@panguard-ai/threat-cloud 0.2.0 → 0.2.2

package/dist/server.js

@@ -3,27 +3,38 @@
  * 威脅雲 HTTP API 伺服器
  *
  * Endpoints:
- * - POST /api/threats      Upload anonymized threat data
- * - POST /api/trap-intel   Upload trap intelligence data
- * - GET  /api/rules        Fetch rules (optional ?since= filter)
- * - POST /api/rules        Publish a new community rule
- * - GET  /api/stats        Get threat statistics
- * - GET  /api/iocs         Search/list IoCs
- * - GET  /api/iocs/:value  Lookup single IoC
- * - GET  /health           Health check
+ * - POST /api/threats                Upload anonymized threat data (single or batch)
+ * - GET  /api/rules                  Fetch rules (optional ?since= filter)
+ * - POST /api/rules                  Publish a new community rule
+ * - GET  /api/stats                  Get threat statistics
+ * - POST /api/atr-proposals          Submit or confirm ATR rule proposal
+ * - POST /api/atr-feedback           Submit feedback on ATR rule
+ * - POST /api/skill-threats          Submit skill threat from audit
+ * - GET  /api/atr-rules              Fetch confirmed ATR rules (?since= filter)
+ * - GET  /api/yara-rules             Fetch YARA rules (?since= filter)
+ * - GET  /api/feeds/ip-blocklist     IP blocklist feed (text/plain, ?minReputation=)
+ * - GET  /api/feeds/domain-blocklist Domain blocklist feed (text/plain, ?minReputation=)
+ * - GET  /api/skill-blacklist        Community skill blacklist (aggregated threats)
+ * - GET  /health                     Health check
  *
  * @module @panguard-ai/threat-cloud/server
  */
 import { createServer } from 'node:http';
-import { createHash, timingSafeEqual } from 'node:crypto';
+import { readdirSync, readFileSync, statSync } from 'node:fs';
+import { join, basename, relative, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { ThreatCloudDB } from './database.js';
-import { IoCStore } from './ioc-store.js';
-import { CorrelationEngine } from './correlation-engine.js';
-import { QueryHandlers } from './query-handlers.js';
-import { FeedDistributor } from './feed-distributor.js';
-import { SightingStore } from './sighting-store.js';
-import { AuditLogger } from './audit-logger.js';
-import { Scheduler } from './scheduler.js';
+import { LLMReviewer } from './llm-reviewer.js';
+import { getAdminHTML } from './admin-dashboard.js';
+/** Simple structured logger for threat-cloud (no core dependency) */
+const log = {
+    info: (msg) => {
+        process.stdout.write(`[threat-cloud] ${msg}\n`);
+    },
+    error: (msg, err) => {
+        process.stderr.write(`[threat-cloud] ERROR ${msg}${err ? `: ${err instanceof Error ? err.message : String(err)}` : ''}\n`);
+    },
+};
 /**
  * Threat Cloud API Server
  * 威脅雲 API 伺服器
@@ -31,30 +42,18 @@ import { Scheduler } from './scheduler.js';
 export class ThreatCloudServer {
     server = null;
     db;
-    iocStore;
-    correlation;
-    queryHandlers;
-    feedDistributor;
-    sightingStore;
-    auditLogger;
-    scheduler;
     config;
+    llmReviewer;
+    promotionTimer = null;
     rateLimits = new Map();
-    /** Pre-hashed API keys for constant-time comparison */
-    hashedApiKeys;
+    /** Promotion interval: 15 minutes / 推廣間隔：15 分鐘 */
+    static PROMOTION_INTERVAL_MS = 15 * 60 * 1000;
     constructor(config) {
         this.config = config;
         this.db = new ThreatCloudDB(config.dbPath);
-        const rawDb = this.db.getDB();
-        this.iocStore = new IoCStore(rawDb);
-        this.correlation = new CorrelationEngine(rawDb);
-        this.queryHandlers = new QueryHandlers(rawDb);
-        this.feedDistributor = new FeedDistributor(rawDb);
-        this.sightingStore = new SightingStore(rawDb);
-        this.auditLogger = new AuditLogger(rawDb);
-        this.scheduler = new Scheduler(rawDb);
-        // Pre-hash API keys for constant-time comparison
-        this.hashedApiKeys = config.apiKeys.map((k) => createHash('sha256').update(k).digest());
+        this.llmReviewer = config.anthropicApiKey
+            ? new LLMReviewer(config.anthropicApiKey, this.db)
+            : null;
     }
     /** Start the server / 啟動伺服器 */
     async start() {
@@ -63,105 +62,94 @@ export class ThreatCloudServer {
                 void this.handleRequest(req, res);
             });
             this.server.listen(this.config.port, this.config.host, () => {
-                console.log(`Threat Cloud server started on ${this.config.host}:${this.config.port}`);
-                if (this.hashedApiKeys.length === 0) {
-                    console.warn('WARNING: No API keys configured. Write endpoints and sensitive data will return 503.');
-                    console.warn('Set TC_API_KEYS=key1,key2 or use --api-key to enable full access.');
+                log.info(`Server started on ${this.config.host}:${this.config.port}`);
+                if (this.llmReviewer) {
+                    log.info('LLM reviewer enabled for ATR proposal review');
                 }
-                this.scheduler.start();
+                // Auto-seed rules from bundled config/ if DB is empty (first startup)
+                const stats = this.db.getStats();
+                if (stats.totalRules === 0) {
+                    log.info('First startup detected — seeding bundled rules...');
+                    try {
+                        const seeded = this.seedFromBundled();
+                        log.info(`Seeded ${seeded} rules into database`);
+                    }
+                    catch (err) {
+                        log.error('Rule seeding failed', err);
+                    }
+                }
+                else {
+                    log.info(`Database: ${stats.totalRules} rules, ${stats.totalThreats} threats`);
+                }
+                // Backfill classification for existing unclassified rules (one-time on startup)
+                try {
+                    const backfilled = this.db.backfillClassification();
+                    if (backfilled > 0) {
+                        log.info(`Backfilled classification for ${backfilled} rules`);
+                    }
+                }
+                catch (err) {
+                    log.error('Classification backfill failed', err);
+                }
+                // Start promotion cron (every 15 minutes)
+                this.promotionTimer = setInterval(() => {
+                    try {
+                        const promoted = this.db.promoteConfirmedProposals();
+                        if (promoted > 0) {
+                            log.info(`Promotion cycle: ${promoted} proposal(s) promoted to rules`);
+                        }
+                    }
+                    catch (err) {
+                        log.error('Promotion cycle failed', err);
+                    }
+                }, ThreatCloudServer.PROMOTION_INTERVAL_MS);
                 resolve();
             });
         });
     }
-    /** Stop the server gracefully / 優雅停止伺服器 */
+    /** Stop the server / 停止伺服器 */
     async stop() {
-        this.scheduler.stop();
         return new Promise((resolve) => {
+            if (this.promotionTimer) {
+                clearInterval(this.promotionTimer);
+                this.promotionTimer = null;
+            }
+            this.db.close();
             if (this.server) {
-                // Stop accepting new connections, wait for in-flight requests
-                this.server.close(() => {
-                    this.db.close();
-                    resolve();
-                });
