import type { Request, Response, NextFunction } from "express";
export declare function isLoopbackHost(host: string): boolean;
export declare function isExtensionOrigin(origin: string | undefined | null): boolean;
/**
 * Rejects requests that did not come from this machine addressed as localhost,
 * and any request carrying a web-page Origin.
 *
 * Together these close the cross-site path that made every endpoint reachable
 * from any page the user happened to visit.
 */
export declare function localOnlyGuard(): (req: Request, res: Response, next: NextFunction) => void;
/** Requires a bearer token on the API surface. */
export declare function requireToken(token: string): (req: Request, res: Response, next: NextFunction) => void;