/**
 * Where a bearer token may go, ported from NotFusion (sophos-core hosts.ts,
 * 3a952a1). Sophos's answers name the API hosts the server calls later:
 * whoami's global and dataRegion hosts, and each tenant's apiHost in a
 * partner or organization tenant list. Before a token goes on a request, its
 * host must be an https address on sophos.com: no other scheme, no port, no
 * user name or password, no path, query or fragment. A host from an
 * unexpected answer then fails here, and nothing is sent.
 */
export declare class UntrustedHostError extends Error {
    constructor();
}
/** True for an https host on sophos.com, as Sophos writes them: "https://api-eu01.central.sophos.com". */
export declare function isSophosApiBase(host: unknown): host is string;
/** The host as a base to build request URLs on, without a trailing slash. Throws UntrustedHostError for anything else. */
export declare function sophosApiBase(host: unknown): string;
//# sourceMappingURL=hosts.d.ts.map