fix(http): getCookies returns Partial<Record<string, string>> (closes #7053)

[MukundaKatta]

Closes #7053 (and the runtime/TS gap originally tracked in #6852).

What's wrong

The previous return type Record<string, string> told TypeScript that any key access yielded a string, but the function only populates keys present in the Cookie header. Consumers without noUncheckedIndexedAccess enabled would unsafely treat missing-cookie reads as guaranteed strings:

const cookies = getCookies(new Headers([['cookie', 'key=val']]));
const baz = cookies.someOtherCookie;
//    ^ TS thinks: string. Reality: undefined.

Fix

Return type is now Partial<Record<string, string>>. Runtime behaviour is unchanged (the returned object is still null-prototyped, so missing-key access really does yield undefined rather than an inherited Object.prototype method), but TypeScript now reflects that.

What changed

• getCookies return type: Record<string, string> → Partial<Record<string, string>>
• JSDoc spells out the contract (null prototype + string | undefined access semantics)
• Regression test asserts the new exact type via IsExact<> so a future revert can't sneak past

Test plan

• deno test http/cookie_test.ts — 10/10 passing locally with full type-check
• Existing null-prototype + missing-key assertions kept; just the type contract tightened

Why now

#7053 explicitly notes the previous attempt left this "still" wrong — the type and the runtime were out of sync.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.61%. Comparing base (a496da2) to head (4632660).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #7131   +/-   ##
=======================================
  Coverage   94.61%   94.61%           
=======================================
  Files         634      634           
  Lines       51801    51802    +1     
  Branches     9329     9329           
=======================================
+ Hits        49011    49012    +1     
  Misses       2216     2216           
  Partials      574      574           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[lunadogbot]

Type matches the runtime: the object is null-prototyped, so missing-key access really is undefined. JSDoc and the IsExact<> test pin the new shape, and the unstable_signed_cookie.ts examples already guard with if (signedCookie === undefined), so they keep type-checking.

One thing for your call: @std/http is v1.1.0 and getCookies is in mod.ts. Even with runtime unchanged, const s: string = getCookies(h).foo stops compiling on this PR — that's a type-level break for callers without noUncheckedIndexedAccess. Worth deciding whether the title should be BREAKING(http): rather than fix(http):.

• nit: the new prose block in JSDoc (lines 236-241) duplicates what @return now says about null-prototype + string | undefined semantics. One could go.

[lunadogbot]

CI is green now, promoting prior review to APPROVE.

[lunadogbot]

@bartlomieju this is ready to merge