@solongate/proxy 0.59.4 → 0.60.0

package/dist/commands/index.js

@@ -0,0 +1,938 @@
+var __defProp = Object.defineProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/api-client/client.ts
+import { readFileSync, existsSync } from "fs";
+import { resolve, join } from "path";
+import { homedir } from "os";
+var DEFAULT_API_URL = "https://api.solongate.com";
+var ApiError = class extends Error {
+  status;
+  code;
+  constructor(status, code, message) {
+    super(message);
+    this.name = "ApiError";
+    this.status = status;
+    this.code = code;
+  }
+};
+var NotAuthenticatedError = class extends Error {
+  constructor() {
+    super("Not logged in. Run `solongate login` first.");
+    this.name = "NotAuthenticatedError";
+  }
+};
+function loginCredentialFile() {
+  try {
+    const p = join(homedir(), ".solongate", "cloud-guard.json");
+    if (!existsSync(p)) return {};
+    const c2 = JSON.parse(readFileSync(p, "utf-8"));
+    return c2 && typeof c2 === "object" ? c2 : {};
+  } catch {
+    return {};
+  }
+}
+function dotenvApiKey() {
+  try {
+    const envPath = resolve(".env");
+    if (!existsSync(envPath)) return void 0;
+    for (const line of readFileSync(envPath, "utf-8").split("\n")) {
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith("#")) continue;
+      const eq = trimmed.indexOf("=");
+      if (eq === -1) continue;
+      const key = trimmed.slice(0, eq).trim();
+      if (key !== "SOLONGATE_API_KEY") continue;
+      return trimmed.slice(eq + 1).trim().replace(/^["']|["']$/g, "");
+    }
+  } catch {
+  }
+  return void 0;
+}
+var cached = null;
+function resolveCredentials(apiUrlOverride) {
+  if (cached && !apiUrlOverride) return cached;
+  const file = loginCredentialFile();
+  const apiKey = process.env["SOLONGATE_API_KEY"] || file.apiKey || dotenvApiKey();
+  if (!apiKey) throw new NotAuthenticatedError();
+  const apiUrl = apiUrlOverride || process.env["SOLONGATE_API_URL"] || file.apiUrl || DEFAULT_API_URL;
+  const creds = { apiKey, apiUrl: apiUrl.replace(/\/$/, "") };
+  if (!apiUrlOverride) cached = creds;
+  return creds;
+}
+function buildUrl(base, path, query) {
+  const url = new URL(`${base}/api/v1${path}`);
+  if (query) {
+    for (const [k, v] of Object.entries(query)) {
+      if (v === void 0) continue;
+      url.searchParams.set(k, String(v));
+    }
+  }
+  return url.toString();
+}
+async function request(method, path, opts = {}) {
+  const creds = resolveCredentials(opts.apiUrl);
+  const url = buildUrl(creds.apiUrl, path, opts.query);
+  const headers = {
+    Authorization: `Bearer ${creds.apiKey}`
+  };
+  let bodyInit;
+  if (opts.body !== void 0) {
+    headers["Content-Type"] = "application/json";
+    bodyInit = JSON.stringify(opts.body);
+  }
+  let res;
+  try {
+    res = await fetch(url, {
+      method,
+      headers,
+      body: bodyInit,
+      signal: AbortSignal.timeout(opts.timeoutMs ?? 15e3)
+    });
+  } catch (err2) {
+    const msg = err2 instanceof Error ? err2.message : String(err2);
+    throw new ApiError(0, "NETWORK_ERROR", `Cannot reach SolonGate API: ${msg}`);
+  }
+  const text = await res.text().catch(() => "");
+  let json = void 0;
+  if (text) {
+    try {
+      json = JSON.parse(text);
+    } catch {
+    }
+  }
+  if (!res.ok) {
+    const envelope = json?.error;
+    if (envelope && typeof envelope === "object") {
