// ============================================================================
// Imara — mock dataset
// Built on the repo's operator naming convention: CMP-{SITE}-{ROLE}-V{NNN}
// Sites: DC (primary datacenter), DR (disaster recovery), DEV, LAB
// Auto-derived labels mirror the real platform (site, role, env, _subnet_24).
// ============================================================================

const NOW = Date.now();
const mins = (n) => new Date(NOW - n * 60000).toISOString();
const secs = (n) => new Date(NOW - n * 1000).toISOString();
const hrs = (n) => new Date(NOW - n * 3600000).toISOString();
const days = (n) => new Date(NOW - n * 86400000).toISOString();

// ---- distro pool -----------------------------------------------------------
const DISTROS = [
  { os_family: "linux", os_distro: "Rocky", os_version: "9.3", kernel: "5.14.0-362" },
  { os_family: "linux", os_distro: "Debian", os_version: "12", kernel: "6.1.0-18" },
  { os_family: "linux", os_distro: "Ubuntu", os_version: "22.04", kernel: "5.15.0-105" },
  { os_family: "linux", os_distro: "Ubuntu", os_version: "24.04", kernel: "6.8.0-39" },
  { os_family: "linux", os_distro: "AlmaLinux", os_version: "9.4", kernel: "5.14.0-427" },
];

// hostname role → tier label
const ROLE_TIER = { ADC: "edge", WEB: "web", APP: "app", CBS: "app", MQ: "infra", CACHE: "infra", DB: "db", AGT: "infra" };

// fleet definition — [site, role, idx, app, env, freshness]
const FLEET_DEF = [
  ["DC", "ADC", 1, "payments", "prod", "live"],
  ["DC", "ADC", 2, "payments", "prod", "live"],
  ["DC", "WEB", 1, "payments", "prod", "live"],
  ["DC", "WEB", 2, "payments", "prod", "live"],
  ["DC", "WEB", 3, "payments", "prod", "stale"],
  ["DC", "APP", 1, "payments", "prod", "live"],
  ["DC", "APP", 2, "payments", "prod", "live"],
  ["DC", "CBS", 1, "payments", "prod", "live"],
  ["DC", "DB", 1, "payments", "prod", "live"],
  ["DC", "DB", 2, "payments", "prod", "live"],
  ["DC", "MQ", 1, "payments", "prod", "live"],
  ["DC", "CACHE", 1, "payments", "prod", "live"],
  ["DC", "WEB", 4, "onlinebank", "prod", "live"],
  ["DC", "WEB", 5, "onlinebank", "prod", "live"],
  ["DC", "APP", 3, "onlinebank", "prod", "live"],
  ["DC", "APP", 4, "onlinebank", "prod", "silent"],
  ["DC", "DB", 3, "onlinebank", "prod", "live"],
  ["DR", "WEB", 1, "payments", "prod", "live"],
  ["DR", "APP", 1, "payments", "prod", "live"],
  ["DR", "DB", 1, "payments", "prod", "live"],
  ["DC", "AGT", 1, "platform", "prod", "live"],
  ["DEV", "APP", 1, "payments", "dev", "live"],
  ["DEV", "DB", 1, "payments", "dev", "stale"],
  ["LAB", "AGT", 1, "platform", "lab", "live"],
];

const APP_NAMES = {
  payments: "Payments",
  onlinebank: "Online Banking",
  platform: "Platform",
};

function subnet(site) {
  return { DC: "10.40.2", DR: "10.60.2", DEV: "10.20.4", LAB: "10.10.8" }[site];
}

const SERVERS = FLEET_DEF.map(([site, role, idx, app, env, fresh], i) => {
  const d = DISTROS[i % DISTROS.length];
  const tier = ROLE_TIER[role];
  const hostname = `CMP-${site}-${role}-V${String(idx).padStart(3, "0")}`;
  const ageSec = fresh === "live" ? 2 + (i % 8) : fresh === "stale" ? 95 + i : 1100 + i * 7;
  const ip = `${subnet(site)}.${10 + i}`;
  return {
    agent_id: `agt-${hostname.toLowerCase()}`,
    hostname,
    ip,
    agent_version: "1.8.2",
    ...d,
    arch: "x86_64",
    fresh,
    ageSec,
    tier,
    role,
    app,
    labels: {
      site,
      role: role.toLowerCase(),
      env,
      tier,
      app,
      _subnet_24: `${subnet(site)}.0/24`,
    },
    cpu: fresh === "live" ? 1.2 + (i % 5) * 0.4 : 0,
    mem: 110 + (i % 7) * 9,
    first_seen: days(40 + i),
    last_seen: fresh === "live" ? secs(ageSec) : fresh === "stale" ? secs(ageSec) : mins(Math.round(ageSec / 60)),
  };
});

