/**
 * Admission policy shared by privileged local-development HTTP surfaces.
 *
 * A Host header never proves locality. This policy requires peer provenance
 * recorded by the native server adapter and rejects configured or header-
 * declared proxy paths. A local relay that deliberately removes every proxy
 * marker is indistinguishable at this boundary and must not expose these
 * routes; use a loopback-only control listener in that topology.
 *
 * @module security/http/local-control-request
 */
/**
 * Route namespace for the local development dashboard's own API.
 *
 * Declared beside this policy so the request-security layer and the dashboard
 * handler agree on one spelling of the surface whose mutations carry the
 * dashboard's port-scoped session credential rather than the project's
 * `security.csrf` token.
 */
export declare const DEV_DASHBOARD_API_PREFIX = "/_dev/api/";
export interface LocalControlRequestOptions {
    /** Explicit trusted-proxy topology state, when the caller already resolved it. */
    readonly proxyTopologyTrusted?: boolean;
}
export declare function hasProxyForwardingHeaders(request: Request): boolean;
/** Cancel a rejected body without letting hostile cancellation delay denial. */
export declare function cancelRejectedLocalControlRequestBody(request: Request, detail?: string): void;
/** Build the uniform fail-closed response used by privileged local controls. */
export declare function createLocalControlAccessDeniedResponse(request: Request, detail?: string): Response;
/**
 * Dedicated authority allowlist for privileged local controls.
 *
 * `localhost` is reserved by RFC 6761, never leaves the machine, and is the
 * hostname printed by the local CLI. It is the only named root; the hostname
 * alone never grants access because `isTrustedLocalControlRequest` still
 * requires an authenticated loopback transport peer and no proxy hop.
 * Third-party wildcard DNS and public development domains that resolve to
 * 127.0.0.1 are not control authorities even when normal application routing
 * accepts them. The named root admits only the bare host,
 * one project label, or one project below `preview`; production, staging,
 * custom-domain simulation, and unknown namespaces stay denied.
 *
 * `*.localhost` gets that same shape check rather than a blanket allow. Trust
 * must not widen just because the printed dev hostname is a single-label root:
 * `project.production.localhost` and `a.b.c.localhost` are denied.
 */
export declare function isTrustedLocalControlHostname(hostname: string): boolean;
/** Require an exact, canonical URL and raw Host authority pair. */
export declare function hasTrustedLocalControlAuthority(request: Request): boolean;
/** Require a native loopback peer and reject proxy or cross-origin browser paths. */
export declare function isTrustedLocalControlRequest(request: Request, options?: LocalControlRequestOptions): boolean;
//# sourceMappingURL=local-control-request.d.ts.map