@panguard-ai/threat-cloud 1.4.2 → 1.5.5

package/dist/server.d.ts

@@ -9,6 +9,7 @@
  * - GET  /api/stats                  Get threat statistics
  * - POST /api/atr-proposals          Submit or confirm ATR rule proposal
  * - POST /api/atr-feedback           Submit feedback on ATR rule
+ * - POST /api/rule-feedback          Submit rule feedback with auto-quarantine
  * - POST /api/skill-threats          Submit skill threat from audit
  * - GET  /api/atr-rules              Fetch confirmed ATR rules (?since= filter)
  * - GET  /api/feeds/ip-blocklist     IP blocklist feed (text/plain, ?minReputation=)
@@ -19,6 +20,7 @@
  * - POST /api/telemetry              Record anonymous telemetry event from CLI
  * - POST /api/scan-events           Report scan event from any source (bulk/CLI/web)
  * - GET  /api/metrics               Aggregated metrics across all sources (public, cached 60s)
+ * - GET  /api/version               Build/deploy info: version, commit, uptime (public, cached 30s)
  * - GET  /api/badge/:author/:skill   ATR Scanned SVG badge for a skill
  * - GET  /api/badge/stats            Badge statistics (JSON)
  * - GET  /health                     Health check
@@ -38,6 +40,7 @@ export declare class ThreatCloudServer {
     private readonly badgeRouter;
     private promotionTimer;
     private rateLimits;
+    private registrationRateLimits;
     private rateLimitCleanupTimer;
     private statsCache;
     /** Promotion interval: 2 minutes / 推廣間隔：2 分鐘 */
@@ -52,6 +55,25 @@ export declare class ThreatCloudServer {
     private handleRequest;
     /** POST /api/telemetry - Record anonymous telemetry event from CLI */
     private handlePostTelemetry;
+    /**
+     * POST /api/migrator/telemetry — record a Migrator run summary.
+     * Body shape matches MigratorTelemetryEvent from
+     * @panguard/migrator/telemetry/tc-reporter:
+     *   { schema_version, install_id, migrator_version, run, rules[], frameworks }
+     * One event yields N rows in migrator_telemetry (one per rule).
+     * Carries fingerprints only — never rule body, never customer ID.
+     */
+    private handlePostMigratorTelemetry;
+    /** GET /api/migrator/telemetry — admin stats. */
+    private handleGetMigratorTelemetryStats;
+    /**
+     * GET /api/migrator/crystallization-candidates — admin only.
+     * Query params:
+     *   - minTenants (default 3): minimum distinct install_ids on a fingerprint
+     *   - windowDays (default 30): observation window
+     *   - limit (default 100)
+     */
+    private handleGetMigratorCrystallizationCandidates;
     /** POST /api/usage - Record usage event (scan, cli_install, etc.) */
     private handlePostUsageEvent;
     /** POST /api/threats - Upload anonymized threat data (single or batch) */
@@ -60,6 +82,18 @@ export declare class ThreatCloudServer {
     private handleGetRules;
     /** POST /api/rules - Publish rules (single or batch) */
     private handlePostRule;
+    /**
+     * POST /api/rules/sync — Admin-only endpoint for ATR repo CI to sync rules.
+     * Requires admin API key. Only accepts source='atr' (community rules use POST /api/rules).
+     * Body: { rules: [{ ruleId, ruleContent, source }] }. Max 200 per request.
+     */
+    private handleSyncATRRules;
+    /** POST /api/rules/bulk-delete — Admin-only delete by rule IDs */
+    private handleBulkDeleteRules;
+    /** DELETE /api/rules/by-source?source=yara — Admin-only bulk purge */
+    /** POST /api/devices/heartbeat — Guard sends periodic device metadata */
+    private handleDeviceHeartbeat;
+    private handleDeleteRulesBySource;
     /** GET /api/stats (cached 60s) */
     private handleGetStats;
     /** GET /api/threats?page=1&limit=50 (admin-only, paginated) */
@@ -68,11 +102,29 @@ export declare class ThreatCloudServer {
     private handleGetATRProposals;
     /** GET /api/skill-threats?limit=50 (admin-only) */
     private handleGetSkillThreats;
+    /**
+     * POST /api/atr-proposals/from-payload — drafter endpoint for external
+     * red-team input. Runs the TC tool-use drafter on the supplied attack
+     * payload and returns the generated ATR YAML. Admin or static key only.
