tough-cookie 6.0.2 → 6.1.0

package/dist/index.d.cts

@@ -16,6 +16,16 @@ declare const PrefixSecurityEnum: {
     readonly STRICT: "strict";
     readonly DISABLED: "unsafe-disabled";
 };
+/**
+ * Prefix security enforcement mode for a CookieJar per RFC 6265bis.
+ *
+ * - `'silent'` - Enable cookie prefix checking but silently ignores the cookie if conditions are not met. Default.
+ * - `'strict'` - Enables cookie prefix checking and will raise an error if conditions are not met.
+ * - `'unsafe-disabled'` - Disables cookie prefix checking.
+ *
+ * @public
+ */
+type PrefixSecurityMode = (typeof PrefixSecurityEnum)[keyof typeof PrefixSecurityEnum];
 /**
  * A JSON representation of a {@link CookieJar}.
  * @public
@@ -212,6 +222,10 @@ declare class Cookie {
      *
      * @remarks
      * Works for a few things, but is by no means comprehensive.
+     * Checks that the cookie name is a non-empty token as defined in RFC 6265 Section 4.1.1.
+     * Nameless cookies (including those parsed in loose mode or created with `new Cookie({ value })`)
+     * and names containing characters outside the token grammar (such as `a b`) return `false`.
+     * Parsing and storage remain permissive; this check only applies to explicit validation.
      *
      * @beta
      */
@@ -370,6 +384,7 @@ declare class Cookie {
     static sameSiteCanonical: {
         readonly strict: "Strict";
         readonly lax: "Lax";
+        readonly none: "None";
     };
     /**
      * Cookie properties that will be serialized when using {@link Cookie.fromJSON} and {@link Cookie.toJSON}.
@@ -928,7 +943,7 @@ declare class ParameterError extends Error {
  * The version of `tough-cookie`
  * @public
  */
-declare const version = "6.0.2";
+declare const version = "6.1.0";
 
 /**
  * Transforms a domain name into a canonical domain name. The canonical domain name is a domain name
@@ -1150,11 +1165,11 @@ interface CreateCookieJarOptions {
      */
     looseMode?: boolean | undefined;
     /**
-     * Controls how cookie prefixes are handled. See {@link PrefixSecurityEnum}.
+     * Controls how cookie prefixes are handled. See {@link PrefixSecurityMode}.
      *
      * Defaults to `silent` if not specified.
      */
-    prefixSecurity?: 'strict' | 'silent' | 'unsafe-disabled' | undefined;
+    prefixSecurity?: PrefixSecurityMode | undefined;
     /**
      * Accepts {@link https://datatracker.ietf.org/doc/html/rfc6761 | special-use domains } such as `local`.
      * This is not in the standard, but is used sometimes on the web and is accepted by most browsers. It is
@@ -1164,10 +1179,10 @@ interface CreateCookieJarOptions {
      */
     allowSpecialUseDomain?: boolean | undefined;
     /**
-     * Flag to indicate if localhost and loopback addresses with an unsecure scheme should store and retrieve `Secure` cookies.
+     * Flag to indicate if localhost and loopback addresses with an insecure scheme should store and retrieve `Secure` cookies.
      *
      * If `true`, localhost, loopback addresses or similarly local addresses are treated as secure contexts
-     * and thus will store and retrieve `Secure` cookies even with an unsecure scheme.
+     * and thus will store and retrieve `Secure` cookies even with an insecure scheme.
      *
      * If `false`, only secure schemes (`https` and `wss`) will store and retrieve `Secure` cookies.
      *
@@ -1176,6 +1191,24 @@ interface CreateCookieJarOptions {
      *  algorithm is followed to determine if a URL is considered a secure context.
      */
     allowSecureOnLocal?: boolean | undefined;
+    /**
+     * Flag to indicate if `Secure` cookies set from an unsecure origin should be rejected.
+     *
+     * If `true`, a cookie with the `Secure` attribute is only stored when it is set from a secure context
+     * (see {@link CreateCookieJarOptions.allowSecureOnLocal}). This applies to all `Secure` cookies, not just
+     * those with a `__Secure-` or `__Host-` prefix, and is independent of {@link CreateCookieJarOptions.prefixSecurity}.
+     *
+     * If `false`, `Secure` cookies are stored regardless of the origin they were set from.
+     *
+     * This only affects storage. On retrieval, `Secure` cookies are only returned for secure contexts
+     * regardless of this setting.
+     *
+     * Defaults to `true` if not specified.
+     *
+     * @remarks
+     * See {@link https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-22#section-5.7-3.13.1 | RFC6265bis draft -22, Section 5.7 step 13}.
