@meyicloud/meyi-insight-server 1.0.0

package/dist/services/alert.service.js

@@ -0,0 +1,688 @@
+import { enqueueAlarm, isRedisAvailable } from "../pipeline/alarmQueue.js";
+import { CloudWatchClient, ListTagsForResourceCommand } from "@aws-sdk/client-cloudwatch";
+function parseMaybeJson(value) {
+    if (typeof value !== "string")
+        return null;
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        return null;
+    }
+}
+function parseTags(rawTags) {
+    const result = {};
+    if (!rawTags)
+        return result;
+    if (Array.isArray(rawTags)) {
+        for (const item of rawTags) {
+            if (!item || typeof item !== "object")
+                continue;
+            const key = item.Key ?? item.key;
+            const value = item.Value ?? item.value;
+            if (key !== undefined && value !== undefined && key !== null) {
+                result[String(key).trim()] = String(value).trim();
+            }
+        }
+    }
+    else if (typeof rawTags === "object") {
+        for (const [key, value] of Object.entries(rawTags)) {
+            if (value !== undefined && value !== null) {
+                result[key.trim()] = String(value).trim();
+            }
+        }
+    }
+    return result;
+}
+function unwrapCloudWatchPayload(body) {
+    if (!body || typeof body !== "object")
+        return body;
+    const snsMessage = parseMaybeJson(body?.Message);
+    if (snsMessage && typeof snsMessage === "object") {
+        return snsMessage;
+    }
+    return body;
+}
+function extractCloudWatchState(payload) {
+    if (!payload || typeof payload !== "object")
+        return null;
+    if (payload?.NewStateValue)
+        return payload.NewStateValue;
+    if (payload?.detail?.state?.value)
+        return payload.detail.state.value;
+    if (payload?.alarmData?.state?.value)
+        return payload.alarmData.state.value;
+    return null;
+}
+function normalizeCloudWatchPayload(body) {
+    const payload = unwrapCloudWatchPayload(body);
+    if (!payload || typeof payload !== "object")
+        return payload;
+    const account = payload.account ||
+        payload.accountId ||
+        payload.AWSAccountId ||
+        payload.detail?.recipientAccountId ||
+        payload.detail?.account ||
+        payload.rawEvent?.account;
+    const tags = payload.tags ||
+        payload.Tags ||
+        payload.detail?.tags ||
+        payload.rawEvent?.tags ||
+        payload.rawEvent?.detail?.tags;
+    const alarmName = payload.AlarmName ||
+        payload.alarmName ||
+        payload.detail?.alarmName ||
+        payload.alarmData?.alarmName;
+    const alarmArn = payload.AlarmArn ||
+        payload.alarmArn ||
+        payload.detail?.alarmArn ||
+        (Array.isArray(payload.rawEvent?.resources) && payload.rawEvent.resources[0]) ||
+        (Array.isArray(payload.resources) && payload.resources[0]) ||
+        (account && alarmName && (payload.region || payload.rawEvent?.region)
+            ? `arn:aws:cloudwatch:${payload.region || payload.rawEvent?.region}:${account}:alarm:${alarmName}`
+            : undefined);
+    if (payload?.alarmData?.state?.value) {
+        return {
+            ...payload,
+            AlarmName: payload.alarmData.alarmName || alarmName,
+            AlarmArn: alarmArn || payload.alarmArn,
+            alarmArn: alarmArn || payload.alarmArn,
+            NewStateValue: payload.alarmData.state.value,
+            NewStateReason: payload.alarmData.state.reason,
+            StateChangeTime: payload.alarmData.state.timestamp || payload.time,
+            configuration: payload.alarmData.configuration,
+            ...(account ? { account, accountId: account } : {}),
+            ...(tags ? { tags } : {}),
+            ...(alarmArn ? { AlarmArn: alarmArn, alarmArn } : {}),
+        };
+    }
+    if (payload?.detail?.state?.value) {
+        return {
+            ...payload,
+            AlarmName: payload.detail.alarmName || alarmName,
+            AlarmArn: alarmArn || payload.detail.alarmArn,
+            alarmArn: alarmArn || payload.detail.alarmArn,
+            NewStateValue: payload.detail.state.value,
+            NewStateReason: payload.detail.state.reason,
+            StateChangeTime: payload.detail.state.timestamp || payload.time,
+            configuration: payload.detail.configuration,
