export declare const CSRF_COOKIE_NAME: "voltro:csrf";

export declare const CSRF_HEADER_NAME: "x-csrf-token";

/** Verify a token's own HMAC (signature integrity), independent of the
 *  cookie/header match. */
export declare const isCsrfTokenWellFormed: (token: string, secret: string) => boolean;

/**
 * Issue a fresh CSRF token: `<randomB64url>.<hmacB64url>`. Set this as a
 * readable (non-HttpOnly) cookie AND hand it to the SPA so it can echo
 * it in the `x-csrf-token` header.
 */
export declare const issueCsrfToken: (secret: string) => string;

/**
 * Verify a state-changing request's CSRF protection. Both the header
 * value and the cookie value must (a) be the SAME token and (b) carry a
 * valid HMAC. Returns true only when both hold.
 */
export declare const verifyCsrf: (headerToken: string | undefined, cookieToken: string | undefined, secret: string) => boolean;

export { }