is
Returns true when url targets a Portal-owned host (or a local Portal API).
Guards two boundaries, both of which depend on the match being anchored to the parsed hostname: the X-Portal-Trace-Id header, which must not leak to third-party calls (e.g. Google Drive, CryptoCompare), and — through Provider.isPortalRpcUrl — the Authorization bearer on RPC gateway URLs, which carries either a Client API Key or an end user's Client Auth session token. An RPC gateway is the one credential-bearing target the host app picks freely, per chain, from values it may have taken from a dApp.
Deliberately not the gate on the hosts the SDK is configured with — apiHost, mpcHost, webSocketHost, tbsHost, enclaveApiHost. Those are Portal endpoints by definition of the configuration, and a self-hosted gateway under a custodian's own domain is a host the token really was handed to; a 401 from one means the token is dead, not that it went somewhere it should not have. See PortalRequests.onUnauthorized.
Parameters
Whether LOCAL_DEVELOPMENT_HOSTS count as Portal-owned. true is right for the trace header — a stray trace ID on a loopback request harms nothing. Pass false wherever a credential is at stake and the host alone cannot settle it: a developer's Anvil or Hardhat node shares localhost/10.0.2.2 with a local Portal API, and only the port distinguishes them. See Provider.isPortalRpcUrl.
@JvmOverloads keeps the one-argument JVM signature this function had before the flag existed: a Kotlin default argument is a source-level convenience only, so without it an already-compiled caller of isPortalOwnedUrl(url) fails with NoSuchMethodError.