@meyicloud/meyi-insight-server 1.0.0

package/dist/pipeline/defaults/ensureDefaults.js

@@ -0,0 +1,124 @@
+import { eq, and } from "drizzle-orm";
+import { PipelineDefaults } from "./pipelineDefaults.js";
+import { parseGroupingYaml, parseDedupYaml, parseNormalizationYaml } from "../yaml/pipelineYaml.js";
+import { insightGroupingConfigs, insightDedupConfigs, insightNormalizationConfigs, insightWorkflows } from "../../database/schema.js";
+export async function ensureSourcePipelineDefaults(db, sourceId, sourceType, tenantId) {
+    if (!sourceId || !sourceType)
+        return;
+    const configs = PipelineDefaults[sourceType];
+    if (!configs)
+        return;
+    try {
+        // 1. Check Grouping
+        if (configs.grouping) {
+            const existingGrouping = await db.select({ id: insightGroupingConfigs.id })
+                .from(insightGroupingConfigs)
+                .where(and(eq(insightGroupingConfigs.sourceId, sourceId), eq(insightGroupingConfigs.isSystem, true)))
+                .limit(1);
+            if (existingGrouping.length === 0) {
+                const parsed = parseGroupingYaml(configs.grouping.yamlDefinition);
+                if (parsed.ok) {
+                    await db.insert(insightGroupingConfigs).values({
+                        name: parsed.data.name || `${sourceType} Default Grouping`,
+                        priority: parsed.data.priority || 10,
+                        isActive: true,
+                        sourceId,
+                        sourceType,
+                        groupBy: parsed.data.default_key || ["resourceId"],
+                        timeoutSeconds: parsed.data.window_seconds || 600,
+                        maxAlarms: parsed.data.max_alarms || 50,
+                        yamlDefinition: configs.grouping.yamlDefinition,
+                        isSystem: true,
+                        tenantId
+                    });
+                }
+            }
+        }
+        // 2. Check Dedup
+        if (configs.dedup) {
+            const existingDedup = await db.select({ id: insightDedupConfigs.id })
+                .from(insightDedupConfigs)
+                .where(and(eq(insightDedupConfigs.sourceId, sourceId), eq(insightDedupConfigs.isSystem, true)))
+                .limit(1);
+            if (existingDedup.length === 0) {
+                const parsed = parseDedupYaml(configs.dedup.yamlDefinition);
+                if (parsed.ok) {
+                    await db.insert(insightDedupConfigs).values({
+                        name: parsed.data.name || `${sourceType} Default Dedup`,
+                        priority: parsed.data.priority || 10,
+                        isActive: true,
+                        sourceId,
+                        sourceType,
+                        windowSeconds: parsed.data.window_seconds || 300,
+                        keyFields: parsed.data.fingerprint?.fields || [],
+                        flapThreshold: 4,
+                        flapWindowSeconds: 600,
+                        onFlap: "none",
+                        yamlDefinition: configs.dedup.yamlDefinition,
+                        isSystem: true,
+                        tenantId
+                    });
+                }
+            }
+        }
+        // 3. Check Normalization
+        if (configs.normalization) {
+            const existingNorm = await db.select({ id: insightNormalizationConfigs.id })
+                .from(insightNormalizationConfigs)
+                .where(and(eq(insightNormalizationConfigs.sourceId, sourceId), eq(insightNormalizationConfigs.isSystem, true)))
+                .limit(1);
+            if (existingNorm.length === 0) {
+                const parsed = parseNormalizationYaml(configs.normalization.yamlDefinition);
+                if (parsed.ok) {
+                    await db.insert(insightNormalizationConfigs).values({
+                        name: parsed.data.name || `${sourceType} Default Normalization`,
+                        priority: parsed.data.priority || 10,
+                        isActive: true,
+                        sourceId,
+                        sourceType,
+                        fieldMapping: configs.normalization.fieldMapping,
+                        yamlDefinition: configs.normalization.yamlDefinition,
+                        isSystem: true,
+                        tenantId
+                    });
+                }
+            }
+        }
+        // 4. Check Workflows
+        const existingWorkflow = await db.select({ id: insightWorkflows.id })
+            .from(insightWorkflows)
+            .where(eq(insightWorkflows.sourceId, sourceId))
+            .limit(1);
+        if (existingWorkflow.length === 0) {
+            await db.insert(insightWorkflows).values({
+                name: `${sourceType} Default Workflow`,
+                priority: 10,
+                isActive: true,
+                sourceId,
+                yamlDefinition: `name: ${sourceType} Default Workflow
+version: 1
+enabled: true
+active: true
+
+triggers:
+  severity:
+    - critical
+    - high
+
+actions:
+  - type: create_incident
+    config:
+      priority: P1
+`,
+                tenantId
+            });
+        }
+    }
+    catch (err) {
+        console.error("Failed to ensure source pipeline defaults:", err);
+    }
+}
+export async function ensureTenantPipelineDefaults(db, tenantId) {
+    // Legacy method: do nothing for global tenant defaults now that we are per-source.
+}
+//# sourceMappingURL=ensureDefaults.js.map

