import { AlError } from '@al/core';
import { RootClient } from '@al/core';

export declare interface AlAdditionalSubmitParams {
    search_type?: string;
    dry_run?: string;
    start?: number;
    end?: number;
    timeframe?: number;
    child_accounts?: string | string[];
}

export declare const AlAeManualClient: AlAeManualClientInstance;

export declare class AlAeManualClientInstance {
    private serviceName;
    /**
     * Create manual incidents/observations
     * POSTS an observable to AEPUBLISH to have it create a manual incident for the SoC
     *
     * @param accountId
     * @param observable
     */
    create(accountId: string, observable: AlManualRequest): Promise<AlManualResponse>;
}

export declare interface AlAsset {
    dict: {
        [key: string]: unknown;
    };
    data: string;
    asset_id: string;
}

export declare interface AlBlockingAction {
    email: string;
    ingestid: string;
    eventid: number;
    duration: number;
    source_ip?: string;
    destination_ip?: string;
}

export declare const AlBlockingActionClient: AlBlockingActionClientInstance;

export declare class AlBlockingActionClientInstance {
    private targetEndpoint;
    private serviceName;
    /**
     * Create a new blocking action
     * POST
     * /v1/{account_id}/action
     *
     * @param accountId AIMS Account ID
     * @param payload The blocking action information to be stored
     * @returns a promise with the list of ids for the blocking actions created
     *
     * @remarks
     */
    create(accountId: string, payload: AlBlockingAction): Promise<AlBlockingActionsIds>;
}

export declare interface AlBlockingActionsIds {
    actions_ids: number[];
}

/**
 * Describes an objects whose properties can be interrogated/tested using a query's conditions.
 */
export declare interface AlConditionalSubject {
    getPropertyValue(property: string, ns: string): any;
}

export declare const AlCoralClient: AlCoralClientInstance;

export declare class AlCoralClientInstance {
    private serviceName;
    /**
     *  Create correlation rule - notification only / incidents from correlation
     */
    createCorrelationRule(accountId: string, correlationRequest: AlCreateCorrelationRequest): Promise<string>;
    /**
     *  Delete correlation rule
     */
    removeCorrelationRule(accountId: string, correlationId: string): Promise<any>;
    /**
     *  Get correlation rule by ID
     */
    getCorrelationRule(accountId: string, correlationId: string): Promise<AlCorrelationRule>;
    /**
     *  Get all correlation rules
     */
    getAllCorrelations(accountId: string, params?: {
        [i: string]: string;
    }): Promise<AlCorrelationRule[] | {
        [type: string]: AlCorrelationRule[];
    }>;
    /**
     *   Update correlation rule
     */
    updateCorrelationRule(accountId: string, correlationId: string, correlation: AlCreateCorrelationRequest): Promise<string>;
    /**
     *  It tests the validity of an input or in a debugging capacity to see what content aecoral would generate for a given input.
     */
    validateCorrelationPolicy(accountId: string, correlation: AlCreateCorrelationRequest): Promise<AlCorrelationValidationResponse>;
    /**
     *  Get possible correlation incident severities and classifications.
     */
    getIncidentSpecifications(): Promise<AlIncidentSpecificationResponse>;
}

export declare class AlCoralClientInstanceV2 {
    private serviceName;
    /**
     *  Create correlation rule - notification only / incidents from correlation
     */
    createCorrelationRule(accountId: string, correlationRequest: AlCreateCorrelationRequestV2): Promise<AlCorrelationRuleV2>;
    /**
     *  Delete correlation rule
     */
    removeCorrelationRule(accountId: string, correlationId: string): Promise<void>;
    /**
     *  Get correlation rule by ID
     */
    getCorrelationRule(accountId: string, correlationId: string): Promise<AlCorrelationRuleV2>;
    /**
     *  Get all correlation rules
     */
    getAllCorrelations(accountId: string, params?: {
        [i: string]: string;
    }): Promise<AlCorrelationRulesResponseV2>;
    /**
     *   Update correlation rule
     */
    updateCorrelationRule(accountId: string, correlationId: string, correlation: AlCreateCorrelationRequestV2): Promise<AlCorrelationRuleV2>;
    /**
     *  It tests the validity of an input or in a debugging capacity to see what content aecoral would generate for a given input.
     */
    validateCorrelationPolicy(accountId: string, correlation: AlCreateCorrelationRequestV2): Promise<void>;
    /**
     *  Get possible correlation incident severities and classifications.
     */
    getIncidentSpecifications(): Promise<AlIncidentSpecificationResponseV2>;
}

export declare const AlCoralClientV2: AlCoralClientInstanceV2;

export declare interface AlCorrelationRule {
    correlation_rule_id?: string;
    attacker_field: string;
    enabled: boolean;
    expression: object | string;
    expression_window: string;
    name: string;
    victim_field: string;
    incident?: AlIncidentDefinition;
    create_ts?: number;
    update_ts?: number;
    unique?: string;
    last_trigger_ts?: number;
    create_by?: string;
    update_by?: string;
}

export declare interface AlCorrelationRulesResponseV2 {
    rules: AlCorrelationRuleV2[] | {
        [key: string]: AlCorrelationRuleV2[];
    }[];
    stats?: Stats;
    total: number;
}

export declare interface AlCorrelationRuleV2 {
    id?: string;
    version?: number;
    enabled: boolean;
    expression: SQXSearchQuery | string;
    timeframe: string;
    name: string;
    victim: string;
    attacker: string;
    output?: AlIncidentDefinitionV2;
    unique?: string;
    created?: {
        at: number;
        by: string;
    } | null;
    modified?: {
        at: number;
        by: string;
    } | null;
    triggered?: {
        at: number;
        by: string;
    } | null;
    sql_version?: 'v1' | 'v3';
}

export declare interface AlCorrelationValidationResponse {
    agg_select_params: string[];
    artifact_name: string;
    attacker_field: string;
    elab_search: {
        omitted: string;
    };
    enabled: boolean;
    expression: {
        omitted: string;
    };
    expression_window: string;
    incident: AlIncidentDefinition;
    name: string;
    nonagg_select_params: string[];
    notification: {
        filter: {
            something: boolean;
        };
        name: string;
    };
    notification_keys: string[];
    object_name: string;
    object_summary: string;
    observation_def: {
        omitted: string;
    };
    original_expression: string;
    rta: {
        omitted: string;
    };
    trigger: {
        omitted: string;
    };
    unique: string;
    victim_field: string;
}

export declare interface AlCreateCorrelationRequest {
    enabled: boolean;
    expression: string;
    name: string;
    attacker_field: string;
    victim_field: string;
    expression_window: string;
    unique?: string;
    incident?: AlIncidentDefinition;
}

export declare interface AlCreateCorrelationRequestV2 {
    version?: number;
    enabled: boolean;
    expression: SQXSearchQuery | string;
    name: string;
    attacker: string;
    victim: string;
    unique?: string;
    output?: AlIncidentDefinitionV2;
    sql_version?: 'v1' | 'v3';
}

/**
 *  A container for Suggestion Template type.
 *
 *  @author Fair Tarapues <fair.tarapues@alertlogic.com>
 *  @copyright Alert Logic, Inc 2020
 */
export declare interface AlCreateQueryTemplateV2 {
    group_id: string | null;
    name: string;
    description: string;
    search_request: string;
}

export declare interface AlCreateSavedQueryParamsV2 {
    group_id: string | null;
    name: string;
    tags?: string[];
    description?: string;
    search_request: string;
    template?: {
        id: string;
        account_id: string;
    };
}

export declare interface AlDataType {
    name: string;
}

export declare interface AlDataTypeAttributesParameters {
    type?: string;
    attributes?: string;
    version?: string;
}

export declare interface AlDataTypeAttributesResponse {
    doc?: AlDataTypeDoc;
    encodings?: string[];
    export?: AlDataTypeProperty;
    interval_size?: number;
    name?: string;
    packet?: AlDataTypeProperty;
    packet_versions?: string[];
    searchable?: boolean;
}

export declare interface AlDataTypeDoc {
    name: string;
    description: string;
    fields: {
        [key: string]: AlDataTypeDocField;
    };
}

export declare interface AlDataTypeDocField {
    description: string;
    type?: string;
    fields?: {
        [key: string]: AlDataTypeDocField;
    };
    label: string;
    presentation_type?: string;
}

export declare interface AlDataTypeProperty {
    [key: string]: string | number | string[] | number[] | AlDataTypeProperty[] | AlDataTypeProperty;
}

export declare interface AlEnumeratedFieldV2 {
    name: string;
    label: string;
    description: string;
    has_fields: boolean;
    has_values: boolean;
    has_cross_cid_values: boolean;
    type?: string | {
        [array: string]: string;
    };
}

export declare interface AlFimDataFields {
    ts: number;
    sha1_hash: string;
    path: string;
    ingest_ts: number;
    ingest_id: string;
    host_id: string;
    file_type: string;
    file_size: number;
    file_permissions: number;
    file_owner: string;
    file_name: string;
    file_mtime: number;
    file_group: string;
    file_ctime: number;
    file_attributes: number;
    file_atime: number;
    event_type: string;
    asset: AlAsset;
}

export declare interface AlFlags {
    urg: boolean;
    syn: boolean;
    rst: boolean;
    psh: boolean;
    ns: boolean;
    fin: boolean;
    ece: boolean;
    cwr: boolean;
    ack: boolean;
    mf?: boolean;
    df?: boolean;
}

export declare interface AlFromEpochTime {
    utc_offset?: string;
    date_format?: string;
}

export declare interface AlIdsMessageFields {
    asset: AlAsset;
    vlan?: number;
    ts_us: number;
    ts: number;
    srcport: number;
    signature: {
        [key: string]: unknown;
    };
    sig_rev: number;
    sig_id: number;
    sig_gen: number;
    proto: number;
    priority: number;
    payload: AlPayload[];
    orig?: boolean;
    mpls?: number;
    ip_src: string;
    ip_proxy_client?: string;
    ip_proxy?: string;
    ip_dst: string;
    ingest_ts: number;
    ingest_id: string;
    event_id: number;
    dstport: number;
    class: number;
    asset_id: string;
}

export declare interface AlIncidentDefinition {
    visibility: string;
    classification: string;
    severity: string;
    summary: string;
    description: string;
    recommendations?: string;
}

export declare interface AlIncidentDefinitionV2 {
    visibility: string;
    classification: string;
    severity: string;
    summary: string;
    description: string;
    recommendations: string;
}

export declare interface AlIncidentSpecificationResponse {
    severities: string[];
    classifications: {
        name: string;
        value: string;
    }[];
}

export declare interface AlIncidentSpecificationResponseV2 {
    severities: string[];
    classifications: {
        name: string;
        value: string;
    }[];
}

export declare const AlIngestClient: AlIngestClientInstance;

export declare class AlIngestClientInstance {
    private serviceName;
    /**
     *  Get list of data types
     */
    getDataTypes(): Promise<AlDataType[]>;
    /**
     *  Get list of data types
     */
    getDataTypeAttributes(dataType: string, params: AlDataTypeAttributesParameters): Promise<AlDataTypeAttributesResponse>;
}

