instar 0.28.106 → 0.28.108

package/dist/monitoring/AttributionResolver.d.ts

@@ -0,0 +1,46 @@
+/**
+ * AttributionResolver — read-side resolver for the burn-detection system.
+ *
+ * Phase 2 of docs/specs/token-burn-detection-and-self-heal.md.
+ *
+ * Pure function: given the shape of a TokenLedger event (sessionId, cwd,
+ * prompt text, model) returns an attribution_key suitable for grouping
+ * "calls of the same structural origin." Used by the Phase 3 BurnDetector
+ * to populate attribution_key for events the Phase 1 chokepoint did NOT
+ * write directly — chiefly the dominant Claude-CLI path where the JSONL
+ * trail carries the prompt and cwd but no source-side label.
+ *
+ * Authority shape: this is signal-only. It does not gate, throttle, or
+ * decide anything. It maps event → key. The detector emits, the
+ * Remediator decides. See umbrella spec §"Signal-vs-Authority Decomposition".
+ *
+ * No I/O, no time-dependent behavior — deterministic for tests + reasoning.
+ */
+export interface AttributionEvent {
+    sessionId: string;
+    /** cwd / projectPath field from the JSONL line. */
+    projectPath?: string | null;
+    /** The user prompt that triggered the assistant response. Optional — when missing, resolver falls back to cwd / unknown. */
+    prompt?: string | null;
+    /** Model string from the JSONL line (`message.model`). */
+    model?: string | null;
+}
+/**
+ * Resolve an attribution_key for an event.
+ *
+ * Resolution order:
+ *   1. Manifest entry that matches the prompt (with optional cwd / model
+ *      narrowing) → `<component>::<promptFingerprint>`.
+ *   2. cwd-based scheduled-job inference — if the cwd contains a path
+ *      segment like `.instar/jobs/<name>`, return `user-job:<name>`.
+ *   3. cwd-based user-extension inference — if the cwd contains
+ *      `.claude/hooks/` or `.instar/hooks/`, return the hook filename.
+ *   4. Fallback: `unknown::<sessionId-prefix>`.
+ *
+ * The prompt-based check is intentionally first: it's the most informative
+ * signal for the bleed-detection use case (one prompt shape running tens
+ * of thousands of times). cwd-based inference is the secondary signal for
+ * cases where the prompt is variable but the source is recognisable.
+ */
+export declare function resolveAttribution(event: AttributionEvent): string;
+//# sourceMappingURL=AttributionResolver.d.ts.map

package/dist/monitoring/AttributionResolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AttributionResolver.d.ts","sourceRoot":"","sources":["../../src/monitoring/AttributionResolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,4HAA4H;IAC5H,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,CAgClE"}