+      throw new ApiError(res.status, envelope.code || "ERROR", envelope.message || res.statusText);
+    }
+    if (typeof envelope === "string") {
+      throw new ApiError(res.status, "ERROR", envelope);
+    }
+    if (res.status === 401) throw new ApiError(401, "AUTHENTICATION_ERROR", "Invalid API key. Run `solongate login`.");
+    if (res.status === 429) throw new ApiError(429, "RATE_LIMITED", "Rate limited by the API. Slow down and retry.");
+    throw new ApiError(res.status, "ERROR", text || res.statusText || `HTTP ${res.status}`);
+  }
+  return json;
+}
+
+// src/api-client/policies.ts
+var policies_exports = {};
+__export(policies_exports, {
+  active: () => active,
+  addRule: () => addRule,
+  create: () => create,
+  dryRun: () => dryRun,
+  get: () => get,
+  list: () => list,
+  remove: () => remove,
+  revokeRule: () => revokeRule,
+  rollback: () => rollback,
+  setActive: () => setActive,
+  update: () => update,
+  versions: () => versions
+});
+function list() {
+  return request("GET", "/policies");
+}
+function get(id, version) {
+  return request("GET", `/policies/${encodeURIComponent(id)}`, {
+    query: version !== void 0 ? { version } : void 0
+  });
+}
+function create(policy) {
+  return request("POST", "/policies", { body: policy });
+}
+function update(id, policy) {
+  return request("PUT", `/policies/${encodeURIComponent(id)}`, { body: policy });
+}
+function remove(id) {
+  return request("DELETE", `/policies/${encodeURIComponent(id)}`);
+}
+function addRule(id, spec) {
+  return request("POST", `/policies/${encodeURIComponent(id)}/rules`, { body: spec });
+}
+function revokeRule(id, ruleId) {
+  return request("DELETE", `/policies/${encodeURIComponent(id)}/rules/${encodeURIComponent(ruleId)}`);
+}
+function versions(id, opts = {}) {
+  return request("GET", `/policies/${encodeURIComponent(id)}/versions`, { query: opts });
+}
+function rollback(id, version) {
+  return request("POST", `/policies/${encodeURIComponent(id)}/rollback`, { body: { version } });
+}
+function active(agentId) {
+  return request("GET", "/policies/active", { query: agentId ? { agent_id: agentId } : void 0 });
+}
+function setActive(policyId) {
+  return request("POST", "/policies/active", { body: { policyId: policyId ?? "" } });
+}
+function dryRun(body) {
+  return request("POST", "/policies/dry-run", { body });
+}
+
+// src/api-client/settings.ts
+var settings_exports = {};
+__export(settings_exports, {
+  clearRateLimitHistory: () => clearRateLimitHistory,
+  getGuardStatus: () => getGuardStatus,
+  getRateLimitHistory: () => getRateLimitHistory,
+  getSecurityLayers: () => getSecurityLayers,
+  setSecurityLayers: () => setSecurityLayers
+});
+function getSecurityLayers() {
+  return request("GET", "/settings/security-layers");
+}
+function setSecurityLayers(layers) {
+  return request("PUT", "/settings/security-layers", { body: { layers } });
+}
+function getRateLimitHistory() {
+  return request("GET", "/settings/rate-limit-history");
+}
+function clearRateLimitHistory() {
+  return request("DELETE", "/settings/rate-limit-history", { query: { all: 1 } });
+}
+function getGuardStatus() {
+  return request("GET", "/settings/guard-status");
+}
+
+// src/api-client/stats.ts
+var stats_exports = {};
+__export(stats_exports, {
+  drift: () => drift,
+  get: () => get2,
+  securityInsights: () => securityInsights,
