export declare const DEFAULT_CSRF_COOKIE_NAME = "__Host-vf_csrf";
export declare const DEFAULT_CSRF_HEADER_NAME = "x-csrf-token";
export declare const INSECURE_ORIGIN_CSRF_COOKIE_NAME = "vf_csrf";
/** Pick a default cookie name that browsers retain for this origin. */
export declare function defaultCsrfCookieNameForOrigin(origin: string): string;
/** Resolve the documented default through the browser origin. */
export declare function effectiveCsrfCookieNameForOrigin(configuredCookieName: string | undefined, origin: string): string;
export interface CsrfNameOptions {
    cookieName?: string;
    headerName?: string;
}
export declare function requireCsrfName(value: unknown, label: string): string;
export declare function resolveCsrfNames(options?: CsrfNameOptions): {
    cookieName: string;
    headerName: string;
};
/**
 * Name of the companion cookie that advertises configured CSRF names.
 *
 * The double-submit helper ships in browser bundles and cannot read server
 * configuration, so a project that sets `security.csrf.cookieName` or
 * `headerName` would otherwise have to hand-plumb those names into every call
 * site. The server publishes them here instead, and the helper discovers them.
 *
 * The names are not secrets: the header name is visible on every request the
 * browser makes, and the cookie name is visible in `document.cookie`. Tampering
 * cannot weaken validation, because the server still checks against its own
 * configuration; a forged value only makes the browser send a header the server
 * is not reading, which fails closed with a 403.
 */
export declare const CSRF_NAMES_COOKIE_NAME = "vf_csrf_names";
/**
 * Return the advertisement cookie name reserved for one browser origin.
 *
 * Cookies do not distinguish ports. Encoding the complete origin into the
 * name lets several local applications on one host retain their own discovery
 * values instead of taking turns overwriting one shared cookie. URL-safe
 * base64 keeps the derived name within the cookie-token alphabet and is
 * deterministic in both server and browser bundles.
 */
export declare function csrfNamesCookieName(origin: string): string;
/**
 * Return the HTTP-only token name used when an unprefixed configured name has
 * no existing cookie to migrate.
 *
 * Secure cookies are shared with HTTPS but cannot be replaced from HTTP. A
 * name scoped to the complete HTTP origin lets an HTTP sibling mint its own
 * token even when an HTTPS-first sibling already owns the configured name as a
 * Secure cookie. The configured name remains part of the derived name so
 * independent CSRF configurations on the same origin cannot alias each other.
 */
export declare function csrfHttpTokenCookieName(cookieName: string, origin: string): string;
/** Return the HTTPS-only token name used while migrating a shared legacy token. */
export declare function csrfHttpsTokenCookieName(cookieName: string, origin: string): string;
/** Select the token name that issuance and browser discovery use for one origin. */
export declare function effectiveCsrfTokenCookieNameForOrigin(configuredCookieName: string, origin: string, hasConfiguredToken: boolean): string;
/** Reports whether a cookie name belongs to an internal CSRF cookie namespace. */
export declare function isReservedCsrfCookieName(cookieName: string): boolean;
/**
 * Reject a configured name that would collide with an internal companion cookie.
 *
 * Without this, `security.csrf.cookieName: "vf_csrf_names"` would make the
 * advertisement overwrite the random token cookie, while a derived token name
 * could alias the token Veryfront validates for another configuration. A
 * pre-existing configured name that merely shares the readable prefix remains
 * valid unless its suffix decodes to a real derived token identity.
 */
export declare function requireNonReservedCsrfCookieName(cookieName: string): string;
/**
 * Encode configured names for the advertisement cookie, or null when both are
 * the documented defaults and the helper already resolves them without help.
 *
 * The serving origin is included because cookies are shared across ports on the
 * same host, so two local projects on different ports would otherwise overwrite
 * each other's advertisement and each send the other's header name.
 *
 * The origin may itself contain colons (a port, or an IPv6 host such as
 * `http://[::1]:3000`). Decoding splits from the right, taking the last two
 * fields as the names, so no restriction on the origin is needed.
 */
export declare function encodeCsrfNamesAdvertisement(cookieName: string, headerName: string, origin: string): string | null;
/**
 * Decode an advertisement cookie value for the document's own origin.
 *
 * Returns null unless every field is present and both names are valid HTTP
 * tokens, so a malformed, truncated, or foreign-origin value falls back to the
 * defaults rather than producing a half-configured request.
 */
export declare function decodeCsrfNamesAdvertisement(value: string | undefined, documentOrigin: string): {
    cookieName: string;
    headerName: string;
} | null;
//# sourceMappingURL=names.d.ts.map