setcookie 0.2.0__tar.gz

setcookie-0.2.0/.gitattributes

@@ -0,0 +1 @@
+* text=auto eol=lf

setcookie-0.2.0/.gitignore

@@ -0,0 +1,16 @@
+__pycache__/
+*.py[cod]
+.venv/
+venv/
+build/
+dist/
+*.egg-info/
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.coverage
+htmlcov/
+
+# Third-party reference files, fetched locally by scripts/fetch_upstream.py; only the manifest is tracked.
+tests/upstream/*
+!tests/upstream/MANIFEST.json

setcookie-0.2.0/CHANGELOG.md

@@ -0,0 +1,49 @@
+# Changelog
+
+All notable changes to this project are documented here. The format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the project uses
+[Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.2.0]
+
+### Changed
+
+- `parse` follows the user agent algorithm of draft-ietf-httpbis-rfc6265bis-22: a pair
+  without `=` is a nameless cookie instead of an error, only spaces and tabs are trimmed,
+  a line with a control character other than tab, an empty name and value, or a name and
+  value over 4096 octets raises `CookieError`, attribute values over 1024 octets are
+  skipped, and the last valid attribute of each kind wins.
+- Expires is read with the cookie date algorithm (any token order, two digit years,
+  zones ignored, nothing before 1601). Max-Age accepts only digits with an optional
+  leading minus. Domain loses its leading dot and is lower-cased. An empty or relative
+  Path reads as `""`, meaning the default path. An unknown SameSite value resets it.
+- `build` checks every part before joining it and raises `CookieError` (still a
+  `ValueError`) for names that are not tokens, values outside cookie-octet, domains that
+  are not host names, relative paths, control characters or `;` in attribute values,
+  a `max_age` below 1, Expires before 1601, size limits, broken `__Secure-` and `__Host-`
+  prefix rules, and SameSite=None or Partitioned without Secure.
+
+### Added
+
+- `parse(line, strict=True)` checks the server grammar and names the broken rule.
+- `Cookie.partitioned`, `Cookie.extensions` for unknown attributes, and `Cookie.header()`.
+- `build(partitioned=..., extensions=...)` and `expire()` for deleting a cookie.
+- `receive()` runs the storage model for one line and returns a `StoredCookie` with the
+  resolved domain, path and expiry (Max-Age over Expires, capped at 400 days), with
+  `is_expired()` and `matches(url)`.
+- `parse_date()`, the cookie date algorithm.
+- The `setcookie` command and `python -m setcookie`: JSON output, `--strict`, `--url`.
+
+## [0.1.0]
+
+- First release.
+- `build` assembles one Set-Cookie line from a name, value and the RFC 6265 attributes
+  (Expires, Max-Age, Domain, Path, Secure, HttpOnly, SameSite), formatting Expires as a
+  locale-independent RFC 7231 GMT date.
+- `parse` decodes one Set-Cookie line into a frozen, typed `Cookie`, reading attribute
+  names case-insensitively and tolerating unknown or malformed attributes.
+- `SameSite` is modelled as a `Literal`, closing the gap left by
+  `http.cookies.SimpleCookie`, which mishandles the Expires comma and treats SameSite as
+  a free-form value.

setcookie-0.2.0/CONTRIBUTING.md

@@ -0,0 +1,19 @@
+# Contributing
+
+Thanks for taking the time. This project keeps a small, predictable shape.
+
+## Setup
+
+```
+pip install -r requirements-dev.txt
+```
+
+## Before you open a pull request
+
+- Keep public API in `src/setcookie/__init__.py`; internals live in `_`-prefixed modules.
+- Add a test for the behaviour you change. Tests inject time, disk and network; they
+  never touch the real thing.
+- Run `scripts/check.ps1` (format, lint, types, tests) and make sure it passes.
+- One logical change per commit, imperative subject line.
+
+Open an issue first if the change is large or shifts the public API.

