)
+      expect(unsigned.value).type.toBe<null>()
     }
-    expectType<boolean>(unsigned.renew)
+    expect(unsigned.renew).type.toBe<boolean>()
 
     reply.send({ hello: 'world' })
   })
 })
 
-expectType<Signer>(new fastifyCookieStar.Signer('secretString'))
-expectType<Signer>(new fastifyCookieStar.Signer(['secretStringInArray']))
-expectType<Signer>(new fastifyCookieStar.Signer(Buffer.from('secretString')))
-expectType<Signer>(new fastifyCookieStar.Signer([Buffer.from('secretStringInArray')]))
+expect(new fastifyCookieStar.Signer('secretString')).type.toBe<Signer>()
+expect(
+  new fastifyCookieStar.Signer(['secretStringInArray'])
+).type.toBe<Signer>()
+expect(
+  new fastifyCookieStar.Signer(Buffer.from('secretString'))
+).type.toBe<Signer>()
+expect(
+  new fastifyCookieStar.Signer([Buffer.from('secretStringInArray')])
+).type.toBe<Signer>()
 
 const signer = new fastifyCookieStar.Signer(['secretStringInArray'], 'sha256')
 signer.sign('Lorem Ipsum')
@@ -242,8 +269,22 @@ appWithHook.register(cookie, { hook: 'preHandler' })
 appWithHook.register(cookie, { hook: 'preParsing' })
 appWithHook.register(cookie, { hook: 'preSerialization' })
 appWithHook.register(cookie, { hook: 'preValidation' })
-expectError(appWithHook.register(cookie, { hook: true }))
-expectError(appWithHook.register(cookie, { hook: 'false' }))
 
-expectType<(cookieHeader: string, opts?: fastifyCookieStar.ParseOptions) => { [key: string]: string }>(cookie.parse)
-expectType<(name: string, value: string, opts?: fastifyCookieStar.SerializeOptions) => string>(cookie.serialize)
+expect(appWithHook.register)
+  .type.not.toBeCallableWith(cookie, { hook: true })
+expect(appWithHook.register)
+  .type.not.toBeCallableWith(cookie, { hook: 'false' })
+
+expect(cookie.parse).type.toBe<
+  (
+    cookieHeader: string,
+    opts?: fastifyCookieStar.ParseOptions
+  ) => { [key: string]: string }
+>()
+expect(cookie.serialize).type.toBe<
+  (
+    name: string,
+    value: string,
+    opts?: fastifyCookieStar.SerializeOptions
+  ) => string
+>()

package/.github/stale.yml

@@ -1,21 +0,0 @@
-# Number of days of inactivity before an issue becomes stale
-daysUntilStale: 15
-# Number of days of inactivity before a stale issue is closed
-daysUntilClose: 7
-# Issues with these labels will never be considered stale
-exemptLabels:
-  - "discussion"
-  - "feature request"
-  - "bug"
-  - "help wanted"
-  - "plugin suggestion"
-  - "good first issue"
-# Label to use when marking an issue as stale
-staleLabel: stale
-# Comment to post when marking an issue as stale. Set to `false` to disable
-markComment: >
-  This issue has been automatically marked as stale because it has not had
-  recent activity. It will be closed if no further activity occurs. Thank you
-  for your contributions.
-# Comment to post when closing a stale issue. Set to `false` to disable
-closeComment: false