+     */
+    enforceSecureOriginOnStorage?: boolean | undefined;
 }
 /**
  * A CookieJar is for storage and retrieval of {@link Cookie} objects as defined in
@@ -1189,12 +1222,13 @@ declare class CookieJar {
     private readonly enableLooseMode;
     private readonly allowSpecialUseDomain;
     private readonly allowSecureOnLocal;
+    private readonly enforceSecureOriginOnStorage;
     /**
      * The configured {@link Store} for the {@link CookieJar}.
      */
     readonly store: Store;
     /**
-     * The configured {@link PrefixSecurityEnum} value for the {@link CookieJar}.
+     * The configured {@link PrefixSecurityMode} value for the {@link CookieJar}.
      */
     readonly prefixSecurity: string;
     /**
@@ -1291,19 +1325,7 @@ declare class CookieJar {
      * @param options - Configuration settings to use when storing the cookie.
      * @public
      */
-    setCookieSync(cookie: string | Cookie, url: string, options?: SetCookieOptions): Cookie | undefined;
-    /**
-     * Retrieve the list of cookies that can be sent in a Cookie header for the
-     * current URL.
-     *
-     * @remarks
-     * - The array of cookies returned will be sorted according to {@link cookieCompare}.
-     *
-     * - The {@link Cookie.lastAccessed} property will be updated on all returned cookies.
-     *
-     * @param url - The domain to store the cookie with.
-     */
-    getCookies(url: string): Promise<Cookie[]>;
+    setCookieSync(cookie: string | Cookie, url: string | URL, options?: SetCookieOptions): Cookie | undefined;
     /**
      * Retrieve the list of cookies that can be sent in a Cookie header for the
      * current URL.
@@ -1316,7 +1338,7 @@ declare class CookieJar {
      * @param url - The domain to store the cookie with.
      * @param callback - A function to call after a cookie has been successfully retrieved.
      */
-    getCookies(url: string, callback: Callback<Cookie[]>): void;
+    getCookies(url: string | URL, callback: Callback<Cookie[]>): void;
     /**
      * Retrieve the list of cookies that can be sent in a Cookie header for the
      * current URL.
@@ -1362,7 +1384,7 @@ declare class CookieJar {
      * @param url - The domain to store the cookie with.
      * @param options - Configuration settings to use when retrieving the cookies.
      */
-    getCookiesSync(url: string, options?: GetCookiesOptions): Cookie[];
+    getCookiesSync(url: string | URL, options?: GetCookiesOptions): Cookie[];
     /**
      * Accepts the same options as `.getCookies()` but returns a string suitable for a
      * `Cookie` header rather than an Array.
@@ -1371,7 +1393,7 @@ declare class CookieJar {
      * @param options - Configuration settings to use when retrieving the cookies.
      * @param callback - A function to call after the `Cookie` header string has been created.
      */
-    getCookieString(url: string, options: GetCookiesOptions, callback: Callback<string | undefined>): void;
+    getCookieString(url: string | URL, options: GetCookiesOptions, callback: Callback<string | undefined>): void;
     /**
      * Accepts the same options as `.getCookies()` but returns a string suitable for a
      * `Cookie` header rather than an Array.
@@ -1379,7 +1401,7 @@ declare class CookieJar {
      * @param url - The domain to store the cookie with.
      * @param callback - A function to call after the `Cookie` header string has been created.
      */
-    getCookieString(url: string, callback: Callback<string | undefined>): void;
+    getCookieString(url: string | URL, callback: Callback<string | undefined>): void;
     /**
      * Accepts the same options as `.getCookies()` but returns a string suitable for a
      * `Cookie` header rather than an Array.
@@ -1387,11 +1409,11 @@ declare class CookieJar {
      * @param url - The domain to store the cookie with.
      * @param options - Configuration settings to use when retrieving the cookies.
      */
-    getCookieString(url: string, options?: GetCookiesOptions): Promise<string>;
+    getCookieString(url: string | URL, options?: GetCookiesOptions): Promise<string>;
     /**
      * @internal No doc because this is an overload that supports the implementation
      */
-    getCookieString(url: string, options: GetCookiesOptions | Callback<string | undefined>, callback?: Callback<string | undefined>): unknown;
+    getCookieString(url: string | URL, options: GetCookiesOptions | Callback<string | undefined>, callback?: Callback<string | undefined>): unknown;
     /**
      * Synchronous version of `.getCookieString()`. Accepts the same options as `.getCookies()` but returns a string suitable for a
      * `Cookie` header rather than an Array.
