@junando/core 0.10.1 → 0.11.1

package/dist/index.d.ts

@@ -1,51 +1,52 @@
-import { z } from 'zod';
-import pino from 'pino';
-import { Redis } from 'ioredis';
-import { Gauge, Counter, Histogram, Registry } from 'prom-client';
-
+import { t as index_d_exports } from "./shared/metrics/index.js";
+import { z } from "zod";
+import pino from "pino";
+import { Writable } from "node:stream";
+import { Redis } from "ioredis";
+//#region src/shared/constants.d.ts
 declare enum AlertType {
-    Error = "http_500",
-    Warning = "latency_spike",
-    Success = "recovery"
+  Error = "http_500",
+  Warning = "latency_spike",
+  Success = "recovery"
 }
 interface AlertTypeConfig {
-    readonly alertName: string;
-    readonly severity: string;
-    readonly summary: (service: string, i: number, count: number) => string;
+  readonly alertName: string;
+  readonly severity: string;
+  readonly summary: (service: string, i: number, count: number) => string;
 }
 declare const _alertTypeConfigs: Record<AlertType, AlertTypeConfig>;
 declare const ALERT_TYPE_LABELS: Readonly<typeof _alertTypeConfigs>;
 declare enum LLMProviderType {
-    Gemini = "gemini",
-    Claude = "claude",
-    OpenRouter = "openrouter",
-    Qwen = "qwen"
+  Gemini = "gemini",
+  Claude = "claude",
+  OpenRouter = "openrouter",
+  Qwen = "qwen"
 }
 declare const HTTP_TIMEOUT_MS: Readonly<{
-    Default: 5000;
-    LLM: 30000;
+  Default: 5000;
+  LLM: 30000;
 }>;
 declare const CIRCUIT_BREAKER: Readonly<{
-    Timeout: 10000;
-    ErrorThresholdPercentage: 70;
-    ResetTimeoutMs: 30000;
+  Timeout: 10000;
+  ErrorThresholdPercentage: 70;
+  ResetTimeoutMs: 30000;
 }>;
 declare const LLM_MAX_TOKENS = 1024;
 declare const RATE_LIMITER: Readonly<{
-    MinTimeMs: 100;
-    MaxConcurrent: 5;
+  MinTimeMs: 100;
+  MaxConcurrent: 5;
 }>;
 declare const DEV_SERVER_PORT = 4000;
 declare const DEDUP_TTL_MS_MULTIPLIER = 1000;
 declare const HOUR_MS = 3600000;
 declare const LLM_FALLBACK_DEFAULTS: Readonly<{
-    TimeoutMs: 60000;
-    Models: string[];
+  TimeoutMs: 60000;
+  Models: string[];
 }>;
 declare const LLM_MODELS: Readonly<{
-    Gemini: "gemini-2.0-flash";
-    Claude: "claude-haiku-4-5";
-    OpenRouter: "qwen/qwen-2.5-72b-instruct";
+  Gemini: "gemini-2.0-flash";
+  Claude: "claude-haiku-4-5";
+  OpenRouter: "qwen/qwen-2.5-72b-instruct";
 }>;
 declare const SLACK_API_URL = "https://slack.com/api/chat.postMessage";
 declare const TEAMS_WEBHOOK_TIMEOUT_MS = 10000;
@@ -53,301 +54,478 @@ declare const _urgencyEmoji: Record<string, string>;
 declare const URGENCY_EMOJI: Readonly<typeof _urgencyEmoji>;
 declare const REDIS_KEY_PREFIX = "junando:dedup:";
 declare const WEBHOOK_DEFAULTS: Readonly<{
-    AlertmanagerUrl: "http://localhost:9093";
-    WebhookUrl: "http://localhost:4000/webhook/alert";
+  AlertmanagerUrl: "http://localhost:9093";
+  WebhookUrl: "http://localhost:4000/webhook/alert";
 }>;
 declare const PAYLOAD_DEFAULTS: Readonly<{
-    Version: "4";
-    TruncatedAlerts: 0;
-    Receiver: "junando";
+  Version: "4";
+  TruncatedAlerts: 0;
+  Receiver: "junando";
 }>;
-
-declare const AlertStatusSchema: z.ZodEnum<["firing", "resolved"]>;
-declare const NormalizedAlertSchema: z.ZodObject<{
-    fingerprint: z.ZodString;
-    alertName: z.ZodString;
-    status: z.ZodEnum<["firing", "resolved"]>;
-    serviceName: z.ZodString;
-    alertType: z.ZodNativeEnum<typeof AlertType>;
-    endpointPath: z.ZodString;
-    traceId: z.ZodOptional<z.ZodString>;
-    startsAt: z.ZodString;
-    latencyMs: z.ZodOptional<z.ZodNumber>;
-    labels: z.ZodRecord<z.ZodString, z.ZodString>;
-    annotations: z.ZodRecord<z.ZodString, z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    fingerprint: string;
-    alertName: string;
-    status: "firing" | "resolved";
-    serviceName: string;
-    alertType: AlertType;
-    endpointPath: string;
-    startsAt: string;
-    labels: Record<string, string>;
-    annotations: Record<string, string>;
-    traceId?: string | undefined;
-    latencyMs?: number | undefined;
-}, {
-    fingerprint: string;
-    alertName: string;
-    status: "firing" | "resolved";
-    serviceName: string;
-    alertType: AlertType;
-    endpointPath: string;
-    startsAt: string;
-    labels: Record<string, string>;
-    annotations: Record<string, string>;
-    traceId?: string | undefined;
-    latencyMs?: number | undefined;
+//#endregion
+//#region src/domain/entities/alert.d.ts
+declare const AlertStatusSchema: z.ZodEnum<{
+  firing: "firing";
+  resolved: "resolved";
 }>;
+declare const NormalizedAlertSchema: z.ZodObject<{
+  fingerprint: z.ZodString;
+  alertName: z.ZodString;
+  status: z.ZodEnum<{
+    firing: "firing";
+    resolved: "resolved";
+  }>;
+  serviceName: z.ZodString;
+  alertType: z.ZodEnum<typeof AlertType>;
+  endpointPath: z.ZodString;
+  traceId: z.ZodOptional<z.ZodString>;
+  startsAt: z.ZodString;
+  latencyMs: z.ZodOptional<z.ZodNumber>;
+  labels: z.ZodRecord<z.ZodString, z.ZodString>;
+  annotations: z.ZodRecord<z.ZodString, z.ZodString>;
+}, z.core.$strip>;
 declare const AlertmanagerPayloadSchema: z.ZodObject<{
-    version: z.ZodDefault<z.ZodString>;
-    groupKey: z.ZodString;
-    truncatedAlerts: z.ZodDefault<z.ZodNumber>;
-    status: z.ZodEnum<["firing", "resolved"]>;
-    receiver: z.ZodString;
-    groupLabels: z.ZodRecord<z.ZodString, z.ZodString>;
-    commonLabels: z.ZodRecord<z.ZodString, z.ZodString>;
-    commonAnnotations: z.ZodRecord<z.ZodString, z.ZodString>;
-    externalURL: z.ZodString;
-    alerts: z.ZodArray<z.ZodObject<{
-        status: z.ZodEnum<["firing", "resolved"]>;
-        labels: z.ZodRecord<z.ZodString, z.ZodString>;
-        annotations: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
-        startsAt: z.ZodString;
-        endsAt: z.ZodString;
-        fingerprint: z.ZodOptional<z.ZodString>;
-    }, "strip", z.ZodTypeAny, {
-        status: "firing" | "resolved";
-        startsAt: string;
-        labels: Record<string, string>;
-        annotations: Record<string, string>;
-        endsAt: string;
-        fingerprint?: string | undefined;
-    }, {
-        status: "firing" | "resolved";
-        startsAt: string;
-        labels: Record<string, string>;
-        endsAt: string;
-        fingerprint?: string | undefined;
-        annotations?: Record<string, string> | undefined;
-    }>, "many">;
-}, "strip", z.ZodTypeAny, {
-    status: "firing" | "resolved";
-    version: string;
-    groupKey: string;
-    truncatedAlerts: number;
-    receiver: string;
-    groupLabels: Record<string, string>;
-    commonLabels: Record<string, string>;
-    commonAnnotations: Record<string, string>;
-    externalURL: string;
-    alerts: {
-        status: "firing" | "resolved";
-        startsAt: string;
-        labels: Record<string, string>;
-        annotations: Record<string, string>;
-        endsAt: string;
-        fingerprint?: string | undefined;
-    }[];
-}, {
-    status: "firing" | "resolved";
-    groupKey: string;
-    receiver: string;
-    groupLabels: Record<string, string>;
-    commonLabels: Record<string, string>;
-    commonAnnotations: Record<string, string>;
-    externalURL: string;
-    alerts: {
-        status: "firing" | "resolved";
-        startsAt: string;
-        labels: Record<string, string>;
-        endsAt: string;
-        fingerprint?: string | undefined;
-        annotations?: Record<string, string> | undefined;
-    }[];
-    version?: string | undefined;
-    truncatedAlerts?: number | undefined;
-}>;
+  version: z.ZodDefault<z.ZodString>;
