@panguard-ai/panguard 1.4.14 → 1.4.16

package/dist/cli/commands/serve-core.js

@@ -1,215 +0,0 @@
-/**
- * Core middleware, health check, static file serving, and rule seeding
- * for panguard serve.
- */
-import { join, dirname, resolve, relative } from 'node:path';
-import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
-import { fileURLToPath } from 'node:url';
-import { c } from '@panguard-ai/core';
-import { generateOpenApiSpec, generateSwaggerHtml } from '@panguard-ai/panguard-auth';
-import { sendJson } from './serve-types.js';
-// ── Security Headers & CORS Middleware ─────────────────────────
-/**
- * Apply security headers and CORS to every response.
- * Returns true if the request was fully handled (OPTIONS preflight).
- */
-export function applyMiddleware(req, res) {
-    // Security headers
-    res.setHeader('X-Content-Type-Options', 'nosniff');
-    res.setHeader('X-Frame-Options', 'SAMEORIGIN');
-    res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
-    res.setHeader('Permissions-Policy', 'camera=(), microphone=(), geolocation=()');
-    res.setHeader('X-XSS-Protection', '0');
-    if (process.env['NODE_ENV'] === 'production') {
-        res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains; preload');
-    }
-    // CORS -- default to same-origin only; set CORS_ALLOWED_ORIGINS to allow cross-origin
-    const corsEnv = process.env['CORS_ALLOWED_ORIGINS'] ?? '';
-    const allowedOrigins = corsEnv ? corsEnv.split(',').map((o) => o.trim()) : [];
-    const origin = req.headers.origin ?? '';
-    if (allowedOrigins.includes('*') && process.env['NODE_ENV'] !== 'production') {
-        res.setHeader('Access-Control-Allow-Origin', origin || '*');
-    }
-    else if (origin && allowedOrigins.includes(origin)) {
-        res.setHeader('Access-Control-Allow-Origin', origin);
-    }
-    res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PATCH, DELETE, OPTIONS');
-    res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');
-    if (req.method === 'OPTIONS') {
-        res.writeHead(204);
-        res.end();
-        return true;
-    }
-    return false;
-}
-// ── Core Routes (health, OpenAPI, static) ──────────────────────
-/**
- * Handle core routes: /health, /openapi.json, /docs/api, /admin/*.
- * Returns true if the route was handled, false otherwise.
- */
-export function handleCoreRoutes(req, res, pathname, db, threatDb, adminDir) {
-    // OpenAPI spec (JSON)
-    if (pathname === '/openapi.json') {
-        const spec = generateOpenApiSpec(process.env['PANGUARD_BASE_URL'] ?? `http://${req.headers.host ?? 'localhost'}`);
-        sendJson(res, 200, spec);
-        return true;
-    }
-    // Swagger UI
-    if (pathname === '/docs/api' || pathname === '/docs/api/') {
-        const specUrl = '/openapi.json';
-        const html = generateSwaggerHtml(specUrl);
-        res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-        res.end(html);
-        return true;
-    }
-    // Health check (minimal public response -- detailed status behind /api/admin/health)
-    if (pathname === '/health') {
-        try {
-            db.healthCheck();
-            sendJson(res, 200, {
-                ok: true,
-                data: {
-                    status: 'healthy',
-                    uptime: Math.round(process.uptime()),
-                    db: 'connected',
-                    threatCloud: threatDb ? 'connected' : 'unavailable',
-                },
-            });
-        }
-        catch {
-            sendJson(res, 503, {
-                ok: false,
-                data: { status: 'unhealthy', db: 'disconnected' },
-            });
-        }
-        return true;
-    }
-    // Admin static files
-    if (adminDir && pathname.startsWith('/admin')) {
-        serveStaticFile(req, res, adminDir, pathname);
-        return true;
-    }
-    return false;
-}
-// ── Static File Serving ────────────────────────────────────────
-function serveStaticFile(_req, res, adminDir, pathname) {
-    // Map /admin -> /admin/index.html
-    const resolvedAdminDir = resolve(adminDir);
-    let filePath;
-    if (pathname === '/admin' || pathname === '/admin/') {
-        filePath = join(resolvedAdminDir, 'index.html');
-    }
-    else {
-        // Strip /admin prefix and leading slash
-        const relativePath = pathname.slice('/admin'.length).replace(/^\//, '');
-        filePath = join(resolvedAdminDir, relativePath);
-        // If no extension, try .html
-        if (!relativePath.includes('.')) {
-            filePath = join(resolvedAdminDir, relativePath + '.html');
-            if (!existsSync(filePath)) {
-                filePath = join(resolvedAdminDir, relativePath, 'index.html');
-            }
-        }
-    }
-    // Prevent path traversal: resolved path must be within admin directory
-    if (!filePath.startsWith(resolvedAdminDir)) {
-        sendJson(res, 403, { ok: false, error: 'Forbidden' });
-        return;
-    }
-    if (!existsSync(filePath)) {
-        sendJson(res, 404, { ok: false, error: 'Not found' });
-        return;
-    }
-    const ext = filePath.split('.').pop() ?? '';
-    const mimeTypes = {
-        html: 'text/html',
-        css: 'text/css',
-        js: 'application/javascript',
-        json: 'application/json',
-        png: 'image/png',
-        svg: 'image/svg+xml',
-        ico: 'image/x-icon',
-    };
-    const contentType = mimeTypes[ext] ?? 'application/octet-stream';
-    const content = readFileSync(filePath);
-    res.writeHead(200, { 'Content-Type': contentType });
-    res.end(content);
-}
-// ── Rule Seeding ───────────────────────────────────────────────
-/**
- * Seed rules from bundled config/ directory into Threat Cloud DB.
