/**
 * SQLite CRUD for custom firewall rules (Pro feature).
 */
export interface FirewallRule {
    id: number;
    name: string;
    priority: number;
    condition_type: string;
    condition_value: string;
    action: 'block' | 'allow' | 'quarantine';
    enabled: number;
    built_in: number;
    created_at: string;
}
export declare function listFirewallRules(opts?: {
    includeBuiltin?: boolean;
}): FirewallRule[];
export declare function getFirewallRule(id: number): FirewallRule | undefined;
export declare function createFirewallRule(rule: {
    name: string;
    priority: number;
    condition_type: string;
    condition_value: string;
    action: 'block' | 'allow' | 'quarantine';
}): FirewallRule;
export declare function updateFirewallRule(id: number, updates: Partial<{
    name: string;
    priority: number;
    condition_type: string;
    condition_value: string;
    action: 'block' | 'allow' | 'quarantine';
    enabled: number;
}>): FirewallRule | undefined;
export declare function deleteFirewallRule(id: number): boolean;
/**
 * Get all enabled rules sorted by priority (used by the defence pipeline).
 */
export declare function getEnabledFirewallRules(): FirewallRule[];
/**
 * Evaluate a single firewall rule against candidate text(s), honouring the
 * rule's `condition_type`. This is the single source of truth for rule
 * matching — the defence pipeline calls it for every enabled rule.
 *
 * - `keyword`: case-insensitive LITERAL substring match. Regex metacharacters
 *   in the value (`a.b`, `x+y`) are treated literally, not as a pattern.
 * - `domain`: the value is matched as a host/domain. It matches when the value
 *   appears as a hostname (or a suffix of one, so `evil.com` matches
 *   `api.evil.com`) anywhere in the text, including inside a URL.
 * - `regex` (and any unknown type): compiled as a case-insensitive RegExp.
 *   Invalid patterns never match (returns false) rather than throwing.
 *
 * `condition_value` is assumed to have already been vetted by safe-regex2 at
 * creation time for regex rules (see createFirewallRule callers); we still
 * guard compilation here so a malformed stored value can't crash the pipeline.
 */
export declare function ruleMatches(rule: Pick<FirewallRule, 'condition_type' | 'condition_value'>, ...texts: Array<string | undefined | null>): boolean;
