@scoutflo/alert-correlation 0.1.0

package/README.md

@@ -0,0 +1,34 @@
+# @scoutflo/alert-correlation
+
+Pure alert-to-topology correlation contracts and policies for Scoutflo alert investigation workflows.
+
+This package intentionally owns only shared contracts, extraction, matching, scoring, and decision logic. Provider detail fetching, tenant authorization, topology loading, topology slice construction, and API response shaping stay in Gateway. Investigation lifecycle and supervisor startup stay in Voyager.
+
+## Version
+
+Current package version: `0.1.0`.
+
+Gateway and Voyager should consume the exact published version:
+
+```json
+"@scoutflo/alert-correlation": "0.1.0"
+```
+
+During local development, consumers may temporarily use a `file:` dependency pointed at `../integration-sdk/packages/alert-correlation`, then replace it with the exact npm version before release.
+
+## Release
+
+Build and test before publishing:
+
+```bash
+npm run build --workspace @scoutflo/alert-correlation
+npm test --workspace @scoutflo/alert-correlation
+```
+
+Publish only when explicitly approved:
+
+```bash
+npm publish --workspace @scoutflo/alert-correlation
+```
+
+The package is configured for public npm publishing through its `publishConfig`.

package/dist/src/contracts/alertRef.d.ts

@@ -0,0 +1,21 @@
+import { z } from 'zod';
+export declare const alertRefSchema: z.ZodObject<{
+    integrationId: z.ZodString;
+    provider: z.ZodString;
+    alertKey: z.ZodString;
+    timestamp: z.ZodString;
+    selectedAt: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    integrationId: string;
+    provider: string;
+    alertKey: string;
+    timestamp: string;
+    selectedAt: string;
+}, {
+    integrationId: string;
+    provider: string;
+    alertKey: string;
+    timestamp: string;
+    selectedAt: string;
+}>;
+export type AlertRef = z.infer<typeof alertRefSchema>;

package/dist/src/contracts/alertRef.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.alertRefSchema = void 0;
+const zod_1 = require("zod");
+exports.alertRefSchema = zod_1.z.object({
+    integrationId: zod_1.z.string().min(1),
+    provider: zod_1.z.string().min(1),
+    alertKey: zod_1.z.string().min(1),
+    timestamp: zod_1.z.string().datetime(),
+    selectedAt: zod_1.z.string().datetime(),
+});
+//# sourceMappingURL=alertRef.js.map

package/dist/src/contracts/alertRef.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"alertRef.js","sourceRoot":"","sources":["../../../src/contracts/alertRef.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAEX,QAAA,cAAc,GAAG,OAAC,CAAC,MAAM,CAAC;IACrC,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC"}

package/dist/src/contracts/context.d.ts

@@ -0,0 +1,37 @@
+import type { AlertRef } from './alertRef';
+import type { AlertCorrelationDecision } from './decision';
+import type { AlertCorrelationFacts, AlertTimeWindow } from './facts';
+export interface AlertSummarySnapshot {
+    title?: string;
+    severity?: string;
+    status?: string;
+    description?: string;
+    project?: string;
+    resource?: string;
+}
+export interface AlertCorrelationDiagnostics {
+    providerDetailFetched: boolean;
+    rawTruncated: boolean;
+    extractorName: string;
+    extractorVersion: string;
+    matcherName?: string;
+    matcherVersion?: string;
+    sourceResourceFound: boolean;
+    relationshipCount: number;
+    candidateCount: number;
+    selectedTarget?: {
+        type: 'service' | 'resource';
+        id: string;
+    };
+}
+export interface AlertInvestigationContext {
+    request: AlertRef;
+    time: AlertTimeWindow;
+    summary: AlertSummarySnapshot;
+    facts: AlertCorrelationFacts;
+    resolution: AlertCorrelationDecision;
+    topologySlice: unknown | null;
+    bindingHints: unknown[];
+    diagnostics: AlertCorrelationDiagnostics;
+    reasonCodes: string[];
+}

package/dist/src/contracts/context.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=context.js.map

package/dist/src/contracts/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../../src/contracts/context.ts"],"names":[],"mappings":""}

