@junando/core 0.6.1

package/dist/index.d.ts

@@ -0,0 +1,720 @@
+import { z } from 'zod';
+import pino from 'pino';
+import { Redis } from 'ioredis';
+import { Gauge, Counter, Histogram, Registry } from 'prom-client';
+
+declare enum AlertType {
+    Error = "http_500",
+    Warning = "latency_spike",
+    Success = "recovery"
+}
+interface AlertTypeConfig {
+    readonly alertName: string;
+    readonly severity: string;
+    readonly summary: (service: string, i: number, count: number) => string;
+}
+declare const _alertTypeConfigs: Record<AlertType, AlertTypeConfig>;
+declare const ALERT_TYPE_LABELS: Readonly<typeof _alertTypeConfigs>;
+declare enum LLMProviderType {
+    Gemini = "gemini",
+    Claude = "claude",
+    OpenRouter = "openrouter",
+    Qwen = "qwen"
+}
+declare const HTTP_TIMEOUT_MS: Readonly<{
+    Default: 5000;
+    LLM: 30000;
+}>;
+declare const CIRCUIT_BREAKER: Readonly<{
+    Timeout: 10000;
+    ErrorThresholdPercentage: 70;
+    ResetTimeoutMs: 30000;
+}>;
+declare const LLM_MAX_TOKENS = 1024;
+declare const RATE_LIMITER: Readonly<{
+    MinTimeMs: 100;
+    MaxConcurrent: 5;
+}>;
+declare const DEV_SERVER_PORT = 4000;
+declare const DEDUP_TTL_MS_MULTIPLIER = 1000;
+declare const HOUR_MS = 3600000;
+declare const LLM_FALLBACK_DEFAULTS: Readonly<{
+    TimeoutMs: 60000;
+    Models: string[];
+}>;
+declare const LLM_MODELS: Readonly<{
+    Gemini: "gemini-2.0-flash";
+    Claude: "claude-haiku-4-5";
+    OpenRouter: "qwen/qwen-2.5-72b-instruct";
+}>;
+declare const SLACK_API_URL = "https://slack.com/api/chat.postMessage";
+declare const TEAMS_WEBHOOK_TIMEOUT_MS = 10000;
+declare const _urgencyEmoji: Record<string, string>;
+declare const URGENCY_EMOJI: Readonly<typeof _urgencyEmoji>;
+declare const REDIS_KEY_PREFIX = "junando:dedup:";
+declare const WEBHOOK_DEFAULTS: Readonly<{
+    AlertmanagerUrl: "http://localhost:9093";
+    WebhookUrl: "http://localhost:4000/webhook/alert";
+}>;
+declare const PAYLOAD_DEFAULTS: Readonly<{
+    Version: "4";
+    TruncatedAlerts: 0;
+    Receiver: "junando";
+}>;
+
+declare const AlertStatusSchema: z.ZodEnum<["firing", "resolved"]>;
+declare const NormalizedAlertSchema: z.ZodObject<{
+    fingerprint: z.ZodString;
+    alertName: z.ZodString;
+    status: z.ZodEnum<["firing", "resolved"]>;
+    serviceName: z.ZodString;
+    alertType: z.ZodNativeEnum<typeof AlertType>;
+    endpointPath: z.ZodString;
+    traceId: z.ZodOptional<z.ZodString>;
+    startsAt: z.ZodString;
+    latencyMs: z.ZodOptional<z.ZodNumber>;
+    labels: z.ZodRecord<z.ZodString, z.ZodString>;
+    annotations: z.ZodRecord<z.ZodString, z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    fingerprint: string;
+    alertName: string;
+    status: "firing" | "resolved";
+    serviceName: string;
+    alertType: AlertType;
+    endpointPath: string;
+    startsAt: string;
+    labels: Record<string, string>;
+    annotations: Record<string, string>;
+    traceId?: string | undefined;
+    latencyMs?: number | undefined;
+}, {
+    fingerprint: string;
+    alertName: string;
+    status: "firing" | "resolved";
+    serviceName: string;
+    alertType: AlertType;
+    endpointPath: string;
+    startsAt: string;
+    labels: Record<string, string>;
+    annotations: Record<string, string>;
+    traceId?: string | undefined;
+    latencyMs?: number | undefined;
+}>;
+declare const AlertmanagerPayloadSchema: z.ZodObject<{
+    version: z.ZodDefault<z.ZodString>;
+    groupKey: z.ZodString;
+    truncatedAlerts: z.ZodDefault<z.ZodNumber>;
+    status: z.ZodEnum<["firing", "resolved"]>;
+    receiver: z.ZodString;
+    groupLabels: z.ZodRecord<z.ZodString, z.ZodString>;
+    commonLabels: z.ZodRecord<z.ZodString, z.ZodString>;
+    commonAnnotations: z.ZodRecord<z.ZodString, z.ZodString>;
+    externalURL: z.ZodString;
+    alerts: z.ZodArray<z.ZodObject<{
+        status: z.ZodEnum<["firing", "resolved"]>;
