@agentlensai/server 0.10.0 → 0.13.0

package/dist/lib/notifications/providers/pagerduty.js

@@ -0,0 +1,94 @@
+/**
+ * PagerDuty notification provider (Feature 12, Story 12.4)
+ *
+ * Uses PagerDuty Events API v2.
+ */
+import { createLogger } from '../../logger.js';
+const log = createLogger('PagerDutyProvider');
+const PD_EVENTS_URL = 'https://events.pagerduty.com/v2/enqueue';
+export class PagerDutyProvider {
+    type = 'pagerduty';
+    async send(channel, payload) {
+        const config = channel.config;
+        const dedupKey = `agentlens:${payload.ruleId}:${payload.agentId ?? 'global'}`;
+        const pdPayload = {
+            routing_key: config.routingKey,
+            event_action: 'trigger',
+            dedup_key: dedupKey,
+            payload: {
+                summary: `[AgentLens] ${payload.title}: ${payload.message}`,
+                source: `agentlens`,
+                severity: this.mapSeverity(payload.severity, config.severityMap),
+                timestamp: payload.triggeredAt,
+                component: payload.agentId ?? 'agentlens',
+                group: payload.source,
+                class: payload.ruleName,
+                custom_details: payload.metadata,
+            },
+        };
+        try {
+            const res = await fetch(PD_EVENTS_URL, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify(pdPayload),
+                signal: AbortSignal.timeout(10_000),
+            });
+            if (res.ok) {
+                return { success: true, channelId: channel.id, channelType: 'pagerduty', attempt: 1, httpStatus: res.status };
+            }
+            const text = await res.text().catch(() => '');
+            return { success: false, channelId: channel.id, channelType: 'pagerduty', attempt: 1, httpStatus: res.status, error: text || `HTTP ${res.status}` };
+        }
+        catch (err) {
+            return { success: false, channelId: channel.id, channelType: 'pagerduty', attempt: 1, error: err instanceof Error ? err.message : String(err) };
+        }
+    }
+    /** Send a resolve event for auto-resolution (PD-3) */
+    async sendResolve(channel, ruleId, agentId) {
+        const config = channel.config;
+        const dedupKey = `agentlens:${ruleId}:${agentId ?? 'global'}`;
+        try {
+            const res = await fetch(PD_EVENTS_URL, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({
+                    routing_key: config.routingKey,
+                    event_action: 'resolve',
+                    dedup_key: dedupKey,
+                }),
+                signal: AbortSignal.timeout(10_000),
+            });
+            return {
+                success: res.ok,
+                channelId: channel.id,
+                channelType: 'pagerduty',
+                attempt: 1,
+                httpStatus: res.status,
+                error: res.ok ? undefined : `HTTP ${res.status}`,
+            };
+        }
+        catch (err) {
+            return { success: false, channelId: channel.id, channelType: 'pagerduty', attempt: 1, error: err instanceof Error ? err.message : String(err) };
+        }
+    }
+    async testSend(channel) {
+        const testPayload = {
+            source: 'alert_rule',
+            severity: 'info',
+            title: 'Test Notification',
+            message: `AgentLens channel "${channel.name}" test`,
+            metadata: { test: true },
+            triggeredAt: new Date().toISOString(),
+            ruleId: 'test',
+            ruleName: 'Test',
+        };
+        return this.send(channel, testPayload);
+    }
+    mapSeverity(severity, severityMap) {
+        if (severityMap?.[severity])
+            return severityMap[severity];
+        // PD accepts: critical, error, warning, info
+        return severity === 'critical' ? 'critical' : severity === 'warning' ? 'warning' : 'info';
+    }
+}
+//# sourceMappingURL=pagerduty.js.map

