@agent-beam/beam 0.2.27 → 0.2.29

package/dist/monitor-rules.js.map

@@ -1 +1 @@
-{"version":3,"file":"monitor-rules.js","sourceRoot":"","sources":["../src/monitor-rules.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,mGAAmG;AACnG,mGAAmG;AACnG,6FAA6F;AAC7F,gGAAgG;AAChG,OAAO,EAAE,gBAAgB,EAAqB,MAAM,WAAW,CAAC;AAahE,8FAA8F;AAC9F,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAA,sBAAsB,CAAC;AAC7C,MAAM,gBAAgB,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,iJAAiJ,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;AAE3M,MAAM,QAAQ,GAAkB;IAC9B,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,yCAAyC,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS;QACrH,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,2DAA2D,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACnF,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,wBAAwB,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS;QAChG,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,8FAA8F,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACtH,EAAE,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,uBAAuB,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS;QAC9F,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,8NAA8N,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACtP,EAAE,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,2BAA2B,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS;QACtG,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACxC,EAAE,EAAE,EAAE,wBAAwB,EAAE,KAAK,EAAE,sCAAsC,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS;QAClH,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,6JAA6J,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACrL,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa;QACxF,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,wHAAwH,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IAChJ,EAAE,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,2BAA2B,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS;QACpG,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,yDAAyD,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACjF,EAAE,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,4BAA4B,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS;QACnG,KAAK,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,+QAA+Q,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;IACjT,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,8BAA8B,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS;QAC7F,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,qHAAqH,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IAC7I,EAAE,EAAE,EAAE,yBAAyB,EAAE,KAAK,EAAE,6BAA6B,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS;QAC5G,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,+DAA+D,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACvF,EAAE,EAAE,EAAE,0BAA0B,EAAE,KAAK,EAAE,mCAAmC,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC;QACpI,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,yLAAyL,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACjN,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC;QACvG,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,qIAAqI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;CAC9J,CAAC;AAEF,MAAM,WAAW,GAAkB,gBAAgB,CAAC,CAAC,uBAAuB,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,uBAAuB,CAAC,CAAC;KACpK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAE7J,MAAM,CAAC,MAAM,YAAY,GAAkB,CAAC,GAAG,QAAQ,EAAE,GAAG,WAAW,CAAC,CAAC;AAEzE,MAAM,SAAS,GAAG,8JAA8J,CAAC;AACjL,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;AAC/C,CAAC;AAED,SAAS,aAAa,CAAC,CAAS;IAC9B,IAAI,CAAC;QAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AACzI,CAAC;AACD,0FAA0F;AAC1F,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QAClD,IAAI,IAAI,KAAK,CAAC;YAAE,MAAM;QACtB,CAAC,GAAG,IAAI,CAAC;IACX,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,SAAqB,UAAU,CAAC,IAAI,CAAC;IAC3E,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChE,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;AACvG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,SAA2B,EAAE;IACpE,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC;SAC1B,OAAO,CAAC,+EAA+E,EAAE,wBAAwB,CAAC;SAClH,OAAO,CAAC,yLAAyL,EAAE,kBAAkB,CAAC;SACtN,OAAO,CAAC,oCAAoC,EAAE,cAAc,CAAC;SAC7D,OAAO,CAAC,uIAAuI,EAAE,cAAc,CAAC;SAChK,OAAO,CAAC,mCAAmC,EAAE,eAAe,CAAC;SAC7D,OAAO,CAAC,6CAA6C,EAAE,SAAS,CAAC,CAAC;IACrE,KAAK,MAAM,QAAQ,IAAI,MAAM,EAAE,CAAC;QAC9B,IAAI,CAAC;YAAC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,mCAAmC,CAAC,CAAC;IACnI,CAAC;IACD,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED,wGAAwG;AACxG,MAAM,cAAc,GAAG,8KAA8K,CAAC;AACtM,MAAM,UAAU,GAAG,+DAA+D,CAAC;AACnF,oHAAoH;AACpH,MAAM,SAAS,GAAG,6CAA6C,CAAC;AAChE;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,OAAO,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACtG,CAAC;AAED,MAAM,SAAS,GAAG,4FAA4F,CAAC;AAC/G,MAAM,cAAc,GAAG,qNAAqN,CAAC;AAC7O,yGAAyG;AACzG,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,MAAkB;IAC5D,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,sFAAsF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3L,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC"}
+{"version":3,"file":"monitor-rules.js","sourceRoot":"","sources":["../src/monitor-rules.