/**
 * CSRF Handler validates CSRF tokens on state-changing requests.
 *
 * Reads config from `ctx.securityConfig?.csrf`. Unless a project sets
 * `security.csrf: false`, every method except GET, HEAD, and OPTIONS must
 * include a valid CSRF token (cookie + header match). `deriveSecurityContext`
 * resolves that default identically in local development and in production, so
 * a browser mutation that passes locally passes after deploy.
 *
 * ## Server Actions integration
 *
 * When `security.csrf` is enabled, Server Action POSTs to `/_veryfront/rsc/action`
 * are **not** exempt and require a valid CSRF token. Client-side code that calls
 * Server Actions must:
 *
 * 1. Import `csrfMutationHeaders` from `veryfront/index.client`
 * 2. Use it to include the CSRF token on every POST
 *
 * Example (client-side fetch wrapper):
 * ```ts
 * import { csrfMutationHeaders } from "veryfront/index.client";
 *
 * const hydration = JSON.parse(
 *   document.getElementById("veryfront-hydration-data")?.textContent || "{}",
 * );
 * const headers = csrfMutationHeaders("/_veryfront/rsc/action");
 * const pinKey = hydration.dependencyPinningCacheKey;
 * if (typeof pinKey === "string" && pinKey.startsWith("on:")) {
 *   headers.set("x-veryfront-dependency-pins", pinKey);
 * }
 *
 * const res = await fetch("/_veryfront/rsc/action", {
 *   method: "POST",
 *   headers,
 *   body: actionPayload,
 * });
 * ```
 *
 * @module security/http/csrf/csrf-handler
 */
import { BaseHandler } from "../base-handler.js";
import type { HandlerContext, HandlerMetadata, HandlerResult } from "../../../types/index.js";
export declare class CsrfHandler extends BaseHandler {
    metadata: HandlerMetadata;
    handle(req: Request, ctx: HandlerContext): Promise<HandlerResult>;
}
//# sourceMappingURL=csrf-handler.d.ts.map