@nestjs/common 11.2.4 → 11.2.6

package/interfaces/http/cookie-options.interface.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Attributes of a `Set-Cookie` header written by `HttpServer.setCookie()` and
+ * `HttpServer.clearCookie()`.
+ *
+ * @see [RFC 6265, section 4.1](https://datatracker.ietf.org/doc/html/rfc6265#section-4.1)
+ *
+ * @publicApi
+ */
+export interface CookieSerializeOptions {
+    /**
+     * `Path` attribute.
+     *
+     * @default '/'
+     */
+    path?: string;
+    /**
+     * `Domain` attribute. Omitted by default, which makes the cookie host-only.
+     */
+    domain?: string;
+    /**
+     * `Max-Age` attribute, in **seconds**, as in RFC 6265 and `@fastify/cookie`.
+     * Must be an integer.
+     *
+     * **Not milliseconds**: Express' `res.cookie()` takes `maxAge` in
+     * milliseconds, so a value carried over from it would make the cookie live
+     * 1000 times longer. For one day, pass `60 * 60 * 24`.
+     */
+    maxAge?: number;
+    /**
+     * `Expires` attribute. Browsers give precedence to `maxAge` when both are
+     * set.
+     */
+    expires?: Date;
+    /**
+     * `HttpOnly` attribute.
+     */
+    httpOnly?: boolean;
+    /**
+     * `Secure` attribute.
+     */
+    secure?: boolean;
+    /**
+     * `SameSite` attribute. `'none'` requires `secure: true`, since browsers
+     * reject `SameSite=None` cookies that are not `Secure`.
+     */
+    sameSite?: 'strict' | 'lax' | 'none';
+    /**
+     * `Partitioned` attribute (CHIPS). Requires `secure: true`, since browsers
+     * reject partitioned cookies that are not `Secure`.
+     */
+    partitioned?: boolean;
+    /**
+     * `Priority` attribute (non-standard, honored by Chromium).
+     */
+    priority?: 'low' | 'medium' | 'high';
+    /**
+     * Whether to sign the value with the first secret configured through the
+     * `cookies.secret` application option. Signed cookies are read with the
+     * `@SignedCookies()` decorator.
+     *
+     * @default false
+     */
+    signed?: boolean;
+}
+/**
+ * The `cookies` option of `NestFactory.create()`.
+ *
+ * @publicApi
+ */
+export interface CookiesOptions {
+    /**
+     * Secret (or secrets) used to sign and verify cookies. When an array is
+     * given, cookies are signed with the first secret and verified against all
+     * of them, which allows rotating secrets without invalidating cookies
+     * signed with a previous one. An empty string, an empty array or an empty
+     * entry throws when the application is created.
+     */
+    secret?: string | string[];
+}

package/interfaces/http/cookie-options.interface.js

@@ -0,0 +1 @@
+export {};

package/interfaces/http/csrf-protection-options.interface.d.ts

@@ -0,0 +1,47 @@
+import type { RouteInfo } from '../middleware/middleware-configuration.interface.js';
+/**
+ * Options for `app.enableCsrfProtection()`.
+ *
+ * The protection is based on Fetch Metadata (`Sec-Fetch-Site`) with an
+ * `Origin`/`Host` fallback, following the algorithm of Go's
+ * `net/http.CrossOriginProtection`. It is not a token scheme: it relies on the
+ * browser telling the server where a request comes from, which every
+ * evergreen browser does since 2023.
+ *
+ * Browsers only send `Sec-Fetch-Site` to secure origins (HTTPS or
+ * `localhost`). Otherwise the `Origin` header is compared with the `Host`
+ * header the server receives (`X-Forwarded-Host` is ignored). Behind a proxy
+ * that rewrites `Host`, preserve it, or list the public origin in
+ * `trustedOrigins`.
+ *
+ * @publicApi
+ */
+export interface CsrfProtectionOptions<TRequest = any> {
+    /**
+     * Origins that may send cross-origin, state-changing requests, e.g.
+     * `https://admin.example.com`. Each entry must be a serialized origin:
+     * `scheme://host[:port]`, without a path, query string, fragment or
+     * wildcard. Entries are normalized the way browsers serialize `Origin`
+     * (lower-case, without the default port), and a request is exempt when its
+     * `Origin` header equals one of them.
+     *
+     * Origins allowed by CORS are not trusted implicitly: list them here too.
+     */
+    trustedOrigins?: string[];
+    /**
+     * Requests that skip the protection altogether (for example webhook
+     * endpoints called by third-party servers that send a foreign `Origin`).
+     *
+     * Either a list of routes, or a predicate receiving the platform request
+     * object. Only consulted for requests that would otherwise be rejected.
+     *
+     * Routes are declared like `MiddlewareConsumer.exclude()`: a path, or
+     * `{ path, method, version? }` to narrow by method (and URI version),
+     * without the global prefix, which is added unless the route is excluded
+     * from it. Unlike `exclude()`, the match is exact: case-sensitive, without
+     * an optional trailing slash, and never for non-canonical request paths
+     * (`//`, dot segments, `;`, encoded `/` or `.`), which a router could
+     * resolve to a route that is not excluded.
+     */
+    exclude?: (string | RouteInfo)[] | ((request: TRequest) => boolean);
+}

