@junando/core 0.11.1 → 0.12.0

package/dist/index.js

@@ -261,6 +261,16 @@ var Fingerprint = class Fingerprint {
 	}
 };
 //#endregion
+//#region src/domain/ports/index.ts
+/**
+* Terminal outcome of a single notification send.
+* Feeds the `notify` section of the wide event.
+*/
+const NotifyOutcome = {
+	Success: "success",
+	Failure: "failure"
+};
+//#endregion
 //#region src/domain/services/clustering.service.ts
 var ClusteringService = class {
 	/**
@@ -330,93 +340,6 @@ function normalizePayload(payload) {
 	}));
 }
 //#endregion
-//#region src/application/use-cases/process-incident.use-case.ts
-var ProcessIncidentUseCase = class {
-	deps;
-	clustering;
-	constructor(deps) {
-		this.deps = deps;
-		this.clustering = deps.clustering ?? new ClusteringService();
-	}
-	async execute(alerts, correlationId) {
-		const { dedup, traces, llm, notifier, logger, dedupTtlSeconds, ruleEngine } = this.deps;
-		const log = logger.child({
-			correlationId,
-			useCase: "ProcessIncident"
-		});
-		log.info({ alertCount: alerts.length }, "Processing alert batch");
-		const clusters = this.clustering.buildClusters(alerts);
-		log.info({ clusterCount: clusters.length }, "Clusters built");
-		this.deps.onClustersBuilt?.(clusters.length);
-		for (const cluster of clusters) {
-			const log2 = log.child({
-				fingerprint: cluster.fingerprint,
-				service: cluster.serviceName
-			});
-			if (!await dedup.isNew(cluster.fingerprint, dedupTtlSeconds)) {
-				log2.debug("Duplicate cluster — skipping");
-				dedupDuplicate.inc({ source: "alertmanager" });
-				continue;
-			}
-			dedupNew.inc({ source: "alertmanager" });
-			let preLlmRouteChannels = [];
-			let preLlmEscalateChannels = [];
-			if (ruleEngine) {
-				const preResult = ruleEngine.evaluatePreLlm(cluster);
-				if (preResult.suppressed) {
-					log2.info({ matchedRuleId: preResult.matchedRuleId }, "Cluster suppressed by rule engine");
-					if (preResult.matchedRuleId) suppressedClusters.inc({ rule_id: preResult.matchedRuleId });
-					continue;
-				}
-				for (const action of preResult.actions) {
-					if (action.type === "route" && "channel" in action) preLlmRouteChannels.push(action.channel);
-					if (action.type === "escalate" && "channel" in action) preLlmEscalateChannels.push(action.channel);
-				}
-			}
-			const allSpans = (await Promise.all(cluster.representativeTraceIds.map((id) => traces.findByTraceId(id).catch((err) => {
-				log2.warn({
-					err,
-					traceId: id
-				}, "Trace fetch failed — continuing without it");
-				return [];
-			})))).flat();
-			log2.info({ spanCount: allSpans.length }, "Traces extracted");
-			let analysis = null;
-			try {
-				analysis = await llm.analyze(cluster, allSpans);
-				log2.info({ urgency: analysis.urgency_level }, "LLM analysis complete");
-			} catch (err) {
-				log2.warn({ err }, "LLM inference failed — notifying without diagnosis");
-			}
-			let postLlmEscalateChannels = [];
-			if (ruleEngine && analysis) {
-				const postResult = ruleEngine.evaluatePostLlm(cluster, analysis);
-				for (const action of postResult.actions) {
-					if (action.type === "escalate" && "channel" in action) postLlmEscalateChannels.push(action.channel);
-					if (action.type === "tag" && "key" in action) log2.info({
-						tagKey: action.key,
-						tagValue: action.value
-					}, "Tag attached to cluster");
-				}
-				if (postResult.tags && Object.keys(postResult.tags).length > 0) cluster.labels = {
-					...cluster.labels,
-					...postResult.tags
-				};
-			}
-			try {
-				const primaryChannel = preLlmRouteChannels[0];
-				const escalateChannels = [...preLlmEscalateChannels, ...postLlmEscalateChannels];
-				await notifier.send(cluster, analysis, primaryChannel);
-				for (const channel of escalateChannels) await notifier.send(cluster, analysis, channel);
-				log2.info("Notification sent");
-			} catch (err) {
-				log2.error({ err }, "Notification failed");
-				throw err;
-			}
-		}
-	}
-};
-//#endregion
 //#region src/shared/logger/loki-transport.ts
 /**
 * Maximum number of buffered log entries before the oldest is dropped.