+            ...(account ? { account, accountId: account } : {}),
+            ...(tags ? { tags } : {}),
+            ...(alarmArn ? { AlarmArn: alarmArn, alarmArn } : {}),
+        };
+    }
+    return {
+        ...payload,
+        ...(account ? { account, accountId: account } : {}),
+        ...(tags ? { tags } : {}),
+        ...(alarmArn ? { AlarmArn: alarmArn, alarmArn } : {}),
+    };
+}
+async function enrichCloudWatchTagsIfMissing(source, body) {
+    if (source?.type !== "cloudwatch" || !body || typeof body !== "object")
+        return;
+    const existingTags = body.tags || body.Tags || body.detail?.tags || body.rawEvent?.tags || body.rawEvent?.detail?.tags;
+    if (existingTags && typeof existingTags === "object" && Object.keys(existingTags).length > 0)
+        return;
+    const alarmArn = body.AlarmArn ||
+        body.alarmArn ||
+        body.detail?.alarmArn ||
+        (Array.isArray(body.rawEvent?.resources) && body.rawEvent.resources[0]) ||
+        (Array.isArray(body.resources) && body.resources[0]) ||
+        (body.accountId && (body.AlarmName || body.alarmName) && (body.region || body.rawEvent?.region)
+            ? `arn:aws:cloudwatch:${body.region || body.rawEvent?.region || "ap-south-1"}:${body.accountId}:alarm:${body.AlarmName || body.alarmName}`
+            : null);
+    if (!alarmArn)
+        return;
+    if (source.awsAccessKeyId && source.awsSecretAccessKey) {
+        try {
+            const client = new CloudWatchClient({
+                region: source.awsRegion || body.region || body.rawEvent?.region || "ap-south-1",
+                credentials: {
+                    accessKeyId: source.awsAccessKeyId,
+                    secretAccessKey: source.awsSecretAccessKey,
+                    ...(source.awsSessionToken ? { sessionToken: source.awsSessionToken } : {}),
+                },
+            });
+            const res = await client.send(new ListTagsForResourceCommand({ ResourceARN: alarmArn }));
+            const tags = {};
+            for (const t of res.Tags || []) {
+                if (t && t.Key)
+                    tags[t.Key] = t.Value || "";
+            }
+            if (Object.keys(tags).length > 0) {
+                body.tags = tags;
+                if (!body.AlarmArn)
+                    body.AlarmArn = alarmArn;
+            }
+        }
+        catch (err) {
+            console.warn(`[AlertService] Could not fetch CloudWatch tags for ${alarmArn}:`, err?.message);
+        }
+    }
+}
+function cloudWatchSeverityFromState(stateValue) {
+    if (stateValue === "ALARM")
+        return "critical";
+    if (stateValue === "INSUFFICIENT_DATA")
+        return "medium";
+    return "low";
+}
+function webhookProcessingErrorMessage(error) {
+    const message = String(error?.message || "");
+    const detail = String(error?.cause?.message || error?.detail || "");
+    const combined = `${message} ${detail}`.toLowerCase();
+    if (combined.includes("not-null") || combined.includes("null value")) {
+        return "Webhook received, but required alert fields were missing after payload mapping.";
+    }
+    if (combined.includes("duplicate key") || combined.includes("unique constraint")) {
+        return "Webhook received, but it matches an alert record that already exists.";
+    }
+    if (combined.includes("does not exist") || combined.includes("column")) {
+        return "Webhook received, but alert storage is not ready. Run migrations and restart the backend.";
+    }
+    if (message.startsWith("Failed query:") || combined.includes("insert into")) {
+        return "Webhook received, but Meyi Connect could not save the alert. Check payload mapping and database migrations.";
+    }
+    return message || "Webhook processing failed.";
+}
+export function normalizePayload(sourceType, rawBody) {
+    const body = sourceType === "cloudwatch" ? normalizeCloudWatchPayload(rawBody) : rawBody;
+    let resourceId = "";
+    let resourceName = "";
+    let resourceType = sourceType;
+    let tags = {};
+    let severity = "high";
+    let alertName = "Unknown Alert";
+    let description;
+    let additionalConfiguration;
+    let downTime;
+    let accountId;
+    let accountName;
+    let metricName;
+    let labels;
+    if (sourceType === "meyi_pulse") {
