// SPDX-License-Identifier: Apache-2.0
// Copyright 2024-2026 Vorion LLC
/**
 * Incident Response System - Type Definitions
 *
 * Comprehensive type definitions for incident management,
 * playbook execution, and notification handling.
 */
import { z } from 'zod';
// ============================================================================
// Enums and Constants
// ============================================================================
export const IncidentSeverity = {
    P1: 'P1', // Critical - System down, data breach
    P2: 'P2', // High - Major functionality impacted
    P3: 'P3', // Medium - Minor functionality impacted
    P4: 'P4', // Low - Cosmetic issues, minor bugs
};
export const IncidentStatus = {
    DETECTED: 'detected',
    INVESTIGATING: 'investigating',
    CONTAINED: 'contained',
    ERADICATED: 'eradicated',
    RECOVERED: 'recovered',
    CLOSED: 'closed',
};
export const IncidentType = {
    DATA_BREACH: 'data_breach',
    ACCOUNT_COMPROMISE: 'account_compromise',
    MALWARE: 'malware',
    DENIAL_OF_SERVICE: 'denial_of_service',
    UNAUTHORIZED_ACCESS: 'unauthorized_access',
    INSIDER_THREAT: 'insider_threat',
    PHISHING: 'phishing',
    RANSOMWARE: 'ransomware',
    CONFIGURATION_ERROR: 'configuration_error',
    OTHER: 'other',
};
export const StepType = {
    MANUAL: 'manual',
    AUTOMATED: 'automated',
};
export const NotificationChannel = {
    SLACK: 'slack',
    EMAIL: 'email',
    PAGERDUTY: 'pagerduty',
    WEBHOOK: 'webhook',
    SMS: 'sms',
};
export const TimelineEntryType = {
    CREATED: 'created',
    STATUS_CHANGE: 'status_change',
    ASSIGNMENT: 'assignment',
    COMMENT: 'comment',
    EVIDENCE_ADDED: 'evidence_added',
    PLAYBOOK_STARTED: 'playbook_started',
    PLAYBOOK_STEP_COMPLETED: 'playbook_step_completed',
    PLAYBOOK_STEP_FAILED: 'playbook_step_failed',
    NOTIFICATION_SENT: 'notification_sent',
    ESCALATION: 'escalation',
    RESOLUTION: 'resolution',
};
// ============================================================================
// Zod Schemas
// ============================================================================
export const EvidenceSchema = z.object({
    id: z.string().uuid(),
    type: z.enum(['log', 'screenshot', 'file', 'network_capture', 'memory_dump', 'configuration', 'other']),
    name: z.string().min(1).max(255),
    description: z.string().optional(),
    source: z.string(),
    collectedAt: z.date(),
    collectedBy: z.string(),
    hash: z.string().optional(), // SHA-256 hash for integrity
    size: z.number().optional(), // Size in bytes
    location: z.string(), // File path or URL
    metadata: z.record(z.unknown()).optional(),
});
export const TimelineEntrySchema = z.object({
    id: z.string().uuid(),
    timestamp: z.date(),
    type: z.nativeEnum(TimelineEntryType),
    actor: z.string(), // User or system that performed the action
    description: z.string(),
    metadata: z.record(z.unknown()).optional(),
    automated: z.boolean().default(false),
});
export const TriggerConditionSchema = z.object({
    field: z.string(),
    operator: z.enum(['equals', 'contains', 'matches', 'gt', 'lt', 'gte', 'lte', 'in', 'not_in']),
    value: z.unknown(),
    logicalOperator: z.enum(['and', 'or']).optional(),
});
export const NotificationConfigSchema = z.object({
    channel: z.nativeEnum(NotificationChannel),
    target: z.string(), // Channel ID, email, webhook URL, etc.
