@junando/core 0.13.0 → 0.15.0

package/dist/index.js

@@ -1,10 +1,13 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM, r as __exportAll, t as __commonJSMin } from "./rolldown-runtime-BMI-E3GI.js";
-import { dedupDuplicate, dedupNew, dedupRedisFailoverTotal, llmInferenceDuration, llmInferenceTotal, notificationsTotal, sqsQueueLag, suppressedClusters, t as metrics_exports } from "./shared/metrics/index.js";
+import { dedupDuplicate, dedupFailoverTotal, dedupNew, llmInferenceDuration, llmInferenceTotal, notificationsTotal, sqsQueueLag, suppressedClusters, t as metrics_exports } from "./shared/metrics/index.js";
 import { $ as booleanSelector, $t as ServiceException, A as BinaryDecisionDiagram, An as isValidHostLabel, B as NODE_REGION_CONFIG_FILE_OPTIONS, C as isIpAddress, Ct as dateToUtcString, Dt as parseRfc7231DateTime, E as EndpointError, En as normalizeProvider$1, Et as parseRfc3339DateTimeWithOffset, F as init_config$1, Fn as hasOwn, G as NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS, H as REGION_ENV_NAME, Ht as NoOpLogger, It as fromBase64, Jt as resolveDefaultRuntimeConfig, Kt as getDefaultExtensionConfiguration, L as resolveDefaultsModeConfig, Ln as getSmithyContext, N as resolveParams, Nn as HttpRequest, Nt as toBase64, O as EndpointCache, On as isValidHostname, Ot as expectUnion, P as config_exports, Pt as fromUtf8, Qt as loadConfigsForDefaultMode, Rt as client_exports$1, Sn as parseUrl, Tt as parseEpochTimestamp, U as REGION_INI_NAME, V as NODE_REGION_CONFIG_OPTIONS, Vt as makeBuilder, Wt as getValueFromTextNode, X as loadConfig$1, Yt as emitWarningIfUnsupportedVersion$1, Z as SelectorType, _ as resolveEndpointConfig, _t as _parseRfc7231DateTime, b as decideEndpoint, bn as init_transport, bt as quoteHeader, c as generateIdempotencyToken, cn as TypeRegistry, ct as NumericValue, d as v4, en as decorateServiceException, ft as splitHeader, g as init_endpoints, gn as deref, gt as _parseRfc3339DateTimeWithOffset, h as getEndpointPlugin, ht as _parseEpochTimestamp, in as Command, jn as HttpResponse, jt as toUtf8, l as init_serde, m as endpoints_exports, mn as getSchemaSerdePlugin, mt as splitEvery, n as init_checksum, nn as createAggregatedClient, on as init_schema, p as sdkStreamMixin, pn as translateTraits, q as NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS, r as Sha256Node, rt as calculateBodyLength, s as Uint8ArrayBlobAdapter, sn as schema_exports, t as checksum_exports, tt as ProviderError, u as serde_exports, un as NormalizedSchema, ut as nv, vn as Client, w as customEndpointFunctions, wn as parseQueryString, xt as LazyJsonString, y as resolveEndpoint, z as resolveRegionConfig, zn as require_dist_cjs$17, zt as init_client$1 } from "./checksum-Bbvsykod.js";
 import { z } from "zod";
 import { createHash, randomUUID } from "node:crypto";
 import pino from "pino";
 import { Readable, Writable } from "node:stream";
+import { DeleteItemCommand, DynamoDBClient, PutItemCommand } from "@aws-sdk/client-dynamodb";
+import { BedrockRuntimeClient, ConverseCommand } from "@aws-sdk/client-bedrock-runtime";
+import { GoogleGenerativeAI, GoogleGenerativeAIAbortError } from "@google/generative-ai";
 import * as Breaker from "opossum";
 import { readFileSync } from "node:fs";
 import { YAMLParseError, parse } from "yaml";
@@ -39,6 +42,7 @@ let LLMProviderType = /* @__PURE__ */ function(LLMProviderType) {
 	LLMProviderType["Claude"] = "claude";
 	LLMProviderType["OpenRouter"] = "openrouter";
 	LLMProviderType["Qwen"] = "qwen";
+	LLMProviderType["Bedrock"] = "bedrock";
 	return LLMProviderType;
 }({});
 const HTTP_TIMEOUT_MS = Object.freeze({
@@ -71,7 +75,8 @@ const LLM_FALLBACK_DEFAULTS = Object.freeze({
 const LLM_MODELS = Object.freeze({
 	Gemini: "gemini-2.0-flash",
 	Claude: "claude-haiku-4-5",
-	OpenRouter: "qwen/qwen-2.5-72b-instruct"
+	OpenRouter: "qwen/qwen-2.5-72b-instruct",
+	Bedrock: "us.amazon.nova-lite-v1:0"
 });
 const SLACK_API_URL = "https://slack.com/api/chat.postMessage";
 const ROLLBACK_ACTION_ID = "trigger_rollback";
@@ -808,6 +813,7 @@ var ProcessIncidentUseCase = class {
 					latencyMs: Date.now() - notifyStartMs
 				});
 				builder.set("error", toErrorSection(err));
+				await this.releaseDedupClaim(cluster.fingerprint);
 				this.emit(builder, Outcome.Error, clusterStartMs);
 				throw err;
 			}
@@ -820,6 +826,22 @@ var ProcessIncidentUseCase = class {
 		}
 	}
 	/**
+	* Releases the dedup claim so an SQS retry is not discarded as a duplicate.
