/**
 * Cookie primitives - parse a request `Cookie` header, serialize a `Set-Cookie`, and sign/verify a
 * value with HMAC-SHA256 via **WebCrypto** (`crypto.subtle`), so they're portable across Bun, Node,
 * Deno, and workerd with no `node:crypto` dependency. Pure + runtime-agnostic: `c.cookies` (read) and
 * `c.set.cookie` (write) build on these, and `@nifrajs/auth` builds sessions on top.
 */
/** Attributes for a `Set-Cookie`. `expires` is a `Date`; `maxAge` is in **seconds**. */
export interface CookieOptions {
    /** Lifetime in seconds. `0` (with a past `expires`) deletes the cookie. */
    readonly maxAge?: number;
    readonly expires?: Date;
    readonly path?: string;
    readonly domain?: string;
    readonly secure?: boolean;
    readonly httpOnly?: boolean;
    readonly sameSite?: "strict" | "lax" | "none";
    readonly partitioned?: boolean;
}
/**
 * RFC 6265bis cookie-name prefix, matched **case-insensitively** the way browsers match it -
 * `__secure-x` triggers the same enforcement as `__Secure-x`. `undefined` for unprefixed names.
 * Writers (set AND delete) must satisfy the prefix contract or the user agent silently discards
 * the whole `Set-Cookie`.
 */
export declare function cookieNamePrefix(name: string): "secure" | "host" | undefined;
/** Parse a request `Cookie` header into a name→value map (values URL-decoded). Unparseable pairs are
 * skipped rather than throwing - a junk `Cookie` header shouldn't fail the request.
 *
 * Hand-rolled index walk instead of `split(";")` + `trim()` chains: those allocated an array + up
 * to three substrings per pair and showed up at ~6% of a realistic (auth + cookie) request. Same
 * semantics, two slices per pair, no intermediate array. */
export declare function parseCookies(header: string | null | undefined): Record<string, string>;
/**
 * Serialize a `Set-Cookie` header value. Pure - applies **no** security defaults (the caller, e.g.
 * `c.set.cookie`, layers `HttpOnly`/`Secure`/`SameSite` on). Throws on an invalid cookie name, a
 * header-injecting `Path`/`Domain`, a non-integer `maxAge`, a `__Secure-`/`__Host-` name whose
 * attributes violate its prefix contract, or an oversized result - a serialization bug should fail
 * loudly, not silently emit a cookie the browser drops.
 */
export declare function serializeCookie(name: string, value: string, options?: CookieOptions): string;
/**
 * A signing secret, or a rotation list of them. With a list, **the first secret signs** and
 * verification accepts **any** entry - so rotation is: prepend the new secret, keep the old one
 * until every cookie signed by it has expired, then drop it. An empty list throws.
 */
export type CookieSecret = string | readonly string[];
/** Append an HMAC-SHA256 signature to a value → `value.signature` (base64url). For signed cookies.
 * With a {@link CookieSecret} rotation list, signs with the first secret. */
export declare function signValue(value: string, secret: CookieSecret): Promise<string>;
/**
 * Verify a `value.signature` produced by {@link signValue} and return the value, or `null` if the
 * signature is missing, malformed, or doesn't match. Verification is **constant-time**
 * (`crypto.subtle.verify`), so a wrong signature can't be discovered byte-by-byte via timing.
 *
 * With a {@link CookieSecret} rotation list, tries each secret in order and accepts the first
 * match. Every listed secret must meet the 32-byte floor - a weak entry throws even when an
 * earlier secret would have matched, so a rotation list can't quietly carry a weak key. (Which
 * rotation generation matched is not attacker-meaningful, so the early exit between secrets leaks
 * nothing useful; each individual comparison stays constant-time.)
 */
export declare function unsignValue(signed: string, secret: CookieSecret): Promise<string | null>;
//# sourceMappingURL=cookies.d.ts.map