import type { AuditContext } from '@cclabsnz/sf-core';
import type { SecurityCheck, CheckResult } from '../SecurityCheck.js';
export declare class GuestTrafficAnomalyCheck implements SecurityCheck {
    readonly id = "guest-traffic-anomaly";
    readonly name = "Guest Traffic Anomaly";
    readonly category = "Threat Detection";
    readonly description = "Scans recent EventLogFile guest requests for anonymizer/hosting source IPs, single-IP bursts, and GraphQL totalCount reconnaissance sweeps";
    readonly dependsOnCache: readonly ['eventLogSummary'];
    run(ctx: AuditContext): Promise<CheckResult>;
    /** Parse an EventLogFile CSV, pushing guest-attributed rows into `out`. */
    private parseGuestRows;
    /** Minimal RFC-4180-ish CSV parser (handles quoted fields and embedded commas/quotes). */
    private parseCsv;
    private isHostingOrAnonymizer;
    /** Object name from a UI-API GraphQL body: `uiapi { query { <Entity> ... } }`. */
    private extractEntity;
    private inconclusive;
    /** Blind spot: EventLogFile unreadable — distinguishes "not enabled" from "no permission". */
    private accessBlind;
    /** Event Monitoring readable, but no guest blobs in the (short) retention window. */
    private noLogs;
}
//# sourceMappingURL=GuestTrafficAnomalyCheck.d.ts.map