+  groupKey: z.ZodString;
+  truncatedAlerts: z.ZodDefault<z.ZodNumber>;
+  status: z.ZodEnum<{
+    firing: "firing";
+    resolved: "resolved";
+  }>;
+  receiver: z.ZodString;
+  groupLabels: z.ZodRecord<z.ZodString, z.ZodString>;
+  commonLabels: z.ZodRecord<z.ZodString, z.ZodString>;
+  commonAnnotations: z.ZodRecord<z.ZodString, z.ZodString>;
+  externalURL: z.ZodString;
+  alerts: z.ZodArray<z.ZodObject<{
+    status: z.ZodEnum<{
+      firing: "firing";
+      resolved: "resolved";
+    }>;
+    labels: z.ZodRecord<z.ZodString, z.ZodString>;
+    annotations: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    startsAt: z.ZodString;
+    endsAt: z.ZodString;
+    fingerprint: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>>;
+}, z.core.$strip>;
 type AlertStatus = z.infer<typeof AlertStatusSchema>;
 type NormalizedAlert = z.infer<typeof NormalizedAlertSchema>;
 type AlertmanagerPayload = z.infer<typeof AlertmanagerPayloadSchema>;
 type AlertErrorType = NormalizedAlert['alertType'];
-
+//#endregion
+//#region src/domain/entities/cluster.d.ts
 declare const AlertClusterSchema: z.ZodObject<{
+  fingerprint: z.ZodString;
+  serviceName: z.ZodString;
+  alertType: z.ZodEnum<typeof AlertType>;
+  endpointPath: z.ZodString;
+  alertCount: z.ZodNumber;
+  representativeTraceIds: z.ZodArray<z.ZodString>;
+  firstSeenAt: z.ZodString;
+  latencyP99Ms: z.ZodOptional<z.ZodNumber>;
+  severity: z.ZodOptional<z.ZodEnum<{
+    critical: "critical";
+    high: "high";
+    low: "low";
+    medium: "medium";
+  }>>;
+  labels: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, z.core.$strip>;
+type AlertCluster = z.infer<typeof AlertClusterSchema>;
+//#endregion
+//#region src/domain/entities/incident.d.ts
+declare const UrgencyLevelSchema: z.ZodEnum<{
+  critical: "critical";
+  high: "high";
+  low: "low";
+  medium: "medium";
+}>;
+declare const LLMAnalysisSchema: z.ZodObject<{
+  probable_cause: z.ZodString;
+  impacted_services: z.ZodArray<z.ZodString>;
+  recommended_steps: z.ZodArray<z.ZodString>;
+  urgency_level: z.ZodEnum<{
+    critical: "critical";
+    high: "high";
+    low: "low";
+    medium: "medium";
+  }>;
+  requires_rollback: z.ZodBoolean;
+}, z.core.$strip>;
+declare const IncidentSchema: z.ZodObject<{
+  cluster: z.ZodObject<{
     fingerprint: z.ZodString;
     serviceName: z.ZodString;
-    alertType: z.ZodNativeEnum<typeof AlertType>;
+    alertType: z.ZodEnum<typeof AlertType>;
     endpointPath: z.ZodString;
     alertCount: z.ZodNumber;
-    representativeTraceIds: z.ZodArray<z.ZodString, "many">;
+    representativeTraceIds: z.ZodArray<z.ZodString>;
     firstSeenAt: z.ZodString;
     latencyP99Ms: z.ZodOptional<z.ZodNumber>;
-}, "strip", z.ZodTypeAny, {
-    fingerprint: string;
-    serviceName: string;
-    alertType: AlertType;
-    endpointPath: string;
-    alertCount: number;
-    representativeTraceIds: string[];
-    firstSeenAt: string;
-    latencyP99Ms?: number | undefined;
-}, {
-    fingerprint: string;
-    serviceName: string;
-    alertType: AlertType;
-    endpointPath: string;
-    alertCount: number;
-    representativeTraceIds: string[];
-    firstSeenAt: string;
-    latencyP99Ms?: number | undefined;
-}>;
-type AlertCluster = z.infer<typeof AlertClusterSchema>;
-
-declare const UrgencyLevelSchema: z.ZodEnum<["low", "medium", "high", "critical"]>;
-declare const LLMAnalysisSchema: z.ZodObject<{
+    severity: z.ZodOptional<z.ZodEnum<{
+      critical: "critical";
+      high: "high";
+      low: "low";
+      medium: "medium";
+    }>>;
+    labels: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+  }, z.core.$strip>;
+  traces: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+  analysis: z.ZodOptional<z.ZodObject<{
     probable_cause: z.ZodString;
-    impacted_services: z.ZodArray<z.ZodString, "many">;
-    recommended_steps: z.ZodArray<z.ZodString, "many">;
-    urgency_level: z.ZodEnum<["low", "medium", "high", "critical"]>;
-    requires_rollback: z.ZodBoolean;
-}, "strip", z.ZodTypeAny, {
-    probable_cause: string;
-    impacted_services: string[];
-    recommended_steps: string[];
-    urgency_level: "critical" | "high" | "medium" | "low";
-    requires_rollback: boolean;
-}, {
-    probable_cause: string;
-    impacted_services: string[];
-    recommended_steps: string[];
-    urgency_level: "critical" | "high" | "medium" | "low";
-    requires_rollback: boolean;
-}>;
-declare const IncidentSchema: z.ZodObject<{
-    cluster: z.ZodObject<{
-        fingerprint: z.ZodString;
-        serviceName: z.ZodString;
-        alertType: z.ZodNativeEnum<typeof AlertType>;
-        endpointPath: z.ZodString;
-        alertCount: z.ZodNumber;
-        representativeTraceIds: z.ZodArray<z.ZodString, "many">;
-        firstSeenAt: z.ZodString;
-        latencyP99Ms: z.ZodOptional<z.ZodNumber>;
-    }, "strip", z.ZodTypeAny, {
-        fingerprint: string;
-        serviceName: string;
-        alertType: AlertType;
-        endpointPath: string;
-        alertCount: number;
-        representativeTraceIds: string[];
-        firstSeenAt: string;
-        latencyP99Ms?: number | undefined;
-    }, {
-        fingerprint: string;
-        serviceName: string;
-        alertType: AlertType;
-        endpointPath: string;
-        alertCount: number;
-        representativeTraceIds: string[];
-        firstSeenAt: string;
-        latencyP99Ms?: number | undefined;
+    impacted_services: z.ZodArray<z.ZodString>;
+    recommended_steps: z.ZodArray<z.ZodString>;
+    urgency_level: z.ZodEnum<{
+      critical: "critical";
+      high: "high";
+      low: "low";
+      medium: "medium";
     }>;
-    traces: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">>;
-    analysis: z.ZodOptional<z.ZodObject<{
-        probable_cause: z.ZodString;
-        impacted_services: z.ZodArray<z.ZodString, "many">;
-        recommended_steps: z.ZodArray<z.ZodString, "many">;
-        urgency_level: z.ZodEnum<["low", "medium", "high", "critical"]>;
-        requires_rollback: z.ZodBoolean;
-    }, "strip", z.ZodTypeAny, {
-        probable_cause: string;
-        impacted_services: string[];
-        recommended_steps: string[];
-        urgency_level: "critical" | "high" | "medium" | "low";
-        requires_rollback: boolean;
-    }, {
-        probable_cause: string;
-        impacted_services: string[];
-        recommended_steps: string[];
-        urgency_level: "critical" | "high" | "medium" | "low";
-        requires_rollback: boolean;
-    }>>;
-    processedAt: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    cluster: {
-        fingerprint: string;
-        serviceName: string;
-        alertType: AlertType;
-        endpointPath: string;
-        alertCount: number;
-        representativeTraceIds: string[];
-        firstSeenAt: string;
-        latencyP99Ms?: number | undefined;
-    };
-    processedAt: string;
-    traces?: Record<string, unknown>[] | undefined;
-    analysis?: {
-        probable_cause: string;
-        impacted_services: string[];
-        recommended_steps: string[];
-        urgency_level: "critical" | "high" | "medium" | "low";
-        requires_rollback: boolean;
-    } | undefined;
-}, {
-    cluster: {
-        fingerprint: string;
-        serviceName: string;
-        alertType: AlertType;
-        endpointPath: string;
-        alertCount: number;
-        representativeTraceIds: string[];
-        firstSeenAt: string;
-        latencyP99Ms?: number | undefined;
-    };
-    processedAt: string;
