@x12i/memorix-retrieval 1.30.0 → 1.31.0

package/dist/analysis/analyze-vulnerability-coverage.d.ts

@@ -0,0 +1,101 @@
+/**
+ * Vulnerability-side coverage analysis: asset inventory match, severity, subnet resolution.
+ */
+import { type AssetJoinDoc, type VulnerabilityJoinDoc } from "./count-assets-with-vulnerabilities.js";
+export type CidrIndexEntry = {
+    cidr: string;
+    recordId?: string;
+    range: {
+        network: number;
+        broadcast: number;
+        prefix: number;
+    } | null;
+};
+export type SubnetMatchResult = {
+    status: "known";
+    cidr: string;
+    recordId?: string;
+} | {
+    status: "unknown";
+    reason: "unparseable-ip" | "no-containing-cidr";
+};
+export type VulnerabilityAssetMatch = {
+    recordId?: string;
+    assetIp: string | null;
+    hasAssetInInventory: boolean;
+    isCriticalOrHigh: boolean;
+    severity: string | null;
+};
+export type VulnerabilitySubnetCoverage = {
+    assetIp: string | null;
+    subnetIp: string | null;
+    subnetIpDerivable: boolean;
+    subnetKnown: boolean;
+    subnetMatch: SubnetMatchResult | null;
+};
+export type VulnerabilityCoverageSummary = {
+    totalVulnerabilities: number;
+    withAssetInInventory: number;
+    withoutAssetInInventory: number;
+    criticalOrHighTotal: number;
+    criticalOrHighWithAsset: number;
+    criticalOrHighWithoutAsset: number;
+    derivableSubnetIp: number;
+    notDerivableSubnetIp: number;
+    knownSubnet: number;
+    unknownSubnet: number;
+};
+/** All join IPs present anywhere in the asset inventory. */
+export declare function collectInventoryAssetIps(assets: AssetJoinDoc[]): Set<string>;
+/** Does this vulnerability's assetIp appear in the asset inventory? */
+export declare function vulnerabilityHasAssetInInventory(vuln: VulnerabilityJoinDoc, inventoryIps: Set<string>): boolean;
+export declare function classifyVulnerabilityAssetMatch(vuln: VulnerabilityJoinDoc, inventoryIps: Set<string>): VulnerabilityAssetMatch;
+/**
+ * Longest-prefix CIDR match — same semantics as `@x12i/memorix-resolvers` findLongestPrefixMatch.
+ * Kept local to avoid coupling memorix-retrieval to memorix-resolvers in unit tests.
+ */
+export declare function findLongestPrefixMatchLocal(assetIp: string, cidrIndex: CidrIndexEntry[]): SubnetMatchResult;
+export declare function resolveVulnerabilitySubnetIp(vuln: VulnerabilityJoinDoc): string | null;
+export declare function classifyVulnerabilitySubnet(vuln: VulnerabilityJoinDoc, cidrIndex: CidrIndexEntry[]): VulnerabilitySubnetCoverage;
+export declare function summarizeVulnerabilityCoverage(vulnerabilities: VulnerabilityJoinDoc[], assets: AssetJoinDoc[], cidrIndex?: CidrIndexEntry[]): VulnerabilityCoverageSummary;
+/** Mongo filter: vulnerabilities whose assetIp is in the asset inventory. */
+export declare function buildVulnerabilityAssetMatchFilter(inventoryIps: string[]): {
+    "data.assetIp": {
+        $in: string[];
+    };
+};
+/** Mongo filter: vulnerabilities with no asset inventory match. */
+export declare function buildVulnerabilityAssetMissFilter(inventoryIps: string[]): {
+    "data.assetIp": {
+        $nin: string[];
+    };
+};
+/** Mongo filter: critical or high severity vulnerabilities. */
+export declare function buildCriticalOrHighVulnerabilityFilter(): {
+    "data.severity": {
+        $in: string[];
+    };
+};
+/** Assets with no linked vulnerability = complement of join filter. */
+export declare function buildAssetsWithoutVulnerabilitiesFilter(vulnerabilityIps: string[]): {
+    $nor: ({
+        "data.assetIps": {
+            $in: string[];
+        };
+        "data.assetIp"?: undefined;
+        "data.ip_address"?: undefined;
+    } | {
+        "data.assetIp": {
+            $in: string[];
+        };
+        "data.assetIps"?: undefined;
+        "data.ip_address"?: undefined;
+    } | {
+        "data.ip_address": {
+            $in: string[];
+        };
+        "data.assetIps"?: undefined;
+        "data.assetIp"?: undefined;
+    })[];
+};
+//# sourceMappingURL=analyze-vulnerability-coverage.d.ts.map

