@profullstack/threatcrush 0.1.16 → 0.2.1

package/src/core/state.ts

@@ -1,146 +0,0 @@
-import Database from 'better-sqlite3';
-import type { ThreatEvent } from '../types/events.js';
-
-let db: Database.Database | null = null;
-
-export function initStateDB(dbPath: string = '/var/lib/threatcrush/state.db'): Database.Database {
-  if (db) return db;
-
-  try {
-    db = new Database(dbPath);
-  } catch {
-    // Fall back to in-memory if we can't write to the path
-    db = new Database(':memory:');
-  }
-
-  db.pragma('journal_mode = WAL');
-
-  db.exec(`
-    CREATE TABLE IF NOT EXISTS events (
-      id INTEGER PRIMARY KEY AUTOINCREMENT,
-      timestamp TEXT NOT NULL,
-      module TEXT NOT NULL,
-      category TEXT NOT NULL,
-      severity TEXT NOT NULL,
-      message TEXT NOT NULL,
-      source_ip TEXT,
-      details TEXT
-    );
-
-    CREATE TABLE IF NOT EXISTS module_state (
-      module TEXT NOT NULL,
-      key TEXT NOT NULL,
-      value TEXT,
-      PRIMARY KEY (module, key)
-    );
-
-    CREATE TABLE IF NOT EXISTS stats (
-      key TEXT PRIMARY KEY,
-      value TEXT NOT NULL,
-      updated_at TEXT NOT NULL
-    );
-
-    CREATE INDEX IF NOT EXISTS idx_events_timestamp ON events(timestamp);
-    CREATE INDEX IF NOT EXISTS idx_events_module ON events(module);
-    CREATE INDEX IF NOT EXISTS idx_events_severity ON events(severity);
-    CREATE INDEX IF NOT EXISTS idx_events_source_ip ON events(source_ip);
-  `);
-
-  return db;
-}
-
-export function insertEvent(event: ThreatEvent): number {
-  const database = db || initStateDB();
-  const stmt = database.prepare(`
-    INSERT INTO events (timestamp, module, category, severity, message, source_ip, details)
-    VALUES (?, ?, ?, ?, ?, ?, ?)
-  `);
-  const result = stmt.run(
-    event.timestamp.toISOString(),
-    event.module,
-    event.category,
-    event.severity,
-    event.message,
-    event.source_ip || null,
-    event.details ? JSON.stringify(event.details) : null,
-  );
-  return result.lastInsertRowid as number;
-}
-
-export function getRecentEvents(limit: number = 50): ThreatEvent[] {
-  const database = db || initStateDB();
-  const rows = database.prepare(`
-    SELECT * FROM events ORDER BY timestamp DESC LIMIT ?
-  `).all(limit) as any[];
-  return rows.map(rowToEvent);
-}
-
-export function getEventCount(since?: Date): number {
-  const database = db || initStateDB();
-  if (since) {
-    return (database.prepare(`SELECT COUNT(*) as count FROM events WHERE timestamp >= ?`)
-      .get(since.toISOString()) as any).count;
-  }
-  return (database.prepare(`SELECT COUNT(*) as count FROM events`).get() as any).count;
-}
-
-export function getThreatCount(since?: Date): number {
-  const database = db || initStateDB();
-  const severities = "('medium','high','critical')";
-  if (since) {
-    return (database.prepare(
-      `SELECT COUNT(*) as count FROM events WHERE severity IN ${severities} AND timestamp >= ?`
-    ).get(since.toISOString()) as any).count;
-  }
-  return (database.prepare(
-    `SELECT COUNT(*) as count FROM events WHERE severity IN ${severities}`
-  ).get() as any).count;
-}
-
-export function getTopSources(limit: number = 10): Array<{ ip: string; count: number }> {
-  const database = db || initStateDB();
-  return database.prepare(`
-    SELECT source_ip as ip, COUNT(*) as count FROM events
-    WHERE source_ip IS NOT NULL
-    GROUP BY source_ip ORDER BY count DESC LIMIT ?