const byId = Object.fromEntries(SERVERS.map((s) => [s.agent_id, s]));
const fleetCounts = {
  total: SERVERS.length,
  live: SERVERS.filter((s) => s.fresh === "live").length,
  stale: SERVERS.filter((s) => s.fresh === "stale").length,
  silent: SERVERS.filter((s) => s.fresh === "silent").length,
};

// ---- groups (label-selector based) -----------------------------------------
const GROUPS = [
  { id: 1, name: "Payments · web tier", description: "Public-facing web frontends for Payments", selector: { app: "payments", tier: "web" }, created_at: days(38) },
  { id: 2, name: "Payments · app tier", description: "Application + core-banking servers", selector: { app: "payments", tier: "app" }, created_at: days(38) },
  { id: 3, name: "Payments · data tier", description: "Postgres primaries and replicas", selector: { app: "payments", tier: "db" }, created_at: days(38) },
  { id: 4, name: "Production · all", description: "Every host tagged env=prod", selector: { env: "prod" }, created_at: days(40) },
  { id: 5, name: "DC edge", description: "Load balancers at the datacenter edge", selector: { site: "DC", role: "adc" }, created_at: days(30) },
  { id: 6, name: "Online Banking · web tier", description: "Online Banking frontends", selector: { app: "onlinebank", tier: "web" }, created_at: days(22) },
  { id: 7, name: "DR · all", description: "Disaster-recovery standby fleet", selector: { site: "DR" }, created_at: days(18) },
];
GROUPS.forEach((g) => {
  g.member_count = SERVERS.filter((s) =>
    Object.entries(g.selector).every(([k, v]) => s.labels[k] === v)
  ).length;
});

// ---- applications (tiered group binding) -----------------------------------
const APPLICATIONS = [
  {
    id: 1, name: "Payments", description: "Card authorization & settlement", env: "prod",
    scope: ["payments"], required_approvers: 2,
    tiers: [
      { name: "web", group_ids: [1] },
      { name: "app", group_ids: [2] },
      { name: "data", group_ids: [3] },
    ],
    created_at: days(38),
  },
  {
    id: 2, name: "Online Banking", description: "Retail customer portal", env: "prod",
    scope: ["onlinebank"], required_approvers: 2,
    tiers: [
      { name: "web", group_ids: [6] },
      { name: "app", group_ids: [] },
    ],
    created_at: days(22),
  },
];

// ---- intents (compiled policy) ---------------------------------------------
const NFT_SAMPLE = `table inet imara_fw {
  chain input {
    type filter hook input priority 0; policy drop;
    ct state established,related accept
    iif "lo" accept
    tcp dport 443 ip saddr 10.40.2.0/24 accept   # from DC edge
    tcp dport 8080 ip saddr @web_tier accept
    tcp dport 22 ip saddr 10.40.2.20 accept       # jump host
    counter drop
  }
  chain output {
    type filter hook output priority 0; policy drop;
    ct state established,related accept
    tcp dport 5432 ip daddr @db_tier accept
    tcp dport 6379 ip daddr 10.40.2.21 accept
    udp dport 53 ip daddr { 10.40.0.10, 10.40.0.11 } accept
    counter drop
  }
}`;

