log10x-mcp 1.0.0

package/build/lib/format.js

@@ -0,0 +1,90 @@
+/**
+ * Output formatting helpers.
+ *
+ * Plain text, not markdown. Dollar amounts are prominent.
+ * Designed for AI consumption — concise, structured, parseable.
+ */
+/** Format a dollar amount: $1.2K, $14K, $1.2M, etc. */
+export function fmtDollar(amount) {
+    const abs = Math.abs(amount);
+    const sign = amount < 0 ? '-' : '';
+    if (abs < 1)
+        return `${sign}$${abs.toFixed(2)}`;
+    if (abs < 10)
+        return `${sign}$${abs.toFixed(1)}`;
+    if (abs < 1000)
+        return `${sign}$${Math.round(abs)}`;
+    if (abs < 10000)
+        return `${sign}$${(abs / 1000).toFixed(1)}K`;
+    if (abs < 1000000)
+        return `${sign}$${Math.round(abs / 1000)}K`;
+    return `${sign}$${(abs / 1000000).toFixed(1)}M`;
+}
+/** Format bytes as human-readable: 1.2 GB, 450 MB, etc. */
+export function fmtBytes(bytes) {
+    const abs = Math.abs(bytes);
+    if (abs < 1024)
+        return `${Math.round(abs)} B`;
+    if (abs < 1024 * 1024)
+        return `${(abs / 1024).toFixed(1)} KB`;
+    if (abs < 1024 * 1024 * 1024)
+        return `${(abs / (1024 * 1024)).toFixed(1)} MB`;
+    if (abs < 1024 * 1024 * 1024 * 1024)
+        return `${(abs / (1024 * 1024 * 1024)).toFixed(1)} GB`;
+    return `${(abs / (1024 * 1024 * 1024 * 1024)).toFixed(1)} TB`;
+}
+/** Format event count: 1.2B, 450M, 12K, etc. */
+export function fmtCount(count) {
+    const abs = Math.abs(count);
+    if (abs < 1000)
+        return `${Math.round(abs)}`;
+    if (abs < 1000000)
+        return `${(abs / 1000).toFixed(abs < 10000 ? 1 : 0)}K`;
+    if (abs < 1000000000)
+        return `${(abs / 1000000).toFixed(abs < 10000000 ? 1 : 0)}M`;
+    return `${(abs / 1000000000).toFixed(1)}B`;
+}
+/** Format a pattern name for display: replace underscores with spaces. */
+export function fmtPattern(pattern) {
+    return pattern.replace(/_/g, ' ');
+}
+/** Format severity: first 4 chars uppercase. */
+export function fmtSeverity(sev) {
+    return sev.toUpperCase().slice(0, 4);
+}
+/** Format a percentage. */
+export function fmtPct(value) {
+    if (value < 1)
+        return `${value.toFixed(1)}%`;
+    return `${Math.round(value)}%`;
+}
+/** Parse a timeframe string (1d, 7d, 30d) into a Timeframe config. */
+export function parseTimeframe(input) {
+    const match = input.match(/^(\d+)d$/);
+    if (!match)
+        throw new Error(`Invalid timeframe: ${input}`);
+    const days = parseInt(match[1], 10);
+    if (days < 1 || days > 90)
+        throw new Error(`Timeframe must be 1-90 days, got ${days}`);
+    let label;
+    if (days === 1)
+        label = 'last 24h';
+    else if (days === 7)
+        label = 'this week';
+    else
+        label = `last ${days}d`;
+    // Baseline: 3 prior windows of same size
+    const baselineOffsets = [days, days * 2, days * 3];
+    return { days, range: `${days}d`, label, baselineOffsets };
+}
+/** Cost period label for output. */
+export function costPeriodLabel(days) {
+    if (days === 1)
+        return '/day';
+    if (days === 7)
+        return '/wk';
+    if (days === 30)
+        return '/mo';
+    return `/${days}d`;
+}
+//# sourceMappingURL=format.js.map

package/build/lib/format.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"format.js","sourceRoot":"","sources":["../../src/lib/format.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,uDAAuD;AACvD,MAAM,UAAU,SAAS,CAAC,MAAc;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAEnC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,GAAG,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAChD,IAAI,GAAG,GAAG,EAAE;QAAE,OAAO,GAAG,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,IAAI,GAAG,GAAG,IAAI;QAAE,OAAO,GAAG,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;IACpD,IAAI,GAAG,GAAG,KAAK;QAAE,OAAO,GAAG,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;IAC9D,IAAI,GAAG,GAAG,OAAO;QAAE,OAAO,GAAG,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IAC/D,OAAO,GAAG,IAAI,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;AAClD,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC5B,IAAI,GAAG,GAAG,IAAI;QAAE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;IAC9C,IAAI,GAAG,GAAG,IAAI,GAAG,IAAI;QAAE,OAAO,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9D,IAAI,GAAG,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI;QAAE,OAAO,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9E,IAAI,GAAG,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI;QAAE,OAAO,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5F,OAAO,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;AAChE,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC5B,IAAI,GAAG,GAAG,IAAI;QAAE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;IAC5C,IAAI,GAAG,GAAG,OAAO;QAAE,OAAO,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC1E,IAAI,GAAG,GAAG,UAAU;QAAE,OAAO,GAAG,CAAC,GAAG,GAAG,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACnF,OAAO,GAAG,CAAC,GAAG,GAAG,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;AAC7C,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,UAAU,CAAC,OAAe;IACxC,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AACpC,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,2BAA2B;AAC3B,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;IAC7C,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC;AACjC,CAAC;AAUD,sEAAsE;AACtE,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACtC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,KAAK,EAAE,CAAC,CAAC;IAE3D,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACpC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,IAAI,EAAE,CAAC,CAAC;IAEvF,IAAI,KAAa,CAAC;IAClB,IAAI,IAAI,KAAK,CAAC;QAAE,KAAK,GAAG,UAAU,CAAC;SAC9B,IAAI,IAAI,KAAK,CAAC;QAAE,KAAK,GAAG,WAAW,CAAC;;QACpC,KAAK,GAAG,QAAQ,IAAI,GAAG,CAAC;IAE7B,yCAAyC;IACzC,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;IAEnD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;AAC7D,CAAC;AAED,oCAAoC;AACpC,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IAC9B,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAC9B,OAAO,IAAI,IAAI,GAAG,CAAC;AACrB,CAAC"}

