import type { AuditContext } from '@cclabsnz/sf-core';
import type { SecurityCheck, CheckResult } from '../SecurityCheck.js';
/**
 * Flags guest (unauthenticated) users whose profile/permission-sets grant API or
 * Bulk API access. The other guest checks cover the UI-API/GraphQL vector; this
 * covers the *programmatic* one: a guest with "API Enabled" can drive the REST/SOAP/
 * Bulk API directly, turning any readable object into a scriptable bulk pull, and
 * "Bulk API Hard Delete" additionally lets an anonymous caller permanently destroy
 * records (bypassing the recycle bin).
 */
export declare class GuestApiAccessCheck implements SecurityCheck {
    readonly id = "guest-api-access";
    readonly name = "Guest API & Bulk Access";
    readonly category = "Access Control";
    readonly description = "Flags guest users granted API Enabled or Bulk API Hard Delete \u2014 programmatic bulk read/delete access for unauthenticated visitors";
    run(ctx: AuditContext): Promise<CheckResult>;
    private inconclusive;
}
//# sourceMappingURL=GuestApiAccessCheck.d.ts.map