-  `).all(limit) as any[];
-}
-
-export function getModuleState(module: string, key: string): unknown {
-  const database = db || initStateDB();
-  const row = database.prepare(`SELECT value FROM module_state WHERE module = ? AND key = ?`)
-    .get(module, key) as any;
-  if (!row) return undefined;
-  try {
-    return JSON.parse(row.value);
-  } catch {
-    return row.value;
-  }
-}
-
-export function setModuleState(module: string, key: string, value: unknown): void {
-  const database = db || initStateDB();
-  database.prepare(`
-    INSERT OR REPLACE INTO module_state (module, key, value) VALUES (?, ?, ?)
-  `).run(module, key, JSON.stringify(value));
-}
-
-function rowToEvent(row: any): ThreatEvent {
-  return {
-    id: row.id,
-    timestamp: new Date(row.timestamp),
-    module: row.module,
-    category: row.category,
-    severity: row.severity,
-    message: row.message,
-    source_ip: row.source_ip,
-    details: row.details ? JSON.parse(row.details) : undefined,
-  };
-}
-
-export function closeDB(): void {
-  if (db) {
-    db.close();
-    db = null;
-  }
-}

package/src/index.ts

@@ -1,474 +0,0 @@
-#!/usr/bin/env node
-
-import { Command } from "commander";
-import chalk from "chalk";
-import readline from "readline";
-import { execSync } from "node:child_process";
-import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";
-import { join } from "node:path";
-import { homedir } from "node:os";
-
-let PKG_VERSION = "0.1.8";
-try {
-  const pkg = JSON.parse(readFileSync(join(__dirname, "..", "package.json"), "utf-8"));
-  PKG_VERSION = pkg.version;
-} catch {}
-
-const LOGO = `
-${chalk.green("  ████████╗██╗  ██╗██████╗ ███████╗ █████╗ ████████╗")}
-${chalk.green("  ╚══██╔══╝██║  ██║██╔══██╗██╔════╝██╔══██╗╚══██╔══╝")}
-${chalk.green("     ██║   ███████║██████╔╝█████╗  ███████║   ██║   ")}
-${chalk.green("     ██║   ██╔══██║██╔══██╗██╔══╝  ██╔══██║   ██║   ")}
-${chalk.green("     ██║   ██║  ██║██║  ██║███████╗██║  ██║   ██║   ")}
-${chalk.green("     ╚═╝   ╚═╝  ╚═╝╚═╝  ╚═╝╚══════╝╚═╝  ╚═╝   ╚═╝")}
-${chalk.dim("                    C R U S H")}
-`;
-
-const API_URL = process.env.THREATCRUSH_API_URL || "https://threatcrush.com";
-const PKG_NAME = "@profullstack/threatcrush";
-const DESKTOP_PKG_NAME = "@profullstack/threatcrush-desktop";
-const INSTALL_CONFIG_PATH = join(homedir(), ".threatcrush", "install.json");
-
-// ─── Helpers ───
-
-async function promptEmail(): Promise<string | null> {
-  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve) => {
-    rl.question(chalk.green("\n  Enter your email to continue: "), (answer) => {
-      rl.close();
-      resolve(answer.trim() || null);
-    });
-  });
-}
-
-async function joinWaitlist(email: string): Promise<{ referral_code?: string } | null> {
-  try {
-    const res = await fetch(`${API_URL}/api/waitlist`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ email }),
-    });
-    return await res.json();
-  } catch {
-    return null;
-  }
-}
-
-async function emailGate(): Promise<boolean> {
-  console.log(LOGO);
-  console.log(chalk.yellow("  ⚡ Coming soon — ThreatCrush is in private beta.\n"));
-
-  const email = await promptEmail();
-  if (!email || !email.includes("@")) {
-    console.log(chalk.red("\n  Invalid email. Try again.\n"));
-    return false;
-  }
-
-  const result = await joinWaitlist(email);
-  if (result?.referral_code) {
-    console.log(chalk.green(`\n  ✓ You're on the list!`));
-    console.log(chalk.dim(`  Referral code: ${chalk.white(result.referral_code)}`));
-    console.log(chalk.dim(`  Share: ${API_URL}?ref=${result.referral_code}`));
-    console.log(chalk.green(`\n  🎁 Refer a friend → they save $100, you earn $100 in crypto via CoinPayPortal\n`));
-  } else {
-    console.log(chalk.green(`\n  ✓ Thanks! We'll notify you when ThreatCrush launches.\n`));
-  }
-
-  return true;
-}
-
