import type { AuditContext } from '@cclabsnz/sf-core';
import type { SecurityCheck, CheckResult } from '../SecurityCheck.js';
/**
 * Detects every object an unauthenticated guest can READ IN BULK. Unlike
 * GuestUserAccessCheck (a fixed list of standard objects + sharing rules), this
 * auto-discovers ALL objects the guest profile/permission-sets can read, then
 * decides whether records are actually reachable:
 *   - public external OWD (Read/ReadWrite) => every record is readable, OR
 *   - Private OWD but the guest OWNS records (public-form submissions) => those
 *     records are still readable, because an owner can always read its own records.
 *
 * Sharing-model readability is necessary but not sufficient: the Experience Cloud
 * UI API (GraphQL) can only return objects it MODELS. Objects like Calendar,
 * AuthSession, or OauthToken can be readable in the sharing model yet fail the UI
 * API `object-info` endpoint, so they are NOT reachable through the guest GraphQL
 * vector. This check therefore probes `object-info` per exposed object and grades:
 *   - Tier 1 (CRITICAL): sharing-readable AND UI-API-modeled  => actually pullable.
 *   - Tier 2 (MEDIUM):   sharing-readable but NOT UI-API-modeled => defense-in-depth
 *     only (remove the grant, but it is not the bulk-exfiltration vector).
 * Where a live record exists, UserRecordAccess is queried as ground-truth read
 * confirmation and surfaced in the finding evidence.
 */
export declare class GuestObjectExposureCheck implements SecurityCheck {
    readonly id = "guest-object-exposure";
    readonly name = "Guest Object Exposure (Bulk Read via UI API)";
    readonly category = "Access Control";
    readonly description = "Auto-discovers every object an unauthenticated guest can read in bulk via the UI API (GraphQL), including records exposed by guest ownership despite a Private org-wide default";
    run(ctx: AuditContext): Promise<CheckResult>;
    /**
     * Probes the UI API `object-info` endpoint. Returns true if the object is
     * modelled (reachable via executeGraphQL), false if the endpoint reports it is
     * not modelled, or null if the probe could not be performed at all.
     */
    private isUiApiModeled;
    /**
     * Ground-truth read confirmation via UserRecordAccess for a single sample
     * record. Returns null when there is no record to test or the probe fails.
     */
    private confirmGuestRead;
    private evidenceNote;
    private ok;
    private inconclusive;
}
//# sourceMappingURL=GuestObjectExposureCheck.d.ts.map