@@ -502,6 +425,174 @@ async function flushLoki() {
 	}
 }
 //#endregion
+//#region src/shared/logger/wide-event-builder.ts
+/** Maximum serialized event size: 256 KB. Events beyond this are truncated. */
+const MAX_EVENT_BYTES = 256 * 1024;
+/**
+* Per-string cap applied when an event exceeds MAX_EVENT_BYTES.
+* ~256 strings × 1 KB would still fit; real events have far fewer fields.
+*/
+const OVERSIZED_STRING_CAP = 1024;
+function serializedBytes(value) {
+	return Buffer.byteLength(JSON.stringify(value), "utf8");
+}
+function shrinkStrings(value, cap) {
+	if (typeof value === "string") return value.length > cap ? value.slice(0, cap) : value;
+	if (Array.isArray(value)) return value.map((item) => shrinkStrings(item, cap));
+	if (value !== null && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, shrinkStrings(item, cap)]));
+	return value;
+}
+var WideEventBuilder = class {
+	requestId;
+	component;
+	fields = {};
+	constructor(requestId, component) {
+		this.requestId = requestId;
+		this.component = component;
+	}
+	set(key, value) {
+		this.fields = {
+			...this.fields,
+			[key]: value
+		};
+		return this;
+	}
+	merge(obj) {
+		const { requestId: _r, component: _c, timestamp: _t, _truncated: _x, ...rest } = obj;
+		this.fields = {
+			...this.fields,
+			...rest
+		};
+		return this;
+	}
+	flush() {
+		const event = {
+			requestId: this.requestId,
+			component: this.component,
+			timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+			...this.fields
+		};
+		return this.enforceSizeLimit(event);
+	}
+	enforceSizeLimit(event) {
+		if (serializedBytes(event) <= MAX_EVENT_BYTES) return event;
+		return {
+			...shrinkStrings(event, OVERSIZED_STRING_CAP),
+			_truncated: true
+		};
+	}
+};
+/** Probability of sampling a normal (non-error, non-slow) event. */
+const NORMAL_SAMPLE_RATE = .05;
+/**
+* Decides whether a wide event should be emitted.
+*
+* Pure function over the event — the only non-determinism is Math.random()
+* for the normal path, which tests can stub.
+*/
+function shouldSample(event) {
+	if (event.error != null) return true;
+	if (event.durationMs !== void 0 && event.durationMs > 1e4) return true;
+	return Math.random() < NORMAL_SAMPLE_RATE;
+}
+//#endregion
+//#region src/shared/logger/redaction.ts
+/** Replacement value for any field outside the whitelist. */
+const REDACTED = "[REDACTED]";
+/** Whitelisted strings longer than this are cut and suffixed. */
+const MAX_STRING_CHARS = 1e3;
+/** Suffix appended to truncated strings so truncation is visible in queries. */
+const TRUNCATION_SUFFIX = "...[truncated]";
+const ERROR_KEY = "error";
+const MESSAGE_KEY = "message";
+const NAME_KEY = "name";
+const STACK_KEY = "stack";
+const DEVELOPMENT = "development";
+/**
+* Top-level fields allowed to pass through. `cluster`, `dedup`, `rule`,
+* `llm` and `notify` are schema-known subtrees whose nested values are safe.
+*/
+const SAFE_FIELDS = /* @__PURE__ */ new Set([
+	"requestId",
+	"correlationId",
+	"timestamp",
+	"component",
+	"version",
+	"outcome",
+	"cluster",
+	"dedup",
+	"rule",
+	"llm",
+	"notify",
+	"durationMs",
+	ERROR_KEY
+]);
+function truncateString(value) {
+	return value.length > 1e3 ? value.slice(0, MAX_STRING_CHARS) + TRUNCATION_SUFFIX : value;
+}
+function redactValue(value) {
+	if (typeof value === "string") return truncateString(value);
+	if (Array.isArray(value)) return value.map(redactValue);
+	if (value !== null && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, redactValue(item)]));
+	return value;
+}
+/**
+* The error section keeps only message and name; the stack is kept solely in
+* development, where it cannot reach production log stores.