package/interfaces/http/csrf-protection-options.interface.js

@@ -0,0 +1 @@
+export {};

package/interfaces/http/security-headers-options.interface.d.ts

@@ -0,0 +1,142 @@
+/**
+ * Value of a Content-Security-Policy directive:
+ *
+ * - a string or a list of strings: the directive's source expressions
+ *   (keywords must be quoted, e.g. `"'self'"`);
+ * - `true` or an empty list: a directive without value (e.g.
+ *   `upgrade-insecure-requests`);
+ * - `null` or `false`: removes the directive, including a default one.
+ *
+ * @publicApi
+ */
+export type ContentSecurityPolicyDirectiveValue = string | readonly string[] | boolean | null;
+/**
+ * @publicApi
+ */
+export interface ContentSecurityPolicyOptions {
+    /**
+     * Whether `directives` are merged into the default directives. When
+     * `false`, only `directives` are sent, and they must include `default-src`
+     * (or remove it explicitly with `defaultSrc: null`).
+     *
+     * @default true
+     */
+    useDefaults?: boolean;
+    /**
+     * Directives keyed by name, in camelCase (`scriptSrc`) or kebab-case
+     * (`'script-src'`). A directive given here replaces the default directive
+     * of the same name.
+     */
+    directives?: Record<string, ContentSecurityPolicyDirectiveValue>;
+    /**
+     * Sends `Content-Security-Policy-Report-Only` instead, so violations are
+     * reported (see the `report-to` directive) but not blocked.
+     *
+     * @default false
+     */
+    reportOnly?: boolean;
+}
+/**
+ * Options for `app.useSecurityHeaders()`.
+ *
+ * Each key controls one header and accepts `false` to leave that header out,
+ * `true` for its default value (the same defaults as helmet 8), or an object
+ * to configure it. Option names match helmet's, so existing helmet
+ * configurations carry over, except for helmet's legacy aliases (`hsts`,
+ * `frameguard`, ...). Unknown options are rejected.
+ *
+ * @publicApi
+ */
+export interface SecurityHeadersOptions {
+    /**
+     * `Content-Security-Policy`. Default: `default-src 'self'; base-uri 'self';
+     * font-src 'self' https: data:; form-action 'self'; frame-ancestors 'self';
+     * img-src 'self' data:; object-src 'none'; script-src 'self';
+     * script-src-attr 'none'; style-src 'self' https: 'unsafe-inline';
+     * upgrade-insecure-requests` (serialized without spaces after `;`).
+     */
+    contentSecurityPolicy?: boolean | ContentSecurityPolicyOptions;
+    /**
+     * `Cross-Origin-Embedder-Policy`. Not sent by default; `true` sends
+     * `require-corp`.
+     */
+    crossOriginEmbedderPolicy?: boolean | {
+        policy?: 'require-corp' | 'credentialless' | 'unsafe-none';
+    };
+    /**
+     * `Cross-Origin-Opener-Policy`. Default: `same-origin`.
+     */
+    crossOriginOpenerPolicy?: boolean | {
+        policy?: 'same-origin' | 'same-origin-allow-popups' | 'noopener-allow-popups' | 'unsafe-none';
+    };
+    /**
+     * `Cross-Origin-Resource-Policy`. Default: `same-origin`.
+     */
+    crossOriginResourcePolicy?: boolean | {
+        policy?: 'same-origin' | 'same-site' | 'cross-origin';
+    };
+    /**
+     * `Origin-Agent-Cluster: ?1`.
+     */
+    originAgentCluster?: boolean;
+    /**
+     * `Referrer-Policy`. Default: `no-referrer`. A list is sent as a fallback
+     * chain (the browser uses the last one it supports).
+     */
+    referrerPolicy?: boolean | {
+        policy?: ReferrerPolicyToken | readonly ReferrerPolicyToken[];
+    };
+    /**
+     * `Strict-Transport-Security`. Default: `max-age=31536000;
+     * includeSubDomains`. Browsers ignore it over plain HTTP.
+     */
+    strictTransportSecurity?: boolean | {
+        /** In seconds. @default 31536000 (365 days) */
+        maxAge?: number;
+        /** @default true */
+        includeSubDomains?: boolean;
+        /** @default false */
+        preload?: boolean;
+    };
+    /**
+     * `X-Content-Type-Options: nosniff`.
+     */
+    xContentTypeOptions?: boolean;
+    /**
+     * `X-DNS-Prefetch-Control`. Default: `off`; `{ allow: true }` sends `on`.
+     */
+    xDnsPrefetchControl?: boolean | {
+        allow?: boolean;
+    };
+    /**
+     * `X-Download-Options: noopen`.
+     */
+    xDownloadOptions?: boolean;
+    /**
+     * `X-Frame-Options`. Default: `SAMEORIGIN`. Superseded by the CSP
+     * `frame-ancestors` directive, kept for older browsers.
+     */
+    xFrameOptions?: boolean | {
+        action?: 'deny' | 'sameorigin';
+    };
+    /**
+     * `X-Permitted-Cross-Domain-Policies`. Default: `none`.
+     */
+    xPermittedCrossDomainPolicies?: boolean | {
+        permittedPolicies?: 'none' | 'master-only' | 'by-content-type' | 'all';
+    };
+    /**
+     * Removes the `X-Powered-By` header (on Express, also disables the
+     * `x-powered-by` setting). `false` leaves it untouched.
+     */
+    xPoweredBy?: boolean;
+    /**
+     * `X-XSS-Protection: 0`, which disables the legacy XSS auditor of old
+     * browsers (a source of vulnerabilities itself).
+     */
+    xXssProtection?: boolean;
+}
+/**
+ * @publicApi
+ */
+export type ReferrerPolicyToken = '' | 'no-referrer' | 'no-referrer-when-downgrade' | 'same-origin' | 'origin' | 'strict-origin' | 'origin-when-cross-origin' | 'strict-origin-when-cross-origin' | 'unsafe-url';

