/**
 * Workspace-authenticated public / no-key API execution.
 *
 * This is not the anonymous keyless proxy. Anonymous
 * `keylessPublicExecutionAvailable` stays false. These origins are executed
 * only after workspace auth, with HTTPS origin pinning, private-network
 * rejection, and redirect:error. Harvested apiKey/unknown rows stay out.
 *
 * The allowlist is generated by scripts/build-workspace-public-apis.mjs into
 * compact JSON plus a JSON.parse data module. The landing catalog reads the
 * JSON from disk so Next does not bundle a 1,003-object TypeScript literal.
 */
export type WorkspacePublicApi = {
    id: string;
    name: string;
    baseUrl: string;
    origin: string;
};
export declare const WORKSPACE_PUBLIC_APIS: readonly WorkspacePublicApi[];
export declare const CURATED_WORKSPACE_PUBLIC_APIS: readonly WorkspacePublicApi[];
export declare function normalizePublicApiReference(value: string): string;
export declare function isNoKeyPublicAuth(auth: unknown): boolean;
export declare function isJunkPublicApiName(name: unknown): boolean;
export declare function isSafePublicApiBaseUrl(value: unknown): URL | undefined;
export declare function shouldUnlockHarvestedPublicApi(entry: {
    name?: string;
    auth?: string;
    baseUrl?: string;
    docsUrl?: string;
    verificationTier?: string;
}): boolean;
export declare const WORKSPACE_PUBLIC_EXECUTABLE_COUNT: number;
/** Exact catalog-card name match. Does not treat Disney+ as Disney. */
export declare function isWorkspacePublicCatalogCard(name: string | undefined): boolean;
export declare function getWorkspacePublicApi(reference: string | undefined): WorkspacePublicApi | undefined;
export declare function isWorkspacePublicExecutableApi(reference: string | undefined): boolean;
export declare function isWorkspacePublicExecutableAction(reference: string | undefined, action: string | undefined): boolean;
/**
 * Pin a caller path onto a cataloged public origin. Relative paths resolve
 * against the cataloged HTTPS baseUrl (not origin), so CoinGecko
 * `/simple/price` keeps `/api/v3`. Absolute https URLs stay origin-pinned.
 * Rejects origin changes, credentials, and private/docs hosts. Used by
 * /v1/execute.
 */
export declare function buildPinnedPublicApiUrl(api: WorkspacePublicApi, path: unknown): URL | undefined;
//# sourceMappingURL=workspace-public-apis.d.ts.map