/**
 * Audit Event Schema
 *
 * Comprehensive audit event schema with 30+ event types for SIEM integration.
 * Defines event types, categories, and metadata for security monitoring.
 *
 * @packageDocumentation
 */
import { z } from 'zod';
/**
 * Audit event type definitions with metadata.
 * Each event type includes category and default severity.
 */
export declare const AUDIT_EVENT_DEFINITIONS: {
    readonly USER_LOGIN: {
        readonly category: "authentication";
        readonly severity: "info";
        readonly description: "User successfully authenticated";
    };
    readonly USER_LOGOUT: {
        readonly category: "authentication";
        readonly severity: "info";
        readonly description: "User logged out";
    };
    readonly USER_LOGIN_FAILED: {
        readonly category: "authentication";
        readonly severity: "warning";
        readonly description: "Authentication attempt failed";
    };
    readonly SESSION_CREATED: {
        readonly category: "authentication";
        readonly severity: "info";
        readonly description: "New session established";
    };
    readonly SESSION_EXPIRED: {
        readonly category: "authentication";
        readonly severity: "info";
        readonly description: "Session expired naturally";
    };
    readonly SESSION_REVOKED: {
        readonly category: "authentication";
        readonly severity: "warning";
        readonly description: "Session forcibly terminated";
    };
    readonly TOKEN_ISSUED: {
        readonly category: "authentication";
        readonly severity: "info";
        readonly description: "Access/refresh token issued";
    };
    readonly TOKEN_REVOKED: {
        readonly category: "authentication";
        readonly severity: "warning";
        readonly description: "Token manually revoked";
    };
    readonly MFA_CHALLENGE: {
        readonly category: "authentication";
        readonly severity: "info";
        readonly description: "MFA challenge initiated";
    };
    readonly MFA_SUCCESS: {
        readonly category: "authentication";
        readonly severity: "info";
        readonly description: "MFA verification successful";
    };
    readonly MFA_FAILURE: {
        readonly category: "authentication";
        readonly severity: "warning";
        readonly description: "MFA verification failed";
    };
    readonly MFA_BYPASS_ATTEMPTED: {
        readonly category: "security";
        readonly severity: "critical";
        readonly description: "Attempt to bypass MFA detected";
    };
    readonly PASSWORD_CHANGE: {
        readonly category: "authentication";
        readonly severity: "info";
        readonly description: "User changed their password";
    };
    readonly PASSWORD_RESET_REQUESTED: {
        readonly category: "authentication";
        readonly severity: "info";
        readonly description: "Password reset requested";
    };
    readonly PASSWORD_RESET_COMPLETED: {
        readonly category: "authentication";
        readonly severity: "info";
        readonly description: "Password reset completed";
    };
    readonly PERMISSION_GRANTED: {
        readonly category: "authorization";
        readonly severity: "info";
        readonly description: "Permission or access granted";
    };
    readonly PERMISSION_DENIED: {
        readonly category: "authorization";
        readonly severity: "warning";
        readonly description: "Permission or access denied";
    };
    readonly PERMISSION_REVOKED: {
        readonly category: "authorization";
        readonly severity: "warning";
        readonly description: "Previously granted permission revoked";
    };
    readonly ROLE_CHANGED: {
        readonly category: "authorization";
        readonly severity: "warning";
        readonly description: "User role assignment changed";
    };
    readonly RESOURCE_CREATE: {
        readonly category: "data-access";
        readonly severity: "info";
        readonly description: "Resource created";
    };
    readonly RESOURCE_READ: {
        readonly category: "data-access";
        readonly severity: "info";
        readonly description: "Resource accessed/read";
    };
    readonly RESOURCE_UPDATE: {
        readonly category: "data-access";
        readonly severity: "info";
        readonly description: "Resource modified";
    };
    readonly RESOURCE_DELETE: {
        readonly category: "data-access";
        readonly severity: "warning";
        readonly description: "Resource deleted";
    };
    readonly RESOURCE_EXPORT: {
        readonly category: "data-access";
        readonly severity: "warning";
        readonly description: "Resource data exported";
    };
    readonly CONFIG_CHANGE: {
        readonly category: "configuration";
        readonly severity: "warning";
        readonly description: "System configuration changed";
    };
    readonly KEY_ROTATION: {
        readonly category: "configuration";
        readonly severity: "info";
        readonly description: "Encryption key rotated";
