log10x-mcp 1.0.0

package/build/tools/dependency-check.js

@@ -0,0 +1,80 @@
+/**
+ * log10x_dependency_check — generate a SIEM dependency scan command.
+ *
+ * Returns a bash command that downloads and runs a Python script to check
+ * if dashboards, alerts, or saved searches in the user's SIEM reference
+ * a given pattern. The command runs locally, read-only. No data sent to Log10x.
+ *
+ * Ported from GettingStarted.jsx depcheck section.
+ */
+import { z } from 'zod';
+export const dependencyCheckSchema = {
+    pattern: z.string().describe('Pattern name (e.g., "Payment_Gateway_Timeout")'),
+    vendor: z.enum(['datadog', 'splunk', 'elasticsearch', 'cloudwatch']).describe('SIEM vendor to scan'),
+    service: z.string().optional().describe('Service name to scope the scan'),
+    severity: z.string().optional().describe('Severity level'),
+};
+const VENDOR_CONFIG = {
+    datadog: {
+        label: 'Datadog',
+        script: 'siem-check-datadog.py',
+        envSetup: 'export DD_API_KEY="<YOUR_API_KEY>"\nexport DD_APP_KEY="<YOUR_APP_KEY>"',
+        envNote: 'Create an Application Key at: Organization Settings > Application Keys',
+    },
+    splunk: {
+        label: 'Splunk',
+        script: 'siem-check-splunk.py',
+        envSetup: 'export SPLUNK_URL="https://<YOUR_SPLUNK>:8089"\nexport SPLUNK_TOKEN="<YOUR_BEARER_TOKEN>"',
+        envNote: 'Create a token at: Settings > Tokens (requires user role)',
+    },
+    elasticsearch: {
+        label: 'Elasticsearch',
+        script: 'siem-check-elasticsearch.py',
+        envSetup: 'export ES_URL="https://<YOUR_ES>:9200"\nexport ES_API_KEY="<YOUR_API_KEY>"',
+        envNote: 'Create an API key at: Stack Management > API Keys',
+    },
+    cloudwatch: {
+        label: 'CloudWatch',
+        script: 'siem-check-cloudwatch.py',
+        envSetup: '# Uses standard AWS credentials (env vars, ~/.aws/credentials, or IAM role)\npip3 install boto3',
+        envNote: 'Requires: logs:Describe*, cloudwatch:Describe*, cloudwatch:GetDashboard',
+    },
+};
+export function executeDependencyCheck(args) {
+    const tokens = args.pattern.split('_').filter(t => t.length > 0);
+    const sev = (args.severity || '').toLowerCase();
+    const svc = args.service || '';
+    const vc = VENDOR_CONFIG[args.vendor];
+    if (!vc)
+        return `Unknown vendor: ${args.vendor}. Supported: ${Object.keys(VENDOR_CONFIG).join(', ')}`;
+    // Build script arguments
+    const scriptArgs = [];
+    if (svc)
+        scriptArgs.push(`--service "${svc}"`);
+    if (sev && sev !== 'uncl' && sev !== 'unclassified')
+        scriptArgs.push(`--severity "${sev}"`);
+    const kwTokens = tokens.filter(t => t.length > 3).slice(0, 5);
+    if (kwTokens.length > 0)
+        scriptArgs.push(`--keywords "${kwTokens.join(',')}"`);
+    const cmd = [
+        `# 1. Set credentials`,
+        vc.envSetup,
+        ``,
+        `# 2. Download and run`,
+        `curl -sO https://dl.log10x.com/siem-check/${vc.script}`,
+        `python3 ${vc.script} ${scriptArgs.join(' ')}`,
+    ].join('\n');
+    const lines = [];
+    lines.push(`Dependency Check — ${vc.label}`);
+    lines.push('');
+    lines.push(`Check if any dashboards, alerts, or saved searches in your ${vc.label} depend on this pattern before dropping it.`);
+    lines.push('');
+    lines.push(`Note: ${vc.envNote}`);
+    lines.push('');
+    lines.push(cmd);
+    lines.push('');
+    lines.push('Runs locally — reads your SIEM config (read-only). No data sent to Log10x.');
+    lines.push('Source: https://github.com/log-10x/siem-check');
+    return lines.join('\n');
+}
+//# sourceMappingURL=dependency-check.js.map

package/build/tools/dependency-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependency-check.js","sourceRoot":"","sources":["../../src/tools/dependency-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gDAAgD,CAAC;IAC9E,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC;IACpG,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;IACzE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC;CAC3D,CAAC;AAEF,MAAM,aAAa,GAKd;IACH,OAAO,EAAE;QACP,KAAK,EAAE,SAAS;QAChB,MAAM,EAAE,uBAAuB;QAC/B,QAAQ,EAAE,wEAAwE;QAClF,OAAO,EAAE,wEAAwE;KAClF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,sBAAsB;QAC9B,QAAQ,EAAE,2FAA2F;QACrG,OAAO,EAAE,2DAA2D;KACrE;IACD,aAAa,EAAE;QACb,KAAK,EAAE,eAAe;QACtB,MAAM,EAAE,6BAA6B;QACrC,QAAQ,EAAE,4EAA4E;QACtF,OAAO,EAAE,mDAAmD;KAC7D;IACD,UAAU,EAAE;QACV,KAAK,EAAE,YAAY;QACnB,MAAM,EAAE,0BAA0B;QAClC,QAAQ,EAAE,iGAAiG;QAC3G,OAAO,EAAE,yEAAyE;KACnF;CACF,CAAC;AAEF,MAAM,UAAU,sBAAsB,CAAC,IAKtC;IACC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;IAC/B,MAAM,EAAE,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAEtC,IAAI,CAAC,EAAE;QAAE,OAAO,mBAAmB,IAAI,CAAC,MAAM,gBAAgB,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAEtG,yBAAyB;IACzB,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,GAAG;QAAE,UAAU,CAAC,IAAI,CAAC,cAAc,GAAG,GAAG,CAAC,CAAC;IAC/C,IAAI,GAAG,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,cAAc;QAAE,UAAU,CAAC,IAAI,CAAC,eAAe,GAAG,GAAG,CAAC,CAAC;IAC5F,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,UAAU,CAAC,IAAI,CAAC,eAAe,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAE/E,MAAM,GAAG,GAAG;QACV,sBAAsB;QACtB,EAAE,CAAC,QAAQ;QACX,EAAE;QACF,uBAAuB;QACvB,6CAA6C,EAAE,CAAC,MAAM,EAAE;QACxD,WAAW,EAAE,CAAC,MAAM,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;KAC/C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;IAC7C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,8DAA8D,EAAE,CAAC,KAAK,6CAA6C,CAAC,CAAC;IAChI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAClC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC;IACzF,KAAK,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;IAE5D,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/build/tools/event-lookup.d.ts