-function detectPackageManager(): string {
-  // Check what installed us
-  try {
-    const npmGlobal = execSync("npm ls -g --depth=0 --json 2>/dev/null", { encoding: "utf-8" });
-    if (npmGlobal.includes(PKG_NAME)) return "npm";
-  } catch {}
-  try {
-    execSync("pnpm --version", { stdio: "pipe" });
-    return "pnpm";
-  } catch {}
-  try {
-    execSync("yarn --version", { stdio: "pipe" });
-    return "yarn";
-  } catch {}
-  try {
-    execSync("bun --version", { stdio: "pipe" });
-    return "bun";
-  } catch {}
-  return "npm";
-}
-
-function readInstallConfig(): { installMode?: string; packageManager?: string; installMethod?: string } {
-  try {
-    return JSON.parse(readFileSync(INSTALL_CONFIG_PATH, "utf-8"));
-  } catch {
-    return {};
-  }
-}
-
-function getGlobalInstallCommand(pm: string, pkgName: string, action: "install" | "update" | "remove"): string {
-  const commands: Record<string, Record<string, string>> = {
-    npm: {
-      install: `npm i -g ${pkgName}`,
-      update: `npm update -g ${pkgName}`,
-      remove: `npm uninstall -g ${pkgName}`,
-    },
-    pnpm: {
-      install: `pnpm add -g ${pkgName}`,
-      update: `pnpm update -g ${pkgName}`,
-      remove: `pnpm remove -g ${pkgName}`,
-    },
-    yarn: {
-      install: `yarn global add ${pkgName}`,
-      update: `yarn global upgrade ${pkgName}`,
-      remove: `yarn global remove ${pkgName}`,
-    },
-    bun: {
-      install: `bun add -g ${pkgName}`,
-      update: `bun update -g ${pkgName}`,
-      remove: `bun remove -g ${pkgName}`,
-    },
-  };
-
-  return commands[pm]?.[action] || commands.npm[action];
-}
-
-function packageLooksInstalled(pm: string, pkgName: string): boolean {
-  try {
-    const listCommands: Record<string, string> = {
-      npm: `npm ls -g ${pkgName} --depth=0`,
-      pnpm: `pnpm list -g ${pkgName} --depth=0`,
-      yarn: `yarn global list --pattern ${pkgName}`,
-      bun: `bun pm ls -g`,
-    };
-
-    const output = execSync(listCommands[pm] || listCommands.npm, {
-      encoding: "utf-8",
-      stdio: ["pipe", "pipe", "pipe"],
-    });
-
-    return output.includes(pkgName);
-  } catch {
-    return false;
-  }
-}
-
-// ─── Program ───
-
-const program = new Command();
-
-program
-  .name("threatcrush")
-  .description(
-    `${chalk.green("⚡ ThreatCrush")} — All-in-one security agent
-
-  Monitor every connection on every port. Detect live attacks,
-  scan your code, pentest your APIs, and alert you in real-time.
-
-  ${chalk.dim("Website:")}  ${chalk.green("https://threatcrush.com")}
-  ${chalk.dim("GitHub:")}   ${chalk.green("https://github.com/profullstack/threatcrush")}
-  ${chalk.dim("npm:")}      ${chalk.green("https://www.npmjs.com/package/@profullstack/threatcrush")}
-  ${chalk.dim("License:")}  ${chalk.green("$499 lifetime")} (or $399 with referral)
-
-${chalk.dim("Examples:")}
-  ${chalk.green("$")} threatcrush monitor          ${chalk.dim("# Real-time monitoring")}
-  ${chalk.green("$")} threatcrush tui              ${chalk.dim("# Interactive dashboard")}
-  ${chalk.green("$")} threatcrush scan ./src       ${chalk.dim("# Scan code for vulns")}
-  ${chalk.green("$")} threatcrush pentest URL      ${chalk.dim("# Pen test a URL")}
-  ${chalk.green("$")} threatcrush modules install  ${chalk.dim("# Install a module")}
-  ${chalk.green("$")} threatcrush update           ${chalk.dim("# Update to latest")}
-  ${chalk.green("$")} threatcrush remove           ${chalk.dim("# Uninstall completely")}`)
-  .version(PKG_VERSION, "-v, --version", "Show version number")
-  .helpOption("-h, --help", "Show this help")
-  .addHelpText("after", `
-${chalk.dim("─────────────────────────────────────────────────────")}
-${chalk.dim("Modules:")}
-  ThreatCrush uses pluggable security modules. Core modules included:
-  ${chalk.green("network-monitor")}  All TCP/UDP traffic, port scans, SYN floods