package/interfaces/http/security-headers-options.interface.js

@@ -0,0 +1 @@
+export {};

package/interfaces/microservices/pre-request-hook.interface.d.ts

@@ -0,0 +1,22 @@
+import { Observable } from 'rxjs';
+import { ExecutionContext } from '../features/execution-context.interface.js';
+/**
+ * Interface describing a global preRequest hook for microservices.
+ *
+ * Hooks are executed before guards, allowing setup of context (e.g. AsyncLocalStorage)
+ * that is available to all downstream enhancers.
+ *
+ * @example
+ * ```typescript
+ * const als = new AsyncLocalStorage();
+ * app.registerPreRequestHook((context, next) => {
+ *   als.enterWith({ correlationId: uuid() });
+ *   return next();
+ * });
+ * ```
+ *
+ * @publicApi
+ */
+export interface PreRequestHook {
+    (context: ExecutionContext, next: () => Observable<unknown>): Observable<unknown>;
+}

package/interfaces/microservices/pre-request-hook.interface.js

@@ -0,0 +1 @@
+export {};

package/interfaces/microservices/transport-server.interface.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Interface describing the shape of a transport server.
+ * Used as the return type of `getTransportServer()` to provide
+ * autocomplete without creating circular dependencies.
+ *
+ * @publicApi
+ */
+export interface ITransportServer {
+    /**
+     * Starts the transport server.
+     * @param callback Function to be called upon initialization
+     */
+    listen(callback: (...optionalParams: unknown[]) => any): any;
+    /**
+     * Closes the transport server (stops listening on port/connection).
+     */
+    close(): any;
+}

package/interfaces/microservices/transport-server.interface.js

@@ -0,0 +1 @@
+export {};