setcookie-0.2.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Javier Lianes
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

setcookie-0.2.0/PKG-INFO

@@ -0,0 +1,215 @@
+Metadata-Version: 2.5
+Name: setcookie
+Version: 0.2.0
+Summary: Parse, validate and safely build HTTP Set-Cookie headers, typed and zero-dependency, per RFC 6265bis
+Project-URL: Homepage, https://lianes8studio.com
+Project-URL: Repository, https://github.com/JaviLianes8/setcookie
+Project-URL: Issues, https://github.com/JaviLianes8/setcookie/issues
+Project-URL: Changelog, https://github.com/JaviLianes8/setcookie/blob/main/CHANGELOG.md
+Project-URL: LinkedIn, https://www.linkedin.com/in/jlianes/
+Project-URL: Funding, https://buymeacoffee.com/jlianesglrs
+Author-email: Javier Lianes <javier@lianes8studio.com>
+License-Expression: MIT
+License-File: LICENSE
+Keywords: chips,cookie,headers,http,partitioned,rfc6265,rfc6265bis,samesite,set-cookie
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Internet :: WWW/HTTP
+Classifier: Topic :: Internet :: WWW/HTTP :: Session
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Classifier: Typing :: Typed
+Requires-Python: >=3.10
+Provides-Extra: dev
+Requires-Dist: build; extra == 'dev'
+Requires-Dist: mypy; extra == 'dev'
+Requires-Dist: pytest; extra == 'dev'
+Requires-Dist: ruff; extra == 'dev'
+Requires-Dist: twine; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# setcookie
+
+Typed Set-Cookie codec for Python: parse one Set-Cookie line the way browsers do, check
+it against the server grammar, build lines that cannot inject headers or break prefix
+rules, and see what a user agent would store. Zero dependencies.
+
+It follows the current cookie specification, draft-ietf-httpbis-rfc6265bis (revision 22,
+the successor of RFC 6265), plus the Partitioned attribute, and is checked against the
+web-platform-tests cookie parser cases.
+
+## Install
+
+```
+pip install setcookie
+```
+
+## Build a header
+
+```python
+from setcookie import build, expire
+
+print(build("sid", "a1b2c3", max_age=3600, secure=True, http_only=True, same_site="Lax"))
+# sid=a1b2c3; Max-Age=3600; Path=/; Secure; HttpOnly; SameSite=Lax
+print(build("__Host-session", "x9", secure=True, partitioned=True, same_site="None"))
+# __Host-session=x9; Path=/; Secure; SameSite=None; Partitioned
+print(expire("sid"))
+# sid=; Expires=Thu, 01 Jan 1970 00:00:00 GMT; Path=/
+```
+
+Every argument is checked on its own before it is joined, and anything a user agent
+would drop or misread raises `CookieError` (a `ValueError`):
+
+```python
+from setcookie import CookieError, build
+
+for name, value, options in [
+    ("sid", "a\r\nSet-Cookie: admin=1", {}),
+    ("sid", "abc", {"domain": "example.com; Secure"}),
+    ("__Host-sid", "abc", {"secure": True, "domain": "example.com"}),
+    ("sid", "abc", {"same_site": "None"}),
+]:
+    try:
+        build(name, value, **options)
+    except CookieError as error:
+        print(error)
+# cookie value 'a\r\nSet-Cookie: admin=1' has characters outside cookie-octet; encode it first
+# domain 'example.com; Secure' is not a host name (no leading dot, no port)
+# a __Host- cookie must not have a Domain attribute
+# SameSite=None needs the Secure attribute
+```
+
+Names must be HTTP tokens and values cookie-octets (encode arbitrary data, for example
+with Base64). `max_age` must be a positive int: the grammar has no `Max-Age=0`, so use
+`expire` to delete a cookie. `expires` is written as an IMF-fixdate in GMT whatever the
+locale or time zone of the datetime; a naive datetime is taken to be UTC, not local time.
+
+## Parse a header
+
+`parse` runs the user agent algorithm: whitespace is trimmed, the last attribute of each
+kind wins, malformed attributes are skipped, dates are read with the cookie date
+algorithm, and unknown attributes are kept.
+
+```python
+from setcookie import parse
+
+cookie = parse(
+    "sid=abc; expires=Fri Jan 01 2038 00:00:00 GMT; Domain=.Example.com; "
+    "Max-Age=+5; samesite=lax; Priority=High"
+)
+print(cookie.expires, cookie.domain, cookie.max_age, cookie.same_site)
+# 2038-01-01 00:00:00+00:00 example.com None Lax
+print(cookie.extensions)
+# (('Priority', 'High'),)
+print(parse("nameless").name == "", parse("nameless").value)
+# True nameless
+```
+
