/**
 * Anomaly detection engine for x402-cfo.
 *
 * Uses exponentially weighted moving average (EWMA) with adaptive
 * thresholds for velocity spike detection. Implements Welford's
 * online algorithm for numerically stable variance computation —
 * no need to store full history in memory.
 *
 * Design choices:
 *   - EWMA with α=0.3 gives ~70% weight to recent history, adapts
 *     quickly to legitimate spending pattern changes while still
 *     detecting true anomalies.
 *   - Z-score threshold of 2.5σ balances sensitivity with false-positive
 *     rate (~1.2% false positives under normal distribution).
 *   - Per-host tracking isolates anomalies: a spike on one API doesn't
 *     pollute the baseline for others.
 *   - Cooldown prevents alert fatigue — one spike event per host per
 *     cooldown window.
 */
/** Percentile-based cost estimate. */
export interface CostEstimate {
    /** Median cost (p50) */
    median: number;
    /** 50th percentile */
    p50: number;
    /** 75th percentile */
    p75: number;
    /** 95th percentile */
    p95: number;
    /** 99th percentile */
    p99: number;
    /** Arithmetic mean */
    mean: number;
    /** Standard deviation */
    stddev: number;
    /** Min observed cost */
    min: number;
    /** Max observed cost */
    max: number;
    /** Number of observations */
    samples: number;
}
/** Result of anomaly check. */
export interface AnomalyResult {
    /** Whether this observation is anomalous */
    isAnomaly: boolean;
    /** Z-score of the observation (how many σ from the mean) */
    zScore: number;
    /** The EWMA baseline it was compared against */
    baseline: number;
    /** Standard deviation of the baseline */
    stddev: number;
    /** How many times larger than baseline (multiplier) */
    multiplier: number;
    /** Whether alert was suppressed by cooldown */
    suppressed: boolean;
}
export interface AnomalyDetectorConfig {
    /** EWMA smoothing factor (0-1). Higher = more weight to recent. Default: 0.3 */
    alpha?: number;
    /** Z-score threshold for anomaly. Default: 2.5 */
    zThreshold?: number;
    /** Cooldown between spike alerts per host (ms). Default: 60000 (1 min) */
    cooldownMs?: number;
    /** Max samples to retain per host for percentiles. Default: 200 */
    bufferSize?: number;
    /** Minimum observations before anomaly detection activates. Default: 5 */
    warmupCount?: number;
}
/**
 * Statistical anomaly detector using EWMA + Welford's online variance.
 *
 * This is the core intelligence engine. Every payment flows through
 * `observe()` which updates the statistical model and returns whether
 * the observation is anomalous. Zero external dependencies.
 */
export declare class AnomalyDetector {
    private hosts;
    private globalStats;
    private readonly alpha;
    private readonly zThreshold;
    private readonly cooldownMs;
    private readonly bufferSize;
    private readonly warmupCount;
    constructor(config?: AnomalyDetectorConfig);
    /**
     * Record a cost observation and check for anomalies.
     *
     * @param host - The API hostname (e.g. "api.chaindata.xyz")
     * @param amount - The cost in dollars
     * @param timestamp - When the payment occurred (ms since epoch)
     * @returns Anomaly check result
     */
    observe(host: string, amount: number, timestamp?: number): AnomalyResult;
    /**
     * Get percentile-based cost estimate for a host.
     * Returns null if insufficient data.
     */
    estimate(host: string): CostEstimate | null;
    /**
     * Get global cost estimate across all hosts.
     */
    estimateGlobal(): CostEstimate | null;
    private createStats;
    /**
     * Update stats using Welford's online algorithm + EWMA.
     *
     * Welford's gives numerically stable running variance without
     * storing all values. EWMA gives an exponentially-weighted
     * baseline that adapts to legitimate pattern changes.
     */
    private updateStats;
    /** Compute standard deviation from Welford's M2. */
    private stddev;
    /** Linear interpolation percentile on sorted array. */
    private percentile;
}
//# sourceMappingURL=anomaly.d.ts.map