import type { DetectionConfig, SessionRiskState, TelemetryEvent, ThreatAlert } from "./contracts.js";
export interface DetectionWindowState {
    siteKey: string;
    tenantId: string;
    actorId: string;
    windowStartedAt?: string;
    lastSeenAt: string;
    recentRoutes: string[];
    recentSensitiveCount: number;
    exportCount: number;
    exportBytes: number;
    lastIp?: string;
    lastRegion?: string;
    lastLat?: number;
    lastLon?: number;
    lastDeviceFingerprint?: string;
    lastBrowserFingerprint?: string;
    failureCount: number;
}
export interface DetectionResult {
    shouldAlert: boolean;
    alert?: ThreatAlert;
    sessionState: SessionRiskState;
}
export declare function createDefaultDetectionConfig(): DetectionConfig;
export declare function evaluateThreat(event: TelemetryEvent, state: DetectionWindowState, config: DetectionConfig): DetectionResult;
//# sourceMappingURL=detections.d.ts.map