@junando/core 0.10.0 → 0.11.0

package/dist/index.js

@@ -230,6 +230,7 @@ var AlertmanagerPayloadSchema = z.object({
 
 // src/domain/entities/cluster.ts
 import { z as z2 } from "zod";
+var SEVERITY_VALUES = ["critical", "high", "medium", "low"];
 var AlertClusterSchema = z2.object({
   fingerprint: z2.string(),
   serviceName: z2.string(),
@@ -239,7 +240,11 @@ var AlertClusterSchema = z2.object({
   alertCount: z2.number().int().positive(),
   representativeTraceIds: z2.array(z2.string()).max(2),
   firstSeenAt: z2.string().datetime(),
-  latencyP99Ms: z2.number().optional()
+  latencyP99Ms: z2.number().optional(),
+  /** Severity level — can be derived from ALERT_TYPE_LABELS[alertType].severity */
+  severity: z2.enum(SEVERITY_VALUES).optional(),
+  /** Arbitrary key-value labels passed through from alerts */
+  labels: z2.record(z2.string()).optional()
 });
 
 // src/domain/entities/incident.ts
@@ -260,6 +265,73 @@ var IncidentSchema = z3.object({
   processedAt: z3.string().datetime()
 });
 
+// src/domain/entities/rule.ts
+import { z as z4 } from "zod";
+var RuleActionType = /* @__PURE__ */ ((RuleActionType2) => {
+  RuleActionType2["Suppress"] = "suppress";
+  RuleActionType2["Route"] = "route";
+  RuleActionType2["Escalate"] = "escalate";
+  RuleActionType2["Tag"] = "tag";
+  return RuleActionType2;
+})(RuleActionType || {});
+var SeverityLevel = /* @__PURE__ */ ((SeverityLevel2) => {
+  SeverityLevel2["Critical"] = "critical";
+  SeverityLevel2["High"] = "high";
+  SeverityLevel2["Medium"] = "medium";
+  SeverityLevel2["Low"] = "low";
+  return SeverityLevel2;
+})(SeverityLevel || {});
+var RuleEvaluationPhase = /* @__PURE__ */ ((RuleEvaluationPhase2) => {
+  RuleEvaluationPhase2["PreLlm"] = "pre-llm";
+  RuleEvaluationPhase2["PostLlm"] = "post-llm";
+  return RuleEvaluationPhase2;
+})(RuleEvaluationPhase || {});
+var AlertCountSchema = z4.object({
+  min: z4.number().optional(),
+  max: z4.number().optional()
+});
+var LatencySchema = z4.object({
+  min: z4.number().optional(),
+  max: z4.number().optional()
+});
+var RuleConditionSchema = z4.object({
+  serviceName: z4.string().optional(),
+  alertType: z4.nativeEnum(AlertType).optional(),
+  severity: z4.nativeEnum(SeverityLevel).optional(),
+  labels: z4.record(z4.string()).optional(),
+  endpointPath: z4.string().optional(),
+  alertCount: AlertCountSchema.optional(),
+  latencyP99Ms: LatencySchema.optional(),
+  urgencyLevel: UrgencyLevelSchema.optional(),
+  requiresRollback: z4.boolean().optional(),
+  impactedServices: z4.array(z4.string()).optional()
+});
+var SUPPRESS_SCHEMA = z4.object({ type: z4.literal("suppress" /* Suppress */) });
+var ROUTE_SCHEMA = z4.object({ type: z4.literal("route" /* Route */), channel: z4.string().min(1) });
+var ESCALATE_SCHEMA = z4.object({ type: z4.literal("escalate" /* Escalate */), channel: z4.string().min(1) });
+var TAG_SCHEMA = z4.object({ type: z4.literal("tag" /* Tag */), key: z4.string().min(1), value: z4.string().min(1) });
+var RuleActionSchema = z4.discriminatedUnion("type", [
+  SUPPRESS_SCHEMA,
+  ROUTE_SCHEMA,
+  ESCALATE_SCHEMA,
+  TAG_SCHEMA
+]);
+var RuleSchema = z4.object({
+  id: z4.string().min(1),
+  name: z4.string().optional(),
+  condition: RuleConditionSchema,
+  actions: z4.array(RuleActionSchema).min(1),
+  urgencyLevel: UrgencyLevelSchema.optional(),
+  requiresRollback: z4.boolean().optional()
+});
+var RuleSectionSchema = z4.object({
+  rules: z4.array(RuleSchema).default([])
+});
+var RuleConfigurationSchema = z4.object({
+  ["pre-llm" /* PreLlm */]: RuleSectionSchema,
+  ["post-llm" /* PostLlm */]: RuleSectionSchema
+});
+
 // src/domain/value-objects/fingerprint.ts