+A line a user agent ignores entirely (a control character, an empty name and value, a
+name and value over 4096 octets) raises `CookieError`. With `strict=True` the line must
+also follow the server grammar, and the error names the rule:
+
+```python
+from setcookie import CookieError, parse
+
+for line in ["sid=a b", "sid=abc; Max-Age=0", "__Secure-id=1", "sid=abc; Path=/; path=/x"]:
+    try:
+        parse(line, strict=True)
+    except CookieError as error:
+        print(error)
+# strict: the cookie-value 'a b' has characters outside cookie-octet
+# strict: Max-Age='0' is not a non-zero-digit followed by DIGITs
+# strict: a __Secure- cookie needs the Secure attribute
+# strict: the path attribute appears twice
+```
+
+## What a browser stores
+
+`receive` runs the storage model for one line received from a URL. It returns a
+`StoredCookie` with the resolved domain, path and expiry, or raises `CookieError` with
+the rule that makes a user agent ignore the line.
+
+```python
+from datetime import datetime, timezone
+
+from setcookie import CookieError, receive
+
+now = datetime(2026, 10, 13, tzinfo=timezone.utc)
+stored = receive(
+    "sid=1; Domain=example.com; Max-Age=999999999", "https://www.example.com/app/login", now=now
+)
+print(stored.domain, stored.host_only, stored.path, stored.expiry)
+# example.com False /app 2027-11-17 00:00:00+00:00
+print(
+    stored.matches("https://shop.example.com/app/cart"), stored.matches("https://example.org/app")
+)
+# True False
+try:
+    receive("sid=1; Secure", "http://www.example.com/", now=now)
+except CookieError as error:
+    print(error)
+# a Secure cookie cannot be set from an insecure URL
+```
+
+Expiry follows Max-Age over Expires and is capped at 400 days. Pass
+`is_public_suffix` to reject domains such as `co.uk`, and `cross_site=True` for a
+cross-site request that is not a top-level navigation. Rules that need the rest of the
+cookie store (overwriting, eviction, secure cookie shadowing) are left to the caller.
+Non-ASCII hosts are converted with the standard library's IDNA 2003 codec, which differs
+from IDNA 2008 for a few characters.
+
+## Command line
+
+```
+$ curl -sI https://example.com | setcookie --strict
+$ setcookie --url https://www.example.com/app "sid=1; Domain=example.com"
+```
+
+`setcookie` reads lines from its arguments or from stdin (from a header dump, which starts
+with an `HTTP/` status line, only the Set-Cookie fields are used) and prints JSON.
+`--strict` checks the server grammar, `--url` adds what a user agent would store, `--now`
+fixes the clock. The exit status is 1 when any line is refused. `python -m setcookie`
+works too.
+
+## API
+
+| Name | What it does |
+| --- | --- |
+| `build(name, value, *, expires, max_age, domain, path="/", secure, http_only, same_site, partitioned, extensions)` | One safe Set-Cookie line |
+| `expire(name, *, domain, path="/", secure, ...)` | A line that deletes the cookie |
+| `parse(line, *, strict=False)` | A frozen `Cookie`, read the way user agents read it |
+| `receive(line, url, *, now, cross_site=False, is_public_suffix=None)` | The `StoredCookie` a user agent keeps |
+| `parse_date(text)` | The cookie date algorithm, an aware UTC datetime or `None` |
+| `Cookie` | Name, value, attributes, `extensions`, and `header()` to render it again |
+| `StoredCookie` | Domain, path, flags, expiry, `is_expired(now)` and `matches(url)` |
+| `SameSite` | `Literal["Lax", "Strict", "None"]` |
+| `CookieError` | The `ValueError` raised for ignored, ungrammatical or unsafe lines |
+
+## Why
+
+`http.cookies.SimpleCookie` was written for the old Cookie header, not for one
+Set-Cookie line: it keeps `Expires` as a string, accepts any `SameSite` value, reads an
+unknown attribute such as `Priority=High` as a second cookie, silently drops the whole
+line when it meets a flag it does not know (`Foo`, and `Partitioned` before Python 3.14),
+drops nameless cookies, and
+writes a control character in a value as an octal escape that browsers do not decode.
+`setcookie` follows the current draft step by step, refuses to build what browsers would
+drop, and gives typed results.
+
+## License
+
+MIT. See [LICENSE](LICENSE).
+
+## Links
+
+- Website: https://lianes8studio.com
+- GitHub: https://github.com/JaviLianes8
+- LinkedIn: https://www.linkedin.com/in/jlianes/

