@depup/nestjs__core 12.0.4-depup.0 → 12.1.1-depup.0

package/README.md

@@ -13,8 +13,8 @@ npm install @depup/nestjs__core
 
 | Field | Value |
 |-------|-------|
-| Original | [@nestjs/core](https://www.npmjs.com/package/@nestjs/core) @ 12.0.4 |
-| Processed | 2026-09-21 |
+| Original | [@nestjs/core](https://www.npmjs.com/package/@nestjs/core) @ 12.1.1 |
+| Processed | 2026-09-28 |
 | Smoke test | failed |
 | Deps updated | 0 |
 

package/adapters/http-adapter.d.ts

@@ -1,6 +1,7 @@
-import type { HttpServer, RequestMethod, VersioningOptions } from '@nestjs/common';
-import type { RequestHandler, VersionValue } from '@nestjs/common/internal';
+import type { CookieSerializeOptions, HttpServer, RequestMethod, VersioningOptions } from '@nestjs/common';
+import type { RequestHandler, SecurityRequestHook, VersionValue } from '@nestjs/common/internal';
 import type { NestApplicationOptions } from '@nestjs/common';
+import type { CookieSigner } from '../helpers/cookies/cookie-signer.js';
 /**
  * Base class for HTTP platform adapters (see `ExpressAdapter` and
  * `FastifyAdapter` for reference implementations).
@@ -13,9 +14,12 @@ import type { NestApplicationOptions } from '@nestjs/common';
  * - default implementations that delegate to the wrapped framework
  *   `instance` (`use()`, the HTTP-verb methods, `listen()`) or are inert
  *   (`init()`, `normalizePath()`, `mapException()`, `beforeClose()`, the
- *   `setOn*Hook()` setters);
+ *   `setOn*Hook()` setters), plus an Express-style, `use()`-based
+ *   `registerSecurityHook()`;
  * - storage for the native server (`httpServer`) and the framework instance
  *   (`instance`), with their accessors;
+ * - `setCookie()` and `clearCookie()`, implemented once on top of
+ *   `appendHeader()`, so they behave the same on every platform;
  * - the introspection hooks used by instrumentation tooling.
  *
  * Every remaining {@link HttpServer} member is declared abstract here, even
@@ -52,6 +56,11 @@ export declare abstract class AbstractHttpAdapter<TServer = any, TRequest = any,
      * {@link AbstractHttpAdapter.setOnRouteTriggered}, if any.
      */
     protected onRouteTriggered: ((requestMethod: RequestMethod, path: string) => void) | undefined;
+    /**
+     * Signer built from the `cookies.secret` application option, used by
+     * {@link AbstractHttpAdapter.setCookie} for `signed` cookies.
+     */
+    protected cookieSigner: CookieSigner | undefined;
     /**
      * @param instance The framework application instance to delegate to (e.g.
      * an Express `Application`). Subclasses typically create a default one
@@ -298,6 +307,47 @@ export declare abstract class AbstractHttpAdapter<TServer = any, TRequest = any,
      * `BadRequestException`.
      */
     mapException(error: unknown): unknown;
+    /**
+     * Installs the request hook of the built-in HTTP security features as a
+     * global middleware (`use()`), which fits Express-like frameworks: the hook
+     * gets the request and the response, and a rejection is handed to
+     * `next(error)`, i.e. to the exception layer. Override when the framework
+     * offers an earlier request hook (the Fastify adapter uses `onRequest`).
+     *
+     * @see {@link HttpServer.registerSecurityHook}
+     */
+    registerSecurityHook(hook: SecurityRequestHook<TRequest>): any;
+    /**
+     * Appends a `Set-Cookie` header through {@link AbstractHttpAdapter.appendHeader},
+     * so every cookie set during a request is sent, on every platform. The
+     * value is percent-encoded, `path` defaults to `/` and `maxAge` is in
+     * seconds (not milliseconds, unlike Express' `res.cookie()`); with
+     * `signed: true`, the value is signed with the first `cookies.secret`.
+     *
+     * Throws a `TypeError` when the name, the value or an attribute is not
+     * valid per RFC 6265 (which rules out header injection through `;`, CR or
+     * LF) or when `sameSite: 'none'` or `partitioned` is set without `secure`,
+     * and an `Error` when `signed` is set but no secret is configured.
+     *
+     * @see {@link HttpServer.setCookie}
+     */
+    setCookie(response: TResponse, name: string, value: string, options?: CookieSerializeOptions): any;
+    /**
+     * Appends a `Set-Cookie` header that expires the cookie immediately.
+     * `path` and `domain` must match the ones the cookie was set with; `maxAge`,
+     * `expires` and `signed` are ignored.
+     *
+     * @see {@link HttpServer.clearCookie}
+     */
+    clearCookie(response: TResponse, name: string, options?: CookieSerializeOptions): any;
+    /**
+     * Sets the signer used for `signed` cookies. Called by `NestApplication`
+     * with the signer it builds from the `cookies.secret` application option;
+     * configure that option instead of calling this method.
+     *
+     * @internal
+     */
+    setCookieSigner(signer: CookieSigner | undefined): void;
     /**
      * Stops the server; called by `app.close()`. May return a promise.
      *

