import { D as DurationString } from '../types-Xk5M26Sz.js';

interface CsrfCookieOptions {
    name: string;
    sameSite?: "strict" | "lax" | "none";
    secure?: boolean;
    httpOnly?: boolean;
    path?: string;
}

declare function verifyOrigin(request: Request): "valid" | "origin_mismatch";

type CsrfMode = "double-submit" | "origin-check";
type CsrfReason = "missing_token" | "expired" | "mismatch" | "origin_mismatch" | "valid";
interface CsrfGuardConfig {
    mode?: CsrfMode;
    secret: string;
    ttl?: DurationString;
    cookie?: CsrfCookieOptions;
    ignorePaths?: string[];
}
interface CsrfVerifyResult {
    valid: boolean;
    reason: CsrfReason;
}
interface CsrfGuardResult {
    success: boolean;
    status: 200 | 403;
    reason: CsrfReason;
    headers: Headers;
}
declare function csrfGuard(config: CsrfGuardConfig): {
    generate(request: Request): Promise<string>;
    verify: (request: Request) => Promise<CsrfVerifyResult>;
    check(request: Request): Promise<CsrfGuardResult>;
    buildCookie(token: string): string;
};

export { type CsrfGuardConfig, type CsrfGuardResult, type CsrfMode, type CsrfReason, type CsrfVerifyResult, csrfGuard, verifyOrigin };