+        resourceId = body.monitorId ?? body.monitor_id ?? body.id ?? crypto.randomUUID();
+        resourceName = body.monitorName ?? body.monitor_name ?? body.name ?? "Unknown Monitor";
+        resourceType = body.monitorType ?? body.monitor_type ?? "monitor";
+        tags = parseTags(body.tags ?? body.Tags ?? (body.tag ? { project: body.tag } : undefined));
+        severity = body.severity ?? "high";
+        alertName = body.monitorName ?? body.title ?? "Monitor Down";
+        description = body.message ?? body.description;
+        downTime = body.downTime ?? body.down_time ?? body.timestamp;
+    }
+    else if (sourceType === "grafana") {
+        const alert = Array.isArray(body.alerts) ? body.alerts[0] : body;
+        const l = alert.labels ?? {};
+        const ann = alert.annotations ?? {};
+        resourceId = l.instance ?? l.job ?? crypto.randomUUID();
+        resourceName = l.instance ?? l.alertname ?? "Grafana Alert";
+        resourceType = l.type ?? "metric";
+        tags = { ...l, ...(ann.project ? { project: ann.project } : {}) };
+        severity = l.severity ?? "high";
+        alertName = l.alertname ?? ann.summary ?? "Grafana Alert";
+        description = ann.description ?? ann.summary;
+        downTime = alert.startsAt;
+        labels = l;
+    }
+    else if (sourceType === "datadog") {
+        resourceId = String(body.id ?? crypto.randomUUID());
+        resourceName = body.host ?? body.title ?? "Datadog Resource";
+        resourceType = body.source_type_name ?? "datadog";
+        const dTags = {};
+        if (Array.isArray(body.tags)) {
+            for (const t of body.tags) {
+                if (typeof t === "string" && t.includes(":")) {
+                    const [k, ...v] = t.split(":");
+                    dTags[k.trim()] = v.join(":").trim();
+                }
+            }
+        }
+        else if (typeof body.tags === "object" && body.tags) {
+            Object.assign(dTags, parseTags(body.tags));
+        }
+        tags = dTags;
+        severity = body.alert_type === "error" ? "critical" : body.alert_type ?? "high";
+        alertName = body.title ?? "Datadog Alert";
+        description = body.text ?? body.body;
+        downTime = body.date ? new Date(body.date * 1000).toISOString() : undefined;
+    }
+    else if (sourceType === "cloudwatch") {
+        const stateValue = body.NewStateValue;
+        const alarmName = body.AlarmName || body.alarmName || body.detail?.alarmName;
+        const alarmArn = body.AlarmArn ||
+            body.alarmArn ||
+            body.detail?.alarmArn ||
+            (Array.isArray(body.rawEvent?.resources) && body.rawEvent.resources[0]) ||
+            (Array.isArray(body.resources) && body.resources[0]);
+        resourceId = alarmName ?? alarmArn ?? crypto.randomUUID();
+        resourceName = alarmName ?? "CloudWatch";
+        resourceType = "cloudwatch";
+        // Robust account ID extraction:
+        // 1. Direct account / accountId / AWSAccountId properties
+        // 2. Event envelope properties (detail.recipientAccountId, rawEvent.account)
+        // 3. ARN regex parsing: arn:aws:cloudwatch:<region>:<accountId>:alarm:<name>
+        let extractedAccount = body.account ??
+            body.accountId ??
+            body.AWSAccountId ??
+            body.rawEvent?.account ??
+            body.detail?.recipientAccountId ??
+            body.detail?.account ??
+            body.recipientAccountId;
+        if (!extractedAccount && alarmArn) {
+            const arnMatch = String(alarmArn).match(/^arn:aws[a-z0-9-]*:cloudwatch:[^:]+:([0-9]{12}):alarm:/i);
+            if (arnMatch) {
+                extractedAccount = arnMatch[1];
+            }
+        }
+        if (!extractedAccount && Array.isArray(body.resources) && body.resources[0]) {
+            const resMatch = String(body.resources[0]).match(/^arn:aws[a-z0-9-]*:cloudwatch:[^:]+:([0-9]{12}):alarm:/i);
+            if (resMatch) {
+                extractedAccount = resMatch[1];
+            }
+        }
+        if (extractedAccount && extractedAccount !== "unknown") {
+            accountId = String(extractedAccount);
+        }
+        // Robust tags extraction:
+        // Handles array of { Key, Value }, { key, value }, and dictionary { [key]: value }
+        const tagsRecord = parseTags(body.tags ??
