export type Severity = "LOW" | "MEDIUM" | "HIGH" | "CRITICAL";
export type ActionMode = "enforce" | "notify-only" | "dry-run";
export type SignalMode = "observed" | "synthetic";
export type Channel = "telemetry" | "alert" | "action" | "health";
export type SensitiveSurfaceKind = "route" | "api" | "export" | "record" | "job";
export type ThreatReason = "bulk_sensitive_access" | "export_burst" | "honeypot_access" | "honey_record_access" | "session_ip_drift" | "session_device_drift" | "session_browser_drift" | "impossible_travel" | "sensitive_route_fanout" | "token_reuse" | "suspicious_download" | "admin_route_sweep" | "elevated_failure_rate" | "client_tampering" | "bot_behavior_detected" | "active_honeytoken_accessed" | "manual_containment_request";
export type PolicyActionType = "block_ip" | "revoke_session" | "step_up_mfa" | "mark_session_high_risk" | "freeze_session" | "cancel_export_jobs" | "disable_exports" | "throttle_actor" | "quarantine_account" | "elevated_monitoring" | "notify_admin" | "notify_webhook" | "analyst_review" | "unblock_ip";
export interface AdminRouteMatcher {
    patterns?: string[];
    matcherName?: string;
}
export interface AdminContext {
    enabled: boolean;
    routeMatcher?: AdminRouteMatcher;
    userId?: string;
    role?: string;
    sessionId?: string;
    email?: string;
}
export interface DashboardConfig {
    mode?: "embedded" | "hosted" | "both";
    embedPath?: string;
    hostedUrl?: string;
    title?: string;
}
export interface PrivacyConfig {
    metadataOnly?: boolean;
    redactQueryParams?: boolean;
    redactUserAgent?: boolean;
    allowPayloadCapture?: boolean;
}
export interface IntegrationTarget {
    name: string;
    type: "waf" | "proxy" | "firewall" | "internal_api" | "webhook";
    endpoint: string;
    token?: string;
    enabled?: boolean;
}
export interface SensitiveResource {
    id: string;
    path: string;
    kind: SensitiveSurfaceKind;
    sensitivity: "low" | "medium" | "high";
    tags?: string[];
    honey?: boolean;
}
export interface PolicyCondition {
    field: string;
    operator: "eq" | "neq" | "contains" | "gt" | "lt" | "in" | "contains_any";
    value: string | number | boolean | string[];
}
export interface PolicyRule {
    id: string;
    name: string;
    priority: number;
    conditions: PolicyCondition[];
    actions: PolicyActionType[];
    expiresInMs?: number;
}
export interface ResponsePolicy {
    mode: ActionMode;
    allowlistedIps: string[];
    trustedVpnIps: string[];
    cooldownMs: number;
    dedupWindowMs: number;
    highConfidenceThreshold: number;
    criticalConfidenceThreshold: number;
    enableIpBlock: boolean;
    enableStepUpMfa: boolean;
    enableTokenRevoke: boolean;
    enableSessionFreeze: boolean;
    enableExportKill: boolean;
    enablePrivilegeDowngrade: boolean;
    enableAnalystReview: boolean;
    enableNotifications: boolean;
    targets: IntegrationTarget[];
    rules?: PolicyRule[];
}
export interface DetectionConfig {
    enableHoneyRoutes: boolean;
    enableHoneyRecords: boolean;
    exfilWindowMs: number;
    sensitiveBurstThreshold: number;
    exportBurstThreshold: number;
    suspiciousDownloadBytes: number;
    routeFanoutThreshold: number;
    impossibleTravelVelocityKph: number;
}
export interface TelemetryActor {
    userId: string;
    role?: string;
    email?: string;
    sessionId?: string;
}
export interface TelemetryNetwork {
    sourceIp?: string;
    forwardedFor?: string[];
    country?: string;
    region?: string;
    city?: string;
    asn?: string;
    latitude?: number;
    longitude?: number;
}
export interface TelemetryClient {
    deviceFingerprint?: string;
    browserFingerprint?: string;
    userAgent?: string;
    headless?: boolean;
    tamperDetected?: boolean;
    botLikelihood?: number;
}
export interface TelemetryMetrics {
    bytesTransferred?: number;
    rowCount?: number;
    durationMs?: number;
    failureCount?: number;
    successCount?: number;
}
export interface TelemetryContext {
    siteKey: string;
    tenantId: string;
    admin?: AdminContext;
    route?: string;
    referrer?: string;
    routeTags?: string[];
    resourceId?: string;
