import type { AuditContext } from '@cclabsnz/sf-core';
import type { SecurityCheck, CheckResult } from '../SecurityCheck.js';
export declare class IntegrationLeastPrivilegeCheck implements SecurityCheck {
    readonly id = "integration-least-privilege";
    readonly name = "Integration Account Least Privilege";
    readonly category = "Permissions";
    readonly description = "Reports permissions held by integration and service accounts that the account is not using \u2014 escalation-grade permissions, bulk-data permissions, and standing-credential settings";
    run(ctx: AuditContext): Promise<CheckResult>;
    /** The degraded-signal qualification, agreeing in number with what was actually degraded. */
    private degradedNote;
    /**
     * Whether the audit user itself can see every record in the org, which is what makes the write
     * probe conclusive (see WRITE_VISIBILITY_CAVEAT).
     *
     * `AuditContext` carries the org, not the running user, and there is no SOQL expression for
     * "the current user". The Connect API's `/chatter/users/me` is the one identity resource reachable
     * through the existing read-only REST client; orgs with Chatter disabled, or any unexpected
     * response, resolve as unknown. Every failure path returns a non-conclusive answer, so the worst
     * outcome is that write evidence is reported as ungathered — never that it is reported as clean.
     */
    private recordVisibility;
    /**
     * Assignees of each granting permission set that are NOT in the resolved integration set.
     *
     * A grant reached through a profile, or through an org-wide permission set, is held by everyone
     * assigned to it. "Remove this object permission" is safe advice on a dedicated integration set
     * and destructive on a shared one, so the finding has to say which it is. Null when the count
     * could not be established — an unknown breadth is reported as unknown, not as exclusive.
     */
    private assigneesOutsideSet;
    /** Names the profile or permission set that grants write on `object`, and how widely it is held. */
    private grantPathNote;
    /**
     * True if the account wrote any record of this object, false if none, null if unprobeable.
     * Null must never be read as false — an object we could not query is not an unused grant.
     */
    private hasEverWritten;
    /** Emits one finding for a permission class, or nothing when the class has no grants. */
    private emit;
    private inconclusive;
}
//# sourceMappingURL=IntegrationLeastPrivilegeCheck.d.ts.map