@@ -0,0 +1,23 @@
+/**
+ * log10x_event_lookup — analyze a specific log pattern.
+ *
+ * Finds the pattern across all services, shows cost breakdown,
+ * and requests AI analysis. Equivalent to `/log10x event {pattern}`.
+ *
+ * Ported from SlackPatternService.queryPatternAcrossServices().
+ */
+import { z } from 'zod';
+import type { EnvConfig } from '../lib/environments.js';
+export declare const eventLookupSchema: {
+    pattern: z.ZodString;
+    service: z.ZodOptional<z.ZodString>;
+    timeRange: z.ZodDefault<z.ZodEnum<["1d", "7d", "30d"]>>;
+    analyzerCost: z.ZodOptional<z.ZodNumber>;
+    environment: z.ZodOptional<z.ZodString>;
+};
+export declare function executeEventLookup(args: {
+    pattern: string;
+    service?: string;
+    timeRange: string;
+    analyzerCost: number;
+}, env: EnvConfig): Promise<string>;

package/build/tools/event-lookup.js

@@ -0,0 +1,131 @@
+/**
+ * log10x_event_lookup — analyze a specific log pattern.
+ *
+ * Finds the pattern across all services, shows cost breakdown,
+ * and requests AI analysis. Equivalent to `/log10x event {pattern}`.
+ *
+ * Ported from SlackPatternService.queryPatternAcrossServices().
+ */
+import { z } from 'zod';
+import { queryInstant, queryAi } from '../lib/api.js';
+import * as pql from '../lib/promql.js';
+import { LABELS } from '../lib/promql.js';
+import { bytesToCost, parsePrometheusValue } from '../lib/cost.js';
+import { resolveMetricsEnv } from '../lib/resolve-env.js';
+import { fmtDollar, fmtPattern, fmtSeverity, fmtCount, parseTimeframe, costPeriodLabel } from '../lib/format.js';
+export const eventLookupSchema = {
+    pattern: z.string().describe('Pattern name or search term to look up (e.g., "Payment_Gateway_Timeout")'),
+    service: z.string().optional().describe('Service to scope the lookup'),
+    timeRange: z.enum(['1d', '7d', '30d']).default('7d').describe('Time range'),
+    analyzerCost: z.number().optional().describe('SIEM ingestion cost in $/GB'),
+    environment: z.string().optional().describe('Environment nickname'),
+};
+export async function executeEventLookup(args, env) {
+    const tf = parseTimeframe(args.timeRange);
+    const costPerGb = args.analyzerCost;
+    const period = costPeriodLabel(tf.days);
+    const metricsEnv = await resolveMetricsEnv(env);
+    // Current window: bytes per service for this pattern
+    const currentRes = await queryInstant(env, pql.patternAcrossServices(args.pattern, metricsEnv, tf.range));
+    if (currentRes.status !== 'success' || currentRes.data.result.length === 0) {
+        // Try fuzzy match with regex
+        const fuzzyPattern = args.pattern.replace(/[_ ]+/g, '.*');
+        const fuzzyQuery = `sum by (${LABELS.service}, ${LABELS.severity}) (increase(all_events_summaryBytes_total{${LABELS.pattern}=~"${fuzzyPattern}",${LABELS.env}="${metricsEnv}"}[${tf.range}]))`;
+        const fuzzyRes = await queryInstant(env, fuzzyQuery);
+        if (fuzzyRes.status !== 'success' || fuzzyRes.data.result.length === 0) {
+            return `No data found for pattern "${args.pattern}". Check the pattern name (use underscores, e.g., Payment_Gateway_Timeout).`;
+        }
+        // Use fuzzy results
+        return formatResults(fuzzyRes.data.result, args.pattern, metricsEnv, tf, costPerGb, period, env);
+    }
+    return formatResults(currentRes.data.result, args.pattern, metricsEnv, tf, costPerGb, period, env);
+}
+async function formatResults(results, pattern, metricsEnv, tf, costPerGb, period, env) {
+    // Aggregate bytes per service (multiple severity levels possible)
+    const serviceBytes = new Map();
+    const serviceSev = new Map();
+    for (const r of results) {
+        const svc = r.metric[LABELS.service] || '';
+        const sev = r.metric[LABELS.severity] || '';
+        const bytes = parsePrometheusValue(r);
+        serviceBytes.set(svc, (serviceBytes.get(svc) || 0) + bytes);
+        // Keep dominant severity
+        const current = serviceSev.get(svc);
+        if (!current || bytes > current.bytes) {
+            serviceSev.set(svc, { sev, bytes });
+        }
+    }
+    // Baseline per service
+    const baselineByService = new Map();
+    for (const offsetDays of tf.baselineOffsets) {
+        const baseRes = await queryInstant(env, pql.patternAcrossServices(pattern, metricsEnv, tf.range, offsetDays));
+        if (baseRes.status === 'success') {
+            for (const r of baseRes.data.result) {
+                const svc = r.metric[LABELS.service] || '';
+                const arr = baselineByService.get(svc) || [];
+                arr.push(parsePrometheusValue(r));
+                baselineByService.set(svc, arr);
+            }
+        }
+    }
+    // Event counts per service
+    const eventsRes = await queryInstant(env, pql.eventsPerServiceForPattern(pattern, metricsEnv, tf.range));
+    const eventsBySvc = new Map();
+    if (eventsRes.status === 'success') {
+        for (const r of eventsRes.data.result) {
+            const svc = r.metric[LABELS.service] || '';
+            eventsBySvc.set(svc, parsePrometheusValue(r));
+        }
+    }
+    const rows = [];
+    let totalCostNow = 0;
+    let totalCostBase = 0;
+    let totalEvents = 0;
+    for (const [svc, bytes] of serviceBytes) {
+        const costNow = bytesToCost(bytes, costPerGb);
+        const baseWeeks = baselineByService.get(svc) || [];
+        const isNew = baseWeeks.length === 0;
+        const costBase = isNew ? 0 : bytesToCost(baseWeeks.reduce((a, b) => a + b, 0) / baseWeeks.length, costPerGb);
+        const events = eventsBySvc.get(svc) || 0;
+        rows.push({ service: svc, severity: serviceSev.get(svc)?.sev || '', costNow, costBaseline: costBase, events, isNew });
+        totalCostNow += costNow;
+        totalCostBase += costBase;
+        totalEvents += events;
+    }
+    rows.sort((a, b) => b.costNow - a.costNow);
+    // Format output
+    const lines = [];
+    lines.push(`${fmtPattern(pattern)} — ${fmtDollar(totalCostBase)} → ${fmtDollar(totalCostNow)}${period}`);
+    lines.push('');
+    lines.push('Services:');
+    for (const r of rows) {
+        const svc = r.service.padEnd(15);
+        const sev = fmtSeverity(r.severity).padEnd(6);
+        const cost = `${fmtDollar(r.costNow)}${period}`;
+        const delta = `(${fmtDollar(r.costBaseline)} → ${fmtDollar(r.costNow)})`;
+        const events = r.events > 0 ? `  ${fmtCount(r.events)} events` : '';
+        const newFlag = r.isNew ? '  NEW' : '';
+        lines.push(`  ${svc} ${sev} ${cost.padEnd(12)} ${delta}${events}${newFlag}`);
+    }
+    // AI analysis
+    try {
+        const queryResultJson = JSON.stringify(results.slice(0, 5));
+        const aiPrompt = `Classify this log pattern and recommend an action. Pattern: ${pattern}. Provide: CATEGORY (error/debug/info/metric/health), CONFIDENCE (high/medium/low), ACTION (filter/keep/reduce), FILTER_PCT (% safe to filter), EXPLANATION (one line).`;
+        const aiResult = await queryAi(env, queryResultJson, aiPrompt, costPerGb);
+        if (aiResult) {
+            lines.push('');
+            lines.push('AI Analysis:');
+            for (const line of aiResult.split('\n')) {
+                if (line.trim())
+                    lines.push(`  ${line.trim()}`);
+            }
+        }
+    }
+    catch {
+        // AI analysis is optional — skip silently
+    }
+    lines.push('');
+    lines.push(`${rows.length} service${rows.length !== 1 ? 's' : ''} · ${fmtCount(totalEvents)} events`);
+    return lines.join('\n');
+}
+//# sourceMappingURL=event-lookup.js.map

