@axis-network/butter-col 0.0.0-stage → 0.1.0

package/package.json

@@ -1,6 +1,79 @@
 {
   "name": "@axis-network/butter-col",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "A service-worker web proxy with pluggable transports and an OpenResty (Lua) backend.",
+  "keywords": [
+    "butter-col",
+    "proxy",
+    "web-proxy",
+    "service-worker",
+    "openresty",
+    "transport"
+  ],
+  "author": "Axis Network",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/TheAxis-Network/butter-col.git",
+    "directory": "packages/butter-col"
+  },
+  "bugs": {
+    "url": "https://github.com/TheAxis-Network/butter-col/issues"
+  },
+  "homepage": "https://github.com/TheAxis-Network/butter-col#readme",
+  "type": "module",
+  "main": "./lib/index.js",
+  "types": "./lib/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "import": "./lib/index.js"
+    },
+    "./formatter": {
+      "types": "./dist/types/formatter/index.d.ts",
+      "import": "./dist/formatter.mjs"
+    },
+    "./controller": {
+      "types": "./dist/types/controller/index.d.ts",
+      "import": "./dist/controller.mjs"
+    },
+    "./package.json": "./package.json"
+  },
+  "bin": {
+    "butter-col": "bin/butter-col.js"
+  },
+  "files": [
+    "bin",
+    "lib",
+    "dist",
+    "site",
+    "LICENSE",
+    "server/conf/nginx.conf.template",
+    "server/conf/butter-proxy.conf.template",
+    "server/conf/mime.types",
+    "server/lua",
+    "server/config.lua",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "node scripts/build.mjs",
+    "dev": "node scripts/build.mjs --watch",
+    "typecheck": "tsc -p tsconfig.json",
+    "test": "node --test test/*.test.mjs",
+    "test:lua": "node test/lua/run.mjs"
+  },
+  "dependencies": {
+    "@axis-network/butter-transport": "^0.1.0"
+  },
+  "devDependencies": {
+    "esbuild": "^0.28.2",
+    "fengari": "^0.1.5",
+    "typescript": "^7.0.2"
+  }
+}

package/server/conf/butter-proxy.conf.template

@@ -0,0 +1,29 @@
+# Rendered by `butter-col server` into <runtime>/conf/butter-proxy.conf ({{CACERT}} = CA bundle path).
+# Upstream settings shared by /butter/fetch and /butter/ws.
+# The Lua access handler fills in the $butter_* variables after validating
+# the target and resolving it to an address that passed the SSRF guard.
+
+proxy_pass $butter_scheme://$butter_addr$butter_uri;
+proxy_http_version 1.1;
+proxy_set_header Host $butter_host;
+
+proxy_ssl_server_name on;
+proxy_ssl_name $butter_sni;
+proxy_ssl_protocols TLSv1.2 TLSv1.3;
+proxy_ssl_verify on;
+proxy_ssl_verify_depth 5;
+proxy_ssl_trusted_certificate {{CACERT}};
+proxy_ssl_session_reuse on;
+
+# Never let an upstream steer nginx (X-Accel-Redirect would be an internal redirect).
+proxy_ignore_headers X-Accel-Redirect X-Accel-Expires X-Accel-Limit-Rate X-Accel-Buffering X-Accel-Charset;
+
+proxy_redirect off;
+proxy_buffering off;
+proxy_intercept_errors off;
+proxy_connect_timeout 15s;
+
+# Room for large upstream response headers (big CSPs, many cookies).
+proxy_buffer_size 64k;
+proxy_buffers 16 64k;
+proxy_busy_buffers_size 128k;

package/server/conf/mime.types

@@ -0,0 +1,19 @@
+types {
+    text/html                   html htm;
+    text/css                    css;
+    text/javascript             js mjs;
+    application/json            json map;
+    application/manifest+json   webmanifest;
+    application/wasm            wasm;
+    text/plain                  txt;
+    text/markdown               md;
+    image/svg+xml               svg svgz;
+    image/png                   png;
+    image/jpeg                  jpg jpeg;
+    image/gif                   gif;
+    image/webp                  webp;
+    image/avif                  avif;
+    image/x-icon                ico;
+    font/woff                   woff;
+    font/woff2                  woff2;
+}

