import type { AuditContext } from '@cclabsnz/sf-core';
import type { SecurityCheck, CheckResult } from '../SecurityCheck.js';
export declare class TrustedUrlHygieneCheck implements SecurityCheck {
    readonly id = "trusted-url-hygiene";
    readonly name = "Trusted URL Hygiene";
    readonly category = "AI & Agents";
    readonly description = "Reviews the CSP trusted-sites allowlist for non-Salesforce domains that could be repurposed as data-exfiltration channels (the ForcedLeak pattern). With --resolve-domains, DNS-checks each domain for unresolvable or parked entries.";
    readonly dependsOnCache: readonly ['cspTrustedSites'];
    run(ctx: AuditContext): Promise<CheckResult>;
    private reviewFinding;
    private unresolvableFinding;
    private parkedFinding;
    private unverifiableFinding;
}
export declare function extractDomain(endpoint: string): string | null;
//# sourceMappingURL=TrustedUrlHygieneCheck.d.ts.map