@depup/nestjs__core 12.0.3-depup.0 → 12.1.0-depup.0

package/README.md

@@ -13,8 +13,8 @@ npm install @depup/nestjs__core
 
 | Field | Value |
 |-------|-------|
-| Original | [@nestjs/core](https://www.npmjs.com/package/@nestjs/core) @ 12.0.3 |
-| Processed | 2026-09-15 |
+| Original | [@nestjs/core](https://www.npmjs.com/package/@nestjs/core) @ 12.1.0 |
+| Processed | 2026-09-23 |
 | Smoke test | failed |
 | Deps updated | 0 |
 

package/Readme.md

@@ -47,6 +47,10 @@ For questions and support please use the official [Discord channel](https://disc
 
 Please make sure to read the [Issue Reporting Checklist](https://github.com/nestjs/nest/blob/master/CONTRIBUTING.md#-submitting-an-issue) before opening an issue. Issues not conforming to the guidelines may be closed immediately.
 
+## Observability
+
+[NestJS Observe](https://observe.nestjs.com) is the official observability platform for Nest applications. Install the `@nestjs/observe` SDK, pass an API key, and requests, background jobs, errors, logs, and distributed traces start streaming to a dashboard - no manual span wiring and no collector to run. Because the SDK hooks into Nest's own request lifecycle, a trace reads like a call graph of your controllers and providers instead of a bare HTTP route. Free for up to 300,000 events a month, and there is a [live demo](https://www.observe-demo.nestjs.com/dashboard) with no signup.
+
 ## Consulting
 
 With official support, you can get expert help straight from the Nest core team. We provide dedicated technical support, migration strategies, advice on best practices (and design decisions), PR reviews, and team augmentation. Read more about [support here](https://enterprise.nestjs.com).

package/adapters/http-adapter.d.ts

@@ -1,6 +1,7 @@
-import type { HttpServer, RequestMethod, VersioningOptions } from '@nestjs/common';
-import type { RequestHandler, VersionValue } from '@nestjs/common/internal';
+import type { CookieSerializeOptions, HttpServer, RequestMethod, VersioningOptions } from '@nestjs/common';
+import type { RequestHandler, SecurityRequestHook, VersionValue } from '@nestjs/common/internal';
 import type { NestApplicationOptions } from '@nestjs/common';
+import type { CookieSigner } from '../helpers/cookies/cookie-signer.js';
 /**
  * Base class for HTTP platform adapters (see `ExpressAdapter` and
  * `FastifyAdapter` for reference implementations).
@@ -13,9 +14,12 @@ import type { NestApplicationOptions } from '@nestjs/common';
  * - default implementations that delegate to the wrapped framework
  *   `instance` (`use()`, the HTTP-verb methods, `listen()`) or are inert
  *   (`init()`, `normalizePath()`, `mapException()`, `beforeClose()`, the
- *   `setOn*Hook()` setters);
+ *   `setOn*Hook()` setters), plus an Express-style, `use()`-based
+ *   `registerSecurityHook()`;
  * - storage for the native server (`httpServer`) and the framework instance
  *   (`instance`), with their accessors;
+ * - `setCookie()` and `clearCookie()`, implemented once on top of
+ *   `appendHeader()`, so they behave the same on every platform;
  * - the introspection hooks used by instrumentation tooling.