@@ -1401,7 +1423,7 @@ declare class CookieJar {
      * @param url - The domain to store the cookie with.
      * @param options - Configuration settings to use when retrieving the cookies.
      */
-    getCookieStringSync(url: string, options?: GetCookiesOptions): string;
+    getCookieStringSync(url: string | URL, options?: GetCookiesOptions): string;
     /**
      * Returns an array of strings suitable for `Set-Cookie` headers. Accepts the same options
      * as `.getCookies()`.
@@ -1409,7 +1431,7 @@ declare class CookieJar {
      * @param url - The domain to store the cookie with.
      * @param callback - A function to call after the `Set-Cookie` header strings have been created.
      */
-    getSetCookieStrings(url: string, callback: Callback<string[] | undefined>): void;
+    getSetCookieStrings(url: string | URL, callback: Callback<string[] | undefined>): void;
     /**
      * Returns an array of strings suitable for `Set-Cookie` headers. Accepts the same options
      * as `.getCookies()`.
@@ -1418,7 +1440,7 @@ declare class CookieJar {
      * @param options - Configuration settings to use when retrieving the cookies.
      * @param callback - A function to call after the `Set-Cookie` header strings have been created.
      */
-    getSetCookieStrings(url: string, options: GetCookiesOptions, callback: Callback<string[] | undefined>): void;
+    getSetCookieStrings(url: string | URL, options: GetCookiesOptions, callback: Callback<string[] | undefined>): void;
     /**
      * Returns an array of strings suitable for `Set-Cookie` headers. Accepts the same options
      * as `.getCookies()`.
@@ -1426,11 +1448,11 @@ declare class CookieJar {
      * @param url - The domain to store the cookie with.
      * @param options - Configuration settings to use when retrieving the cookies.
      */
-    getSetCookieStrings(url: string, options?: GetCookiesOptions): Promise<string[] | undefined>;
+    getSetCookieStrings(url: string | URL, options?: GetCookiesOptions): Promise<string[] | undefined>;
     /**
      * @internal No doc because this is an overload that supports the implementation
      */
-    getSetCookieStrings(url: string, options: GetCookiesOptions, callback?: Callback<string[] | undefined>): unknown;
+    getSetCookieStrings(url: string | URL, options: GetCookiesOptions, callback?: Callback<string[] | undefined>): unknown;
     /**
      * Synchronous version of `.getSetCookieStrings()`. Returns an array of strings suitable for `Set-Cookie` headers.
      * Accepts the same options as `.getCookies()`.
@@ -1440,7 +1462,7 @@ declare class CookieJar {
      * @param url - The domain to store the cookie with.
      * @param options - Configuration settings to use when retrieving the cookies.
      */
-    getSetCookieStringsSync(url: string, options?: GetCookiesOptions): string[];
+    getSetCookieStringsSync(url: string | URL, options?: GetCookiesOptions): string[];
     /**
      * Serialize the CookieJar if the underlying store supports `.getAllCookies`.
      * @param callback - A function to call after the CookieJar has been serialized
@@ -1803,4 +1825,5 @@ declare function parse(str: string, options?: ParseCookieOptions): Cookie | unde
  */
 declare function fromJSON(str: unknown): Cookie | undefined;
 
-export { type Callback, Cookie, CookieJar, type CreateCookieJarOptions, type CreateCookieOptions, type ErrorCallback, type GetCookiesOptions, type GetPublicSuffixOptions, MemoryCookieStore, type MemoryCookieStoreIndex, type Nullable, ParameterError, type ParseCookieOptions, PrefixSecurityEnum, type SerializedCookie, type SerializedCookieJar, type SetCookieOptions, Store, canonicalDomain, cookieCompare, defaultPath, domainMatch, formatDate, fromJSON, getPublicSuffix, parse, parseDate, pathMatch, permuteDomain, permutePath, version };
+export { Cookie, CookieJar, MemoryCookieStore, ParameterError, PrefixSecurityEnum, Store, canonicalDomain, cookieCompare, defaultPath, domainMatch, formatDate, fromJSON, getPublicSuffix, parse, parseDate, pathMatch, permuteDomain, permutePath, version };
+export type { Callback, CreateCookieJarOptions, CreateCookieOptions, ErrorCallback, GetCookiesOptions, GetPublicSuffixOptions, MemoryCookieStoreIndex, Nullable, ParseCookieOptions, PrefixSecurityMode, SerializedCookie, SerializedCookieJar, SetCookieOptions };

package/dist/index.d.ts

@@ -16,6 +16,16 @@ declare const PrefixSecurityEnum: {
     readonly STRICT: "strict";
     readonly DISABLED: "unsafe-disabled";
 };
+/**
+ * Prefix security enforcement mode for a CookieJar per RFC 6265bis.
