/**
 * Validates an origin (scheme + host + port) supplied to `/connect/start`.
 *
 * HTTPS origins are always permitted. HTTP origins are permitted only when
 * the host is loopback (RFC 8252 §7.3) or the exact origin appears in the
 * tenant's `allow_http_return_to` allowlist.
 */
export type ValidConnectOrigin = {
    ok: true;
    origin: string;
    isLoopback: boolean;
    isAllowlisted: boolean;
    isHttp: boolean;
};
export type InvalidConnectOrigin = {
    ok: false;
    reason: string;
};
export type ConnectOriginResult = ValidConnectOrigin | InvalidConnectOrigin;
export declare function validateConnectOrigin(raw: string, allowHttp?: readonly string[]): ConnectOriginResult;
