import { type Middleware } from "@nifrajs/core/server";
/**
 * An HMAC secret, or a rotation list of them. With a list, the **first** secret signs new tokens
 * and any listed secret verifies - rotate by prepending the new secret and dropping the old one
 * once outstanding tokens have expired. Every entry must meet the 32-byte floor; an empty list
 * throws.
 */
export type CsrfSecret = string | Uint8Array | ReadonlyArray<string | Uint8Array>;
export interface CsrfOptions {
    /** HMAC secret (≥ 32 bytes), or a rotation list - see {@link CsrfSecret}. */
    readonly secret: CsrfSecret;
    /** Cookie carrying the signed token. Default `"csrf-token"`. */
    readonly cookie?: string;
    /** Header carrying the same signed token. Default `"x-csrf-token"`. */
    readonly header?: string;
    /** Unsafe methods to protect. Default: every method except GET/HEAD/OPTIONS/TRACE. */
    readonly methods?: readonly string[];
    /** Allowed request origins. Default: same-origin derived from the request URL. */
    readonly origins?: readonly string[];
    /** Check Origin/Referer on protected requests. Default true. */
    readonly checkOrigin?: boolean;
}
export declare function createCsrfToken(secret: CsrfSecret, nonce?: string): Promise<string>;
export declare function verifyCsrfToken(token: string, secret: CsrfSecret): Promise<boolean>;
/**
 * Signed double-submit CSRF protection. A protected request must carry the same signed token in a
 * cookie and a header, and must come from an allowed Origin/Referer unless `checkOrigin:false` is set.
 */
export declare function csrf(options: CsrfOptions): Middleware;
//# sourceMappingURL=csrf.d.ts.map