package/server/conf/nginx.conf.template

@@ -0,0 +1,152 @@
+# butter-col: OpenResty configuration template.
+#
+# `butter-col server start` renders this into <runtime>/conf/nginx.conf,
+# replacing each double-brace placeholder with an absolute path or value:
+#
+#   {{LISTEN}}       listen address, e.g. 8080
+#   {{LUA_DIR}}      this package's server/lua
+#   {{CONFIG_FILE}}  your butter.config.lua (or the package default)
+#   {{SITE_ROOT}}    the site served at / (launcher, docs, your app)
+#   {{APP_DIR}}      this package's built-in frontend (site/), served at /app/
+#   {{DIST_DIR}}     this package's dist (service worker, runtime, ...)
+#   {{RUNTIME_DIR}}  the runtime directory (logs, transports, cacert.pem)
+#
+# The /butter/ paths below must match `base` in the Lua configuration.
+
+worker_processes auto;
+error_log logs/error.log notice;
+pid logs/nginx.pid;
+
+events {
+    worker_connections 4096;
+}
+
+http {
+    include mime.types;
+    default_type application/octet-stream;
+    charset utf-8;
+    charset_types text/css text/plain text/javascript application/javascript application/json image/svg+xml;
+    sendfile on;
+    server_tokens off;
+
+    # Target URLs travel in headers, so access logs never contain browsing history.
+    access_log logs/access.log;
+
+    lua_package_path "{{LUA_DIR}}/?.lua;{{LUA_DIR}}/?/init.lua;;";
+    lua_shared_dict butter_dns     10m;
+    lua_shared_dict butter_cookies 64m;
+    lua_shared_dict butter_limit   10m;
+
+    init_by_lua_block {
+        require("butter").init([==[{{CONFIG_FILE}}]==])
+    }
+
+    # X-Butter-Headers carries the page's request headers as JSON.
+    large_client_header_buffers 8 64k;
+    client_max_body_size 100m;
+
+    server {
+        listen {{LISTEN}};
+        server_name _;
+
+        root {{SITE_ROOT}};
+        index index.html;
+
+        location / {
+            try_files $uri $uri/ =404;
+        }
+
+        # The built-in frontend, always available (also served at / when no
+        # --site is given).
+        location = /app {
+            return 301 /app/;
+        }
+        location ^~ /app/ {
+            alias {{APP_DIR}}/;
+            index index.html;
+            add_header Cache-Control "no-cache" always;
+        }
+
+        # --- butter-col endpoints --------------------------------------------
+
+        location = /butter/sw.js {
+            alias {{DIST_DIR}}/sw.js;
+            add_header Service-Worker-Allowed "/" always;
+            add_header Cache-Control "no-cache" always;
+        }
+
+        location = /butter/config.js {
+            content_by_lua_block { require("butter.transport").config_js() }
+        }
+
+        location = /butter/health {
+            content_by_lua_block { require("butter.transport").health() }
+        }
+
+        location = /butter/cookie {
+            client_max_body_size 16k;
+            client_body_buffer_size 16k;
+            content_by_lua_block { require("butter.transport").cookie() }
+        }
+
+        location = /butter/fetch {
+            set $butter_scheme "";
+            set $butter_addr "";
+            set $butter_uri "";
+            set $butter_host "";
+            set $butter_sni "";
+            access_by_lua_block { require("butter.transport").access_fetch() }
+
+            include butter-proxy.conf;
+            proxy_set_header Connection "";
+            proxy_read_timeout 120s;
+            proxy_send_timeout 60s;
+
+            header_filter_by_lua_block { require("butter.transport").header_filter_fetch() }
+            error_page 502 504 @butter_upstream_error;
+        }
+
+        location = /butter/ws {
+            set $butter_scheme "";
+            set $butter_addr "";
+            set $butter_uri "";
+            set $butter_host "";
+            set $butter_sni "";
+            access_by_lua_block { require("butter.transport").access_ws() }
+
+            include butter-proxy.conf;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "upgrade";
+            proxy_read_timeout 1h;
+            proxy_send_timeout 1h;
+
+            header_filter_by_lua_block { require("butter.transport").header_filter_ws() }
+            error_page 502 504 @butter_upstream_error;
+        }
+
+        location @butter_upstream_error {
+            content_by_lua_block { require("butter.transport").upstream_error() }
+        }
+
+        # Transport scripts: the built-in ones plus any added with
+        # `butter-col transport add`, copied here at startup.
+        location ^~ /butter/transports/ {
+            root {{RUNTIME_DIR}}/www;
+            add_header Cache-Control "no-cache" always;
+        }
+
+        # Proxied URLs only reach the server when the service worker is not
+        # running yet; the bootstrap page installs it and reloads.
+        location ^~ /butter/go/ {
+            root {{DIST_DIR}};
+            rewrite ^ /bootstrap.html break;
+            add_header Cache-Control "no-store" always;
+        }
+
+        # Built assets: client.js, controller.mjs, formatter.mjs, source maps.
+        location ^~ /butter/ {
+            alias {{DIST_DIR}}/;
+            add_header Cache-Control "no-cache" always;
+        }
+    }
+}