-                // Force close after 25s if requests haven't drained
-                setTimeout(() => {
-                    this.db.close();
-                    resolve();
-                }, 25_000);
+                this.server.close(() => resolve());
             }
             else {
-                this.db.close();
                 resolve();
             }
         });
     }
-    /** Expose DB for testing / 暴露 DB 供測試使用 */
-    getDB() {
-        return this.db;
-    }
-    /** Expose IoC store for testing / 暴露 IoCStore 供測試使用 */
-    getIoCStore() {
-        return this.iocStore;
-    }
-    /** Expose scheduler for backup management / 暴露排程器供備份管理 */
-    getScheduler() {
-        return this.scheduler;
-    }
     async handleRequest(req, res) {
         // Security headers
         res.setHeader('X-Content-Type-Options', 'nosniff');
         res.setHeader('X-Frame-Options', 'DENY');
-        res.setHeader('X-XSS-Protection', '1; mode=block');
-        res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
-        res.setHeader('Content-Security-Policy', "default-src 'none'; frame-ancestors 'none'");
-        if (process.env['NODE_ENV'] === 'production') {
-            res.setHeader('Strict-Transport-Security', 'max-age=63072000; includeSubDomains; preload');
-        }
         res.setHeader('Content-Type', 'application/json');
         const clientIP = req.socket.remoteAddress ?? 'unknown';
-        // Rate limiting (per client IP)
+        // Rate limiting
         if (!this.checkRateLimit(clientIP)) {
             this.sendJson(res, 429, { ok: false, error: 'Rate limit exceeded' });
             return;
         }
-        // API key verification
+        // API key verification (skip for health check)
         const url = req.url ?? '/';
-        const pathname = url.split('?')[0] ?? '/';
-        let apiKeyHash = '';
-        // Determine if this endpoint requires authentication
-        const isHealthCheck = pathname === '/health';
-        const allowAnonymousUpload = process.env['ALLOW_ANONYMOUS_UPLOAD'] === 'true';
-        const isAnonymousThreatUpload = allowAnonymousUpload && req.method === 'POST' && pathname === '/api/threats';
-        const isWriteOrSensitive = req.method === 'POST' || pathname === '/api/audit-log' || pathname === '/api/sightings';
-        // Write and sensitive endpoints ALWAYS require auth, except anonymous threat uploads
-        const requiresAuth = !isHealthCheck &&
-            !isAnonymousThreatUpload &&
-            (this.config.apiKeyRequired || isWriteOrSensitive);
-        if (requiresAuth) {
-            if (this.hashedApiKeys.length === 0) {
-                this.sendJson(res, 503, {
-                    ok: false,
-                    error: 'Server not configured with API keys. Set TC_API_KEYS environment variable.',
-                });
-                return;
-            }
+        const pathname = url.split('?')[0];
+        if (pathname !== '/health' && this.config.apiKeyRequired) {
             const authHeader = req.headers.authorization ?? '';
-            const token = authHeader.startsWith('Bearer ') ? authHeader.slice(7) : '';
-            if (!token || !this.verifyApiKey(token)) {
-                this.sendJson(res, 401, { ok: false, error: 'Unauthorized' });
-                return;
-            }
-            apiKeyHash = AuditLogger.hashApiKey(token);
-            // Per-API-key rate limiting (stricter for write ops)
-            if (req.method === 'POST' && !this.checkRateLimit(`key:${apiKeyHash}`, 30)) {
-                this.sendJson(res, 429, { ok: false, error: 'Rate limit exceeded' });
+            const token = authHeader.replace('Bearer ', '');
+            if (!this.config.apiKeys.includes(token)) {
+                this.sendJson(res, 401, { ok: false, error: 'Invalid API key' });
                 return;
             }
         }
-        // CORS
-        const allowedOrigins = (process.env['CORS_ALLOWED_ORIGINS'] ?? 'https://panguard.ai,https://www.panguard.ai').split(',');
+        // CORS — restrict to known origins
+        const allowedOrigins = (process.env['CORS_ALLOWED_ORIGINS'] ??
+            'https://panguard.ai,https://www.panguard.ai,https://tc.panguard.ai,https://get.panguard.ai,https://docs.panguard.ai').split(',');
         const origin = req.headers.origin ?? '';
-        if (origin && allowedOrigins.includes(origin)) {
+        if (allowedOrigins.includes(origin)) {
             res.setHeader('Access-Control-Allow-Origin', origin);
         }
         res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
@@ -171,622 +159,407 @@ export class ThreatCloudServer {
             res.end();
             return;
         }
-        // Strict Content-Type for POST requests
-        if (req.method === 'POST') {
-            const contentType = req.headers['content-type'] ?? '';
-            if (!contentType.includes('application/json')) {
-                this.sendJson(res, 415, { ok: false, error: 'Content-Type must be application/json' });
-                return;
-            }
-        }
-        // Attach audit context to this request (anonymize client IP for privacy)
-        const auditCtx = { actorHash: apiKeyHash, ipAddress: this.anonymizeIP(clientIP) };
         try {
-            // Route matching
-            if (pathname === '/health') {
-                try {
-                    this.db.getDB().prepare('SELECT 1').get();
+            switch (pathname) {
+                case '/health':
                     this.sendJson(res, 200, {
                         ok: true,
-                        data: { status: 'healthy', uptime: process.uptime(), db: 'connected' },
-                    });
-                }
-                catch {
-                    this.sendJson(res, 503, {
-                        ok: false,
-                        data: { status: 'unhealthy', uptime: process.uptime(), db: 'disconnected' },
+                        data: { status: 'healthy', uptime: process.uptime() },
                     });
-                }
-                return;
-            }
-            if (pathname === '/api/threats' && req.method === 'POST') {
-                await this.handlePostThreat(req, res, auditCtx);
-                return;
-            }
-            if (pathname === '/api/trap-intel' && req.method === 'POST') {
-                await this.handlePostTrapIntel(req, res, auditCtx);
-                return;
-            }
-            // Sighting endpoints
-            if (pathname === '/api/sightings' && req.method === 'POST') {
-                await this.handlePostSighting(req, res, auditCtx);
-                return;
-            }
-            if (pathname === '/api/sightings' && req.method === 'GET') {
-                this.handleGetSightings(url, res);
-                return;
-            }
-            // Audit log endpoint
-            if (pathname === '/api/audit-log' && req.method === 'GET') {
-                this.handleGetAuditLog(url, res);
-                return;
-            }
-            if (pathname === '/api/rules') {
-                if (req.method === 'GET') {
-                    this.handleGetRules(url, res);
-                }
-                else if (req.method === 'POST') {
-                    await this.handlePostRule(req, res, auditCtx);
-                }
-                else {
-                    this.sendJson(res, 405, { ok: false, error: 'Method not allowed' });
-                }
-                return;
-            }