+        labels: z.ZodRecord<z.ZodString, z.ZodString>;
+        annotations: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+        startsAt: z.ZodString;
+        endsAt: z.ZodString;
+        fingerprint: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        status: "firing" | "resolved";
+        startsAt: string;
+        labels: Record<string, string>;
+        annotations: Record<string, string>;
+        endsAt: string;
+        fingerprint?: string | undefined;
+    }, {
+        status: "firing" | "resolved";
+        startsAt: string;
+        labels: Record<string, string>;
+        endsAt: string;
+        fingerprint?: string | undefined;
+        annotations?: Record<string, string> | undefined;
+    }>, "many">;
+}, "strip", z.ZodTypeAny, {
+    status: "firing" | "resolved";
+    version: string;
+    groupKey: string;
+    truncatedAlerts: number;
+    receiver: string;
+    groupLabels: Record<string, string>;
+    commonLabels: Record<string, string>;
+    commonAnnotations: Record<string, string>;
+    externalURL: string;
+    alerts: {
+        status: "firing" | "resolved";
+        startsAt: string;
+        labels: Record<string, string>;
+        annotations: Record<string, string>;
+        endsAt: string;
+        fingerprint?: string | undefined;
+    }[];
+}, {
+    status: "firing" | "resolved";
+    groupKey: string;
+    receiver: string;
+    groupLabels: Record<string, string>;
+    commonLabels: Record<string, string>;
+    commonAnnotations: Record<string, string>;
+    externalURL: string;
+    alerts: {
+        status: "firing" | "resolved";
+        startsAt: string;
+        labels: Record<string, string>;
+        endsAt: string;
+        fingerprint?: string | undefined;
+        annotations?: Record<string, string> | undefined;
+    }[];
+    version?: string | undefined;
+    truncatedAlerts?: number | undefined;
+}>;
+type AlertStatus = z.infer<typeof AlertStatusSchema>;
+type NormalizedAlert = z.infer<typeof NormalizedAlertSchema>;
+type AlertmanagerPayload = z.infer<typeof AlertmanagerPayloadSchema>;
+type AlertErrorType = NormalizedAlert['alertType'];
+
+declare const AlertClusterSchema: z.ZodObject<{
+    fingerprint: z.ZodString;
+    serviceName: z.ZodString;
+    alertType: z.ZodNativeEnum<typeof AlertType>;
+    endpointPath: z.ZodString;
+    alertCount: z.ZodNumber;
+    representativeTraceIds: z.ZodArray<z.ZodString, "many">;
+    firstSeenAt: z.ZodString;
+    latencyP99Ms: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    fingerprint: string;
+    serviceName: string;
+    alertType: AlertType;
+    endpointPath: string;
+    alertCount: number;
+    representativeTraceIds: string[];
+    firstSeenAt: string;
+    latencyP99Ms?: number | undefined;
+}, {
+    fingerprint: string;
+    serviceName: string;
+    alertType: AlertType;
+    endpointPath: string;
+    alertCount: number;
+    representativeTraceIds: string[];
+    firstSeenAt: string;
+    latencyP99Ms?: number | undefined;
+}>;
+type AlertCluster = z.infer<typeof AlertClusterSchema>;
+
+declare const UrgencyLevelSchema: z.ZodEnum<["low", "medium", "high", "critical"]>;
+declare const LLMAnalysisSchema: z.ZodObject<{
+    probable_cause: z.ZodString;
+    impacted_services: z.ZodArray<z.ZodString, "many">;
+    recommended_steps: z.ZodArray<z.ZodString, "many">;
+    urgency_level: z.ZodEnum<["low", "medium", "high", "critical"]>;
+    requires_rollback: z.ZodBoolean;
+}, "strip", z.ZodTypeAny, {
+    probable_cause: string;
+    impacted_services: string[];
+    recommended_steps: string[];
+    urgency_level: "critical" | "high" | "medium" | "low";
+    requires_rollback: boolean;
+}, {
+    probable_cause: string;
+    impacted_services: string[];
+    recommended_steps: string[];
+    urgency_level: "critical" | "high" | "medium" | "low";
+    requires_rollback: boolean;