package/dist/monitoring/AttributionResolver.js

@@ -0,0 +1,107 @@
+/**
+ * AttributionResolver — read-side resolver for the burn-detection system.
+ *
+ * Phase 2 of docs/specs/token-burn-detection-and-self-heal.md.
+ *
+ * Pure function: given the shape of a TokenLedger event (sessionId, cwd,
+ * prompt text, model) returns an attribution_key suitable for grouping
+ * "calls of the same structural origin." Used by the Phase 3 BurnDetector
+ * to populate attribution_key for events the Phase 1 chokepoint did NOT
+ * write directly — chiefly the dominant Claude-CLI path where the JSONL
+ * trail carries the prompt and cwd but no source-side label.
+ *
+ * Authority shape: this is signal-only. It does not gate, throttle, or
+ * decide anything. It maps event → key. The detector emits, the
+ * Remediator decides. See umbrella spec §"Signal-vs-Authority Decomposition".
+ *
+ * No I/O, no time-dependent behavior — deterministic for tests + reasoning.
+ */
+import { buildAttributionKey } from './attributionKey.js';
+import { ATTRIBUTION_MANIFEST } from './attribution-manifest.js';
+/**
+ * Resolve an attribution_key for an event.
+ *
+ * Resolution order:
+ *   1. Manifest entry that matches the prompt (with optional cwd / model
+ *      narrowing) → `<component>::<promptFingerprint>`.
+ *   2. cwd-based scheduled-job inference — if the cwd contains a path
+ *      segment like `.instar/jobs/<name>`, return `user-job:<name>`.
+ *   3. cwd-based user-extension inference — if the cwd contains
+ *      `.claude/hooks/` or `.instar/hooks/`, return the hook filename.
+ *   4. Fallback: `unknown::<sessionId-prefix>`.
+ *
+ * The prompt-based check is intentionally first: it's the most informative
+ * signal for the bleed-detection use case (one prompt shape running tens
+ * of thousands of times). cwd-based inference is the secondary signal for
+ * cases where the prompt is variable but the source is recognisable.
+ */
+export function resolveAttribution(event) {
+    // 1. Manifest-based prompt match (with optional cwd/model narrowing).
+    if (event.prompt && event.prompt.length > 0) {
+        for (const entry of ATTRIBUTION_MANIFEST) {
+            if (matchesEntry(entry, event)) {
+                return buildAttributionKey(entry.component, event.prompt);
+            }
+        }
+    }
+    // 2. Scheduled-job inference: a path segment of the cwd is the job name.
+    //    e.g. /Users/x/.instar/jobs/daily-summary → user-job:daily-summary
+    if (event.projectPath) {
+        const jobMatch = event.projectPath.match(/[/\\]\.instar[/\\]jobs[/\\]([^/\\]+)/);
+        if (jobMatch && jobMatch[1]) {
+            return `user-job:${jobMatch[1]}::${shortPromptFp(event.prompt)}`;
+        }
+        // 3. Hook / extension inference.
+        const hookMatch = event.projectPath.match(/[/\\](?:\.claude|\.instar)[/\\]hooks[/\\]([^/\\]+)/);
+        if (hookMatch && hookMatch[1]) {
+            return `user-hook:${hookMatch[1]}::${shortPromptFp(event.prompt)}`;
+        }
+    }
+    // 4. Fallback. Use a stable session-id prefix so a single misbehaving
+    //    session shows as one key (and not exploded by per-prompt fingerprint).
+    if (!event.sessionId || event.sessionId.length === 0) {
+        return 'unknown::no-session';
+    }
+    const sidPrefix = event.sessionId.slice(0, 8);
+    return `unknown::${sidPrefix}`;
+}
+function matchesEntry(entry, event) {
+    // Prompt must match if patterns are defined (Phase 2 always defines them).
+    if (entry.promptPatterns && entry.promptPatterns.length > 0) {
+        if (!event.prompt)
+            return false;
+        const hit = entry.promptPatterns.some((re) => re.test(event.prompt));
+        if (!hit)
+            return false;
+    }
+    // Optional cwd narrowing.
+    if (entry.cwdPatterns && entry.cwdPatterns.length > 0) {
+        if (!event.projectPath)
+            return false;
+        const hit = entry.cwdPatterns.some((re) => re.test(event.projectPath));
+        if (!hit)
+            return false;
+    }
+    // Optional model narrowing.
+    if (entry.modelHints && entry.modelHints.length > 0) {
+        if (!event.model)
+            return false;
+        const hit = entry.modelHints.some((m) => event.model.includes(m));
+        if (!hit)
+            return false;
+    }
+    return true;
+}
+function shortPromptFp(prompt) {
+    if (!prompt || prompt.length === 0)
+        return 'nonprompt';
+    // Cheap deterministic fingerprint without importing crypto on every call.
+    // Phase 1's buildAttributionKey covers the cryptographic case; here we
+    // only need to disambiguate prompts at the user-job / user-hook level.
+    let h = 0;
+    const slice = prompt.slice(0, 128);
+    for (let i = 0; i < slice.length; i++)
+        h = ((h << 5) - h + slice.charCodeAt(i)) | 0;
+    return (h >>> 0).toString(16).padStart(8, '0').slice(0, 8);
+}
+//# sourceMappingURL=AttributionResolver.js.map