- * Reads ATR YAML files.
- * Returns count of rules seeded.
- */
-export async function seedRulesFromBundled(threatDb) {
-    let seeded = 0;
-    const now = new Date().toISOString();
-    // Resolve config directory (Docker: /app/config, monorepo: ../../config)
-    const configDirs = [
-        join(process.cwd(), 'config'),
-        join(dirname(fileURLToPath(import.meta.url)), '..', '..', '..', '..', '..', 'config'),
-    ];
-    const configDir = configDirs.find((d) => {
-        try {
-            return statSync(d).isDirectory();
-        }
-        catch {
-            return false;
-        }
-    });
-    if (!configDir) {
-        console.log(`  ${c.dim('  No config/ directory found -- skipping rule seeding')}`);
-        console.log(`  ${c.dim(`  Searched: ${configDirs.join(', ')}`)}`);
-        return 0;
-    }
-    console.log(`  ${c.dim(`  Using config directory: ${configDir}`)}`);
-    /** Recursively collect files matching extensions */
-    function collectFiles(dir, extensions) {
-        const results = [];
-        try {
-            for (const entry of readdirSync(dir, { withFileTypes: true })) {
-                const fullPath = join(dir, entry.name);
-                if (entry.isDirectory()) {
-                    results.push(...collectFiles(fullPath, extensions));
-                }
-                else if (extensions.some((ext) => entry.name.endsWith(ext))) {
-                    results.push(fullPath);
-                }
-            }
-        }
-        catch (err) {
-            console.error(`  [WARN] Cannot read directory ${dir}: ${err instanceof Error ? err.message : String(err)}`);
-        }
-        return results;
-    }
-    // ATR rules (.yaml, .yml) from atr package
-    const atrDirs = [
-        join(process.cwd(), 'node_modules', 'agent-threat-rules', 'rules'),
-        join(dirname(fileURLToPath(import.meta.url)), '..', '..', '..', '..', '..', 'packages', 'atr', 'rules'),
-    ];
-    const atrDir = atrDirs.find((d) => {
-        try {
-            return statSync(d).isDirectory();
-        }
-        catch {
-            return false;
-        }
-    });
-    if (atrDir) {
-        try {
-            const atrFiles = collectFiles(atrDir, ['.yaml', '.yml']);
-            for (const file of atrFiles) {
-                const content = readFileSync(file, 'utf-8');
-                const ruleId = `atr:${relative(atrDir, file).replace(/\//g, ':')}`;
-                threatDb.upsertRule({ ruleId, ruleContent: content, publishedAt: now, source: 'atr' });
-                seeded++;
-            }
-            console.log(`  ${c.dim(`  ATR: ${atrFiles.length} files processed`)}`);
-        }
-        catch (err) {
-            console.error(`  [WARN] ATR rule seeding failed: ${err instanceof Error ? err.message : String(err)}`);
-        }
-    }
-    return seeded;
-}
-//# sourceMappingURL=serve-core.js.map

package/dist/cli/commands/serve-core.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"serve-core.js","sourceRoot":"","sources":["../../../src/cli/commands/serve-core.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,mBAAmB,CAAC;AACtC,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEtF,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,kEAAkE;AAElE;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,GAAoB,EAAE,GAAmB;IACvE,mBAAmB;IACnB,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;IACnD,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;IAC/C,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,iCAAiC,CAAC,CAAC;IACpE,GAAG,CAAC,SAAS,CAAC,oBAAoB,EAAE,0CAA0C,CAAC,CAAC;IAChF,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IACvC,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY,EAAE,CAAC;QAC7C,GAAG,CAAC,SAAS,CAAC,2BAA2B,EAAE,8CAA8C,CAAC,CAAC;IAC7F,CAAC;IAED,sFAAsF;IACtF,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,EAAE,CAAC;IAC1D,MAAM,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9E,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;IACxC,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY,EAAE,CAAC;QAC7E,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,MAAM,IAAI,GAAG,CAAC,CAAC;IAC9D,CAAC;SAAM,IAAI,MAAM,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;IACvD,CAAC;IACD,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,mCAAmC,CAAC,CAAC;IACnF,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,6BAA6B,CAAC,CAAC;IAE7E,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACnB,GAAG,CAAC,GAAG,EAAE,CAAC;QACV,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,kEAAkE;AAElE;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAoB,EACpB,GAAmB,EACnB,QAAgB,EAChB,EAA2B,EAC3B,QAA+B,EAC/B,QAA4B;IAE5B,sBAAsB;IACtB,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,mBAAmB,CAC9B,