package/dist/src/contracts/decision.d.ts

@@ -0,0 +1,29 @@
+export type CorrelationStatus = 'resolved' | 'ambiguous' | 'degraded' | 'unresolved';
+export interface CorrelationEvidence {
+    kind: 'relationship_attribute' | 'raw_alert_field' | 'resource_inference' | 'fallback';
+    factKey?: string;
+    factValue?: string;
+    relationshipId?: string;
+    reason: string;
+}
+export interface CorrelationCandidate {
+    target: {
+        type: 'service' | 'resource';
+        id: string;
+    };
+    name?: string;
+    confidence: number;
+    evidence: CorrelationEvidence[];
+    reasonCodes: string[];
+}
+export interface AlertCorrelationDecision {
+    status: CorrelationStatus;
+    target: {
+        type: 'service' | 'resource';
+        id: string;
+    } | null;
+    candidates: CorrelationCandidate[];
+    evidence: CorrelationEvidence[];
+    confidence: number;
+    reasonCodes: string[];
+}

package/dist/src/contracts/decision.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=decision.js.map

package/dist/src/contracts/decision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision.js","sourceRoot":"","sources":["../../../src/contracts/decision.ts"],"names":[],"mappings":""}

package/dist/src/contracts/facts.d.ts

@@ -0,0 +1,32 @@
+export type FactKind = 'label' | 'tag' | 'annotation' | 'provider_identity' | 'resource_hint' | 'text_derived' | 'time';
+export interface Fact {
+    key: string;
+    value: string;
+    sourcePath: string;
+    confidence: number;
+    kind: FactKind;
+}
+export interface AlertTimeWindow {
+    timestamp: string;
+    selectedAt: string;
+    startsAt: string;
+    endsAt?: string;
+    lastSeen?: string;
+    isOpenEnded: boolean;
+}
+export interface AlertCorrelationFacts {
+    provider: string;
+    integrationId: string;
+    alertKey: string;
+    extractor: {
+        name: string;
+        version: string;
+    };
+    time: AlertTimeWindow;
+    labels: Fact[];
+    identifiers: Fact[];
+    resourceHints: Fact[];
+    textHints: Fact[];
+    severity?: Fact;
+    title?: Fact;
+}

package/dist/src/contracts/facts.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=facts.js.map

package/dist/src/contracts/facts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"facts.js","sourceRoot":"","sources":["../../../src/contracts/facts.ts"],"names":[],"mappings":""}

package/dist/src/contracts/index.d.ts

@@ -0,0 +1,5 @@
+export * from './alertRef';
+export * from './facts';
+export * from './topology';
+export * from './decision';
+export * from './context';

package/dist/src/contracts/index.js

@@ -0,0 +1,22 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./alertRef"), exports);
+__exportStar(require("./facts"), exports);
+__exportStar(require("./topology"), exports);
+__exportStar(require("./decision"), exports);
+__exportStar(require("./context"), exports);
+//# sourceMappingURL=index.js.map

package/dist/src/contracts/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/contracts/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,6CAA2B;AAC3B,0CAAwB;AACxB,6CAA2B;AAC3B,6CAA2B;AAC3B,4CAA0B"}

package/dist/src/contracts/topology.d.ts

@@ -0,0 +1,38 @@
+export type CorrelationEntityType = 'service' | 'resource';
+export interface CorrelationTopologyEntityRef {
+    type: CorrelationEntityType;
+    id: string;
+}
+export interface CorrelationService {
+    id: string;
+    name: string;
+    displayName?: string;
+    attributes?: Record<string, unknown>;
+}
+export interface CorrelationTopologyResource {
+    id: string;
+    name: string;
+    provider?: string;
+    resourceType?: string;
+    externalRef?: {
+        provider?: string;
+        externalId?: string;
+        sourceCollection?: string;
+    };
+    attributes?: Record<string, unknown>;
+}
+export interface CorrelationRelationship {
+    id: string;
+    relation: string;
+    from: CorrelationTopologyEntityRef;
+    to: CorrelationTopologyEntityRef;
+    attributeSchemaKey?: string;
+    attributes?: Record<string, unknown>;
+}
+export interface TopologyCandidateInput {
+    sourceResource: CorrelationTopologyResource | null;
+    monitoredByRelationships: CorrelationRelationship[];
+    deployedAsRelationships: CorrelationRelationship[];
+    services: CorrelationService[];
+    resources: CorrelationTopologyResource[];
+}

