export declare const playgroundAllowlistTemplate = "import allowlistData from \"@/services/openapi/playground-allowlist.json\";\n\n// A single request-execution target the API playground is permitted to call.\n// Derived at build time from the union of every OpenAPI spec's `servers`.\n// `allowPrivate` is set ONLY for a loopback server declared by the spec (the\n// local-development case). Private-network and metadata ranges stay blocked.\nexport interface AllowlistEntry {\n  scheme: \"http\" | \"https\";\n  host: string;\n  port: number | null;\n  basePath?: string;\n  allowPrivate?: boolean;\n}\n\nconst allowlist: AllowlistEntry[] = Array.isArray(allowlistData)\n  ? (allowlistData as AllowlistEntry[])\n  : [];\n\nexport function getAllowlist(): AllowlistEntry[] {\n  return allowlist;\n}\n\nfunction defaultPort(scheme: string): number {\n  return scheme === \"https\" ? 443 : 80;\n}\n\n/**\n * Returns the matching allowlist entry for a target URL, or null. Matches on\n * exact scheme + hostname + effective port, plus an optional base-path prefix.\n * This is isomorphic: the server proxy uses it as a hard gate; the client uses\n * it for a consistent pre-flight check (NOT a security boundary on its own).\n */\nexport function matchAllowlistIn(\n  entries: AllowlistEntry[],\n  targetUrl: string,\n): AllowlistEntry | null {\n  let url: URL;\n  try {\n    url = new URL(targetUrl);\n  } catch {\n    return null;\n  }\n  const scheme =\n    url.protocol === \"https:\"\n      ? \"https\"\n      : url.protocol === \"http:\"\n        ? \"http\"\n        : null;\n  if (!scheme) return null;\n  // Reject embedded credentials (userinfo) outright.\n  if (url.username || url.password) return null;\n\n  const host = url.hostname\n    .toLowerCase()\n    .replace(/\\.$/, \"\")\n    .replace(/^\\[|\\]$/g, \"\");\n  const port = url.port ? Number(url.port) : defaultPort(scheme);\n\n  for (const entry of entries) {\n    if (entry.scheme !== scheme) continue;\n    if (entry.host !== host) continue;\n    const entryPort = entry.port ?? defaultPort(entry.scheme);\n    if (entryPort !== port) continue;\n    if (\n      entry.basePath &&\n      url.pathname !== entry.basePath &&\n      !url.pathname.startsWith(entry.basePath + \"/\")\n    ) {\n      continue;\n    }\n    return entry;\n  }\n  return null;\n}\n\nexport function matchAllowlist(targetUrl: string): AllowlistEntry | null {\n  return matchAllowlistIn(allowlist, targetUrl);\n}\n";