  *
  * Every remaining {@link HttpServer} member is declared abstract here, even
@@ -52,6 +56,11 @@ export declare abstract class AbstractHttpAdapter<TServer = any, TRequest = any,
      * {@link AbstractHttpAdapter.setOnRouteTriggered}, if any.
      */
     protected onRouteTriggered: ((requestMethod: RequestMethod, path: string) => void) | undefined;
+    /**
+     * Signer built from the `cookies.secret` application option, used by
+     * {@link AbstractHttpAdapter.setCookie} for `signed` cookies.
+     */
+    protected cookieSigner: CookieSigner | undefined;
     /**
      * @param instance The framework application instance to delegate to (e.g.
      * an Express `Application`). Subclasses typically create a default one
@@ -298,6 +307,47 @@ export declare abstract class AbstractHttpAdapter<TServer = any, TRequest = any,
      * `BadRequestException`.
      */
     mapException(error: unknown): unknown;
+    /**
+     * Installs the request hook of the built-in HTTP security features as a
+     * global middleware (`use()`), which fits Express-like frameworks: the hook
+     * gets the request and the response, and a rejection is handed to
+     * `next(error)`, i.e. to the exception layer. Override when the framework
+     * offers an earlier request hook (the Fastify adapter uses `onRequest`).
+     *
+     * @see {@link HttpServer.registerSecurityHook}
+     */
+    registerSecurityHook(hook: SecurityRequestHook<TRequest>): any;
+    /**
+     * Appends a `Set-Cookie` header through {@link AbstractHttpAdapter.appendHeader},
+     * so every cookie set during a request is sent, on every platform. The
+     * value is percent-encoded, `path` defaults to `/` and `maxAge` is in
+     * seconds (not milliseconds, unlike Express' `res.cookie()`); with
+     * `signed: true`, the value is signed with the first `cookies.secret`.
+     *
+     * Throws a `TypeError` when the name, the value or an attribute is not
+     * valid per RFC 6265 (which rules out header injection through `;`, CR or
+     * LF) or when `sameSite: 'none'` or `partitioned` is set without `secure`,
+     * and an `Error` when `signed` is set but no secret is configured.
+     *
+     * @see {@link HttpServer.setCookie}
+     */
+    setCookie(response: TResponse, name: string, value: string, options?: CookieSerializeOptions): any;
+    /**
+     * Appends a `Set-Cookie` header that expires the cookie immediately.
+     * `path` and `domain` must match the ones the cookie was set with; `maxAge`,
+     * `expires` and `signed` are ignored.
+     *
+     * @see {@link HttpServer.clearCookie}
+     */
+    clearCookie(response: TResponse, name: string, options?: CookieSerializeOptions): any;
+    /**
+     * Sets the signer used for `signed` cookies. Called by `NestApplication`
+     * with the signer it builds from the `cookies.secret` application option;
+     * configure that option instead of calling this method.
+     *
+     * @internal
+     */
+    setCookieSigner(signer: CookieSigner | undefined): void;
     /**
      * Stops the server; called by `app.close()`. May return a promise.
      *