    };
    readonly SECRET_ACCESSED: {
        readonly category: "configuration";
        readonly severity: "warning";
        readonly description: "Secret or sensitive config accessed";
    };
    readonly POLICY_UPDATE: {
        readonly category: "configuration";
        readonly severity: "warning";
        readonly description: "Security or governance policy updated";
    };
    readonly RATE_LIMIT_EXCEEDED: {
        readonly category: "security";
        readonly severity: "warning";
        readonly description: "Rate limit threshold exceeded";
    };
    readonly INJECTION_ATTEMPT: {
        readonly category: "security";
        readonly severity: "critical";
        readonly description: "Potential injection attack detected";
    };
    readonly ANOMALY_DETECTED: {
        readonly category: "security";
        readonly severity: "warning";
        readonly description: "Anomalous behavior detected";
    };
    readonly BRUTE_FORCE_DETECTED: {
        readonly category: "security";
        readonly severity: "critical";
        readonly description: "Brute force attack pattern detected";
    };
    readonly IP_BLOCKED: {
        readonly category: "security";
        readonly severity: "warning";
        readonly description: "IP address blocked";
    };
    readonly SUSPICIOUS_ACTIVITY: {
        readonly category: "security";
        readonly severity: "warning";
        readonly description: "Suspicious activity flagged for review";
    };
    readonly SYSTEM_STARTUP: {
        readonly category: "system";
        readonly severity: "info";
        readonly description: "System or service started";
    };
    readonly SYSTEM_SHUTDOWN: {
        readonly category: "system";
        readonly severity: "info";
        readonly description: "System or service shutdown";
    };
    readonly HEALTH_CHECK_FAILED: {
        readonly category: "system";
        readonly severity: "error";
        readonly description: "Health check returned unhealthy";
    };
    readonly SERVICE_DEGRADED: {
        readonly category: "system";
        readonly severity: "warning";
        readonly description: "Service operating in degraded mode";
    };
    readonly DATA_RETENTION_CLEANUP: {
        readonly category: "compliance";
        readonly severity: "info";
        readonly description: "Data retention cleanup executed";
    };
    readonly GDPR_REQUEST_RECEIVED: {
        readonly category: "compliance";
        readonly severity: "info";
        readonly description: "GDPR data request received";
    };
    readonly AUDIT_LOG_EXPORTED: {
        readonly category: "compliance";
        readonly severity: "info";
        readonly description: "Audit log exported for compliance";
    };
    readonly TRUST_LEVEL_CHANGED: {
        readonly category: "authorization";
        readonly severity: "warning";
        readonly description: "Entity trust level changed";
    };
    readonly ESCALATION_TRIGGERED: {
        readonly category: "authorization";
        readonly severity: "warning";
        readonly description: "Escalation workflow triggered";
    };
    readonly INTENT_EVALUATED: {
        readonly category: "authorization";
        readonly severity: "info";
        readonly description: "Intent governance evaluation completed";
    };
};
export type AuditEventType = keyof typeof AUDIT_EVENT_DEFINITIONS;
export declare const EVENT_CATEGORIES: readonly ["authentication", "authorization", "data-access", "configuration", "system", "security", "compliance", "network"];
export type EventCategory = (typeof EVENT_CATEGORIES)[number];
export declare const EVENT_SEVERITIES: readonly ["info", "warning", "error", "critical"];
export type EventSeverity = (typeof EVENT_SEVERITIES)[number];
export declare const EVENT_OUTCOMES: readonly ["success", "failure", "unknown"];
export type EventOutcome = (typeof EVENT_OUTCOMES)[number];
/**
 * Actor schema - who performed the action
 */
export declare const ActorSchema: z.ZodObject<{
    /** User ID if authenticated */
    userId: z.ZodOptional<z.ZodString>;
    /** Tenant ID for multi-tenant systems */
    tenantId: z.ZodOptional<z.ZodString>;
    /** Client IP address */
    ipAddress: z.ZodString;
    /** User agent string */
    userAgent: z.ZodOptional<z.ZodString>;
    /** Session ID if applicable */
    sessionId: z.ZodOptional<z.ZodString>;
    /** Agent/service ID if not a user */
    agentId: z.ZodOptional<z.ZodString>;
    /** Actor type */
    actorType: z.ZodDefault<z.ZodEnum<["user", "agent", "service", "system"]>>;
}, "strip", z.ZodTypeAny, {
    userId?: string;
    tenantId?: string;
    sessionId?: string;
    userAgent?: string;
    actorType?: "service" | "user" | "agent" | "system";
    ipAddress?: string;
    agentId?: string;
}, {
    userId?: string;
    tenantId?: string;
    sessionId?: string;
    userAgent?: string;
    actorType?: "service" | "user" | "agent" | "system";
    ipAddress?: string;
    agentId?: string;
}>;
export type Actor = z.infer<typeof ActorSchema>;