package/interfaces/router-options.interface.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Severity level applied to a single kind of route conflict detected at
+ * bootstrap.
+ *
+ * @publicApi
+ */
+export type RouteConflictPolicyLevel = 'off' | 'warn' | 'error';
+/**
+ * Per-kind policy for overlapping routes detected at bootstrap.
+ * `duplicate` covers identical (method, path, host, version) registrations.
+ * `shadow` covers patterns that can match the same request (for example
+ * `/users/me` vs `/users/:id`). Each kind defaults to `'off'`.
+ *
+ * @publicApi
+ */
+export interface RouteConflictPolicy {
+    duplicate?: RouteConflictPolicyLevel;
+    shadow?: RouteConflictPolicyLevel;
+}
+/**
+ * Order in which routes are registered on the underlying HTTP adapter.
+ * `'specificity'` registers literal segments before parametric and
+ * wildcard ones on order-sensitive adapters (such as Express). Defaults
+ * to `'declaration'`.
+ *
+ * @publicApi
+ */
+export type RouteResolutionStrategy = 'declaration' | 'specificity';

package/interfaces/router-options.interface.js

@@ -0,0 +1 @@
+export {};

package/internal.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Internal module - not part of the public API.
+ * These exports are used by sibling @nestjs packages.
+ * Do not depend on these in your application code.
+ * @internal
+ * @module
+ */
+export * from './constants.js';
+export { RouteParamtypes } from './enums/route-paramtypes.enum.js';
+export * from './utils/shared.utils.js';
+export * from './utils/parameter-decorator-options.util.js';
+export * from './utils/load-package.util.js';
+export * from './utils/cli-colors.util.js';
+export * from './utils/random-string-generator.util.js';
+export * from './utils/select-exception-filter-metadata.util.js';
+export type { Controller, Injectable } from './interfaces/index.js';
+export type { NestApplicationContextOptions } from './interfaces/nest-application-context-options.interface.js';
+export type { NestMicroserviceOptions } from './interfaces/microservices/nest-microservice-options.interface.js';
+export type { CorsOptions, CorsOptionsDelegate, CustomOrigin, } from './interfaces/external/cors-options.interface.js';
+export type { ExceptionFilterMetadata } from './interfaces/exceptions/exception-filter-metadata.interface.js';
+export type { RpcExceptionFilterMetadata } from './interfaces/exceptions/rpc-exception-filter-metadata.interface.js';
+export type { VersionValue } from './interfaces/version-options.interface.js';
+export type { GlobalPrefixOptions } from './interfaces/global-prefix-options.interface.js';
+export type { MiddlewareConfiguration, RouteInfo, } from './interfaces/middleware/middleware-configuration.interface.js';
+export type { MiddlewareConfigProxy } from './interfaces/middleware/middleware-config-proxy.interface.js';
+export type { ModuleMetadata } from './interfaces/modules/module-metadata.interface.js';
+export type { HttpArgumentsHost, RpcArgumentsHost, WsArgumentsHost, } from './interfaces/features/arguments-host.interface.js';
+export type { RequestHandler, SecurityRequestHook, } from './interfaces/http/http-server.interface.js';
+export type { GetOrResolveOptions, SelectOptions, } from './interfaces/nest-application-context.interface.js';
+export type { ShutdownHooksOptions } from './interfaces/shutdown-hooks-options.interface.js';
+export { assignMetadata } from './decorators/http/route-params.decorator.js';

package/internal.js

@@ -0,0 +1,20 @@
+/**
+ * Internal module - not part of the public API.
+ * These exports are used by sibling @nestjs packages.
+ * Do not depend on these in your application code.
+ * @internal
+ * @module
+ */
+// Constants
+export * from './constants.js';
+// Enums (internal)
+export { RouteParamtypes } from './enums/route-paramtypes.enum.js';
+// Utils
+export * from './utils/shared.utils.js';
+export * from './utils/parameter-decorator-options.util.js';
+export * from './utils/load-package.util.js';
+export * from './utils/cli-colors.util.js';
+export * from './utils/random-string-generator.util.js';
+export * from './utils/select-exception-filter-metadata.util.js';
+// Decorators (internal)
+export { assignMetadata } from './decorators/http/route-params.decorator.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nestjs/common",
-  "version": "11.2.4",
+  "version": "11.2.6",
   "description": "Nest - modern, fast, powerful node.js web framework (@common)",
   "author": "Kamil Mysliwiec",
   "homepage": "https://nestjs.com",
@@ -38,5 +38,5 @@
       "optional": true
     }
   },
-  "gitHead": "d5046225d86131285fb2f44c4c06860316a99474"
+  "gitHead": "c07cfb0be5e95ffa129da39ccc49a23cb64d49ff"
 }