package/dist/pipeline/defaults/ensureDefaults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensureDefaults.js","sourceRoot":"","sources":["../../../src/pipeline/defaults/ensureDefaults.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACpG,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEtI,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,EAAO,EAAE,QAAgB,EAAE,UAAkB,EAAE,QAAuB;IACvH,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU;QAAE,OAAO;IAErC,MAAM,OAAO,GAAG,gBAAgB,CAAC,UAA2C,CAAC,CAAC;IAC9E,IAAI,CAAC,OAAO;QAAE,OAAO;IAErB,IAAI,CAAC;QACH,oBAAoB;QACpB,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,gBAAgB,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,sBAAsB,CAAC,EAAE,EAAE,CAAC;iBACxE,IAAI,CAAC,sBAAsB,CAAC;iBAC5B,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,sBAAsB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;iBACpG,KAAK,CAAC,CAAC,CAAC,CAAC;YAEZ,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAClC,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;gBAClE,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;oBACd,MAAM,EAAE,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAAC;wBAC7C,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,UAAU,mBAAmB;wBAC1D,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE;wBACpC,QAAQ,EAAE,IAAI;wBACd,QAAQ;wBACR,UAAU;wBACV,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,YAAY,CAAC;wBAClD,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,IAAI,GAAG;wBACjD,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE;wBACvC,cAAc,EAAE,OAAO,CAAC,QAAQ,CAAC,cAAc;wBAC/C,QAAQ,EAAE,IAAI;wBACd,QAAQ;qBACT,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,iBAAiB;QACjB,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,aAAa,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,mBAAmB,CAAC,EAAE,EAAE,CAAC;iBAClE,IAAI,CAAC,mBAAmB,CAAC;iBACzB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;iBAC9F,KAAK,CAAC,CAAC,CAAC,CAAC;YAEZ,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/B,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;gBAC5D,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;oBACd,MAAM,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC;wBAC1C,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,UAAU,gBAAgB;wBACvD,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE;wBACpC,QAAQ,EAAE,IAAI;wBACd,QAAQ;wBACR,UAAU;wBACV,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,IAAI,GAAG;wBAChD,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,IAAI,EAAE;wBAChD,aAAa,EAAE,CAAC;wBAChB,iBAAiB,EAAE,GAAG;wBACtB,MAAM,EAAE,MAAM;wBACd,cAAc,EAAE,OAAO,CAAC,KAAK,CAAC,cAAc;wBAC5C,QAAQ,EAAE,IAAI;wBACd,QAAQ;qBACT,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,yBAAyB;QACzB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YAC1B,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,2BAA2B,CAAC,EAAE,EAAE,CAAC;iBACzE,IAAI,CAAC,2BAA2B,CAAC;iBACjC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,2BAA2B,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,2BAA2B,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;iBAC9G,KAAK,CAAC,CAAC,CAAC,CAAC;YAEZ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9B,MAAM,MAAM,GAAG,sBAAsB,CAAC,OAAO,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;gBAC5E,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;oBACd,MAAM,EAAE,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC,MAAM,CAAC;wBAClD,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,UAAU,wBAAwB;wBAC/D,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE;wBACpC,QAAQ,EAAE,IAAI;wBACd,QAAQ;wBACR,UAAU;wBACV,YAAY,EAAE,OAAO,CAAC,aAAa,CAAC,YAAY;wBAChD,cAAc,EAAE,OAAO,CAAC,aAAa,CAAC,cAAc;wBACpD,QAAQ,EAAE,IAAI;wBACd,QAAQ;qBACT,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,qBAAqB;QACrB,MAAM,gBAAgB,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,gBAAgB,CAAC,EAAE,EAAE,CAAC;aAClE,IAAI,CAAC,gBAAgB,CAAC;aACtB,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;aAC9C,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClC,MAAM,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC;gBACvC,IAAI,EAAE,GAAG,UAAU,mBAAmB;gBACtC,QAAQ,EAAE,EAAE;gBACZ,QAAQ,EAAE,IAAI;gBACd,QAAQ;gBACR,cAAc,EAAE,SAAS,UAAU;;;;;;;;;;;;;;CAc1C;gBACO,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,4CAA4C,EAAE,GAAG,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,EAAO,EAAE,QAAgB;IAC1E,mFAAmF;AACrF,CAAC"}

