@agent-beam/beam 0.2.30 → 0.2.33

package/dist/monitor-client.d.ts

@@ -1,9 +1,10 @@
 import { type Identity } from "./enroll.js";
 import type { InstalledPackage } from "./lockfiles.js";
+import type { RequestMeta, RequestOutcome } from "./monitor-rules.js";
 /** What the App monitoring API needs: where to send, and the secret to send with. */
 export type MonitorAuth = Pick<Identity, "apiBase" | "deviceSecret">;
 /**
- * An app token (BEAM_APP_TOKEN, created per app on the dashboard's App monitoring page) for
+ * An app token (BEAM_APP_TOKEN, created per app under App monitoring > Settings, apps and alerts) for
  * servers, containers and CI; otherwise this machine's own connection from 'beam connect'.
  */
 export declare function monitorAuth(env?: NodeJS.ProcessEnv): Promise<MonitorAuth | null>;
@@ -42,6 +43,49 @@ export interface MonitorFinding {
         reason: string;
         model: string;
     };
+    /** The flagged request (traffic findings): client, agent, path, response status and what became of it. Redacted. */
+    request?: RequestMeta & {
+        ip?: string;
+        outcome: RequestOutcome;
+    };
+    /** Set on a roll-up: many requests that matched a rule but couldn't have worked, sent as one finding. */
+    rollup?: MonitorRollup;
+}
+/**
+ * Requests that matched one rule but were refused (3xx/4xx) or aimed at software the app doesn't
+ * run, over a few minutes. Sent as one low-severity finding instead of one per address, so a
+ * botnet's scan shows up as one campaign and doesn't spend the month's allowance or page anyone.
+ */
+export interface MonitorRollup {
+    outcome: "blocked" | "not_applicable";
+    requests: number;
+    /** Distinct client addresses (counted up to 10,000). */
+    addresses: number;
+    from: string;
+    to: string;
+    statuses: Record<string, number>;
+    /** The busiest addresses, with what each sent last. */
+    clients: {
+        ip: string;
+        count: number;
+        status?: number;
+        path?: string;
+        userAgent?: string;
+        country?: string;
+        asn?: number;
+    }[];
+    paths: {
+        path: string;
+        count: number;
+    }[];
+    userAgents: {
+        userAgent: string;
+        count: number;
+    }[];
+    countries: {
+        country: string;
+        count: number;
+    }[];
 }
 export interface Vulnerability {
     id: string;

package/dist/monitor-client.js

@@ -4,14 +4,14 @@
 import { readIdentity } from "./enroll.js";
 import { getDashboardUrl } from "./config.js";
 /**
- * An app token (BEAM_APP_TOKEN, created per app on the dashboard's App monitoring page) for
+ * An app token (BEAM_APP_TOKEN, created per app under App monitoring > Settings, apps and alerts) for
  * servers, containers and CI; otherwise this machine's own connection from 'beam connect'.
  */
 export async function monitorAuth(env = process.env) {
     const token = env.BEAM_APP_TOKEN?.trim();
     if (token) {
         if (!/^beam_app_[\w-]{40,}$/.test(token))
-            throw new Error("BEAM_APP_TOKEN doesn't look like an app token (beam_app_…). Copy it again from the dashboard's App monitoring page.");
+            throw new Error("BEAM_APP_TOKEN doesn't look like an app token (beam_app_…). Copy it again from App monitoring > Settings, apps and alerts in the dashboard.");
         const apiBase = getDashboardUrl();
         // A bearer token over plain HTTP can be read on the wire; only loopback (local testing) is exempt.