-  ${chalk.green("log-watcher")}      nginx, Apache, syslog, journald
-  ${chalk.green("ssh-guard")}        Failed logins, brute force, tunneling
-  ${chalk.green("code-scanner")}     Vulnerabilities, secrets, dependency CVEs
-  ${chalk.green("pentest-engine")}   SQLi, XSS, SSRF, API fuzzing
-  ${chalk.green("dns-monitor")}      DNS tunneling, DGA detection
-  ${chalk.green("firewall-rules")}   Auto-blocks via iptables/nftables
-  ${chalk.green("alert-system")}     Slack, Discord, email, webhook, PagerDuty
-
-  Browse community modules: ${chalk.green("threatcrush store")}
-`);
-
-// ─── Gated commands (coming soon) ───
-
-const gatedCommand = (name: string, desc: string, aliases?: string[]) => {
-  const cmd = program.command(name).description(desc).action(async () => {
-    await emailGate();
-  });
-  if (aliases) {
-    for (const alias of aliases) {
-      cmd.alias(alias);
-    }
-  }
-};
-
-gatedCommand("monitor", "Real-time security monitoring (all ports, all protocols)");
-gatedCommand("tui", "Interactive security dashboard (htop for security)", ["dashboard"]);
-gatedCommand("init", "Auto-detect services and configure ThreatCrush");
-gatedCommand("scan", "Scan codebase for vulnerabilities and secrets");
-gatedCommand("pentest", "Penetration test URLs and APIs");
-gatedCommand("status", "Show daemon status and loaded modules");
-gatedCommand("start", "Start the ThreatCrush daemon");
-gatedCommand("stop", "Stop the ThreatCrush daemon");
-gatedCommand("logs", "Tail daemon logs");
-gatedCommand("activate", "Activate your license key");
-
-// ─── Real commands ───
-
-program
-  .command("update")
-  .description("Update ThreatCrush CLI and installed bundle")
-  .option("--cli", "Update CLI only")
-  .option("--modules", "Update modules only")
-  .option("--desktop", "Update desktop app too")
-  .action(async (opts) => {
-    console.log(LOGO);
-
-    if (opts.modules) {
-      console.log(chalk.yellow("  Module updates coming soon.\n"));
-      return;
-    }
-
-    const pm = detectPackageManager();
-    const installConfig = readInstallConfig();
-    const installMode = opts.cli ? "server" : (opts.desktop ? "desktop" : installConfig.installMode || "server");
-
-    console.log(chalk.dim(`  Detected package manager: ${pm}`));
-    console.log(chalk.dim(`  Install mode: ${installMode}\n`));
-
-    const commands = [getGlobalInstallCommand(pm, PKG_NAME, "update")];
-
-    if (installMode === "desktop") {
-      commands.push(getGlobalInstallCommand(pm, DESKTOP_PKG_NAME, "update"));
-    }
-
-    try {
-      for (const cmd of commands) {
-        console.log(chalk.green(`  → ${cmd}\n`));
-        execSync(cmd, { stdio: "inherit" });
-      }
-
-      console.log(chalk.green("\n  ✓ ThreatCrush updated successfully!\n"));
-      if (installMode === "desktop") {
-        console.log(chalk.dim("  Updated bundle: CLI + desktop app\n"));
-      } else {
-        console.log(chalk.dim("  Updated bundle: CLI only\n"));
-      }
-    } catch (err) {
-      console.log(chalk.red("\n  ✗ Update failed. Try manually:\n"));
-      for (const cmd of commands) {
-        console.log(chalk.dim(`    ${cmd}`));
-      }
-      console.log();
-    }
-  });
-
-program
-  .command("remove")
-  .description("Uninstall ThreatCrush and the installed bundle")
-  .alias("uninstall")
-  .action(async () => {
-    console.log(LOGO);
-
-    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-    const confirm = await new Promise<string>((resolve) => {
-      rl.question(chalk.yellow("  Are you sure you want to uninstall ThreatCrush? (y/N): "), (answer) => {
-        rl.close();
-        resolve(answer.trim().toLowerCase());
-      });
-    });
-
-    if (confirm !== "y" && confirm !== "yes") {
-      console.log(chalk.dim("\n  Cancelled.\n"));
-      return;
-    }
-
-    const pm = detectPackageManager();