package/dist/pipeline/defaults/pipelineDefaults.d.ts

@@ -0,0 +1,13 @@
+export declare const PipelineDefaults: Record<string, {
+    normalization?: {
+        fieldMapping: string;
+        yamlDefinition: string;
+    };
+    dedup?: {
+        yamlDefinition: string;
+    };
+    grouping?: {
+        yamlDefinition: string;
+    };
+}>;
+//# sourceMappingURL=pipelineDefaults.d.ts.map

package/dist/pipeline/defaults/pipelineDefaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipelineDefaults.d.ts","sourceRoot":"","sources":["../../../src/pipeline/defaults/pipelineDefaults.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE;IAC5C,aAAa,CAAC,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,KAAK,CAAC,EAAE;QAAE,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IACnC,QAAQ,CAAC,EAAE;QAAE,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;CACvC,CAwQA,CAAC"}

package/dist/pipeline/defaults/pipelineDefaults.js

@@ -0,0 +1,266 @@
+export const PipelineDefaults = {
+    cloudtrail: {
+        normalization: {
+            fieldMapping: `
+resourceId: >-
+  {{#if detail.responseElements.instancesSet.items.[0].instanceId}}
+    {{detail.responseElements.instancesSet.items.[0].instanceId}}
+  {{else if detail.requestParameters.instanceId}}
+    {{detail.requestParameters.instanceId}}
+  {{else}}
+    {{detail.eventSource}}/{{detail.eventName}}
+  {{/if}}
+resourceName: >-
+  {{#if detail.responseElements.instancesSet.items.[0].instanceId}}
+    {{detail.responseElements.instancesSet.items.[0].instanceId}}
+  {{else if detail.requestParameters.instanceId}}
+    {{detail.requestParameters.instanceId}}
+  {{else}}
+    {{detail.eventName}}
+  {{/if}}
+resourceType: "{{detail.eventSource}}"
+alertName: "{{detail.eventName}} ({{detail.eventSource}})"
+description: "{{detail.eventName}} by {{default detail.userIdentity.arn detail.userIdentity.type}} from {{detail.sourceIPAddress}}"
+eventTime: "{{default detail.eventTime time}}"
+accountId: "{{default detail.recipientAccountId account}}"
+region: "{{default detail.awsRegion region}}"
+action: "{{detail.eventName}}"
+actorType: "{{detail.userIdentity.type}}"
+actorPrincipalId: "{{detail.userIdentity.principalId}}"
+actorArn: "{{detail.userIdentity.arn}}"
+actorUsername: "{{detail.userIdentity.userName}}"
+actorAccessKeyId: "{{detail.userIdentity.accessKeyId}}"
+sourceIp: "{{detail.sourceIPAddress}}"
+userAgent: "{{detail.userAgent}}"
+errorCode: "{{detail.errorCode}}"
+outcome: "{{#if detail.errorCode}}failure{{else}}success{{/if}}"
+consoleLoginResult: "{{detail.responseElements.ConsoleLogin}}"
+mfaUsed: "{{detail.additionalEventData.MFAUsed}}"
+      `.trim(),
+            yamlDefinition: `
+name: "CloudTrail Default Normalization"
+priority: 10
+is_active: true
+source_type: "cloudtrail"
+category_rules:
+  - match: { action_in: [StopLogging, DeleteTrail, UpdateTrail, PutEventSelectors, DeleteEventDataStore, CreateTrail, DeleteDetector, UpdateDetector, StopConfigurationRecorder, DeleteConfigurationRecorder, DeleteDeliveryChannel, DisableSecurityHub, BatchDisableStandards, DeleteMembers] }
+    category: "logging"
+    tags: ["anti-tamper"]
+  - match: { action_prefix_in: [Create, Delete, Attach, Detach, Put, Update], service: "iam" }
+    category: "iam"
+  - match: { service: "kms" }
+    category: "data"
+  - match: { service: "s3" }
+    category: "data"
+  - match: { service: "rds" }
+    category: "data"
+  - match: { service: ["ec2"] }
+    category: "network"
+  - match: { service: ["lambda", "ssm", "secretsmanager"] }
+    category: "compute"
+  - match: { service: "organizations" }
+    category: "identity"
+  - match: { detail_type: "AWS Console Sign In via CloudTrail" }
+    category: "identity"
+  - default: { category: "other" }
+severity_rules:
+  - when: "is_root == true"
+    severity: "critical"
+    tags: ["root-activity"]
+  - when: { tags_contains: "anti-tamper" }
+    severity: "critical"
+  - when: { action_in: [ScheduleKeyDeletion, DisableKey, DisableKeyRotation, PutKeyPolicy, DeleteAlias] }
+    severity: "critical"
+  - when: { action_in: [DeactivateMFADevice, UpdateAccountPasswordPolicy, DeleteAccountPasswordPolicy] }
+    severity: "critical"
+  - when: { action_in: [LeaveOrganization, RemoveAccountFromOrganization, DeletePolicy, DetachPolicy, DisablePolicyType], service: organizations }
+    severity: "critical"
+  - when: { action_in: [PutBucketPublicAccessBlock, DeletePublicAccessBlock] }
+    severity: "critical"
+  - when: { detail_type: "AWS Console Sign In via CloudTrail", console_login_result: "Failure" }
+    severity: "high"
+  - when: { action_in: [CreateAccessKey, AttachUserPolicy, AttachRolePolicy, PutUserPolicy, PutRolePolicy, CreateSAMLProvider, UpdateSAMLProvider, CreateOpenIDConnectProvider, UpdateOpenIDConnectProvider] }
