/**
 * Loopback-address helpers, shared by the daemon (deciding whether a bind gates behind the
 * token, #1051) and the RPC mount (rejecting a rebound `Host`). A leaf module on purpose:
 * `daemon.ts` imports the dashboard, so the mount cannot import these back out of it.
 */
/**
 * True when `host` is a loopback address the browser reaches without leaving the machine (#1051).
 * A bind-all (`0.0.0.0`, `::`) or a routable address is not, and gates behind the shared token.
 *
 * The IPv4 check matches the whole `127.0.0.0/8` range but only as an address: a bare
 * `startsWith('127.')` also accepts a *registrable name* like `127.evil.com`, which is exactly the
 * rebound `Host` the DNS-rebinding guard exists to reject (it can resolve to `127.0.0.1`).
 */
export declare function isLoopbackHost(host: string): boolean;
/**
 * The hostname a `Host` header names, with the port dropped. Keeps the bracketed IPv6 form
 * (`[::1]:4200` → `[::1]`), which splitting on the first colon would mangle.
 */
export declare function hostnameFromHostHeader(header: string): string;
//# sourceMappingURL=loopback-host.d.ts.map