         const url = new URL(apiBase);
@@ -50,7 +50,7 @@ async function call(identity, path, init = {}) {
             ok: false,
             status: "revoked",
             message: identity.deviceSecret.startsWith("beam_app_")
-                ? `This app token was rotated or removed, or its app was deleted. Copy the current token from ${getDashboardUrl()}/dashboard/monitoring (Apps) into BEAM_APP_TOKEN.`
+                ? `This app token was rotated or removed, or its app was deleted. Copy the current token from ${getDashboardUrl()}/dashboard/monitoring/settings#apps into BEAM_APP_TOKEN.`
                 : "This device was revoked or is unknown to the workspace. Run 'beam connect' again.",
         };
     if (response.status === 404 || response.status === 405)

package/dist/monitor-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"monitor-client.js","sourceRoot":"","sources":["../src/monitor-client.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,8FAA8F;AAC9F,kFAAkF;AAClF,OAAO,EAAE,YAAY,EAAiB,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAM9C;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAyB,OAAO,CAAC,GAAG;IACpE,MAAM,KAAK,GAAG,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IACzC,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qHAAqH,CAAC,CAAC;QACjL,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;QAClC,mGAAmG;QACnG,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC1F,MAAM,IAAI,KAAK,CAAC,sCAAsC,OAAO,uDAAuD,CAAC,CAAC;QACxH,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAC1C,CAAC;IACD,OAAO,YAAY,EAAE,CAAC;AACxB,CAAC;AAiCD,KAAK,UAAU,IAAI,CAAC,QAAqB,EAAE,IAAY,EAAE,OAAoB,EAAE;IAC7E,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;YACnD,GAAG,IAAI;YACP,OAAO,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,aAAa,EAAE,UAAU,QAAQ,CAAC,YAAY,EAAE,EAAE;YAC3H,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,mBAAmB,QAAQ,CAAC,OAAO,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IACzJ,CAAC;IACD,IAAI,IAAI,GAAmE,EAAE,CAAC;IAC9E,IAAI,CAAC;QAAC,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAgB,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,4BAA4B,CAAC,CAAC;IAC7F,IAAI,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,OAAO,wBAAwB,QAAQ,CAAC,MAAM,GAAG,CAAC;IAC5H,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IAC/E,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IAClJ,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QACzB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,QAAQ,CAAC,YAAY,CAAC,UAAU,CAAC,WAAW,CAAC;gBACpD,CAAC,CAAC,8FAA8F,eAAe,EAAE,mDAAmD;gBACpK,CAAC,CAAC,mFAAmF;SACxF,CAAC;IACJ,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QACpD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC,OAAO,sCAAsC,EAAE,CAAC;IAClH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAAqB;IAC5D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;IAC1D,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAqB,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AACjF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAqB,EAAE,QAA0B;IAClF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,sBAAsB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;IACpH,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC;IAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,IAA+C,CAAC;IACpE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC;AAChF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,QAAqB,EAAE,QAA4B;IACrF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;IAC7G,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAsB,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AAClF,CAAC"}
+{"version":3,"file":"monitor-client.js","sourceRoot":"","sources":["../src/monitor-client.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,8FAA8F;AAC9F,kFAAkF;AAClF,OAAO,EAAE,YAAY,EAAiB,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAO9C;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAyB,OAAO,CAAC,GAAG;IACpE,MAAM,KAAK,GAAG,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IACzC,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6IAA6I,CAAC,CAAC;QACzM,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;QAClC,mGAAmG;QACnG,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC1F,MAAM,IAAI,KAAK,CAAC,sCAAsC,OAAO,uDAAuD,CAAC,CAAC;QACxH,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAC1C,CAAC;IACD,OAAO,YAAY,EAAE,CAAC;AACxB,CAAC;AAuDD,KAAK,UAAU,IAAI,CAAC,QAAqB,EAAE,IAAY,EAAE,OAAoB,EAAE;IAC7E,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;YACnD,GAAG,IAAI;YACP,OAAO,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,aAAa,EAAE,UAAU,QAAQ,CAAC,YAAY,EAAE,EAAE;YAC3H,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,mBAAmB,QAAQ,CAAC,OAAO,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IACzJ,CAAC;IACD,IAAI,IAAI,GAAmE,EAAE,CAAC;IAC9E,IAAI,CAAC;QAAC,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAgB,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,4BAA4B,CAAC,CAAC;IAC7F,IAAI,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,OAAO,wBAAwB,QAAQ,CAAC,MAAM,GAAG,CAAC;IAC5H,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IAC/E,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IAClJ,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QACzB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,QAAQ,CAAC,YAAY,CAAC,UAAU,CAAC,WAAW,CAAC;gBACpD,CAAC,CAAC,8FAA8F,eAAe,EAAE,0DAA0D;gBAC3K,CAAC,CAAC,mFAAmF;SACxF,CAAC;IACJ,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QACpD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC,OAAO,sCAAsC,EAAE,CAAC;IAClH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAAqB;IAC5D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;IAC1D,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAqB,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AACjF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAqB,EAAE,QAA0B;IAClF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,sBAAsB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;IACpH,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC;IAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,IAA+C,CAAC;IACpE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC;AAChF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,QAAqB,EAAE,QAA4B;IACrF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;IAC7G,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAsB,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AAClF,CAAC"}

package/dist/monitor-pipeline.d.ts

@@ -1,6 +1,7 @@
 import type { MonitorFinding, MonitorLevel, MonitorSeverity } from "./monitor-client.js";
 import type { CustomDetector } from "./data-detectors.js";
 import { type LineSource, type MonitorRule } from "./monitor-rules.js";
+import { type Stack } from "./monitor-stacks.js";
 /** A short, stable fingerprint (two seeded 53-bit hashes); not cryptographic, only used for dedupe ids. */
 export declare function fingerprint(text: string): string;
 /** light: critical only · standard: high and up · strict: medium and up (same thresholds as the server). */
@@ -9,6 +10,7 @@ export declare const DEDUPE_WINDOW_MS: Record<MonitorLevel, number>;
 export declare const BRUTE_FORCE_THRESHOLD: Record<MonitorLevel, number>;
 export declare const LLM_FLOOD_THRESHOLD: Record<MonitorLevel, number>;
 export declare const MAX_NEW_FINDINGS_PER_10_MIN = 200;
+export declare const ROLLUP_EVERY_MS: number;
 export type SendOutcome = "sent" | "retry" | "drop";
 export interface IngestOptions {
     /** What the text is. Default: worked out from the line (an access-log line or an app log line). */
@@ -29,6 +31,18 @@ export interface PipelineOptions {
     cpuBudgetMsPerMinute?: number;
     /** Or a budget shared with other work (the SDK's prompt and output checks). */
     budget?: CpuBudget;
+    /** LLM tokens one user may use in an hour before it's raised. Default: SIGNAL_THRESHOLDS.tokensPerHour for the level. */
+    tokensPerUserHour?: number;
+    /**
+     * The app is JavaScript (the SDK): a request for a PHP, WordPress, ASP or Java path can't reach
+     * code that would run it, so it's rolled up like a refused one even without a response status.