package/build/tools/event-lookup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-lookup.js","sourceRoot":"","sources":["../../src/tools/event-lookup.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,GAAG,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EACL,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAC5C,cAAc,EAAE,eAAe,EAChC,MAAM,kBAAkB,CAAC;AAE1B,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,0EAA0E,CAAC;IACxG,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6BAA6B,CAAC;IACtE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;IAC3E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6BAA6B,CAAC;IAC3E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sBAAsB,CAAC;CACpE,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAoF,EACpF,GAAc;IAEd,MAAM,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC;IACpC,MAAM,MAAM,GAAG,eAAe,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAEhD,qDAAqD;IACrD,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IAE1G,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3E,6BAA6B;QAC7B,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC1D,MAAM,UAAU,GAAG,WAAW,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,QAAQ,6CAA6C,MAAM,CAAC,OAAO,MAAM,YAAY,KAAK,MAAM,CAAC,GAAG,KAAK,UAAU,MAAM,EAAE,CAAC,KAAK,KAAK,CAAC;QAC/L,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAErD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvE,OAAO,8BAA8B,IAAI,CAAC,OAAO,6EAA6E,CAAC;QACjI,CAAC;QACD,oBAAoB;QACpB,OAAO,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IACnG,CAAC;IAED,OAAO,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;AACrG,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,OAA4E,EAC5E,OAAe,EACf,UAAkB,EAClB,EAAqC,EACrC,SAAiB,EACjB,MAAc,EACd,GAAc;IAEd,kEAAkE;IAClE,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC/C,MAAM,UAAU,GAAG,IAAI,GAAG,EAA0C,CAAC;IAErE,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAC;QACtC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;QAC5D,yBAAyB;QACzB,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,OAAO,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;YACtC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAoB,CAAC;IACtD,KAAK,MAAM,UAAU,IAAI,EAAE,CAAC,eAAe,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,qBAAqB,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;QAC9G,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACpC,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;gBAC3C,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC7C,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC;gBAClC,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;IACH,CAAC;IAED,2BAA2B;IAC3B,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,0BAA0B,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IACzG,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC9C,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAC3C,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAOD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,WAAW,GAAG,CAAC,CAAC;IAEpB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,YAAY,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CACtC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,EACvD,SAAS,CACV,CAAC;QACF,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEzC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACtH,YAAY,IAAI,OAAO,CAAC;QACxB,aAAa,IAAI,QAAQ,CAAC;QAC1B,WAAW,IAAI,MAAM,CAAC;IACxB,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;IAE3C,gBAAgB;IAChB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,SAAS,CAAC,aAAa,CAAC,MAAM,SAAS,CAAC,YAAY,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC;IACzG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACxB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,IAAI,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;QACzE,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,GAAG,MAAM,GAAG,OAAO,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,cAAc;IACd,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,+DAA+D,OAAO,yKAAyK,CAAC;QACjQ,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,eAAe,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;QAE1E,IAAI,QAAQ,EAAE,CAAC;YACb,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAC3B,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxC,IAAI,IAAI,CAAC,IAAI,EAAE;oBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0CAA0C;IAC5C,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,WAAW,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,QAAQ,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAEtG,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/build/tools/exclusion-filter.d.ts