package/pipes/standard-schema-validation.pipe.d.ts

@@ -0,0 +1,88 @@
+import type { StandardSchemaV1 } from '@standard-schema/spec';
+import { ArgumentMetadata, PipeTransform } from '../interfaces/features/pipe-transform.interface.js';
+import { ErrorHttpStatusCode } from '../utils/http-error-by-code.util.js';
+/**
+ * @publicApi
+ */
+export interface StandardSchemaValidationPipeOptions {
+    /**
+     * If true, the pipe will return the value produced by the schema
+     * (which may differ from the input if the schema coerces/transforms values).
+     * If false, the original input value is returned after successful validation.
+     * @default true
+     */
+    transform?: boolean;
+    /**
+     * If true, the pipe will also validate parameters decorated with custom decorators
+     * (created with `createParamDecorator`). When false, custom parameters are skipped.
+     * @default false
+     */
+    validateCustomDecorators?: boolean;
+    /**
+     * Options to pass to the standard schema `validate` function.
+     * These options are forwarded as the second argument to the schema's `~standard.validate` method.
+     */
+    validateOptions?: Record<string, unknown>;
+    /**
+     * The HTTP status code to be used in the response when the validation fails.
+     * @default HttpStatus.BAD_REQUEST
+     */
+    errorHttpStatusCode?: ErrorHttpStatusCode;
+    /**
+     * A factory function that returns an exception object to be thrown
+     * if validation fails.
+     * @param issues The issues returned by the standard schema validation
+     * @returns The exception object
+     */
+    exceptionFactory?: (issues: readonly StandardSchemaV1.Issue[]) => any;
+}
+/**
+ * Defines the built-in StandardSchemaValidation Pipe.
+ *
+ * Uses a standard schema object (conforming to the Standard Schema spec)
+ * attached to the parameter metadata to validate incoming values.
+ *
+ * @see [Standard Schema](https://github.com/standard-schema/standard-schema)
+ *
+ * @publicApi
+ */
+export declare class StandardSchemaValidationPipe implements PipeTransform {
+    protected readonly options?: StandardSchemaValidationPipeOptions | undefined;
+    protected isTransformEnabled: boolean;
+    protected validateCustomDecorators: boolean;
+    protected validateOptions: Record<string, unknown> | undefined;
+    protected exceptionFactory: (issues: readonly StandardSchemaV1.Issue[]) => any;
+    constructor(options?: StandardSchemaValidationPipeOptions | undefined);
+    /**
+     * Formats Standard Schema validation issues into a flat list of error messages.
+     * When an issue includes a path, the path is prefixed to the message.
+     */
+    protected formatIssueMessages(issues: readonly StandardSchemaV1.Issue[]): string[];
+    /**
+     * Method that validates the incoming value against the standard schema
+     * provided in the parameter metadata.
+     *
+     * @param value currently processed route argument
+     * @param metadata contains metadata about the currently processed route argument
+     */
+    transform<T = any>(value: T, metadata: ArgumentMetadata): Promise<T>;
+    /**
+     * Determines whether validation should be performed for the given metadata.
+     * Skips validation for custom decorators unless `validateCustomDecorators` is enabled.
+     *
+     * @param metadata contains metadata about the currently processed route argument
+     * @returns `true` if validation should be performed
+     */
+    protected toValidate(metadata: ArgumentMetadata): boolean;
+    /**
+     * Validates a value against a standard schema.
+     * Can be overridden to customize validation behavior.
+     *
+     * @param value The value to validate
+     * @param schema The standard schema to validate against
+     * @param options Optional options forwarded to the schema's validate method
+     * @returns The validation result
+     */
+    protected validate<T = unknown>(value: unknown, schema: StandardSchemaV1, options?: Record<string, unknown>): Promise<StandardSchemaV1.Result<T>> | StandardSchemaV1.Result<T>;
+    protected stripProtoKeys(value: any): void;
+}