package/dist/analysis/analyze-vulnerability-coverage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyze-vulnerability-coverage.d.ts","sourceRoot":"","sources":["../../src/analysis/analyze-vulnerability-coverage.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAIL,KAAK,YAAY,EACjB,KAAK,oBAAoB,EAC1B,MAAM,wCAAwC,CAAC;AAEhD,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACtE,CAAC;AAEF,MAAM,MAAM,iBAAiB,GACzB;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,gBAAgB,GAAG,oBAAoB,CAAA;CAAE,CAAC;AAE3E,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,iBAAiB,GAAG,IAAI,CAAC;CACvC,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IACzC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,uBAAuB,EAAE,MAAM,CAAC;IAChC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,uBAAuB,EAAE,MAAM,CAAC;IAChC,0BAA0B,EAAE,MAAM,CAAC;IACnC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAQF,4DAA4D;AAC5D,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAM5E;AAED,uEAAuE;AACvE,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,oBAAoB,EAC1B,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,GACxB,OAAO,CAGT;AAED,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,oBAAoB,EAC1B,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,GACxB,uBAAuB,CASzB;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,cAAc,EAAE,GAC1B,iBAAiB,CAyBnB;AAED,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,oBAAoB,GAAG,MAAM,GAAG,IAAI,CAItF;AAED,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,oBAAoB,EAC1B,SAAS,EAAE,cAAc,EAAE,GAC1B,2BAA2B,CAuB7B;AAED,wBAAgB,8BAA8B,CAC5C,eAAe,EAAE,oBAAoB,EAAE,EACvC,MAAM,EAAE,YAAY,EAAE,EACtB,SAAS,GAAE,cAAc,EAAO,GAC/B,4BAA4B,CAkC9B;AAED,6EAA6E;AAC7E,wBAAgB,kCAAkC,CAAC,YAAY,EAAE,MAAM,EAAE;;;;EAExE;AAED,mEAAmE;AACnE,wBAAgB,iCAAiC,CAAC,YAAY,EAAE,MAAM,EAAE;;;;EAEvE;AAED,+DAA+D;AAC/D,wBAAgB,sCAAsC;;;;EAErD;AAED,uEAAuE;AACvE,wBAAgB,uCAAuC,CAAC,gBAAgB,EAAE,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;EAQjF"}

package/dist/analysis/analyze-vulnerability-coverage.js

@@ -0,0 +1,150 @@
+/**
+ * Vulnerability-side coverage analysis: asset inventory match, severity, subnet resolution.
+ */
+import { deriveSubnetIpFromAssetIp } from "./derive-subnet-ip.js";
+import { collectAssetJoinIps, isCriticalOrHighSeverity, resolveVulnerabilitySeverity, } from "./count-assets-with-vulnerabilities.js";
+function asNonEmptyString(value) {
+    if (typeof value !== "string")
+        return null;
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : null;
+}
+/** All join IPs present anywhere in the asset inventory. */
+export function collectInventoryAssetIps(assets) {
+    const ips = new Set();
+    for (const asset of assets) {
+        for (const ip of collectAssetJoinIps(asset))
+            ips.add(ip);
+    }
+    return ips;
+}
+/** Does this vulnerability's assetIp appear in the asset inventory? */
+export function vulnerabilityHasAssetInInventory(vuln, inventoryIps) {
+    const assetIp = asNonEmptyString(vuln.data?.assetIp);
+    return assetIp !== null && inventoryIps.has(assetIp);
+}
+export function classifyVulnerabilityAssetMatch(vuln, inventoryIps) {
+    const assetIp = asNonEmptyString(vuln.data?.assetIp);
+    const severity = resolveVulnerabilitySeverity(vuln);
+    return {
+        assetIp,
+        hasAssetInInventory: assetIp !== null && inventoryIps.has(assetIp),
+        isCriticalOrHigh: isCriticalOrHighSeverity(severity),
+        severity,
+    };
+}
+/**
+ * Longest-prefix CIDR match — same semantics as `@x12i/memorix-resolvers` findLongestPrefixMatch.
+ * Kept local to avoid coupling memorix-retrieval to memorix-resolvers in unit tests.
+ */
+export function findLongestPrefixMatchLocal(assetIp, cidrIndex) {
+    const parts = assetIp.split(".").map((p) => Number(p));
+    if (parts.length !== 4 || parts.some((p) => !Number.isInteger(p) || p < 0 || p > 255)) {
+        return { status: "unknown", reason: "unparseable-ip" };
+    }
+    const ipInt = ((parts[0] << 24) | (parts[1] << 16) | (parts[2] << 8) | parts[3]) >>> 0;
+    let best = null;
+    for (const entry of cidrIndex) {
+        const range = entry.range;
+        if (!range)
+            continue;
+        if (ipInt >= range.network && ipInt <= range.broadcast) {
+            if (!best || range.prefix > best.range.prefix)
+                best = { entry, range };
+        }
+    }
+    if (!best)
+        return { status: "unknown", reason: "no-containing-cidr" };
+    return {
+        status: "known",
+        cidr: best.entry.cidr,
+        recordId: best.entry.recordId,
+    };
+}
+export function resolveVulnerabilitySubnetIp(vuln) {
+    const stored = asNonEmptyString(vuln.data?.subnetIp);
+    if (stored)
+        return stored;
+    return deriveSubnetIpFromAssetIp(vuln.data?.assetIp);
+}
+export function classifyVulnerabilitySubnet(vuln, cidrIndex) {
+    const assetIp = asNonEmptyString(vuln.data?.assetIp);
+    const subnetIp = resolveVulnerabilitySubnetIp(vuln);
+    const subnetIpDerivable = subnetIp !== null;
+    if (!assetIp || !subnetIpDerivable) {
+        return {
+            assetIp,
+            subnetIp,
+            subnetIpDerivable,
+            subnetKnown: false,
+            subnetMatch: null,
+        };
+    }
+    const subnetMatch = findLongestPrefixMatchLocal(assetIp, cidrIndex);
+    return {
+        assetIp,
+        subnetIp,
+        subnetIpDerivable,
+        subnetKnown: subnetMatch.status === "known",
+        subnetMatch,
+    };
+}
+export function summarizeVulnerabilityCoverage(vulnerabilities, assets, cidrIndex = []) {
+    const inventoryIps = collectInventoryAssetIps(assets);
+    let withAssetInInventory = 0;
+    let criticalOrHighTotal = 0;
+    let criticalOrHighWithAsset = 0;
+    let derivableSubnetIp = 0;
+    let knownSubnet = 0;
+    for (const vuln of vulnerabilities) {
+        const match = classifyVulnerabilityAssetMatch(vuln, inventoryIps);
+        if (match.hasAssetInInventory)
+            withAssetInInventory += 1;
+        if (match.isCriticalOrHigh) {
+            criticalOrHighTotal += 1;
+            if (match.hasAssetInInventory)
+                criticalOrHighWithAsset += 1;
+        }
+        const subnet = classifyVulnerabilitySubnet(vuln, cidrIndex);
+        if (subnet.subnetIpDerivable)
+            derivableSubnetIp += 1;
+        if (subnet.subnetKnown)
+            knownSubnet += 1;
+    }
+    const totalVulnerabilities = vulnerabilities.length;
+    return {
+        totalVulnerabilities,
+        withAssetInInventory,
+        withoutAssetInInventory: totalVulnerabilities - withAssetInInventory,
+        criticalOrHighTotal,
+        criticalOrHighWithAsset,
+        criticalOrHighWithoutAsset: criticalOrHighTotal - criticalOrHighWithAsset,
+        derivableSubnetIp,
+        notDerivableSubnetIp: totalVulnerabilities - derivableSubnetIp,
+        knownSubnet,
+        unknownSubnet: derivableSubnetIp - knownSubnet,
+    };
+}
+/** Mongo filter: vulnerabilities whose assetIp is in the asset inventory. */
+export function buildVulnerabilityAssetMatchFilter(inventoryIps) {
+    return { "data.assetIp": { $in: inventoryIps } };
+}
+/** Mongo filter: vulnerabilities with no asset inventory match. */
+export function buildVulnerabilityAssetMissFilter(inventoryIps) {
+    return { "data.assetIp": { $nin: inventoryIps } };
+}
+/** Mongo filter: critical or high severity vulnerabilities. */
+export function buildCriticalOrHighVulnerabilityFilter() {
+    return { "data.severity": { $in: ["critical", "high"] } };
+}
+/** Assets with no linked vulnerability = complement of join filter. */
+export function buildAssetsWithoutVulnerabilitiesFilter(vulnerabilityIps) {
+    return {
+        $nor: [
+            { "data.assetIps": { $in: vulnerabilityIps } },
+            { "data.assetIp": { $in: vulnerabilityIps } },
+            { "data.ip_address": { $in: vulnerabilityIps } },
+        ],
+    };
+}
+//# sourceMappingURL=analyze-vulnerability-coverage.js.map