-    traces?: Record<string, unknown>[] | undefined;
-    analysis?: {
-        probable_cause: string;
-        impacted_services: string[];
-        recommended_steps: string[];
-        urgency_level: "critical" | "high" | "medium" | "low";
-        requires_rollback: boolean;
-    } | undefined;
-}>;
+    requires_rollback: z.ZodBoolean;
+  }, z.core.$strip>>;
+  processedAt: z.ZodString;
+}, z.core.$strip>;
 type UrgencyLevel = z.infer<typeof UrgencyLevelSchema>;
 type LLMAnalysis = z.infer<typeof LLMAnalysisSchema>;
 type Incident = z.infer<typeof IncidentSchema>;
-
+//#endregion
+//#region src/domain/entities/rule.d.ts
+declare enum RuleActionType {
+  Suppress = "suppress",
+  Route = "route",
+  Escalate = "escalate",
+  Tag = "tag"
+}
+declare enum SeverityLevel {
+  Critical = "critical",
+  High = "high",
+  Medium = "medium",
+  Low = "low"
+}
+/** Rule evaluation points in the pipeline */
+declare enum RuleEvaluationPhase {
+  PreLlm = "pre-llm",
+  PostLlm = "post-llm"
+}
+interface RuleCondition {
+  serviceName?: string;
+  alertType?: AlertType;
+  severity?: SeverityLevel;
+  labels?: Record<string, string>;
+  endpointPath?: string;
+  alertCount?: {
+    min?: number;
+    max?: number;
+  };
+  latencyP99Ms?: {
+    min?: number;
+    max?: number;
+  };
+  /** POST-LLM only (analysis must be present) */
+  urgencyLevel?: z.infer<typeof UrgencyLevelSchema>;
+  requiresRollback?: boolean;
+  impactedServices?: string[];
+}
+declare const RuleConditionSchema: z.ZodObject<{
+  serviceName: z.ZodOptional<z.ZodString>;
+  alertType: z.ZodOptional<z.ZodEnum<typeof AlertType>>;
+  severity: z.ZodOptional<z.ZodEnum<typeof SeverityLevel>>;
+  labels: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+  endpointPath: z.ZodOptional<z.ZodString>;
+  alertCount: z.ZodOptional<z.ZodObject<{
+    min: z.ZodOptional<z.ZodNumber>;
+    max: z.ZodOptional<z.ZodNumber>;
+  }, z.core.$strip>>;
+  latencyP99Ms: z.ZodOptional<z.ZodObject<{
+    min: z.ZodOptional<z.ZodNumber>;
+    max: z.ZodOptional<z.ZodNumber>;
+  }, z.core.$strip>>;
+  urgencyLevel: z.ZodOptional<z.ZodEnum<{
+    critical: "critical";
+    high: "high";
+    low: "low";
+    medium: "medium";
+  }>>;
+  requiresRollback: z.ZodOptional<z.ZodBoolean>;
+  impactedServices: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+type RuleAction = {
+  type: RuleActionType.Suppress;
+} | {
+  type: RuleActionType.Route;
+  channel: string;
+} | {
+  type: RuleActionType.Escalate;
+  channel: string;
+} | {
+  type: RuleActionType.Tag;
+  key: string;
+  value: string;
+};
+declare const RuleActionSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+  type: z.ZodLiteral<RuleActionType.Suppress>;
+}, z.core.$strip>, z.ZodObject<{
+  type: z.ZodLiteral<RuleActionType.Route>;
+  channel: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+  type: z.ZodLiteral<RuleActionType.Escalate>;
+  channel: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+  type: z.ZodLiteral<RuleActionType.Tag>;
+  key: z.ZodString;
+  value: z.ZodString;
+}, z.core.$strip>], "type">;
+interface Rule {
+  id: string;
+  name?: string;
+  condition: RuleCondition;
+  actions: RuleAction[];
+  /** POST-LLM only (can only be used in post-llm section) */
+  urgencyLevel?: z.infer<typeof UrgencyLevelSchema>;
+  requiresRollback?: boolean;
+}
+declare const RuleSchema: z.ZodObject<{
+  id: z.ZodString;
+  name: z.ZodOptional<z.ZodString>;
+  condition: z.ZodObject<{
+    serviceName: z.ZodOptional<z.ZodString>;
+    alertType: z.ZodOptional<z.ZodEnum<typeof AlertType>>;
+    severity: z.ZodOptional<z.ZodEnum<typeof SeverityLevel>>;
+    labels: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    endpointPath: z.ZodOptional<z.ZodString>;
+    alertCount: z.ZodOptional<z.ZodObject<{
+      min: z.ZodOptional<z.ZodNumber>;
+      max: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>;
+    latencyP99Ms: z.ZodOptional<z.ZodObject<{
+      min: z.ZodOptional<z.ZodNumber>;
+      max: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>;
+    urgencyLevel: z.ZodOptional<z.ZodEnum<{
+      critical: "critical";
+      high: "high";
+      low: "low";
+      medium: "medium";
+    }>>;
+    requiresRollback: z.ZodOptional<z.ZodBoolean>;
+    impactedServices: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  }, z.core.$strip>;
+  actions: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+    type: z.ZodLiteral<RuleActionType.Suppress>;
+  }, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<RuleActionType.Route>;
+    channel: z.ZodString;
+  }, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<RuleActionType.Escalate>;
+    channel: z.ZodString;
+  }, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<RuleActionType.Tag>;
+    key: z.ZodString;
+    value: z.ZodString;
+  }, z.core.$strip>], "type">>;
+  urgencyLevel: z.ZodOptional<z.ZodEnum<{
+    critical: "critical";
+    high: "high";
+    low: "low";
+    medium: "medium";
+  }>>;
+  requiresRollback: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+interface RuleSection {
+  rules: Rule[];
+}
+declare const RuleSectionSchema: z.ZodObject<{
+  rules: z.ZodDefault<z.ZodArray<z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodOptional<z.ZodString>;
+    condition: z.ZodObject<{
+      serviceName: z.ZodOptional<z.ZodString>;
+      alertType: z.ZodOptional<z.ZodEnum<typeof AlertType>>;
+      severity: z.ZodOptional<z.ZodEnum<typeof SeverityLevel>>;
+      labels: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+      endpointPath: z.ZodOptional<z.ZodString>;
+      alertCount: z.ZodOptional<z.ZodObject<{
+        min: z.ZodOptional<z.ZodNumber>;
+        max: z.ZodOptional<z.ZodNumber>;
+      }, z.core.$strip>>;
+      latencyP99Ms: z.ZodOptional<z.ZodObject<{
+        min: z.ZodOptional<z.ZodNumber>;
+        max: z.ZodOptional<z.ZodNumber>;
+      }, z.core.$strip>>;
+      urgencyLevel: z.ZodOptional<z.ZodEnum<{
+        critical: "critical";
+        high: "high";
+        low: "low";
+        medium: "medium";
+      }>>;
+      requiresRollback: z.ZodOptional<z.ZodBoolean>;
+      impactedServices: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>;
+    actions: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+      type: z.ZodLiteral<RuleActionType.Suppress>;
+    }, z.core.$strip>, z.ZodObject<{
+      type: z.ZodLiteral<RuleActionType.Route>;
+      channel: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+      type: z.ZodLiteral<RuleActionType.Escalate>;
+      channel: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+      type: z.ZodLiteral<RuleActionType.Tag>;
+      key: z.ZodString;
+      value: z.ZodString;
+    }, z.core.$strip>], "type">>;
+    urgencyLevel: z.ZodOptional<z.ZodEnum<{
+      critical: "critical";
+      high: "high";
+      low: "low";
+      medium: "medium";
+    }>>;
+    requiresRollback: z.ZodOptional<z.ZodBoolean>;
+  }, z.core.$strip>>>;
+}, z.core.$strip>;
+interface RuleConfiguration {
+  [RuleEvaluationPhase.PreLlm]: RuleSection;
+  [RuleEvaluationPhase.PostLlm]: RuleSection;
+}
+declare const RuleConfigurationSchema: z.ZodObject<{
+  "pre-llm": z.ZodObject<{
+    rules: z.ZodDefault<z.ZodArray<z.ZodObject<{
+      id: z.ZodString;
+      name: z.ZodOptional<z.ZodString>;
+      condition: z.ZodObject<{
+        serviceName: z.ZodOptional<z.ZodString>;
+        alertType: z.ZodOptional<z.ZodEnum<typeof AlertType>>;
+        severity: z.ZodOptional<z.ZodEnum<typeof SeverityLevel>>;
+        labels: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        endpointPath: z.ZodOptional<z.ZodString>;
