// Core type definitions for openclaw-security-guardrails

export interface SecretPattern {
  name: string;
  pattern: RegExp;
  severity?: string;
}

export interface InjectionPattern {
  name: string;
  pattern: RegExp;
  severity: 'high' | 'medium' | 'low';
}

export interface ExfilPattern {
  name: string;
  pattern: RegExp;
  severity?: string;
}

export interface Finding {
  rule: string;
  hook: string;
  severity: string;
  matched: string;
}

export interface ScanResult {
  matched: boolean;
  findings: Finding[];
}

export interface AuditEntry {
  timestamp: string;
  event: string;
  sessionKey: string;
  channel?: string;
  isGroup?: boolean;
  alerts: Finding[];
  metadata: Record<string, unknown>;
}

export interface SecurityCheckResult {
  name: string;
  status: 'pass' | 'warn' | 'fail';
  message: string;
}

// OpenClaw hook event context (internal hooks)
export interface EventContext {
  from?: string;
  to?: string;
  content?: string;
  channelId?: string;
  cfg?: Record<string, unknown>;
  isGroup?: boolean;
  groupId?: string;
  conversationId?: string;
  success?: boolean;
  bodyForAgent?: string;
  bootstrapFiles?: BootstrapFile[];
  workspaceDir?: string;
}

// OpenClaw hook event (internal hooks)
export interface HookEvent {
  type: 'command' | 'session' | 'agent' | 'gateway' | 'message';
  action: string;
  sessionKey: string;
  timestamp: Date;
  messages: string[];
  context: EventContext;
}

// Bootstrap file structure for agent:bootstrap hooks
export interface BootstrapFile {
  name: string;
  path: string;
  content: string;
  missing: boolean;
}

// Plugin hook event for before_tool_call
export interface ToolCallEvent {
  toolName: string;
  toolCallId?: string;
  params?: Record<string, unknown>;
  sessionKey?: string;
  agentId?: string;
}

// Plugin hook decision for before_tool_call
export interface ToolCallDecision {
  block?: boolean;
  reason?: string;
}

// Plugin hook event for tool_result_persist
export interface ToolResultEvent {
  toolName: string;
  toolCallId?: string;
  result: string;
  params?: Record<string, unknown>;
  isError?: boolean;
}

// Redaction rule for secret-redactor
export interface RedactionRule {
  regex: RegExp;
  label: string;
}