@x12i/map-store-client 0.1.2 → 0.1.4

package/dist/estate/localStories.js

@@ -0,0 +1,980 @@
+import { getTemplate, validateInput } from '@x12i/storyflowix';
+import { predictionDiagram, predictionStepsFrom, tacticColumn } from './predictedAttack';
+function asRecord(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : null;
+}
+function list(value) {
+    return Array.isArray(value) ? value : [];
+}
+function text(value) {
+    if (typeof value === 'string')
+        return value.trim() || null;
+    if (typeof value === 'number' && Number.isFinite(value))
+        return String(value);
+    return null;
+}
+function count(value) {
+    return typeof value === 'number' && Number.isFinite(value) ? value : null;
+}
+/** Strings in a list, or the `value` of `{ value }` claim items. */
+function texts(value) {
+    return list(value).flatMap((item) => {
+        const own = text(item) ?? text(asRecord(item)?.value);
+        return own ? [own] : [];
+    });
+}
+/** `NO_PATH_EVIDENCE` or `no-nrts-cidr-match` as words. */
+function human(code) {
+    const raw = text(code);
+    if (!raw)
+        return null;
+    if (!/^[A-Za-z0-9_\-:]+$/.test(raw) || !/[_-]/.test(raw))
+        return raw;
+    const words = raw.replace(/[_-]+/g, ' ').trim().toLowerCase();
+    return words ? words[0].toUpperCase() + words.slice(1) : raw;
+}
+/** First sentence, clipped for a node label. */
+function brief(value, max = 80) {
+    const first = value.split(/(?<=[.!?])\s/)[0] ?? value;
+    return first.length > max ? `${first.slice(0, max - 1).trimEnd()}…` : first;
+}
+function tone(code) {
+    const raw = (text(code) ?? '').toUpperCase();
+    if (/^(REACHABLE|EXPLOITABLE|EXPEDITE|CRITICAL|CONFIRMED|HIGH)$/.test(raw))
+        return 'crit';
+    if (/^(BLOCKED|NOT_REACHABLE|NOT_EXPLOITABLE|CLOSED|RESOLVED|SAFE)$/.test(raw))
+        return 'ok';
+    if (/^(POSSIBLE|SCHEDULE|UNCONFIRMED|MEDIUM|AMBIGUOUS|UNRESOLVED|UNRESOLVED_IDENTITY)$/.test(raw))
+        return 'warn';
+    return 'neutral';
+}
+function facts(rows) {
+    return rows.flatMap(([label, value]) => {
+        const shown = human(value) ?? (Array.isArray(value) ? texts(value).join(', ') || null : null);
+        return shown ? [[label, shown]] : [];
+    });
+}
+function rowsOf(contents, contentType) {
+    return contents.get(contentType) ?? [];
+}
+function rowOf(contents, contentType, match) {
+    const rows = rowsOf(contents, contentType);
+    return (match ? rows.find(match) : rows[0]) ?? null;
+}
+function analysis(contents, analysisType) {
+    return rowOf(contents, 'analysis', (row) => row.analysisType === analysisType);
+}
+function narrative(row, kind) {
+    const items = list(asRecord(row?.itemContext)?.narratives);
+    for (const item of items) {
+        const rec = asRecord(item);
+        if (rec?.kind === kind)
+            return text(rec.text);
+    }
+    return null;
+}
+function securityContext(contents) {
+    return rowOf(contents, 'security-context');
+}
+function subjectName(contents, fallback) {
+    const inv = rowOf(contents, 'inventory');
+    const identity = asRecord(securityContext(contents)?.identity);
+    const named = text(inv?.displayName) ??
+        text(inv?.subjectDisplayName) ??
+        text(inv?.title) ??
+        text(identity?.displayName) ??
+        texts(inv?.addresses)[0] ??
