@agentlens/core                 // Zero-dependency core (70 tests)
├── ARLS schema types          // Versioned AI-Readable Log Schema v1.0
├── AsyncLocalStorage context  // Automatic run/trace ID propagation
├── Type-safe event builders   // 9 event types with strict typing
└── Typed error classes        // No Error(string) in public APIs

@agentlens/interceptors        // SDK wrappers (45 tests)
├── Anthropic SDK proxy        // Automatic message.create() logging
├── OpenAI SDK proxy           // Streaming support with accumulation
└── Generic tool wrapper       // Any async function → logged tool

@agentlens/privacy             // PII detection & redaction (38 tests)
├── 6 detector types           // Email, API keys, SSN, CC, phone, password
├── 4 redaction modes          // MASK, HASH, DROP, PLACEHOLDER
└── Recursive object traversal // Nested object/array handling

@agentlens/renderer            // Output rendering (32 tests)
├── Human mode                 // ANSI colored terminal output
└── AI mode                    // JSONL with _claude_context fields

@agentlens/transport           // Event persistence (27 tests)
├── BaseTransport              // Async queue, non-blocking writes
├── ConsoleTransport           // stdout/stderr output
└── FileTransport              // JSONL with log rotation

@agentlens/cli                 // Analysis tools (18 tests)
├── init command               // Config scaffolding
├── trace command              // Run visualization
└── analyze command            // Statistics aggregation

// BaseTransport implements async queue pattern
private async drainQueue(): Promise<void> {
  while (this.queue.length > 0) {
    const batch = this.queue.splice(0, this.batchSize)
    await Promise.all(batch.map(e => this.write(e)))
  }
}

// Writer never blocks — events queued immediately
async write(event: ARLSEvent, rendered: string): Promise<void> {
  this.queue.push({ event, rendered })
  if (!this.draining) {
    this.draining = true
    setImmediate(() => this.drainQueue())
  }
}

interface ARLSEvent {
  agentlens_version: "1.0"
  schema_type: SchemaType  // 9 types: AGENT_START, LLM_CALL, TOOL_CALL, ERROR, etc.
  timestamp: string        // ISO 8601
  run_id: string          // Unique run identifier
  trace_id: string        // Trace identifier
  step_index: number      // Sequential step tracking
  agent: AgentContext     // Name + phase (PLAN, TOOL_CALL, OBSERVE, REFLECT, RESPOND)
  llm?: LLMCallData       // Tokens, cost, latency, finish_reason
  tool?: ToolCallData     // Input/output/duration/status
  privacy: PrivacyData    // PII detection + redaction mode
}

// Accurate pricing for 10+ LLM models
const costs: Record<string, PricingInfo> = {
  "claude-opus-4-*": { input: 15.00, output: 75.00 },        // per 1M tokens
  "claude-sonnet-4-*": { input: 3.00, output: 15.00 },
  "gpt-4o": { input: 2.50, output: 10.00 },
  "gpt-4-turbo": { input: 10.00, output: 30.00 }
}

function calculateCost(model: string, tokens: number): number {
  const pricing = lookupPricing(model)
  return (tokens / 1_000_000) * pricing.rate
}

// 6 detector types with regex + validation
detectors: {
  email: /^[^\s@]+@[^\s@]+\.[^\s@]+$/,
  apiKey: /^(sk_|ak_|pk_|Bearer\s)/,
  creditCard: /^\d{13,19}$/, // With Luhn validation
  phone: /^\+?1?\s?\(?(\d{3})\)?[\s.-]?(\d{3})[\s.-]?(\d{4})$/,
  ssn: /^\d{3}-\d{2}-\d{4}$/,
  password: /(password|passwd|secret|token)[\s]*[:=][\s]*/i
}

// Human mode: ANSI colored terminal output with emoji
[AgentLens] ──────────────────────────────── run_1712282400000_a3c2e5
🤖 AGENT START MyAgent
  🔧 TOOL CALL → web_search
     input: { "query": "..." }
     status: ✅ SUCCESS
     duration: 842ms
  🧠 LLM CALL → claude-3-5-sonnet-20241022
     tokens: 1540 (1200 in / 340 out)
     cost: $0.0048
🏁 AGENT END
   total: 3 steps | $0.0048 | 2.16s

// AI mode: JSONL with _claude_context
{"agentlens_version":"1.0","schema_type":"LLM_CALL",...,"_claude_context":{"summary":"...","debug_suggestion":"..."}}

interface MedicalClaim {
  diagnosis: ICD10Code[]           // Primary + secondary diagnoses
  procedures: CPTCode[]            // Primary + secondary procedures
  modifiers: ProcedureModifier[]   // HCPCS modifiers (laterality, etc.)
  bundlingRules: BundleConstraint[] // Which procedures can't be billed together
  medicalNecessity: ClinicalJustification // Evidence linking diagnosis → procedure
}

// Example: Knee arthroscopy with diagnosis mismatch
{
  diagnosis: ["M17.11"], // Knee arthritis (secondary)
  procedures: ["29881"], // Knee arthroscopy with repair
  issue: "Arthroscopy requires primary diagnosis of tear/damage, not arthritis"
  fix: "Add secondary diagnosis M66.360 (rotator cuff tear) or M83.8"
}

interface PayerPolicy {
  payerId: string
  rules: {
    requiresPriorAuth: string[]     // Procedure codes requiring pre-approval
    bundleRequirements: BundleRule[]
    coverageLimits: CoverageLimit[] // Max visits, age limits, etc.
    auditThreshold: number          // Claims >$X automatically audited
    denialPatterns: DenialPattern[] // Common reasons for denials
  }
}