+*/
+function redactError(error) {
+	const safe = {};
+	if (typeof error[MESSAGE_KEY] === "string") safe[MESSAGE_KEY] = truncateString(error[MESSAGE_KEY]);
+	if (typeof error[NAME_KEY] === "string") safe[NAME_KEY] = truncateString(error[NAME_KEY]);
+	if (process.env["NODE_ENV"] === DEVELOPMENT && typeof error[STACK_KEY] === "string") safe[STACK_KEY] = truncateString(error[STACK_KEY]);
+	return safe;
+}
+/**
+* Deep-redacts an object against the wide-event whitelist.
+*
+* Returns a new object — the input is never mutated. Whitelisted values keep
+* their structure with over-long strings truncated; everything else becomes
+* [REDACTED].
+*/
+function redact(obj) {
+	return Object.fromEntries(Object.entries(obj).map(([key, value]) => {
+		if (!SAFE_FIELDS.has(key)) return [key, REDACTED];
+		if (key === ERROR_KEY && value !== null && typeof value === "object" && !Array.isArray(value)) return [key, redactError(value)];
+		return [key, redactValue(value)];
+	}));
+}
+//#endregion
+//#region src/shared/logger/enums.ts
+/**
+* Pipeline component taxonomy.
+*
+* `component` (not `service`) distinguishes pipeline stages in wide events.
+* `service` stays constant ("junando"); `component` tells you WHERE the event
+* was emitted from.
+*/
+const Component = {
+	Webhook: "webhook",
+	Worker: "worker",
+	UseCase: "useCase",
+	Llm: "llm",
+	Notifier: "notifier",
+	Dedup: "dedup",
+	Traces: "traces",
+	Ingest: "ingest"
+};
+/**
+* Terminal outcomes for a wide event across all entry points.
+*/
+const Outcome = {
+	Success: "success",
+	Suppressed: "suppressed",
+	Degraded: "degraded",
+	Error: "error",
+	Accepted: "accepted",
+	Empty: "empty",
+	ParseError: "parse_error"
+};
+//#endregion
 //#region src/shared/logger/index.ts
 let _root = buildLogger({});
 function buildLogger(opts) {
@@ -558,6 +649,154 @@ function reinitLogger(opts) {
 	_root = buildLogger(opts ?? {});
 }
 //#endregion
+//#region src/application/use-cases/process-incident.use-case.ts
+/** Source label for dedup counter metrics. */
+const DEDUP_METRIC_SOURCE = "alertmanager";
+function toErrorSection(err) {
+	if (err instanceof Error) return {
+		message: err.message,
+		name: err.name,
+		...err.stack !== void 0 && { stack: err.stack }
+	};
+	return { message: String(err) };
+}
+/**
+* Terminal outcome for a processed cluster. Early returns — no switch/case.
+* Notify failure is fatal (the batch is retried via SQS); LLM failure is
+* degraded (notification still went out without a diagnosis).
+*/
+function resolveOutcome({ llmError, notifyError }) {
+	if (notifyError != null) return Outcome.Error;
+	if (llmError != null) return Outcome.Degraded;
+	return Outcome.Success;
+}
+var ProcessIncidentUseCase = class {
+	deps;
+	clustering;
+	wideEventsEnabled;
+	constructor(deps) {
+		this.deps = deps;
+		this.clustering = deps.clustering ?? new ClusteringService();
+		this.wideEventsEnabled = process.env["WIDE_EVENTS_ENABLED"] !== "false";
+	}
+	async execute(alerts, correlationId) {
+		const { dedup, traces, llm, notifier, dedupTtlSeconds, ruleEngine } = this.deps;
+		const clusters = this.clustering.buildClusters(alerts);
+		this.deps.onClustersBuilt?.(clusters.length);
+		for (const cluster of clusters) {
+			const clusterStartMs = Date.now();
+			const builder = new WideEventBuilder(`${correlationId}:${cluster.fingerprint}`, Component.UseCase).set("correlationId", correlationId).set("cluster", {
+				fingerprint: cluster.fingerprint,
+				serviceName: cluster.serviceName,
+				alertCount: cluster.alertCount,
+				spanCount: 0
+			});
+			const dedupResult = await dedup.isNew(cluster.fingerprint, dedupTtlSeconds);
+			builder.set("dedup", {
+				isNew: dedupResult.isNew,