+        texts(identity?.addresses)[0];
+    if (named)
+        return named;
+    const absence = narrative(inv, 'absence');
+    const referred = absence?.match(/Refer to it as ([^.]+)\./)?.[1];
+    return referred?.trim() || fallback;
+}
+function assessmentGaps(row) {
+    return texts(asRecord(row?.assessment)?.gaps);
+}
+function ledger(contents) {
+    const sc = securityContext(contents);
+    const fromContext = list(sc?.completenessLedger);
+    const rows = fromContext.length ? fromContext : list(rowOf(contents, 'field-completeness')?.completenessLedger);
+    return rows.flatMap((item) => (asRecord(item) ? [item] : []));
+}
+function zoneEntry(contents) {
+    return ledger(contents).find((item) => item.dimension === 'network-zone') ?? null;
+}
+function ledgerGaps(contents) {
+    return ledger(contents).flatMap((item) => {
+        if (item.status !== 'MISSING')
+            return [];
+        const what = human(item.dimension) ?? 'A field';
+        const why = human(item.reasonCode);
+        return [why ? `${what} is missing: ${why.toLowerCase()}.` : `${what} is missing.`];
+    });
+}
+function used(contents, types) {
+    return types.filter((type) => rowsOf(contents, type).length > 0);
+}
+function uniqueGaps(gaps, max = 8) {
+    return [...new Set(gaps.map((gap) => gap.trim()).filter(Boolean))].slice(0, max);
+}
+function verdictCounts(sc) {
+    const summary = asRecord(asRecord(asRecord(sc?.exploitability)?.context)?.exploitabilityContextSummary);
+    return { findings: count(summary?.findingCount), cves: count(summary?.cveCount), verdicts: asRecord(summary?.localVerdicts) };
+}
+function assetTriage(contents) {
+    return rowOf(contents, 'triage', (row) => row.urgency != null || row.decisionType === 'asset-triage');
+}
+function assetSituation(contents) {
+    const sc = securityContext(contents);
+    const inv = rowOf(contents, 'inventory');
+    if (!sc && !inv)
+        return { needs: ['The security context or inventory row for this asset.'] };
+    const name = subjectName(contents, 'This asset');
+    const triage = assetTriage(contents);
+    const pathGap = analysis(contents, 'path-gap');
+    const identity = asRecord(sc?.identity);
+    const classification = asRecord(sc?.classification);
+    const summary = asRecord(classification?.summary);
+    const role = ['deviceWorkloadType', 'functionalRoles', 'networkFunction', 'businessEnvironment']
+        .flatMap((key) => texts(summary?.[key]))
+        .map((value) => human(value) ?? value)[0];
+    const zone = zoneEntry(contents);
+    const reach = asRecord(sc?.reachability);
+    const reachCode = pathGap?.pathState ?? reach?.evaluationStatus;
+    const traffic = asRecord(sc?.observedTrafficSummary);
+    const exploit = asRecord(sc?.exploitability);
+    const { findings, cves, verdicts } = verdictCounts(sc);
+    const exploitable = count(verdicts?.EXPLOITABLE) ?? 0;
+    const possible = count(verdicts?.POSSIBLE) ?? 0;
+    const exploitTitle = exploitable
+        ? `${exploitable} exploitable finding${exploitable === 1 ? '' : 's'}`
+        : possible
+            ? `${possible} possibly exploitable`
+            : human(exploit?.evaluationStatus) ?? 'Exploitability unknown';
+    const urgency = triage?.urgency;
+    const checks = list(triage?.checks).flatMap((item) => {
+        const question = text(asRecord(item)?.question);
+        return question ? [question] : [];
+    });
+    const evidence = list(triage?.priorityEvidence).flatMap((item, index) => {
+        const rec = asRecord(item);
+        const fact = text(rec?.fact);
+        if (!fact)
+            return [];
+        return [
+            {
+                id: `situation-evidence-${index}`,
+                title: human(rec?.factor) ?? 'Evidence',
+                subtitle: brief(fact, 56),
+                link: { label: 'evidence' },
+                details: { summary: fact },
+            },
+        ];
+    });
+    const decision = text(triage?.summary) ?? text(asRecord(triage?.assessment)?.summary);
+    const steps = [
+        {
+            id: 'role',
+            title: role ?? 'Role not classified',
+            subtitle: human(identity?.identityStatus ?? inv?.identityStatus) ?? undefined,
+            tag: name,
+            details: {
+                summary: text(asRecord(classification?.explanation)?.whyInsufficient) ??
+                    narrative(inv, 'identity') ??
+                    `${name} as the inventory records it.`,
+                facts: facts([
+                    ['Identity', identity?.identityStatus ?? inv?.identityStatus],
+                    ['Addresses', texts(identity?.addresses ?? inv?.addresses).slice(0, 4)],
+                    ['Classification', classification?.processingStatus],
+                ]),
+            },
+            attachments: zone
+                ? {
+                    context: [
+                        {
+                            id: 'situation-zone',
+                            title: 'Zone',
+                            subtitle: zone.status === 'MISSING' ? 'Not placed' : human(zone.status) ?? undefined,
+                            details: { summary: human(zone.reasonCode) ?? 'No zone reason is recorded.' },
+                        },
+                    ],
+                }
+                : undefined,
+        },
+        {
+            id: 'reach',
+            title: human(reachCode) ?? 'Reachability unknown',
+            subtitle: traffic ? `Traffic: ${(human(traffic.status) ?? 'unknown').toLowerCase()}` : undefined,
+            tone: tone(reachCode),
+            link: { label: 'then' },
+            details: {
+                summary: text(asRecord(pathGap?.assessment)?.summary) ?? 'No route or hop record is stored for this asset.',
+                facts: facts([
