/**
 * Origin guard — defeats DNS-rebind attacks against the loopback listener.
 *
 * The listener is bound to 127.0.0.1 only, but a malicious page on
 * `evil.example.com` can still resolve its own hostname to 127.0.0.1 and
 * speak HTTP to us. We mitigate by requiring that:
 *   - `Host` is `127.0.0.1[:port]` or `localhost[:port]` (case-insensitive),
 *   - `Origin` (when present) matches one of those origins.
 *
 * Forbidden requests return 403 with the standard error envelope.
 *
 * The expected port can be supplied as a constant or as a getter — the
 * server's port-fallback loop discovers the bound port only after `listen`,
 * but Fastify hooks must be registered before `ready`, so the guard reads
 * the port at request time via the getter.
 */
import type { FastifyInstance } from 'fastify';
export interface OriginGuardOptions {
    /** Bound port (constant) or a getter for the current bound port. */
    port: number | (() => number);
    /** Allow these additional hosts (test harnesses, integrations). */
    extraAllowedHosts?: ReadonlyArray<string>;
}
export declare function registerOriginGuard(app: FastifyInstance, opts: OriginGuardOptions): void;