+}>;
+declare const IncidentSchema: z.ZodObject<{
+    cluster: z.ZodObject<{
+        fingerprint: z.ZodString;
+        serviceName: z.ZodString;
+        alertType: z.ZodNativeEnum<typeof AlertType>;
+        endpointPath: z.ZodString;
+        alertCount: z.ZodNumber;
+        representativeTraceIds: z.ZodArray<z.ZodString, "many">;
+        firstSeenAt: z.ZodString;
+        latencyP99Ms: z.ZodOptional<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        fingerprint: string;
+        serviceName: string;
+        alertType: AlertType;
+        endpointPath: string;
+        alertCount: number;
+        representativeTraceIds: string[];
+        firstSeenAt: string;
+        latencyP99Ms?: number | undefined;
+    }, {
+        fingerprint: string;
+        serviceName: string;
+        alertType: AlertType;
+        endpointPath: string;
+        alertCount: number;
+        representativeTraceIds: string[];
+        firstSeenAt: string;
+        latencyP99Ms?: number | undefined;
+    }>;
+    traces: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">>;
+    analysis: z.ZodOptional<z.ZodObject<{
+        probable_cause: z.ZodString;
+        impacted_services: z.ZodArray<z.ZodString, "many">;
+        recommended_steps: z.ZodArray<z.ZodString, "many">;
+        urgency_level: z.ZodEnum<["low", "medium", "high", "critical"]>;
+        requires_rollback: z.ZodBoolean;
+    }, "strip", z.ZodTypeAny, {
+        probable_cause: string;
+        impacted_services: string[];
+        recommended_steps: string[];
+        urgency_level: "critical" | "high" | "medium" | "low";
+        requires_rollback: boolean;
+    }, {
+        probable_cause: string;
+        impacted_services: string[];
+        recommended_steps: string[];
+        urgency_level: "critical" | "high" | "medium" | "low";
+        requires_rollback: boolean;
+    }>>;
+    processedAt: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    cluster: {
+        fingerprint: string;
+        serviceName: string;
+        alertType: AlertType;
+        endpointPath: string;
+        alertCount: number;
+        representativeTraceIds: string[];
+        firstSeenAt: string;
+        latencyP99Ms?: number | undefined;
+    };
+    processedAt: string;
+    traces?: Record<string, unknown>[] | undefined;
+    analysis?: {
+        probable_cause: string;
+        impacted_services: string[];
+        recommended_steps: string[];
+        urgency_level: "critical" | "high" | "medium" | "low";
+        requires_rollback: boolean;
+    } | undefined;
+}, {
+    cluster: {
+        fingerprint: string;
+        serviceName: string;
+        alertType: AlertType;
+        endpointPath: string;
+        alertCount: number;
+        representativeTraceIds: string[];
+        firstSeenAt: string;
+        latencyP99Ms?: number | undefined;
+    };
+    processedAt: string;
+    traces?: Record<string, unknown>[] | undefined;
+    analysis?: {
+        probable_cause: string;
+        impacted_services: string[];
+        recommended_steps: string[];
+        urgency_level: "critical" | "high" | "medium" | "low";
+        requires_rollback: boolean;
+    } | undefined;
+}>;
+type UrgencyLevel = z.infer<typeof UrgencyLevelSchema>;
+type LLMAnalysis = z.infer<typeof LLMAnalysisSchema>;
+type Incident = z.infer<typeof IncidentSchema>;
+
+interface TraceabilityDocument {
+    '@timestamp': string;
+    uploadId?: string;
+    channel: string;
+    application: string;
+    messageType: string;
+    message: string;
+    originFlow?: string;
+    refId?: string;
+    fingerprint: string;
+    correlationId: string;
+}
+
+declare class Fingerprint {
+    readonly value: string;
+    private constructor();
+    static fromAlert(alert: NormalizedAlert): Fingerprint;
+    equals(other: Fingerprint): boolean;
+    toString(): string;
+}
+
+/**
+ * Deduplication store.
