/**
 * Local-source POC tool: pulls log lines from kubectl or from local
 * files/globs and renders a cost-optimization report without touching
 * any log-analyzer API.
 *
 * Distinct from `log10x_poc_from_siem_submit`:
 *   - No vendor credentials needed (kubeconfig, or plain file reads)
 *   - Cost framing is an industry-pricing matrix (Datadog list,
 *     Splunk list, CloudWatch, OpenSearch), NOT a prediction of any
 *     specific bill — we only see the sampled slice, not
 *     CloudTrail / ALB logs / VM-hosted apps that the SIEM ingests
 *   - Synchronous (the pull is fast); no snapshot lifecycle
 *
 * `source: "file"` is the serverless-estate path: a host with no
 * cluster (100% Lambda shops, VMs, a downloaded log bundle) samples
 * from `paths` instead of pods.
 *
 * Sample-composition table forces the user to declare the sample
 * representative: "70% of bytes come from your-noisy-service" surfaces
 * up-front so the prospect can either confirm or widen scope before
 * trusting the savings projection.
 */
import { z } from 'zod';
import { type RoundTripResult } from '../lib/dev-cli.js';
import { type StructuredOutput } from '../lib/output-types.js';
import { type SiemId } from '../lib/siem/pricing.js';
import { type Plan } from '../lib/plan-solver.js';
export declare const REPORT_FILE_NAME = "log10x-poc-report.html";
/**
 * Markdown copy of the plan, written alongside the HTML report in the fenced
 * profile only.
 *
 * The fenced profile's honest residual is that the ANSWER leaves the fence —
 * any tool that answers leaks its answer, and the plan is read by a human in
 * a chat window that is not inside the container. Nothing can change that.
 * What can change is where the detail lives: the full plan lands on the
 * mounted output directory as a file the user controls, so the chat transcript
 * does not have to be the only copy, and a user who wants to keep pattern
 * bodies off a hosted model's context has somewhere to read them instead.
 */
export declare const PLAN_FILE_NAME = "plan.md";
/** Kept rows a tool response carries: the costliest, since the rest are the long tail the plan leaves alone. */
export declare const RESPONSE_KEPT_ROWS = 20;
/**
 * The plan as a tool response carries it. Every kept row (thousands on a real
 * capture, over a megabyte) would fill an agent's context, so the response
 * keeps the costliest RESPONSE_KEPT_ROWS and counts the rest; the report and
 * the engine files are built from the full plan.
 */
export declare function planForResponse(plan: Plan): Plan;
export declare const pocFromLocalSchema: {
    source: z.ZodDefault<z.ZodOptional<z.ZodEnum<{
        file: "file";
        kubectl: "kubectl";
    }>>>;
    path: z.ZodOptional<z.ZodString>;
    siem: z.ZodOptional<z.ZodEnum<{
        datadog: "datadog";
        splunk: "splunk";
        elasticsearch: "elasticsearch";
        clickhouse: "clickhouse";
        cloudwatch: "cloudwatch";
        "azure-monitor": "azure-monitor";
        "gcp-logging": "gcp-logging";
        sumo: "sumo";
        coralogix: "coralogix";
        "elastic-serverless": "elastic-serverless";
    }>>;
    forwarder: z.ZodOptional<z.ZodString>;
    workload: z.ZodOptional<z.ZodString>;
    report_annotations: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
    namespace: z.ZodDefault<z.ZodOptional<z.ZodString>>;
    paths: z.ZodOptional<z.ZodArray<z.ZodString>>;
    window: z.ZodOptional<z.ZodString>;
    per_pod_limit: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
    max_pods: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
    fleet_default: z.ZodOptional<z.ZodObject<{
        headroom: z.ZodOptional<z.ZodNumber>;
        action: z.ZodOptional<z.ZodEnum<{
            tier_down: "tier_down";
            offload: "offload";
        }>>;
        error_floor: z.ZodOptional<z.ZodNumber>;
    }, z.core.$strip>>;
    record_overhead_bytes: z.ZodOptional<z.ZodNumber>;
    check_dependencies: z.ZodOptional<z.ZodBoolean>;
    retriever_installed: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
    allow_lossy: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
    target_percent_reduction: z.ZodOptional<z.ZodNumber>;
    budget_usd_monthly: z.ZodOptional<z.ZodNumber>;
    budget_gb_monthly: z.ZodOptional<z.ZodNumber>;
    exception_services: z.ZodOptional<z.ZodArray<z.ZodString>>;
    splunk_pricing: z.ZodOptional<z.ZodEnum<{
        ingest: "ingest";
        workload: "workload";
    }>>;
    enterprise_security: z.ZodOptional<z.ZodBoolean>;
    pin_services: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<{
        pass: "pass";
        sample: "sample";
        compact: "compact";
        tier_down: "tier_down";
        offload: "offload";
        drop: "drop";
    }>>>;
    pin_patterns: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<{
        pass: "pass";
        sample: "sample";
        compact: "compact";
        tier_down: "tier_down";
        offload: "offload";
        drop: "drop";
    }>>>;
};
export interface PocFromLocalArgs {
    source?: 'kubectl' | 'file';
    path?: string;
    siem?: SiemId;
    forwarder?: string;
    workload?: string;
    report_annotations?: Record<string, string>;
    namespace?: string;
    paths?: string[];
    window?: string;
    per_pod_limit?: number;
    max_pods?: number;
    ai_prettify?: boolean;
    retriever_installed?: boolean;
    /** Datadog only, default true: list the log monitors and log-based metrics that read each rule's moved lines. */
    check_dependencies?: boolean;
    /** Forwarder metadata bytes per record when the capture carries the log text only. */
    record_overhead_bytes?: number;
    /** Set the fleet default from this capture. */
    fleet_default?: {
        headroom?: number;
        action?: 'tier_down' | 'offload';
        error_floor?: number;
    };
    allow_lossy?: boolean;
    target_percent_reduction?: number;
    budget_usd_monthly?: number;
    budget_gb_monthly?: number;
    exception_services?: string[];
    splunk_pricing?: 'ingest' | 'workload';
    enterprise_security?: boolean;
    pin_services?: Record<string, 'pass' | 'sample' | 'compact' | 'tier_down' | 'offload' | 'drop'>;
    pin_patterns?: Record<string, 'pass' | 'sample' | 'compact' | 'tier_down' | 'offload' | 'drop'>;
}
export interface PriceRow {
    vendor: string;
    perGb: number;
    note: string;
}
export declare const INDUSTRY_PRICING: PriceRow[];
/** At most `max` characters, cut at a word boundary, with an ellipsis-free "(cut)" marker when shortened. */
export declare function clipAtWord(s: string, max: number): string;
export declare function executePocFromLocal(args: PocFromLocalArgs): Promise<StructuredOutput>;
/**
 * One sentence on the decode pass, for the report and the summary. States
 * the count it checked; a pass that did not run says so rather than
 * implying a proof.
 */
export declare function describeRoundTrip(rt: RoundTripResult): string;