package/dist/analysis/analyze-vulnerability-coverage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyze-vulnerability-coverage.js","sourceRoot":"","sources":["../../src/analysis/analyze-vulnerability-coverage.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,4BAA4B,GAG7B,MAAM,wCAAwC,CAAC;AAyChD,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,wBAAwB,CAAC,MAAsB;IAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,MAAM,EAAE,IAAI,mBAAmB,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,gCAAgC,CAC9C,IAA0B,EAC1B,YAAyB;IAEzB,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACrD,OAAO,OAAO,KAAK,IAAI,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,IAA0B,EAC1B,YAAyB;IAEzB,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAC;IACpD,OAAO;QACL,OAAO;QACP,mBAAmB,EAAE,OAAO,KAAK,IAAI,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC;QAClE,gBAAgB,EAAE,wBAAwB,CAAC,QAAQ,CAAC;QACpD,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CACzC,OAAe,EACf,SAA2B;IAE3B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;QACtF,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACzD,CAAC;IACD,MAAM,KAAK,GACT,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,CAAC;IAE/E,IAAI,IAAI,GACN,IAAI,CAAC;IAEP,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QAC1B,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACvD,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM;gBAAE,IAAI,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACzE,CAAC;IACH,CAAC;IAED,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACtE,OAAO;QACL,MAAM,EAAE,OAAO;QACf,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;QACrB,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ;KAC9B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,IAA0B;IACrE,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACrD,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,OAAO,yBAAyB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,IAA0B,EAC1B,SAA2B;IAE3B,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,iBAAiB,GAAG,QAAQ,KAAK,IAAI,CAAC;IAE5C,IAAI,CAAC,OAAO,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACnC,OAAO;YACL,OAAO;YACP,QAAQ;YACR,iBAAiB;YACjB,WAAW,EAAE,KAAK;YAClB,WAAW,EAAE,IAAI;SAClB,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,2BAA2B,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACpE,OAAO;QACL,OAAO;QACP,QAAQ;QACR,iBAAiB;QACjB,WAAW,EAAE,WAAW,CAAC,MAAM,KAAK,OAAO;QAC3C,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,eAAuC,EACvC,MAAsB,EACtB,YAA8B,EAAE;IAEhC,MAAM,YAAY,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACtD,IAAI,oBAAoB,GAAG,CAAC,CAAC;IAC7B,IAAI,mBAAmB,GAAG,CAAC,CAAC;IAC5B,IAAI,uBAAuB,GAAG,CAAC,CAAC;IAChC,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,IAAI,WAAW,GAAG,CAAC,CAAC;IAEpB,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,+BAA+B,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAClE,IAAI,KAAK,CAAC,mBAAmB;YAAE,oBAAoB,IAAI,CAAC,CAAC;QACzD,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;YAC3B,mBAAmB,IAAI,CAAC,CAAC;YACzB,IAAI,KAAK,CAAC,mBAAmB;gBAAE,uBAAuB,IAAI,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,MAAM,GAAG,2BAA2B,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC5D,IAAI,MAAM,CAAC,iBAAiB;YAAE,iBAAiB,IAAI,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,WAAW;YAAE,WAAW,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,oBAAoB,GAAG,eAAe,CAAC,MAAM,CAAC;IACpD,OAAO;QACL,oBAAoB;QACpB,oBAAoB;QACpB,uBAAuB,EAAE,oBAAoB,GAAG,oBAAoB;QACpE,mBAAmB;QACnB,uBAAuB;QACvB,0BAA0B,EAAE,mBAAmB,GAAG,uBAAuB;QACzE,iBAAiB;QACjB,oBAAoB,EAAE,oBAAoB,GAAG,iBAAiB;QAC9D,WAAW;QACX,aAAa,EAAE,iBAAiB,GAAG,WAAW;KAC/C,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,kCAAkC,CAAC,YAAsB;IACvE,OAAO,EAAE,cAAc,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,EAAE,CAAC;AACnD,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,iCAAiC,CAAC,YAAsB;IACtE,OAAO,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,CAAC;AACpD,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,sCAAsC;IACpD,OAAO,EAAE,eAAe,EAAE,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;AAC5D,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,uCAAuC,CAAC,gBAA0B;IAChF,OAAO;QACL,IAAI,EAAE;YACJ,EAAE,eAAe,EAAE,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE;YAC9C,EAAE,cAAc,EAAE,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE;YAC7C,EAAE,iBAAiB,EAAE,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE;SACjD;KACF,CAAC;AACJ,CAAC"}

