import type { RequestHandler } from 'express';

/**
 * DI token for the double-submit CSRF middleware (per ADR-0009).
 * Resolved at bootstrap in `main.ts` and mounted with `app.use(...)`
 * after the session middleware so `req.session.csrfToken` is
 * available for comparison.
 */
export const CSRF_MIDDLEWARE = 'CSRF_MIDDLEWARE';

export type { RequestHandler };
