Host Tuple Validator (vendorsurface/hosts.go)

Validates, expands and matches host scheme/host/port tuples against allowed egress policies, ensuring only declared host configurations are used.

// Source: https://github.com/superbasedapp/observer | License: Apache-2.0 | Copyright 2026 Gaja AI
// Provided via justclaw.it.com; keep this notice with the code.
package vendorsurface

import (
	"fmt"
	"net"
	"regexp"
	"strconv"
	"strings"
)

// HostTuple is one exact (scheme, host, port) a surface's operations may be
// sent to (plan 6.2: one URL policy, exact scheme, host and port tuple from
// the surface). The egress seam allows a request only to a tuple the catalog
// row declares; a connection may pick one of them (a residency variant) but
// never add one.
type HostTuple struct {
	Scheme string `json:"scheme"`
	Host   string `json:"host"`
	Port   int    `json:"port"`
}

// String renders the tuple as scheme://host:port.
func (h HostTuple) String() string {
	return h.Scheme + "://

... (truncated -- full source via MCP)