-            if (pathname === '/api/stats' && req.method === 'GET') {
-                this.handleGetStats(res);
-                return;
-            }
-            // GET /api/iocs or GET /api/iocs/:value
-            if (pathname === '/api/iocs' && req.method === 'GET') {
-                this.handleSearchIoCs(url, res);
-                return;
-            }
-            // /api/iocs/xxx path param routing
-            if (pathname.startsWith('/api/iocs/') && req.method === 'GET') {
-                const value = decodeURIComponent(pathname.slice('/api/iocs/'.length));
-                this.handleLookupIoC(url, value, res);
-                return;
-            }
-            // Campaign endpoints
-            if (pathname === '/api/campaigns/stats' && req.method === 'GET') {
-                this.handleCampaignStats(res);
-                return;
-            }
-            if (pathname === '/api/campaigns' && req.method === 'GET') {
-                this.handleListCampaigns(url, res);
-                return;
-            }
-            if (pathname.startsWith('/api/campaigns/') && req.method === 'GET') {
-                const id = decodeURIComponent(pathname.slice('/api/campaigns/'.length));
-                this.handleGetCampaign(id, res);
-                return;
-            }
-            // Query endpoints
-            if (pathname === '/api/query/timeseries' && req.method === 'GET') {
-                this.handleTimeSeries(url, res);
-                return;
-            }
-            if (pathname === '/api/query/geo' && req.method === 'GET') {
-                this.handleGeoDistribution(url, res);
-                return;
-            }
-            if (pathname === '/api/query/trends' && req.method === 'GET') {
-                this.handleTrends(url, res);
-                return;
-            }
-            if (pathname === '/api/query/mitre-heatmap' && req.method === 'GET') {
-                this.handleMitreHeatmap(url, res);
-                return;
-            }
-            // Feed endpoints
-            if (pathname === '/api/feeds/ip-blocklist' && req.method === 'GET') {
-                this.handleIPBlocklist(url, res);
-                return;
-            }
-            if (pathname === '/api/feeds/domain-blocklist' && req.method === 'GET') {
-                this.handleDomainBlocklist(url, res);
-                return;
-            }
-            if (pathname === '/api/feeds/iocs' && req.method === 'GET') {
-                this.handleIoCFeed(url, res);
-                return;
-            }
-            if (pathname === '/api/feeds/agent-update' && req.method === 'GET') {
-                this.handleAgentUpdate(url, res);
-                return;
+                    break;
+                case '/admin':
+                    this.serveAdminDashboard(req, res);
+                    break;
+                case '/api/threats':
+                    if (req.method === 'POST') {
+                        await this.handlePostThreat(req, res);
+                    }
+                    else {
+                        this.sendJson(res, 405, { ok: false, error: 'Method not allowed' });
+                    }
+                    break;
+                case '/api/rules':
+                    if (req.method === 'GET') {
+                        this.handleGetRules(url, res);
+                    }
+                    else if (req.method === 'POST') {
+                        if (!this.checkAdminAuth(req)) {
+                            this.sendJson(res, 403, {
+                                ok: false,
+                                error: 'Admin API key required for rule publishing',
+                            });
+                            break;
+                        }
+                        await this.handlePostRule(req, res);
+                    }
+                    else {
+                        this.sendJson(res, 405, { ok: false, error: 'Method not allowed' });
+                    }
+                    break;
+                case '/api/stats':
+                    if (req.method === 'GET') {
+                        this.handleGetStats(res);
+                    }
+                    else {
+                        this.sendJson(res, 405, { ok: false, error: 'Method not allowed' });
+                    }
+                    break;
+                case '/api/atr-proposals':
+                    if (req.method === 'POST') {
+                        await this.handlePostATRProposal(req, res);
+                    }
+                    else {
+                        this.sendJson(res, 405, { ok: false, error: 'Method not allowed' });
+                    }
+                    break;
+                case '/api/atr-feedback':
+                    if (req.method === 'POST') {
+                        await this.handlePostATRFeedback(req, res);
+                    }
+                    else {
+                        this.sendJson(res, 405, { ok: false, error: 'Method not allowed' });
+                    }
+                    break;
+                case '/api/skill-threats':
+                    if (req.method === 'POST') {
+                        await this.handlePostSkillThreat(req, res);
+                    }
+                    else {
+                        this.sendJson(res, 405, { ok: false, error: 'Method not allowed' });
+                    }
+                    break;
+                case '/api/atr-rules':
+                    if (req.method === 'GET') {
+                        this.handleGetATRRules(url, res);
+                    }
+                    else {
+                        this.sendJson(res, 405, { ok: false, error: 'Method not allowed' });
+                    }
+                    break;
+                case '/api/yara-rules':
+                    if (req.method === 'GET') {
+                        this.handleGetYaraRules(url, res);
+                    }
+                    else {
+                        this.sendJson(res, 405, { ok: false, error: 'Method not allowed' });
+                    }
+                    break;
+                case '/api/feeds/ip-blocklist':
+                    if (req.method === 'GET') {
+                        this.handleGetIPBlocklist(url, res);
+                    }
+                    else {
+                        this.sendJson(res, 405, { ok: false, error: 'Method not allowed' });
+                    }
+                    break;
+                case '/api/feeds/domain-blocklist':
+                    if (req.method === 'GET') {
+                        this.handleGetDomainBlocklist(url, res);
+                    }
+                    else {
+                        this.sendJson(res, 405, { ok: false, error: 'Method not allowed' });
+                    }
+                    break;
+                case '/api/skill-whitelist':
+                    if (req.method === 'GET') {
+                        this.handleGetSkillWhitelist(res);
+                    }
+                    else if (req.method === 'POST') {
+                        await this.handlePostSkillWhitelist(req, res);
+                    }
+                    else {
+                        this.sendJson(res, 405, { ok: false, error: 'Method not allowed' });
+                    }
+                    break;
+                case '/api/skill-blacklist':
+                    if (req.method === 'GET') {
+                        this.handleGetSkillBlacklist(url, res);
+                    }
+                    else {
