/**
 * AnomalyCorrelator -- Cross-agent anomaly correlation engine.
 *
 * Analyzes anomaly patterns across multiple agents to detect
 * coordinated attacks, cascading failures, and systemic issues
 * that individual AnomalyDetectors cannot identify alone.
 *
 * T-071: Cross-agent anomaly correlation.
 *
 * @connexum/ai-governance
 */
import type { Anomaly } from './anomaly-detector';
export interface AnomalyCorrelatorConfig {
    /** Directory containing per-agent anomaly data */
    dataDir: string;
    /** Time window for correlation (ms, default: 5 min DEV MODE -- production: 300000 / 5 min) */
    correlationWindowMs?: number;
    /** Minimum agents with anomalies to trigger correlation alert (default: 2) */
    minAgentsForCorrelation?: number;
    /** Minimum total anomalies within window to trigger alert (default: 3) */
    minAnomaliesForAlert?: number;
}
export interface CorrelatedAnomaly {
    id: string;
    pattern: CorrelationPattern;
    agents: string[];
    anomalies: Anomaly[];
    severity: 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL';
    description: string;
    detectedAt: string;
    windowStart: string;
    windowEnd: string;
}
export type CorrelationPattern = 'COORDINATED_SPIKE' | 'CASCADE_FAILURE' | 'SYSTEMIC_DEVIATION' | 'RESOURCE_EXHAUSTION' | 'UNKNOWN';
export declare class AnomalyCorrelator {
    private config;
    private correlationFile;
    constructor(config: AnomalyCorrelatorConfig);
    /**
     * Analyze anomalies across all agents and return correlated patterns.
     */
    correlate(allAnomalies: Map<string, Anomaly[]>): CorrelatedAnomaly[];
    /**
     * Load all agent anomalies from the data directory.
     */
    loadAllAgentAnomalies(): Map<string, Anomaly[]>;
    /**
     * Get all stored correlations.
     */
    getCorrelations(): CorrelatedAnomaly[];
    /**
     * Get statistics.
     */
    getStats(): {
        totalCorrelations: number;
        byPattern: Record<string, number>;
        bySeverity: Record<string, number>;
        uniqueAgents: number;
    };
    private detectCoordinatedSpike;
    private detectCascadeFailure;
    private detectSystemicDeviation;
    private detectResourceExhaustion;
    private persistCorrelations;
}
//# sourceMappingURL=anomaly-correlator.d.ts.map