import type { AuditContext } from '@cclabsnz/sf-core';
import type { SecurityCheck, CheckResult } from '../SecurityCheck.js';
/**
 * Re-slices the Health Check risk set (populated by HealthCheckCheck, so no extra
 * API call) to the session / clickjack / CSRF / XSS hardening domain and gives
 * targeted, per-setting remediation. HealthCheckCheck reports a flat count; this
 * check tells you *which* browser-session protections deviate from Salesforce's
 * baseline and how to fix each — the "enable secure config" surface.
 */
export declare class SessionHardeningCheck implements SecurityCheck {
    readonly id = "session-hardening";
    readonly name = "Session & Clickjack Hardening";
    readonly category = "Session Security";
    readonly description = "Grades clickjack, CSRF, session-lock, and XSS-protection settings from Health Check and gives per-setting remediation";
    readonly dependsOnCache: readonly ['healthCheckRisks'];
    run(ctx: AuditContext): Promise<CheckResult>;
    private static readonly FLAGS;
    /** Authoritative evaluation from SecuritySettings metadata; null → fall back to the cache path. */
    private evaluateFromMetadata;
}
//# sourceMappingURL=SessionHardeningCheck.d.ts.map