import type { AuditEvent } from "./types.js";
export declare const OCSF_SCHEMA_VERSION = "1.9.0";
/** OCSF `activity_id`: 1 Create, 2 Read, 3 Update, 4 Delete, 99 Other. */
type OcsfActivityId = 1 | 2 | 3 | 4 | 99;
export interface OcsfApiActivity {
    class_uid: 6003;
    class_name: "API Activity";
    category_uid: 6;
    category_name: "Application Activity";
    activity_id: OcsfActivityId;
    activity_name: string;
    type_uid: number;
    type_name: string;
    /** Epoch milliseconds. */
    time: number;
    severity_id: 1 | 2 | 3;
    severity: "Informational" | "Low" | "Medium";
    status_id: 1 | 2;
    status: "Success" | "Failure";
    status_code?: string;
    status_detail?: string;
    /** 1 Allowed, 2 Denied. */
    action_id: 1 | 2;
    action: "Allowed" | "Denied";
    message: string;
    metadata: {
        version: string;
        uid: string;
        log_name: string;
        tenant_uid?: string;
        product: {
            name: string;
            vendor_name: string;
            uid?: string;
        };
    };
    actor: {
        user: {
            uid?: string;
            name: string;
            email_addr?: string;
            /** 1 User, 3 System, 4 Service. */
            type_id: 1 | 3 | 4;
            type: "User" | "System" | "Service";
        };
        session?: {
            uid: string;
        };
    };
    api: {
        operation: string;
        service?: {
            name: string;
        };
    };
    src_endpoint: {
        name: string;
        uid?: string;
    };
    resources?: Array<{
        type?: string;
        uid?: string;
        owner?: {
            email_addr: string;
        };
    }>;
    unmapped: Record<string, string>;
}
export declare function auditEventToOcsf(event: AuditEvent): OcsfApiActivity;
export {};