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,mGAAmG;AACnG,mGAAmG;AACnG,6FAA6F;AAC7F,iGAAiG;AACjG,mEAAmE;AACnE,OAAO,EAAE,gBAAgB,EAAqB,MAAM,mBAAmB,CAAC;AAGxE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAYjE,8FAA8F;AAC9F,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAA,sBAAsB,CAAC;AAC7C,MAAM,gBAAgB,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,iJAAiJ,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;AAC3M,8FAA8F;AAC9F,kGAAkG;AAClG,kGAAkG;AAClG,gEAAgE;AAChE,MAAM,SAAS,GAAG,0GAA0G,CAAC;AAC7H,MAAM,WAAW,GAAG,6CAA6C,CAAC;AAClE,MAAM,aAAa,GAAG,iPAAiP,CAAC;AACxQ,SAAS,IAAI,CAAC,CAAS;IACrB,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACxD,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,EAAE,GAAG,CAAC;YAAE,SAAS;QACrB,IAAI,EAAE,IAAI,GAAG,GAAG;YAAE,MAAM;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAClC,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACvH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AACD,yFAAyF;AACzF,MAAM,MAAM,GAAG,8XAA8X,CAAC;AAC9Y,MAAM,GAAG,GAAG,qHAAqH,CAAC;AAClI,MAAM,UAAU,GAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACrE,MAAM,cAAc,GAAG,yLAAyL,CAAC;AACjN,MAAM,aAAa,GAAG,sHAAsH,CAAC;AAC7I,yDAAyD;AACzD,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACpC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,QAAQ,GAAkB;IAC9B,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,yCAAyC,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS;QACrH,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,2DAA2D,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACnF,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,wBAAwB,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS;QAChG,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,8FAA8F,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACtH,EAAE,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,uBAAuB,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS;QAC9F,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,8NAA8N,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACtP,EAAE,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,2BAA2B,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS;QACtG,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACxC,EAAE,EAAE,EAAE,wBAAwB,EAAE,KAAK,EAAE,sCAAsC,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS;QAClH,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,6JAA6J,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACrL,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa;QACxF,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,wHAAwH,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IAChJ,EAAE,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,2BAA2B,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS;QACpG,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,yDAAyD,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACjF,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,qCAAqC,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC;QACtH,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACvB,EAAE,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,4BAA4B,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS;QACnG,KAAK,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;IACxC,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,8BAA8B,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS;QAC7F,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IAC3B,EAAE,EAAE,EAAE,yBAAyB,EAAE,KAAK,EAAE,6BAA6B,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS;QAC5G,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,+DAA+D,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACvF,6FAA6F;IAC7F,4FAA4F;IAC5F,qDAAqD;IACrD,EAAE,EAAE,EAAE,0BAA0B,EAAE,KAAK,EAAE,mCAAmC,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC;QACpI,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACtC,EAAE,EAAE,EAAE,yBAAyB,EAAE,KAAK,EAAE,0CAA0C,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC;QAC1I,KAAK,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE;IAC/D,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC;QACvG,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,qIAAqI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;CAC9J,CAAC;AAEF,2FAA2F;AAC3F,4FAA4F;AAC5F,0EAA0E;AAC1E,MAAM,QAAQ,GAAkB;IAC9B,EAAE,EAAE,EAAE,sBAAsB,EAAE,KAAK,EAAE,0BAA0B,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU;QACrH,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;IACxC,EAAE,EAAE,EAAE,2BAA2B,EAAE,KAAK,EAAE,gCAAgC,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU;QAChI,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;IACxC,EAAE,EAAE,EAAE,yBAAyB,EAAE,KAAK,EAAE,0CAA0C,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU;QACxI,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;IACtC,EAAE,EAAE,EAAE,6BAA6B,EAAE,KAAK,EAAE,wCAAwC,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;QAClJ,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE;IAC5C,EAAE,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,wCAAwC,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC;QACjI,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE;IAC7C,EAAE,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,wCAAwC,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;QAC5I,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE;IAC9E,EAAE,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC;QACxH,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;IACzC,EAAE,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,0CAA0C,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC;QACvJ,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;IAC1C,EAAE,EAAE,EAAE,yBAAyB,EAAE,KAAK,EAAE,wCAAwC,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC;QACnI,KAAK,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE;IACvD,EAAE,EAAE,EAAE,yBAAyB,EAAE,KAAK,EAAE,wCAAwC,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC;QACtI,KAAK,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE;IACnD,EAAE,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,4BAA4B,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC;QACpH,KAAK,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE;IACvE,EAAE,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,uCAAuC,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC;QACjI,KAAK,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;CACtC,CAAC;AAEF,MAAM,WAAW,GAAkB,gBAAgB,CAAC,CAAC,uBAAuB,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,kBAAkB,CAAC,CAAC;KAC3I,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACT,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACzI,wFAAwF;IACxF,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,kBAAkB,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CAChE,CAAC,CAAC,CAAC;AAEN,MAAM,CAAC,MAAM,YAAY,GAAkB,CAAC,GAAG,QAAQ,EAAE,GAAG,QAAQ,EAAE,GAAG,WAAW,CAAC,CAAC;AACtF,MAAM,OAAO,GAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAE9C,MAAM,SAAS,GAAG,8JAA8J,CAAC;AACjL,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;AAC/C,CAAC;AAED,SAAS,aAAa,CAAC,CAAS;IAC9B,IAAI,CAAC;QAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AACzI,CAAC;AACD,0FAA0F;AAC1F,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QAClD,IAAI,IAAI,KAAK,CAAC;YAAE,MAAM;QACtB,CAAC,GAAG,IAAI,CAAC;IACX,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,SAAqB,UAAU,CAAC,IAAI,CAAC,EAAE,QAAuB,EAAE;IACtG,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChE,MAAM,OAAO,GAAG,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IACxF,OAAO,CAAC,GAAG,YAAY,EAAE,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;AACnH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,SAA2B,EAAE;IACpE,yGAAyG;IACzG,IAAI,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;SACxC,OAAO,CAAC,+EAA+E,EAAE,wBAAwB,CAAC;SAClH,OAAO,CAAC,wSAAwS,EAAE,kBAAkB,CAAC;SACrU,OAAO,CAAC,oCAAoC,EAAE,cAAc,CAAC;SAC7D,OAAO,CAAC,uIAAuI,EAAE,cAAc,CAAC;SAChK,OAAO,CAAC,mCAAmC,EAAE,eAAe,CAAC;SAC7D,OAAO,CAAC,6CAA6C,EAAE,SAAS,CAAC,CAAC;IACrE,KAAK,MAAM,QAAQ,IAAI,MAAM,EAAE,CAAC;QAC9B,IAAI,CAAC;YAAC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,mCAAmC,CAAC,CAAC;IACnI,CAAC;IACD,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED,wGAAwG;AACxG,MAAM,cAAc,GAAG,8KAA8K,CAAC;AACtM,MAAM,UAAU,GAAG,+DAA+D,CAAC;AACnF,oHAAoH;AACpH,MAAM,SAAS,GAAG,6CAA6C,CAAC;AAChE;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,OAAO,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACtG,CAAC;AAED,MAAM,SAAS,GAAG,4FAA4F,CAAC;AAC/G,MAAM,cAAc,GAAG,qNAAqN,CAAC;AAC7O,MAAM,YAAY,GAAG,+BAA+B,CAAC;AACrD,MAAM,WAAW,GAAG,0DAA0D,CAAC;AAC/E,MAAM,SAAS,GAAG,4DAA4D,CAAC;AAC/E,MAAM,QAAQ,GAAG,uJAAuJ,CAAC;AACzK,4GAA4G;AAC5G,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxD,OAAO,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,MAAkB;IAC5D,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,CAAC,iDAAiD;IAC/G,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,sFAAsF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3L,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC"}

package/dist/monitor.d.ts

@@ -1,39 +1,5 @@
-import { type MonitorFinding, type MonitorLevel, type MonitorSeverity, type Vulnerability } from "./monitor-client.js";
-import type { CustomDetector } from "./data-detectors.js";
-/** light: critical only · standard: high and up · strict: medium and up (same thresholds as the server). */
-export declare const meetsLevel: (severity: MonitorSeverity, level: MonitorLevel) => boolean;
-export declare const DEDUPE_WINDOW_MS: Record<MonitorLevel, number>;
-export declare const BRUTE_FORCE_THRESHOLD: Record<MonitorLevel, number>;
-export declare const MAX_NEW_FINDINGS_PER_10_MIN = 200;
-export type SendOutcome = "sent" | "retry" | "drop";
-export interface PipelineOptions {
-    /** The active level, or null while capture is off (not enabled, or the allowance is spent). */
-    level: () => MonitorLevel | null;
-    customDetectors?: () => CustomDetector[];
-    now?: () => number;
-}
-export declare class MonitorPipeline {
-    private readonly opts;
-    private seen;
-    private queue;
-    private queued;
-    private authFailures;
-    private floodBucket;
-    private floodCount;
-    private suppressed;
-    constructor(opts: PipelineOptions);
-    private now;
-    get pending(): MonitorFinding[];
-    /** Matches one line and queues any findings at or above the level. Returns the rule ids raised. */
-    ingestLine(line: string, file?: string): string[];
-    /** Queues a finding produced elsewhere (dependency checks) under its own stable id, once. */
-    addFinding(finding: MonitorFinding): boolean;
-    private raise;
-    private emitSuppressed;
-    private enqueue;
-    /** Sends queued findings in batches; a "retry" outcome keeps the batch for the next flush. */
-    flush(send: (batch: MonitorFinding[]) => Promise<SendOutcome>): Promise<void>;
-}
+import { type MonitorFinding, type Vulnerability } from "./monitor-client.js";
+export { BRUTE_FORCE_THRESHOLD, DEDUPE_WINDOW_MS, MAX_NEW_FINDINGS_PER_10_MIN, MonitorPipeline, meetsLevel, type PipelineOptions, type SendOutcome } from "./monitor-pipeline.js";
 /** Follows a log file like `tail -F`: survives rotation (new inode) and truncation (copytruncate). */
 export declare class FileTailer {
     private readonly path;
@@ -67,8 +33,35 @@ export interface MonitorOptions {
     fromStart?: boolean;
     /** Keep waiting while App monitoring is off in the dashboard (default) instead of exiting. */
     wait?: boolean;
+    /** LLM provider for the second opinion (--llm), with this server's own key; "beam" for Beam's model. */
+    llm?: string;
+    /** The most of one CPU core detection may use, in percent (--max-cpu). Default: monitor.json, else 25. */
+    maxCpu?: number;
 }
 export declare function runMonitor(options: MonitorOptions, log?: (message: string) => void): Promise<void>;
-export declare function monitorStatus(write?: (line: string) => void): Promise<number>;
-/** `beam monitor test`: one test finding through the real path, to prove an integration end to end. */
-export declare function monitorTest(write?: (line: string) => void): Promise<number>;
+export declare function monitorStatus(write?: (line: string) => void, llm?: string): Promise<number>;
+/**
+ * `beam monitor test`: one test finding through the real path, to prove an integration end to end.
+ * With an own LLM (--llm), also one LLM check on a harmless sample, to prove the key works.
+ */
+export declare function monitorTest(write?: (line: string) => void, llm?: string): Promise<number>;
+export interface ConfigureOptions {
+    llm?: string;
+    model?: string;
+    baseUrl?: string;
+    keyEnv?: string;
+    key?: string;
+    forgetKey?: boolean;
+    files?: string[];
+    noFiles?: boolean;
+    app?: string;
+    noApp?: boolean;
+    maxCpu?: number;
+}
+/**
+ * `beam monitor configure`: saves settings to monitor.json so `beam monitor` needs no flags. With
+ * no options, prints the current settings. A key is only ever stored from stdin (`key`), and a
+ * provider's key that isn't set in this shell is a warning, not an error: it may be set only where
+ * beam monitor runs (a systemd EnvironmentFile, a container's secrets).