package/dist/src/contracts/topology.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=topology.js.map

package/dist/src/contracts/topology.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"topology.js","sourceRoot":"","sources":["../../../src/contracts/topology.ts"],"names":[],"mappings":""}

package/dist/src/decision/decideTarget.d.ts

@@ -0,0 +1,3 @@
+import type { AlertCorrelationDecision, CorrelationCandidate } from '../contracts';
+export declare const DETERMINISTIC_CONFIDENCE = 8;
+export declare function decideTarget(candidates: CorrelationCandidate[]): AlertCorrelationDecision;

package/dist/src/decision/decideTarget.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DETERMINISTIC_CONFIDENCE = void 0;
+exports.decideTarget = decideTarget;
+const reasonCodes_1 = require("./reasonCodes");
+exports.DETERMINISTIC_CONFIDENCE = 8;
+function hasTopologyEvidence(candidate) {
+    return candidate.evidence.some((evidence) => evidence.kind === 'relationship_attribute' || evidence.kind === 'resource_inference');
+}
+function sortedCandidates(candidates) {
+    return [...candidates].sort((left, right) => right.confidence - left.confidence);
+}
+function uniqueReasonCodes(candidates, extra = []) {
+    return [...new Set([...candidates.flatMap((candidate) => candidate.reasonCodes), ...extra])];
+}
+function decideTarget(candidates) {
+    const ranked = sortedCandidates(candidates);
+    const best = ranked[0];
+    if (!best) {
+        return {
+            status: 'unresolved',
+            target: null,
+            candidates: [],
+            evidence: [],
+            confidence: 0,
+            reasonCodes: [reasonCodes_1.REASON_CODES.NO_CANDIDATES],
+        };
+    }
+    if (ranked.length === 1 && best.confidence >= exports.DETERMINISTIC_CONFIDENCE && hasTopologyEvidence(best)) {
+        return {
+            status: 'resolved',
+            target: best.target,
+            candidates: ranked,
+            evidence: best.evidence,
+            confidence: best.confidence,
+            reasonCodes: uniqueReasonCodes(ranked, [reasonCodes_1.REASON_CODES.RESOLVED_DETERMINISTIC]),
+        };
+    }
+    return {
+        status: 'ambiguous',
+        target: null,
+        candidates: ranked,
+        evidence: best.evidence,
+        confidence: best.confidence,
+        reasonCodes: uniqueReasonCodes(ranked, [
+            ranked.length > 1 ? reasonCodes_1.REASON_CODES.MULTIPLE_CANDIDATES : reasonCodes_1.REASON_CODES.WEAK_CANDIDATE,
+        ]),
+    };
+}
+//# sourceMappingURL=decideTarget.js.map

package/dist/src/decision/decideTarget.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decideTarget.js","sourceRoot":"","sources":["../../../src/decision/decideTarget.ts"],"names":[],"mappings":";;;AAoBA,oCAoCC;AAvDD,+CAA6C;AAEhC,QAAA,wBAAwB,GAAG,CAAC,CAAC;AAE1C,SAAS,mBAAmB,CAAC,SAA+B;IAC1D,OAAO,SAAS,CAAC,QAAQ,CAAC,IAAI,CAC5B,CAAC,QAAQ,EAAE,EAAE,CACX,QAAQ,CAAC,IAAI,KAAK,wBAAwB,IAAI,QAAQ,CAAC,IAAI,KAAK,oBAAoB,CACvF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,UAAkC;IAC1D,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,iBAAiB,CAAC,UAAkC,EAAE,QAAkB,EAAE;IACjF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED,SAAgB,YAAY,CAAC,UAAkC;IAC7D,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAEvB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,IAAI;YACZ,UAAU,EAAE,EAAE;YACd,QAAQ,EAAE,EAAE;YACZ,UAAU,EAAE,CAAC;YACb,WAAW,EAAE,CAAC,0BAAY,CAAC,aAAa,CAAC;SAC1C,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,IAAI,gCAAwB,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;QACpG,OAAO;YACL,MAAM,EAAE,UAAU;YAClB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,MAAM;YAClB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,WAAW,EAAE,iBAAiB,CAAC,MAAM,EAAE,CAAC,0BAAY,CAAC,sBAAsB,CAAC,CAAC;SAC9E,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,WAAW;QACnB,MAAM,EAAE,IAAI;QACZ,UAAU,EAAE,MAAM;QAClB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,WAAW,EAAE,iBAAiB,CAAC,MAAM,EAAE;YACrC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,0BAAY,CAAC,mBAAmB,CAAC,CAAC,CAAC,0BAAY,CAAC,cAAc;SACnF,CAAC;KACH,CAAC;AACJ,CAAC"}

