/**
 * Session-Level Threat Accumulation (SLTA) - Escalation Engine
 *
 * Pure function module that computes session threat level from accumulated hits
 * and detects chain patterns. Stateless — receives state, returns new level + chains.
 *
 * @module session/escalation-engine
 */
import type { SessionHit, ChainAlert, SessionThreatLevel } from './session-store.js';
/**
 * Input to the escalation engine
 */
export interface EscalationInput {
    /** All accumulated hits */
    hits: SessionHit[];
    /** Existing chains */
    chains: ChainAlert[];
    /** The hit being added (undefined for recompute) */
    newHit?: SessionHit;
}
/**
 * Output from the escalation engine
 */
export interface EscalationOutput {
    /** Computed threat level */
    level: SessionThreatLevel;
    /** Newly detected chains (to append) */
    newChains: ChainAlert[];
}
/**
 * Compute session threat level from accumulated hits
 *
 * @param input - Escalation input with hits and chains
 * @returns Escalation output with level and new chains
 *
 * @example
 * ```typescript
 * const input = {
 *   hits: [{ call_index: 0, ...annotations: [{ severity: 'HIGH', ... }]],
 *   chains: []
 * };
 * const output = computeThreatLevel(input);
 * // { level: 'HIGH', newChains: [] }
 * ```
 */
export declare function computeThreatLevel(input: EscalationInput): EscalationOutput;
/**
 * Detect multi-call attack chains from hits
 *
 * @param hits - All session hits
 * @param existingChains - Already detected chains
 * @returns Array of newly detected chains
 *
 * @example
 * ```typescript
 * const hits = [
 *   { call_index: 0, threat_classes: ['IPI-003'], ... },
 *   { call_index: 1, threat_classes: ['IPI-001'], ... }
 * ];
 * const chains = detectChains(hits, []);
 * // [{ pattern: 'PROBE_THEN_EXPLOIT', trigger_call_index: 0, ... }]
 * ```
 */
export declare function detectChains(hits: SessionHit[], existingChains: ChainAlert[]): ChainAlert[];
//# sourceMappingURL=escalation-engine.d.ts.map