import { type OriginCheckOptions } from "./origin.js";
/**
 * Resolves a server action by name and optional page scope.
 */
export type ActionResolver = (name: string, page?: string) => Promise<((...args: unknown[]) => unknown) | undefined>;
/** Options shared by `handleActionRequest` callers for CSRF protection. */
export interface ActionSecurityOptions extends OriginCheckOptions {
    /** Maximum body size in bytes. Defaults to 1MB (1_048_576). */
    bodyLimit?: number;
}
/**
 * Handles a POST request to the server action endpoint.
 *
 * Accepts both JSON requests (`{ name, page?, args }`) and HTML form submissions
 * for progressive enhancement. The provided resolver looks up the action
 * implementation, invokes it with the supplied arguments and returns the result
 * as JSON or redirects back to the request origin for form submissions.
 *
 * Origin verification (CSRF protection) runs before parsing the body: any
 * cross-origin POST is rejected with 403 unless its origin is allow-listed via
 * `security.allowedOrigins`.
 *
 * For progressive-enhancement form submissions that fail, the failure payload
 * is relayed back via a short-lived `__nix_js_action_error` cookie (SameSite=Lax,
 * Max-Age=15s) instead of a query param, so errors do not leak into browser
 * history, server logs or third-party Referer headers.
 */
export declare function handleActionRequest(request: Request, resolveAction: ActionResolver, security?: ActionSecurityOptions): Promise<Response>;
export { verifyOrigin, originForbidden, type OriginCheckOptions } from "./origin.js";
export { decodeActionErrorCookie, clearActionErrorCookieHeader, setActionErrorCookieHeader, ACTION_ERROR_COOKIE, } from "./error-store.js";