@agentlensai/server 0.11.0 → 0.14.0

package/dist/lib/notifications/providers/webhook.js

@@ -0,0 +1,78 @@
+/**
+ * Webhook notification provider (Feature 12, Story 12.2)
+ *
+ * Backward-compatible with existing webhook delivery + retry with exponential backoff.
+ */
+import { validateExternalUrl } from '../ssrf.js';
+import { createLogger } from '../../logger.js';
+const log = createLogger('WebhookProvider');
+const RETRY_DELAYS = [1000, 5000, 30000]; // 1s, 5s, 30s
+export class WebhookProvider {
+    type = 'webhook';
+    async send(channel, payload) {
+        const config = channel.config;
+        return this.deliver(channel.id, config, payload);
+    }
+    async testSend(channel) {
+        const testPayload = {
+            source: 'alert_rule',
+            severity: 'info',
+            title: 'Test Notification',
+            message: `This is a test from AgentLens notification channel "${channel.name}"`,
+            metadata: { test: true },
+            triggeredAt: new Date().toISOString(),
+            ruleId: 'test',
+            ruleName: 'Test',
+        };
+        return this.send(channel, testPayload);
+    }
+    /** Send with inline URL (for backward compat with raw URL notifyChannels) */
+    async sendToUrl(url, payload) {
+        const config = { url, method: 'POST' };
+        return this.deliver('inline', config, payload);
+    }
+    async deliver(channelId, config, payload) {
+        const urlCheck = validateExternalUrl(config.url);
+        if (!urlCheck.valid) {
+            return { success: false, channelId, channelType: 'webhook', attempt: 1, error: urlCheck.reason };
+        }
+        const method = config.method ?? 'POST';
+        const headers = {
+            'Content-Type': 'application/json',
+            ...(config.headers ?? {}),
+        };
+        for (let attempt = 1; attempt <= RETRY_DELAYS.length + 1; attempt++) {
+            try {
+                const res = await fetch(config.url, {
+                    method,
+                    headers,
+                    body: JSON.stringify(payload),
+                    signal: AbortSignal.timeout(10_000),
+                });
+                if (res.ok) {
+                    return { success: true, channelId, channelType: 'webhook', attempt, httpStatus: res.status };
+                }
+                log.warn(`Webhook ${config.url} returned HTTP ${res.status} (attempt ${attempt})`);
+                if (attempt <= RETRY_DELAYS.length) {
+                    await sleep(RETRY_DELAYS[attempt - 1]);
+                    continue;
+                }
+                return { success: false, channelId, channelType: 'webhook', attempt, httpStatus: res.status, error: `HTTP ${res.status}` };
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                log.warn(`Webhook ${config.url} error (attempt ${attempt}): ${msg}`);
+                if (attempt <= RETRY_DELAYS.length) {
+                    await sleep(RETRY_DELAYS[attempt - 1]);
+                    continue;
+                }
+                return { success: false, channelId, channelType: 'webhook', attempt, error: msg };
+            }
+        }
+        return { success: false, channelId, channelType: 'webhook', attempt: RETRY_DELAYS.length + 1, error: 'Max retries exceeded' };
+    }
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+//# sourceMappingURL=webhook.js.map

package/dist/lib/notifications/providers/webhook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook.js","sourceRoot":"","sources":["../../../../src/lib/notifications/providers/webhook.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,GAAG,GAAG,YAAY,CAAC,iBAAiB,CAAC,CAAC;AAC5C,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,cAAc;AAExD,MAAM,OAAO,eAAe;IACjB,IAAI,GAAG,SAAS,CAAC;IAE1B,KAAK,CAAC,IAAI,CAAC,OAA4B,EAAE,OAA4B;QACnE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAyC,CAAC;QACjE,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAA4B;QACzC,MAAM,WAAW,GAAwB;YACvC,MAAM,EAAE,YAAY;YACpB,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,mBAAmB;YAC1B,OAAO,EAAE,uDAAuD,OAAO,CAAC,IAAI,GAAG;YAC/E,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;YACxB,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,MAAM;SACjB,CAAC;QACF,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IAED,6EAA6E;IAC7E,KAAK,CAAC,SAAS,CAAC,GAAW,EAAE,OAA4B;QACvD,MAAM,MAAM,GAAyB,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC7D,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,SAAiB,EACjB,MAA4B,EAC5B,OAA4B;QAE5B,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACpB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QACnG,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC;QACvC,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;SAC1B,CAAC;QAEF,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;YACpE,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE;oBAClC,MAAM;oBACN,OAAO;oBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;oBAC7B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;iBACpC,CAAC,CAAC;gBAEH,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;oBACX,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;gBAC/F,CAAC;gBAED,GAAG,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,GAAG,kBAAkB,GAAG,CAAC,MAAM,aAAa,OAAO,GAAG,CAAC,CAAC;gBAEnF,IAAI,OAAO,IAAI,YAAY,CAAC,MAAM,EAAE,CAAC;oBACnC,MAAM,KAAK,CAAC,YAAY,CAAC,OAAO,GAAG,CAAC,CAAE,CAAC,CAAC;oBACxC,SAAS;gBACX,CAAC;gBAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;YAC7H,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,GAAG,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,GAAG,mBAAmB,OAAO,MAAM,GAAG,EAAE,CAAC,CAAC;gBAErE,IAAI,OAAO,IAAI,YAAY,CAAC,MAAM,EAAE,CAAC;oBACnC,MAAM,KAAK,CAAC,YAAY,CAAC,OAAO,GAAG,CAAC,CAAE,CAAC,CAAC;oBACxC,SAAS;gBACX,CAAC;gBAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;YACpF,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAChI,CAAC;CACF;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/dist/lib/notifications/router.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Notification Router (Feature 12, Story 12.8)
+ *
+ * Central dispatcher that resolves channel IDs, applies grouping,
+ * and routes to the correct provider. Used by both AlertEngine
+ * and GuardrailEngine.
+ */
+import type { NotificationPayload, DeliveryResult } from '@agentlensai/core';
+import type { NotificationChannelRepository } from '../../db/repositories/notification-channel-repository.js';
+export declare class NotificationRouter {
+    private repo;
+    private providers;
+    private groupingBuffer;
+    private webhookProvider;
+    constructor(repo: NotificationChannelRepository);
+    /**
+     * Dispatch notifications for the given channel entries.
+     * Channel entries can be:
+     * - Raw URLs (backward compat) → sent via WebhookProvider inline
+     * - Channel IDs (ULIDs) → resolved from DB and routed to correct provider
+     */
+    dispatch(channelEntries: string[], payload: NotificationPayload, tenantId?: string): Promise<DeliveryResult[]>;
+    private dispatchDirect;
+    /** Test a specific channel */
+    testChannel(channelId: string, tenantId?: string): Promise<DeliveryResult>;
+    private logResult;
+    private isUrl;
+    stop(): void;
+}
+//# sourceMappingURL=router.d.ts.map