package/adapters/http-adapter.js

@@ -1,3 +1,4 @@
+import { serializeCookie } from '../helpers/cookies/serialize-cookie.js';
 /**
  * Base class for HTTP platform adapters (see `ExpressAdapter` and
  * `FastifyAdapter` for reference implementations).
@@ -10,9 +11,12 @@
  * - default implementations that delegate to the wrapped framework
  *   `instance` (`use()`, the HTTP-verb methods, `listen()`) or are inert
  *   (`init()`, `normalizePath()`, `mapException()`, `beforeClose()`, the
- *   `setOn*Hook()` setters);
+ *   `setOn*Hook()` setters), plus an Express-style, `use()`-based
+ *   `registerSecurityHook()`;
  * - storage for the native server (`httpServer`) and the framework instance
  *   (`instance`), with their accessors;
+ * - `setCookie()` and `clearCookie()`, implemented once on top of
+ *   `appendHeader()`, so they behave the same on every platform;
  * - the introspection hooks used by instrumentation tooling.
  *
  * Every remaining {@link HttpServer} member is declared abstract here, even
@@ -49,6 +53,11 @@ export class AbstractHttpAdapter {
      * {@link AbstractHttpAdapter.setOnRouteTriggered}, if any.
      */
     onRouteTriggered;
+    /**
+     * Signer built from the `cookies.secret` application option, used by
+     * {@link AbstractHttpAdapter.setCookie} for `signed` cookies.
+     */
+    cookieSigner;
     /**
      * @param instance The framework application instance to delegate to (e.g.
      * an Express `Application`). Subclasses typically create a default one
@@ -220,4 +229,71 @@ export class AbstractHttpAdapter {
     mapException(error) {
         return error;
     }
+    /**
+     * Installs the request hook of the built-in HTTP security features as a
+     * global middleware (`use()`), which fits Express-like frameworks: the hook
+     * gets the request and the response, and a rejection is handed to
+     * `next(error)`, i.e. to the exception layer. Override when the framework
+     * offers an earlier request hook (the Fastify adapter uses `onRequest`).
+     *
+     * @see {@link HttpServer.registerSecurityHook}
+     */
+    registerSecurityHook(hook) {
+        return this.use((request, response, next) => {
+            const error = hook(request, response);
+            return error ? next(error) : next();
+        });
+    }
+    /**
+     * Appends a `Set-Cookie` header through {@link AbstractHttpAdapter.appendHeader},
+     * so every cookie set during a request is sent, on every platform. The
+     * value is percent-encoded, `path` defaults to `/` and `maxAge` is in
+     * seconds (not milliseconds, unlike Express' `res.cookie()`); with
+     * `signed: true`, the value is signed with the first `cookies.secret`.
+     *
+     * Throws a `TypeError` when the name, the value or an attribute is not
+     * valid per RFC 6265 (which rules out header injection through `;`, CR or
+     * LF) or when `sameSite: 'none'` or `partitioned` is set without `secure`,
+     * and an `Error` when `signed` is set but no secret is configured.
+     *
+     * @see {@link HttpServer.setCookie}
+     */
+    setCookie(response, name, value, options = {}) {
+        let cookieValue = value;
+        if (options.signed) {
+            if (!this.cookieSigner) {
+                throw new Error(`Cannot sign cookie "${name}": no cookie secret is configured. ` +
+                    'Pass "cookies: { secret }" to NestFactory.create().');
+            }
+            if (typeof value !== 'string') {
+                throw new TypeError(`Invalid value for cookie "${name}": expected a string, received ${typeof value}`);
+            }
+            cookieValue = this.cookieSigner.sign(value);
+        }
+        return this.appendHeader(response, 'Set-Cookie', serializeCookie(name, cookieValue, options));
+    }
+    /**
+     * Appends a `Set-Cookie` header that expires the cookie immediately.
+     * `path` and `domain` must match the ones the cookie was set with; `maxAge`,
+     * `expires` and `signed` are ignored.
+     *
+     * @see {@link HttpServer.clearCookie}
+     */
+    clearCookie(response, name, options = {}) {
+        return this.appendHeader(response, 'Set-Cookie', serializeCookie(name, '', {
+            ...options,
+            maxAge: 0,
+            expires: new Date(0),
+        }));
+    }
+    /**
+     * Sets the signer used for `signed` cookies. Called by `NestApplication`
+     * with the signer it builds from the `cookies.secret` application option;
+     * configure that option instead of calling this method.
+     *
+     * @internal
+     */
+    setCookieSigner(signer) {
+        this.cookieSigner = signer;
+    }
 }