export declare interface AlLogMessageFields {
    time_recv: number;
    hostname: string;
    facility: string;
    message: string;
    parsed: {
        rule_id: string;
        rule_name: string;
        pattern_id: string;
        tokens: {
            [key: string]: string;
        };
    };
    metadata: {
        uuid: string;
        create_ts: number;
        dict: {
            hostname: string;
            public_hostname: string;
            instance_id: string;
            ip_addr: string;
            public_ip_addr: string;
            os: string;
            os_version: string;
            os_arch: string;
            os_machine: string;
        };
    };
    prioriy: number;
    program: string;
}

export declare interface AlLogMessageFieldsV2 {
    time_recv: string;
    source_id: string;
    program: string;
    priority: string;
    pid: string;
    metadata: any[];
    message: string;
    ingest_id: string;
    host_name: string;
    header: string;
    facility: string;
}

export declare interface AlLogMessageIdV2 {
    msgid: string;
    aid: string;
    account: string;
}

export declare interface AlLogMessageV2 {
    id: AlLogMessageIdV2;
    fields: AlLogMessageFieldsV2;
}

export declare interface AlManualFact {
    message?: AlManualFactMessage[];
}

export declare interface AlManualFactMessage {
    id?: string;
    type?: string;
}

export declare interface AlManualRequest {
    /**
     * The Account (customer) Id
     */
    customer_id: number;
    /**
     * The Incident Summary
     */
    summary: string;
    /**
     * The Incident Description
     */
    description: string;
    /**
     * The Incident Classification
     */
    classification: string;
    /**
     * The duration (in minutes)
     */
    time_frame: number;
    /**
     * A list of message_id and type (associated events or logs)
     */
    facts: AlManualFact[];
    /**
     * Only for MANI
     */
    correlation: string[];
    /**
     * The datacenter that facts are coming from (Ashburn, Denver, Integration, Newport, etc)
     */
    datacenter?: string;
    /**
     * The Incident Source (MANL for log, MANI for IDS)
     */
    sources?: AlManualRequest.SourcesEnum[];
    /**
     * The base_incident_keyedon_value
     */
    keyedon_value?: string;
    /**
     * The generator type (analytic, guardduty, log_correlation, etc)
     */
    gen_type?: string;
    /**
     * The threat rating for the incident (Low, Medium, High, Critical)
     */
    threat_rating?: AlManualRequest.ThreatRatingEnum;
}

export declare namespace AlManualRequest {
    export type SourcesEnum = 'MANL' | 'MANI';
    const sourcesEnum: {
        MANL: SourcesEnum;
        MANI: SourcesEnum;
    };
    export type ThreatRatingEnum = 'Low' | 'Medium' | 'Hihg' | 'Critical';
    const threatRatingEnum: {
        Low: ThreatRatingEnum;
        Medium: ThreatRatingEnum;
        Hihg: ThreatRatingEnum;
        Critical: ThreatRatingEnum;
    };
}

export declare interface AlManualResponse {
    status?: string;
    message?: string;
}

export declare type AlMessageDataType = 'logmsgs' | 'observation' | 'idsmsgs' | 'fimdata';

export declare interface AlMessageDetailsMetaData {
    qingest_id: string;
    account: number;
    aid: number;
    msgid: string;
}

export declare const AlMsgAccessClient: AlMsgAccessClientInstance;

export declare class AlMsgAccessClientInstance {
    private serviceName;
    /**
     * Read Messages
     * Read a set of messages from storage by ID. Proxy for daccess service messages API. Only addition is logmsgs data type messages are also parsed and tokenised
     */
    readMessagesGET(accountId: string, dataType: AlMessageDataType, queryParams: {
        ids: string;
        fields?: string;
        return_type?: string;
    }): Promise<AlReadMessageDetailsResponse[]>;
    /**
     * Read Messages POST
     * Read a set of messages from storage by ID. Proxy for daccess service messages API. Only addition is logmsgs data type messages are also parsed and tokenised
     */
    readMessagesPOST(accountId: string, dataType: AlMessageDataType, params: {
        ids: string[];
        fields?: string;
        return_type?: string;
    }): Promise<AlReadMessageDetailsResponse[]>;
    private setOptionalParams;
}

export declare interface AlObservationFields {
    visibility: string;
    ts: number;
    technique?: string;
    tactic?: string;
    summary: string;
    subclass: string;
    sub_technique?: string;
    start_ts: number;
    severity: string;
    scope_type: string;
    scope: string[];
    recommendations: string;
    properties_data: string;
    properties: {
        [key: string]: any;
    };
    path: string;
    parents: string[];
    keys_data: string;
    keys: {
        [key: string]: any;
    };
    internal_data: string;
    internal: {
        [key: string]: any;
    };
    ingest_ts: number;
    ingest_id: string;
    id: string;
    handling: string[];
    evolved_to?: string;
    end_ts: number;
    desc: string;
    confidence?: number;
    class: string;
    authority: string;
}

export declare interface AlPayload {
    proto: AlProto;
    data: string;
    hex: string;
    ascii: string;
    ts: number;
    ts_us: number;
}

export declare interface AlPropertyValuesV2 {
    tags: string[];
}

export declare interface AlProto {
    srcport: number;
    protocols: AlProtocol[];
    protocol: number;
    offset: number;
    ip_src: string;
    ip_dst: string;
    dstport: number;
}

export declare interface AlProtocol {
    winsize: number;
    urgent: number;
    srcport: number;
    seq: number;
    options: string;
    offset: number;
    id: string;
    flags: AlFlags;
    dstport: number;
    data_off: number;
    checksum: number;
    ack: number;
    ttl?: number;
    total_length?: number;
    srcip: string;
    ident?: number;
    header_len?: number;
    frag_offset?: number;
    ecn?: number;
    dstip: string;
    diffserv?: number;
    srcmac: string;
    dstmac: string;
}

export declare interface AlReadMessageDetailsResponse {
    id: AlMessageDetailsMetaData;
    fields: AlLogMessageFields | AlIdsMessageFields | AlFimDataFields | AlObservationFields;
}

export declare interface AlSavedQueriesStats {
    data_type: {
        [key: string]: number;
    };
    tags: {
        [key: string]: number;
    };
}

export declare interface AlSavedQueriesV2 {
    queries: AlSavedQueryV2[];
    stats: AlSavedQueriesStats;
}

export declare interface AlSavedQueryV2 {
    id: string;
    account_id: string;
    group_id: string | null;
    name: string;
    tags?: string[];
    description?: string;
    data_type: string;
    search_request: string;
    deleted?: boolean;
    template?: {
        id: string;
        account_id: string;
    };
    created: {
        at: number;
        by: string;
    };
    modified: {
        at: number;
        by: string;
    };
}

declare const alSearchClientV2: AlSearchClientV2_2;
export { alSearchClientV2 as AlSearchClientV2 }
export { alSearchClientV2 }

declare class AlSearchClientV2_2 {
    private serviceName;
    /**
     *  Submit the Search Text to be processed
     */
    submit(searchQuery: string, accountId: string, additionalParams?: AlAdditionalSubmitParams): Promise<AlSearchSubmitV2>;
    /**
     *  Get the Search results based in the uuid, additional parameters are allowed
     */
    get(accountId: string, uuid: string, additionalParams?: AlSearchResultsQueryParamsV2): Promise<AlSearchGetV2>;
    /**
     *  Get the Search status information based in the search uuid
     *
     *
     * @param accountId   Customer ID
     * @param uuid        Search ID
     *
     * @return Observable<SearchStatusV2>
     */
    status(accountId: string, uuid: string): Promise<AlSearchStatusV2>;
    /**
     *  Delete a currently executing search operation in the backend
     */
    delete(accountId: string, uuid: string): Promise<any>;
    /**
     *  Get expert mode search grammar
     */
    getGrammar(): Promise<AlSearchSQLGrammar>;
    /**
     *  Complete interactive search (in suspended status)
     */
    completeSuspendedSearch(accountId: string, uuid: string): Promise<void>;
    /**
     * Convert a SIEMless (search/v1) search into an Expert Mode SQL query (search/v2).
     */
    convertQueryToEMS(queryJSON: any): Promise<string>;
}

export declare interface AlSearchDetailsV2 {
    query: string;
    search_type: string;
    submit_ts: number;
    update_ts: number;
    stats: AlSearchStatsV2;
    request: string;
}

export declare interface AlSearchGetResultsV2 {
    columns: Array<string>;
    records: Array<AlSearchResultRecordV2>;
    metadata: {
        [key: string]: string;
    };
}

export declare interface AlSearchGetV2 {
    search_uuid: string;
    data_type: string;
    search_status: string;
    status_details: string;
    details: AlSearchDetailsV2;
    progress?: number;
    remaining?: number;
    results?: AlSearchGetResultsV2;
    next_token?: string;
    offset: number;
    total_found: number;
    external_details: string;
}

export declare interface AlSearchProgressV2 {
    input_scanned_records: number;
    input_scanned_bytes: number;
    estimated_output_records: number;
}

export declare interface AlSearchResultRecordIdV2 {
    account: number;
    aid: number;
    msgid: string;
    datatype: AlMessageDataType;
}

export declare interface AlSearchResultRecordV2 {
    fields: {
        [key: string]: unknown;
    };
    id: AlSearchResultRecordIdV2;
}

export declare interface AlSearchResultsQueryParamsV2 {
    limit?: number;
    offset?: number;
    details?: boolean;
    next_token?: string;
    utc_offset?: string;
    from_epochtime?: AlFromEpochTime;
    selected?: string;
}

export declare interface AlSearchSQLGrammar {
    [key: string]: {
        keywords: {
            [key: string]: {
                spec: AlSearchSQLGrammarSpec[];
            };
        };
    };
}

export declare interface AlSearchSQLGrammarSpec {
    help: string;
    insertText: string;
    label: string;
}

export declare interface AlSearchStatsV2 {
    fetchers_executed: number;
    filtered_batches: number;
    filtered_bytes: number;
    filtered_compressed_bytes: number;
    filtered_records: number;
    filters_executed: number;
    filters_scheduled: number;
    input_scanned_bytes: number;
    input_scanned_packets: number;
    input_scanned_records: number;
    output_records: number;
    recurse_sorts: number;
    sort_recurse_time: number;
    sorts_executed: number;
}

export declare interface AlSearchStatusStatsV2 {
    fetchers_executed: number;
    filter_process_time: number;
    filtered_batches: number;
    filtered_bytes: number;
    filtered_compressed_bytes: number;
    filtered_records: number;
    filters_executed: number;
    filters_scheduled: number;
    input_scanned_bytes: number;
    input_scanned_packets: number;
    input_scanned_records: number;
    intervals_requested: number;
    libalalgo_gaps_parse_call_count: number;
    libalalgo_json_parse_call_count: number;
    libalalgo_kv_parse_call_count: number;
    messages_parse_error: number;
    messages_parsed: number;
    messages_unparsed: number;
    output_records: number;
    recurse_sorts: number;
    sort_recurse_time: number;
    sorts_executed: number;
}