+ *
+ * - `'silent'` - Enable cookie prefix checking but silently ignores the cookie if conditions are not met. Default.
+ * - `'strict'` - Enables cookie prefix checking and will raise an error if conditions are not met.
+ * - `'unsafe-disabled'` - Disables cookie prefix checking.
+ *
+ * @public
+ */
+type PrefixSecurityMode = (typeof PrefixSecurityEnum)[keyof typeof PrefixSecurityEnum];
 /**
  * A JSON representation of a {@link CookieJar}.
  * @public
@@ -212,6 +222,10 @@ declare class Cookie {
      *
      * @remarks
      * Works for a few things, but is by no means comprehensive.
+     * Checks that the cookie name is a non-empty token as defined in RFC 6265 Section 4.1.1.
+     * Nameless cookies (including those parsed in loose mode or created with `new Cookie({ value })`)
+     * and names containing characters outside the token grammar (such as `a b`) return `false`.
+     * Parsing and storage remain permissive; this check only applies to explicit validation.
      *
      * @beta
      */
@@ -370,6 +384,7 @@ declare class Cookie {
     static sameSiteCanonical: {
         readonly strict: "Strict";
         readonly lax: "Lax";
+        readonly none: "None";
     };
     /**
      * Cookie properties that will be serialized when using {@link Cookie.fromJSON} and {@link Cookie.toJSON}.
@@ -928,7 +943,7 @@ declare class ParameterError extends Error {
  * The version of `tough-cookie`
  * @public
  */
-declare const version = "6.0.2";
+declare const version = "6.1.0";
 
 /**
  * Transforms a domain name into a canonical domain name. The canonical domain name is a domain name
@@ -1150,11 +1165,11 @@ interface CreateCookieJarOptions {
      */
     looseMode?: boolean | undefined;
     /**
-     * Controls how cookie prefixes are handled. See {@link PrefixSecurityEnum}.
+     * Controls how cookie prefixes are handled. See {@link PrefixSecurityMode}.
      *
      * Defaults to `silent` if not specified.
      */
-    prefixSecurity?: 'strict' | 'silent' | 'unsafe-disabled' | undefined;
+    prefixSecurity?: PrefixSecurityMode | undefined;
     /**
      * Accepts {@link https://datatracker.ietf.org/doc/html/rfc6761 | special-use domains } such as `local`.
      * This is not in the standard, but is used sometimes on the web and is accepted by most browsers. It is
@@ -1164,10 +1179,10 @@ interface CreateCookieJarOptions {
      */
     allowSpecialUseDomain?: boolean | undefined;
     /**
-     * Flag to indicate if localhost and loopback addresses with an unsecure scheme should store and retrieve `Secure` cookies.
+     * Flag to indicate if localhost and loopback addresses with an insecure scheme should store and retrieve `Secure` cookies.
      *
      * If `true`, localhost, loopback addresses or similarly local addresses are treated as secure contexts
-     * and thus will store and retrieve `Secure` cookies even with an unsecure scheme.
+     * and thus will store and retrieve `Secure` cookies even with an insecure scheme.
      *
      * If `false`, only secure schemes (`https` and `wss`) will store and retrieve `Secure` cookies.
      *
@@ -1176,6 +1191,24 @@ interface CreateCookieJarOptions {
      *  algorithm is followed to determine if a URL is considered a secure context.
      */
     allowSecureOnLocal?: boolean | undefined;
+    /**
+     * Flag to indicate if `Secure` cookies set from an unsecure origin should be rejected.
+     *
+     * If `true`, a cookie with the `Secure` attribute is only stored when it is set from a secure context
+     * (see {@link CreateCookieJarOptions.allowSecureOnLocal}). This applies to all `Secure` cookies, not just
+     * those with a `__Secure-` or `__Host-` prefix, and is independent of {@link CreateCookieJarOptions.prefixSecurity}.
+     *
+     * If `false`, `Secure` cookies are stored regardless of the origin they were set from.
+     *
+     * This only affects storage. On retrieval, `Secure` cookies are only returned for secure contexts
+     * regardless of this setting.
+     *
+     * Defaults to `true` if not specified.
+     *
+     * @remarks
+     * See {@link https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-22#section-5.7-3.13.1 | RFC6265bis draft -22, Section 5.7 step 13}.