+	* Concurrency: safe without a lock — sqs.adapter.ts sets messageGroupId to
+	* the fingerprint, so SQS FIFO serialises delivery per fingerprint and two
+	* runs for the same fingerprint are never in flight simultaneously.
+	*/
+	async releaseDedupClaim(fingerprint) {
+		try {
+			await this.deps.dedup.reset(fingerprint);
+		} catch (err) {
+			this.deps.logger.warn({
+				err,
+				fingerprint
+			}, "Failed to release dedup claim; retry may be suppressed");
+		}
+	}
+	/**
 	* Flushes the builder into a final event, applies tail sampling, redacts
 	* PII, and emits the single canonical log line for the cluster.
 	*/
@@ -832,7 +854,7 @@ var ProcessIncidentUseCase = class {
 };
 //#endregion
 //#region src/infrastructure/dedup/redis-dedup.adapter.ts
-const logger$6 = createLogger();
+const logger$8 = createLogger();
 var RedisDeduplicationStore = class {
 	redis;
 	keyPrefix = "junando:dedup:";
@@ -847,11 +869,11 @@ var RedisDeduplicationStore = class {
 			};
 		} catch (err) {
 			const message = err instanceof Error ? err.message : String(err);
-			logger$6.warn({
+			logger$8.warn({
 				err,
 				fingerprint
 			}, "Redis dedup check failed, failing open");
-			dedupRedisFailoverTotal.inc();
+			dedupFailoverTotal.inc();
 			return {
 				isNew: true,
 				ttlSeconds,
@@ -886,6 +908,63 @@ var InMemoryDeduplicationStore = class {
 	}
 };
 //#endregion
+//#region src/infrastructure/dedup/dynamodb-dedup.adapter.ts
+const logger$7 = createLogger();
+const CONDITION_EXPRESSION = "attribute_not_exists(fingerprint) OR expiresAt < :now";
+var DynamoDBDeduplicationStore = class {
+	tableName;
+	region;
+	client = null;
+	constructor(tableName, region) {
+		this.tableName = tableName;
+		this.region = region;
+	}
+	getClient() {
+		if (!this.client) this.client = new DynamoDBClient(this.region ? { region: this.region } : {});
+		return this.client;
+	}
+	async isNew(fingerprint, ttlSeconds) {
+		const nowSec = Math.floor(Date.now() / 1e3);
+		try {
+			await this.getClient().send(new PutItemCommand({
+				TableName: this.tableName,
+				Item: {
+					fingerprint: { S: fingerprint },
+					expiresAt: { N: String(nowSec + ttlSeconds) }
+				},
+				ConditionExpression: CONDITION_EXPRESSION,
+				ExpressionAttributeValues: { ":now": { N: String(nowSec) } }
+			}));
+			return {
+				isNew: true,
+				ttlSeconds
+			};
+		} catch (err) {
+			if (err instanceof Error && err.name === "ConditionalCheckFailedException") return {
+				isNew: false,
+				ttlSeconds
+			};
+			const message = err instanceof Error ? err.message : String(err);
+			logger$7.warn({
+				err,
+				fingerprint
+			}, "DynamoDB dedup check failed, failing open");
+			dedupFailoverTotal.inc();
+			return {
+				isNew: true,
+				ttlSeconds,
+				error: message
+			};
+		}
+	}
+	async reset(fingerprint) {
+		await this.getClient().send(new DeleteItemCommand({
+			TableName: this.tableName,
+			Key: { fingerprint: { S: fingerprint } }
+		}));
+	}
+};
+//#endregion
 //#region src/infrastructure/indexer/opensearch.adapter.ts
 var OpenSearchIndexer = class {
 	endpoint;
@@ -917,30 +996,8 @@ var InMemoryIndexer = class {
 	}
 };
 //#endregion
-//#region src/infrastructure/llm/llm.adapter.ts
-const logger$5 = createLogger();
-/** Provider name reported by MockLLMProvider results. */
-const MOCK_PROVIDER_NAME = "mock";
-/**
-* Schema for OpenRouter API response validation.