package/dist/analysis/count-assets-with-vulnerabilities.d.ts

@@ -0,0 +1,89 @@
+/**
+ * Count assets that have at least one linked vulnerability via the
+ * `assetVulnerabilities` relation join:
+ *   assets.data.assetIps[] / assets.data.assetIp  ↔  vulnerabilities.data.assetIp
+ */
+export type AssetJoinDoc = {
+    recordId?: string;
+    entityId?: string;
+    data?: {
+        assetIps?: unknown;
+        assetIp?: unknown;
+        ip_address?: unknown;
+    };
+};
+export type VulnerabilityJoinDoc = {
+    data?: {
+        assetIp?: unknown;
+        subnetIp?: unknown;
+        severity?: unknown;
+        severityLevel?: unknown;
+        riskLevel?: unknown;
+    };
+};
+/** Resolve severity from common vulnerability snapshot fields. */
+export declare function resolveVulnerabilitySeverity(vuln: VulnerabilityJoinDoc): string | null;
+export declare function isCriticalOrHighSeverity(severity: string | null): boolean;
+/** Collect all IP values used to join an asset to vulnerabilities. */
+export declare function collectAssetJoinIps(asset: AssetJoinDoc): string[];
+/** Collect distinct vulnerability join IPs from in-memory docs. */
+export declare function collectVulnerabilityJoinIps(vulnerabilities: VulnerabilityJoinDoc[]): Set<string>;
+export declare function assetHasLinkedVulnerability(asset: AssetJoinDoc, vulnerabilityIps: Set<string>): boolean;
+export declare function resolveAssetRecordId(asset: AssetJoinDoc): string;
+export type AssetVulnerabilityExposure = {
+    recordId: string;
+    hasAnyVulnerability: boolean;
+    hasCriticalOrHighVulnerability: boolean;
+    vulnerabilityCount: number;
+    criticalOrHighCount: number;
+};
+export type AssetsWithVulnerabilitiesSummary = {
+    totalAssets: number;
+    assetsWithAnyVulnerability: number;
+    assetsWithCriticalOrHighVulnerability: number;
+    assetsWithoutVulnerabilities: number;
+    anyVulnerabilityCoveragePct: number;
+    criticalOrHighCoveragePct: number;
+    distinctVulnerabilityIps: number;
+    distinctVulnerabilityIpsMatchingAssets: number;
+    assetIdsWithAnyVulnerability: string[];
+    assetIdsWithCriticalOrHighVulnerability: string[];
+    /** @deprecated use assetsWithAnyVulnerability */
+    assetsWithVulnerabilities: number;
+    /** @deprecated use assetIdsWithAnyVulnerability */
+    assetIdsWithVulnerabilities: string[];
+    /** @deprecated use anyVulnerabilityCoveragePct */
+    coveragePct: number;
+};
+export declare function buildVulnerabilityExposureByIp(vulnerabilities: VulnerabilityJoinDoc[]): Map<string, {
+    total: number;
+    criticalOrHigh: number;
+}>;
+export declare function summarizeAssetVulnerabilityExposure(asset: AssetJoinDoc, exposureByIp: Map<string, {
+    total: number;
+    criticalOrHigh: number;
+}>): AssetVulnerabilityExposure;
+export declare function summarizeAssetsWithVulnerabilities(assets: AssetJoinDoc[], vulnerabilities: VulnerabilityJoinDoc[]): AssetsWithVulnerabilitiesSummary;
+/** Mongo filter for assets whose join IPs intersect vulnerability IPs. */
+export declare function buildAssetVulnerabilityJoinFilter(vulnerabilityIps: string[]): {
+    $or: ({
+        "data.assetIps": {
+            $in: string[];
+        };
+        "data.assetIp"?: undefined;
+        "data.ip_address"?: undefined;
+    } | {
+        "data.assetIp": {
+            $in: string[];
+        };
+        "data.assetIps"?: undefined;
+        "data.ip_address"?: undefined;
+    } | {
+        "data.ip_address": {
+            $in: string[];
+        };
+        "data.assetIps"?: undefined;
+        "data.assetIp"?: undefined;
+    })[];
+};
+//# sourceMappingURL=count-assets-with-vulnerabilities.d.ts.map