+     */
+    enforceSecureOriginOnStorage?: boolean | undefined;
 }
 /**
  * A CookieJar is for storage and retrieval of {@link Cookie} objects as defined in
@@ -1189,12 +1222,13 @@ declare class CookieJar {
     private readonly enableLooseMode;
     private readonly allowSpecialUseDomain;
     private readonly allowSecureOnLocal;
+    private readonly enforceSecureOriginOnStorage;
     /**
      * The configured {@link Store} for the {@link CookieJar}.
      */
     readonly store: Store;
     /**
-     * The configured {@link PrefixSecurityEnum} value for the {@link CookieJar}.
+     * The configured {@link PrefixSecurityMode} value for the {@link CookieJar}.
      */
     readonly prefixSecurity: string;
     /**
@@ -1291,19 +1325,7 @@ declare class CookieJar {
      * @param options - Configuration settings to use when storing the cookie.
      * @public
      */
-    setCookieSync(cookie: string | Cookie, url: string, options?: SetCookieOptions): Cookie | undefined;
-    /**
-     * Retrieve the list of cookies that can be sent in a Cookie header for the
-     * current URL.
-     *
-     * @remarks
-     * - The array of cookies returned will be sorted according to {@link cookieCompare}.
-     *
-     * - The {@link Cookie.lastAccessed} property will be updated on all returned cookies.
-     *
-     * @param url - The domain to store the cookie with.
-     */
-    getCookies(url: string): Promise<Cookie[]>;
+    setCookieSync(cookie: string | Cookie, url: string | URL, options?: SetCookieOptions): Cookie | undefined;
     /**
      * Retrieve the list of cookies that can be sent in a Cookie header for the
      * current URL.
@@ -1316,7 +1338,7 @@ declare class CookieJar {
      * @param url - The domain to store the cookie with.
      * @param callback - A function to call after a cookie has been successfully retrieved.
      */
-    getCookies(url: string, callback: Callback<Cookie[]>): void;
+    getCookies(url: string | URL, callback: Callback<Cookie[]>): void;
     /**
      * Retrieve the list of cookies that can be sent in a Cookie header for the
      * current URL.
@@ -1362,7 +1384,7 @@ declare class CookieJar {
      * @param url - The domain to store the cookie with.
      * @param options - Configuration settings to use when retrieving the cookies.
      */
-    getCookiesSync(url: string, options?: GetCookiesOptions): Cookie[];
+    getCookiesSync(url: string | URL, options?: GetCookiesOptions): Cookie[];
     /**
      * Accepts the same options as `.getCookies()` but returns a string suitable for a
      * `Cookie` header rather than an Array.
@@ -1371,7 +1393,7 @@ declare class CookieJar {
      * @param options - Configuration settings to use when retrieving the cookies.
      * @param callback - A function to call after the `Cookie` header string has been created.
      */
-    getCookieString(url: string, options: GetCookiesOptions, callback: Callback<string | undefined>): void;
+    getCookieString(url: string | URL, options: GetCookiesOptions, callback: Callback<string | undefined>): void;
     /**
      * Accepts the same options as `.getCookies()` but returns a string suitable for a
      * `Cookie` header rather than an Array.
@@ -1379,7 +1401,7 @@ declare class CookieJar {
      * @param url - The domain to store the cookie with.
      * @param callback - A function to call after the `Cookie` header string has been created.
      */
-    getCookieString(url: string, callback: Callback<string | undefined>): void;
+    getCookieString(url: string | URL, callback: Callback<string | undefined>): void;
     /**
      * Accepts the same options as `.getCookies()` but returns a string suitable for a
      * `Cookie` header rather than an Array.
@@ -1387,11 +1409,11 @@ declare class CookieJar {
      * @param url - The domain to store the cookie with.
      * @param options - Configuration settings to use when retrieving the cookies.
      */
-    getCookieString(url: string, options?: GetCookiesOptions): Promise<string>;
+    getCookieString(url: string | URL, options?: GetCookiesOptions): Promise<string>;
     /**
      * @internal No doc because this is an overload that supports the implementation
      */
-    getCookieString(url: string, options: GetCookiesOptions | Callback<string | undefined>, callback?: Callback<string | undefined>): unknown;
+    getCookieString(url: string | URL, options: GetCookiesOptions | Callback<string | undefined>, callback?: Callback<string | undefined>): unknown;
     /**
      * Synchronous version of `.getCookieString()`. Accepts the same options as `.getCookies()` but returns a string suitable for a
      * `Cookie` header rather than an Array.
@@ -1401,7 +1423,7 @@ declare class CookieJar {
      * @param url - The domain to store the cookie with.
