I URL-Encode it:

    var res = opt.encode(key) + '=' + encoded + ...

Where `opt.encode()` is defined as:

    function (val) {
      return encodeURIComponent(val);
    }

But from your comment I understand that this is not enough and I should dig deeper into this (though I find the RFC really dense/difficult to read).

I did more research and have a further follow-up. According to MDN [1], encodeURIComponent escapes all characters except the following:

  alphabetic, decimal digits, - _ . ! ~ * ' ( )

which means that out of the allowed ASCII characters in a cookie name:

   "!" / "#" / "$" / "%" / "&" / "'" / "*"
  / "+" / "-" / "." / "^" / "_" / "`" / "|" / "~"
  / DIGIT (0-9) / ALPHA (A-Z, a-z)

the following matrix of behaviors results:

      Gets-Encoded? Is-Allowed?   Current-Behavior
  -----------------------------------------------------
  !   not-encoded   allowed       behavior-OK
  #   encoded       allowed       unnecessarily-encoded
  $   encoded       allowed       unnecessarily-encoded
  %   encoded       allowed       unnecessarily-encoded
  &   encoded       allowed       unnecessarily-encoded
  '   not-encoded   allowed       behavior-OK
  *   not-encoded   allowed       behavior-OK
  +   encoded       allowed       unnecessarily-encoded
  -   not-encoded   allowed       behavior-OK
  .   not-encoded   allowed       behavior-OK
  ^   encoded       allowed       unnecessarily-encoded
  _   not-encoded   allowed       behavior-OK
  `   encoded       allowed       unnecessarily-encoded
  |   encoded       allowed       unnecessarily-encoded
  ~   not-encoded   allowed       unnecessarily-encoded
  (   not-encoded   not-allowed   invalid-must-encode
  )   not-encoded   not-allowed   invalid-must-encode

[1] https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...

For the edit:

I see, so I could add a `cookies.encodevalue()` and default it to `cookies.encode`. However, I think that'd just add too much noise to it so I will just add a warning. Thank you.