import type http from 'node:http';
/**
 * Single-route privilege boundary. Returns true iff this method+path pair is
 * allowed through to upstream. The only true case is POST /git-token (with
 * optional query string). Trailing slash is significant; the query string is
 * stripped before comparison.
 */
export declare function isAllowedRoute(method: string | undefined, url: string | undefined): boolean;
/**
 * Returns a new headers object containing ONLY 'content-type' and
 * 'content-length' (when present in the input). All other keys are dropped.
 * Header names are normalized to lowercase. The caller is expected to
 * overwrite 'content-length' with the actual buffered body length before
 * forwarding upstream.
 */
export declare function pickAllowedHeaders(headers: http.IncomingHttpHeaders): Record<string, string>;
//# sourceMappingURL=allowlists.d.ts.map