 import { createHash } from "crypto";
 var Fingerprint = class _Fingerprint {
@@ -383,6 +455,7 @@ __export(metrics_exports, {
   pipelineInlineFailuresTotal: () => pipelineInlineFailuresTotal,
   registry: () => registry,
   sqsQueueLag: () => sqsQueueLag,
+  suppressedClusters: () => suppressedClusters,
   webhookRequestsTotal: () => webhookRequestsTotal
 });
 import { Registry, Counter, Gauge, Histogram } from "prom-client";
@@ -465,6 +538,12 @@ var sqsQueueLag = new Gauge({
   labelNames: ["queue_name"],
   registers: [registry]
 });
+var suppressedClusters = new Gauge({
+  name: "junando_suppressed_clusters",
+  help: "Current number of clusters suppressed by the rule engine",
+  labelNames: ["rule_id"],
+  registers: [registry]
+});
 
 // src/application/use-cases/process-incident.use-case.ts
 var ProcessIncidentUseCase = class {
@@ -475,7 +554,7 @@ var ProcessIncidentUseCase = class {
   deps;
   clustering;
   async execute(alerts, correlationId) {
-    const { dedup, traces, llm, notifier, logger: logger5, dedupTtlSeconds } = this.deps;
+    const { dedup, traces, llm, notifier, logger: logger5, dedupTtlSeconds, ruleEngine } = this.deps;
     const log = logger5.child({ correlationId, useCase: "ProcessIncident" });
     log.info({ alertCount: alerts.length }, "Processing alert batch");
     const clusters = this.clustering.buildClusters(alerts);
@@ -490,6 +569,26 @@ var ProcessIncidentUseCase = class {
         continue;
       }
       dedupNew.inc({ source: "alertmanager" });
+      let preLlmRouteChannels = [];
+      let preLlmEscalateChannels = [];
+      if (ruleEngine) {
+        const preResult = ruleEngine.evaluatePreLlm(cluster);
+        if (preResult.suppressed) {
+          log2.info({ matchedRuleId: preResult.matchedRuleId }, "Cluster suppressed by rule engine");
+          if (preResult.matchedRuleId) {
+            suppressedClusters.inc({ rule_id: preResult.matchedRuleId });
+          }
+          continue;
+        }
+        for (const action of preResult.actions) {
+          if (action.type === "route" && "channel" in action) {
+            preLlmRouteChannels.push(action.channel);
+          }
+          if (action.type === "escalate" && "channel" in action) {
+            preLlmEscalateChannels.push(action.channel);
+          }
+        }
+      }
       const spanLists = await Promise.all(
         cluster.representativeTraceIds.map(
           (id) => traces.findByTraceId(id).catch((err) => {
@@ -507,8 +606,31 @@ var ProcessIncidentUseCase = class {
       } catch (err) {
         log2.warn({ err }, "LLM inference failed \u2014 notifying without diagnosis");
       }
+      let postLlmEscalateChannels = [];
+      if (ruleEngine && analysis) {
+        const postResult = ruleEngine.evaluatePostLlm(cluster, analysis);
+        for (const action of postResult.actions) {
+          if (action.type === "escalate" && "channel" in action) {
+            postLlmEscalateChannels.push(action.channel);
+          }
+          if (action.type === "tag" && "key" in action) {
+            log2.info({ tagKey: action.key, tagValue: action.value }, "Tag attached to cluster");
+          }
+        }
+        if (postResult.tags && Object.keys(postResult.tags).length > 0) {
+          cluster.labels = { ...cluster.labels, ...postResult.tags };
+        }
+      }
       try {
-        await notifier.send(cluster, analysis);
+        const primaryChannel = preLlmRouteChannels[0];
+        const escalateChannels = [
+          ...preLlmEscalateChannels,
+          ...postLlmEscalateChannels
+        ];
+        await notifier.send(cluster, analysis, primaryChannel);