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAChF,CAAC;QACF,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,aAAa;IACb,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC1D,MAAM,OAAO,GAAG,eAAe,CAAC;QAChC,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC1C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACnE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAED,qFAAqF;IACrF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,EAAE,CAAC,WAAW,EAAE,CAAC;YACjB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACjB,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE;oBACJ,MAAM,EAAE,SAAS;oBACjB,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;oBACpC,EAAE,EAAE,WAAW;oBACf,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa;iBACpD;aACF,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACjB,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,cAAc,EAAE;aAClD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,qBAAqB;IACrB,IAAI,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9C,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,kEAAkE;AAElE,SAAS,eAAe,CACtB,IAAqB,EACrB,GAAmB,EACnB,QAAgB,EAChB,QAAgB;IAEhB,kCAAkC;IAClC,MAAM,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,QAAgB,CAAC;IACrB,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACpD,QAAQ,GAAG,IAAI,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;IAClD,CAAC;SAAM,CAAC;QACN,wCAAwC;QACxC,MAAM,YAAY,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACxE,QAAQ,GAAG,IAAI,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;QAEhD,6BAA6B;QAC7B,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,QAAQ,GAAG,IAAI,CAAC,gBAAgB,EAAE,YAAY,GAAG,OAAO,CAAC,CAAC;YAC1D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC1B,QAAQ,GAAG,IAAI,CAAC,gBAAgB,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC3C,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QACtD,OAAO;IACT,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QACtD,OAAO;IACT,CAAC;IAED,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAC5C,MAAM,SAAS,GAA2B;QACxC,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,UAAU;QACf,EAAE,EAAE,wBAAwB;QAC5B,IAAI,EAAE,kBAAkB;QACxB,GAAG,EAAE,WAAW;QAChB,GAAG,EAAE,eAAe;QACpB,GAAG,EAAE,cAAc;KACpB,CAAC;IAEF,MAAM,WAAW,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAC;IACjE,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACvC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;IACpD,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACnB,CAAC;AAED,kEAAkE;AAElE;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,QAA+B;IACxE,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAErC,yEAAyE;IACzE,MAAM,UAAU,GAAG;QACjB,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC;KACtF,CAAC;IACF,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QACtC,IAAI,CAAC;YACH,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,uDAAuD,CAAC,EAAE,CAAC,CAAC;QACnF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,eAAe,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAClE,OAAO,CAAC,CAAC;IACX,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,6BAA6B,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;IAEpE,oDAAoD;IACpD,SAAS,YAAY,CAAC,GAAW,EAAE,UAAoB;QACrD,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBACvC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;oBACxB,OAAO,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;gBACtD,CAAC;qBAAM,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;oBAC9D,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,OAAO,CAAC,KAAK,CACX,kCAAkC,GAAG,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC7F,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,2CAA2C;IAC3C,MAAM,OAAO,GAAG;QACd,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,oBAAoB,EAAE,OAAO,CAAC;QAClE,IAAI,CACF,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EACvC,IAAI,EACJ,IAAI,EACJ,IAAI,EACJ,IAAI,EACJ,IAAI,EACJ,UAAU,EACV,KAAK,EACL,OAAO,CACR;KACF,CAAC;IACF,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAChC,IAAI,CAAC;YACH,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;IACH,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;YACzD,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;gBAC5B,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC5C,MAAM,MAAM,GAAG,OAAO,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;gBACnE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;gBACvF,MAAM,EAAE,CAAC;YACX,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,UAAU,QAAQ,CAAC,MAAM,kBAAkB,CAAC,EAAE,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,OAAO,CAAC,KAAK,CACX,qCAAqC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACxF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/cli/commands/serve-tc.d.ts

@@ -1,12 +0,0 @@
-/**
- * Threat Cloud route handlers for panguard serve.
