/**
 * OCSF (Open Cybersecurity Schema Framework) v1.3 types for audit events.
 * See https://schema.ocsf.io/ for the full spec.
 *
 * We implement a subset relevant to Superblocks audit logging:
 * - Category 3: Identity & Access Management
 * - Category 6: Application Activity
 */
export declare enum OCSFCategoryUid {
    IAM = 3,
    APPLICATION_ACTIVITY = 6
}
export declare enum OCSFClassUid {
    ACCOUNT_CHANGE = 3001,
    AUTHENTICATION = 3002,
    ENTITY_MANAGEMENT = 3004,
    USER_ACCESS_MANAGEMENT = 3005,
    APPLICATION_LIFECYCLE = 6002,
    API_ACTIVITY = 6003
}
export declare enum OCSFActivityId {
    UNKNOWN = 0,
    CREATE = 1,
    READ = 2,
    UPDATE = 3,
    DELETE = 4,
    EXECUTE = 5,
    LOGIN = 6,
    LOGOUT = 7,
    DEPLOY = 8,
    GRANT = 9,
    REVOKE = 10,
    OTHER = 99
}
export declare enum OCSFStatusId {
    UNKNOWN = 0,
    SUCCESS = 1,
    FAILURE = 2,
    IN_PROGRESS = 99
}
export declare enum OCSFSeverityId {
    UNKNOWN = 0,
    INFORMATIONAL = 1,
    LOW = 2,
    MEDIUM = 3,
    HIGH = 4,
    CRITICAL = 5,
    FATAL = 6
}
export interface OCSFActor {
    user: {
        uid: string;
        name?: string;
        email_addr?: string;
        type?: string;
    };
    session?: {
        uid: string;
    };
}
export interface OCSFResource {
    uid: string;
    type: string;
    name?: string;
}
export interface OCSFApi {
    operation: string;
    service: {
        name: string;
    };
}
export interface OCSFMetadata {
    product: {
        name: string;
        vendor_name: string;
    };
    version: string;
    log_name: string;
}
/**
 * Core OCSF event shape stored in audit_event.data (jsonb).
 * `type_uid` = class_uid * 100 + activity_id (OCSF convention).
 */
export interface OCSFAuditEvent {
    category_uid: OCSFCategoryUid;
    class_uid: OCSFClassUid;
    activity_id: OCSFActivityId;
    type_uid: number;
    status_id: OCSFStatusId;
    severity_id: OCSFSeverityId;
    time: number;
    duration?: number;
    actor: OCSFActor;
    resource: OCSFResource;
    api?: OCSFApi;
    metadata: OCSFMetadata;
    unmapped?: Record<string, unknown>;
}
export declare function computeTypeUid(classUid: OCSFClassUid, activityId: OCSFActivityId): number;
/**
 * Describes one group of audit events sharing a class, category, and resource type.
 * Used by the MCP `list_audit_event_types` tool so consumers can discover valid
 * filter values for `get_audit_events`.
 *
 * **Sync contract**: the server-side test `auditEventCatalog.test.ts` validates
 * that every `AuditOp` operation is present in this catalog. If you add a new
 * `AuditOp` or `auditResource` entry, add the operation here too — CI will
 * fail otherwise.
 */
export interface AuditEventTypeEntry {
    class_uid: OCSFClassUid;
    class_name: string;
    category_uid: OCSFCategoryUid;
    category_name: string;
    resource_type: string;
    operations: string[];
}
/**
 * Complete catalog of OCSF audit event types emitted by Superblocks.
 * Derived from `auditResource` (class/category/resource) and `AuditOp` (operations)
 * in `packages/server/src/middleware/auditEvent.ts`.
 */
export declare const AUDIT_EVENT_TYPE_CATALOG: AuditEventTypeEntry[];
export declare function buildOCSFMetadata(logName: string): OCSFMetadata;
//# sourceMappingURL=ocsf.d.ts.map