package/build/lib/gates.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Cost driver gates.
+ *
+ * A pattern is a cost driver only if BOTH gates pass:
+ * 1. Dollar delta > minDollarPerWeek (default $500/wk)
+ * 2. Contribution > minContributionPct of total positive delta (default 5%)
+ *
+ * These are business rules, not statistical constants.
+ * Ported from SlackPatternService.java.
+ */
+export interface PatternWithDelta {
+    delta: number;
+}
+export interface GateConfig {
+    minDollarPerWeek: number;
+    minContributionPct: number;
+}
+export declare const DEFAULT_GATES: GateConfig;
+/**
+ * Filters patterns through cost driver gates.
+ * Returns only patterns that pass both the dollar floor and contribution % gate.
+ */
+export declare function applyCostDriverGates<T extends PatternWithDelta>(patterns: T[], totalPositiveDelta: number, gates?: GateConfig): T[];

package/build/lib/gates.js

@@ -0,0 +1,29 @@
+/**
+ * Cost driver gates.
+ *
+ * A pattern is a cost driver only if BOTH gates pass:
+ * 1. Dollar delta > minDollarPerWeek (default $500/wk)
+ * 2. Contribution > minContributionPct of total positive delta (default 5%)
+ *
+ * These are business rules, not statistical constants.
+ * Ported from SlackPatternService.java.
+ */
+export const DEFAULT_GATES = {
+    minDollarPerWeek: 500,
+    minContributionPct: 5,
+};
+/**
+ * Filters patterns through cost driver gates.
+ * Returns only patterns that pass both the dollar floor and contribution % gate.
+ */
+export function applyCostDriverGates(patterns, totalPositiveDelta, gates = DEFAULT_GATES) {
+    return patterns.filter(p => {
+        if (p.delta <= 0)
+            return false;
+        const passesDollar = p.delta >= gates.minDollarPerWeek;
+        const passesContrib = totalPositiveDelta > 0
+            && (p.delta / totalPositiveDelta) * 100 >= gates.minContributionPct;
+        return passesDollar && passesContrib;
+    });
+}
+//# sourceMappingURL=gates.js.map

package/build/lib/gates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gates.js","sourceRoot":"","sources":["../../src/lib/gates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAWH,MAAM,CAAC,MAAM,aAAa,GAAe;IACvC,gBAAgB,EAAE,GAAG;IACrB,kBAAkB,EAAE,CAAC;CACtB,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAa,EACb,kBAA0B,EAC1B,QAAoB,aAAa;IAEjC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;QACzB,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/B,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,gBAAgB,CAAC;QACvD,MAAM,aAAa,GAAG,kBAAkB,GAAG,CAAC;eACvC,CAAC,CAAC,CAAC,KAAK,GAAG,kBAAkB,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,kBAAkB,CAAC;QACtE,OAAO,YAAY,IAAI,aAAa,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/build/lib/promql.d.ts