+            body.Tags ??
+            body.detail?.tags ??
+            body.rawEvent?.tags ??
+            body.rawEvent?.detail?.tags);
+        tags = tagsRecord;
+        severity = cloudWatchSeverityFromState(stateValue);
+        alertName = alarmName
+            ? `${alarmName} (${stateValue || "UNKNOWN"})`
+            : `${stateValue || "UNKNOWN"}`;
+        description = body.NewStateReason ?? body.description ?? body.message ?? body.text;
+        additionalConfiguration = {
+            ...(typeof body.configuration === "object" ? body.configuration : {}),
+            ...(Object.keys(tagsRecord).length > 0 ? { tags: tagsRecord } : {}),
+            ...(accountId ? { accountId } : {}),
+        };
+        downTime = body.StateChangeTime;
+        labels = Object.keys(tagsRecord).length > 0 ? tagsRecord : undefined;
+        metricName = body.MetricName || body.metricName || body.configuration?.metrics?.[0]?.metricStat?.metric?.name;
+    }
+    else if (sourceType === "cloudtrail") {
+        // CloudTrail events arrive via SNS → EventBridge. The SNS message wrapper may nest
+        // the EventBridge detail under `detail` (direct EventBridge) or as a JSON string in `Message`.
+        let event = body;
+        if (typeof body.Message === "string") {
+            try {
+                event = JSON.parse(body.Message);
+            }
+            catch {
+                event = body;
+            }
+        }
+        const detail = event?.detail ?? event;
+        const evtSrc = detail?.eventSource ?? event?.source ?? "aws.unknown";
+        const evtName = detail?.eventName ?? "UnknownEvent";
+        const user = detail?.userIdentity?.arn ?? detail?.userIdentity?.userName ?? detail?.userIdentity?.type ?? "unknown";
+        const srcIp = detail?.sourceIPAddress ?? "unknown";
+        const region = event?.region ?? detail?.awsRegion ?? "unknown";
+        const account = event?.account ?? detail?.recipientAccountId ?? "unknown";
+        accountId = account !== "unknown" ? account : undefined;
+        const req = detail?.requestParameters;
+        const resp = detail?.responseElements;
+        const targetResource = req?.groupId ??
+            req?.ModifySecurityGroupRulesRequest?.GroupId ??
+            req?.bucketName ??
+            req?.instanceId ??
+            req?.dbInstanceIdentifier ??
+            req?.functionName ??
+            req?.userName ??
+            req?.roleName ??
+            resp?.groupId ??
+            resp?.instancesSet?.items?.[0]?.instanceId;
+        if (targetResource) {
+            resourceId = `${evtSrc}/${targetResource}`;
+            resourceName = `${evtName} (${targetResource})`;
+        }
+        else {
+            resourceId = `${evtSrc}/${evtName}`;
+            resourceName = evtName;
+        }
+        resourceType = evtSrc.replace(/^aws\./, "") || "cloudtrail";
+        severity = "high"; // CloudTrail events are always security-relevant — treat as high
+        alertName = targetResource ? `${evtName}: ${targetResource}` : `${evtName} (${evtSrc})`;
+        description = `${evtName} on ${targetResource || evtSrc} by ${user} from ${srcIp} in ${region} (account: ${account})`;
+        additionalConfiguration = { eventSource: evtSrc, eventName: evtName, targetResource, user, sourceIp: srcIp, region, account };
+        downTime = detail?.eventTime ?? event?.time ?? new Date().toISOString();
+        tags = parseTags(body.tags ?? body.Tags ?? (account && account !== "unknown" ? { account } : undefined));
+    }
+    else if (sourceType === "prometheus") {
+        // Q3: Prometheus Alertmanager sends an alerts[] array. Process alerts[0] for now.
+        // Full batch processing (one record per alert) deferred to Phase 5.
