/**
 * Incident Response System - Type Definitions
 *
 * Comprehensive type definitions for incident management,
 * playbook execution, and notification handling.
 */
import { z } from 'zod';
export declare const IncidentSeverity: {
    readonly P1: "P1";
    readonly P2: "P2";
    readonly P3: "P3";
    readonly P4: "P4";
};
export type IncidentSeverity = (typeof IncidentSeverity)[keyof typeof IncidentSeverity];
export declare const IncidentStatus: {
    readonly DETECTED: "detected";
    readonly INVESTIGATING: "investigating";
    readonly CONTAINED: "contained";
    readonly ERADICATED: "eradicated";
    readonly RECOVERED: "recovered";
    readonly CLOSED: "closed";
};
export type IncidentStatus = (typeof IncidentStatus)[keyof typeof IncidentStatus];
export declare const IncidentType: {
    readonly DATA_BREACH: "data_breach";
    readonly ACCOUNT_COMPROMISE: "account_compromise";
    readonly MALWARE: "malware";
    readonly DENIAL_OF_SERVICE: "denial_of_service";
    readonly UNAUTHORIZED_ACCESS: "unauthorized_access";
    readonly INSIDER_THREAT: "insider_threat";
    readonly PHISHING: "phishing";
    readonly RANSOMWARE: "ransomware";
    readonly CONFIGURATION_ERROR: "configuration_error";
    readonly OTHER: "other";
};
export type IncidentType = (typeof IncidentType)[keyof typeof IncidentType];
export declare const StepType: {
    readonly MANUAL: "manual";
    readonly AUTOMATED: "automated";
};
export type StepType = (typeof StepType)[keyof typeof StepType];
export declare const NotificationChannel: {
    readonly SLACK: "slack";
    readonly EMAIL: "email";
    readonly PAGERDUTY: "pagerduty";
    readonly WEBHOOK: "webhook";
    readonly SMS: "sms";
};
export type NotificationChannel = (typeof NotificationChannel)[keyof typeof NotificationChannel];
export declare const TimelineEntryType: {
    readonly CREATED: "created";
    readonly STATUS_CHANGE: "status_change";
    readonly ASSIGNMENT: "assignment";
    readonly COMMENT: "comment";
    readonly EVIDENCE_ADDED: "evidence_added";
    readonly PLAYBOOK_STARTED: "playbook_started";
    readonly PLAYBOOK_STEP_COMPLETED: "playbook_step_completed";
    readonly PLAYBOOK_STEP_FAILED: "playbook_step_failed";
    readonly NOTIFICATION_SENT: "notification_sent";
    readonly ESCALATION: "escalation";
    readonly RESOLUTION: "resolution";
};
export type TimelineEntryType = (typeof TimelineEntryType)[keyof typeof TimelineEntryType];
export declare const EvidenceSchema: z.ZodObject<{
    id: z.ZodString;
    type: z.ZodEnum<["log", "screenshot", "file", "network_capture", "memory_dump", "configuration", "other"]>;
    name: z.ZodString;
    description: z.ZodOptional<z.ZodString>;
    source: z.ZodString;
    collectedAt: z.ZodDate;
    collectedBy: z.ZodString;
    hash: z.ZodOptional<z.ZodString>;
    size: z.ZodOptional<z.ZodNumber>;
    location: z.ZodString;
    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
}, "strip", z.ZodTypeAny, {
    name?: string;
    id?: string;
    description?: string;
    type?: "other" | "file" | "configuration" | "log" | "screenshot" | "network_capture" | "memory_dump";
    metadata?: Record<string, unknown>;
    location?: string;
    source?: string;
    size?: number;
    hash?: string;
    collectedAt?: Date;
    collectedBy?: string;
}, {
    name?: string;
    id?: string;
    description?: string;
    type?: "other" | "file" | "configuration" | "log" | "screenshot" | "network_capture" | "memory_dump";
    metadata?: Record<string, unknown>;
    location?: string;
    source?: string;
    size?: number;
    hash?: string;
    collectedAt?: Date;
    collectedBy?: string;
}>;
export type Evidence = z.infer<typeof EvidenceSchema>;
export declare const TimelineEntrySchema: z.ZodObject<{
    id: z.ZodString;
    timestamp: z.ZodDate;
    type: z.ZodNativeEnum<{
        readonly CREATED: "created";
        readonly STATUS_CHANGE: "status_change";
        readonly ASSIGNMENT: "assignment";
        readonly COMMENT: "comment";
        readonly EVIDENCE_ADDED: "evidence_added";
        readonly PLAYBOOK_STARTED: "playbook_started";
        readonly PLAYBOOK_STEP_COMPLETED: "playbook_step_completed";
        readonly PLAYBOOK_STEP_FAILED: "playbook_step_failed";
        readonly NOTIFICATION_SENT: "notification_sent";
        readonly ESCALATION: "escalation";
        readonly RESOLUTION: "resolution";
    }>;
    actor: z.ZodString;
    description: z.ZodString;
    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
    automated: z.ZodDefault<z.ZodBoolean>;
}, "strip", z.ZodTypeAny, {
    id?: string;
    description?: string;
    type?: "escalation" | "resolution" | "created" | "assignment" | "status_change" | "comment" | "evidence_added" | "playbook_started" | "playbook_step_completed" | "playbook_step_failed" | "notification_sent";
    metadata?: Record<string, unknown>;
    timestamp?: Date;
    actor?: string;
    automated?: boolean;
}, {
    id?: string;
    description?: string;
    type?: "escalation" | "resolution" | "created" | "assignment" | "status_change" | "comment" | "evidence_added" | "playbook_started" | "playbook_step_completed" | "playbook_step_failed" | "notification_sent";
    metadata?: Record<string, unknown>;
    timestamp?: Date;
    actor?: string;
    automated?: boolean;
}>;
export type TimelineEntry = z.infer<typeof TimelineEntrySchema>;
export declare const TriggerConditionSchema: z.ZodObject<{
    field: z.ZodString;
    operator: z.ZodEnum<["equals", "contains", "matches", "gt", "lt", "gte", "lte", "in", "not_in"]>;
    value: z.ZodUnknown;
    logicalOperator: z.ZodOptional<z.ZodEnum<["and", "or"]>>;
}, "strip", z.ZodTypeAny, {
    operator?: "equals" | "in" | "not_in" | "contains" | "matches" | "gt" | "lt" | "gte" | "lte";
    value?: unknown;
    field?: string;
    logicalOperator?: "and" | "or";
}, {
    operator?: "equals" | "in" | "not_in" | "contains" | "matches" | "gt" | "lt" | "gte" | "lte";
    value?: unknown;
    field?: string;
    logicalOperator?: "and" | "or";
}>;
export type TriggerCondition = z.infer<typeof TriggerConditionSchema>;
export declare const NotificationConfigSchema: z.ZodObject<{
    channel: z.ZodNativeEnum<{
        readonly SLACK: "slack";
        readonly EMAIL: "email";
        readonly PAGERDUTY: "pagerduty";
        readonly WEBHOOK: "webhook";
        readonly SMS: "sms";
    }>;
    target: z.ZodString;
    template: z.ZodOptional<z.ZodString>;
    severityFilter: z.ZodOptional<z.ZodArray<z.ZodNativeEnum<{
        readonly P1: "P1";
        readonly P2: "P2";
        readonly P3: "P3";
        readonly P4: "P4";
    }>, "many">>;
    enabled: z.ZodDefault<z.ZodBoolean>;
    retryAttempts: z.ZodDefault<z.ZodNumber>;
    retryDelayMs: z.ZodDefault<z.ZodNumber>;