+        for (const channel of escalateChannels) {
+          await notifier.send(cluster, analysis, channel);
+        }
         log2.info("Notification sent");
       } catch (err) {
         log2.error({ err }, "Notification failed");
@@ -727,24 +849,24 @@ var InMemoryIndexer = class {
 
 // src/infrastructure/llm/llm.adapter.ts
 import * as Breaker from "opossum";
-import { z as z4 } from "zod";
+import { z as z5 } from "zod";
 var logger2 = createLogger();
-var OpenRouterResponseSchema = z4.object({
-  id: z4.string().optional(),
-  choices: z4.array(
-    z4.object({
-      index: z4.number(),
-      message: z4.object({
-        role: z4.string(),
-        content: z4.string().optional()
+var OpenRouterResponseSchema = z5.object({
+  id: z5.string().optional(),
+  choices: z5.array(
+    z5.object({
+      index: z5.number(),
+      message: z5.object({
+        role: z5.string(),
+        content: z5.string().optional()
       }),
-      finish_reason: z4.string().optional()
+      finish_reason: z5.string().optional()
     })
   ),
-  usage: z4.object({
-    prompt_tokens: z4.number().optional(),
-    completion_tokens: z4.number().optional(),
-    total_tokens: z4.number().optional()
+  usage: z5.object({
+    prompt_tokens: z5.number().optional(),
+    completion_tokens: z5.number().optional(),
+    total_tokens: z5.number().optional()
   }).optional()
 });
 var SYSTEM_PROMPT = `You are a senior Site Reliability Engineer.
@@ -1005,6 +1127,53 @@ function createLLMProvider(provider, apiKey, model, options) {
   return factory(apiKey, model, options);
 }
 
+// src/infrastructure/notifier/factory.ts
+import { readFileSync } from "fs";
+
+// src/shared/factory-registry.ts
+var FactoryRegistry = class {
+  _factories = /* @__PURE__ */ new Map();
+  _default = () => {
+    throw new Error(`No factory registered and no default available`);
+  };
+  /**
+   * Register a factory for a given key.
+   * Overwrites any existing registration for that key.
+   */
+  register(key, factory) {
+    this._factories.set(key, factory);
+  }
+  /**
+   * Set the default factory to use when no key matches.
+   */
+  registerDefault(factory) {
+    this._default = factory;
+  }
+  /**
+   * Resolve the factory for a given key.
+   * Returns the default if no specific factory is registered for that key.
+   */
+  resolve(key) {
+    const factory = this._factories.get(key);
+    if (factory) {
+      return factory();
+    }
+    return this._default();
+  }
+  /**
+   * Check if a factory is registered for a given key.
+   */
+  has(key) {
+    return this._factories.has(key);
+  }
+  /**
+   * Return all registered keys.
+   */
+  keys() {
+    return Array.from(this._factories.keys());
+  }
+};
+
 // src/infrastructure/notifier/slack.adapter.ts
 var logger3 = createLogger();
 function sanitizeEndpointPath(endpointPath) {
@@ -1018,7 +1187,7 @@ var SlackNotifier = class {
   }
   botToken;
   channel;
-  async send(cluster, analysis) {
+  async send(cluster, analysis, _channel) {
     const payload = analysis ? this.buildAnalysisMessage(cluster, analysis) : this.buildFallbackMessage(cluster);
     try {
       const res = await fetch(SLACK_API_URL, {
@@ -1140,7 +1309,7 @@ LLM analysis unavailable \u2014 manual investigation required.`
 };
 var ConsoleNotifier = class {
   sent = [];
-  async send(cluster, analysis) {
+  async send(cluster, analysis, _channel) {
     try {
       this.sent.push({ cluster, analysis });
       logger3.info(
@@ -1297,7 +1466,7 @@ var TeamsNotifier = class {
   // If parsing happens inside the catch block and throws, the original error
   // context (timeout, network failure, etc.) would be lost.