+     */
+    private handleDraftProposalFromPayload;
     /** POST /api/atr-proposals - Submit or confirm an ATR rule proposal */
     private handlePostATRProposal;
     /** POST /api/atr-feedback - Submit feedback on an ATR rule */
     private handlePostATRFeedback;
+    /** POST /api/rule-feedback - Submit negative feedback on a canary/active rule, auto-quarantine at threshold */
+    private handlePostRuleFeedback;
     /** POST /api/skill-threats - Submit skill threat from audit */
+    /** POST /api/clients/register — auto-provision client API key */
+    private handleClientRegister;
+    /** POST /api/admin/client-keys/revoke — revoke client keys */
+    private handleClientKeyRevoke;
+    /**
+     * Admin-only: issue a partner-tier client key for L5 live-sync access.
+     * Body: { partnerName: string, issuedBy?: string }
+     * Returns raw key once — never retrievable again.
+     */
+    private handlePartnerKeyIssue;
     private handlePostSkillThreat;
     /**
      * Bridge skill_threats → atr_proposals when consensus is reached.
@@ -80,7 +132,7 @@ export declare class ThreatCloudServer {
      * auto-scaffold an ATR proposal from the aggregated findings.
      */
     private maybeGenerateATRFromSkillThreats;
-    /** GET /api/atr-rules?since=<ISO> - Fetch confirmed/promoted ATR rules */
+    /** GET /api/atr-rules?since=<ISO> - Fetch promoted ATR rules (+ canary for 10% of clients) */
     private handleGetATRRules;
     /** GET /api/feeds/ip-blocklist?minReputation=70 - IP blocklist feed (plain text) */
     private handleGetIPBlocklist;
@@ -88,7 +140,7 @@ export declare class ThreatCloudServer {
     private handleGetDomainBlocklist;
     /** POST /api/skill-whitelist - Report a safe skill (audit passed) */
     private handlePostSkillWhitelist;
-    /** GET /api/skill-whitelist - Fetch community-confirmed safe skills */
+    /** GET /api/skill-whitelist?since=ISO — Fetch community-confirmed safe skills (incremental) */
     private handleGetSkillWhitelist;
     /**
      * GET /api/skill-blacklist?minReports=3&minAvgRisk=70
@@ -124,6 +176,21 @@ export declare class ThreatCloudServer {
     private handlePostScanEvent;
     /** GET /api/metrics - Aggregated metrics across all sources (public, cached 60s) */
     private handleGetMetrics;
+    /**
+     * GET /api/version — public deploy verification endpoint.
+     *
+     * Reports the package version, server start time, uptime, Node version,
+     * and (if running on Railway) the Railway deployment metadata. The
+     * commit SHA is read from `RAILWAY_GIT_COMMIT_SHA` if Railway sets it,
+     * or `APP_COMMIT_SHA` if the build pipeline injects it manually.
+     *
+     * Used by external tooling and CI to verify which commit is actually
+     * running in production. Without this endpoint, deploy verification
+     * relied on inspecting Railway's dashboard, which is not scriptable.
+     *
+     * Public, no auth, no rate-limit. Cached for 30 seconds.
