export type ServeMode = "loopback" | "exposed" | "share-safe-open";
export declare function buildServeSecurityHeaders(): Record<string, string>;
/** Saved artifacts may contain active HTML, SVG or XML. Give raw documents an
 * opaque origin even on direct navigation, while preserving self-contained scripts.
 * Generated Observer pages use buildServeSecurityHeaders instead. */
export declare function buildArtifactSecurityHeaders(): Record<string, string>;
export declare function hostAllowed(hostHeader: string | undefined, allowlist: ReadonlySet<string>): boolean;
export declare function parsePublicOrigin(value: string): {
    origin: string;
    host: string;
    scheme: "http" | "https";
} | null;