@x12i/map-store-playground 0.1.1 → 0.1.3

package/README.md

@@ -38,3 +38,5 @@ createPlaygroundServer({
 ```
 
 Product-specific catalogs (e.g. Synapix UI flows / how-to guides) stay in the consumer app.
+
+The **Tenant queries** group holds the two POST routes the Pre-AI pages use on top of the working products: `findings:query` (scanner severity, CVSS, KEV, EPSS) and `vulnerabilities:briefing` (ranked CVE hubs). Both take the covering pair from `working/bootstrap`. The matching client calls are `queryFindings` and `fetchVulnerabilitiesBriefing` in `@x12i/map-store-client`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@x12i/map-store-playground",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "Map-store /map-store/v1 catalog and response previews for @x12i/api-playground",
   "type": "module",
   "license": "UNLICENSED",

package/src/catalog.js

@@ -11,6 +11,7 @@ export const groups = [
   { id: "objects", label: "Objects" },
   { id: "investigation", label: "Investigation packets" },
   { id: "counts", label: "Counts (Countex)" },
+  { id: "queries", label: "Tenant queries" },
   { id: "advanced", label: "Advanced / lab" },
 ];
 
@@ -287,11 +288,11 @@ export const endpoints = [
   workingProduct({
     id: "object-exploitability-assessments",
     name: "Object exploitability assessments",
-    summary: "EPA rows (attachment ≠ local asset exploitability).",
-    purpose: "Published EPA. Finding/alert EPA must not be promoted to “asset locally exploitable”.",
-    useWhen: ["EPA sections on findings/alerts/assets"],
-    avoidWhen: ["Do not promote finding EPA to asset exploitability"],
-    responseDescription: "EPA rows in data.",
+    summary: "Exploitability assessment records (attachment ≠ local asset exploitability).",
+    purpose: "Published exploitability assessments. A finding/alert assessment must not be promoted to “asset locally exploitable”.",
+    useWhen: ["Exploitability assessment sections on findings/alerts/assets"],
+    avoidWhen: ["Do not promote a finding exploitability assessment to asset exploitability"],
+    responseDescription: "Exploitability assessment records in data.",
   }),
 
   workingProduct({
@@ -778,4 +779,116 @@ export const endpoints = [
     responseViews: ["json"],
     submitLabel: "Fetch (lab only)",
   }),
+
+  ep({
+    id: "findings-query",
+    group: "queries",
+    name: "Findings query",
+    method: "POST",
+    path: "/map-store/v1/tenants/{tenant}/findings:query",
+    family: "queries",
+    summary: "Scanner fields for the open vulnerability findings of one covering pair.",
+    purpose:
+      "Severity, CVSS, KEV, EPSS, and the vendor description for the open vulnerability findings. The catalog joins these onto the walked findings-query rows by finding id and by CVE id.",
+    useWhen: ["Vulnerability catalog rows", "CVE panel scanner facts"],
+    avoidWhen: ["Do not send current, latest, or scs:… as pins", HONESTY.opaqueTokens],
+    internalFlow: [
+      { title: "Pin", description: "snapshotSetId and analysisSnapshotId come from the session bootstrap." },
+      { title: "Query", description: "Open vulnerability findings, JSON, up to the limit." },
+    ],
+    requestUi: {
+      tenant: {
+        label: "tenant",
+        description: "Tenant segment. The Pre-AI app sends tgi.",
+        section: "primary",
+        order: 1,
+        required: true,
+        type: "path",
+        default: "tgi",
+      },
+      body: {
+        label: "JSON body",
+        description: "Covering pair from bootstrap, plus the open vulnerability filter.",
+        section: "primary",
+        order: 2,
+        required: true,
+        type: "json",
+        example: JSON.stringify(
+          {
+            snapshotSetId: "ss:…",
+            analysisSnapshotId: "as:…",
+            status: "open",
+            findingType: "vulnerability",
+            format: "json",
+            limit: 200,
+          },
+          null,
+          2
+        ),
+      },
+    },
+    inputs: [
+      { name: "tenant", required: true, meaning: "Tenant id", type: "path", default: "tgi" },
+      { name: "body", required: true, meaning: "Findings query body", type: "json" },
+    ],
+    responseDescription: "items[] of findings with severity, cvssScore, kevListed, epss, exprtRating, description, descriptionStatus.",
+    responseViews: ["preview", "json"],
+    submitLabel: "Run query",
+  }),
+
+  ep({
