"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.EXTERNAL_CONNECTION_DEFAULTS = exports.FORBIDDEN_CUSTOM_HEADER_NAMES = exports.CUSTOM_HEADER_LIMITS = exports.EXTERNAL_CONNECTION_METHODS = void 0;
/** HTTP methods an admin can opt a connection into. Single source of truth for
 *  the backend validation allowlist and the frontend method pickers. */
exports.EXTERNAL_CONNECTION_METHODS = [
    'GET',
    'POST',
    'PUT',
    'PATCH',
    'DELETE',
];
/** Bounds for a connection's custom request headers — shared by backend
 *  validation and the frontend form so both reject the same shapes. */
exports.CUSTOM_HEADER_LIMITS = {
    maxCount: 20,
    maxNameChars: 128,
    maxValueChars: 1024,
};
/** Header names custom request headers may never use: routing/framing headers
 *  the proxy owns, plus credential-shaped names — header values are plaintext
 *  config returned by the read API, so secrets belong in the encrypted secret. */
exports.FORBIDDEN_CUSTOM_HEADER_NAMES = [
    'host',
    'content-length',
    'content-type',
    'connection',
    'transfer-encoding',
    'te',
    'trailer',
    'upgrade',
    'keep-alive',
    'expect',
    'authorization',
    'proxy-authorization',
    'proxy-connection',
    'cookie',
    'x-api-key',
    'api-key',
    'x-auth-token',
    'x-access-token',
];
/** Server-applied defaults for the optional numeric limits. */
exports.EXTERNAL_CONNECTION_DEFAULTS = {
    responseMaxBytes: 1048576,
    requestMaxBytes: 262144,
    timeoutMs: 10000,
};
//# sourceMappingURL=types.js.map