export interface OriginCheckOptions {
    /** Extra origins allowed to call actions (e.g. preview deployments). */
    allowedOrigins?: string[];
    /**
     * When true, requests missing both `Origin` and `Referer` are rejected.
     * Defaults to false so curl/server-to-server calls keep working.
     */
    strictOrigin?: boolean;
}
/**
 * Verifies that a request originates from the same host (or an allow-listed
 * origin). Returns an error message when the request must be rejected, or
 * undefined when it is allowed.
 *
 * @param request The incoming Request to actions.
 * @param options Origin check configuration.
 */
export declare function verifyOrigin(request: Request, options?: OriginCheckOptions): string | undefined;
/** Builds a 403 Response for a rejected origin. */
export declare function originForbidden(message: string): Response;