/**
 * public-suffix.ts, the registrable domain (eTLD+1) of a host.
 *
 * ── Why this exists rather than a string comparison ───────────────────────
 *
 * Every naive host check fails to a real attack:
 *
 *   `endsWith('google.com')`      passes `google.com.evil.example`
 *   `includes('google.com')`      passes `google.com.evil.example`
 *   split on the last two labels  gets `co.uk` wrong for `bbc.co.uk`
 *
 * The only correct comparison is on the REGISTRABLE domain, the label
 * immediately below the public suffix, because that is the unit somebody had
 * to buy. `google.com.evil.example` is registrable-domain `evil.example`, and
 * so it fails against `google.com` for the right reason rather than by luck.
 *
 * ── The data, and how it stays current ────────────────────────────────────
 *
 * This is a BUNDLED SNAPSHOT of the ICANN section of Mozilla's Public Suffix
 * List, reduced to the rules that matter for the comparison this module
 * performs: the multi-label suffixes. A single-label suffix (`com`, `dev`,
 * `app`, any new gTLD) needs no rule, the fallback treats one label as the
 * suffix, which is correct for all of them.
 *
 * That fallback is what makes the snapshot safe to be slightly stale: an
 * unknown NEW suffix degrades to the single-label rule. The failure that
 * matters is the opposite direction, a multi-label suffix we do not know
 * about, e.g. a newly delegated `something.xx`, would make two distinct
 * registrants compare equal. So the list must be refreshed, and refreshing it
 * is a data change with no code change:
 *
 *   curl -s https://publicsuffix.org/list/public_suffix_list.dat
 *
 * take the ICANN DOMAINS section, keep the rules containing a dot plus the
 * wildcard and exception rules, and replace the tables below. A test pins the
 * cases that motivated each group, so a bad refresh fails rather than silently
 * widening what compares equal.
 */
/**
 * The bundled snapshot, for the drift check.
 *
 * Exported so `scripts/check-public-suffix-drift.ts` compares against the data
 * this module actually uses, a drift check holding its own copy of what it is
 * checking would pass forever.
 */
export declare function bundledMultiLabelSuffixes(): ReadonlySet<string>;
/** The wildcard-parent rules in the snapshot. See the header. */
export declare function bundledWildcardSuffixParents(): readonly string[];
/** True when `host` is itself exactly a public suffix (so it has no registrant). */
export declare function isPublicSuffix(host: string): boolean;
/**
 * The registrable domain of `host`, the label immediately below its public
 * suffix, or `null` when the host has none (it IS a suffix, or is a single
 * label, or is malformed).
 *
 * `null` is a refusal, never a fallback to the whole host: a caller that
 * treated an unparseable host as its own registrable domain would compare
 * equal to itself and let a malformed host through.
 */
export declare function registrableDomain(host: string): string | null;
/** True when both hosts sit under the same registrable domain. */
export declare function sameRegistrableDomain(left: string, right: string): boolean;
//# sourceMappingURL=public-suffix.d.ts.map