@@ -0,0 +1,43 @@
+/**
+ * PromQL query builders.
+ *
+ * Generates the PromQL queries used by each tool, matching the patterns
+ * in SlackPatternService.java.
+ */
+export declare const LABELS: {
+    readonly pattern: "message_pattern";
+    readonly service: "tenx_user_service";
+    readonly severity: "severity_level";
+    readonly env: "tenx_env";
+};
+/** Bytes per pattern for a time window, with optional offset in days. */
+export declare function bytesPerPattern(filters: Record<string, string>, env: string, range: string, offsetDays?: number): string;
+/** Event count per pattern for a time window. */
+export declare function eventsPerPattern(filters: Record<string, string>, env: string, range: string): string;
+/** Event count per service for a specific pattern. */
+export declare function eventsPerServiceForPattern(pattern: string, env: string, range: string): string;
+/** Top N patterns by bytes across all services. */
+export declare function topPatterns(env: string, range: string, limit: number): string;
+/** Bytes per service for a specific pattern. */
+export declare function patternAcrossServices(pattern: string, env: string, range: string, offsetDays?: number): string;
+/** Total bytes for a time window. */
+export declare function totalBytes(env: string, range: string): string;
+/** Bytes per service. */
+export declare function bytesPerService(env: string, range: string): string;
+/** Bytes per severity. */
+export declare function bytesPerSeverity(env: string, range: string): string;
+/** Pattern bytes over time (for range queries / trends). */
+export declare function patternBytesOverTime(pattern: string, env: string, step: string): string;
+/** Probe: does edge env have data? */
+export declare function edgeProbe(): string;
+/** Probe: does edge env have data for specific filters? */
+export declare function edgeProbeFiltered(filters: Record<string, string>): string;
+/** Pipeline instance count. */
+export declare function pipelineUp(): string;
+/** Distinct services with data. */
+export declare function distinctServices(range: string): string;
+export declare function regulatorInput(range: string): string;
+export declare function regulatorOutput(range: string): string;
+export declare function optimizerInput(range: string): string;
+export declare function optimizerOutput(range: string): string;
+export declare function streamerIndexed(range: string): string;

package/build/lib/promql.js

@@ -0,0 +1,99 @@
+/**
+ * PromQL query builders.
+ *
+ * Generates the PromQL queries used by each tool, matching the patterns
+ * in SlackPatternService.java.
+ */
+const BYTES_METRIC = 'all_events_summaryBytes_total';
+const VOLUME_METRIC = 'all_events_summaryVolume_total';
+export const LABELS = {
+    pattern: 'message_pattern',
+    service: 'tenx_user_service',
+    severity: 'severity_level',
+    env: 'tenx_env',
+};
+function escapeLabel(value) {
+    return value.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+}
+function buildSelector(filters, env) {
+    const parts = [];
+    for (const [key, value] of Object.entries(filters)) {
+        parts.push(`${key}="${escapeLabel(value)}"`);
+    }
+    parts.push(`${LABELS.env}="${env}"`);
+    return parts.join(',');
+}
+/** Bytes per pattern for a time window, with optional offset in days. */
+export function bytesPerPattern(filters, env, range, offsetDays) {
+    const offset = offsetDays ? ` offset ${offsetDays}d` : '';
+    const selector = buildSelector(filters, env);
+    return `sum by (${LABELS.pattern}, ${LABELS.service}, ${LABELS.severity}) (increase(${BYTES_METRIC}{${selector}}[${range}]${offset}))`;
+}
+/** Event count per pattern for a time window. */
+export function eventsPerPattern(filters, env, range) {
+    const selector = buildSelector(filters, env);
+    return `sum by (${LABELS.pattern}) (increase(${VOLUME_METRIC}{${selector}}[${range}]))`;
+}
+/** Event count per service for a specific pattern. */
+export function eventsPerServiceForPattern(pattern, env, range) {
+    return `sum by (${LABELS.service}) (increase(${VOLUME_METRIC}{${LABELS.pattern}="${escapeLabel(pattern)}",${LABELS.env}="${env}"}[${range}]))`;
+}
+/** Top N patterns by bytes across all services. */
+export function topPatterns(env, range, limit) {
+    return `topk(${limit}, sum by (${LABELS.pattern}, ${LABELS.service}, ${LABELS.severity}) (increase(${BYTES_METRIC}{${LABELS.env}="${env}"}[${range}])))`;
+}
+/** Bytes per service for a specific pattern. */
+export function patternAcrossServices(pattern, env, range, offsetDays) {
+    const offset = offsetDays ? ` offset ${offsetDays}d` : '';
+    return `sum by (${LABELS.service}, ${LABELS.severity}) (increase(${BYTES_METRIC}{${LABELS.pattern}="${escapeLabel(pattern)}",${LABELS.env}="${env}"}[${range}]${offset}))`;
+}
+/** Total bytes for a time window. */
+export function totalBytes(env, range) {
+    return `sum(increase(${BYTES_METRIC}{${LABELS.env}="${env}"}[${range}]))`;
+}
+/** Bytes per service. */
+export function bytesPerService(env, range) {
+    return `sort_desc(sum by (${LABELS.service}) (increase(${BYTES_METRIC}{${LABELS.env}="${env}"}[${range}])))`;
+}
+/** Bytes per severity. */
+export function bytesPerSeverity(env, range) {
+    return `sum by (${LABELS.severity}) (increase(${BYTES_METRIC}{${LABELS.env}="${env}"}[${range}]))`;
+}
+/** Pattern bytes over time (for range queries / trends). */
+export function patternBytesOverTime(pattern, env, step) {
+    return `sum by (${LABELS.pattern}) (increase(${BYTES_METRIC}{${LABELS.env}="${env}",${LABELS.pattern}="${escapeLabel(pattern)}"}[${step}]))`;
+}
+/** Probe: does edge env have data? */
+export function edgeProbe() {
+    return `count(increase(${BYTES_METRIC}{${LABELS.env}="edge"}[7d]) > 0)`;
+}
+/** Probe: does edge env have data for specific filters? */
+export function edgeProbeFiltered(filters) {
+    const selector = buildSelector(filters, 'edge');
+    return `count(increase(${BYTES_METRIC}{${selector}}[7d]) > 0)`;
+}
+/** Pipeline instance count. */
+export function pipelineUp() {
+    return 'count(tenx_pipeline_up)';
+}
+/** Distinct services with data. */
+export function distinctServices(range) {
+    return `count(count by (${LABELS.service}) (increase(${BYTES_METRIC}[${range}]) > 0))`;
+}
+// ── Savings queries (regulator, optimizer, streamer) ──
+export function regulatorInput(range) {
+    return `sum(increase(${BYTES_METRIC}{tenx_app="regulator",${LABELS.env}="edge"}[${range}]))`;
+}
+export function regulatorOutput(range) {
+    return `sum(increase(${BYTES_METRIC}{tenx_app=~"regulator|optimizer",${LABELS.env}="edge"}[${range}]))`;
+}
+export function optimizerInput(range) {
+    return `sum(increase(${BYTES_METRIC}{tenx_app="optimizer",tenx_env="edge",tenx_stage="input"}[${range}]))`;
+}
+export function optimizerOutput(range) {
+    return `sum(increase(${BYTES_METRIC}{tenx_app="optimizer",tenx_env="edge",tenx_stage="output"}[${range}]))`;
+}
+export function streamerIndexed(range) {
+    return `sum(increase(${BYTES_METRIC}{tenx_app="streamer",${LABELS.env}="cloud"}[${range}]))`;
+}
+//# sourceMappingURL=promql.js.map

