/**
 * Canonical loopback-host detection shared across security gates
 * (bridge-token exemption, localhost-only endpoints, http: allowlists,
 * OAuth redirect branching). One accepted set — do not reimplement.
 *
 * Accepts:
 * - `localhost`
 * - the entire `127.0.0.0/8` block (e.g. `127.0.0.1`, `127.0.0.2`)
 * - IPv6 loopback, bracketed or bare (`[::1]`, `::1`)
 */
/** True when `hostname` is a loopback name (no URL parse — host only). */
export declare function isLoopbackHostname(hostname: string): boolean;
/**
 * True when `origin` parses as a URL whose hostname is loopback.
 * Returns false for missing / empty / unparseable values.
 */
export declare function isLoopbackOrigin(origin: string | undefined | null): boolean;
//# sourceMappingURL=loopback.d.ts.map