-* Ensures type safety at the external boundary.
-*/
-const OpenRouterResponseSchema = z.object({
-	id: z.string().optional(),
-	choices: z.array(z.object({
-		index: z.number(),
-		message: z.object({
-			role: z.string(),
-			content: z.string().optional()
-		}),
-		finish_reason: z.string().optional()
-	})),
-	usage: z.object({
-		prompt_tokens: z.number().optional(),
-		completion_tokens: z.number().optional(),
-		total_tokens: z.number().optional()
-	}).optional()
-});
+//#region src/infrastructure/llm/shared.ts
+const logger$6 = createLogger();
 const SYSTEM_PROMPT = `You are a senior Site Reliability Engineer.
 Respond ONLY with raw JSON, no markdown, no text before or after:
 {"probable_cause":"string","impacted_services":["string"],"recommended_steps":["string"],"urgency_level":"low|medium|high|critical","requires_rollback":true|false}`;
@@ -954,11 +1011,6 @@ const RE_URGENCY_LEVEL = /"urgency_level"\s*:\s*"([^"]+)"/;
 const RE_REQUIRES_ROLLBACK = /"requires_rollback"\s*:\s*(true|false)/;
 const RE_RECOMMENDED_STEPS = /"recommended_steps"\s*:\s*\[([^\]]+)\]/;
 const RE_IMPACTED_SERVICES = /"impacted_services"\s*:\s*\[([^\]]+)\]/;
-const BREAKER_OPTIONS = {
-	timeout: CIRCUIT_BREAKER.Timeout,
-	errorThresholdPercentage: CIRCUIT_BREAKER.ErrorThresholdPercentage,
-	resetTimeout: CIRCUIT_BREAKER.ResetTimeoutMs
-};
 /**
 * Builds the user-facing prompt sent to the LLM for analysis.
 * Includes cluster summary and trace count for context.
@@ -980,7 +1032,7 @@ function parseAnalysis(raw, correlationId) {
 		stage1Succeeded = true;
 		return analysis;
 	} catch {}
-	if (!stage1Succeeded) logger$5.warn({
+	if (!stage1Succeeded) logger$6.warn({
 		rawResponse: raw.slice(0, 500),
 		correlationId
 	}, "llm:parse:failed");
@@ -1001,13 +1053,13 @@ function parseAnalysis(raw, correlationId) {
 			requires_rollback: rollbackMatch?.[1] === "true"
 		};
 		const parsed = LLMAnalysisSchema.parse(analysis);
-		logger$5.warn({
+		logger$6.warn({
 			matchedFields: ["probable_cause", "urgency_level"],
 			correlationId
 		}, "llm:parse:partial");
 		return parsed;
 	}
-	logger$5.warn({ correlationId }, "llm:parse:unusable");
+	logger$6.warn({ correlationId }, "llm:parse:unusable");
 	return null;
 }
 /**
@@ -1017,7 +1069,7 @@ function parseAnalysis(raw, correlationId) {
 */
 function parseLlmText(raw, correlationId) {
 	if (raw.trim() === "") {
-		logger$5.warn({ correlationId }, "llm:parse:empty");
+		logger$6.warn({ correlationId }, "llm:parse:empty");
 		return {
 			analysis: null,
 			degradedReason: "empty_response"
@@ -1029,49 +1081,79 @@ function parseLlmText(raw, correlationId) {
 		degradedReason: "unparseable_response"
 	};
 }
+//#endregion
+//#region src/infrastructure/llm/bedrock.provider.ts
 /**
-* Gemini LLM provider using Google Generative AI SDK.
-* Wrapped with circuit breaker for resilience.
+* Recognized transient Bedrock error names, mapped to their degradedReason.