+ */
+export declare function monitorConfigure(options: ConfigureOptions, write?: (line: string) => void): Promise<number>;

package/dist/monitor.js

@@ -15,158 +15,10 @@ import { StringDecoder } from "node:string_decoder";
 import { readPolicy } from "./policy.js";
 import { readInstalledPackages } from "./lockfiles.js";
 import { checkPackages, fetchMonitorConfig, monitorAuth, sendFindings, } from "./monitor-client.js";
-import { clientIp, isAuthFailure, lineSource, matchLine, redactLine } from "./monitor-rules.js";
-import { judgeWithOwnLlm, ownLlmConfig } from "./monitor-llm.js";
-const RANK = { critical: 3, high: 2, medium: 1, low: 0 };
-const MIN_RANK = { light: 3, standard: 2, strict: 1 };
-/** light: critical only · standard: high and up · strict: medium and up (same thresholds as the server). */
-export const meetsLevel = (severity, level) => RANK[severity] >= MIN_RANK[level];
-// One finding absorbs repeats (its `count` goes up) for this long before a new one is raised.
-export const DEDUPE_WINDOW_MS = { light: 60 * 60_000, standard: 15 * 60_000, strict: 5 * 60_000 };
-// Failed sign-ins from one address within five minutes before it counts as brute forcing.
-export const BRUTE_FORCE_THRESHOLD = { light: 50, standard: 20, strict: 10 };
-const BRUTE_FORCE_WINDOW_MS = 5 * 60_000;
-// A scan or a log loop can match thousands of distinct lines; past this many new findings in ten
-// minutes the rest are folded into one summary finding so a flood can't spend the month's allowance.
-export const MAX_NEW_FINDINGS_PER_10_MIN = 200;
-const FLOOD_WINDOW_MS = 10 * 60_000;
-const MAX_QUEUE = 1000;
-const BATCH_SIZE = 100;
-/** Groups lines that differ only in ids, numbers, addresses or timestamps. */
-function normalizeForGrouping(line) {
-    return line.toLowerCase()
-        .replace(/\b(?:\d{1,3}\.){3}\d{1,3}\b/g, "<ip>")
-        .replace(/\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/g, "<id>")
-        .replace(/\b[0-9a-f]{16,}\b/g, "<hex>")
-        .replace(/\d+/g, "0")
-        .replace(/\s+/g, " ")
-        .slice(0, 300);
-}
-export class MonitorPipeline {
-    opts;
-    seen = new Map();
-    queue = [];
-    queued = new Set();
-    authFailures = new Map();
-    floodBucket = -1;
-    floodCount = 0;
-    suppressed = null;
-    constructor(opts) {
-        this.opts = opts;
-    }
-    now() { return this.opts.now?.() ?? Date.now(); }
-    get pending() { return [...this.queue]; }
-    /** Matches one line and queues any findings at or above the level. Returns the rule ids raised. */
-    ingestLine(line, file) {
-        const level = this.opts.level();
-        if (!level || !line.trim())
-            return [];
-        const custom = this.opts.customDetectors?.() ?? [];
-        const source = lineSource(line);
-        const ip = source === "http" ? clientIp(line) : undefined;
-        const raised = [];
-        for (const rule of matchLine(line, source)) {
-            if (!meetsLevel(rule.severity, level))
-                continue;
-            // Traffic groups by client address (one scan = one finding); app logs group by line shape.
-            this.raise(level, ip ?? normalizeForGrouping(line), {
-                ruleId: rule.id, title: ip ? `${rule.title} from ${ip}` : rule.title, severity: rule.severity,
-                category: rule.category, source, file, evidence: redactLine(line, custom),
-            });
-            raised.push(rule.id);
-        }
-        if (isAuthFailure(line, source) && meetsLevel("high", level)) {
-            const key = clientIp(line) ?? "unknown address";
-            const now = this.now();
-            const recent = (this.authFailures.get(key) ?? []).filter(t => now - t < BRUTE_FORCE_WINDOW_MS);
-            recent.push(now);
-            this.authFailures.set(key, recent);
-            if (this.authFailures.size > 10_000)
-                this.authFailures.delete(this.authFailures.keys().next().value);
-            if (recent.length >= BRUTE_FORCE_THRESHOLD[level]) {
-                this.raise(level, key, {
-                    ruleId: "app.auth_bruteforce", title: `Repeated failed sign-ins from ${key}`, severity: "high", category: "recon",
-                    source, file, evidence: `${recent.length} failures in 5 minutes. Latest: ${redactLine(line, custom)}`.slice(0, 600),
-                });
-                raised.push("app.auth_bruteforce");
-            }
-        }
-        return raised;
-    }
-    /** Queues a finding produced elsewhere (dependency checks) under its own stable id, once. */
-    addFinding(finding) {
-        const level = this.opts.level();
-        if (!level || !meetsLevel(finding.severity, level) || this.queued.has(finding.id))
-            return false;
-        this.queued.add(finding.id);
-        this.enqueue(finding);
-        return true;
-    }
-    raise(level, groupKey, partial) {
-        const now = this.now();
-        const bucket = Math.floor(now / DEDUPE_WINDOW_MS[level]);
-        const fp = createHash("sha256").update(`${partial.ruleId}\0${groupKey}`).digest("hex").slice(0, 24);