setcookie-0.2.0/README.md

@@ -0,0 +1,177 @@
+# setcookie
+
+Typed Set-Cookie codec for Python: parse one Set-Cookie line the way browsers do, check
+it against the server grammar, build lines that cannot inject headers or break prefix
+rules, and see what a user agent would store. Zero dependencies.
+
+It follows the current cookie specification, draft-ietf-httpbis-rfc6265bis (revision 22,
+the successor of RFC 6265), plus the Partitioned attribute, and is checked against the
+web-platform-tests cookie parser cases.
+
+## Install
+
+```
+pip install setcookie
+```
+
+## Build a header
+
+```python
+from setcookie import build, expire
+
+print(build("sid", "a1b2c3", max_age=3600, secure=True, http_only=True, same_site="Lax"))
+# sid=a1b2c3; Max-Age=3600; Path=/; Secure; HttpOnly; SameSite=Lax
+print(build("__Host-session", "x9", secure=True, partitioned=True, same_site="None"))
+# __Host-session=x9; Path=/; Secure; SameSite=None; Partitioned
+print(expire("sid"))
+# sid=; Expires=Thu, 01 Jan 1970 00:00:00 GMT; Path=/
+```
+
+Every argument is checked on its own before it is joined, and anything a user agent
+would drop or misread raises `CookieError` (a `ValueError`):
+
+```python
+from setcookie import CookieError, build
+
+for name, value, options in [
+    ("sid", "a\r\nSet-Cookie: admin=1", {}),
+    ("sid", "abc", {"domain": "example.com; Secure"}),
+    ("__Host-sid", "abc", {"secure": True, "domain": "example.com"}),
+    ("sid", "abc", {"same_site": "None"}),
+]:
+    try:
+        build(name, value, **options)
+    except CookieError as error:
+        print(error)
+# cookie value 'a\r\nSet-Cookie: admin=1' has characters outside cookie-octet; encode it first
+# domain 'example.com; Secure' is not a host name (no leading dot, no port)
+# a __Host- cookie must not have a Domain attribute
+# SameSite=None needs the Secure attribute
+```
+
+Names must be HTTP tokens and values cookie-octets (encode arbitrary data, for example
+with Base64). `max_age` must be a positive int: the grammar has no `Max-Age=0`, so use
+`expire` to delete a cookie. `expires` is written as an IMF-fixdate in GMT whatever the
+locale or time zone of the datetime; a naive datetime is taken to be UTC, not local time.
+
+## Parse a header
+
+`parse` runs the user agent algorithm: whitespace is trimmed, the last attribute of each
+kind wins, malformed attributes are skipped, dates are read with the cookie date
+algorithm, and unknown attributes are kept.
+
+```python
+from setcookie import parse
+
+cookie = parse(
+    "sid=abc; expires=Fri Jan 01 2038 00:00:00 GMT; Domain=.Example.com; "
+    "Max-Age=+5; samesite=lax; Priority=High"
+)
+print(cookie.expires, cookie.domain, cookie.max_age, cookie.same_site)
+# 2038-01-01 00:00:00+00:00 example.com None Lax
+print(cookie.extensions)
+# (('Priority', 'High'),)
+print(parse("nameless").name == "", parse("nameless").value)
+# True nameless
+```
+
+A line a user agent ignores entirely (a control character, an empty name and value, a
+name and value over 4096 octets) raises `CookieError`. With `strict=True` the line must
+also follow the server grammar, and the error names the rule:
+
+```python
+from setcookie import CookieError, parse
+
+for line in ["sid=a b", "sid=abc; Max-Age=0", "__Secure-id=1", "sid=abc; Path=/; path=/x"]:
+    try:
+        parse(line, strict=True)
+    except CookieError as error:
+        print(error)
+# strict: the cookie-value 'a b' has characters outside cookie-octet
+# strict: Max-Age='0' is not a non-zero-digit followed by DIGITs
+# strict: a __Secure- cookie needs the Secure attribute
+# strict: the path attribute appears twice
