fix: add pagination cursor and totalCount to cyber threats response

server/worldmonitor/cyber/v1/_shared.ts

@@ -191,12 +191,25 @@ const COUNTRY_CENTROIDS: Record<string, [number, number]> = {
   SN:[14.5,-14.5],CM:[7.4,12.4],CI:[7.5,-5.5],TZ:[-6.4,34.9],UG:[1.4,32.3],
 };
 
-function getCountryCentroid(countryCode: string): { lat: number; lon: number } | null {
+/**
+ * Simple deterministic hash (djb2) that returns a float in [-0.5, 0.5).
+ * Same seed always produces the same value.
+ */
+function hashJitter(seed: string, index: number): number {
+  let hash = 5381;
+  const s = `${seed}:${index}`;
+  for (let i = 0; i < s.length; i++) {
+    hash = ((hash << 5) + hash + s.charCodeAt(i)) | 0;
+  }
+  return ((hash & 0x7fffffff) / 0x7fffffff - 0.5) * 2;
+}
+
+function getCountryCentroid(countryCode: string, seed?: string): { lat: number; lon: number } | null {
   if (!countryCode) return null;
   const coords = COUNTRY_CENTROIDS[countryCode.toUpperCase()];
   if (!coords) return null;
-  const jitter = () => (Math.random() - 0.5) * 2;
-  return { lat: coords[0] + jitter(), lon: coords[1] + jitter() };
+  const key = seed || countryCode;
+  return { lat: coords[0] + hashJitter(key, 0), lon: coords[1] + hashJitter(key, 1) };
 }
 
 // ========================================================================
@@ -366,7 +379,7 @@ export async function hydrateThreatCoordinates(threats: RawThreat[]): Promise<Ra
       return { ...threat, lat: lookup.lat, lon: lookup.lon, country: threat.country || lookup.country };
     }
 
-    const centroid = getCountryCentroid(threat.country);
+    const centroid = getCountryCentroid(threat.country, threat.id);
     if (centroid) {
       return { ...threat, lat: centroid.lat, lon: centroid.lon };
     }

server/worldmonitor/cyber/v1/list-cyber-threats.ts

@@ -33,6 +33,7 @@ export async function listCyberThreats(
   try {
     const now = Date.now();
     const pageSize = clampInt(req.pagination?.pageSize, DEFAULT_LIMIT, 1, MAX_LIMIT);
+    const offset = req.pagination?.cursor ? parseInt(req.pagination.cursor, 10) || 0 : 0;
 
     // Derive days from timeRange or use default
     let days = DEFAULT_DAYS;
@@ -55,7 +56,7 @@ export async function listCyberThreats(
 
     const anySucceeded = feodo.ok || urlhaus.ok || c2intel.ok || otx.ok || abuseipdb.ok;
     if (!anySucceeded) {
-      return { threats: [], pagination: undefined };
+      return { threats: [], pagination: { totalCount: 0, nextCursor: '' } };
     }
 
     // Merge, deduplicate, hydrate coordinates
@@ -95,13 +96,18 @@ export async function listCyberThreats(
         if (bySeverity !== 0) return bySeverity;
         return (b.lastSeen || b.firstSeen) - (a.lastSeen || a.firstSeen);
       })
-      .slice(0, pageSize);
+    const totalCount = results.length;
+    const paged = results.slice(offset, offset + pageSize);
+    const nextOffset = offset + paged.length;
 
     return {
-      threats: results.map(toProtoCyberThreat),
-      pagination: undefined,
+      threats: paged.map(toProtoCyberThreat),
+      pagination: {
+        totalCount,
+        nextCursor: nextOffset < totalCount ? String(nextOffset) : '',
+      },
     };
   } catch {
-    return { threats: [], pagination: undefined };
+    return { threats: [], pagination: { totalCount: 0, nextCursor: '' } };
   }
 }

server/worldmonitor/unrest/v1/_shared.ts

@@ -73,8 +73,8 @@ export function deduplicateEvents(events: UnrestEvent[]): UnrestEvent[] {
   for (const event of events) {
     const lat = event.location?.latitude ?? 0;
     const lon = event.location?.longitude ?? 0;
-    const latKey = Math.round(lat * 2) / 2;
-    const lonKey = Math.round(lon * 2) / 2;
+    const latKey = Math.round(lat * 10) / 10;
+    const lonKey = Math.round(lon * 10) / 10;
     const dateKey = new Date(event.occurredAt).toISOString().split('T')[0];
     const key = `${latKey}:${lonKey}:${dateKey}`;