src/utils/cookie.ts (1)

313-321: Malformed cookie handling is reasonable but worth documenting.

When parseSetCookie returns undefined for a malformed cookie (Line 316), the cookie is preserved in state.cookies but its key is undefined, meaning it won't match for deduplication. This is a reasonable fallback—malformed cookies won't be lost, but repeated writes of the same malformed cookie would accumulate. Consider adding a brief comment explaining this behavior.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/utils/cookie.ts` around lines 313 - 321, The code intentionally preserves
malformed Set-Cookie strings in state.cookies while pushing undefined into
state.keys when parseSetCookie returns undefined, which prevents them from being
deduplicated via state.distinctKeys; add a concise inline comment next to the
loop (or above the parseSetCookie usage) explaining that malformed cookies are
retained unchanged, that _getDistinctCookieKey is only called for parsed
cookies, and that resulting undefined keys mean malformed cookies will not be
deduplicated (so repeated malformed cookies may accumulate), to make this
fallback behavior explicit for future readers.

src/utils/cookie.ts (1)

297-345: Consider extracting _getSetCookieState / _writeSetCookieState to an internal module.

This file is now well beyond the short-file target; moving this helper block to src/utils/internal/ would keep cookie.ts easier to maintain.

As per coding guidelines, "Keep files short — aim for less than 200 lines of code per file, split when larger."

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/utils/cookie.ts` around lines 297 - 345, Extract the helper functions
_getSetCookieState and _writeSetCookieState into a new internal module under
src/utils/internal (e.g., src/utils/internal/setCookieState.ts), move any
related types/consts they need (SetCookieState, responseCookiesCache) or
re-export them as needed, and update all callers in cookie.ts to import these
functions from the new module; ensure references to parseSetCookie,
_getDistinctCookieKey, and Headers remain accessible (either by importing them
into the new module or keeping them in cookie.ts and passing them in), run/fix
tests and exports so behavior is identical after the move.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

test/cookies.test.ts (1)

149-162: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Consider adding coverage for the unparseable-cookie preservation change.

PR notes call out that unparseable set-cookie entries are now preserved during dedup instead of dropped — a deliberate behavior change from main. No test here exercises that path (e.g., appending a malformed set-cookie string externally, then overwriting an h3-managed cookie with the same key, and asserting the malformed entry survives).

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/cookies.test.ts` around lines 149 - 162, Add coverage for the new
unparseable set-cookie preservation behavior in cookies.test.ts. Extend the
existing set-cookie dedup test around setCookie and res.headers.append so it
includes a malformed external set-cookie entry, then overwrite the h3-managed
cookie with the same key and assert the malformed entry is still preserved in
getSetCookie(). Use the existing setCookie helper and the same app route
structure so the test targets the dedup logic change directly.