-        const existing = this.seen.get(fp);
-        if (existing && existing.bucket === bucket) {
-            existing.finding.count++; // still queued: the batch carries the new count
-            return;
-        }
-        const flood = Math.floor(now / FLOOD_WINDOW_MS);
-        if (flood !== this.floodBucket) {
-            this.emitSuppressed();
-            this.floodBucket = flood;
-            this.floodCount = 0;
-        }
-        if (this.floodCount >= MAX_NEW_FINDINGS_PER_10_MIN) {
-            const worst = this.suppressed && RANK[this.suppressed.severity] >= RANK[partial.severity] ? this.suppressed.severity : partial.severity;
-            this.suppressed = { count: (this.suppressed?.count ?? 0) + 1, severity: worst };
-            return;
-        }
-        this.floodCount++;
-        const finding = { id: `${fp}-${bucket}`, ...partial, count: 1, firstSeen: new Date(now).toISOString() };
-        this.seen.set(fp, { bucket, finding, at: now });
-        this.enqueue(finding);
-    }
-    emitSuppressed() {
-        if (!this.suppressed)
-            return;
-        const { count, severity } = this.suppressed;
-        this.suppressed = null;
-        this.enqueue({
-            id: `flood-${this.floodBucket}`, ruleId: "beam.monitor.flood", title: "Too many findings to send individually", severity,
-            category: "integrity", source: "log", count,
-            evidence: `${count} more findings within 10 minutes were not sent one by one, to protect the monthly allowance. Check this server's logs.`,
-            firstSeen: new Date(this.floodBucket * FLOOD_WINDOW_MS).toISOString(),
-        });
-    }
-    enqueue(finding) {
-        if (this.queue.length >= MAX_QUEUE) {
-            // Full (usually: the workspace is unreachable). Make room by dropping the least severe, oldest.
-            let drop = 0;
-            for (let i = 1; i < this.queue.length; i++)
-                if (RANK[this.queue[i].severity] < RANK[this.queue[drop].severity])
-                    drop = i;
-            this.queue.splice(drop, 1);
-        }
-        this.queue.push(finding);
-    }
-    /** Sends queued findings in batches; a "retry" outcome keeps the batch for the next flush. */
-    async flush(send) {
-        if (this.suppressed && Math.floor(this.now() / FLOOD_WINDOW_MS) !== this.floodBucket)
-            this.emitSuppressed();
-        while (this.queue.length) {
-            const batch = this.queue.splice(0, BATCH_SIZE);
-            if ((await send(batch)) === "retry") {
-                this.queue.unshift(...batch);
-                break;
-            }
-        }
-        const cutoff = this.now() - 2 * DEDUPE_WINDOW_MS.light;
-        for (const [fp, entry] of this.seen)
-            if (entry.at < cutoff)
-                this.seen.delete(fp);
-    }
-}
+import { LLM_PROVIDERS, describeOwnLlm, detectedLlmKeys, judgeWithOwnLlm, ownLlmConfig } from "./monitor-llm.js";
+import { describeMonitorConfig, ensureMonitorConfig, monitorConfigPath, writeMonitorConfig } from "./monitor-config.js";
+export { BRUTE_FORCE_THRESHOLD, DEDUPE_WINDOW_MS, MAX_NEW_FINDINGS_PER_10_MIN, MonitorPipeline, meetsLevel } from "./monitor-pipeline.js";
+import { MonitorPipeline } from "./monitor-pipeline.js";
 /** Follows a log file like `tail -F`: survives rotation (new inode) and truncation (copytruncate). */
 export class FileTailer {
     path;
@@ -271,36 +123,63 @@ export function vulnerabilityFinding(v) {
         evidence: `${v.name} ${v.version} (${v.ecosystem}) is in the affected range ${v.vulnerable}; ${v.patched ? `fixed in ${v.patched}` : "no fixed version yet"}. ${v.title} ${v.url}`.slice(0, 600),
     };
 }
+const MAX_BACKOFF_MS = 5 * 60_000;
+const backoff = (failures) => Math.min(MAX_BACKOFF_MS, 5_000 * 2 ** Math.min(failures, 10)) * (0.5 + Math.random() / 2);
+/** A server-provided resume time, sanity-checked: never in the past, never more than a day away. */
+function pauseUntil(resetAt, fallbackMs) {
+    const at = resetAt ? Date.parse(resetAt) : Number.NaN;
+    const now = Date.now();
+    return Number.isFinite(at) && at > now ? Math.min(at, now + 24 * 60 * 60_000) : now + fallbackMs;
+}
+/** Points at a key that's already here when no provider was chosen; it is never used without --llm. */
+function llmKeyHint(own) {
+    if (own)
+        return "";
+    const [found] = detectedLlmKeys();
+    return found ? ` ${found.variable} is set here: add --llm ${found.provider} to review findings with your own key instead (Beam never sees it).` : "";
+}
 const sleep = (ms) => new Promise(r => setTimeout(r, ms));
 export async function runMonitor(options, log = m => console.error(`[beam monitor] ${m}`)) {
-    const files = (options.files ?? []).map(f => resolve(f));
-    const appDir = options.app ? resolve(options.app) : undefined;
+    const { config: saved, created } = await ensureMonitorConfig();
+    if (created)
+        log(`Created ${monitorConfigPath()} for App monitoring settings. Edit it, or run 'beam monitor configure'.`);
+    // Sources on the command line replace the file's; with none, the file says what to watch.