package/adapters/http-adapter.js

@@ -1,3 +1,4 @@
+import { serializeCookie } from '../helpers/cookies/serialize-cookie.js';
 /**
  * Base class for HTTP platform adapters (see `ExpressAdapter` and
  * `FastifyAdapter` for reference implementations).
@@ -10,9 +11,12 @@
  * - default implementations that delegate to the wrapped framework
  *   `instance` (`use()`, the HTTP-verb methods, `listen()`) or are inert
  *   (`init()`, `normalizePath()`, `mapException()`, `beforeClose()`, the
- *   `setOn*Hook()` setters);
+ *   `setOn*Hook()` setters), plus an Express-style, `use()`-based
+ *   `registerSecurityHook()`;
  * - storage for the native server (`httpServer`) and the framework instance
  *   (`instance`), with their accessors;
+ * - `setCookie()` and `clearCookie()`, implemented once on top of
+ *   `appendHeader()`, so they behave the same on every platform;
  * - the introspection hooks used by instrumentation tooling.
  *
  * Every remaining {@link HttpServer} member is declared abstract here, even
@@ -49,6 +53,11 @@ export class AbstractHttpAdapter {
      * {@link AbstractHttpAdapter.setOnRouteTriggered}, if any.
      */
     onRouteTriggered;
+    /**
+     * Signer built from the `cookies.secret` application option, used by
+     * {@link AbstractHttpAdapter.setCookie} for `signed` cookies.
+     */
+    cookieSigner;
     /**
      * @param instance The framework application instance to delegate to (e.g.
      * an Express `Application`). Subclasses typically create a default one
@@ -220,4 +229,71 @@ export class AbstractHttpAdapter {
     mapException(error) {
         return error;
     }
+    /**
+     * Installs the request hook of the built-in HTTP security features as a
+     * global middleware (`use()`), which fits Express-like frameworks: the hook
+     * gets the request and the response, and a rejection is handed to
+     * `next(error)`, i.e. to the exception layer. Override when the framework
+     * offers an earlier request hook (the Fastify adapter uses `onRequest`).
+     *
+     * @see {@link HttpServer.registerSecurityHook}
+     */
+    registerSecurityHook(hook) {
+        return this.use((request, response, next) => {
+            const error = hook(request, response);
+            return error ? next(error) : next();
+        });
+    }
+    /**
+     * Appends a `Set-Cookie` header through {@link AbstractHttpAdapter.appendHeader},
+     * so every cookie set during a request is sent, on every platform. The
+     * value is percent-encoded, `path` defaults to `/` and `maxAge` is in
+     * seconds (not milliseconds, unlike Express' `res.cookie()`); with
+     * `signed: true`, the value is signed with the first `cookies.secret`.
+     *
+     * Throws a `TypeError` when the name, the value or an attribute is not
+     * valid per RFC 6265 (which rules out header injection through `;`, CR or
+     * LF) or when `sameSite: 'none'` or `partitioned` is set without `secure`,
+     * and an `Error` when `signed` is set but no secret is configured.
+     *
+     * @see {@link HttpServer.setCookie}
+     */
+    setCookie(response, name, value, options = {}) {
+        let cookieValue = value;
+        if (options.signed) {
+            if (!this.cookieSigner) {
+                throw new Error(`Cannot sign cookie "${name}": no cookie secret is configured. ` +
+                    'Pass "cookies: { secret }" to NestFactory.create().');
+            }
+            if (typeof value !== 'string') {
+                throw new TypeError(`Invalid value for cookie "${name}": expected a string, received ${typeof value}`);
+            }
+            cookieValue = this.cookieSigner.sign(value);
+        }
+        return this.appendHeader(response, 'Set-Cookie', serializeCookie(name, cookieValue, options));
+    }
+    /**
+     * Appends a `Set-Cookie` header that expires the cookie immediately.
+     * `path` and `domain` must match the ones the cookie was set with; `maxAge`,
+     * `expires` and `signed` are ignored.
+     *
+     * @see {@link HttpServer.clearCookie}
+     */
+    clearCookie(response, name, options = {}) {
+        return this.appendHeader(response, 'Set-Cookie', serializeCookie(name, '', {
+            ...options,
+            maxAge: 0,
+            expires: new Date(0),
+        }));
+    }
+    /**
+     * Sets the signer used for `signed` cookies. Called by `NestApplication`
+     * with the signer it builds from the `cookies.secret` application option;
+     * configure that option instead of calling this method.
+     *
+     * @internal
+     */
+    setCookieSigner(signer) {
+        this.cookieSigner = signer;
+    }
 }

package/application-config.d.ts

@@ -1,5 +1,6 @@
 import type { CanActivate, ExceptionFilter, NestInterceptor, PipeTransform, PreRequestHook, RouteConflictPolicy, RouteResolutionStrategy, VersioningOptions, WebSocketAdapter } from '@nestjs/common';
 import type { GlobalPrefixOptions } from '@nestjs/common/internal';
+import type { CookieSigner } from './helpers/cookies/cookie-signer.js';
 import { InstanceWrapper } from './injector/instance-wrapper.js';
 import { ExcludeRouteMetadata } from './router/interfaces/exclude-route-metadata.interface.js';
 export declare class ApplicationConfig {
@@ -14,6 +15,7 @@ export declare class ApplicationConfig {
     private versioningOptions;
     private routeConflictPolicy;
     private routeResolutionStrategy;
+    private cookieSigner;
     private readonly globalRequestPipes;
     private readonly globalRequestFilters;
     private readonly globalRequestInterceptors;
@@ -53,4 +55,6 @@ export declare class ApplicationConfig {
     getRouteConflictPolicy(): RouteConflictPolicy | undefined;
     setRouteResolutionStrategy(strategy: RouteResolutionStrategy | undefined): void;
     getRouteResolutionStrategy(): RouteResolutionStrategy | undefined;
+    setCookieSigner(signer: CookieSigner | undefined): void;
+    getCookieSigner(): CookieSigner | undefined;
 }

