import { type CsrfNameOptions } from "./names.js";
export interface CsrfConfig {
    cookieName?: string;
    headerName?: string;
    excludePaths?: string[];
    ttlSec?: number;
}
export interface CsrfTokenOptions {
    cookieName?: string;
    ttlSec?: number;
    /** When false, omits HttpOnly so client JS can read the cookie (double-submit pattern). Default: true */
    httpOnly?: boolean;
    /** When true, adds the Secure flag (cookie only sent over HTTPS). Default: true */
    secure?: boolean;
}
/** Generate a CSRF token and return value + Set-Cookie header string */
export declare function generateCsrfToken(options?: CsrfTokenOptions): {
    token: string;
    setCookie: string;
};
/** Validate CSRF token by comparing header and cookie */
export declare function validateCsrf(req: Request, options?: CsrfNameOptions): boolean;
/**
 * Resolve the token-issuing CSRF setting for a response-serving surface.
 *
 * `deriveSecurityContext` defaults `security.csrf` on in every environment, so
 * a derived context already asks for the token cookie. This covers the surfaces
 * that serve a local response before any security context was derived: without
 * it a local page would render with no CSRF cookie, leaving correct client code,
 * including the hooks that build on `csrfMutationHeaders`, with nothing to echo
 * into the header the gate then requires.
 *
 * It only ever issues a token. Enforcement keys off `security.csrf`, which this
 * never sets, and an explicit `false` passes straight through so the documented
 * opt-out suppresses the cookie as well as the check.
 */
export declare function csrfCookieSetting(csrfConfig: boolean | CsrfConfig | undefined, isLocalDevelopment: boolean): boolean | CsrfConfig | undefined;
/**
 * Set or refresh browser-readable CSRF token and name-advertisement cookies on
 * GET/HEAD responses. Existing tokens stay in place while stale or missing
 * current and sibling advertisements are synchronized.
 *
 * Missing tokens get a fresh double-submit cookie. Existing tokens are retained,
 * but stale or missing name advertisements are refreshed with the token TTL so
 * browser helpers keep discovering configured names. When a host-wide custom
 * token is shared with HTTP and HTTPS sibling origins, HTTPS refreshes use an
 * origin-isolated Secure token so the legacy token remains readable to HTTP.
 * HTTP siblings use their own origin-scoped token names for fresh pairs.
 * `__Host-` and `__Secure-` token names always keep Secure.
 */
export declare function applyCsrfCookie(req: Request, responseHeaders: Headers, csrfConfig?: boolean | CsrfConfig): void;
/**
 * The origin the browser actually used, which is what `document.location.origin`
 * will report.
 *
 * Behind a TLS-terminating proxy the request URL stays an internal `http://`
 * address, so advertising it would publish an origin the document can never
 * match and discovery would silently fall back to the defaults. The forwarded
 * headers are consulted only when the deployment opts in through
 * VERYFRONT_TRUST_FORWARDED_HEADERS, exactly as the Secure flag decision does,
 * because they are client-spoofable otherwise. The flag is passed in rather than
 * read here so this stays a pure function the colocated unit test can drive
 * without touching process env.
 */
export declare function browserFacingOrigin(req: Request, trustProxyHeaders: boolean): string;
//# sourceMappingURL=helpers.d.ts.map