/**
 * Types shared by `sf audit incident collect` and `report`. The bundle on disk is the contract
 * between the two commands: collect writes it, report only reads it.
 */
export declare const LOG_TYPES: readonly ['AuraRequest', 'Sites', 'URI', 'ApexExecution', 'VisualforceRequest', 'ContentTransfer', 'GraphQlQueryExecution', 'UniqueQuery', 'LightningError', 'ApexUnexpectedException'];
export type LogType = (typeof LOG_TYPES)[number];
/** Without these two, response sizes cannot be assessed, so a wave's result is `not-assessed`. */
export declare const REQUIRED_LOG_TYPES: readonly LogType[];
export declare const DEFAULTS: {
    readonly spikeRatio: 5;
    readonly emptyBandBytes: 64;
    readonly auditWindowDays: 4;
    /** jsforce autoFetchQuery stops here; a window returning this many rows may be truncated. */
    readonly auditPageCap: 10000;
    readonly outlierFloor: 100;
    readonly outlierMultiple: 3;
    /** An IP with logins from more distinct users than this is shared egress (proxy, NAT). */
    readonly sharedEgressUsers: 8;
};
export declare function id15(id: string | undefined | null): string | undefined;
export interface AnomalyEvent {
    eventIdentifier: string;
    eventDate: string;
    score: number;
    userId15: string;
    username: string;
    sourceIp?: string;
    userAgent?: string;
    summary?: string;
    totalControllerEvents?: number;
    requestedEntities?: string;
    soqlCommands?: string;
}
export interface GuestUser {
    id15: string;
    username: string;
    name: string;
    profileName: string;
    permissionSetLabels: string[];
    siteNames: string[];
    /** false when the user came only from an anomaly event and is no longer an active guest. */
    active: boolean;
}
export interface Wave {
    id: string;
    guestId15: string;
    site: string;
    days: string[];
    eventIds: string[];
}
export type LogStatus = 'collected' | 'missing' | 'no-permission' | 'failed';
export interface LogCoverage {
    type: LogType;
    day: string;
    status: LogStatus;
    totalRows: number;
    guestRows: number;
    guestRowsByUser: Record<string, number>;
    malformed: number;
    file?: string;
    detail?: string;
}
export interface AuditRow {
    createdDate: string;
    createdBy: string;
    section: string | null;
    action: string;
    display: string;
}
export interface AuditCoverage {
    from: string;
    to: string;
    truncatedWindows: Array<{
        from: string;
        to: string;
    }>;
    inaccessible: boolean;
}
export interface LoginRow {
    loginTime: string;
    userId15: string;
    sourceIp: string;
    status: string;
    loginUrl?: string;
    browser?: string;
}
export interface LoginDayCount {
    day: string;
    status: string;
    count: number;
}
export interface LinkedUser {
    id15: string;
    name: string;
    email: string;
    createdDate: string;
    createdById15: string;
    profileName: string;
    isActive: boolean;
}
export interface RunningUserLimits {
    queryAllFiles: boolean;
    viewAllData: boolean;
}
export interface BundleManifest {
    version: 1;
    complete: boolean;
    orgId: string;
    orgName: string;
    collectedAt: string;
    sinceDays: number;
    detectorAvailable: boolean;
    waves: Wave[];
    guests: GuestUser[];
    logs: LogCoverage[];
    audit: AuditCoverage;
    limits: RunningUserLimits;
    ipRangeFiles: string[];
    /** Degraded reads while snapshotting guest configuration (optional: older bundles lack it). */
    snapshotWarnings?: string[];
    files: Record<string, string>;
}
export interface FollowUp {
    logins: LoginRow[];
    users: LinkedUser[];
    /** True when a LoginHistory batch returned the queryAll cap, so some logins may be missing. */
    truncated?: boolean;
}
export type ActionClass = 'data-access' | 'auth' | 'plumbing' | 'unknown';
export type Classification = 'internal-testing' | 'automated-scan' | 'organic' | 'indeterminate';
export type WaveOutcome = 'access-gained' | 'content-returned' | 'no-evidence' | 'not-assessed';
//# sourceMappingURL=model.d.ts.map