init({
  // Global bypass list
  allowedDomains: ["localhost", "127.0.0.1"],
  
  // Per-destination rules
  destinationPolicies: [
    // Payment processor - needs credit cards
    {
      domain: "*.stripe.com",
      label: "Payment Processor",
      allowedPiiTypes: ["credit_card", "email"],
    },
    
    // Analytics - never gets sensitive data
    {
      domain: "*.segment.io",
      label: "Analytics",
      blockedPiiTypes: ["ssn", "credit_card", "api_key"],
    },
    
    // Internal API - full bypass
    {
      domain: "api.internal.company.com",
      label: "Internal API",
      bypass: true,
    },
    
    // AI providers - block credentials
    {
      domain: "*.openai.com",
      label: "AI Provider",
      blockedPiiTypes: ["ssn", "credit_card", "api_key", "aws_key"],
    },
  ],
});

init({
  allowedDomains: ["localhost", "api.trusted.com"],
  destinationPolicies: [
    { domain: "*.stripe.com", allowedPiiTypes: ["credit_card"] },
  ],
  blockUnknownDomains: true,
});

// Requests to unknown domains throw BorderBlockedError
try {
  await fetch("https://unknown.com/api", { body: sensitiveData });
} catch (e) {
  if (e.name === "BorderBlockedError") {
    console.log("Request blocked: unknown domain");
  }
}

import { getDomainPolicy, shouldBlockRequest } from "@dotsetlabs/border";

const policy = getPolicy();

// Check what would happen for a URL
const result = getDomainPolicy("https://api.stripe.com/v1/charges", policy);
console.log(result.isAllowed);      // false (has specific rules)
console.log(result.allowedTypes);   // Set { "credit_card", "email" }

// Check if a request would be blocked
const blocked = shouldBlockRequest("https://unknown.com", policy);