package/pipes/standard-schema-validation.pipe.js

@@ -0,0 +1,106 @@
+import { __decorate, __metadata, __param } from "tslib";
+import { Injectable } from '../decorators/core/injectable.decorator.js';
+import { Optional } from '../decorators/core/optional.decorator.js';
+import { HttpStatus } from '../enums/http-status.enum.js';
+import { HttpErrorByCode, } from '../utils/http-error-by-code.util.js';
+import { isObject } from '../utils/shared.utils.js';
+import { stripProtoKeys } from '../utils/strip-proto-keys.util.js';
+/**
+ * Defines the built-in StandardSchemaValidation Pipe.
+ *
+ * Uses a standard schema object (conforming to the Standard Schema spec)
+ * attached to the parameter metadata to validate incoming values.
+ *
+ * @see [Standard Schema](https://github.com/standard-schema/standard-schema)
+ *
+ * @publicApi
+ */
+let StandardSchemaValidationPipe = class StandardSchemaValidationPipe {
+    options;
+    isTransformEnabled;
+    validateCustomDecorators;
+    validateOptions;
+    exceptionFactory;
+    constructor(options) {
+        this.options = options;
+        const { transform = true, validateCustomDecorators = false, validateOptions, exceptionFactory, errorHttpStatusCode = HttpStatus.BAD_REQUEST, } = options || {};
+        this.isTransformEnabled = transform;
+        this.validateCustomDecorators = validateCustomDecorators;
+        this.validateOptions = validateOptions;
+        this.exceptionFactory =
+            exceptionFactory ||
+                (issues => {
+                    const messages = this.formatIssueMessages(issues);
+                    return new HttpErrorByCode[errorHttpStatusCode](messages);
+                });
+    }
+    /**
+     * Formats Standard Schema validation issues into a flat list of error messages.
+     * When an issue includes a path, the path is prefixed to the message.
+     */
+    formatIssueMessages(issues) {
+        return issues.map(issue => {
+            if (issue.path?.length) {
+                const stringPath = issue.path
+                    .map(segment => String(isObject(segment) ? segment.key : segment))
+                    .join('.');
+                return `${stringPath}: ${issue.message}`;
+            }
+            return issue.message;
+        });
+    }
+    /**
+     * Method that validates the incoming value against the standard schema
+     * provided in the parameter metadata.
+     *
+     * @param value currently processed route argument
+     * @param metadata contains metadata about the currently processed route argument
+     */
+    async transform(value, metadata) {
+        const schema = metadata.schema;
+        if (!schema || !this.toValidate(metadata)) {
+            return value;
+        }
+        this.stripProtoKeys(value);
+        const result = await this.validate(value, schema, this.validateOptions);
+        if (result.issues) {
+            throw this.exceptionFactory(result.issues);
+        }
+        return this.isTransformEnabled ? result.value : value;
+    }
+    /**
+     * Determines whether validation should be performed for the given metadata.
+     * Skips validation for custom decorators unless `validateCustomDecorators` is enabled.
+     *
+     * @param metadata contains metadata about the currently processed route argument
+     * @returns `true` if validation should be performed
+     */
+    toValidate(metadata) {
+        const { type } = metadata;
+        if (type === 'custom' && !this.validateCustomDecorators) {
+            return false;
+        }
+        return true;
+    }
+    /**
+     * Validates a value against a standard schema.
+     * Can be overridden to customize validation behavior.
+     *
+     * @param value The value to validate
+     * @param schema The standard schema to validate against
+     * @param options Optional options forwarded to the schema's validate method
+     * @returns The validation result
+     */
+    validate(value, schema, options) {
+        return schema['~standard'].validate(value, options);
+    }
+    stripProtoKeys(value) {
+        stripProtoKeys(value);
+    }
+};
+StandardSchemaValidationPipe = __decorate([
+    Injectable(),
+    __param(0, Optional()),
+    __metadata("design:paramtypes", [Object])
+], StandardSchemaValidationPipe);
+export { StandardSchemaValidationPipe };