+     */
+    javascriptApp?: boolean;
+    /**
+     * The app's stack (nextjs, django, laravel, spring...). Attacks aimed at software it doesn't run
+     * are rolled up as not applicable, and its own framework's rules count in full.
+     */
+    stack?: Stack;
 }
 /**
  * A hard cap on detection time per minute, so monitoring can never take more than a fixed share of
@@ -57,6 +71,9 @@ export declare class WindowCounter {
     get size(): number;
     /** Records one event and returns the count over the window, this one included. */
     add(key: string, now: number): number;
+    /** The count over the window, without recording anything. */
+    peek(key: string, now: number): number;
+    clear(key: string): void;
     /** Drops keys with nothing in the window. */
     prune(now: number): void;
 }
@@ -70,19 +87,24 @@ export declare class MonitorPipeline {
     private floodBucket;
     private floodCount;
     private suppressed;
+    private rollups;
+    private misses;
+    private errors;
+    private walks;
+    private loginFailures;
+    private tokens;
+    private knownHosts;
+    private reportedHosts;
     private maintainedMinute;
     readonly budget: CpuBudget | null;
     constructor(opts: PipelineOptions);
     private now;
+    private stack;
     get pending(): MonitorFinding[];
+    /** Roll-ups still collecting; a forced flush sends them early. */
+    get rollingUp(): number;
     /** Sizes of everything the pipeline keeps, for tests and diagnostics: all of them are bounded. */
-    get footprint(): {
-        seen: number;
-        queue: number;
-        queued: number;
-        authFailures: number;
-        llmCalls: number;
-    };
+    get footprint(): Record<"seen" | "queue" | "queued" | "authFailures" | "llmCalls" | "rollups" | "misses" | "errors" | "walks" | "loginFailures" | "tokens" | "hosts", number>;
     /** Once a minute: forget dedupe entries and counters that can no longer matter. */
     private maintain;
     /**
@@ -91,11 +113,40 @@ export declare class MonitorPipeline {
      */
     ingestLine(line: string, file?: string, options?: IngestOptions): string[];
     private ingest;
+    /** The attack-in-progress signals for one traffic or log line. Returns the rule ids raised. */
+    private signals;
+    private loginSucceeded;
+    private privilegeChanged;
+    private noteTokens;
+    /**
+     * Structured security events from the app (the SDK's event() and usage()), checked like the log
+     * lines that say the same thing.
+     */
+    event(type: "login.failed" | "login.succeeded" | "admin.granted" | "apikey.created", who: {
+        ip?: string;
+        user?: string;
+    }, detail?: string): string[];
+    /** LLM tokens used by one user (or address), as reported by the app. */
+    usage(user: string, tokens: number, detail?: string): string[];
+    /** Hosts the workspace has already seen this app call (from its config), so only new ones are raised. */
+    setKnownOutboundHosts(hosts: string[]): void;
+    /** The app called this URL or host. Raises the first call to a host the workspace hasn't seen for this app. */
+    outbound(target: string): boolean;
+    /** The request behind a traffic line, redacted like evidence, with what became of it. */
+    private describeRequest;
+    private rollUp;
+    /** Queues roll-ups that have collected for ROLLUP_EVERY_MS, or all of them when `force`. */
+    private emitRollups;
     /** Queues a finding produced elsewhere (dependency checks) under its own stable id, once. */
     addFinding(finding: MonitorFinding): boolean;
     private raise;
     private emitSuppressed;
     private enqueue;
-    /** Sends queued findings in batches; a "retry" outcome keeps the batch for the next flush. */
-    flush(send: (batch: MonitorFinding[]) => Promise<SendOutcome>): Promise<void>;
+    /**
+     * Sends queued findings in batches; a "retry" outcome keeps the batch for the next flush.
+     * `force` (shutdown, the SDK's flush({ force })) also sends roll-ups still collecting.