+                        this.sendJson(res, 405, { ok: false, error: 'Method not allowed' });
+                    }
+                    break;
+                default:
+                    this.sendJson(res, 404, { ok: false, error: 'Not found' });
             }
-            this.sendJson(res, 404, { ok: false, error: 'Not found' });
         }
         catch (err) {
-            // Never leak stack traces or internal details in production
-            if (err instanceof SyntaxError) {
-                this.sendJson(res, 400, { ok: false, error: 'Invalid JSON in request body' });
-                return;
-            }
-            const isDev = process.env['NODE_ENV'] !== 'production';
-            const message = isDev && err instanceof Error ? err.message : 'Internal server error';
-            console.error('Request error:', err);
-            this.sendJson(res, 500, { ok: false, error: message });
+            log.error('Request failed', err);
+            this.sendJson(res, 500, { ok: false, error: 'Internal server error' });
         }
     }
-    // -------------------------------------------------------------------------
-    // POST /api/threats - Upload anonymized threat data (enhanced: also creates IoC)
-    // -------------------------------------------------------------------------
-    async handlePostThreat(req, res, auditCtx) {
-        const body = await this.readBody(req);
-        const data = JSON.parse(body);
-        // Input validation
-        if (!data.attackSourceIP ||
-            !data.attackType ||
-            !data.mitreTechnique ||
-            !data.sigmaRuleMatched ||
-            !data.timestamp ||
-            !data.region) {
-            this.sendJson(res, 400, {
-                ok: false,
-                error: 'Missing required fields: attackSourceIP, attackType, mitreTechnique, sigmaRuleMatched, timestamp, region',
-            });
-            return;
-        }
-        if (!this.isValidIP(data.attackSourceIP)) {
-            this.sendJson(res, 400, { ok: false, error: 'Invalid IP address format' });
-            return;
-        }
-        if (!this.isValidTimestamp(data.timestamp)) {
-            this.sendJson(res, 400, { ok: false, error: 'Invalid timestamp format' });
-            return;
-        }
-        // Sanitize string fields
-        data.attackType = this.sanitizeString(data.attackType, 100);
-        data.mitreTechnique = this.sanitizeString(data.mitreTechnique, 50);
-        data.sigmaRuleMatched = this.sanitizeString(data.sigmaRuleMatched, 200);
-        data.region = this.sanitizeString(data.region, 10);
-        if (data.industry)
-            data.industry = this.sanitizeString(data.industry, 50);
-        // Anonymize IP
-        data.attackSourceIP = this.anonymizeIP(data.attackSourceIP);
-        // Insert into legacy threats table (backward compat)
-        this.db.insertThreat(data);
-        // Insert into enriched_threats
-        const enriched = ThreatCloudDB.guardToEnriched(data);
-        const enrichedId = this.db.insertEnrichedThreat(enriched);
-        // Extract IP as IoC + auto-sighting (learning)
-        if (data.attackSourceIP && data.attackSourceIP !== 'unknown') {
-            const ioc = this.iocStore.upsertIoC({
-                type: 'ip',
-                value: data.attackSourceIP,
-                threatType: data.attackType,
-                source: 'guard',
-                confidence: 50,
-                tags: [data.mitreTechnique],
-            });
-            // Auto-sighting: agent reported this IP → positive sighting
-            if (ioc.sightings > 1) {
-                this.sightingStore.recordAgentMatch(ioc.id, 'guard', auditCtx.actorHash);
-                // Check for cross-source correlation
-                this.sightingStore.recordCrossSourceMatch(ioc.id, auditCtx.actorHash);
-            }
-        }
-        // Audit log
-        this.auditLogger.log('threat_upload', 'enriched_threat', String(enrichedId ?? 'dup'), {
-            ...auditCtx,
-            details: { attackType: data.attackType, region: data.region },
-        });
-        this.sendJson(res, 201, {
-            ok: true,
-            data: {
-                message: 'Threat data received',
-                enrichedId: enrichedId ?? 'duplicate',
-            },
-        });
-    }
-    // -------------------------------------------------------------------------
-    // POST /api/trap-intel - Upload trap intelligence
-    // -------------------------------------------------------------------------
-    async handlePostTrapIntel(req, res, auditCtx) {
+    /** POST /api/threats - Upload anonymized threat data (single or batch) */
+    async handlePostThreat(req, res) {
         const body = await this.readBody(req);
         const parsed = JSON.parse(body);
-        const items = Array.isArray(parsed) ? parsed : [parsed];
-        if (items.length > 100) {
-            this.sendJson(res, 400, { ok: false, error: 'Batch size exceeds maximum of 100' });
-            return;
-        }
-        let accepted = 0;
-        let duplicates = 0;
-        for (const data of items) {
+        // Support both single object and batch { events: [...] } format
+        const events = 'events' in parsed && Array.isArray(parsed.events)
+            ? parsed.events
+            : [parsed];
+        for (const data of events) {
             // Validate required fields
-            if (!data.sourceIP || !data.attackType || !data.timestamp || !data.mitreTechniques) {
-                continue;
-            }
-            if (!this.isValidIP(data.sourceIP))
-                continue;
-            // Sanitize
-            data.attackType = this.sanitizeString(data.attackType, 100);
-            if (data.region)
-                data.region = this.sanitizeString(data.region, 10);
-            // Anonymize IP
-            data.sourceIP = this.anonymizeIP(data.sourceIP);
-            // Convert and insert enriched threat
-            const enriched = ThreatCloudDB.trapToEnriched(data);
-            const enrichedId = this.db.insertEnrichedThreat(enriched);
-            if (enrichedId !== null) {
-                accepted++;
-                // Insert trap credentials (sanitize usernames)
-                if (data.topCredentials && data.topCredentials.length > 0) {
-                    const safeCreds = data.topCredentials.slice(0, 50).map((c) => ({
-                        username: this.sanitizeString(c.username, 200),
-                        count: Math.max(0, Math.min(1_000_000, c.count)),
-                    }));
-                    this.db.insertTrapCredentials(enrichedId, safeCreds);
-                }
-                // Extract IP as IoC + auto-sighting (learning)
-                if (data.sourceIP && data.sourceIP !== 'unknown') {
-                    const techniques = data.mitreTechniques ?? [];
-                    const ioc = this.iocStore.upsertIoC({
-                        type: 'ip',
-                        value: data.sourceIP,
-                        threatType: data.attackType,
-                        source: 'trap',
-                        confidence: 60,
-                        tags: techniques.map((t) => this.sanitizeString(t, 50)),
-                        metadata: {
-                            serviceType: data.serviceType,
-                            skillLevel: data.skillLevel,
-                            intent: data.intent,
-                        },
-                    });