package/dist/analysis/count-assets-with-vulnerabilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"count-assets-with-vulnerabilities.d.ts","sourceRoot":"","sources":["../../src/analysis/count-assets-with-vulnerabilities.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE;QACL,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,UAAU,CAAC,EAAE,OAAO,CAAC;KACtB,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,SAAS,CAAC,EAAE,OAAO,CAAC;KACrB,CAAC;CACH,CAAC;AASF,kEAAkE;AAClE,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,oBAAoB,GAAG,MAAM,GAAG,IAAI,CAMtF;AAED,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAEzE;AAQD,sEAAsE;AACtE,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,EAAE,CAgBjE;AAED,mEAAmE;AACnE,wBAAgB,2BAA2B,CACzC,eAAe,EAAE,oBAAoB,EAAE,GACtC,GAAG,CAAC,MAAM,CAAC,CAOb;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,YAAY,EACnB,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,GAC5B,OAAO,CAET;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CAEhE;AAED,MAAM,MAAM,0BAA0B,GAAG;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,8BAA8B,EAAE,OAAO,CAAC;IACxC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,mBAAmB,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,gCAAgC,GAAG;IAC7C,WAAW,EAAE,MAAM,CAAC;IACpB,0BAA0B,EAAE,MAAM,CAAC;IACnC,qCAAqC,EAAE,MAAM,CAAC;IAC9C,4BAA4B,EAAE,MAAM,CAAC;IACrC,2BAA2B,EAAE,MAAM,CAAC;IACpC,yBAAyB,EAAE,MAAM,CAAC;IAClC,wBAAwB,EAAE,MAAM,CAAC;IACjC,sCAAsC,EAAE,MAAM,CAAC;IAC/C,4BAA4B,EAAE,MAAM,EAAE,CAAC;IACvC,uCAAuC,EAAE,MAAM,EAAE,CAAC;IAClD,iDAAiD;IACjD,yBAAyB,EAAE,MAAM,CAAC;IAClC,mDAAmD;IACnD,2BAA2B,EAAE,MAAM,EAAE,CAAC;IACtC,kDAAkD;IAClD,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,wBAAgB,8BAA8B,CAC5C,eAAe,EAAE,oBAAoB,EAAE,GACtC,GAAG,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC,CAexD;AAED,wBAAgB,mCAAmC,CACjD,KAAK,EAAE,YAAY,EACnB,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC,GACnE,0BAA0B,CAmB5B;AAED,wBAAgB,kCAAkC,CAChD,MAAM,EAAE,YAAY,EAAE,EACtB,eAAe,EAAE,oBAAoB,EAAE,GACtC,gCAAgC,CA8ClC;AAED,0EAA0E;AAC1E,wBAAgB,iCAAiC,CAAC,gBAAgB,EAAE,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;EAQ3E"}