+				ttlSeconds: dedupResult.ttlSeconds,
+				...dedupResult.error !== void 0 && { error: dedupResult.error }
+			});
+			if (!dedupResult.isNew) {
+				dedupDuplicate.inc({ source: DEDUP_METRIC_SOURCE });
+				continue;
+			}
+			dedupNew.inc({ source: DEDUP_METRIC_SOURCE });
+			let preLlmRouteChannels = [];
+			let preLlmEscalateChannels = [];
+			if (ruleEngine) {
+				const preResult = ruleEngine.evaluatePreLlm(cluster);
+				builder.set("rule", {
+					matched: preResult.matchedRuleId != null,
+					suppressed: preResult.suppressed,
+					...preResult.matchedRuleId !== void 0 && { matchedRuleId: preResult.matchedRuleId }
+				});
+				if (preResult.suppressed) {
+					if (preResult.matchedRuleId) suppressedClusters.inc({ rule_id: preResult.matchedRuleId });
+					this.emit(builder, Outcome.Suppressed, clusterStartMs);
+					continue;
+				}
+				for (const action of preResult.actions) {
+					if (action.type === "route" && "channel" in action) preLlmRouteChannels.push(action.channel);
+					if (action.type === "escalate" && "channel" in action) preLlmEscalateChannels.push(action.channel);
+				}
+			}
+			let traceErrors = 0;
+			const allSpans = (await Promise.all(cluster.representativeTraceIds.map((id) => traces.findByTraceId(id).catch(() => {
+				traceErrors++;
+				return [];
+			})))).flat();
+			builder.set("cluster", {
+				fingerprint: cluster.fingerprint,
+				serviceName: cluster.serviceName,
+				alertCount: cluster.alertCount,
+				spanCount: allSpans.length,
+				...traceErrors > 0 && { traceErrors }
+			});
+			let analysis = null;
+			let llmError = null;
+			try {
+				const llmResult = await llm.analyze(cluster, allSpans);
+				analysis = llmResult.analysis;
+				builder.set("llm", {
+					provider: llmResult.provider,
+					model: llmResult.model,
+					latencyMs: llmResult.latencyMs,
+					urgency: llmResult.analysis.urgency_level,
+					tokens: llmResult.promptTokens + llmResult.completionTokens
+				});
+			} catch (err) {
+				llmError = err;
+			}
+			let postLlmEscalateChannels = [];
+			if (ruleEngine && analysis) {
+				const postResult = ruleEngine.evaluatePostLlm(cluster, analysis);
+				for (const action of postResult.actions) if (action.type === "escalate" && "channel" in action) postLlmEscalateChannels.push(action.channel);
+				if (postResult.tags && Object.keys(postResult.tags).length > 0) cluster.labels = {
+					...cluster.labels,
+					...postResult.tags
+				};
+			}
+			const escalateChannels = [...preLlmEscalateChannels, ...postLlmEscalateChannels];
+			const notifyStartMs = Date.now();
+			try {
+				const primaryChannel = preLlmRouteChannels[0];
+				const results = [await notifier.send(cluster, analysis, primaryChannel)];
+				for (const channel of escalateChannels) results.push(await notifier.send(cluster, analysis, channel));
+				builder.set("notify", {
+					channels: results.flatMap((r) => r.channels),
+					outcome: NotifyOutcome.Success,
+					latencyMs: Date.now() - notifyStartMs
+				});
+			} catch (err) {
+				builder.set("notify", {
+					channels: [...preLlmRouteChannels, ...escalateChannels],
+					outcome: NotifyOutcome.Failure,
+					latencyMs: Date.now() - notifyStartMs
+				});
+				builder.set("error", toErrorSection(err));
+				this.emit(builder, Outcome.Error, clusterStartMs);
+				throw err;
+			}
+			if (llmError != null) builder.set("error", toErrorSection(llmError));
+			this.emit(builder, resolveOutcome({
+				llmError,
+				notifyError: null
+			}), clusterStartMs);
+		}
+	}
+	/**
+	* Flushes the builder into a final event, applies tail sampling, redacts
+	* PII, and emits the single canonical log line for the cluster.
