/**
 * Rule Schema - Core type definitions for WardnMesh rules
 */
export type RuleCategory = "workflow" | "quality" | "safety" | "network_boundary" | "supply_chain";
export type Severity = "critical" | "high" | "medium" | "low";
export type DetectorType = "sequence" | "state" | "pattern" | "content_analysis" | "semantic";
export type ThreatAction = "allow" | "block" | "warn" | "log" | "confirm";
export type EscalationLevel = "none" | "warning" | "critical" | "block";
export interface SequenceDetectorConfig {
    lookback: number;
    pattern: SequencePattern[];
    advancedChecks?: {
        multipleEditsThreshold?: number;
        requireSuccessfulRead?: boolean;
    };
}
export interface SequencePattern {
    tool: string;
    extractPath: string;
    storeAs?: string;
    mustMatch?: string;
    maxTimeSinceMatch?: number;
    requireSuccess?: boolean;
    matchesPattern?: string;
}
export interface StateDetectorConfig {
    requiredState: string;
    targetStateValue: unknown;
    trigger: {
        tool: string;
        parameterMatch?: {
            key: string;
            valuePattern: string;
        };
    };
    stateDerivation?: {
        fromTool: string;
        setState: string;
        setValue: unknown;
        validityDurationMs?: number;
    };
}
export interface StateCondition {
    eventType: "scan_complete" | "violation_detected" | "error" | "agent_started";
    value?: unknown;
    predicate?: (state: Record<string, unknown>) => boolean;
}
export interface PatternDetectorConfig {
    targetTool: string;
    targetParameter: string;
    patterns: {
        name: string;
        regex: string;
        description: string;
    }[];
    exceptions?: string[];
    patternType?: "excessive_usage" | "slow_execution" | "high_failure_rate";
    threshold?: number;
    timeWindow?: number;
}
export interface ContentAnalysisDetectorConfig {
    suspiciousPatterns?: RegExp[];
    validPatterns?: RegExp[];
    logic: "suspicious_without_valid" | "contains_suspicious" | "missing_valid";
    minMatches?: number;
}
export interface SemanticDetectorConfig {
    type: "semantic";
    embeddingMatch?: string;
    threshold?: number;
}
export type DetectorConfig = SequenceDetectorConfig | StateDetectorConfig | PatternDetectorConfig | ContentAnalysisDetectorConfig | SemanticDetectorConfig;
export type EscalationConfig = Record<number, EscalationLevel>;
export interface AutofixConfig {
    enabled: boolean;
    agent: string;
    strategy: string;
    params?: Record<string, unknown>;
}
export interface Rule {
    id: string;
    name: string;
    category: RuleCategory;
    severity: Severity;
    description: string;
    detector: {
        type: DetectorType;
        config: DetectorConfig;
    };
    escalation: EscalationConfig;
    autofix?: AutofixConfig;
    action?: ThreatAction;
}
export interface ToolData {
    toolName: string;
    parameters: Record<string, unknown>;
    result: ToolResult;
    duration: number;
    timestamp: string;
}
export interface ToolResult {
    success: boolean;
    output?: string;
    error?: string;
    [key: string]: unknown;
}
export interface Violation {
    id: string;
    ruleId: string;
    ruleName: string;
    severity: Severity;
    description: string;
    context: ViolationContext;
    timestamp: string;
    recommendedAction: ThreatAction;
    scope?: string;
}
export interface ViolationContext {
    toolName: string;
    toolData: ToolData;
    filePath?: string;
    additionalInfo?: Record<string, unknown>;
}
export interface ViolationRecord {
    ruleId: string;
    count: number;
    firstViolation: string;
    lastViolation: string;
    history: ViolationEvent[];
    escalationLevel: EscalationLevel;
}
export interface ViolationEvent {
    violation: Violation;
    timestamp: string;
    action: "detected" | "warned" | "critical" | "blocked";
}
export interface SessionState {
    startTime: string;
    toolCalls: ToolData[];
    recentTools: ToolData[];
    detectedViolations: Violation[];
    currentFile?: string;
    customState: Record<string, unknown>;
}
/**
 * Interface for State Provider
 */
export interface StateProvider {
    getRecentTools(count?: number): ToolData[];
    setCustomState(key: string, value: unknown): void;
    getCustomState(key: string): unknown;
}
export interface Detector {
    detect(toolData: ToolData, rule: Rule, sessionState: StateProvider): Violation | null;
    getType?(): DetectorType | string;
}
export declare enum RiskLevel {
    NONE = "none",
    WARNING = "warning",
    CRITICAL = "critical",
    BLOCK = "block"
}
export interface WardnConfig {
    rules: Rule[];
    enabled?: boolean;
    /**
     * Maximum number of recent tool calls to keep in session state.
     * Defaults to 50.
     */
    maxHistorySize?: number;
    telemetry?: {
        enabled?: boolean;
        serviceName?: string;
    };
    /**
     * URL to poll for rule updates (e.g., "http://localhost:3000/api/rules").
     * If provided, the SDK will periodically fetch rules from this endpoint.
     */
    remoteRulesUrl?: string;
    /**
     * API Key for WardnMesh Cloud (optional if WARDN_API_KEY env var is set)
     */
    apiKey?: string;
    /**
     * Polling interval in milliseconds. Defaults to 60000 (1 minute).
     */
    pollingIntervalMs?: number;
    /**
     * Behavior when scan encounters an error.
     * - 'open': Allow request through on error (default, fail-open)
     * - 'closed': Block request on error (fail-closed, more secure)
     */
    failMode?: "open" | "closed";
}
export interface WardnRequest {
    sessionId?: string;
    toolName?: string;
    parameters?: Record<string, unknown>;
    prompt?: string;
    messages?: unknown[];
    context?: Record<string, unknown>;
    metadata?: Record<string, unknown>;
}
export interface ScanResult {
    action: ThreatAction;
    violations: Violation[];
    latencyMs: number;
    metadata: Record<string, unknown>;
    confirmationDetails?: {
        message: string;
        timeout: number;
        defaultAction: 'allow' | 'block';
        ruleId: string;
        ruleName: string;
        severity: Severity;
    };
}
export type PatternConfig = PatternDetectorConfig;