/**
 * Datadog monitor definitions on the per-pattern series the engine's Datadog
 * output publishes. Rendered as JSON for the account owner to apply with
 * their own tooling; nothing here calls Datadog.
 *
 * Route monitor: a metric monitor (multi alert) that fires for a statement
 * the first time its lines carry `routestate:tier_down` or
 * `routestate:offload`. Datadog notifies on the OK to Alert transition, so a
 * statement a rule holds every day alerts once, when it turns.
 *
 * Volume monitor: an anomaly monitor with weekly seasonality, so a statement
 * alerts when its volume rises above what the same hour of the week usually
 * shows. Datadog documents weekly seasonality for the `agile` and `robust`
 * algorithms and needs three weeks of data for it
 * (docs.datadoghq.com/monitors/types/anomaly/). `robust` is the one Datadog
 * recommends when a slow level shift counts as an anomaly, which is the cost
 * case: a statement that stays loud keeps costing.
 */
export interface DatadogMonitorDefinition {
    name: string;
    type: 'query alert';
    query: string;
    message: string;
    tags: string[];
    priority: null;
    options: Record<string, unknown>;
}
export interface SpikeMonitorOptions {
    /** `tenx_env` value to scope both monitors to. */
    tenxEnv?: string;
    /** Team tag key, included only when the series carry it (e.g. `tenx_team`). */
    teamTag?: string;
    /** Notification handles appended to each message (e.g. `@slack-log-cost`). */
    notify?: string[];
    /** Anomaly bounds, in deviations. Default 3. */
    deviations?: number;
}
export interface SpikeMonitors {
    route: DatadogMonitorDefinition;
    volume: DatadogMonitorDefinition;
    group_by: string[];
    docs: string[];
}
export declare const MONITOR_DOCS: string[];
export declare function normalizeTagKey(key: string | undefined): string | undefined;
export declare function spikeMonitorGroupBy(teamTag?: string): string[];
export declare function buildSpikeMonitors(opts?: SpikeMonitorOptions): SpikeMonitors;