+     */
+    flush(send: (batch: MonitorFinding[]) => Promise<SendOutcome>, options?: {
+        force?: boolean;
+    }): Promise<void>;
 }

package/dist/monitor-pipeline.js

@@ -1,4 +1,6 @@
-import { clientIp, isAuthFailure, isLlmRequest, lineSource, matchLine, redactLine } from "./monitor-rules.js";
+import { clientIp, isAuthFailure, isAuthSuccess, isLlmRequest, lineSource, logUser, matchLine, privilegeChange, quickRequest, redactLine, requestMeta, requestOutcome, routeKey, tokenUsage, } from "./monitor-rules.js";
+import { DistinctPerMinute, MinuteSeries, SIGNAL_THRESHOLDS, meaningfulPath, outboundHost } from "./monitor-signals.js";
+import { foreignTo, ruleFamilies } from "./monitor-stacks.js";
 /** A short, stable fingerprint (two seeded 53-bit hashes); not cryptographic, only used for dedupe ids. */
 export function fingerprint(text) {
     const h = (seed) => {
@@ -33,6 +35,22 @@ export const MAX_NEW_FINDINGS_PER_10_MIN = 200;
 const FLOOD_WINDOW_MS = 10 * 60_000;
 const MAX_QUEUE = 1000;
 const BATCH_SIZE = 100;
+// Attacks that were refused or can't work here are rolled up per rule and sent this often.
+export const ROLLUP_EVERY_MS = 5 * 60_000;
+const ROLLUP_LIMITS = { addresses: 10_000, clients: 2000, paths: 500, userAgents: 300, countries: 250 };
+const ROLLUP_TOP = { clients: 25, paths: 10, userAgents: 10, countries: 10 };
+/** Adds one to `key`, keeping at most `max` keys (new keys past it aren't tracked). */
+function bump(map, key, max) {
+    if (!key)
+        return;
+    const n = map.get(key);
+    if (n !== undefined)
+        map.set(key, n + 1);
+    else if (map.size < max)
+        map.set(key, 1);
+}
+const top = (map, n) => [...map].sort((a, b) => b[1] - a[1]).slice(0, n);
+const OUTCOME_TITLE = { blocked: "refused by the app", not_applicable: "aimed at software this app doesn't run" };
 /** Groups lines that differ only in ids, numbers, addresses or timestamps. */
 function normalizeForGrouping(line) {
     return line.toLowerCase()
@@ -114,6 +132,19 @@ export class WindowCounter {
                 total += entry.counts[i];
         return total;
     }
+    /** The count over the window, without recording anything. */
+    peek(key, now) {
+        const entry = this.keys.get(key);
+        if (!entry)
+            return 0;
+        const minute = Math.floor(now / 60_000);
+        let total = 0;
+        for (let i = 0; i < this.windowMinutes; i++)
+            if (minute - entry.minutes[i] < this.windowMinutes)
+                total += entry.counts[i];
+        return total;
+    }
+    clear(key) { this.keys.delete(key); }
     /** Drops keys with nothing in the window. */
     prune(now) {
         const minute = Math.floor(now / 60_000);
@@ -132,6 +163,15 @@ export class MonitorPipeline {
     floodBucket = -1;
     floodCount = 0;
     suppressed = null;
+    rollups = new Map();
+    // Attack-in-progress signals (monitor-signals.ts).
+    misses = new MinuteSeries(10, 5000);
+    errors = new MinuteSeries(35, 1000);
+    walks = new DistinctPerMinute(SIGNAL_THRESHOLDS.pathWalk.light, 2000);
+    loginFailures = new WindowCounter(15, 10_000);
+    tokens = new MinuteSeries(60, 5000);
+    knownHosts = new Set();
+    reportedHosts = new Set();
     maintainedMinute = -1;
     budget;
     constructor(opts) {
@@ -139,10 +179,17 @@ export class MonitorPipeline {
         this.budget = opts.budget ?? (opts.cpuBudgetMsPerMinute ? new CpuBudget(opts.cpuBudgetMsPerMinute) : null);
     }
     now() { return this.opts.now?.() ?? Date.now(); }
+    stack() { return this.opts.stack ?? (this.opts.javascriptApp ? "node" : undefined); }
     get pending() { return [...this.queue]; }
+    /** Roll-ups still collecting; a forced flush sends them early. */
+    get rollingUp() { return this.rollups.size; }
     /** Sizes of everything the pipeline keeps, for tests and diagnostics: all of them are bounded. */
     get footprint() {
-        return { seen: this.seen.size, queue: this.queue.length, queued: this.queued.size, authFailures: this.authFailures.size, llmCalls: this.llmCalls.size };
+        return {
+            seen: this.seen.size, queue: this.queue.length, queued: this.queued.size, authFailures: this.authFailures.size, llmCalls: this.llmCalls.size,
+            rollups: this.rollups.size, misses: this.misses.size, errors: this.errors.size, walks: this.walks.size, loginFailures: this.loginFailures.size,
+            tokens: this.tokens.size, hosts: this.knownHosts.size + this.reportedHosts.size,
+        };
     }
     /** Once a minute: forget dedupe entries and counters that can no longer matter. */
     maintain(now) {
@@ -156,8 +203,14 @@ export class MonitorPipeline {
                 this.seen.delete(fp);
         this.authFailures.prune(now);
         this.llmCalls.prune(now);
+        this.misses.prune(now);
+        this.errors.prune(now);
+        this.walks.prune(now);
+        this.loginFailures.prune(now);
+        this.tokens.prune(now);
         if (this.queued.size > 5000)
             this.queued.clear(); // dependency ids; a repeat is deduped by the server too
+        this.emitRollups(now, false);
     }
     /**
      * Matches one line and queues any findings at or above the level. Returns the rule ids raised.