package/application-config.js

@@ -10,6 +10,7 @@ export class ApplicationConfig {
     versioningOptions;
     routeConflictPolicy;
     routeResolutionStrategy;
+    cookieSigner;
     globalRequestPipes = [];
     globalRequestFilters = [];
     globalRequestInterceptors = [];
@@ -123,4 +124,10 @@ export class ApplicationConfig {
     getRouteResolutionStrategy() {
         return this.routeResolutionStrategy;
     }
+    setCookieSigner(signer) {
+        this.cookieSigner = signer;
+    }
+    getCookieSigner() {
+        return this.cookieSigner;
+    }
 }

package/changes.json

@@ -1,5 +1,5 @@
 {
   "bumped": {},
-  "timestamp": "2026-09-15T08:12:01.242Z",
+  "timestamp": "2026-09-23T08:11:57.414Z",
   "totalUpdated": 0
 }

package/errors/exceptions/invalid-provider.exception.d.ts

@@ -0,0 +1,5 @@
+import { InjectorDependency } from '../../injector/injector.js';
+import { RuntimeException } from './runtime.exception.js';
+export declare class InvalidProviderException extends RuntimeException {
+    constructor(token: InjectorDependency, moduleName: string);
+}

package/errors/exceptions/invalid-provider.exception.js

@@ -0,0 +1,7 @@
+import { INVALID_PROVIDER_MESSAGE } from '../messages.js';
+import { RuntimeException } from './runtime.exception.js';
+export class InvalidProviderException extends RuntimeException {
+    constructor(token, moduleName) {
+        super(INVALID_PROVIDER_MESSAGE(token, moduleName));
+    }
+}

package/errors/messages.d.ts

@@ -1,5 +1,5 @@
 import type { ForwardReference, Type } from '@nestjs/common';
-import { InjectorDependencyContext } from '../injector/injector.js';
+import { InjectorDependency, InjectorDependencyContext } from '../injector/injector.js';
 import { Module } from '../injector/module.js';
 export declare const UNKNOWN_DEPENDENCIES_MESSAGE: (type: string | symbol, unknownDependencyContext: InjectorDependencyContext, moduleRef: Module | undefined) => string;
 export declare const INVALID_MIDDLEWARE_MESSAGE: (text: TemplateStringsArray, name: string) => string;
@@ -7,6 +7,7 @@ export declare const UNDEFINED_FORWARDREF_MESSAGE: (scope: Type<any>[]) => strin
 export declare const INVALID_MODULE_MESSAGE: (parentModule: any, index: number, scope: any[], receivedValue: unknown) => string;
 export declare const USING_INVALID_CLASS_AS_A_MODULE_MESSAGE: (metatypeUsedAsAModule: Type | ForwardReference, scope: any[], classKind: "provider" | "controller" | "filter") => string;
 export declare const UNDEFINED_MODULE_MESSAGE: (parentModule: any, index: number, scope: any[]) => string;
+export declare const INVALID_PROVIDER_MESSAGE: (token: InjectorDependency, moduleName: string) => string;
 export declare const UNKNOWN_EXPORT_MESSAGE: (token: string | symbol | undefined, module: string) => string;
 export declare const INVALID_CLASS_MESSAGE: (text: TemplateStringsArray, value: any) => string;
 export declare const INVALID_CLASS_SCOPE_MESSAGE: (text: TemplateStringsArray, name: string | undefined) => string;

package/errors/messages.js

@@ -163,6 +163,12 @@ Potential causes:
 
 Scope [${stringifyScope(scope)}]`;
 };
+export const INVALID_PROVIDER_MESSAGE = (token, moduleName) => `Nest cannot create the ${moduleName} instance.
+The provider ${getDependencyName(token, 'provider')} in the ${moduleName} "providers" array does not define a valid "useClass", "useValue", "useFactory" or "useExisting" property.
+
+Potential causes:
+- The value of "useClass", "useFactory" or "useExisting" is undefined at runtime, often because of a circular import between files. Check your import statements.
+- None of these properties is set, or the one that is set is null.`;
 export const UNKNOWN_EXPORT_MESSAGE = (token = 'item', module) => {
     token = isSymbol(token) ? token.toString() : token;
     return `Nest cannot export a provider/module that is not a part of the currently processed module (${module}). Please verify whether the exported ${token} is available in this particular context.