+    const fromCli = Boolean(options.files?.length || options.stdin || options.app);
+    const files = (fromCli ? options.files ?? [] : saved.files).map(f => resolve(f));
+    const app = fromCli ? options.app : saved.app ?? undefined;
+    const appDir = app ? resolve(app) : undefined;
     if (!files.length && !options.stdin && !appDir)
-        throw new Error("Tell beam monitor what to watch: --file <path> (repeatable) for log files, --stdin to read piped output, and/or --app <dir> for dependency checks.");
+        throw new Error(`Tell beam monitor what to watch: --file <path> (repeatable) for log files, --stdin to read piped output, and/or --app <dir> for dependency checks. Or save them with 'beam monitor configure --file <path>' (${monitorConfigPath()}).`);
     const identity = await monitorAuth();
     if (!identity)
         throw new Error("Set BEAM_APP_TOKEN to the app's token from the dashboard's App monitoring page, or connect this machine with 'beam connect'.");
     const custom = (await readPolicy())?.rules.customDetectors ?? [];
-    const ownLlm = ownLlmConfig();
+    const ownLlm = ownLlmConfig(process.env, options.llm, saved.llm);
     let config = null;
     let lastRefresh = 0;
     let pausedUntil = 0;
     let offNotice = false;
+    // A rejected token or a missing API while running pauses capture and is checked again every 15
+    // minutes, rather than exiting: during an AgentBeam incident those can be transient.
+    let rejected = false;
     let fatal = null;
-    const refresh = async () => {
+    const refresh = async (startup = false) => {
         lastRefresh = Date.now();
         const result = await fetchMonitorConfig(identity);
         if (result.ok) {
             if (!config) {
                 log(`App monitoring is on${result.config.app ? ` for ${result.config.app}` : ""} (${result.config.level} level). Findings go to your workspace${result.config.webhooks ? ` and ${result.config.webhooks} webhook${result.config.webhooks === 1 ? "" : "s"}` : ""}.`);
                 log(ownLlm
-                    ? `LLM checks: your own model, ${ownLlm.model} at ${new URL(ownLlm.baseUrl).host}.`
-                    : `LLM checks: ${result.config.llm ? "Beam's model (set in the dashboard)" : "off"}.`);
+                    ? `LLM checks: ${describeOwnLlm(ownLlm)}. Only redacted excerpts go there, and the key never leaves this server.`
+                    : `LLM checks: ${result.config.llm ? "Beam's model (set in the dashboard)" : "off"}.${llmKeyHint(ownLlm)}`);
             }
             else if (config.level !== result.config.level)
                 log(`Level changed to ${result.config.level}.`);
+            if (rejected)
+                log("AgentBeam accepted this server again. Capture resumed.");
             config = result.config;
             offNotice = false;
+            rejected = false;
             return;
         }
         if (result.status === "disabled") {
@@ -310,20 +189,29 @@ export async function runMonitor(options, log = m => console.error(`[beam monito
             config = null;
             return;
         }
-        if (result.status === "revoked" || result.status === "unsupported")
-            throw new Error(result.message);
+        if (result.status === "revoked" || result.status === "unsupported") {
+            if (startup)
+                throw new Error(result.message);
+            if (!rejected)
+                log(`${result.message} Capture paused; checking again every 15 minutes.`);
+            rejected = true;
+            config = null;
+            return;
+        }
         log(`${result.message} Retrying.`); // unreachable: keep the last known settings
     };
-    await refresh();
+    await refresh(true);
     while (!config) {
         if (options.wait === false)
             throw new Error("App monitoring is not on for this workspace.");
         await sleep(60_000);
-        await refresh();
+        await refresh(true);
     }
+    const maxCpu = Math.min(100, Math.max(1, Number(options.maxCpu ?? saved.maxCpuPercent) || 25));
     const pipeline = new MonitorPipeline({
         level: () => (config && Date.now() >= pausedUntil ? config.level : null),
         customDetectors: () => custom,
+        cpuBudgetMsPerMinute: 600 * maxCpu, // 1% of a core = 600 ms per minute
     });
     const send = async (batch) => {
         if (ownLlm && config)
@@ -338,12 +226,15 @@ export async function runMonitor(options, log = m => console.error(`[beam monito
             return "drop";
         }
         if (result.status === "quota") {
-            pausedUntil = result.resetAt ? Date.parse(result.resetAt) : Date.now() + 60 * 60_000;
+            pausedUntil = pauseUntil(result.resetAt, 60 * 60_000);
             log(`${result.message} Capture paused until then.`);
             return "drop";
         }
         if (result.status === "revoked" || result.status === "unsupported") {
-            fatal = new Error(result.message);
+            if (!rejected)
+                log(`${result.message} Capture paused; checking again every 15 minutes.`);
+            rejected = true;
+            config = null;
             return "drop";
         }
         return "retry";
@@ -371,36 +262,92 @@ export async function runMonitor(options, log = m => console.error(`[beam monito
         tailer.start();
     if (files.length)
         log(`Watching ${files.join(", ")}.`);
+    // When AgentBeam is unreachable or erroring, sends back off (with jitter, up to 5 minutes) instead
+    // of retrying every few seconds; findings wait in a queue capped at 1,000.
     let flushing = false;
-    const flush = async () => {
-        if (flushing)
+    let sendFailures = 0;
+    let nextSendAt = 0;
+    const flush = async (force = false) => {
+        if (flushing || (!force && Date.now() < nextSendAt))
             return;
         flushing = true;
+        let retry = false;
         try {
-            await pipeline.flush(send);
+            await pipeline.flush(async (batch) => {
+                const outcome = await send(batch);
+                retry = outcome === "retry";
+                return outcome;
+            });
         }
         finally {
             flushing = false;
+            if (retry)
+                nextSendAt = Date.now() + backoff(++sendFailures);
+            else
+                sendFailures = 0;
         }
     };
+    // Piped output: the app's lines go straight through (honoring backpressure, as without Beam),
+    // and detection works through a bounded backlog in short slices. If detection can't keep up,
+    // lines are skipped for detection, never held back from the app's output.