package/application-config.d.ts

@@ -1,5 +1,6 @@
 import type { CanActivate, ExceptionFilter, NestInterceptor, PipeTransform, PreRequestHook, RouteConflictPolicy, RouteResolutionStrategy, VersioningOptions, WebSocketAdapter } from '@nestjs/common';
 import type { GlobalPrefixOptions } from '@nestjs/common/internal';
+import type { CookieSigner } from './helpers/cookies/cookie-signer.js';
 import { InstanceWrapper } from './injector/instance-wrapper.js';
 import { ExcludeRouteMetadata } from './router/interfaces/exclude-route-metadata.interface.js';
 export declare class ApplicationConfig {
@@ -14,6 +15,7 @@ export declare class ApplicationConfig {
     private versioningOptions;
     private routeConflictPolicy;
     private routeResolutionStrategy;
+    private cookieSigner;
     private readonly globalRequestPipes;
     private readonly globalRequestFilters;
     private readonly globalRequestInterceptors;
@@ -53,4 +55,6 @@ export declare class ApplicationConfig {
     getRouteConflictPolicy(): RouteConflictPolicy | undefined;
     setRouteResolutionStrategy(strategy: RouteResolutionStrategy | undefined): void;
     getRouteResolutionStrategy(): RouteResolutionStrategy | undefined;
+    setCookieSigner(signer: CookieSigner | undefined): void;
+    getCookieSigner(): CookieSigner | undefined;
 }

package/application-config.js

@@ -10,6 +10,7 @@ export class ApplicationConfig {
     versioningOptions;
     routeConflictPolicy;
     routeResolutionStrategy;
+    cookieSigner;
     globalRequestPipes = [];
     globalRequestFilters = [];
     globalRequestInterceptors = [];
@@ -123,4 +124,10 @@ export class ApplicationConfig {
     getRouteResolutionStrategy() {
         return this.routeResolutionStrategy;
     }
+    setCookieSigner(signer) {
+        this.cookieSigner = signer;
+    }
+    getCookieSigner() {
+        return this.cookieSigner;
+    }
 }

