/**
 * Society Protocol - Advanced Security Layer v1.0
 *
 * Camada de segurança aprimorada:
 * - End-to-end encryption (E2EE)
 * - Key rotation automático
 * - Permission system granular
 * - Audit logging
 * - Rate limiting avançado
 * - Content sanitization
 * - DDoS protection
 * - Threat detection
 */
import { type SwpEnvelope } from './swp.js';
import { type Identity } from './identity.js';
export type SecurityLevel = 'low' | 'medium' | 'high' | 'paranoid';
export interface EncryptionConfig {
    algorithm: 'x25519-xsalsa20-poly1305' | 'aes-256-gcm' | 'chacha20-poly1305';
    keyRotationInterval: number;
    forwardSecrecy: boolean;
}
export interface Permission {
    resource: string;
    action: 'read' | 'write' | 'execute' | 'admin';
    conditions?: {
        timeWindow?: {
            start: number;
            end: number;
        };
        ipWhitelist?: string[];
        reputationMin?: number;
        mfaRequired?: boolean;
    };
}
export interface SecurityContext {
    identity: Identity;
    permissions: Permission[];
    sessionId: string;
    ip?: string;
    userAgent?: string;
    mfaVerified: boolean;
    reputation: number;
    trustTier: 'unverified' | 'bronze' | 'silver' | 'gold' | 'platinum';
}
export interface AuditEvent {
    id: string;
    timestamp: number;
    type: 'auth' | 'access' | 'action' | 'violation' | 'encryption';
    severity: 'info' | 'warning' | 'error' | 'critical';
    actor: string;
    resource: string;
    action: string;
    result: 'success' | 'failure' | 'blocked';
    details: Record<string, any>;
    ip?: string;
    sessionId?: string;
    signature?: string;
}
export interface ThreatIntel {
    id: string;
    type: 'ip' | 'did' | 'pattern' | 'behavior';
    value: string;
    severity: 'low' | 'medium' | 'high' | 'critical';
    category: 'spam' | 'malware' | 'ddos' | 'sybil' | 'eclipse' | 'other';
    firstSeen: number;
    lastSeen: number;
    occurrences: number;
    confidence: number;
}
export declare class E2EEncryption {
    private keys;
    private sharedSecrets;
    private config;
    constructor(config?: Partial<EncryptionConfig>);
    /**
     * Gerar par de chaves X25519 para Diffie-Hellman
     */
    generateKeyPair(identityId: string): Promise<any>;
    /**
     * Derivar segredo compartilhado com outro participante
     */
    deriveSharedSecret(myId: string, theirPublicKey: Uint8Array): Promise<Uint8Array>;
    /**
     * Criptografar mensagem
     */
    encrypt(plaintext: string, recipientPublicKey: Uint8Array, senderId: string): Promise<{
        ciphertext: Uint8Array;
        nonce: Uint8Array;
    }>;
    /**
     * Descriptografar mensagem
     */
    decrypt(ciphertext: Uint8Array, nonce: Uint8Array, senderPublicKey: Uint8Array, recipientId: string): Promise<string>;
    private deriveEncryptionKey;
    private xorWithKey;
    private rotateKeys;
}
export declare class PermissionManager {
    private roles;
    private userPermissions;
    private acl;
    constructor();
    private setupDefaultRoles;
    /**
     * Verificar se usuário tem permissão
     */
    checkPermission(context: SecurityContext, resource: string, action: Permission['action']): boolean;
    /**
     * Conceder permissão a usuário
     */
    grantPermission(did: string, permission: Permission): void;
    /**
     * Revogar permissão
     */
    revokePermission(did: string, resource: string, action: string): void;
    /**
     * Verificar ACL de recurso
     */
    checkACL(resource: string, did: string): boolean;
    /**
     * Adicionar entrada ACL
     */
    addToACL(resource: string, did: string): void;
    private hasMatchingPermission;
    private matchPermission;
    private matchResource;
    private checkConditions;
}
export declare class AuditLogger {
    private events;
    private maxSize;
    private listeners;
    constructor(maxSize?: number);
    log(event: Omit<AuditEvent, 'id' | 'timestamp'>): Promise<void>;
    query(filters: {
        type?: AuditEvent['type'];
        actor?: string;
        resource?: string;
        severity?: AuditEvent['severity'];
        startTime?: number;
        endTime?: number;
        limit?: number;
    }): AuditEvent[];
    onEvent(listener: (event: AuditEvent) => void): void;
    private signEvent;
}
export declare class ThreatDetector {
    private threatIntel;
    private patterns;
    private behaviorScores;
    constructor();
    private setupPatterns;
    /**
     * Analisar envelope para ameaças
     */
    analyzeEnvelope(envelope: SwpEnvelope): {
        threat: boolean;
        severity: ThreatIntel['severity'];
        category?: ThreatIntel['category'];
        reason?: string;
    };
    /**
     * Reportar ameaça
     */
    reportThreat(threat: Omit<ThreatIntel, 'firstSeen' | 'lastSeen' | 'occurrences'>): void;
    /**
     * Verificar se está na lista de ameaças
     */
    isThreat(value: string): ThreatIntel | undefined;
    private checkKnownThreats;
    private checkContentPatterns;
    private checkBehaviorAnomalies;
    private checkRateAnomalies;
    updateBehaviorScore(did: string, delta: number): void;
    private severityRank;
}
export declare class ContentSanitizer {
    private allowedTags;
    private allowedSchemes;
    /**
     * Sanitizar conteúdo HTML/Markdown
     */
    sanitize(input: string): string;
    /**
     * Validar e normalizar input
     */
    normalize(input: string): string;
}
export declare class SecurityManager {
    encryption: E2EEncryption;
    permissions: PermissionManager;
    audit: AuditLogger;
    threats: ThreatDetector;
    sanitizer: ContentSanitizer;
    private identity?;
    private localEncryptionId?;
    private localEncryptionPublicKey?;
    private localKeyGenerated;
    constructor(identityOrConfig?: Identity | {
        encryption?: Partial<EncryptionConfig>;
    });
    /**
     * Pipeline completo de segurança para mensagem
     */
    processIncoming(envelope: SwpEnvelope): Promise<{
        allowed: boolean;
        reason?: string;
        sanitized?: SwpEnvelope;
    }>;
    /**
     * Verificar permissão completa
     */
    checkAccess(context: SecurityContext, resource: string, action: Permission['action']): Promise<boolean>;
    generateKeyPair(identityId?: string): Promise<any>;
    sign(message: Uint8Array): Promise<Uint8Array>;
    verify(message: Uint8Array, signature: Uint8Array, publicKey: Uint8Array): Promise<boolean>;
    encrypt(plaintext: Uint8Array, recipientPublicKey: Uint8Array): Promise<{
        ciphertext: Uint8Array;
        nonce: Uint8Array;
        senderPublicKey: Uint8Array;
    }>;
    decrypt(message: {
        ciphertext: Uint8Array;
        nonce: Uint8Array;
        senderPublicKey: Uint8Array;
    }): Promise<Uint8Array>;
    private isIdentity;
    private ensureEncryptionIdentity;
}
//# sourceMappingURL=security.d.ts.map