package/dist/lib/notifications/router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../../src/lib/notifications/router.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAuB,cAAc,EAAwB,MAAM,mBAAmB,CAAC;AAExH,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,0DAA0D,CAAC;AAW9G,qBAAa,kBAAkB;IAKjB,OAAO,CAAC,IAAI;IAJxB,OAAO,CAAC,SAAS,CAAoC;IACrD,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,eAAe,CAAkB;gBAErB,IAAI,EAAE,6BAA6B;IAiBvD;;;;;OAKG;IACG,QAAQ,CACZ,cAAc,EAAE,MAAM,EAAE,EACxB,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,GAAE,MAAkB,GAC3B,OAAO,CAAC,cAAc,EAAE,CAAC;YAiBd,cAAc;IAgD5B,8BAA8B;IACxB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;YAclE,SAAS;IAyBvB,OAAO,CAAC,KAAK;IAIb,IAAI,IAAI,IAAI;CAGb"}

package/dist/lib/notifications/router.js

@@ -0,0 +1,137 @@
+/**
+ * Notification Router (Feature 12, Story 12.8)
+ *
+ * Central dispatcher that resolves channel IDs, applies grouping,
+ * and routes to the correct provider. Used by both AlertEngine
+ * and GuardrailEngine.
+ */
+import { ulid } from 'ulid';
+import { WebhookProvider } from './providers/webhook.js';
+import { SlackProvider } from './providers/slack.js';
+import { PagerDutyProvider } from './providers/pagerduty.js';
+import { EmailProvider } from './providers/email.js';
+import { GroupingBuffer } from './grouping-buffer.js';
+import { isWebhookUrlAllowed } from './ssrf.js';
+import { createLogger } from '../logger.js';
+const log = createLogger('NotificationRouter');
+export class NotificationRouter {
+    repo;
+    providers;
+    groupingBuffer;
+    webhookProvider;
+    constructor(repo) {
+        this.repo = repo;
+        this.webhookProvider = new WebhookProvider();
+        this.providers = new Map([
+            ['webhook', this.webhookProvider],
+            ['slack', new SlackProvider()],
+            ['pagerduty', new PagerDutyProvider()],
+            ['email', new EmailProvider()],
+        ]);
+        this.groupingBuffer = new GroupingBuffer(async (payload, groupCount) => {
+            // On group flush, re-dispatch without grouping
+            await this.dispatchDirect(payload, payload.metadata._channelEntries ?? [], payload.metadata._tenantId ?? 'default');
+        });
+    }
+    /**
+     * Dispatch notifications for the given channel entries.
+     * Channel entries can be:
+     * - Raw URLs (backward compat) → sent via WebhookProvider inline
+     * - Channel IDs (ULIDs) → resolved from DB and routed to correct provider
+     */
+    async dispatch(channelEntries, payload, tenantId = 'default') {
+        if (channelEntries.length === 0)
+            return [];
+        // Apply grouping
+        const enrichedPayload = {
+            ...payload,
+            metadata: { ...payload.metadata, _channelEntries: channelEntries, _tenantId: tenantId },
+        };
+        const shouldSend = this.groupingBuffer.submit(payload.ruleId, enrichedPayload);
+        if (!shouldSend) {
+            log.info(`Alert for rule ${payload.ruleId} grouped (suppressed)`);
+            return [];
+        }
+        return this.dispatchDirect(payload, channelEntries, tenantId);
+    }
+    async dispatchDirect(payload, channelEntries, tenantId) {
+        const results = [];
+        for (const entry of channelEntries) {
+            try {
+                if (this.isUrl(entry)) {
+                    // Backward compat: raw URL → inline webhook
+                    if (!isWebhookUrlAllowed(entry)) {
+                        log.warn(`SSRF blocked: ${entry}`);
+                        continue;
+                    }
+                    const result = await this.webhookProvider.sendToUrl(entry, payload);
+                    results.push(result);
+                    await this.logResult(result, payload, tenantId, entry);
+                }
+                else {
+                    // Channel ID → resolve and dispatch
+                    const channel = await this.repo.getChannel(entry, tenantId);
+                    if (!channel) {
+                        log.warn(`Notification channel not found: ${entry}`);
+                        continue;
+                    }
+                    if (!channel.enabled) {
+                        log.info(`Notification channel disabled: ${channel.name} (${entry})`);
+                        continue;
+                    }
+                    const provider = this.providers.get(channel.type);
+                    if (!provider) {
+                        log.warn(`No provider for channel type: ${channel.type}`);
+                        continue;
+                    }
+                    const result = await provider.send(channel, payload);
+                    results.push(result);
+                    await this.logResult(result, payload, tenantId, channel.id);
+                }
+            }
+            catch (err) {
+                log.error(`Notification dispatch error for ${entry}: ${err}`);
+            }
+        }
+        return results;
+    }
+    /** Test a specific channel */
+    async testChannel(channelId, tenantId) {
+        const channel = await this.repo.getChannel(channelId, tenantId);
+        if (!channel) {
+            return { success: false, channelId, channelType: 'webhook', attempt: 1, error: 'Channel not found' };
+        }
+        const provider = this.providers.get(channel.type);
+        if (!provider) {
+            return { success: false, channelId, channelType: channel.type, attempt: 1, error: `No provider for type: ${channel.type}` };
+        }
+        return provider.testSend(channel);
+    }
+    async logResult(result, payload, tenantId, channelId) {
+        try {
+            const logEntry = {
+                id: ulid(),
+                tenantId,
+                channelId,
+                ruleId: payload.ruleId,
+                ruleType: payload.source,
+                status: result.success ? 'success' : 'failed',
+                attempt: result.attempt,
+                errorMessage: result.error,
+                payloadSummary: JSON.stringify({ title: payload.title, severity: payload.severity }).slice(0, 500),
+                createdAt: new Date().toISOString(),
+            };
+            await this.repo.insertLog(logEntry);
+        }
+        catch (err) {
+            log.error(`Failed to log notification result: ${err}`);
+        }
+    }
+    isUrl(s) {
+        return s.startsWith('http://') || s.startsWith('https://');
+    }
+    stop() {
+        this.groupingBuffer.stop();
+    }
+}
+//# sourceMappingURL=router.js.map