const INTENTS = [
  {
    id: 101, name: "payments-app → payments-db (5432)", version: 7,
    target_selector: { app: "payments", tier: "app" }, resolved_count: 4,
    status: "applied", approval_state: "approved", canary_state: "fully_deployed",
    required_approvers: 2, approvers_count: 2, approved_by: "rao.k", requested_by: "muya.k",
    created_at: days(12), updated_at: hrs(6), applied_at: hrs(6),
    body: "Payments application servers may reach the Payments database on tcp/5432.\nDeny all other east-west traffic between app servers.",
    nft: NFT_SAMPLE,
    sim: { window_days: 14, window_flows: 184203, allowed: 182910, denied: 1293, skipped: 0,
      by_direction: { in: { allowed: 90120, denied: 902 }, out: { allowed: 92790, denied: 391 } },
      top_denied: [
        { peer: "10.40.2.55", port: 5432, proto: "tcp", comm: "psql", flows: 412, verdict: "deny", reason: "src not in app tier" },
        { peer: "203.0.113.9", port: 9000, proto: "tcp", comm: "java", flows: 308, verdict: "deny", reason: "no matching allow" },
        { peer: "10.40.2.61", port: 22, proto: "tcp", comm: "ssh", flows: 144, verdict: "deny", reason: "not jump host" },
      ],
      top_allowed: [
        { peer: "10.40.2.30", port: 5432, proto: "tcp", comm: "java", flows: 41203, verdict: "allow" },
        { peer: "10.40.2.31", port: 5432, proto: "tcp", comm: "java", flows: 38110, verdict: "allow" },
      ] },
  },
  {
    id: 102, name: "payments-web ingress 443 from edge", version: 3,
    target_selector: { app: "payments", tier: "web" }, resolved_count: 3,
    status: "applied", approval_state: "approved", canary_state: "fully_deployed",
    required_approvers: 2, approvers_count: 2, approved_by: "rao.k", requested_by: "muya.k",
    created_at: days(10), updated_at: days(2), applied_at: days(2),
    body: "Payments web frontends accept tcp/443 only from the DC edge load balancers.\nDeny direct internet ingress.",
    nft: NFT_SAMPLE,
    sim: { window_days: 14, window_flows: 92410, allowed: 91002, denied: 1408, skipped: 0,
      by_direction: { in: { allowed: 91002, denied: 1408 }, out: { allowed: 0, denied: 0 } },
      top_denied: [{ peer: "198.51.100.4", port: 443, proto: "tcp", comm: "nginx", flows: 1408, verdict: "deny", reason: "not from edge" }],
      top_allowed: [{ peer: "10.40.2.10", port: 443, proto: "tcp", comm: "nginx", flows: 91002, verdict: "allow" }] },
  },
  {
    id: 103, name: "onlinebank-web isolate from payments-db", version: 1,
    target_selector: { app: "onlinebank", tier: "web" }, resolved_count: 2,
    status: "pending", approval_state: "requested", canary_state: "canarying",
    required_approvers: 2, approvers_count: 1, requested_by: "muya.k",
    canary_target: "agt-cmp-dc-web-v004", canary_started_at: mins(18), canary_bake_until: mins(-12),
    created_at: days(1), updated_at: mins(18),
    body: "Online Banking web tier must not reach the Payments database segment.\nAllow egress to Online Banking app tier on tcp/8080 only.",
    nft: NFT_SAMPLE,
    sim: { window_days: 14, window_flows: 40112, allowed: 39801, denied: 311, skipped: 0,
      by_direction: { in: { allowed: 19900, denied: 110 }, out: { allowed: 19901, denied: 201 } },
      top_denied: [{ peer: "10.40.2.18", port: 5432, proto: "tcp", comm: "java", flows: 201, verdict: "deny", reason: "cross-app to payments db" }],
      top_allowed: [{ peer: "10.40.2.40", port: 8080, proto: "tcp", comm: "java", flows: 19901, verdict: "allow" }] },
  },
  {
    id: 104, name: "DR standby — mirror payments policy", version: 2,
    target_selector: { site: "DR" }, resolved_count: 3,
    status: "error", approval_state: "approved", canary_state: "rolled_back",
    required_approvers: 2, approvers_count: 2, approved_by: "rao.k", requested_by: "muya.k",
    error_text: "compile guard: rule would fence agt-cmp-dr-db-v001 from control plane (10.60.2.0/24 drop before allow)",
    created_at: days(3), updated_at: hrs(20), applied_at: null,
    body: "Replicate the Payments enforcement set onto the DR standby fleet.\nKeep control-plane reachability on tcp/8443.",
    nft: NFT_SAMPLE,
    sim: { window_days: 14, window_flows: 5102, allowed: 4900, denied: 202, skipped: 0,
      by_direction: { in: { allowed: 2450, denied: 100 }, out: { allowed: 2450, denied: 102 } },
      top_denied: [], top_allowed: [] },
  },
  {
    id: 105, name: "jump-host SSH lockdown", version: 1,
    target_agent_id: "agt-cmp-dc-agt-v001", resolved_count: 1,
    status: "draft", approval_state: "draft", canary_state: "none",
    required_approvers: 2, approvers_count: 0,
    created_at: hrs(3), updated_at: hrs(3),
    body: "The platform jump host accepts tcp/22 only from the admin bastion subnet 10.40.0.0/24.\nAll other SSH ingress denied.",
    nft: NFT_SAMPLE,
    sim: { window_days: 14, window_flows: 880, allowed: 410, denied: 470, skipped: 0,
      by_direction: { in: { allowed: 410, denied: 470 }, out: { allowed: 0, denied: 0 } },
      top_denied: [{ peer: "185.220.101.5", port: 22, proto: "tcp", comm: "sshd", flows: 470, verdict: "deny", reason: "outside bastion subnet" }],
      top_allowed: [{ peer: "10.40.0.12", port: 22, proto: "tcp", comm: "sshd", flows: 410, verdict: "allow" }] },
  },
];