package/changes.json

@@ -1,5 +1,5 @@
 {
   "bumped": {},
-  "timestamp": "2026-09-21T08:13:04.811Z",
+  "timestamp": "2026-09-28T16:11:01.983Z",
   "totalUpdated": 0
 }

package/errors/exceptions/invalid-provider.exception.d.ts

@@ -0,0 +1,5 @@
+import { InjectorDependency } from '../../injector/injector.js';
+import { RuntimeException } from './runtime.exception.js';
+export declare class InvalidProviderException extends RuntimeException {
+    constructor(token: InjectorDependency, moduleName: string);
+}

package/errors/exceptions/invalid-provider.exception.js

@@ -0,0 +1,7 @@
+import { INVALID_PROVIDER_MESSAGE } from '../messages.js';
+import { RuntimeException } from './runtime.exception.js';
+export class InvalidProviderException extends RuntimeException {
+    constructor(token, moduleName) {
+        super(INVALID_PROVIDER_MESSAGE(token, moduleName));
+    }
+}

package/errors/messages.d.ts

@@ -1,5 +1,5 @@
 import type { ForwardReference, Type } from '@nestjs/common';
-import { InjectorDependencyContext } from '../injector/injector.js';
+import { InjectorDependency, InjectorDependencyContext } from '../injector/injector.js';
 import { Module } from '../injector/module.js';
 export declare const UNKNOWN_DEPENDENCIES_MESSAGE: (type: string | symbol, unknownDependencyContext: InjectorDependencyContext, moduleRef: Module | undefined) => string;
 export declare const INVALID_MIDDLEWARE_MESSAGE: (text: TemplateStringsArray, name: string) => string;
@@ -7,6 +7,7 @@ export declare const UNDEFINED_FORWARDREF_MESSAGE: (scope: Type<any>[]) => strin
 export declare const INVALID_MODULE_MESSAGE: (parentModule: any, index: number, scope: any[], receivedValue: unknown) => string;
 export declare const USING_INVALID_CLASS_AS_A_MODULE_MESSAGE: (metatypeUsedAsAModule: Type | ForwardReference, scope: any[], classKind: "provider" | "controller" | "filter") => string;
 export declare const UNDEFINED_MODULE_MESSAGE: (parentModule: any, index: number, scope: any[]) => string;
+export declare const INVALID_PROVIDER_MESSAGE: (token: InjectorDependency, moduleName: string) => string;
 export declare const UNKNOWN_EXPORT_MESSAGE: (token: string | symbol | undefined, module: string) => string;
 export declare const INVALID_CLASS_MESSAGE: (text: TemplateStringsArray, value: any) => string;
 export declare const INVALID_CLASS_SCOPE_MESSAGE: (text: TemplateStringsArray, name: string | undefined) => string;

package/errors/messages.js

@@ -163,6 +163,12 @@ Potential causes:
 
 Scope [${stringifyScope(scope)}]`;
 };
+export const INVALID_PROVIDER_MESSAGE = (token, moduleName) => `Nest cannot create the ${moduleName} instance.
+The provider ${getDependencyName(token, 'provider')} in the ${moduleName} "providers" array does not define a valid "useClass", "useValue", "useFactory" or "useExisting" property.
+
+Potential causes:
+- The value of "useClass", "useFactory" or "useExisting" is undefined at runtime, often because of a circular import between files. Check your import statements.
+- None of these properties is set, or the one that is set is null.`;
 export const UNKNOWN_EXPORT_MESSAGE = (token = 'item', module) => {
     token = isSymbol(token) ? token.toString() : token;
     return `Nest cannot export a provider/module that is not a part of the currently processed module (${module}). Please verify whether the exported ${token} is available in this particular context.