package/dist/lib/notifications/router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.js","sourceRoot":"","sources":["../../../src/lib/notifications/router.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,MAAM,GAAG,GAAG,YAAY,CAAC,oBAAoB,CAAC,CAAC;AAE/C,MAAM,OAAO,kBAAkB;IAKT;IAJZ,SAAS,CAAoC;IAC7C,cAAc,CAAiB;IAC/B,eAAe,CAAkB;IAEzC,YAAoB,IAAmC;QAAnC,SAAI,GAAJ,IAAI,CAA+B;QACrD,IAAI,CAAC,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;QAC7C,IAAI,CAAC,SAAS,GAAG,IAAI,GAAG,CAA+B;YACrD,CAAC,SAAS,EAAE,IAAI,CAAC,eAAe,CAAC;YACjC,CAAC,OAAO,EAAE,IAAI,aAAa,EAAE,CAAC;YAC9B,CAAC,WAAW,EAAE,IAAI,iBAAiB,EAAE,CAAC;YACtC,CAAC,OAAO,EAAE,IAAI,aAAa,EAAE,CAAC;SAC/B,CAAC,CAAC;QAEH,IAAI,CAAC,cAAc,GAAG,IAAI,cAAc,CACtC,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE;YAC5B,+CAA+C;YAC/C,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,eAA2B,IAAI,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAmB,IAAI,SAAS,CAAC,CAAC;QAC5I,CAAC,CACF,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CACZ,cAAwB,EACxB,OAA4B,EAC5B,WAAmB,SAAS;QAE5B,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAE3C,iBAAiB;QACjB,MAAM,eAAe,GAAG;YACtB,GAAG,OAAO;YACV,QAAQ,EAAE,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,eAAe,EAAE,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE;SACxF,CAAC;QACF,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QAC/E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,GAAG,CAAC,IAAI,CAAC,kBAAkB,OAAO,CAAC,MAAM,uBAAuB,CAAC,CAAC;YAClE,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;IAChE,CAAC;IAEO,KAAK,CAAC,cAAc,CAC1B,OAA4B,EAC5B,cAAwB,EACxB,QAAgB;QAEhB,MAAM,OAAO,GAAqB,EAAE,CAAC;QAErC,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;oBACtB,4CAA4C;oBAC5C,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;wBAChC,GAAG,CAAC,IAAI,CAAC,iBAAiB,KAAK,EAAE,CAAC,CAAC;wBACnC,SAAS;oBACX,CAAC;oBACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;oBACpE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBACrB,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;gBACzD,CAAC;qBAAM,CAAC;oBACN,oCAAoC;oBACpC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;oBAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;wBACb,GAAG,CAAC,IAAI,CAAC,mCAAmC,KAAK,EAAE,CAAC,CAAC;wBACrD,SAAS;oBACX,CAAC;oBACD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;wBACrB,GAAG,CAAC,IAAI,CAAC,kCAAkC,OAAO,CAAC,IAAI,KAAK,KAAK,GAAG,CAAC,CAAC;wBACtE,SAAS;oBACX,CAAC;oBAED,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;oBAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;wBACd,GAAG,CAAC,IAAI,CAAC,iCAAiC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;wBAC1D,SAAS;oBACX,CAAC;oBAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBACrD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBACrB,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;gBAC9D,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,KAAK,CAAC,mCAAmC,KAAK,KAAK,GAAG,EAAE,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,8BAA8B;IAC9B,KAAK,CAAC,WAAW,CAAC,SAAiB,EAAE,QAAiB;QACpD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;QACvG,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,yBAAyB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9H,CAAC;QAED,OAAO,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IAEO,KAAK,CAAC,SAAS,CACrB,MAAsB,EACtB,OAA4B,EAC5B,QAAgB,EAChB,SAAiB;QAEjB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAyB;gBACrC,EAAE,EAAE,IAAI,EAAE;gBACV,QAAQ;gBACR,SAAS;gBACT,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,QAAQ,EAAE,OAAO,CAAC,MAAM;gBACxB,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;gBAC7C,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,YAAY,EAAE,MAAM,CAAC,KAAK;gBAC1B,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBAClG,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC;YACF,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,sCAAsC,GAAG,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,CAAS;QACrB,OAAO,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI;QACF,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAC7B,CAAC;CACF"}