+```
+
+## What a browser stores
+
+`receive` runs the storage model for one line received from a URL. It returns a
+`StoredCookie` with the resolved domain, path and expiry, or raises `CookieError` with
+the rule that makes a user agent ignore the line.
+
+```python
+from datetime import datetime, timezone
+
+from setcookie import CookieError, receive
+
+now = datetime(2026, 10, 13, tzinfo=timezone.utc)
+stored = receive(
+    "sid=1; Domain=example.com; Max-Age=999999999", "https://www.example.com/app/login", now=now
+)
+print(stored.domain, stored.host_only, stored.path, stored.expiry)
+# example.com False /app 2027-11-17 00:00:00+00:00
+print(
+    stored.matches("https://shop.example.com/app/cart"), stored.matches("https://example.org/app")
+)
+# True False
+try:
+    receive("sid=1; Secure", "http://www.example.com/", now=now)
+except CookieError as error:
+    print(error)
+# a Secure cookie cannot be set from an insecure URL
+```
+
+Expiry follows Max-Age over Expires and is capped at 400 days. Pass
+`is_public_suffix` to reject domains such as `co.uk`, and `cross_site=True` for a
+cross-site request that is not a top-level navigation. Rules that need the rest of the
+cookie store (overwriting, eviction, secure cookie shadowing) are left to the caller.
+Non-ASCII hosts are converted with the standard library's IDNA 2003 codec, which differs
+from IDNA 2008 for a few characters.
+
+## Command line
+
+```
+$ curl -sI https://example.com | setcookie --strict
+$ setcookie --url https://www.example.com/app "sid=1; Domain=example.com"
+```
+
+`setcookie` reads lines from its arguments or from stdin (from a header dump, which starts
+with an `HTTP/` status line, only the Set-Cookie fields are used) and prints JSON.
+`--strict` checks the server grammar, `--url` adds what a user agent would store, `--now`
+fixes the clock. The exit status is 1 when any line is refused. `python -m setcookie`
+works too.
+
+## API
+
+| Name | What it does |
+| --- | --- |
+| `build(name, value, *, expires, max_age, domain, path="/", secure, http_only, same_site, partitioned, extensions)` | One safe Set-Cookie line |
+| `expire(name, *, domain, path="/", secure, ...)` | A line that deletes the cookie |
+| `parse(line, *, strict=False)` | A frozen `Cookie`, read the way user agents read it |
+| `receive(line, url, *, now, cross_site=False, is_public_suffix=None)` | The `StoredCookie` a user agent keeps |
+| `parse_date(text)` | The cookie date algorithm, an aware UTC datetime or `None` |
+| `Cookie` | Name, value, attributes, `extensions`, and `header()` to render it again |
+| `StoredCookie` | Domain, path, flags, expiry, `is_expired(now)` and `matches(url)` |
+| `SameSite` | `Literal["Lax", "Strict", "None"]` |
+| `CookieError` | The `ValueError` raised for ignored, ungrammatical or unsafe lines |
+
+## Why
+
+`http.cookies.SimpleCookie` was written for the old Cookie header, not for one
+Set-Cookie line: it keeps `Expires` as a string, accepts any `SameSite` value, reads an
+unknown attribute such as `Priority=High` as a second cookie, silently drops the whole
+line when it meets a flag it does not know (`Foo`, and `Partitioned` before Python 3.14),
+drops nameless cookies, and
+writes a control character in a value as an octal escape that browsers do not decode.
+`setcookie` follows the current draft step by step, refuses to build what browsers would
+drop, and gives typed results.
+
+## License
+
+MIT. See [LICENSE](LICENSE).
+
+## Links
+
+- Website: https://lianes8studio.com
+- GitHub: https://github.com/JaviLianes8
+- LinkedIn: https://www.linkedin.com/in/jlianes/