- * Uses centralized Zod schemas from @panguard-ai/core for input validation.
- */
-import type { IncomingMessage, ServerResponse } from 'node:http';
-import type { RouteContext } from './serve-types.js';
-/**
- * Handle Threat Cloud API routes (/api/threats, /api/rules, /api/stats, etc.).
- * Returns true if the route was handled, false otherwise.
- */
-export declare function handleTCRoutes(req: IncomingMessage, res: ServerResponse, url: string, pathname: string, ctx: RouteContext): Promise<boolean>;
-//# sourceMappingURL=serve-tc.d.ts.map

package/dist/cli/commands/serve-tc.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"serve-tc.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/serve-tc.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAgFrD;;;GAGG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,YAAY,GAChB,OAAO,CAAC,OAAO,CAAC,CAoOlB"}

package/dist/cli/commands/serve-tc.js

@@ -1,287 +0,0 @@
-/**
- * Threat Cloud route handlers for panguard serve.
- * Uses centralized Zod schemas from @panguard-ai/core for input validation.
- */
-import { sendJson, readRequestBody, requireTCWriteAuth, requireTCAdminAuth, requireJsonContentType, checkTCRateLimit, } from './serve-types.js';
-import { tryValidateInput, ClientIdSchema, ISODateSchema, PaginationLimitSchema, ReputationSchema, ThreatDataSchema, RulePublishSchema, ATRProposalSchema, ATRFeedbackSchema, SkillThreatSchema, SkillWhitelistItemSchema, } from '@panguard-ai/core';
-/** Threat Cloud rate-limited endpoint paths */
-const TC_RATE_LIMITED_PATHS = new Set([
-    '/api/threats',
-    '/api/rules',
-    '/api/stats',
-    '/api/atr-proposals',
-    '/api/atr-feedback',
-    '/api/skill-threats',
-    '/api/atr-rules',
-    '/api/feeds/ip-blocklist',
-    '/api/feeds/domain-blocklist',
-]);
-/**
- * Parse JSON body and validate against a Zod schema.
- * Sends 400 response on failure and returns null.
- */
-async function parseAndValidate(req, res, schema) {
-    const body = await readRequestBody(req);
-    let raw;
-    try {
-        raw = JSON.parse(body);
-    }
-    catch {
-        sendJson(res, 400, { ok: false, error: 'Invalid JSON body' });
-        return null;
-    }
-    const result = tryValidateInput(schema, raw);
-    if (!result.ok) {
-        sendJson(res, 400, { ok: false, error: result.error });
-        return null;
-    }
-    return result.data;
-}
-/**
- * Extract and validate the x-panguard-client-id header.
- * Returns the client ID string or null if invalid/missing.
- */
-function extractClientId(req) {
-    const raw = req.headers['x-panguard-client-id'];
-    if (typeof raw !== 'string')
-        return null;
-    const result = ClientIdSchema.safeParse(raw);
-    return result.success ? result.data : null;
-}
-/**
- * Parse URL search params with standard helpers.
- */
-function parseUrl(url, host) {
-    return new URL(url, `http://${host ?? 'localhost'}`);
-}
-/**
- * Handle Threat Cloud API routes (/api/threats, /api/rules, /api/stats, etc.).
- * Returns true if the route was handled, false otherwise.
