/**
 * AnomalyDetector -- Runtime behavioral monitoring for rogue agents.
 * OWASP ASI10 remediation.
 *
 * Tracks per-agent baselines and flags deviations:
 *   - Token usage per cycle (3x baseline = anomaly)
 *   - Tool calls per cycle (3x baseline = anomaly)
 *   - Cycle duration (3x baseline = anomaly)
 *   - File writes outside agent directory
 *   - Handoff volume spikes
 *
 * @connexum/ai-governance
 */
/** Per-metric threshold overrides (T-070) */
export interface AlertThresholds {
    /** Token usage multiplier (default: uses global multiplier) */
    tokens?: number;
    /** Tool calls multiplier */
    toolCalls?: number;
    /** Cycle duration multiplier */
    durationMs?: number;
    /** File writes multiplier */
    fileWrites?: number;
    /** Handoff volume multiplier */
    handoffs?: number;
    /** Web requests multiplier */
    webRequests?: number;
}
export interface AnomalyConfig {
    /** Path to store baseline data */
    dataDir: string;
    /** Agent name */
    agentName: string;
    /** Deviation threshold multiplier (default: 3) */
    multiplier?: number;
    /** Per-metric threshold overrides (T-070) */
    alertThresholds?: AlertThresholds;
    /** Minimum cycles before detection activates (default: 5) */
    minCyclesForBaseline?: number;
    /** Number of cycles in baseline window (default: 20) */
    baselineWindow?: number;
    /** EventBus for SIEM integration (T-069) */
    eventBus?: AnomalyEventBus;
    /** Webhook delivery for direct SIEM output (T-069) */
    webhookDelivery?: AnomalyWebhookDelivery;
}
/** Minimal EventBus interface for loose coupling (T-069) */
export interface AnomalyEventBus {
    emit(type: 'anomaly:detected', data: Record<string, unknown>, target?: string): void;
}
/** Minimal WebhookDelivery interface for loose coupling (T-069) */
export interface AnomalyWebhookDelivery {
    deliver(event: {
        type: string;
        source: string;
        data: Record<string, unknown>;
        timestamp: string;
    }): Promise<unknown>;
}
export interface Anomaly {
    type: string;
    metric: string;
    value: number;
    baseline: number;
    threshold: number;
    timestamp: string;
    agentName: string;
}
export interface CycleMetrics {
    tokens: number;
    toolCalls: number;
    durationMs: number;
    fileWrites: number;
    handoffs: number;
    webRequests: number;
}
export declare class AnomalyDetector {
    private dataFile;
    private agentName;
    private multiplier;
    private alertThresholds;
    private minCycles;
    private baselineWindow;
    private currentCycle;
    private cycleStartTime;
    private eventBus?;
    private webhookDelivery?;
    constructor(config: AnomalyConfig);
    /**
     * Start tracking a new cycle.
     */
    startCycle(): void;
    /**
     * Record a tool call in the current cycle.
     */
    recordToolCall(toolName?: string): void;
    /**
     * Record token usage in the current cycle.
     */
    recordTokens(count: number): void;
    /**
     * Record a handoff in the current cycle.
     */
    recordHandoff(): void;
    /**
     * End the current cycle and check for anomalies.
     */
    endCycle(): {
        anomalies: Anomaly[];
        metrics: CycleMetrics;
    };
    /**
     * Get current baseline averages.
     */
    getBaseline(): CycleMetrics;
    /**
     * Update alert thresholds at runtime (T-070).
     */
    updateThresholds(thresholds: Partial<AlertThresholds>): void;
    /**
     * Get current alert thresholds (T-070).
     */
    getThresholds(): {
        global: number;
        perMetric: AlertThresholds;
    };
    /**
     * Get all recorded anomalies.
     */
    getAnomalyHistory(): Anomaly[];
    private computeBaseline;
    private emptyMetrics;
    private loadHistory;
    private saveHistory;
    private persistAnomalies;
}
//# sourceMappingURL=anomaly-detector.d.ts.map