+	*/
+	emit(builder, outcome, startMs) {
+		if (!this.wideEventsEnabled) return;
+		const event = builder.set("outcome", outcome).set("durationMs", Date.now() - startMs).flush();
+		if (!shouldSample(event)) return;
+		this.deps.logger.info(redact(event));
+	}
+};
+//#endregion
 //#region src/infrastructure/dedup/redis-dedup.adapter.ts
 const logger$3 = createLogger();
 var RedisDeduplicationStore = class {
@@ -568,14 +807,22 @@ var RedisDeduplicationStore = class {
 	}
 	async isNew(fingerprint, ttlSeconds) {
 		try {
-			return await this.redis.set(`${this.keyPrefix}${fingerprint}`, "1", "EX", ttlSeconds, "NX") === "OK";
+			return {
+				isNew: await this.redis.set(`${this.keyPrefix}${fingerprint}`, "1", "EX", ttlSeconds, "NX") === "OK",
+				ttlSeconds
+			};
 		} catch (err) {
+			const message = err instanceof Error ? err.message : String(err);
 			logger$3.warn({
 				err,
 				fingerprint
 			}, "Redis dedup check failed, failing open");
 			dedupRedisFailoverTotal.inc();
-			return true;
+			return {
+				isNew: true,
+				ttlSeconds,
+				error: message
+			};
 		}
 	}
 	async reset(fingerprint) {
@@ -587,9 +834,15 @@ var InMemoryDeduplicationStore = class {
 	async isNew(fingerprint, ttlSeconds) {
 		const expiry = this.store.get(fingerprint);
 		const now = Date.now();
-		if (expiry !== void 0 && expiry > now) return false;
+		if (expiry !== void 0 && expiry > now) return {
+			isNew: false,
+			ttlSeconds
+		};
 		this.store.set(fingerprint, now + ttlSeconds * 1e3);
-		return true;
+		return {
+			isNew: true,
+			ttlSeconds
+		};
 	}
 	async reset(fingerprint) {
 		this.store.delete(fingerprint);
@@ -632,6 +885,8 @@ var InMemoryIndexer = class {
 //#endregion
 //#region src/infrastructure/llm/llm.adapter.ts
 const logger$2 = createLogger();
+/** Provider name reported by MockLLMProvider results. */
+const MOCK_PROVIDER_NAME = "mock";
 /**
 * Schema for OpenRouter API response validation.
 * Ensures type safety at the external boundary.
@@ -738,6 +993,15 @@ var GeminiProvider = class {
 		this.breaker = new Breaker.default(this.analyzeRaw.bind(this), BREAKER_OPTIONS);
 	}
 	async analyze(cluster, traces) {
+		const startMs = Date.now();
+		return {
+			...await this.analyzeWithBreaker(cluster, traces),
+			provider: "gemini",
+			model: this.model,
+			latencyMs: Date.now() - startMs
+		};
+	}
+	async analyzeWithBreaker(cluster, traces) {
 		try {
 			return await this.breaker.fire(cluster, traces);
 		} catch {
@@ -746,10 +1010,16 @@ var GeminiProvider = class {
 	}
 	async analyzeRaw(cluster, traces) {
 		const { GoogleGenerativeAI } = await import("@google/generative-ai");
-		return parseAnalysis((await new GoogleGenerativeAI(this.apiKey).getGenerativeModel({
+		const result = await new GoogleGenerativeAI(this.apiKey).getGenerativeModel({
 			model: this.model,
 			systemInstruction: SYSTEM_PROMPT
-		}).generateContent(buildUserPrompt(cluster, traces))).response.text());
+		}).generateContent(buildUserPrompt(cluster, traces));
+		const usage = result.response.usageMetadata;
+		return {
+			analysis: parseAnalysis(result.response.text()),
+			promptTokens: usage?.promptTokenCount ?? 0,
+			completionTokens: usage?.candidatesTokenCount ?? 0
+		};
 	}
 };
 /**
@@ -764,16 +1034,25 @@ var ClaudeProvider = class {
 		this.model = model;
 	}
 	async analyze(cluster, traces) {
+		const startMs = Date.now();
 		const Anthropic = (await import("@anthropic-ai/sdk")).default;
-		return parseAnalysis((await new Anthropic({ apiKey: this.apiKey }).messages.create({
+		const message = await new Anthropic({ apiKey: this.apiKey }).messages.create({
 			model: this.model,
-			max_tokens: 1024,
+			max_tokens: LLM_MAX_TOKENS,
 			system: SYSTEM_PROMPT,
 			messages: [{
 				role: "user",
