@scoutflo/alert-correlation 0.2.0 → 0.2.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +11 -3
- package/dist/src/contracts/decision.d.ts +4 -9
- package/dist/src/contracts/facts.d.ts +3 -6
- package/dist/src/contracts/topology.d.ts +3 -5
- package/dist/src/index.d.ts +1 -0
- package/dist/src/index.js +24 -1
- package/dist/src/index.js.map +1 -1
- package/dist/test/core-compatibility.test.d.ts +1 -0
- package/dist/test/core-compatibility.test.js +50 -0
- package/dist/test/core-compatibility.test.js.map +1 -0
- package/package.json +2 -1
package/README.md
CHANGED
|
@@ -4,14 +4,22 @@ Pure alert-to-topology correlation contracts and policies for Scoutflo alert inv
|
|
|
4
4
|
|
|
5
5
|
This package intentionally owns only shared contracts, extraction, matching, scoring, and decision logic. Provider detail fetching, tenant authorization, topology loading, topology slice construction, and API response shaping stay in Gateway. Investigation lifecycle and supervisor startup stay in Voyager.
|
|
6
6
|
|
|
7
|
+
## Relationship To Correlation Core
|
|
8
|
+
|
|
9
|
+
Reusable cross-mode contracts live in `@scoutflo/correlation-core`.
|
|
10
|
+
|
|
11
|
+
`@scoutflo/alert-correlation` remains alert-specific. It owns `AlertRef`, alert time windows, provider alert extractors, alert-to-topology matching, alert-specific scoring, and alert decision behavior.
|
|
12
|
+
|
|
13
|
+
This package consumes core entity, fact, and status primitives where safe. It also exports `correlationCore` as a namespace for compatibility during migration, without replacing existing alert-specific export names.
|
|
14
|
+
|
|
7
15
|
## Version
|
|
8
16
|
|
|
9
|
-
Current package version: `0.2.
|
|
17
|
+
Current package version: `0.2.1`.
|
|
10
18
|
|
|
11
19
|
Gateway and Voyager should consume the exact published version:
|
|
12
20
|
|
|
13
21
|
```json
|
|
14
|
-
"@scoutflo/alert-correlation": "0.2.
|
|
22
|
+
"@scoutflo/alert-correlation": "0.2.1"
|
|
15
23
|
```
|
|
16
24
|
|
|
17
25
|
During local development, consumers may temporarily use a `file:` dependency pointed at `../integration-sdk/packages/alert-correlation`, then replace it with the exact npm version before release.
|
|
@@ -88,7 +96,7 @@ If `npm view` returns `E404` immediately after a successful publish, wait and re
|
|
|
88
96
|
After the version is visible, update Gateway and Voyager from any local `file:` dependency to the exact published version, for example:
|
|
89
97
|
|
|
90
98
|
```json
|
|
91
|
-
"@scoutflo/alert-correlation": "0.2.
|
|
99
|
+
"@scoutflo/alert-correlation": "0.2.1"
|
|
92
100
|
```
|
|
93
101
|
|
|
94
102
|
Run install and the relevant tests in each consumer repo after updating its dependency lockfile.
|
|
@@ -1,4 +1,5 @@
|
|
|
1
|
-
|
|
1
|
+
import type { CorrelationEntityRef, CorrelationStatus as CoreCorrelationStatus } from '@scoutflo/correlation-core';
|
|
2
|
+
export type CorrelationStatus = Extract<CoreCorrelationStatus, 'resolved' | 'ambiguous' | 'degraded' | 'unresolved'>;
|
|
2
3
|
export interface CorrelationEvidence {
|
|
3
4
|
kind: 'relationship_attribute' | 'raw_alert_field' | 'resource_inference' | 'fallback';
|
|
4
5
|
factKey?: string;
|
|
@@ -7,10 +8,7 @@ export interface CorrelationEvidence {
|
|
|
7
8
|
reason: string;
|
|
8
9
|
}
|
|
9
10
|
export interface CorrelationCandidate {
|
|
10
|
-
target:
|
|
11
|
-
type: 'service' | 'resource';
|
|
12
|
-
id: string;
|
|
13
|
-
};
|
|
11
|
+
target: CorrelationEntityRef;
|
|
14
12
|
name?: string;
|
|
15
13
|
confidence: number;
|
|
16
14
|
evidence: CorrelationEvidence[];
|
|
@@ -18,10 +16,7 @@ export interface CorrelationCandidate {
|
|
|
18
16
|
}
|
|
19
17
|
export interface AlertCorrelationDecision {
|
|
20
18
|
status: CorrelationStatus;
|
|
21
|
-
target:
|
|
22
|
-
type: 'service' | 'resource';
|
|
23
|
-
id: string;
|
|
24
|
-
} | null;
|
|
19
|
+
target: CorrelationEntityRef | null;
|
|
25
20