   hostForErrors;
-  async send(cluster, analysis) {
+  async send(cluster, analysis, _channel) {
     const card = analysis ? buildAnalysisCard(cluster, analysis) : buildFallbackCard(cluster);
     const payload = buildAdaptiveCardPayload(card);
     const controller = new AbortController();
@@ -1335,15 +1504,350 @@ var TeamsNotifier = class {
   }
 };
 
+// src/infrastructure/notifier/routing-notifier.ts
+var ACTION_DISPATCH = {
+  ["suppress" /* Suppress */]: async (_action, ctx) => {
+    ctx.suppressed = true;
+  },
+  ["route" /* Route */]: async (action, ctx) => {
+    const routeAction = action;
+    ctx.routeChannels.add(routeAction.channel);
+  },
+  ["escalate" /* Escalate */]: async (action, ctx) => {
+    const escalateAction = action;
+    ctx.escalationChannels.add(escalateAction.channel);
+  },
+  ["tag" /* Tag */]: async (_action, _ctx) => {
+  }
+};
+var RoutingNotifier = class {
+  constructor(registry2, defaultNotifier) {
+    this.registry = registry2;
+    this.defaultNotifier = defaultNotifier;
+  }
+  registry;
+  defaultNotifier;
+  /**
+   * Implements INotifier.send — sends via default notifier.
+   * Backward-compatible with existing call sites that don't use rule actions.
+   */
+  async send(cluster, analysis) {
+    await this.defaultNotifier.send(cluster, analysis);
+  }
+  /**
+   * Dispatch notifications based on rule engine actions.
+   *
+   * - Route actions: send to the specified channel instead of default.
+   * - Escalate actions: send additional notifications to escalation channels.
+   * - Tag actions: metadata-only, no notification side effect.
+   * - Suppress actions: skip all notification (defensive — caller should have already skipped).
+   * - Unknown channels: fall back to default notifier.
+   * - Empty actions or no Route/Escalate: send via default notifier.
+   */
+  async sendWithActions(cluster, analysis, actions) {
+    const ctx = {
+      cluster,
+      analysis,
+      registry: this.registry,
+      defaultNotifier: this.defaultNotifier,
+      routeChannels: /* @__PURE__ */ new Set(),
+      escalationChannels: /* @__PURE__ */ new Set(),
+      suppressed: false
+    };
+    for (const action of actions) {
+      const handler = ACTION_DISPATCH[action.type];
+      if (handler) {
+        await handler(action, ctx);
+      }
+    }
+    if (ctx.suppressed) {
+      return;
+    }
+    const notifications = [];
+    const hasRoute = ctx.routeChannels.size > 0;
+    if (hasRoute) {
+      for (const channel of ctx.routeChannels) {
+        notifications.push(this.tryResolveAndSend(channel, cluster, analysis));
+      }
+    } else {
+      notifications.push(this.defaultNotifier.send(cluster, analysis));
+    }
+    for (const channel of ctx.escalationChannels) {
+      notifications.push(this.tryResolveAndSend(channel, cluster, analysis));
+    }
+    await Promise.all(notifications);
+  }
+  // ── Private helpers ──────────────────────────────────────────────────────
+  /**
+   * Resolve a channel name to its notifier and send.
+   * Falls back to default notifier if channel is unknown.
+   */
+  async tryResolveAndSend(channel, cluster, analysis) {
+    try {
+      const notifier = this.registry.resolve(channel);
+      await notifier.send(cluster, analysis);
+    } catch {
+      await this.defaultNotifier.send(cluster, analysis);
+    }
+  }
+};
+
+// src/infrastructure/rules/yaml-rule-loader.ts
+import { parse as parseYaml, YAMLParseError } from "yaml";
+function parseRuleConfig(yamlString) {
+  let raw;
+  try {
+    raw = parseYaml(yamlString);
+  } catch (err) {
+    if (err instanceof YAMLParseError) {
+      throw new Error(`Invalid YAML in rules config: ${err.message}`);
+    }
+    throw err;
+  }
+  const result = RuleConfigurationSchema.safeParse(raw);
+  if (!result.success) {
+    const issues = result.error.issues.map((i3) => `  - ${i3.path.join(".")}: ${i3.message}`).join("\n");
+    throw new Error(`Invalid rules configuration:
+${issues}`);
+  }
+  return result.data;
+}
+
+// src/infrastructure/rules/channel-registry.ts
+var ChannelRegistry = class {
+  _channels = /* @__PURE__ */ new Map();
+  _default = null;
+  /**
+   * Register a notifier for a given channel name.
