import {z} from 'zod' export type Severity = 'info' | 'low' | 'medium' | 'high' | 'critical'; export type EmailAction = {type: 'email', severity?: Array | undefined, to: Array, cc?: Array | undefined, bcc?: Array | undefined, body?: string | undefined}; export type SlackAction = {type: 'slack', severity?: Array | undefined, integration_instance_id: string, channels: Array, message_format?: string | undefined}; export type TelegramAction = {type: 'telegram', severity?: Array | undefined, integration_instance_id: string, chats: Array<{chat_id: string, topic_ids?: Array | undefined}>, message_format?: string | undefined}; export type HMACAuthentication = {type: 'hmac', hmac_secret: string}; export type AuthorizationHeaderAuthentication = {type: 'authorization_header', value: string}; export type APIKeyAuthorization = {type: 'api_key', header_name: string, api_key: string}; export type BasicAuth = {type: 'basic_auth', username: string, password: string}; export type Authentication = HMACAuthentication | AuthorizationHeaderAuthentication | APIKeyAuthorization | BasicAuth; export type WebhookAction = {type: 'webhook', severity?: Array | undefined, url: string, authentication?: Authentication | undefined, custom_headers?: Array<{name: string, value: string}> | undefined, custom_payload_fields?: Array<{key: string, value: string}> | undefined}; export type PauseContractAction = {type?: 'pause-contract' | undefined, severity?: Array | undefined, pause: boolean}; export type SequencerAction = {type?: 'sequencer' | undefined, severity?: Array | undefined, target: 'target' | 'source', comment?: string | undefined, expiration_time?: string | undefined}; export type APICallAction = {type: 'api_call', severity?: Array | undefined, url: string, authentication?: Authentication | undefined, custom_headers?: Record | undefined, request_type: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE', body?: Record | undefined, incident_payload_override: Array<{key_to_override: string, incident_field: 'targets' | 'attackers' | 'incident_name' | 'incident_start_date' | 'incident_end_date' | 'incident_duration' | 'severity' | 'dollars_funds_lost' | 'dollars_funds_exposed'}>}; export type AssetIDTarget = {type: 'asset_id', identifier: string}; export type AssetTagTarget = {type: 'asset_tag', identifier: string}; export type CallContractAction = {type: 'contract_call', severity?: Array | undefined, targets: Array | 'dynamic', via_router?: {contracts: Array} | undefined, function_signature: string, function_parameters: Array, response_wallet: {integration_instance_id: string}}; export type LabelEntityAction = {type: 'label_entity', severity?: Array | undefined, entity_from_incident: 'target' | 'source', label: 'account_takeover' | 'compromised' | 'custom_malicious' | 'investment_scam' | 'address_poisoning_impersonator_wallet' | 'address_poisoning_operator' | 'exploiter' | 'exploit_contract' | 'malicious_airdrop_operator' | 'wallet_drainer' | 'rugpull_operator' | 'malicious_implementation'}; export type AssetLabelTarget = {type: 'asset_label', identifier: string}; export type AssetIDExcludeTarget = {type: 'exclude_asset_id', identifier: string}; export type ApprovalToMulticallContractMonitor = {type: 'approval_to_multicall_contract', severity: Severity, target: Array, is_silent: boolean, just_mine?: boolean | undefined}; export type MonitoringSupportedChains = 'abstract' | 'apechain' | 'arbitrum' | 'avalanche' | 'avalanche-fuji' | 'base' | 'berachain' | 'bitcoin' | 'blast' | 'bsc' | 'degen' | 'ethereum' | 'ethereum-sepolia' | 'gnosis' | 'hedera' | 'hyperevm' | 'hyperliquid' | 'aster' | 'lighter' | 'ink' | 'kaia' | 'katana' | 'kite-ai' | 'linea' | 'monad' | 'optimism' | 'plume' | 'polymarket' | 'polygon' | 'ronin' | 'scroll' | 'sei' | 'solana' | 'soneium' | 'soneium-minato' | 'stellar' | 'sui' | 'unichain' | 'zksync' | 'mainnet' | 'kaia' | 'tron' | 'robinhood' | 'arc' | 'flare' | 'xlayer' | 'tempo'; export type AssetHasDeployedContractMonitor = {type: 'asset_has_deployed_contract', target: Array, parameters?: ({chain?: ({operator: 'in' | 'not_in', value: MonitoringSupportedChains}) | undefined}) | undefined, severity: Severity, is_silent?: boolean | undefined, just_mine?: boolean | undefined}; export type BenignInteractionWithAnAssetMonitor = {type: 'benign_interaction_with_an_asset', target: Array, parameters: {interaction_type?: ({operator: 'in' | 'not_in', value: Array<'funds_transfer' | 'approval' | 'function_call'>}) | undefined, interacted_addresses: {operator: 'in' | 'not_in', value: Array}, interaction_direction: {operator: 'is' | 'is_not', value: 'inbound' | 'outbound' | 'any'}, interaction_usd_value?: ({operator: 'is' | 'is_not' | 'gt' | 'gte' | 'lt' | 'lte', value: number}) | undefined}, severity: Severity, is_silent?: boolean | undefined, just_mine?: boolean | undefined}; export type ContractOwnerChangeMonitor = {type: 'contract_owner_change', target: Array, severity: Severity, is_silent?: boolean | undefined, just_mine?: boolean | undefined}; export type ObjectOwnerChangeMonitor = {type: 'object_owner_change', target: Array, parameters?: ({change_type?: ({operator: 'in' | 'not_in', value: Array<'transferred' | 'frozen' | 'shared'>}) | undefined}) | undefined, severity: Severity, is_silent?: boolean | undefined, just_mine?: boolean | undefined}; export type DelegateCallToNonApprovedContractMonitor = {type: 'delegate_call_to_non_approved_contract', target: Array, parameters: {function_name: {operator: 'is' | 'is_not', value: string}, function_parameter?: (Array<{parameter: string, operator: 'is' | 'is_not' | 'contains' | 'not_contains', value: string} | {parameter: string, operator: 'is' | 'is_not' | 'eq' | 'gte' | 'lte' | 'lt' | 'gt' | 'neq' | 'increase_by' | 'decrease_by' | 'multiply_by' | 'divide_by', value: number}>) | undefined, approved_contract: {operator: 'in' | 'not_in', value: Array}}, severity: Severity, is_silent?: boolean | undefined, just_mine?: boolean | undefined}; export type Eip7702SetCodeUpgradeMonitor = {type: 'eip_7702_set_code_upgrade_monitor', target: Array, severity: Severity, is_silent?: boolean | undefined, just_mine?: boolean | undefined}; export type EventEmittedMonitor = {type: 'event_emitted', target: Array, parameters: {event_name: {operator: 'is' | 'is_not', value: string}, event_parameter?: (Array<{parameter: string, operator: 'is' | 'is_not' | 'contains' | 'not_contains', value: string} | {parameter: string, operator: 'is' | 'is_not' | 'eq' | 'gte' | 'lte' | 'lt' | 'gt' | 'neq' | 'increase_by' | 'decrease_by' | 'multiply_by' | 'divide_by', value: number}>) | undefined}, severity: Severity, is_silent?: boolean | undefined, just_mine?: boolean | undefined}; export type FunctionCallMonitor = {type: 'function_call', target: Array, parameters: {function_name: {operator: 'is' | 'is_not', value: string}, function_parameter?: (Array<{parameter: string, operator: 'is' | 'is_not' | 'contains' | 'not_contains', value: string} | {parameter: string, operator: 'is' | 'is_not' | 'eq' | 'gte' | 'lte' | 'lt' | 'gt' | 'neq' | 'increase_by' | 'decrease_by' | 'multiply_by' | 'divide_by', value: number}>) | undefined, caller_address: {operator: 'in' | 'not_in', value: Array}}, severity: Severity, is_silent?: boolean | undefined, just_mine?: boolean | undefined}; export type MaliciousInteractionWithAssetMonitor = {type: 'malicious_interaction_with_asset', target: Array, parameters?: ({chain?: ({operator: 'in' | 'not_in', value: Array}) | undefined, malicious_actor_label?: ({operator: 'in' | 'not_in', value: Array<'custom_malicious' | 'address_poisoning_imperatonator_wallet' | 'wallet_drainer' | 'exploiter' | 'exploit_contract' | 'ofac_address' | 'malicious_contract_deployer' | 'compromised' | 'malicious_operator'>}) | undefined, interaction_type: {operator: 'in' | 'not_in', value: Array<'funds_transfer' | 'approval' | 'function_call'>}, interaction_direction: {operator: 'is' | 'is_not', value: 'inbound' | 'outbound' | 'any'}, interaction_usd_value: {operator: 'is' | 'is_not' | 'gt' | 'gte' | 'lt' | 'lte', value: number}}) | undefined, severity: Severity, is_silent?: boolean | undefined, just_mine?: boolean | undefined}; export type PigButcheringInteractionMonitor = {type: 'pig_butchering_interaction', target: Array, severity: Severity, is_silent?: boolean | undefined, just_mine?: boolean | undefined}; export type ProxyUpgradeDetectedMonitor = {type: 'proxy_upgrade_detected', target: Array, severity: Severity, is_silent?: boolean | undefined, just_mine?: boolean | undefined}; export type TokenStateChangedToMaliciousMonitor = {type: 'token_state_changed_to_malicious', target: Array, severity: Severity, is_silent?: boolean | undefined, just_mine?: boolean | undefined}; export type ToxicityRateThresholdCrossedMonitor = {type: 'toxicity_monitor', target: Array, parameters: {toxicity_category: Array<{parameter: string, operator: 'gte' | 'lte' | 'lt' | 'gt', value: string}>, proximity?: ({operator: 'is', value: 'ownership' | 'counterparty' | 