export declare interface AlSearchStatusV2 {
    search_status: string;
    status_details: string;
    details: AlSearchDetailsV2;
    search_uuid: string;
    total_found?: number;
    authoritative_retry?: string;
    retried_by?: string[];
    rerun?: string;
    external_details: string;
    request: string;
    requested_type: 'auto' | 'batch' | 'report';
    search_type: 'interactive' | 'batch' | 'report';
    submit_ts: number;
    update_ts: number;
    stats: AlSearchStatusStatsV2;
    progress?: number;
    search_end: number;
    search_start: number;
    search_progress?: AlSearchProgressV2;
}

declare const alSearchStylist: AlSearchStylist_2;
export { alSearchStylist as AlSearchStylist }
export { alSearchStylist }

declare class AlSearchStylist_2 {
    private serviceName;
    private version;
    /**
     *  Get the results of a search with applied human readable transformations.
     *  search_stylist will request results from EM search service by calling Search Results
     *  endpoint for the same account_id/uuid with the same query string params (offset/limit/etc) as passed to this endpoint.
     */
    searchStylist(accountId: string, uuid: string, type?: 'json' | 'csv' | 'pcap', additionalParams?: AlSearchResultsQueryParamsV2, exportData?: boolean): Promise<AlSearchGetV2 | any>;
}

export declare interface AlSearchSubmitV2 {
    update_ts: number;
    status_details: string;
    start_ts: number;
    search_uuid: string;
    search_status: string;
    results: Array<AlLogMessageV2>;
}

declare class AlSuggestionsClientInstanceV1 {
    private client;
    private serviceName;
    /**
     * Create a saved query for the given account ID
     */
    createSavedQuery(accountId: string, savedQueryParams: CreateSavedQueryParams): Promise<SavedQuery>;
    /**
     * Get a saved query by account ID and query ID
     */
    getQuery(accountId: string, queryId: string): Promise<SavedQuery>;
    /**
     * Get a list of saved queries for the given account ID
     */
    getQueries(accountId: string, queryParams?: {
        data_type?: string;
    }): Promise<SavedQuery[]>;
    /**
     * Update the saved query with the given ID. All body parameters are optional, but at least one should be given.
     */
    updateQuery(accountId: string, queryId: string, queryUpdate: UpdateSavedQueryParams): Promise<SavedQuery>;
    /**
     * Delete the saved query with the given ID.
     */
    deleteQuery(accountId: string, queryId: string): Promise<unknown>;
    /**
     * Get a list of search categories. If the ids parameter is passed with a CSV of IDs, the result is the set of categories identified by each ID in a categories array.
     * If no ids parameter is passed, returns all categories.
     */
    getCategories(accountId: string, queryParams?: {
        ids: string[];
    }): Promise<SearchCategory[]>;
    /**
     * Get a search rule by rule ID
     */
    getRule(accountId: string, ruleId: string, queryParams?: {
        include_categories: string;
    }): Promise<SearchRule>;
    /**
     * Get a list of search rules. If the ids parameter is passed with a CSV of IDs, the result is the set of rules identified by each ID in a rules array.
     * If no ids parameter is passed, returns all rules
     */
    getRules(accountId: string, queryParams?: {
        ids?: string;
        include_categories?: boolean;
    }): Promise<SearchRule[]>;
    /**
     * Get a list of search tokens. If the ids parameter is passed with a CSV of IDs, the result is the set of tokens identified by each ID in a tokens array.
     * If no ids parameter is passed, returns all rules
     */
    getTokens(accountId: string, queryParams?: {
        ids?: string;
    }): Promise<SearchToken[]>;
    /**
     * This hints suggestions to preload and index the data sets for the given account_id. If the data for this account is already in the cache, nothing is done
     */
    precache(accountId: string): Promise<void>;
    /**
     * Provides suggestions for the search filters of all displayable fields (depending on how it is called).
     */
    suggest(accountId: string, dataType: string, requestParams: SuggestionsRequestParams): Promise<SuggestSearchResponse>;
    /**
     * This endpoint takes an entire search request  and rewrites it so that the descriptor fields (field_descriptors array and display attributes on some id fields) have been added or updated.
     * Additionally, this performs syntactic and semantic validation of the query
     */
    describe(accountId: string, dataType: string, searchRequest: DescribeSearchRequest): Promise<DescribeSearchResponse>;
    /**
     * The translate endpoint behaves similarly to describe, taking the same input, performing the same
     * validation and producing a similar output, .except the resulting query in search_request is returned in the
     * format suitable for input to the search API
     * Specifically, JSON body of the request to the search API is returned in the search_request key of the response.
     */
    translate(accountId: string, dataType: string, searchRequest: TranslateSearchRequest): Promise<TranslateSearchResponse>;
    /**
     * Get a list of search templates for the given account ID. By default, the list will include search templates in accounts that have a managed relationship to account_id given in the URL
     * This behavior can be disabled by setting include_managing_account_templates to false, in which case the response will exclusively contain templates for the account_id given in the URL.
     */
    getSearchTemplates(accountId: string, queryParams?: {
        type?: string;
    }): Promise<SearchTemplatesResponse>;
    /**
     * Get a search template by account ID and template ID.
     */
    getSearchTemplate(accountId: string, templateId: string): Promise<SearchTemplate>;
    /**
     * Create a search template for the given account ID.
     */
    createSearchTemplate(accountId: string, template: SearchTemplate): Promise<SearchTemplate>;
    /**
     * Update the search template with the given ID. All body parameters are optional, but at least one should be given.
     */
    updateSearchTemplate(accountId: string, templateId: string, template: SearchTemplate): Promise<any>;
    /**
     * Delete the search template with the given ID.
     * A search template must be soft-deleted (set to "deleted": true) prior to being permanently deleted.
     * Attempting to delete a search template set to "deleted": false will result in a 400 Bad Request error.
     */
    deleteSearchTemplate(accountId: string, templateId: string): Promise<unknown>;
    /**
     * Get a group by account ID, object type, and group ID.
     */
    getGroup(accountId: string, objectType: 'queries' | 'templates', groupId: string, queryParams?: FetchGroupsQueryParams): Promise<SavedGroup>;
    /**
     * Get a list of all groups (by object type) for the given account ID.
     */
    getGroups(accountId: string, objectType: 'queries' | 'templates', queryParams?: FetchGroupsQueryParams): Promise<{
        groups: SavedGroup[];
        templates?: SearchTemplate[];
        queries?: SavedQuery[];
    }>;
    /**
     * Groups can be used to organize saved queries and search templates. Groups are associated with a specific object type, either queries or templates.
     * A group can be parented to another group of the same type to create nested groups, and objects (queries or templates) can be associated to groups by setting their group_id property
     */
    createGroup(accountId: string, objectType: 'queries' | 'templates', group: SavedGroup): Promise<SavedGroup>;
    /**
     * Update a group. Groups are associated with a specific object type, either queries or templates.
     * All body parameters are optional, but at least one must be given.
     */
    updateGroup(accountId: string, objectType: 'queries' | 'templates', groupId: string, group: SavedGroup): Promise<any>;
    /**
     * Permanently delete a group. A group must be soft-deleted (set to "deleted": true) prior to being permanently deleted.
     * Attempting to delete a group set to "deleted": false will result in a 400 Bad Request error.
     * If a group is permanently deleted, all child groups and all associated objects (templates or saved queries) will be permanently deleted as well.
     */
    deleteGroup(accountId: string, objectType: 'queries' | 'templates', groupId: string): Promise<void>;
}

export declare class AlSuggestionsClientInstanceV2 {
    client: RootClient;
    protected serviceVersion: string;
    protected serviceName: string;
    constructor(client?: RootClient);
    /**
     * Create a Template
     * POST
     * /suggestions/v2/:account_id/templates
     * @remarks "https://console.account.product.dev.alertlogic.com/users/api/suggestions/index.html#api-Templates_V2-CreateTemplate"
     */
    createQueryTemplate(accountId: string, queryTemplate: AlCreateQueryTemplateV2): Promise<AlSuggestionsTemplateResponseV2>;
    /**
     * Delete Template Query with the given uuid
     * DELETE
     * /suggestions/v2/:account_id/templates/:id
     * @remarks "https://console.account.product.dev.alertlogic.com/users/api/suggestions/index.html#api-Templates_V2-DeleteTemplate"
     */
    deleteQueryTemplate(accountId: string, queryId: string): Promise<void>;
    /**
     * Get Templates
     * GET
     * /suggestions/v2/:account_id/templates
     * @remarks "https://console.account.product.dev.alertlogic.com/users/api/suggestions/index.html#api-Templates-GetTemplates"
     */
    getQueryTemplates(accountId: string, params?: {
        deleted?: boolean;
        data_type?: string;
    }): Promise<AlSuggestionsTemplateResponseV2[]>;
    /**
     * Get Template
     * GET
     * /suggestions/v2/:account_id/templates/:id
     * @remarks "https://console.account.product.dev.alertlogic.com/users/api/suggestions/index.html#api-Templates-GetTemplate"
     */
    getQueryTemplate(accountId: string, params?: {
        deleted?: boolean;
        data_type?: string;
    }): Promise<AlSuggestionsTemplateResponseV2>;
    /**
     * Update a Template
     * POST
     * /suggestions/v2/:account_id/templates/:id
     * @remarks "https://console.account.product.dev.alertlogic.com/users/api/suggestions/index.html#api-Templates-UpdateTemplate"
     */
    updateQueryTemplate(accountId: string, queryId: string, queryTemplate: AlUpdateQueryTemplateV2): Promise<AlSuggestionsTemplateResponseV2>;
    /**
     * Create a Saved Query
     * POST
     * /suggestions/v2/:account_id/search
     * @remarks "https://console.account.product.dev.alertlogic.com/users/api/suggestions/index.html#api-Queries_V2-CreateQuery"
     */
    createSavedQuery(accountId: string, savedQueryParams: AlCreateSavedQueryParamsV2): Promise<AlSavedQueryV2>;
    /**
     * Delete Saved Query with the given uuid
     * DELETE
     * /suggestions/v2/:account_id/queries/:id
     * @remarks "https://console.account.product.dev.alertlogic.com/users/api/suggestions/index.html#api-Queries_V2-GetQueries"
     */
    deleteSavedQuery(accountId: string, queryId: string): Promise<void>;
    /**
     * Get Property Values (list)
     * GET
     * /suggestions/v2/:account_id/queries/properties
     * @remarks "https://algithub.pd.alertlogic.net/pages/alertlogic/suggestions/api/index.html#api-Queries_V2-GetQueriesProperties"
     */
    getPropertyValues(accountId: string, properties: ValidPropertiesV2[]): Promise<AlPropertyValuesV2>;
    /**
     * Get a Saved Query
     * GET
     * /suggestions/v2/:account_id/queries/:id
     * @remarks "https://console.account.product.dev.alertlogic.com/users/api/suggestions/index.html#api-Queries_V2-GetQuery
     */
    getSavedQuery(accountId: string, queryId: string): Promise<AlSavedQueryV2>;
    /**
     * Get Saved Queries (list)
     * GET
     * /suggestions/v2/:account_id/queries/
     * @remarks "https://console.account.product.dev.alertlogic.com/users/api/suggestions/index.html#api-Queries_V2-GetQueries"
     */
    getSavedQueries(accountId: string): Promise<AlSavedQueriesV2>;
    /**
     * Update a Saved Query
     * PUT
     * /suggestions/v2/:account_id/search
     * @remarks "https://console.account.product.dev.alertlogic.com/users/api/suggestions/index.html#api-Queries_V2-CreateQuery"
     */
    updateSavedQuery(accountId: string, queryId: string, savedQueryParams: AlUpdateSavedQueryParamsV2): Promise<AlSavedQueryV2>;
    /**
     * Retrieve an enumeration of fields for a given datatype and filter string (optional, although the use value
     * of this method without it is questionable.
     *
     * The special parameter `applyMagic` will submit the resulting array to a heuristic sorting algorithm design
     * to bubble more meaningful suggestions to the top of the list.
     *
     * GET /suggestions/v2/:account_id/enumeration/:datatype/all_fields[?filter=foo]
     * @remarks "https://console.account.product.dev.alertlogic.com/users/api/suggestions/index.html#api-Enumeration"
     */
    enumerateFields(accountId: string, dataType: string, filter?: string, applyMagic?: boolean): Promise<AlEnumeratedFieldV2[]>;
    /**
     * Retrieves a single field by name
     *
     * GET /suggestions/v2/:account_id/enumeration/:datatype/all_fields
     */
    enumerateFieldByName(accountId: string, dataType: string, fieldName: string): Promise<AlEnumeratedFieldV2>;
    /**
     * Retrieves an enumeration of values for a given field
     *
     * GET /suggestions/v2/:account_id/enumeration/:datatype/:field
     * @remarks "https://console.account.product.dev.alertlogic.com/users/api/suggestions/index.html#api-Enumeration"
     */
    enumerateValues(accountId: string, dataType: string, field: string, isCrossCid?: boolean): Promise<string[]>;
    protected applyMagic(fields: AlEnumeratedFieldV2[], searchPhrase: string): void;
}