+        alertCount: z.ZodOptional<z.ZodObject<{
+          min: z.ZodOptional<z.ZodNumber>;
+          max: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>>;
+        latencyP99Ms: z.ZodOptional<z.ZodObject<{
+          min: z.ZodOptional<z.ZodNumber>;
+          max: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>>;
+        urgencyLevel: z.ZodOptional<z.ZodEnum<{
+          critical: "critical";
+          high: "high";
+          low: "low";
+          medium: "medium";
+        }>>;
+        requiresRollback: z.ZodOptional<z.ZodBoolean>;
+        impactedServices: z.ZodOptional<z.ZodArray<z.ZodString>>;
+      }, z.core.$strip>;
+      actions: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<RuleActionType.Suppress>;
+      }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<RuleActionType.Route>;
+        channel: z.ZodString;
+      }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<RuleActionType.Escalate>;
+        channel: z.ZodString;
+      }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<RuleActionType.Tag>;
+        key: z.ZodString;
+        value: z.ZodString;
+      }, z.core.$strip>], "type">>;
+      urgencyLevel: z.ZodOptional<z.ZodEnum<{
+        critical: "critical";
+        high: "high";
+        low: "low";
+        medium: "medium";
+      }>>;
+      requiresRollback: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>>;
+  }, z.core.$strip>;
+  "post-llm": z.ZodObject<{
+    rules: z.ZodDefault<z.ZodArray<z.ZodObject<{
+      id: z.ZodString;
+      name: z.ZodOptional<z.ZodString>;
+      condition: z.ZodObject<{
+        serviceName: z.ZodOptional<z.ZodString>;
+        alertType: z.ZodOptional<z.ZodEnum<typeof AlertType>>;
+        severity: z.ZodOptional<z.ZodEnum<typeof SeverityLevel>>;
+        labels: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        endpointPath: z.ZodOptional<z.ZodString>;
+        alertCount: z.ZodOptional<z.ZodObject<{
+          min: z.ZodOptional<z.ZodNumber>;
+          max: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>>;
+        latencyP99Ms: z.ZodOptional<z.ZodObject<{
+          min: z.ZodOptional<z.ZodNumber>;
+          max: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>>;
+        urgencyLevel: z.ZodOptional<z.ZodEnum<{
+          critical: "critical";
+          high: "high";
+          low: "low";
+          medium: "medium";
+        }>>;
+        requiresRollback: z.ZodOptional<z.ZodBoolean>;
+        impactedServices: z.ZodOptional<z.ZodArray<z.ZodString>>;
+      }, z.core.$strip>;
+      actions: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<RuleActionType.Suppress>;
+      }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<RuleActionType.Route>;
+        channel: z.ZodString;
+      }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<RuleActionType.Escalate>;
+        channel: z.ZodString;
+      }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<RuleActionType.Tag>;
+        key: z.ZodString;
+        value: z.ZodString;
+      }, z.core.$strip>], "type">>;
+      urgencyLevel: z.ZodOptional<z.ZodEnum<{
+        critical: "critical";
+        high: "high";
+        low: "low";
+        medium: "medium";
+      }>>;
+      requiresRollback: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>>;
+  }, z.core.$strip>;
+}, z.core.$strip>;
+type ValidatedRuleCondition = z.infer<typeof RuleConditionSchema>;
+type ValidatedRuleAction = z.infer<typeof RuleActionSchema>;
+type ValidatedRule = z.infer<typeof RuleSchema>;
+type ValidatedRuleSection = z.infer<typeof RuleSectionSchema>;
+type ValidatedRuleConfiguration = z.infer<typeof RuleConfigurationSchema>;
+//#endregion
+//#region src/domain/entities/traceability.d.ts
 interface TraceabilityDocument {
-    '@timestamp': string;
-    uploadId?: string;
-    channel: string;
-    application: string;
-    messageType: string;
-    message: string;
-    originFlow?: string;
-    refId?: string;
-    fingerprint: string;
-    correlationId: string;
-}
-
+  '@timestamp': string;
+  uploadId?: string;
+  channel: string;
+  application: string;
+  messageType: string;
+  message: string;
+  originFlow?: string;
+  refId?: string;
+  fingerprint: string;
+  correlationId: string;
+}
+//#endregion
+//#region src/domain/value-objects/fingerprint.d.ts
 declare class Fingerprint {
-    readonly value: string;
-    private constructor();
-    static fromAlert(alert: NormalizedAlert): Fingerprint;
-    equals(other: Fingerprint): boolean;
-    toString(): string;
-}
-
+  readonly value: string;
+  private constructor();
+  static fromAlert(alert: NormalizedAlert): Fingerprint;
+  equals(other: Fingerprint): boolean;
+  toString(): string;
+}
+//#endregion
+//#region src/domain/ports/index.d.ts
 /**
  * Deduplication store.
  * Determines whether an alert fingerprint is new within a rolling TTL window.
  * Implementations: RedisDeduplicationStore, InMemoryDeduplicationStore (tests)
  */
 interface IDeduplicationStore {
-    isNew(fingerprint: string, ttlSeconds: number): Promise<boolean>;
-    reset(fingerprint: string): Promise<void>;
+  isNew(fingerprint: string, ttlSeconds: number): Promise<boolean>;
+  reset(fingerprint: string): Promise<void>;
 }
 /**
  * Alert queue.
@@ -355,7 +533,7 @@ interface IDeduplicationStore {
  * Implementations: SQSAlertQueue, BullMQAlertQueue, InMemoryAlertQueue (tests)
  */
 interface IAlertQueue {
-    publish(alert: NormalizedAlert): Promise<void>;
+  publish(alert: NormalizedAlert): Promise<void>;
 }
 /**
  * Trace repository.
@@ -363,7 +541,7 @@ interface IAlertQueue {
  * Implementations: LokiTraceRepository, DatadogTraceRepository, MockTraceRepository (tests)
  */
 interface ITraceRepository {
-    findByTraceId(traceId: string): Promise<Record<string, unknown>[]>;
+  findByTraceId(traceId: string): Promise<Record<string, unknown>[]>;
 }
 /**
  * LLM provider.
@@ -371,7 +549,7 @@ interface ITraceRepository {
  * Implementations: GeminiProvider, ClaudeProvider, OpenAIProvider, MockLLMProvider (tests)
  */
 interface ILLMProvider {
-    analyze(cluster: AlertCluster, traces: Record<string, unknown>[]): Promise<LLMAnalysis>;
+  analyze(cluster: AlertCluster, traces: Record<string, unknown>[]): Promise<LLMAnalysis>;
 }
 /**
  * Notifier.
@@ -379,7 +557,14 @@ interface ILLMProvider {
  * Implementations: SlackNotifier, TeamsNotifier, ConsoleNotifier (local dev/tests)
  */
 interface INotifier {
-    send(cluster: AlertCluster, analysis: LLMAnalysis | null): Promise<void>;
+  /**
+   * Deliver an incident diagnosis to a ChatOps channel.
+   * @param channel — optional channel override for multi-channel routing.
+   *   When provided, implementations MAY route to the specified channel
+   *   instead of their default. Backward-compatible — existing call sites
+   *   work unchanged.
+   */
+  send(cluster: AlertCluster, analysis: LLMAnalysis | null, channel?: string): Promise<void>;
 }
 /**
  * Indexer.
@@ -387,25 +572,52 @@ interface INotifier {
  * Implementations: OpenSearchIndexer, InMemoryIndexer (tests)
  */
 interface IIndexer<TDocument> {
-    index(doc: TDocument): Promise<void>;
+  index(doc: TDocument): Promise<void>;
 }
-
+/**
+ * Result of rule engine evaluation.
+ */
+interface RuleActionResult {
+  suppressed: boolean;
+  actions: RuleAction[];
+  matchedRuleId?: string;
+  tags: Record<string, string>;
+}
+/**
+ * Rule engine port — evaluates rules at pipeline hooks.
+ */
+interface IRuleEngine {
+  /**
+   * PRE-LLM: evaluated after dedup, before LLM.