// ---- alerts (tamper/health + behavioral) -----------------------------------
const ALERTS = [
  { id: 9001, server_id: "agt-cmp-dc-app-v004", kind: "agent_silent", severity: "critical", status: "open", title: "Agent offline", created_at: mins(19), details: { last_seen: "19m ago", expected: "30s" } },
  { id: 9002, server_id: "agt-cmp-dc-web-v002", kind: "firewall_drift", severity: "critical", status: "open", title: "Firewall ruleset drifted from policy", created_at: mins(7), details: { added: 2, removed: 1, action: "auto-reapplied last known-good" } },
  { id: 9003, server_id: "agt-cmp-dc-db-v001", kind: "lateral_movement", severity: "critical", status: "open", title: "Unusual east-west: db → 6 new internal peers", created_at: mins(3), details: { peers: 6, baseline: 1, window: "5m" } },
  { id: 9004, server_id: "agt-cmp-dc-cbs-v001", kind: "beaconing", severity: "warn", status: "open", title: "Periodic egress to 203.0.113.44:8443 (60s ± 2s)", created_at: mins(12), details: { interval: "60s", jitter: "2s", hits: 41 } },
  { id: 9005, server_id: "agt-cmp-dc-app-v001", kind: "dns_tunneling", severity: "warn", status: "open", title: "High-entropy DNS labels to *.x7q2.net", created_at: mins(25), details: { qps: 38, entropy: 4.2 } },
  { id: 9006, server_id: "agt-cmp-dc-web-v003", kind: "service_disablement", severity: "warn", status: "open", title: "imara-agent service stopped", created_at: mins(41), details: { service: "imara-agent", state: "inactive" } },
  { id: 9007, server_id: "agt-cmp-dr-db-v001", kind: "binary_hash_drift", severity: "info", status: "acknowledged", title: "Agent binary hash changed (signed upgrade)", created_at: hrs(2), details: { from: "1.8.1", to: "1.8.2", signed: true } },
  { id: 9008, server_id: "agt-cmp-dc-app-v002", kind: "kernel_module_unload", severity: "info", status: "resolved", title: "nf_conntrack reloaded after kernel update", created_at: hrs(5), resolved_at: hrs(4), details: {} },
];

// ---- audit log -------------------------------------------------------------
const AUDIT = [
  { id: 5001, actor: "muya.k", role: "admin", action: "intent.approve", target_kind: "intent", target_id: "101", occurred_at: hrs(6), details: { name: "payments-app → payments-db" } },
  { id: 5002, actor: "rao.k", role: "admin", action: "intent.canary.promote", target_kind: "intent", target_id: "101", occurred_at: hrs(6), details: { from: "canarying", to: "fully_deployed" } },
  { id: 5003, actor: "system", role: "system", action: "intent.rollback.auto", target_kind: "intent", target_id: "104", occurred_at: hrs(20), details: { reason: "compile guard: control-plane fence" } },
  { id: 5004, actor: "muya.k", role: "admin", action: "intent.request_approval", target_kind: "intent", target_id: "103", occurred_at: days(1), details: {} },
  { id: 5005, actor: "chen.l", role: "operator", action: "alert.acknowledge", target_kind: "alert", target_id: "9007", occurred_at: hrs(2), details: {} },
  { id: 5006, actor: "rao.k", role: "admin", action: "group.create", target_kind: "group", target_id: "7", occurred_at: days(18), details: { name: "DR · all" } },
  { id: 5008, actor: "system", role: "system", action: "siem.fanout", target_kind: "alert", target_id: "9002", occurred_at: mins(7), details: { sink: "elastic-siem" } },
];

