export interface ParsedBind {
    hostname: string;
    port: number;
}
/**
 * Parse a `host:port` (or bare `port`, which assumes loopback) string.
 *
 * Accepts:
 *   - `"4000"`            → `127.0.0.1:4000`
 *   - `"0.0.0.0:4000"`    → as written
 *   - `"[::1]:4000"`      → as written (brackets retained, Bun handles them)
 *
 * Rejects:
 *   - empty input
 *   - empty hostname (`":4000"`)
 *   - non-integer / out-of-range port
 */
export declare function parseBind(raw: string): ParsedBind;
/** True for loopback-only hostnames the auth servers may bind without credentials. */
export declare function isLoopbackHostname(hostname: string): boolean;
/**
 * Fail closed when an unauthenticated auth server (empty bearer token set)
 * would bind a non-loopback address: that exposes credential operations to the
 * network with no proof of possession.
 */
export declare function assertAuthenticatedOrLoopback(bind: ParsedBind, bearerTokenCount: number, serverName: string): void;