package/server/config.lua

@@ -0,0 +1,34 @@
+-- butter-col server configuration (the package default).
+-- Copy this file to butter.config.lua in your project and edit it; anything
+-- left out falls back to the defaults in lua/butter/config.lua.
+-- Run `butter-col server reload` after editing.
+
+return {
+  -- URL codec for proxied URLs: "none", "plain", "xor" or "base64".
+  codec = "plain",
+
+  -- Transports offered to browsers; visitors can switch between them with
+  -- ButterController.setTransport(). Add more with `butter-col transport add`.
+  transports = {
+    { name = "butter" },                       -- built in: this server
+    -- { name = "bare", options = { server = "https://bare.example.com/" } },
+  },
+  default_transport = "butter",
+
+  dns = {
+    nameservers = { "1.1.1.1", "8.8.8.8" },
+  },
+
+  guard = {
+    -- Never set this to true on a server other people can reach: it lets
+    -- visitors reach your local network and cloud metadata endpoints.
+    allow_private = false,
+    blocked_hosts = { "localhost", "local", "internal", "localdomain", "home.arpa" },
+  },
+
+  rate_limit = {
+    enabled = true,
+    requests = 1200,
+    window = 60,
+  },
+}

package/server/lua/butter/config.lua

@@ -0,0 +1,160 @@
+-- Configuration: defaults merged with server/config.lua (if present).
+
+local M = {}
+
+M.VERSION = "0.1.0"
+
+local CODECS = { none = true, plain = true, xor = true, base64 = true }
+
+local defaults = {
+  -- Where butter-col's own endpoints and assets live. The nginx locations in
+  -- conf/nginx.conf use this path too; change both together.
+  base = "/butter/",
+  -- Prefix of proxied URLs; must live under `base` (see the bootstrap location).
+  prefix = "/butter/go/",
+  -- URL codec: "none" | "plain" | "xor" | "base64"
+  codec = "plain",
+
+  -- Transports offered to browsers. Each entry: { name, url?, options? }.
+  -- `url` defaults to <base>transports/<name>.js; `options` is sent to the
+  -- transport's factory as JSON. Visitors can switch between these with
+  -- ButterController.setTransport().
+  transports = {
+    { name = "butter" },
+  },
+  -- Used until a visitor picks another one.
+  default_transport = "butter",
+
+  -- Reject transport requests that a browser marks as cross-site, so other
+  -- websites cannot use visitors' browsers to drive the proxy.
+  require_same_origin = true,
+  -- Allow clients that send neither Sec-Fetch-Site nor Origin (curl, scripts).
+  allow_non_browser = true,
+  -- Override the upstream User-Agent (nil forwards the browser's own).
+  user_agent = nil,
+
+  dns = {
+    nameservers = { "1.1.1.1", "8.8.8.8" },
+    timeout = 2000,     -- ms per attempt
+    retrans = 2,
+    ipv6 = false,       -- also look up AAAA records when there is no A record
+    min_ttl = 30,
+    max_ttl = 3600,
+    negative_ttl = 30,
+  },
+
+  guard = {
+    -- Allow upstream connections to private / loopback / link-local addresses.
+    -- Leave this off unless the proxy only serves you on a trusted network.
+    allow_private = false,
+    -- Allow the ports browsers refuse to fetch (SMTP, IRC, ...).
+    allow_bad_ports = false,
+    -- Hosts that may never be proxied; "example.com" also covers subdomains.
+    blocked_hosts = { "localhost", "local", "internal", "localdomain", "home.arpa" },
+    -- If set, only these hosts (and their subdomains) may be proxied.
+    allowed_hosts = nil,
+  },
+
+  cookies = {
+    enabled = true,
+    max_per_session = 500,
+    session_ttl = 7 * 24 * 3600, -- seconds a jar is kept after its last change
+  },
+
+  rate_limit = {
+    enabled = true,
+    requests = 1200,    -- per client IP ...