package/build/lib/promql.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"promql.js","sourceRoot":"","sources":["../../src/lib/promql.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,YAAY,GAAG,+BAA+B,CAAC;AACrD,MAAM,aAAa,GAAG,gCAAgC,CAAC;AAEvD,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,OAAO,EAAE,iBAAiB;IAC1B,OAAO,EAAE,mBAAmB;IAC5B,QAAQ,EAAE,gBAAgB;IAC1B,GAAG,EAAE,UAAU;CACP,CAAC;AAEX,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,aAAa,CAAC,OAA+B,EAAE,GAAW;IACjE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,GAAG,KAAK,GAAG,GAAG,CAAC,CAAC;IACrC,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,eAAe,CAC7B,OAA+B,EAC/B,GAAW,EACX,KAAa,EACb,UAAmB;IAEnB,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,WAAW,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC7C,OAAO,WAAW,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,QAAQ,eAAe,YAAY,IAAI,QAAQ,KAAK,KAAK,IAAI,MAAM,IAAI,CAAC;AACzI,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,gBAAgB,CAC9B,OAA+B,EAC/B,GAAW,EACX,KAAa;IAEb,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC7C,OAAO,WAAW,MAAM,CAAC,OAAO,eAAe,aAAa,IAAI,QAAQ,KAAK,KAAK,KAAK,CAAC;AAC1F,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,0BAA0B,CACxC,OAAe,EACf,GAAW,EACX,KAAa;IAEb,OAAO,WAAW,MAAM,CAAC,OAAO,eAAe,aAAa,IAAI,MAAM,CAAC,OAAO,KAAK,WAAW,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC,GAAG,KAAK,GAAG,MAAM,KAAK,KAAK,CAAC;AACjJ,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,KAAa,EAAE,KAAa;IACnE,OAAO,QAAQ,KAAK,aAAa,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,QAAQ,eAAe,YAAY,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG,MAAM,KAAK,MAAM,CAAC;AAC3J,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,qBAAqB,CACnC,OAAe,EACf,GAAW,EACX,KAAa,EACb,UAAmB;IAEnB,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,WAAW,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,OAAO,WAAW,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,QAAQ,eAAe,YAAY,IAAI,MAAM,CAAC,OAAO,KAAK,WAAW,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC,GAAG,KAAK,GAAG,MAAM,KAAK,IAAI,MAAM,IAAI,CAAC;AAC7K,CAAC;AAED,qCAAqC;AACrC,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,KAAa;IACnD,OAAO,gBAAgB,YAAY,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG,MAAM,KAAK,KAAK,CAAC;AAC5E,CAAC;AAED,yBAAyB;AACzB,MAAM,UAAU,eAAe,CAAC,GAAW,EAAE,KAAa;IACxD,OAAO,qBAAqB,MAAM,CAAC,OAAO,eAAe,YAAY,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG,MAAM,KAAK,MAAM,CAAC;AAC/G,CAAC;AAED,0BAA0B;AAC1B,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,KAAa;IACzD,OAAO,WAAW,MAAM,CAAC,QAAQ,eAAe,YAAY,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG,MAAM,KAAK,KAAK,CAAC;AACrG,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,GAAW,EACX,IAAY;IAEZ,OAAO,WAAW,MAAM,CAAC,OAAO,eAAe,YAAY,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG,KAAK,MAAM,CAAC,OAAO,KAAK,WAAW,CAAC,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC;AAC/I,CAAC;AAED,sCAAsC;AACtC,MAAM,UAAU,SAAS;IACvB,OAAO,kBAAkB,YAAY,IAAI,MAAM,CAAC,GAAG,oBAAoB,CAAC;AAC1E,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,iBAAiB,CAAC,OAA+B;IAC/D,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAChD,OAAO,kBAAkB,YAAY,IAAI,QAAQ,aAAa,CAAC;AACjE,CAAC;AAED,+BAA+B;AAC/B,MAAM,UAAU,UAAU;IACxB,OAAO,yBAAyB,CAAC;AACnC,CAAC;AAED,mCAAmC;AACnC,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,mBAAmB,MAAM,CAAC,OAAO,eAAe,YAAY,IAAI,KAAK,UAAU,CAAC;AACzF,CAAC;AAED,yDAAyD;AAEzD,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,gBAAgB,YAAY,yBAAyB,MAAM,CAAC,GAAG,YAAY,KAAK,KAAK,CAAC;AAC/F,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,gBAAgB,YAAY,oCAAoC,MAAM,CAAC,GAAG,YAAY,KAAK,KAAK,CAAC;AAC1G,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,gBAAgB,YAAY,6DAA6D,KAAK,KAAK,CAAC;AAC7G,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,gBAAgB,YAAY,8DAA8D,KAAK,KAAK,CAAC;AAC9G,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,gBAAgB,YAAY,wBAAwB,MAAM,CAAC,GAAG,aAAa,KAAK,KAAK,CAAC;AAC/F,CAAC"}