@@ -0,0 +1,21 @@
+/**
+ * log10x_exclusion_filter — generate SIEM/forwarder config to drop a pattern.
+ *
+ * Supports 14 vendors (4 SIEMs + 10 forwarders), with config and API modes
+ * where applicable. Ported from GettingStarted.jsx exclude section.
+ */
+import { z } from 'zod';
+export declare const exclusionFilterSchema: {
+    pattern: z.ZodString;
+    vendor: z.ZodEnum<["datadog", "splunk", "elasticsearch", "cloudwatch", "datadog-agent", "fluentbit", "fluentd", "otel", "vector", "logstash", "filebeat", "rsyslog", "syslog-ng", "promtail"]>;
+    mode: z.ZodDefault<z.ZodEnum<["config", "api"]>>;
+    service: z.ZodOptional<z.ZodString>;
+    severity: z.ZodOptional<z.ZodString>;
+};
+export declare function executeExclusionFilter(args: {
+    pattern: string;
+    vendor: string;
+    mode: string;
+    service?: string;
+    severity?: string;
+}): string;

package/build/tools/exclusion-filter.js

@@ -0,0 +1,246 @@
+/**
+ * log10x_exclusion_filter — generate SIEM/forwarder config to drop a pattern.
+ *
+ * Supports 14 vendors (4 SIEMs + 10 forwarders), with config and API modes
+ * where applicable. Ported from GettingStarted.jsx exclude section.
+ */
+import { z } from 'zod';
+export const exclusionFilterSchema = {
+    pattern: z.string().describe('Pattern name (e.g., "Payment_Gateway_Timeout")'),
+    vendor: z.enum([
+        'datadog', 'splunk', 'elasticsearch', 'cloudwatch',
+        'datadog-agent', 'fluentbit', 'fluentd', 'otel', 'vector',
+        'logstash', 'filebeat', 'rsyslog', 'syslog-ng', 'promtail',
+    ]).describe('Target vendor to generate the filter for'),
+    mode: z.enum(['config', 'api']).default('config').describe('Config snippet or API command (API available for Datadog, Splunk, Elasticsearch)'),
+    service: z.string().optional().describe('Service name for scoping the filter'),
+    severity: z.string().optional().describe('Severity level (e.g., "error", "warn")'),
+};
+export function executeExclusionFilter(args) {
+    const tokens = args.pattern.split('_').filter(t => t.length > 0);
+    const patRegex = tokens.join('.*');
+    const svc = args.service || '';
+    const sev = (args.severity || '').toLowerCase();
+    const vk = args.vendor;
+    const mode = args.mode;
+    const { label, text } = generateFilter(vk, mode, tokens, patRegex, svc, sev, args.pattern);
+    const lines = [];
+    const vendorLabel = VENDOR_LABELS[vk] || vk;
+    lines.push(`Exclusion Filter — ${vendorLabel} (${mode})`);
+    lines.push('');
+    lines.push(label);
+    lines.push('');
+    lines.push(text);
+    return lines.join('\n');
+}
+const VENDOR_LABELS = {
+    'datadog': 'Datadog',
+    'splunk': 'Splunk',
+    'elasticsearch': 'Elasticsearch',
+    'cloudwatch': 'CloudWatch',
+    'datadog-agent': 'Datadog Agent',
+    'fluentbit': 'Fluent Bit',
+    'fluentd': 'Fluentd',
+    'otel': 'OTel Collector',
+    'vector': 'Vector',
+    'logstash': 'Logstash',
+    'filebeat': 'Filebeat',
+    'rsyslog': 'rsyslog',
+    'syslog-ng': 'syslog-ng',
+    'promtail': 'Promtail',
+};
+function generateFilter(vk, mode, tokens, patRegex, svc, sev, rawPattern) {
+    // Datadog query for SIEM filters
+    const ddQuery = (() => {
+        const parts = [];
+        if (svc)
+            parts.push(`service:${svc}`);
+        if (sev && sev !== 'uncl')
+            parts.push(`status:${sev}`);
+        parts.push(`@message:/${patRegex}/`);
+        return parts.join(' ');
+    })();
+    // ── SIEMs ──
+    if (vk === 'datadog' && mode === 'config') {
+        return { label: 'Paste this query into an exclusion filter under Logs > Configuration > Indexes.', text: ddQuery };
+    }
+    if (vk === 'datadog' && mode === 'api') {
+        const body = JSON.stringify({ name: `Drop ${rawPattern.slice(0, 40)}`, is_enabled: true, filter: { query: ddQuery } });
+        return {
+            label: 'Run this curl command to create an exclusion filter via the Datadog API.',
+            text: `curl -X POST "https://api.datadoghq.com/api/v1/logs/config/indexes/<INDEX_NAME>/exclusion_filters" \\\n  -H "DD-API-KEY: <YOUR_API_KEY>" \\\n  -H "DD-APPLICATION-KEY: <YOUR_APP_KEY>" \\\n  -H "Content-Type: application/json" \\\n  -d '${body}'`
+        };
+    }
+    if (vk === 'splunk' && mode === 'config') {
+        const lines = [
+            `# Add to transforms.conf on your Heavy Forwarder or Indexer`,
+            `[drop_${tokens.slice(0, 3).join('_')}]`,
+            `REGEX = ${patRegex}`,
+            `DEST_KEY = queue`,
+            `FORMAT = nullQueue`,
+        ];
+        if (svc)
+            lines.push(`# Apply in props.conf under [source::${svc}]`);
+        return { label: 'Add this stanza to transforms.conf to route matching events to nullQueue.', text: lines.join('\n') };
+    }
+    if (vk === 'splunk' && mode === 'api') {
+        return {
+            label: 'Run this curl command to create a transforms extraction via the Splunk REST API.',
+            text: `curl -k -u <USERNAME>:<PASSWORD> \\\n  "https://<SPLUNK_HOST>:8089/servicesNS/nobody/search/data/transforms/extractions" \\\n  -d name=drop_${tokens.slice(0, 3).join('_')} \\\n  -d REGEX="${patRegex}" \\\n  -d DEST_KEY=queue \\\n  -d FORMAT=nullQueue`
+        };
+    }
+    if (vk === 'elasticsearch' && mode === 'config') {
+        const condition = `ctx.message != null && ctx.message =~ /${patRegex}/`
+            + (svc ? ` && ctx['service.name'] == '${svc}'` : '')
+            + (sev && sev !== 'uncl' ? ` && ctx.level == '${sev.toUpperCase()}'` : '');
+        return {
+            label: 'Add this drop processor to an ingest pipeline under Stack Management > Ingest Pipelines.',
+            text: JSON.stringify({ drop: { if: condition } }, null, 2)
+        };
+    }
+    if (vk === 'elasticsearch' && mode === 'api') {
+        const condition = `ctx.message != null && ctx.message =~ /${patRegex}/`
+            + (svc ? ` && ctx['service.name'] == '${svc}'` : '')
+            + (sev && sev !== 'uncl' ? ` && ctx.level == '${sev.toUpperCase()}'` : '');
+        const body = JSON.stringify({ description: `Drop ${rawPattern.slice(0, 40)}`, processors: [{ drop: { if: condition } }] }, null, 2);
+        return {
+            label: 'Run this curl command to create an ingest pipeline with a drop processor.',
