export declare function isExplicitlyEnabled(value: string | undefined): boolean;
/**
 * True when unauthenticated network exposure is acceptable: either a password is
 * set (auth active) or the operator explicitly acknowledged it. Used by the
 * tunnel-enable guard (COD-55) to refuse publishing an unauthenticated public URL.
 */
export declare function isUnauthenticatedNetworkAcknowledged(allowFlag?: boolean): boolean;
export declare function isLoopbackBindHost(host: string): boolean;
/**
 * Hostname suffixes that are always accepted by the Host/Origin allowlist. These
 * are namespaces an external attacker cannot register DNS-rebinding records under
 * (tailscale MagicDNS, Cloudflare quick/named tunnels), so accepting them keeps
 * the project's documented tunnel access paths working without reopening the
 * rebinding hole. Extend per-deployment via CODEMAN_ALLOWED_HOSTS.
 */
export declare const DEFAULT_TRUSTED_HOST_SUFFIXES: string[];
/** Policy inputs for the anti-DNS-rebinding Host allowlist + cross-site Origin guard. */
export interface HostPolicy {
    /** The host the server is bound to (e.g. '127.0.0.1', '0.0.0.0', or a hostname). */
    bindHost: string;
    /** Extra allowed hosts: exact lowercased names, or a leading-dot '.suffix' for suffix matches. */
    allowedHosts: string[];
    /** Hostname of the currently-active Codeman-managed tunnel, if any. */
    tunnelHost?: string | null;
}
/**
 * Extract the lowercased hostname from a Host/authority value, stripping the port
 * and IPv6 brackets. Returns null for empty/garbage input.
 */
export declare function parseAuthorityHostname(authority: string | undefined): string | null;
/** Build a HostPolicy from the bind host, CODEMAN_ALLOWED_HOSTS, and an active tunnel URL. */
export declare function buildHostPolicy(bindHost: string, tunnelUrl?: string | null): HostPolicy;
/**
 * True if a request's Host header is allowed. Blocks DNS-rebinding: a custom
 * domain rebound to a loopback/LAN address still carries its own name in Host,
 * which will not be in the allowlist.
 */
export declare function isAllowedRequestHost(hostHeader: string | undefined, policy: HostPolicy): boolean;
/**
 * True if a request's Origin is allowed for a state-changing / WebSocket request.
 * A MISSING Origin is allowed: non-browser clients (curl, Claude Code hooks) omit
 * it, while browsers always attach it on cross-origin state-changing/WS requests —
 * so a forged cross-site request is caught while local automation keeps working.
 * The opaque origin 'null' (sandboxed iframe, data: URL) is rejected.
 */
export declare function isAllowedRequestOrigin(originHeader: string | undefined, policy: HostPolicy): boolean;
//# sourceMappingURL=network-auth-policy.d.ts.map