/**
 * B4n1Web SecurityShield — URL security validation with in-memory cache.
 *
 * SecurityShield provides URL safety checking for agentic browser navigation.
 *
 * API:
 *   new SecurityShield({ dbPath?, cacheDays? })
 *   shield.isUrlSafe(url)        → { isSafe: boolean, needsApiCheck: boolean }
 *   shield.markDomain(domain, isSafe)
 *   shield.clearCache()
 */
import type { SecurityShieldOptions, SecurityCheckResult } from './types';
export declare class SecurityShield {
    private cacheDays;
    private cache;
    /**
     * Create a SecurityShield instance.
     * @param opts - Optional configuration
     * @param opts.cacheDays - TTL of a cached result in days (default 7)
     */
    constructor(opts?: SecurityShieldOptions);
    /**
     * Check whether a URL is safe to navigate.
     *
     * @param rawURL - The URL to check.
     * @returns `{ isSafe, needsApiCheck }`
     *   isSafe         — `true` if the domain is not blacklisted.
     *   needsApiCheck  — `false` when the result was previously cached.
     *
     * @example
     *   const { isSafe, needsApiCheck } = shield.isUrlSafe('https://unknown.com');
     *   // → isSafe=true, needsApiCheck=true  (unknown domain, needs screening)
     *
     *   shield.markDomain('evil.com', false);
     *   shield.isUrlSafe('https://evil.com');
     *   // → isSafe=false, needsApiCheck=false (explicitly blacklisted)
     */
    isUrlSafe(rawURL: string): SecurityCheckResult;
    /**
     * Explicitly mark a domain as safe (whitelist) or unsafe (blacklist).
     * Overwrites any previous entry and resets the TTL timer.
     *
     * @param domain  - The domain to mark, e.g. `"example.com"`
     * @param isSafe  - `true` to whitelist, `false` to blacklist
     *
     * @example
     *   shield.markDomain('trusted.com', true);   // always allow
     *   shield.markDomain('malware.com', false);  // always block
     */
    markDomain(domain: string, isSafe: boolean): void;
    /**
     * Remove all cached domain entries.
     * After clearing, every next `isUrlSafe()` call for a previously-known domain
     * will return `needsApiCheck=true` again.
     */
    clearCache(): void;
    /**
     * Extract the hostname from a URL string.
     * Returns `''` for invalid / missing URLs.
     * @internal — exposed for testing as `extractDomain`.
     */
    extractDomain(rawURL: string): string | null;
    private _extractHost;
}
//# sourceMappingURL=security.d.ts.map