+    window = 60,        -- ... per this many seconds
+  },
+}
+
+local current
+
+local function is_array(t)
+  return type(t) == "table" and t[1] ~= nil
+end
+
+--- Deep-merge `override` into `base`. Lists (and scalars) replace wholesale.
+local function merge(base, override)
+  if override == nil then return base end
+  if type(base) ~= "table" or type(override) ~= "table" or is_array(base) or is_array(override) then
+    return override
+  end
+  local out = {}
+  for k, v in pairs(base) do out[k] = v end
+  for k, v in pairs(override) do out[k] = merge(base[k], v) end
+  return out
+end
+
+local function validate(cfg)
+  assert(type(cfg.base) == "string" and cfg.base:match("^/.*/$"), "config.base must start and end with '/'")
+  assert(type(cfg.prefix) == "string" and cfg.prefix:match("^/.*/$"), "config.prefix must start and end with '/'")
+  assert(cfg.prefix:sub(1, #cfg.base) == cfg.base and cfg.prefix ~= cfg.base, "config.prefix must live under config.base")
+  assert(CODECS[cfg.codec], "config.codec must be one of none, plain, xor, base64")
+  assert(type(cfg.dns.nameservers) == "table" and #cfg.dns.nameservers > 0, "config.dns.nameservers must not be empty")
+  assert(cfg.rate_limit.window > 0 and cfg.rate_limit.requests > 0, "config.rate_limit values must be positive")
+
+  assert(type(cfg.transports) == "table" and #cfg.transports > 0, "config.transports must list at least one transport")
+  local seen = {}
+  for i, entry in ipairs(cfg.transports) do
+    assert(type(entry) == "table", "config.transports[" .. i .. "] must be a table")
+    assert(type(entry.name) == "string" and entry.name:match("^[a-z0-9][a-z0-9._-]*$") and #entry.name <= 64,
+      "config.transports[" .. i .. "].name must be lower-case letters, digits, '.', '_' or '-'")
+    assert(not seen[entry.name], "config.transports lists \"" .. entry.name .. "\" twice")
+    assert(entry.url == nil or type(entry.url) == "string", "config.transports[" .. i .. "].url must be a string")
+    seen[entry.name] = true
+  end
+  assert(seen[cfg.default_transport], "config.default_transport must name one of config.transports")
+end
+
+--- Load defaults merged with the user file at `path` (missing file = defaults).
+function M.load(path)
+  local user = {}
+  if path then
+    local chunk, err = loadfile(path)
+    if not chunk and not tostring(err):find("cannot open", 1, true) then
+      error("butter: cannot parse " .. path .. ": " .. tostring(err))
+    end
+    if chunk then
+      local ok, result = pcall(chunk)
+      if not ok then error("butter: error in " .. path .. ": " .. tostring(result)) end
+      if type(result) ~= "table" then error("butter: " .. path .. " must return a table") end
+      user = result
+    end
+  end
+  local cfg = merge(defaults, user)
+  validate(cfg)
+  current = cfg
+  return cfg
+end
+
+function M.get()
+  return current or M.load()
+end
+
+--- The subset sent to browsers as /butter/config.js.
+function M.public()
+  local cfg = M.get()
+  local base = cfg.base
+  local transports = {}
+  for i, entry in ipairs(cfg.transports) do
+    transports[i] = {
+      name = entry.name,
+      url = entry.url or (base .. "transports/" .. entry.name .. ".js"),
+      options = entry.options,
+    }
+  end
+  return {
+    version = M.VERSION,
+    prefix = cfg.prefix,
+    base = base,
+    codec = cfg.codec,
+    transport = { fetch = base .. "fetch", ws = base .. "ws", cookie = base .. "cookie" },
+    client = base .. "client.js",
+    config = base .. "config.js",
+    transports = transports,
+    defaultTransport = cfg.default_transport,
+  }
+end
+
+return M