+    severity: "high"
+  - when: { action_in: [PutBucketPolicy, DeleteBucketPolicy, PutBucketAcl, PutBucketEncryption, DeleteBucketEncryption, DeleteBucket] }
+    severity: "high"
+  - when: { action_in: [AddPermission, CreateFunction, UpdateFunctionCode, CreateEventSourceMapping, SendCommand, StartSession, PutParameter, DeleteParameter, DeleteSecret, PutResourcePolicy] }
+    severity: "high"
+  - when: { action_in: [ModifyDBInstance, ModifyDBSnapshotAttribute, DeleteDBInstance, RestoreDBInstanceFromDBSnapshot] }
+    severity: "high"
+  - when: { category: "network" }
+    severity: "high"
+  - when: { action_in: [RunInstances, StartInstances, StopInstances, RebootInstances, TerminateInstances] }
+    severity: "medium"
+  - default: { severity: "medium" }
+      `.trim()
+        },
+        dedup: {
+            yamlDefinition: `
+name: "CloudTrail Default Deduplication"
+priority: 10
+is_active: true
+source_type: "cloudtrail"
+window_seconds: 300
+fingerprint:
+  algo: "sha256"
+  fields: ["source", "resourceId", "alertName", "state"]
+  excluded: ["downTime", "rawPayload"]
+on_hit:
+  action: "increment_counter"
+on_miss:
+  action: "pass_to_grouping"
+cache_ttl_seconds: 300
+      `.trim()
+        },
+        grouping: {
+            yamlDefinition: `
+name: "CloudTrail Default Grouping"
+priority: 10
+is_active: true
+source_type: "cloudtrail"
+default_key: ["resourceId", "alertName"]
+window_seconds: 300
+group_name: "{{alertName}}"
+incident_title: "{{count}} alerts on {{resourceName}}"
+max_alarms: 50
+incident_severity: "max_of_members"
+strategies:
+  - name: "resource_focus"
+    priority: 1
+    key: ["resourceId"]
+    window_seconds: 300
+    label: "Multiple events on one resource"
+  - name: "event_focus"
+    priority: 2
+    key: ["alertName"]
+    window_seconds: 300
+    label: "Repeated security events"
+notification:
+  suppress_duplicate_for_open_incident: true
+  digest_interval_seconds: 300
+  auto_resolve_on_recovery: true
+      `.trim()
+        }
+    },
+    cloudwatch: {
+        dedup: {
+            yamlDefinition: `
+name: "CloudWatch Default Dedup"
+priority: 10
+is_active: true
+source_type: "cloudwatch"
+window_seconds: 300
+fingerprint:
+  algo: "sha256"
+  fields: ["source", "resourceId", "metricName", "state"]
+on_hit:
+  action: "increment_counter"
+on_miss:
+  action: "pass_to_grouping"
+      `.trim()
+        },
+        grouping: {
+            yamlDefinition: `
+name: "CloudWatch Default Grouping"
+priority: 10
+is_active: true
+source_type: "cloudwatch"
+default_key: ["resourceId"]
+window_seconds: 300
+max_alarms: 50
+incident_severity: "max_of_members"
+      `.trim()
+        }
+    },
+    datadog: {
+        dedup: {
+            yamlDefinition: `
+name: "Datadog Default Dedup"
+priority: 10
+is_active: true
+source_type: "datadog"
+window_seconds: 300
+fingerprint:
+  algo: "sha256"
+  fields: ["source", "resourceId", "alertName", "state"]
+on_hit:
+  action: "increment_counter"
+on_miss:
+  action: "pass_to_grouping"
+      `.trim()
+        },
+        grouping: {
+            yamlDefinition: `
+name: "Datadog Default Grouping"
+priority: 10
+is_active: true
+source_type: "datadog"
+default_key: ["resourceId"]
+window_seconds: 300
+max_alarms: 50
+incident_severity: "max_of_members"
+      `.trim()
+        }
+    },
+    prometheus: {
+        dedup: {
+            yamlDefinition: `
+name: "Prometheus Default Dedup"
+priority: 10
+is_active: true
+source_type: "prometheus"
+window_seconds: 300
+fingerprint:
+  algo: "sha256"
+  fields: ["source", "resourceId", "alertName", "state"]
+on_hit:
+  action: "increment_counter"
+on_miss:
+  action: "pass_to_grouping"
+      `.trim()
+        },
+        grouping: {
+            yamlDefinition: `
+name: "Prometheus Default Grouping"
+priority: 10
+is_active: true
+source_type: "prometheus"
+default_key: ["resourceId"]
+window_seconds: 300
+max_alarms: 50
+incident_severity: "max_of_members"
+      `.trim()
+        }
+    },
+    grafana: {
+        dedup: {
+            yamlDefinition: `
+name: "Grafana Default Dedup"
+priority: 10
+is_active: true
+source_type: "grafana"
+window_seconds: 300
+fingerprint:
+  algo: "sha256"
+  fields: ["source", "resourceId", "alertName", "state"]
+on_hit:
+  action: "increment_counter"
+on_miss:
+  action: "pass_to_grouping"
+      `.trim()
+        },
+        grouping: {
+            yamlDefinition: `
+name: "Grafana Default Grouping"
+priority: 10
+is_active: true
+source_type: "grafana"
+default_key: ["resourceId"]
+window_seconds: 300
+max_alarms: 50
+incident_severity: "max_of_members"
+      `.trim()
+        }
+    },
+};
+//# sourceMappingURL=pipelineDefaults.js.map