package/dist/lib/notifications/ssrf.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Consolidated SSRF protection (Feature 12, SEC-2)
+ *
+ * Single implementation used by all notification providers and both
+ * AlertEngine and GuardrailEngine.
+ */
+export declare function validateExternalUrl(urlStr: string): {
+    valid: boolean;
+    reason?: string;
+};
+/** Simple boolean check (backward compat with AlertEngine) */
+export declare function isWebhookUrlAllowed(url: string): boolean;
+//# sourceMappingURL=ssrf.d.ts.map

package/dist/lib/notifications/ssrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf.d.ts","sourceRoot":"","sources":["../../../src/lib/notifications/ssrf.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAyBvF;AAED,8DAA8D;AAC9D,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAExD"}

package/dist/lib/notifications/ssrf.js

@@ -0,0 +1,37 @@
+/**
+ * Consolidated SSRF protection (Feature 12, SEC-2)
+ *
+ * Single implementation used by all notification providers and both
+ * AlertEngine and GuardrailEngine.
+ */
+const PRIVATE_IP_PATTERNS = [
+    /^127\./, /^10\./, /^172\.(1[6-9]|2\d|3[01])\./, /^192\.168\./,
+    /^169\.254\./, /^0\./,
+];
+export function validateExternalUrl(urlStr) {
+    let parsed;
+    try {
+        parsed = new URL(urlStr);
+    }
+    catch {
+        return { valid: false, reason: 'Invalid URL' };
+    }
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+        return { valid: false, reason: `Disallowed protocol: ${parsed.protocol}` };
+    }
+    const hostname = parsed.hostname.toLowerCase().replace(/^\[|\]$/g, '');
+    // Block localhost variants
+    if (hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '::1' || hostname === '0:0:0:0:0:0:0:1') {
+        return { valid: false, reason: 'Localhost URLs are not allowed' };
+    }
+    // Block private IP ranges
+    if (PRIVATE_IP_PATTERNS.some((p) => p.test(hostname))) {
+        return { valid: false, reason: `Private IP range blocked: ${hostname}` };
+    }
+    return { valid: true };
+}
+/** Simple boolean check (backward compat with AlertEngine) */
+export function isWebhookUrlAllowed(url) {
+    return validateExternalUrl(url).valid;
+}
+//# sourceMappingURL=ssrf.js.map

package/dist/lib/notifications/ssrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf.js","sourceRoot":"","sources":["../../../src/lib/notifications/ssrf.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,mBAAmB,GAAG;IAC1B,QAAQ,EAAE,OAAO,EAAE,4BAA4B,EAAE,aAAa;IAC9D,aAAa,EAAE,MAAM;CACtB,CAAC;AAEF,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACjD,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC7E,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAEvE,2BAA2B;IAC3B,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;QACjH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IACpE,CAAC;IAED,0BAA0B;IAC1B,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACtD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,QAAQ,EAAE,EAAE,CAAC;IAC3E,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;AACxC,CAAC"}

package/dist/lib/optimization/analyzers/model-downgrade.d.ts

@@ -0,0 +1,15 @@
+/**
+ * ModelDowngradeAnalyzer (Feature 17 — Story 17.2)
+ *
+ * Wraps the existing OptimizationEngine and maps its CostRecommendation
+ * output to EnhancedRecommendation with category 'model_downgrade'.
+ */
+import type { ModelCosts, EnhancedRecommendation } from '@agentlensai/core';
+import type { Analyzer, AnalyzerContext } from './types.js';
+export declare class ModelDowngradeAnalyzer implements Analyzer {
+    readonly name = "model_downgrade";
+    private engine;
+    constructor(modelCosts?: ModelCosts);
+    analyze(ctx: AnalyzerContext): Promise<EnhancedRecommendation[]>;
+}
+//# sourceMappingURL=model-downgrade.d.ts.map

package/dist/lib/optimization/analyzers/model-downgrade.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-downgrade.d.ts","sourceRoot":"","sources":["../../../../src/lib/optimization/analyzers/model-downgrade.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAG5E,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAG5D,qBAAa,sBAAuB,YAAW,QAAQ;IACrD,QAAQ,CAAC,IAAI,qBAAqB;IAClC,OAAO,CAAC,MAAM,CAAqB;gBAEvB,UAAU,GAAE,UAAgC;IAIlD,OAAO,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC;CA4CvE"}