|
candidates: CorrelationCandidate[];
|
|
26
21
|
evidence: CorrelationEvidence[];
|
|
27
22
|
confidence: number;
|
|
@@ -1,9 +1,6 @@
|
|
|
1
|
-
|
|
2
|
-
export
|
|
3
|
-
|
|
4
|
-
value: string;
|
|
5
|
-
sourcePath: string;
|
|
6
|
-
confidence: number;
|
|
1
|
+
import type { CorrelationFact, FactKind as CoreFactKind } from '@scoutflo/correlation-core';
|
|
2
|
+
export type FactKind = Extract<CoreFactKind, 'label' | 'tag' | 'annotation' | 'provider_identity' | 'resource_hint' | 'text_derived' | 'time'>;
|
|
3
|
+
export interface Fact extends Omit<CorrelationFact, 'kind'> {
|
|
7
4
|
kind: FactKind;
|
|
8
5
|
}
|
|
9
6
|
export interface AlertTimeWindow {
|
|
@@ -1,8 +1,6 @@
|
|
|
1
|
-
|
|
2
|
-
export
|
|
3
|
-
|
|
4
|
-
id: string;
|
|
5
|
-
}
|
|
1
|
+
import type { CorrelationEntityRef, CorrelationEntityType } from '@scoutflo/correlation-core';
|
|
2
|
+
export type { CorrelationEntityType };
|
|
3
|
+
export type CorrelationTopologyEntityRef = CorrelationEntityRef;
|
|
6
4
|
export interface CorrelationService {
|
|
7
5
|
id: string;
|
|
8
6
|
name: string;
|
package/dist/src/index.d.ts
CHANGED
package/dist/src/index.js
CHANGED
|
@@ -10,12 +10,35 @@ var __createBinding = (this && this.__createBinding) || (Object.create ? (functi
|
|
|
10
10
|
if (k2 === undefined) k2 = k;
|
|
11
11
|
o[k2] = m[k];
|
|
12
12
|
}));
|
|
13
|
+
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
|
|
14
|
+
Object.defineProperty(o, "default", { enumerable: true, value: v });
|
|
15
|
+
}) : function(o, v) {
|
|
16
|
+
o["default"] = v;
|
|
17
|
+
});
|
|
18
|
+
var __importStar = (this && this.__importStar) || (function () {
|
|
19
|
+
var ownKeys = function(o) {
|
|
20
|
+
ownKeys = Object.getOwnPropertyNames || function (o) {
|
|
21
|
+
var ar = [];
|
|
22
|
+
for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
|
|
23
|
+
return ar;
|
|
24
|
+
};
|
|
25
|
+
return ownKeys(o);
|
|
26
|
+
};
|
|
27
|
+
return function (mod) {
|
|
28
|
+
if (mod && mod.__esModule) return mod;
|
|
29
|
+
var result = {};
|
|
30
|
+
if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
|
|
31
|
+
__setModuleDefault(result, mod);
|
|
32
|
+
return result;
|
|
33
|
+
};
|
|
34
|
+
})();
|
|
13
35
|
var __exportStar = (this && this.__exportStar) || function(m, exports) {
|
|
14
36
|
for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
|
|
15
37
|
};
|
|
16
38
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
17
|
-
exports.ALERT_CORRELATION_PACKAGE = void 0;
|
|
39
|
+
exports.correlationCore = exports.ALERT_CORRELATION_PACKAGE = void 0;
|
|
18
40
|
exports.ALERT_CORRELATION_PACKAGE = '@scoutflo/alert-correlation';
|
|
41
|
+
exports.correlationCore = __importStar(require("@scoutflo/correlation-core"));
|
|
19
42
|
__exportStar(require("./contracts/alertRef"), exports);
|
|
20
43
|
__exportStar(require("./contracts/facts"), exports);
|
|
21
44
|
__exportStar(require("./contracts/topology"), exports);
|
package/dist/src/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAa,QAAA,yBAAyB,GAAG,6BAA6B,CAAC;AAEvE,8EAA8D;AAE9D,uDAAqC;AACrC,oDAAkC;AAClC,uDAAqC;AACrC,uDAAqC;AACrC,sDAAoC;AACpC,4DAA0C;AAC1C,qDAAmC;AACnC,gEAA8C;AAC9C,mEAAiD;AACjD,+DAA6C;AAC7C,wEAAsD;AACtD,wDAAsC;AACtC,yDAAuC;AACvC,0DAAwC;AACxC,mDAAiC;AACjC,yEAAuD;AACvD,4DAA0C"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
export {};
|
|
@@ -0,0 +1,50 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
var __importDefault = (this && this.__importDefault) || function (mod) {
|
|
3
|
+
return (mod && mod.__esModule) ? mod : { "default": mod };
|
|
4
|
+
};
|
|
5
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
6
|
+
const strict_1 = __importDefault(require("node:assert/strict"));
|
|
7
|
+
const node_test_1 = __importDefault(require("node:test"));
|
|
8
|
+
const src_1 = require("../src");
|
|
9
|
+
(0, node_test_1.default)('alert facts remain core fact compatible', () => {
|
|
10