- */
-export async function handleTCRoutes(req, res, url, pathname, ctx) {
-    const { threatDb, llmReviewer, db } = ctx;
-    // Only handle TC paths when threatDb is available and path is a TC endpoint
-    if (!threatDb || !pathname.startsWith('/api/'))
-        return false;
-    // Rate limiting for known TC endpoints
-    if (TC_RATE_LIMITED_PATHS.has(pathname)) {
-        const clientIP = req.socket.remoteAddress ?? 'unknown';
-        if (!checkTCRateLimit(clientIP)) {
-            sendJson(res, 429, { ok: false, error: 'Rate limit exceeded. Try again later.' });
-            return true;
-        }
-    }
-    // POST /api/threats - Upload anonymized threat data
-    if (pathname === '/api/threats' && req.method === 'POST') {
-        if (!requireTCWriteAuth(req, res))
-            return true;
-        if (!requireJsonContentType(req, res))
-            return true;
-        const data = await parseAndValidate(req, res, ThreatDataSchema);
-        if (!data)
-            return true;
-        // Anonymize IP (zero last octet)
-        const mutableData = { ...data };
-        const ip = data.attackSourceIP;
-        if (ip.includes('.')) {
-            const parts = ip.split('.');
-            if (parts.length === 4) {
-                parts[3] = '0';
-                mutableData['attackSourceIP'] = parts.join('.');
-            }
-        }
-        threatDb.insertThreat(mutableData);
-        sendJson(res, 201, { ok: true, data: { message: 'Threat data received' } });
-        return true;
-    }
-    // GET /api/rules - Fetch rules (optional ?since= filter, paginated)
-    if (pathname === '/api/rules' && req.method === 'GET') {
-        const urlObj = parseUrl(url, req.headers.host);
-        const rawSince = urlObj.searchParams.get('since');
-        if (rawSince) {
-            const sinceResult = ISODateSchema.safeParse(rawSince);
-            if (!sinceResult.success) {
-                sendJson(res, 400, { ok: false, error: 'Invalid since parameter: must be ISO 8601' });
-                return true;
-            }
-        }
-        const limit = PaginationLimitSchema.parse(urlObj.searchParams.get('limit') ?? '1000');
-        const rules = rawSince ? threatDb.getRulesSince(rawSince) : threatDb.getAllRules(limit);
-        sendJson(res, 200, { ok: true, data: rules });
-        return true;
-    }
-    // POST /api/rules - Publish a new community rule
-    if (pathname === '/api/rules' && req.method === 'POST') {
-        if (!requireTCWriteAuth(req, res))
-            return true;
-        if (!requireJsonContentType(req, res))
-            return true;
-        const rule = await parseAndValidate(req, res, RulePublishSchema);
-        if (!rule)
-            return true;
-        const ruleData = {
-            ...rule,
-            publishedAt: rule.publishedAt || new Date().toISOString(),
-        };
-        threatDb.upsertRule(ruleData);
-        sendJson(res, 201, { ok: true, data: { message: 'Rule published', ruleId: rule.ruleId } });
-        return true;
-    }
-    // GET /api/stats - Threat statistics
-    if (pathname === '/api/stats' && req.method === 'GET') {
-        const stats = threatDb.getStats();
-        sendJson(res, 200, { ok: true, data: stats });
-        return true;
-    }
-    // POST /api/atr-proposals - Submit ATR rule proposal
-    if (pathname === '/api/atr-proposals' && req.method === 'POST') {
-        if (!requireTCWriteAuth(req, res))
-            return true;
-        if (!requireJsonContentType(req, res))
-            return true;
-        const proposal = await parseAndValidate(req, res, ATRProposalSchema);
-        if (!proposal)
-            return true;
-        const clientId = extractClientId(req);
-        const proposalData = { ...proposal, clientId };
-        const pHash = proposal.patternHash;
-        // Check if this pattern already has a proposal - if so, increment confirmation
-        const existing = threatDb
-            .getATRProposals()
-            .find((p) => p['pattern_hash'] === pHash);
-        if (existing) {
-            threatDb.confirmATRProposal(pHash);
-            sendJson(res, 200, {
-                ok: true,
-                data: { message: 'Confirmation recorded', patternHash: pHash },
-            });
-        }
-        else {
-            threatDb.insertATRProposal(proposalData);
-            // Fire-and-forget LLM review on first submission
-            if (llmReviewer?.isAvailable()) {
-                void llmReviewer.reviewProposal(pHash, proposal.ruleContent).catch((err) => {
-                    console.error(`LLM review error for ${pHash}:`, err);
-                });
-            }
-            sendJson(res, 201, {
-                ok: true,
-                data: { message: 'Proposal submitted', patternHash: pHash },
-            });
-        }
-        return true;
-    }
-    // GET /api/atr-proposals - List proposals (admin-only)
-    if (pathname === '/api/atr-proposals' && req.method === 'GET') {
-        if (!requireTCAdminAuth(req, res, db))
-            return true;
-        const urlObj = parseUrl(url, req.headers.host);
-        const status = urlObj.searchParams.get('status') ?? undefined;
-        const proposals = threatDb.getATRProposals(status);
-        sendJson(res, 200, { ok: true, data: proposals });
-        return true;
-    }
-    // POST /api/atr-feedback - Report ATR rule match feedback
-    if (pathname === '/api/atr-feedback' && req.method === 'POST') {
