[TalhaHunter101]

Description

When un-signing a cookie via signer.unsign(signedValue), signed cookies are expected in the format <value>.<signature>.

If an incoming cookie is unsigned or malformed (i.e. contains no dot delimiter or ends with a trailing dot):

1. signedValue.lastIndexOf('.') returns -1.
2. signedValue.slice(0, -1) slices off the last character instead of failing.
3. signedValue.slice(0) treats the entire string as the signature buffer.
4. It iterates through the secrets array and computes an expensive crypto.createHmac(...) digest for every key before finally failing on signature length comparison.

Changes

• Checks dotIndex before allocating buffers or executing crypto operations. If dotIndex === -1 || dotIndex === signedValue.length - 1, early-exits with { valid: false, renew: false, value: null }.
• Adds unit tests in test/signer.test.js covering unsigned strings and strings ending with a dot.

Benchmark

Benchmark on unsigned cookie inputs (50,000 iterations with 3 rotating secrets):

• Before: ~280,000 ops/sec
• After: ~44,000,000 ops/sec (~157x speedup by eliminating redundant HMAC hashing and buffer allocations)

Checklist

• All unit tests pass (npm test)
• 100% test coverage maintained (c8 --100)
• TypeScript types verify cleanly (tstyche)
• Linting passes (npm run lint)

[gurgunday]

lgtm

[mcollina]

lgtm