// Medicare vs United Health vs Blue Cross = different rules
// System learns from historical denials for each payer

const denialPatterns = {
  "Eligibility": 18,
  "Medical Necessity": 15,
  "Coding Error": 23,
  "Prior Auth Missing": 12,
  "Duplicate Claim": 8,
  "Timely Filing": 9,
  "Out of Network": 7,
  "Bundling Violation": 6,
  // ... 15+ more patterns
}

// Agent analyzes claim BEFORE submission:
// "High-risk cluster detected: Bundling violation (6%) + Medical Necessity (15%)"
// "Recommendation: Add M66.360 diagnosis code for justification"

interface VoiceTransaction {
  // Intent Recognition
  intent: "balance" | "transfer" | "payment" | "dispute" | "fraud_check"
  entities: {
    amount?: number
    recipient?: string
    account?: string
    urgency?: "normal" | "high" | "emergency"
  }

  // Real-time Fraud Detection
  fraudScores: {
    velocityCheck: number      // How many transactions in last hour?
    amountAnomaly: number      // Is amount unusual for this account?
    recipientRisk: number      // New payee = higher risk
    socialEngineeringSignals: string[] // Pressure language detected?
    deviceFingerprint: boolean // Device matches historical patterns?
  }

  // Transaction Execution
  transactionId: string
  status: "pending" | "approved" | "blocked" | "requires_verification"
  timestamp: ISO8601
}

// Real-time pattern detection during conversation
fraudRules: {
  velocityThreshold: number,      // Max transactions per hour
  amountThreshold: number,        // Amount outside 3-sigma range = flag
  newRecipientPenalty: number,    // First-time payee = higher scrutiny
  socialEngineeringPatterns: [
    "sending today",
    "don't tell anyone",
    "urgent",
    "emergency",
    "gift card",
    "wire immediately"
  ],
  geoVelocity: {
    maxDistance: number,          // Max miles between transactions (detect spoofing)
    timeWindow: number            // Time between transactions in different cities
  }
}

// Example: Agent detects risk mid-conversation
User: "Transfer $5,000 to a new payee John at ChaseBank"
System: [Fraud score: 7.2/10]
  - New recipient (5.0 points)
  - Amount above monthly average (1.5 points)
  - Time: 2 AM (1.2 points)
  - Velocity: 3rd transaction in 2 hours (1.5 points)

Agent Response: "I've detected this transfer is unusual for your account.
  You're sending $5,000 to a new recipient at 2 AM. Can you confirm this
  is a legitimate transfer? For security, I can send a verification code
  to your registered email first."

// System understands banking context, not just NLP
interface BankingContext {
  transactionTypes: {
    ACH: { settlement: "1-3 business days", reversible: true },
    Wire: { settlement: "same day", reversible: false },
    P2P: { settlement: "instant", reversible: "30 days" },
    BillPay: { settlement: "configurable", reversible: true }
  }

  riskFactors: {
    firstTimePayee: true,        // Requires additional verification
    unusualAmount: true,         // Above account's typical transaction size
    unusualTime: true,           // 2 AM = higher risk
    unusualDestination: true,    // International = higher verification
    velocityExceeded: true       // Too many recent transactions
  }

  recoveryOptions: [
    "Send verification code",
    "Call registered number",
    "Request government ID",
    "Block transaction + manual review",
    "Reverse if fraud within 48 hours"
  ]
}

interface QueryPlan {
  intent: "trend" | "comparison" | "cohort" | "attribution"

  tables: string[]              // Required tables
  joins: JoinCondition[]        // How to connect them
  filters: WhereClause[]        // Temporal + categorical
  groupBy: string[]             // Aggregation dimensions
  aggregations: Aggregation[]   // COUNT, SUM, AVG, etc.
  orderBy: SortSpec[]           // Ranking

  semantics: {
    temporalContext: TimeRange
    businessMetric: string      // Revenue, Users, Engagement, etc.
    attribution: AttributionModel // first-touch, multi-touch, etc.
  }
}

// Generated SQL enforces:
// - Indexed column usage for performance
// - Proper NULL handling (COALESCE)
// - Statistical significance testing
// - Partition pruning for large tables

interface InsightGeneration {
  descriptiveStats: {
    mean: number
    median: number
    stdDev: number
    percentiles: Record<number, number>
  }

  trendAnalysis: {
    direction: "increasing" | "decreasing" | "stable"
    rate: number              // % change period-over-period
    significance: boolean     // Statistically significant?
    confidence: number        // 95%, 99%, etc.
  }

  anomalyDetection: {
    outliers: DataPoint[]     // Values outside expected range
    causes: string[]          // Why are they outliers?
    recommendations: string[] // What to do about them
  }

  recommendations: {
    action: string
    expectedImpact: string
    priority: "high" | "medium" | "low"
  }
}

// Example output:
{
  "insight": "Email campaigns achieved 5.2x ROAS in Q3, highest among all channels",
  "context": "Represents $45K revenue with 8.3% conversion rate",
  "trend": "18% improvement vs Q2 (+3.2 percentage points)",
  "significance": "p-value < 0.05 (statistically significant)",
  "anomaly": "Facebook retargeting: unusual 47% CTR increase (likely from A/B test)",
  "recommendation": "Increase email budget allocation from 18% to 25%"
}