import type { IncomingMessage, ServerResponse } from 'http';
/** Constant-time compare that does not leak length through an early return. */
export declare function timingSafeTokenCompare(provided: string, expected: string): boolean;
/**
 * The socket peer is genuinely on this machine. Checks the real socket address,
 * not a spoofable header.
 *
 * An EMPTY remoteAddress is rejected. A real TCP loopback connection always
 * presents 127.0.0.1 or ::1; empty arises only from a destroyed or odd socket,
 * and treating it as local is how a closed socket becomes an authorised one.
 */
export declare function isLoopbackPeer(req: IncomingMessage): boolean;
/**
 * The Origin is one we allow, compared as a whole origin — never by prefix,
 * because `https://hq.example.com.evil.com` defeats a startsWith.
 *
 * A missing Origin is REFUSED rather than allowed. Non-browser clients omit it
 * and would otherwise skip the only check that distinguishes the HQ page from
 * any other page the user has open.
 */
export declare function isAllowedOrigin(origin: string | undefined, allowed: string[]): boolean;
/** The bearer presented in an Authorization header, or '' when there is none. */
export declare function presentedBearer(req: IncomingMessage): string;
/** Headers a signed (paired) request carries; see src/pty/pairing.ts. */
export declare const PAIRING_HEADERS: string[];
/**
 * Answer a CORS preflight for an allowlisted origin, including the Private
 * Network Access header.
 *
 * Without Access-Control-Allow-Private-Network, a page on https cannot reach
 * this daemon at all in current Chromium — the request fails before any of our
 * own auth runs, and it fails in a way that looks like the daemon is down.
 * The header is only asserted when it was actually requested; sending it
 * unconditionally advertises a capability on every preflight.
 *
 * Returns true when it handled the request.
 */
export declare function respondToPnaPreflight(req: IncomingMessage, res: ServerResponse, allowedOrigins: string[], extraHeaders?: string[]): boolean;
//# sourceMappingURL=boundary.d.ts.map