package/dist/analysis/count-assets-with-vulnerabilities.js

@@ -0,0 +1,143 @@
+/**
+ * Count assets that have at least one linked vulnerability via the
+ * `assetVulnerabilities` relation join:
+ *   assets.data.assetIps[] / assets.data.assetIp  ↔  vulnerabilities.data.assetIp
+ */
+const CRITICAL_OR_HIGH_SEVERITIES = new Set(["critical", "high"]);
+function normalizeSeverity(value) {
+    const text = asNonEmptyString(value);
+    return text ? text.toLowerCase() : null;
+}
+/** Resolve severity from common vulnerability snapshot fields. */
+export function resolveVulnerabilitySeverity(vuln) {
+    return (normalizeSeverity(vuln.data?.severity) ??
+        normalizeSeverity(vuln.data?.severityLevel) ??
+        normalizeSeverity(vuln.data?.riskLevel));
+}
+export function isCriticalOrHighSeverity(severity) {
+    return severity !== null && CRITICAL_OR_HIGH_SEVERITIES.has(severity);
+}
+function asNonEmptyString(value) {
+    if (typeof value !== "string")
+        return null;
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : null;
+}
+/** Collect all IP values used to join an asset to vulnerabilities. */
+export function collectAssetJoinIps(asset) {
+    const ips = new Set();
+    const push = (value) => {
+        const ip = asNonEmptyString(value);
+        if (ip)
+            ips.add(ip);
+    };
+    push(asset.data?.assetIp);
+    push(asset.data?.ip_address);
+    const assetIps = asset.data?.assetIps;
+    if (Array.isArray(assetIps)) {
+        for (const entry of assetIps)
+            push(entry);
+    }
+    return [...ips];
+}
+/** Collect distinct vulnerability join IPs from in-memory docs. */
+export function collectVulnerabilityJoinIps(vulnerabilities) {
+    const ips = new Set();
+    for (const vuln of vulnerabilities) {
+        const ip = asNonEmptyString(vuln.data?.assetIp);
+        if (ip)
+            ips.add(ip);
+    }
+    return ips;
+}
+export function assetHasLinkedVulnerability(asset, vulnerabilityIps) {
+    return collectAssetJoinIps(asset).some((ip) => vulnerabilityIps.has(ip));
+}
+export function resolveAssetRecordId(asset) {
+    return asset.recordId ?? asset.entityId ?? "(unknown)";
+}
+export function buildVulnerabilityExposureByIp(vulnerabilities) {
+    const byIp = new Map();
+    for (const vuln of vulnerabilities) {
+        const ip = asNonEmptyString(vuln.data?.assetIp);
+        if (!ip)
+            continue;
+        const severity = resolveVulnerabilitySeverity(vuln);
+        const entry = byIp.get(ip) ?? { total: 0, criticalOrHigh: 0 };
+        entry.total += 1;
+        if (isCriticalOrHighSeverity(severity))
+            entry.criticalOrHigh += 1;
+        byIp.set(ip, entry);
+    }
+    return byIp;
+}
+export function summarizeAssetVulnerabilityExposure(asset, exposureByIp) {
+    const recordId = resolveAssetRecordId(asset);
+    let vulnerabilityCount = 0;
+    let criticalOrHighCount = 0;
+    for (const ip of collectAssetJoinIps(asset)) {
+        const exposure = exposureByIp.get(ip);
+        if (!exposure)
+            continue;
+        vulnerabilityCount += exposure.total;
+        criticalOrHighCount += exposure.criticalOrHigh;
+    }
+    return {
+        recordId,
+        hasAnyVulnerability: vulnerabilityCount > 0,
+        hasCriticalOrHighVulnerability: criticalOrHighCount > 0,
+        vulnerabilityCount,
+        criticalOrHighCount,
+    };
+}
+export function summarizeAssetsWithVulnerabilities(assets, vulnerabilities) {
+    const vulnerabilityIps = collectVulnerabilityJoinIps(vulnerabilities);
+    const exposureByIp = buildVulnerabilityExposureByIp(vulnerabilities);
+    const assetIdsWithAnyVulnerability = [];
+    const assetIdsWithCriticalOrHighVulnerability = [];
+    const matchedVulnIps = new Set();
+    for (const asset of assets) {
+        const exposure = summarizeAssetVulnerabilityExposure(asset, exposureByIp);
+        if (!exposure.hasAnyVulnerability)
+            continue;
+        assetIdsWithAnyVulnerability.push(exposure.recordId);
+        if (exposure.hasCriticalOrHighVulnerability) {
+            assetIdsWithCriticalOrHighVulnerability.push(exposure.recordId);
+        }
+        for (const ip of collectAssetJoinIps(asset)) {
+            if (vulnerabilityIps.has(ip))
+                matchedVulnIps.add(ip);
+        }
+    }
+    const totalAssets = assets.length;
+    const assetsWithAnyVulnerability = assetIdsWithAnyVulnerability.length;
+    const assetsWithCriticalOrHighVulnerability = assetIdsWithCriticalOrHighVulnerability.length;
+    return {
+        totalAssets,
+        assetsWithAnyVulnerability,
+        assetsWithCriticalOrHighVulnerability,
+        assetsWithoutVulnerabilities: totalAssets - assetsWithAnyVulnerability,
+        anyVulnerabilityCoveragePct: totalAssets === 0 ? 0 : (assetsWithAnyVulnerability / totalAssets) * 100,
+        criticalOrHighCoveragePct: totalAssets === 0
+            ? 0
+            : (assetsWithCriticalOrHighVulnerability / totalAssets) * 100,
+        distinctVulnerabilityIps: vulnerabilityIps.size,
+        distinctVulnerabilityIpsMatchingAssets: matchedVulnIps.size,
+        assetIdsWithAnyVulnerability,
+        assetIdsWithCriticalOrHighVulnerability,
+        assetsWithVulnerabilities: assetsWithAnyVulnerability,
+        assetIdsWithVulnerabilities: assetIdsWithAnyVulnerability,
+        coveragePct: totalAssets === 0 ? 0 : (assetsWithAnyVulnerability / totalAssets) * 100,
+    };
+}
+/** Mongo filter for assets whose join IPs intersect vulnerability IPs. */
+export function buildAssetVulnerabilityJoinFilter(vulnerabilityIps) {
+    return {
+        $or: [
+            { "data.assetIps": { $in: vulnerabilityIps } },
+            { "data.assetIp": { $in: vulnerabilityIps } },
+            { "data.ip_address": { $in: vulnerabilityIps } },
+        ],
+    };
+}
+//# sourceMappingURL=count-assets-with-vulnerabilities.js.map

