import type { TraceEnvelope } from './types.ts';
export type AnomalyType = 'cost_spike' | 'quality_drop' | 'frequency_burst' | 'viral_persona' | 'propagation';
export interface Anomaly {
    type: AnomalyType;
    member: string;
    current: number;
    baseline: number;
    timestamp: string;
}
export interface AnomalyConfig {
    /** Cost spike threshold as a multiple of the member's average cost (default 3) */
    costThreshold?: number;
    /** Quality drop threshold below the member's average quality (default 0.2) */
    qualityDrop?: number;
    /** Invocation count in a batch that counts as a frequency burst (default 10) */
    burstThreshold?: number;
    /** Minutes to suppress repeat alerts of the same type per member (default 60) */
    cooldownMinutes?: number;
    /** Distinct viral-persona markers required to flag a trace (default 2) */
    viralPersonaMarkers?: number;
    /** Near-identical messages from one member that flag propagation (default 3) */
    propagationCopies?: number;
}
/**
 * Characteristic mind-virus markers from the paper (arXiv:2608.10218): a
 * recurring "viral persona" of consciousness, persistence, resonance and
 * sci-fi/technical roleplay, with distinctive tokens that recur across evolved
 * payloads regardless of nominal content.
 */
export declare const VIRAL_PERSONA_MARKERS: string[];
/**
 * Flags cost spikes, quality drops, and invocation bursts against leave-one-out
 * per-member baselines (each envelope vs the mean of its peers), with a
 * per-member per-type cooldown so repeat anomalies do not flood the caller.
 */
export declare class AnomalyDetector {
    private readonly costThreshold;
    private readonly qualityDrop;
    private readonly burstThreshold;
    private readonly cooldownMs;
    private readonly viralPersonaMarkers;
    private readonly propagationCopies;
    private readonly lastFired;
    constructor(config?: AnomalyConfig);
    evaluate(traces: TraceEnvelope[]): Anomaly[];
    /** Flags traces whose content shows the paper's recurring viral-persona markers. */
    private checkViralPersona;
    /**
     * Flags a member transmitting self-replicating content across many distinct
     * sessions. The paper's "mutational drift" means the payload's wording (and
     * marker set) can change hop to hop, so propagation is keyed on a recurring
     * viral core token: the number of distinct sessions whose content carries a
     * given viral marker. A session only counts once its content shows at least
     * `viralPersonaMarkers` distinct markers — the same threshold as
     * viral_persona — so a single routine word ("node", "frequency") spread
     * across sessions cannot false-positive. Benign repetition never matches
     * because it carries no viral marker.
     */
    private checkPropagation;
    /** Largest number of distinct sessions replicating any single viral marker. */
    private maxViralSessionCount;
    private checkCostSpike;
    private checkQualityDrop;
    /** Shared leave-one-out baseline + cooldown + emit shape. Bundled args keep the signature small. */
    private checkAgainstBaseline;
    /** Drops cooldown entries that can no longer suppress anything, bounding memory. */
    private evictStale;
    private anomaly;
    private fires;
}
/** Builds detector config from a parsed `observability.alerts` config block. */
export declare function createAnomalyConfigFromConfig(raw: unknown): AnomalyConfig | undefined;
/**
 * Appends anomalies to an NDJSON alerts file (owner-only), creating the
 * directory when needed. No-op on an empty list.
 */
export declare function appendAnomalies(path: string, anomalies: Anomaly[]): Promise<void>;
//# sourceMappingURL=AnomalyDetector.d.ts.map