+* Any other error name (or non-Error rejection) is rethrown by the caller.
 */
-var GeminiProvider = class {
-	apiKey;
+const BEDROCK_AVAILABILITY_ERRORS = /* @__PURE__ */ new Map([
+	["ThrottlingException", "provider_unavailable"],
+	["ServiceUnavailableException", "provider_unavailable"],
+	["InternalServerException", "provider_unavailable"],
+	["ModelTimeoutException", "timeout"],
+	["AbortError", "timeout"]
+]);
+function classifyBedrockError(error) {
+	if (!(error instanceof Error)) return void 0;
+	return BEDROCK_AVAILABILITY_ERRORS.get(error.name);
+}
+/**
+* Bedrock LLM provider using AWS Bedrock Runtime's Converse API.
+* No circuit breaker — Bedrock's own throttling/timeout errors are
+* classified directly into a degradedReason.
+*/
+var BedrockProvider = class {
 	model;
-	breaker;
-	constructor(apiKey, model = LLM_MODELS.Gemini) {
-		this.apiKey = apiKey;
+	client = null;
+	constructor(model = LLM_MODELS.Bedrock) {
 		this.model = model;
-		this.breaker = new Breaker.default(this.analyzeRaw.bind(this), BREAKER_OPTIONS);
+	}
+	getClient() {
+		if (!this.client) this.client = new BedrockRuntimeClient({});
+		return this.client;
 	}
 	async analyze(cluster, traces) {
 		const startMs = Date.now();
-		return {
-			...await this.analyzeWithBreaker(cluster, traces),
-			provider: "gemini",
-			model: this.model,
-			latencyMs: Date.now() - startMs
-		};
-	}
-	async analyzeWithBreaker(cluster, traces) {
+		const abortController = new AbortController();
+		const timeoutHandle = setTimeout(() => abortController.abort(), HTTP_TIMEOUT_MS.LLM);
 		try {
-			return await this.breaker.fire(cluster, traces);
-		} catch {
-			return this.analyzeRaw(cluster, traces);
+			const response = await this.getClient().send(new ConverseCommand({
+				modelId: this.model,
+				system: [{ text: SYSTEM_PROMPT }],
+				messages: [{
+					role: "user",
+					content: [{ text: buildUserPrompt(cluster, traces) }]
+				}],
+				inferenceConfig: { maxTokens: LLM_MAX_TOKENS }
+			}), { abortSignal: abortController.signal });
+			return {
+				...parseLlmText(response.output?.message?.content?.find((b) => b.text !== void 0)?.text ?? ""),
+				provider: "bedrock",
+				model: this.model,
+				latencyMs: Date.now() - startMs,
+				promptTokens: response.usage?.inputTokens ?? 0,
+				completionTokens: response.usage?.outputTokens ?? 0
+			};
+		} catch (error) {
+			const degradedReason = classifyBedrockError(error);
+			if (degradedReason === void 0) throw error;
+			return {
+				analysis: null,
+				degradedReason,
+				provider: "bedrock",
+				model: this.model,
+				latencyMs: Date.now() - startMs,
+				promptTokens: 0,
+				completionTokens: 0
+			};
+		} finally {
+			clearTimeout(timeoutHandle);
 		}
 	}
-	async analyzeRaw(cluster, traces) {
-		const { GoogleGenerativeAI } = await import("@google/generative-ai");
-		const result = await new GoogleGenerativeAI(this.apiKey).getGenerativeModel({
-			model: this.model,
-			systemInstruction: SYSTEM_PROMPT
-		}).generateContent(buildUserPrompt(cluster, traces));
-		const usage = result.response.usageMetadata;
-		return {
-			...parseLlmText(result.response.text()),
-			promptTokens: usage?.promptTokenCount ?? 0,
-			completionTokens: usage?.candidatesTokenCount ?? 0
-		};
-	}
 };
+//#endregion
+//#region src/infrastructure/llm/claude.provider.ts
 /**
 * Claude LLM provider using Anthropic SDK.
 * Supports Claude Haiku and other models.