+   * Returns actions to apply, or suppressed=true if should not proceed.
+   */
+  evaluatePreLlm(cluster: AlertCluster): RuleActionResult;
+  /**
+   * POST-LLM: evaluated after LLM analysis.
+   * Returns additional actions based on analysis (escalate, tag, etc.).
+   */
+  evaluatePostLlm(cluster: AlertCluster, analysis: LLMAnalysis): RuleActionResult;
+}
+//#endregion
+//#region src/domain/services/clustering.service.d.ts
 declare class ClusteringService {
-    /**
-     * Groups alerts by fingerprint and builds AlertCluster objects.
-     * 300 alerts with the same root cause → 1 cluster with 2 representative traces.
-     */
-    buildClusters(alerts: NormalizedAlert[]): AlertCluster[];
-    private buildCluster;
-    private sampleTraceIds;
-}
-
+  /**
+   * Groups alerts by fingerprint and builds AlertCluster objects.
+   * 300 alerts with the same root cause → 1 cluster with 2 representative traces.
+   */
+  buildClusters(alerts: NormalizedAlert[]): AlertCluster[];
+  private buildCluster;
+  private sampleTraceIds;
+}
+//#endregion
+//#region src/application/dtos/normalize-payload.d.ts
 declare function normalizePayload(payload: AlertmanagerPayload): NormalizedAlert[];
-
+//#endregion
+//#region src/shared/logger/index.d.ts
 type Logger = pino.Logger;
 interface LoggerOptions {
-    level?: string;
-    name?: string;
+  level?: string;
+  name?: string;
 }
 /**
  * Returns a Proxy logger that always delegates to the current root logger.
@@ -422,340 +634,380 @@ declare function createLogger(levelOrOptions?: string | LoggerOptions): Logger;
  * reinitLogger(); // all module-level proxy loggers now write to Loki
  */
 declare function reinitLogger(opts?: LoggerOptions): void;
-
+//#endregion
+//#region src/application/use-cases/process-incident.use-case.d.ts
 interface Dependencies {
-    dedup: IDeduplicationStore;
-    traces: ITraceRepository;
-    llm: ILLMProvider;
-    notifier: INotifier;
-    logger: Logger;
-    dedupTtlSeconds: number;
-    clustering?: ClusteringService;
-    onClustersBuilt?: (count: number) => void;
+  dedup: IDeduplicationStore;
+  traces: ITraceRepository;
+  llm: ILLMProvider;
+  notifier: INotifier;
+  logger: Logger;
+  dedupTtlSeconds: number;
+  clustering?: ClusteringService;
+  onClustersBuilt?: (count: number) => void;
+  ruleEngine?: IRuleEngine;
 }
 declare class ProcessIncidentUseCase {
-    private readonly deps;
-    private readonly clustering;
-    constructor(deps: Dependencies);
-    execute(alerts: NormalizedAlert[], correlationId: string): Promise<void>;
+  private readonly deps;
+  private readonly clustering;
+  constructor(deps: Dependencies);
+  execute(alerts: NormalizedAlert[], correlationId: string): Promise<void>;
 }
-
+//#endregion
+//#region src/infrastructure/dedup/redis-dedup.adapter.d.ts
 declare class RedisDeduplicationStore implements IDeduplicationStore {
-    private readonly redis;
-    private readonly keyPrefix;
-    constructor(redis: Redis);
-    isNew(fingerprint: string, ttlSeconds: number): Promise<boolean>;
-    reset(fingerprint: string): Promise<void>;
+  private readonly redis;
+  private readonly keyPrefix;
+  constructor(redis: Redis);
+  isNew(fingerprint: string, ttlSeconds: number): Promise<boolean>;
+  reset(fingerprint: string): Promise<void>;
 }
 declare class InMemoryDeduplicationStore implements IDeduplicationStore {
-    private readonly store;
-    isNew(fingerprint: string, ttlSeconds: number): Promise<boolean>;
-    reset(fingerprint: string): Promise<void>;
-    clear(): void;
+  private readonly store;
+  isNew(fingerprint: string, ttlSeconds: number): Promise<boolean>;
+  reset(fingerprint: string): Promise<void>;
+  clear(): void;
 }
-
+//#endregion
+//#region src/infrastructure/indexer/opensearch.adapter.d.ts
 interface SignedHttpRequest {
-    method: string;
-    url: string;
-    headers: Record<string, string>;
-    body: string;
+  method: string;
+  url: string;
+  headers: Record<string, string>;
+  body: string;
 }
 interface OpenSearchHttpResponse {
-    status: number;
-    body: string;
+  status: number;
+  body: string;
 }
 type OpenSearchHttpFetcher = (request: SignedHttpRequest) => Promise<OpenSearchHttpResponse>;
 interface OpenSearchIndexerDeps {
-    endpoint: string;
-    indexName: string;
-    region: string;
-    fetcher: OpenSearchHttpFetcher;
+  endpoint: string;
+  indexName: string;
+  region: string;
+  fetcher: OpenSearchHttpFetcher;
 }
 declare class OpenSearchIndexer implements IIndexer<TraceabilityDocument> {
-    private readonly endpoint;
-    private readonly indexName;
-    private readonly region;
-    private readonly fetcher;
-    constructor(deps: OpenSearchIndexerDeps);
-    index(doc: TraceabilityDocument): Promise<void>;
+  private readonly endpoint;
+  private readonly indexName;
+  private readonly region;
+  private readonly fetcher;
+  constructor(deps: OpenSearchIndexerDeps);
+  index(doc: TraceabilityDocument): Promise<void>;
 }
 declare class InMemoryIndexer implements IIndexer<TraceabilityDocument> {
-    readonly indexed: TraceabilityDocument[];
-    index(doc: TraceabilityDocument): Promise<void>;
+  readonly indexed: TraceabilityDocument[];
+  index(doc: TraceabilityDocument): Promise<void>;
 }
-
+//#endregion
+//#region src/infrastructure/llm/llm.adapter.d.ts
 /**
  * Gemini LLM provider using Google Generative AI SDK.
  * Wrapped with circuit breaker for resilience.
  */
 declare class GeminiProvider implements ILLMProvider {
-    private readonly apiKey;
-    private readonly model;
-    private readonly breaker;
-    constructor(apiKey: string, model?: string);
-    analyze(cluster: AlertCluster, traces: Record<string, unknown>[]): Promise<LLMAnalysis>;
-    private analyzeRaw;
+  private readonly apiKey;
+  private readonly model;
+  private readonly breaker;
+  constructor(apiKey: string, model?: string);
+  analyze(cluster: AlertCluster, traces: Record<string, unknown>[]): Promise<LLMAnalysis>;
+  private analyzeRaw;
 }
 /**
  * Claude LLM provider using Anthropic SDK.
  * Supports Claude Haiku and other models.
  */
 declare class ClaudeProvider implements ILLMProvider {
-    private readonly apiKey;
-    private readonly model;
-    constructor(apiKey: string, model?: string);
-    analyze(cluster: AlertCluster, traces: Record<string, unknown>[]): Promise<LLMAnalysis>;
+  private readonly apiKey;
+  private readonly model;
+  constructor(apiKey: string, model?: string);
+  analyze(cluster: AlertCluster, traces: Record<string, unknown>[]): Promise<LLMAnalysis>;
 }
 /**
  * Mock LLM provider for testing and local development.
  * Returns deterministic responses without external API calls.
  */
 declare class MockLLMProvider implements ILLMProvider {
-    readonly callLog: Array<{
-        cluster: AlertCluster;
-    }>;
-    analyze(cluster: AlertCluster, _traces: Record<string, unknown>[]): Promise<LLMAnalysis>;
+  readonly callLog: Array<{
+    cluster: AlertCluster;
+  }>;
+  analyze(cluster: AlertCluster, _traces: Record<string, unknown>[]): Promise<LLMAnalysis>;
 }
 /**
  * Options for configuring the OpenRouter fallback chain.
  * Infra-internal — not exported.