package/dist/monitoring/AttributionResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AttributionResolver.js","sourceRoot":"","sources":["../../src/monitoring/AttributionResolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAA2B,MAAM,2BAA2B,CAAC;AAY1F;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAuB;IACxD,sEAAsE;IACtE,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,KAAK,MAAM,KAAK,IAAI,oBAAoB,EAAE,CAAC;YACzC,IAAI,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC/B,OAAO,mBAAmB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,uEAAuE;IACvE,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACjF,IAAI,QAAQ,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5B,OAAO,YAAY,QAAQ,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,CAAC;QAED,iCAAiC;QACjC,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAC;QAChG,IAAI,SAAS,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9B,OAAO,aAAa,SAAS,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACrE,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,4EAA4E;IAC5E,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9C,OAAO,YAAY,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,YAAY,CAAC,KAAyB,EAAE,KAAuB;IACtE,2EAA2E;IAC3E,IAAI,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAChC,MAAM,GAAG,GAAG,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAO,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;IACzB,CAAC;IACD,0BAA0B;IAC1B,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtD,IAAI,CAAC,KAAK,CAAC,WAAW;YAAE,OAAO,KAAK,CAAC;QACrC,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,WAAY,CAAC,CAAC,CAAC;QACxE,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;IACzB,CAAC;IACD,4BAA4B;IAC5B,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,KAAK,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QAC/B,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,KAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;IACzB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,MAAiC;IACtD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC;IACvD,0EAA0E;IAC1E,uEAAuE;IACvE,uEAAuE;IACvE,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACpF,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC7D,CAAC"}

package/dist/monitoring/BurnDetector.d.ts

@@ -0,0 +1,84 @@
+/**
+ * BurnDetector — emits a structured signal when a single attribution_key
+ * crosses configured spend thresholds.
+ *
+ * Phase 3 of docs/specs/token-burn-detection-and-self-heal.md.
+ *
+ * Signal-only (per umbrella spec §"Signal-vs-Authority Decomposition"): the
+ * detector emits to the existing DegradationReporter. The Phase 4 runbook
+ * (Tier-2 Remediator surface) is the only authority that decides whether
+ * to alert / throttle / both. The BurnDetector cannot decide anything.
+ *
+ * Triggers (OR'd):
+ *   1. Absolute share — a single attribution_key consumed > absoluteShareThreshold
+ *      of total 24h spend.
+ *   2. Baseline divergence — the key's last-1h rate is > rollingBaselineMultiplier ×
+ *      its trailing-7-day median rate, AND the 1h rate exceeds rollingBaselineFloor
+ *      tokens/h.
+ *
+ * Cold-start (per umbrella spec §"Threshold logic"): the baseline-divergence
+ * trigger only fires after a key has been observed for 7 days. Until then,
+ * absolute-share is the only signal — that's the trigger that would have
+ * caught the 2026-05-15 incident.
+ *
+ * Polling cadence: 60s, decoupled from the ledger writer. The detector does
+ * its own clock (injected `now`) so tests don't need to fake timers globally.
+ */
+import type { TokenLedger } from './TokenLedger.js';
+import type { DegradationReporter } from './DegradationReporter.js';
+export interface BurnDetectionConfig {
+    enabled: boolean;
+    /** Default 0.25 (25%). */
+    absoluteShareThreshold: number;
+    /** Default 2 (2x). */
+    rollingBaselineMultiplier: number;
+    /** Default 10_000_000 tokens/hour. */
+    rollingBaselineFloor: number;
+    /** Per-key alert cooldown (default 3_600_000ms = 1h). */
+    perKeyAlertCooldownMs: number;
+    /** Poll interval (default 60_000ms = 60s). */
+    pollIntervalMs: number;
+    /** Cold-start duration (default 7d). Baseline-divergence trigger disabled until elapsed. */
+    coldStartMs: number;
+}
+export declare const DEFAULT_BURN_DETECTION_CONFIG: BurnDetectionConfig;
+export interface BurnSignal {
+    attributionKey: string;
+    trigger: 'absolute-share' | 'baseline-divergence';
+    emittedAt: string;
+    observed: {
+        tokens24h: number;
+        share24h: number;
+        tokensLast1h: number;
+        projectedDaily: number;
+    };
+    /** Trailing-7d median tokens/h. Only populated for `baseline-divergence`. */
+    baselineMedian7d?: number;
+}
+export interface BurnDetectorDeps {
+    ledger: Pick<TokenLedger, 'byAttributionKey' | 'summary'>;
+    reporter: Pick<DegradationReporter, 'report'>;
+    config?: Partial<BurnDetectionConfig>;
+    /** Injectable clock for tests. Defaults to `Date.now`. */
+    now?: () => number;
+}
+export declare class BurnDetector {
+    private readonly ledger;
+    private readonly reporter;
+    private readonly config;
+    private readonly now;
+    /** First time a given attribution_key was seen. Used for cold-start cutoff. */
+    private readonly firstSeen;
+    /** Last alert emit time per key — gates per-key alert cooldown. */
+    private readonly lastAlertAt;
+    private timer;
+    constructor(deps: BurnDetectorDeps);
+    start(): void;
+    stop(): void;
+    /**
+     * One detector cycle. Returns the signals emitted on this tick — useful
+     * for tests, and the production loop ignores the return.
+     */
+    tick(): BurnSignal[];
+}
+//# sourceMappingURL=BurnDetector.d.ts.map