package/dist/pipeline/defaults/pipelineDefaults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipelineDefaults.js","sourceRoot":"","sources":["../../../src/pipeline/defaults/pipelineDefaults.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,gBAAgB,GAIxB;IACH,UAAU,EAAE;QACV,aAAa,EAAE;YACb,YAAY,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCb,CAAC,IAAI,EAAE;YACR,cAAc,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAuDf,CAAC,IAAI,EAAE;SACT;QACD,KAAK,EAAE;YACL,cAAc,EAAE;;;;;;;;;;;;;;;OAef,CAAC,IAAI,EAAE;SACT;QACD,QAAQ,EAAE;YACR,cAAc,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;OA0Bf,CAAC,IAAI,EAAE;SACT;KACF;IACD,UAAU,EAAE;QACV,KAAK,EAAE;YACL,cAAc,EAAE;;;;;;;;;;;;;OAaf,CAAC,IAAI,EAAE;SACT;QACD,QAAQ,EAAE;YACR,cAAc,EAAE;;;;;;;;;OASf,CAAC,IAAI,EAAE;SACT;KACF;IACD,OAAO,EAAE;QACP,KAAK,EAAE;YACL,cAAc,EAAE;;;;;;;;;;;;;OAaf,CAAC,IAAI,EAAE;SACT;QACD,QAAQ,EAAE;YACR,cAAc,EAAE;;;;;;;;;OASf,CAAC,IAAI,EAAE;SACT;KACF;IACD,UAAU,EAAE;QACV,KAAK,EAAE;YACL,cAAc,EAAE;;;;;;;;;;;;;OAaf,CAAC,IAAI,EAAE;SACT;QACD,QAAQ,EAAE;YACR,cAAc,EAAE;;;;;;;;;OASf,CAAC,IAAI,EAAE;SACT;KACF;IACD,OAAO,EAAE;QACP,KAAK,EAAE;YACL,cAAc,EAAE;;;;;;;;;;;;;OAaf,CAAC,IAAI,EAAE;SACT;QACD,QAAQ,EAAE;YACR,cAAc,EAAE;;;;;;;;;OASf,CAAC,IAAI,EAAE;SACT;KACF;CACF,CAAC"}