+    id: "vulnerabilities-briefing",
+    group: "queries",
+    name: "Vulnerabilities briefing",
+    method: "POST",
+    path: "/map-store/v1/tenants/{tenant}/vulnerabilities:briefing",
+    family: "queries",
+    summary: "Ranked CVE hubs for one covering pair.",
+    purpose:
+      "relevantCriticals[] ranked by host count, plus gaps. The CVE catalog paints these before the walked cve-catalog and the bundled CVE text. A gap id of gap:soes:cve-name-unavailable means the vendor gave no description.",
+    useWhen: ["CVE board", "CVE panel header"],
+    avoidWhen: ["Do not invent a description when descriptionStatus is VENDOR_NOT_PROVIDED"],
+    internalFlow: [
+      { title: "Pin", description: "snapshotSetId and analysisSnapshotId come from the session bootstrap." },
+      { title: "Brief", description: "Open vulnerability findings, rolled up to the relevant criticals." },
+    ],
+    requestUi: {
+      tenant: {
+        label: "tenant",
+        description: "Tenant segment. The Pre-AI app sends tgi.",
+        section: "primary",
+        order: 1,
+        required: true,
+        type: "path",
+        default: "tgi",
+      },
+      body: {
+        label: "JSON body",
+        description: "Covering pair from bootstrap, plus how many hubs to return.",
+        section: "primary",
+        order: 2,
+        required: true,
+        type: "json",
+        example: JSON.stringify(
+          {
+            snapshotSetId: "ss:…",
+            analysisSnapshotId: "as:…",
+            status: "open",
+            findingType: "vulnerability",
+            format: "json",
+            relevantLimit: 10,
+          },
+          null,
+          2
+        ),
+      },
+    },
+    inputs: [
+      { name: "tenant", required: true, meaning: "Tenant id", type: "path", default: "tgi" },
+      { name: "body", required: true, meaning: "Briefing body", type: "json" },
+    ],
+    responseDescription: "briefing.relevantCriticals[] and briefing.gaps[].",
+    responseViews: ["preview", "json"],
+    submitLabel: "Run briefing",
+  }),
 ];

package/src/renderers.js

@@ -121,6 +121,61 @@ function buildPreviewHtml(body, endpointId) {
     ]);
   }
 
+  if (
+    endpointId === "nexum-graph-direct" ||
+    endpointId === "nexum-graph-extended" ||
+    (Array.isArray(o.edges) && (o.nodes != null || o.truncated != null))
+  ) {
+    const edges = Array.isArray(o.edges) ? o.edges : [];
+    const nodes = Array.isArray(o.nodes) ? o.nodes : [];
+    const rows = [
+      ["mode", endpointId === "nexum-graph-extended" ? "extended (depth 2)" : endpointId === "nexum-graph-direct" ? "direct (depth 1)" : "graph query"],
+      ["nodes", String(nodes.length)],
+      ["edges", String(edges.length)],
+      ["truncated", fmt(o.truncated)],
+      ["revisionNumber", fmt(o.revisionNumber)],
+    ];
+    const edgeLines = edges.slice(0, 40).map((e) => {
+      const rec = asRecord(e);
+      if (!rec) return `<li class="muted">—</li>`;
+      return `<li><code>${escape(String(rec.sourceNodeId ?? ""))}</code> —<em>${escape(String(rec.relation ?? ""))}</em>→ <code>${escape(String(rec.targetNodeId ?? ""))}</code></li>`;
+    });
+    const more =
+      edges.length > 40
+        ? `<p class="field-hint">${edges.length - 40} more edges in JSON tab.</p>`
+        : "";
+    return (
+      kvGrid(rows) +
+      (edgeLines.length
+        ? `<h3 style="margin-top:12px;font-size:13px">Links</h3><ul class="simple-list">${edgeLines.join("")}</ul>${more}`
+        : `<p class="field-hint" style="margin-top:12px">No edges in this neighborhood.</p>`)
+    );
+  }
+
+  if (endpointId === "nexum-entities-list") {
+    const items = Array.isArray(o.items) ? o.items : [];
+    const sample = items
+      .slice(0, 12)
+      .map((it) => {
+        const rec = asRecord(it);
+        return rec ? String(rec.nodeId ?? "") : "";
+      })
+      .filter(Boolean);
+    return kvGrid([
+      ["items", String(items.length)],
+      ["cursor", fmt(o.cursor)],
+      ["sample nodeIds", sample.length ? sample.join(", ") : "—"],
+    ]);
+  }
+
+  if (endpointId === "nexum-statistics" || endpointId === "nexum-signals") {
+    return kvGrid(
+      Object.keys(o)
+        .slice(0, 16)
+        .map((k) => [k, summarizeValue(o[k])]),
+    );
+  }
+
   if (endpointId === "investigation-packets-index" || endpointId === "ui-packets-index" || endpointId === "ui-evidence") {
     const index = o.index;
     let count = "—";