/**
 * Request/response cookie access. `ctx.cookies` reads the incoming `Cookie`
 * header and collects outgoing `Set-Cookie`s, which the framework writes onto
 * the response.
 */
/**
 * `Set-Cookie` attributes passed to {@link Cookies.set}. Every field is
 * optional; unset flags are simply omitted from the emitted header (only `Path`
 * is always written, defaulting to `/`).
 */
export interface CookieOptions {
    /** Send the cookie to this domain and its subdomains; omit to scope it to the exact response host. */
    domain?: string;
    /** URL-path prefix the cookie is scoped to; always emitted, defaulting to `/` (whole site). */
    path?: string;
    /** Absolute expiry, serialized as an HTTP date; a past date deletes the cookie. Browsers prefer `maxAge` when both are set. */
    expires?: Date;
    /** Lifetime in seconds, floored to an integer; `0` or a negative value expires the cookie immediately. */
    maxAge?: number;
    /** Emit `HttpOnly` so client-side JS (`document.cookie`) can't read the cookie — mitigates token theft via XSS. */
    httpOnly?: boolean;
    /** Emit `Secure` so the cookie is sent only over HTTPS; required by browsers when `sameSite` is `'none'`. */
    secure?: boolean;
    /** Cross-site send policy (`SameSite`): `'lax'` sends on top-level navigations, `'strict'` never cross-site, `'none'` always (needs `secure`). Serialized capitalized. */
    sameSite?: 'strict' | 'lax' | 'none';
    /** Emit `Partitioned` (CHIPS): key the cookie to the current top-level site rather than sharing it cross-site; requires `secure`. */
    partitioned?: boolean;
}
/**
 * The cookie jar for one request. Reads are backed by the incoming `Cookie`
 * header; writes queue `Set-Cookie` headers applied to the response.
 */
export declare class Cookies {
    private readonly incoming;
    private readonly outgoing;
    /** Build a jar from the incoming request's `Cookie` header (may be `null`). */
    constructor(cookieHeader: string | null);
    /**
     * The value of an incoming cookie, or `undefined`.
     *
     * @param name - matched case-sensitively against the request's `Cookie` header only; cookies queued via {@link Cookies.set} are not visible here.
     * @returns The decoded cookie value, or `undefined` if not present.
     */
    get(name: string): string | undefined;
    /**
     * Whether an incoming cookie is present.
     *
     * @param name - checked against incoming (request) cookies only, not pending writes.
     * @returns `true` if the request sent a cookie with that name.
     */
    has(name: string): boolean;
    /**
     * All incoming cookies as a plain object.
     *
     * @returns A fresh name→value object of every incoming cookie, values already URL-decoded.
     */
    all(): Record<string, string>;
    /**
     * Queue a cookie to be set on the response. Each call appends a distinct
     * `Set-Cookie`; queuing the same name twice emits two headers (no dedupe).
     *
     * @param name - the cookie name (written verbatim, not encoded).
     * @param value - the cookie value; URL-encoded when serialized.
     * @param options - `Set-Cookie` attributes and flags; see {@link CookieOptions} (`path` defaults to `/`).
     */
    set(name: string, value: string, options?: CookieOptions): void;
    /**
     * Queue a cookie to be cleared on the response — emits it with an empty
     * value, `Max-Age=0`, and a 1970 `Expires` so the browser drops it.
     *
     * @param name - the cookie name to clear.
     * @param options - `path`/`domain` etc. must match how the cookie was set, or the browser keeps it; `expires`/`maxAge` are excluded since they're set here.
     */
    delete(name: string, options?: Omit<CookieOptions, 'expires' | 'maxAge'>): void;
    /**
     * The queued `Set-Cookie` header values.
     *
     * @returns the queued `Set-Cookie` values in insertion order (one per `set`/`delete` call); the framework writes each as its own response header.
     */
    serialize(): readonly string[];
}
//# sourceMappingURL=cookies.d.ts.map