+            text: `curl -X PUT "https://<ES_HOST>:9200/_ingest/pipeline/<PIPELINE_ID>" \\\n  -H "Content-Type: application/json" \\\n  -u <USERNAME>:<PASSWORD> \\\n  -d '${body}'`
+        };
+    }
+    if (vk === 'cloudwatch') {
+        return { label: 'Use this regex in a Lambda subscription filter on the matching log group.', text: patRegex };
+    }
+    // ── Forwarders ──
+    if (vk === 'datadog-agent') {
+        const lines = [
+            `# Add to your Datadog Agent log integration config`,
+            `# (e.g. conf.d/<integration>.d/conf.yaml)`,
+            `logs:`,
+            `  - type: file`,
+            `    path: /var/log/app.log`,
+        ];
+        if (svc)
+            lines.push(`    service: ${svc}`);
+        lines.push(`    log_processing_rules:`, `      - type: exclude_at_match`, `        name: drop_${tokens.slice(0, 3).join('_')}`, `        pattern: '${patRegex}'`);
+        return { label: 'Add this log_processing_rules block to your Datadog Agent config to drop matching events before ingestion.', text: lines.join('\n') };
+    }
+    if (vk === 'fluentbit') {
+        const lines = [
+            `# Add to your Fluent Bit configuration`,
+            `[FILTER]`,
+            `    Name     grep`,
+            `    Match    ${svc || '*'}`,
+            `    Exclude  log ${patRegex}`,
+        ];
+        return { label: 'Add this filter section to your Fluent Bit configuration to drop matching events.', text: lines.join('\n') };
+    }
+    if (vk === 'fluentd') {
+        const lines = [
+            `# Add to your Fluentd configuration`,
+            `<filter ${svc || '**'}>`,
+            `  @type grep`,
+            `  <exclude>`,
+            `    key message`,
+            `    pattern /${patRegex}/`,
+            `  </exclude>`,
+        ];
+        if (sev && sev !== 'uncl') {
+            lines.push(`  <exclude>`, `    key level`, `    pattern /^${sev}$/i`, `  </exclude>`);
+        }
+        lines.push(`</filter>`);
+        return { label: 'Add this filter block to your Fluentd configuration to drop matching events.', text: lines.join('\n') };
+    }
+    if (vk === 'otel') {
+        const cond = [`IsMatch(body, "${patRegex}")`];
+        if (svc)
+            cond.push(`resource.attributes["service.name"] == "${svc}"`);
+        if (sev && sev !== 'uncl')
+            cond.push(`severity_text == "${sev.toUpperCase()}"`);
+        const lines = [
+            `# Add to your OTel Collector config under processors:`,
+            `processors:`,
+            `  filter/drop_pattern:`,
+            `    logs:`,
+            `      log_record:`,
+            `        - '${cond.join(' and ')}'`,
+        ];
+        return { label: 'Add this filter processor to your OTel Collector config to drop matching events.', text: lines.join('\n') };
+    }
+    if (vk === 'vector') {
+        const conds = [`match(string!(.message), r'${patRegex}')`];
+        if (svc)
+            conds.push(`.service == "${svc}"`);
+        if (sev && sev !== 'uncl')
+            conds.push(`.level == "${sev}"`);
+        const lines = [
+            `# Add to your Vector configuration (vector.toml)`,
+            `[transforms.drop_pattern]`,
+            `type = "filter"`,
+            `inputs = ["<YOUR_SOURCE>"]`,
+            `condition = '!(${conds.join(' && ')})'`,
+        ];
+        return { label: 'Add this filter transform to your Vector config to drop matching events.', text: lines.join('\n') };
+    }
+    if (vk === 'logstash') {
+        const conds = [`[message] =~ /${patRegex}/`];
+        if (svc)
+            conds.push(`[service] == "${svc}"`);
+        if (sev && sev !== 'uncl')
+            conds.push(`[level] == "${sev}"`);
+        const lines = [
+            `# Add to the filter section of your Logstash pipeline`,
+            `filter {`,
+            `  if ${conds.join(' and ')} {`,
+            `    drop { }`,
+            `  }`,
+            `}`,
+        ];
+        return { label: 'Add this filter block to your Logstash pipeline to drop matching events.', text: lines.join('\n') };
+    }
+    if (vk === 'filebeat') {
+        const lines = [`# Add to the processors section of your filebeat.yml`];
+        const conditions = [{ regexp: { message: patRegex } }];
+        if (svc)
+            conditions.push({ equals: { 'service.name': svc } });
+        if (sev && sev !== 'uncl')
+            conditions.push({ equals: { 'log.level': sev } });
+        lines.push(`processors:`, `  - drop_event:`);
+        if (conditions.length > 1) {
+            lines.push(`      when:`, `        and:`);
+            for (const c of conditions)
+                lines.push(`          - ${JSON.stringify(c)}`);
+        }
+        else {
+            lines.push(`      when:`, `        regexp:`, `          message: '${patRegex}'`);
+        }
+        return { label: 'Add this processor to your filebeat.yml to drop matching events.', text: lines.join('\n') };
+    }
+    if (vk === 'rsyslog') {
+        const lines = [`# Add to your rsyslog.conf or /etc/rsyslog.d/*.conf`];
+        if (svc)
+            lines.push(`# For messages from ${svc}:`);
+        lines.push(`:msg, regex, "${patRegex}" stop`);
+        return { label: 'Add this rule to your rsyslog config to drop matching messages.', text: lines.join('\n') };
+    }
+    if (vk === 'syslog-ng') {
+        const lines = [
+            `# Add to your syslog-ng.conf`,
+            `filter f_drop_pattern {`,
+            `  not match("${patRegex}" value("MESSAGE"))`,
+            `};`,
+        ];
+        return { label: 'Add this filter to your syslog-ng config and apply it to your log path.', text: lines.join('\n') };
+    }
+    if (vk === 'promtail') {
+        const lines = [
+            `# Add to your Promtail config under scrape_configs > pipeline_stages`,
+            `pipeline_stages:`,
+            `  - drop:`,
+            `      expression: '${patRegex}'`,
+        ];
+        return { label: 'Add this pipeline stage to your Promtail config to drop matching events before sending to Loki.', text: lines.join('\n') };
+    }
+    return { label: 'Regex pattern matching this log template.', text: patRegex };
+}
+//# sourceMappingURL=exclusion-filter.js.map