-                    // Auto-sighting: trap agent confirmed this IP
-                    if (ioc.sightings > 1) {
-                        this.sightingStore.recordAgentMatch(ioc.id, 'trap', auditCtx.actorHash);
-                        this.sightingStore.recordCrossSourceMatch(ioc.id, auditCtx.actorHash);
-                    }
-                }
-            }
-            else {
-                duplicates++;
+            if (!data.attackSourceIP ||
+                !data.attackType ||
+                !data.mitreTechnique ||
+                !data.sigmaRuleMatched ||
+                !data.timestamp ||
+                !data.region) {
+                this.sendJson(res, 400, {
+                    ok: false,
+                    error: 'Missing required fields: attackSourceIP, attackType, mitreTechnique, sigmaRuleMatched, timestamp, region',
+                });
+                return;
             }
+            // Anonymize IP further (zero last octet if not already)
+            data.attackSourceIP = this.anonymizeIP(data.attackSourceIP);
+            this.db.insertThreat(data);
         }
-        // Audit log
-        this.auditLogger.log('trap_intel_upload', 'trap_intel', 'batch', {
-            ...auditCtx,
-            details: { accepted, duplicates, batchSize: items.length },
-        });
         this.sendJson(res, 201, {
             ok: true,
-            data: { message: 'Trap intelligence received', accepted, duplicates },
-        });
-    }
-    // -------------------------------------------------------------------------
-    // GET /api/iocs - Search IoCs
-    // -------------------------------------------------------------------------
-    handleSearchIoCs(url, res) {
-        const params = new URL(url, `http://localhost:${this.config.port}`).searchParams;
-        const result = this.iocStore.searchIoCs({
-            type: params.get('type') || undefined,
-            source: params.get('source') || undefined,
-            minReputation: params.get('minReputation')
-                ? Number(params.get('minReputation'))
-                : undefined,
-            status: params.get('status') || undefined,
-            since: params.get('since') || undefined,
-            search: params.get('search') || undefined,
-        }, {
-            page: Number(params.get('page') ?? '1'),
-            limit: Number(params.get('limit') ?? '50'),
+            data: { message: 'Threat data received', count: events.length },
         });
-        this.sendJson(res, 200, { ok: true, data: result });
-    }
-    // -------------------------------------------------------------------------
-    // GET /api/iocs/:value - Lookup single IoC
-    // -------------------------------------------------------------------------
-    handleLookupIoC(url, value, res) {
-        const params = new URL(url, `http://localhost:${this.config.port}`).searchParams;
-        const typeParam = params.get('type');
-        const type = typeParam ?? this.iocStore.detectType(value);
-        const result = this.iocStore.lookupIoCWithContext(type, value, (ip) => this.db.countRelatedThreats(ip));
-        this.sendJson(res, 200, { ok: true, data: result });
     }
-    // -------------------------------------------------------------------------
-    // Existing handlers / 既有處理器
-    // -------------------------------------------------------------------------
-    /** GET /api/rules?since=<ISO timestamp> */
+    /** GET /api/rules?since=<ISO>&category=<cat>&severity=<sev>&source=<src> */
     handleGetRules(url, res) {
         const params = new URL(url, `http://localhost:${this.config.port}`).searchParams;
         const since = params.get('since');
-        const rules = since ? this.db.getRulesSince(since) : this.db.getAllRules();
+        const filters = {
+            category: params.get('category') ?? undefined,
+            severity: params.get('severity') ?? undefined,
+            source: params.get('source') ?? undefined,
+        };
+        // Cache for 1 hour — rules rarely change, let CDN absorb traffic
+        res.setHeader('Cache-Control', 'public, max-age=3600, s-maxage=3600');
+        const rules = since
+            ? this.db.getRulesSince(since, filters)
+            : this.db.getAllRules(5000, filters);
         this.sendJson(res, 200, rules);
     }
-    /** POST /api/rules */
-    async handlePostRule(req, res, auditCtx) {
+    /** POST /api/rules - Publish rules (single or batch) */
+    async handlePostRule(req, res) {
         const body = await this.readBody(req);
-        const rule = JSON.parse(body);
-        if (!rule.ruleId || !rule.ruleContent || !rule.source) {
+        const parsed = JSON.parse(body);
+        // Support both single object and batch { rules: [...] } format
+        const rules = 'rules' in parsed && Array.isArray(parsed.rules) ? parsed.rules : [parsed];
+        const now = new Date().toISOString();
+        let count = 0;
+        for (const rule of rules) {
+            if (!rule.ruleId || !rule.ruleContent || !rule.source)
+                continue;
+            rule.publishedAt = rule.publishedAt || now;
+            this.db.upsertRule(rule);
+            count++;
+        }
+        this.sendJson(res, 201, { ok: true, data: { message: `${count} rule(s) published`, count } });
+    }
+    /** GET /api/stats */
+    handleGetStats(res) {
+        res.setHeader('Cache-Control', 'public, max-age=300, s-maxage=300');
+        const stats = this.db.getStats();
+        this.sendJson(res, 200, { ok: true, data: stats });
+    }
+    /** POST /api/atr-proposals - Submit or confirm an ATR rule proposal */
+    async handlePostATRProposal(req, res) {
+        const body = await this.readBody(req);
+        const data = JSON.parse(body);
+        const clientId = req.headers['x-panguard-client-id'] ?? undefined;
+        if (!data.patternHash || !data.ruleContent) {
             this.sendJson(res, 400, {
                 ok: false,
-                error: 'Missing required fields: ruleId, ruleContent, source',
+                error: 'Missing required fields: patternHash, ruleContent',
             });
             return;
         }
-        // Validate ruleContent size and format
-        const MAX_RULE_CONTENT_SIZE = 65_536; // 64KB max
-        if (rule.ruleContent.length > MAX_RULE_CONTENT_SIZE) {
+        // Check if a proposal with the same patternHash already exists
+        const proposals = this.db.getATRProposals();
+        const existing = proposals.find((p) => p['pattern_hash'] === data.patternHash);
+        if (existing) {
+            this.db.confirmATRProposal(data.patternHash);
+            this.sendJson(res, 200, {
+                ok: true,
+                data: { message: 'Proposal confirmed', patternHash: data.patternHash },
+            });
+        }
+        else {
+            const proposal = {
+                ...data,
+                clientId: clientId ?? data.clientId,
+            };
+            this.db.insertATRProposal(proposal);
+            // Fire-and-forget LLM review on first submission only
+            if (this.llmReviewer?.isAvailable()) {
+                void this.llmReviewer.reviewProposal(data.patternHash, data.ruleContent).catch((err) => {
+                    log.error(`LLM review failed for ${data.patternHash}`, err);
+                });
+            }
+            this.sendJson(res, 201, {
+                ok: true,
+                data: { message: 'Proposal submitted', patternHash: data.patternHash },
+            });
+        }
+    }