@@ -1105,30 +1187,108 @@ var ClaudeProvider = class {
 		};
 	}
 };
+//#endregion
+//#region src/infrastructure/llm/gemini.provider.ts
+const OPOSSUM_TIMEOUT_CODE = "ETIMEDOUT";
+const OPOSSUM_OPEN_BREAKER_CODE = "EOPENBREAKER";
+const UNDICI_CONNECT_TIMEOUT_CODE = "UND_ERR_CONNECT_TIMEOUT";
+function isErrorLike(value) {
+	return typeof value === "object" && value !== null;
+}
+function hasTimeoutCode(error) {
+	return error.code === OPOSSUM_TIMEOUT_CODE || error.code === UNDICI_CONNECT_TIMEOUT_CODE;
+}
+function isStandardFetchTimeout(error) {
+	return error instanceof DOMException && error.name === "TimeoutError";
+}
+function classifyGeminiAvailabilityError(error) {
+	if (!isErrorLike(error)) return void 0;
+	if (error.code === OPOSSUM_OPEN_BREAKER_CODE) return "circuit_breaker_open";
+	if (hasTimeoutCode(error)) return "timeout";
+	if (error instanceof GoogleGenerativeAIAbortError) return "timeout";
+	if (isStandardFetchTimeout(error)) return "timeout";
+	if (isErrorLike(error.cause) && (hasTimeoutCode(error.cause) || isStandardFetchTimeout(error.cause))) return "timeout";
+}
+function degradedGeminiResult(degradedReason) {
+	return {
+		analysis: null,
+		degradedReason,
+		promptTokens: 0,
+		completionTokens: 0
+	};
+}
+const BREAKER_OPTIONS = {
+	timeout: CIRCUIT_BREAKER.Timeout,
+	errorThresholdPercentage: CIRCUIT_BREAKER.ErrorThresholdPercentage,
+	resetTimeout: CIRCUIT_BREAKER.ResetTimeoutMs
+};
 /**
-* Mock LLM provider for testing and local development.
-* Returns deterministic responses without external API calls.
+* Gemini LLM provider using Google Generative AI SDK.
+* Wrapped with circuit breaker for resilience.
 */
-var MockLLMProvider = class {
-	callLog = [];
-	async analyze(cluster, _traces) {
-		this.callLog.push({ cluster });
+var GeminiProvider = class {
+	apiKey;
+	model;
+	breaker;
+	constructor(apiKey, model = LLM_MODELS.Gemini) {
+		this.apiKey = apiKey;
+		this.model = model;
+		this.breaker = new Breaker.default(this.analyzeRaw.bind(this), BREAKER_OPTIONS);
+	}
+	async analyze(cluster, traces) {
+		const startMs = Date.now();
 		return {
-			analysis: {
-				probable_cause: `Mock: ${cluster.alertType} on ${cluster.serviceName}`,
-				impacted_services: [cluster.serviceName],
-				recommended_steps: ["Check the logs", "Verify the deployment"],
-				urgency_level: "high",
-				requires_rollback: false
-			},
-			provider: MOCK_PROVIDER_NAME,
-			model: MOCK_PROVIDER_NAME,
-			latencyMs: 0,
-			promptTokens: 0,
-			completionTokens: 0
+			...await this.analyzeWithBreaker(cluster, traces),
+			provider: "gemini",
+			model: this.model,
+			latencyMs: Date.now() - startMs
+		};
+	}
+	async analyzeWithBreaker(cluster, traces) {
+		try {
+			return await this.breaker.fire(cluster, traces);
+		} catch (error) {
+			const degradedReason = classifyGeminiAvailabilityError(error);
+			if (degradedReason !== void 0) return degradedGeminiResult(degradedReason);
+			throw error;
+		}
+	}
+	async analyzeRaw(cluster, traces) {
+		const result = await new GoogleGenerativeAI(this.apiKey).getGenerativeModel({
+			model: this.model,
+			systemInstruction: SYSTEM_PROMPT
+		}).generateContent(buildUserPrompt(cluster, traces));
+		const usage = result.response.usageMetadata;
+		return {
+			...parseLlmText(result.response.text()),
+			promptTokens: usage?.promptTokenCount ?? 0,
+			completionTokens: usage?.candidatesTokenCount ?? 0
 		};
 	}
 };
+//#endregion
+//#region src/infrastructure/llm/openrouter.provider.ts
+const logger$5 = createLogger();
+/**
+* Schema for OpenRouter API response validation.
+* Ensures type safety at the external boundary.
+*/
+const OpenRouterResponseSchema = z.object({
+	id: z.string().optional(),
+	choices: z.array(z.object({
+		index: z.number(),
+		message: z.object({
+			role: z.string(),
+			content: z.string().optional()
+		}),
+		finish_reason: z.string().optional()
+	})),
+	usage: z.object({
+		prompt_tokens: z.number().optional(),
+		completion_tokens: z.number().optional(),
+		total_tokens: z.number().optional()
+	}).optional()
+});
 /**
 * OpenRouter LLM provider using OpenAI-compatible API.