package/build/tools/exclusion-filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exclusion-filter.js","sourceRoot":"","sources":["../../src/tools/exclusion-filter.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gDAAgD,CAAC;IAC9E,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC;QACb,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,YAAY;QAClD,eAAe,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ;QACzD,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU;KAC3D,CAAC,CAAC,QAAQ,CAAC,0CAA0C,CAAC;IACvD,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,kFAAkF,CAAC;IAC9I,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qCAAqC,CAAC;IAC9E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;CACnF,CAAC;AAEF,MAAM,UAAU,sBAAsB,CAAC,IAMtC;IACC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAChD,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;IACvB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IAEvB,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,cAAc,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAE3F,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,WAAW,GAAG,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;IAC5C,KAAK,CAAC,IAAI,CAAC,sBAAsB,WAAW,KAAK,IAAI,GAAG,CAAC,CAAC;IAC1D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEjB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,aAAa,GAA2B;IAC5C,SAAS,EAAE,SAAS;IACpB,QAAQ,EAAE,QAAQ;IAClB,eAAe,EAAE,eAAe;IAChC,YAAY,EAAE,YAAY;IAC1B,eAAe,EAAE,eAAe;IAChC,WAAW,EAAE,YAAY;IACzB,SAAS,EAAE,SAAS;IACpB,MAAM,EAAE,gBAAgB;IACxB,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,UAAU;IACtB,UAAU,EAAE,UAAU;IACtB,SAAS,EAAE,SAAS;IACpB,WAAW,EAAE,WAAW;IACxB,UAAU,EAAE,UAAU;CACvB,CAAC;AAEF,SAAS,cAAc,CACrB,EAAU,EAAE,IAAY,EACxB,MAAgB,EAAE,QAAgB,EAClC,GAAW,EAAE,GAAW,EAAE,UAAkB;IAE5C,iCAAiC;IACjC,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE;QACpB,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,GAAG;YAAE,KAAK,CAAC,IAAI,CAAC,WAAW,GAAG,EAAE,CAAC,CAAC;QACtC,IAAI,GAAG,IAAI,GAAG,KAAK,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC;QACvD,KAAK,CAAC,IAAI,CAAC,aAAa,QAAQ,GAAG,CAAC,CAAC;QACrC,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC,CAAC,EAAE,CAAC;IAEL,cAAc;IACd,IAAI,EAAE,KAAK,SAAS,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC1C,OAAO,EAAE,KAAK,EAAE,iFAAiF,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACrH,CAAC;IACD,IAAI,EAAE,KAAK,SAAS,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QACvH,OAAO;YACL,KAAK,EAAE,0EAA0E;YACjF,IAAI,EAAE,8OAA8O,IAAI,GAAG;SAC5P,CAAC;IACJ,CAAC;IACD,IAAI,EAAE,KAAK,QAAQ,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG;YACZ,6DAA6D;YAC7D,SAAS,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG;YACxC,WAAW,QAAQ,EAAE;YACrB,kBAAkB;YAClB,oBAAoB;SACrB,CAAC;QACF,IAAI,GAAG;YAAE,KAAK,CAAC,IAAI,CAAC,wCAAwC,GAAG,GAAG,CAAC,CAAC;QACpE,OAAO,EAAE,KAAK,EAAE,2EAA2E,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACxH,CAAC;IACD,IAAI,EAAE,KAAK,QAAQ,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACtC,OAAO;YACL,KAAK,EAAE,kFAAkF;YACzF,IAAI,EAAE,+IAA+I,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,QAAQ,qDAAqD;SACnQ,CAAC;IACJ,CAAC;IACD,IAAI,EAAE,KAAK,eAAe,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,SAAS,GAAG,0CAA0C,QAAQ,GAAG;cACnE,CAAC,GAAG,CAAC,CAAC,CAAC,+BAA+B,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;cAClD,CAAC,GAAG,IAAI,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,qBAAqB,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7E,OAAO;YACL,KAAK,EAAE,0FAA0F;YACjG,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;SAC3D,CAAC;IACJ,CAAC;IACD,IAAI,EAAE,KAAK,eAAe,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,0CAA0C,QAAQ,GAAG;cACnE,CAAC,GAAG,CAAC,CAAC,CAAC,+BAA+B,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;cAClD,CAAC,GAAG,IAAI,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,qBAAqB,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7E,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,QAAQ,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACpI,OAAO;YACL,KAAK,EAAE,2EAA2E;YAClF,IAAI,EAAE,0JAA0J,IAAI,GAAG;SACxK,CAAC;IACJ,CAAC;IACD,IAAI,EAAE,KAAK,YAAY,EAAE,CAAC;QACxB,OAAO,EAAE,KAAK,EAAE,2EAA2E,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAChH,CAAC;IAED,mBAAmB;IACnB,IAAI,EAAE,KAAK,eAAe,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG;YACZ,oDAAoD;YACpD,2CAA2C;YAC3C,OAAO;YACP,gBAAgB;YAChB,4BAA4B;SAC7B,CAAC;QACF,IAAI,GAAG;YAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,GAAG,EAAE,CAAC,CAAC;QAC3C,KAAK,CAAC,IAAI,CACR,2BAA2B,EAC3B,gCAAgC,EAChC,sBAAsB,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EACpD,qBAAqB,QAAQ,GAAG,CACjC,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,4GAA4G,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACzJ,CAAC;IACD,IAAI,EAAE,KAAK,WAAW,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG;YACZ,wCAAwC;YACxC,UAAU;YACV,mBAAmB;YACnB,gBAAgB,GAAG,IAAI,GAAG,EAAE;YAC5B,oBAAoB,QAAQ,EAAE;SAC/B,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,mFAAmF,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAChI,CAAC;IACD,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG;YACZ,qCAAqC;YACrC,WAAW,GAAG,IAAI,IAAI,GAAG;YACzB,cAAc;YACd,aAAa;YACb,iBAAiB;YACjB,gBAAgB,QAAQ,GAAG;YAC3B,cAAc;SACf,CAAC;QACF,IAAI,GAAG,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,eAAe,EAAE,iBAAiB,GAAG,KAAK,EAAE,cAAc,CAAC,CAAC;QACxF,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxB,OAAO,EAAE,KAAK,EAAE,8EAA8E,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAC3H,CAAC;IACD,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;QAClB,MAAM,IAAI,GAAG,CAAC,kBAAkB,QAAQ,IAAI,CAAC,CAAC;QAC9C,IAAI,GAAG;YAAE,IAAI,CAAC,IAAI,CAAC,2CAA2C,GAAG,GAAG,CAAC,CAAC;QACtE,IAAI,GAAG,IAAI,GAAG,KAAK,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,qBAAqB,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAChF,MAAM,KAAK,GAAG;YACZ,uDAAuD;YACvD,aAAa;YACb,wBAAwB;YACxB,WAAW;YACX,mBAAmB;YACnB,cAAc,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG;SACpC,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,kFAAkF,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAC/H,CAAC;IACD,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,CAAC,8BAA8B,QAAQ,IAAI,CAAC,CAAC;QAC3D,IAAI,GAAG;YAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,GAAG,GAAG,CAAC,CAAC;QAC5C,IAAI,GAAG,IAAI,GAAG,KAAK,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,cAAc,GAAG,GAAG,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG;YACZ,kDAAkD;YAClD,2BAA2B;YAC3B,iBAAiB;YACjB,4BAA4B;YAC5B,kBAAkB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI;SACzC,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,0EAA0E,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACvH,CAAC;IACD,IAAI,EAAE,KAAK,UAAU,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,CAAC,iBAAiB,QAAQ,GAAG,CAAC,CAAC;QAC7C,IAAI,GAAG;YAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,GAAG,GAAG,CAAC,CAAC;QAC7C,IAAI,GAAG,IAAI,GAAG,KAAK,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,eAAe,GAAG,GAAG,CAAC,CAAC;QAC7D,MAAM,KAAK,GAAG;YACZ,uDAAuD;YACvD,UAAU;YACV,QAAQ,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI;YAC/B,cAAc;YACd,KAAK;YACL,GAAG;SACJ,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,0EAA0E,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACvH,CAAC;IACD,IAAI,EAAE,KAAK,UAAU,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,CAAC,sDAAsD,CAAC,CAAC;QACvE,MAAM,UAAU,GAA8B,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAClF,IAAI,GAAG;YAAE,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC9D,IAAI,GAAG,IAAI,GAAG,KAAK,MAAM;YAAE,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAE7E,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;QAC7C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;YAC1C,KAAK,MAAM,CAAC,IAAI,UAAU;gBAAE,KAAK,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7E,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,iBAAiB,EAAE,uBAAuB,QAAQ,GAAG,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,kEAAkE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAC/G,CAAC;IACD,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,CAAC,qDAAqD,CAAC,CAAC;QACtE,IAAI,GAAG;YAAE,KAAK,CAAC,IAAI,CAAC,uBAAuB,GAAG,GAAG,CAAC,CAAC;QACnD,KAAK,CAAC,IAAI,CAAC,iBAAiB,QAAQ,QAAQ,CAAC,CAAC;QAC9C,OAAO,EAAE,KAAK,EAAE,iEAAiE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAC9G,CAAC;IACD,IAAI,EAAE,KAAK,WAAW,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG;YACZ,8BAA8B;YAC9B,yBAAyB;YACzB,gBAAgB,QAAQ,qBAAqB;YAC7C,IAAI;SACL,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,yEAAyE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACtH,CAAC;IACD,IAAI,EAAE,KAAK,UAAU,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG;YACZ,sEAAsE;YACtE,kBAAkB;YAClB,WAAW;YACX,sBAAsB,QAAQ,GAAG;SAClC,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,iGAAiG,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAC9I,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,2CAA2C,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAChF,CAAC"}

