/**
 * The origin allowlist behind `lit-devtools dev --allow-origin`.
 *
 * devframe compares `allowedOrigins` entries exactly, which cannot admit a
 * page whose origin is only known once it boots: StackBlitz gives every port
 * of a project its own `https://<slug>--<port>--<hash>.<zone>.webcontainer-api.io`.
 * An entry may therefore put `*` in its host (`https://*.webcontainer-api.io`),
 * standing for one or more DNS labels. Scheme and port still have to match.
 *
 * With a wildcard among the entries the list is handed to devframe as an
 * origin registry, the one shape it accepts that decides per origin; its
 * WebSocket and SSE gates both ask it. Without one it stays a plain array.
 */
import type { WsOriginRegistry } from 'devframe/rpc/transports/ws-server';
/**
 * `allowedOrigins` for `createDevServer`, from the `--allow-origin` values:
 * `undefined` for none, the entries as given when all are exact, or a registry
 * that also matches the wildcard ones. Throws on a malformed wildcard entry.
 */
export declare const resolveAllowedOrigins: (entries: readonly string[]) => readonly string[] | WsOriginRegistry | undefined;
/**
 * The origins to admit when the server runs in a WebContainer (StackBlitz),
 * where the page and the panel come from `*.webcontainer-api.io` rather
 * than loopback: `undefined` anywhere else. Only that host can reach a
 * WebContainer's ports, and the one-time code still gates the RPC.
 */
export declare const webContainerOrigins: (versions?: Readonly<Record<string, string | undefined>>) => readonly string[] | WsOriginRegistry | undefined;
//# sourceMappingURL=allowed-origins.d.ts.map