/**
 * Resource schema - what was acted upon
 */
export declare const ResourceSchema: z.ZodObject<{
    /** Resource type (e.g., 'user', 'intent', 'policy') */
    type: z.ZodString;
    /** Resource identifier */
    id: z.ZodString;
    /** Human-readable resource name */
    name: z.ZodOptional<z.ZodString>;
    /** Parent resource ID if hierarchical */
    parentId: z.ZodOptional<z.ZodString>;
    /** Additional resource attributes */
    attributes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
}, "strip", z.ZodTypeAny, {
    id?: string;
    type?: string;
    name?: string;
    parentId?: string;
    attributes?: Record<string, unknown>;
}, {
    id?: string;
    type?: string;
    name?: string;
    parentId?: string;
    attributes?: Record<string, unknown>;
}>;
export type Resource = z.infer<typeof ResourceSchema>;
/**
 * Metadata schema - correlation and tracing information
 */
export declare const MetadataSchema: z.ZodObject<{
    /** Unique request identifier */
    requestId: z.ZodString;
    /** Distributed trace ID (W3C TraceContext) */
    traceId: z.ZodOptional<z.ZodString>;
    /** Span ID for trace correlation */
    spanId: z.ZodOptional<z.ZodString>;
    /** Correlation ID for multi-step operations */
    correlationId: z.ZodOptional<z.ZodString>;
    /** Source service/component name */
    source: z.ZodOptional<z.ZodString>;
    /** Additional tags for filtering */
    tags: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
}, "strip", z.ZodTypeAny, {
    traceId?: string;
    spanId?: string;
    tags?: string[];
    requestId?: string;
    source?: string;
    correlationId?: string;
}, {
    traceId?: string;
    spanId?: string;
    tags?: string[];
    requestId?: string;
    source?: string;
    correlationId?: string;
}>;
export type Metadata = z.infer<typeof MetadataSchema>;
/**
 * Full audit event schema
 */
export declare const AuditEventSchemaFull: z.ZodObject<{
    /** Unique event identifier (UUID) */
    id: z.ZodString;
    /** Event timestamp */
    timestamp: z.ZodDate;
    /** Event type from AUDIT_EVENT_DEFINITIONS */
    type: z.ZodString;
    /** Event category */
    category: z.ZodEnum<["authentication", "authorization", "data-access", "configuration", "system", "security", "compliance", "network"]>;
    /** Event severity */
    severity: z.ZodEnum<["info", "warning", "error", "critical"]>;
    /** Actor information */
    actor: z.ZodObject<{
        /** User ID if authenticated */
        userId: z.ZodOptional<z.ZodString>;
        /** Tenant ID for multi-tenant systems */
        tenantId: z.ZodOptional<z.ZodString>;
        /** Client IP address */
        ipAddress: z.ZodString;
        /** User agent string */
        userAgent: z.ZodOptional<z.ZodString>;
        /** Session ID if applicable */
        sessionId: z.ZodOptional<z.ZodString>;
        /** Agent/service ID if not a user */
        agentId: z.ZodOptional<z.ZodString>;
        /** Actor type */
        actorType: z.ZodDefault<z.ZodEnum<["user", "agent", "service", "system"]>>;
    }, "strip", z.ZodTypeAny, {
        userId?: string;
        tenantId?: string;
        sessionId?: string;
        userAgent?: string;
        actorType?: "service" | "user" | "agent" | "system";
        ipAddress?: string;
        agentId?: string;
    }, {
        userId?: string;
        tenantId?: string;
        sessionId?: string;
        userAgent?: string;
        actorType?: "service" | "user" | "agent" | "system";
        ipAddress?: string;
        agentId?: string;
    }>;
    /** Resource information */
    resource: z.ZodObject<{
        /** Resource type (e.g., 'user', 'intent', 'policy') */
        type: z.ZodString;
        /** Resource identifier */
        id: z.ZodString;
        /** Human-readable resource name */
        name: z.ZodOptional<z.ZodString>;
        /** Parent resource ID if hierarchical */
        parentId: z.ZodOptional<z.ZodString>;
        /** Additional resource attributes */
        attributes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
    }, "strip", z.ZodTypeAny, {
        id?: string;
        type?: string;
        name?: string;
        parentId?: string;
        attributes?: Record<string, unknown>;
    }, {
        id?: string;
        type?: string;
        name?: string;
        parentId?: string;
        attributes?: Record<string, unknown>;
    }>;
    /** Action performed */
    action: z.ZodString;
    /** Outcome of the action */
    outcome: z.ZodEnum<["success", "failure", "unknown"]>;
    /** Additional event details */
    details: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
    /** Event metadata for correlation */
    metadata: z.ZodObject<{
        /** Unique request identifier */
        requestId: z.ZodString;
        /** Distributed trace ID (W3C TraceContext) */
        traceId: z.ZodOptional<z.ZodString>;
        /** Span ID for trace correlation */
        spanId: z.ZodOptional<z.ZodString>;