package/dist/lib/notifications/providers/pagerduty.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pagerduty.js","sourceRoot":"","sources":["../../../../src/lib/notifications/providers/pagerduty.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,GAAG,GAAG,YAAY,CAAC,mBAAmB,CAAC,CAAC;AAC9C,MAAM,aAAa,GAAG,yCAAyC,CAAC;AAEhE,MAAM,OAAO,iBAAiB;IACnB,IAAI,GAAG,WAAW,CAAC;IAE5B,KAAK,CAAC,IAAI,CAAC,OAA4B,EAAE,OAA4B;QACnE,MAAM,MAAM,GAAG,OAAO,CAAC,MAA2C,CAAC;QACnE,MAAM,QAAQ,GAAG,aAAa,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,IAAI,QAAQ,EAAE,CAAC;QAE9E,MAAM,SAAS,GAAG;YAChB,WAAW,EAAE,MAAM,CAAC,UAAU;YAC9B,YAAY,EAAE,SAAS;YACvB,SAAS,EAAE,QAAQ;YACnB,OAAO,EAAE;gBACP,OAAO,EAAE,eAAe,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,OAAO,EAAE;gBAC3D,MAAM,EAAE,WAAW;gBACnB,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC;gBAChE,SAAS,EAAE,OAAO,CAAC,WAAW;gBAC9B,SAAS,EAAE,OAAO,CAAC,OAAO,IAAI,WAAW;gBACzC,KAAK,EAAE,OAAO,CAAC,MAAM;gBACrB,KAAK,EAAE,OAAO,CAAC,QAAQ;gBACvB,cAAc,EAAE,OAAO,CAAC,QAAQ;aACjC;SACF,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;gBACrC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;gBAC/B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACpC,CAAC,CAAC;YAEH,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;YAChH,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;QACtJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAClJ,CAAC;IACH,CAAC;IAED,sDAAsD;IACtD,KAAK,CAAC,WAAW,CAAC,OAA4B,EAAE,MAAc,EAAE,OAAgB;QAC9E,MAAM,MAAM,GAAG,OAAO,CAAC,MAA2C,CAAC;QACnE,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;QAE9D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;gBACrC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,WAAW,EAAE,MAAM,CAAC,UAAU;oBAC9B,YAAY,EAAE,SAAS;oBACvB,SAAS,EAAE,QAAQ;iBACpB,CAAC;gBACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACpC,CAAC,CAAC;YAEH,OAAO;gBACL,OAAO,EAAE,GAAG,CAAC,EAAE;gBACf,SAAS,EAAE,OAAO,CAAC,EAAE;gBACrB,WAAW,EAAE,WAAW;gBACxB,OAAO,EAAE,CAAC;gBACV,UAAU,EAAE,GAAG,CAAC,MAAM;gBACtB,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE;aACjD,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAClJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAA4B;QACzC,MAAM,WAAW,GAAwB;YACvC,MAAM,EAAE,YAAY;YACpB,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,mBAAmB;YAC1B,OAAO,EAAE,sBAAsB,OAAO,CAAC,IAAI,QAAQ;YACnD,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;YACxB,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,MAAM;SACjB,CAAC;QACF,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IAEO,WAAW,CAAC,QAAgB,EAAE,WAAoC;QACxE,IAAI,WAAW,EAAE,CAAC,QAAQ,CAAC;YAAE,OAAO,WAAW,CAAC,QAAQ,CAAE,CAAC;QAC3D,6CAA6C;QAC7C,OAAO,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5F,CAAC;CACF"}

package/dist/lib/notifications/providers/slack.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Slack notification provider (Feature 12, Story 12.3)
+ *
+ * Uses Slack Incoming Webhooks with Block Kit formatting.
+ */
+import type { NotificationPayload, DeliveryResult, NotificationChannel } from '@agentlensai/core';
+import type { NotificationProvider } from '../provider.js';
+export declare class SlackProvider implements NotificationProvider {
+    readonly type = "slack";
+    send(channel: NotificationChannel, payload: NotificationPayload): Promise<DeliveryResult>;
+    testSend(channel: NotificationChannel): Promise<DeliveryResult>;
+    private buildBlocks;
+}
+//# sourceMappingURL=slack.d.ts.map

package/dist/lib/notifications/providers/slack.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack.d.ts","sourceRoot":"","sources":["../../../../src/lib/notifications/providers/slack.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,cAAc,EAAE,mBAAmB,EAAsB,MAAM,mBAAmB,CAAC;AACtH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAY3D,qBAAa,aAAc,YAAW,oBAAoB;IACxD,QAAQ,CAAC,IAAI,WAAW;IAElB,IAAI,CAAC,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC;IA0CzF,QAAQ,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC;IAcrE,OAAO,CAAC,WAAW;CAkCpB"}