@@ -179,16 +232,32 @@ export class MonitorPipeline {
         const ip = options.client ? redactLine(options.client, custom).slice(0, 80) : source === "http" ? clientIp(line) : undefined;
         this.maintain(this.now());
         const excerpt = options.excerpt === false ? "(the app withheld the text)" : redactLine(line, custom);
+        const request = source === "http" ? this.describeRequest(line, ip, custom, options.excerpt !== false) : undefined;
         const raised = [];
         const seenRules = new Set();
+        const stack = this.stack();
         for (const rule of matchLine(line, source, options.rules)) {
-            if (!meetsLevel(rule.severity, level) || seenRules.has(rule.id))
+            if (seenRules.has(rule.id))
+                continue;
+            // An attack on a framework this app doesn't run (a Laravel exploit against a Next.js app),
+            // with no status to say otherwise, can't have worked.
+            const outcome = request?.outcome === "unknown" && stack && foreignTo(stack, ruleFamilies(rule.id)) ? "not_applicable" : request?.outcome;
+            // Refused, or aimed at software that isn't here: rolled up whatever the level, as context
+            // for the dashboard, never one finding (or alert) per address.
+            if (request && (outcome === "blocked" || outcome === "not_applicable")) {
+                seenRules.add(rule.id);
+                this.rollUp(rule, outcome, { ...request, outcome }, file, excerpt);
+                raised.push(rule.id);
+                continue;
+            }
+            if (!meetsLevel(rule.severity, level))
                 continue;
             seenRules.add(rule.id);
             // Traffic groups by client address (one scan = one finding); app logs group by line shape.
             this.raise(level, ip ?? normalizeForGrouping(line), {
                 ruleId: rule.id, title: ip ? `${rule.title} from ${ip}` : rule.title, severity: rule.severity,
                 category: rule.category, source: wire, file, evidence: options.excerpt === false ? `Matched "${rule.title}"; the app withheld the text.` : excerpt,
+                ...(request ? { request } : {}),
             });
             raised.push(rule.id);
         }
@@ -199,6 +268,7 @@ export class MonitorPipeline {
                 this.raise(level, key, {
                     ruleId: "app.auth_bruteforce", title: `Repeated failed sign-ins from ${key}`, severity: "high", category: "recon",
                     source: wire, file, evidence: `${recent} failures in 5 minutes. Latest: ${redactLine(line, custom)}`.slice(0, 600),
+                    ...(request ? { request } : {}),
                 });
                 raised.push("app.auth_bruteforce");
             }
@@ -210,12 +280,258 @@ export class MonitorPipeline {
                 this.raise(level, ip, {
                     ruleId: "llm.denial_of_wallet", title: `Unusual volume of LLM requests from ${ip}`, severity: "high", category: "llm",
                     source: wire, file, evidence: `${recent} ${source === "prompt" ? "prompts" : "requests to LLM endpoints"} in 5 minutes. Scripted use runs up the model bill. Latest: ${excerpt}`.slice(0, 600),
+                    ...(request ? { request } : {}),
                 });
                 raised.push("llm.denial_of_wallet");
             }
         }
+        if (source === "http" || source === "log")
+            raised.push(...this.signals(line, source, wire, file, ip, request, level, custom, excerpt));
         return raised;
     }
+    /** The attack-in-progress signals for one traffic or log line. Returns the rule ids raised. */
+    signals(line, source, wire, file, ip, request, level, custom, excerpt) {
+        const now = this.now();
+        const out = [];
+        const high = meetsLevel("high", level);
+        const base = { source: wire, file, ...(request ? { request } : {}) };
+        if (source === "http" && request) {
+            const path = request.path ?? quickRequest(line).path;
+            const status = request.status;
+            // A scan finding something: an address with a run of 4xx gets a 2xx on a real page.
