/**
 * Datadog spike audit: from the account's own estimated usage metrics, the
 * hours each service ran far above its usual level, what the excess cost at
 * the account's rates, and what a fleet default limit would have held.
 *
 * Inputs are hourly sums of `datadog.estimated_usage.logs.ingested_events`
 * (indexed events, `datadog_is_excluded:false`, by service and datadog_index)
 * and `datadog.estimated_usage.logs.ingested_bytes` (by service).
 */
import type { DdPointSeries } from './datadog-metrics-read.js';
export declare const SPIKE_MULTIPLIER = 3;
export declare const BASELINE_DAYS = 7;
export interface SpikeAuditInput {
    fromSec: number;
    toSec: number;
    events: DdPointSeries[];
    bytes: DdPointSeries[];
}
export interface SpikeAuditOptions {
    multiplier?: number;
    headroom?: number;
    standardUsdPerMillion?: number;
    ingestionUsdPerGb?: number;
    /** X: a monthly Standard indexing budget for the whole account, dollars. */
    budgetUsdMonthly?: number;
    /** Index names that bill as Standard; empty or absent counts every index. */
    standardIndexes?: string[];
}
/** One calendar month (UTC) of Standard indexing against the budget. */
export interface BudgetMonth {
    /** `2026-07`. */
    month: string;
    events: number;
    usd: number;
    overEvents: number;
    overUsd: number;
    /** True when the window holds only part of the month. */
    partial: boolean;
    /** X for this month: prorated by the hours inside the window when the month is partial. */
    budgetUsd: number;
    /** The hour Standard crossed X, when it did. */
    crossedIso?: string;
}
export interface BudgetOverService {
    service: string;
    overEvents: number;
    overUsd: number;
    /** Its share of the lines past the budget, 0 to 1. */
    share: number;
}
/** Given X, how far over it the account went, month by month and per service. */
export interface BudgetOverage {
    usdMonthly: number;
    standardIndexes: string[];
    months: BudgetMonth[];
    services: BudgetOverService[];
    overUsd: number;
    overEvents: number;
    monthsOver: number;
}
export interface Spike {
    startIso: string;
    hours: number;
    /** The index that took most of the spike's events, when Datadog tagged one. */
    index?: string;
    events: number;
    excessEvents: number;
    excessBytes: number;
    usd: number;
    heldEvents: number;
    heldUsd: number;
}
export interface ServiceSpikes {
    service: string;
    spikes: Spike[];
    excessEvents: number;
    excessBytes: number;
    usd: number;
    heldEvents: number;
    heldUsd: number;
    largestNormalHourEvents: number;
    limitEventsPerHour: number;
}
export interface SpikeAudit {
    fromIso: string;
    toIso: string;
    judgedDays: number;
    multiplier: number;
    headroom: number;
    standardUsdPerMillion: number;
    ingestionUsdPerGb: number;
    servicesScanned: number;
    services: ServiceSpikes[];
    /** Present when a budget was given. */
    budget?: BudgetOverage;
    totals: {
        spikes: number;
        excessEvents: number;
        excessBytes: number;
        usd: number;
        heldEvents: number;
        heldUsd: number;
        usdPerYear: number;
        heldUsdPerYear: number;
    };
}
/**
 * Given X, the account's Standard indexing month by month (UTC): each hour's
 * indexed events in order, and once the month's running total passes X every
 * later line is past the budget. A service's overage is its share of those
 * lines (the crossing hour split by each service's events in it), so the
 * services' overages add up to the month's. A month only partly inside the
 * window is held to X prorated by its hours inside the window.
 */
export declare function budgetOverage(input: SpikeAuditInput, opts: {
    budgetUsdMonthly: number;
    standardUsdPerMillion: number;
    standardIndexes?: string[];
}): BudgetOverage;
export declare function buildSpikeAudit(input: SpikeAuditInput, opts?: SpikeAuditOptions): SpikeAudit;
/** What the budget figures cover, in words. */
export declare function budgetScopeWords(b: BudgetOverage): string;
export declare function renderSpikeAuditMarkdown(a: SpikeAudit, opts?: {
    limit?: number;
    spikesPerService?: number;
    standardRateSupplied?: boolean;
    ingestionRateSupplied?: boolean;
}): string;