package/dist/lib/notifications/providers/slack.js

@@ -0,0 +1,106 @@
+/**
+ * Slack notification provider (Feature 12, Story 12.3)
+ *
+ * Uses Slack Incoming Webhooks with Block Kit formatting.
+ */
+import { validateExternalUrl } from '../ssrf.js';
+import { createLogger } from '../../logger.js';
+const log = createLogger('SlackProvider');
+const SEVERITY_COLORS = {
+    critical: '#E01E5A',
+    warning: '#ECB22E',
+    info: '#36C5F0',
+};
+export class SlackProvider {
+    type = 'slack';
+    async send(channel, payload) {
+        const config = channel.config;
+        const urlCheck = validateExternalUrl(config.webhookUrl);
+        if (!urlCheck.valid) {
+            return { success: false, channelId: channel.id, channelType: 'slack', attempt: 1, error: urlCheck.reason };
+        }
+        const blocks = this.buildBlocks(payload);
+        const body = { blocks };
+        if (config.channel)
+            body.channel = config.channel;
+        // Retry on 429
+        for (let attempt = 1; attempt <= 3; attempt++) {
+            try {
+                const res = await fetch(config.webhookUrl, {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json' },
+                    body: JSON.stringify(body),
+                    signal: AbortSignal.timeout(10_000),
+                });
+                if (res.ok) {
+                    return { success: true, channelId: channel.id, channelType: 'slack', attempt, httpStatus: res.status };
+                }
+                if (res.status === 429 && attempt < 3) {
+                    const retryAfter = parseInt(res.headers.get('Retry-After') ?? '5', 10);
+                    await sleep(retryAfter * 1000);
+                    continue;
+                }
+                return { success: false, channelId: channel.id, channelType: 'slack', attempt, httpStatus: res.status, error: `HTTP ${res.status}` };
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                if (attempt < 3) {
+                    await sleep(2000);
+                    continue;
+                }
+                return { success: false, channelId: channel.id, channelType: 'slack', attempt, error: msg };
+            }
+        }
+        return { success: false, channelId: channel.id, channelType: 'slack', attempt: 3, error: 'Max retries' };
+    }
+    async testSend(channel) {
+        const testPayload = {
+            source: 'alert_rule',
+            severity: 'info',
+            title: '✅ Test Notification',
+            message: `AgentLens notification channel "${channel.name}" is working correctly.`,
+            metadata: { test: true },
+            triggeredAt: new Date().toISOString(),
+            ruleId: 'test',
+            ruleName: 'Test',
+        };
+        return this.send(channel, testPayload);
+    }
+    buildBlocks(payload) {
+        const color = SEVERITY_COLORS[payload.severity] ?? SEVERITY_COLORS.info;
+        const severityEmoji = payload.severity === 'critical' ? '🔴' : payload.severity === 'warning' ? '🟡' : 'ℹ️';
+        return [
+            {
+                type: 'header',
+                text: { type: 'plain_text', text: `${severityEmoji} ${payload.title}`, emoji: true },
+            },
+            {
+                type: 'section',
+                text: {
+                    type: 'mrkdwn',
+                    text: payload.message,
+                },
+            },
+            {
+                type: 'section',
+                fields: [
+                    { type: 'mrkdwn', text: `*Source:* ${payload.source}` },
+                    { type: 'mrkdwn', text: `*Severity:* ${payload.severity}` },
+                    { type: 'mrkdwn', text: `*Rule:* ${payload.ruleName}` },
+                    ...(payload.agentId ? [{ type: 'mrkdwn', text: `*Agent:* ${payload.agentId}` }] : []),
+                ],
+            },
+            {
+                type: 'context',
+                elements: [
+                    { type: 'mrkdwn', text: `Triggered at ${payload.triggeredAt}` },
+                ],
+            },
+            { type: 'divider' },
+        ];
+    }
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+//# sourceMappingURL=slack.js.map

package/dist/lib/notifications/providers/slack.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack.js","sourceRoot":"","sources":["../../../../src/lib/notifications/providers/slack.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,GAAG,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;AAE1C,MAAM,eAAe,GAA2B;IAC9C,QAAQ,EAAE,SAAS;IACnB,OAAO,EAAE,SAAS;IAClB,IAAI,EAAE,SAAS;CAChB,CAAC;AAEF,MAAM,OAAO,aAAa;IACf,IAAI,GAAG,OAAO,CAAC;IAExB,KAAK,CAAC,IAAI,CAAC,OAA4B,EAAE,OAA4B;QACnE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAuC,CAAC;QAC/D,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACxD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACpB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC7G,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,IAAI,GAA4B,EAAE,MAAM,EAAE,CAAC;QACjD,IAAI,MAAM,CAAC,OAAO;YAAE,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAElD,eAAe;QACf,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;YAC9C,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE;oBACzC,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;oBAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;iBACpC,CAAC,CAAC;gBAEH,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;oBACX,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;gBACzG,CAAC;gBAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;oBACtC,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;oBACvE,MAAM,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;oBAC/B,SAAS;gBACX,CAAC;gBAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;YACvI,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;oBAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;oBAAC,SAAS;gBAAC,CAAC;gBACjD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;YAC9F,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;IAC3G,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAA4B;QACzC,MAAM,WAAW,GAAwB;YACvC,MAAM,EAAE,YAAY;YACpB,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,qBAAqB;YAC5B,OAAO,EAAE,mCAAmC,OAAO,CAAC,IAAI,yBAAyB;YACjF,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;YACxB,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,MAAM;SACjB,CAAC;QACF,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IAEO,WAAW,CAAC,OAA4B;QAC9C,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC;QACxE,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAE5G,OAAO;YACL;gBACE,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,aAAa,IAAI,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;aACrF;YACD;gBACE,IAAI,EAAE,SAAS;gBACf,IAAI,EAAE;oBACJ,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,OAAO,CAAC,OAAO;iBACtB;aACF;YACD;gBACE,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE;oBACN,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,OAAO,CAAC,MAAM,EAAE,EAAE;oBACvD,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,OAAO,CAAC,QAAQ,EAAE,EAAE;oBAC3D,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,OAAO,CAAC,QAAQ,EAAE,EAAE;oBACvD,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;iBACtF;aACF;YACD;gBACE,IAAI,EAAE,SAAS;gBACf,QAAQ,EAAE;oBACR,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,OAAO,CAAC,WAAW,EAAE,EAAE;iBAChE;aACF;YACD,EAAE,IAAI,EAAE,SAAS,EAAE;SACpB,CAAC;IACJ,CAAC;CACF;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/dist/lib/notifications/providers/webhook.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Webhook notification provider (Feature 12, Story 12.2)
+ *
+ * Backward-compatible with existing webhook delivery + retry with exponential backoff.
+ */
+import type { NotificationPayload, DeliveryResult, NotificationChannel } from '@agentlensai/core';
+import type { NotificationProvider } from '../provider.js';
+export declare class WebhookProvider implements NotificationProvider {
+    readonly type = "webhook";
+    send(channel: NotificationChannel, payload: NotificationPayload): Promise<DeliveryResult>;
+    testSend(channel: NotificationChannel): Promise<DeliveryResult>;
+    /** Send with inline URL (for backward compat with raw URL notifyChannels) */
+    sendToUrl(url: string, payload: NotificationPayload): Promise<DeliveryResult>;
+    private deliver;
+}
+//# sourceMappingURL=webhook.d.ts.map