package/dist/pipeline/yaml/DedupYaml.d.ts

@@ -0,0 +1,33 @@
+import { z } from "zod";
+export declare const DedupYamlSchema: z.ZodObject<{
+    name: z.ZodString;
+    priority: z.ZodDefault<z.ZodNumber>;
+    is_active: z.ZodDefault<z.ZodBoolean>;
+    source_type: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    source_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    window_seconds: z.ZodDefault<z.ZodNumber>;
+    fingerprint: z.ZodObject<{
+        algo: z.ZodDefault<z.ZodEnum<{
+            sha256: "sha256";
+            md5: "md5";
+        }>>;
+        fields: z.ZodArray<z.ZodString>;
+        excluded: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>;
+    window_overrides: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNumber>>;
+    on_hit: z.ZodObject<{
+        action: z.ZodEnum<{
+            increment_counter: "increment_counter";
+            suppress: "suppress";
+            elevate_severity: "elevate_severity";
+        }>;
+        update: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        renotify_threshold: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>;
+    on_miss: z.ZodObject<{
+        action: z.ZodLiteral<"pass_to_grouping">;
+    }, z.core.$strip>;
+    cache_ttl_seconds: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export type DedupYaml = z.infer<typeof DedupYamlSchema>;
+//# sourceMappingURL=DedupYaml.d.ts.map

package/dist/pipeline/yaml/DedupYaml.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DedupYaml.d.ts","sourceRoot":"","sources":["../../../src/pipeline/yaml/DedupYaml.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsB1B,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC"}

