import { DASHBOARD_CSRF_COOKIE_NAME, DASHBOARD_CSRF_HEADER_NAME } from "../../../../extensions/dev-ui/protocol.js";
export { DASHBOARD_CSRF_COOKIE_NAME, DASHBOARD_CSRF_HEADER_NAME };
export declare const DASHBOARD_ACCESS_DENIED_MESSAGE = "Dashboard access requires a direct loopback connection and a trusted local-development host";
/**
 * Admit only canonical local-development URL/Host pairs.
 *
 * Binding the dev server to a non-loopback interface does not implicitly make
 * its privileged dashboard remotely accessible. Besides literal loopback, the
 * admitted names are the canonical local domains also used by HMR and printed
 * by the CLI. A future remote-dashboard feature must define an authenticated
 * host contract explicitly.
 */
export declare function isTrustedDashboardRequest(req: Request): boolean;
/** Token embedded only in the trusted dashboard shell for a double-submit header. */
export declare function getDashboardSessionToken(): string;
/** Issue the process-lifetime dashboard session as a host-only session cookie. */
export declare function createDashboardSessionCookie(req: Request): string;
/** Validate both halves of the dashboard's session-bound CSRF credential. */
export declare function hasValidDashboardMutationSession(req: Request): boolean;
//# sourceMappingURL=access-policy.d.ts.map