+    const MAX_BACKLOG = 10_000;
+    const backlog = [];
+    let backlogHead = 0;
+    let pipedSkipped = 0;
+    let draining = false;
+    const drain = () => {
+        const until = performance.now() + 20;
+        while (backlogHead < backlog.length && performance.now() < until)
+            pipeline.ingestLine(backlog[backlogHead++], "stdin");
+        if (backlogHead > 1000) {
+            backlog.splice(0, backlogHead);
+            backlogHead = 0;
+        }
+        if (backlogHead < backlog.length)
+            setImmediate(drain);
+        else
+            draining = false;
+    };
     const timers = [
         setInterval(() => void flush(), 5_000),
         setInterval(() => {
-            if (Date.now() - lastRefresh >= (config ? 5 * 60_000 : 60_000))
+            const every = config ? 5 * 60_000 : rejected ? 15 * 60_000 : 60_000;
+            if (Date.now() - lastRefresh >= every)
                 void refresh().catch(e => { fatal = e; });
         }, 15_000),
+        setInterval(() => {
+            const skipped = (pipeline.budget?.takeSkipped() ?? 0) + pipedSkipped;
+            pipedSkipped = 0;
+            if (skipped)
+                log(`Skipped ${skipped} lines in the last minute to stay under ${maxCpu}% of a CPU (--max-cpu).`);
+        }, 60_000),
         setInterval(() => void checkDependencies(), 24 * 60 * 60_000),
     ];
+    for (const timer of timers)
+        timer.unref?.();
     void checkDependencies();
     let stdinDone = !options.stdin;
     if (options.stdin) {
-        if (options.echo !== false)
+        const echo = options.echo !== false;
+        if (echo)
             process.stdout.on("error", () => { });
         const lines = createInterface({ input: process.stdin, crlfDelay: Infinity });
+        let paused = false;
         lines.on("line", line => {
-            if (options.echo !== false)
-                process.stdout.write(`${line}\n`);
-            pipeline.ingestLine(line, "stdin");
+            if (echo && !process.stdout.write(`${line}\n`) && !paused) {
+                paused = true;
+                lines.pause();
+                process.stdout.once("drain", () => { paused = false; lines.resume(); });
+            }
+            if (backlog.length - backlogHead >= MAX_BACKLOG) {
+                pipedSkipped++;
+                return;
+            }
+            backlog.push(line);
+            if (!draining) {
+                draining = true;
+                setImmediate(drain);
+            }
         });
         lines.on("close", () => { stdinDone = true; });
     }
@@ -418,15 +365,17 @@ export async function runMonitor(options, log = m => console.error(`[beam monito
         tailer.stop();
     process.removeListener("SIGINT", stop);
     process.removeListener("SIGTERM", stop);
-    // Last flush, bounded so a dead network can't hold up shutdown.
+    // What's left of the piped backlog, then a last flush, bounded so a dead network can't hold up shutdown.
+    while (backlogHead < backlog.length)
+        pipeline.ingestLine(backlog[backlogHead++], "stdin");
     let giveUp;
-    await Promise.race([flush(), new Promise(r => { giveUp = setTimeout(r, 5_000); })]);
+    await Promise.race([flush(true), new Promise(r => { giveUp = setTimeout(r, 5_000); })]);
     clearTimeout(giveUp);
     if (fatal)
         throw fatal;
 }
 const fmt = (n) => (n >= 2_147_483_647 ? "unlimited" : n.toLocaleString("en-US"));
-export async function monitorStatus(write = console.log) {
+export async function monitorStatus(write = console.log, llm) {
     let identity;
     try {
         identity = await monitorAuth();
@@ -444,11 +393,11 @@ export async function monitorStatus(write = console.log) {
         write(result.status === "disabled" ? `App monitoring: off\n${result.message}` : result.message);
         return result.status === "disabled" ? 0 : 1;
     }
-    const { app, level, llm, webhooks, usage, limits, resetAt, settingsUrl } = result.config;
+    const { app, level, llm: beamLlm, webhooks, usage, limits, resetAt, settingsUrl } = result.config;
     let own = null;
     let ownError = "";
     try {
-        own = ownLlmConfig();
+        own = ownLlmConfig(process.env, llm, (await ensureMonitorConfig()).config.llm);
     }
     catch (error) {
         ownError = error.message;
@@ -457,15 +406,19 @@ export async function monitorStatus(write = console.log) {
         "App monitoring: on",
         ...(app ? [`App:            ${app}`] : []),
         `Level:          ${level}`,
-        `LLM checks:     ${own ? `your own model, ${own.model} at ${new URL(own.baseUrl).host}` : ownError ? `misconfigured: ${ownError}` : llm ? "Beam's model" : "off"}`,
+        `LLM checks:     ${own ? describeOwnLlm(own) : ownError ? `misconfigured: ${ownError}` : `${beamLlm ? "Beam's model" : "off"}${llmKeyHint(own)}`}`,
         `Webhooks:       ${webhooks}`,
         `This month:     ${fmt(usage.findings)} / ${fmt(limits.findings)} findings · ${fmt(usage.cveChecks)} / ${fmt(limits.cveChecks)} dependency checks · ${fmt(usage.llmChecks)} / ${fmt(limits.llmChecks)} LLM checks (resets ${resetAt.slice(0, 10)})`,
         `Settings:       ${settingsUrl}`,
+        `This server:    ${monitorConfigPath()}`,
     ].join("\n"));
     return 0;
 }
-/** `beam monitor test`: one test finding through the real path, to prove an integration end to end. */
-export async function monitorTest(write = console.log) {
+/**
+ * `beam monitor test`: one test finding through the real path, to prove an integration end to end.
