/**
 * CORS and cross-origin protection middleware.
 *
 * Ports Python's reject_cross_origin() logic from codemem/viewer_http.py.
 * GETs are allowed from any origin (viewer is local-only).
 * Mutations (POST/DELETE/PATCH/PUT) require an Origin header matching a
 * loopback address, or are rejected with 403.
 */
/**
 * Cross-origin protection middleware.
 *
 * Ports Python's `reject_cross_origin(missing_origin_policy="reject_if_unsafe")`:
 *
 * - GET/HEAD/OPTIONS: allowed from any origin (viewer is local-only).
 * - POST/DELETE/PATCH/PUT:
 *   - Origin present + loopback → allowed (browser on localhost)
 *   - Origin present + non-loopback → rejected 403
 *   - No Origin + no suspicious browser signals → allowed (CLI callers)
 *   - No Origin + suspicious Sec-Fetch-Site/Referer → rejected 403
 *
 * For same-origin requests (no Origin header) on safe methods, no
 * Access-Control-Allow-Origin is set — the browser doesn't need it.
 * For valid loopback origins, ACAO is echoed back.
 */
export declare function originGuard(): import("hono").MiddlewareHandler<any, any, {}, Response | (Response & import("hono").TypedResponse<{
    error: string;
}, 403, "json">)>;
/**
 * Handle OPTIONS preflight requests.
 * Returns 204 with appropriate CORS headers for loopback origins.
 */
export declare function preflightHandler(): import("hono").MiddlewareHandler<any, any, {}, Response | (Response & import("hono").TypedResponse<null, 204, "body">)>;
//# sourceMappingURL=middleware.d.ts.map