package/dist/pipeline/yaml/DedupYaml.js

@@ -0,0 +1,25 @@
+import { z } from "zod";
+export const DedupYamlSchema = z.object({
+    name: z.string(),
+    priority: z.number().default(0),
+    is_active: z.boolean().default(true),
+    source_type: z.string().nullable().optional(),
+    source_id: z.string().nullable().optional(),
+    window_seconds: z.number().min(120).max(300).default(300),
+    fingerprint: z.object({
+        algo: z.enum(["sha256", "md5"]).default("sha256"),
+        fields: z.array(z.string()),
+        excluded: z.array(z.string()).optional(),
+    }),
+    window_overrides: z.record(z.string(), z.number().min(120).max(300)).optional(),
+    on_hit: z.object({
+        action: z.enum(["increment_counter", "suppress", "elevate_severity"]),
+        update: z.array(z.string()).optional(),
+        renotify_threshold: z.number().optional(),
+    }),
+    on_miss: z.object({
+        action: z.literal("pass_to_grouping"),
+    }),
+    cache_ttl_seconds: z.number().min(120).max(300).optional(),
+});
+//# sourceMappingURL=DedupYaml.js.map

package/dist/pipeline/yaml/DedupYaml.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DedupYaml.js","sourceRoot":"","sources":["../../../src/pipeline/yaml/DedupYaml.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/B,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACpC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IACzD,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACjD,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAC3B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KACzC,CAAC;IACF,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/E,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,mBAAmB,EAAE,UAAU,EAAE,kBAAkB,CAAC,CAAC;QACrE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QACtC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC1C,CAAC;IACF,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;KACtC,CAAC;IACF,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAC3D,CAAC,CAAC"}

package/dist/pipeline/yaml/GroupingYaml.d.ts

@@ -0,0 +1,49 @@
+import { z } from "zod";
+export declare const GroupingStrategySchema: z.ZodObject<{
+    name: z.ZodString;
+    priority: z.ZodNumber;
+    key: z.ZodArray<z.ZodString>;
+    window_seconds: z.ZodOptional<z.ZodNumber>;
+    min_events: z.ZodOptional<z.ZodNumber>;
+    signal_actions: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    match: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    label: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const GroupingYamlSchema: z.ZodObject<{
+    name: z.ZodString;
+    priority: z.ZodDefault<z.ZodNumber>;
+    is_active: z.ZodDefault<z.ZodBoolean>;
+    source_type: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    source_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    default_key: z.ZodArray<z.ZodString>;
+    window_seconds: z.ZodDefault<z.ZodNumber>;
+    early_incident_delay_seconds: z.ZodDefault<z.ZodNumber>;
+    max_alarms: z.ZodDefault<z.ZodNumber>;
+    incident_title: z.ZodOptional<z.ZodString>;
+    use_ai_generate: z.ZodDefault<z.ZodBoolean>;
+    group_name: z.ZodOptional<z.ZodString>;
+    topology_tag_mapping: z.ZodOptional<z.ZodString>;
+    incident_severity: z.ZodDefault<z.ZodString>;
+    escalation: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        when: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        set_severity: z.ZodString;
+        add_tag: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+    strategies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        priority: z.ZodNumber;
+        key: z.ZodArray<z.ZodString>;
+        window_seconds: z.ZodOptional<z.ZodNumber>;
+        min_events: z.ZodOptional<z.ZodNumber>;
+        signal_actions: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        match: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        label: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+    notification: z.ZodOptional<z.ZodObject<{
+        suppress_duplicate_for_open_incident: z.ZodDefault<z.ZodBoolean>;
+        digest_interval_seconds: z.ZodDefault<z.ZodNumber>;
+        auto_resolve_on_recovery: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type GroupingYaml = z.infer<typeof GroupingYamlSchema>;
+//# sourceMappingURL=GroupingYaml.d.ts.map

package/dist/pipeline/yaml/GroupingYaml.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GroupingYaml.d.ts","sourceRoot":"","sources":["../../../src/pipeline/yaml/GroupingYaml.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,sBAAsB;;;;;;;;;iBASjC,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0B7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC"}

