/** Issue an opaque CSRF token for the double-submit pattern (32 random bytes, base64url). */
declare function issueCsrfToken(): string;
/**
 * Double-submit verify: the token stored in a cookie vs the token echoed back in a request
 * header/body field. Constant-time compare (timingSafeEqual). Fail-closed: either side
 * null/undefined/empty → `false` (before the compare — a present-vs-absent check is not a
 * secret-timing leak). Equal-length, equal-value → `true`.
 */
declare function verifyDoubleSubmit(cookieToken: string | null | undefined, submittedToken: string | null | undefined): boolean;
/**
 * Origin-based CSRF defense for state-changing requests. Returns `true` IFF same-origin:
 *   - `Origin` header present → must be ∈ `allowedOrigins` (exact string match)
 *   - `Origin` absent         → `Sec-Fetch-Site` ∈ {'same-origin','none'}
 *   - neither present         → `false` (fail-closed)
 *
 * Bearer-token requests have no ambient cookie credential — CSRF is N/A; the host SHOULD exempt
 * them before calling this.
 */
declare function isSameOrigin(headers: HeadersInit, allowedOrigins: readonly string[]): boolean;

export { isSameOrigin, issueCsrfToken, verifyDoubleSubmit };