  */
 interface FallbackOptions {
-    fallbackModels?: string[];
-    fallbackTimeoutMs?: number;
+  fallbackModels?: string[];
+  fallbackTimeoutMs?: number;
 }
 declare function createLLMProvider(provider: string, apiKey: string, model?: string, options?: FallbackOptions): ILLMProvider;
-
-declare const ConfigSchema: z.ZodEffects<z.ZodObject<{
-    llmProvider: z.ZodEnum<["gemini", "claude", "openrouter", "qwen"]>;
-    llmApiKey: z.ZodString;
-    llmModel: z.ZodEffects<z.ZodOptional<z.ZodString>, string | undefined, string | undefined>;
-    notifierType: z.ZodDefault<z.ZodEnum<["slack", "teams"]>>;
-    slackBotToken: z.ZodOptional<z.ZodString>;
-    slackSigningSecret: z.ZodOptional<z.ZodString>;
-    slackChannel: z.ZodOptional<z.ZodString>;
-    teamsWebhookUrl: z.ZodOptional<z.ZodString>;
-    lokiUrl: z.ZodEffects<z.ZodOptional<z.ZodString>, string | undefined, string | undefined>;
-    redisUrl: z.ZodString;
-    sqsQueueUrl: z.ZodUnion<[z.ZodOptional<z.ZodString>, z.ZodLiteral<"">]>;
-    dedupTtlSeconds: z.ZodDefault<z.ZodNumber>;
-    clusterWindowMs: z.ZodDefault<z.ZodNumber>;
-    logLevel: z.ZodDefault<z.ZodEnum<["trace", "debug", "info", "warn", "error"]>>;
-    nodeEnv: z.ZodDefault<z.ZodEnum<["development", "test", "production"]>>;
-    llmFallbackModels: z.ZodEffects<z.ZodOptional<z.ZodString>, string[], string | undefined>;
-    llmFallbackTimeoutMs: z.ZodDefault<z.ZodNumber>;
-}, "strip", z.ZodTypeAny, {
-    dedupTtlSeconds: number;
-    llmProvider: "gemini" | "claude" | "openrouter" | "qwen";
-    llmApiKey: string;
-    notifierType: "slack" | "teams";
-    redisUrl: string;
-    clusterWindowMs: number;
-    logLevel: "info" | "error" | "warn" | "debug" | "trace";
-    nodeEnv: "production" | "development" | "test";
-    llmFallbackModels: string[];
-    llmFallbackTimeoutMs: number;
-    llmModel?: string | undefined;
-    slackBotToken?: string | undefined;
-    slackSigningSecret?: string | undefined;
-    slackChannel?: string | undefined;
-    teamsWebhookUrl?: string | undefined;
-    lokiUrl?: string | undefined;
-    sqsQueueUrl?: string | undefined;
-}, {
-    llmProvider: "gemini" | "claude" | "openrouter" | "qwen";
-    llmApiKey: string;
-    redisUrl: string;
-    dedupTtlSeconds?: number | undefined;
-    llmModel?: string | undefined;
-    notifierType?: "slack" | "teams" | undefined;
-    slackBotToken?: string | undefined;
-    slackSigningSecret?: string | undefined;
-    slackChannel?: string | undefined;
-    teamsWebhookUrl?: string | undefined;
-    lokiUrl?: string | undefined;
-    sqsQueueUrl?: string | undefined;
-    clusterWindowMs?: number | undefined;
-    logLevel?: "info" | "error" | "warn" | "debug" | "trace" | undefined;
-    nodeEnv?: "production" | "development" | "test" | undefined;
-    llmFallbackModels?: string | undefined;
-    llmFallbackTimeoutMs?: number | undefined;
-}>, {
-    dedupTtlSeconds: number;
-    llmProvider: "gemini" | "claude" | "openrouter" | "qwen";
-    llmApiKey: string;
-    notifierType: "slack" | "teams";
-    redisUrl: string;
-    clusterWindowMs: number;
-    logLevel: "info" | "error" | "warn" | "debug" | "trace";
-    nodeEnv: "production" | "development" | "test";
-    llmFallbackModels: string[];
-    llmFallbackTimeoutMs: number;
-    llmModel?: string | undefined;
-    slackBotToken?: string | undefined;
-    slackSigningSecret?: string | undefined;
-    slackChannel?: string | undefined;
-    teamsWebhookUrl?: string | undefined;
-    lokiUrl?: string | undefined;
-    sqsQueueUrl?: string | undefined;
-}, {
-    llmProvider: "gemini" | "claude" | "openrouter" | "qwen";
-    llmApiKey: string;
-    redisUrl: string;
-    dedupTtlSeconds?: number | undefined;
-    llmModel?: string | undefined;
-    notifierType?: "slack" | "teams" | undefined;
-    slackBotToken?: string | undefined;
-    slackSigningSecret?: string | undefined;
-    slackChannel?: string | undefined;
-    teamsWebhookUrl?: string | undefined;
-    lokiUrl?: string | undefined;
-    sqsQueueUrl?: string | undefined;
-    clusterWindowMs?: number | undefined;
-    logLevel?: "info" | "error" | "warn" | "debug" | "trace" | undefined;
-    nodeEnv?: "production" | "development" | "test" | undefined;
-    llmFallbackModels?: string | undefined;
-    llmFallbackTimeoutMs?: number | undefined;
-}>;
+//#endregion
+//#region src/shared/config/index.d.ts
+declare const ConfigSchema: z.ZodObject<{
+  llmProvider: z.ZodEnum<{
+    claude: "claude";
+    gemini: "gemini";
+    openrouter: "openrouter";
+    qwen: "qwen";
+  }>;
+  llmApiKey: z.ZodString;
+  llmModel: z.ZodPipe<z.ZodOptional<z.ZodString>, z.ZodTransform<string | undefined, string | undefined>>;
+  notifierType: z.ZodDefault<z.ZodEnum<{
+    slack: "slack";
+    teams: "teams";
+  }>>;
+  slackBotToken: z.ZodOptional<z.ZodString>;
+  slackSigningSecret: z.ZodOptional<z.ZodString>;
+  slackChannel: z.ZodOptional<z.ZodString>;
+  teamsWebhookUrl: z.ZodOptional<z.ZodString>;
+  lokiUrl: z.ZodPipe<z.ZodOptional<z.ZodString>, z.ZodTransform<string | undefined, string | undefined>>;
+  redisUrl: z.ZodString;
+  sqsQueueUrl: z.ZodUnion<[z.ZodOptional<z.ZodString>, z.ZodLiteral<"">]>;
+  dedupTtlSeconds: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+  clusterWindowMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+  logLevel: z.ZodDefault<z.ZodEnum<{
+    debug: "debug";
+    error: "error";
+    info: "info";
+    trace: "trace";
+    warn: "warn";
+  }>>;
+  nodeEnv: z.ZodDefault<z.ZodEnum<{
+    development: "development";
+    production: "production";
+    test: "test";
+  }>>;
+  llmFallbackModels: z.ZodPipe<z.ZodOptional<z.ZodString>, z.ZodTransform<string[], string | undefined>>;
+  llmFallbackTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+  rulesConfigPath: z.ZodPipe<z.ZodOptional<z.ZodString>, z.ZodTransform<string | undefined, string | undefined>>;
+}, z.core.$strip>;
 type Config = z.infer<typeof ConfigSchema>;
 declare function loadConfig(): Promise<Config>;
-
+//#endregion
+//#region src/infrastructure/notifier/factory.d.ts
+/**
+ * Creates the notifier for the application.
+ *
+ * When `config.rulesConfigPath` is set:
+ *   - Reads and validates the rules YAML config
+ *   - Creates a ChannelRegistry with the default notifier as fallback
+ *   - Wraps the default notifier with a RoutingNotifier for multi-channel dispatch
+ *
+ * When `config.rulesConfigPath` is NOT set:
+ *   - Returns the default notifier directly (backward-compatible)
+ */
 declare function createNotifier(config: Config): INotifier;
-
+//#endregion
+//#region src/infrastructure/notifier/slack.adapter.d.ts
 declare class SlackNotifier implements INotifier {
-    private readonly botToken;
-    private readonly channel;
-    constructor(botToken: string, channel: string);
-    send(cluster: AlertCluster, analysis: LLMAnalysis | null): Promise<void>;
-    private buildAnalysisMessage;
-    private buildFallbackMessage;
+  private readonly botToken;
+  private readonly channel;
+  constructor(botToken: string, channel: string);
+  send(cluster: AlertCluster, analysis: LLMAnalysis | null, _channel?: string): Promise<void>;
+  private buildAnalysisMessage;
+  private buildFallbackMessage;
 }
 declare class ConsoleNotifier implements INotifier {
-    readonly sent: Array<{
-        cluster: AlertCluster;
-        analysis: LLMAnalysis | null;
-    }>;
-    send(cluster: AlertCluster, analysis: LLMAnalysis | null): Promise<void>;
-}
-
+  readonly sent: Array<{
+    cluster: AlertCluster;
+    analysis: LLMAnalysis | null;
+  }>;
+  send(cluster: AlertCluster, analysis: LLMAnalysis | null, _channel?: string): Promise<void>;
+}
+//#endregion
+//#region src/infrastructure/notifier/teams.adapter.d.ts
 declare class TeamsNotifierError extends Error {
-    constructor(message: string);
+  constructor(message: string);
 }
 declare class TeamsNotifier implements INotifier {
-    private readonly webhookUrl;
-    private readonly timeoutMs;
-    private readonly hostForErrors;
-    constructor(webhookUrl: string, timeoutMs?: number);
-    send(cluster: AlertCluster, analysis: LLMAnalysis | null): Promise<void>;
-}
-
+  private readonly webhookUrl;
+  private readonly timeoutMs;
+  private readonly hostForErrors;
+  constructor(webhookUrl: string, timeoutMs?: number);
+  send(cluster: AlertCluster, analysis: LLMAnalysis | null, _channel?: string): Promise<void>;
+}
+//#endregion
+//#region src/infrastructure/rules/channel-registry.d.ts
+declare class ChannelRegistry {
+  private readonly _channels;
+  private _default;
+  /**
+   * Register a notifier for a given channel name.