+            if (ip && status !== undefined) {
+                if (status >= 400 && status < 500)
+                    this.misses.add(ip, now);
+                else if (status >= 200 && status < 300 && path && meaningfulPath(path)) {
+                    const misses = this.misses.sum(ip, now, 0, 9);
+                    if (high && misses >= SIGNAL_THRESHOLDS.probeMisses[level]) {
+                        const route = routeKey(redactLine(path, custom));
+                        this.raise(level, ip, {
+                            ruleId: "signal.probe_hit", title: `Scan from ${ip} found a live path`, severity: "high", category: "activity", ...base,
+                            evidence: `${ip} got ${misses} 4xx answers in 10 minutes, then ${status} on ${route}. Latest: ${excerpt}`.slice(0, 600),
+                        });
+                        out.push("signal.probe_hit");
+                    }
+                }
+            }
+            // A jump in server errors on one route, against its own last half hour.
+            if (status !== undefined && status >= 500 && path) {
+                const route = routeKey(redactLine(path, custom));
+                this.errors.add(route, now);
+                const recent = this.errors.sum(route, now, 0, 4);
+                const usual = this.errors.sum(route, now, 5, 34) / 6;
+                if (high && recent >= SIGNAL_THRESHOLDS.errorSpike[level] && recent >= 5 * Math.max(1, usual)) {
+                    this.raise(level, route, {
+                        ruleId: "signal.error_spike", title: `Server errors jumped on ${route}`, severity: "high", category: "activity", ...base,
+                        evidence: `${recent} 5xx answers on ${route} in 5 minutes, against about ${Math.round(usual)} per 5 minutes before. Latest: ${excerpt}`.slice(0, 600),
+                    });
+                    out.push("signal.error_spike");
+                }
+            }
+            // One address walking the app: many distinct paths in a minute.
+            if (ip && path) {
+                const distinct = this.walks.add(ip, path.split(/[?#]/)[0], now);
+                if (high && distinct >= SIGNAL_THRESHOLDS.pathWalk[level]) {
+                    this.raise(level, ip, {
+                        ruleId: "signal.path_walk", title: `${ip} is walking the app's paths`, severity: "high", category: "activity", ...base,
+                        evidence: `${distinct}+ different paths from ${ip} within a minute: a scanner or scraper mapping the app. Latest: ${excerpt}`.slice(0, 600),
+                    });
+                    out.push("signal.path_walk");
+                }
+            }
+        }
+        // A sign-in that succeeds right after a run of failures, by address or by user.
+        const who = [source === "http" ? ip : clientIp(line), logUser(line)];
+        const keys = [who[0] ? `ip:${who[0]}` : null, who[1] ? `user:${who[1]}` : null].filter((k) => Boolean(k));
+        if (keys.length && isAuthFailure(line, source))
+            for (const key of keys)
+                this.loginFailures.add(key, now);
+        else if (keys.length && isAuthSuccess(line, source))
+            out.push(...this.loginSucceeded(level, keys, who[0], wire, file, request, excerpt));
+        // A role or permission granted, or a new API key.
+        const change = privilegeChange(line, source);
+        if (change)
+            out.push(...this.privilegeChanged(level, change, ip ?? normalizeForGrouping(line), wire, file, request, excerpt));
+        // LLM token usage the app logs, per user.
+        const usage = source === "log" ? tokenUsage(line) : null;
+        if (usage)
+            out.push(...this.noteTokens(level, usage.user ?? who[0] ?? "unknown", usage.tokens, wire, file, excerpt, custom));
+        return out;
+    }
+    loginSucceeded(level, keys, ip, wire, file, request, excerpt) {
+        const now = this.now();
+        const failures = Math.max(...keys.map(k => this.loginFailures.peek(k, now)));
+        for (const key of keys)
+            this.loginFailures.clear(key);
+        if (failures < SIGNAL_THRESHOLDS.loginAfterFailures[level])
+            return [];
+        this.raise(level, keys[0], {
+            ruleId: "signal.login_after_failures", title: `Sign-in succeeded after ${failures} failed attempts${ip ? ` from ${ip}` : ""}`,
+            severity: "critical", category: "activity", source: wire, file, ...(request ? { request } : {}),
+            evidence: `${failures} failed sign-ins in 15 minutes, then a successful one: a guessed or stuffed password, possibly. Latest: ${excerpt}`.slice(0, 600),
+        });
+        return ["signal.login_after_failures"];
+    }
+    privilegeChanged(level, change, groupKey, wire, file, request, excerpt) {
+        const severity = change === "admin" ? "high" : "medium";
+        if (!meetsLevel(severity, level))
+            return [];
+        this.raise(level, `${change}\0${groupKey}`, {
+            ruleId: "signal.privilege_change", title: change === "admin" ? "Admin or role granted" : "New API key or access token created",
+            severity, category: "activity", source: wire, file, ...(request ? { request } : {}),
+            evidence: `${change === "admin" ? "Someone was given admin rights or a new role." : "A new API key or access token was created."} Latest: ${excerpt}`.slice(0, 600),
+        });
+        return ["signal.privilege_change"];
+    }
+    noteTokens(level, user, tokens, wire, file, excerpt, custom) {
+        const now = this.now();
+        this.tokens.add(user, now, tokens);
+        const total = this.tokens.sum(user, now, 0, 59);
+        const limit = this.opts.tokensPerUserHour ?? SIGNAL_THRESHOLDS.tokensPerHour[level];
+        if (!meetsLevel("high", level) || total < limit)
+            return [];
+        const shown = redactLine(user, custom).slice(0, 80);
+        this.raise(level, user, {
+            ruleId: "llm.token_spend", title: `Unusual LLM spend: ${Math.round(total).toLocaleString("en-US")} tokens in an hour for ${shown}`,
+            severity: "high", category: "llm", source: wire, file,
+            evidence: `${Math.round(total).toLocaleString("en-US")} tokens in the last hour for ${shown} (limit ${limit.toLocaleString("en-US")}). Scripted use or a runaway loop runs up the bill. Latest: ${excerpt}`.slice(0, 600),
+        });
+        return ["llm.token_spend"];
+    }
+    /**
+     * Structured security events from the app (the SDK's event() and usage()), checked like the log
+     * lines that say the same thing.