package/dist/lib/notifications/providers/webhook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook.d.ts","sourceRoot":"","sources":["../../../../src/lib/notifications/providers/webhook.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,cAAc,EAAE,mBAAmB,EAAwB,MAAM,mBAAmB,CAAC;AACxH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAO3D,qBAAa,eAAgB,YAAW,oBAAoB;IAC1D,QAAQ,CAAC,IAAI,aAAa;IAEpB,IAAI,CAAC,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC;IAKzF,QAAQ,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC;IAcrE,6EAA6E;IACvE,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC;YAKrE,OAAO;CAoDtB"}

package/dist/lib/notifications/providers/webhook.js

@@ -0,0 +1,78 @@
+/**
+ * Webhook notification provider (Feature 12, Story 12.2)
+ *
+ * Backward-compatible with existing webhook delivery + retry with exponential backoff.
+ */
+import { validateExternalUrl } from '../ssrf.js';
+import { createLogger } from '../../logger.js';
+const log = createLogger('WebhookProvider');
+const RETRY_DELAYS = [1000, 5000, 30000]; // 1s, 5s, 30s
+export class WebhookProvider {
+    type = 'webhook';
+    async send(channel, payload) {
+        const config = channel.config;
+        return this.deliver(channel.id, config, payload);
+    }
+    async testSend(channel) {
+        const testPayload = {
+            source: 'alert_rule',
+            severity: 'info',
+            title: 'Test Notification',
+            message: `This is a test from AgentLens notification channel "${channel.name}"`,
+            metadata: { test: true },
+            triggeredAt: new Date().toISOString(),
+            ruleId: 'test',
+            ruleName: 'Test',
+        };
+        return this.send(channel, testPayload);
+    }
+    /** Send with inline URL (for backward compat with raw URL notifyChannels) */
+    async sendToUrl(url, payload) {
+        const config = { url, method: 'POST' };
+        return this.deliver('inline', config, payload);
+    }
+    async deliver(channelId, config, payload) {
+        const urlCheck = validateExternalUrl(config.url);
+        if (!urlCheck.valid) {
+            return { success: false, channelId, channelType: 'webhook', attempt: 1, error: urlCheck.reason };
+        }
+        const method = config.method ?? 'POST';
+        const headers = {
+            'Content-Type': 'application/json',
+            ...(config.headers ?? {}),
+        };
+        for (let attempt = 1; attempt <= RETRY_DELAYS.length + 1; attempt++) {
+            try {
+                const res = await fetch(config.url, {
+                    method,
+                    headers,
+                    body: JSON.stringify(payload),
+                    signal: AbortSignal.timeout(10_000),
+                });
+                if (res.ok) {
+                    return { success: true, channelId, channelType: 'webhook', attempt, httpStatus: res.status };
+                }
+                log.warn(`Webhook ${config.url} returned HTTP ${res.status} (attempt ${attempt})`);
+                if (attempt <= RETRY_DELAYS.length) {
+                    await sleep(RETRY_DELAYS[attempt - 1]);
+                    continue;
+                }
+                return { success: false, channelId, channelType: 'webhook', attempt, httpStatus: res.status, error: `HTTP ${res.status}` };
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                log.warn(`Webhook ${config.url} error (attempt ${attempt}): ${msg}`);
+                if (attempt <= RETRY_DELAYS.length) {
+                    await sleep(RETRY_DELAYS[attempt - 1]);
+                    continue;
+                }
+                return { success: false, channelId, channelType: 'webhook', attempt, error: msg };
+            }
+        }
+        return { success: false, channelId, channelType: 'webhook', attempt: RETRY_DELAYS.length + 1, error: 'Max retries exceeded' };
+    }
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+//# sourceMappingURL=webhook.js.map