+   * Overwrites any existing registration for that name.
+   */
+  register(channel, notifier) {
+    this._channels.set(channel, notifier);
+  }
+  /**
+   * Set the default notifier to use when a channel is not found.
+   */
+  setDefault(notifier) {
+    this._default = notifier;
+  }
+  /**
+   * Resolve a channel name to its notifier instance.
+   * Falls back to the default notifier if the channel is unknown.
+   *
+   * @throws {Error} if the channel is unknown and no default is set
+   */
+  resolve(channel) {
+    const instance = this._channels.get(channel);
+    if (instance) {
+      return instance;
+    }
+    if (this._default) {
+      return this._default;
+    }
+    throw new Error(
+      `Unknown channel "${channel}" and no default notifier configured`
+    );
+  }
+  /**
+   * Check if a channel is registered.
+   */
+  has(channel) {
+    return this._channels.has(channel);
+  }
+};
+
+// src/infrastructure/rules/condition-evaluator.ts
+var MATCHER_MAP = {
+  serviceName: (value) => {
+    const target = value.toLowerCase();
+    return (cluster) => cluster.serviceName.toLowerCase() === target;
+  },
+  alertType: (value) => {
+    return (cluster) => cluster.alertType === value;
+  },
+  severity: (value) => {
+    return (cluster) => {
+      const config = ALERT_TYPE_LABELS[cluster.alertType];
+      return config?.severity === value;
+    };
+  },
+  endpointPath: (value) => {
+    return (cluster) => cluster.endpointPath === value;
+  },
+  alertCount: (value) => {
+    const range = value;
+    return (cluster) => {
+      const count = cluster.alertCount;
+      if (range.min !== void 0 && count < range.min) return false;
+      if (range.max !== void 0 && count > range.max) return false;
+      return true;
+    };
+  },
+  latencyP99Ms: (value) => {
+    const range = value;
+    return (cluster) => {
+      const latency2 = cluster.latencyP99Ms;
+      if (latency2 === void 0) return false;
+      if (range.min !== void 0 && latency2 < range.min) return false;
+      if (range.max !== void 0 && latency2 > range.max) return false;
+      return true;
+    };
+  },
+  labels: (value) => {
+    const expected = value;
+    return (cluster) => {
+      const clusterLabels = cluster.labels;
+      if (!clusterLabels) return false;
+      return Object.entries(expected).every(
+        ([key, val]) => clusterLabels[key] === val
+      );
+    };
+  },
+  urgencyLevel: (value) => {
+    return (_cluster, analysis) => {
+      if (!analysis) return false;
+      return analysis.urgency_level === value;
+    };
+  },
+  requiresRollback: (value) => {
+    return (_cluster, analysis) => {
+      if (!analysis) return false;
+      return analysis.requires_rollback === value;
+    };
+  },
+  impactedServices: (value) => {
+    const targets = value;
+    return (_cluster, analysis) => {
+      if (!analysis) return false;
+      return targets.some((t) => analysis.impacted_services.includes(t));
+    };
+  }
+};
+function compileCondition(condition) {
+  const predicates = [];
+  for (const [field, value] of Object.entries(condition)) {
+    if (value === void 0) continue;
+    const factory = MATCHER_MAP[field];
+    if (factory) {
+      predicates.push(factory(value));
+    }
+  }
+  if (predicates.length === 0) {
+    return () => true;
+  }
+  return (cluster, analysis) => predicates.every((p) => p(cluster, analysis));
+}
+
+// src/infrastructure/rules/action-dispatcher.ts
+var HANDLER_MAP = {
+  ["suppress" /* Suppress */]: (_action, result) => {
+    result.suppressed = true;
+  },
+  ["route" /* Route */]: (action, result) => {
+    result.actions.push(action);
+  },
+  ["escalate" /* Escalate */]: (action, result) => {
+    result.actions.push(action);
+  },
+  ["tag" /* Tag */]: (action, result) => {
+    const tagAction = action;
+    result.tags[tagAction.key] = tagAction.value;
+  }
+};
+function dispatchActions(actions) {
+  const result = {
+    suppressed: false,
+    actions: [],
+    tags: {}
+  };
+  for (const action of actions) {
+    const handler = HANDLER_MAP[action.type];
+    if (handler) {
+      handler(action, result);
+    }
+  }
+  return result;
+}
+
+// src/infrastructure/rules/rule-engine.ts
+var RuleEngine = class {
+  preLlmRules;
+  postLlmRules;
+  constructor(config) {
+    this.preLlmRules = this.compileSection(config["pre-llm" /* PreLlm */].rules);
+    this.postLlmRules = this.compileSection(config["post-llm" /* PostLlm */].rules);
+  }
+  /**
+   * Evaluate PRE-LLM rules against a cluster.