package/dist/src/decision/reasonCodes.d.ts

@@ -0,0 +1,10 @@
+export declare const REASON_CODES: {
+    readonly NO_CANDIDATES: "no_candidates";
+    readonly RELATIONSHIP_ATTRIBUTE_MATCH: "relationship_attribute_match";
+    readonly RELATIONSHIP_PATTERN_MATCH: "relationship_pattern_match";
+    readonly RAW_LABEL_CANDIDATE: "raw_label_candidate";
+    readonly MULTIPLE_CANDIDATES: "multiple_candidates";
+    readonly WEAK_CANDIDATE: "weak_candidate";
+    readonly RESOLVED_DETERMINISTIC: "resolved_deterministic";
+};
+export type ReasonCode = (typeof REASON_CODES)[keyof typeof REASON_CODES];

package/dist/src/decision/reasonCodes.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REASON_CODES = void 0;
+exports.REASON_CODES = {
+    NO_CANDIDATES: 'no_candidates',
+    RELATIONSHIP_ATTRIBUTE_MATCH: 'relationship_attribute_match',
+    RELATIONSHIP_PATTERN_MATCH: 'relationship_pattern_match',
+    RAW_LABEL_CANDIDATE: 'raw_label_candidate',
+    MULTIPLE_CANDIDATES: 'multiple_candidates',
+    WEAK_CANDIDATE: 'weak_candidate',
+    RESOLVED_DETERMINISTIC: 'resolved_deterministic',
+};
+//# sourceMappingURL=reasonCodes.js.map

package/dist/src/decision/reasonCodes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reasonCodes.js","sourceRoot":"","sources":["../../../src/decision/reasonCodes.ts"],"names":[],"mappings":";;;AAAa,QAAA,YAAY,GAAG;IAC1B,aAAa,EAAE,eAAe;IAC9B,4BAA4B,EAAE,8BAA8B;IAC5D,0BAA0B,EAAE,4BAA4B;IACxD,mBAAmB,EAAE,qBAAqB;IAC1C,mBAAmB,EAAE,qBAAqB;IAC1C,cAAc,EAAE,gBAAgB;IAChC,sBAAsB,EAAE,wBAAwB;CACxC,CAAC"}

package/dist/src/extractors/genericExtractor.d.ts

@@ -0,0 +1,23 @@
+import type { AlertCorrelationFacts, Fact, FactKind } from '../contracts';
+import { type ProviderTimeHints } from '../time/normalizeAlertTime';
+import type { ProviderExtractor, ProviderExtractorInput } from './types';
+type UnknownRecord = Record<string, unknown>;
+export declare const GENERIC_EXTRACTOR_NAME = "generic-extractor";
+export declare const EXTRACTOR_VERSION = "0.1.0";
+export declare function isRecord(value: unknown): value is UnknownRecord;
+export declare function primitiveToString(value: unknown): string | undefined;
+export declare function makeFact(input: {
+    key: string;
+    value: unknown;
+    sourcePath: string;
+    kind: FactKind;
+    confidence?: number;
+}): Fact | undefined;
+export declare function factsFromRecord(value: unknown, sourcePath: string, kind: FactKind, confidence?: number): Fact[];
+export declare function factsFromTagCollection(value: unknown, sourcePath: string): Fact[];
+export declare function getPath(value: unknown, path: string[]): unknown;
+export declare function firstPrimitive(raw: unknown, paths: string[][]): string | undefined;
+export declare function extractProviderTimeHints(raw: unknown): ProviderTimeHints;
+export declare function extractGenericFacts(input: ProviderExtractorInput, extractorName?: string): AlertCorrelationFacts;
+export declare const genericExtractor: ProviderExtractor;
+export {};

