module.exports = {
  name: 'high-memory-auto-heal',
  
  // When does this rule apply?
  match: (alert) => {
    return alert.type === 'HIGH_MEMORY_USAGE' 
      && alert.service !== 'database'  // Never auto-restart DB
      && alert.value < 95;             // Below critical threshold
  },
  
  // How confident are we in auto-healing?
  confidence: (alert, context) => {
    let score = 0.7;  // Base confidence
    
    // Boost if we've seen this exact pattern before
    if (context.previousOccurrences > 5) score += 0.1;
    
    // Reduce if it's been flapping
    if (context.alertsLastHour > 3) score -= 0.2;
    
    // Reduce during business hours (more cautious)
    if (isBusinessHours()) score -= 0.1;
    
    return Math.min(Math.max(score, 0), 1);
  },
  
  // What do we do if confidence > threshold?
  action: async (alert, context) => {
    // 1. Take a memory snapshot first
    await diagnostics.captureHeapSnapshot(alert.service);
    
    // 2. Gracefully restart the service
    await kubernetes.rolloutRestart(alert.service);
    
    // 3. Wait for health check
    await health.waitForReady(alert.service, { timeout: 120 });
    
    // 4. Verify memory is actually lower
    const newMemory = await metrics.getMemoryUsage(alert.service);
    
    return {
      success: newMemory < alert.value,
      action: 'rollout-restart',
      beforeMemory: alert.value,
      afterMemory: newMemory
    };
  }
};

const runbook = {
  name: 'disk-space-cleanup',
  description: 'Automated disk space recovery',
  
  steps: [
    {
      name: 'Identify large files',
      action: async (ctx) => {
        const largeFiles = await ssh.exec(ctx.host, 
          'find /var/log -size +100M -type f'
        );
        ctx.largeFiles = largeFiles;
        return { found: largeFiles.length };
      }
    },
    {
      name: 'Rotate logs',
      action: async (ctx) => {
        await ssh.exec(ctx.host, 'logrotate -f /etc/logrotate.conf');
        return { rotated: true };
      }
    },
    {
      name: 'Clear old temp files',
      action: async (ctx) => {
        // Only delete files older than 7 days
        const deleted = await ssh.exec(ctx.host,
          'find /tmp -type f -mtime +7 -delete -print | wc -l'
        );
        return { deletedCount: parseInt(deleted) };
      }
    },
    {
      name: 'Clear Docker artifacts',
      condition: (ctx) => ctx.hasDocker,
      action: async (ctx) => {
        await ssh.exec(ctx.host, 'docker system prune -f');
        return { pruned: true };
      }
    },
    {
      name: 'Verify space recovered',
      action: async (ctx) => {
        const newUsage = await metrics.getDiskUsage(ctx.host);
        const recovered = ctx.originalUsage - newUsage;
        return { 
          newUsage,
          recoveredGB: (recovered / 1024).toFixed(2)
        };
      }
    }
  ],
  
  rollback: async (ctx, failedStep) => {
    // Disk cleanup is generally safe, but log what happened
    await slack.post('#ops-alerts', 
      `Disk cleanup failed at step: ${failedStep.name}`
    );
  }
};