import type { Bundle } from '../bundleIo.js';
import type { BundleManifest, Wave } from '../model.js';
import type { IpRangeSet } from '../ipRanges.js';
export interface Actor {
    id: string;
    block: string;
    ips: string[];
    days: string[];
    controllerCalls: number;
    pageLoads: number;
    firstSeen: string;
    lastSeen: string;
    hourly: Record<string, number>;
    steady: boolean;
    userAgents: Array<{
        ua: string;
        count: number;
    }>;
    emptyUaShare: number;
    markers: string[];
    hosting: string | null;
    hostingAssessed: boolean;
    sources: Array<'detector-ip' | 'outlier'>;
    /** Invocation counts per parsed action name (Controller.method). Bounded by distinct names. */
    actionCounts: Record<string, number>;
    /**
     * Actor IPs that many distinct users also log in from (a proxy or NAT). Logins from them are
     * not access, and one person's activity behind them cannot be separated in these logs.
     */
    sharedEgressIps: string[];
}
/**
 * IPs that more than DEFAULTS.sharedEgressUsers distinct users SUCCESSFULLY logged in from, counting
 * only users known not to have been created through a guest site. Failed logins (credential
 * stuffing) and self-registered throwaway accounts can therefore never make an attacker's IP look
 * like a proxy; an unknown creator does not count either.
 */
export declare function sharedEgressIps(b: Bundle): Set<string>;
/**
 * One canonical form per address, used on both sides of every IP comparison: trimmed,
 * lowercased, and for IPv6 fully expanded then compressed per RFC 5952 (leading zeros dropped,
 * the first longest run of two or more zero groups written as ::). Text that is not a plain
 * IPv6 address (including IPv4-embedded forms) is only trimmed and lowercased.
 */
export declare function normaliseIp(raw: string): string;
export declare function blockOf(rawIp: string): string;
/** Days collected for this guest that are not a wave day of any wave on that guest. */
export declare function baselineDaysFor(manifest: BundleManifest, guestId15: string): string[];
/**
 * Actor blocks for a wave: any block whose controller calls on a wave day exceed
 * max(outlierFloor, outlierMultiple × the busiest block on any baseline day, ignoring blocks that
 * also appear on a wave day), plus any block
 * holding an anomaly event's SourceIp (which catches low-volume probes that are not spikes).
 */
export declare function findActors(b: Bundle, wave: Wave, ranges: IpRangeSet | null): Promise<Actor[]>;
//# sourceMappingURL=actors.d.ts.map