+ * Determines whether an alert fingerprint is new within a rolling TTL window.
+ * Implementations: RedisDeduplicationStore, InMemoryDeduplicationStore (tests)
+ */
+interface IDeduplicationStore {
+    isNew(fingerprint: string, ttlSeconds: number): Promise<boolean>;
+    reset(fingerprint: string): Promise<void>;
+}
+/**
+ * Alert queue.
+ * Publishes normalized alerts for async processing.
+ * Implementations: SQSAlertQueue, BullMQAlertQueue, InMemoryAlertQueue (tests)
+ */
+interface IAlertQueue {
+    publish(alert: NormalizedAlert): Promise<void>;
+}
+/**
+ * Trace repository.
+ * Fetches distributed trace context by trace ID.
+ * Implementations: LokiTraceRepository, DatadogTraceRepository, MockTraceRepository (tests)
+ */
+interface ITraceRepository {
+    findByTraceId(traceId: string): Promise<Record<string, unknown>[]>;
+}
+/**
+ * LLM provider.
+ * Analyzes an incident cluster and returns a structured diagnosis.
+ * Implementations: GeminiProvider, ClaudeProvider, OpenAIProvider, MockLLMProvider (tests)
+ */
+interface ILLMProvider {
+    analyze(cluster: AlertCluster, traces: Record<string, unknown>[]): Promise<LLMAnalysis>;
+}
+/**
+ * Notifier.
+ * Delivers incident diagnoses to a ChatOps channel.
+ * Implementations: SlackNotifier, TeamsNotifier, ConsoleNotifier (local dev/tests)
+ */
+interface INotifier {
+    send(cluster: AlertCluster, analysis: LLMAnalysis | null): Promise<void>;
+}
+/**
+ * Indexer.
+ * Persists a typed document into a searchable index/store.
+ * Implementations: OpenSearchIndexer, InMemoryIndexer (tests)
+ */
+interface IIndexer<TDocument> {
+    index(doc: TDocument): Promise<void>;
+}
+
+declare class ClusteringService {
+    /**
+     * Groups alerts by fingerprint and builds AlertCluster objects.
+     * 300 alerts with the same root cause → 1 cluster with 2 representative traces.
+     */
+    buildClusters(alerts: NormalizedAlert[]): AlertCluster[];
+    private buildCluster;
+    private sampleTraceIds;
+}
+
+declare function normalizePayload(payload: AlertmanagerPayload): NormalizedAlert[];
+
+type Logger = pino.Logger;
+interface LoggerOptions {
+    level?: string;
+    name?: string;
+}
+/**
+ * Returns a Proxy logger that always delegates to the current root logger.
+ * Module-level callers get a proxy that automatically starts writing to Loki
+ * once reinitLogger() is called inside the handler after loadConfig().