        /** Correlation ID for multi-step operations */
        correlationId: z.ZodOptional<z.ZodString>;
        /** Source service/component name */
        source: z.ZodOptional<z.ZodString>;
        /** Additional tags for filtering */
        tags: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    }, "strip", z.ZodTypeAny, {
        traceId?: string;
        spanId?: string;
        tags?: string[];
        requestId?: string;
        source?: string;
        correlationId?: string;
    }, {
        traceId?: string;
        spanId?: string;
        tags?: string[];
        requestId?: string;
        source?: string;
        correlationId?: string;
    }>;
}, "strip", z.ZodTypeAny, {
    id?: string;
    type?: string;
    timestamp?: Date;
    details?: Record<string, unknown>;
    outcome?: "unknown" | "success" | "failure";
    metadata?: {
        traceId?: string;
        spanId?: string;
        tags?: string[];
        requestId?: string;
        source?: string;
        correlationId?: string;
    };
    severity?: "error" | "info" | "warning" | "critical";
    action?: string;
    actor?: {
        userId?: string;
        tenantId?: string;
        sessionId?: string;
        userAgent?: string;
        actorType?: "service" | "user" | "agent" | "system";
        ipAddress?: string;
        agentId?: string;
    };
    category?: "authentication" | "authorization" | "system" | "security" | "configuration" | "network" | "compliance" | "data-access";
    resource?: {
        id?: string;
        type?: string;
        name?: string;
        parentId?: string;
        attributes?: Record<string, unknown>;
    };
}, {
    id?: string;
    type?: string;
    timestamp?: Date;
    details?: Record<string, unknown>;
    outcome?: "unknown" | "success" | "failure";
    metadata?: {
        traceId?: string;
        spanId?: string;
        tags?: string[];
        requestId?: string;
        source?: string;
        correlationId?: string;
    };
    severity?: "error" | "info" | "warning" | "critical";
    action?: string;
    actor?: {
        userId?: string;
        tenantId?: string;
        sessionId?: string;
        userAgent?: string;
        actorType?: "service" | "user" | "agent" | "system";
        ipAddress?: string;
        agentId?: string;
    };
    category?: "authentication" | "authorization" | "system" | "security" | "configuration" | "network" | "compliance" | "data-access";
    resource?: {
        id?: string;
        type?: string;
        name?: string;
        parentId?: string;
        attributes?: Record<string, unknown>;
    };
}>;
export type AuditEventFull = z.infer<typeof AuditEventSchemaFull>;
/**
 * Get event definition by type
 */
export declare function getEventDefinition(type: string): {
    category: EventCategory;
    severity: EventSeverity;
    description: string;
} | null;
/**
 * Get all event types for a category
 */
export declare function getEventTypesByCategory(category: EventCategory): AuditEventType[];
/**
 * Get all event types for a severity level
 */
export declare function getEventTypesBySeverity(severity: EventSeverity): AuditEventType[];
/**
 * Validate that a string is a valid event type
 */
export declare function isValidEventType(type: string): type is AuditEventType;
/**
 * Get all defined event types as an array
 */
export declare function getAllEventTypes(): AuditEventType[];
/**
 * Count events by category
 */
export declare function countEventsByCategory(): Record<EventCategory, number>;
/**
 * Builder for creating audit events with validation
 */
export declare class AuditEventBuilder {
    private event;
    constructor();
    /**
     * Set the event ID (auto-generated if not provided)
     */
    withId(id: string): this;
    /**
     * Set the event timestamp (defaults to now)
     */
    withTimestamp(timestamp: Date): this;
    /**
     * Set the event type and auto-populate category/severity
     */
    withType(type: AuditEventType): this;
    /**
     * Override the category
     */
    withCategory(category: EventCategory): this;
    /**
     * Override the severity
     */
    withSeverity(severity: EventSeverity): this;
    /**
     * Set the actor information
     */
    withActor(actor: Actor): this;
    /**
     * Set the resource information
     */
    withResource(resource: Resource): this;
    /**
     * Set the action string
     */
    withAction(action: string): this;
    /**
     * Set the outcome
     */
    withOutcome(outcome: EventOutcome): this;
    /**
     * Set event details
     */
    withDetails(details: Record<string, unknown>): this;
    /**
     * Add a detail field
     */
    addDetail(key: string, value: unknown): this;
    /**
     * Set the metadata
     */
    withMetadata(metadata: Metadata): this;
    /**
     * Build and validate the event
     */
    build(): AuditEventFull;
}
/**
 * Create a new audit event builder
 */
export declare function createAuditEvent(): AuditEventBuilder;
//# sourceMappingURL=event-schema.d.ts.map