package/dist/monitoring/BurnDetector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BurnDetector.d.ts","sourceRoot":"","sources":["../../src/monitoring/BurnDetector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAqB,MAAM,kBAAkB,CAAC;AACvE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAEpE,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,0BAA0B;IAC1B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,sBAAsB;IACtB,yBAAyB,EAAE,MAAM,CAAC;IAClC,sCAAsC;IACtC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,yDAAyD;IACzD,qBAAqB,EAAE,MAAM,CAAC;IAC9B,8CAA8C;IAC9C,cAAc,EAAE,MAAM,CAAC;IACvB,4FAA4F;IAC5F,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,eAAO,MAAM,6BAA6B,EAAE,mBAQ3C,CAAC;AAEF,MAAM,WAAW,UAAU;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,gBAAgB,GAAG,qBAAqB,CAAC;IAClD,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE;QACR,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,6EAA6E;IAC7E,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,kBAAkB,GAAG,SAAS,CAAC,CAAC;IAC1D,QAAQ,EAAE,IAAI,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC;IAC9C,MAAM,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACtC,0DAA0D;IAC1D,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;IACpD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+B;IACxD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsB;IAC7C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,+EAA+E;IAC/E,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA6B;IACvD,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IACzD,OAAO,CAAC,KAAK,CAA+C;gBAEhD,IAAI,EAAE,gBAAgB;IAOlC,KAAK,IAAI,IAAI;IAgBb,IAAI,IAAI,IAAI;IAOZ;;;OAGG;IACH,IAAI,IAAI,UAAU,EAAE;CAkGrB"}