package/dist/lib/optimization/analyzers/model-downgrade.js

@@ -0,0 +1,58 @@
+/**
+ * ModelDowngradeAnalyzer (Feature 17 — Story 17.2)
+ *
+ * Wraps the existing OptimizationEngine and maps its CostRecommendation
+ * output to EnhancedRecommendation with category 'model_downgrade'.
+ */
+import { DEFAULT_MODEL_COSTS } from '@agentlensai/core';
+import { OptimizationEngine } from '../engine.js';
+import { createHash } from 'node:crypto';
+export class ModelDowngradeAnalyzer {
+    name = 'model_downgrade';
+    engine;
+    constructor(modelCosts = DEFAULT_MODEL_COSTS) {
+        this.engine = new OptimizationEngine(modelCosts);
+    }
+    async analyze(ctx) {
+        const result = await this.engine.getRecommendations(ctx.store, {
+            agentId: ctx.agentId,
+            period: ctx.period,
+            limit: ctx.limit,
+        });
+        const now = new Date().toISOString();
+        return result.recommendations.map((rec) => {
+            const id = createHash('sha256')
+                .update(`model_downgrade:${rec.agentId}:${rec.currentModel}:${rec.recommendedModel}:${rec.complexityTier}`)
+                .digest('hex')
+                .slice(0, 16);
+            return {
+                id,
+                category: 'model_downgrade',
+                estimatedMonthlySavings: rec.monthlySavings,
+                confidence: rec.confidence,
+                difficulty: 'config_change',
+                actionableSteps: [
+                    `Change model from ${rec.currentModel} to ${rec.recommendedModel} for ${rec.complexityTier} complexity calls`,
+                    'Monitor success rate for 48h after switch',
+                ],
+                agentId: rec.agentId,
+                evidence: {
+                    callsAnalyzed: rec.callVolume,
+                    period: ctx.period,
+                },
+                createdAt: now,
+                modelDowngrade: {
+                    currentModel: rec.currentModel,
+                    recommendedModel: rec.recommendedModel,
+                    complexityTier: rec.complexityTier,
+                    currentCostPerCall: rec.currentCostPerCall,
+                    recommendedCostPerCall: rec.recommendedCostPerCall,
+                    callVolume: rec.callVolume,
+                    currentSuccessRate: rec.currentSuccessRate,
+                    recommendedSuccessRate: rec.recommendedSuccessRate,
+                },
+            };
+        });
+    }
+}
+//# sourceMappingURL=model-downgrade.js.map

package/dist/lib/optimization/analyzers/model-downgrade.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-downgrade.js","sourceRoot":"","sources":["../../../../src/lib/optimization/analyzers/model-downgrade.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,OAAO,sBAAsB;IACxB,IAAI,GAAG,iBAAiB,CAAC;IAC1B,MAAM,CAAqB;IAEnC,YAAY,aAAyB,mBAAmB;QACtD,IAAI,CAAC,MAAM,GAAG,IAAI,kBAAkB,CAAC,UAAU,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAoB;QAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,EAAE;YAC7D,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,KAAK,EAAE,GAAG,CAAC,KAAK;SACjB,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAErC,OAAO,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YACxC,MAAM,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC;iBAC5B,MAAM,CAAC,mBAAmB,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;iBAC1G,MAAM,CAAC,KAAK,CAAC;iBACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAEhB,OAAO;gBACL,EAAE;gBACF,QAAQ,EAAE,iBAA0B;gBACpC,uBAAuB,EAAE,GAAG,CAAC,cAAc;gBAC3C,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,UAAU,EAAE,eAAwB;gBACpC,eAAe,EAAE;oBACf,qBAAqB,GAAG,CAAC,YAAY,OAAO,GAAG,CAAC,gBAAgB,QAAQ,GAAG,CAAC,cAAc,mBAAmB;oBAC7G,2CAA2C;iBAC5C;gBACD,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,QAAQ,EAAE;oBACR,aAAa,EAAE,GAAG,CAAC,UAAU;oBAC7B,MAAM,EAAE,GAAG,CAAC,MAAM;iBACnB;gBACD,SAAS,EAAE,GAAG;gBACd,cAAc,EAAE;oBACd,YAAY,EAAE,GAAG,CAAC,YAAY;oBAC9B,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;oBACtC,cAAc,EAAE,GAAG,CAAC,cAAc;oBAClC,kBAAkB,EAAE,GAAG,CAAC,kBAAkB;oBAC1C,sBAAsB,EAAE,GAAG,CAAC,sBAAsB;oBAClD,UAAU,EAAE,GAAG,CAAC,UAAU;oBAC1B,kBAAkB,EAAE,GAAG,CAAC,kBAAkB;oBAC1C,sBAAsB,EAAE,GAAG,CAAC,sBAAsB;iBACnD;aACF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/lib/optimization/analyzers/prompt-optimization.d.ts