+   * Overwrites any existing registration for that name.
+   */
+  register(channel: string, notifier: INotifier): void;
+  /**
+   * Set the default notifier to use when a channel is not found.
+   */
+  setDefault(notifier: INotifier): void;
+  /**
+   * Resolve a channel name to its notifier instance.
+   * Falls back to the default notifier if the channel is unknown.
+   *
+   * @throws {Error} if the channel is unknown and no default is set
+   */
+  resolve(channel: string): INotifier;
+  /**
+   * Check if a channel is registered.
+   */
+  has(channel: string): boolean;
+}
+//#endregion
+//#region src/infrastructure/notifier/routing-notifier.d.ts
+declare class RoutingNotifier implements INotifier {
+  private readonly registry;
+  private readonly defaultNotifier;
+  constructor(registry: ChannelRegistry, defaultNotifier: INotifier);
+  /**
+   * Implements INotifier.send — sends via default notifier.
+   * Backward-compatible with existing call sites that don't use rule actions.
+   */
+  send(cluster: AlertCluster, analysis: LLMAnalysis | null): Promise<void>;
+  /**
+   * Dispatch notifications based on rule engine actions.
+   *
+   * - Route actions: send to the specified channel instead of default.
+   * - Escalate actions: send additional notifications to escalation channels.
+   * - Tag actions: metadata-only, no notification side effect.
+   * - Suppress actions: skip all notification (defensive — caller should have already skipped).
+   * - Unknown channels: fall back to default notifier.
+   * - Empty actions or no Route/Escalate: send via default notifier.
+   */
+  sendWithActions(cluster: AlertCluster, analysis: LLMAnalysis | null, actions: RuleAction[]): Promise<void>;
+  /**
+   * Resolve a channel name to its notifier and send.
+   * Falls back to default notifier if channel is unknown.
+   */
+  private tryResolveAndSend;
+}
+//#endregion
+//#region src/infrastructure/queue/sqs.adapter.d.ts
 interface SendMessageParams {
-    messageBody: string;
-    messageGroupId: string;
-    messageDeduplicationId: string;
+  messageBody: string;
+  messageGroupId: string;
+  messageDeduplicationId: string;
 }
 declare class SQSAlertQueue implements IAlertQueue {
-    private readonly queueUrl;
-    private readonly region?;
-    private sqsClient;
-    constructor(queueUrl: string, region?: string | undefined);
-    private getClient;
-    sendMessage(params: SendMessageParams): Promise<void>;
-    publish(alert: NormalizedAlert): Promise<void>;
+  private readonly queueUrl;
+  private readonly region?;
+  private sqsClient;
+  constructor(queueUrl: string, region?: string | undefined);
+  private getClient;
+  sendMessage(params: SendMessageParams): Promise<void>;
+  publish(alert: NormalizedAlert): Promise<void>;
 }
 declare class InMemoryAlertQueue implements IAlertQueue {
-    readonly published: NormalizedAlert[];
-    publish(alert: NormalizedAlert): Promise<void>;
+  readonly published: NormalizedAlert[];
+  publish(alert: NormalizedAlert): Promise<void>;
 }
-
+//#endregion
+//#region src/infrastructure/queue/sqs-lag-poller.d.ts
 declare function startSqsLagPoller(queueUrl: string, intervalMs: number, region?: string): () => void;
-
+//#endregion
+//#region src/infrastructure/traces/loki-trace.adapter.d.ts
 declare class LokiTraceRepository implements ITraceRepository {
-    private readonly lokiUrl;
-    private readonly apiKey?;
-    constructor(lokiUrl: string, apiKey?: string | undefined);
-    findByTraceId(traceId: string): Promise<Record<string, unknown>[]>;
-    private parseResponse;
-    private tryParseJSON;
+  private readonly lokiUrl;
+  private readonly apiKey?;
+  constructor(lokiUrl: string, apiKey?: string | undefined);
+  findByTraceId(traceId: string): Promise<Record<string, unknown>[]>;
+  private parseResponse;
+  private tryParseJSON;
 }
 declare class MockTraceRepository implements ITraceRepository {
-    private readonly fixtures;
-    constructor(fixtures?: Map<string, Record<string, unknown>[]>);
-    findByTraceId(traceId: string): Promise<Record<string, unknown>[]>;
-    addFixture(traceId: string, spans: Record<string, unknown>[]): void;
+  private readonly fixtures;
+  constructor(fixtures?: Map<string, Record<string, unknown>[]>);
+  findByTraceId(traceId: string): Promise<Record<string, unknown>[]>;
+  addFixture(traceId: string, spans: Record<string, unknown>[]): void;
 }
-
+//#endregion
+//#region src/infrastructure/rules/yaml-rule-loader.d.ts
+/**
+ * Parse and validate a YAML string into a RuleConfiguration.
+ * Pure function — no I/O, no side effects. Fast-fails on invalid config.
+ *
+ * @throws {Error} if YAML is malformed or Zod validation fails
+ */
+declare function parseRuleConfig(yamlString: string): ValidatedRuleConfiguration;
+//#endregion
+//#region src/infrastructure/rules/condition-evaluator.d.ts
+type Predicate = (cluster: AlertCluster, analysis?: LLMAnalysis) => boolean;
+/**
+ * Compile a RuleCondition into a predicate function.
+ * The returned function can be called with (cluster, analysis?) to evaluate the condition.
+ * Pre-compilation ensures the field iteration and matcher assembly happen once at load time.
+ *
+ * All specified conditions must match (AND logic).
+ * If no fields are specified, the predicate returns true (match-all).
+ */
+declare function compileCondition(condition: ValidatedRuleCondition): Predicate;
+//#endregion
+//#region src/infrastructure/rules/action-dispatcher.d.ts
+/**
+ * Dispatch an array of RuleAction into a RuleActionResult.
+ * All actions are processed in order.
+ * The result accumulates: suppressed flag, route/escalate actions, and tags.
+ *
+ * Pure function — no I/O, no side effects beyond the returned result.
+ */
+declare function dispatchActions(actions: RuleAction[]): RuleActionResult;
+//#endregion
+//#region src/infrastructure/rules/rule-engine.d.ts
+declare class RuleEngine implements IRuleEngine {
+  private readonly preLlmRules;
+  private readonly postLlmRules;
+  constructor(config: ValidatedRuleConfiguration);
+  /**
+   * Evaluate PRE-LLM rules against a cluster.
+   * First-match-wins — returns result of first matching rule.
+   * If no rule matches, returns pass-through (suppressed=false, no actions).
+   */
+  evaluatePreLlm(cluster: AlertCluster): RuleActionResult;
+  /**
+   * Evaluate POST-LLM rules against a cluster and LLM analysis.
+   * First-match-wins — returns result of first matching rule.
+   * If no rule matches, returns pass-through.
+   */
+  evaluatePostLlm(cluster: AlertCluster, analysis: LLMAnalysis): RuleActionResult;
+  private compileSection;
+  private evaluateRules;
+}
+//#endregion
+//#region src/shared/factory-registry.d.ts
 declare class FactoryRegistry<T> {
-    private readonly _factories;
-    private _default;
-    /**
-     * Register a factory for a given key.
-     * Overwrites any existing registration for that key.
-     */
-    register(key: string, factory: () => T): void;
-    /**
-     * Set the default factory to use when no key matches.
-     */
-    registerDefault(factory: () => T): void;
-    /**
-     * Resolve the factory for a given key.
-     * Returns the default if no specific factory is registered for that key.
-     */
-    resolve(key: string): T;
-    /**
-     * Check if a factory is registered for a given key.
