/** * Reporter + Receiver install/verify/teardown plan builder. * * Given a DiscoverySnapshot + user args, produce an `AdvisePlan` that * covers the whole lifecycle for one forwarder kind. The plan is pure * data — rendering to markdown is the render layer's job. * * The same builder serves both apps. The current chart format unifies * around a single Receiver workload with two opt-in feature flags: * - `optimize`: compact events (reduction varies by destination and by the * events themselves). The losslessness is not a property of the encoding * alone: it holds only where the DESTINATION has the 10x expander installed * to expand events again at read time, meaning the Splunk app or the l1es * Elasticsearch/OpenSearch plugin. Destinations with no expander (Datadog, * CloudWatch) cannot use the flag at all, and on ClickHouse the lever is * offload rather than compaction. See `./compaction-support.ts`. * - `readOnly` — emit metrics, do NOT write events back through the * forwarder (passive observation). * The flags are mutually exclusive at the chart level. AdvisorApp keeps * a thin distinction at the user-facing surface: `reporter` is sugar * for "Receiver with readOnly=true" (different release-name default, * different verify wording, blocks optimize since there are no * write-back events to encode); `receiver` exposes the flags directly. */ import type { DiscoverySnapshot, ForwarderKind, MetricsBackendKind, BackendCredentialConfig } from '../discovery/types.js'; import type { AdvisePlan, GitopsExplainer } from './types.js'; import { type PolicyGitDelivery, type OutputDestination } from './reporter-forwarders.js'; export type AdvisorApp = 'reporter' | 'receiver'; /** Receiver forwarders whose overlay renders the Splunk compact-mode outputs. */ export declare const SPLUNK_COMPACT_FORWARDERS: ForwarderKind[]; /** * Deployment shape — orthogonal to forwarder kind. * inline = replace the user's forwarder deployment with a * log10x-repackaged version of the same chart (tenx baked * in as a processor/filter/init-container). * standalone = install log10x/reporter-10x as a parallel DaemonSet * that bundles its own fluent-bit. Does NOT touch the * user's forwarder. Report-mode only. * The user's detected forwarder kind is still surfaced in the plan when * shape='standalone' — as context, not as the install target. */ export type DeploymentShape = 'inline' | 'standalone'; export interface ReporterAdviseArgs { snapshot: DiscoverySnapshot; /** * Which app this plan installs. Default: 'reporter'. * - 'reporter' → standalone dedicated fluent-bit DaemonSet, read-only * - 'receiver' → sidecar inside the user's existing forwarder * Deployment shape is derived from app; no `shape` arg. */ app?: AdvisorApp; /** Forwarder to target. If omitted, uses the snapshot's recommendation. */ forwarder?: ForwarderKind; /** Helm release name. Default: `my-${app}`. */ releaseName?: string; /** Target namespace. Default: snapshot's suggestedNamespace. */ namespace?: string; /** * Log10x license JWT — mints from `POST /api/v1/license/demo` (anonymous) * or `POST /api/v1/license` (Auth0-authed). Maps to the chart's * `log10xLicenseJwt` value. An install plan needs either this or * `builtinLicense: true`. */ licenseJwt?: string; /** * True when the JWT came from the demo endpoint. Drives the secret-vs-inline * decision in the chart values renderer: demo licenses inline the JWT * (one-step setup, transient); real licenses point the chart at an * out-of-band Kubernetes Secret the user creates before `helm upgrade`. */ isDemoLicense?: boolean; /** * True when the plan deliberately carries no licence (the install * wizard's default). The engine then runs its built-in Free * tier: up to 10 nodes, no expiry, airgapped. The plan emits * no licence Secret step, and no overlay names TENX_LICENSE_FILE or a * licence volume. Ignored when `licenseJwt` is set. */ builtinLicense?: boolean; /** Output destination flavor. Default: 'mock' (safe for dogfooding). */ destination?: OutputDestination; /** * Receiver only: engine options after the app, in order, and env vars on * the engine container (the fleet default, the team label, the Datadog * hash field; see fleet-default-install.ts). Ignored for the Reporter. */ engineOptions?: Array<[string, string]>; engineEnv?: Array<[string, string]>; /** Receiver only: pull the policy files from git (GH_ENABLED) instead of the ConfigMap. */ policyGit?: PolicyGitDelivery; /** Host for non-mock destinations (ES endpoint, Splunk HEC host, etc.). */ outputHost?: string; /** Splunk HEC token if destination=splunk. */ splunkHecToken?: string; /** * Enable encoded event output (compact encoded form; the reduction varies * by destination and by the events). Only meaningful when app='receiver'; * blocks when app='reporter' (Reporter has no write-back path to * encode events on). Maps to `tenx.optimize: true` in every * supported chart's values.yaml. * * Reading those events back needs the destination's 10x expander, so a plan * that compacts states that prerequisite in preflight, and a destination * with no expander to install blocks the flag outright. */ optimize?: boolean; /** * Read-only mode (Receiver app only). When true, the receiver * publishes TenXSummary metrics but does NOT write events back * through the forwarder. Maps to `tenx.readOnly: true` in every * supported chart's values.yaml. Silently ignored when app='reporter' * — that app sets readOnly implicitly (Reporter IS read-only by * definition). */ readOnly?: boolean; /** * Metrics backends the engine emits TenXSummary to: one or more of the * user's own TSDBs (Datadog/Prom/etc.). Each entry maps to a `@run/output/metric/` * CLI arg appended to the engine's launch args, plus any vendor- * specific env vars (DD_API_KEY for datadog, ELASTIC_HOST for elastic, * etc.). No default: the wizard always passes the user's own backends; * `'log10x'` (the Log10x-hosted TSDB, for the public demo) appears only * when passed explicitly. When `airgapped=true`, `'log10x'` * MUST NOT be in this list (engine sends nothing to log10x.com). */ backends?: MetricsBackendKind[]; /** * Per-backend credential configuration the wizard collected: secret * name + plain-value overrides. The renderer threads this into the * `tenx.extraEnv` block as `valueFrom.secretKeyRef` references. * When unset for a selected backend, the renderer falls back to * `-credentials` for the secret name and per-backend defaults * for plain values. */ backendCredentials?: Partial>; /** * Run the engine fully airgapped — no outbound calls to log10x.com * (no telemetry, no online license check, no update probes). Engine * emits only to the user-configured `backend`. Reporter chart maps * this to top-level `airgapped: true`; Receiver wires it via the * `TENX_AIRGAPPED=true` env var on the engine sidecar. * * Every licence runs airgapped on engine 1.1.61+, including the * built-in Free tier (which is airgapped by construction) and * a demo JWT: both verify offline. */ airgapped?: boolean; /** Skip install — for users who just want verify or teardown guidance. */ skipInstall?: boolean; /** Skip teardown. */ skipTeardown?: boolean; /** Skip verify. */ skipVerify?: boolean; } /** Produce the plan. Never throws — surfaces missing input as `blockers`. */ export declare function buildReporterPlan(args: ReporterAdviseArgs): Promise; /** * The switch for the engine's pull of the files `paths` lists: GH_FILES_ENABLED * from 1.1.146 (where GH_ENABLED pulls the regulator policy folder * log10x/policy/ instead), GH_ENABLED before it. */ export declare function gitopsFilesSwitch(engineVersion: string | undefined): 'GH_FILES_ENABLED' | 'GH_ENABLED'; export declare function buildCompactReceiverGitopsExplainer(opts: { optimize: boolean; engineVersion?: string; }): GitopsExplainer;