package/helpers/cookies/cookie-signer.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Prefix that marks a signed cookie value, as written by Express'
+ * `res.cookie(name, value, { signed: true })` and read by `cookie-parser`.
+ */
+export declare const SIGNED_COOKIE_PREFIX = "s:";
+/**
+ * Signs and verifies cookie values with HMAC-SHA256.
+ *
+ * The format is the one of the `cookie-signature` package (used by
+ * `cookie-parser` and `express-session`): `value.signature`, where the
+ * signature is the base64 digest without `=` padding. Signed values carry the
+ * `s:` prefix, so cookies signed by `cookie-parser`/Express with the same
+ * secret keep verifying, and so do un-prefixed values signed by
+ * `@fastify/cookie`.
+ *
+ * With several secrets, values are signed with the first one and verified
+ * against each of them (secret rotation).
+ */
+export declare class CookieSigner {
+    private readonly secrets;
+    constructor(secret: string | string[]);
+    /**
+     * Returns `s:<value>.<signature>`, signed with the first secret.
+     */
+    sign(value: string): string;
+    /**
+     * Returns the original value when `input` carries a valid signature for
+     * any of the secrets, `undefined` otherwise. The `s:` prefix is optional.
+     */
+    unsign(input: string): string | undefined;
+    private digest;
+}

package/helpers/cookies/cookie-signer.js

@@ -0,0 +1,70 @@
+import { createHmac, timingSafeEqual } from 'crypto';
+/**
+ * Prefix that marks a signed cookie value, as written by Express'
+ * `res.cookie(name, value, { signed: true })` and read by `cookie-parser`.
+ */
+export const SIGNED_COOKIE_PREFIX = 's:';
+/**
+ * Signs and verifies cookie values with HMAC-SHA256.
+ *
+ * The format is the one of the `cookie-signature` package (used by
+ * `cookie-parser` and `express-session`): `value.signature`, where the
+ * signature is the base64 digest without `=` padding. Signed values carry the
+ * `s:` prefix, so cookies signed by `cookie-parser`/Express with the same
+ * secret keep verifying, and so do un-prefixed values signed by
+ * `@fastify/cookie`.
+ *
+ * With several secrets, values are signed with the first one and verified
+ * against each of them (secret rotation).
+ */
+export class CookieSigner {
+    secrets;
+    constructor(secret) {
+        const secrets = Array.isArray(secret) ? secret : [secret];
+        if (secrets.length === 0 ||
+            secrets.some(item => typeof item !== 'string' || item.length === 0)) {
+            throw new TypeError('The "cookies.secret" option must be a non-empty string or a non-empty array of non-empty strings.');
+        }
+        this.secrets = [...secrets];
+    }
+    /**
+     * Returns `s:<value>.<signature>`, signed with the first secret.
+     */
+    sign(value) {
+        return `${SIGNED_COOKIE_PREFIX}${value}.${this.digest(value, this.secrets[0])}`;
+    }
+    /**
+     * Returns the original value when `input` carries a valid signature for
+     * any of the secrets, `undefined` otherwise. The `s:` prefix is optional.
+     */
+    unsign(input) {
+        if (typeof input !== 'string') {
+            return undefined;
+        }
+        const signed = input.startsWith(SIGNED_COOKIE_PREFIX)
+            ? input.slice(SIGNED_COOKIE_PREFIX.length)
+            : input;
+        const dotIndex = signed.lastIndexOf('.');
+        if (dotIndex === -1) {
+            return undefined;
+        }
+        const value = signed.slice(0, dotIndex);
+        const signature = Buffer.from(signed.slice(dotIndex + 1));
+        let valid = false;
+        for (const secret of this.secrets) {
+            const expected = Buffer.from(this.digest(value, secret));
+            // Every secret is checked, so timing does not reveal which one matched.
+            if (expected.length === signature.length &&
+                timingSafeEqual(expected, signature)) {
+                valid = true;
+            }
+        }
+        return valid ? value : undefined;
+    }
+    digest(value, secret) {
+        return createHmac('sha256', secret)
+            .update(value)
+            .digest('base64')
+            .replace(/=+$/, '');
+    }
+}