'indirect'}) | undefined}, severity: Severity, is_silent?: boolean | undefined, just_mine?: boolean | undefined}; export type TransferToNonApprovedEntityMonitor = {type: 'transfer_to_non_approved_entity', target: Array, severity: Severity, is_silent?: boolean | undefined, just_mine?: boolean | undefined}; export type Timeframe = {value: number, unit: string}; export type CompositeMonitor = {type: 'composite', category: 'scam_fraud' | 'security' | 'compliance' | 'finance', must_match_monitor_configs: Array<{monitor_id: string, severity: Severity}>, must_not_match_monitor_configs: Array<{monitor_id: string, severity: Severity}>, incidents_must_share_same_target?: boolean | undefined, incidents_must_share_same_attacker?: boolean | undefined, timeframe?: Timeframe | undefined, severity: Severity, is_silent?: boolean | undefined}; export type DefinedMetric = {metric_id: string, aggregation?: ({aggregation_function: 'sum' | 'avg' | 'min' | 'max' | 'std_dev' | 'count', timeframe: Timeframe}) | undefined}; export type FormulaMonitor = {type: 'formula', category: 'scam_fraud' | 'security' | 'compliance' | 'finance', metrics: Array<{symbol: string, metric: DefinedMetric}>, formula: string, severity: Severity}; export type CodeBasedMonitor = {type: 'code_based_monitor', severity: Severity, source: string, params?: ({[key: string]: unknown} | null) | undefined, target: Array, is_silent?: boolean | undefined}; export type IPInfringementMonitor = {type: 'ip_infringement', severity: Severity, parameters: {keywords: {operator: 'in', value: Array}, search_location: {operator: 'in' | 'not_in', value: Array<'token_names' | 'token_symbols' | 'dapp_dns_name'>}, chains?: ({operator: 'in' | 'not_in', value: Array}) | undefined}, is_silent?: boolean | undefined, just_mine?: boolean | undefined}; export type NewMonitorCreation = {name: string, tags?: Array | undefined, actions?: (Array) | undefined, monitors: Array | Array | Array | Array | Array | Array | Array | Array | Array | Array | Array | Array | Array | Array | Array | Array | Array | Array | Array}; export type CreateApiV0PlatformMonitorsArgs = {body: NewMonitorCreation}; export type CreateApiV0PlatformMonitorsOptions = {baseUrl?: string | undefined, APIKey?: string | undefined, fetch?: typeof fetch | undefined}; export const severity = z.enum(["info", "low", "medium", "high", "critical"]); export const assetIDTarget = z.object({type: z.literal("asset_id"), identifier: z.string()}); export const assetTagTarget = z.object({type: z.literal("asset_tag"), identifier: z.string()}); export const assetLabelTarget = z.object({type: z.literal("asset_label"), identifier: z.string()}); export const assetIDExcludeTarget = z.object({type: z.literal("exclude_asset_id"), identifier: z.string()}); export const approvalToMulticallContractMonitor = z.object({type: z.literal("approval_to_multicall_contract"), severity: severity, target: z.array(z.union([assetIDTarget, assetTagTarget, assetLabelTarget, assetIDExcludeTarget])), is_silent: z.boolean(), just_mine: z.boolean().optional()}); export const monitoringSupportedChains = z.enum(["abstract", "apechain", "arbitrum", "avalanche", "avalanche-fuji", "base", "berachain", "bitcoin", "blast", "bsc", "degen", "ethereum", "ethereum-sepolia", "gnosis", "hedera", "hyperevm", "hyperliquid", "aster", "lighter", "ink", "kaia", "katana", "kite-ai", "linea", "monad", "optimism", "plume", "polymarket", "polygon", "ronin", "scroll", "sei", "solana", "soneium", "soneium-minato", "stellar", "sui", "unichain", "zksync", "mainnet", "kaia", "tron", "robinhood", "arc", "flare", "xlayer", "tempo"]); export const assetHasDeployedContractMonitor = z.object({type: z.literal("asset_has_deployed_contract"), target: z.array(z.union([assetIDTarget, assetTagTarget, assetLabelTarget, assetIDExcludeTarget])), parameters: z.object({chain: z.object({operator: z.enum(["in", "not_in"]), value: monitoringSupportedChains}).optional()}).optional(), severity: severity, is_silent: z.boolean().optional(), just_mine: z.boolean().optional()}); export const benignInteractionWithAnAssetMonitor = z.object({type: z.literal("benign_interaction_with_an_asset"), target: z.array(z.union([assetIDTarget, assetTagTarget, assetLabelTarget, assetIDExcludeTarget])), parameters: z.object({interaction_type: z.object({operator: z.enum(["in", "not_in"]), value: z.array(z.enum(["funds_transfer", "approval", "function_call"]))}).optional(), interacted_addresses: z.object({operator: z.enum(["in", "not_in"]), value: z.array(assetIDTarget)}), interaction_direction: z.object({operator: z.enum(["is", "is_not"]), value: z.enum(["inbound", "outbound", "any"])}), interaction_usd_value: z.object({operator: z.enum(["is", "is_not", "gt", "gte", "lt", "lte"]), value: z.number().int()}).optional()}), severity: severity, is_silent: z.boolean().optional(), just_mine: z.boolean().optional()}); export const contractOwnerChangeMonitor = z.object({type: z.literal("contract_owner_change"), target: z.array(z.union([assetIDTarget, assetTagTarget, assetLabelTarget, assetIDExcludeTarget])), severity: severity, is_silent: z.boolean().optional(), just_mine: z.boolean().optional()}); export const objectOwnerChangeMonitor = z.object({type: z.literal("object_owner_change"), target: z.array(z.union([assetIDTarget, assetTagTarget, assetLabelTarget, assetIDExcludeTarget])), parameters: z.object({change_type: z.object({operator: z.enum(["in", "not_in"]), value: z.array(z.enum(["transferred", "frozen", "shared"]))}).optional()}).optional(), severity: severity, is_silent: z.boolean().optional(), just_mine: z.boolean().optional()}); export const delegateCallToNonApprovedContractMonitor = z.object({type: z.literal("delegate_call_to_non_approved_contract"), target: z.array(z.union([assetIDTarget, assetTagTarget, assetLabelTarget, assetIDExcludeTarget])), parameters: z.object({function_name: z.object({operator: z.enum(["is", "is_not"]), value: z.string()}), function_parameter: z.array(z.union([z.object({parameter: z.string(), operator: z.enum(["is", "is_not", "contains", "not_contains"]), value: z.string()}), z.object({parameter: z.string(), operator: z.enum(["is", "is_not", "eq", "gte", "lte", "lt", "gt", "neq", "increase_by", "decrease_by", "multiply_by", "divide_by"]), value: z.number().int()})])).optional(), approved_contract: z.object({operator: z.enum(["in", "not_in"]), value: z.array(assetIDTarget)})}), severity: severity, is_silent: z.boolean().optional(), just_mine: z.boolean().optional()}); export const eip7702SetCodeUpgradeMonitor = z.object({type: z.literal("eip_7702_set_code_upgrade_monitor"), target: z.array(z.union([assetIDTarget, assetTagTarget, assetLabelTarget, assetIDExcludeTarget])), severity: severity, is_silent: z.boolean().optional(), just_mine: z.boolean().optional()}); export const eventEmittedMonitor = z.object({type: z.literal("event_emitted"), target: z.array(z.union([assetIDTarget, assetTagTarget, assetLabelTarget, assetIDExcludeTarget])), parameters: z.object({event_name: z.object({operator: z.enum(["is", "is_not"]), value: z.string()}), event_parameter: z.array(z.union([z.object({parameter: z.string(), operator: z.enum(["is", "is_not", "contains", "not_contains"]), value: z.string()}), z.object({parameter: z.string(), operator: z.enum(["is", "is_not", "eq", "gte", "lte", "lt", "gt", "neq", "increase_by", "decrease_by", "multiply_by", "divide_by"]), value: z.number().int()})])).optional()}), severity: severity, is_silent: z.boolean().optional(), just_mine: z.boolean().optional()}); export const functionCallMonitor = z.object({type: z.literal("function_call"), target: z.array(z.union([assetIDTarget, assetTagTarget, assetLabelTarget, assetIDExcludeTarget])), parameters: z.object({function_name: z.object({operator: z.enum(["is", "is_not"]), value: z.string()}), function_parameter: z.array(z.union([z.object({parameter: z.string(), operator: z.enum(["is", "is_not", "contains", "not_contains"]), value: z.string()}), z.object({parameter: z.string(), operator: z.enum(["is", "is_not", "eq", "gte", "lte", "lt", "gt", "neq", "increase_by", "decrease_by", "multiply_by", "divide_by"]), value: z.number().int()})])).optional(), caller_address: z.object({operator: z.enum(["in", "not_in"]), value: z.array(assetIDTarget)})}), severity: severity, is_silent: z.boolean().optional(), just_mine: z.boolean().optional()}); export const maliciousInteractionWithAssetMonitor = z.object({type: z.literal("malicious_interaction_with_asset"), target: z.array(z.union([assetIDTarget, assetTagTarget, assetLabelTarget, assetIDExcludeTarget])), parameters: z.object({chain: z.object({operator: z.enum(["in", "not_in"]), value: z.array(monitoringSupportedChains)}).optional(), malicious_actor_label: z.object({operator: z.enum(["in", "not_in"]), value: z.array(z.enum(["custom_malicious", "address_poisoning_imperatonator_wallet", "wallet_drainer", "exploiter", "exploit_contract", "ofac_address", "malicious_contract_deployer", "compromised", "malicious_operator"]))}).optional(), interaction_type: z.object({operator: z.enum(["in", "not_in"]), value: z.array(z.enum(["funds_transfer", "approval", "function_call"]))}), interaction_direction: z.object({operator: z.enum(["is", "is_not"]), value: z.enum(["inbound", "outbound", "any"])}), interaction_usd_value: z.object({operator: z.enum(["is", "is_not", "gt", "gte", "lt", "lte"]), value: z.number().int()})}).optional(), severity: severity, is_silent: z.boolean().optional(), just_mine: z.boolean().optional()}); export const pigButcheringInteractionMonitor = z.object({type: z.literal("pig_butchering_interaction"), target: z.array(z.union([assetIDTarget, assetTagTarget, assetLabelTarget, assetIDExcludeTarget])), severity: severity, is_silent: z.boolean().optional(), just_mine: z.boolean().optional()}); export const proxyUpgradeDetectedMonitor = z.object({type: z.literal("proxy_upgrade_detected"), target: z.array(z.union([assetIDTarget, assetTagTarget, assetLabelTarget, assetIDExcludeTarget])), severity: severity, is_silent: z.boolean().optional(), just_mine: z.boolean().optional()}); export const tokenStateChangedToMaliciousMonitor = z.object({type: z.literal("token_state_changed_to_malicious"), target: z.array(z.union([assetIDTarget, assetTagTarget, assetLabelTarget, assetIDExcludeTarget])), severity: severity, is_silent: z.boolean().optional(), just_mine: z.boolean().optional()}); export const toxicityRateThresholdCrossedMonitor = z.object({type: z.literal("toxicity_monitor"), target: z.array(z.union([assetIDTarget, assetTagTarget, assetLabelTarget, assetIDExcludeTarget])), parameters: z.object({toxicity_category: z.array(z.object({parameter: z.string(), operator: z.enum(["gte", "lte", "lt", "gt"]), value: z.string()})), proximity: z.object({operator: z.literal("is"), value: z.enum(["ownership", "counterparty", "indirect"])}).optional()}), severity: severity, is_silent: z.boolean().optional(), just_mine: z.boolean().optional()}); export const transferToNonApprovedEntityMonitor = z.object({type: z.literal("transfer_to_non_approved_entity"), target: z.array(z.union([assetIDTarget, assetTagTarget, assetLabelTarget, assetIDExcludeTarget])), severity: severity, is_silent: z.boolean().optional(), just_mine: z.boolean().optional()}); export const timeframe = z.object({value: z.number().int(), unit: z.string()}); export const compositeMonitor = z.object({type: z.literal("composite"), category: z.enum(["scam_fraud", "security", "compliance", "finance"]), must_match_monitor_configs: z.array(z.object({monitor_id: z.string(), severity: severity})), must_not_match_monitor_configs: z.array(z.object({monitor_id: z.string(), severity: severity})), incidents_must_share_same_target: z.boolean().optional(), incidents_must_share_same_attacker: z.boolean().optional(), timeframe: timeframe.optional(), severity: severity, is_silent: z.boolean().optional()}); export const definedMetric = z.object({metric_id: z.string(), aggregation: z.object({aggregation_function: z.enum(["sum", "avg", "min", "max", "std_dev", "count"]), timeframe: timeframe}).optional()}); export const formulaMonitor = z.object({type: z.literal("formula"), category: z.enum(["scam_fraud", "security", "compliance", "finance"]), metrics: z.array(z.object({symbol: z.string().min(1).max(1), metric: definedMetric})), formula: z.string(), severity: severity}); export const codeBasedMonitor = z.object({type: z.literal("code_based_monitor"), severity: severity, source: z.string().min(1), params: z.record(z.string(), z.unknown()).nullable().optional(), target: z.array(z.union([assetIDTarget, assetTagTarget, assetLabelTarget, assetIDExcludeTarget])), is_silent: z.boolean().optional()}); export const iPInfringementMonitor = z.object({type: z.literal("ip_infringement"), severity: severity, parameters: z.object({keywords: z.object({operator: z.literal("in"), value: z.array(z.string())}), search_location: z.object({operator: z.enum(["in", "not_in"]), value: z.array(z.enum(["token_names", "token_symbols", "dapp_dns_name"]))}), chains: z.object({operator: z.enum(["in", "not_in"]), value: z.array(monitoringSupportedChains)}).optional()}), is_silent: z.boolean().optional(), just_mine: z.boolean().optional()}); export const monitorRuleResponse = z.union([z.array(approvalToMulticallContractMonitor), z.array(assetHasDeployedContractMonitor), z.array(benignInteractionWithAnAssetMonitor), z.array(contractOwnerChangeMonitor), z.array(objectOwnerChangeMonitor), z.array(delegateCallToNonApprovedContractMonitor), z.array(eip7702SetCodeUpgradeMonitor), z.array(eventEmittedMonitor), z.array(functionCallMonitor), z.array(maliciousInteractionWithAssetMonitor), z.array(pigButcheringInteractionMonitor), z.array(proxyUpgradeDetectedMonitor), z.array(tokenStateChangedToMaliciousMonitor), z.array(toxicityRateThresholdCrossedMonitor), z.array(transferToNonApprovedEntityMonitor), z.array(compositeMonitor), z.array(formulaMonitor), z.array(codeBasedMonitor), z.array(iPInfringementMonitor), z.array(z.unknown())]); export const maliciousInteractionWithOFACAddressMonitor = z.object({type: z.literal("malicious_interaction_with_ofac_address"), target: z.array(z.union([assetIDTarget, assetTagTarget, assetLabelTarget, assetIDExcludeTarget])), parameters: z.object({malicious_actor_label: z.object({operator: z.enum(["in", "not_in"]), value: z.array(z.string())}), interaction_direction: z.object({operator: z.enum(["is", "is_not"]), value: z.enum(["any", "inbound", "outbound"])}), chain: z.object({operator: z.enum(["in", "not_in"]), value: z.array(monitoringSupportedChains)}).optional(), interaction_type: z.object({operator: z.enum(["in", "not_in"]), value: z.array(z.enum(["funds_transfer", "approval", "function_call"]))}).optional(), interaction_usd_value: z.object({operator: z.enum(["eq", "neq", "gt", "gte", "lt", "lte"]), value: z.number()}).optional()}), severity: severity, is_silent: z.boolean().optional(), just_mine: z.boolean().optional()}); export const monitoredContractExploitMonitor = z.object({type: z.literal("monitored_contract_was_exploited"), target: z.array(z.union([assetIDTarget, assetTagTarget, assetLabelTarget, assetIDExcludeTarget])), severity: severity, parameters: z.object({confidence: z.object({operator: z.enum(["is", "is_not", "gt", "gte", "lt", "lte"]), value: z.number()}), funds_lost: z.array(z.object({operator: z.enum(["eq", "neq", "gt", "gte", "lt", "lte"]), value: z.number()})).optional()}), is_silent: z.boolean().optional(), just_mine: z.boolean().optional()}); export const impersonatorDappDeployedMonitor = z.object({type: z.literal("impersonator_dapp_deployed"), target: z.array(z.union([assetIDTarget, assetTagTarget, assetLabelTarget, assetIDExcludeTarget])), parameters: z.object({similarity_score: z.object({operator: z.enum(["eq", "neq", "gt", "gte", "lt", "lte"]), value: z.number().gte(0).lte(1)}), popularity_score: z.object({operator: z.enum(["eq", "neq", "gt", "gte", "lt", "lte"]), value: z.number()}).optional()}), severity: severity, is_silent: z.boolean().optional(), just_mine: z.boolean().optional()}); export const impersonatorTokenDeployedMonitor = z.object({type: z.literal("impersonator_token_deployed"), target: z.array(z.union([assetIDTarget, assetTagTarget, assetLabelTarget, assetIDExcludeTarget])), severity: severity, is_silent: z.boolean().optional(), just_mine: z.boolean().optional()}); export const frontendAttackMonitor = z.object({type: z.literal("frontend_attack"), target: z.array(z.union([assetIDTarget, assetTagTarget, assetLabelTarget, assetIDExcludeTarget])), severity: severity, is_silent: z.boolean().optional(), just_mine: z.boolean().optional()}); export const exploitContractDeployedWithReferenceToMonitoredAssetMonitor = z.object({type: z.literal("exploit_contract_deployed_with_reference"), target: z.array(z.union([assetIDTarget, assetTagTarget, assetLabelTarget, assetIDExcludeTarget])), severity: severity, parameters: z.object({confidence: z.object({operator: z.enum(["is", "is_not", "gt", "gte", "lt", "lte"]), value: z.number()})}), is_silent: z.boolean().optional(), just_mine: z.boolean().optional()}); export const maliciousFundsExposureMonitor = z.object({type: z.literal("malicious_funds_exposure"), target: z.array(z.union([assetIDTarget, assetTagTarget, assetLabelTarget, assetIDExcludeTarget])), parameters: z.object({exposed_amount_usd: z.array(z.object({operator: z.enum(["eq", "neq", "gt", "gte", "lt", "lte"]), value: z.number()})), chains: z.object({operator: z.enum(["in", "not_in"]), value: z.array(monitoringSupportedChains)}).optional()}), severity: severity, is_silent: z.boolean().optional(), just_mine: z.boolean().optional()}); export const userGotDrainedMonitor = z.object({type: z.literal("user_got_drained"), target: z.array(z.union([assetIDTarget, assetTagTarget, assetLabelTarget, assetIDExcludeTarget])), parameters: z.object({drain_amount_usd: z.array(z.object({operator: z.enum(["eq", "neq", "gt", "gte", "lt", "lte"]), value: z.number()})), chain: z.object({operator: z.enum(["in", "not_in"]), value: z.array(monitoringSupportedChains)}).optional()}), severity: severity, is_silent: z.boolean().optional(), just_mine: z.boolean().optional()}); export const maliciousTransactionWasBlockedMonitor = z.object({type: z.literal("malicious_transaction_was_blocked"), target: z.array(z.union([assetIDTarget, assetTagTarget, assetLabelTarget, assetIDExcludeTarget])), parameters: z.object({tx_amount_usd: z.object({operator: z.enum(["eq", "neq", "gt", "gte", "lt", "lte"]), value: z.number()}), chain: z.object({operator: z.enum(["in", "not_in"]), value: z.array(monitoringSupportedChains)}).optional(), domain: z.object({operator: z.enum(["is", "is_not", "contains", "not_contains"]), value: z.string()}).optional()}), severity: severity, is_silent: z.boolean().optional(), just_mine: z.boolean().optional()}); export const maliciousTransactionDetectedMonitor = z.object({type: z.literal("malicious_transaction_detected"), severity: severity, is_silent: z.boolean().optional(), just_mine: z.boolean().optional()}); export const toctouPackageDeployedMonitor = z.object({type: z.literal("toctou_package_deployed"), severity: severity, is_silent: z.boolean().optional(), just_mine: z.boolean().optional()}); export const activeMaliciousAirdropCampaignMonitor = z.object({type: z.literal("active_malicious_airdrop_campaign"), target: z.array(z.union([assetIDTarget, assetTagTarget, assetLabelTarget, assetIDExcludeTarget])), parameters: z.object({victims_amount: z.array(z.object({operator: z.enum(["eq", "neq", "gt", "gte", "lt", "lte"]), value: z.number().int()})), operator_address: z.object({operator: z.enum(["in", "not_in"]), value: z.array(z.string())}).optional(), token_address: z.object({operator: z.enum(["in", "not_in"]), value: z.array(z.string())}).optional(), chain: z.object({operator: z.enum(["in", "not_in"]), value: z.array(monitoringSupportedChains)}).optional()}), severity: severity, is_silent: z.boolean().optional(), just_mine: z.boolean().optional()}); export const addressPoisoningCampaignMonitor = z.object({type: z.literal("address_poisoning_campaign"), target: z.array(z.union([assetIDTarget, assetTagTarget, assetLabelTarget, assetIDExcludeTarget])), parameters: z.object({victims_amount: z.object({operator: z.enum(["eq", "neq", "gt", "gte", "lt", "lte"]), value: z.number().int()}), operator_address: z.object({operator: z.enum(["in", "not_in"]), value: z.array(z.string())}).optional(), chain: z.object({operator: z.enum(["in", "not_in"]), value: z.array(monitoringSupportedChains)}).optional()}), severity: severity, is_silent: z.boolean().optional(), just_mine: z.boolean().optional()}); export const systemMonitorRuleResponse = z.union([z.array(maliciousInteractionWithOFACAddressMonitor), z.array(monitoredContractExploitMonitor), z.array(impersonatorDappDeployedMonitor), z.array(impersonatorTokenDeployedMonitor), z.array(frontendAttackMonitor), z.array(exploitContractDeployedWithReferenceToMonitoredAssetMonitor), z.array(maliciousFundsExposureMonitor), z.array(userGotDrainedMonitor), z.array(maliciousTransactionWasBlockedMonitor), z.array(maliciousTransactionDetectedMonitor), z.array(toctouPackageDeployedMonitor), z.array(activeMaliciousAirdropCampaignMonitor), z.array(addressPoisoningCampaignMonitor)]); export const emailAction = z.object({type: z.literal("email"), severity: z.array(severity).optional(), to: z.array(z.string()), cc: z.array(z.string()).optional(), bcc: z.array(z.string()).optional(), body: z.string().optional()}); export const slackAction = z.object({type: z.literal("slack"), severity: z.array(severity).optional(), integration_instance_id: z.string(), channels: z.array(z.string()), message_format: z.string().optional()}); export const telegramAction = z.object({type: z.literal("telegram"), severity: z.array(severity).optional(), integration_instance_id: z.string(), chats: z.array(z.object({chat_id: z.string(), topic_ids: z.array(z.number().int()).optional()})), message_format: z.string().optional()}); export const hMACAuthentication = z.object({type: z.literal("hmac"), hmac_secret: z.string()}); export const authorizationHeaderAuthentication = z.object({type: z.literal("authorization_header"), value: z.string()}); export const aPIKeyAuthorization = z.object({type: z.literal("api_key"), header_name: z.string(), api_key: z.string()}); export const basicAuth = z.object({type: z.literal("basic_auth"), username: z.string(), password: z.string()}); export const authentication = z.union([hMACAuthentication, authorizationHeaderAuthentication, aPIKeyAuthorization, basicAuth]); export const