+     */
+    private handleGetVersion;
     /** GET /api/contributors - Public leaderboard (hashed IDs, no PII) */
     private handleGetContributors;
     /** Anonymize IP by zeroing last octet / 匿名化 IP */

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAqBH,OAAO,KAAK,EACV,YAAY,EAMb,MAAM,YAAY,CAAC;AA4BpB;;;GAGG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,MAAM,CAAgD;IAC9D,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAgB;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IACtC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAc;IAC1C,OAAO,CAAC,cAAc,CAA+C;IACrE,OAAO,CAAC,UAAU,CAA0C;IAC5D,OAAO,CAAC,qBAAqB,CAA+C;IAC5E,OAAO,CAAC,UAAU,CAAqD;IAEvE,gDAAgD;IAChD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAiB;IAC9D,kCAAkC;IAClC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAU;gBAExC,MAAM,EAAE,YAAY;IAwBhC,+BAA+B;IACzB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA6E5B,8BAA8B;IACxB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAmBb,aAAa;IA6X3B,sEAAsE;YACxD,mBAAmB;IA6CjC,qEAAqE;YACvD,oBAAoB;IA4BlC,0EAA0E;YAC5D,gBAAgB;IA+C9B,4EAA4E;IAC5E,OAAO,CAAC,cAAc;IAmBtB,wDAAwD;YAC1C,cAAc;IAkC5B,kCAAkC;IAClC,OAAO,CAAC,cAAc;IAYtB,+DAA+D;IAC/D,OAAO,CAAC,gBAAgB;IAcxB,yDAAyD;IACzD,OAAO,CAAC,qBAAqB;IAO7B,mDAAmD;IACnD,OAAO,CAAC,qBAAqB;IAO7B,uEAAuE;YACzD,qBAAqB;IAoDnC,8DAA8D;YAChD,qBAAqB;IASnC,+DAA+D;YACjD,qBAAqB;IAgCnC;;;;OAIG;YACW,gCAAgC;IA2F9C,0EAA0E;IAC1E,OAAO,CAAC,iBAAiB;IASzB,oFAAoF;IACpF,OAAO,CAAC,oBAAoB;IAW5B,4FAA4F;IAC5F,OAAO,CAAC,wBAAwB;IAWhC,qEAAqE;YACvD,wBAAwB;IA2BtC,uEAAuE;IACvE,OAAO,CAAC,uBAAuB;IAK/B;;;;OAIG;IACH,OAAO,CAAC,uBAAuB;IAU/B,iEAAiE;YACnD,sBAAsB;IAwBpC,wEAAwE;YAC1D,0BAA0B;IAkBxC,iEAAiE;YACnD,wBAAwB;IAYtC,wEAAwE;YAC1D,0BAA0B;IAkBxC;;;;;;OAMG;YACW,mBAAmB;IA0DjC,sDAAsD;IACtD,OAAO,CAAC,iBAAiB;IAczB;;;;OAIG;YACW,mBAAmB;IAkBjC,kEAAkE;YACpD,mBAAmB;IA8BjC,oFAAoF;YACtE,gBAAgB;IAgC9B,sEAAsE;IACtE,OAAO,CAAC,qBAAqB;IAM7B,kDAAkD;IAClD,OAAO,CAAC,WAAW;IAiBnB,kFAAkF;IAClF,OAAO,CAAC,mBAAmB;IAW3B,uEAAuE;IACvE,OAAO,CAAC,cAAc;IAwBtB,gCAAgC;IAChC,OAAO,CAAC,cAAc;IAWtB;;;OAGG;YACW,gBAAgB;IAqB9B,wDAAwD;IACxD,OAAO,CAAC,QAAQ;IAoBhB,sCAAsC;IACtC,OAAO,CAAC,QAAQ;IAUhB;;;OAGG;IACH,OAAO,CAAC,eAAe;CAwExB"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAgCH,OAAO,KAAK,EACV,YAAY,EAMb,MAAM,YAAY,CAAC;AA4BpB;;;GAGG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,MAAM,CAAgD;IAC9D,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAgB;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IACtC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAc;IAC1C,OAAO,CAAC,cAAc,CAA+C;IACrE,OAAO,CAAC,UAAU,CAA0C;IAC5D,OAAO,CAAC,sBAAsB,CAA8D;IAC5F,OAAO,CAAC,qBAAqB,CAA+C;IAC5E,OAAO,CAAC,UAAU,CAAqD;IAEvE,gDAAgD;IAChD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAiB;IAC9D,kCAAkC;IAClC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAU;gBAExC,MAAM,EAAE,YAAY;IAwBhC,+BAA+B;IACzB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAsG5B,8BAA8B;IACxB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAmBb,aAAa;IAosB3B,sEAAsE;YACxD,mBAAmB;IA6CjC;;;;;;;OAOG;YACW,2BAA2B;IA0DzC,iDAAiD;YACnC,+BAA+B;IAa7C;;;;;;OAMG;YACW,0CAA0C;IAkCxD,qEAAqE;YACvD,oBAAoB;IA4BlC,0EAA0E;YAC5D,gBAAgB;IA+C9B,4EAA4E;IAC5E,OAAO,CAAC,cAAc;IA6CtB,wDAAwD;YAC1C,cAAc;IAkC5B;;;;OAIG;YACW,kBAAkB;IAkDhC,kEAAkE;YACpD,qBAAqB;IAgCnC,sEAAsE;IACtE,yEAAyE;YAC3D,qBAAqB;YA+BrB,yBAAyB;IAmBvC,kCAAkC;IAClC,OAAO,CAAC,cAAc;IAYtB,+DAA+D;IAC/D,OAAO,CAAC,gBAAgB;IAcxB,yDAAyD;IACzD,OAAO,CAAC,qBAAqB;IAO7B,mDAAmD;IACnD,OAAO,CAAC,qBAAqB;IAO7B;;;;OAIG;YACW,8BAA8B;IAuF5C,uEAAuE;YACzD,qBAAqB;IAoDnC,8DAA8D;YAChD,qBAAqB;IASnC,+GAA+G;YACjG,sBAAsB;IA2CpC,+DAA+D;IAC/D,iEAAiE;YACnD,oBAAoB;IAqDlC,8DAA8D;YAChD,qBAAqB;IAgCnC;;;;OAIG;YACW,qBAAqB;YA+CrB,qBAAqB;IAgCnC;;;;OAIG;YACW,gCAAgC;IAuF9C,8FAA8F;IAC9F,OAAO,CAAC,iBAAiB;IA6BzB,oFAAoF;IACpF,OAAO,CAAC,oBAAoB;IAW5B,4FAA4F;IAC5F,OAAO,CAAC,wBAAwB;IAWhC,qEAAqE;YACvD,wBAAwB;IA2BtC,+FAA+F;IAC/F,OAAO,CAAC,uBAAuB;IAO/B;;;;OAIG;IACH,OAAO,CAAC,uBAAuB;IAe/B,iEAAiE;YACnD,sBAAsB;IAwBpC,wEAAwE;YAC1D,0BAA0B;IAkBxC,iEAAiE;YACnD,wBAAwB;IA2BtC,wEAAwE;YAC1D,0BAA0B;IAkBxC;;;;;;OAMG;YACW,mBAAmB;IA4NjC,sDAAsD;IACtD,OAAO,CAAC,iBAAiB;IAczB;;;;OAIG;YACW,mBAAmB;IAkBjC,kEAAkE;YACpD,mBAAmB;IA8BjC,oFAAoF;YACtE,gBAAgB;IAgC9B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,gBAAgB;IAmBxB,sEAAsE;IACtE,OAAO,CAAC,qBAAqB;IAM7B,kDAAkD;IAClD,OAAO,CAAC,WAAW;IAiBnB,kFAAkF;IAClF,OAAO,CAAC,mBAAmB;IAW3B,uEAAuE;IACvE,OAAO,CAAC,cAAc;IAwBtB,gCAAgC;IAChC,OAAO,CAAC,cAAc;IAWtB;;;OAGG;YACW,gBAAgB;IAqB9B,wDAAwD;IACxD,OAAO,CAAC,QAAQ;IAoBhB,sCAAsC;IACtC,OAAO,CAAC,QAAQ;IAUhB;;;OAGG;IACH,OAAO,CAAC,eAAe;CAwExB"}