@@ -0,0 +1,17 @@
+/**
+ * PromptOptimizationAnalyzer (Feature 17 — Story 17.3)
+ *
+ * Detects cost-saving opportunities in prompt construction:
+ * 1. System prompts exceeding 4,000 tokens (string length ÷ 4 estimation)
+ * 2. Repeated context patterns within sessions (>30% shared prefix)
+ */
+import type { ModelCosts, EnhancedRecommendation } from '@agentlensai/core';
+import type { Analyzer, AnalyzerContext } from './types.js';
+export declare class PromptOptimizationAnalyzer implements Analyzer {
+    private readonly modelCosts;
+    readonly name = "prompt_optimization";
+    constructor(modelCosts?: ModelCosts);
+    analyze(ctx: AnalyzerContext): Promise<EnhancedRecommendation[]>;
+    private determineConfidence;
+}
+//# sourceMappingURL=prompt-optimization.d.ts.map

package/dist/lib/optimization/analyzers/prompt-optimization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt-optimization.d.ts","sourceRoot":"","sources":["../../../../src/lib/optimization/analyzers/prompt-optimization.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EACV,UAAU,EACV,sBAAsB,EAKvB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAM5D,qBAAa,0BAA2B,YAAW,QAAQ;IAG7C,OAAO,CAAC,QAAQ,CAAC,UAAU;IAFvC,QAAQ,CAAC,IAAI,yBAAyB;gBAET,UAAU,GAAE,UAAgC;IAEnE,OAAO,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC;IA8JtE,OAAO,CAAC,mBAAmB;CAK5B"}

package/dist/lib/optimization/analyzers/prompt-optimization.js

@@ -0,0 +1,160 @@
+/**
+ * PromptOptimizationAnalyzer (Feature 17 — Story 17.3)
+ *
+ * Detects cost-saving opportunities in prompt construction:
+ * 1. System prompts exceeding 4,000 tokens (string length ÷ 4 estimation)
+ * 2. Repeated context patterns within sessions (>30% shared prefix)
+ */
+import { DEFAULT_MODEL_COSTS, lookupModelCost } from '@agentlensai/core';
+import { createHash } from 'node:crypto';
+const SYSTEM_PROMPT_TOKEN_THRESHOLD = 4000;
+const REPEATED_CONTEXT_RATIO = 0.3;
+export class PromptOptimizationAnalyzer {
+    modelCosts;
+    name = 'prompt_optimization';
+    constructor(modelCosts = DEFAULT_MODEL_COSTS) {
+        this.modelCosts = modelCosts;
+    }
+    async analyze(ctx) {
+        const recommendations = [];
+        const now = new Date().toISOString();
+        // Group calls by (agentId, model)
+        const groupMap = new Map();
+        // Session-level grouping for repeated context detection
+        const sessionCalls = new Map();
+        for (const evt of ctx.llmCallEvents) {
+            const payload = evt.payload;
+            const model = payload.model;
+            if (!model || !payload.messages)
+                continue;
+            const agentId = evt.agentId;
+            const groupKey = `${agentId}::${model}`;
+            // System prompt analysis
+            let group = groupMap.get(groupKey);
+            if (!group) {
+                group = { agentId, model, systemTokenCounts: [], sessionIds: new Set(), callCount: 0 };
+                groupMap.set(groupKey, group);
+            }
+            group.callCount++;
+            if (evt.sessionId)
+                group.sessionIds.add(evt.sessionId);
+            const systemMsgs = payload.messages.filter(m => m.role === 'system');
+            if (systemMsgs.length > 0) {
+                const totalLen = systemMsgs.reduce((sum, m) => sum + (m.content?.length ?? 0), 0);
+                const estimatedTokens = Math.ceil(totalLen / 4);
+                group.systemTokenCounts.push(estimatedTokens);
+            }
+            // Repeated context: hash first non-system message content as prefix
+            if (evt.sessionId) {
+                const sessionKey = `${evt.sessionId}::${model}`;
+                let sc = sessionCalls.get(sessionKey);
+                if (!sc) {
+                    sc = { agentId, model, prefixHashes: [] };
+                    sessionCalls.set(sessionKey, sc);
+                }
+                const nonSystem = payload.messages.filter(m => m.role !== 'system');
+                if (nonSystem.length > 0) {
+                    const prefix = nonSystem.map(m => m.content ?? '').join('|').slice(0, 500);
+                    const hash = createHash('md5').update(prefix).digest('hex');
+                    sc.prefixHashes.push(hash);
+                }
+            }
+        }
+        // Detect large system prompts
+        for (const [, group] of groupMap) {
+            if (group.systemTokenCounts.length === 0)
+                continue;
+            const sorted = [...group.systemTokenCounts].sort((a, b) => a - b);
+            const median = sorted[Math.floor(sorted.length / 2)];
+            if (median > SYSTEM_PROMPT_TOKEN_THRESHOLD) {
+                const reducible = Math.floor((median - SYSTEM_PROMPT_TOKEN_THRESHOLD) * 0.5);