package/server/lua/butter/cookiejar.lua

@@ -0,0 +1,197 @@
+-- Server-side cookie jar logic (RFC 6265 subset). Pure Lua, no ngx dependency:
+-- storage lives in butter.store; this module only transforms cookie lists.
+--
+-- A cookie is a table:
+--   { name, value, domain, host_only, path, secure, http_only, same_site,
+--     expires (epoch seconds or nil for session cookies), created }
+
+local url_util = require "butter.url"
+
+local M = {}
+
+local function trim(s)
+  return (s:gsub("^%s+", ""):gsub("%s+$", ""))
+end
+
+local MONTHS = { jan = 1, feb = 2, mar = 3, apr = 4, may = 5, jun = 6, jul = 7, aug = 8, sep = 9, oct = 10, nov = 11, dec = 12 }
+
+local function days_from_civil(y, m, d)
+  if m <= 2 then y = y - 1 end
+  local era = math.floor(y / 400)
+  local yoe = y - era * 400
+  local mp = (m + 9) % 12
+  local doy = math.floor((153 * mp + 2) / 5) + d - 1
+  local doe = yoe * 365 + math.floor(yoe / 4) - math.floor(yoe / 100) + doy
+  return era * 146097 + doe - 719468
+end
+
+--- Parse a cookie date (RFC 6265 section 5.1.1). Returns epoch seconds or nil.
+function M.parse_date(s)
+  local hour, minute, second, day, month, year
+  for token in s:gmatch("[^%s,;%-/]+") do
+    local h, mi, se = token:match("^(%d%d?):(%d%d?):(%d%d?)")
+    if h and not hour then
+      hour, minute, second = tonumber(h), tonumber(mi), tonumber(se)
+    elseif not day and token:match("^%d%d?$") then
+      day = tonumber(token)
+    elseif not month and MONTHS[token:sub(1, 3):lower()] then
+      month = MONTHS[token:sub(1, 3):lower()]
+    elseif not year and token:match("^%d%d%d?%d?$") then
+      year = tonumber(token)
+    end
+  end
+  if not (hour and day and month and year) then return nil end
+  if year >= 70 and year <= 99 then year = year + 1900 elseif year < 70 then year = year + 2000 end
+  if day < 1 or day > 31 or year < 1601 or hour > 23 or minute > 59 or second > 59 then return nil end
+  return days_from_civil(year, month, day) * 86400 + hour * 3600 + minute * 60 + second
+end
+
+--- Default-path of a request path (RFC 6265 section 5.1.4).
+function M.default_path(path)
+  path = url_util.path_only(path or "/")
+  if path:sub(1, 1) ~= "/" then return "/" end
+  local last = path:match("^.*()/")
+  if not last or last == 1 then return "/" end
+  return path:sub(1, last - 1)
+end
+
+local function is_ip(host)
+  return host:match("^%d+%.%d+%.%d+%.%d+$") ~= nil or host:find(":", 1, true) ~= nil
+end
+
+function M.domain_match(host, domain)
+  if host == domain then return true end
+  if is_ip(host) then return false end
+  return #host > #domain and host:sub(-#domain - 1) == "." .. domain
+end
+
+function M.path_match(request_path, cookie_path)
+  if request_path == cookie_path then return true end
+  if request_path:sub(1, #cookie_path) ~= cookie_path then return false end
+  return cookie_path:sub(-1) == "/" or request_path:sub(#cookie_path + 1, #cookie_path + 1) == "/"
+end
+
+--- Parse one Set-Cookie header received from `target` (a butter.url table).
+-- @return table|nil, string|nil
+function M.parse_set_cookie(header, target, now)
+  if type(header) ~= "string" then return nil, "not a string" end
+  local pair, attrs = header:match("^([^;]*)(.*)$")
+  local name, value
+  local eq = pair:find("=", 1, true)
+  if eq then
+    name, value = trim(pair:sub(1, eq - 1)), trim(pair:sub(eq + 1))
+  else
+    name, value = "", trim(pair)
+  end
+  if name == "" and value == "" then return nil, "empty cookie" end
+  if #name + #value > 4096 then return nil, "cookie too large" end
+  if (name .. value):find("%c") then return nil, "control characters in cookie" end
+
+  local cookie = { name = name, value = value, secure = false, http_only = false }
+  local max_age, expires, domain, path
+  for attr in attrs:gmatch(";([^;]*)") do