 				content: buildUserPrompt(cluster, traces)
 			}]
-		})).content.find((b) => b.type === "text")?.text ?? "");
+		});
+		return {
+			analysis: parseAnalysis(message.content.find((b) => b.type === "text")?.text ?? ""),
+			provider: "claude",
+			model: this.model,
+			latencyMs: Date.now() - startMs,
+			promptTokens: message.usage?.input_tokens ?? 0,
+			completionTokens: message.usage?.output_tokens ?? 0
+		};
 	}
 };
 /**
@@ -785,11 +1064,18 @@ var MockLLMProvider = class {
 	async analyze(cluster, _traces) {
 		this.callLog.push({ cluster });
 		return {
-			probable_cause: `Mock: ${cluster.alertType} on ${cluster.serviceName}`,
-			impacted_services: [cluster.serviceName],
-			recommended_steps: ["Check the logs", "Verify the deployment"],
-			urgency_level: "high",
-			requires_rollback: false
+			analysis: {
+				probable_cause: `Mock: ${cluster.alertType} on ${cluster.serviceName}`,
+				impacted_services: [cluster.serviceName],
+				recommended_steps: ["Check the logs", "Verify the deployment"],
+				urgency_level: "high",
+				requires_rollback: false
+			},
+			provider: MOCK_PROVIDER_NAME,
+			model: MOCK_PROVIDER_NAME,
+			latencyMs: 0,
+			promptTokens: 0,
+			completionTokens: 0
 		};
 	}
 };
@@ -803,11 +1089,13 @@ var OpenRouterProvider = class {
 	model;
 	fallbackModels;
 	fallbackTimeoutMs;
-	constructor(apiKey, model = LLM_MODELS.OpenRouter, fallbackModels = [], fallbackTimeoutMs = LLM_FALLBACK_DEFAULTS.TimeoutMs) {
+	providerName;
+	constructor(apiKey, model = LLM_MODELS.OpenRouter, fallbackModels = [], fallbackTimeoutMs = LLM_FALLBACK_DEFAULTS.TimeoutMs, providerName = "openrouter") {
 		this.apiKey = apiKey;
 		this.model = model;
 		this.fallbackModels = fallbackModels.filter((m) => m !== model);
 		this.fallbackTimeoutMs = fallbackTimeoutMs;
+		this.providerName = providerName;
 	}
 	async analyze(cluster, traces, correlationId) {
 		const prompt = buildUserPrompt(cluster, traces);
@@ -862,7 +1150,7 @@ var OpenRouterProvider = class {
 				if (res.status === 429) {
 					if (this.fallbackModels.length > 0) {
 						const deadlineMs = Date.now() + this.fallbackTimeoutMs;
-						return this.analyzeFallback(prompt, correlationId, deadlineMs, this.model);
+						return this.analyzeFallback(prompt, correlationId, deadlineMs, this.model, startMs);
 					}
 					llmInferenceTotal.inc({ status: "rate_limited" });
 					throw new Error(`OpenRouter API failed: ${res.status}`);
@@ -876,8 +1164,9 @@ var OpenRouterProvider = class {
 				correlationId
 			}, "llm:validation:failed");
 			const analysis = parseAnalysis(parsed.success ? parsed.data.choices?.[0]?.message?.content ?? "" : "", correlationId);
-			if (parsed.success && parsed.data.usage) {
-				const { prompt_tokens, completion_tokens, total_tokens } = parsed.data.usage;
+			const usage = parsed.success ? parsed.data.usage : void 0;
+			if (usage) {
+				const { prompt_tokens, completion_tokens, total_tokens } = usage;
 				logger$2.info({
 					model: this.model,
 					usage: {
@@ -891,11 +1180,18 @@ var OpenRouterProvider = class {
 			}
 			llmInferenceTotal.inc({ status: "success" });
 			llmInferenceDuration.observe({ model: this.model }, latencyMs / 1e3);
-			return analysis;
+			return {
+				analysis,
+				provider: this.providerName,
+				model: this.model,
+				latencyMs,
+				promptTokens: usage?.prompt_tokens ?? 0,
+				completionTokens: usage?.completion_tokens ?? 0
+			};
 		}
 		throw new Error("OpenRouter API failed after retry");
 	}
-	async analyzeFallback(prompt, correlationId, deadlineMs, fromModel) {
+	async analyzeFallback(prompt, correlationId, deadlineMs, fromModel, startMs) {
 		for (const toModel of this.fallbackModels) {
 			if (Date.now() >= deadlineMs) throw new Error("OpenRouter fallback chain timed out");
