/**
 * build-report-data — compute ReportData from the enriched POC
 * pipeline output. Everything here is tool arithmetic over measured
 * window values; the agent's only input is the annotation map, which
 * is validated fail-closed (unknown hash or over-cap length refuses
 * the render — never silently truncated or dropped).
 *
 * Honesty constraints implemented here:
 *  - severity gate: below MIN_SEVERITY_COVERAGE no volume action is
 *    proposed at all (a gate must fail on known-broken input).
 *  - THE CHANGE renders the container-keyed grammar configure_engine
 *    truly emits; the per-statement gap is stated, not papered over.
 *  - impacts are this window's arithmetic; no extrapolation.
 */
import type { RenderInput, _EnrichedPattern } from '../poc-report-renderer.js';
import type { Plan } from '../plan-solver.js';
import type { IncidentCluster } from '../detectors/incident-cluster.js';
import { type InstallMethod } from './command-matrix.js';
import { type ReportData } from './report-data.js';
import { type EnforcingInstances } from '../enforcing-instances.js';
import { type FleetLimit } from './user-units.js';
import { type RuleDependencySummary } from '../siem/deps/datadog-log-queries.js';
import { type FleetDefaultAction } from '../fleet-default.js';
/** A cluster must carry at least this share of window bytes to drive
 * the verdict + an operational action. */
export declare const DOMINANT_CLUSTER_SHARE = 0.2;
export declare const CAPS_FILE_NAME = "log10x-caps.csv";
export { ACTIONS_FILE_NAME } from './command-matrix.js';
/**
 * The engine's two files from a plan's container rows. `caps.csv` gives each
 * container the bytes a pattern may spend per regulator window before its
 * excess takes the action; `actions.csv` gives the action. Both in the
 * engine's own grammar, `<container>,<bytes>::<reason>` and
 * `<container>,<action>::<reason>`, the empty middle field being the expiry
 * slot. A tier_down cap is the largest kept pattern's bytes, so the planned
 * patterns and no other exceed it; offload and drop act on the whole
 * container, so their cap is the 1-byte minimum (0 would switch the
 * regulator off for that container). `spanSeconds` is the span the plan's
 * byte figures cover. A container's row carries its own reason from
 * `reasonByContainer` when one is given (the plan's sentence in user units),
 * else `reason`.
 */
export declare function engineFilesFromContainerCaps(caps: Plan['containerCaps'], spanSeconds: number, reason: string, instances?: EnforcingInstances, reasonByContainer?: Record<string, string>): {
    capsCsv: string;
    actionsCsv: string;
    capRows: string[];
};
export interface BuildReportOptions {
    siem: string | null;
    siemLabel: string | null;
    forwarder: string | null;
    install: InstallMethod;
    namespace?: string;
    workload?: string;
    /** Agent annotation slots, keyed by evidence hash. */
    annotations?: Record<string, string>;
    generatedAtIso: string;
    mcpVersion: string;
    /** The ladder plan the tool solved; its container rows become the engine files. */
    plan?: Plan;
    /** The span the plan's byte figures cover, in seconds. */
    planSpanSeconds?: number;
    /** Receivers enforcing each container's cap; caps are divided by them. */
    enforcingInstances?: EnforcingInstances;
    /** The fleet-wide default for services with no row, when the plan writes one. */
    fleetDefault?: FleetLimit;
    /** Compute the fleet default from this capture (wins over `fleetDefault`). */
    fleetDefaultRequest?: FleetDefaultRequest;
    /** One sentence on the caps' unit and how it was reached (receiver-bytes.ts). */
    capUnitStatement?: string;
    /** Datadog: the log monitors and log-based metrics that read each rule's moved lines, printed beside the rule. */
    ruleDependencies?: RuleDependencySummary;
}
export declare class ReportRefusal extends Error {
}
export interface FleetDefaultRequest {
    /** Multiplier on the baseline. Default 2. */
    headroom?: number;
    /** Where a statement above the limit goes. Default `tier_down`. */
    action?: FleetDefaultAction;
    /** Share of ERROR and CRITICAL lines above the limit kept in Standard. Default by action. */
    errorFloor?: number;
}
/** The fleet default a capture sets, for the plan and for `log10x_advise_install`. */
export interface FleetDefaultReport {
    /** False when the capture keeps no statement to set the limit from. */
    computed: boolean;
    reason?: string;
    action: FleetDefaultAction;
    error_floor: number;
    headroom: number;
    /** The engine value, `rateReceiverAbsoluteCap`: bytes per reset window per node. */
    cap_bytes_per_window_per_node?: number;
    baseline_bytes_per_window_per_node?: number;
    baseline_statement?: string;
    baseline_container?: string;
    /** The limit in lines a day at the baseline statement's line size, across `nodes_for_lines` nodes. */
    limit_lines_per_day?: number;
    /** The median Receivers per container with a known count; 1 when none is known. */
    nodes_for_lines: number;
    containers_with_known_nodes: number;
    /** The fleet line in user units. */
    sentence: string;
}
/**
 * The fleet default from a capture: each container's largest kept statement
 * as a per-node cell, the rule in `fleet-default.ts` on those cells, and the
 * limit in lines a day for the fleet line.
 */
export declare function fleetDefaultFromPatterns<P extends {
    service?: string;
    bytes: number;
    count: number;
    receiverBytes?: number;
    receiverCapBytes?: number;
}>(patterns: P[], isMoved: (p: P) => boolean, windowSeconds: number, instances: EnforcingInstances | undefined, request: FleetDefaultRequest, siem: string | null, nameOf: (p: P) => string): FleetDefaultReport;
export interface BuiltReport {
    data: ReportData;
    /** Verbatim caps.csv content matching THE CHANGE rows, or null when
     * the plan has no volume action. Written beside the report so the
     * apply commands reference a real file. */
    capsCsv: string | null;
    /** The sibling actions.csv, the engine's per-container action file. */
    actionsCsv: string | null;
    /** Planned patterns with no container, which no cap row can key. */
    unattributedPlanned: number;
    /** The fleet default this capture sets, when the caller asked for one. */
    fleetDefault?: FleetDefaultReport;
}
export declare function buildReportData(input: RenderInput, enriched: {
    patterns: _EnrichedPattern[];
    clusters: IncidentCluster[];
}, opts: BuildReportOptions): BuiltReport;
export declare function windowLabel(windowHours: number, window?: string): string;