/** * Can the install's destination read compacted events back? * * Compaction is a reversible in-place shrink: the Receiver rewrites each * event into an encoded form, and something on the DESTINATION side expands * it again at search or query time. That expander is a separate artifact * installed on the SIEM, not part of the helm release this advisor emits: * the 10x Splunk app, or the l1es Elasticsearch/OpenSearch plugin. Without it, * compaction is lossless on disk and lossy to the person running the search, * which is the one failure the product's headline claim cannot afford. * * So `optimize=true` carries a prerequisite the plan MUST state, and on * destinations that have no expander at all it is not a lever, it is damage. * The facts live in `lib/cost.ts` (`compact_mode`, `compact_requires`), which * the pricing path already renders per-lever; this module reads the same * models so the install path cannot drift from what the plan quoted. */ import type { OutputDestination } from './reporter-forwarders.js'; export type CompactionSupport = /** Destination expands compacted events, once its expander is installed. */ { kind: 'expander-required'; requires: string; docsUrl?: string; } /** Destination cannot expand them at all — compaction here is unreadable. */ | { kind: 'unsupported'; displayName: string; } /** No real destination configured yet (the `mock` bench sink). */ | { kind: 'no-destination'; }; /** * What compaction means at this destination. `mock` is the advisor's default * when no destination is passed, so it gets its own answer rather than * falling into either real branch. */ export declare function compactionSupport(destination: OutputDestination): CompactionSupport; /** * The dependency stated without naming a destination. * * The install wizard does not ask where events go: the Receiver is a sidecar * that rides the customer's existing forwarder, and that forwarder still owns * the destination. So the plan it emits genuinely does not know which expander * applies, and saying "install the Splunk app" would be a guess. Name both and * let the customer pick the row that matches their stack. */ export declare const EXPANDER_PREREQUISITE_GENERAL: string;