import type { AuditContext } from '@cclabsnz/sf-core';
import type { SecurityCheck, CheckResult } from '../SecurityCheck.js';
/**
 * Verifies the PREVENTIVE guardrail that stops the guest-ownership-defeats-OWD
 * exfiltration vector: "Secure guest user record access".
 *
 * This is the policy complement to GuestObjectExposureCheck (which detects the
 * SYMPTOM — guest-owned records readable under a Private OWD). Once "Secure guest
 * user record access" is enforced, guests can no longer be granted record access
 * except via explicit guest user sharing rules, and — paired with "Assign new
 * records created by guest users to the default owner" — guests stop OWNING the
 * records they submit, which is what otherwise nullifies a Private OWD for
 * guest-submitted records (an owner can always read its own records).
 *
 * The enforcement ships as a Salesforce Release Update ("Secure guest user record
 * access", api-visible as a CriticalUpdate). This check reads that update's
 * activation state via the Tooling API and grades:
 *   - update present & IsEnabled = false  => HIGH: guardrail available, NOT activated.
 *   - update present & IsEnabled = true    => pass: guardrail enforced.
 *   - update absent (older orgs where it was auto-activated long ago, or not
 *     surfaced)                            => LOW advisory: confirm the Sharing
 *     Settings checkboxes manually, since the API no longer exposes the toggle.
 * Degrades to inconclusive if guest users or the Tooling API cannot be read.
 */
export declare class GuestRecordAccessPolicyCheck implements SecurityCheck {
    readonly id = "guest-record-access-policy";
    readonly name = "Secure Guest User Record Access";
    readonly category = "Access Control";
    readonly description = "Verifies the \"Secure guest user record access\" enforcement is activated, the guardrail that stops guest-owned records defeating a Private org-wide default";
    private matchesSecureGuestAccess;
    run(ctx: AuditContext): Promise<CheckResult>;
    private inconclusive;
}
//# sourceMappingURL=GuestRecordAccessPolicyCheck.d.ts.map