import type { AuditContext } from '@cclabsnz/sf-core';
export type IntegrationSignal = 'integration-license' | 'connected-app-run-as' | 'scheduled-job-owner' | 'never-logged-in' | 'api-only-login' | 'username-pattern';
export interface IntegrationAccount {
    id: string;
    username: string;
    profileName: string;
    lastLoginDate: string | null;
    signals: IntegrationSignal[];
}
export interface ResolveResult {
    accounts: IntegrationAccount[];
    /** Signals that could not be gathered. Findings must disclose these. */
    degraded: IntegrationSignal[];
    /** True when the candidate query itself failed: callers go inconclusive. */
    unavailable: boolean;
    /**
     * True when the candidate query returned exactly its row limit, so the org may hold further
     * integration accounts this run never saw. Any finding that counts or lists accounts must
     * disclose it: SBS-ACS-007 asks for *all* non-human identities, and a truncated list that
     * reads as complete is the wrong answer to that control.
     */
    truncated: boolean;
}
/**
 * Username segments that strongly indicate a service/integration account. Moved here from
 * IntegrationUsersCheck so there is one definition rather than two that drift.
 */
export declare const SERVICE_LIKE_CLAUSES: string[];
/**
 * The sentence findings use to disclose a truncated account set. Defined here, next to the limit
 * it describes, so the two checks cannot state different numbers.
 */
export declare function truncationDisclosure(truncated: boolean): string;
export declare function resolveIntegrationAccounts(ctx: AuditContext): Promise<ResolveResult>;
//# sourceMappingURL=integrationAccounts.d.ts.map