package/helpers/cookies/cookie-signer.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Prefix that marks a signed cookie value, as written by Express'
+ * `res.cookie(name, value, { signed: true })` and read by `cookie-parser`.
+ */
+export declare const SIGNED_COOKIE_PREFIX = "s:";
+/**
+ * Signs and verifies cookie values with HMAC-SHA256.
+ *
+ * The format is the one of the `cookie-signature` package (used by
+ * `cookie-parser` and `express-session`): `value.signature`, where the
+ * signature is the base64 digest without `=` padding. Signed values carry the
+ * `s:` prefix, so cookies signed by `cookie-parser`/Express with the same
+ * secret keep verifying, and so do un-prefixed values signed by
+ * `@fastify/cookie`.
+ *
+ * With several secrets, values are signed with the first one and verified
+ * against each of them (secret rotation).
+ */
+export declare class CookieSigner {
+    private readonly secrets;
+    constructor(secret: string | string[]);
+    /**
+     * Returns `s:<value>.<signature>`, signed with the first secret.
+     */
+    sign(value: string): string;
+    /**
+     * Returns the original value when `input` carries a valid signature for
+     * any of the secrets, `undefined` otherwise. The `s:` prefix is optional.
+     */
+    unsign(input: string): string | undefined;
+    private digest;
+}

package/helpers/cookies/cookie-signer.js

@@ -0,0 +1,70 @@
+import { createHmac, timingSafeEqual } from 'crypto';
+/**
+ * Prefix that marks a signed cookie value, as written by Express'
+ * `res.cookie(name, value, { signed: true })` and read by `cookie-parser`.
+ */
+export const SIGNED_COOKIE_PREFIX = 's:';
+/**
+ * Signs and verifies cookie values with HMAC-SHA256.
+ *
+ * The format is the one of the `cookie-signature` package (used by
+ * `cookie-parser` and `express-session`): `value.signature`, where the
+ * signature is the base64 digest without `=` padding. Signed values carry the
+ * `s:` prefix, so cookies signed by `cookie-parser`/Express with the same
+ * secret keep verifying, and so do un-prefixed values signed by
+ * `@fastify/cookie`.
+ *
+ * With several secrets, values are signed with the first one and verified
+ * against each of them (secret rotation).
+ */
+export class CookieSigner {
+    secrets;
+    constructor(secret) {
+        const secrets = Array.isArray(secret) ? secret : [secret];
+        if (secrets.length === 0 ||
+            secrets.some(item => typeof item !== 'string' || item.length === 0)) {
+            throw new TypeError('The "cookies.secret" option must be a non-empty string or a non-empty array of non-empty strings.');
+        }
+        this.secrets = [...secrets];
+    }
+    /**
+     * Returns `s:<value>.<signature>`, signed with the first secret.
+     */
+    sign(value) {
+        return `${SIGNED_COOKIE_PREFIX}${value}.${this.digest(value, this.secrets[0])}`;
+    }
+    /**
+     * Returns the original value when `input` carries a valid signature for
+     * any of the secrets, `undefined` otherwise. The `s:` prefix is optional.
+     */
+    unsign(input) {
+        if (typeof input !== 'string') {
+            return undefined;
+        }
+        const signed = input.startsWith(SIGNED_COOKIE_PREFIX)
+            ? input.slice(SIGNED_COOKIE_PREFIX.length)
+            : input;
+        const dotIndex = signed.lastIndexOf('.');
+        if (dotIndex === -1) {
+            return undefined;
+        }
+        const value = signed.slice(0, dotIndex);
+        const signature = Buffer.from(signed.slice(dotIndex + 1));
+        let valid = false;
+        for (const secret of this.secrets) {
+            const expected = Buffer.from(this.digest(value, secret));
+            // Every secret is checked, so timing does not reveal which one matched.
+            if (expected.length === signature.length &&
+                timingSafeEqual(expected, signature)) {
+                valid = true;
+            }
+        }
+        return valid ? value : undefined;
+    }
+    digest(value, secret) {
+        return createHmac('sha256', secret)
+            .update(value)
+            .digest('base64')
+            .replace(/=+$/, '');
+    }
+}

