/**
 * Peer identity for loopback connections.
 *
 * The session-token fallback (browser's token handed to token-less local
 * callers) is only safe if "local" means "the same user". On a shared login
 * node it does not: every other account's processes also reach 127.0.0.1.
 *
 * On Linux the kernel publishes the answer. A loopback connection appears in
 * /proc/net/tcp twice — once for each end — and the client's row carries the
 * uid that owns it. Matching on the port pair (client's local port == our
 * peer port, client's remote port == our listening port) identifies that row
 * without having to re-encode addresses.
 */
export interface TcpRow {
    localPort: number;
    remPort: number;
    uid: number;
}
/** Parse /proc/net/tcp (or tcp6). Unparseable lines are skipped, not thrown. */
export declare function parseProcNetTcp(content: string): TcpRow[];
/**
 * uid of the process that opened `peerPort` toward `serverPort`, or null when
 * the pair isn't present. Listening sockets (remote port 0) never match.
 */
export declare function findPeerUid(rows: TcpRow[], peerPort: number, serverPort: number): number | null;
export type PeerVerdict = 'same-user' | 'other-user' | 'unknown';
/**
 * Is the loopback peer the same OS user the server runs as?
 *
 * 'unknown' on platforms without /proc (macOS, Windows) — callers decide the
 * policy there; on Linux, where shared multi-user hosts actually live, the
 * answer is authoritative.
 */
export declare function classifyPeer(peerPort: number | undefined, serverPort: number | undefined): PeerVerdict;