import type { AuditContext } from '@cclabsnz/sf-core';
import type { SecurityCheck, CheckResult } from '../SecurityCheck.js';
/**
 * Complements `failed-login-detection` (which only sees failures) by looking at
 * SUCCESSFUL logins for a compromise signature: one user authenticating from an
 * unusually large number of distinct source IPs in a short window — the footprint
 * of credential sharing, a leaked token replayed from many egress nodes, or an
 * account being driven from attacker infrastructure.
 */
export declare class LoginAnomalyCheck implements SecurityCheck {
    readonly id = "login-anomaly";
    readonly name = "Anomalous Successful Logins";
    readonly category = "Threat Detection";
    readonly description = "Flags user accounts with successful logins from an unusually high number of distinct source IPs (credential-sharing / account-compromise signature)";
    run(ctx: AuditContext): Promise<CheckResult>;
}
//# sourceMappingURL=LoginAnomalyCheck.d.ts.map