+ */
+declare function createLogger(levelOrOptions?: string | LoggerOptions): Logger;
+/**
+ * Re-creates the root logger with current env vars (including LOKI_URL).
+ * Call this inside your Lambda handler immediately after loadConfig():
+ *
+ * @example
+ * const config = await loadConfig();
+ * reinitLogger(); // all module-level proxy loggers now write to Loki
+ */
+declare function reinitLogger(opts?: LoggerOptions): void;
+
+interface Dependencies {
+    dedup: IDeduplicationStore;
+    traces: ITraceRepository;
+    llm: ILLMProvider;
+    notifier: INotifier;
+    logger: Logger;
+    dedupTtlSeconds: number;
+    clustering?: ClusteringService;
+    onClustersBuilt?: (count: number) => void;
+}
+declare class ProcessIncidentUseCase {
+    private readonly deps;
+    private readonly clustering;
+    constructor(deps: Dependencies);
+    execute(alerts: NormalizedAlert[], correlationId: string): Promise<void>;
+}
+
+declare class RedisDeduplicationStore implements IDeduplicationStore {
+    private readonly redis;
+    private readonly keyPrefix;
+    constructor(redis: Redis);
+    isNew(fingerprint: string, ttlSeconds: number): Promise<boolean>;
+    reset(fingerprint: string): Promise<void>;
+}
+declare class InMemoryDeduplicationStore implements IDeduplicationStore {
+    private readonly store;
+    isNew(fingerprint: string, ttlSeconds: number): Promise<boolean>;
+    reset(fingerprint: string): Promise<void>;
+    clear(): void;
+}
+
+interface SignedHttpRequest {
+    method: string;
+    url: string;
+    headers: Record<string, string>;
+    body: string;
+}
+interface OpenSearchHttpResponse {
+    status: number;
+    body: string;
+}
+type OpenSearchHttpFetcher = (request: SignedHttpRequest) => Promise<OpenSearchHttpResponse>;
+interface OpenSearchIndexerDeps {
+    endpoint: string;
+    indexName: string;
+    region: string;
+    fetcher: OpenSearchHttpFetcher;
+}
+declare class OpenSearchIndexer implements IIndexer<TraceabilityDocument> {
+    private readonly endpoint;
+    private readonly indexName;
+    private readonly region;
+    private readonly fetcher;
+    constructor(deps: OpenSearchIndexerDeps);
+    index(doc: TraceabilityDocument): Promise<void>;
+}
+declare class InMemoryIndexer implements IIndexer<TraceabilityDocument> {
+    readonly indexed: TraceabilityDocument[];
+    index(doc: TraceabilityDocument): Promise<void>;
+}
+
+/**
+ * Gemini LLM provider using Google Generative AI SDK.
+ * Wrapped with circuit breaker for resilience.
+ */
+declare class GeminiProvider implements ILLMProvider {
+    private readonly apiKey;
+    private readonly model;
+    private readonly breaker;
+    constructor(apiKey: string, model?: string);
+    analyze(cluster: AlertCluster, traces: Record<string, unknown>[]): Promise<LLMAnalysis>;
+    private analyzeRaw;
+}
+/**
+ * Claude LLM provider using Anthropic SDK.
+ * Supports Claude Haiku and other models.
+ */
+declare class ClaudeProvider implements ILLMProvider {
+    private readonly apiKey;
+    private readonly model;
+    constructor(apiKey: string, model?: string);
+    analyze(cluster: AlertCluster, traces: Record<string, unknown>[]): Promise<LLMAnalysis>;
+}
+/**
+ * Mock LLM provider for testing and local development.
+ * Returns deterministic responses without external API calls.
+ */
+declare class MockLLMProvider implements ILLMProvider {
+    readonly callLog: Array<{
+        cluster: AlertCluster;
+    }>;
+    analyze(cluster: AlertCluster, _traces: Record<string, unknown>[]): Promise<LLMAnalysis>;
+}
+/**
+ * Options for configuring the OpenRouter fallback chain.
+ * Infra-internal — not exported.