package/helpers/cookies/parse-cookie-header.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Dictionary of cookies keyed by name. Created without a prototype, so names
+ * such as `__proto__` or `constructor` are stored as plain entries.
+ */
+export type CookieRecord = Record<string, string>;
+/**
+ * Parses a `Cookie` request header (RFC 6265, section 5.4) into a
+ * prototype-less dictionary.
+ *
+ * - pairs are separated by `;`, and split on the first `=` only;
+ * - names and values are trimmed, and a value wrapped in double quotes is
+ *   unquoted;
+ * - values are percent-decoded, falling back to the raw value when they are
+ *   not valid percent-encoding;
+ * - pairs without `=` or with an empty name are ignored;
+ * - when a name occurs more than once, the first occurrence wins (browsers
+ *   send the most specific path first).
+ */
+export declare function parseCookieHeader(header: string | string[] | undefined | null): CookieRecord;

package/helpers/cookies/parse-cookie-header.js

@@ -0,0 +1,47 @@
+/**
+ * Parses a `Cookie` request header (RFC 6265, section 5.4) into a
+ * prototype-less dictionary.
+ *
+ * - pairs are separated by `;`, and split on the first `=` only;
+ * - names and values are trimmed, and a value wrapped in double quotes is
+ *   unquoted;
+ * - values are percent-decoded, falling back to the raw value when they are
+ *   not valid percent-encoding;
+ * - pairs without `=` or with an empty name are ignored;
+ * - when a name occurs more than once, the first occurrence wins (browsers
+ *   send the most specific path first).
+ */
+export function parseCookieHeader(header) {
+    const cookies = Object.create(null);
+    if (!header) {
+        return cookies;
+    }
+    const source = Array.isArray(header) ? header.join('; ') : String(header);
+    for (const pair of source.split(';')) {
+        const eqIndex = pair.indexOf('=');
+        if (eqIndex === -1) {
+            continue;
+        }
+        const name = pair.slice(0, eqIndex).trim();
+        if (!name || name in cookies) {
+            continue;
+        }
+        let value = pair.slice(eqIndex + 1).trim();
+        if (value.length >= 2 && value[0] === '"' && value.endsWith('"')) {
+            value = value.slice(1, -1);
+        }
+        cookies[name] = safeDecode(value);
+    }
+    return cookies;
+}
+function safeDecode(value) {
+    if (!value.includes('%')) {
+        return value;
+    }
+    try {
+        return decodeURIComponent(value);
+    }
+    catch {
+        return value;
+    }
+}

package/helpers/cookies/request-cookies.d.ts

@@ -0,0 +1,30 @@
+import type { CookieSigner } from './cookie-signer.js';
+import { CookieRecord } from './parse-cookie-header.js';
+/**
+ * Returns the request cookies. `req.cookies`, when a cookie middleware
+ * (`cookie-parser`, `@fastify/cookie`) already populated it, takes precedence
+ * over parsing the `Cookie` header.
+ */
+export declare function getRequestCookies(req: Record<string, any>): CookieRecord;
+/**
+ * Returns a single request cookie, or `undefined` when it was not sent. Only
+ * own entries count, so names such as `constructor` never resolve to
+ * inherited members of a middleware-provided `req.cookies` object.
+ */
+export declare function getRequestCookie(req: Record<string, any>, name: string): string | undefined;
+/**
+ * Returns the request cookies whose signature verifies, with their unsigned
+ * value. Cookies that are not signed, or whose signature does not verify, are
+ * left out.
+ *
+ * Without a signer (no `cookies.secret` option), falls back to
+ * `req.signedCookies` as populated by `cookie-parser`, dropping the entries it
+ * marked invalid (`false`). Throws when neither is available.
+ */
+export declare function getRequestSignedCookies(req: Record<string, any>, signer: CookieSigner | undefined): CookieRecord;
+/**
+ * Returns the unsigned value of a single signed cookie, or `undefined` when it
+ * is missing or its signature does not verify. Same fallbacks as
+ * {@link getRequestSignedCookies}.
+ */
+export declare function getRequestSignedCookie(req: Record<string, any>, name: string, signer: CookieSigner | undefined): string | undefined;

