/**
 * Generate a signed CSRF token: `<random>.<hmac>`.
 * The random half is the token proper; the HMAC binds it to the server secret
 * so an attacker who plants a fake cookie can't forge the tag.
 *
 * @param {string | Buffer} secret — at least 32 bytes of entropy
 * @param {{ length?: number }} [options]
 * @returns {string}
 */
declare function generate(secret: string | Buffer, options?: {
    length?: number;
}): string;
/**
 * Verify a signed CSRF token. Returns true iff:
 *   - both values are present and structurally valid,
 *   - the two values are identical (timing-safe),
 *   - the HMAC tag matches the current secret.
 *
 * Never throws for invalid input — a malformed or missing token is just an
 * unauthenticated request. Only throws `SecurityError` on programmer error
 * (bad secret).
 *
 * @param {unknown} fromCookie
 * @param {unknown} fromHeader
 * @param {string | Buffer} secret
 * @returns {boolean}
 */
declare function verify(fromCookie: unknown, fromHeader: unknown, secret: string | Buffer): boolean;
/**
 * Generate an unsigned random token. Use only when there is no server secret
 * available — the check is a plain equality between cookie and header, so a
 * planted cookie will pass. `generate` is preferred.
 *
 * @param {{ length?: number }} [options]
 * @returns {string}
 */
declare function generateUnsigned(options?: {
    length?: number;
}): string;
/**
 * Verify an unsigned CSRF token — plain timing-safe equality of cookie and
 * form/header value.
 *
 * @param {unknown} fromCookie
 * @param {unknown} fromForm
 * @returns {boolean}
 */
declare function verifyUnsigned(fromCookie: unknown, fromForm: unknown): boolean;
/**
 * Generate a session-bound CSRF token: `hmacBase64Url(sessionId, secret)`.
 * Requires no per-request storage — the value is derived from state the
 * server already has. When the session expires, so does the token.
 *
 * @param {string} sessionId — non-empty session identifier
 * @param {string | Buffer} secret
 * @returns {string}
 */
declare function generateForSession(sessionId: string, secret: string | Buffer): string;
/**
 * Verify a session-bound CSRF token against the current session.
 *
 * @param {unknown} token
 * @param {string} sessionId
 * @param {string | Buffer} secret
 * @returns {boolean}
 */
declare function verifyForSession(token: unknown, sessionId: string, secret: string | Buffer): boolean;

export { generate, generateForSession, generateUnsigned, verify, verifyForSession, verifyUnsigned };