}, "strip", z.ZodTypeAny, {
    target?: string;
    enabled?: boolean;
    retryAttempts?: number;
    retryDelayMs?: number;
    channel?: "email" | "webhook" | "slack" | "pagerduty" | "sms";
    template?: string;
    severityFilter?: ("P1" | "P2" | "P3" | "P4")[];
}, {
    target?: string;
    enabled?: boolean;
    retryAttempts?: number;
    retryDelayMs?: number;
    channel?: "email" | "webhook" | "slack" | "pagerduty" | "sms";
    template?: string;
    severityFilter?: ("P1" | "P2" | "P3" | "P4")[];
}>;
export type NotificationConfig = z.infer<typeof NotificationConfigSchema>;
export declare const EscalationLevelSchema: z.ZodObject<{
    level: z.ZodNumber;
    afterMinutes: z.ZodNumber;
    targets: z.ZodArray<z.ZodString, "many">;
    channels: z.ZodArray<z.ZodNativeEnum<{
        readonly SLACK: "slack";
        readonly EMAIL: "email";
        readonly PAGERDUTY: "pagerduty";
        readonly WEBHOOK: "webhook";
        readonly SMS: "sms";
    }>, "many">;
    message: z.ZodOptional<z.ZodString>;
}, "strip", z.ZodTypeAny, {
    level?: number;
    message?: string;
    channels?: ("email" | "webhook" | "slack" | "pagerduty" | "sms")[];
    afterMinutes?: number;
    targets?: string[];
}, {
    level?: number;
    message?: string;
    channels?: ("email" | "webhook" | "slack" | "pagerduty" | "sms")[];
    afterMinutes?: number;
    targets?: string[];
}>;
export type EscalationLevel = z.infer<typeof EscalationLevelSchema>;
export declare const EscalationConfigSchema: z.ZodObject<{
    enabled: z.ZodDefault<z.ZodBoolean>;
    levels: z.ZodArray<z.ZodObject<{
        level: z.ZodNumber;
        afterMinutes: z.ZodNumber;
        targets: z.ZodArray<z.ZodString, "many">;
        channels: z.ZodArray<z.ZodNativeEnum<{
            readonly SLACK: "slack";
            readonly EMAIL: "email";
            readonly PAGERDUTY: "pagerduty";
            readonly WEBHOOK: "webhook";
            readonly SMS: "sms";
        }>, "many">;
        message: z.ZodOptional<z.ZodString>;
    }, "strip", z.ZodTypeAny, {
        level?: number;
        message?: string;
        channels?: ("email" | "webhook" | "slack" | "pagerduty" | "sms")[];
        afterMinutes?: number;
        targets?: string[];
    }, {
        level?: number;
        message?: string;
        channels?: ("email" | "webhook" | "slack" | "pagerduty" | "sms")[];
        afterMinutes?: number;
        targets?: string[];
    }>, "many">;
    maxLevel: z.ZodDefault<z.ZodNumber>;
    resetOnAcknowledge: z.ZodDefault<z.ZodBoolean>;
}, "strip", z.ZodTypeAny, {
    levels?: {
        level?: number;
        message?: string;
        channels?: ("email" | "webhook" | "slack" | "pagerduty" | "sms")[];
        afterMinutes?: number;
        targets?: string[];
    }[];
    enabled?: boolean;
    maxLevel?: number;
    resetOnAcknowledge?: boolean;
}, {
    levels?: {
        level?: number;
        message?: string;
        channels?: ("email" | "webhook" | "slack" | "pagerduty" | "sms")[];
        afterMinutes?: number;
        targets?: string[];
    }[];
    enabled?: boolean;
    maxLevel?: number;
    resetOnAcknowledge?: boolean;
}>;
export type EscalationConfig = z.infer<typeof EscalationConfigSchema>;
export declare const PlaybookStepSchema: z.ZodObject<{
    id: z.ZodString;
    name: z.ZodString;
    type: z.ZodNativeEnum<{
        readonly MANUAL: "manual";
        readonly AUTOMATED: "automated";
    }>;
    description: z.ZodString;
    action: z.ZodOptional<z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodPromise<z.ZodVoid>>>;
    actionId: z.ZodOptional<z.ZodString>;
    timeout: z.ZodOptional<z.ZodNumber>;
    requiresApproval: z.ZodDefault<z.ZodBoolean>;
    approvers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    onFailure: z.ZodDefault<z.ZodEnum<["continue", "halt", "retry"]>>;
    retryAttempts: z.ZodDefault<z.ZodNumber>;
    dependencies: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
}, "strip", z.ZodTypeAny, {
    timeout?: number;
    name?: string;
    action?: (...args: unknown[]) => Promise<void>;
    id?: string;
    description?: string;
    type?: "manual" | "automated";
    metadata?: Record<string, unknown>;
    retryAttempts?: number;
    dependencies?: string[];
    requiresApproval?: boolean;
    onFailure?: "retry" | "continue" | "halt";
    actionId?: string;
    approvers?: string[];
}, {
    timeout?: number;
    name?: string;
    action?: (...args: unknown[]) => Promise<void>;
    id?: string;
    description?: string;
    type?: "manual" | "automated";
    metadata?: Record<string, unknown>;
    retryAttempts?: number;
    dependencies?: string[];
    requiresApproval?: boolean;
    onFailure?: "retry" | "continue" | "halt";
    actionId?: string;
    approvers?: string[];
}>;
export type PlaybookStep = z.infer<typeof PlaybookStepSchema>;
/**
 * Input type for creating playbook steps - allows optional fields with defaults
 */
export type PlaybookStepInput = Omit<PlaybookStep, 'requiresApproval' | 'onFailure' | 'retryAttempts'> & {
    requiresApproval?: boolean;
    onFailure?: 'continue' | 'halt' | 'retry';
    retryAttempts?: number;
    actionId?: string;
};
export declare const PlaybookSchema: z.ZodObject<{
    id: z.ZodString;
    name: z.ZodString;
    description: z.ZodOptional<z.ZodString>;
    version: z.ZodDefault<z.ZodString>;
    triggerConditions: z.ZodArray<z.ZodObject<{
        field: z.ZodString;
        operator: z.ZodEnum<["equals", "contains", "matches", "gt", "lt", "gte", "lte", "in", "not_in"]>;
        value: z.ZodUnknown;
        logicalOperator: z.ZodOptional<z.ZodEnum<["and", "or"]>>;
    }, "strip", z.ZodTypeAny, {
        operator?: "equals" | "in" | "not_in" | "contains" | "matches" | "gt" | "lt" | "gte" | "lte";
        value?: unknown;
        field?: string;
        logicalOperator?: "and" | "or";
    }, {
        operator?: "equals" | "in" | "not_in" | "contains" | "matches" | "gt" | "lt" | "gte" | "lte";
        value?: unknown;
        field?: string;
        logicalOperator?: "and" | "or";
    }>, "many">;
    steps: z.ZodArray<z.ZodObject<{
        id: z.ZodString;
        name: z.ZodString;
        type: z.ZodNativeEnum<{
            readonly MANUAL: "manual";
            readonly AUTOMATED: "automated";
        }>;
        description: z.ZodString;
        action: z.ZodOptional<z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodPromise<z.ZodVoid>>>;
        actionId: z.ZodOptional<z.ZodString>;
        timeout: z.ZodOptional<z.ZodNumber>;
        requiresApproval: z.ZodDefault<z.ZodBoolean>;
        approvers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
        onFailure: z.ZodDefault<z.ZodEnum<["continue", "halt", "retry"]>>;
