/**
 * The CSRF header an AdonisJS app expects on a mutating request, read from the page at call time.
 *
 * `@adonisjs/shield` accepts the token two ways, and this reads whichever the app serves:
 *  - `enableXsrfCookie: true` (the Inertia/SPA setup) → the `XSRF-TOKEN` cookie, sent back as
 *    `X-XSRF-TOKEN`;
 *  - otherwise a `<meta name="csrf-token" content="{{ csrfToken }}">` tag, sent as `X-CSRF-TOKEN`.
 *
 * Read per request rather than once: shield rotates the cookie, and a token captured at mount goes
 * stale. Outside a browser (SSR, tests) there is nothing to read and no header is sent.
 */
/** The decoded value of cookie `name`, or `undefined` when the page has no such cookie. */
export declare function readCookie(name: string): string | undefined;
/** `{ 'X-XSRF-TOKEN': … }` / `{ 'X-CSRF-TOKEN': … }` for this page, or `{}` when it carries no token. */
export declare function csrfHeaders(): Record<string, string>;
//# sourceMappingURL=csrf.d.ts.map