-        if (!requireTCWriteAuth(req, res))
-            return true;
-        if (!requireJsonContentType(req, res))
-            return true;
-        const feedback = await parseAndValidate(req, res, ATRFeedbackSchema);
-        if (!feedback)
-            return true;
-        const cid = extractClientId(req);
-        threatDb.insertATRFeedback(feedback.ruleId, feedback.isTruePositive, cid);
-        sendJson(res, 201, { ok: true, data: { message: 'Feedback recorded' } });
-        return true;
-    }
-    // POST /api/skill-threats - Submit skill audit result
-    if (pathname === '/api/skill-threats' && req.method === 'POST') {
-        if (!requireTCWriteAuth(req, res))
-            return true;
-        if (!requireJsonContentType(req, res))
-            return true;
-        const submission = await parseAndValidate(req, res, SkillThreatSchema);
-        if (!submission)
-            return true;
-        const cid = extractClientId(req);
-        const submissionData = { ...submission, clientId: cid };
-        threatDb.insertSkillThreat(submissionData);
-        sendJson(res, 201, { ok: true, data: { message: 'Skill threat recorded' } });
-        return true;
-    }
-    // GET /api/skill-threats - List skill threats (admin-only)
-    if (pathname === '/api/skill-threats' && req.method === 'GET') {
-        if (!requireTCAdminAuth(req, res, db))
-            return true;
-        const urlObj = parseUrl(url, req.headers.host);
-        const limit = PaginationLimitSchema.parse(urlObj.searchParams.get('limit') ?? '50');
-        const threats = threatDb.getSkillThreats(Math.min(limit, 500));
-        sendJson(res, 200, { ok: true, data: threats });
-        return true;
-    }
-    // GET /api/atr-rules - Fetch confirmed ATR rules (for Guard sync)
-    if (pathname === '/api/atr-rules' && req.method === 'GET') {
-        const urlObj = parseUrl(url, req.headers.host);
-        const since = urlObj.searchParams.get('since') ?? undefined;
-        const rules = threatDb.getConfirmedATRRules(since);
-        sendJson(res, 200, { ok: true, data: rules });
-        return true;
-    }
-    // GET /api/feeds/ip-blocklist - IP blocklist feed (plain text)
-    if (pathname === '/api/feeds/ip-blocklist' && req.method === 'GET') {
-        const urlObj = parseUrl(url, req.headers.host);
-        const minReputation = ReputationSchema.parse(urlObj.searchParams.get('minReputation') ?? '70');
-        const ips = threatDb.getIPBlocklist(minReputation);
-        res.setHeader('Content-Type', 'text/plain');
-        res.writeHead(200);
-        res.end(ips.join('\n'));
-        return true;
-    }
-    // GET /api/feeds/domain-blocklist - Domain blocklist feed (plain text)
-    if (pathname === '/api/feeds/domain-blocklist' && req.method === 'GET') {
-        const urlObj = parseUrl(url, req.headers.host);
-        const minReputation = ReputationSchema.parse(urlObj.searchParams.get('minReputation') ?? '70');
-        const domains = threatDb.getDomainBlocklist(minReputation);
-        res.setHeader('Content-Type', 'text/plain');
-        res.writeHead(200);
-        res.end(domains.join('\n'));
-        return true;
-    }
-    // POST /api/skill-whitelist - Report safe skill (audit passed)
-    if (pathname === '/api/skill-whitelist' && req.method === 'POST') {
-        if (!requireTCWriteAuth(req, res))
-            return true;
-        if (!requireJsonContentType(req, res))
-            return true;
-        const body = await readRequestBody(req);
-        let raw;
-        try {
-            raw = JSON.parse(body);
-        }
-        catch {
-            sendJson(res, 400, { ok: false, error: 'Invalid JSON body' });
-            return true;
-        }
-        const data = raw;
-        const skills = 'skills' in data && Array.isArray(data['skills']) ? data['skills'] : [data];
-        let count = 0;
-        for (const skill of skills) {
-            const result = SkillWhitelistItemSchema.safeParse(skill);
-            if (!result.success)
-                continue;
-            threatDb.reportSafeSkill(result.data.skillName, result.data.fingerprintHash);
-            count++;
-        }
-        sendJson(res, 201, { ok: true, data: { message: `${count} skill(s) reported`, count } });
-        return true;
-    }
-    // GET /api/skill-whitelist - Fetch community whitelist
-    if (pathname === '/api/skill-whitelist' && req.method === 'GET') {
-        const whitelist = threatDb.getSkillWhitelist();
-        sendJson(res, 200, { ok: true, data: whitelist });
-        return true;
-    }
-    return false;
-}
-//# sourceMappingURL=serve-tc.js.map