        retryAttempts: z.ZodDefault<z.ZodNumber>;
        dependencies: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
    }, "strip", z.ZodTypeAny, {
        timeout?: number;
        name?: string;
        action?: (...args: unknown[]) => Promise<void>;
        id?: string;
        description?: string;
        type?: "manual" | "automated";
        metadata?: Record<string, unknown>;
        retryAttempts?: number;
        dependencies?: string[];
        requiresApproval?: boolean;
        onFailure?: "retry" | "continue" | "halt";
        actionId?: string;
        approvers?: string[];
    }, {
        timeout?: number;
        name?: string;
        action?: (...args: unknown[]) => Promise<void>;
        id?: string;
        description?: string;
        type?: "manual" | "automated";
        metadata?: Record<string, unknown>;
        retryAttempts?: number;
        dependencies?: string[];
        requiresApproval?: boolean;
        onFailure?: "retry" | "continue" | "halt";
        actionId?: string;
        approvers?: string[];
    }>, "many">;
    notifications: z.ZodArray<z.ZodObject<{
        channel: z.ZodNativeEnum<{
            readonly SLACK: "slack";
            readonly EMAIL: "email";
            readonly PAGERDUTY: "pagerduty";
            readonly WEBHOOK: "webhook";
            readonly SMS: "sms";
        }>;
        target: z.ZodString;
        template: z.ZodOptional<z.ZodString>;
        severityFilter: z.ZodOptional<z.ZodArray<z.ZodNativeEnum<{
            readonly P1: "P1";
            readonly P2: "P2";
            readonly P3: "P3";
            readonly P4: "P4";
        }>, "many">>;
        enabled: z.ZodDefault<z.ZodBoolean>;
        retryAttempts: z.ZodDefault<z.ZodNumber>;
        retryDelayMs: z.ZodDefault<z.ZodNumber>;
    }, "strip", z.ZodTypeAny, {
        target?: string;
        enabled?: boolean;
        retryAttempts?: number;
        retryDelayMs?: number;
        channel?: "email" | "webhook" | "slack" | "pagerduty" | "sms";
        template?: string;
        severityFilter?: ("P1" | "P2" | "P3" | "P4")[];
    }, {
        target?: string;
        enabled?: boolean;
        retryAttempts?: number;
        retryDelayMs?: number;
        channel?: "email" | "webhook" | "slack" | "pagerduty" | "sms";
        template?: string;
        severityFilter?: ("P1" | "P2" | "P3" | "P4")[];
    }>, "many">;
    escalation: z.ZodObject<{
        enabled: z.ZodDefault<z.ZodBoolean>;
        levels: z.ZodArray<z.ZodObject<{
            level: z.ZodNumber;
            afterMinutes: z.ZodNumber;
            targets: z.ZodArray<z.ZodString, "many">;
            channels: z.ZodArray<z.ZodNativeEnum<{
                readonly SLACK: "slack";
                readonly EMAIL: "email";
                readonly PAGERDUTY: "pagerduty";
                readonly WEBHOOK: "webhook";
                readonly SMS: "sms";
            }>, "many">;
            message: z.ZodOptional<z.ZodString>;
        }, "strip", z.ZodTypeAny, {
            level?: number;
            message?: string;
            channels?: ("email" | "webhook" | "slack" | "pagerduty" | "sms")[];
            afterMinutes?: number;
            targets?: string[];
        }, {
            level?: number;
            message?: string;
            channels?: ("email" | "webhook" | "slack" | "pagerduty" | "sms")[];
            afterMinutes?: number;
            targets?: string[];
        }>, "many">;
        maxLevel: z.ZodDefault<z.ZodNumber>;
        resetOnAcknowledge: z.ZodDefault<z.ZodBoolean>;
    }, "strip", z.ZodTypeAny, {
        levels?: {
            level?: number;
            message?: string;
            channels?: ("email" | "webhook" | "slack" | "pagerduty" | "sms")[];
            afterMinutes?: number;
            targets?: string[];
        }[];
        enabled?: boolean;
        maxLevel?: number;
        resetOnAcknowledge?: boolean;
    }, {
        levels?: {
            level?: number;
            message?: string;
            channels?: ("email" | "webhook" | "slack" | "pagerduty" | "sms")[];
            afterMinutes?: number;
            targets?: string[];
        }[];
        enabled?: boolean;
        maxLevel?: number;
        resetOnAcknowledge?: boolean;
    }>;
    enabled: z.ZodDefault<z.ZodBoolean>;
    tags: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    createdAt: z.ZodOptional<z.ZodDate>;
    updatedAt: z.ZodOptional<z.ZodDate>;
}, "strip", z.ZodTypeAny, {
    version?: string;
    name?: string;
    id?: string;
    description?: string;
    enabled?: boolean;
    escalation?: {
        levels?: {
            level?: number;
            message?: string;
            channels?: ("email" | "webhook" | "slack" | "pagerduty" | "sms")[];
            afterMinutes?: number;
            targets?: string[];
        }[];
        enabled?: boolean;
        maxLevel?: number;
        resetOnAcknowledge?: boolean;
    };
    createdAt?: Date;
    updatedAt?: Date;
    tags?: string[];
    notifications?: {
        target?: string;
        enabled?: boolean;
        retryAttempts?: number;
        retryDelayMs?: number;
        channel?: "email" | "webhook" | "slack" | "pagerduty" | "sms";
        template?: string;
        severityFilter?: ("P1" | "P2" | "P3" | "P4")[];
    }[];
    triggerConditions?: {
        operator?: "equals" | "in" | "not_in" | "contains" | "matches" | "gt" | "lt" | "gte" | "lte";
        value?: unknown;
        field?: string;
        logicalOperator?: "and" | "or";
    }[];
    steps?: {
        timeout?: number;
        name?: string;
        action?: (...args: unknown[]) => Promise<void>;
        id?: string;
        description?: string;
        type?: "manual" | "automated";
        metadata?: Record<string, unknown>;
        retryAttempts?: number;
        dependencies?: string[];
        requiresApproval?: boolean;
        onFailure?: "retry" | "continue" | "halt";
        actionId?: string;
        approvers?: string[];
    }[];
}, {
    version?: string;
    name?: string;
    id?: string;
    description?: string;
    enabled?: boolean;
    escalation?: {
        levels?: {
            level?: number;
            message?: string;
            channels?: ("email" | "webhook" | "slack" | "pagerduty" | "sms")[];
            afterMinutes?: number;
            targets?: string[];
        }[];
        enabled?: boolean;
        maxLevel?: number;
        resetOnAcknowledge?: boolean;
    };
    createdAt?: Date;
    updatedAt?: Date;
    tags?: string[];
    notifications?: {
        target?: string;
        enabled?: boolean;
        retryAttempts?: number;
        retryDelayMs?: number;
        channel?: "email" | "webhook" | "slack" | "pagerduty" | "sms";
        template?: string;