+                    ['Evaluation', reach?.evaluationStatus],
+                    ['Path state', pathGap?.pathState],
+                    ['Observed traffic', traffic?.status],
+                ]),
+            },
+        },
+        {
+            id: 'exploit',
+            title: exploitTitle,
+            subtitle: findings != null ? `${findings} finding${findings === 1 ? '' : 's'}, ${cves ?? 0} CVE${cves === 1 ? '' : 's'}` : undefined,
+            tone: exploitable ? 'crit' : possible ? 'warn' : 'neutral',
+            link: { label: 'then' },
+            details: {
+                summary: texts(exploit?.limitations)[0] ?? 'Local exploitability as the security context reports it.',
+                facts: facts([
+                    ['Evaluation', exploit?.evaluationStatus],
+                    ['Findings', findings],
+                    ['CVEs', cves],
+                ]),
+                list: texts(exploit?.limitations).length
+                    ? { title: 'Limitations', items: texts(exploit?.limitations) }
+                    : undefined,
+            },
+            attachments: evidence.length ? { findings: evidence.slice(0, 3) } : undefined,
+        },
+        {
+            id: 'decide',
+            title: human(urgency) ?? 'No decision yet',
+            subtitle: triage?.confidence ? `${human(triage.confidence)} confidence` : undefined,
+            tone: tone(urgency),
+            link: { label: 'so' },
+            details: {
+                summary: decision ?? 'No triage decision is stored for this asset.',
+                list: checks.length ? { title: 'Next checks', items: checks } : undefined,
+            },
+        },
+    ];
+    return {
+        input: {
+            title: `${name}: what to do about it`,
+            subtitle: 'Role, reachability, exploitability and the decision, from stored content.',
+            overview: decision ? brief(decision, 260) : undefined,
+            glance: facts([
+                ['Asset', name],
+                ['Role', role],
+                ['Reachability', reachCode],
+                ['Findings', findings],
+                ['Urgency', urgency],
+            ]),
+            steps,
+        },
+        sources: used(contents, ['inventory', 'security-context', 'analysis', 'triage']),
+        gaps: uniqueGaps([...assessmentGaps(pathGap), ...ledgerGaps(contents)]),
+    };
+}
+const ROUTE_VERDICTS = new Set(['REACHABLE', 'BLOCKED', 'NO_PATH_EVIDENCE', 'UNKNOWN_MISSING_ROUTE']);
+function routeVerdict(contents) {
+    const pathGap = analysis(contents, 'path-gap');
+    const pathState = text(pathGap?.pathState);
+    if (pathState && ROUTE_VERDICTS.has(pathState)) {
+        return { code: pathState, why: text(asRecord(pathGap?.assessment)?.summary) ?? text(pathGap?.note) ?? '' };
+    }
+    const device = analysis(contents, 'device-reachability');
+    const deviceState = text(device?.reachability);
+    if (deviceState && ROUTE_VERDICTS.has(deviceState))
+        return { code: deviceState, why: text(device?.evidence) ?? '' };
+    const reach = asRecord(securityContext(contents)?.reachability) ?? asRecord(rowOf(contents, 'reachability-claims')?.reachability);
+    if (!reach)
+        return null;
+    const codes = texts(reach.reasonCodes);
+    if (codes.includes('NO_REACHABILITY_CLAIMS')) {
+        return { code: 'NO_PATH_EVIDENCE', why: texts(reach.limitations)[0] ?? 'No reachability claim is stored.' };
+    }
+    return {
+        code: 'UNKNOWN_MISSING_ROUTE',
+        why: `Reachability is ${(human(reach.evaluationStatus) ?? 'recorded').toLowerCase()}, but no route or hop is stored.`,
+    };
+}
+function hopsOf(contents) {
+    for (const row of rowsOf(contents, 'reachability-paths')) {
+        for (const key of ['hops', 'path', 'steps']) {
+            const hops = list(row[key]).flatMap((item) => (asRecord(item) ? [item] : []));
+            if (hops.length)
+                return hops;
+        }
+    }
+    return [];
+}
+function routeEvidence(contents, objectType) {
+    const verdict = routeVerdict(contents);
+    if (!verdict) {
+        return {
+            needs: [
+                `A route verdict for this ${objectType}: a path-gap analysis, a device reachability analysis, or reachability on the security context.`,
+            ],
+        };
+    }
+    const name = subjectName(contents, `This ${objectType}`);
+    const pathGap = analysis(contents, 'path-gap');
+    const reach = asRecord(securityContext(contents)?.reachability);
+    const hops = hopsOf(contents).map((hop, index) => ({
+        id: `hop-${index}`,
+        title: text(hop.label) ?? text(hop.name) ?? text(hop.title) ?? text(hop.id) ?? `Hop ${index + 1}`,
+        column: `Hop ${index + 1}`,
+        link: text(hop.allows) ? { label: text(hop.allows) } : undefined,
+    }));
+    const gapTexts = uniqueGaps([...assessmentGaps(pathGap), ...texts(reach?.limitations)], 5);
+    const gapCodes = texts(reach?.reasonCodes);
+    const gaps = [
+        ...gapTexts.map((gap, index) => ({
+            id: `route-gap-${index}`,
+            title: brief(gap, 60),
+            tag: 'MISSING_EVIDENCE',
+            details: { summary: gap },
+        })),
+        ...gapCodes.map((code, index) => ({
+            id: `route-code-${index}`,
+            title: human(code) ?? code,
+            tag: code,
+        })),
+    ];
+    return {
+        input: {
+            title: `Can ${name} be reached?`,
+            subtitle: 'Published hops and the route verdict, from stored content.',
+            overview: verdict.why ? brief(verdict.why, 260) : undefined,
+            glance: facts([
+                ['Subject', name],
+                ['Verdict', verdict.code],
+                ['Published hops', hops.length],