package/dist/lib/notifications/providers/webhook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook.js","sourceRoot":"","sources":["../../../../src/lib/notifications/providers/webhook.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,GAAG,GAAG,YAAY,CAAC,iBAAiB,CAAC,CAAC;AAC5C,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,cAAc;AAExD,MAAM,OAAO,eAAe;IACjB,IAAI,GAAG,SAAS,CAAC;IAE1B,KAAK,CAAC,IAAI,CAAC,OAA4B,EAAE,OAA4B;QACnE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAyC,CAAC;QACjE,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAA4B;QACzC,MAAM,WAAW,GAAwB;YACvC,MAAM,EAAE,YAAY;YACpB,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,mBAAmB;YAC1B,OAAO,EAAE,uDAAuD,OAAO,CAAC,IAAI,GAAG;YAC/E,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;YACxB,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,MAAM;SACjB,CAAC;QACF,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IAED,6EAA6E;IAC7E,KAAK,CAAC,SAAS,CAAC,GAAW,EAAE,OAA4B;QACvD,MAAM,MAAM,GAAyB,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC7D,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,SAAiB,EACjB,MAA4B,EAC5B,OAA4B;QAE5B,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACpB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QACnG,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC;QACvC,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;SAC1B,CAAC;QAEF,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;YACpE,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE;oBAClC,MAAM;oBACN,OAAO;oBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;oBAC7B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;iBACpC,CAAC,CAAC;gBAEH,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;oBACX,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;gBAC/F,CAAC;gBAED,GAAG,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,GAAG,kBAAkB,GAAG,CAAC,MAAM,aAAa,OAAO,GAAG,CAAC,CAAC;gBAEnF,IAAI,OAAO,IAAI,YAAY,CAAC,MAAM,EAAE,CAAC;oBACnC,MAAM,KAAK,CAAC,YAAY,CAAC,OAAO,GAAG,CAAC,CAAE,CAAC,CAAC;oBACxC,SAAS;gBACX,CAAC;gBAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;YAC7H,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,GAAG,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,GAAG,mBAAmB,OAAO,MAAM,GAAG,EAAE,CAAC,CAAC;gBAErE,IAAI,OAAO,IAAI,YAAY,CAAC,MAAM,EAAE,CAAC;oBACnC,MAAM,KAAK,CAAC,YAAY,CAAC,OAAO,GAAG,CAAC,CAAE,CAAC,CAAC;oBACxC,SAAS;gBACX,CAAC;gBAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;YACpF,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAChI,CAAC;CACF;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/dist/lib/notifications/router.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Notification Router (Feature 12, Story 12.8)
+ *
+ * Central dispatcher that resolves channel IDs, applies grouping,
+ * and routes to the correct provider. Used by both AlertEngine
+ * and GuardrailEngine.
+ */
+import type { NotificationPayload, DeliveryResult } from '@agentlensai/core';
+import type { NotificationChannelRepository } from '../../db/repositories/notification-channel-repository.js';
+export declare class NotificationRouter {
+    private repo;
+    private providers;
+    private groupingBuffer;
+    private webhookProvider;
+    constructor(repo: NotificationChannelRepository);
+    /**
+     * Dispatch notifications for the given channel entries.
+     * Channel entries can be:
+     * - Raw URLs (backward compat) → sent via WebhookProvider inline
+     * - Channel IDs (ULIDs) → resolved from DB and routed to correct provider
+     */
+    dispatch(channelEntries: string[], payload: NotificationPayload, tenantId?: string): Promise<DeliveryResult[]>;
+    private dispatchDirect;
+    /** Test a specific channel */
+    testChannel(channelId: string, tenantId?: string): Promise<DeliveryResult>;
+    private logResult;
+    private isUrl;
+    stop(): void;
+}
+//# sourceMappingURL=router.d.ts.map

package/dist/lib/notifications/router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../../src/lib/notifications/router.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAuB,cAAc,EAAwB,MAAM,mBAAmB,CAAC;AAExH,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,0DAA0D,CAAC;AAW9G,qBAAa,kBAAkB;IAKjB,OAAO,CAAC,IAAI;IAJxB,OAAO,CAAC,SAAS,CAAoC;IACrD,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,eAAe,CAAkB;gBAErB,IAAI,EAAE,6BAA6B;IAiBvD;;;;;OAKG;IACG,QAAQ,CACZ,cAAc,EAAE,MAAM,EAAE,EACxB,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,GAAE,MAAkB,GAC3B,OAAO,CAAC,cAAc,EAAE,CAAC;YAiBd,cAAc;IAgD5B,8BAA8B;IACxB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;YAclE,SAAS;IAyBvB,OAAO,CAAC,KAAK;IAIb,IAAI,IAAI,IAAI;CAGb"}