+ */
+interface FallbackOptions {
+    fallbackModels?: string[];
+    fallbackTimeoutMs?: number;
+}
+declare function createLLMProvider(provider: string, apiKey: string, model?: string, options?: FallbackOptions): ILLMProvider;
+
+declare const ConfigSchema: z.ZodEffects<z.ZodObject<{
+    llmProvider: z.ZodEnum<["gemini", "claude", "openrouter", "qwen"]>;
+    llmApiKey: z.ZodString;
+    llmModel: z.ZodEffects<z.ZodOptional<z.ZodString>, string | undefined, string | undefined>;
+    notifierType: z.ZodDefault<z.ZodEnum<["slack", "teams"]>>;
+    slackBotToken: z.ZodOptional<z.ZodString>;
+    slackSigningSecret: z.ZodOptional<z.ZodString>;
+    slackChannel: z.ZodOptional<z.ZodString>;
+    teamsWebhookUrl: z.ZodOptional<z.ZodString>;
+    lokiUrl: z.ZodEffects<z.ZodOptional<z.ZodString>, string | undefined, string | undefined>;
+    redisUrl: z.ZodString;
+    sqsQueueUrl: z.ZodUnion<[z.ZodOptional<z.ZodString>, z.ZodLiteral<"">]>;
+    dedupTtlSeconds: z.ZodDefault<z.ZodNumber>;
+    clusterWindowMs: z.ZodDefault<z.ZodNumber>;
+    logLevel: z.ZodDefault<z.ZodEnum<["trace", "debug", "info", "warn", "error"]>>;
+    nodeEnv: z.ZodDefault<z.ZodEnum<["development", "test", "production"]>>;
+    llmFallbackModels: z.ZodEffects<z.ZodOptional<z.ZodString>, string[], string | undefined>;
+    llmFallbackTimeoutMs: z.ZodDefault<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    dedupTtlSeconds: number;
+    llmProvider: "gemini" | "claude" | "openrouter" | "qwen";
+    llmApiKey: string;
+    notifierType: "slack" | "teams";
+    redisUrl: string;
+    clusterWindowMs: number;
+    logLevel: "info" | "error" | "warn" | "debug" | "trace";
+    nodeEnv: "production" | "development" | "test";
+    llmFallbackModels: string[];
+    llmFallbackTimeoutMs: number;
+    llmModel?: string | undefined;
+    slackBotToken?: string | undefined;
+    slackSigningSecret?: string | undefined;
+    slackChannel?: string | undefined;
+    teamsWebhookUrl?: string | undefined;
+    lokiUrl?: string | undefined;
+    sqsQueueUrl?: string | undefined;
+}, {
+    llmProvider: "gemini" | "claude" | "openrouter" | "qwen";
+    llmApiKey: string;
+    redisUrl: string;
+    dedupTtlSeconds?: number | undefined;
+    llmModel?: string | undefined;
+    notifierType?: "slack" | "teams" | undefined;
+    slackBotToken?: string | undefined;
+    slackSigningSecret?: string | undefined;
+    slackChannel?: string | undefined;
+    teamsWebhookUrl?: string | undefined;
+    lokiUrl?: string | undefined;
+    sqsQueueUrl?: string | undefined;
+    clusterWindowMs?: number | undefined;
+    logLevel?: "info" | "error" | "warn" | "debug" | "trace" | undefined;
+    nodeEnv?: "production" | "development" | "test" | undefined;
+    llmFallbackModels?: string | undefined;
+    llmFallbackTimeoutMs?: number | undefined;
+}>, {
+    dedupTtlSeconds: number;
+    llmProvider: "gemini" | "claude" | "openrouter" | "qwen";
+    llmApiKey: string;
+    notifierType: "slack" | "teams";
+    redisUrl: string;
+    clusterWindowMs: number;
+    logLevel: "info" | "error" | "warn" | "debug" | "trace";
+    nodeEnv: "production" | "development" | "test";
+    llmFallbackModels: string[];
+    llmFallbackTimeoutMs: number;
+    llmModel?: string | undefined;
+    slackBotToken?: string | undefined;
+    slackSigningSecret?: string | undefined;
+    slackChannel?: string | undefined;