|
+
const fact = {
|
|
11
|
+
key: 'service',
|
|
12
|
+
value: 'checkout',
|
|
13
|
+
sourcePath: 'labels.service',
|
|
14
|
+
confidence: 0.8,
|
|
15
|
+
kind: 'label',
|
|
16
|
+
};
|
|
17
|
+
const parsed = src_1.correlationCore.correlationFactSchema.parse(fact);
|
|
18
|
+
strict_1.default.equal(parsed.key, 'service');
|
|
19
|
+
strict_1.default.equal(parsed.kind, 'label');
|
|
20
|
+
});
|
|
21
|
+
(0, node_test_1.default)('alert topology entity refs use the core entity ref shape', () => {
|
|
22
|
+
const ref = {
|
|
23
|
+
type: 'service',
|
|
24
|
+
id: 'svc-checkout',
|
|
25
|
+
};
|
|
26
|
+
const parsed = src_1.correlationCore.correlationEntityRefSchema.parse(ref);
|
|
27
|
+
strict_1.default.deepEqual(parsed, ref);
|
|
28
|
+
});
|
|
29
|
+
(0, node_test_1.default)('alert decisions preserve legacy confidence candidate shape', () => {
|
|
30
|
+
const candidate = {
|
|
31
|
+
target: { type: 'service', id: 'svc-checkout' },
|
|
32
|
+
name: 'checkout',
|
|
33
|
+
confidence: 10,
|
|
34
|
+
evidence: [
|
|
35
|
+
{
|
|
36
|
+
kind: 'relationship_attribute',
|
|
37
|
+
factKey: 'service',
|
|
38
|
+
factValue: 'checkout',
|
|
39
|
+
relationshipId: 'rel-1',
|
|
40
|
+
reason: 'serviceLabel exact match',
|
|
41
|
+
},
|
|
42
|
+
],
|
|
43
|
+
reasonCodes: ['relationship_attribute_match'],
|
|
44
|
+
};
|
|
45
|
+
const decision = (0, src_1.decideTarget)([candidate]);
|
|
46
|
+
strict_1.default.equal(decision.status, 'resolved');
|
|
47
|
+
strict_1.default.equal(decision.confidence, 10);
|
|
48
|
+
strict_1.default.deepEqual(decision.target, { type: 'service', id: 'svc-checkout' });
|
|
49
|
+
});
|
|
50
|
+
//# sourceMappingURL=core-compatibility.test.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"core-compatibility.test.js","sourceRoot":"","sources":["../../test/core-compatibility.test.ts"],"names":[],"mappings":";;;;;AAAA,gEAAwC;AACxC,0DAA6B;AAC7B,gCAOgB;AAEhB,IAAA,mBAAI,EAAC,yCAAyC,EAAE,GAAG,EAAE;IACnD,MAAM,IAAI,GAAS;QACjB,GAAG,EAAE,SAAS;QACd,KAAK,EAAE,UAAU;QACjB,UAAU,EAAE,gBAAgB;QAC5B,UAAU,EAAE,GAAG;QACf,IAAI,EAAE,OAAO;KACd,CAAC;IAEF,MAAM,MAAM,GAAG,qBAAe,CAAC,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAEjE,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACpC,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACrC,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,0DAA0D,EAAE,GAAG,EAAE;IACpE,MAAM,GAAG,GAAiC;QACxC,IAAI,EAAE,SAAS;QACf,EAAE,EAAE,cAAc;KACnB,CAAC;IAEF,MAAM,MAAM,GAAG,qBAAe,CAAC,0BAA0B,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAErE,gBAAM,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAChC,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,4DAA4D,EAAE,GAAG,EAAE;IACtE,MAAM,SAAS,GAAyB;QACtC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,cAAc,EAAE;QAC/C,IAAI,EAAE,UAAU;QAChB,UAAU,EAAE,EAAE;QACd,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,wBAAwB;gBAC9B,OAAO,EAAE,SAAS;gBAClB,SAAS,EAAE,UAAU;gBACrB,cAAc,EAAE,OAAO;gBACvB,MAAM,EAAE,0BAA0B;aACnC;SACF;QACD,WAAW,EAAE,CAAC,8BAA8B,CAAC;KAC9C,CAAC;IAEF,MAAM,QAAQ,GAA6B,IAAA,kBAAY,EAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAErE,gBAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC1C,gBAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACtC,gBAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC;AAC7E,CAAC,CAAC,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@scoutflo/alert-correlation",
|
|
3
|
-
"version": "0.2.
|
|
3
|
+
"version": "0.2.1",
|
|
4
4
|
"description": "Pure alert-to-topology correlation contracts and policies for Scoutflo alert investigation workflows.",
|
|
5
5
|
"main": "dist/src/index.js",
|
|
6
6
|
"types": "dist/src/index.d.ts",
|
|
@@ -19,6 +19,7 @@
|
|
|
19
19
|
"author": "Scoutflo",
|
|
20
20
|
"license": "MIT",
|
|
21
21
|
"dependencies": {
|
|
22
|
+
"@scoutflo/correlation-core": "0.1.0",
|
|
22
23
|
"zod": "^3.23.8"
|
|
23
24
|
},
|
|
24
25
|
"devDependencies": {
|