+    /** POST /api/atr-feedback - Submit feedback on an ATR rule */
+    async handlePostATRFeedback(req, res) {
+        const body = await this.readBody(req);
+        const data = JSON.parse(body);
+        const clientId = req.headers['x-panguard-client-id'] ?? undefined;
+        if (!data.ruleId || typeof data.isTruePositive !== 'boolean') {
             this.sendJson(res, 400, {
                 ok: false,
-                error: `ruleContent exceeds maximum size of ${MAX_RULE_CONTENT_SIZE} bytes`,
+                error: 'Missing required fields: ruleId (string), isTruePositive (boolean)',
             });
             return;
         }
-        // Basic Sigma YAML validation: must look like YAML (has title: or detection:)
-        const looksLikeYaml = rule.ruleContent.includes('title:') || rule.ruleContent.includes('detection:');
-        if (!looksLikeYaml) {
+        this.db.insertATRFeedback(data.ruleId, data.isTruePositive, clientId);
+        this.sendJson(res, 201, { ok: true, data: { message: 'Feedback received' } });
+    }
+    /** POST /api/skill-threats - Submit skill threat from audit */
+    async handlePostSkillThreat(req, res) {
+        const body = await this.readBody(req);
+        const data = JSON.parse(body);
+        const clientId = req.headers['x-panguard-client-id'] ?? undefined;
+        if (!data.skillHash || !data.skillName) {
             this.sendJson(res, 400, {
                 ok: false,
-                error: 'ruleContent must be valid Sigma YAML (missing title: or detection:)',
+                error: 'Missing required fields: skillHash, skillName',
             });
             return;
         }
-        rule.ruleId = this.sanitizeString(rule.ruleId, 200);
-        rule.ruleContent = this.sanitizeString(rule.ruleContent, MAX_RULE_CONTENT_SIZE);
-        rule.source = this.sanitizeString(rule.source, 100);
-        rule.publishedAt = rule.publishedAt || new Date().toISOString();
-        this.db.upsertRule(rule);
-        this.auditLogger.log('rule_publish', 'rule', rule.ruleId, {
-            ...auditCtx,
-            details: { source: rule.source },
-        });
-        this.sendJson(res, 201, { ok: true, data: { message: 'Rule published', ruleId: rule.ruleId } });
-    }
-    /** GET /api/stats (enhanced) */
-    handleGetStats(res) {
-        const stats = this.queryHandlers.getEnhancedStats();
-        this.sendJson(res, 200, { ok: true, data: stats });
-    }
-    // -------------------------------------------------------------------------
-    // Campaign handlers / Campaign 處理器
-    // -------------------------------------------------------------------------
-    handleListCampaigns(url, res) {
-        const params = new URL(url, `http://localhost:${this.config.port}`).searchParams;
-        const result = this.correlation.listCampaigns({
-            page: Number(params.get('page') ?? '1'),
-            limit: Number(params.get('limit') ?? '20'),
-        }, params.get('status') || undefined);
-        this.sendJson(res, 200, { ok: true, data: result });
-    }
-    handleCampaignStats(res) {
-        const stats = this.correlation.getCampaignStats();
-        this.sendJson(res, 200, { ok: true, data: stats });
-    }
-    handleGetCampaign(id, res) {
-        const campaign = this.correlation.getCampaign(id);
-        if (!campaign) {
-            this.sendJson(res, 404, { ok: false, error: 'Campaign not found' });
+        if (typeof data.riskScore !== 'number' || data.riskScore < 0 || data.riskScore > 100) {
+            this.sendJson(res, 400, { ok: false, error: 'riskScore must be a number between 0 and 100' });
             return;
         }
-        const events = this.correlation.getCampaignEvents(id);
-        this.sendJson(res, 200, { ok: true, data: { campaign, events } });
-    }
-    // -------------------------------------------------------------------------
-    // Query handlers / 查詢處理器
-    // -------------------------------------------------------------------------
-    handleTimeSeries(url, res) {
-        const params = new URL(url, `http://localhost:${this.config.port}`).searchParams;
-        const rawGranularity = params.get('granularity') ?? 'day';
-        const ALLOWED_GRANULARITIES = ['hour', 'day', 'week'];
-        if (!ALLOWED_GRANULARITIES.includes(rawGranularity)) {
-            this.sendJson(res, 400, { ok: false, error: 'granularity must be one of: hour, day, week' });
+        if (!data.riskLevel || typeof data.riskLevel !== 'string') {
+            this.sendJson(res, 400, { ok: false, error: 'riskLevel is required and must be a string' });
             return;
         }
-        const granularity = rawGranularity;
-        const result = this.queryHandlers.getTimeSeries(granularity, params.get('since') || undefined, params.get('attackType') || undefined);
-        this.sendJson(res, 200, { ok: true, data: result });
-    }
-    handleGeoDistribution(url, res) {
-        const params = new URL(url, `http://localhost:${this.config.port}`).searchParams;
-        const result = this.queryHandlers.getGeoDistribution(params.get('since') || undefined);
-        this.sendJson(res, 200, { ok: true, data: result });
+        const submission = {
+            ...data,
+            clientId: clientId ?? data.clientId,
+        };
+        this.db.insertSkillThreat(submission);
+        this.sendJson(res, 201, { ok: true, data: { message: 'Skill threat received' } });
     }
-    handleTrends(url, res) {
+    /** GET /api/atr-rules?since=<ISO> - Fetch confirmed/promoted ATR rules */
+    handleGetATRRules(url, res) {
+        res.setHeader('Cache-Control', 'public, max-age=3600, s-maxage=3600');
         const params = new URL(url, `http://localhost:${this.config.port}`).searchParams;
-        const periodDays = Number(params.get('periodDays') ?? '7');
-        const result = this.queryHandlers.getTrends(periodDays);
-        this.sendJson(res, 200, { ok: true, data: result });
+        const since = params.get('since') ?? undefined;
+        const rules = this.db.getConfirmedATRRules(since);
+        this.sendJson(res, 200, rules);
     }
-    handleMitreHeatmap(url, res) {
+    /** GET /api/yara-rules?since=<ISO> - Fetch YARA rules */
+    handleGetYaraRules(url, res) {
+        res.setHeader('Cache-Control', 'public, max-age=3600, s-maxage=3600');
         const params = new URL(url, `http://localhost:${this.config.port}`).searchParams;
-        const result = this.queryHandlers.getMitreHeatmap(params.get('since') || undefined);
-        this.sendJson(res, 200, { ok: true, data: result });
+        const since = params.get('since') ?? undefined;
+        const rules = this.db.getRulesBySource('yara', since);
+        this.sendJson(res, 200, rules);
     }
-    // -------------------------------------------------------------------------
-    // Feed handlers / Feed 處理器
-    // -------------------------------------------------------------------------
-    handleIPBlocklist(url, res) {
+    /** GET /api/feeds/ip-blocklist?minReputation=70 - IP blocklist feed (plain text) */
+    handleGetIPBlocklist(url, res) {
         const params = new URL(url, `http://localhost:${this.config.port}`).searchParams;
-        const minRep = Number(params.get('minReputation') ?? '70');
-        const blocklist = this.feedDistributor.getIPBlocklist(minRep);
+        const minReputation = Number(params.get('minReputation') ?? '70');
+        const ips = this.db.getIPBlocklist(minReputation);
         res.setHeader('Content-Type', 'text/plain');