package/dist/lib/notifications/router.js

@@ -0,0 +1,137 @@
+/**
+ * Notification Router (Feature 12, Story 12.8)
+ *
+ * Central dispatcher that resolves channel IDs, applies grouping,
+ * and routes to the correct provider. Used by both AlertEngine
+ * and GuardrailEngine.
+ */
+import { ulid } from 'ulid';
+import { WebhookProvider } from './providers/webhook.js';
+import { SlackProvider } from './providers/slack.js';
+import { PagerDutyProvider } from './providers/pagerduty.js';
+import { EmailProvider } from './providers/email.js';
+import { GroupingBuffer } from './grouping-buffer.js';
+import { isWebhookUrlAllowed } from './ssrf.js';
+import { createLogger } from '../logger.js';
+const log = createLogger('NotificationRouter');
+export class NotificationRouter {
+    repo;
+    providers;
+    groupingBuffer;
+    webhookProvider;
+    constructor(repo) {
+        this.repo = repo;
+        this.webhookProvider = new WebhookProvider();
+        this.providers = new Map([
+            ['webhook', this.webhookProvider],
+            ['slack', new SlackProvider()],
+            ['pagerduty', new PagerDutyProvider()],
+            ['email', new EmailProvider()],
+        ]);
+        this.groupingBuffer = new GroupingBuffer(async (payload, groupCount) => {
+            // On group flush, re-dispatch without grouping
+            await this.dispatchDirect(payload, payload.metadata._channelEntries ?? [], payload.metadata._tenantId ?? 'default');
+        });
+    }
+    /**
+     * Dispatch notifications for the given channel entries.
+     * Channel entries can be:
+     * - Raw URLs (backward compat) → sent via WebhookProvider inline
+     * - Channel IDs (ULIDs) → resolved from DB and routed to correct provider
+     */
+    async dispatch(channelEntries, payload, tenantId = 'default') {
+        if (channelEntries.length === 0)
+            return [];
+        // Apply grouping
+        const enrichedPayload = {
+            ...payload,
+            metadata: { ...payload.metadata, _channelEntries: channelEntries, _tenantId: tenantId },
+        };
+        const shouldSend = this.groupingBuffer.submit(payload.ruleId, enrichedPayload);
+        if (!shouldSend) {
+            log.info(`Alert for rule ${payload.ruleId} grouped (suppressed)`);
+            return [];
+        }
+        return this.dispatchDirect(payload, channelEntries, tenantId);
+    }
+    async dispatchDirect(payload, channelEntries, tenantId) {
+        const results = [];
+        for (const entry of channelEntries) {
+            try {
+                if (this.isUrl(entry)) {
+                    // Backward compat: raw URL → inline webhook
+                    if (!isWebhookUrlAllowed(entry)) {
+                        log.warn(`SSRF blocked: ${entry}`);
+                        continue;
+                    }
+                    const result = await this.webhookProvider.sendToUrl(entry, payload);
+                    results.push(result);
+                    await this.logResult(result, payload, tenantId, entry);
+                }
+                else {
+                    // Channel ID → resolve and dispatch
+                    const channel = await this.repo.getChannel(entry, tenantId);
+                    if (!channel) {
+                        log.warn(`Notification channel not found: ${entry}`);
+                        continue;
+                    }
+                    if (!channel.enabled) {
+                        log.info(`Notification channel disabled: ${channel.name} (${entry})`);
+                        continue;
+                    }
+                    const provider = this.providers.get(channel.type);
+                    if (!provider) {
+                        log.warn(`No provider for channel type: ${channel.type}`);
+                        continue;
+                    }
+                    const result = await provider.send(channel, payload);
+                    results.push(result);
+                    await this.logResult(result, payload, tenantId, channel.id);
+                }
+            }
+            catch (err) {
+                log.error(`Notification dispatch error for ${entry}: ${err}`);
+            }
+        }
+        return results;
+    }
+    /** Test a specific channel */
+    async testChannel(channelId, tenantId) {
+        const channel = await this.repo.getChannel(channelId, tenantId);
+        if (!channel) {
+            return { success: false, channelId, channelType: 'webhook', attempt: 1, error: 'Channel not found' };
+        }
+        const provider = this.providers.get(channel.type);
+        if (!provider) {
+            return { success: false, channelId, channelType: channel.type, attempt: 1, error: `No provider for type: ${channel.type}` };
+        }
+        return provider.testSend(channel);
+    }
+    async logResult(result, payload, tenantId, channelId) {
+        try {
+            const logEntry = {
+                id: ulid(),
+                tenantId,
+                channelId,
+                ruleId: payload.ruleId,
+                ruleType: payload.source,
+                status: result.success ? 'success' : 'failed',
+                attempt: result.attempt,
+                errorMessage: result.error,
+                payloadSummary: JSON.stringify({ title: payload.title, severity: payload.severity }).slice(0, 500),
+                createdAt: new Date().toISOString(),
+            };
+            await this.repo.insertLog(logEntry);
+        }
+        catch (err) {
+            log.error(`Failed to log notification result: ${err}`);
+        }
+    }
+    isUrl(s) {
+        return s.startsWith('http://') || s.startsWith('https://');
+    }
+    stop() {
+        this.groupingBuffer.stop();
+    }
+}
+//# sourceMappingURL=router.js.map