package/dist/src/extractors/genericExtractor.js

@@ -0,0 +1,162 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.genericExtractor = exports.EXTRACTOR_VERSION = exports.GENERIC_EXTRACTOR_NAME = void 0;
+exports.isRecord = isRecord;
+exports.primitiveToString = primitiveToString;
+exports.makeFact = makeFact;
+exports.factsFromRecord = factsFromRecord;
+exports.factsFromTagCollection = factsFromTagCollection;
+exports.getPath = getPath;
+exports.firstPrimitive = firstPrimitive;
+exports.extractProviderTimeHints = extractProviderTimeHints;
+exports.extractGenericFacts = extractGenericFacts;
+const normalizeAlertTime_1 = require("../time/normalizeAlertTime");
+exports.GENERIC_EXTRACTOR_NAME = 'generic-extractor';
+exports.EXTRACTOR_VERSION = '0.1.0';
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function primitiveToString(value) {
+    if (typeof value === 'string')
+        return value;
+    if (typeof value === 'number' || typeof value === 'boolean')
+        return String(value);
+    return undefined;
+}
+function makeFact(input) {
+    const value = primitiveToString(input.value);
+    if (!value)
+        return undefined;
+    return {
+        key: input.key,
+        value,
+        sourcePath: input.sourcePath,
+        confidence: input.confidence ?? 0.7,
+        kind: input.kind,
+    };
+}
+function factsFromRecord(value, sourcePath, kind, confidence = 0.7) {
+    if (!isRecord(value))
+        return [];
+    return Object.entries(value)
+        .map(([key, entry]) => makeFact({
+        key,
+        value: entry,
+        sourcePath: `${sourcePath}.${key}`,
+        kind,
+        confidence,
+    }))
+        .filter((fact) => Boolean(fact));
+}
+function factsFromTagCollection(value, sourcePath) {
+    if (Array.isArray(value)) {
+        return value
+            .map((entry, index) => {
+            if (!isRecord(entry))
+                return undefined;
+            const key = primitiveToString(entry.key) ?? primitiveToString(entry.name);
+            if (!key)
+                return undefined;
+            return makeFact({
+                key,
+                value: entry.value,
+                sourcePath: `${sourcePath}[${index}]`,
+                kind: 'tag',
+                confidence: 0.72,
+            });
+        })
+            .filter((fact) => Boolean(fact));
+    }
+    return factsFromRecord(value, sourcePath, 'tag', 0.72);
+}
+function getPath(value, path) {
+    let cursor = value;
+    for (const segment of path) {
+        if (!isRecord(cursor))
+            return undefined;
+        cursor = cursor[segment];
+    }
+    return cursor;
+}
+function firstPrimitive(raw, paths) {
+    for (const path of paths) {
+        const value = primitiveToString(getPath(raw, path));
+        if (value)
+            return value;
+    }
+    return undefined;
+}
+function extractProviderTimeHints(raw) {
+    return {
+        startsAt: firstPrimitive(raw, [['startsAt']]),
+        firstSeen: firstPrimitive(raw, [['firstSeen'], ['first_seen'], ['dateCreated']]),
+        eventTimestamp: firstPrimitive(raw, [['eventTimestamp'], ['event_time'], ['timestamp']]),
+        endsAt: firstPrimitive(raw, [['endsAt'], ['endedAt']]),
+        lastSeen: firstPrimitive(raw, [['lastSeen'], ['last_seen'], ['dateUpdated']]),
+    };
+}
+function extractGenericFacts(input, extractorName = exports.GENERIC_EXTRACTOR_NAME) {
+    const raw = input.raw;
+    const labels = [
+        ...factsFromRecord(getPath(raw, ['labels']), 'raw.labels', 'label', 0.75),
+        ...factsFromRecord(getPath(raw, ['commonLabels']), 'raw.commonLabels', 'label', 0.75),
+        ...factsFromTagCollection(getPath(raw, ['tags']), 'raw.tags'),
+    ];
+    const textHints = [
+        ...factsFromRecord(getPath(raw, ['annotations']), 'raw.annotations', 'annotation', 0.6),
+    ];
+    const title = makeFact({
+        key: 'title',
+        value: firstPrimitive(raw, [['title'], ['name']]) ?? input.summary?.title,
+        sourcePath: firstPrimitive(raw, [['title']])
+            ? 'raw.title'
+            : firstPrimitive(raw, [['name']])
+                ? 'raw.name'
+                : 'summary.title',
+        kind: 'text_derived',
+        confidence: 0.8,
+    }) ?? undefined;
+    const severity = makeFact({
+        key: 'severity',
+        value: firstPrimitive(raw, [['severity'], ['level']]) ?? input.summary?.severity,
+        sourcePath: firstPrimitive(raw, [['severity']])
+            ? 'raw.severity'
+            : firstPrimitive(raw, [['level']])
+                ? 'raw.level'
+                : 'summary.severity',
+        kind: 'label',
+        confidence: 0.7,
+    }) ?? undefined;
+    const resourceHints = [
+        makeFact({
+            key: 'resource',
+            value: firstPrimitive(raw, [['resource']]) ?? input.summary?.resource,
+            sourcePath: firstPrimitive(raw, [['resource']]) ? 'raw.resource' : 'summary.resource',
+            kind: 'resource_hint',
+            confidence: 0.65,
+        }),
+    ].filter((fact) => Boolean(fact));
+    return {
+        provider: input.alertRef.provider,
+        integrationId: input.alertRef.integrationId,
+        alertKey: input.alertRef.alertKey,
+        extractor: {
+            name: extractorName,
+            version: exports.EXTRACTOR_VERSION,
+        },
+        time: (0, normalizeAlertTime_1.normalizeAlertTime)(input.alertRef, extractProviderTimeHints(raw)),
+        labels,
+        identifiers: [],
+        resourceHints,
+        textHints,
+        ...(severity ? { severity } : {}),
+        ...(title ? { title } : {}),
+    };
+}
+exports.genericExtractor = {
+    provider: '*',
+    name: exports.GENERIC_EXTRACTOR_NAME,
+    version: exports.EXTRACTOR_VERSION,
+    extract: (input) => extractGenericFacts(input),
+};
+//# sourceMappingURL=genericExtractor.js.map