+  timeseries: () => timeseries
+});
+function get2() {
+  return request("GET", "/stats");
+}
+function timeseries(opts = {}) {
+  return request("GET", "/stats/timeseries", { query: opts });
+}
+function drift(days) {
+  return request("GET", "/stats/drift", { query: days !== void 0 ? { days } : void 0 });
+}
+function securityInsights(days) {
+  return request("GET", "/stats/security-insights", { query: days !== void 0 ? { days } : void 0 });
+}
+
+// src/api-client/audit.ts
+var audit_exports = {};
+__export(audit_exports, {
+  list: () => list2,
+  whitelist: () => whitelist
+});
+function list2(query = {}) {
+  return request("GET", "/audit-logs", { query });
+}
+function whitelist(id, scope = "exact") {
+  return request("POST", `/audit-logs/${encodeURIComponent(id)}/whitelist`, { body: { scope } });
+}
+
+// src/api-client/agents.ts
+var agents_exports = {};
+__export(agents_exports, {
+  anomalies: () => anomalies,
+  get: () => get3,
+  live: () => live
+});
+function live(opts = {}) {
+  return request("GET", "/agents/live", {
+    query: { limit: opts.limit, include_deactivated: opts.includeDeactivated ? 1 : void 0 }
+  });
+}
+function get3(id, scan = false) {
+  return request("GET", `/agents/${encodeURIComponent(id)}`, { query: scan ? { scan: 1 } : void 0 });
+}
+function anomalies(id, limit) {
+  return request("GET", `/agents/${encodeURIComponent(id)}/anomalies`, {
+    query: limit !== void 0 ? { limit } : void 0
+  });
+}
+
+// src/api-client/index.ts
+var api = { policies: policies_exports, settings: settings_exports, stats: stats_exports, audit: audit_exports, agents: agents_exports };
+
+// src/cli-utils.ts
+var c = {
+  reset: "\x1B[0m",
+  bold: "\x1B[1m",
+  dim: "\x1B[2m",
+  italic: "\x1B[3m",
+  white: "\x1B[97m",
+  gray: "\x1B[90m",
+  blue1: "\x1B[38;2;20;50;160m",
+  blue2: "\x1B[38;2;40;80;190m",
+  blue3: "\x1B[38;2;60;110;215m",
+  blue4: "\x1B[38;2;90;140;230m",
+  blue5: "\x1B[38;2;130;170;240m",
+  blue6: "\x1B[38;2;170;200;250m",
+  green: "\x1B[38;2;80;200;120m",
+  red: "\x1B[38;2;220;80;80m",
+  cyan: "\x1B[38;2;100;200;220m",
+  yellow: "\x1B[38;2;220;200;80m",
+  bgBlue: "\x1B[48;2;20;50;160m"
+};
+var BANNER_COLORS = [c.blue1, c.blue2, c.blue3, c.blue4, c.blue5, c.blue6];
+
+// src/commands/format.ts
+var out = (s = "") => void process.stdout.write(s + "\n");
+var err = (s = "") => void process.stderr.write(s + "\n");
+function printJson(value) {
+  out(JSON.stringify(value, null, 2));
+}
+var dim = (s) => `${c.dim}${s}${c.reset}`;
+var bold = (s) => `${c.bold}${s}${c.reset}`;
+var green = (s) => `${c.green}${s}${c.reset}`;
+var red = (s) => `${c.red}${s}${c.reset}`;
+var yellow = (s) => `${c.yellow}${s}${c.reset}`;
+var cyan = (s) => `${c.cyan}${s}${c.reset}`;
+function decisionColor(decision) {
+  const d = decision.toUpperCase();
+  if (d === "ALLOW") return green(d);
+  if (d === "DENY" || d === "DENIED") return red(d);
+  return dim(d);
+}
+var ANSI = /\x1b\[[0-9;]*m/g;
+var width = (s) => s.replace(ANSI, "").length;
+function table(headers, rows) {
+  const cols = headers.length;
+  const w = new Array(cols).fill(0);
+  for (let i = 0; i < cols; i++) w[i] = width(headers[i] ?? "");
+  for (const row of rows) {
+    for (let i = 0; i < cols; i++) w[i] = Math.max(w[i], width(row[i] ?? ""));
+  }
+  const pad = (s, i) => s + " ".repeat(Math.max(0, w[i] - width(s)));