package/dist/pipeline/yaml/GroupingYaml.js

@@ -0,0 +1,39 @@
+import { z } from "zod";
+export const GroupingStrategySchema = z.object({
+    name: z.string(),
+    priority: z.number(),
+    key: z.array(z.string()),
+    window_seconds: z.number().min(120).max(300).optional(),
+    min_events: z.number().optional(),
+    signal_actions: z.array(z.string()).optional(),
+    match: z.record(z.string(), z.string()).optional(),
+    label: z.string().optional(),
+});
+export const GroupingYamlSchema = z.object({
+    name: z.string(),
+    priority: z.number().default(0),
+    is_active: z.boolean().default(true),
+    source_type: z.string().nullable().optional(),
+    source_id: z.string().nullable().optional(),
+    default_key: z.array(z.string()),
+    window_seconds: z.number().min(120).max(300).default(300),
+    early_incident_delay_seconds: z.number().min(0).max(120).default(120),
+    max_alarms: z.number().default(50),
+    incident_title: z.string().optional(),
+    use_ai_generate: z.boolean().default(false),
+    group_name: z.string().optional(),
+    topology_tag_mapping: z.string().optional(),
+    incident_severity: z.string().default("max_of_members"),
+    escalation: z.array(z.object({
+        when: z.record(z.string(), z.unknown()),
+        set_severity: z.string(),
+        add_tag: z.string().optional(),
+    })).optional(),
+    strategies: z.array(GroupingStrategySchema).optional(),
+    notification: z.object({
+        suppress_duplicate_for_open_incident: z.boolean().default(true),
+        digest_interval_seconds: z.number().default(300),
+        auto_resolve_on_recovery: z.boolean().default(false),
+    }).optional(),
+});
+//# sourceMappingURL=GroupingYaml.js.map

package/dist/pipeline/yaml/GroupingYaml.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GroupingYaml.js","sourceRoot":"","sources":["../../../src/pipeline/yaml/GroupingYaml.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACxB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACvD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9C,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAClD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/B,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACpC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3C,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAChC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IACzD,4BAA4B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IACrE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAClC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC;IACvD,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QACvC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;QACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC/B,CAAC,CAAC,CAAC,QAAQ,EAAE;IACd,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,QAAQ,EAAE;IACtD,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,oCAAoC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC/D,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;QAChD,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;KACrD,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC"}

package/dist/pipeline/yaml/NormalizationYaml.d.ts

@@ -0,0 +1,54 @@
+import { z } from "zod";
+export declare const CategoryRuleSchema: z.ZodObject<{
+    match: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+    category: z.ZodString;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+export declare const SeverityRuleSchema: z.ZodUnion<[z.ZodObject<{
+    when: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>]>>;
+    severity: z.ZodEnum<{
+        high: "high";
+        critical: "critical";
+        medium: "medium";
+        low: "low";
+    }>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>, z.ZodObject<{
+    default: z.ZodObject<{
+        severity: z.ZodString;
+    }, z.core.$strip>;
+}, z.core.$strip>]>;
+export declare const NormalizationYamlSchema: z.ZodObject<{
+    name: z.ZodString;
+    priority: z.ZodDefault<z.ZodNumber>;
+    is_active: z.ZodDefault<z.ZodBoolean>;
+    source_type: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    source_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    canonical_schema: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    enrichment: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>]>>>;
+    category_rules: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+        match: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+        category: z.ZodString;
+        tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>, z.ZodObject<{
+        default: z.ZodObject<{
+            category: z.ZodString;
+        }, z.core.$strip>;
+    }, z.core.$strip>]>>>;
+    severity_rules: z.ZodOptional<z.ZodArray<z.ZodUnion<[z.ZodObject<{
+        when: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>]>>;
+        severity: z.ZodEnum<{
+            high: "high";
+            critical: "critical";
+            medium: "medium";
+            low: "low";
+        }>;
+        tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>, z.ZodObject<{
+        default: z.ZodObject<{
+            severity: z.ZodString;
+        }, z.core.$strip>;
+    }, z.core.$strip>]>>>;
+}, z.core.$strip>;
+export type NormalizationYaml = z.infer<typeof NormalizationYamlSchema>;
+//# sourceMappingURL=NormalizationYaml.d.ts.map

package/dist/pipeline/yaml/NormalizationYaml.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"NormalizationYaml.d.ts","sourceRoot":"","sources":["../../../src/pipeline/yaml/NormalizationYaml.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,kBAAkB;;;;iBAI7B,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;mBAIiC,CAAC;AAEjE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAUlC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC"}