package/helpers/cookies/parse-cookie-header.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Dictionary of cookies keyed by name. Created without a prototype, so names
+ * such as `__proto__` or `constructor` are stored as plain entries.
+ */
+export type CookieRecord = Record<string, string>;
+/**
+ * Parses a `Cookie` request header (RFC 6265, section 5.4) into a
+ * prototype-less dictionary.
+ *
+ * - pairs are separated by `;`, and split on the first `=` only;
+ * - names and values are trimmed, and a value wrapped in double quotes is
+ *   unquoted;
+ * - values are percent-decoded, falling back to the raw value when they are
+ *   not valid percent-encoding;
+ * - pairs without `=` or with an empty name are ignored;
+ * - when a name occurs more than once, the first occurrence wins (browsers
+ *   send the most specific path first).
+ */
+export declare function parseCookieHeader(header: string | string[] | undefined | null): CookieRecord;

package/helpers/cookies/parse-cookie-header.js

@@ -0,0 +1,47 @@
+/**
+ * Parses a `Cookie` request header (RFC 6265, section 5.4) into a
+ * prototype-less dictionary.
+ *
+ * - pairs are separated by `;`, and split on the first `=` only;
+ * - names and values are trimmed, and a value wrapped in double quotes is
+ *   unquoted;
+ * - values are percent-decoded, falling back to the raw value when they are
+ *   not valid percent-encoding;
+ * - pairs without `=` or with an empty name are ignored;
+ * - when a name occurs more than once, the first occurrence wins (browsers
+ *   send the most specific path first).
+ */
+export function parseCookieHeader(header) {
+    const cookies = Object.create(null);
+    if (!header) {
+        return cookies;
+    }
+    const source = Array.isArray(header) ? header.join('; ') : String(header);
+    for (const pair of source.split(';')) {
+        const eqIndex = pair.indexOf('=');
+        if (eqIndex === -1) {
+            continue;
+        }
+        const name = pair.slice(0, eqIndex).trim();
+        if (!name || name in cookies) {
+            continue;
+        }
+        let value = pair.slice(eqIndex + 1).trim();
+        if (value.length >= 2 && value[0] === '"' && value.endsWith('"')) {
+            value = value.slice(1, -1);
+        }
+        cookies[name] = safeDecode(value);
+    }
+    return cookies;
+}
+function safeDecode(value) {
+    if (!value.includes('%')) {
+        return value;
+    }
+    try {
+        return decodeURIComponent(value);
+    }
+    catch {
+        return value;
+    }
+}

package/helpers/cookies/request-cookies.d.ts

@@ -0,0 +1,30 @@
+import type { CookieSigner } from './cookie-signer.js';
+import { CookieRecord } from './parse-cookie-header.js';
+/**
+ * Returns the request cookies. `req.cookies`, when a cookie middleware
+ * (`cookie-parser`, `@fastify/cookie`) already populated it, takes precedence
+ * over parsing the `Cookie` header.
+ */
+export declare function getRequestCookies(req: Record<string, any>): CookieRecord;
+/**
+ * Returns a single request cookie, or `undefined` when it was not sent. Only
+ * own entries count, so names such as `constructor` never resolve to
+ * inherited members of a middleware-provided `req.cookies` object.
+ */
+export declare function getRequestCookie(req: Record<string, any>, name: string): string | undefined;
+/**
+ * Returns the request cookies whose signature verifies, with their unsigned
+ * value. Cookies that are not signed, or whose signature does not verify, are
+ * left out.
+ *
+ * Without a signer (no `cookies.secret` option), falls back to
+ * `req.signedCookies` as populated by `cookie-parser`, dropping the entries it
+ * marked invalid (`false`). Throws when neither is available.
+ */
+export declare function getRequestSignedCookies(req: Record<string, any>, signer: CookieSigner | undefined): CookieRecord;
+/**
+ * Returns the unsigned value of a single signed cookie, or `undefined` when it
+ * is missing or its signature does not verify. Same fallbacks as
+ * {@link getRequestSignedCookies}.
+ */
+export declare function getRequestSignedCookie(req: Record<string, any>, name: string, signer: CookieSigner | undefined): string | undefined;