 			logger$2.info({
@@ -932,7 +1228,16 @@ var OpenRouterProvider = class {
 				throw new Error(`OpenRouter API failed: ${res.status}`);
 			}
 			const parsed = OpenRouterResponseSchema.safeParse(raw);
-			return parseAnalysis(parsed.success ? parsed.data.choices?.[0]?.message?.content ?? "" : "", correlationId);
+			const text = parsed.success ? parsed.data.choices?.[0]?.message?.content ?? "" : "";
+			const usage = parsed.success ? parsed.data.usage : void 0;
+			return {
+				analysis: parseAnalysis(text, correlationId),
+				provider: this.providerName,
+				model: toModel,
+				latencyMs: Date.now() - startMs,
+				promptTokens: usage?.prompt_tokens ?? 0,
+				completionTokens: usage?.completion_tokens ?? 0
+			};
 		}
 		throw new Error("OpenRouter API exhausted all models");
 	}
@@ -944,8 +1249,8 @@ var OpenRouterProvider = class {
 const LLM_PROVIDER_REGISTRY = /* @__PURE__ */ new Map([
 	["gemini", (apiKey, model) => new GeminiProvider(apiKey, model)],
 	["claude", (apiKey, model) => new ClaudeProvider(apiKey, model)],
-	["openrouter", (apiKey, model, options) => new OpenRouterProvider(apiKey, model, options?.fallbackModels, options?.fallbackTimeoutMs)],
-	["qwen", (apiKey, model, options) => new OpenRouterProvider(apiKey, model, options?.fallbackModels, options?.fallbackTimeoutMs)]
+	["openrouter", (apiKey, model, options) => new OpenRouterProvider(apiKey, model, options?.fallbackModels, options?.fallbackTimeoutMs, "openrouter")],
+	["qwen", (apiKey, model, options) => new OpenRouterProvider(apiKey, model, options?.fallbackModels, options?.fallbackTimeoutMs, "qwen")]
 ]);
 function createLLMProvider(provider, apiKey, model, options) {
 	const factory = LLM_PROVIDER_REGISTRY.get(provider);
@@ -1017,6 +1322,7 @@ var SlackNotifier = class {
 	}
 	async send(cluster, analysis, _channel) {
 		const payload = analysis ? this.buildAnalysisMessage(cluster, analysis) : this.buildFallbackMessage(cluster);
+		const startMs = Date.now();
 		try {
 			const res = await fetch(SLACK_API_URL, {
 				method: "POST",
@@ -1037,6 +1343,11 @@ var SlackNotifier = class {
 				channel: "slack",
 				outcome: "success"
 			});
+			return {
+				outcome: NotifyOutcome.Success,
+				latencyMs: Date.now() - startMs,
+				channels: [this.channel]
+			};
 		} catch (err) {
 			notificationsTotal.inc({
 				channel: "slack",
@@ -1155,6 +1466,7 @@ var SlackNotifier = class {
 var ConsoleNotifier = class {
 	sent = [];
 	async send(cluster, analysis, _channel) {
+		const startMs = Date.now();
 		try {
 			this.sent.push({
 				cluster,
@@ -1171,6 +1483,11 @@ var ConsoleNotifier = class {
 				channel: "unknown",
 				outcome: "success"
 			});
+			return {
+				outcome: NotifyOutcome.Success,
+				latencyMs: Date.now() - startMs,
+				channels: ["console"]
+			};
 		} catch (err) {
 			notificationsTotal.inc({
 				channel: "unknown",
@@ -1321,6 +1638,7 @@ var TeamsNotifier = class {
 		const payload = buildAdaptiveCardPayload(analysis ? buildAnalysisCard(cluster, analysis) : buildFallbackCard(cluster));
 		const controller = new AbortController();
 		const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+		const startMs = Date.now();
 		try {
 			const res = await fetch(this.webhookUrl, {
 				method: "POST",
@@ -1333,6 +1651,11 @@ var TeamsNotifier = class {
 				channel: "teams",
 				outcome: "success"
 			});
+			return {
+				outcome: NotifyOutcome.Success,
+				latencyMs: Date.now() - startMs,
+				channels: ["teams"]
+			};
 		} catch (err) {
 			if (err instanceof TeamsNotifierError) {
 				notificationsTotal.inc({
@@ -1391,7 +1714,7 @@ var RoutingNotifier = class {
 	* Backward-compatible with existing call sites that don't use rule actions.