        severityFilter?: ("P1" | "P2" | "P3" | "P4")[];
    }[];
    triggerConditions?: {
        operator?: "equals" | "in" | "not_in" | "contains" | "matches" | "gt" | "lt" | "gte" | "lte";
        value?: unknown;
        field?: string;
        logicalOperator?: "and" | "or";
    }[];
    steps?: {
        timeout?: number;
        name?: string;
        action?: (...args: unknown[]) => Promise<void>;
        id?: string;
        description?: string;
        type?: "manual" | "automated";
        metadata?: Record<string, unknown>;
        retryAttempts?: number;
        dependencies?: string[];
        requiresApproval?: boolean;
        onFailure?: "retry" | "continue" | "halt";
        actionId?: string;
        approvers?: string[];
    }[];
}>;
export type Playbook = z.infer<typeof PlaybookSchema>;
/**
 * Input type for creating playbooks - allows optional fields with defaults
 */
export type PlaybookInput = Omit<Playbook, 'steps' | 'version' | 'enabled'> & {
    steps: PlaybookStepInput[];
    version?: string;
    enabled?: boolean;
};
export declare const IncidentSchema: z.ZodObject<{
    id: z.ZodString;
    title: z.ZodString;
    description: z.ZodString;
    severity: z.ZodNativeEnum<{
        readonly P1: "P1";
        readonly P2: "P2";
        readonly P3: "P3";
        readonly P4: "P4";
    }>;
    status: z.ZodNativeEnum<{
        readonly DETECTED: "detected";
        readonly INVESTIGATING: "investigating";
        readonly CONTAINED: "contained";
        readonly ERADICATED: "eradicated";
        readonly RECOVERED: "recovered";
        readonly CLOSED: "closed";
    }>;
    type: z.ZodNativeEnum<{
        readonly DATA_BREACH: "data_breach";
        readonly ACCOUNT_COMPROMISE: "account_compromise";
        readonly MALWARE: "malware";
        readonly DENIAL_OF_SERVICE: "denial_of_service";
        readonly UNAUTHORIZED_ACCESS: "unauthorized_access";
        readonly INSIDER_THREAT: "insider_threat";
        readonly PHISHING: "phishing";
        readonly RANSOMWARE: "ransomware";
        readonly CONFIGURATION_ERROR: "configuration_error";
        readonly OTHER: "other";
    }>;
    detectedAt: z.ZodDate;
    acknowledgedAt: z.ZodOptional<z.ZodDate>;
    containedAt: z.ZodOptional<z.ZodDate>;
    resolvedAt: z.ZodOptional<z.ZodDate>;
    closedAt: z.ZodOptional<z.ZodDate>;
    assignee: z.ZodOptional<z.ZodString>;
    team: z.ZodOptional<z.ZodString>;
    affectedResources: z.ZodArray<z.ZodString, "many">;
    timeline: z.ZodArray<z.ZodObject<{
        id: z.ZodString;
        timestamp: z.ZodDate;
        type: z.ZodNativeEnum<{
            readonly CREATED: "created";
            readonly STATUS_CHANGE: "status_change";
            readonly ASSIGNMENT: "assignment";
            readonly COMMENT: "comment";
            readonly EVIDENCE_ADDED: "evidence_added";
            readonly PLAYBOOK_STARTED: "playbook_started";
            readonly PLAYBOOK_STEP_COMPLETED: "playbook_step_completed";
            readonly PLAYBOOK_STEP_FAILED: "playbook_step_failed";
            readonly NOTIFICATION_SENT: "notification_sent";
            readonly ESCALATION: "escalation";
            readonly RESOLUTION: "resolution";
        }>;
        actor: z.ZodString;
        description: z.ZodString;
        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
        automated: z.ZodDefault<z.ZodBoolean>;
    }, "strip", z.ZodTypeAny, {
        id?: string;
        description?: string;
        type?: "escalation" | "resolution" | "created" | "assignment" | "status_change" | "comment" | "evidence_added" | "playbook_started" | "playbook_step_completed" | "playbook_step_failed" | "notification_sent";
        metadata?: Record<string, unknown>;
        timestamp?: Date;
        actor?: string;
        automated?: boolean;
    }, {
        id?: string;
        description?: string;
        type?: "escalation" | "resolution" | "created" | "assignment" | "status_change" | "comment" | "evidence_added" | "playbook_started" | "playbook_step_completed" | "playbook_step_failed" | "notification_sent";
        metadata?: Record<string, unknown>;
        timestamp?: Date;
        actor?: string;
        automated?: boolean;
    }>, "many">;
    evidence: z.ZodArray<z.ZodObject<{
        id: z.ZodString;
        type: z.ZodEnum<["log", "screenshot", "file", "network_capture", "memory_dump", "configuration", "other"]>;
        name: z.ZodString;
        description: z.ZodOptional<z.ZodString>;
        source: z.ZodString;
        collectedAt: z.ZodDate;
        collectedBy: z.ZodString;
        hash: z.ZodOptional<z.ZodString>;
        size: z.ZodOptional<z.ZodNumber>;
        location: z.ZodString;
        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
    }, "strip", z.ZodTypeAny, {
        name?: string;
        id?: string;
        description?: string;
        type?: "other" | "file" | "configuration" | "log" | "screenshot" | "network_capture" | "memory_dump";
        metadata?: Record<string, unknown>;
        location?: string;
        source?: string;
        size?: number;
        hash?: string;
        collectedAt?: Date;
        collectedBy?: string;
    }, {
        name?: string;
        id?: string;
        description?: string;
        type?: "other" | "file" | "configuration" | "log" | "screenshot" | "network_capture" | "memory_dump";
        metadata?: Record<string, unknown>;
        location?: string;
        source?: string;
        size?: number;
        hash?: string;
        collectedAt?: Date;
        collectedBy?: string;
    }>, "many">;
    playbook: z.ZodOptional<z.ZodString>;
    playbookProgress: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["pending", "in_progress", "completed", "failed", "skipped"]>>>;
    tags: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    externalReferences: z.ZodOptional<z.ZodArray<z.ZodObject<{
        type: z.ZodString;
        id: z.ZodString;
        url: z.ZodOptional<z.ZodString>;
    }, "strip", z.ZodTypeAny, {
        id?: string;
        type?: string;
        url?: string;
    }, {
        id?: string;
        type?: string;
        url?: string;
    }>, "many">>;
    rootCause: z.ZodOptional<z.ZodString>;
    remediation: z.ZodOptional<z.ZodString>;
    lessonsLearned: z.ZodOptional<z.ZodString>;
    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
}, "strip", z.ZodTypeAny, {
    id?: string;
    description?: string;
    status?: "closed" | "detected" | "investigating" | "contained" | "eradicated" | "recovered";
    type?: "other" | "unauthorized_access" | "data_breach" | "account_compromise" | "malware" | "denial_of_service" | "insider_threat" | "phishing" | "ransomware" | "configuration_error";
    metadata?: Record<string, unknown>;