package/build/lib/resolve-env.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Edge/cloud environment resolution.
+ *
+ * Prefers edge reporter metrics when available, falls back to cloud.
+ * Matches resolveEnv/resolveEnvAll in SlackPatternService.java.
+ */
+import type { EnvConfig } from './environments.js';
+/** Resolve whether to use edge or cloud metrics (global). */
+export declare function resolveMetricsEnv(env: EnvConfig): Promise<'edge' | 'cloud'>;
+/** Resolve whether to use edge or cloud metrics for specific filters. */
+export declare function resolveMetricsEnvFiltered(env: EnvConfig, filters: Record<string, string>): Promise<'edge' | 'cloud'>;

package/build/lib/resolve-env.js

@@ -0,0 +1,35 @@
+/**
+ * Edge/cloud environment resolution.
+ *
+ * Prefers edge reporter metrics when available, falls back to cloud.
+ * Matches resolveEnv/resolveEnvAll in SlackPatternService.java.
+ */
+import { queryInstant } from './api.js';
+import * as pql from './promql.js';
+/** Resolve whether to use edge or cloud metrics (global). */
+export async function resolveMetricsEnv(env) {
+    try {
+        const res = await queryInstant(env, pql.edgeProbe());
+        if (res.status === 'success' && res.data.result.length > 0) {
+            return 'edge';
+        }
+    }
+    catch {
+        // fall through to cloud
+    }
+    return 'cloud';
+}
+/** Resolve whether to use edge or cloud metrics for specific filters. */
+export async function resolveMetricsEnvFiltered(env, filters) {
+    try {
+        const res = await queryInstant(env, pql.edgeProbeFiltered(filters));
+        if (res.status === 'success' && res.data.result.length > 0) {
+            return 'edge';
+        }
+    }
+    catch {
+        // fall through to cloud
+    }
+    return 'cloud';
+}
+//# sourceMappingURL=resolve-env.js.map

package/build/lib/resolve-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-env.js","sourceRoot":"","sources":["../../src/lib/resolve-env.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AAEnC,6DAA6D;AAC7D,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAc;IACpD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;QACrD,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3D,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,wBAAwB;IAC1B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,GAAc,EACd,OAA+B;IAE/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;QACpE,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3D,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,wBAAwB;IAC1B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/build/resources/status.d.ts

@@ -0,0 +1,7 @@
+/**
+ * log10x://status resource — pipeline health summary.
+ *
+ * AI assistants can read this for context before answering questions.
+ */
+import type { EnvConfig } from '../lib/environments.js';
+export declare function getStatus(env: EnvConfig): Promise<string>;

package/build/resources/status.js

@@ -0,0 +1,37 @@
+/**
+ * log10x://status resource — pipeline health summary.
+ *
+ * AI assistants can read this for context before answering questions.
+ */
+import { queryInstant } from '../lib/api.js';
+import * as pql from '../lib/promql.js';
+import { parsePrometheusValue, bytesToGb } from '../lib/cost.js';
+import { fmtBytes } from '../lib/format.js';
+import { resolveMetricsEnv } from '../lib/resolve-env.js';
+export async function getStatus(env) {
+    const metricsEnv = await resolveMetricsEnv(env);
+    const [pipeRes, svcRes, volRes] = await Promise.all([
+        queryInstant(env, pql.pipelineUp()).catch(() => null),
+        queryInstant(env, pql.distinctServices('24h')).catch(() => null),
+        queryInstant(env, pql.totalBytes(metricsEnv, '24h')).catch(() => null),
+    ]);
+    const pipelines = pipeRes?.data?.result?.[0] ? Math.round(parsePrometheusValue(pipeRes.data.result[0])) : 0;
+    const services = svcRes?.data?.result?.[0] ? Math.round(parsePrometheusValue(svcRes.data.result[0])) : 0;
+    const vol24h = volRes?.data?.result?.[0] ? parsePrometheusValue(volRes.data.result[0]) : 0;
+    const lines = [];
+    lines.push('Log10x Pipeline Status');
+    lines.push('');
+    if (pipelines > 0 || services > 0 || vol24h > 0) {
+        lines.push(`  Pipeline instances: ${pipelines}`);
+        lines.push(`  Services monitored: ${services}`);
+        lines.push(`  Volume (24h): ${fmtBytes(vol24h)} (${bytesToGb(vol24h).toFixed(1)} GB)`);
+        lines.push('');
+        lines.push('  Status: active');
+    }
+    else {
+        lines.push('  No pipeline data available.');
+        lines.push('  Data appears after the first 24h of collection.');
+    }
+    return lines.join('\n');
+}
+//# sourceMappingURL=status.js.map