+    teamsWebhookUrl?: string | undefined;
+    lokiUrl?: string | undefined;
+    sqsQueueUrl?: string | undefined;
+}, {
+    llmProvider: "gemini" | "claude" | "openrouter" | "qwen";
+    llmApiKey: string;
+    redisUrl: string;
+    dedupTtlSeconds?: number | undefined;
+    llmModel?: string | undefined;
+    notifierType?: "slack" | "teams" | undefined;
+    slackBotToken?: string | undefined;
+    slackSigningSecret?: string | undefined;
+    slackChannel?: string | undefined;
+    teamsWebhookUrl?: string | undefined;
+    lokiUrl?: string | undefined;
+    sqsQueueUrl?: string | undefined;
+    clusterWindowMs?: number | undefined;
+    logLevel?: "info" | "error" | "warn" | "debug" | "trace" | undefined;
+    nodeEnv?: "production" | "development" | "test" | undefined;
+    llmFallbackModels?: string | undefined;
+    llmFallbackTimeoutMs?: number | undefined;
+}>;
+type Config = z.infer<typeof ConfigSchema>;
+declare function loadConfig(): Promise<Config>;
+
+declare function createNotifier(config: Config): INotifier;
+
+declare class SlackNotifier implements INotifier {
+    private readonly botToken;
+    private readonly channel;
+    constructor(botToken: string, channel: string);
+    send(cluster: AlertCluster, analysis: LLMAnalysis | null): Promise<void>;
+    private buildAnalysisMessage;
+    private buildFallbackMessage;
+}
+declare class ConsoleNotifier implements INotifier {
+    readonly sent: Array<{
+        cluster: AlertCluster;
+        analysis: LLMAnalysis | null;
+    }>;
+    send(cluster: AlertCluster, analysis: LLMAnalysis | null): Promise<void>;
+}
+
+declare class TeamsNotifierError extends Error {
+    constructor(message: string);
+}
+declare class TeamsNotifier implements INotifier {
+    private readonly webhookUrl;
+    private readonly timeoutMs;
+    private readonly hostForErrors;
+    constructor(webhookUrl: string, timeoutMs?: number);
+    send(cluster: AlertCluster, analysis: LLMAnalysis | null): Promise<void>;
+}
+
+interface SendMessageParams {
+    messageBody: string;
+    messageGroupId: string;
+    messageDeduplicationId: string;
+}
+declare class SQSAlertQueue implements IAlertQueue {
+    private readonly queueUrl;
+    private readonly region?;
+    private sqsClient;
+    constructor(queueUrl: string, region?: string | undefined);
+    private getClient;
+    sendMessage(params: SendMessageParams): Promise<void>;
+    publish(alert: NormalizedAlert): Promise<void>;
+}
+declare class InMemoryAlertQueue implements IAlertQueue {
+    readonly published: NormalizedAlert[];
+    publish(alert: NormalizedAlert): Promise<void>;
+}
+
+declare class LokiTraceRepository implements ITraceRepository {
+    private readonly lokiUrl;
+    private readonly apiKey?;
+    constructor(lokiUrl: string, apiKey?: string | undefined);
+    findByTraceId(traceId: string): Promise<Record<string, unknown>[]>;
+    private parseResponse;
+    private tryParseJSON;
+}
+declare class MockTraceRepository implements ITraceRepository {
+    private readonly fixtures;
+    constructor(fixtures?: Map<string, Record<string, unknown>[]>);
+    findByTraceId(traceId: string): Promise<Record<string, unknown>[]>;
+    addFixture(traceId: string, spans: Record<string, unknown>[]): void;
+}
+
+/**
+ * Flush all buffered log entries to Loki in a single HTTP request.
+ * Call this at the END of the Lambda handler, after all business logic completes.