package/dist/src/extractors/genericExtractor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"genericExtractor.js","sourceRoot":"","sources":["../../../src/extractors/genericExtractor.ts"],"names":[],"mappings":";;;AASA,4BAEC;AAED,8CAIC;AAED,4BAiBC;AAED,0CAmBC;AAED,wDAmBC;AAED,0BAOC;AAED,wCAMC;AAED,4DAQC;AAED,kDAkEC;AA5KD,mEAAwF;AAK3E,QAAA,sBAAsB,GAAG,mBAAmB,CAAC;AAC7C,QAAA,iBAAiB,GAAG,OAAO,CAAC;AAEzC,SAAgB,QAAQ,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAgB,iBAAiB,CAAC,KAAc;IAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IAClF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAgB,QAAQ,CAAC,KAMxB;IACC,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAE7B,OAAO;QACL,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,KAAK;QACL,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,GAAG;QACnC,IAAI,EAAE,KAAK,CAAC,IAAI;KACjB,CAAC;AACJ,CAAC;AAED,SAAgB,eAAe,CAC7B,KAAc,EACd,UAAkB,EAClB,IAAc,EACd,UAAU,GAAG,GAAG;IAEhB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEhC,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;SACzB,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CACpB,QAAQ,CAAC;QACP,GAAG;QACH,KAAK,EAAE,KAAK;QACZ,UAAU,EAAE,GAAG,UAAU,IAAI,GAAG,EAAE;QAClC,IAAI;QACJ,UAAU;KACX,CAAC,CACH;SACA,MAAM,CAAC,CAAC,IAAI,EAAgB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,SAAgB,sBAAsB,CAAC,KAAc,EAAE,UAAkB;IACvE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK;aACT,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACpB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAC;YACvC,MAAM,GAAG,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC1E,IAAI,CAAC,GAAG;gBAAE,OAAO,SAAS,CAAC;YAC3B,OAAO,QAAQ,CAAC;gBACd,GAAG;gBACH,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,UAAU,EAAE,GAAG,UAAU,IAAI,KAAK,GAAG;gBACrC,IAAI,EAAE,KAAK;gBACX,UAAU,EAAE,IAAI;aACjB,CAAC,CAAC;QACL,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,IAAI,EAAgB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,OAAO,eAAe,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AACzD,CAAC;AAED,SAAgB,OAAO,CAAC,KAAc,EAAE,IAAc;IACpD,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,MAAM,OAAO,IAAI,IAAI,EAAE,CAAC;QAC3B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAC;QACxC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAgB,cAAc,CAAC,GAAY,EAAE,KAAiB;IAC5D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACpD,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAgB,wBAAwB,CAAC,GAAY;IACnD,OAAO;QACL,QAAQ,EAAE,cAAc,CAAC,GAAG,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QAC7C,SAAS,EAAE,cAAc,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;QAChF,cAAc,EAAE,cAAc,CAAC,GAAG,EAAE,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;QACxF,MAAM,EAAE,cAAc,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QACtD,QAAQ,EAAE,cAAc,CAAC,GAAG