+ * With an own LLM (--llm), also one LLM check on a harmless sample, to prove the key works.
+ */
+export async function monitorTest(write = console.log, llm) {
     let identity;
     try {
         identity = await monitorAuth();
@@ -496,6 +449,72 @@ export async function monitorTest(write = console.log) {
         return 1;
     }
     write(`✔ Test finding sent for ${where}. Check the dashboard's App monitoring page${config.config.webhooks ? ` and your ${config.config.webhooks} webhook${config.config.webhooks === 1 ? "" : "s"}` : ""}.`);
+    let own;
+    try {
+        own = ownLlmConfig(process.env, llm, (await ensureMonitorConfig()).config.llm);
+    }
+    catch (error) {
+        write(`✖ LLM check: ${error.message}`);
+        return 1;
+    }
+    if (!own)
+        return 0;
+    // A harmless sample, judged separately: its verdict isn't attached to the test finding, which must reach the webhooks.
+    const sample = {
+        id: "llm-test", ruleId: "web.sql_injection", title: "SQL injection attempt from 203.0.113.9", severity: "high", category: "exploit",
+        source: "http", count: 1, firstSeen: now, evidence: '203.0.113.9 - - "GET /items?id=1 UNION SELECT password FROM users-- HTTP/1.1" 200 "sqlmap/1.8"',
+    };
+    await judgeWithOwnLlm([sample], "strict", own);
+    const verdict = sample.llm;
+    if (!verdict || verdict.verdict === "error") {
+        write(`✖ LLM check with ${describeOwnLlm(own)} failed: ${verdict?.reason ?? "no answer"}`);
+        return 1;
+    }
+    write(`✔ LLM check works: ${describeOwnLlm(own)} judged a sample attack "${verdict.verdict}".`);
+    return 0;
+}
+/**
+ * `beam monitor configure`: saves settings to monitor.json so `beam monitor` needs no flags. With
+ * no options, prints the current settings. A key is only ever stored from stdin (`key`), and a
+ * provider's key that isn't set in this shell is a warning, not an error: it may be set only where
+ * beam monitor runs (a systemd EnvironmentFile, a container's secrets).
+ */
+export async function monitorConfigure(options, write = console.log) {
+    const { config: current } = await ensureMonitorConfig();
+    const changing = Object.values(options).some(v => v !== undefined && v !== false);
+    if (!changing) {
+        write(`${monitorConfigPath()}\n${JSON.stringify(describeMonitorConfig(current), null, 2)}`);
+        return 0;
+    }
+    const provider = options.llm?.trim().toLowerCase();
+    if (provider && provider !== "beam" && !(provider in LLM_PROVIDERS))
+        throw new Error(`Unknown LLM provider "${provider}". Use one of ${Object.keys(LLM_PROVIDERS).join(", ")}, or beam for Beam's model.`);
+    const switching = provider !== undefined && provider !== current.llm.provider;
+    const next = {
+        ...current,
+        files: options.noFiles ? [] : options.files?.length ? options.files.map(f => resolve(f)) : current.files,
+        app: options.noApp ? null : options.app ? resolve(options.app) : current.app,
+        maxCpuPercent: options.maxCpu ?? current.maxCpuPercent,
+        llm: {
+            provider: provider ?? current.llm.provider,
+            // A new provider starts from its own defaults rather than the old provider's model and endpoint.
+            model: options.model ?? (switching ? null : current.llm.model),
+            baseUrl: options.baseUrl ?? (switching ? null : current.llm.baseUrl),
+            apiKeyEnv: options.keyEnv ?? (switching ? null : current.llm.apiKeyEnv),
+            ...(options.key ? { apiKey: options.key } : !options.forgetKey && !switching && current.llm.apiKey ? { apiKey: current.llm.apiKey } : {}),
+        },
+    };
+    await writeMonitorConfig(next);
+    write(`Saved ${monitorConfigPath()} (0600).`);
+    try {
+        const own = ownLlmConfig(process.env, undefined, next.llm);
+        write(own ? `LLM checks: ${describeOwnLlm(own)}. The key stays on this server and is never sent to Beam.` : "LLM checks: Beam's model, when an admin turns it on in the dashboard.");
+    }
+    catch (error) {
+        write(`⚠ ${error.message} (Saved anyway: that may be set only where beam monitor runs.)`);
+    }
+    if (next.files.length || next.app)
+        write(`Watches: ${[...next.files, ...(next.app ? [`dependencies in ${next.app}`] : [])].join(", ")}. Start with 'beam monitor'.`);
     return 0;
 }
 //# sourceMappingURL=monitor.js.map