+                ['Open evidence', gaps.length],
+            ]),
+            steps: [
+                ...hops,
+                {
+                    id: 'verdict',
+                    title: verdict.code,
+                    column: 'Verdict',
+                    tone: verdict.code === 'REACHABLE' ? 'crit' : verdict.code === 'BLOCKED' ? 'ok' : 'neutral',
+                    details: { summary: verdict.why || 'The stored route verdict.' },
+                    attachments: gaps.length ? { gap: gaps.slice(0, 6) } : undefined,
+                },
+            ],
+        },
+        sources: used(contents, ['analysis', 'security-context', 'reachability-claims', 'reachability-paths']),
+        gaps: gapTexts,
+    };
+}
+function proposalsOf(contents) {
+    const out = [];
+    const triage = rowOf(contents, 'triage');
+    const decided = triage?.effective === true ? triage : null;
+    const urgency = text(triage?.urgency);
+    if (urgency) {
+        out.push({
+            label: human(urgency) ?? urgency,
+            detail: text(triage?.summary) ?? text(asRecord(triage?.assessment)?.summary) ?? '',
+            source: 'Triage',
+            decision: decided,
+        });
+    }
+    for (const model of rowsOf(contents, 'triage-model')) {
+        for (const item of list(model.treatmentCandidates)) {
+            const value = text(asRecord(item)?.value) ?? text(item);
+            if (value)
+                out.push({ label: brief(value, 48), detail: value, source: 'Triage model', decision: null });
+        }
+        const suggested = text(model.suggestedUrgency);
+        if (suggested)
+            out.push({ label: human(suggested) ?? suggested, detail: text(asRecord(model.assessment)?.summary) ?? '', source: 'Triage model', decision: null });
+    }
+    for (const row of rowsOf(contents, 'mitigation')) {
+        for (const step of list(row.interruptionSteps)) {
+            const value = text(step) ?? text(asRecord(step)?.title) ?? text(asRecord(step)?.value);
+            if (value)
+                out.push({ label: brief(value, 48), detail: value, source: 'Mitigation', decision: null });
+        }
+    }
+    return out;
+}
+function responseWork(contents, objectType) {
+    const proposals = proposalsOf(contents);
+    const triage = rowOf(contents, 'triage');
+    if (!proposals.length) {
+        const why = texts(triage?.requests)[0] ?? text(triage?.reason);
+        return {
+            needs: [
+                'A response proposal: a triage urgency, a triage-model treatment candidate, or a mitigation step.',
+                ...(why ? [`Triage says: ${why}.`] : []),
+            ],
+        };
+    }
+    const name = subjectName(contents, `This ${objectType}`);
+    const workState = text(triage?.workState);
+    return {
+        input: {
+            title: `Response work for ${name}`,
+            subtitle: 'From proposal to decision to task, from stored content.',
+            overview: `${proposals.length} response${proposals.length === 1 ? ' is' : 's are'} proposed. ${proposals.some((p) => p.decision) ? 'A decision is effective.' : 'None is decided yet, so every row stays dashed.'}`,
+            glance: facts([
+                ['Subject', name],
+                ['Proposals', proposals.length],
+                ['Work state', workState],
+            ]),
+            root: { id: 'subject', title: name, subtitle: human(objectType) ?? objectType },
+            threads: proposals.slice(0, 8).map((proposal, index) => ({
+                id: `work-${index}`,
+                label: proposal.label,
+                style: proposal.decision ? undefined : 'dashed',
+                tone: proposal.decision ? undefined : 'info',
+                nodes: [
+                    {
+                        id: `work-${index}-proposal`,
+                        title: proposal.label,
+                        subtitle: `Proposed by ${proposal.source.toLowerCase()}`,
+                        details: proposal.detail ? { summary: proposal.detail } : undefined,
+                    },
+                    proposal.decision
+                        ? {
+                            id: `work-${index}-decision`,
+                            title: human(proposal.decision.disposition) ?? 'Decided',
+                            subtitle: 'Effective',
+                            tone: 'ok',
+                        }
+                        : null,
+                    null,
+                ],
+            })),
+            sinks: workState ? [{ id: 'work-state', title: human(workState) ?? workState, subtitle: 'Work state' }] : undefined,
+        },
+        sources: used(contents, ['triage', 'triage-model', 'mitigation']),
+    };
+}
+function factorName(value) {
+    const lower = value.toLowerCase();
+    if (/reachab|path|route/.test(lower))
+        return 'Path';
+    if (/exploit/.test(lower))
+        return 'Exploit evidence';
+    if (/component|version|patch|install/.test(lower))
+        return 'Patch status';
+    if (/identity|hostname|binding/.test(lower))
+        return 'Identity';
+    if (/expos|public/.test(lower))
+        return 'Exposure';
+    return 'Other evidence';
+}
+function evidenceGaps(contents) {
+    const factors = new Map();
+    const add = (value, code, name = factorName(value), closesWith) => {
+        const factor = factors.get(name) ?? { name, reasons: [] };
+        if (!factor.reasons.some((reason) => reason.text === value)) {
+            factor.reasons.push({ text: value, code, ...(closesWith ? { closesWith } : {}) });
+        }
+        factors.set(name, factor);
+    };
+    for (const model of rowsOf(contents, 'triage-model')) {
+        for (const item of list(model.evidenceRequests)) {
+            const rec = asRecord(item);
+            const value = text(rec?.value);
