import type { AuditContext } from '@cclabsnz/sf-core';
import type { SecurityCheck, CheckResult } from '../SecurityCheck.js';
/**
 * Cross-references data classification against ACTUAL field encryption. `data-
 * classification` confirms Shield is licensed and that fields are classified;
 * this check answers the next question: are the fields marked sensitive (PII/PHI
 * via ComplianceGroup) actually encrypted at rest? Classified-but-plaintext
 * fields are the gap that matters for a health/PII org — the data is labelled
 * sensitive yet stored in the clear.
 */
export declare class EncryptionCoverageCheck implements SecurityCheck {
    readonly id = "encryption-coverage";
    readonly name = "Encryption Coverage for Sensitive Fields";
    readonly category = "Data Security";
    readonly description = "Flags fields classified as sensitive (PII/PHI via ComplianceGroup) that are not encrypted at rest with Shield Platform Encryption";
    run(ctx: AuditContext): Promise<CheckResult>;
    private inconclusive;
}
//# sourceMappingURL=EncryptionCoverageCheck.d.ts.map