import type { AuditContext } from '@cclabsnz/sf-core';
import type { SecurityCheck, CheckResult } from '../SecurityCheck.js';
/**
 * Reviews External Credentials (the modern auth half of Named Credentials) for
 * weak authentication. Complements `named-credentials` (which inventories the
 * endpoints) by grading HOW the org authenticates to them: a credential with no
 * authentication, or a hand-rolled custom scheme, is a soft target for spoofing
 * the remote system or leaking a static secret.
 */
export declare class ExternalCredentialsCheck implements SecurityCheck {
    readonly id = "external-credentials";
    readonly name = "External Credential Authentication";
    readonly category = "External Connectivity";
    readonly description = "Grades External Credential authentication protocols, flagging callouts that use no authentication or a custom (non-standard) scheme";
    run(ctx: AuditContext): Promise<CheckResult>;
}
//# sourceMappingURL=ExternalCredentialsCheck.d.ts.map