    resolvedAt?: Date;
    acknowledgedAt?: Date;
    severity?: "P1" | "P2" | "P3" | "P4";
    tags?: string[];
    team?: string;
    title?: string;
    evidence?: {
        name?: string;
        id?: string;
        description?: string;
        type?: "other" | "file" | "configuration" | "log" | "screenshot" | "network_capture" | "memory_dump";
        metadata?: Record<string, unknown>;
        location?: string;
        source?: string;
        size?: number;
        hash?: string;
        collectedAt?: Date;
        collectedBy?: string;
    }[];
    detectedAt?: Date;
    containedAt?: Date;
    closedAt?: Date;
    assignee?: string;
    affectedResources?: string[];
    timeline?: {
        id?: string;
        description?: string;
        type?: "escalation" | "resolution" | "created" | "assignment" | "status_change" | "comment" | "evidence_added" | "playbook_started" | "playbook_step_completed" | "playbook_step_failed" | "notification_sent";
        metadata?: Record<string, unknown>;
        timestamp?: Date;
        actor?: string;
        automated?: boolean;
    }[];
    playbook?: string;
    playbookProgress?: Record<string, "pending" | "completed" | "failed" | "in_progress" | "skipped">;
    externalReferences?: {
        id?: string;
        type?: string;
        url?: string;
    }[];
    rootCause?: string;
    remediation?: string;
    lessonsLearned?: string;
}, {
    id?: string;
    description?: string;
    status?: "closed" | "detected" | "investigating" | "contained" | "eradicated" | "recovered";
    type?: "other" | "unauthorized_access" | "data_breach" | "account_compromise" | "malware" | "denial_of_service" | "insider_threat" | "phishing" | "ransomware" | "configuration_error";
    metadata?: Record<string, unknown>;
    resolvedAt?: Date;
    acknowledgedAt?: Date;
    severity?: "P1" | "P2" | "P3" | "P4";
    tags?: string[];
    team?: string;
    title?: string;
    evidence?: {
        name?: string;
        id?: string;
        description?: string;
        type?: "other" | "file" | "configuration" | "log" | "screenshot" | "network_capture" | "memory_dump";
        metadata?: Record<string, unknown>;
        location?: string;
        source?: string;
        size?: number;
        hash?: string;
        collectedAt?: Date;
        collectedBy?: string;
    }[];
    detectedAt?: Date;
    containedAt?: Date;
    closedAt?: Date;
    assignee?: string;
    affectedResources?: string[];
    timeline?: {
        id?: string;
        description?: string;
        type?: "escalation" | "resolution" | "created" | "assignment" | "status_change" | "comment" | "evidence_added" | "playbook_started" | "playbook_step_completed" | "playbook_step_failed" | "notification_sent";
        metadata?: Record<string, unknown>;
        timestamp?: Date;
        actor?: string;
        automated?: boolean;
    }[];
    playbook?: string;
    playbookProgress?: Record<string, "pending" | "completed" | "failed" | "in_progress" | "skipped">;
    externalReferences?: {
        id?: string;
        type?: string;
        url?: string;
    }[];
    rootCause?: string;
    remediation?: string;
    lessonsLearned?: string;
}>;
export type Incident = z.infer<typeof IncidentSchema>;
export declare const CreateIncidentSchema: z.ZodObject<{
    description: z.ZodString;
    status: z.ZodNativeEnum<{
        readonly DETECTED: "detected";
        readonly INVESTIGATING: "investigating";
        readonly CONTAINED: "contained";
        readonly ERADICATED: "eradicated";
        readonly RECOVERED: "recovered";
        readonly CLOSED: "closed";
    }>;
    type: z.ZodNativeEnum<{
        readonly DATA_BREACH: "data_breach";
        readonly ACCOUNT_COMPROMISE: "account_compromise";
        readonly MALWARE: "malware";
        readonly DENIAL_OF_SERVICE: "denial_of_service";
        readonly UNAUTHORIZED_ACCESS: "unauthorized_access";
        readonly INSIDER_THREAT: "insider_threat";
        readonly PHISHING: "phishing";
        readonly RANSOMWARE: "ransomware";
        readonly CONFIGURATION_ERROR: "configuration_error";
        readonly OTHER: "other";
    }>;
    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
    severity: z.ZodNativeEnum<{
        readonly P1: "P1";
        readonly P2: "P2";
        readonly P3: "P3";
        readonly P4: "P4";
    }>;
    team: z.ZodOptional<z.ZodString>;
    title: z.ZodString;
    detectedAt: z.ZodDate;
    assignee: z.ZodOptional<z.ZodString>;
    playbook: z.ZodOptional<z.ZodString>;
    externalReferences: z.ZodOptional<z.ZodArray<z.ZodObject<{
        type: z.ZodString;
        id: z.ZodString;
        url: z.ZodOptional<z.ZodString>;
    }, "strip", z.ZodTypeAny, {
        id?: string;
        type?: string;
        url?: string;
    }, {
        id?: string;
        type?: string;
        url?: string;
    }>, "many">>;
    rootCause: z.ZodOptional<z.ZodString>;
    remediation: z.ZodOptional<z.ZodString>;
    lessonsLearned: z.ZodOptional<z.ZodString>;
} & {
    affectedResources: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
    tags: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
}, "strip", z.ZodTypeAny, {
    description?: string;
    status?: "closed" | "detected" | "investigating" | "contained" | "eradicated" | "recovered";
    type?: "other" | "unauthorized_access" | "data_breach" | "account_compromise" | "malware" | "denial_of_service" | "insider_threat" | "phishing" | "ransomware" | "configuration_error";
    metadata?: Record<string, unknown>;
    severity?: "P1" | "P2" | "P3" | "P4";
    tags?: string[];
    team?: string;
    title?: string;
    detectedAt?: Date;
    assignee?: string;
    affectedResources?: string[];
    playbook?: string;
    externalReferences?: {
        id?: string;
        type?: string;
        url?: string;
    }[];
    rootCause?: string;
    remediation?: string;
    lessonsLearned?: string;
}, {
    description?: string;
    status?: "closed" | "detected" | "investigating" | "contained" | "eradicated" | "recovered";
    type?: "other" | "unauthorized_access" | "data_breach" | "account_compromise" | "malware" | "denial_of_service" | "insider_threat" | "phishing" | "ransomware" | "configuration_error";
    metadata?: Record<string, unknown>;
    severity?: "P1" | "P2" | "P3" | "P4";
    tags?: string[];
    team?: string;
    title?: string;
    detectedAt?: Date;
    assignee?: string;
    affectedResources?: string[];
    playbook?: string;
    externalReferences?: {
        id?: string;
        type?: string;
        url?: string;
    }[];
    rootCause?: string;
    remediation?: string;
    lessonsLearned?: string;
}>;
export type CreateIncidentInput = z.infer<typeof CreateIncidentSchema>;