export declare const AlSuggestionsClientV2: AlSuggestionsClientInstanceV2;

export declare interface AlSuggestionsTemplateResponseV2 {
    id: string;
    account_id: string;
    group_id: string | null;
    name: string;
    description?: string;
    data_type: string;
    deleted: boolean;
    search_request: string;
    created: {
        at: number;
        by: string;
    };
    modified: {
        at: number;
        by: string;
    };
}

export declare interface AlUpdateQueryTemplateV2 {
    group_id?: string | null;
    name?: string;
    description?: string;
    search_request?: string;
    deleted?: boolean;
}

export declare interface AlUpdateSavedQueryParamsV2 {
    group_id?: string | null;
    name?: string;
    tags?: string[];
    description?: string;
    search_request?: string;
    deleted?: boolean;
    template?: {
        id: string;
        account_id: string;
    };
}

export declare const AlWhoisClient: AlWhoisClientInstance;

export declare class AlWhoisClientInstance {
    private serviceName;
    /**
     * Get whois by ip address
     * Returns WHOIS information from ip address
     */
    get(ip: string): Promise<AlWhoisResponse>;
}

export declare interface AlWhoisResponse {
    raw: string;
    hostnames: string[];
}

export declare interface Asset {
    dict: object;
    data: string;
    asset_id: string;
}

export declare interface CreateSavedQueryParams {
    group_id: string;
    name: string;
    data_type: string;
    search_request: any;
}

export declare interface DescribeSearchError {
    error_type: string;
    error_text: string;
    attribute?: string;
    field?: string;
    operator?: string;
    value?: string;
}

export declare interface DescribeSearchRequest {
    search_request: SuggestionsSearchQuery;
}

export declare interface DescribeSearchResponse {
    search_request: {
        field_descriptors: SuggestedFieldDescriptor[];
    };
    errors?: DescribeSearchError[];
    selected_fields?: string[] | {
        field: string;
        label: string;
    }[];
}

export declare interface FetchGroupsQueryParams {
    deleted?: boolean;
    include_object?: boolean;
    include_child_groups?: boolean;
    data_type?: string;
    view_type?: string;
    include_managing_account_groups?: boolean;
}

export declare interface FetchQueriesResponse {
    queries: SavedQuery[];
}

export declare interface FetchSearchResponse extends SubmitSearchResponse {
    results: LogMessageSearchResult[];
    next_token?: string;
    estimated?: number;
    remaining?: number;
}

export declare interface FimDataFields {
    ts: number;
    sha1_hash: string;
    path: string;
    ingest_ts: number;
    ingest_id: string;
    host_id: string;
    file_type: string;
    file_size: number;
    file_permissions: number;
    file_owner: string;
    file_name: string;
    file_mtime: number;
    file_group: string;
    file_ctime: number;
    file_attributes: number;
    file_atime: number;
    event_type: string;
    asset: Asset;
}

export declare interface Flags {
    urg: boolean;
    syn: boolean;
    rst: boolean;
    psh: boolean;
    ns: boolean;
    fin: boolean;
    ece: boolean;
    cwr: boolean;
    ack: boolean;
    mf?: boolean;
    df?: boolean;
}

export declare interface IdsMessageFields {
    vlan?: number;
    ts_us: number;
    ts: number;
    srcport: number;
    sig_rev: number;
    sig_id: number;
    sig_gen: number;
    proto: number;
    priority: number;
    payload: Payload[];
    orig?: boolean;
    mpls?: number;
    ip_src: string;
    ip_proxy_client?: string;
    ip_proxy?: string;
    ip_dst: string;
    ingest_ts: number;
    ingest_id: string;
    event_id: number;
    dstport: number;
    class: number;
    asset_id: string;
}

export declare interface LogMessageFields {
    time_recv: number;
    hostname: string;
    facility: string;
    message: string;
    parsed: {
        rule_id: string;
        rule_name: string;
        pattern_id: string;
        tokens: {
            [key: string]: string;
        };
        json?: {
            [key: string]: unknown;
        };
        tokens_metadata?: {
            [key: string]: TokensMetadata;
        };
        tokens_offsets?: {
            [key: string]: number[];
        };
    };
    metadata: {
        uuid: string;
        create_ts: number;
        dict: {
            hostname: string;
            public_hostname: string;
            instance_id: string;
            ip_addr: string;
            public_ip_addr: string;
            os: string;
            os_version: string;
            os_arch: string;
            os_machine: string;
        };
    };
    prioriy: number;
    program: string;
    source_id: string;
}

declare interface LogMessageMetaData {
    account: number;
    aid: number;
    msgid: string;
}

export declare interface LogMessageSearchResult {
    fields: {
        ingest_id: string;
        message: string;
        metadata: {
            create_ts: number;
            data: string;
            meta_id: string;
            uuid: string;
        }[];
        pid: number;
        priority: number;
        time_recv: number;
        source_id: string;
        host_name: string;
        facility: string;
        program: string;
    };
    id: LogMessageMetaData;
}

export declare interface ObservationFields {
    visibility: string;
    ts: number;
    technique?: string;
    tactic?: string;
    summary: string;
    subclass: string;
    sub_technique?: string;
    start_ts: number;
    severity: string;
    scope_type: string;
    scope: string[];
    recommendations: string;
    properties_data: string;
    properties: {
        [key: string]: any;
    };
    path: string;
    parents: string[];
    keys_data: string;
    keys: {
        [key: string]: any;
    };
    internal_data: string;
    internal: {
        [key: string]: any;
    };
    ingest_ts: number;
    ingest_id: string;
    id: string;
    handling: string[];
    evolved_to?: string;
    end_ts: number;
    desc: string;
    confidence?: number;
    class: string;
    authority: string;
}

export declare interface Payload {
    ts_us: number;
    ts: number;
    rec_idx: number;
    proto: Proto;
    data: string;
}

export declare interface Proto {
    srcport: number;
    protocols: Protocol[];
    protocol: number;
    offset: number;
    ip_src: string;
    ip_dst: string;
    dstport: number;
}

export declare interface Protocol {
    winsize: number;
    urgent: number;
    srcport: number;
    seq: number;
    options: string;
    offset: number;
    id: string;
    flags: Flags;
    dstport: number;
    data_off: number;
    checksum: number;
    ack: number;
    ttl?: number;
    total_length?: number;
    srcip: string;
    ident?: number;
    header_len?: number;
    frag_offset?: number;
    ecn?: number;
    dstip: string;
    diffserv?: number;
    srcmac: string;
    dstmac: string;
}

export declare interface ReadFimDataResponse extends ReadLogMessageResponse {
    fields: FimDataFields;
}

export declare interface ReadIdsMessageResponse extends ReadLogMessageResponse {
    fields: IdsMessageFields;
}

export declare interface ReadLogMessageResponse {
    id: LogMessageMetaData;
    fields: LogMessageFields | IdsMessageFields | FimDataFields | ObservationFields;
}

export declare interface ReadObservationResponse extends ReadLogMessageResponse {
    fields: ObservationFields;
}

export declare interface SavedGroup {
    id?: string;
    account_id?: string;
    parent_id?: string;
    name?: string;
    description?: string;
    deleted?: boolean;
    groups?: SavedGroup[];
    templates?: SearchTemplate[];
    queries?: SavedQuery[];
    created?: UserTimeStamp;
    modified?: UserTimeStamp;
}

export declare interface SavedQuery {
    id: string;
    account_id: string;
    group_id: string;
    name: string;
    description?: string;
    data_type: string;
    search_request: any;
    deleted?: boolean;
}

export declare interface SearchCategory {
    id: string;
    name: string;
}

declare class SearchClient {
    private alClient;
    private serviceName;
    /**
     * Submit Search - starts the search query job in the backend
     */
    submitSearch(accountId: string, dataType: string, searchQuery?: any): Promise<SubmitSearchResponse>;
    /**
     * Fetch Search Results - Access the results of the submitted search
     */
    fetchSearchResults(accountId: string, searchId: string, queryParams?: SearchResultsQueryParams): Promise<FetchSearchResponse>;
    /**
     * Fetch Search Results as CSV - Access the results of the submitted search in CSV format
     */
    fetchSearchResultsAsCSV(accountId: string, searchId: string, queryParams?: SearchResultsQueryParams): Promise<any>;
    /**
     * Search Status - Get latest status of the submitted search
     */
    searchStatus(accountId: string, searchId: string): Promise<SearchStatusResponse>;
    /**
     * Release Search
     * Free resources occupied by a completed search. The resources are freed up.
     * Pending search is cancelled. Resources area also automatically released 24 hours after the search is completed
     */
    releaseSearch(accountId: string, searchId: string): Promise<any>;
    /**
     * Read Messages
     * Read a set of messages from storage by ID. Proxy for daccess service messages API. Only addition is logmsgs data type messages are also parsed and tokenised
     */
    readMessages(accountId: string, queryParams: {
        ids: string;
        fields?: string;
    }): Promise<ReadLogMessageResponse[]>;
    /**
     * Read Messages POST
     * Read a set of messages from storage by ID. Proxy for daccess service messages API. Only addition is logmsgs data type messages are also parsed and tokenised
     */
    readMessagesPost(accountId: string, dataType: string, params: {
        ids: string[];
        fields?: string;
    }): Promise<ReadLogMessageResponse[]>;
}

