perf: cache the default cookie header parse and avoid allocations in cookies.get

[Nic-Polumeyv]

closes #16340

get_cookies parsed the header once but with an identity decode, so every cookies.get() re-parsed the whole header, and also allocated, filtered and sorted an array of locally set cookies even when there were none. No behavior change, three things:

• the default-decode parse is now cached for the lifetime of the request, since the header never changes. A custom opts.decode bypasses the cache, and there is a test pinning that.
• the best-match scan in get is a single pass instead of Array.from().filter().sort()[0], no allocations, same tie-breaking (first inserted wins, as with the stable sort).
• getAll copies the parsed object before merging locally set cookies into it, so the cache is never mutated.

Measured on the real get_cookies with a realistic ~800B header and five get calls per request: 6.00µs before, 2.98µs after. Parse cost scales linearly with header size, about 1µs per KB.

---

Please don't delete this checklist! Before submitting the PR, please make sure you do the following:

• It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs
• This message body should clearly illustrate what problems it solves.
• Ideally, include a test that fails without this PR but passes with it.

Tests

• Run the tests with pnpm test and lint the project with pnpm lint and pnpm check

Changesets

• If your PR makes a change that should be noted in one or more packages' changelogs, generate a changeset by running pnpm changeset and following the prompts. Changesets that add features should be minor and those that fix bugs should be patch. Please prefix changeset messages with feat:, fix:, or chore:.

Edits

• Please ensure that 'Allow edits from maintainers' is checked. PRs without this option may be closed.

[pkg-svelte-dev]

Install the latest version of @sveltejs/kit from 10a86d2:

pnpm add https://pkg.svelte.dev/@sveltejs/kit/c/10a86d2608e7c0094ff8a1e5c2948f1d044c4803

Open in pkg.svelte.dev: https://pkg.svelte.dev/repos/kit/pr/16341

Note

This PR is from a fork. A maintainer must approve approve each commit before it can be built and installed.

[changeset-bot]

🦋 Changeset detected

Latest commit: 10a86d2

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@sveltejs/kit	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[Rich-Harris]

Hey — we really appreciate all the recent contributions, but we're mostly working on the version-3 branch, and PRs against main are liable to cause merge conflicts. Can I ask you to submit future PRs against version-3 instead? (I've just updated the default branch to point there — should probably have done that sooner.) Updating the existing PRs to point to version-3 would be even better but no worries if that proves troublesome

[Nic-Polumeyv]

Not a problem at all with some AI help, sorry for this! Thanks for the heads up. Working on it now

[Rich-Harris]

thank you!