-    const installConfig = readInstallConfig();
-    const installMode = installConfig.installMode || "server";
-    const commands = [getGlobalInstallCommand(pm, PKG_NAME, "remove")];
-
-    if (installMode === "desktop" && packageLooksInstalled(pm, DESKTOP_PKG_NAME)) {
-      commands.push(getGlobalInstallCommand(pm, DESKTOP_PKG_NAME, "remove"));
-    }
-
-    console.log(chalk.dim(`\n  Detected package manager: ${pm}`));
-    console.log(chalk.dim(`  Install mode: ${installMode}\n`));
-
-    try {
-      for (const cmd of commands) {
-        console.log(chalk.green(`  → ${cmd}\n`));
-        execSync(cmd, { stdio: "inherit" });
-      }
-      console.log(chalk.green("\n  ✓ ThreatCrush has been uninstalled.\n"));
-      console.log(chalk.dim("  We're sorry to see you go! 👋\n"));
-      console.log(chalk.dim("  Config files may remain at /etc/threatcrush/"));
-      console.log(chalk.dim("  Logs may remain at /var/log/threatcrush/"));
-      console.log(chalk.dim("  State may remain at /var/lib/threatcrush/"));
-      console.log(chalk.dim(`  Local install metadata may remain at ${INSTALL_CONFIG_PATH}\n`));
-    } catch (err) {
-      console.log(chalk.red("\n  ✗ Uninstall failed. Try manually:\n"));
-      for (const cmd of commands) {
-        console.log(chalk.dim(`    ${cmd}`));
-      }
-      console.log();
-    }
-  });
-
-program
-  .command("modules")
-  .description("Manage security modules")
-  .argument("[action]", "list | install | remove | available | update")
-  .argument("[name]", "module name")
-  .action(async () => {
-    await emailGate();
-  });
-
-const storeCmd = program
-  .command("store")
-  .description("Browse the module marketplace")
-  .action(async () => {
-    await emailGate();
-  });
-
-storeCmd
-  .command("search <query>")
-  .description("Search for modules in the store")
-  .action(async () => {
-    await emailGate();
-  });
-
-storeCmd
-  .command("publish <url>")
-  .description("Publish a module from a git URL or web URL")
-  .action(async (url: string) => {
-    console.log(LOGO);
-
-    // 1. Get email
-    const configPath = join(homedir(), ".threatcrush", "config.json");
-    let email = "";
-    try {
-      const config = JSON.parse(readFileSync(configPath, "utf-8"));
-      email = config.email || "";
-    } catch {}
-
-    if (!email) {
-      const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-      email = await new Promise<string>((resolve) => {
-        rl.question(chalk.green("  Enter your email: "), (answer) => {
-          rl.close();
-          resolve(answer.trim());
-        });
-      });
-
-      if (!email || !email.includes("@")) {
-        console.log(chalk.red("\n  Invalid email.\n"));
-        return;
-      }
-
-      // Save email
-      try {
-        const dir = join(homedir(), ".threatcrush");
-        if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
-        writeFileSync(configPath, JSON.stringify({ email }, null, 2));
-        console.log(chalk.dim(`  Saved email to ${configPath}`));
-      } catch {}
-    }
-
-    console.log(chalk.dim(`\n  Fetching metadata from ${url}...\n`));
-
-    // 2. Fetch metadata
-    let meta: Record<string, unknown>;
-    try {
-      const res = await fetch(`${API_URL}/api/modules/fetch-meta`, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ url, git_url: url }),
-      });
-      if (!res.ok) {
-        const err = await res.json().catch(() => ({ error: res.statusText }));
-        console.log(chalk.red(`  ✗ Failed to fetch metadata: ${(err as Record<string, string>).error}\n`));
-        return;
-      }
-      meta = await res.json() as Record<string, unknown>;
-    } catch (err) {
-      console.log(chalk.red(`  ✗ Failed to fetch metadata: ${err instanceof Error ? err.message : err}\n`));
-      return;
-    }
-
-    // 3. Preview
-    console.log(chalk.green("  ── Module Preview ──\n"));