declare const searchClient: SearchClient;
export { searchClient as AlSearchClient }
export { searchClient }

export declare interface SearchResultsQueryParams {
    limit?: number;
    offset?: number;
    starting_token?: string;
}

export declare interface SearchRule {
    id: string;
    name: string;
    patterns: {
        id: string;
        pattern: string;
    }[];
    properties: {
        id: string;
        values: string[];
    }[];
    tokens: string[];
    categories?: SearchCategory[];
}

export declare interface SearchRulesResponse {
    rules: SearchRule[];
}

export declare interface SearchStatusResponse extends SubmitSearchResponse {
    query: string;
    search_type: 'batch' | 'interactive' | 'report';
}

export declare interface SearchTemplate {
    id?: string;
    name?: string;
    account_id?: string;
    data_type?: string;
    description?: string;
    group_id?: string;
    search_request?: any;
    deleted?: boolean;
    created?: UserTimeStamp;
    modified?: UserTimeStamp;
}

export declare interface SearchTemplatesResponse {
    templates: SearchTemplate[];
}

export declare interface SearchToken {
    id: string;
    desc: string;
    name: string;
    parent: string;
    type: string;
}

export declare let SQX_ALL_CLAUSES: (typeof SQXClauseSelect | typeof SQXClauseGroupByPermuted | typeof SQXClauseWhere | typeof SQXClauseOrderBy | typeof SQXClauseLimit | typeof SQXClauseTimeRange)[];

export declare let SQX_ALL_OPERATORS: (typeof SQXOperatorAnd | typeof SQXOperatorNegate | typeof SQXComparatorEqual | typeof SQXComparatorBetween | typeof SQXComparatorIn | typeof SQXOperatorIsNull | typeof SQXOperatorProjectCount)[];

/**
 * This interface allows external components to provide a series of callbacks to customize the behavior of the parser.
 */
export declare interface SQXBehaviorHooks {
    beforeParse?: {
        (sequence: SQXToken[]): void;
    };
    afterParse?: {
        (element: SQXToken, context?: SQXOperatorBase): void;
    };
}

export declare class SQXClauseGroupBy extends SQXOperatorBase {
    static opSpec: SQXOperatorMetadata;
    fields: Array<SQXPropertyRef | SQXOperatorBase>;
    constructor();
    fromJson(raw: any, converter: (x: any) => any): void;
    toJson(): any;
    fromParser(cursor: SQXParseCursor, tokenIndex: number): void;
    toQueryString(): string;
}

export declare class SQXClauseGroupByPermuted extends SQXOperatorBase {
    static opSpec: SQXOperatorMetadata;
    fields: Array<SQXPropertyRef | SQXOperatorBase>;
    constructor();
    fromJson(raw: any, converter: (x: any) => any): void;
    toJson(): any;
    toQueryString(): string;
    fromParser(cursor: SQXParseCursor, tokenIndex: number): void;
}

export declare class SQXClauseHaving extends SQXOperatorBase {
    static opSpec: SQXOperatorMetadata;
    condition: SQXOperatorBase;
    constructor();
    fromJson(raw: any, converter: any): void;
    fromParser(cursor: SQXParseCursor, tokenIndex: number): void;
    toQueryString(): string;
    toJson(): any;
}

export declare class SQXClauseLimit extends SQXOperatorBase {
    static opSpec: SQXOperatorMetadata;
    count: SQXScalarValue;
    fromParser(cursor: SQXParseCursor, tokenIndex: number): void;
    toQueryString(): string;
    toJson(): {
        limit: any;
    };
    fromJson(raw: any, converter: any): void;
}

export declare class SQXClauseOrderBy extends SQXOperatorBase {
    static opSpec: SQXOperatorMetadata;
    sortFields: Array<SQXSortField>;
    fromParser(cursor: SQXParseCursor, tokenIndex: number): void;
    toQueryString(): string;
    toJson(): {
        order_by: any[][];
    };
    fromJson(raw: string[][], converter: (x: any) => any): void;
    getDescendants(): SQXToken[];
}

export declare class SQXClauseSelect extends SQXOperatorBase {
    static opSpec: SQXOperatorMetadata;
    columns: Array<SQXPropertyRef | SQXOperatorBase>;
    constructor();
    fromJson(raw: any, converter: any): void;
    toJson(): any;
    fromParser(cursor: SQXParseCursor, tokenIndex: number): void;
    toQueryString(): string;
    getDescendants(): SQXToken[];
}

export declare class SQXClauseTimeRange extends SQXOperatorBase {
    static opSpec: SQXOperatorMetadata;
    end_timestamp?: number;
    start_timestamp?: number;
    timespan?: number;
    constructor();
    toJson(): any;
    fromJson(raw: any, converter: any): void;
}

export declare class SQXClauseWhere extends SQXOperatorBase {
    static opSpec: SQXOperatorMetadata;
    condition: SQXOperatorBase;
    constructor();
    fromJson(raw: any, converter: any): void;
    fromParser(cursor: SQXParseCursor, tokenIndex: number): void;
    toQueryString(): string;
    toJson(): any;
    getDescendants(): SQXToken[];
}

/**
 * Describes a column (any field or projection that is part of the SELECT statement)
 */
export declare interface SQXColumnDescriptor {
    name: string;
    type: string;
    asField?: string;
    isAggregate?: boolean;
}

export declare class SQXComparatorBetween extends SQXOperatorBase {
    static opSpec: SQXOperatorMetadata;
    property: SQXPropertyRef;
    value1: SQXScalarValue;
    value2: SQXScalarValue;
    constructor();
    fromParser(cursor: SQXParseCursor, tokenIndex: number, peers: SQXToken[], parameters: SQXToken[]): void;
    fromJson(raw: any, converter: any): void;
    toQueryString(): string;
    toJson(): any;
}

export declare class SQXComparatorCIDRMatch extends SQXOperatorBase {
    static opSpec: SQXOperatorMetadata;
    property: SQXPropertyRef;
    value: SQXScalarValue;
    constructor();
    fromJson(raw: any, converter: any): void;
    fromParser(cursor: SQXParseCursor, tokenIndex: number): void;
    toQueryString(): string;
    toJson(): any;
}

export declare class SQXComparatorContains extends SQXOperatorBase {
    static opSpec: SQXOperatorMetadata;
    property: SQXPropertyRef;
    value: SQXScalarValue;
    constructor();
    fromJson(raw: any, converter: any): void;
    fromParser(cursor: SQXParseCursor, tokenIndex: number): void;
    toQueryString(): string;
    toJson(): any;
}

export declare class SQXComparatorContainsAll extends SQXOperatorBase {
    static opSpec: SQXOperatorMetadata;
    property: SQXPropertyRef;
    values: SQXScalarValue[];
    constructor();
    fromJson(raw: any, converter: any): void;
    fromParser(cursor: SQXParseCursor, tokenIndex: number, peers: SQXToken[], parameters: SQXToken[]): void;
    toQueryString(): string;
    toJson(): any;
}

export declare class SQXComparatorContainsAny extends SQXOperatorBase {
    static opSpec: SQXOperatorMetadata;
    property: SQXPropertyRef;
    values: SQXScalarValue[];
    constructor();
    fromJson(raw: any, converter: any): void;
    fromParser(cursor: SQXParseCursor, tokenIndex: number, peers: SQXToken[], parameters: SQXToken[]): void;
    toQueryString(): string;
    toJson(): any;
}

export declare class SQXComparatorEqual extends SQXOperatorBase {
    static opSpec: SQXOperatorMetadata;
    property: SQXPropertyRef | SQXOperatorBase;
    value: SQXScalarValue;
    constructor(property?: string | SQXPropertyRef, value?: string | number | boolean | SQXScalarValue);
    fromJson(raw: any, converter: any): void;
    fromParser(cursor: SQXParseCursor, tokenIndex: number): void;
    toQueryString(): string;
    toJson(): any;
}

export declare class SQXComparatorGT extends SQXOperatorBase {
    static opSpec: SQXOperatorMetadata;
    property: SQXPropertyRef | SQXOperatorBase;
    value: SQXScalarValue;
    constructor();
    fromJson(raw: any, converter: any): void;
    fromParser(cursor: SQXParseCursor, tokenIndex: number): void;
    toQueryString(): string;
    toJson(): any;
}

export declare class SQXComparatorGTE extends SQXOperatorBase {
    static opSpec: SQXOperatorMetadata;
    property: SQXPropertyRef | SQXOperatorBase;
    value: SQXScalarValue;
    constructor();
    fromJson(raw: any, converter: any): void;
    fromParser(cursor: SQXParseCursor, tokenIndex: number): void;
    toQueryString(): string;
    toJson(): any;
}

export declare class SQXComparatorIn extends SQXOperatorBase {
    static opSpec: SQXOperatorMetadata;
    property: SQXPropertyRef;
    values: SQXScalarValue[];
    constructor(property?: string | SQXPropertyRef, values?: (string | number | boolean | SQXScalarValue)[]);
    fromJson(raw: any, converter: any): void;
    fromParser(cursor: SQXParseCursor, tokenIndex: number, peers: SQXToken[], parameters: SQXToken[]): void;
    toQueryString(): string;
    toJson(): any;
}

export declare class SQXComparatorLike extends SQXOperatorBase {
    static opSpec: SQXOperatorMetadata;
    property: SQXPropertyRef;
    value: SQXScalarValue;
    constructor();
    fromJson(raw: any, converter: any): void;
    fromParser(cursor: SQXParseCursor, tokenIndex: number): void;
    toQueryString(): string;
    toJson(): any;
}

export declare class SQXComparatorLT extends SQXOperatorBase {
    static opSpec: SQXOperatorMetadata;
    property: SQXPropertyRef | SQXOperatorBase;
    value: SQXScalarValue;
    constructor();
    fromJson(raw: any, converter: any): void;
    fromParser(cursor: SQXParseCursor, tokenIndex: number): void;
    toQueryString(): string;
    toJson(): any;
}

export declare class SQXComparatorLTE extends SQXOperatorBase {
    static opSpec: SQXOperatorMetadata;
    property: SQXPropertyRef | SQXOperatorBase;
    value: SQXScalarValue;
    constructor();
    fromJson(raw: any, converter: any): void;
    fromParser(cursor: SQXParseCursor, tokenIndex: number): void;
    toQueryString(): string;
    toJson(): any;
}

export declare class SQXComparatorNotEqual extends SQXOperatorBase {
    static opSpec: SQXOperatorMetadata;
    property: SQXPropertyRef | SQXOperatorBase;
    value: SQXScalarValue;
    constructor(property?: string | SQXPropertyRef, value?: string | number | boolean | SQXScalarValue);
    fromJson(raw: any, converter: any): void;
    fromParser(cursor: SQXParseCursor, tokenIndex: number): void;
    toQueryString(): string;
    toJson(): any;
}

