/**
 * Generate a CSRF token
 */
export declare function generateCsrfToken(length?: number): string;
/**
 * Get the current CSRF token, generating one if it doesn't exist
 */
export declare function getCsrfToken(): string;
/**
 * Reset the CSRF token (mainly for testing)
 */
export declare function resetCsrfToken(): void;
/**
 * Set a specific CSRF token (useful for server frameworks that have their own token generation)
 */
export declare function setCsrfToken(token: string): void;
/**
 * Generate a CSRF input field HTML
 */
export declare function csrfField(inputName?: string): string;
/**
 * Process @csrf directives in templates
 */
export declare function processCsrfDirectives(template: string): string;
/**
 * Verify a CSRF token.
 *
 * When called with one argument, compares against the module-global token.
 * When called with two arguments, compares submitted vs expected (for per-request usage).
 *
 * Per-request usage avoids the global state race condition under concurrent requests:
 * ```typescript
 * const expected = req.session.csrfToken
 * const submitted = req.body._token
 * if (!verifyCsrfToken(submitted, expected)) { ... }
 * ```
 */
export declare function verifyCsrfToken(token: string, expectedToken?: string): boolean;