package/dist/cli/commands/serve-tc.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"serve-tc.js","sourceRoot":"","sources":["../../../src/cli/commands/serve-tc.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,EACL,QAAQ,EACR,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAG3B,+CAA+C;AAC/C,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,cAAc;IACd,YAAY;IACZ,YAAY;IACZ,oBAAoB;IACpB,mBAAmB;IACnB,oBAAoB;IACpB,gBAAgB;IAChB,yBAAyB;IACzB,6BAA6B;CAC9B,CAAC,CAAC;AAEH;;;GAGG;AACH,KAAK,UAAU,gBAAgB,CAC7B,GAAoB,EACpB,GAAmB,EACnB,MAAsB;IAEtB,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,GAAoB;IAC3C,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAChD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7C,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED;;GAEG;AACH,SAAS,QAAQ,CAAC,GAAW,EAAE,IAAwB;IACrD,OAAO,IAAI,GAAG,CAAC,GAAG,EAAE,UAAU,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAoB,EACpB,GAAmB,EACnB,GAAW,EACX,QAAgB,EAChB,GAAiB;IAEjB,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE,GAAG,GAAG,CAAC;IAE1C,4EAA4E;IAC5E,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAE7D,uCAAuC;IACvC,IAAI,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;QACvD,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC,CAAC;YAClF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,oDAAoD;IACpD,IAAI,QAAQ,KAAK,cAAc,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACzD,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/C,IAAI,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,iCAAiC;QACjC,MAAM,WAAW,GAA4B,EAAE,GAAG,IAAI,EAAE,CAAC;QACzD,MAAM,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC;QAC/B,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;gBACf,WAAW,CAAC,gBAAgB,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QACD,QAAQ,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QACnC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,CAAC,CAAC;QAC5E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,oEAAoE;IACpE,IAAI,QAAQ,KAAK,YAAY,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QACtD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,WAAW,GAAG,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YACtD,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;gBACzB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC,CAAC;gBACtF,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,CAAC;QACtF,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACxF,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,iDAAiD;IACjD,IAAI,QAAQ,KAAK,YAAY,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACvD,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/C,IAAI,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,MAAM,QAAQ,GAA4B;YACxC,GAAG,IAAI;YACP,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAC1D,CAAC;QACF,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC9B,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC3F,OAAO,IAAI,CAAC;IACd,CAAC;IAED,qCAAqC;IACrC,IAAI,QAAQ,KAAK,YAAY,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QACtD,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAClC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,qDAAqD;IACrD,IAAI,QAAQ,KAAK,oBAAoB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC/D,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/C,IAAI,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACnD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC;QACrE,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE3B,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,YAAY,GAA4B,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,CAAC;QACxE,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,CAAC;QAEnC,+EAA+E;QAC/E,MAAM,QAAQ,GAAG,QAAQ;aACtB,eAAe,EAAE;aACjB,IAAI,CAAC,CAAC,CAA0B,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,KAAK,CAAC,CAAC;QACrE,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;YACnC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACjB,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,KAAK,EAAE;aAC/D,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;YACzC,iDAAiD;YACjD,IAAI,WAAW,EAAE,WAAW,EAAE,EAAE,CAAC;gBAC/B,KAAK,WAAW,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;oBAClF,OAAO,CAAC,KAAK,CAAC,wBAAwB,KAAK,GAAG,EAAE,GAAG,CAAC,CAAC;gBACvD,CAAC,CAAC,CAAC;YACL,CAAC;YACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACjB,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,EAAE,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,KAAK,EAAE;aAC5D,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,uDAAuD;IACvD,IAAI,QAAQ,KAAK,oBAAoB,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC9D,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QACnD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC;QAC9D,MAAM,SAAS,GAAG,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACnD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,0DAA0D;IAC1D,IAAI,QAAQ,KAAK,mBAAmB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9D,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/C,IAAI,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACnD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC;QACrE,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE3B,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACjC,QAAQ,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAC1E,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAC;QACzE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sDAAsD;IACtD,IAAI,QAAQ,KAAK,oBAAoB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC/D,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/C,IAAI,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACnD,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC;QACvE,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QAE7B,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,cAAc,GAA4B,EAAE,GAAG,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;QACjF,QAAQ,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;QAC3C,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,2DAA2D;IAC3D,IAAI,QAAQ,KAAK,oBAAoB,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC9D,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QACnD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC;QACpF,MAAM,OAAO,GAAG