package/dist/lib/notifications/router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.js","sourceRoot":"","sources":["../../../src/lib/notifications/router.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,MAAM,GAAG,GAAG,YAAY,CAAC,oBAAoB,CAAC,CAAC;AAE/C,MAAM,OAAO,kBAAkB;IAKT;IAJZ,SAAS,CAAoC;IAC7C,cAAc,CAAiB;IAC/B,eAAe,CAAkB;IAEzC,YAAoB,IAAmC;QAAnC,SAAI,GAAJ,IAAI,CAA+B;QACrD,IAAI,CAAC,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;QAC7C,IAAI,CAAC,SAAS,GAAG,IAAI,GAAG,CAA+B;YACrD,CAAC,SAAS,EAAE,IAAI,CAAC,eAAe,CAAC;YACjC,CAAC,OAAO,EAAE,IAAI,aAAa,EAAE,CAAC;YAC9B,CAAC,WAAW,EAAE,IAAI,iBAAiB,EAAE,CAAC;YACtC,CAAC,OAAO,EAAE,IAAI,aAAa,EAAE,CAAC;SAC/B,CAAC,CAAC;QAEH,IAAI,CAAC,cAAc,GAAG,IAAI,cAAc,CACtC,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE;YAC5B,+CAA+C;YAC/C,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,eAA2B,IAAI,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAmB,IAAI,SAAS,CAAC,CAAC;QAC5I,CAAC,CACF,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CACZ,cAAwB,EACxB,OAA4B,EAC5B,WAAmB,SAAS;QAE5B,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAE3C,iBAAiB;QACjB,MAAM,eAAe,GAAG;YACtB,GAAG,OAAO;YACV,QAAQ,EAAE,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,eAAe,EAAE,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE;SACxF,CAAC;QACF,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QAC/E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,GAAG,CAAC,IAAI,CAAC,kBAAkB,OAAO,CAAC,MAAM,uBAAuB,CAAC,CAAC;YAClE,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;IAChE,CAAC;IAEO,KAAK,CAAC,cAAc,CAC1B,OAA4B,EAC5B,cAAwB,EACxB,QAAgB;QAEhB,MAAM,OAAO,GAAqB,EAAE,CAAC;QAErC,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;oBACtB,4CAA4C;oBAC5C,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;wBAChC,GAAG,CAAC,IAAI,CAAC,iBAAiB,KAAK,EAAE,CAAC,CAAC;wBACnC,SAAS;oBACX,CAAC;oBACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;oBACpE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBACrB,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;gBACzD,CAAC;qBAAM,CAAC;oBACN,oCAAoC;oBACpC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;oBAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;wBACb,GAAG,CAAC,IAAI,CAAC,mCAAmC,KAAK,EAAE,CAAC,CAAC;wBACrD,SAAS;oBACX,CAAC;oBACD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;wBACrB,GAAG,CAAC,IAAI,CAAC,kCAAkC,OAAO,CAAC,IAAI,KAAK,KAAK,GAAG,CAAC,CAAC;wBACtE,SAAS;oBACX,CAAC;oBAED,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;oBAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;wBACd,GAAG,CAAC,IAAI,CAAC,iCAAiC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;wBAC1D,SAAS;oBACX,CAAC;oBAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBACrD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBACrB,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;gBAC9D,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,KAAK,CAAC,mCAAmC,KAAK,KAAK,GAAG,EAAE,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,8BAA8B;IAC9B,KAAK,CAAC,WAAW,CAAC,SAAiB,EAAE,QAAiB;QACpD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;QACvG,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,yBAAyB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9H,CAAC;QAED,OAAO,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IAEO,KAAK,CAAC,SAAS,CACrB,MAAsB,EACtB,OAA4B,EAC5B,QAAgB,EAChB,SAAiB;QAEjB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAyB;gBACrC,EAAE,EAAE,IAAI,EAAE;gBACV,QAAQ;gBACR,SAAS;gBACT,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,QAAQ,EAAE,OAAO,CAAC,MAAM;gBACxB,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;gBAC7C,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,YAAY,EAAE,MAAM,CAAC,KAAK;gBAC1B,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBAClG,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC;YACF,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,sCAAsC,GAAG,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,CAAS;QACrB,OAAO,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI;QACF,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAC7B,CAAC;CACF"}