+   * First-match-wins — returns result of first matching rule.
+   * If no rule matches, returns pass-through (suppressed=false, no actions).
+   */
+  evaluatePreLlm(cluster) {
+    return this.evaluateRules(this.preLlmRules, cluster);
+  }
+  /**
+   * Evaluate POST-LLM rules against a cluster and LLM analysis.
+   * First-match-wins — returns result of first matching rule.
+   * If no rule matches, returns pass-through.
+   */
+  evaluatePostLlm(cluster, analysis) {
+    return this.evaluateRules(this.postLlmRules, cluster, analysis);
+  }
+  // ── Private helpers ──────────────────────────────────────────────────────
+  compileSection(rules) {
+    return rules.map((rule) => ({
+      id: rule.id,
+      predicate: compileCondition(rule.condition),
+      result: dispatchActions(rule.actions)
+    }));
+  }
+  evaluateRules(rules, cluster, analysis) {
+    for (const rule of rules) {
+      if (rule.predicate(cluster, analysis)) {
+        return {
+          ...rule.result,
+          matchedRuleId: rule.id
+        };
+      }
+    }
+    return {
+      suppressed: false,
+      actions: [],
+      tags: {}
+    };
+  }
+};
+
 // src/infrastructure/notifier/factory.ts
+function buildNotifierRegistry(config) {
+  const registry2 = new FactoryRegistry();
+  registry2.register("teams", () => {
+    if (!config.teamsWebhookUrl) {
+      throw new Error("NOTIFIER_TYPE=teams requires TEAMS_WEBHOOK_URL to be set");
+    }
+    return new TeamsNotifier(config.teamsWebhookUrl);
+  });
+  registry2.register("slack", () => {
+    if (!config.slackBotToken || !config.slackChannel) {
+      throw new Error("NOTIFIER_TYPE=slack requires SLACK_BOT_TOKEN and SLACK_CHANNEL to be set");
+    }
+    return new SlackNotifier(config.slackBotToken, config.slackChannel);
+  });
+  registry2.registerDefault(() => new SlackNotifier("dummy-token", "#alerts"));
+  return registry2;
+}
 function createNotifier(config) {
-  switch (config.notifierType) {
-    case "teams":
-      return new TeamsNotifier(config.teamsWebhookUrl);
-    case "slack":
-    default:
-      return new SlackNotifier(config.slackBotToken, config.slackChannel);
-  }
+  const registry2 = buildNotifierRegistry(config);
+  const defaultNotifier = registry2.resolve(config.notifierType);
+  if (!config.rulesConfigPath) {
+    console.info("[createNotifier] RULES_CONFIG_PATH not set \u2014 rule engine disabled, using default notifier");
+    return defaultNotifier;
+  }
+  const yamlContent = readFileSync(config.rulesConfigPath, "utf-8");
+  parseRuleConfig(yamlContent);
+  const channelRegistry = new ChannelRegistry();
+  channelRegistry.setDefault(defaultNotifier);
+  return new RoutingNotifier(channelRegistry, defaultNotifier);
 }
 
 // ../../node_modules/.pnpm/@smithy+smithy-client@4.12.13/node_modules/@smithy/smithy-client/dist-es/NoOpLogger.js
@@ -9743,7 +10247,7 @@ var GetParametersCommand = class extends Command.classBuilder().ep(commonParams2
 };
 
 // src/shared/config/index.ts
-import { z as z5 } from "zod";
+import { z as z6 } from "zod";
 async function loadSecretsFromSSM() {
   const prefix = process.env.SSM_PREFIX;