-    console.log(`  ${chalk.bold("Name:")}         ${meta.name || chalk.dim("(none)")}`);
-    console.log(`  ${chalk.bold("Display:")}      ${meta.display_name || chalk.dim("(none)")}`);
-    console.log(`  ${chalk.bold("Description:")}  ${meta.description || chalk.dim("(none)")}`);
-    console.log(`  ${chalk.bold("Version:")}      ${meta.version || "0.1.0"}`);
-    console.log(`  ${chalk.bold("License:")}      ${meta.license || "MIT"}`);
-    console.log(`  ${chalk.bold("Author:")}       ${meta.author_name || chalk.dim("(none)")}`);
-    console.log(`  ${chalk.bold("Homepage:")}     ${meta.homepage_url || chalk.dim("(none)")}`);
-    console.log(`  ${chalk.bold("Git:")}          ${meta.git_url || url}`);
-    if (Array.isArray(meta.tags) && meta.tags.length > 0) {
-      console.log(`  ${chalk.bold("Tags:")}         ${(meta.tags as string[]).join(", ")}`);
-    }
-    if (meta.stars) {
-      console.log(`  ${chalk.bold("Stars:")}        ⭐ ${meta.stars}`);
-    }
-    console.log();
-
-    // 4. Confirm
-    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-    const confirm = await new Promise<string>((resolve) => {
-      rl.question(chalk.yellow("  Publish this module? (y/N): "), (answer) => {
-        rl.close();
-        resolve(answer.trim().toLowerCase());
-      });
-    });
-
-    if (confirm !== "y" && confirm !== "yes") {
-      console.log(chalk.dim("\n  Cancelled.\n"));
-      return;
-    }
-
-    // 5. Publish
-    console.log(chalk.dim("\n  Publishing..."));
-    try {
-      const res = await fetch(`${API_URL}/api/modules`, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({
-          ...meta,
-          author_email: email,
-          git_url: (meta.git_url as string) || url,
-          homepage_url: (meta.homepage_url as string) || url,
-        }),
-      });
-
-      const result = await res.json() as Record<string, unknown>;
-
-      if (!res.ok) {
-        console.log(chalk.red(`\n  ✗ Publish failed: ${(result as Record<string, string>).error}\n`));
-        return;
-      }
-
-      const mod = result.module as Record<string, string>;
-      const slug = mod?.slug || meta.name;
-      console.log(chalk.green(`\n  ✓ Module published!`));
-      console.log(chalk.dim(`  ${API_URL}/store/${slug}\n`));
-    } catch (err) {
-      console.log(chalk.red(`\n  ✗ Publish failed: ${err instanceof Error ? err.message : err}\n`));
-    }
-  });
-
-// Default action (no command — show help)
-program.action(() => {
-  console.log(LOGO);
-  program.help();
-});
-
-program.parse();

package/src/types/config.ts

@@ -1,63 +0,0 @@
-export interface DaemonConfig {
-  pid_file: string;
-  log_level: 'debug' | 'info' | 'warn' | 'error';
-  log_file: string;
-  state_db: string;
-}
-
-export interface ApiConfig {
-  enabled: boolean;
-  bind: string;
-  tls: boolean;
-}
-
-export interface AlertChannelConfig {
-  enabled: boolean;
-  [key: string]: unknown;
-}
-
-export interface ModulesConfig {
-  auto_update: boolean;
-  update_interval: string;
-  module_dir: string;
-  config_dir: string;
-}
-
-export interface ThreatCrushConfig {
-  daemon: DaemonConfig;
-  api: ApiConfig;
-  alerts: Record<string, AlertChannelConfig>;
-  modules: ModulesConfig;
-  license?: {
-    key_file?: string;
-    key?: string;
-  };
-}
-
-export interface ModuleManifest {
-  module: {
-    name: string;
-    version: string;
-    description: string;
-    author: string;
-    license: string;
-    homepage?: string;
-    pricing?: {
-      type: 'free' | 'paid' | 'freemium';
-      price_usd?: number;
-    };
-    requirements?: {
-      threatcrush?: string;
-      os?: string[];
-      capabilities?: string[];
-    };
-    config?: {
-      defaults?: Record<string, unknown>;
-    };
-  };
-}
-
-export interface ModuleConfig {
-  enabled: boolean;
-  [key: string]: unknown;
-}