+            if (value)
+                add(value, rec?.epistemicState === 'HYPOTHESIS' ? 'UNCONFIRMED' : 'MISSING_EVIDENCE', undefined, text(rec?.closesWith));
+        }
+    }
+    const applicability = analysis(contents, 'applicability');
+    for (const gap of assessmentGaps(applicability))
+        add(gap, 'MISSING_EVIDENCE');
+    for (const item of list(applicability?.affectednessHypotheses)) {
+        const value = text(asRecord(item)?.value);
+        if (value)
+            add(value, 'UNCONFIRMED');
+    }
+    if (list(applicability?.conflictingAssessments).length > 1) {
+        add('Assessments of this finding disagree with each other.', 'CONFLICTING', 'Exploit evidence');
+    }
+    const admission = analysis(contents, 'assessment-admission');
+    for (const code of texts(admission?.gaps))
+        add(human(code) ?? code, 'MISSING_EVIDENCE', 'Patch status');
+    const ova = rowOf(contents, 'open-vuln-assessment');
+    if (asRecord(ova?.intelStamp)?.status === 'SOURCE_UNAVAILABLE') {
+        add('A vulnerability intelligence source was unavailable for this finding.', 'MISSING_INTEGRATION', 'Exploit evidence');
+    }
+    if (!factors.size)
+        return { needs: ['Open factors on this finding: triage-model evidence requests or analysis gaps.'] };
+    const name = subjectName(contents, 'This finding');
+    const steps = [...factors.values()].slice(0, 6).map((factor, index) => ({
+        id: `factor-${index}`,
+        title: factor.name,
+        subtitle: `${factor.reasons.length} open`,
+        attachments: {
+            gap: factor.reasons.slice(0, 3).map((reason, at) => ({
+                id: `factor-${index}-gap-${at}`,
+                title: brief(reason.text, 60),
+                tag: reason.code,
+                details: { summary: reason.text, ...(reason.closesWith ? { closesWith: reason.closesWith } : {}) },
+            })),
+        },
+    }));
+    return {
+        input: {
+            title: `What is still open on ${name}`,
+            subtitle: 'Each open factor and why it is open, from stored content.',
+            glance: facts([
+                ['Finding', name],
+                ['Open factors', factors.size],
+            ]),
+            steps,
+        },
+        sources: used(contents, ['triage-model', 'analysis', 'open-vuln-assessment']),
+    };
+}
+function alertActivity(contents) {
+    const inv = rowOf(contents, 'inventory');
+    if (!inv)
+        return { needs: ['The inventory row for this alert.'] };
+    const name = text(inv.title) ?? subjectName(contents, 'This alert');
+    const pressure = analysis(contents, 'alert-pressure');
+    const correlation = analysis(contents, 'alert-correlation');
+    const observation = rowOf(contents, 'observation');
+    const triage = rowOf(contents, 'triage');
+    const overview = text(rowOf(contents, 'overview')?.summary);
+    const correlated = text(correlation?.correlation);
+    const steps = [
+        {
+            id: 'pressure',
+            title: human(pressure?.pressure) ?? 'Pressure unknown',
+            subtitle: pressure?.severity ? `Severity ${(human(pressure.severity) ?? '').toLowerCase()}` : undefined,
+            column: 'Pressure',
+            tone: tone(pressure?.severity),
+            details: {
+                summary: text(pressure?.evidence) ?? 'No pressure analysis is stored.',
+                facts: facts([
+                    ['Confidence', pressure?.confidence],
+                    ['Grounding', pressure?.groundingStatus],
+                ]),
+            },
+        },
+        {
+            id: 'observation',
+            title: observation?.observed == null ? 'Not observed' : human(String(observation.observed)) ?? 'Observed',
+            subtitle: observation ? `Coverage ${(human(observation.coverage) ?? 'unknown').toLowerCase()}` : undefined,
+            column: 'Observation',
+            link: { label: 'then' },
+        },
+        {
+            id: 'response',
+            title: human(triage?.disposition) ?? 'No response',
+            subtitle: triage?.workState ? `Work ${(human(triage.workState) ?? '').toLowerCase()}` : undefined,
+            column: 'Response',
+            link: { label: 'then' },
+            details: {
+                summary: triage ? `Readiness: ${(human(triage.readiness) ?? 'unknown').toLowerCase()}.` : 'No triage is stored.',
+                facts: facts([
+                    ['Assessment', triage?.assessmentState],
+                    ['Urgency', triage?.urgency],
+                ]),
+            },
+        },
+        {
+            id: 'correlation',
+            title: human(correlated) ?? 'Not correlated',
+            column: 'Correlation',
+            tone: tone(correlated),
+            link: { label: 'then' },
+            details: {
+                summary: text(asRecord(correlation?.assessment)?.summary) ?? 'No correlation analysis is stored.',
+                list: texts(correlation?.correlationInterpretations).length
+                    ? { title: 'Interpretations', items: texts(correlation?.correlationInterpretations) }
+                    : undefined,
+            },
+            attachments: correlated && correlated !== 'CONFIRMED'
+                ? {
+                    skipped: [
+                        {
+                            id: 'skipped-join',
+                            title: 'Target, service and time join',
+                            subtitle: 'Not made',
+                            details: { summary: text(correlation?.note) ?? 'The alert is not joined to a target, service and time.' },
+                        },
+                    ],
+                }
+                : undefined,
+        },
+        {
+            id: 'detection',
+            title: text(inv.ruleId) ?? name,