/**
 * Contains detailed information about a specific cursor location and its context within a parsed query
 */
export declare class SQXCursorDetails {
    token: SQXToken;
    tokenText: string;
    inferredType: string;
    topClause: SQXOperatorBase;
    topClauseType: string;
    property: SQXPropertyRef;
    operator: SQXOperatorBase;
    values: SQXToken[];
    isNegated: boolean;
    alias: string;
    aggregatorCode: string;
    append: boolean;
    phrase: string;
    phraseRange: number[];
    expression: string;
    cursorIndex: number;
    parser: SQXParser;
    tokens: SQXToken[];
    tokenIndex: number;
    origin: any;
    target: any;
    static fromParser(parser: SQXParser, cursorIndex: number): SQXCursorDetails;
    trace(start: SQXToken, callback: {
        (startElement: SQXToken): boolean;
    }): SQXToken;
    relativeToken(offset: number, relativeTo?: SQXToken): SQXToken;
    setProperty(property: SQXToken): this;
    setOperator(operator: SQXToken): this;
    setValues(...valueTokens: SQXToken[]): this;
    summarize(): void;
    /**
     * This method supports execution of macros and shortcuts against specific keystrokes.
     *
     * @param {object} event The browser's keyup event
     * @returns {boolean} True if the keystroke was acted on, false otherwise.  If true, the cursor's `expression` property
     */
    onKeyboardEvent(event: any): boolean;
    replaceCursorPhrase(replacement: string): string;
    appendCursorPhrase(conjunction: string, phrase: string): string;
    getBaseProperty(): SQXPropertyRef;
}

export declare class SQXDelimiter extends SQXToken {
    constructor(value?: SQXToken | string);
}

export declare interface SQXExternalErrorDescriptor {
    match: {
        [property: string]: any;
    };
    error: string | Error;
}

/**
 * A base class for operators that are groups of other elements (AND, OR, generic group)
 */
export declare class SQXGroupBase<ItemType> extends SQXOperatorBase {
    items: ItemType[];
    constructor();
    forEach(callback: {
        (element: ItemType, index: number): void;
    }): void;
    get count(): number;
    push(item: ItemType): void;
}

export declare interface SQXNamedEntity {
    name: string;
    ns?: string;
    id: string;
}

export declare class SQXOperatorAnd extends SQXGroupBase<SQXOperatorBase> {
    static opSpec: SQXOperatorMetadata;
    constructor();
    fromJson(raw: any, converter: any): void;
    fromParser(cursor: SQXParseCursor, tokenIndex: number, peers?: SQXToken[], parameters?: SQXToken[]): void;
    toQueryString(): string;
    toJson(): any;
}

/**
 * A base class for operators that can be converted between JSON and SQL formats
 */
export declare abstract class SQXOperatorBase extends SQXToken {
    /**
     * Publicly references properties (or property-based operators, like FROM_EPOCHTIME) that belong to this operator instance
     */
    opPropertyRef: SQXToken;
    /**
     * Publicly references scalar values or literal parameters that belong to this operator instance.
     */
    opValues: SQXToken[];
    /**
     * Provides access to children of a given operator.  By default, includes property and any values.
     * May be overridden by specific operators to provide access to additional structured child information.
     */
    getDescendants(): SQXToken[];
    toJson(): any;
    fromJson(raw: any, converter: any): void;
    toQueryString(): string;
    fromParser(cursor: SQXParseCursor, index: number, peers?: SQXToken[], parameters?: SQXToken[]): void;
    getValues(): (string | number | boolean | null)[];
}

export declare class SQXOperatorExists extends SQXOperatorBase {
    static opSpec: SQXOperatorMetadata;
    property: SQXPropertyRef;
    constructor();
    fromJson(raw: any, converter: any): void;
    fromParser(cursor: SQXParseCursor, tokenIndex: number): void;
    toQueryString(): string;
    toJson(): any;
}

export declare class SQXOperatorFromEpochTime extends SQXOperatorBase {
    static opSpec: SQXOperatorMetadata;
    origin: SQXPropertyRef;
    format: SQXScalarValue;
    constructor();
    fromParser(cursor: SQXParseCursor, tokenIndex: number, peers: SQXToken[], parameters: SQXToken[]): void;
    toJson(): any;
    fromJson(raw: any, converter: any): void;
    toQueryString(): string;
}

export declare class SQXOperatorInterval extends SQXOperatorBase {
    static opSpec: SQXOperatorMetadata;
    origin: SQXPropertyRef;
    format: SQXScalarValue;
    constructor();
    fromParser(cursor: SQXParseCursor, tokenIndex: number, peers: SQXToken[], parameters: SQXToken[]): void;
    toJson(): any;
    fromJson(raw: any, converter: any): void;
    toQueryString(): string;
}

export declare class SQXOperatorIsNull extends SQXOperatorBase {
    static opSpec: SQXOperatorMetadata;
    property: SQXPropertyRef;
    constructor();
    fromJson(raw: any, converter: any): void;
    fromParser(cursor: SQXParseCursor, tokenIndex: number): void;
    toQueryString(): string;
    toJson(): any;
}

/**
 * This interface allows registered operators to describe their own type and behaviors.
 */
export declare interface SQXOperatorMetadata {
    opType: any;
    tokens: string | string[];
    jsonKey?: string;
    topClause?: boolean;
    asDelimiter?: boolean;
    asFunction?: boolean;
    beforeProperty?: boolean;
    uiDefaultValue?: string;
    autoAlias?: {
        (field: string): string;
    };
}

export declare class SQXOperatorNegate extends SQXOperatorBase {
    static opSpec: SQXOperatorMetadata;
    condition: SQXOperatorBase;
    constructor();
    fromJson(raw: any, converter: any): void;
    fromParser(cursor: SQXParseCursor, tokenIndex: number): void;
    toQueryString(): string;
    toJson(): any;
    getDescendants(): SQXToken[];
}

export declare class SQXOperatorOr extends SQXGroupBase<SQXOperatorBase> {
    static opSpec: SQXOperatorMetadata;
    constructor();
    fromJson(raw: any, converter: any): void;
    fromParser(cursor: SQXParseCursor, tokenIndex: number, peers?: SQXToken[], parameters?: SQXToken[]): void;
    toQueryString(): string;
    toJson(): any;
}

export declare class SQXOperatorProjectAs extends SQXOperatorBase {
    static opSpec: SQXOperatorMetadata;
    origin: SQXPropertyRef | SQXOperatorBase;
    alias: SQXScalarValue;
    constructor();
    fromParser(cursor: SQXParseCursor, tokenIndex: number, peers: SQXToken[], parameters: SQXToken[]): void;
    toQueryString(): string;
    fromJson(raw: any, converter: any): void;
    toJson(): any;
}

export declare class SQXOperatorProjectAverage extends SQXOperatorBase {
    static opSpec: SQXOperatorMetadata;
    origin: SQXPropertyRef | SQXOperatorBase;
    constructor();
    fromJson(raw: any, converter: any): void;
    fromParser(cursor: SQXParseCursor, tokenIndex: number, peers: SQXToken[], parameters: SQXToken[]): void;
    toJson(): any;
    toQueryString(): string;
}

export declare class SQXOperatorProjectCount extends SQXOperatorBase {
    static opSpec: SQXOperatorMetadata;
    origin: SQXPropertyRef | SQXOperatorBase;
    constructor();
    fromJson(raw: any, converter: any): void;
    fromParser(cursor: SQXParseCursor, tokenIndex: number, peers: SQXToken[], parameters: SQXToken[]): void;
    toJson(): any;
    toQueryString(): string;
}

export declare class SQXOperatorProjectMax extends SQXOperatorBase {
    static opSpec: SQXOperatorMetadata;
    origin: SQXPropertyRef | SQXOperatorBase;
    constructor();
    fromJson(raw: any, converter: any): void;
    fromParser(cursor: SQXParseCursor, tokenIndex: number, peers: SQXToken[], parameters: SQXToken[]): void;
    toJson(): any;
    toQueryString(): string;
}

export declare class SQXOperatorProjectMin extends SQXOperatorBase {
    static opSpec: SQXOperatorMetadata;
    origin: SQXPropertyRef | SQXOperatorBase;
    constructor();
    fromJson(raw: any, converter: any): void;
    fromParser(cursor: SQXParseCursor, tokenIndex: number, peers: SQXToken[], parameters: SQXToken[]): void;
    toJson(): any;
    toQueryString(): string;
}

export declare class SQXOperatorProjectSum extends SQXOperatorBase {
    static opSpec: SQXOperatorMetadata;
    origin: SQXPropertyRef | SQXOperatorBase;
    constructor();
    fromJson(raw: any, converter: any): void;
    fromParser(cursor: SQXParseCursor, tokenIndex: number, peers: SQXToken[], parameters: SQXToken[]): void;
    toJson(): any;
    toQueryString(): string;
}

export declare class SQXOperatorProjectUCount extends SQXOperatorBase {
    static opSpec: SQXOperatorMetadata;
    origin: SQXPropertyRef | SQXOperatorBase;
    constructor();
    fromJson(raw: any, converter: any): void;
    fromParser(cursor: SQXParseCursor, tokenIndex: number, peers: SQXToken[], parameters: SQXToken[]): void;
    toJson(): any;
    toQueryString(): string;
}

export declare class SQXOperatorRegexpMatch extends SQXOperatorBase {
    static opSpec: SQXOperatorMetadata;
    origin: SQXPropertyRef;
    format: SQXScalarValue;
    constructor();
    fromParser(cursor: SQXParseCursor, tokenIndex: number, peers: SQXToken[], parameters: SQXToken[]): void;
    toJson(): any;
    fromJson(raw: any, converter: any): void;
    toQueryString(): string;
}

export declare class SQXOperatorWindow extends SQXOperatorBase {
    static opSpec: SQXOperatorMetadata;
    origin: SQXPropertyRef;
    format: SQXScalarValue;
    constructor();
    fromParser(cursor: SQXParseCursor, tokenIndex: number, peers: SQXToken[], parameters: SQXToken[]): void;
    toJson(): any;
    fromJson(raw: any, converter: any): void;
    toQueryString(): string;
}