   if (!prefix) {
@@ -9779,51 +10283,53 @@ async function loadSecretsFromSSM() {
     createLogger().error({ err }, "Failed to load SSM parameters");
   }
 }
-var ConfigSchema = z5.object({
-  llmProvider: z5.enum(["gemini", "claude", "openrouter", "qwen"]),
-  llmApiKey: z5.string().min(1),
-  llmModel: z5.string().optional().transform((v) => v === "" ? void 0 : v),
+var ConfigSchema = z6.object({
+  llmProvider: z6.enum(["gemini", "claude", "openrouter", "qwen"]),
+  llmApiKey: z6.string().min(1),
+  llmModel: z6.string().optional().transform((v) => v === "" ? void 0 : v),
   // Notifier selector — defaults to 'slack' for backward compatibility
-  notifierType: z5.enum(["slack", "teams"]).default("slack"),
+  notifierType: z6.enum(["slack", "teams"]).default("slack"),
   // Slack fields — optional at schema level; superRefine enforces them conditionally
-  slackBotToken: z5.string().startsWith("xoxb-").optional(),
-  slackSigningSecret: z5.string().min(1).optional(),
-  slackChannel: z5.string().startsWith("#").optional(),
+  slackBotToken: z6.string().startsWith("xoxb-").optional(),
+  slackSigningSecret: z6.string().min(1).optional(),
+  slackChannel: z6.string().startsWith("#").optional(),
   // Teams field
-  teamsWebhookUrl: z5.string().url().optional(),
-  lokiUrl: z5.string().optional().transform((v) => v === "" ? void 0 : v),
+  teamsWebhookUrl: z6.string().url().optional(),
+  lokiUrl: z6.string().optional().transform((v) => v === "" ? void 0 : v),
   // URL with embedded credentials — skip .url() which rejects user:pass@ format. Optional: containers may run without Loki; logger falls back to stdout. Empty string is coerced to undefined (env var unset vs empty are equivalent).
-  redisUrl: z5.string().url(),
-  sqsQueueUrl: z5.string().url().optional().or(z5.literal("")),
-  dedupTtlSeconds: z5.coerce.number().int().positive().default(300),
-  clusterWindowMs: z5.coerce.number().int().positive().default(12e4),
-  logLevel: z5.enum(["trace", "debug", "info", "warn", "error"]).default("info"),
-  nodeEnv: z5.enum(["development", "test", "production"]).default("development"),
-  llmFallbackModels: z5.string().optional().transform((v) => {
+  redisUrl: z6.string().url(),
+  sqsQueueUrl: z6.string().url().optional().or(z6.literal("")),
+  dedupTtlSeconds: z6.coerce.number().int().positive().default(300),
+  clusterWindowMs: z6.coerce.number().int().positive().default(12e4),
+  logLevel: z6.enum(["trace", "debug", "info", "warn", "error"]).default("info"),
+  nodeEnv: z6.enum(["development", "test", "production"]).default("development"),
+  llmFallbackModels: z6.string().optional().transform((v) => {
     if (v === void 0) return LLM_FALLBACK_DEFAULTS.Models;
     if (!v) return [];
     return v.split(",").map((s) => s.trim()).filter(Boolean);
   }),
-  llmFallbackTimeoutMs: z5.coerce.number().int().positive().default(LLM_FALLBACK_DEFAULTS.TimeoutMs)
+  llmFallbackTimeoutMs: z6.coerce.number().int().positive().default(LLM_FALLBACK_DEFAULTS.TimeoutMs),
+  // Optional path to rules.yaml for business rules engine. When not set, rule engine is disabled.