 * Supports various open models (Qwen, etc.) via OpenRouter gateway.
@@ -1292,6 +1452,8 @@ var OpenRouterProvider = class {
 		throw new Error("OpenRouter API exhausted all models");
 	}
 };
+//#endregion
+//#region src/infrastructure/llm/factory.ts
 /**
 * Registry mapping provider names to their factory functions.
 * Used by createLLMProvider to instantiate the appropriate LLM client.
@@ -1300,7 +1462,8 @@ const LLM_PROVIDER_REGISTRY = /* @__PURE__ */ new Map([
 	["gemini", (apiKey, model) => new GeminiProvider(apiKey, model)],
 	["claude", (apiKey, model) => new ClaudeProvider(apiKey, model)],
 	["openrouter", (apiKey, model, options) => new OpenRouterProvider(apiKey, model, options?.fallbackModels, options?.fallbackTimeoutMs, "openrouter")],
-	["qwen", (apiKey, model, options) => new OpenRouterProvider(apiKey, model, options?.fallbackModels, options?.fallbackTimeoutMs, "qwen")]
+	["qwen", (apiKey, model, options) => new OpenRouterProvider(apiKey, model, options?.fallbackModels, options?.fallbackTimeoutMs, "qwen")],
+	["bedrock", (_apiKey, model) => new BedrockProvider(model)]
 ]);
 function createLLMProvider(provider, apiKey, model, options) {
 	const factory = LLM_PROVIDER_REGISTRY.get(provider);
@@ -1308,9 +1471,37 @@ function createLLMProvider(provider, apiKey, model, options) {
 		const supported = Array.from(LLM_PROVIDER_REGISTRY.keys()).join(", ");
 		throw new Error(`Unknown LLM_PROVIDER: "${provider}". Supported: ${supported}`);
 	}
-	return factory(apiKey, model, options);
+	return factory(apiKey ?? "", model, options);
 }
 //#endregion
+//#region src/infrastructure/llm/mock.provider.ts
+/** Provider name reported by MockLLMProvider results. */
+const MOCK_PROVIDER_NAME = "mock";
+/**
+* Mock LLM provider for testing and local development.
+* Returns deterministic responses without external API calls.
+*/
+var MockLLMProvider = class {
+	callLog = [];
+	async analyze(cluster, _traces) {
+		this.callLog.push({ cluster });
+		return {
+			analysis: {
+				probable_cause: `Mock: ${cluster.alertType} on ${cluster.serviceName}`,
+				impacted_services: [cluster.serviceName],
+				recommended_steps: ["Check the logs", "Verify the deployment"],
+				urgency_level: "high",
+				requires_rollback: false
+			},
+			provider: MOCK_PROVIDER_NAME,
+			model: MOCK_PROVIDER_NAME,
+			latencyMs: 0,
+			promptTokens: 0,
+			completionTokens: 0
+		};
+	}
+};
+//#endregion
 //#region src/shared/factory-registry.ts
 var FactoryRegistry = class {
 	_factories = /* @__PURE__ */ new Map();
@@ -35621,6 +35812,20 @@ function parseBooleanEnv(value) {
 	const normalized = value.trim().toLowerCase();
 	return normalized === "true" || normalized === "1";
 }
+function llmApiKeyRequired(llmProvider, llmApiKey) {
+	return llmProvider !== "bedrock" && !llmApiKey;
+}
+/**
+* Resolves the effective LLM_MODEL. An explicit LLM_MODEL always wins, for any
+* provider. BEDROCK_DEFAULT_MODEL (set by the CDK stack from the deployment
+* region — see junando-stack.ts) is used ONLY as a fallback when the provider
+* is bedrock, so a Bedrock-specific value can never leak into another
+* provider's model override.
