/**
 * Refuses to send session JWTs or signed auth payloads over plaintext HTTP
 * unless the endpoint is loopback. https://* is always allowed; http://localhost,
 * http://127.0.0.1 (and the 127.0.0.0/8 range), and http://[::1] are allowed for
 * local development; everything else throws.
 *
 * Audit L-10: the previous `*.localhost` wildcard was dropped. `.localhost` is reserved to
 * loopback by RFC 6761, but not every resolver honours it strictly — a hostile or misconfigured
 * DNS could resolve `foo.localhost` to an off-host IP and exfiltrate the cleartext token. Exact
 * loopback literals + the numeric 127.0.0.0/8 range can't be DNS-hijacked.
 *
 * IPv4-mapped IPv6 loopback (e.g. `http://[::ffff:127.0.0.1]`) is intentionally NOT accepted: the
 * URL parser normalises it to a hex form (`[::ffff:7f00:1]`) that is fragile to match safely. Use
 * `127.0.0.1`, `::1`, or `localhost` for local development.
 */
export declare function assertSafeServiceEndpoint(endpoint: string): void;