setcookie-0.2.0/pyproject.toml

@@ -0,0 +1,74 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "setcookie"
+version = "0.2.0"
+description = "Parse, validate and safely build HTTP Set-Cookie headers, typed and zero-dependency, per RFC 6265bis"
+readme = "README.md"
+requires-python = ">=3.10"
+license = "MIT"
+license-files = ["LICENSE"]
+authors = [{ name = "Javier Lianes", email = "javier@lianes8studio.com" }]
+keywords = ["cookie", "set-cookie", "http", "headers", "rfc6265", "rfc6265bis", "samesite", "partitioned", "chips"]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Intended Audience :: Developers",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3 :: Only",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
+    "Operating System :: OS Independent",
+    "Environment :: Console",
+    "Topic :: Internet :: WWW/HTTP",
+    "Topic :: Internet :: WWW/HTTP :: Session",
+    "Topic :: Software Development :: Libraries :: Python Modules",
+    "Typing :: Typed",
+]
+dependencies = []
+
+[project.optional-dependencies]
+dev = ["ruff", "mypy", "pytest", "build", "twine"]
+
+[project.scripts]
+setcookie = "setcookie._cli:main"
+
+[project.urls]
+Homepage = "https://lianes8studio.com"
+Repository = "https://github.com/JaviLianes8/setcookie"
+Issues = "https://github.com/JaviLianes8/setcookie/issues"
+Changelog = "https://github.com/JaviLianes8/setcookie/blob/main/CHANGELOG.md"
+LinkedIn = "https://www.linkedin.com/in/jlianes/"
+Funding = "https://buymeacoffee.com/jlianesglrs"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/setcookie"]
+
+[tool.hatch.build.targets.sdist]
+# Third-party reference files are fetched locally and never shipped; only their manifest is.
+exclude = [
+    ".github",
+    "IMPROVEMENTS-round*.md",
+    "tests/upstream/*.txt",
+    "tests/upstream/wpt",
+]
+
+[tool.ruff]
+line-length = 100
+target-version = "py310"
+
+[tool.ruff.lint]
+select = ["E", "F", "I", "UP", "B", "SIM", "RUF"]
+
+[tool.mypy]
+python_version = "3.10"
+strict = true
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+pythonpath = ["src"]
+addopts = "-q"

setcookie-0.2.0/requirements-dev.txt

@@ -0,0 +1,3 @@
+# Development dependencies: the package in editable mode plus its dev extras
+# (ruff, mypy, pytest, build, twine). Install with:  pip install -r requirements-dev.txt
+-e .[dev]