package/serializer/standard-schema-serializer.interceptor.d.ts

@@ -0,0 +1,50 @@
+import type { StandardSchemaV1 } from '@standard-schema/spec';
+import { Observable } from 'rxjs';
+import { CallHandler, ExecutionContext, NestInterceptor } from '../interfaces/index.js';
+import { StandardSchemaSerializerContextOptions } from './standard-schema-serializer.interfaces.js';
+interface PlainLiteralObject {
+    [key: string]: any;
+}
+/**
+ * @publicApi
+ */
+export interface StandardSchemaSerializerInterceptorOptions {
+    /**
+     * A default standard schema to use for serialization when no schema
+     * is provided via `@SerializeOptions()`.
+     */
+    schema?: StandardSchemaV1;
+    /**
+     * Default options forwarded to the schema's `~standard.validate()` call.
+     * Can be overridden per-handler via `@SerializeOptions({ validateOptions })`.
+     */
+    validateOptions?: StandardSchemaV1.Options;
+}
+/**
+ * An interceptor that serializes outgoing responses using a Standard Schema.
+ *
+ * The schema can be provided either:
+ * - As a default option in the interceptor constructor
+ * - Per-handler or per-class via `@SerializeOptions({ schema })` decorator
+ *
+ * When a schema is present, the interceptor validates/transforms the response
+ * through the schema's `~standard.validate()` method. If validation fails,
+ * the issues are thrown as an error.
+ *
+ * @see [Standard Schema](https://github.com/standard-schema/standard-schema)
+ *
+ * @publicApi
+ */
+export declare class StandardSchemaSerializerInterceptor implements NestInterceptor {
+    protected readonly reflector: any;
+    protected readonly defaultOptions: StandardSchemaSerializerInterceptorOptions;
+    constructor(reflector: any, defaultOptions?: StandardSchemaSerializerInterceptorOptions);
+    intercept(context: ExecutionContext, next: CallHandler): Observable<any>;
+    /**
+     * Serializes responses that are non-null objects nor streamable files.
+     */
+    serialize(response: PlainLiteralObject | Array<PlainLiteralObject>, schema: StandardSchemaV1 | undefined, validateOptions?: StandardSchemaV1.Options): PlainLiteralObject | Array<PlainLiteralObject> | Promise<PlainLiteralObject | Array<PlainLiteralObject>>;
+    transformToPlain(plainOrClass: any, schema: StandardSchemaV1, validateOptions?: StandardSchemaV1.Options): Promise<PlainLiteralObject>;
+    protected getContextOptions(context: ExecutionContext): StandardSchemaSerializerContextOptions | undefined;
+}
+export {};

package/serializer/standard-schema-serializer.interceptor.js

@@ -0,0 +1,75 @@
+import { __decorate, __metadata, __param } from "tslib";
+import { concatMap } from 'rxjs/operators';
+import { Inject, Injectable, Optional } from '../decorators/core/index.js';
+import { StreamableFile } from '../file-stream/index.js';
+import { isObject } from '../utils/shared.utils.js';
+import { CLASS_SERIALIZER_OPTIONS } from './class-serializer.constants.js';
+// NOTE (external)
+// We need to deduplicate them here due to the circular dependency
+// between core and common packages
+const REFLECTOR = 'Reflector';
+/**
+ * An interceptor that serializes outgoing responses using a Standard Schema.
+ *
+ * The schema can be provided either:
+ * - As a default option in the interceptor constructor
+ * - Per-handler or per-class via `@SerializeOptions({ schema })` decorator
+ *
+ * When a schema is present, the interceptor validates/transforms the response
+ * through the schema's `~standard.validate()` method. If validation fails,
+ * the issues are thrown as an error.
+ *
+ * @see [Standard Schema](https://github.com/standard-schema/standard-schema)
+ *
+ * @publicApi
+ */
+let StandardSchemaSerializerInterceptor = class StandardSchemaSerializerInterceptor {
+    reflector;
+    defaultOptions;
+    constructor(reflector, defaultOptions = {}) {
+        this.reflector = reflector;
+        this.defaultOptions = defaultOptions;
+    }
+    intercept(context, next) {
+        const contextOptions = this.getContextOptions(context);
+        const schema = contextOptions?.schema ?? this.defaultOptions.schema;
+        const validateOptions = contextOptions?.validateOptions ?? this.defaultOptions.validateOptions;
+        return next
+            .handle()
+            .pipe(concatMap(async (res) => this.serialize(res, schema, validateOptions)));
+    }
+    /**
+     * Serializes responses that are non-null objects nor streamable files.
+     */
+    serialize(response, schema, validateOptions) {
+        if (!schema || !isObject(response) || response instanceof StreamableFile) {
+            return response;
+        }
+        return Array.isArray(response)
+            ? Promise.all(response.map(item => this.transformToPlain(item, schema, validateOptions)))
+            : this.transformToPlain(response, schema, validateOptions);
+    }
+    async transformToPlain(plainOrClass, schema, validateOptions) {
+        if (!plainOrClass) {
+            return plainOrClass;
+        }
+        const result = await schema['~standard'].validate(plainOrClass, validateOptions);
+        if (result.issues) {
+            throw new Error(`Serialization failed: ${result.issues.map(i => i.message).join(', ')}`);
+        }
+        return result.value;
+    }
+    getContextOptions(context) {
+        return this.reflector.getAllAndOverride(CLASS_SERIALIZER_OPTIONS, [
+            context.getHandler(),
+            context.getClass(),
+        ]);
+    }
+};
+StandardSchemaSerializerInterceptor = __decorate([
+    Injectable(),
+    __param(0, Inject(REFLECTOR)),
+    __param(1, Optional()),
+    __metadata("design:paramtypes", [Object, Object])
+], StandardSchemaSerializerInterceptor);
+export { StandardSchemaSerializerInterceptor };