+            subtitle: human(inv.family) ?? undefined,
+            column: 'Detection',
+            link: { label: 'from' },
+            details: {
+                summary: `Recorded ${text(inv.occurredAt) ?? 'at an unknown time'}.`,
+                facts: facts([
+                    ['Severity', inv.severity],
+                    ['Connector', inv.connectorId],
+                ]),
+            },
+        },
+    ];
+    return {
+        input: {
+            title: `What happened with ${name}`,
+            subtitle: 'Pressure, observation, response, correlation and detection, from stored content.',
+            overview: overview ? brief(overview, 260) : undefined,
+            glance: facts([
+                ['Alert', name],
+                ['Family', inv.family],
+                ['Correlation', correlated],
+                ['Disposition', triage?.disposition],
+            ]),
+            steps,
+        },
+        sources: used(contents, ['inventory', 'analysis', 'observation', 'triage', 'overview']),
+        gaps: uniqueGaps(assessmentGaps(correlation)),
+    };
+}
+function identityGap(contents) {
+    const sc = securityContext(contents);
+    const inv = rowOf(contents, 'inventory');
+    if (!sc && !inv)
+        return { needs: ['The inventory row or security context for this subject.'] };
+    const name = subjectName(contents, 'This subject');
+    const identity = asRecord(sc?.identity);
+    const addresses = texts(identity?.addresses ?? inv?.addresses);
+    const status = identity?.identityStatus ?? inv?.identityStatus;
+    const link = analysis(contents, 'identity-link');
+    const bindings = list(sc?.objectBindings).flatMap((item, index) => {
+        const rec = asRecord(item);
+        const title = text(rec?.kind) ?? text(rec?.source) ?? text(rec?.objectId);
+        return title ? [{ id: `binding-${index}`, title: human(title) ?? title, subtitle: 'Possible binding' }] : [];
+    });
+    const zone = zoneEntry(contents);
+    const traffic = asRecord(sc?.observedTrafficSummary);
+    const { findings } = verdictCounts(sc);
+    const correlation = asRecord(traffic?.vulnerableServiceCorrelation);
+    const linked = findings ?? list(correlation?.findingRefs).length;
+    const steps = [
+        {
+            id: 'address',
+            title: addresses[0] ?? 'No address',
+            subtitle: addresses.length > 1 ? `+${addresses.length - 1} more` : undefined,
+            details: { summary: narrative(inv, 'absence') ?? narrative(inv, 'identity') ?? 'Addresses published for this subject.' },
+        },
+        {
+            id: 'identity',
+            title: human(status) ?? 'Identity unknown',
+            tone: tone(status),
+            link: { label: 'names' },
+            details: {
+                summary: text(link?.evidence) ?? 'No identity link analysis is stored.',
+                list: texts(link?.gaps).length ? { title: 'Why it is open', items: texts(link?.gaps) } : undefined,
+            },
+            attachments: bindings.length ? { binding: bindings.slice(0, 4) } : undefined,
+        },
+        {
+            id: 'zone',
+            title: zone ? (zone.status === 'MISSING' ? 'No zone' : human(zone.status) ?? 'Zone') : 'Zone unknown',
+            subtitle: human(zone?.reasonCode) ?? undefined,
+            link: { label: 'placed in' },
+        },
+        {
+            id: 'traffic',
+            title: human(traffic?.status) ?? 'Traffic unknown',
+            subtitle: traffic ? `${count(traffic.totalObservationCount) ?? 0} observations` : undefined,
+            link: { label: 'talks' },
+        },
+        {
+            id: 'findings',
+            title: `${linked} linked finding${linked === 1 ? '' : 's'}`,
+            subtitle: 'Cannot be acted on until the identity binds',
+            link: { label: 'carries' },
+        },
+    ];
+    return {
+        input: {
+            title: `Who is ${name}?`,
+            subtitle: 'Address, identity, zone, traffic and linked findings, from stored content.',
+            overview: text(rowOf(contents, 'overview')?.summary) ?? undefined,
+            glance: facts([
+                ['Subject', name],
+                ['Identity', status],
+                ['Addresses', addresses.length],
+                ['Linked findings', linked],
+            ]),
+            steps,
+        },
+        sources: used(contents, ['inventory', 'security-context', 'analysis', 'overview']),
+        gaps: uniqueGaps([...texts(link?.gaps), ...ledgerGaps(contents)]),
+    };
+}
+function assetFindings(contents) {
+    const sc = securityContext(contents);
+    const assessments = list(asRecord(asRecord(sc?.exploitability)?.context)?.assessments).flatMap((item) => asRecord(item) ? [item] : []);
+    if (!assessments.length) {
+        const counted = count(assetTriage(contents)?.findingCount);
+        return {
+            needs: [
+                'Per-finding assessments on this asset\u2019s security context: applicability, path, attackability and decision.',
+                ...(counted
+                    ? [`Triage counts ${counted} finding${counted === 1 ? '' : 's'} on this asset, but no per-finding rows are stored with it.`]
+                    : []),
+            ],
+        };
+    }
+    const name = subjectName(contents, 'This asset');
+    const attack = asRecord(sc?.attackability);
+    const attackCode = texts(attack?.reasonCodes)[0] ?? text(attack?.evaluationStatus);
+    return {
+        input: {
+            title: `Findings on ${name}`,
+            subtitle: 'Applicability, path, attackability and decision per finding, from stored content.',
+            glance: facts([
+                ['Asset', name],
+                ['Findings', assessments.length],