+        res.setHeader('Cache-Control', 'public, max-age=1800, s-maxage=1800');
         res.writeHead(200);
-        res.end(blocklist);
+        res.end(ips.join('\n'));
     }
-    handleDomainBlocklist(url, res) {
+    /** GET /api/feeds/domain-blocklist?minReputation=70 - Domain blocklist feed (plain text) */
+    handleGetDomainBlocklist(url, res) {
         const params = new URL(url, `http://localhost:${this.config.port}`).searchParams;
-        const minRep = Number(params.get('minReputation') ?? '70');
-        const blocklist = this.feedDistributor.getDomainBlocklist(minRep);
+        const minReputation = Number(params.get('minReputation') ?? '70');
+        const domains = this.db.getDomainBlocklist(minReputation);
         res.setHeader('Content-Type', 'text/plain');
+        res.setHeader('Cache-Control', 'public, max-age=1800, s-maxage=1800');
         res.writeHead(200);
-        res.end(blocklist);
-    }
-    handleIoCFeed(url, res) {
-        const params = new URL(url, `http://localhost:${this.config.port}`).searchParams;
-        const result = this.feedDistributor.getIoCFeed(Number(params.get('minReputation') ?? '50'), Number(params.get('limit') ?? '1000'), params.get('since') || undefined);
-        this.sendJson(res, 200, { ok: true, data: result });
-    }
-    handleAgentUpdate(url, res) {
-        const params = new URL(url, `http://localhost:${this.config.port}`).searchParams;
-        const result = this.feedDistributor.getAgentUpdate(params.get('since') || undefined);
-        this.sendJson(res, 200, { ok: true, data: result });
+        res.end(domains.join('\n'));
     }
-    // -------------------------------------------------------------------------
-    // Utility methods / 工具方法
-    // -------------------------------------------------------------------------
-    // -------------------------------------------------------------------------
-    // Sighting + Audit handlers
-    // -------------------------------------------------------------------------
-    async handlePostSighting(req, res, auditCtx) {
+    /** POST /api/skill-whitelist - Report a safe skill (audit passed) */
+    async handlePostSkillWhitelist(req, res) {
         const body = await this.readBody(req);
-        const input = JSON.parse(body);
-        if (!input.iocId || !input.type || !input.source) {
-            this.sendJson(res, 400, {
-                ok: false,
-                error: 'Missing required fields: iocId, type, source',
-            });
-            return;
-        }
-        if (!['positive', 'negative', 'false_positive'].includes(input.type)) {
-            this.sendJson(res, 400, {
-                ok: false,
-                error: 'type must be one of: positive, negative, false_positive',
-            });
-            return;
-        }
-        // Verify IoC exists
-        const ioc = this.iocStore.getIoCById(input.iocId);
-        if (!ioc) {
-            this.sendJson(res, 404, { ok: false, error: 'IoC not found' });
-            return;
-        }
-        input.source = this.sanitizeString(input.source, 200);
-        if (input.details)
-            input.details = this.sanitizeString(input.details, 1000);
-        const sighting = this.sightingStore.createSighting(input, auditCtx.actorHash);
-        this.auditLogger.log('sighting_create', 'sighting', String(sighting.id), {
-            ...auditCtx,
-            details: { iocId: input.iocId, type: input.type, source: input.source },
-        });
-        this.sendJson(res, 201, { ok: true, data: sighting });
-    }
-    handleGetSightings(url, res) {
-        const params = new URL(url, `http://localhost:${this.config.port}`).searchParams;
-        const iocId = Number(params.get('iocId') ?? '0');
-        if (!iocId) {
-            this.sendJson(res, 400, { ok: false, error: 'iocId query parameter required' });
-            return;
+        const data = JSON.parse(body);
+        const skills = 'skills' in data && Array.isArray(data.skills)
+            ? data.skills
+            : [data];
+        let count = 0;
+        for (const skill of skills) {
+            if (!skill.skillName || typeof skill.skillName !== 'string')
+                continue;
+            this.db.reportSafeSkill(skill.skillName, skill.fingerprintHash);
+            count++;
         }
-        const result = this.sightingStore.getSightingsForIoC(iocId, {
-            page: Number(params.get('page') ?? '1'),
-            limit: Number(params.get('limit') ?? '50'),
-        });
-        const summary = this.sightingStore.getSightingSummary(iocId);
-        this.sendJson(res, 200, { ok: true, data: { ...result, summary } });
+        this.sendJson(res, 201, { ok: true, data: { message: `${count} skill(s) reported`, count } });
     }
-    handleGetAuditLog(url, res) {
-        const params = new URL(url, `http://localhost:${this.config.port}`).searchParams;
-        const query = {
-            action: params.get('action') || undefined,
-            entityType: params.get('entityType') || undefined,
-            entityId: params.get('entityId') || undefined,
-            since: params.get('since') || undefined,
-            limit: Number(params.get('limit') ?? '50'),
-        };
-        const result = this.auditLogger.query(query);
-        this.sendJson(res, 200, { ok: true, data: result });
+    /** GET /api/skill-whitelist - Fetch community-confirmed safe skills */
+    handleGetSkillWhitelist(res) {
+        const whitelist = this.db.getSkillWhitelist();
+        this.sendJson(res, 200, { ok: true, data: whitelist });
     }
-    // -------------------------------------------------------------------------
-    // Utility methods / 工具方法
-    // -------------------------------------------------------------------------
     /**
-     * Anonymize IP by zeroing last two octets (/16 for IPv4).
-     * GDPR-compliant: /16 masking prevents re-identification.
-     * 匿名化 IP（IPv4 遮蔽最後兩個八位元組，符合 GDPR）
+     * GET /api/skill-blacklist?minReports=3&minAvgRisk=70
+     * Fetch community skill blacklist (aggregated from skill threat reports)
+     * 取得社群技能黑名單（從技能威脅回報聚合）
      */
+    handleGetSkillBlacklist(url, res) {
+        const params = new URL(url, `http://localhost:${this.config.port}`).searchParams;
+        const minReports = Number(params.get('minReports') ?? '3');
+        const minAvgRisk = Number(params.get('minAvgRisk') ?? '70');
+        res.setHeader('Cache-Control', 'public, max-age=1800, s-maxage=1800');
+        const blacklist = this.db.getSkillBlacklist(minReports, minAvgRisk);
+        this.sendJson(res, 200, { ok: true, data: blacklist });
+    }
+    /** Anonymize IP by zeroing last octet / 匿名化 IP */
     anonymizeIP(ip) {
         if (ip.includes('.')) {
             const parts = ip.split('.');
             if (parts.length === 4) {
-                parts[2] = '0';
                 parts[3] = '0';
                 return parts.join('.');
             }
         }
+        // IPv6: truncate last segment
         if (ip.includes(':')) {
             const parts = ip.split(':');
-            // Zero last two groups for IPv6
-            if (parts.length >= 2) {
-                parts[parts.length - 1] = '0';
-                parts[parts.length - 2] = '0';
-                return parts.join(':');
-            }
+            parts[parts.length - 1] = '0';
+            return parts.join(':');
         }
         return ip;
     }
-    /**
-     * Verify API key using constant-time comparison to prevent timing attacks.