package/serializer/standard-schema-serializer.interfaces.d.ts

@@ -0,0 +1,18 @@
+import type { StandardSchemaV1 } from '@standard-schema/spec';
+/**
+ * Options for the `StandardSchemaSerializerInterceptor`, passed via
+ * `@SerializeOptions({ schema })`.
+ *
+ * @publicApi
+ */
+export interface StandardSchemaSerializerContextOptions {
+    /**
+     * A standard schema to use for serialization.
+     * Used by `StandardSchemaSerializerInterceptor` to validate/transform the response.
+     */
+    schema?: StandardSchemaV1;
+    /**
+     * Optional options forwarded to the schema's `~standard.validate()` call.
+     */
+    validateOptions?: StandardSchemaV1.Options;
+}

package/serializer/standard-schema-serializer.interfaces.js

@@ -0,0 +1 @@
+export {};

package/utils/parameter-decorator-options.util.d.ts

@@ -0,0 +1,13 @@
+import type { ParameterDecoratorOptions } from '../decorators/http/route-params.decorator.js';
+/**
+ * Determines whether a parameter-decorator argument is a
+ * `ParameterDecoratorOptions` object rather than a pipe (instance or class).
+ *
+ * Kept in one place so every decorator (`@Query`, `@Body`, `@Param`,
+ * `@RawBody`, `@Payload`, `@MessageBody`, custom decorators, ...) classifies
+ * arguments identically: a pipe instance that happens to expose a `schema` or
+ * `pipes` property must never be mistaken for an options object.
+ *
+ * @internal
+ */
+export declare function isParameterDecoratorOptions(value: unknown): value is ParameterDecoratorOptions;

package/utils/parameter-decorator-options.util.js

@@ -0,0 +1,22 @@
+import { isFunction } from './shared.utils.js';
+const isPipeLike = (value) => isFunction(value?.transform) ||
+    (isFunction(value) &&
+        value.prototype &&
+        isFunction(value.prototype.transform));
+/**
+ * Determines whether a parameter-decorator argument is a
+ * `ParameterDecoratorOptions` object rather than a pipe (instance or class).
+ *
+ * Kept in one place so every decorator (`@Query`, `@Body`, `@Param`,
+ * `@RawBody`, `@Payload`, `@MessageBody`, custom decorators, ...) classifies
+ * arguments identically: a pipe instance that happens to expose a `schema` or
+ * `pipes` property must never be mistaken for an options object.
+ *
+ * @internal
+ */
+export function isParameterDecoratorOptions(value) {
+    return (!!value &&
+        typeof value === 'object' &&
+        !isPipeLike(value) &&
+        ('schema' in value || 'pipes' in value));
+}

package/utils/strip-proto-keys.util.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Strips dangerous prototype pollution keys (__proto__, prototype, constructor)
+ * from an object recursively.
+ */
+export declare function stripProtoKeys(value: any): void;

package/utils/strip-proto-keys.util.js

@@ -0,0 +1,36 @@
+import { types } from 'util';
+/**
+ * Built-in JavaScript types that should be excluded from prototype stripping
+ * to avoid conflicts with test frameworks like Jest's useFakeTimers
+ */
+const BUILT_IN_TYPES = [Date, RegExp, Error, Map, Set, WeakMap, WeakSet];
+/**
+ * Strips dangerous prototype pollution keys (__proto__, prototype, constructor)
+ * from an object recursively.
+ */
+export function stripProtoKeys(value) {
+    if (value == null || typeof value !== 'object' || types.isTypedArray(value)) {
+        return;
+    }
+    // Skip built-in JavaScript primitives to avoid Jest useFakeTimers conflicts
+    if (BUILT_IN_TYPES.some(type => value instanceof type)) {
+        return;
+    }
+    if (Array.isArray(value)) {
+        for (const v of value) {
+            stripProtoKeys(v);
+        }
+        return;
+    }
+    // Delete dangerous prototype pollution keys
+    delete value.__proto__;
+    delete value.prototype;
+    // Only delete constructor if it's NOT a built-in type
+    const constructorType = value?.constructor;
+    if (constructorType && !BUILT_IN_TYPES.includes(constructorType)) {
+        delete value.constructor;
+    }
+    for (const key in value) {
+        stripProtoKeys(value[key]);
+    }
+}