+                ['Attackability', attack?.evaluationStatus],
+            ]),
+            root: { id: 'asset', title: name },
+            threads: assessments.slice(0, 10).map((row, index) => {
+                const label = text(row.cveId) ?? texts(row.cveIds)[0] ?? `Finding ${index + 1}`;
+                const verdict = text(row.verdict);
+                return {
+                    id: `finding-${index}`,
+                    label,
+                    style: verdict === 'EXPLOITABLE' ? undefined : 'dashed',
+                    tone: tone(verdict),
+                    nodes: [
+                        {
+                            id: `finding-${index}-applies`,
+                            title: human(verdict) ?? 'Not evaluated',
+                            subtitle: human(row.evaluationStatus) ?? undefined,
+                            details: { summary: text(row.findingId) ?? label },
+                        },
+                        null,
+                        attackCode ? { id: `finding-${index}-attack`, title: human(attackCode) ?? attackCode } : null,
+                        null,
+                    ],
+                };
+            }),
+        },
+        sources: ['security-context'],
+    };
+}
+function techniqueSet(contents) {
+    const row = rowOf(contents, 'mitre-techniques');
+    const techniques = list(row?.techniques).flatMap((item) => (asRecord(item) ? [item] : []));
+    if (!techniques.length)
+        return { needs: ['MITRE ATT&CK techniques on this asset. The stored technique list is empty.'] };
+    const name = subjectName(contents, 'This asset');
+    return {
+        input: {
+            title: `Techniques that apply to ${name}`,
+            subtitle: 'From stored content.',
+            steps: techniques.slice(0, 12).map((tech, index) => {
+                const tactic = asRecord(tech.tactic);
+                const tacticName = text(tactic?.name) ?? text(tactic?.label) ?? (typeof tech.tactic === 'string' ? text(tech.tactic) : null) ?? texts(tech.tactics)[0];
+                const tacticId = text(tech.tacticId) ?? text(tactic?.id);
+                const name = tacticName && /^TA\d{4}$/i.test(tacticName) ? tacticName : human(tacticName) ?? tacticName;
+                const cves = texts(tech.cveIds);
+                return {
+                    id: `technique-${index}`,
+                    title: text(tech.name) ?? text(tech.title) ?? text(tech.id) ?? `Technique ${index + 1}`,
+                    tag: text(tech.id) ?? text(tech.techniqueId) ?? undefined,
+                    column: tacticColumn(name, tacticId),
+                    ...(cves.length
+                        ? { attachments: { cve: cves.slice(0, 4).map((cve, at) => ({ id: `technique-${index}-cve-${at}`, title: cve })) } }
+                        : {}),
+                };
+            }),
+        },
+        sources: ['mitre-techniques'],
+    };
+}
+function funnelLeaks(contents) {
+    const data = asRecord(rowOf(contents, 'bootstrap')?.data);
+    const coverage = asRecord(data?.objectCoverage);
+    const canonical = count(coverage?.canonicalObjectCount);
+    const published = count(coverage?.publishedObjectContextCount);
+    const both = count(coverage?.bothPlanes);
+    const reachOnly = count(coverage?.reachabilityOnly) ?? 0;
+    const exploitOnly = count(coverage?.exploitabilityOnly) ?? 0;
+    const neither = count(coverage?.neitherPlaneWithExplicitReason);
+    if (canonical == null || published == null || both == null) {
+        return { needs: ['Object coverage counts on the security map bootstrap.'] };
+    }
+    const anyPlane = both + reachOnly + exploitOnly;
+    return {
+        input: {
+            title: 'Where objects drop out of the security map',
+            subtitle: 'Object coverage from the bootstrap row.',
+            entries: [{ id: 'inventory', title: 'Inventory rows', value: count(coverage?.inventoryRowCount) ?? canonical }],
+            steps: [
+                { id: 'canonical', title: 'Canonical objects', value: canonical },
+                { id: 'published', title: 'Published contexts', value: published },
+                {
+                    id: 'any-plane',
+                    title: 'On at least one plane',
+                    value: anyPlane,
+                    attachments: neither != null
+                        ? { leak: [{ id: 'leak-neither', title: 'On neither plane', subtitle: `${neither} with a reason`, link: { label: `-${neither}` } }] }
+                        : undefined,
+                },
+                {
+                    id: 'both',
+                    title: 'On both planes',
+                    value: both,
+                    kind: 'outcome',
+                    badge: anyPlane ? `${Math.round((both / anyPlane) * 100)}% of covered` : undefined,
+                    attachments: reachOnly
+                        ? { leak: [{ id: 'leak-reach-only', title: 'Reachability only', subtitle: `${reachOnly} objects`, link: { label: `-${reachOnly}` } }] }
+                        : undefined,
+                },
+            ],
+        },
+        sources: ['bootstrap'],
+    };
+}
+function relationCounts(contents) {
+    const out = new Map();
+    for (const row of rowsOf(contents, 'entity-relations')) {
+        for (const item of list(row.relations)) {
+            const kind = text(asRecord(item)?.peerKind) ?? 'other';
+            out.set(kind, (out.get(kind) ?? 0) + 1);
+        }
+    }
+    return out;
+}
+function relationText(counts) {
+    return [...counts.entries()].map(([kind, n]) => `${n} ${kind}${n === 1 ? '' : 's'}`).join(', ');
+}
+function predictionSource(row, fallbackTitle) {
+    const steps = predictionStepsFrom(row);
+    const summary = text(row.summary) ?? texts(row.summary).join('\n\n');
+    return {