+    local k, v = attr:match("^%s*([^=]-)%s*=%s*(.-)%s*$")
+    if not k then
+      k, v = trim(attr), ""
+    end
+    k = k:lower()
+    if k == "expires" then
+      expires = M.parse_date(v) or expires
+    elseif k == "max-age" then
+      if v:match("^%-?%d+$") then max_age = tonumber(v) end
+    elseif k == "domain" then
+      v = v:gsub("^%.", ""):lower()
+      if v ~= "" then domain = v end
+    elseif k == "path" then
+      if v:sub(1, 1) == "/" then path = v end
+    elseif k == "secure" then
+      cookie.secure = true
+    elseif k == "httponly" then
+      cookie.http_only = true
+    elseif k == "samesite" then
+      cookie.same_site = v:lower()
+    end
+  end
+
+  if max_age then
+    cookie.expires = max_age <= 0 and 0 or now + max_age
+  elseif expires then
+    cookie.expires = expires
+  end
+
+  local host = target.host
+  if domain then
+    if not M.domain_match(host, domain) then return nil, "domain does not match" end
+    -- Without a public suffix list, at least refuse single-label domains ("com").
+    if domain ~= host and not domain:find(".", 1, true) then return nil, "domain too broad" end
+    cookie.domain, cookie.host_only = domain, false
+  else
+    cookie.domain, cookie.host_only = host, true
+  end
+  cookie.path = path or M.default_path(target.path)
+
+  if cookie.secure and not target.secure then return nil, "secure cookie from insecure origin" end
+  if name:sub(1, 9) == "__Secure-" and not cookie.secure then return nil, "__Secure- prefix requires Secure" end
+  if name:sub(1, 7) == "__Host-" and not (cookie.secure and cookie.host_only and cookie.path == "/") then
+    return nil, "__Host- prefix requirements not met"
+  end
+  return cookie
+end
+
+--- Insert or replace `cookie` in `list`, dropping expired entries.
+-- opts.from_script: the cookie comes from document.cookie (cannot touch HttpOnly)
+-- opts.max: maximum cookies kept (oldest are evicted)
+-- @return table  the new list
+function M.upsert(list, cookie, now, opts)
+  opts = opts or {}
+  if opts.from_script and cookie.http_only then return list end
+  local out, created = {}, nil
+  for _, c in ipairs(list) do
+    if c.expires and c.expires <= now then
+      -- expired: drop
+    elseif c.name == cookie.name and c.domain == cookie.domain and c.path == cookie.path then
+      if opts.from_script and c.http_only then return list end
+      created = c.created
+    else
+      out[#out + 1] = c
+    end
+  end
+  cookie.created = created or now
+  if not (cookie.expires and cookie.expires <= now) then out[#out + 1] = cookie end
+
+  local max = opts.max or 500
+  if #out > max then
+    table.sort(out, function(a, b) return (a.created or 0) > (b.created or 0) end)
+    for i = #out, max + 1, -1 do out[i] = nil end
+  end
+  return out
+end
+
+--- Cookie header value for a request to `target`.
+-- opts.for_script: only cookies visible to document.cookie (no HttpOnly)
+function M.header(list, target, now, opts)
+  local for_script = opts and opts.for_script
+  local path = url_util.path_only(target.path)
+  local matches = {}
+  for _, c in ipairs(list) do
+    if not (c.expires and c.expires <= now)
+      and ((c.host_only and c.domain == target.host) or (not c.host_only and M.domain_match(target.host, c.domain)))
+      and M.path_match(path, c.path)
+      and (not c.secure or target.secure)
+      and not (for_script and c.http_only)
+    then
+      matches[#matches + 1] = c
+    end
+  end
+  table.sort(matches, function(a, b)
+    if #a.path ~= #b.path then return #a.path > #b.path end
+    return (a.created or 0) < (b.created or 0)
+  end)
+  local parts = {}
+  for i, c in ipairs(matches) do
+    parts[i] = c.name ~= "" and (c.name .. "=" .. c.value) or c.value
+  end
+  return table.concat(parts, "; ")
+end
+
+return M