+ * Errors are swallowed — Loki is best-effort; CloudWatch is the primary sink.
+ */
+declare function flushLoki(): Promise<void>;
+
+declare const registry: Registry<"text/plain; version=0.0.4; charset=utf-8">;
+declare const alertsReceived: Counter<"status">;
+declare const webhookRequestsTotal: Counter<"status" | "endpoint">;
+declare const alertsProcessed: Counter<string>;
+declare const alertClusters: Gauge<string>;
+declare const latency: Histogram<string>;
+declare const llmInferenceDuration: Histogram<"model">;
+declare const llmInferenceTotal: Counter<"status">;
+/** Tracks inline pipeline failures in local dev mode. */
+declare const pipelineInlineFailuresTotal: Counter<"reason">;
+/** Tracks Redis dedup fallback activations. */
+declare const dedupRedisFailoverTotal: Counter<string>;
+
+declare const index_alertClusters: typeof alertClusters;
+declare const index_alertsProcessed: typeof alertsProcessed;
+declare const index_alertsReceived: typeof alertsReceived;
+declare const index_dedupRedisFailoverTotal: typeof dedupRedisFailoverTotal;
+declare const index_latency: typeof latency;
+declare const index_llmInferenceDuration: typeof llmInferenceDuration;
+declare const index_llmInferenceTotal: typeof llmInferenceTotal;
+declare const index_pipelineInlineFailuresTotal: typeof pipelineInlineFailuresTotal;
+declare const index_registry: typeof registry;
+declare const index_webhookRequestsTotal: typeof webhookRequestsTotal;
+declare namespace index {
+  export { index_alertClusters as alertClusters, index_alertsProcessed as alertsProcessed, index_alertsReceived as alertsReceived, index_dedupRedisFailoverTotal as dedupRedisFailoverTotal, index_latency as latency, index_llmInferenceDuration as llmInferenceDuration, index_llmInferenceTotal as llmInferenceTotal, index_pipelineInlineFailuresTotal as pipelineInlineFailuresTotal, index_registry as registry, index_webhookRequestsTotal as webhookRequestsTotal };
+}
+
+export { ALERT_TYPE_LABELS, type AlertCluster, AlertClusterSchema, type AlertErrorType, type AlertStatus, AlertStatusSchema, AlertType, type AlertmanagerPayload, AlertmanagerPayloadSchema, CIRCUIT_BREAKER, ClaudeProvider, ClusteringService, type Config, ConsoleNotifier, DEDUP_TTL_MS_MULTIPLIER, DEV_SERVER_PORT, Fingerprint, GeminiProvider, HOUR_MS, HTTP_TIMEOUT_MS, type IAlertQueue, type IDeduplicationStore, type IIndexer, type ILLMProvider, type INotifier, type ITraceRepository, InMemoryAlertQueue, InMemoryDeduplicationStore, InMemoryIndexer, type Incident, IncidentSchema, type LLMAnalysis, LLMAnalysisSchema, LLMProviderType, LLM_FALLBACK_DEFAULTS, LLM_MAX_TOKENS, LLM_MODELS, type Logger, type LoggerOptions, LokiTraceRepository, MockLLMProvider, MockTraceRepository, type NormalizedAlert, NormalizedAlertSchema, type OpenSearchHttpFetcher, type OpenSearchHttpResponse, OpenSearchIndexer, type OpenSearchIndexerDeps, PAYLOAD_DEFAULTS, ProcessIncidentUseCase, RATE_LIMITER, REDIS_KEY_PREFIX, RedisDeduplicationStore, SLACK_API_URL, SQSAlertQueue, type SignedHttpRequest, SlackNotifier, TEAMS_WEBHOOK_TIMEOUT_MS, TeamsNotifier, TeamsNotifierError, type TraceabilityDocument, URGENCY_EMOJI, type UrgencyLevel, UrgencyLevelSchema, WEBHOOK_DEFAULTS, createLLMProvider, createLogger, createNotifier, flushLoki, loadConfig, index as metrics, normalizePayload, reinitLogger };