+  rulesConfigPath: z6.string().optional().transform((v) => v === "" ? void 0 : v)
 }).superRefine((data, ctx) => {
   if (data.notifierType === "slack") {
     if (!data.slackBotToken) {
       ctx.addIssue({
-        code: z5.ZodIssueCode.custom,
+        code: z6.ZodIssueCode.custom,
         path: ["slackBotToken"],
         message: "[notifierType: slack] SLACK_BOT_TOKEN is required and must start with xoxb-"
       });
     }
     if (!data.slackChannel) {
       ctx.addIssue({
-        code: z5.ZodIssueCode.custom,
+        code: z6.ZodIssueCode.custom,
         path: ["slackChannel"],
         message: "[notifierType: slack] SLACK_CHANNEL is required and must start with #"
       });
     }
     if (!data.slackSigningSecret) {
       ctx.addIssue({
-        code: z5.ZodIssueCode.custom,
+        code: z6.ZodIssueCode.custom,
         path: ["slackSigningSecret"],
         message: "[notifierType: slack] SLACK_SIGNING_SECRET is required (used to verify Slack interactivity callbacks)"
       });
@@ -9832,7 +10338,7 @@ var ConfigSchema = z5.object({
   if (data.notifierType === "teams") {
     if (!data.teamsWebhookUrl) {
       ctx.addIssue({
-        code: z5.ZodIssueCode.custom,
+        code: z6.ZodIssueCode.custom,
         path: ["teamsWebhookUrl"],
         message: "[notifierType: teams] TEAMS_WEBHOOK_URL is required"
       });
@@ -9842,14 +10348,14 @@ var ConfigSchema = z5.object({
         parsed = new URL(data.teamsWebhookUrl);
       } catch {
         ctx.addIssue({
-          code: z5.ZodIssueCode.custom,
+          code: z6.ZodIssueCode.custom,
           path: ["teamsWebhookUrl"],
           message: "[notifierType: teams] TEAMS_WEBHOOK_URL must be a valid URL"
         });
       }
       if (parsed && !parsed.searchParams.has("api-version")) {
         ctx.addIssue({
-          code: z5.ZodIssueCode.custom,
+          code: z6.ZodIssueCode.custom,
           path: ["teamsWebhookUrl"],
           message: "[notifierType: teams] TEAMS_WEBHOOK_URL must include api-version= as a query parameter"
         });
@@ -9876,7 +10382,8 @@ async function loadConfig2() {
     logLevel: process.env["LOG_LEVEL"],
     nodeEnv: process.env["NODE_ENV"],
     llmFallbackModels: process.env["LLM_FALLBACK_MODELS"],
-    llmFallbackTimeoutMs: process.env["LLM_FALLBACK_TIMEOUT_MS"]
+    llmFallbackTimeoutMs: process.env["LLM_FALLBACK_TIMEOUT_MS"],
+    rulesConfigPath: process.env["RULES_CONFIG_PATH"]
   });
   if (!result.success) {
     const errorMessages = result.error.issues.map(
@@ -9894,11 +10401,13 @@ export {
   AlertType,
   AlertmanagerPayloadSchema,
   CIRCUIT_BREAKER,
+  ChannelRegistry,
   ClaudeProvider,
   ClusteringService,
   ConsoleNotifier,
   DEDUP_TTL_MS_MULTIPLIER,
   DEV_SERVER_PORT,
+  FactoryRegistry,
   Fingerprint,
   GeminiProvider,
   HOUR_MS,
@@ -9922,8 +10431,18 @@ export {
   RATE_LIMITER,
   REDIS_KEY_PREFIX,
   RedisDeduplicationStore,
+  RoutingNotifier,
+  RuleActionSchema,
+  RuleActionType,
+  RuleConditionSchema,
+  RuleConfigurationSchema,
+  RuleEngine,
+  RuleEvaluationPhase,
+  RuleSchema,
+  RuleSectionSchema,
   SLACK_API_URL,
   SQSAlertQueue,
+  SeverityLevel,
   SlackNotifier,
   TEAMS_WEBHOOK_TIMEOUT_MS,
   TeamsNotifier,
@@ -9931,13 +10450,16 @@ export {
   URGENCY_EMOJI,
   UrgencyLevelSchema,
   WEBHOOK_DEFAULTS,
+  compileCondition,
   createLLMProvider,
   createLogger,
   createNotifier,
+  dispatchActions,
   flushLoki,
   loadConfig2 as loadConfig,
   metrics_exports as metrics,
   normalizePayload,
+  parseRuleConfig,
   reinitLogger,
   startSqsLagPoller
 };