/**
 * Registrable domains the vendor controls. A URL on one of these fails both
 * checks. Adding a new vendor domain to the codebase without adding it here
 * does NOT make it invisible: check 1 is an allowlist, so an unlisted domain
 * fails as "unapproved" even if nobody has classified it as ours.
 */
export declare const VENDOR_CONTROLLED_DOMAINS: readonly string[];
/**
 * POLICY — third-party endpoint defaults vs vendor endpoint defaults.
 *
 * R1 bans defaulting to hosts *we operate*. It does not ban a bring-your-own-key
 * skill from naming the public API of the provider whose key the user supplies:
 * `api.openai.com` in a skill pointed at the user's own OpenAI account is the
 * provider's published address, not a service we run, and there is no other
 * value it could sensibly take. That is legitimate under R2's "third-party
 * provider the user configures directly (BYO key — documented, never proxied)".
 *
 * So the distinction is explicit rather than accidental:
 *
 *   - a default endpoint on a host WE operate            → forbidden, always;
 *   - a default endpoint on an approved third-party host → allowed;
 *   - a default endpoint on any other host               → forbidden until
 *     reviewed and listed here with a reason.
 *
 * Every entry is a registrable domain plus its justification. This list doubles
 * as the inventory of every host the published code is able to name.
 */
export declare const APPROVED_CODE_HOSTS: readonly {
    domain: string;
    reason: string;
}[];
/**
 * Exact URLs that may appear despite being on a vendor domain. Matched on the
 * full URL, never on the domain, so a real endpoint on the same domain still
 * fails. Keep minimal and justified.
 */
export declare const VENDOR_HOST_URL_EXCEPTIONS: readonly {
    url: string;
    reason: string;
}[];
/** Reduce a hostname to its registrable domain (approximate eTLD+1). */
export declare function registrableDomain(host: string): string;
export declare function isLoopbackHost(host: string): boolean;
export declare function isVendorControlledHost(host: string): boolean;
export declare function isApprovedCodeHost(host: string): boolean;
/**
 * Packed files allowed to contain a host whose TLD is supplied by `{…}` template
 * syntax (`https://s3.{partitionResult#dnsSuffix}`). These are bundles of the
 * AWS SDK, whose endpoint-rule engine substitutes the DNS suffix per partition.
 *
 * File-scoped on purpose: the carve-out used to be package-wide, which meant any
 * file could park a partial authority next to a runtime value and be exempted.
 * A host completed from a *code* expression is never exempt, in any file.
 */
export declare const TEMPLATE_HOST_FILES: readonly {
    file: string;
    reason: string;
}[];
export declare function allowsTemplateHost(file: string): boolean;
/**
 * Sites that build a host out of a computed value.
 *
 * Building a host from configuration is exactly what R1 asks for, so these are
 * not defects — but they are also the shape an endpoint default hides in, so
 * each one is acknowledged here rather than exempted by a blanket rule. Matched
 * on file AND exact URL fragment, never on file alone, and never on line number
 * so that rebuilding a bundle does not churn the list. A new dynamic-host site
 * fails until someone reads it and adds it.
 */
export declare const DYNAMIC_HOST_SITES: readonly {
    file: string;
    path: string;
    expr: string;
    reason: string;
}[];
/**
 * Path component of a URL, used as the annotation key. Deliberately not the full
 * URL: a dynamic-host URL renders as a bare scheme, and storing that literal
 * would both read as noise and trip the repo's own insecure-HTTP scanner.
 */
export declare function urlPath(url: string): string;
/**
 * Is this specific site annotated?
 *
 * Matched on file AND url path AND a substring of the host-producing EXPRESSION.
 * The expression is what makes the annotation site-scoped: keying on
 * (file, path) alone degenerated to keying on the file, because every
 * computed host with no path renders to the same bare scheme — so one annotated
 * site silently pre-approved every future one in the same file.
 */
export declare function isAnnotatedDynamicHost(file: string, url: string, expressionText: string): boolean;
/**
 * The policy module must name the vendor domains it declares. Exclude only this
 * file from the value-independent token check; URL-shaped checks still apply.
 */
export declare const VENDOR_DOMAIN_DECLARATION_FILE = "src/lib/vendor-host-policy.ts";