package/build/resources/status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../../src/resources/status.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,GAAG,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAc;IAC5C,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAClD,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;QACrD,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;QAChE,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,UAAU,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;KACvE,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5G,MAAM,QAAQ,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzG,MAAM,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAE3F,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACrC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,IAAI,SAAS,GAAG,CAAC,IAAI,QAAQ,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,KAAK,CAAC,IAAI,CAAC,yBAAyB,SAAS,EAAE,CAAC,CAAC;QACjD,KAAK,CAAC,IAAI,CAAC,yBAAyB,QAAQ,EAAE,CAAC,CAAC;QAChD,KAAK,CAAC,IAAI,CAAC,mBAAmB,QAAQ,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACvF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACjC,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAC5C,KAAK,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/build/tools/cost-drivers.d.ts

@@ -0,0 +1,28 @@
+/**
+ * log10x_cost_drivers — the core attribution tool.
+ *
+ * Finds patterns whose cost increase exceeds both the dollar floor
+ * and contribution gate, ranked by delta. Equivalent to `/log10x {service}`.
+ *
+ * Algorithm (ported from SlackPatternService.java):
+ * 1. Query current window bytes per pattern
+ * 2. Query 3 baseline windows (offset N, 2N, 3N days)
+ * 3. Compute delta = current cost - avg baseline cost
+ * 4. Filter: delta > $500/wk AND delta/totalDelta > 5%
+ * 5. Sort by delta descending
+ */
+import { z } from 'zod';
+import type { EnvConfig } from '../lib/environments.js';
+export declare const costDriversSchema: {
+    service: z.ZodOptional<z.ZodString>;
+    timeRange: z.ZodDefault<z.ZodEnum<["1d", "7d", "30d"]>>;
+    limit: z.ZodDefault<z.ZodNumber>;
+    analyzerCost: z.ZodOptional<z.ZodNumber>;
+    environment: z.ZodOptional<z.ZodString>;
+};
+export declare function executeCostDrivers(args: {
+    service?: string;
+    timeRange: string;
+    limit: number;
+    analyzerCost: number;
+}, env: EnvConfig): Promise<string>;