+                const modelCost = lookupModelCost(group.model, this.modelCosts);
+                const inputCostPer1M = modelCost?.input ?? 3;
+                const savings = (reducible / 1_000_000) * inputCostPer1M * group.callCount * (30 / ctx.period);
+                if (savings <= 0)
+                    continue;
+                const id = createHash('sha256')
+                    .update(`prompt_optimization:system_prompt_size:${group.agentId}:${group.model}`)
+                    .digest('hex')
+                    .slice(0, 16);
+                const sessionArr = Array.from(group.sessionIds);
+                recommendations.push({
+                    id,
+                    category: 'prompt_optimization',
+                    estimatedMonthlySavings: Math.round(savings * 1_000_000) / 1_000_000,
+                    confidence: this.determineConfidence(group.callCount),
+                    difficulty: 'code_change',
+                    actionableSteps: [
+                        `Reduce system prompt for ${group.model} — median is ~${median} tokens, ${SYSTEM_PROMPT_TOKEN_THRESHOLD} recommended`,
+                        'Consider extracting static instructions into a reference doc or using prompt compression',
+                    ],
+                    agentId: group.agentId,
+                    evidence: { callsAnalyzed: group.callCount, period: ctx.period },
+                    createdAt: now,
+                    promptOptimization: {
+                        targetType: 'system_prompt_size',
+                        currentTokens: median,
+                        estimatedReducibleTokens: reducible,
+                        sampleSessionIds: sessionArr.slice(0, 3),
+                    },
+                });
+            }
+        }
+        // Detect repeated context within sessions
+        for (const [sessionKey, sc] of sessionCalls) {
+            if (sc.prefixHashes.length < 3)
+                continue;
+            // Count most frequent prefix hash
+            const freq = new Map();
+            for (const h of sc.prefixHashes) {
+                freq.set(h, (freq.get(h) ?? 0) + 1);
+            }
+            const maxFreq = Math.max(...freq.values());
+            const ratio = maxFreq / sc.prefixHashes.length;
+            if (ratio > REPEATED_CONTEXT_RATIO && maxFreq >= 3) {
+                // Estimate token savings: average message length of repeated prefix
+                const estimatedTokensSaved = 500; // conservative estimate per repeated call
+                const modelCost = lookupModelCost(sc.model, this.modelCosts);
+                const inputCostPer1M = modelCost?.input ?? 3;
+                const redundantCalls = maxFreq - 1;
+                const savings = (estimatedTokensSaved / 1_000_000) * inputCostPer1M * redundantCalls * (30 / ctx.period);
+                if (savings <= 0)
+                    continue;
+                const sessionId = sessionKey.split('::')[0];
+                const id = createHash('sha256')
+                    .update(`prompt_optimization:repeated_context:${sc.agentId}:${sessionId}`)
+                    .digest('hex')
+                    .slice(0, 16);
+                recommendations.push({
+                    id,
+                    category: 'prompt_optimization',
+                    estimatedMonthlySavings: Math.round(savings * 1_000_000) / 1_000_000,
+                    confidence: this.determineConfidence(sc.prefixHashes.length),
+                    difficulty: 'code_change',
+                    actionableSteps: [
+                        `Session has ${maxFreq} calls with repeated context prefix — consider caching or summarizing context`,
+                        'Use conversation summarization to reduce context window growth',
+                    ],
+                    agentId: sc.agentId,
+                    evidence: { callsAnalyzed: sc.prefixHashes.length, period: ctx.period },
+                    createdAt: now,
+                    promptOptimization: {
+                        targetType: 'repeated_context',
+                        currentTokens: estimatedTokensSaved * maxFreq,
+                        estimatedReducibleTokens: estimatedTokensSaved * redundantCalls,
+                        sampleSessionIds: [sessionId],
+                    },
+                });
+            }
+        }
+        return recommendations;
+    }
+    determineConfidence(callCount) {
+        if (callCount >= 50)
+            return 'high';
+        if (callCount >= 20)
+            return 'medium';
+        return 'low';
+    }
+}
+//# sourceMappingURL=prompt-optimization.js.map