export declare const UpdateIncidentSchema: z.ZodObject<Omit<{
    id: z.ZodOptional<z.ZodString>;
    title: z.ZodOptional<z.ZodString>;
    description: z.ZodOptional<z.ZodString>;
    severity: z.ZodOptional<z.ZodNativeEnum<{
        readonly P1: "P1";
        readonly P2: "P2";
        readonly P3: "P3";
        readonly P4: "P4";
    }>>;
    status: z.ZodOptional<z.ZodNativeEnum<{
        readonly DETECTED: "detected";
        readonly INVESTIGATING: "investigating";
        readonly CONTAINED: "contained";
        readonly ERADICATED: "eradicated";
        readonly RECOVERED: "recovered";
        readonly CLOSED: "closed";
    }>>;
    type: z.ZodOptional<z.ZodNativeEnum<{
        readonly DATA_BREACH: "data_breach";
        readonly ACCOUNT_COMPROMISE: "account_compromise";
        readonly MALWARE: "malware";
        readonly DENIAL_OF_SERVICE: "denial_of_service";
        readonly UNAUTHORIZED_ACCESS: "unauthorized_access";
        readonly INSIDER_THREAT: "insider_threat";
        readonly PHISHING: "phishing";
        readonly RANSOMWARE: "ransomware";
        readonly CONFIGURATION_ERROR: "configuration_error";
        readonly OTHER: "other";
    }>>;
    detectedAt: z.ZodOptional<z.ZodDate>;
    acknowledgedAt: z.ZodOptional<z.ZodOptional<z.ZodDate>>;
    containedAt: z.ZodOptional<z.ZodOptional<z.ZodDate>>;
    resolvedAt: z.ZodOptional<z.ZodOptional<z.ZodDate>>;
    closedAt: z.ZodOptional<z.ZodOptional<z.ZodDate>>;
    assignee: z.ZodOptional<z.ZodOptional<z.ZodString>>;
    team: z.ZodOptional<z.ZodOptional<z.ZodString>>;
    affectedResources: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    timeline: z.ZodOptional<z.ZodArray<z.ZodObject<{
        id: z.ZodString;
        timestamp: z.ZodDate;
        type: z.ZodNativeEnum<{
            readonly CREATED: "created";
            readonly STATUS_CHANGE: "status_change";
            readonly ASSIGNMENT: "assignment";
            readonly COMMENT: "comment";
            readonly EVIDENCE_ADDED: "evidence_added";
            readonly PLAYBOOK_STARTED: "playbook_started";
            readonly PLAYBOOK_STEP_COMPLETED: "playbook_step_completed";
            readonly PLAYBOOK_STEP_FAILED: "playbook_step_failed";
            readonly NOTIFICATION_SENT: "notification_sent";
            readonly ESCALATION: "escalation";
            readonly RESOLUTION: "resolution";
        }>;
        actor: z.ZodString;
        description: z.ZodString;
        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
        automated: z.ZodDefault<z.ZodBoolean>;
    }, "strip", z.ZodTypeAny, {
        id?: string;
        description?: string;
        type?: "escalation" | "resolution" | "created" | "assignment" | "status_change" | "comment" | "evidence_added" | "playbook_started" | "playbook_step_completed" | "playbook_step_failed" | "notification_sent";
        metadata?: Record<string, unknown>;
        timestamp?: Date;
        actor?: string;
        automated?: boolean;
    }, {
        id?: string;
        description?: string;
        type?: "escalation" | "resolution" | "created" | "assignment" | "status_change" | "comment" | "evidence_added" | "playbook_started" | "playbook_step_completed" | "playbook_step_failed" | "notification_sent";
        metadata?: Record<string, unknown>;
        timestamp?: Date;
        actor?: string;
        automated?: boolean;
    }>, "many">>;
    evidence: z.ZodOptional<z.ZodArray<z.ZodObject<{
        id: z.ZodString;
        type: z.ZodEnum<["log", "screenshot", "file", "network_capture", "memory_dump", "configuration", "other"]>;
        name: z.ZodString;
        description: z.ZodOptional<z.ZodString>;
        source: z.ZodString;
        collectedAt: z.ZodDate;
        collectedBy: z.ZodString;
        hash: z.ZodOptional<z.ZodString>;
        size: z.ZodOptional<z.ZodNumber>;
        location: z.ZodString;
        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
    }, "strip", z.ZodTypeAny, {
        name?: string;
        id?: string;
        description?: string;
        type?: "other" | "file" | "configuration" | "log" | "screenshot" | "network_capture" | "memory_dump";
        metadata?: Record<string, unknown>;
        location?: string;
        source?: string;
        size?: number;
        hash?: string;
        collectedAt?: Date;
        collectedBy?: string;
    }, {
        name?: string;
        id?: string;
        description?: string;
        type?: "other" | "file" | "configuration" | "log" | "screenshot" | "network_capture" | "memory_dump";
        metadata?: Record<string, unknown>;
        location?: string;
        source?: string;
        size?: number;
        hash?: string;
        collectedAt?: Date;
        collectedBy?: string;
    }>, "many">>;
    playbook: z.ZodOptional<z.ZodOptional<z.ZodString>>;
    playbookProgress: z.ZodOptional<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["pending", "in_progress", "completed", "failed", "skipped"]>>>>;
    tags: z.ZodOptional<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
    externalReferences: z.ZodOptional<z.ZodOptional<z.ZodArray<z.ZodObject<{
        type: z.ZodString;
        id: z.ZodString;
        url: z.ZodOptional<z.ZodString>;
    }, "strip", z.ZodTypeAny, {
        id?: string;
        type?: string;
        url?: string;
    }, {
        id?: string;
        type?: string;
        url?: string;
    }>, "many">>>;
    rootCause: z.ZodOptional<z.ZodOptional<z.ZodString>>;
    remediation: z.ZodOptional<z.ZodOptional<z.ZodString>>;
    lessonsLearned: z.ZodOptional<z.ZodOptional<z.ZodString>>;
    metadata: z.ZodOptional<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
}, "id" | "detectedAt" | "timeline">, "strip", z.ZodTypeAny, {
    description?: string;
    status?: "closed" | "detected" | "investigating" | "contained" | "eradicated" | "recovered";
    type?: "other" | "unauthorized_access" | "data_breach" | "account_compromise" | "malware" | "denial_of_service" | "insider_threat" | "phishing" | "ransomware" | "configuration_error";
    metadata?: Record<string, unknown>;
    resolvedAt?: Date;
    acknowledgedAt?: Date;
    severity?: "P1" | "P2" | "P3" | "P4";
    tags?: string[];
    team?: string;
    title?: string;
    evidence?: {
        name?: string;
        id?: string;
        description?: string;
        type?: "other" | "file" | "configuration" | "log" | "screenshot" | "network_capture" | "memory_dump";
        metadata?: Record<string, unknown>;
        location?: string;
        source?: string;
        size?: number;
        hash?: string;
        collectedAt?: Date;
        collectedBy?: string;
    }[];
    containedAt?: Date;
    closedAt?: Date;
    assignee?: string;
    affectedResources?: string[];
    playbook?: string;