,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;KAC9E,CAAC;AACJ,CAAC;AAED,SAAgB,mBAAmB,CACjC,KAA6B,EAC7B,aAAa,GAAG,8BAAsB;IAEtC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACtB,MAAM,MAAM,GAAG;QACb,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC;QACzE,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,EAAE,IAAI,CAAC;QACrF,GAAG,sBAAsB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,UAAU,CAAC;KAC9D,CAAC;IACF,MAAM,SAAS,GAAG;QAChB,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,iBAAiB,EAAE,YAAY,EAAE,GAAG,CAAC;KACxF,CAAC;IAEF,MAAM,KAAK,GACT,QAAQ,CAAC;QACP,GAAG,EAAE,OAAO;QACZ,KAAK,EAAE,cAAc,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,KAAK;QACzE,UAAU,EAAE,cAAc,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;YAC1C,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC/B,CAAC,CAAC,UAAU;gBACZ,CAAC,CAAC,eAAe;QACrB,IAAI,EAAE,cAAc;QACpB,UAAU,EAAE,GAAG;KAChB,CAAC,IAAI,SAAS,CAAC;IAElB,MAAM,QAAQ,GACZ,QAAQ,CAAC;QACP,GAAG,EAAE,UAAU;QACf,KAAK,EAAE,cAAc,CAAC,GAAG,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,QAAQ;QAChF,UAAU,EAAE,cAAc,CAAC,GAAG,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;YAC7C,CAAC,CAAC,cAAc;YAChB,CAAC,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;gBAChC,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,kBAAkB;QACxB,IAAI,EAAE,OAAO;QACb,UAAU,EAAE,GAAG;KAChB,CAAC,IAAI,SAAS,CAAC;IAElB,MAAM,aAAa,GAAG;QACpB,QAAQ,CAAC;YACP,GAAG,EAAE,UAAU;YACf,KAAK,EAAE,cAAc,CAAC,GAAG,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,QAAQ;YACrE,UAAU,EAAE,cAAc,CAAC,GAAG,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,kBAAkB;YACrF,IAAI,EAAE,eAAe;YACrB,UAAU,EAAE,IAAI;SACjB,CAAC;KACH,CAAC,MAAM,CAAC,CAAC,IAAI,EAAgB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAEhD,OAAO;QACL,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ;QACjC,aAAa,EAAE,KAAK,CAAC,QAAQ,CAAC,aAAa;QAC3C,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ;QACjC,SAAS,EAAE;YACT,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,yBAAiB;SAC3B;QACD,IAAI,EAAE,IAAA,uCAAkB,EAAC,KAAK,CAAC,QAAQ,EAAE,wBAAwB,CAAC,GAAG,CAAC,CAAC;QACvE,MAAM;QACN,WAAW,EAAE,EAAE;QACf,aAAa;QACb,SAAS;QACT,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5B,CAAC;AACJ,CAAC;AAEY,QAAA,gBAAgB,GAAsB;IACjD,QAAQ,EAAE,GAAG;IACb,IAAI,EAAE,8BAAsB;IAC5B,OAAO,EAAE,yBAAiB;IAC1B,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,mBAAmB,CAAC,KAAK,CAAC;CAC/C,CAAC"}

package/dist/src/extractors/prometheusExtractor.d.ts

@@ -0,0 +1,4 @@
+import type { AlertCorrelationFacts } from '../contracts';
+import type { ProviderExtractor, ProviderExtractorInput } from './types';
+export declare function extractPrometheusCompatibleFacts(input: ProviderExtractorInput, extractorName: string): AlertCorrelationFacts;
+export declare const prometheusExtractor: ProviderExtractor;