package/build/tools/savings.d.ts

@@ -0,0 +1,17 @@
+/**
+ * log10x_savings — pipeline savings summary.
+ *
+ * Shows current savings from regulator (filtering), optimizer (compaction),
+ * and streamer (indexing). Projects annual savings.
+ */
+import { z } from 'zod';
+import type { EnvConfig } from '../lib/environments.js';
+export declare const savingsSchema: {
+    timeRange: z.ZodDefault<z.ZodEnum<["1d", "7d", "30d"]>>;
+    analyzerCost: z.ZodOptional<z.ZodNumber>;
+    environment: z.ZodOptional<z.ZodString>;
+};
+export declare function executeSavings(args: {
+    timeRange: string;
+    analyzerCost: number;
+}, env: EnvConfig): Promise<string>;

package/build/tools/savings.js

@@ -0,0 +1,75 @@
+/**
+ * log10x_savings — pipeline savings summary.
+ *
+ * Shows current savings from regulator (filtering), optimizer (compaction),
+ * and streamer (indexing). Projects annual savings.
+ */
+import { z } from 'zod';
+import { queryInstant } from '../lib/api.js';
+import * as pql from '../lib/promql.js';
+import { bytesToCost, parsePrometheusValue } from '../lib/cost.js';
+import { fmtDollar, fmtBytes, parseTimeframe, costPeriodLabel } from '../lib/format.js';
+export const savingsSchema = {
+    timeRange: z.enum(['1d', '7d', '30d']).default('7d').describe('Time range'),
+    analyzerCost: z.number().optional().describe('SIEM ingestion cost in $/GB'),
+    environment: z.string().optional().describe('Environment nickname'),
+};
+export async function executeSavings(args, env) {
+    const tf = parseTimeframe(args.timeRange);
+    const costPerGb = args.analyzerCost;
+    const period = costPeriodLabel(tf.days);
+    // Query all savings metrics in parallel
+    const [regInRes, regOutRes, optInRes, optOutRes, streamRes, pipeRes, svcRes] = await Promise.all([
+        queryInstant(env, pql.regulatorInput(tf.range)).catch(() => null),
+        queryInstant(env, pql.regulatorOutput(tf.range)).catch(() => null),
+        queryInstant(env, pql.optimizerInput(tf.range)).catch(() => null),
+        queryInstant(env, pql.optimizerOutput(tf.range)).catch(() => null),
+        queryInstant(env, pql.streamerIndexed(tf.range)).catch(() => null),
+        queryInstant(env, pql.pipelineUp()).catch(() => null),
+        queryInstant(env, pql.distinctServices(tf.range)).catch(() => null),
+    ]);
+    const regIn = regInRes?.data?.result?.[0] ? parsePrometheusValue(regInRes.data.result[0]) : 0;
+    const regOut = regOutRes?.data?.result?.[0] ? parsePrometheusValue(regOutRes.data.result[0]) : 0;
+    const optIn = optInRes?.data?.result?.[0] ? parsePrometheusValue(optInRes.data.result[0]) : 0;
+    const optOut = optOutRes?.data?.result?.[0] ? parsePrometheusValue(optOutRes.data.result[0]) : 0;
+    const streamBytes = streamRes?.data?.result?.[0] ? parsePrometheusValue(streamRes.data.result[0]) : 0;
+    const pipeCount = pipeRes?.data?.result?.[0] ? parsePrometheusValue(pipeRes.data.result[0]) : 0;
+    const svcCount = svcRes?.data?.result?.[0] ? parsePrometheusValue(svcRes.data.result[0]) : 0;
+    const regSavedBytes = Math.max(0, regIn - regOut);
+    const optSavedBytes = Math.max(0, optIn - optOut);
+    const regSavedCost = bytesToCost(regSavedBytes, costPerGb);
+    const optSavedCost = bytesToCost(optSavedBytes, costPerGb);
+    const streamCost = bytesToCost(streamBytes, costPerGb);
+    const totalSaved = regSavedCost + optSavedCost + streamCost;
+    const annualProjection = totalSaved * (365 / tf.days);
+    const lines = [];
+    lines.push(`Pipeline Savings (${tf.label}) at ${fmtDollar(costPerGb)}/GB`);
+    lines.push('');
+    if (regSavedBytes > 0) {
+        lines.push(`  Regulator:  ${fmtBytes(regSavedBytes).padEnd(14)} filtered   → ${fmtDollar(regSavedCost)}${period} saved`);
+    }
+    if (optSavedBytes > 0) {
+        lines.push(`  Optimizer:  ${fmtBytes(optSavedBytes).padEnd(14)} compacted  → ${fmtDollar(optSavedCost)}${period} saved`);
+    }
+    if (streamBytes > 0) {
+        lines.push(`  Streamer:   ${fmtBytes(streamBytes).padEnd(14)} indexed    → ${fmtDollar(streamCost)}${period} saved`);
+    }
+    if (totalSaved === 0) {
+        lines.push('  No savings data available yet. Savings appear once the pipeline processes data.');
+    }
+    else {
+        lines.push('');
+        lines.push(`  Total: ${fmtDollar(totalSaved)}${period} · ${fmtDollar(annualProjection)}/yr projected`);
+    }
+    if (pipeCount > 0 || svcCount > 0) {
+        lines.push('');
+        const parts = [];
+        if (pipeCount > 0)
+            parts.push(`${Math.round(pipeCount)} pipeline instance${pipeCount !== 1 ? 's' : ''}`);
+        if (svcCount > 0)
+            parts.push(`${Math.round(svcCount)} service${svcCount !== 1 ? 's' : ''} monitored`);
+        lines.push(`  ${parts.join(' · ')}`);
+    }
+    return lines.join('\n');
+}
+//# sourceMappingURL=savings.js.map