      * @param options - Configuration settings to use when retrieving the cookies.
      */
-    getCookieStringSync(url: string, options?: GetCookiesOptions): string;
+    getCookieStringSync(url: string | URL, options?: GetCookiesOptions): string;
     /**
      * Returns an array of strings suitable for `Set-Cookie` headers. Accepts the same options
      * as `.getCookies()`.
@@ -1409,7 +1431,7 @@ declare class CookieJar {
      * @param url - The domain to store the cookie with.
      * @param callback - A function to call after the `Set-Cookie` header strings have been created.
      */
-    getSetCookieStrings(url: string, callback: Callback<string[] | undefined>): void;
+    getSetCookieStrings(url: string | URL, callback: Callback<string[] | undefined>): void;
     /**
      * Returns an array of strings suitable for `Set-Cookie` headers. Accepts the same options
      * as `.getCookies()`.
@@ -1418,7 +1440,7 @@ declare class CookieJar {
      * @param options - Configuration settings to use when retrieving the cookies.
      * @param callback - A function to call after the `Set-Cookie` header strings have been created.
      */
-    getSetCookieStrings(url: string, options: GetCookiesOptions, callback: Callback<string[] | undefined>): void;
+    getSetCookieStrings(url: string | URL, options: GetCookiesOptions, callback: Callback<string[] | undefined>): void;
     /**
      * Returns an array of strings suitable for `Set-Cookie` headers. Accepts the same options
      * as `.getCookies()`.
@@ -1426,11 +1448,11 @@ declare class CookieJar {
      * @param url - The domain to store the cookie with.
      * @param options - Configuration settings to use when retrieving the cookies.
      */
-    getSetCookieStrings(url: string, options?: GetCookiesOptions): Promise<string[] | undefined>;
+    getSetCookieStrings(url: string | URL, options?: GetCookiesOptions): Promise<string[] | undefined>;
     /**
      * @internal No doc because this is an overload that supports the implementation
      */
-    getSetCookieStrings(url: string, options: GetCookiesOptions, callback?: Callback<string[] | undefined>): unknown;
+    getSetCookieStrings(url: string | URL, options: GetCookiesOptions, callback?: Callback<string[] | undefined>): unknown;
     /**
      * Synchronous version of `.getSetCookieStrings()`. Returns an array of strings suitable for `Set-Cookie` headers.
      * Accepts the same options as `.getCookies()`.
@@ -1440,7 +1462,7 @@ declare class CookieJar {
      * @param url - The domain to store the cookie with.
      * @param options - Configuration settings to use when retrieving the cookies.
      */
-    getSetCookieStringsSync(url: string, options?: GetCookiesOptions): string[];
+    getSetCookieStringsSync(url: string | URL, options?: GetCookiesOptions): string[];
     /**
      * Serialize the CookieJar if the underlying store supports `.getAllCookies`.
      * @param callback - A function to call after the CookieJar has been serialized
@@ -1803,4 +1825,5 @@ declare function parse(str: string, options?: ParseCookieOptions): Cookie | unde
  */
 declare function fromJSON(str: unknown): Cookie | undefined;
 
-export { type Callback, Cookie, CookieJar, type CreateCookieJarOptions, type CreateCookieOptions, type ErrorCallback, type GetCookiesOptions, type GetPublicSuffixOptions, MemoryCookieStore, type MemoryCookieStoreIndex, type Nullable, ParameterError, type ParseCookieOptions, PrefixSecurityEnum, type SerializedCookie, type SerializedCookieJar, type SetCookieOptions, Store, canonicalDomain, cookieCompare, defaultPath, domainMatch, formatDate, fromJSON, getPublicSuffix, parse, parseDate, pathMatch, permuteDomain, permutePath, version };
+export { Cookie, CookieJar, MemoryCookieStore, ParameterError, PrefixSecurityEnum, Store, canonicalDomain, cookieCompare, defaultPath, domainMatch, formatDate, fromJSON, getPublicSuffix, parse, parseDate, pathMatch, permuteDomain, permutePath, version };
+export type { Callback, CreateCookieJarOptions, CreateCookieOptions, ErrorCallback, GetCookiesOptions, GetPublicSuffixOptions, MemoryCookieStoreIndex, Nullable, ParseCookieOptions, PrefixSecurityMode, SerializedCookie, SerializedCookieJar, SetCookieOptions };

package/dist/index.js

@@ -384,7 +384,7 @@ var ParameterError = class extends Error {
 };
 
 // lib/version.ts
-var version = "6.0.2";
+var version = "6.1.0";
 
 // lib/cookie/constants.ts
 var PrefixSecurityEnum = {
@@ -438,6 +438,17 @@ function formatDate(date) {
   return date.toUTCString();
 }
 
+// lib/cookie/cookieName.ts
+var INVALID_TOKEN_CHARACTER = /[^\x21\x23-\x27\x2A\x2B\x2D\x2E\x30-\x39\x41-\x5A\x5E-\x7A\x7C\x7E]/;
+var CookieName = {
+  parse(input) {
+    if (input.length === 0 || INVALID_TOKEN_CHARACTER.test(input)) {
+      return void 0;
+    }
+    return input;
+  }
+};
+
 // lib/cookie/parseDate.ts
 function parseDate(cookieDate) {
   if (!cookieDate) {
@@ -612,8 +623,8 @@ function parse(str, options) {
     return c;
   }
   const cookie_avs = unparsed.split(";");
-  while (cookie_avs.length) {
-    const av = (cookie_avs.shift() ?? "").trim();
+  for (const cookie_av of cookie_avs) {
+    const av = cookie_av.trim();
     if (av.length === 0) {
       continue;
     }
@@ -896,10 +907,17 @@ var _Cookie = class _Cookie {
    *
    * @remarks
    * Works for a few things, but is by no means comprehensive.