    playbookProgress?: Record<string, "pending" | "completed" | "failed" | "in_progress" | "skipped">;
    externalReferences?: {
        id?: string;
        type?: string;
        url?: string;
    }[];
    rootCause?: string;
    remediation?: string;
    lessonsLearned?: string;
}, {
    description?: string;
    status?: "closed" | "detected" | "investigating" | "contained" | "eradicated" | "recovered";
    type?: "other" | "unauthorized_access" | "data_breach" | "account_compromise" | "malware" | "denial_of_service" | "insider_threat" | "phishing" | "ransomware" | "configuration_error";
    metadata?: Record<string, unknown>;
    resolvedAt?: Date;
    acknowledgedAt?: Date;
    severity?: "P1" | "P2" | "P3" | "P4";
    tags?: string[];
    team?: string;
    title?: string;
    evidence?: {
        name?: string;
        id?: string;
        description?: string;
        type?: "other" | "file" | "configuration" | "log" | "screenshot" | "network_capture" | "memory_dump";
        metadata?: Record<string, unknown>;
        location?: string;
        source?: string;
        size?: number;
        hash?: string;
        collectedAt?: Date;
        collectedBy?: string;
    }[];
    containedAt?: Date;
    closedAt?: Date;
    assignee?: string;
    affectedResources?: string[];
    playbook?: string;
    playbookProgress?: Record<string, "pending" | "completed" | "failed" | "in_progress" | "skipped">;
    externalReferences?: {
        id?: string;
        type?: string;
        url?: string;
    }[];
    rootCause?: string;
    remediation?: string;
    lessonsLearned?: string;
}>;
export type UpdateIncidentInput = z.infer<typeof UpdateIncidentSchema>;
export interface IncidentReport {
    incident: Incident;
    generatedAt: Date;
    generatedBy: string;
    summary: {
        duration: number;
        timeToDetect?: number;
        timeToContain?: number;
        timeToResolve?: number;
        escalationLevel: number;
        playbookStepsCompleted: number;
        playbookStepsTotal: number;
        evidenceCount: number;
        notificationsSent: number;
    };
    timelineFormatted: string;
    impactAssessment?: string;
    recommendations: string[];
}
export interface IncidentMetrics {
    totalIncidents: number;
    byStatus: Record<IncidentStatus, number>;
    bySeverity: Record<IncidentSeverity, number>;
    byType: Record<IncidentType, number>;
    averageTimeToDetect: number;
    averageTimeToContain: number;
    averageTimeToResolve: number;
    averageTimeToClose: number;
}
export interface IncidentEvent {
    type: 'incident_created' | 'incident_updated' | 'incident_closed' | 'playbook_started' | 'playbook_completed' | 'playbook_failed' | 'step_completed' | 'step_failed' | 'escalation_triggered' | 'notification_sent' | 'evidence_added';
    incidentId: string;
    timestamp: Date;
    data: Record<string, unknown>;
}
export type IncidentEventHandler = (event: IncidentEvent) => void | Promise<void>;
export interface PlaybookExecutionContext {
    incident: Incident;
    playbook: Playbook;
    currentStepIndex: number;
    startedAt: Date;
    completedSteps: string[];
    failedSteps: string[];
    skippedSteps: string[];
    variables: Record<string, unknown>;
}
export interface StepExecutionResult {
    stepId: string;
    success: boolean;
    startedAt: Date;
    completedAt: Date;
    duration: number;
    output?: unknown;
    error?: string;
    retryCount: number;
}
export interface NotificationPayload {
    incidentId: string;
    title: string;
    message: string;
    severity: IncidentSeverity;
    status: IncidentStatus;
    url?: string;
    additionalData?: Record<string, unknown>;
}
export interface NotificationResult {
    channel: NotificationChannel;
    target: string;
    success: boolean;
    sentAt: Date;
    messageId?: string;
    error?: string;
    retryCount: number;
}
export interface IncidentManagerConfig {
    defaultEscalation: EscalationConfig;
    notificationDefaults: Partial<NotificationConfig>;
    autoAssignment: {
        enabled: boolean;
        rules: Array<{
            conditions: TriggerCondition[];
            assignee: string;
        }>;
    };
    retentionDays: number;
    webhooks: {
        slack?: string;
        pagerduty?: string;
        email?: {
            host: string;
            port: number;
            secure: boolean;
            auth?: {
                user: string;
                pass: string;
            };
        };
        custom?: Array<{
            name: string;
            url: string;
            headers?: Record<string, string>;
        }>;
    };
    /** Automation configuration */
    automation: {
        /** Whether automated playbook execution is enabled */
        enabled: boolean;
        /** Maximum concurrent playbook executions */
        maxConcurrentExecutions: number;
        /** Default timeout for automated steps in milliseconds */
        defaultStepTimeoutMs: number;
        /** Whether to persist execution state */
        persistState: boolean;
        /** State storage configuration */
        stateStorage?: {
            type: 'memory' | 'redis' | 'database';
            connectionString?: string;
        };
    };
}
/**
 * Execution state for a playbook
 */
export declare const ExecutionState: {
    readonly PENDING: "pending";
    readonly RUNNING: "running";
    readonly PAUSED: "paused";
    readonly WAITING_APPROVAL: "waiting_approval";
    readonly WAITING_MANUAL: "waiting_manual";
    readonly COMPLETED: "completed";
    readonly FAILED: "failed";
    readonly ROLLED_BACK: "rolled_back";
    readonly CANCELLED: "cancelled";
};
export type ExecutionState = (typeof ExecutionState)[keyof typeof ExecutionState];
/**
 * Step execution state
 */
export declare const StepState: {
    readonly PENDING: "pending";
    readonly QUEUED: "queued";
    readonly RUNNING: "running";
    readonly WAITING_APPROVAL: "waiting_approval";
    readonly COMPLETED: "completed";
    readonly FAILED: "failed";
    readonly SKIPPED: "skipped";
    readonly ROLLED_BACK: "rolled_back";
    readonly TIMED_OUT: "timed_out";
};
export type StepState = (typeof StepState)[keyof typeof StepState];
/**
 * Persistent execution state for a playbook run
 */
export interface PlaybookExecutionState {
    /** Unique execution ID */
    executionId: string;
    /** Associated incident ID */
    incidentId: string;
    /** Playbook ID being executed */
    playbookId: string;
    /** Current execution state */
    state: ExecutionState;
    /** State of each step */
    stepStates: Record<string, StepExecutionState>;
    /** Execution variables/context */
    variables: Record<string, unknown>;
    /** When execution started */
    startedAt: Date;