// ---- connections per minute, last hour --------------------------------------
const FLOW_TS = Array.from({ length: 60 }, (_, i) => {
  const base = 1400 + Math.sin(i / 6) * 320 + Math.sin(i / 2.3) * 90;
  const spike = i > 44 && i < 49 ? 700 : 0;
  return { t: i, count: Math.round(base + spike + (i % 5) * 18) };
});

// ---- topology edges (allowed/observed/denied flows between hosts) -----------
// verdict: allow = sanctioned by policy, observed = seen, no policy yet, deny = blocked
function edge(from, to, port, proto, verdict, flows) { return { from, to, port, proto, verdict, flows }; }
const TOPO_EDGES = [
  // payments path
  edge("agt-cmp-dc-adc-v001", "agt-cmp-dc-web-v001", 443, "tcp", "allow", 41203),
  edge("agt-cmp-dc-adc-v001", "agt-cmp-dc-web-v002", 443, "tcp", "allow", 38110),
  edge("agt-cmp-dc-adc-v002", "agt-cmp-dc-web-v003", 443, "tcp", "allow", 12044),
  edge("agt-cmp-dc-web-v001", "agt-cmp-dc-app-v001", 8080, "tcp", "allow", 30221),
  edge("agt-cmp-dc-web-v002", "agt-cmp-dc-app-v002", 8080, "tcp", "allow", 28110),
  edge("agt-cmp-dc-app-v001", "agt-cmp-dc-cbs-v001", 9000, "tcp", "allow", 19044),
  edge("agt-cmp-dc-app-v001", "agt-cmp-dc-db-v001", 5432, "tcp", "allow", 41203),
  edge("agt-cmp-dc-app-v002", "agt-cmp-dc-db-v002", 5432, "tcp", "allow", 38900),
  edge("agt-cmp-dc-app-v001", "agt-cmp-dc-cache-v001", 6379, "tcp", "allow", 51200),
  edge("agt-cmp-dc-cbs-v001", "agt-cmp-dc-mq-v001", 5672, "tcp", "allow", 9100),
  edge("agt-cmp-dc-cbs-v001", "agt-cmp-dc-db-v001", 5432, "tcp", "allow", 22100),
  // online banking
  edge("agt-cmp-dc-web-v004", "agt-cmp-dc-app-v003", 8080, "tcp", "allow", 14200),
  edge("agt-cmp-dc-web-v005", "agt-cmp-dc-app-v003", 8080, "tcp", "allow", 11900),
  edge("agt-cmp-dc-app-v003", "agt-cmp-dc-db-v003", 5432, "tcp", "allow", 18100),
  // DR mirror
  edge("agt-cmp-dr-web-v001", "agt-cmp-dr-app-v001", 8080, "tcp", "allow", 1200),
  edge("agt-cmp-dr-app-v001", "agt-cmp-dr-db-v001", 5432, "tcp", "allow", 980),
  // platform / jump
  edge("agt-cmp-dc-agt-v001", "agt-cmp-dc-app-v001", 9100, "tcp", "allow", 880),
  edge("agt-cmp-dc-agt-v001", "agt-cmp-dc-db-v001", 9100, "tcp", "allow", 760),
  // VIOLATIONS / suspicious (the interesting part)
  edge("agt-cmp-dc-db-v001", "agt-cmp-dc-web-v004", 8080, "tcp", "deny", 201),   // cross-app lateral
  edge("agt-cmp-dc-app-v004", "agt-cmp-dc-db-v001", 5432, "tcp", "deny", 412),   // onlinebank app → payments db
  edge("agt-cmp-dc-web-v003", "agt-cmp-dc-cbs-v001", 9000, "tcp", "observed", 308), // unsanctioned, no policy
  edge("agt-cmp-dc-db-v001", "agt-cmp-dc-app-v003", 5432, "tcp", "deny", 144),   // db initiating outbound (lateral_movement alert)
];

// expose to window for cross-script use
Object.assign(window, {
  MS_DATA: {
    SERVERS, byId, fleetCounts, GROUPS, APPLICATIONS, INTENTS,
    ALERTS, AUDIT, FLOW_TS, TOPO_EDGES, APP_NAMES,
  },
});