+     */
+    event(type, who, detail = "") {
+        const level = this.opts.level();
+        if (!level)
+            return [];
+        const run = () => {
+            this.maintain(this.now());
+            const custom = this.opts.customDetectors?.() ?? [];
+            const ip = who.ip ? redactLine(who.ip, custom).slice(0, 80) : undefined;
+            const keys = [who.ip ? `ip:${who.ip}` : null, who.user ? `user:${who.user}` : null].filter((k) => Boolean(k));
+            const excerpt = redactLine(`${type}${ip ? ` ip=${ip}` : ""}${who.user ? ` user=${who.user}` : ""}${detail ? ` ${detail}` : ""}`, custom);
+            if (type === "login.failed") {
+                for (const key of keys)
+                    this.loginFailures.add(key, this.now());
+                return [];
+            }
+            if (type === "login.succeeded")
+                return keys.length ? this.loginSucceeded(level, keys, ip, "log", "security events", undefined, excerpt) : [];
+            return this.privilegeChanged(level, type === "admin.granted" ? "admin" : "key", keys[1] ?? keys[0] ?? excerpt, "log", "security events", undefined, excerpt);
+        };
+        return (this.budget ? this.budget.run(run) : run()) ?? [];
+    }
+    /** LLM tokens used by one user (or address), as reported by the app. */
+    usage(user, tokens, detail = "") {
+        const level = this.opts.level();
+        if (!level || !(tokens > 0) || !user)
+            return [];
+        this.maintain(this.now());
+        const custom = this.opts.customDetectors?.() ?? [];
+        return this.noteTokens(level, user, tokens, "log", "llm usage", redactLine(`${tokens} tokens user=${user}${detail ? ` ${detail}` : ""}`, custom), custom);
+    }
+    /** Hosts the workspace has already seen this app call (from its config), so only new ones are raised. */
+    setKnownOutboundHosts(hosts) {
+        this.knownHosts = new Set(hosts.slice(0, 5000).map(h => outboundHost(h)).filter((h) => Boolean(h)));
+    }
+    /** The app called this URL or host. Raises the first call to a host the workspace hasn't seen for this app. */
+    outbound(target) {
+        const level = this.opts.level();
+        const host = outboundHost(target);
+        if (!level || !host || this.knownHosts.has(host) || this.reportedHosts.has(host))
+            return false;
+        if (this.reportedHosts.size >= 2000)
+            return false;
+        this.reportedHosts.add(host);
+        if (!meetsLevel("high", level))
+            return false;
+        this.maintain(this.now());
+        this.raise(level, host, {
+            ruleId: "signal.new_outbound_host", title: `First call to ${host}`, severity: "high", category: "activity", source: "log", file: "outbound calls",
+            evidence: `The app called ${host}, a host it hasn't called before. New destinations are how stolen data and stolen compute leave a server.`,
+            request: { outcome: "unknown", host },
+        });
+        return true;
+    }
+    /** The request behind a traffic line, redacted like evidence, with what became of it. */
+    describeRequest(line, ip, custom, withText) {
+        const meta = requestMeta(line);
+        const clip = (s, max) => (s === undefined ? undefined : redactLine(s, custom).slice(0, max));
+        const request = {
+            outcome: requestOutcome(meta, { stack: this.stack() }),
+            ip, method: meta.method, status: meta.status, bytes: meta.bytes, durationMs: meta.durationMs,
+            host: clip(meta.host, 200), country: meta.country, asn: meta.asn, userAgent: clip(meta.userAgent, 300),
+            // The path and referrer carry the payload; an app that withholds text withholds them too.
