/**
 * Checks for transports that carry no bearer token. A browser always sends an
 * `Origin` header and cannot be stopped by CORS on a WebSocket upgrade, and a
 * rebinding page reaches 127.0.0.1 under its own hostname, so an open loopback
 * server must look at both. Non-browser clients send no `Origin`.
 */
import type { IncomingMessage } from 'node:http';
export declare function isLoopbackName(host: string): boolean;
/** Whether the `Host` header names this server (a loopback name or the bound host). */
export declare function hostHeaderAllowed(header: string | undefined, boundHost: string): boolean;
/** Whether a request's `Origin` may talk to an unauthenticated server: none at all, or one listed by name (`*` does not count). */
export declare function originAllowed(origin: string | undefined, allowed: readonly string[] | undefined): boolean;
/** Why an unauthenticated request must be refused, or `undefined` when it may proceed. */
export declare function refuseOpenRequest(req: Pick<IncomingMessage, 'headers'>, boundHost: string, allowedOrigins: readonly string[] | undefined): string | undefined;
/** Refuse to listen beyond loopback with no token unless the operator said so. */
export declare function assertSafeBind(host: string, authenticated: boolean, allowUnauthenticated: boolean | undefined): void;
//# sourceMappingURL=guard.d.ts.map