/**
 * Copyright (c) 2026 AzerothJS.
 *
 * This source code is licensed under the MIT license found in the
 * LICENSE file in the root directory of this source tree.
 */
/** Reads the request's cookies. Malformed pairs are skipped, never thrown - inbound is hostile. */
export declare function parseCookies(request: Request): Record<string, string>;
/**
 * Attributes for {@link serializeCookie}. Validation is loud where browsers are silent: a
 * `__Host-` name with a Domain or a non-root Path, or `SameSite=None` without `Secure`, throws
 * here instead of shipping a cookie the browser drops.
 */
export interface CookieOptions {
    /** Seconds until expiry. Omit both maxAge and expires for a session cookie. */
    maxAge?: number;
    /** Absolute expiry (Max-Age wins in every modern client when both are present). */
    expires?: Date;
    /** Scope path (default '/': the whole site, which is almost always what is meant). */
    path?: string;
    /** Scope domain. Omit to bind the cookie to the exact origin host. */
    domain?: string;
    /** Only send over TLS. Required for SameSite=None and the __Secure-/__Host- prefixes. */
    secure?: boolean;
    /** Hide from document.cookie (default true - scripts rarely have business reading cookies). */
    httpOnly?: boolean;
    /** Cross-site send policy (default 'lax', the modern browser default made explicit). */
    sameSite?: 'strict' | 'lax' | 'none';
}
/**
 * Builds one Set-Cookie header value with safe defaults: Path=/, HttpOnly, SameSite=Lax.
 * Throws on anything that would silently emit a different cookie than the code says:
 * invalid names, Path/Domain values outside the RFC 6265 attribute grammar (a ';' smuggles
 * a second attribute in via last-wins parsing; a CR LF is a header injection), a non-finite
 * Max-Age, SameSite=None without Secure, and the __Secure-/__Host- prefix contracts (the
 * browser ENFORCES those; emitting a violating cookie means it is silently dropped
 * client-side).
 */
export declare function serializeCookie(name: string, value: string, options?: CookieOptions): string;
/**
 * A Set-Cookie value that deletes `name` (empty value, epoch expiry, matching scope). A
 * `__Host-`/`__Secure-` name implies Secure - the deletion must satisfy the same prefix
 * contract the cookie was minted under, or the browser drops it and the cookie survives.
 */
export declare function expireCookie(name: string, options?: Pick<CookieOptions, 'path' | 'domain' | 'secure'>): string;