/**
 * This declares the data and public API for the parse cursor class, which helps
 * operators (and the parser) to digest tokens in a recursive, structured, systematic way.
 */
export declare abstract class SQXParseCursor {
    expression: string;
    tokens: SQXToken[];
    currentIndex: number;
    state: SQXQueryState;
    /**
     * Gets a token relative to the currently active index, defaulting to 0
     */
    abstract token(tokenIndex?: number): any;
    /**
     *  Pulls a single element from the current token sequence.
     */
    abstract drawOne(inContext?: SQXOperatorBase, assert?: boolean, fromIndex?: number): SQXToken;
    /**
     *  Pulls one or more elements from the current token sequence.
     *  If a conjunction (SQXOperatorAnd, SQXOperatorOr, or SQXOperatorGroup) type is provided, it will be used to group multiple elements.
     *  An element is one or more tokens that "work" together and which exist between delimeters.
     */
    abstract drawGroup(conjunction: any, inContext?: SQXOperatorBase, until?: {
        (token: SQXToken): boolean;
    }): SQXToken;
    /**
     * Increments the intake index or sets it to a specific location.
     */
    abstract next(newCurrentIndex?: number): any;
    /**
     * Marks a given token as digested and reflects its status in the expression map.  There are several variants of this method -- a plain vanilla
     * one, one for operators claiming properties, and one for operators claiming values.
     */
    abstract digest(...tokens: SQXToken[]): SQXParseCursor;
    abstract digestOperatorProperty(operator: SQXOperatorBase, property: SQXToken): SQXParseCursor;
    abstract digestOperatorValues(operator: SQXOperatorBase, ...values: SQXToken[]): SQXParseCursor;
    /**
     * Generates an SQXParseError for the given token.
     */
    abstract error(token: SQXToken | number, message: string): SQXParseError;
}

/**
 * This is a parser specific error.  Its constructor allows it to "attach" to a token where the error occurred, and to identify a specific point
 * in the input query where the error originates.
 */
export declare class SQXParseError extends AlError {
    message: string;
    expression: string;
    pointer: number | SQXToken | SQXParseCursor;
    token: SQXToken;
    constructor(message: string, expression: string, pointer?: number | SQXToken | SQXParseCursor);
}

/**
 * This class is responsible for managing the process of parsing a SQL-like query phrase into an operator tree.
 */
export declare class SQXParser {
    /**
     * Output properties - public members that are meant to be digested by the outside world
     */
    select: SQXClauseSelect;
    where: SQXClauseWhere;
    having: SQXClauseHaving;
    orderBy: SQXClauseOrderBy;
    groupBy: SQXClauseGroupBy;
    groupByPermuted: SQXClauseGroupByPermuted;
    limit: SQXClauseLimit;
    state: SQXQueryState;
    expression: string;
    tokens: SQXToken[];
    /**
     * Miscellaneous private dictionaries and state information
     */
    protected expressionMap: any[];
    protected lastOffset: number;
    protected tokenTypeDictionary: {
        [token: string]: SQXOperatorMetadata;
    };
    protected jsonKeyMap: {
        [property: string]: SQXOperatorMetadata;
    };
    protected externalErrors: {
        [group: string]: SQXExternalErrorDescriptor[];
    };
    protected anchorMap: {
        [id: string]: SQXOperatorBase;
    };
    protected lastCursorOffset: number;
    protected emptyToken: SQXToken;
    protected hooks: SQXBehaviorHooks;
    constructor(hooks?: SQXBehaviorHooks, operatorTypes?: any[]);
    static charClass(c: any): "symbol" | "alphanum" | "whitespace" | "other";
    setHooks(hooks: SQXBehaviorHooks): void;
    evaluate(expression: string): boolean;
    getCursorToken(cursorPosition: number, skipDelimiters: boolean): SQXToken;
    setExternalErrors(group: string, externalErrors?: SQXExternalErrorDescriptor[]): void;
    clearExternalErrors(group: string): void;
    /**
     * Attempts to interpret a json element (at any level) into a specialized token.
     */
    importElementFromJson: (raw: any) => SQXToken;
    fromJson(raw: any, ignoreErrors?: boolean): any;
    /**
     * Use the public static operator metadata provided by each operator to build a map
     * of textual strings to operator types.
     */
    buildTokenTypeDictionary(operatorTypes: any[]): void;
    /**
     *  Converts a segment of the input string into an array of tokens that can be further processed, or throws an error describing syntactical or structural errors with the input.
     *
     *  Errors will be expressed as thrown instances of SQXParseError, and include information about the location in the input string where the error was found.
     */
    tokenize: (startOffset?: number, depth?: number) => SQXToken[];
    /**
     * Whereas tokenization breaks the input string into nested sequences from left to right and bottom to top, the preprocess routine
     * traverses each tree from right to left and top to bottom, establishes parent and sibling relationships, and consolidates keywords that belong
     * together.
     */
    preprocess(tokenSequence: SQXToken[], parent: SQXToken): void;
    parse(tokenSequence: SQXToken[], depth?: number): SQXRootParseCursor;
    withTokens(callback: {
        (token: SQXToken, depth: number): void;
    }, tokens?: SQXToken[], depth?: number): void;
    updateExpressionMap: (token: SQXToken, depth?: number) => void;
    annotateExternalErrors(): void;
    /**
     * Diagnostic method dumps a token tree to console
     **/
    dumpTokenTree(): void;
    /**
     *  @method transformReservedChars
     *
     *  This allows us to transform reserved characters from html while we're parsing string queries
     *  into html.
     *
     *  @param{ string } expression - query expression.
     *  @return{ string } new expression transformed.
     *
     */
    transformReservedChars(expression: string): string;
    toHtmlString(classifyCallback: {
        (token: string | SQXToken, depth: number): string[];
    }, startIndex?: number): string;
    getOperatorByToken(operatorToken: string): SQXOperatorMetadata;
    replace(tokens: SQXToken[], cursorOffset: number, tokenCount: number, replacements?: string | string[], verbose?: boolean): string;
    protected resetState(): void;
}

export declare class SQXPropertyRef extends SQXToken {
    ns: string;
    property: string;
    isAlias: boolean;
    constructor(value?: SQXPropertyRef | string);
    static fromToken(token: SQXToken): SQXPropertyRef;
    static fromJson(raw: any): SQXPropertyRef;
    static sourceJson(id: string, ns?: string): {
        source: {
            ns: string;
            id: string;
        };
    } | {
        source: string;
    };
    toQueryString(): string;
    toJson(): any;
}

export declare class SQXQueryBuilder {
    query?: SQXSearchQuery;
    cursor?: SQXOperatorBase;
    constructor(query?: SQXSearchQuery, cursor?: SQXOperatorBase);
    where(): SQXQueryBuilder;
    toJson(): any;
    toQueryString(): string;
    not(): SQXQueryBuilder;
    equals(property: string | SQXPropertyRef, value: string | number | boolean | SQXScalarValue): SQXQueryBuilder;
    notEquals(property: string | SQXPropertyRef, value: string | number | boolean | SQXScalarValue): SQXQueryBuilder;
    in(property: string | SQXPropertyRef, values: (string | SQXScalarValue)[]): SQXQueryBuilder;
    protected applyOperatorToCursor(op: SQXOperatorBase, cursor: SQXOperatorBase): SQXQueryBuilder;
}

/**
 *  This class simply maintains stateful information about a specific parsed phrase.
 *  This includes the errors it generated, its outputs (top level clauses), alias information, and token substitution info.
 */
export declare class SQXQueryState {
    static propertyByNameMap: {
        [name: string]: SQXNamedEntity;
    };
    static propertyByIdMap: {
        [id: string]: SQXNamedEntity;
    };
    static valueByNameMap: {
        [name: string]: SQXNamedEntity;
    };
    static valueByIdMap: {
        [id: string]: SQXNamedEntity;
    };
    outputs: {
        [id: string]: SQXToken;
    };
    errors: SQXParseError[];
    reflector: {
        (token: SQXToken): void;
    };
    aliases: {
        [alias: string]: SQXToken;
    };
    constructor(reflector: {
        (token: SQXToken): void;
    });
    static removeQuotes(item: SQXNamedEntity): void;
    static addNamedProperty(property: SQXNamedEntity): void;
    static getNamedProperty(name: string): SQXNamedEntity;
    static getNamedPropertyById(uuid: string): SQXNamedEntity;
    static addNamedValue(value: SQXNamedEntity): void;
    static getNamedValue(name: string): SQXNamedEntity;
    static getNamedValueById(uuid: string): SQXNamedEntity;
    static dump(): void;
    addError(error: SQXParseError): void;
    reflect(token: SQXToken): void;
    setOutput(outputId: string, token: SQXToken): void;
    getOutput(outputId: string): SQXToken;
    reset(): void;
}

/**
 * This is the LtR, active pull equivalent of the normal parse cursor.  It removes the logic of "consuming" a particular
 * expression out of SQXParser.
 */
export declare class SQXRootParseCursor implements SQXParseCursor {
    state: SQXQueryState;
    hooks: SQXBehaviorHooks;
    expression: string;
    tokens: SQXToken[];
    currentIndex: number;
    constructor(expression: string, tokens: SQXToken[], state: SQXQueryState, hooks: SQXBehaviorHooks);
    static shouldStop(token: SQXToken, digestedCount: number, conjunction: any, until?: {
        (token: SQXToken): boolean;
    }): boolean;
    /**
     * Gets a token relative to the currently active index, defaulting to 0
     */
    token(tokenIndex?: number): SQXToken;
    /**
     * Calculates the number of tokens remaining AFTER a given relative index from the current one, inclusive.
     */
    remaining(): number;
    /**
     * Increments the intake index or sets it to a specific location.
     */
    next(newcurrentIndex?: number): this;
    /**
     * Updates one or more tokens in the current token sequence to a new/more specific type.
     */
    evolve(token: SQXToken, tokenIndex?: number): this;
    evaluateChildren(child: SQXToken, inContext?: SQXOperatorBase): SQXToken;
    /**
     * Block magic!  This is the engine of the parsing process.  It attempts to extract raw sequences of tokens into single entities
     * that make sense together.  If it works, take credit for it.  If it breaks, blame El Rosado.
     */
    drawOne(inContext?: SQXOperatorBase, assertToken?: boolean, fromIndex?: number): SQXToken;
    /**
     * This is to group simple operators(AND) basically it takes the item before and the item after the operator and join in a conjuntion
     * @param tokens
     * @param operator
     * @param cursor
     * @returns array with tokens partially digested
     */
    simpleGroup(tokens: any, operator: any, cursor: any): SQXToken[];
    /**
     *  Pulls one or more elements from the current token sequence.
     *  If a conjunction (SQXOperatorAnd, SQXOperatorOr, or SQXTokenCollection) type is provided, it will be used to group multiple elements.
     *  An element is one or more tokens that "work" together and which exist between delimeters.
     */
    drawGroup(conjunction: any, inContext?: SQXOperatorBase, until?: {
        (token: SQXToken): boolean;
    }): SQXToken;
    digest(...tokens: SQXToken[]): SQXParseCursor;
    digestOperatorProperty(operator: SQXOperatorBase, property: SQXToken): SQXParseCursor;
    digestOperatorValues(operator: SQXOperatorBase, ...tokens: SQXToken[]): SQXParseCursor;
    error(token: SQXToken | number, message: string): SQXParseError;
}