,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QAC/D,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kEAAkE;IAClE,IAAI,QAAQ,KAAK,gBAAgB,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;QAC5D,MAAM,KAAK,GAAG,QAAQ,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACnD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+DAA+D;IAC/D,IAAI,QAAQ,KAAK,yBAAyB,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QACnE,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,aAAa,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,CAAC;QAC/F,MAAM,GAAG,GAAG,QAAQ,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;QACnD,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;QAC5C,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACnB,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,uEAAuE;IACvE,IAAI,QAAQ,KAAK,6BAA6B,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QACvE,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,aAAa,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,CAAC;QAC/F,MAAM,OAAO,GAAG,QAAQ,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;QAC3D,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;QAC5C,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACnB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+DAA+D;IAC/D,IAAI,QAAQ,KAAK,sBAAsB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACjE,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/C,IAAI,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,GAAY,CAAC;QACjB,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC9D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GAAG,GAA8B,CAAC;QAC5C,MAAM,MAAM,GACV,QAAQ,IAAI,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,QAAQ,CAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAE7F,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,wBAAwB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACzD,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,SAAS;YAC9B,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC7E,KAAK,EAAE,CAAC;QACV,CAAC;QACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,GAAG,KAAK,oBAAoB,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACzF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,uDAAuD;IACvD,IAAI,QAAQ,KAAK,sBAAsB,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAChE,MAAM,SAAS,GAAG,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QAC/C,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/cli/commands/serve-types.d.ts

@@ -1,38 +0,0 @@
-/**
- * Shared types, helpers and middleware for serve sub-modules.
- */
-import type { IncomingMessage, ServerResponse } from 'node:http';
-import type { AuthDB } from '@panguard-ai/panguard-auth';
-import type { ManagerProxy } from '@panguard-ai/panguard-auth';
-import type { createAuthHandlers } from '@panguard-ai/panguard-auth';
-export type ThreatCloudDBInstance = any;
-export type LLMReviewerInstance = any;
-/** Context passed to every route handler module */
-export interface RouteContext {
-    readonly handlers: ReturnType<typeof createAuthHandlers>;
-    readonly db: AuthDB;
-    readonly adminDir: string | undefined;
-    readonly managerProxy: ManagerProxy;
-    readonly threatDb: ThreatCloudDBInstance;
-    readonly llmReviewer: LLMReviewerInstance;
-}
-export declare function sendJson(res: ServerResponse, status: number, data: unknown): void;
-/** Read request body with 1MB size limit */
-export declare function readRequestBody(req: IncomingMessage): Promise<string>;
-/** Timing-safe string comparison to prevent side-channel attacks */
-export declare function timingSafeCompare(a: string, b: string): boolean;
-/**
- * Require TC_API_KEY auth for write endpoints.
- * In production: BLOCK if TC_API_KEY not set (refuse unauthenticated writes).
- * In dev: allow passthrough with warning.
- */
-export declare function requireTCWriteAuth(req: IncomingMessage, res: ServerResponse): boolean;
-/**
- * Require admin session auth for admin-only GET endpoints.
- * Verifies the Bearer token is a valid session with admin role.
- */
-export declare function requireTCAdminAuth(req: IncomingMessage, res: ServerResponse, db: AuthDB): boolean;
-/** Validate Content-Type is application/json for POST requests */
-export declare function requireJsonContentType(req: IncomingMessage, res: ServerResponse): boolean;
-export declare function checkTCRateLimit(ip: string): boolean;
-//# sourceMappingURL=serve-types.d.ts.map

package/dist/cli/commands/serve-types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"serve-types.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/serve-types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAIrE,MAAM,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAExC,MAAM,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEtC,mDAAmD;AACnD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC;IACzD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,QAAQ,CAAC,WAAW,EAAE,mBAAmB,CAAC;CAC3C;AAID,wBAAgB,QAAQ,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,CAGjF;AAID,4CAA4C;AAC5C,wBAAgB,eAAe,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAkBrE;AAID,oEAAoE;AACpE,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAW/D;AAID;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAmBrF;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAWjG;AAED,kEAAkE;AAClE,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAOzF;AAOD,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CASpD"}