package/dist/monitoring/BurnDetector.js

@@ -0,0 +1,169 @@
+/**
+ * BurnDetector — emits a structured signal when a single attribution_key
+ * crosses configured spend thresholds.
+ *
+ * Phase 3 of docs/specs/token-burn-detection-and-self-heal.md.
+ *
+ * Signal-only (per umbrella spec §"Signal-vs-Authority Decomposition"): the
+ * detector emits to the existing DegradationReporter. The Phase 4 runbook
+ * (Tier-2 Remediator surface) is the only authority that decides whether
+ * to alert / throttle / both. The BurnDetector cannot decide anything.
+ *
+ * Triggers (OR'd):
+ *   1. Absolute share — a single attribution_key consumed > absoluteShareThreshold
+ *      of total 24h spend.
+ *   2. Baseline divergence — the key's last-1h rate is > rollingBaselineMultiplier ×
+ *      its trailing-7-day median rate, AND the 1h rate exceeds rollingBaselineFloor
+ *      tokens/h.
+ *
+ * Cold-start (per umbrella spec §"Threshold logic"): the baseline-divergence
+ * trigger only fires after a key has been observed for 7 days. Until then,
+ * absolute-share is the only signal — that's the trigger that would have
+ * caught the 2026-05-15 incident.
+ *
+ * Polling cadence: 60s, decoupled from the ledger writer. The detector does
+ * its own clock (injected `now`) so tests don't need to fake timers globally.
+ */
+export const DEFAULT_BURN_DETECTION_CONFIG = {
+    enabled: true,
+    absoluteShareThreshold: 0.25,
+    rollingBaselineMultiplier: 2,
+    rollingBaselineFloor: 10_000_000,
+    perKeyAlertCooldownMs: 3_600_000,
+    pollIntervalMs: 60_000,
+    coldStartMs: 7 * 24 * 60 * 60 * 1000,
+};
+export class BurnDetector {
+    ledger;
+    reporter;
+    config;
+    now;
+    /** First time a given attribution_key was seen. Used for cold-start cutoff. */
+    firstSeen = new Map();
+    /** Last alert emit time per key — gates per-key alert cooldown. */
+    lastAlertAt = new Map();
+    timer = null;
+    constructor(deps) {
+        this.ledger = deps.ledger;
+        this.reporter = deps.reporter;
+        this.config = { ...DEFAULT_BURN_DETECTION_CONFIG, ...(deps.config ?? {}) };
+        this.now = deps.now ?? (() => Date.now());
+    }
+    start() {
+        if (!this.config.enabled || this.timer)
+            return;
+        this.timer = setInterval(() => {
+            try {
+                this.tick();
+            }
+            catch (err) {
+                console.warn(`[burn-detector] tick error (non-fatal): ${err.message}`);
+            }
+        }, this.config.pollIntervalMs);
+        // Prevent the interval from keeping the process alive on its own — the
+        // server's lifecycle owns shutdown.
+        if (this.timer && typeof this.timer.unref === 'function') {
+            this.timer.unref();
+        }
+    }
+    stop() {
+        if (this.timer) {
+            clearInterval(this.timer);
+            this.timer = null;
+        }
+    }
+    /**
+     * One detector cycle. Returns the signals emitted on this tick — useful
+     * for tests, and the production loop ignores the return.
+     */
+    tick() {
+        if (!this.config.enabled)
+            return [];
+        const now = this.now();
+        const since24h = now - 24 * 60 * 60 * 1000;
+        const since1h = now - 60 * 60 * 1000;
+        const since7d = now - 7 * 24 * 60 * 60 * 1000;
+        const keys24h = this.ledger.byAttributionKey({ sinceMs: since24h });
+        if (keys24h.length === 0)
+            return [];
+        const total24h = keys24h.reduce((sum, k) => sum + k.totalTokens, 0);
+        if (total24h <= 0)
+            return [];
+        // Update first-seen map.
+        for (const k of keys24h) {
+            if (!this.firstSeen.has(k.attributionKey)) {
+                this.firstSeen.set(k.attributionKey, k.firstTs);
+            }
+        }
+        const signals = [];
+        const keys1h = this.ledger.byAttributionKey({ sinceMs: since1h });