+   * Checks that the cookie name is a non-empty token as defined in RFC 6265 Section 4.1.1.
+   * Nameless cookies (including those parsed in loose mode or created with `new Cookie({ value })`)
+   * and names containing characters outside the token grammar (such as `a b`) return `false`.
+   * Parsing and storage remain permissive; this check only applies to explicit validation.
    *
    * @beta
    */
   validate() {
+    if (CookieName.parse(this.key) === void 0) {
+      return false;
+    }
     if (!this.value || !COOKIE_OCTETS.test(this.value)) {
       return false;
     }
@@ -918,7 +936,7 @@ var _Cookie = class _Cookie {
         return false;
       }
       const suffix = getPublicSuffix(cdomain);
-      if (suffix == null) {
+      if (suffix == null && !IP_V4_REGEX_OBJECT.test(cdomain) && !IP_V6_REGEX_OBJECT.test(cdomain)) {
         return false;
       }
     }
@@ -994,11 +1012,13 @@ var _Cookie = class _Cookie {
     if (this.httpOnly) {
       str += "; HttpOnly";
     }
-    if (this.sameSite && this.sameSite !== "none") {
+    if (this.sameSite) {
       if (this.sameSite.toLowerCase() === _Cookie.sameSiteCanonical.lax.toLowerCase()) {
         str += `; SameSite=${_Cookie.sameSiteCanonical.lax}`;
       } else if (this.sameSite.toLowerCase() === _Cookie.sameSiteCanonical.strict.toLowerCase()) {
         str += `; SameSite=${_Cookie.sameSiteCanonical.strict}`;
+      } else if (this.sameSite.toLowerCase() === _Cookie.sameSiteCanonical.none.toLowerCase()) {
+        str += `; SameSite=${_Cookie.sameSiteCanonical.none}`;
       } else {
         str += `; SameSite=${this.sameSite}`;
       }
@@ -1045,6 +1065,9 @@ var _Cookie = class _Cookie {
    */
   expiryTime(now) {
     if (this.maxAge != null) {
+      if (this.maxAge === "Infinity") {
+        return Infinity;
+      }
       const relativeTo = now || this.lastAccessed || /* @__PURE__ */ new Date();
       const maxAge = typeof this.maxAge === "number" ? this.maxAge : -Infinity;
       const age = maxAge <= 0 ? -Infinity : maxAge * 1e3;
@@ -1177,7 +1200,8 @@ _Cookie.sameSiteLevel = {
  */
 _Cookie.sameSiteCanonical = {
   strict: "Strict",
-  lax: "Lax"
+  lax: "Lax",
+  none: "None"
 };
 /**
  * Cookie properties that will be serialized when using {@link Cookie.fromJSON} and {@link Cookie.toJSON}.