setcookie-0.2.0/scripts/check.ps1

@@ -0,0 +1,17 @@
+# Local quality gate. Run before every commit. No CI runs in the cloud.
+# $ErrorActionPreference does NOT stop on a native command's non-zero exit, so each tool's
+# exit code is checked explicitly: a red gate must fail, never pass silently.
+$ErrorActionPreference = "Stop"
+
+function Invoke-Step($label, [scriptblock]$cmd) {
+    Write-Host "== $label =="
+    & $cmd
+    if ($LASTEXITCODE -ne 0) { Write-Host "FAILED: $label (exit $LASTEXITCODE)"; exit $LASTEXITCODE }
+}
+
+Invoke-Step "ruff format" { ruff format --check . }
+Invoke-Step "ruff lint"   { ruff check . }
+Invoke-Step "mypy"        { mypy --strict src tests }
+Invoke-Step "pytest"      { pytest }
+Write-Host "gate green"
+Write-Host "Reference files: python scripts/fetch_upstream.py; wheel test: SETCOOKIE_E2E=1 pytest tests/test_e2e_wheel.py"

setcookie-0.2.0/scripts/fetch_upstream.py

@@ -0,0 +1,39 @@
+"""Fetch the third-party test files listed in tests/upstream/MANIFEST.json.
+
+The files are not part of the repository. Their tests skip until this script has fetched
+them; each download is checked against the size and sha256 in the manifest.
+
+    python scripts/fetch_upstream.py
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import sys
+import urllib.request
+from pathlib import Path
+
+FOLDER = Path(__file__).resolve().parents[1] / "tests" / "upstream"
+
+
+def main() -> int:
+    manifest = json.loads((FOLDER / "MANIFEST.json").read_text(encoding="utf-8"))
+    failed = 0
+    for name, entry in manifest.items():
+        with urllib.request.urlopen(entry["url"], timeout=60) as response:
+            body = response.read()
+        digest = hashlib.sha256(body).hexdigest()
+        if len(body) != entry["size"] or digest != entry["sha256"]:
+            print(f"{name}: got {len(body)} bytes, sha256 {digest}; manifest differs")
+            failed += 1
+            continue
+        target = FOLDER / name
+        target.parent.mkdir(parents=True, exist_ok=True)
+        target.write_bytes(body)
+        print(f"{name}: ok")
+    return 1 if failed else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

setcookie-0.2.0/scripts/release.ps1

@@ -0,0 +1,28 @@
+# Build and upload to PyPI. Run scripts/check.ps1 first.
+# The name must not already exist on PyPI; the token is read from a secret store, never git.
+$ErrorActionPreference = "Stop"
+
+# Works on both Windows PowerShell 5.1 and pwsh 7 (generic catch, no PS7-only types).
+$taken = $true
+try {
+    Invoke-WebRequest -UseBasicParsing "https://pypi.org/pypi/setcookie/json" | Out-Null
+} catch {
+    if ($_.Exception.Response.StatusCode.value__ -eq 404) { $taken = $false } else { throw }
+}
+if ($taken) { throw "The name 'setcookie' already exists on PyPI. Choose another before publishing." }
+
+$token = $env:PYPI_TOKEN
+if (-not $token -and (Test-Path "C:\secrets\pypi-token.txt")) {
+    $token = (Get-Content "C:\secrets\pypi-token.txt" -Raw).Trim()
+}
+if (-not $token) {
+    throw "No PyPI token. Set `$env:PYPI_TOKEN or save it to C:\secrets\pypi-token.txt (never commit it)."
+}
+
+Remove-Item -Recurse -Force dist -ErrorAction SilentlyContinue
+python -m build
+python -m twine check dist/*
+
+$env:TWINE_USERNAME = "__token__"
+$env:TWINE_PASSWORD = $token
+try { python -m twine upload dist/* } finally { Remove-Item Env:\TWINE_PASSWORD -ErrorAction SilentlyContinue }