import type { AuditContext } from '@cclabsnz/sf-core';
import type { SecurityCheck, CheckResult } from '../SecurityCheck.js';
/** Queryable on OauthToken and permanently excluded: an audit report must not carry credentials. */
export declare const NEVER_SELECT: readonly ['AccessToken', 'RequestToken', 'DeleteToken'];
export declare class OauthTokenInventoryCheck implements SecurityCheck {
    readonly id = "oauth-token-inventory";
    readonly name = "Standing OAuth Token Inventory";
    readonly category = "App Security";
    readonly description = "Inventories live OAuth tokens per app: a standing refresh token grants API access without any new login";
    readonly dependsOnCache: readonly ['connectedAppNames'];
    run(ctx: AuditContext): Promise<CheckResult>;
    private inconclusive;
}
//# sourceMappingURL=OauthTokenInventoryCheck.d.ts.map