+*/
+function resolveLlmModel(llmProvider, llmModel, bedrockDefaultModel) {
+	if (llmModel) return llmModel;
+	return llmProvider === "bedrock" ? bedrockDefaultModel : void 0;
+}
 function parseOptionalStringArray(value) {
 	if (value === void 0 || value === "") return void 0;
 	return value.split(",").map((s) => s.trim()).filter(Boolean);
@@ -35659,6 +35864,8 @@ async function loadSecretsFromSSM() {
 			const key = param.Name.replace(`${prefix}/`, "").replaceAll("-", "_").toUpperCase();
 			process.env[key] = param.Value;
 		}
+		const missing = result.InvalidParameters ?? [];
+		if (missing.length > 0) createLogger().warn({ missingParameters: missing }, "SSM parameters not found");
 	} catch (err) {
 		createLogger().error({ err }, "Failed to load SSM parameters");
 	}
@@ -35668,9 +35875,10 @@ const ConfigSchema = z.object({
 		"gemini",
 		"claude",
 		"openrouter",
-		"qwen"
+		"qwen",
+		"bedrock"
 	]),
-	llmApiKey: z.string().min(1),
+	llmApiKey: z.string().min(1).optional(),
 	llmModel: z.string().optional().transform((v) => v === "" ? void 0 : v),
 	notifierType: z.enum(["slack", "teams"]).default("slack"),
 	slackBotToken: z.string().startsWith("xoxb-").optional(),
@@ -35680,7 +35888,9 @@ const ConfigSchema = z.object({
 	rollbackActionAllowedSlackUserIds: z.array(z.string()).optional(),
 	teamsWebhookUrl: z.string().url().optional(),
 	lokiUrl: z.string().optional().transform((v) => v === "" ? void 0 : v),
-	redisUrl: z.string().url(),
+	dedupStore: z.enum(["dynamodb", "redis"]).default("dynamodb"),
+	dedupTableName: z.string().min(1).optional(),
+	redisUrl: z.string().url().optional(),
 	sqsQueueUrl: z.string().url().optional().or(z.literal("")),
 	dedupTtlSeconds: z.coerce.number().int().positive().default(300),
 	clusterWindowMs: z.coerce.number().int().positive().default(12e4),
@@ -35741,13 +35951,28 @@ const ConfigSchema = z.object({
 			});
 		}
 	}
+	if (data.dedupStore === "dynamodb" && !data.dedupTableName) ctx.addIssue({
+		code: z.ZodIssueCode.custom,
+		path: ["dedupTableName"],
+		message: "[dedupStore: dynamodb] DEDUP_TABLE_NAME is required"
+	});
+	if (data.dedupStore === "redis" && !data.redisUrl) ctx.addIssue({
+		code: z.ZodIssueCode.custom,
+		path: ["redisUrl"],
+		message: "[dedupStore: redis] REDIS_URL is required"
+	});
+	if (llmApiKeyRequired(data.llmProvider, data.llmApiKey)) ctx.addIssue({
+		code: z.ZodIssueCode.custom,
+		path: ["llmApiKey"],
+		message: `[llmProvider: ${data.llmProvider}] LLM_API_KEY is required`
+	});
 });
 async function loadConfig() {
 	await loadSecretsFromSSM();
 	const result = ConfigSchema.safeParse({
 		llmProvider: process.env["LLM_PROVIDER"],
 		llmApiKey: process.env["LLM_API_KEY"],
-		llmModel: process.env["LLM_MODEL"],
+		llmModel: resolveLlmModel(process.env["LLM_PROVIDER"], process.env["LLM_MODEL"], process.env["BEDROCK_DEFAULT_MODEL"]),
 		notifierType: process.env["NOTIFIER_TYPE"],
 		slackBotToken: process.env["SLACK_BOT_TOKEN"],
 		slackSigningSecret: process.env["SLACK_SIGNING_SECRET"],
@@ -35755,6 +35980,8 @@ async function loadConfig() {
 		teamsWebhookUrl: process.env["TEAMS_WEBHOOK_URL"],
 		lokiUrl: process.env["LOKI_URL"],
 		redisUrl: process.env["REDIS_URL"],
+		dedupStore: process.env["DEDUP_STORE"],
+		dedupTableName: process.env["DEDUP_TABLE_NAME"],
 		sqsQueueUrl: process.env["SQS_QUEUE_URL"],
 		dedupTtlSeconds: process.env["DEDUP_TTL_SECONDS"],
 		clusterWindowMs: process.env["CLUSTER_WINDOW_MS"],