package/dist/lib/notifications/ssrf.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Consolidated SSRF protection (Feature 12, SEC-2)
+ *
+ * Single implementation used by all notification providers and both
+ * AlertEngine and GuardrailEngine.
+ */
+export declare function validateExternalUrl(urlStr: string): {
+    valid: boolean;
+    reason?: string;
+};
+/** Simple boolean check (backward compat with AlertEngine) */
+export declare function isWebhookUrlAllowed(url: string): boolean;
+//# sourceMappingURL=ssrf.d.ts.map

package/dist/lib/notifications/ssrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf.d.ts","sourceRoot":"","sources":["../../../src/lib/notifications/ssrf.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAyBvF;AAED,8DAA8D;AAC9D,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAExD"}

package/dist/lib/notifications/ssrf.js

@@ -0,0 +1,37 @@
+/**
+ * Consolidated SSRF protection (Feature 12, SEC-2)
+ *
+ * Single implementation used by all notification providers and both
+ * AlertEngine and GuardrailEngine.
+ */
+const PRIVATE_IP_PATTERNS = [
+    /^127\./, /^10\./, /^172\.(1[6-9]|2\d|3[01])\./, /^192\.168\./,
+    /^169\.254\./, /^0\./,
+];
+export function validateExternalUrl(urlStr) {
+    let parsed;
+    try {
+        parsed = new URL(urlStr);
+    }
+    catch {
+        return { valid: false, reason: 'Invalid URL' };
+    }
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+        return { valid: false, reason: `Disallowed protocol: ${parsed.protocol}` };
+    }
+    const hostname = parsed.hostname.toLowerCase().replace(/^\[|\]$/g, '');
+    // Block localhost variants
+    if (hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '::1' || hostname === '0:0:0:0:0:0:0:1') {
+        return { valid: false, reason: 'Localhost URLs are not allowed' };
+    }
+    // Block private IP ranges
+    if (PRIVATE_IP_PATTERNS.some((p) => p.test(hostname))) {
+        return { valid: false, reason: `Private IP range blocked: ${hostname}` };
+    }
+    return { valid: true };
+}
+/** Simple boolean check (backward compat with AlertEngine) */
+export function isWebhookUrlAllowed(url) {
+    return validateExternalUrl(url).valid;
+}
+//# sourceMappingURL=ssrf.js.map

package/dist/lib/notifications/ssrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf.js","sourceRoot":"","sources":["../../../src/lib/notifications/ssrf.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,mBAAmB,GAAG;IAC1B,QAAQ,EAAE,OAAO,EAAE,4BAA4B,EAAE,aAAa;IAC9D,aAAa,EAAE,MAAM;CACtB,CAAC;AAEF,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACjD,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC7E,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAEvE,2BAA2B;IAC3B,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;QACjH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IACpE,CAAC;IAED,0BAA0B;IAC1B,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACtD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,QAAQ,EAAE,EAAE,CAAC;IAC3E,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;AACxC,CAAC"}

package/dist/lib/optimization/analyzers/model-downgrade.d.ts

@@ -0,0 +1,15 @@
+/**
+ * ModelDowngradeAnalyzer (Feature 17 — Story 17.2)
+ *
+ * Wraps the existing OptimizationEngine and maps its CostRecommendation
+ * output to EnhancedRecommendation with category 'model_downgrade'.
+ */
+import type { ModelCosts, EnhancedRecommendation } from '@agentlensai/core';
+import type { Analyzer, AnalyzerContext } from './types.js';
+export declare class ModelDowngradeAnalyzer implements Analyzer {
+    readonly name = "model_downgrade";
+    private engine;
+    constructor(modelCosts?: ModelCosts);
+    analyze(ctx: AnalyzerContext): Promise<EnhancedRecommendation[]>;
+}
+//# sourceMappingURL=model-downgrade.d.ts.map

package/dist/lib/optimization/analyzers/model-downgrade.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-downgrade.d.ts","sourceRoot":"","sources":["../../../../src/lib/optimization/analyzers/model-downgrade.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAG5E,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAG5D,qBAAa,sBAAuB,YAAW,QAAQ;IACrD,QAAQ,CAAC,IAAI,qBAAqB;IAClC,OAAO,CAAC,MAAM,CAAqB;gBAEvB,UAAU,GAAE,UAAgC;IAIlD,OAAO,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC;CA4CvE"}