package/build/tools/cost-drivers.js

@@ -0,0 +1,142 @@
+/**
+ * log10x_cost_drivers — the core attribution tool.
+ *
+ * Finds patterns whose cost increase exceeds both the dollar floor
+ * and contribution gate, ranked by delta. Equivalent to `/log10x {service}`.
+ *
+ * Algorithm (ported from SlackPatternService.java):
+ * 1. Query current window bytes per pattern
+ * 2. Query 3 baseline windows (offset N, 2N, 3N days)
+ * 3. Compute delta = current cost - avg baseline cost
+ * 4. Filter: delta > $500/wk AND delta/totalDelta > 5%
+ * 5. Sort by delta descending
+ */
+import { z } from 'zod';
+import { queryInstant } from '../lib/api.js';
+import * as pql from '../lib/promql.js';
+import { LABELS } from '../lib/promql.js';
+import { bytesToCost, parsePrometheusValue } from '../lib/cost.js';
+import { applyCostDriverGates, DEFAULT_GATES } from '../lib/gates.js';
+import { resolveMetricsEnv, resolveMetricsEnvFiltered } from '../lib/resolve-env.js';
+import { fmtDollar, fmtPattern, fmtSeverity, fmtCount, parseTimeframe, costPeriodLabel } from '../lib/format.js';
+export const costDriversSchema = {
+    service: z.string().optional().describe("Service name to filter (e.g., 'checkout'). Omit for all services."),
+    timeRange: z.enum(['1d', '7d', '30d']).default('7d').describe('Time range to analyze'),
+    limit: z.number().min(1).max(20).default(10).describe('Max patterns to return'),
+    analyzerCost: z.number().optional().describe('SIEM ingestion cost in $/GB. Auto-detected from your profile if omitted.'),
+    environment: z.string().optional().describe('Environment nickname (for multi-env setups)'),
+};
+export async function executeCostDrivers(args, env) {
+    const tf = parseTimeframe(args.timeRange);
+    const costPerGb = args.analyzerCost;
+    const period = costPeriodLabel(tf.days);
+    const filters = {};
+    if (args.service)
+        filters[LABELS.service] = args.service;
+    // Resolve edge vs cloud
+    const metricsEnv = Object.keys(filters).length > 0
+        ? await resolveMetricsEnvFiltered(env, filters)
+        : await resolveMetricsEnv(env);
+    // Query 1: current window
+    const currentRes = await queryInstant(env, pql.bytesPerPattern(filters, metricsEnv, tf.range));
+    if (currentRes.status !== 'success' || currentRes.data.result.length === 0) {
+        return 'No pattern data available. Patterns appear after the first 24h of data collection.';
+    }
+    const currentByHash = new Map();
+    for (const r of currentRes.data.result) {
+        const hash = r.metric[LABELS.pattern];
+        if (!hash)
+            continue;
+        currentByHash.set(hash, {
+            service: r.metric[LABELS.service] || '',
+            severity: r.metric[LABELS.severity] || '',
+            bytes: parsePrometheusValue(r),
+        });
+    }
+    // Queries 2-4: baseline windows (3 prior periods)
+    const baselineByHash = new Map();
+    for (const offsetDays of tf.baselineOffsets) {
+        const baseRes = await queryInstant(env, pql.bytesPerPattern(filters, metricsEnv, tf.range, offsetDays));
+        if (baseRes.status === 'success') {
+            for (const r of baseRes.data.result) {
+                const hash = r.metric[LABELS.pattern];
+                if (!hash)
+                    continue;
+                const arr = baselineByHash.get(hash) || [];
+                arr.push(parsePrometheusValue(r));
+                baselineByHash.set(hash, arr);
+            }
+        }
+    }
+    // Query 5: event counts
+    const eventsRes = await queryInstant(env, pql.eventsPerPattern(filters, metricsEnv, tf.range));
+    const eventsByHash = new Map();
+    if (eventsRes.status === 'success') {
+        for (const r of eventsRes.data.result) {
+            const hash = r.metric[LABELS.pattern];
+            if (hash)
+                eventsByHash.set(hash, parsePrometheusValue(r));
+        }
+    }
+    // Build patterns with cost + delta
+    const allPatterns = [];
+    let totalPositiveDelta = 0;
+    for (const [hash, row] of currentByHash) {
+        const costNow = bytesToCost(row.bytes, costPerGb);
+        const baseWeeks = baselineByHash.get(hash) || [];
+        const isNew = baseWeeks.length === 0;
+        const costBaseline = isNew ? 0 : bytesToCost(baseWeeks.reduce((a, b) => a + b, 0) / baseWeeks.length, costPerGb);
+        const delta = costNow - costBaseline;
+        allPatterns.push({
+            hash, service: row.service, severity: row.severity,
+            costNow, costBaseline, delta, isNew,
+            events: eventsByHash.get(hash) || 0,
+        });
+        if (delta > 0)
+            totalPositiveDelta += delta;
+    }
+    // Sort by delta descending
+    allPatterns.sort((a, b) => b.delta - a.delta);
+    // Apply cost driver gates
+    const drivers = applyCostDriverGates(allPatterns, totalPositiveDelta, DEFAULT_GATES);
+    // Format output
+    const lines = [];
+    const displayName = args.service || 'all services';
+    if (drivers.length > 0) {
+        const driversCost = drivers.reduce((s, d) => s + d.costNow, 0);
+        const baselineCost = drivers.reduce((s, d) => s + d.costBaseline, 0);
+        lines.push(`${displayName} — ${fmtDollar(baselineCost)} → ${fmtDollar(driversCost)}${period} (${drivers.length} cost driver${drivers.length > 1 ? 's' : ''})`);
+        lines.push('');
+        for (let i = 0; i < Math.min(drivers.length, args.limit); i++) {
+            const d = drivers[i];
+            const name = fmtPattern(d.hash).padEnd(35);
+            const costStr = `${fmtDollar(d.costBaseline)} → ${fmtDollar(d.costNow)}${period}`;
+            const sev = fmtSeverity(d.severity);
+            const newFlag = d.isNew ? '  NEW' : '';
+            const evtStr = d.events > 0 ? `  ${fmtCount(d.events)} events` : '';
+            lines.push(`#${i + 1}  ${name} ${costStr}   ${sev}${newFlag}${evtStr}`);
+        }
+        // Summary line
+        const driverPct = totalPositiveDelta > 0
+            ? Math.round((drivers.reduce((s, d) => s + d.delta, 0) / totalPositiveDelta) * 100)
+            : 0;
+        const stableCount = allPatterns.length - drivers.length;
+        lines.push('');
+        lines.push(`${drivers.length} driver${drivers.length > 1 ? 's' : ''} = ${driverPct}% of increase · ${stableCount} other pattern${stableCount !== 1 ? 's' : ''}`);
+    }
+    else {
+        // No drivers — show top patterns by current cost
+        lines.push(`${displayName} — no cost drivers detected (${tf.label})`);
+        lines.push(`All ${allPatterns.length} patterns are within normal range.`);
+        lines.push('');
+        lines.push(`Top patterns by current cost:`);
+        const top = allPatterns
+            .sort((a, b) => b.costNow - a.costNow)
+            .slice(0, Math.min(5, args.limit));
+        for (const p of top) {
+            lines.push(`  ${fmtPattern(p.hash).padEnd(35)} ${fmtDollar(p.costNow)}${period}   ${fmtSeverity(p.severity)}`);
+        }
+    }
+    return lines.join('\n');
+}
+//# sourceMappingURL=cost-drivers.js.map