+        const keys1hMap = new Map(keys1h.map((k) => [k.attributionKey, k]));
+        for (const key24h of keys24h) {
+            const share = key24h.totalTokens / total24h;
+            const key1h = keys1hMap.get(key24h.attributionKey);
+            const tokens1h = key1h ? key1h.totalTokens : 0;
+            const projectedDaily = tokens1h * 24;
+            // Skip exempt runbook self-attribution prefix (defence in depth — Phase 4
+            // runbook also exempts itself at the gate level).
+            if (key24h.attributionKey.startsWith('burn-throttle-runbook::'))
+                continue;
+            // Cooldown.
+            const lastAlert = this.lastAlertAt.get(key24h.attributionKey) ?? 0;
+            if (now - lastAlert < this.config.perKeyAlertCooldownMs)
+                continue;
+            let trigger = null;
+            let baselineMedian7d;
+            // Trigger 1 — absolute share.
+            if (share > this.config.absoluteShareThreshold) {
+                trigger = 'absolute-share';
+            }
+            // Trigger 2 — baseline divergence (only after cold-start window).
+            if (!trigger) {
+                const firstSeen = this.firstSeen.get(key24h.attributionKey) ?? key24h.firstTs;
+                if (now - firstSeen >= this.config.coldStartMs && tokens1h >= this.config.rollingBaselineFloor) {
+                    // 7-day median rate (tokens/h). Use the simple per-key 7d total / 168
+                    // as a proxy when the table doesn't store hourly buckets — Phase 4 may
+                    // refine to a true median.
+                    const keys7d = this.ledger.byAttributionKey({ sinceMs: since7d });
+                    const key7d = keys7d.find((k) => k.attributionKey === key24h.attributionKey);
+                    if (key7d) {
+                        baselineMedian7d = key7d.totalTokens / (7 * 24);
+                        if (tokens1h > this.config.rollingBaselineMultiplier * baselineMedian7d) {
+                            trigger = 'baseline-divergence';
+                        }
+                    }
+                }
+            }
+            if (!trigger)
+                continue;
+            const signal = {
+                attributionKey: key24h.attributionKey,
+                trigger,
+                emittedAt: new Date(now).toISOString(),
+                observed: {
+                    tokens24h: key24h.totalTokens,
+                    share24h: share,
+                    tokensLast1h: tokens1h,
+                    projectedDaily,
+                },
+                baselineMedian7d,
+            };
+            signals.push(signal);
+            this.lastAlertAt.set(key24h.attributionKey, now);
+            // Emit to DegradationReporter. The runbook in Phase 4 will subscribe via
+            // the existing Remediator dispatch and decide alert vs throttle.
+            this.reporter.report({
+                feature: 'token-burn-detection',
+                primary: `attribution_key ${key24h.attributionKey} sustained spend within thresholds`,
+                fallback: `signal-only: detector flagged the key (Phase 4 runbook will decide alert vs throttle)`,
+                reason: trigger === 'absolute-share'
+                    ? `${key24h.attributionKey} consumed ${(share * 100).toFixed(1)}% of 24h spend (threshold ${(this.config.absoluteShareThreshold * 100).toFixed(0)}%)`
+                    : `${key24h.attributionKey} last-1h rate ${tokens1h.toLocaleString()} tok/h, baseline ${baselineMedian7d?.toLocaleString() ?? '?'} tok/h (multiplier ${this.config.rollingBaselineMultiplier}x)`,
+                impact: `Projected ${projectedDaily.toLocaleString()} tokens in next 24h at current rate. ` +
+                    `Phase 3 is observation-only; Phase 4 wires alerting and bounded auto-throttle.`,
+            });
+        }
+        return signals;
+    }
+}
+//# sourceMappingURL=BurnDetector.js.map

