clustering

type AlertCluster struct {
	ID            string
	CenterAlertID types.AlertID   // ID of the alert closest to the cluster center
	AlertIDs      []types.AlertID // IDs of all alerts in the cluster
	Size          int
	Keywords      []string // Common keywords (optional)
}

type ClusteringResult struct {
	Clusters      []*AlertCluster
	NoiseAlertIDs []types.AlertID // IDs of alerts that don't belong to any cluster
	Parameters    DBSCANParams
}

type DBSCANParams struct {
	Eps        float64 // Maximum distance between two samples for one to be considered as in the neighborhood
	MinSamples int     // Minimum number of samples in a neighborhood for a point to be considered as a core point
}

type Service interface {
	// ClusterAlerts performs DBSCAN clustering on alerts using their embedding vectors
	// Note: Only unbound alerts (TicketID == nil) should be included
	ClusterAlerts(ctx context.Context, alerts []*alert.Alert, params DBSCANParams) (*ClusteringResult, error)

	// FindCenterAlert finds the alert closest to the cluster center
	FindCenterAlert(ctx context.Context, alerts []*alert.Alert) (*alert.Alert, error)

	// ExtractKeywords extracts common keywords from alerts (optional)
	ExtractKeywords(ctx context.Context, alerts []*alert.Alert, limit int) ([]string, error)
}