package/helpers/cookies/request-cookies.js

@@ -0,0 +1,83 @@
+import { isObject } from '@nestjs/common/internal';
+import { parseCookieHeader } from './parse-cookie-header.js';
+/**
+ * Parsed `Cookie` header per request, so the header is parsed at most once
+ * however many parameters read cookies.
+ */
+const parsedCookiesCache = new WeakMap();
+function getParsedCookieHeader(req) {
+    let cookies = parsedCookiesCache.get(req);
+    if (!cookies) {
+        cookies = parseCookieHeader(req.headers?.cookie);
+        parsedCookiesCache.set(req, cookies);
+    }
+    return cookies;
+}
+/**
+ * Returns the request cookies. `req.cookies`, when a cookie middleware
+ * (`cookie-parser`, `@fastify/cookie`) already populated it, takes precedence
+ * over parsing the `Cookie` header.
+ */
+export function getRequestCookies(req) {
+    if (isObject(req.cookies)) {
+        return req.cookies;
+    }
+    return getParsedCookieHeader(req);
+}
+/**
+ * Returns a single request cookie, or `undefined` when it was not sent. Only
+ * own entries count, so names such as `constructor` never resolve to
+ * inherited members of a middleware-provided `req.cookies` object.
+ */
+export function getRequestCookie(req, name) {
+    const cookies = getRequestCookies(req);
+    return Object.prototype.hasOwnProperty.call(cookies, name)
+        ? cookies[name]
+        : undefined;
+}
+/**
+ * Returns the request cookies whose signature verifies, with their unsigned
+ * value. Cookies that are not signed, or whose signature does not verify, are
+ * left out.
+ *
+ * Without a signer (no `cookies.secret` option), falls back to
+ * `req.signedCookies` as populated by `cookie-parser`, dropping the entries it
+ * marked invalid (`false`). Throws when neither is available.
+ */
+export function getRequestSignedCookies(req, signer) {
+    const signedCookies = Object.create(null);
+    if (signer) {
+        const cookies = getParsedCookieHeader(req);
+        for (const name of Object.keys(cookies)) {
+            const value = signer.unsign(cookies[name]);
+            if (value !== undefined) {
+                signedCookies[name] = value;
+            }
+        }
+        return signedCookies;
+    }
+    if (isObject(req.signedCookies)) {
+        for (const [name, value] of Object.entries(req.signedCookies)) {
+            // `false` marks an invalid signature. Other values are kept as is,
+            // including the objects cookie-parser makes of `j:` JSON cookies.
+            if (value !== false) {
+                signedCookies[name] = value;
+            }
+        }
+        return signedCookies;
+    }
+    throw new Error('Cannot read signed cookies: no cookie secret is configured. ' +
+        'Pass "cookies: { secret }" to NestFactory.create().');
+}
+/**
+ * Returns the unsigned value of a single signed cookie, or `undefined` when it
+ * is missing or its signature does not verify. Same fallbacks as
+ * {@link getRequestSignedCookies}.
+ */
+export function getRequestSignedCookie(req, name, signer) {
+    if (signer) {
+        const value = getParsedCookieHeader(req)[name];
+        return value === undefined ? undefined : signer.unsign(value);
+    }
+    return getRequestSignedCookies(req, signer)[name];
+}

package/helpers/cookies/serialize-cookie.d.ts

@@ -0,0 +1,14 @@
+import type { CookieSerializeOptions } from '@nestjs/common';
+/**
+ * Builds the value of a `Set-Cookie` response header (RFC 6265, section 4.1).
+ *
+ * The value is percent-encoded with `encodeURIComponent()`, whose output only
+ * contains RFC 6265 `cookie-octet`s. `path` defaults to `/`. Throws a
+ * `TypeError` when the name, the value or an attribute would produce an
+ * invalid header or smuggle extra attributes (`;`, CR, LF, ...), and when
+ * `sameSite: 'none'` or `partitioned` is set without `secure`, since browsers
+ * reject such cookies.
+ *
+ * Signing is not handled here: pass an already signed value.
+ */
+export declare function serializeCookie(name: string, value: string, options?: CookieSerializeOptions): string;