-     */
-    has(key: string): boolean;
-    /**
-     * Return all registered keys.
-     */
-    keys(): string[];
-}
-
+  private readonly _factories;
+  private _default;
+  /**
+   * Register a factory for a given key.
+   * Overwrites any existing registration for that key.
+   */
+  register(key: string, factory: () => T): void;
+  /**
+   * Set the default factory to use when no key matches.
+   */
+  registerDefault(factory: () => T): void;
+  /**
+   * Resolve the factory for a given key.
+   * Returns the default if no specific factory is registered for that key.
+   */
+  resolve(key: string): T;
+  /**
+   * Check if a factory is registered for a given key.
+   */
+  has(key: string): boolean;
+  /**
+   * Return all registered keys.
+   */
+  keys(): string[];
+}
+//#endregion
+//#region src/shared/logger/loki-transport.d.ts
 /**
  * Flush all buffered log entries to Loki in a single HTTP request.
  * Call this at the END of the Lambda handler, after all business logic completes.
  * Errors are swallowed — Loki is best-effort; CloudWatch is the primary sink.
  */
 declare function flushLoki(): Promise<void>;
-
-declare const registry: Registry<"text/plain; version=0.0.4; charset=utf-8">;
-declare const alertsReceived: Counter<"status">;
-declare const webhookRequestsTotal: Counter<"status" | "endpoint">;
-declare const alertsProcessed: Counter<"result">;
-declare const alertClusters: Gauge<string>;
-declare const latency: Histogram<"status">;
-declare const llmInferenceDuration: Histogram<"model">;
-declare const llmInferenceTotal: Counter<"status">;
-/** Tracks inline pipeline failures in local dev mode. */
-declare const pipelineInlineFailuresTotal: Counter<"reason">;
-/** Tracks Redis dedup fallback activations. */
-declare const dedupRedisFailoverTotal: Counter<string>;
-/** Tracks new alert clusters (dedup: first-time fingerprint). */
-declare const dedupNew: Counter<"source">;
-/** Tracks duplicate alert clusters (dedup: fingerprint already seen). */
-declare const dedupDuplicate: Counter<"source">;
-/** Tracks outbound notification attempts by channel and outcome. */
-declare const notificationsTotal: Counter<"channel" | "outcome">;
-/** Tracks approximate number of unprocessed SQS messages (queue lag). */
-declare const sqsQueueLag: Gauge<"queue_name">;
-
-declare const index_alertClusters: typeof alertClusters;
-declare const index_alertsProcessed: typeof alertsProcessed;
-declare const index_alertsReceived: typeof alertsReceived;
-declare const index_dedupDuplicate: typeof dedupDuplicate;
-declare const index_dedupNew: typeof dedupNew;
-declare const index_dedupRedisFailoverTotal: typeof dedupRedisFailoverTotal;
-declare const index_latency: typeof latency;
-declare const index_llmInferenceDuration: typeof llmInferenceDuration;
-declare const index_llmInferenceTotal: typeof llmInferenceTotal;
-declare const index_notificationsTotal: typeof notificationsTotal;
-declare const index_pipelineInlineFailuresTotal: typeof pipelineInlineFailuresTotal;
-declare const index_registry: typeof registry;
-declare const index_sqsQueueLag: typeof sqsQueueLag;
-declare const index_webhookRequestsTotal: typeof webhookRequestsTotal;
-declare namespace index {
-  export { index_alertClusters as alertClusters, index_alertsProcessed as alertsProcessed, index_alertsReceived as alertsReceived, index_dedupDuplicate as dedupDuplicate, index_dedupNew as dedupNew, index_dedupRedisFailoverTotal as dedupRedisFailoverTotal, index_latency as latency, index_llmInferenceDuration as llmInferenceDuration, index_llmInferenceTotal as llmInferenceTotal, index_notificationsTotal as notificationsTotal, index_pipelineInlineFailuresTotal as pipelineInlineFailuresTotal, index_registry as registry, index_sqsQueueLag as sqsQueueLag, index_webhookRequestsTotal as webhookRequestsTotal };
-}
-
-export { ALERT_TYPE_LABELS, type AlertCluster, AlertClusterSchema, type AlertErrorType, type AlertStatus, AlertStatusSchema, AlertType, type AlertmanagerPayload, AlertmanagerPayloadSchema, CIRCUIT_BREAKER, ClaudeProvider, ClusteringService, type Config, ConsoleNotifier, DEDUP_TTL_MS_MULTIPLIER, DEV_SERVER_PORT, FactoryRegistry, Fingerprint, GeminiProvider, HOUR_MS, HTTP_TIMEOUT_MS, type IAlertQueue, type IDeduplicationStore, type IIndexer, type ILLMProvider, type INotifier, type ITraceRepository, InMemoryAlertQueue, InMemoryDeduplicationStore, InMemoryIndexer, type Incident, IncidentSchema, type LLMAnalysis, LLMAnalysisSchema, LLMProviderType, LLM_FALLBACK_DEFAULTS, LLM_MAX_TOKENS, LLM_MODELS, type Logger, type LoggerOptions, LokiTraceRepository, MockLLMProvider, MockTraceRepository, type NormalizedAlert, NormalizedAlertSchema, type OpenSearchHttpFetcher, type OpenSearchHttpResponse, OpenSearchIndexer, type OpenSearchIndexerDeps, PAYLOAD_DEFAULTS, ProcessIncidentUseCase, RATE_LIMITER, REDIS_KEY_PREFIX, RedisDeduplicationStore, SLACK_API_URL, SQSAlertQueue, type SignedHttpRequest, SlackNotifier, TEAMS_WEBHOOK_TIMEOUT_MS, TeamsNotifier, TeamsNotifierError, type TraceabilityDocument, URGENCY_EMOJI, type UrgencyLevel, UrgencyLevelSchema, WEBHOOK_DEFAULTS, createLLMProvider, createLogger, createNotifier, flushLoki, loadConfig, index as metrics, normalizePayload, reinitLogger, startSqsLagPoller };
+//#endregion
+export { ALERT_TYPE_LABELS, AlertCluster, AlertClusterSchema, AlertErrorType, AlertStatus, AlertStatusSchema, AlertType, AlertmanagerPayload, AlertmanagerPayloadSchema, CIRCUIT_BREAKER, ChannelRegistry, ClaudeProvider, ClusteringService, type Config, ConsoleNotifier, DEDUP_TTL_MS_MULTIPLIER, DEV_SERVER_PORT, FactoryRegistry, Fingerprint, GeminiProvider, HOUR_MS, HTTP_TIMEOUT_MS, type IAlertQueue, type IDeduplicationStore, type IIndexer, type ILLMProvider, type INotifier, type IRuleEngine, type ITraceRepository, InMemoryAlertQueue, InMemoryDeduplicationStore, InMemoryIndexer, Incident, IncidentSchema, LLMAnalysis, LLMAnalysisSchema, LLMProviderType, LLM_FALLBACK_DEFAULTS, LLM_MAX_TOKENS, LLM_MODELS, type Logger, type LoggerOptions, LokiTraceRepository, MockLLMProvider, MockTraceRepository, NormalizedAlert, NormalizedAlertSchema, type OpenSearchHttpFetcher, type OpenSearchHttpResponse, OpenSearchIndexer, type OpenSearchIndexerDeps, PAYLOAD_DEFAULTS, ProcessIncidentUseCase, RATE_LIMITER, REDIS_KEY_PREFIX, RedisDeduplicationStore, RoutingNotifier, Rule, RuleAction, type RuleActionResult, RuleActionSchema, RuleActionType, RuleCondition, RuleConditionSchema, RuleConfiguration, RuleConfigurationSchema, RuleEngine, RuleEvaluationPhase, RuleSchema, RuleSection, RuleSectionSchema, SLACK_API_URL, SQSAlertQueue, SeverityLevel, type SignedHttpRequest, SlackNotifier, TEAMS_WEBHOOK_TIMEOUT_MS, TeamsNotifier, TeamsNotifierError, type TraceabilityDocument, URGENCY_EMOJI, UrgencyLevel, UrgencyLevelSchema, ValidatedRule, ValidatedRuleAction, ValidatedRuleCondition, ValidatedRuleConfiguration, ValidatedRuleSection, WEBHOOK_DEFAULTS, compileCondition, createLLMProvider, createLogger, createNotifier, dispatchActions, flushLoki, loadConfig, index_d_exports as metrics, normalizePayload, parseRuleConfig, reinitLogger, startSqsLagPoller };
+//# sourceMappingURL=index.d.ts.map