/**
 * Domain allowlist filtering — shared by HTTP and SOCKS5 proxies.
 *
 * Pure functions: no I/O, no state. The caller owns the allowlist Set.
 */
/** Domains that are always allowed without prompting. */
const ALWAYS_ALLOWED = new Set(['localhost', '127.0.0.1', '::1']);
/** Normalize a domain for comparison: lowercase, strip trailing dots. */
export function normalizeDomain(domain) {
    return domain.toLowerCase().replace(/\.+$/, '');
}
/** Check if a domain matches the allowlist (exact or wildcard). */
export function isDomainAllowed(domain, allowed) {
    const normalized = normalizeDomain(domain);
    if (ALWAYS_ALLOWED.has(normalized))
        return true;
    if (allowed.has(normalized))
        return true;
    for (const pattern of allowed) {
        if (pattern.startsWith('*.')) {
            const suffix = pattern.slice(1); // .github.com
            if (normalized.endsWith(suffix) || normalized === pattern.slice(2)) {
                return true;
            }
        }
    }
    return false;
}
//# sourceMappingURL=domain-filter.js.map