 	*/
 	async send(cluster, analysis) {
-		await this.defaultNotifier.send(cluster, analysis);
+		return this.defaultNotifier.send(cluster, analysis);
 	}
 	/**
 	* Dispatch notifications based on rule engine actions.
@@ -1963,6 +2286,6 @@ async function loadConfig() {
 	return result.data;
 }
 //#endregion
-export { ALERT_TYPE_LABELS, AlertClusterSchema, AlertStatusSchema, AlertType, AlertmanagerPayloadSchema, CIRCUIT_BREAKER, ChannelRegistry, ClaudeProvider, ClusteringService, ConsoleNotifier, DEDUP_TTL_MS_MULTIPLIER, DEV_SERVER_PORT, FactoryRegistry, Fingerprint, GeminiProvider, HOUR_MS, HTTP_TIMEOUT_MS, InMemoryAlertQueue, InMemoryDeduplicationStore, InMemoryIndexer, IncidentSchema, LLMAnalysisSchema, LLMProviderType, LLM_FALLBACK_DEFAULTS, LLM_MAX_TOKENS, LLM_MODELS, LokiTraceRepository, MockLLMProvider, MockTraceRepository, NormalizedAlertSchema, OpenSearchIndexer, PAYLOAD_DEFAULTS, ProcessIncidentUseCase, RATE_LIMITER, REDIS_KEY_PREFIX, RedisDeduplicationStore, RoutingNotifier, RuleActionSchema, RuleActionType, RuleConditionSchema, RuleConfigurationSchema, RuleEngine, RuleEvaluationPhase, RuleSchema, RuleSectionSchema, SLACK_API_URL, SQSAlertQueue, SeverityLevel, SlackNotifier, TEAMS_WEBHOOK_TIMEOUT_MS, TeamsNotifier, TeamsNotifierError, URGENCY_EMOJI, UrgencyLevelSchema, WEBHOOK_DEFAULTS, compileCondition, createLLMProvider, createLogger, createNotifier, dispatchActions, flushLoki, loadConfig, metrics_exports as metrics, normalizePayload, parseRuleConfig, reinitLogger, startSqsLagPoller };
+export { ALERT_TYPE_LABELS, AlertClusterSchema, AlertStatusSchema, AlertType, AlertmanagerPayloadSchema, CIRCUIT_BREAKER, ChannelRegistry, ClaudeProvider, ClusteringService, ConsoleNotifier, DEDUP_TTL_MS_MULTIPLIER, DEV_SERVER_PORT, FactoryRegistry, Fingerprint, GeminiProvider, HOUR_MS, HTTP_TIMEOUT_MS, InMemoryAlertQueue, InMemoryDeduplicationStore, InMemoryIndexer, IncidentSchema, LLMAnalysisSchema, LLMProviderType, LLM_FALLBACK_DEFAULTS, LLM_MAX_TOKENS, LLM_MODELS, LokiTraceRepository, MockLLMProvider, MockTraceRepository, NormalizedAlertSchema, NotifyOutcome, OpenSearchIndexer, PAYLOAD_DEFAULTS, ProcessIncidentUseCase, RATE_LIMITER, REDIS_KEY_PREFIX, RedisDeduplicationStore, RoutingNotifier, RuleActionSchema, RuleActionType, RuleConditionSchema, RuleConfigurationSchema, RuleEngine, RuleEvaluationPhase, RuleSchema, RuleSectionSchema, SLACK_API_URL, SQSAlertQueue, SeverityLevel, SlackNotifier, TEAMS_WEBHOOK_TIMEOUT_MS, TeamsNotifier, TeamsNotifierError, URGENCY_EMOJI, UrgencyLevelSchema, WEBHOOK_DEFAULTS, compileCondition, createLLMProvider, createLogger, createNotifier, dispatchActions, flushLoki, loadConfig, metrics_exports as metrics, normalizePayload, parseRuleConfig, reinitLogger, startSqsLagPoller };
 
 //# sourceMappingURL=index.js.map