package/dist/analysis/count-assets-with-vulnerabilities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"count-assets-with-vulnerabilities.js","sourceRoot":"","sources":["../../src/analysis/count-assets-with-vulnerabilities.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAsBH,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;AAElE,SAAS,iBAAiB,CAAC,KAAc;IACvC,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACrC,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1C,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,4BAA4B,CAAC,IAA0B;IACrE,OAAO,CACL,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACtC,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC;QAC3C,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CACxC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,QAAuB;IAC9D,OAAO,QAAQ,KAAK,IAAI,IAAI,2BAA2B,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,mBAAmB,CAAC,KAAmB;IACrD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,EAAE;QAC9B,MAAM,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,EAAE;YAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACtB,CAAC,CAAC;IAEF,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1B,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAE7B,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC;IACtC,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,KAAK,MAAM,KAAK,IAAI,QAAQ;YAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,2BAA2B,CACzC,eAAuC;IAEvC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,EAAE;YAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,KAAmB,EACnB,gBAA6B;IAE7B,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAmB;IACtD,OAAO,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,IAAI,WAAW,CAAC;AACzD,CAAC;AA6BD,MAAM,UAAU,8BAA8B,CAC5C,eAAuC;IAEvC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAqD,CAAC;IAE1E,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,EAAE;YAAE,SAAS;QAElB,MAAM,QAAQ,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC;QAC9D,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;QACjB,IAAI,wBAAwB,CAAC,QAAQ,CAAC;YAAE,KAAK,CAAC,cAAc,IAAI,CAAC,CAAC;QAClE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACtB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,KAAmB,EACnB,YAAoE;IAEpE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAC3B,IAAI,mBAAmB,GAAG,CAAC,CAAC;IAE5B,KAAK,MAAM,EAAE,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,QAAQ;YAAE,SAAS;QACxB,kBAAkB,IAAI,QAAQ,CAAC,KAAK,CAAC;QACrC,mBAAmB,IAAI,QAAQ,CAAC,cAAc,CAAC;IACjD,CAAC;IAED,OAAO;QACL,QAAQ;QACR,mBAAmB,EAAE,kBAAkB,GAAG,CAAC;QAC3C,8BAA8B,EAAE,mBAAmB,GAAG,CAAC;QACvD,kBAAkB;QAClB,mBAAmB;KACpB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,MAAsB,EACtB,eAAuC;IAEvC,MAAM,gBAAgB,GAAG,2BAA2B,CAAC,eAAe,CAAC,CAAC;IACtE,MAAM,YAAY,GAAG,8BAA8B,CAAC,eAAe,CAAC,CAAC;IACrE,MAAM,4BAA4B,GAAa,EAAE,CAAC;IAClD,MAAM,uCAAuC,GAAa,EAAE,CAAC;IAC7D,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IAEzC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,mCAAmC,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QAC1E,IAAI,CAAC,QAAQ,CAAC,mBAAmB;YAAE,SAAS;QAE5C,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,QAAQ,CAAC,8BAA8B,EAAE,CAAC;YAC5C,uCAAuC,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAClE,CAAC;QAED,KAAK,MAAM,EAAE,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC;IAClC,MAAM,0BAA0B,GAAG,4BAA4B,CAAC,MAAM,CAAC;IACvE,MAAM,qCAAqC,GACzC,uCAAuC,CAAC,MAAM,CAAC;IAEjD,OAAO;QACL,WAAW;QACX,0BAA0B;QAC1B,qCAAqC;QACrC,4BAA4B,EAAE,WAAW,GAAG,0BAA0B;QACtE,2BAA2B,EACzB,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,0BAA0B,GAAG,WAAW,CAAC,GAAG,GAAG;QAC1E,yBAAyB,EACvB,WAAW,KAAK,CAAC;YACf,CAAC,CAAC,CAAC;YACH,CAAC,CAAC,CAAC,qCAAqC,GAAG,WAAW,CAAC,GAAG,GAAG;QACjE,wBAAwB,EAAE,gBAAgB,CAAC,IAAI;QAC/C,sCAAsC,EAAE,cAAc,CAAC,IAAI;QAC3D,4BAA4B;QAC5B,uCAAuC;QACvC,yBAAyB,EAAE,0BAA0B;QACrD,2BAA2B,EAAE,4BAA4B;QACzD,WAAW,EACT,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,0BAA0B,GAAG,WAAW,CAAC,GAAG,GAAG;KAC3E,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,iCAAiC,CAAC,gBAA0B;IAC1E,OAAO;QACL,GAAG,EAAE;YACH,EAAE,eAAe,EAAE,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE;YAC9C,EAAE,cAAc,EAAE,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE;YAC7C,EAAE,iBAAiB,EAAE,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE;SACjD;KACF,CAAC;AACJ,CAAC"}

package/dist/analysis/derive-subnet-ip.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Derive legacy subnet keys from IPv4 addresses — first three octets.
+ * Same rule as `scripts/memorix-2.0-migrate/patches/backfill-assets-snapshots-subnet-ip.mjs`.
+ *
+ * Example: 10.38.16.147 -> 10.38.16
+ */
+export declare function deriveSubnetIpFromAssetIp(value: unknown): string | null;
+export declare function resolveVulnerabilityAssetIp(vuln: {
+    data?: {
+        assetIp?: unknown;
+    };
+}): string | null;
+export declare function deriveSubnetIpForVulnerability(vuln: {
+    data?: {
+        assetIp?: unknown;
+    };
+}): string | null;
+//# sourceMappingURL=derive-subnet-ip.d.ts.map

package/dist/analysis/derive-subnet-ip.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"derive-subnet-ip.d.ts","sourceRoot":"","sources":["../../src/analysis/derive-subnet-ip.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAcvE;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CAC9B,GAAG,MAAM,GAAG,IAAI,CAKhB;AAED,wBAAgB,8BAA8B,CAAC,IAAI,EAAE;IACnD,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CAC9B,GAAG,MAAM,GAAG,IAAI,CAEhB"}

package/dist/analysis/derive-subnet-ip.js

@@ -0,0 +1,32 @@
+/**
+ * Derive legacy subnet keys from IPv4 addresses — first three octets.
+ * Same rule as `scripts/memorix-2.0-migrate/patches/backfill-assets-snapshots-subnet-ip.mjs`.
+ *
+ * Example: 10.38.16.147 -> 10.38.16
+ */
+const IPV4_RE = /\b(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})\b/;
+export function deriveSubnetIpFromAssetIp(value) {
+    if (value === null || value === undefined)
+        return null;
+    const text = String(value).trim();
+    if (!text)
+        return null;
+    const match = text.match(IPV4_RE);
+    if (!match)
+        return null;
+    const octets = [match[1], match[2], match[3], match[4]].map((part) => Number(part));
+    if (octets.some((n) => !Number.isInteger(n) || n < 0 || n > 255))
+        return null;
+    return `${octets[0]}.${octets[1]}.${octets[2]}`;
+}
+export function resolveVulnerabilityAssetIp(vuln) {
+    const ip = vuln.data?.assetIp;
+    if (typeof ip !== "string")
+        return null;
+    const trimmed = ip.trim();
+    return trimmed.length > 0 ? trimmed : null;
+}
+export function deriveSubnetIpForVulnerability(vuln) {
+    return deriveSubnetIpFromAssetIp(resolveVulnerabilityAssetIp(vuln));
+}
+//# sourceMappingURL=derive-subnet-ip.js.map