    /** When execution was last updated */
    updatedAt: Date;
    /** When execution completed (if applicable) */
    completedAt?: Date;
    /** Error message if failed */
    error?: string;
    /** Steps that have been rolled back */
    rolledBackSteps: string[];
    /** Checkpoint for resuming execution */
    checkpoint?: {
        stepId: string;
        position: number;
    };
}
/**
 * State of a single step execution
 */
export interface StepExecutionState {
    stepId: string;
    state: StepState;
    startedAt?: Date;
    completedAt?: Date;
    retryCount: number;
    output?: unknown;
    error?: string;
    approvedBy?: string;
    approvedAt?: Date;
    rollbackCompleted?: boolean;
}
/**
 * Action context provided to automated actions
 */
export interface ActionContext {
    /** The incident being handled */
    incident: Incident;
    /** The playbook being executed */
    playbook: Playbook;
    /** The current step being executed */
    step: PlaybookStep;
    /** Execution variables */
    variables: Record<string, unknown>;
    /** Logger for the action */
    logger: {
        debug: (message: string, data?: Record<string, unknown>) => void;
        info: (message: string, data?: Record<string, unknown>) => void;
        warn: (message: string, data?: Record<string, unknown>) => void;
        error: (message: string, data?: Record<string, unknown>) => void;
    };
    /** Add evidence to the incident */
    addEvidence: (evidence: Omit<Evidence, 'id' | 'collectedAt'>) => Promise<Evidence>;
    /** Update incident */
    updateIncident: (updates: UpdateIncidentInput) => Promise<void>;
    /** Set a variable for later steps */
    setVariable: (key: string, value: unknown) => void;
    /** Get a variable from a previous step */
    getVariable: <T = unknown>(key: string) => T | undefined;
    /** Abort signal for cancellation */
    abortSignal: AbortSignal;
}
/**
 * Result of executing an automated action
 */
export interface ActionResult {
    /** Whether the action succeeded */
    success: boolean;
    /** Output data from the action */
    output?: unknown;
    /** Error message if failed */
    error?: string;
    /** Metrics about the action */
    metrics?: {
        durationMs: number;
        itemsProcessed?: number;
        itemsFailed?: number;
    };
    /** Whether the action can be rolled back */
    canRollback?: boolean;
    /** Data needed for rollback */
    rollbackData?: unknown;
}
/**
 * Definition of an automated action
 */
export interface ActionDefinition {
    /** Unique action ID */
    id: string;
    /** Human-readable name */
    name: string;
    /** Description of what the action does */
    description: string;
    /** Category of action */
    category: 'containment' | 'eradication' | 'recovery' | 'notification' | 'evidence' | 'monitoring';
    /** Risk level of the action */
    riskLevel: 'low' | 'medium' | 'high' | 'critical';
    /** Whether the action requires approval by default */
    requiresApproval: boolean;
    /** Whether the action supports rollback */
    supportsRollback: boolean;
    /** Default timeout in milliseconds */
    defaultTimeoutMs: number;
    /** Maximum retry attempts */
    maxRetries: number;
    /** Execute the action */
    execute: (context: ActionContext) => Promise<ActionResult>;
    /** Rollback the action (if supported) */
    rollback?: (context: ActionContext, rollbackData: unknown) => Promise<ActionResult>;
    /** Validate that the action can be executed */
    validate?: (context: ActionContext) => Promise<{
        valid: boolean;
        reason?: string;
    }>;
}
/**
 * Rollback procedure for a step
 */
export interface RollbackProcedure {
    stepId: string;
    rollbackSteps: Array<{
        order: number;
        description: string;
        action: (context: ActionContext, rollbackData: unknown) => Promise<void>;
    }>;
}
/**
 * Alert rule for triggering incidents
 */
export interface AlertRule {
    /** Unique rule ID */
    id: string;
    /** Rule name */
    name: string;
    /** Whether the rule is enabled */
    enabled: boolean;
    /** Conditions that trigger the rule */
    conditions: AlertCondition[];
    /** How conditions are combined */
    conditionOperator: 'and' | 'or';
    /** Resulting incident configuration */
    incidentConfig: {
        type: IncidentType;
        severity: IncidentSeverity;
        titleTemplate: string;
        descriptionTemplate: string;
        tags?: string[];
        autoAssignee?: string;
    };
    /** Playbook to auto-attach */
    playbookId?: string;
    /** Cooldown period to prevent duplicate incidents (in seconds) */
    cooldownSeconds: number;
    /** Priority for rule matching (higher = checked first) */
    priority: number;
}
/**
 * Condition for alert rules
 */
export interface AlertCondition {
    /** Field to evaluate */
    field: string;
    /** Operator for comparison */
    operator: 'equals' | 'not_equals' | 'contains' | 'not_contains' | 'matches' | 'gt' | 'lt' | 'gte' | 'lte' | 'in' | 'not_in' | 'exists' | 'not_exists';
    /** Value to compare against */
    value?: unknown;
}
/**
 * Alert from an external system or detector
 */
export interface Alert {
    /** Unique alert ID */
    alertId: string;
    /** Alert source (e.g., 'anomaly_detector', 'waf', 'ids') */
    source: string;
    /** Alert type/category */
    type: string;
    /** Alert severity */
    severity: 'info' | 'warning' | 'error' | 'critical';
    /** Alert title/summary */
    title: string;
    /** Detailed description */
    description: string;
    /** When the alert was generated */
    timestamp: Date;
    /** Associated user ID if any */
    userId?: string;
    /** Associated IP address if any */
    ipAddress?: string;
    /** Associated resource/endpoint if any */
    resource?: string;
    /** Raw alert data */
    rawData: Record<string, unknown>;
    /** Additional metadata */
    metadata?: Record<string, unknown>;
}
/**
 * State storage interface for persisting execution state
 */
export interface ExecutionStateStore {
    /** Save execution state */
    save(state: PlaybookExecutionState): Promise<void>;
    /** Load execution state */
    load(executionId: string): Promise<PlaybookExecutionState | null>;
    /** Load execution state by incident ID */
    loadByIncident(incidentId: string): Promise<PlaybookExecutionState | null>;
    /** Delete execution state */
    delete(executionId: string): Promise<void>;
    /** List all active executions */
    listActive(): Promise<PlaybookExecutionState[]>;
    /** Update specific fields */
    update(executionId: string, updates: Partial<PlaybookExecutionState>): Promise<void>;
}
//# sourceMappingURL=types.d.ts.map