/**
 * Checks for transports that carry no bearer token. A browser always sends an
 * `Origin` header and cannot be stopped by CORS on a WebSocket upgrade, and a
 * rebinding page reaches 127.0.0.1 under its own hostname, so an open loopback
 * server must look at both. Non-browser clients send no `Origin`.
 */
import type { IncomingMessage } from 'node:http';
export declare function isLoopbackName(host: string): boolean;
/** Whether the `Host` header names this server (a loopback name or the bound host). */
export declare function hostHeaderAllowed(header: string | undefined, boundHost: string): boolean;
/** Whether a request's `Origin` may talk to an unauthenticated server: none at all, or one listed by name (`*` does not count). */
export declare function originAllowed(origin: string | undefined, allowed: readonly string[] | undefined): boolean;
/** Why an unauthenticated request must be refused, or `undefined` when it may proceed. */
export declare function refuseOpenRequest(req: Pick<IncomingMessage, 'headers'>, boundHost: string, allowedOrigins: readonly string[] | undefined): string | undefined;
/** Refuse to listen beyond loopback with no token unless the operator said so. */
export declare function assertSafeBind(host: string, authenticated: boolean, allowUnauthenticated: boolean | undefined): void;
/**
 * The token in an `Authorization: Bearer <token>` header, or `undefined`.
 *
 * Deliberately not `/^Bearer\s+(.+)$/i`: there `\s+` and `.+` both match
 * whitespace, so a header of many spaces or tabs makes the engine try every
 * split point — polynomial backtracking on input an unauthenticated caller
 * controls (CodeQL js/polynomial-redos). A prefix compare, one unquantified
 * character class and trimStart are all linear.
 */
export declare function bearerToken(header: string | undefined): string | undefined;
//# sourceMappingURL=guard.d.ts.map