/**
 * hosting/signin/browserGuard — the door guard a door whose credential rides
 * along on forged browser requests must have (design §3, H1/H4).
 *
 * Built from the HOST's own lists (one source: the same `allowedHosts` /
 * `allowedOrigins` the host is given). Refused at construction:
 *  - `'any'` for either list — that says no browser reaches the door;
 *  - `requireJsonContentType: false` — a form could post to it;
 *  - no `allowedHosts` for a public URL that is not this machine;
 *  - for a door that sets a cookie on a plain-http (development) public URL, a
 *    LAN name in `allowedHosts` (a cookie without `Secure` must never be
 *    offered to another machine);
 *  - a public URL the lists themselves would refuse.
 *
 * Used by the sign-in door (its cookie) and by `proxy-token` (the proxy's
 * cookie or Windows login, turned into a header on every request it forwards).
 */
import { type CrossSiteOptions, type DoorGuard } from '../doorGuard.js';
export declare function browserDoorGuard(name: string, lists: CrossSiteOptions | undefined, url: URL, 
/** Does THIS door set a cookie without `Secure` (a plain-http development URL)? */
insecureCookie: boolean): DoorGuard;
//# sourceMappingURL=browserGuard.d.ts.map