+        const alerts = body.alerts ?? [];
+        if (alerts.length > 1) {
+            console.warn(`[normalizePayload] Prometheus batch contains ${alerts.length} alerts — processing alerts[0] only. Full batch support coming in Phase 5.`);
+        }
+        const alert = alerts[0] ?? body;
+        const l = alert.labels ?? {};
+        const ann = alert.annotations ?? {};
+        const status = (alert.status ?? body.status ?? "firing");
+        resourceId = l.instance ?? l.job ?? crypto.randomUUID();
+        resourceName = l.instance ?? l.alertname ?? "Prometheus Alert";
+        resourceType = l.job ?? "prometheus";
+        tags = { ...l, ...(ann.project ? { project: ann.project } : {}) };
+        severity = l.severity ?? "high";
+        alertName = l.alertname ?? ann.summary ?? "Prometheus Alert";
+        description = ann.description ?? ann.summary;
+        downTime = alert.startsAt ?? new Date().toISOString();
+        additionalConfiguration = { status, groupLabels: body.groupLabels, commonLabels: body.commonLabels };
+        labels = l;
+    }
+    else {
+        resourceId = body.resource_id ?? body.instanceId ?? body.id ?? crypto.randomUUID();
+        resourceName = body.resource_name ?? body.monitorName ?? body.name ?? "Unknown Resource";
+        resourceType = body.resource_type ?? body.monitorType ?? body.type ?? "custom";
+        tags = parseTags(body.tags ?? body.Tags ?? body.labels ?? (body.tag ? { project: body.tag } : undefined));
+        severity = body.severity ?? "high";
+        alertName = body.title ?? body.alertname ?? body.summary ?? "Alert";
+        description = body.description ?? body.message ?? body.text;
+        downTime = body.downTime ?? body.down_time ?? body.timestamp ?? body.time;
+    }
+    if (!accountName) {
+        accountName = body.accountName ?? body.account_name ?? body.detail?.accountName ?? body.detail?.account_name ?? body.rawEvent?.accountName;
+    }
+    if (!downTime) {
+        downTime = new Date().toISOString();
+    }
+    return {
+        resourceId,
+        resourceName,
+        resourceType,
+        tags,
+        severity,
+        alertName,
+        description,
+        additionalConfiguration,
+        downTime,
+        accountId,
+        accountName,
+        metricName,
+        labels: Object.keys(tags).length > 0 ? tags : labels,
+    };
+}
+export class AlertService {
+    alertModel;
+    incidentModel;
+    sourceModel;
+    publisher;
+    observabilityService;
+    workflowService;
+    constructor(alertModel, incidentModel, sourceModel, publisher, observabilityService, workflowService) {
+        this.alertModel = alertModel;
+        this.incidentModel = incidentModel;
+        this.sourceModel = sourceModel;
+        this.publisher = publisher;
+        this.observabilityService = observabilityService;
+        this.workflowService = workflowService;
+    }
+    async summary(params) {
+        return this.alertModel.summary(params);
+    }
+    async emitTotals(reason) {
+        if (!this.publisher)
+            return;
+        try {
+            const summary = await this.alertModel.summary({ status: "all" });
+            const payload = {
+                total: Number(summary?.total ?? 0),
+                bySeverity: {
+                    critical: Number(summary?.bySeverity?.critical ?? 0),
+                    high: Number(summary?.bySeverity?.high ?? 0),
+                    medium: Number(summary?.bySeverity?.medium ?? 0),
+                    low: Number(summary?.bySeverity?.low ?? 0),
+                },
+                reason,
+            };
+            this.publisher.emit({
+                topic: "alerts.totals",
+                payload,
+                ts: new Date().toISOString(),
+            });
+        }
+        catch {
+            // Best-effort realtime signal, do not fail request path.
+        }
+    }
+    emitSourceUpdated(sourceId, reason) {
+        if (!this.publisher)
+            return;
+        try {
+            this.publisher.emit({
+                topic: "sources.updated",
+                payload: { sourceId, reason },
+                ts: new Date().toISOString(),
+            });
+        }
+        catch {
+            // Best-effort realtime signal, do not fail request path.