export declare class SQXScalarValue extends SQXToken {
    value: string | number | boolean;
    type: string;
    constructor(value?: string | number | boolean | SQXScalarValue);
    static fromToken(vtoken: SQXToken, expression: string, allowedTypes?: string | string[]): SQXScalarValue;
    static fromJson(raw: any): SQXScalarValue;
    toQueryString(): string;
    toJson(): any;
}

export declare class SQXSearchQuery {
    key: string;
    name: string;
    select: SQXClauseSelect;
    where: SQXClauseWhere;
    order_by: SQXClauseOrderBy;
    group_by: SQXClauseGroupBy;
    group_by_permuted: SQXClauseGroupByPermuted;
    having: SQXClauseHaving;
    limit: SQXClauseLimit;
    time_range: SQXClauseTimeRange;
    aggregate: boolean;
    protected jsonConditions: any;
    /**
     *  Builds a query instance from an SQL-like statement.
     *
     *  @param {string} expression The SQL-like statement.
     *  @return {object} of type SQXSearchQuery.
     */
    static fromQueryString(expression: string): SQXSearchQuery;
    /**
     *  Builds a query instance consisting of only a set of conditions, e.g., ( a = 1 && b = true ) OR c IN ( 5, 6, 7 ).
     *  These conditions can be retrieved without their `WHERE` clause using the getConditions() method.
     */
    static fromConditionString(expression: string): SQXSearchQuery;
    /**
     *  Builds a query instance from an SQL-like statement.
     *
     *  @param {string} parser The parser to extract data from.
     *  @return {SQXSearchQuery} The resulting query instance.
     */
    static fromParser(parser: SQXParser): SQXSearchQuery;
    /**
     *  Builds a query instance from a JSON object in native search format.
     *
     *  @param rawData object with the attributes to set the menu item
     *  @return Object of type SQXSearchQuery
     */
    static fromJson(rawData: any): SQXSearchQuery;
    /**
     *  Creates an empty query instance.
     */
    static empty(name?: string): SQXSearchQuery;
    /**
     * Exports an instance into native search format JSON.
     *
     * @param filterOnly If true, returns only the conditional expression (filters), without the WHERE clause.
     */
    toJson(filterOnly?: boolean): any;
    /**
     * Exports an instance into SQL-like syntax
     */
    toQueryString(filterOnly?: boolean): string;
    /**
     * Exports filter criteria in SQL-like syntax
     */
    toConditionString(): string;
    /**
     * Retrieves the conditions of the WHERE clause, which will always be an operator (either a coordinating operator like AND or OR, or an actual value test or function).
     * If no condition is already specified, a new one will be created.
     */
    getConditions(): SQXOperatorBase;
    /**
     * Retrieves top level conditions applied to a given property
     */
    getPropertyConditions(property: string | SQXPropertyRef): SQXOperatorBase[];
    /**
     * Retrieves a single condition applied to a given property.  If there are multiple conditions applied to the property, the method
     * will throw an error.
     */
    getPropertyCondition(property: string | SQXPropertyRef): SQXOperatorBase | null;
    /**
     * Applies an `and` to the conditions clause of the top level WHERE.  Any existing conditions will become part of this AND.
     */
    and(): SQXSearchQuery;
    /**
     * Applies an `or` to the conditions clause of the top level WHERE.  Any existing conditions will become part of this OR.
     */
    or(): SQXSearchQuery;
    /**
     * Adds an equals operator to the current top level conditions of the WHERE clause.
     */
    equals(property: string | SQXPropertyRef, value: string | number | boolean | SQXScalarValue): SQXSearchQuery;
    in(property: string | SQXPropertyRef, values: (string | SQXScalarValue)[]): SQXSearchQuery;
    /**
     * Calculates information about the columns described by a given query.
     */
    getColumnDescriptions(): SQXColumnDescriptor[];
    /**
     *  It triggers the column's descriptions process so we know also if the query is aggregate.
     */
    isAggregate(): boolean;
    /**
     * Executes a callback against every token in the *idealized* token tree.
     * This is in contrast to the raw token traversal seen in SQXParser's `withTokens` method.
     *
     * @param {function} callback A callback method accepting a single token.
     * @param {SQXToken} from The starting point to traverse from; if null (default), enumerates all top level clauses except time range.
     * @param {depth} The current depth of execution.
     */
    traverseDescendants(callback: {
        (token: SQXToken, depth?: number): void;
    }, from?: SQXToken, depth?: number): void;
    test(subject: AlConditionalSubject): boolean;
    /**
     *  The following dispatch/evaluate methods are support methods used to actually test a search condition against a target object.
     *  The evaluative functionality of SQXSearchQuery doesn't necessarily encompass the full range of operators supported by log search.
     */
    protected dispatchOperator(op: any, subject: AlConditionalSubject): boolean;
    protected evaluateAnd(op: any, subject: AlConditionalSubject): boolean;
    protected evaluateOr(op: any, subject: AlConditionalSubject): boolean;
    protected evaluateEquals(op: any, subject: AlConditionalSubject): boolean;
    protected evaluateNotEquals(op: any, subject: AlConditionalSubject): boolean;
    protected evaluateIn(op: any, subject: AlConditionalSubject): boolean;
    protected evaluateNot(op: any, subject: AlConditionalSubject): boolean;
    protected evaluateContainsAny(op: any, subject: AlConditionalSubject): boolean;
    protected evaluateContainsAll(op: any, subject: AlConditionalSubject): boolean;
    protected normalizeProperty(descriptor: any): {
        ns: string;
        id: string;
    };
    protected assert(subject: any, value: boolean, message: string): void;
}

export declare interface SQXSortField {
    property: SQXPropertyRef;
    direction: string;
}

/**
 * This is the base token class.  Every other token type -- operators, clauses, property references, scalar values -- inherit from this class.
 * It manages the textual value of the token, the location in the origin string where the token exists, links to parents and siblings, and references
 * to various types of metadata.
 *
 * A note on offsets: token_start and token_end indicate the space in the source expression the token itself occupies; children_end indicates
 * the end of any attached parenthetical expression; and block_start and block_end indicate the top level expression range that this token belongs in.
 */
export declare class SQXToken {
    textValue: string;
    id: string;
    digested: boolean;
    children: SQXToken[];
    siblings: SQXToken[];
    parent: SQXToken;
    state: SQXQueryState;
    index: number;
    token_start: number;
    token_end: number;
    children_end: number;
    block_start: number;
    block_end: number;
    opSpec?: SQXOperatorMetadata;
    error: SQXParseError;
    literal: boolean;
    blob: boolean;
    constructor(value?: SQXToken | string, blobValue?: boolean);
    import(token: SQXToken): void;
    /**
     * Checks to see if the current token is an operator, optionally matching it against one or more operator token names.
     * If any operator names are provided, the function will only return true if this token IS an operator and its jsonKey or tokens match at least one entry.
     */
    isOperator(...opNames: string[]): boolean;
    /**
     * Returns true if this token represents a top level clause, like WHERE or GROUP BY, or false for other tokens.
     */
    isTopClause(): boolean;
    /**
     * Returns true if this token represents a structural operator
     */
    isStructuralOperator(): boolean;
    /**
     * Merges multiple tokens into a single, new token.
     */
    merge(sequence: SQXToken[], index: number, count: number): void;
    /**
     * Climbs the operator tree from the current token until it reaches the TOP of the operator tree.
     */
    findExpressionRoot(): SQXToken;
    findExpressionRange(): {
        expression_start: number;
        expression_end: number;
    };
}

export declare class SQXTokenCollection extends SQXGroupBase<SQXToken> {
    static opSpec: SQXOperatorMetadata;
    constructor();
    fromParser(cursor: SQXParseCursor, tokenIndex: number, peers?: SQXToken[], parameters?: SQXToken[]): void;
}

export declare interface Stats {
    enabled: {
        true: number;
        false: number;
    };
    output: {
        visibility: {
            notification: number;
            incident: number;
        };
    };
}

export declare interface SubmitSearchResponse {
    search_uuid: string;
    search_status: 'suspended' | 'pending' | 'complete' | 'failed';
    start_ts: number;
    update_ts: number;
    status_details: string;
    progress: number;
}

export declare interface SuggestedFieldDescriptor {
    aggregators?: string[];
    array?: boolean;
    depends_on?: SuggestedFieldSpecification[];
    displayable?: boolean;
    groupable?: boolean;
    name?: string;
    operators?: string[];
    id?: SuggestedFieldSpecification;
    path?: string;
    search_name?: string;
    searchable: boolean;
    sortable?: boolean;
    type: string;
}

export declare interface SuggestedFieldSpecification {
    ns: string;
    id: string;
}

export declare interface SuggestedTerm {
    field: SuggestedFieldSpecification;
    field_descriptor: SuggestedFieldDescriptor;
    values: (SuggestedTermValue | string | number)[];
}

export declare interface SuggestedTermValue {
    value: string;
    display: string;
}

export declare interface SuggestionNamespaceSpecification {
    ns: string;
    max_names?: number;
}

export declare interface SuggestionQueryGlobalOptions {
    exclude_filter_names?: boolean;
    exclude_filter_values?: boolean;
    exclude_id_names?: boolean;
    exclude_unused_entries?: boolean;
}

export declare const SuggestionsClient: AlSuggestionsClientInstanceV1;

export declare interface SuggestionsRequestParams {
    subject?: string;
    suggest_names?: SuggestionNamespaceSpecification[];
    suggest_values?: SuggestValueSpecification[];
    options?: SuggestionQueryGlobalOptions;
    filter?: any;
}

export declare interface SuggestionsSearchQuery {
    select: any;
    where: any;
    order_by?: any;
    group_by?: any;
    having?: any;
    limit?: number;
    time_range?: any;
}

export declare interface SuggestSearchResponse {
    suggested_terms: SuggestedTerm[];
}

export declare interface SuggestValueSpecification {
    field: SuggestedFieldSpecification;
    max_values?: string;
    max_names?: string;
}

export declare interface TimeRangeSpecification {
    end_timestamp?: number;
    start_timestamp?: number;
    timespan?: number;
}

export declare interface TokensMetadata {
    type: string;
    taxonomy: string;
    parent: string | null;
    path: string;
    id: string;
}

export declare interface TranslateSearchRequest {
    response_format?: 'search';
    search_request: SuggestionsSearchQuery;
}

export declare interface TranslateSearchResponse {
    response_format: string;
    search_request: {
        field_descriptors: SuggestedFieldDescriptor[];
    };
    errors: DescribeSearchError[];
}

export declare interface UpdateSavedQueryParams {
    data_type?: string;
    group_id?: string;
    name?: string;
    search_request?: any;
    deleted?: boolean;
}

declare interface UserTimeStamp {
    at?: number;
    by?: string;
}

export declare type ValidPropertiesV2 = 'tags';

export { }
