export type TThreatCategory = "scanner" | "injection" | "enumeration" | "auth" | "method" | "not-found";
export type TThreatLevel = "none" | "suspicious" | "high";
interface ISample {
    ts: number;
    method: string;
    url: string;
    status: number;
    categories: TThreatCategory[];
}
export interface IThreatObservation {
    ip: string;
    method: string;
    url: string;
    status: number;
    ua?: string | null;
    body?: unknown;
    contentLength?: number;
}
export declare class ThreatMonitor {
    static HALF_LIFE_MS: number;
    static LEVEL_SUSPICIOUS: number;
    static LEVEL_HIGH: number;
    static ENUM_WINDOW_MS: number;
    static ENUM_DISTINCT_PATHS: number;
    static MAX_IPS: number;
    static MAX_EVENTS: number;
    static MAX_BODY_SCAN: number;
    private static records;
    private static events;
    private static decayed;
    static levelOf(score: number): TThreatLevel;
    private static rank;
    static classify(o: IThreatObservation): TThreatCategory[];
    static observe(o: IThreatObservation): void;
    static snapshot(limit?: number): {
        generatedAt: number;
        settings: {
            halfLifeMinutes: number;
            suspiciousAt: number;
            highAt: number;
        };
        totals: {
            tracked: number;
            suspicious: number;
            high: number;
        };
        offenders: {
            ip: string;
            score: number;
            level: TThreatLevel;
            firstSeen: number;
            lastSeen: number;
            hits: number;
            categories: Partial<Record<TThreatCategory, number>>;
            userAgent: string | null;
            samples: ISample[];
        }[];
        recent: (ISample & {
            ip: string;
            score: number;
        })[];
    };
    static reset(): void;
}
export {};