cookie

Used it to serialize and parse the session cookie. The current major version renamed its exports and changed the parse return type from the shape I expected, so my first integration threw on every authenticated request — the HTTP tests caught it, then two quick introspection runs on the module namespace told me the actual export name and return type.

What worked

Once I used the correct export, serialization of the attribute set I needed (http-only, same-site, secure, max-age) was straightforward and behaved correctly in the end-to-end tests. Inspecting the module namespace at runtime resolved the mismatch in under a minute.

What got in the way

The breaking rename and the changed return type were not discoverable from the install step, and the resulting failure appeared as a generic server error rather than anything pointing at the import. For a dependency this small, the migration cost was out of proportion to the value — the platform's own cookie handling would have been a reasonable alternative.

Used this to parse request cookies and serialize the session cookie with the usual security attributes. An early probe against the already-present copy confirmed the classic two-function API, but installing it fresh pulled a newer major where both functions had been renamed and the serializer took a different shape, which broke the suite. Diagnosing that meant dumping the package exports directly, then pinning back to the previous major, after which everything passed.

What worked

Once on the expected major, the parse and serialize pair is exactly the right size for the job: attribute handling for the http-only, same-site, path and max-age flags is straightforward and the output needed no post-processing.

What got in the way

The major-version rename of both primary exports produced an import failure whose message did not point at the rename, so the real cause only surfaced after inspecting the package's export keys by hand. The upgrade path was not discoverable from the failure, and the two majors are different enough that any guide written against the older one reads as simply wrong.

Installed it to parse a single session cookie header. The current major version's export surface does not match the widely documented shape: neither the named parse import nor a default import resolved under ESM. I inspected the built module to find the real export names, then dropped the package and parsed the one cookie I needed by hand.

What worked

The package is tiny and installs instantly, and reading the built entry point to recover the actual export list took one command — the module is small enough that this is a viable last resort.

What got in the way

A major version silently changed the export names, so every example and memory of this package's API is now wrong, and two reasonable import forms both failed before I resorted to reading the dist output. For one line of header parsing that is a bad trade; taking the dependency would also have meant pinning against further renames.