+        }
+    }
+    async list(params) {
+        const page = Math.max(1, params.page ?? 1);
+        const limit = Math.min(100, params.limit ?? 20);
+        const result = await this.alertModel.list({
+            page,
+            limit,
+            status: params.status,
+            severity: params.severity,
+            sourceId: params.sourceId,
+            search: params.search,
+            tenantId: params.tenantId,
+            incidentId: params.incidentId,
+        });
+        const incidentIds = result.alerts
+            .map(a => a.incidentId)
+            .filter((id) => Boolean(id));
+        if (incidentIds.length > 0) {
+            const incidents = await this.incidentModel.findByIds(incidentIds, params.tenantId);
+            const assigneeMap = new Map(incidents.map(inc => [inc.id, inc.assigneeId]));
+            result.alerts = result.alerts.map(a => ({
+                ...a,
+                incidentAssigneeId: a.incidentId ? assigneeMap.get(a.incidentId) : null,
+            }));
+        }
+        return result;
+    }
+    async getById(id, tenantId) {
+        return this.alertModel.findById(id, tenantId);
+    }
+    async ingestWebhook(token, authToken, body, meta) {
+        const validation = await this.sourceModel.validateWebhookToken(token, authToken);
+        if (!validation.source) {
+            const reason = validation.reason || "NOT_FOUND";
+            const sourceId = validation.rejectedSource?.id ?? null;
+            // Do not log a failure for the initial AWS SNS / HTTP challenge request (no auth token provided)
+            const isAuthChallenge = reason === "UNAUTHORIZED" && !authToken;
+            if (!isAuthChallenge) {
+                await this.observabilityService?.recordFailure({
+                    ...meta,
+                    sourceId,
+                    token,
+                    errorCode: `SOURCE_${reason}`,
+                    errorMessage: reason === "EXPIRED"
+                        ? "Webhook token expired"
+                        : reason === "INACTIVE"
+                            ? "Source is inactive"
+                            : reason === "UNAUTHORIZED"
+                                ? "Unauthorized webhook token"
+                                : "Invalid webhook token",
+                    payload: body,
+                });
+            }
+            if (reason === "INACTIVE")
+                throw new Error("SOURCE_INACTIVE");
+            if (reason === "EXPIRED")
+                throw new Error("SOURCE_EXPIRED");
+            if (reason === "UNAUTHORIZED")
+                throw new Error("SOURCE_UNAUTHORIZED");
+            throw new Error("SOURCE_NOT_FOUND");
+        }
+        const source = validation.source;
+        // Server-side fallback: enrich tags for CloudWatch alarms if not already present in the payload
+        await enrichCloudWatchTagsIfMissing(source, body);
+        // ── Queue-first path (pipeline active) ───────────────────────────────────
+        if (isRedisAvailable()) {
+            try {
+                // Phase 5 (Q3): Prometheus multi-alert batch — fan-out each alert as a separate job
+                if (source.type === "prometheus" && Array.isArray(body?.alerts) && body.alerts.length > 1) {
+                    let enqueuedCount = 0;
+                    for (const singleAlert of body.alerts) {
+                        // Reconstruct a single-alert Alertmanager payload
+                        const singlePayload = {
+                            ...body,
+                            alerts: [singleAlert],
+                        };
+                        const enqueued = await enqueueAlarm({
+                            sourceId: source.id,
+                            sourceType: source.type,
+                            sourceName: source.name,
+                            tenantId: source.tenantId ?? null,
+                            rawPayload: singlePayload,
+                            receivedAt: new Date().toISOString(),
+                            token,
+                        });
+                        if (enqueued)
+                            enqueuedCount++;
+                    }
+                    if (enqueuedCount > 0) {
+                        console.info(`[AlertService] Prometheus batch: enqueued ${enqueuedCount}/${body.alerts.length} alerts`);
+                        this.emitSourceUpdated(source.id, "webhook_queued");
+                        return { alertId: null, incidentId: null, queued: true };
+                    }
+                }
+                // Standard single-payload enqueue
+                const enqueued = await enqueueAlarm({
+                    sourceId: source.id,
+                    sourceType: source.type,
+                    sourceName: source.name,
+                    tenantId: source.tenantId ?? null,
+                    rawPayload: body,
+                    receivedAt: new Date().toISOString(),
+                    token,
+                });
+                if (enqueued) {
+                    this.emitSourceUpdated(source.id, "webhook_queued");
+                    return { alertId: null, incidentId: null, queued: true };