-     * 使用常數時間比較驗證 API key 以防止計時攻擊
-     */
-    verifyApiKey(token) {
-        const tokenHash = createHash('sha256').update(token).digest();
-        for (const keyHash of this.hashedApiKeys) {
-            if (tokenHash.length === keyHash.length && timingSafeEqual(tokenHash, keyHash)) {
-                return true;
-            }
-        }
-        return false;
-    }
-    /** Rate limit check (supports per-IP and per-key) / 速率限制檢查 */
-    checkRateLimit(key, maxPerMinute) {
-        const limit = maxPerMinute ?? this.config.rateLimitPerMinute;
+    /** Serve admin dashboard HTML (requires admin key or returns login page) */
+    serveAdminDashboard(_req, res) {
+        res.setHeader('Content-Type', 'text/html; charset=utf-8');
+        res.setHeader('Cache-Control', 'no-store');
+        res.setHeader('X-Robots-Tag', 'noindex, nofollow');
+        res.writeHead(200);
+        res.end(getAdminHTML());
+    }
+    /** Check admin API key for write-protected endpoints / 檢查管理員 API 金鑰 */
+    checkAdminAuth(req) {
+        if (!this.config.adminApiKey)
+            return true; // no admin key configured = open
+        const authHeader = req.headers.authorization ?? '';
+        const token = authHeader.replace('Bearer ', '');
+        return token === this.config.adminApiKey;
+    }
+    /** Rate limit check / 速率限制檢查 */
+    checkRateLimit(ip) {
         const now = Date.now();
-        const entry = this.rateLimits.get(key);
+        const entry = this.rateLimits.get(ip);
         if (!entry || now > entry.resetAt) {
-            this.rateLimits.set(key, { count: 1, resetAt: now + 60_000 });
-            // Periodic cleanup: remove expired entries every ~500 checks
-            if (this.rateLimits.size > 500) {
-                for (const [k, v] of this.rateLimits) {
-                    if (now > v.resetAt)
-                        this.rateLimits.delete(k);
-                }
-            }
+            this.rateLimits.set(ip, { count: 1, resetAt: now + 60_000 });
             return true;
         }
         entry.count++;
-        return entry.count <= limit;
-    }
-    /** Validate IPv4 or IPv6 format / 驗證 IP 格式 */
-    isValidIP(ip) {
-        // IPv4
-        if (/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(:\d+)?$/.test(ip)) {
-            const parts = ip.replace(/:\d+$/, '').split('.');
-            return parts.every((p) => {
-                const n = Number(p);
-                return n >= 0 && n <= 255;
-            });
-        }
-        // IPv6
-        if (ip.includes(':') && /^[0-9a-fA-F:]+$/.test(ip))
-            return true;
-        return false;
-    }
-    /** Validate ISO timestamp with reasonable bounds / 驗證 ISO 時間戳格式 */
-    isValidTimestamp(ts) {
-        const d = new Date(ts);
-        if (isNaN(d.getTime()))
-            return false;
-        const now = Date.now();
-        const oneHourAhead = now + 3_600_000;
-        const oneYearAgo = now - 365 * 24 * 3_600_000;
-        return d.getTime() >= oneYearAgo && d.getTime() <= oneHourAhead;
-    }
-    /** Sanitize string input: truncate and strip control characters / 清理字串輸入 */
-    sanitizeString(input, maxLength) {
-        // eslint-disable-next-line no-control-regex
-        return input.replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, '').slice(0, maxLength);
+        return entry.count <= this.config.rateLimitPerMinute;
     }
-    /** Read request body with size limit / 讀取請求主體 */
+    /** Read request body with size limit / 讀取請求主體（含大小限制） */
     readBody(req) {
         return new Promise((resolve, reject) => {
             const chunks = [];
             let size = 0;
-            const MAX_BODY = 1_048_576; // 1MB
+            const MAX_BODY = 52_428_800; // 50MB (for batch rule uploads)
             req.on('data', (chunk) => {
                 size += chunk.length;
                 if (size > MAX_BODY) {
@@ -805,5 +578,122 @@ export class ThreatCloudServer {
         res.writeHead(status);
         res.end(JSON.stringify(data));
     }
+    /**
+     * Seed rules from bundled config/ directory on first startup.
+     * Looks for config/ in cwd, relative to this file, or common Docker paths.
+     */
+    seedFromBundled() {
+        const __dirname = dirname(fileURLToPath(import.meta.url));
+        const candidates = [
+            join(process.cwd(), 'config'),
+            join(__dirname, '..', '..', '..', 'config'), // monorepo: packages/threat-cloud/dist -> config
+            join(__dirname, '..', '..', '..', '..', 'config'), // deeper nesting
+            '/app/config', // Docker standard
+        ];
+        const configDir = candidates.find((d) => {
+            try {
+                return statSync(d).isDirectory();
+            }
+            catch {
+                return false;
+            }
+        });
+        if (!configDir) {
+            log.info(`No config/ directory found (searched: ${candidates.join(', ')})`);
+            return 0;
+        }
+        log.info(`Using config directory: ${configDir}`);
+        const now = new Date().toISOString();
+        let seeded = 0;
+        const collectFiles = (dir, extensions) => {
+            const results = [];
+            try {
+                for (const entry of readdirSync(dir, { withFileTypes: true })) {
+                    const fullPath = join(dir, entry.name);
+                    if (entry.isDirectory()) {
+                        results.push(...collectFiles(fullPath, extensions));
+                    }
+                    else if (extensions.some((ext) => entry.name.endsWith(ext))) {
+                        results.push(fullPath);
+                    }
+                }
+            }
+            catch (err) {
+                log.error(`Cannot read directory ${dir}`, err);
+            }
+            return results;
+        };
+        // Sigma rules
+        const sigmaDir = join(configDir, 'sigma-rules');
+        try {
+            const files = collectFiles(sigmaDir, ['.yml', '.yaml']);
+            for (const file of files) {
+                const content = readFileSync(file, 'utf-8');
+                const ruleId = `sigma:${relative(sigmaDir, file).replace(/\//g, ':')}`;
+                this.db.upsertRule({ ruleId, ruleContent: content, publishedAt: now, source: 'sigma' });
+                seeded++;
+            }
+            log.info(`  Sigma: ${files.length} files`);
+        }
+        catch (err) {
+            log.error('Sigma seeding failed', err);
+        }
+        // YARA rules (split multi-rule files)
+        const yaraDir = join(configDir, 'yara-rules');
+        try {
+            const files = collectFiles(yaraDir, ['.yar', '.yara']);
+            for (const file of files) {
+                const content = readFileSync(file, 'utf-8');
+                const ruleMatches = content.match(/rule\s+\w+/g);
+                if (ruleMatches && ruleMatches.length > 1) {
+                    for (const match of ruleMatches) {
+                        const ruleName = match.replace('rule ', '');
+                        const ruleId = `yara:${basename(file, '.yar').replace('.yara', '')}:${ruleName}`;
+                        this.db.upsertRule({ ruleId, ruleContent: content, publishedAt: now, source: 'yara' });
+                        seeded++;
+                    }
+                }
+                else {
+                    const ruleId = `yara:${relative(yaraDir, file).replace(/\//g, ':')}`;
+                    this.db.upsertRule({ ruleId, ruleContent: content, publishedAt: now, source: 'yara' });
+                    seeded++;
+                }
+            }
+            log.info(`  YARA: ${files.length} files`);
+        }
+        catch (err) {
+            log.error('YARA seeding failed', err);
+        }
+        // ATR rules
+        const atrCandidates = [
+            join(process.cwd(), 'node_modules', 'agent-threat-rules', 'rules'),
+            join(__dirname, '..', '..', 'atr', 'rules'),
+            join(__dirname, '..', '..', '..', 'packages', 'atr', 'rules'),
+        ];
+        const atrDir = atrCandidates.find((d) => {
+            try {
+                return statSync(d).isDirectory();
+            }
+            catch {
+                return false;
+            }
+        });
+        if (atrDir) {
+            try {
+                const files = collectFiles(atrDir, ['.yaml', '.yml']);
+                for (const file of files) {
+                    const content = readFileSync(file, 'utf-8');
+                    const ruleId = `atr:${relative(atrDir, file).replace(/\//g, ':')}`;
+                    this.db.upsertRule({ ruleId, ruleContent: content, publishedAt: now, source: 'atr' });
+                    seeded++;
+                }
+                log.info(`  ATR: ${files.length} files`);
+            }
+            catch (err) {
+                log.error('ATR seeding failed', err);
+            }
+        }
+        return seeded;
+    }
 }
 //# sourceMappingURL=server.js.map