package/dist/monitoring/BurnDetector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BurnDetector.js","sourceRoot":"","sources":["../../src/monitoring/BurnDetector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAqBH,MAAM,CAAC,MAAM,6BAA6B,GAAwB;IAChE,OAAO,EAAE,IAAI;IACb,sBAAsB,EAAE,IAAI;IAC5B,yBAAyB,EAAE,CAAC;IAC5B,oBAAoB,EAAE,UAAU;IAChC,qBAAqB,EAAE,SAAS;IAChC,cAAc,EAAE,MAAM;IACtB,WAAW,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;CACrC,CAAC;AAwBF,MAAM,OAAO,YAAY;IACN,MAAM,CAA6B;IACnC,QAAQ,CAA+B;IACvC,MAAM,CAAsB;IAC5B,GAAG,CAAe;IACnC,+EAA+E;IAC9D,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvD,mEAAmE;IAClD,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IACjD,KAAK,GAA0C,IAAI,CAAC;IAE5D,YAAY,IAAsB;QAChC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,6BAA6B,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3E,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK;QACH,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO;QAC/C,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC;gBACH,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,IAAI,CAAC,2CAA4C,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YACpF,CAAC;QACH,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAC/B,uEAAuE;QACvE,oCAAoC;QACpC,IAAI,IAAI,CAAC,KAAK,IAAI,OAAQ,IAAI,CAAC,KAAgC,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YACpF,IAAI,CAAC,KAA+B,CAAC,KAAK,EAAE,CAAC;QAChD,CAAC;IACH,CAAC;IAED,IAAI;QACF,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QACpB,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,IAAI;QACF,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QAC3C,MAAM,OAAO,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QACrC,MAAM,OAAO,GAAG,GAAG,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QAE9C,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QACpE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QACpE,IAAI,QAAQ,IAAI,CAAC;YAAE,OAAO,EAAE,CAAC;QAE7B,yBAAyB;QACzB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC1C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAiB,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAClE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAEpE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,GAAG,QAAQ,CAAC;YAC5C,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;YACnD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/C,MAAM,cAAc,GAAG,QAAQ,GAAG,EAAE,CAAC;YAErC,0EAA0E;YAC1E,kDAAkD;YAClD,IAAI,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,yBAAyB,CAAC;gBAAE,SAAS;YAE1E,YAAY;YACZ,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YACnE,IAAI,GAAG,GAAG,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,qBAAqB;gBAAE,SAAS;YAElE,IAAI,OAAO,GAAiC,IAAI,CAAC;YACjD,IAAI,gBAAoC,CAAC;YAEzC,8BAA8B;YAC9B,IAAI,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAC;gBAC/C,OAAO,GAAG,gBAAgB,CAAC;YAC7B,CAAC;YAED,kEAAkE;YAClE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC;gBAC9E,IAAI,GAAG,GAAG,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;oBAC/F,sEAAsE;oBACtE,uEAAuE;oBACvE,2BAA2B;oBAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;oBAClE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc,CAAC,CAAC;oBAC7E,IAAI,KAAK,EAAE,CAAC;wBACV,gBAAgB,GAAG,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;wBAChD,IAAI,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,yBAAyB,GAAG,gBAAgB,EAAE,CAAC;4BACxE,OAAO,GAAG,qBAAqB,CAAC;wBAClC,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAED,IAAI,CAAC,OAAO;gBAAE,SAAS;YAEvB,MAAM,MAAM,GAAe;gBACzB,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,OAAO;gBACP,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;gBACtC,QAAQ,EAAE;oBACR,SAAS,EAAE,MAAM,CAAC,WAAW;oBAC7B,QAAQ,EAAE,KAAK;oBACf,YAAY,EAAE,QAAQ;oBACtB,cAAc;iBACf;gBACD,gBAAgB;aACjB,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;YAEjD,yEAAyE;YACzE,iEAAiE;YACjE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACnB,OAAO,EAAE,sBAAsB;gBAC/B,OAAO,EAAE,mBAAmB,MAAM,CAAC,cAAc,oCAAoC;gBACrF,QAAQ,EAAE,uFAAuF;gBACjG,MAAM,EACJ,OAAO,KAAK,gBAAgB;oBAC1B,CAAC,CAAC,GAAG,MAAM,CAAC,cAAc,aAAa,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,6BAA6B,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;oBACrJ,CAAC,CAAC,GAAG,MAAM,CAAC,cAAc,iBAAiB,QAAQ,CAAC,cAAc,EAAE,oBAAoB,gBAAgB,EAAE,cAAc,EAAE,IAAI,GAAG,sBAAsB,IAAI,CAAC,MAAM,CAAC,yBAAyB,IAAI;gBACpM,MAAM,EACJ,aAAa,cAAc,CAAC,cAAc,EAAE,uCAAuC;oBACnF,gFAAgF;aACnF,CAAC,CAAC;QACL,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}