@@ -35768,11 +35995,14 @@ async function loadConfig() {
 	});
 	if (!result.success) {
 		const errorMessages = result.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`);
+		const rawLlmProvider = process.env["LLM_PROVIDER"];
+		const rawLlmApiKey = process.env["LLM_API_KEY"];
+		if (!errorMessages.some((m) => m.startsWith("llmApiKey")) && llmApiKeyRequired(rawLlmProvider, rawLlmApiKey)) errorMessages.push(`llmApiKey: [llmProvider: ${rawLlmProvider ?? "(unset)"}] LLM_API_KEY is required`);
 		throw new Error(`Invalid configuration:\n  - ${errorMessages.join("\n  - ")}`);
 	}
 	return result.data;
 }
 //#endregion
-export { ALERT_TYPE_LABELS, AlertClusterSchema, AlertStatusSchema, AlertType, AlertmanagerPayloadSchema, CIRCUIT_BREAKER, ChannelRegistry, ClaudeProvider, ClusteringService, Component, ConsoleNotifier, DEDUP_TTL_MS_MULTIPLIER, DEV_SERVER_PORT, FactoryRegistry, Fingerprint, GeminiProvider, HOUR_MS, HTTP_TIMEOUT_MS, InMemoryAlertQueue, InMemoryDeduplicationStore, InMemoryIndexer, IncidentSchema, LLMAnalysisSchema, LLMProviderType, LLM_FALLBACK_DEFAULTS, LLM_MAX_TOKENS, LLM_MODELS, LokiTraceRepository, MockLLMProvider, MockTraceRepository, NoopRollbackActionHandler, NormalizedAlertSchema, NotifyOutcome, OpenSearchIndexer, Outcome, PAYLOAD_DEFAULTS, ProcessIncidentUseCase, RATE_LIMITER, REDIS_KEY_PREFIX, ROLLBACK_ACTION_ID, RedisDeduplicationStore, RoutingNotifier, RuleActionSchema, RuleActionType, RuleConditionSchema, RuleConfigurationSchema, RuleEngine, RuleEvaluationPhase, RuleSchema, RuleSectionSchema, SLACK_API_URL, SQSAlertQueue, SamplingDecision, SeverityLevel, SlackNotifier, Stage, TEAMS_WEBHOOK_TIMEOUT_MS, TeamsNotifier, TeamsNotifierError, URGENCY_EMOJI, UrgencyLevelSchema, WEBHOOK_DEFAULTS, WideEventBuilder, compileCondition, createLLMProvider, createLogger, createNotifier, createRollbackActionHandler, dispatchActions, flushLoki, loadConfig, metrics_exports as metrics, normalizePayload, parseRuleConfig, reinitLogger, startSqsLagPoller };
+export { ALERT_TYPE_LABELS, AlertClusterSchema, AlertStatusSchema, AlertType, AlertmanagerPayloadSchema, BedrockProvider, CIRCUIT_BREAKER, ChannelRegistry, ClaudeProvider, ClusteringService, Component, ConsoleNotifier, DEDUP_TTL_MS_MULTIPLIER, DEV_SERVER_PORT, DynamoDBDeduplicationStore, FactoryRegistry, Fingerprint, GeminiProvider, HOUR_MS, HTTP_TIMEOUT_MS, InMemoryAlertQueue, InMemoryDeduplicationStore, InMemoryIndexer, IncidentSchema, LLMAnalysisSchema, LLMProviderType, LLM_FALLBACK_DEFAULTS, LLM_MAX_TOKENS, LLM_MODELS, LokiTraceRepository, MockLLMProvider, MockTraceRepository, NoopRollbackActionHandler, NormalizedAlertSchema, NotifyOutcome, OpenRouterProvider, OpenSearchIndexer, Outcome, PAYLOAD_DEFAULTS, ProcessIncidentUseCase, RATE_LIMITER, REDIS_KEY_PREFIX, ROLLBACK_ACTION_ID, RedisDeduplicationStore, RoutingNotifier, RuleActionSchema, RuleActionType, RuleConditionSchema, RuleConfigurationSchema, RuleEngine, RuleEvaluationPhase, RuleSchema, RuleSectionSchema, SLACK_API_URL, SQSAlertQueue, SamplingDecision, SeverityLevel, SlackNotifier, Stage, TEAMS_WEBHOOK_TIMEOUT_MS, TeamsNotifier, TeamsNotifierError, URGENCY_EMOJI, UrgencyLevelSchema, WEBHOOK_DEFAULTS, WideEventBuilder, compileCondition, createLLMProvider, createLogger, createNotifier, createRollbackActionHandler, dispatchActions, flushLoki, loadConfig, metrics_exports as metrics, normalizePayload, parseRuleConfig, reinitLogger, startSqsLagPoller };
 
 //# sourceMappingURL=index.js.map