package/build/tools/cost-drivers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cost-drivers.js","sourceRoot":"","sources":["../../src/tools/cost-drivers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,GAAG,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AACrF,OAAO,EACL,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAC5C,cAAc,EAAE,eAAe,EAChC,MAAM,kBAAkB,CAAC;AAE1B,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mEAAmE,CAAC;IAC5G,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC;IACtF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,wBAAwB,CAAC;IAC/E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0EAA0E,CAAC;IACxH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6CAA6C,CAAC;CAC3F,CAAC;AAaF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAKC,EACD,GAAc;IAEd,MAAM,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC;IACpC,MAAM,MAAM,GAAG,eAAe,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;IAExC,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;IAEzD,wBAAwB;IACxB,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC;QAChD,CAAC,CAAC,MAAM,yBAAyB,CAAC,GAAG,EAAE,OAAO,CAAC;QAC/C,CAAC,CAAC,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAEjC,0BAA0B;IAC1B,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/F,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3E,OAAO,oFAAoF,CAAC;IAC9F,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,GAAG,EAAgE,CAAC;IAC9F,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE;YACtB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE;YACvC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE;YACzC,KAAK,EAAE,oBAAoB,CAAC,CAAC,CAAC;SAC/B,CAAC,CAAC;IACL,CAAC;IAED,kDAAkD;IAClD,MAAM,cAAc,GAAG,IAAI,GAAG,EAAoB,CAAC;IACnD,KAAK,MAAM,UAAU,IAAI,EAAE,CAAC,eAAe,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;QACxG,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACpC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBACtC,IAAI,CAAC,IAAI;oBAAE,SAAS;gBACpB,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC3C,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC;gBAClC,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;IAED,wBAAwB;IACxB,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,gBAAgB,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/F,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC/C,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACtC,IAAI,IAAI;gBAAE,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,mCAAmC;IACnC,MAAM,WAAW,GAAc,EAAE,CAAC;IAClC,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAE3B,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,aAAa,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAClD,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC;QACrC,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAC1C,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,EACvD,SAAS,CACV,CAAC;QACF,MAAM,KAAK,GAAG,OAAO,GAAG,YAAY,CAAC;QAErC,WAAW,CAAC,IAAI,CAAC;YACf,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ;YAClD,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK;YACnC,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;SACpC,CAAC,CAAC;QAEH,IAAI,KAAK,GAAG,CAAC;YAAE,kBAAkB,IAAI,KAAK,CAAC;IAC7C,CAAC;IAED,2BAA2B;IAC3B,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IAE9C,0BAA0B;IAC1B,MAAM,OAAO,GAAG,oBAAoB,CAAC,WAAW,EAAE,kBAAkB,EAAE,aAAa,CAAC,CAAC;IAErF,gBAAgB;IAChB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC;IAEnD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC/D,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;QACrE,KAAK,CAAC,IAAI,CAAC,GAAG,WAAW,MAAM,SAAS,CAAC,YAAY,CAAC,MAAM,SAAS,CAAC,WAAW,CAAC,GAAG,MAAM,KAAK,OAAO,CAAC,MAAM,eAAe,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC/J,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC9D,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YACrB,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC3C,MAAM,OAAO,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC;YAClF,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACpC,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,OAAO,MAAM,GAAG,GAAG,OAAO,GAAG,MAAM,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED,eAAe;QACf,MAAM,SAAS,GAAG,kBAAkB,GAAG,CAAC;YACtC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,kBAAkB,CAAC,GAAG,GAAG,CAAC;YACnF,CAAC,CAAC,CAAC,CAAC;QACN,MAAM,WAAW,GAAG,WAAW,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QACxD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,UAAU,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,SAAS,mBAAmB,WAAW,iBAAiB,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnK,CAAC;SAAM,CAAC;QACN,iDAAiD;QACjD,KAAK,CAAC,IAAI,CAAC,GAAG,WAAW,gCAAgC,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC;QACtE,KAAK,CAAC,IAAI,CAAC,OAAO,WAAW,CAAC,MAAM,oCAAoC,CAAC,CAAC;QAC1E,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAE5C,MAAM,GAAG,GAAG,WAAW;aACpB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;aACrC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAErC,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACpB,KAAK,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,MAAM,MAAM,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACjH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/build/tools/dependency-check.d.ts

@@ -0,0 +1,22 @@
+/**
+ * log10x_dependency_check — generate a SIEM dependency scan command.
+ *
+ * Returns a bash command that downloads and runs a Python script to check
+ * if dashboards, alerts, or saved searches in the user's SIEM reference
+ * a given pattern. The command runs locally, read-only. No data sent to Log10x.
+ *
+ * Ported from GettingStarted.jsx depcheck section.
+ */
+import { z } from 'zod';
+export declare const dependencyCheckSchema: {
+    pattern: z.ZodString;
+    vendor: z.ZodEnum<["datadog", "splunk", "elasticsearch", "cloudwatch"]>;
+    service: z.ZodOptional<z.ZodString>;
+    severity: z.ZodOptional<z.ZodString>;
+};
+export declare function executeDependencyCheck(args: {
+    pattern: string;
+    vendor: string;
+    service?: string;
+    severity?: string;
+}): string;