    resourceKind?: SensitiveSurfaceKind;
    sensitive?: boolean;
    honey?: boolean;
    honeyTokenId?: string;
    exportJobId?: string;
}
export interface TelemetryEvent {
    id: string;
    timestamp: string;
    mode: SignalMode;
    type: string;
    action?: string;
    source: "sdk" | "connector" | "backend" | "manual";
    actor: TelemetryActor;
    network: TelemetryNetwork;
    client: TelemetryClient;
    metrics?: TelemetryMetrics;
    context: TelemetryContext;
    details?: Record<string, unknown>;
}
export interface TelemetryEnvelope {
    schemaVersion: string;
    sentAt: string;
    siteKey: string;
    signature?: string;
    events: TelemetryEvent[];
}
export interface RiskSignal {
    reason: ThreatReason;
    score: number;
    evidence: string[];
}
export interface ThreatAlert {
    alertId: string;
    correlationId: string;
    createdAt: string;
    updatedAt: string;
    siteKey: string;
    tenantId: string;
    severity: Severity;
    confidence: number;
    riskScore: number;
    sourceIp?: string;
    actor: TelemetryActor;
    reasons: ThreatReason[];
    signals: RiskSignal[];
    evidence: string[];
    eventIds: string[];
    sessionState: SessionRiskState;
    responseState: "pending" | "executed" | "dry-run" | "notify-only" | "failed";
    containmentRequested?: boolean;
}
export interface PolicyAction {
    actionId: string;
    alertId: string;
    type: PolicyActionType;
    mode: ActionMode;
    status: "requested" | "executed" | "blocked" | "failed" | "rolled_back";
    target?: string;
    targetType?: string;
    createdAt: string;
    completedAt?: string;
    reason: string;
    evidence: string[];
    expiresInMs?: number;
    rollbackActionId?: string;
    error?: string;
    metadata?: Record<string, unknown>;
}
export interface ActionExecutionResult {
    actions: PolicyAction[];
    primaryAction?: PolicyAction;
}
export interface AnalystFeedback {
    id: string;
    alertId: string;
    label: "true_positive" | "false_positive" | "needs_review";
    notes?: string;
    createdAt: string;
    analyst: string;
}
export interface SessionRiskState {
    sessionId?: string;
    currentIp?: string;
    currentRoute?: string;
    adminRole?: string;
    riskScore: number;
    riskLevel: Severity;
    flags: string[];
    lastSeenAt: string;
}
export interface EvidencePacket {
    generatedAt: string;
    alert: ThreatAlert;
    actions: PolicyAction[];
    relatedEvents: TelemetryEvent[];
    feedback: AnalystFeedback[];
}
export interface HealthSnapshot {
    status: "ok" | "degraded";
    streamLagMs: number;
    alertsOpen: number;
    actionsExecuted: number;
    lastEventAt?: string;
}
export interface DashboardSnapshot {
    alerts: ThreatAlert[];
    actions: PolicyAction[];
    health: HealthSnapshot;
}
export interface AdminSessionContext {
    userId: string;
    sessionId: string;
    email?: string;
    role?: string;
    route?: string;
}
export interface ContainmentRequest {
    alertId?: string;
    reason: string;
    actor: TelemetryActor;
    sourceIp?: string;
    requestedActions?: PolicyActionType[];
    metadata?: Record<string, unknown>;
}
export interface StorageAdapter {
    putEvent(event: TelemetryEvent): Promise<void>;
    putAlert(alert: ThreatAlert): Promise<void>;
    putAction(action: PolicyAction): Promise<void>;
    getAlert(alertId: string): Promise<ThreatAlert | null>;
    listAlerts(opts?: {
        limit?: number;
        offset?: number;
        severity?: Severity;
    }): Promise<ThreatAlert[]>;
    listActions(opts?: {
        limit?: number;
        alertId?: string;
    }): Promise<PolicyAction[]>;
    getDetectionWindow(key: string): Promise<any | null>;
    putDetectionWindow(key: string, state: any): Promise<void>;
    putFeedback(feedback: AnalystFeedback): Promise<void>;
    getFeedback(alertId: string): Promise<AnalystFeedback[]>;
    getEventsByIds(ids: string[]): Promise<TelemetryEvent[]>;
}
export interface EventBus {
    publish(channel: Channel, payload: unknown): void;
    subscribe(channel: Channel, handler: (payload: unknown) => void): () => void;
}
//# sourceMappingURL=contracts.d.ts.map