+                }
+            }
+            catch (err) {
+                console.warn("[AlertService] Queue enqueue failed, falling back to sync:", err.message);
+            }
+        }
+        // ── Sync fallback (Redis unavailable or enqueue failed) ──────────────
+        console.info("[AlertService] Using synchronous fallback path (Redis unavailable)");
+        try {
+            const payload = source.type === "cloudwatch" ? normalizeCloudWatchPayload(body) : body;
+            const normalized = normalizePayload(source.type, payload);
+            const row = await this.alertModel.create({
+                sourceId: source.id,
+                tenantId: source.tenantId ?? null,
+                sourceName: source.name,
+                sourceType: source.type,
+                resourceId: normalized.resourceId,
+                resourceName: normalized.resourceName,
+                resourceType: normalized.resourceType,
+                accountId: normalized.accountId ?? null,
+                accountName: normalized.accountName ?? null,
+                tags: normalized.tags,
+                severity: normalized.severity,
+                alertName: normalized.alertName,
+                description: normalized.description ?? null,
+                additionalConfiguration: normalized.additionalConfiguration ?? null,
+                downTime: normalized.downTime,
+                aliasId: null,
+                pipelineStatus: "routed", // sync path = fully processed immediately
+                rawPayload: body,
+            });
+            let incidentId = null;
+            try {
+                await this.observabilityService?.recordSuccess({ sourceId: source.id, alertId: row.id });
+            }
+            catch { /* best-effort */ }
+            this.emitSourceUpdated(source.id, "webhook_success");
+            void this.emitTotals("created");
+            if (this.workflowService) {
+                const savedAlert = await this.alertModel.findById(row.id);
+                if (savedAlert) {
+                    this.workflowService.evaluateAndExecute(savedAlert).catch(err => {
+                        console.error("[WorkflowService] evaluateAndExecute error:", err);
+                    });
+                }
+            }
+            return { alertId: row.id, incidentId, queued: false };
+        }
+        catch (e) {
+            const publicErrorMessage = webhookProcessingErrorMessage(e);
+            await this.observabilityService?.recordFailure({
+                ...meta,
+                sourceId: source.id,
+                token,
+                errorCode: "WEBHOOK_PROCESSING_FAILED",
+                errorMessage: publicErrorMessage,
+                payload: body,
+            });
+            this.emitSourceUpdated(source.id, "webhook_failure");
+            throw new Error("WEBHOOK_PROCESSING_FAILED");
+        }
+    }
+    async convert(id, tenantId) {
+        const alert = await this.alertModel.findById(id, tenantId);
+        if (!alert)
+            throw new Error("Alert not found");
+        if (alert.status !== "open") {
+            throw new Error(`Alert cannot be converted: status is "${alert.status}"`);
+        }
+        const incident = await this.incidentModel.create({
+            name: alert.alertName,
+            source: (alert.sourceType || alert.source_type || alert.sourceName || "Unknown").toLowerCase(),
+            resourceName: alert.resourceName,
+            resourceType: alert.resourceType,
+            downMessage: alert.description ?? `Alert on ${alert.resourceName}`,
+            tags: alert.tags ?? {},
+            accountId: alert.accountId ?? null,
+            accountName: alert.accountName ?? alert.account_name ?? null,
+            downTime: alert.downTime instanceof Date
+                ? alert.downTime.toISOString()
+                : String(alert.downTime),
+            alertId: alert.id,
+            assigneeIds: alert.assigneeId ? [alert.assigneeId] : [],
+            tenantId: alert.tenantId ?? null,
+        });
+        await this.alertModel.update(id, {
+            status: "converted",
+            convertedIncidentId: incident.id,
+            incidentId: incident.id,
+        });
+        void this.emitTotals("converted");
+        return { incidentId: incident.id };
+    }
+    async dismiss(id, tenantId) {
+        const existing = await this.alertModel.findById(id, tenantId);
+        if (!existing)
+            throw new Error("Alert not found");
+        await this.alertModel.update(id, { status: "dismissed" });
+        void this.emitTotals("dismissed");
+    }
+    async update(id, data, tenantId) {
+        const existing = await this.alertModel.findById(id, tenantId);
+        if (!existing)
+            throw new Error("Alert not found");
+        await this.alertModel.update(id, data);
+    }
+    async delete(id, tenantId) {
+        const existing = await this.alertModel.findById(id, tenantId);
+        if (!existing)
+            throw new Error("Alert not found");
+        await this.alertModel.delete(id);
+        void this.emitTotals("deleted");
+    }
+}
+//# sourceMappingURL=alert.service.js.map