/**
 * @license
 * Copyright 2026 HopCode Team
 * SPDX-License-Identifier: Apache-2.0
 */
/**
 * The set of `--hostname` values that are treated as loopback. Both the
 * runner (boot-time auth-required check) and the request middleware (Host
 * header allowlist) consult this; keeping the set in one place prevents the
 * two from drifting apart.
 *
 * IPv6 loopback is included so users who prefer `::1`/`[::1]` don't have to
 * configure a token. We compare against the raw hostname string the operator
 * typed, not the resolved interface — both must be loopback for the bind to
 * be auth-free.
 */
export declare const LOOPBACK_BINDS: ReadonlySet<string>;
export declare function isLoopbackBind(hostname: string): boolean;
