export interface CsrfClientOptions {
    cookieName?: string;
    headerName?: string;
    /**
     * Match the server's `csrf.useHostPrefix` — read the token from the
     * `__Host-`-prefixed cookie name. Leave `false` (default) unless the server
     * sets `useHostPrefix: true`.
     */
    useHostPrefix?: boolean;
}
/**
 * Read the CSRF token from document.cookie. Returns null outside the browser
 * or when the cookie is absent (e.g. before the server has set it).
 */
export declare function readCsrfToken(cookieName?: string, useHostPrefix?: boolean): string | null;
/**
 * Augment a `fetch` init object with the CSRF header. Safe to call even when
 * the token is missing — the init object is returned unchanged in that case,
 * so the server-side origin check stays the sole gatekeeper.
 */
export declare function withCsrfHeader(init?: RequestInit, options?: CsrfClientOptions): RequestInit;
/**
 * Thin fetch wrapper that automatically echoes the CSRF token for mutating
 * requests. Use from client components that talk to endpoints guarded by
 * the Double-Submit-Cookie pattern.
 *
 * `fetchImpl` swaps the underlying fetch implementation (mock backends in
 * demos/tests, custom retry/auth layers). Defaults to the global `fetch`.
 */
export declare function csrfFetch(input: RequestInfo | URL, init?: RequestInit, options?: CsrfClientOptions, fetchImpl?: typeof globalThis.fetch): Promise<Response>;