package/dist/lib/optimization/analyzers/prompt-optimization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt-optimization.js","sourceRoot":"","sources":["../../../../src/lib/optimization/analyzers/prompt-optimization.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAUH,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEzE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,6BAA6B,GAAG,IAAI,CAAC;AAC3C,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAEnC,MAAM,OAAO,0BAA0B;IAGR;IAFpB,IAAI,GAAG,qBAAqB,CAAC;IAEtC,YAA6B,aAAyB,mBAAmB;QAA5C,eAAU,GAAV,UAAU,CAAkC;IAAG,CAAC;IAE7E,KAAK,CAAC,OAAO,CAAC,GAAoB;QAChC,MAAM,eAAe,GAA6B,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAErC,kCAAkC;QAClC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAMpB,CAAC;QAEL,wDAAwD;QACxD,MAAM,YAAY,GAAG,IAAI,GAAG,EAIxB,CAAC;QAEL,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;YACpC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAkC,CAAC;YACvD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;YAC5B,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAAE,SAAS;YAE1C,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;YAC5B,MAAM,QAAQ,GAAG,GAAG,OAAO,KAAK,KAAK,EAAE,CAAC;YAExC,yBAAyB;YACzB,IAAI,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACnC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,KAAK,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,GAAG,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;gBACvF,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAChC,CAAC;YACD,KAAK,CAAC,SAAS,EAAE,CAAC;YAClB,IAAI,GAAG,CAAC,SAAS;gBAAE,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAEvD,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;YACrE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBAClF,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;gBAChD,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAChD,CAAC;YAED,oEAAoE;YACpE,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;gBAClB,MAAM,UAAU,GAAG,GAAG,GAAG,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;gBAChD,IAAI,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACtC,IAAI,CAAC,EAAE,EAAE,CAAC;oBACR,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;oBAC1C,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;gBACnC,CAAC;gBACD,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;gBACpE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACzB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;oBAC3E,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBAC5D,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC;QACH,CAAC;QAED,8BAA8B;QAC9B,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;YACjC,IAAI,KAAK,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACnD,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAClE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;YAErD,IAAI,MAAM,GAAG,6BAA6B,EAAE,CAAC;gBAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,6BAA6B,CAAC,GAAG,GAAG,CAAC,CAAC;gBAC7E,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;gBAChE,MAAM,cAAc,GAAG,SAAS,EAAE,KAAK,IAAI,CAAC,CAAC;gBAC7C,MAAM,OAAO,GAAG,CAAC,SAAS,GAAG,SAAS,CAAC,GAAG,cAAc,GAAG,KAAK,CAAC,SAAS,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;gBAE/F,IAAI,OAAO,IAAI,CAAC;oBAAE,SAAS;gBAE3B,MAAM,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC;qBAC5B,MAAM,CAAC,0CAA0C,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;qBAChF,MAAM,CAAC,KAAK,CAAC;qBACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAEhB,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBAChD,eAAe,CAAC,IAAI,CAAC;oBACnB,EAAE;oBACF,QAAQ,EAAE,qBAAqB;oBAC/B,uBAAuB,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,SAAS,CAAC,GAAG,SAAS;oBACpE,UAAU,EAAE,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,SAAS,CAAC;oBACrD,UAAU,EAAE,aAAa;oBACzB,eAAe,EAAE;wBACf,4BAA4B,KAAK,CAAC,KAAK,iBAAiB,MAAM,YAAY,6BAA6B,cAAc;wBACrH,0FAA0F;qBAC3F;oBACD,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,QAAQ,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE;oBAChE,SAAS,EAAE,GAAG;oBACd,kBAAkB,EAAE;wBAClB,UAAU,EAAE,oBAAoB;wBAChC,aAAa,EAAE,MAAM;wBACrB,wBAAwB,EAAE,SAAS;wBACnC,gBAAgB,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;qBACzC;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,0CAA0C;QAC1C,KAAK,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,YAAY,EAAE,CAAC;YAC5C,IAAI,EAAE,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;gBAAE,SAAS;YAEzC,kCAAkC;YAClC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;YACvC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,YAAY,EAAE,CAAC;gBAChC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACtC,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YAC3C,MAAM,KAAK,GAAG,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC;YAE/C,IAAI,KAAK,GAAG,sBAAsB,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;gBACnD,oEAAoE;gBACpE,MAAM,oBAAoB,GAAG,GAAG,CAAC,CAAC,0CAA0C;gBAC5E,MAAM,SAAS,GAAG,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;gBAC7D,MAAM,cAAc,GAAG,SAAS,EAAE,KAAK,IAAI,CAAC,CAAC;gBAC7C,MAAM,cAAc,GAAG,OAAO,GAAG,CAAC,CAAC;gBACnC,MAAM,OAAO,GAAG,CAAC,oBAAoB,GAAG,SAAS,CAAC,GAAG,cAAc,GAAG,cAAc,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;gBAEzG,IAAI,OAAO,IAAI,CAAC;oBAAE,SAAS;gBAE3B,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5C,MAAM,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC;qBAC5B,MAAM,CAAC,wCAAwC,EAAE,CAAC,OAAO,IAAI,SAAS,EAAE,CAAC;qBACzE,MAAM,CAAC,KAAK,CAAC;qBACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAEhB,eAAe,CAAC,IAAI,CAAC;oBACnB,EAAE;oBACF,QAAQ,EAAE,qBAAqB;oBAC/B,uBAAuB,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,SAAS,CAAC,GAAG,SAAS;oBACpE,UAAU,EAAE,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC;oBAC5D,UAAU,EAAE,aAAa;oBACzB,eAAe,EAAE;wBACf,eAAe,OAAO,+EAA+E;wBACrG,gEAAgE;qBACjE;oBACD,OAAO,EAAE,EAAE,CAAC,OAAO;oBACnB,QAAQ,EAAE,EAAE,aAAa,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE;oBACvE,SAAS,EAAE,GAAG;oBACd,kBAAkB,EAAE;wBAClB,UAAU,EAAE,kBAAkB;wBAC9B,aAAa,EAAE,oBAAoB,GAAG,OAAO;wBAC7C,wBAAwB,EAAE,oBAAoB,GAAG,cAAc;wBAC/D,gBAAgB,EAAE,CAAC,SAAS,CAAC;qBAC9B;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,eAAe,CAAC;IACzB,CAAC;IAEO,mBAAmB,CAAC,SAAiB;QAC3C,IAAI,SAAS,IAAI,EAAE;YAAE,OAAO,MAAM,CAAC;QACnC,IAAI,SAAS,IAAI,EAAE;YAAE,OAAO,QAAQ,CAAC;QACrC,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/lib/optimization/analyzers/types.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Analyzer Plugin Interface (Feature 17 — Story 17.1)
+ */
+import type { IEventStore, AgentLensEvent, EnhancedRecommendation } from '@agentlensai/core';
+export interface AnalyzerContext {
+    store: IEventStore;
+    agentId?: string;
+    from: string;
+    to: string;
+    period: number;
+    limit: number;
+    /** Pre-fetched llm_call events (shared across analyzers) */
+    llmCallEvents: AgentLensEvent[];
+    /** Pre-fetched llm_response events (shared across analyzers) */
+    llmResponseEvents: AgentLensEvent[];
+    /** callId → llm_response event map */
+    responseMap: Map<string, AgentLensEvent>;
+}
+export interface Analyzer {
+    readonly name: string;
+    analyze(ctx: AnalyzerContext): Promise<EnhancedRecommendation[]>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/lib/optimization/analyzers/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/lib/optimization/analyzers/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAE7F,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,WAAW,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,4DAA4D;IAC5D,aAAa,EAAE,cAAc,EAAE,CAAC;IAChC,gEAAgE;IAChE,iBAAiB,EAAE,cAAc,EAAE,CAAC;IACpC,sCAAsC;IACtC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC;CAClE"}

package/dist/lib/optimization/analyzers/types.js

@@ -0,0 +1,5 @@
+/**
+ * Analyzer Plugin Interface (Feature 17 — Story 17.1)
+ */
+export {};
+//# sourceMappingURL=types.js.map