+            ...(withText ? { path: clip(meta.path, 500), referer: clip(meta.referer, 300) } : {}),
+        };
+        for (const key of Object.keys(request))
+            if (request[key] === undefined)
+                delete request[key];
+        return request;
+    }
+    rollUp(rule, outcome, request, file, excerpt) {
+        const now = this.now();
+        const key = `${rule.id}\0${outcome}\0${file ?? ""}`;
+        let r = this.rollups.get(key);
+        if (!r) {
+            r = {
+                ruleId: rule.id, title: rule.title, category: rule.category, file, outcome, started: now, last: now, requests: 0, excerpt,
+                addresses: new Set(), statuses: new Map(), clients: new Map(), paths: new Map(), userAgents: new Map(), countries: new Map(),
+            };
+            this.rollups.set(key, r);
+        }
+        r.requests++;
+        r.last = now;
+        r.excerpt = excerpt;
+        const ip = request.ip ?? "unknown";
+        if (r.addresses.size < ROLLUP_LIMITS.addresses)
+            r.addresses.add(ip);
+        bump(r.statuses, request.status === undefined ? "none" : String(request.status), 100);
+        bump(r.paths, request.path, ROLLUP_LIMITS.paths);
+        bump(r.userAgents, request.userAgent, ROLLUP_LIMITS.userAgents);
+        bump(r.countries, request.country, ROLLUP_LIMITS.countries);
+        const client = r.clients.get(ip);
+        const latest = { status: request.status, path: request.path, userAgent: request.userAgent, country: request.country, asn: request.asn };
+        for (const k of Object.keys(latest))
+            if (latest[k] === undefined)
+                delete latest[k];
+        if (client)
+            Object.assign(client, latest, { count: client.count + 1 });
+        else if (r.clients.size < ROLLUP_LIMITS.clients)
+            r.clients.set(ip, { ip, count: 1, ...latest });
+    }
+    /** Queues roll-ups that have collected for ROLLUP_EVERY_MS, or all of them when `force`. */
+    emitRollups(now, force) {
+        for (const [key, r] of this.rollups) {
+            if (!force && now - r.started < ROLLUP_EVERY_MS)
+                continue;
+            this.rollups.delete(key);
+            const statuses = Object.fromEntries(r.statuses);
+            const answered = Object.entries(statuses).filter(([s]) => s !== "none").sort((a, b) => b[1] - a[1]).map(([s, n]) => `${n} × ${s}`).join(", ");
+            const [topPath] = top(r.paths, 1);
+            const rollup = {
+                outcome: r.outcome, requests: r.requests, addresses: r.addresses.size,
+                from: new Date(r.started).toISOString(), to: new Date(r.last).toISOString(), statuses,
+                clients: [...r.clients.values()].sort((a, b) => b.count - a.count).slice(0, ROLLUP_TOP.clients),
+                paths: top(r.paths, ROLLUP_TOP.paths).map(([path, count]) => ({ path, count })),
+                userAgents: top(r.userAgents, ROLLUP_TOP.userAgents).map(([userAgent, count]) => ({ userAgent, count })),
+                countries: top(r.countries, ROLLUP_TOP.countries).map(([country, count]) => ({ country, count })),
+            };
+            const plural = (n, word) => `${n.toLocaleString("en-US")} ${word}${n === 1 ? "" : word.endsWith("s") ? "es" : "s"}`;
+            this.enqueue({
+                id: `rollup-${fingerprint(key)}-${r.started}`, ruleId: r.ruleId, title: `${r.title}, ${OUTCOME_TITLE[r.outcome]}`,
+                severity: "low", category: r.category, source: "http", file: r.file, count: r.requests, firstSeen: rollup.from,
+                evidence: [
+                    `${plural(r.requests, "request")} from ${plural(r.addresses.size, "address")}${answered ? `, answered ${answered}` : ""}.`,
+                    topPath ? `Most sent: ${topPath[0]} (${topPath[1]}).` : "",
+                    `Latest: ${r.excerpt}`,
+                ].filter(Boolean).join(" ").slice(0, 900),
+                rollup,
+            });
+        }
+    }
     /** Queues a finding produced elsewhere (dependency checks) under its own stable id, once. */
     addFinding(finding) {
         const level = this.opts.level();
@@ -274,10 +590,14 @@ export class MonitorPipeline {
         }
         this.queue.push(finding);
     }
-    /** Sends queued findings in batches; a "retry" outcome keeps the batch for the next flush. */
-    async flush(send) {
+    /**
+     * Sends queued findings in batches; a "retry" outcome keeps the batch for the next flush.
+     * `force` (shutdown, the SDK's flush({ force })) also sends roll-ups still collecting.
+     */
+    async flush(send, options = {}) {
         if (this.suppressed && Math.floor(this.now() / FLOOD_WINDOW_MS) !== this.floodBucket)
             this.emitSuppressed();
+        this.emitRollups(this.now(), Boolean(options.force));
         while (this.queue.length) {
             const batch = this.queue.splice(0, BATCH_SIZE);
             if ((await send(batch)) === "retry") {