package/helpers/cookies/request-cookies.js

@@ -0,0 +1,83 @@
+import { isObject } from '@nestjs/common/internal';
+import { parseCookieHeader } from './parse-cookie-header.js';
+/**
+ * Parsed `Cookie` header per request, so the header is parsed at most once
+ * however many parameters read cookies.
+ */
+const parsedCookiesCache = new WeakMap();
+function getParsedCookieHeader(req) {
+    let cookies = parsedCookiesCache.get(req);
+    if (!cookies) {
+        cookies = parseCookieHeader(req.headers?.cookie);
+        parsedCookiesCache.set(req, cookies);
+    }
+    return cookies;
+}
+/**
+ * Returns the request cookies. `req.cookies`, when a cookie middleware
+ * (`cookie-parser`, `@fastify/cookie`) already populated it, takes precedence
+ * over parsing the `Cookie` header.
+ */
+export function getRequestCookies(req) {
+    if (isObject(req.cookies)) {
+        return req.cookies;
+    }
+    return getParsedCookieHeader(req);
+}
+/**
+ * Returns a single request cookie, or `undefined` when it was not sent. Only
+ * own entries count, so names such as `constructor` never resolve to
+ * inherited members of a middleware-provided `req.cookies` object.
+ */
+export function getRequestCookie(req, name) {
+    const cookies = getRequestCookies(req);
+    return Object.prototype.hasOwnProperty.call(cookies, name)
+        ? cookies[name]
+        : undefined;
+}
+/**
+ * Returns the request cookies whose signature verifies, with their unsigned
+ * value. Cookies that are not signed, or whose signature does not verify, are
+ * left out.
+ *
+ * Without a signer (no `cookies.secret` option), falls back to
+ * `req.signedCookies` as populated by `cookie-parser`, dropping the entries it
+ * marked invalid (`false`). Throws when neither is available.
+ */
+export function getRequestSignedCookies(req, signer) {
+    const signedCookies = Object.create(null);
+    if (signer) {
+        const cookies = getParsedCookieHeader(req);
+        for (const name of Object.keys(cookies)) {
+            const value = signer.unsign(cookies[name]);
+            if (value !== undefined) {
+                signedCookies[name] = value;
+            }
+        }
+        return signedCookies;
+    }
+    if (isObject(req.signedCookies)) {
+        for (const [name, value] of Object.entries(req.signedCookies)) {
+            // `false` marks an invalid signature. Other values are kept as is,
+            // including the objects cookie-parser makes of `j:` JSON cookies.
+            if (value !== false) {
+                signedCookies[name] = value;
+            }
+        }
+        return signedCookies;
+    }
+    throw new Error('Cannot read signed cookies: no cookie secret is configured. ' +
+        'Pass "cookies: { secret }" to NestFactory.create().');
+}
+/**
+ * Returns the unsigned value of a single signed cookie, or `undefined` when it
+ * is missing or its signature does not verify. Same fallbacks as
+ * {@link getRequestSignedCookies}.
+ */
+export function getRequestSignedCookie(req, name, signer) {
+    if (signer) {
+        const value = getParsedCookieHeader(req)[name];
+        return value === undefined ? undefined : signer.unsign(value);
+    }
+    return getRequestSignedCookies(req, signer)[name];
+}

package/helpers/cookies/serialize-cookie.d.ts

@@ -0,0 +1,14 @@
+import type { CookieSerializeOptions } from '@nestjs/common';
+/**
+ * Builds the value of a `Set-Cookie` response header (RFC 6265, section 4.1).
+ *
+ * The value is percent-encoded with `encodeURIComponent()`, whose output only
+ * contains RFC 6265 `cookie-octet`s. `path` defaults to `/`. Throws a
+ * `TypeError` when the name, the value or an attribute would produce an
+ * invalid header or smuggle extra attributes (`;`, CR, LF, ...), and when
+ * `sameSite: 'none'` or `partitioned` is set without `secure`, since browsers
+ * reject such cookies.
+ *
+ * Signing is not handled here: pass an already signed value.
+ */
+export declare function serializeCookie(name: string, value: string, options?: CookieSerializeOptions): string;