webhookAction = z.object({type: z.literal("webhook"), severity: z.array(severity).optional(), url: z.string(), authentication: authentication.optional(), custom_headers: z.array(z.object({name: z.string(), value: z.string()})).optional(), custom_payload_fields: z.array(z.object({key: z.string(), value: z.string()})).optional()}); export const pauseContractAction = z.object({type: z.literal("pause-contract").optional(), severity: z.array(severity).optional(), pause: z.boolean()}); export const sequencerAction = z.object({type: z.literal("sequencer").optional(), severity: z.array(severity).optional(), target: z.enum(["target", "source"]), comment: z.string().optional(), expiration_time: z.string().optional()}); export const aPICallAction = z.object({type: z.literal("api_call"), severity: z.array(severity).optional(), url: z.string(), authentication: authentication.optional(), custom_headers: z.object({}).optional(), request_type: z.enum(["GET", "POST", "PUT", "PATCH", "DELETE"]), body: z.object({}).optional(), incident_payload_override: z.array(z.object({key_to_override: z.string(), incident_field: z.enum(["targets", "attackers", "incident_name", "incident_start_date", "incident_end_date", "incident_duration", "severity", "dollars_funds_lost", "dollars_funds_exposed"])}))}); export const callContractAction = z.object({type: z.literal("contract_call"), severity: z.array(severity).optional(), targets: z.union([z.array(z.union([assetIDTarget, assetTagTarget])), z.literal("dynamic")]), via_router: z.object({contracts: z.array(assetIDTarget)}).optional(), function_signature: z.string(), function_parameters: z.array(z.string()), response_wallet: z.object({integration_instance_id: z.string()})}); export const labelEntityAction = z.object({type: z.literal("label_entity"), severity: z.array(severity).optional(), entity_from_incident: z.enum(["target", "source"]), label: z.enum(["account_takeover", "compromised", "custom_malicious", "investment_scam", "address_poisoning_impersonator_wallet", "address_poisoning_operator", "exploiter", "exploit_contract", "malicious_airdrop_operator", "wallet_drainer", "rugpull_operator", "malicious_implementation"])}); export const monitorObject = z.object({id: z.string(), is_enabled: z.boolean(), name: z.string(), created_by: z.string(), updated_by: z.string(), updated_at: z.string(), created_at: z.string(), monitors: z.union([monitorRuleResponse, systemMonitorRuleResponse]), actions: z.array(z.union([emailAction, slackAction, telegramAction, webhookAction, pauseContractAction, sequencerAction, aPICallAction, callContractAction, labelEntityAction])).optional(), tags: z.array(z.string()).optional()}); export const validateResponse = async ( schema: { readonly '~standard': { readonly validate: (value: unknown) => ({ readonly value: Output; readonly issues?: undefined } | { readonly issues: ReadonlyArray<{ readonly message: string; readonly path?: ReadonlyArray | undefined }> }) | Promise<{ readonly value: Output; readonly issues?: undefined } | { readonly issues: ReadonlyArray<{ readonly message: string; readonly path?: ReadonlyArray | undefined }> }> } }, value: unknown ): Promise => { const result = await schema['~standard'].validate(value) if (result.issues !== undefined) { const detail = result.issues .map(({ message, path }) => path?.length ? `${path.map((segment) => String(typeof segment === 'object' ? segment.key : segment)).join('.')}: ${message}` : message ) .join('; ') throw new Error(`Response does not match the schema: ${detail}`, { cause: { issues: result.issues } }) } return result.value }; /** * Create Monitor * * POST /v0/platform/monitors/ * * Also accepts auth: ClientID, JWT */ export const createApiV0PlatformMonitors = async (args: CreateApiV0PlatformMonitorsArgs, options?: CreateApiV0PlatformMonitorsOptions) => { const {baseUrl = "https://api.blockaid.io", fetch: fetchFn = fetch, APIKey} = options ?? {} const query = new URLSearchParams() const headers = new Headers() headers.set('content-type', "application/json") headers.set('accept', "application/json") if (APIKey !== undefined) headers.set("X-API-Key", APIKey) const url = `${baseUrl.replace(/\/+$/, '')}/v0/platform/monitors/${query.size > 0 ? `?${query}` : ''}` const res = await fetchFn(url, {method: "POST", headers, body: JSON.stringify(args.body)}) if (!res.ok) throw new Error(`Request failed with status ${res.status}`, {cause: {status: res.status, body: await res.text()}}) return validateResponse(monitorObject, await res.json()) };