@@ -1336,9 +1360,14 @@ var defaultGetCookieOptions = {
 var SAME_SITE_CONTEXT_VAL_ERR = 'Invalid sameSiteContext option for getCookies(); expected one of "strict", "lax", or "none"';
 function getCookieContext(url) {
   if (url && typeof url === "object" && "hostname" in url && typeof url.hostname === "string" && "pathname" in url && typeof url.pathname === "string" && "protocol" in url && typeof url.protocol === "string") {
+    let pathname = url.pathname;
+    try {
+      pathname = decodeURI(pathname);
+    } catch {
+    }
     return {
       hostname: url.hostname,
-      pathname: url.pathname,
+      pathname,
       protocol: url.protocol
     };
   } else if (typeof url === "string") {
@@ -1372,7 +1401,7 @@ function isSecurePrefixConditionMet(cookie) {
 function isHostPrefixConditionMet(cookie) {
   const startsWithHostPrefix = typeof cookie.key === "string" && cookie.key.startsWith("__Host-");
   return !startsWithHostPrefix || Boolean(
-    cookie.secure && cookie.hostOnly && cookie.path != null && cookie.path === "/"
+    cookie.secure && cookie.hostOnly && cookie.path != null && cookie.path === "/" && !cookie.pathIsDefault
   );
 }
 function getNormalizedPrefixSecurity(prefixSecurity) {
@@ -1405,6 +1434,7 @@ var CookieJar = class _CookieJar {
     this.enableLooseMode = options?.looseMode ?? false;
     this.allowSpecialUseDomain = options?.allowSpecialUseDomain ?? true;
     this.allowSecureOnLocal = options?.allowSecureOnLocal ?? true;
+    this.enforceSecureOriginOnStorage = options?.enforceSecureOriginOnStorage ?? true;
     this.prefixSecurity = getNormalizedPrefixSecurity(
       options?.prefixSecurity ?? "silent"
     );
@@ -1492,7 +1522,7 @@ var CookieJar = class _CookieJar {
           allowSpecialUseDomain: this.allowSpecialUseDomain,
           ignoreError: options?.ignoreError
         }) : null;
-        if (suffix == null && !IP_V6_REGEX_OBJECT.test(cookie.domain)) {
+        if (suffix == null && !IP_V4_REGEX_OBJECT.test(cdomain ?? "") && !IP_V6_REGEX_OBJECT.test(cdomain ?? "")) {
           const err = new Error("Cookie has domain set to a public suffix");
           return options?.ignoreError ? promiseCallback.resolve(void 0) : promiseCallback.reject(err);
         }
@@ -1521,6 +1551,12 @@ var CookieJar = class _CookieJar {
       cookie.path = defaultPath(context.pathname);
       cookie.pathIsDefault = true;
     }
+    if (this.enforceSecureOriginOnStorage && cookie.secure && !isPotentiallyTrustworthy(url, this.allowSecureOnLocal)) {
+      const err = new Error(
+        "Cookie is Secure but this is not a secure connection"
+      );
+      return options?.ignoreError ? promiseCallback.resolve(void 0) : promiseCallback.reject(err);
+    }
     if (options?.http === false && cookie.httpOnly) {
       const err = new Error("Cookie is HttpOnly and this isn't an HTTP API");
       return options.ignoreError ? promiseCallback.resolve(void 0) : promiseCallback.reject(err);
@@ -1845,6 +1881,7 @@ var CookieJar = class _CookieJar {
       rejectPublicSuffixes: this.rejectPublicSuffixes,
       enableLooseMode: this.enableLooseMode,
       allowSpecialUseDomain: this.allowSpecialUseDomain,
+      enforceSecureOriginOnStorage: this.enforceSecureOriginOnStorage,
       prefixSecurity: getNormalizedPrefixSecurity(this.prefixSecurity),
       // this gets filled from getAllCookies:
       cookies: []
@@ -2091,6 +2128,9 @@ var CookieJar = class _CookieJar {
       rejectPublicSuffixes: readSerializedBoolean("rejectPublicSuffixes"),
       looseMode: readSerializedBoolean("enableLooseMode"),
       allowSpecialUseDomain: readSerializedBoolean("allowSpecialUseDomain"),
+      enforceSecureOriginOnStorage: readSerializedBoolean(
+        "enforceSecureOriginOnStorage"
+      ),
       prefixSecurity: getNormalizedPrefixSecurity(
         readSerializedString("prefixSecurity") ?? "silent"
       )
@@ -2136,6 +2176,9 @@ var CookieJar = class _CookieJar {
       rejectPublicSuffixes: readSerializedBoolean("rejectPublicSuffixes"),
       looseMode: readSerializedBoolean("enableLooseMode"),
       allowSpecialUseDomain: readSerializedBoolean("allowSpecialUseDomain"),
+      enforceSecureOriginOnStorage: readSerializedBoolean(
+        "enforceSecureOriginOnStorage"
+      ),
       prefixSecurity: getNormalizedPrefixSecurity(
         readSerializedString("prefixSecurity") ?? "silent"
       )