package/dist/monitoring/BurnThrottleRunbook.d.ts

@@ -0,0 +1,97 @@
+/**
+ * BurnThrottleRunbook — Tier-2 authority surface for burn-detection signals.
+ *
+ * Phase 4 of docs/specs/token-burn-detection-and-self-heal.md. This is the
+ * ONLY blocking surface in the burn-detection pipeline. The BurnDetector
+ * (Phase 3) emits structured signals via DegradationReporter; this runbook
+ * subscribes via the existing handler hook and decides:
+ *   - alert-only (default for `unknown::*` keys and any caller config disables)
+ *   - throttle (default for known component names)
+ *   - both (the umbrella spec's primary policy)
+ *
+ * Authority shape (per umbrella spec §"Signal-vs-Authority Decomposition"):
+ * the runbook is the only piece in this pipeline with blocking authority.
+ * The detector emits; the gate enforces; the runbook decides.
+ *
+ * Self-reinforcing-loop guard: the runbook never throttles a key starting
+ * with `burn-throttle-runbook::*` — defence-in-depth (the gate also refuses
+ * to install such throttles, the detector also exempts the prefix). This
+ * three-layer guard is from the convergence audit.
+ */
+import { LlmRateGate, type InstalledThrottle } from './LlmRateGate.js';
+import type { DegradationEvent } from './DegradationReporter.js';
+export interface BurnThrottleConfig {
+    /** Whether to auto-throttle (true) or alert-only (false). Default true. */
+    autoThrottle: boolean;
+    /**
+     * Whether to auto-throttle keys with no known component (`unknown::*`).
+     * Default false — the umbrella spec is conservative here: an unknown key
+     * may be a user extension the agent doesn't recognise, and throttling
+     * something the agent doesn't understand can break user workflows.
+     * Operators opt in to auto-throttle on unknown explicitly.
+     */
+    autoThrottleOnUnknown: boolean;
+    /** Throttle duration (default 60min). */
+    throttleDurationMs: number;
+}
+export declare const DEFAULT_BURN_THROTTLE_CONFIG: BurnThrottleConfig;
+export type RunbookOutcomeKind = 'alert-only-unknown' | 'alert-only-config-disabled' | 'alert-only-self-attribution' | 'throttle-installed' | 'throttle-failed';
+export interface RunbookOutcome {
+    kind: RunbookOutcomeKind;
+    attributionKey: string;
+    decidedAt: string;
+    trigger: string;
+    /** When kind === 'throttle-installed', the actually-installed throttle. */
+    throttle?: InstalledThrottle;
+    /** Free-text reason for the decision. */
+    reason: string;
+}
+/** Telegram emit function. Phase 5 upgrades to principal-bound buttons. */
+export type TelegramAlertSender = (topicId: number, text: string) => void | Promise<void>;
+export interface BurnThrottleRunbookDeps {
+    gate: LlmRateGate;
+    config?: Partial<BurnThrottleConfig>;
+    /** Telegram emit. Optional — when missing, decisions still happen, just no alert. */
+    sendTelegram?: TelegramAlertSender;
+    /** Telegram topic ID for alerts. */
+    alertTopicId?: number;
+    /** Injectable clock for tests. */
+    now?: () => number;
+}
+/** Identity tag the runbook uses when installing throttles. */
+export declare const RUNBOOK_ISSUER = "burn-throttle-runbook";
+export declare class BurnThrottleRunbook {
+    private readonly gate;
+    private readonly config;
+    private readonly sendTelegram;
+    private readonly alertTopicId;
+    private readonly now;
+    constructor(deps: BurnThrottleRunbookDeps);
+    /**
+     * Handle a burn-detection signal. Called from a subscriber hook on
+     * DegradationReporter for feature='token-burn-detection' events.
+     *
+     * Returns the outcome so tests + audit + the verification step (Phase 6)
+     * can inspect what happened.
+     */
+    handle(event: DegradationEvent): RunbookOutcome;
+    private fireTelegram;
+}
+/**
+ * Extract the attribution key from a burn-detection DegradationEvent. The
+ * BurnDetector formats the `primary` field as "attribution_key <KEY>
+ * sustained spend within thresholds" — we parse it back here. The wire
+ * shape is internal to the burn-detection pipeline; if it changes, change
+ * both ends in the same PR.
+ */
+export declare function extractAttributionKey(event: DegradationEvent): string;
+/**
+ * Extract the trigger label from the event's reason field. Returns
+ * 'absolute-share' or 'baseline-divergence' or 'unknown-trigger'.
+ */
+export declare function extractTrigger(event: DegradationEvent): string;
+/** Is the attribution key one of the unknown::* fallback shapes? */
+export declare function isUnknownKey(attributionKey: string): boolean;
+/** Compose the ELI16 alert text for Telegram. No backticks, no camelCase config keys, narrative tone. */
+export declare function composeAlertText(event: DegradationEvent, attributionKey: string, trigger: string): string;
+//# sourceMappingURL=BurnThrottleRunbook.d.ts.map

package/dist/monitoring/BurnThrottleRunbook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BurnThrottleRunbook.d.ts","sourceRoot":"","sources":["../../src/monitoring/BurnThrottleRunbook.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,WAAW,EAAE,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,YAAY,EAAE,OAAO,CAAC;IACtB;;;;;;OAMG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAC/B,yCAAyC;IACzC,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,eAAO,MAAM,4BAA4B,EAAE,kBAI1C,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAC1B,oBAAoB,GACpB,4BAA4B,GAC5B,6BAA6B,GAC7B,oBAAoB,GACpB,iBAAiB,CAAC;AAEtB,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,kBAAkB,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,2EAA2E;AAC3E,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1F,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACrC,qFAAqF;IACrF,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,oCAAoC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kCAAkC;IAClC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,+DAA+D;AAC/D,eAAO,MAAM,cAAc,0BAA0B,CAAC;AAEtD,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAc;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;IAC5C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAkC;IAC/D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,IAAI,EAAE,uBAAuB;IAQzC;;;;;;OAMG;IACH,MAAM,CAAC,KAAK,EAAE,gBAAgB,GAAG,cAAc;IA8F/C,OAAO,CAAC,YAAY;CAYrB;AAID;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,CAGrE;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,CAI9D;AAED,oEAAoE;AACpE,wBAAgB,YAAY,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAE5D;AAED,yGAAyG;AACzG,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAazG"}