Drop tough-cookie and har-validator dependencies

lib/cookies.js

@@ -1,5 +1,3 @@
-import { Cookie } from 'tough-cookie';
-
 export function formatCookie(cookie) {
   let expiresISO;
 
@@ -23,12 +21,66 @@ export function formatCookie(cookie) {
 }
 
 function parseCookie(cookieString) {
-  let cookie = Cookie.parse(cookieString);
-  if (!cookie) {
-    return;
+  const parts = cookieString.split(';');
+  const firstPart = parts.shift();
+  if (firstPart === undefined) return;
+
+  const eqIndex = firstPart.indexOf('=');
+  if (eqIndex === -1) return;
+
+  const name = firstPart.slice(0, eqIndex).trim();
+  if (!name) return;
+
+  const cookie = {
+    name,
+    value: firstPart.slice(eqIndex + 1).trim(),
+    path: undefined,
+    domain: undefined,
+    expires: undefined,
+    httpOnly: false,
+    secure: false
+  };
+
+  for (const part of parts) {
+    const trimmed = part.trim();
+    if (!trimmed) continue;
+    const idx = trimmed.indexOf('=');
+    const attrName = (
+      idx === -1 ? trimmed : trimmed.slice(0, idx)
+    ).toLowerCase();
+    const attrValue = idx === -1 ? '' : trimmed.slice(idx + 1).trim();
+
+    switch (attrName) {
+      case 'path': {
+        cookie.path = attrValue || undefined;
+        break;
+      }
+      case 'domain': {
+        // tough-cookie strips a leading '.'; preserve that behavior
+        cookie.domain = attrValue.startsWith('.')
+          ? attrValue.slice(1) || undefined
+          : attrValue || undefined;
+        break;
+      }
+      case 'expires': {
+        const date = new Date(attrValue);
+        if (!Number.isNaN(date.getTime())) {
+          cookie.expires = date.toISOString();
+        }
+        break;
+      }
+      case 'httponly': {
+        cookie.httpOnly = true;
+        break;
+      }
+      case 'secure': {
+        cookie.secure = true;
+        break;
+      }
+    }
   }
 
-  return formatCookie(cookie);
+  return cookie;
 }
 
 function splitAndParse(header, divider) {