package/dist/analysis/derive-subnet-ip.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"derive-subnet-ip.js","sourceRoot":"","sources":["../../src/analysis/derive-subnet-ip.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,OAAO,GAAG,gDAAgD,CAAC;AAEjE,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACnE,MAAM,CAAC,IAAI,CAAC,CACb,CAAC;IACF,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9E,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,IAE3C;IACC,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;IAC9B,IAAI,OAAO,EAAE,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,OAAO,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;IAC1B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,IAE9C;IACC,OAAO,yBAAyB,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC;AACtE,CAAC"}

package/dist/descriptors/content-type-labels.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"content-type-labels.d.ts","sourceRoot":"","sources":["../../src/descriptors/content-type-labels.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,eAAO,MAAM,2BAA2B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAW9D,CAAC;AAEF,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,OAAO,uBAAuB,EAAE,uBAAuB,GAC9D,MAAM,EAAE,CAEV;AAED,2EAA2E;AAC3E,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,OAAO,uBAAuB,EAAE,uBAAuB,GAC9D,MAAM,CAGR;AAED,uFAAuF;AACvF,eAAO,MAAM,8BAA8B,cAAc,CAAC;AAE1D,wBAAgB,kCAAkC,CAChD,MAAM,EAAE,OAAO,uBAAuB,EAAE,uBAAuB,GAC9D,OAAO,CAET"}
+{"version":3,"file":"content-type-labels.d.ts","sourceRoot":"","sources":["../../src/descriptors/content-type-labels.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,eAAO,MAAM,2BAA2B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAU9D,CAAC;AAEF,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,OAAO,uBAAuB,EAAE,uBAAuB,GAC9D,MAAM,EAAE,CAEV;AAED,2EAA2E;AAC3E,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,OAAO,uBAAuB,EAAE,uBAAuB,GAC9D,MAAM,CAGR;AAED,uFAAuF;AACvF,eAAO,MAAM,8BAA8B,cAAc,CAAC;AAE1D,wBAAgB,kCAAkC,CAChD,MAAM,EAAE,OAAO,uBAAuB,EAAE,uBAAuB,GAC9D,OAAO,CAET"}

package/dist/descriptors/content-type-labels.js

@@ -2,14 +2,13 @@
 export const MEMORIX_CONTENT_TYPE_LABELS = {
     scoped: "Scoped records",
     snapshots: "Snapshots",
+    discovery: "Discovery",
+    analysis: "Analysis",
+    decisions: "Decisions",
     narratives: "Narratives",
-    web: "Web",
-    "web-scoped": "Web (scoped)",
+    "ai-processing": "AI processing",
     raw: "Raw",
-    inference: "Inference",
     analytics: "Analytics",
-    foresights: "Foresights",
-    analysis: "Analysis",
 };
 export function memorixContentTypeLabel(contentType) {
     return MEMORIX_CONTENT_TYPE_LABELS[contentType] ?? contentType;

package/dist/descriptors/content-type-labels.js.map

@@ -1 +1 @@
-{"version":3,"file":"content-type-labels.js","sourceRoot":"","sources":["../../src/descriptors/content-type-labels.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,MAAM,CAAC,MAAM,2BAA2B,GAA2B;IACjE,MAAM,EAAE,gBAAgB;IACxB,SAAS,EAAE,WAAW;IACtB,UAAU,EAAE,YAAY;IACxB,GAAG,EAAE,KAAK;IACV,YAAY,EAAE,cAAc;IAC5B,GAAG,EAAE,KAAK;IACV,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,WAAW;IACtB,UAAU,EAAE,YAAY;IACxB,QAAQ,EAAE,UAAU;CACrB,CAAC;AAEF,MAAM,UAAU,uBAAuB,CAAC,WAAmB;IACzD,OAAO,2BAA2B,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,MAA+D;IAE/D,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;AAC1C,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,wBAAwB,CACtC,MAA+D;IAE/D,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM;QAAE,OAAO,QAAQ,CAAC;IAChD,OAAO,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC;AAC9C,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,MAAM,8BAA8B,GAAG,WAAW,CAAC;AAE1D,MAAM,UAAU,kCAAkC,CAChD,MAA+D;IAE/D,OAAO,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,8BAA8B,CAAC,CAAC,CAAC;AACtE,CAAC"}
+{"version":3,"file":"content-type-labels.js","sourceRoot":"","sources":["../../src/descriptors/content-type-labels.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,MAAM,CAAC,MAAM,2BAA2B,GAA2B;IACjE,MAAM,EAAE,gBAAgB;IACxB,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,WAAW;IACtB,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;IACtB,UAAU,EAAE,YAAY;IACxB,eAAe,EAAE,eAAe;IAChC,GAAG,EAAE,KAAK;IACV,SAAS,EAAE,WAAW;CACvB,CAAC;AAEF,MAAM,UAAU,uBAAuB,CAAC,WAAmB;IACzD,OAAO,2BAA2B,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,MAA+D;IAE/D,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;AAC1C,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,wBAAwB,CACtC,MAA+D;IAE/D,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM;QAAE,OAAO,QAAQ,CAAC;IAChD,OAAO,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC;AAC9C,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,MAAM,8BAA8B,GAAG,WAAW,CAAC;AAE1D,MAAM,UAAU,kCAAkC,CAChD,MAA+D;IAE/D,OAAO,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,8BAA8B,CAAC,CAAC,CAAC;AACtE,CAAC"}