    template: z.string().optional(),
    severityFilter: z.array(z.nativeEnum(IncidentSeverity)).optional(),
    enabled: z.boolean().default(true),
    retryAttempts: z.number().default(3),
    retryDelayMs: z.number().default(5000),
});
export const EscalationLevelSchema = z.object({
    level: z.number().min(1),
    afterMinutes: z.number().min(0),
    targets: z.array(z.string()), // User IDs or team names
    channels: z.array(z.nativeEnum(NotificationChannel)),
    message: z.string().optional(),
});
export const EscalationConfigSchema = z.object({
    enabled: z.boolean().default(true),
    levels: z.array(EscalationLevelSchema),
    maxLevel: z.number().default(3),
    resetOnAcknowledge: z.boolean().default(true),
});
export const PlaybookStepSchema = z.object({
    id: z.string(),
    name: z.string().min(1).max(255),
    type: z.nativeEnum(StepType),
    description: z.string(),
    action: z.function().args().returns(z.promise(z.void())).optional(),
    actionId: z.string().optional(), // ID of registered ActionDefinition to execute
    timeout: z.number().optional(), // Timeout in milliseconds
    requiresApproval: z.boolean().default(false),
    approvers: z.array(z.string()).optional(),
    onFailure: z.enum(['continue', 'halt', 'retry']).default('halt'),
    retryAttempts: z.number().default(0),
    dependencies: z.array(z.string()).optional(), // Step IDs that must complete first
    metadata: z.record(z.unknown()).optional(),
});
export const PlaybookSchema = z.object({
    id: z.string(),
    name: z.string().min(1).max(255),
    description: z.string().optional(),
    version: z.string().default('1.0.0'),
    triggerConditions: z.array(TriggerConditionSchema),
    steps: z.array(PlaybookStepSchema),
    notifications: z.array(NotificationConfigSchema),
    escalation: EscalationConfigSchema,
    enabled: z.boolean().default(true),
    tags: z.array(z.string()).optional(),
    createdAt: z.date().optional(),
    updatedAt: z.date().optional(),
});
export const IncidentSchema = z.object({
    id: z.string().uuid(),
    title: z.string().min(1).max(500),
    description: z.string(),
    severity: z.nativeEnum(IncidentSeverity),
    status: z.nativeEnum(IncidentStatus),
    type: z.nativeEnum(IncidentType),
    detectedAt: z.date(),
    acknowledgedAt: z.date().optional(),
    containedAt: z.date().optional(),
    resolvedAt: z.date().optional(),
    closedAt: z.date().optional(),
    assignee: z.string().optional(),
    team: z.string().optional(),
    affectedResources: z.array(z.string()),
    timeline: z.array(TimelineEntrySchema),
    evidence: z.array(EvidenceSchema),
    playbook: z.string().optional(), // Playbook ID
    playbookProgress: z.record(z.enum(['pending', 'in_progress', 'completed', 'failed', 'skipped'])).optional(),
    tags: z.array(z.string()).optional(),
    externalReferences: z.array(z.object({
        type: z.string(),
        id: z.string(),
        url: z.string().url().optional(),
    })).optional(),
    rootCause: z.string().optional(),
    remediation: z.string().optional(),
    lessonsLearned: z.string().optional(),
    metadata: z.record(z.unknown()).optional(),
});
export const CreateIncidentSchema = IncidentSchema.omit({
    id: true,
    timeline: true,
    evidence: true,
    playbookProgress: true,
    acknowledgedAt: true,
    containedAt: true,
    resolvedAt: true,
    closedAt: true,
}).extend({
    affectedResources: z.array(z.string()).default([]),
    tags: z.array(z.string()).optional(),
});
export const UpdateIncidentSchema = IncidentSchema.partial().omit({
    id: true,
    detectedAt: true,
    timeline: true,
});
// ============================================================================
// Automation Types
// ============================================================================
/**
 * Execution state for a playbook
 */
export const ExecutionState = {
    PENDING: 'pending',
    RUNNING: 'running',
    PAUSED: 'paused',
    WAITING_APPROVAL: 'waiting_approval',
    WAITING_MANUAL: 'waiting_manual',
    COMPLETED: 'completed',
    FAILED: 'failed',
    ROLLED_BACK: 'rolled_back',
    CANCELLED: 'cancelled',
};
/**
 * Step execution state
 */
export const StepState = {
    PENDING: 'pending',
    QUEUED: 'queued',
    RUNNING: 'running',
    WAITING_APPROVAL: 'waiting_approval',
    COMPLETED: 'completed',
    FAILED: 'failed',
    SKIPPED: 'skipped',
    ROLLED_BACK: 'rolled_back',
    TIMED_OUT: 'timed_out',
};
//# sourceMappingURL=types.js.map