+        title: text(row.title) ?? fallbackTitle,
+        summary: summary || null,
+        decision: text(row.decision),
+        status: text(row.status),
+        score: count(row.score),
+        asOf: text(row.asOf),
+        support: text(row.support),
+        assumedTransitionsAreEdges: row.assumedTransitionsAreEdges === false ? false : row.assumedTransitionsAreEdges === true ? true : null,
+        gaps: texts(row.gaps),
+        reasons: texts(row.reasons),
+        evidence: [...texts(row.evidence), ...list(row.evidence).flatMap((item) => {
+                const id = text(asRecord(item)?.evidenceId);
+                return id ? [id] : [];
+            })],
+        assetRefs: texts(row.assetRefs),
+        steps,
+    };
+}
+function attackPath(contents, objectType) {
+    const predicted = rowOf(contents, 'predicted-attack');
+    if (!predicted)
+        return { needs: [`A predicted-attack row for this ${objectType}.`] };
+    const name = subjectName(contents, `This ${objectType}`);
+    const diagram = predictionDiagram(predictionSource(predicted, `Predicted attack on ${name}`));
+    if (diagram)
+        return { input: diagram.input, sources: ['predicted-attack'], drawTemplate: diagram.template };
+    const reasons = texts(predicted.reasons).map((reason) => human(reason) ?? reason);
+    return {
+        needs: [
+            `The stored prediction has support ${(human(predicted.support) ?? 'unknown').toLowerCase()}${reasons.length ? `: ${reasons.join(', ').toLowerCase()}` : ''}.`,
+            'The installed Storyflowix build has no predicted-attack template, so this row cannot be drawn yet.',
+        ],
+    };
+}
+const BUILDERS = {
+    'asset-situation': assetSituation,
+    'asset-findings': assetFindings,
+    'route-evidence': routeEvidence,
+    'response-work': responseWork,
+    'evidence-gaps': evidenceGaps,
+    'alert-activity': alertActivity,
+    'identity-gap': identityGap,
+    'technique-set': techniqueSet,
+    'funnel-leaks': funnelLeaks,
+    'attack-path': attackPath,
+    'device-policy': (contents) => {
+        const counts = relationCounts(contents);
+        return {
+            needs: [
+                'Firewall rules or flows for this device, each with ingress, policy, egress and verdict.',
+                counts.size ? `Stored relations link it to ${relationText(counts)}, with no rule rows.` : 'No relations are stored for it.',
+            ],
+        };
+    },
+    'zone-placement': (contents) => {
+        const counts = relationCounts(contents);
+        return {
+            needs: [
+                'The assets placed in this zone, each with identity, placement, exposure and decision.',
+                counts.size ? `Stored relations link it to ${relationText(counts)}, not to assets.` : 'No relations are stored for it.',
+            ],
+        };
+    },
+    'vuln-spread': () => ({ needs: ['The assets this vulnerability matches, with a component match per asset.'] }),
+};
+/**
+ * Draw `template` from stored rows. A drawing Storyflowix rejects is reported as missing.
+ * Templates with no builder are missing too: only the agent's function or a stored drawing can fill them.
+ */
+export function buildLocalStory(template, objectType, contents) {
+    const build = BUILDERS[template];
+    if (!build)
+        return { status: 'missing', needs: ['The agent\u2019s story function or a stored drawing. The app does not draw this story itself.'] };
+    const outcome = build(contents, objectType);
+    if ('needs' in outcome)
+        return { status: 'missing', needs: outcome.needs };
+    const drawTemplate = outcome.drawTemplate ?? template;
+    const definition = getTemplate(drawTemplate);
+    if (definition) {
+        const check = validateInput(definition, outcome.input);
+        if (!check.ok) {
+            return { status: 'missing', needs: check.errors.map((error) => `Drawing rejected: ${error.message}`) };
+        }
+    }
+    return {
+        status: 'built',
+        input: outcome.input,
+        sources: outcome.sources,
+        gaps: outcome.gaps ?? [],
+        drawTemplate: outcome.drawTemplate,
+    };
+}
+function blockData(value) {
+    const rec = asRecord(value);
+    return asRecord(asRecord(rec?.json)?.data) ?? asRecord(rec?.data);
+}
+const contentCache = new Map();
+/**
+ * Every stored content row on one record, by content type.
+ * One `listRecords` read per record, with `representation: 'both'`.
+ */
+export function loadRecordContents(client, objectType, recordId) {
+    const type = objectType.trim().toLowerCase();
+    const id = recordId.trim();
+    const key = `${type}\u0000${id}`;
+    const hit = contentCache.get(key);
+    if (hit)
+        return hit;
+    const request = client
+        .listRecords(type, { filter: { recordId: id }, limit: 1, representation: 'both' })
+        .then((body) => {
+        const top = asRecord(body);
+        const item = Array.isArray(top?.items) ? asRecord(top.items[0]) : null;
+        const contents = asRecord(item?.contents) ?? asRecord(top?.contents) ?? {};
+        const out = new Map();
+        for (const [contentType, raw] of Object.entries(contents)) {
+            const blocks = Array.isArray(raw) ? raw : raw == null ? [] : [raw];
+            const rows = blocks.flatMap((block) => {
+                const data = blockData(block);
+                return data ? [data] : [];
+            });
+            if (rows.length)
+                out.set(contentType, rows);
+        }
+        return out;
+    });
+    const settled = request.catch((err) => {
+        if (contentCache.get(key) === settled)
+            contentCache.delete(key);
+        throw err;
+    });
+    contentCache.set(key, settled);
+    return settled;
+}
+//# sourceMappingURL=localStories.js.map