+  err("  " + headers.map((h, i) => dim(pad(h, i))).join("  "));
+  for (const row of rows) {
+    err("  " + row.map((cell, i) => pad(cell ?? "", i)).join("  "));
+  }
+}
+function truncate(s, n) {
+  if (s.length <= n) return s;
+  return s.slice(0, Math.max(0, n - 1)) + "\u2026";
+}
+var BLOCKS = ["\u2581", "\u2582", "\u2583", "\u2584", "\u2585", "\u2586", "\u2587", "\u2588"];
+function sparkline(values) {
+  if (values.length === 0) return "";
+  const max = Math.max(...values, 0);
+  if (max === 0) return BLOCKS[0].repeat(values.length);
+  return values.map((v) => BLOCKS[Math.min(BLOCKS.length - 1, Math.round(v / max * (BLOCKS.length - 1)))]).join("");
+}
+
+// src/commands/policy.ts
+import { readFileSync as readFileSync2 } from "fs";
+
+// src/commands/args.ts
+function parse(argv) {
+  const positionals = [];
+  const flags = {};
+  for (let i = 0; i < argv.length; i++) {
+    const tok = argv[i];
+    if (tok.startsWith("--")) {
+      const body = tok.slice(2);
+      const eq = body.indexOf("=");
+      if (eq !== -1) {
+        flags[body.slice(0, eq)] = body.slice(eq + 1);
+        continue;
+      }
+      const next = argv[i + 1];
+      if (next !== void 0 && !next.startsWith("--")) {
+        flags[body] = next;
+        i++;
+      } else {
+        flags[body] = true;
+      }
+    } else {
+      positionals.push(tok);
+    }
+  }
+  return { positionals, flags };
+}
+function flagStr(flags, name) {
+  const v = flags[name];
+  return typeof v === "string" ? v : void 0;
+}
+function flagNum(flags, name) {
+  const v = flagStr(flags, name);
+  if (v === void 0) return void 0;
+  const n = Number(v);
+  return Number.isFinite(n) ? n : void 0;
+}
+function flagBool(flags, name) {
+  return flags[name] === true || flags[name] === "true";
+}
+
+// src/commands/policy.ts
+var USAGE = `${bold("solongate policy")} \u2014 manage cloud policies
+
+  policy list                          List all policies
+  policy show <id> [--version N]       Show one policy (rules, mode)
+  policy rules <id>                    List a policy's rules
+  policy allow <id> --tool <p> [--command|--path|--url <val>]
+                                       Append an ALLOW rule
+  policy revoke <id> <ruleId>          Remove a rule
+  policy versions <id>                 List version history
+  policy rollback <id> <version>       Roll back to a version
+  policy active                        Show the resolved active policy
+  policy activate <id> | --clear       Pin / unpin the active policy
+  policy dry-run <id|file.json> [--limit N] [--mode denylist|whitelist]
+                                       Replay recent traffic against a policy's rules
+
+  Add --json to any read command for machine-readable output.`;
+async function run(argv) {
+  const { positionals, flags } = parse(argv);
+  const sub = positionals[0];
+  const json = flagBool(flags, "json");
+  switch (sub) {
+    case void 0:
+    case "help":
+      err(USAGE);
+      return sub ? 0 : 1;
+    case "list": {
+      const { policies } = await api.policies.list();
+      if (json) return printJson(policies), 0;
+      if (policies.length === 0) {
+        err(dim("  No policies. Create one at https://dashboard.solongate.com"));
+        return 0;
+      }
+      table(
+        ["ID", "NAME", "MODE", "RULES", "VER", "UPDATED BY"],
+        policies.map((p) => [
+          cyan(p.id),
+          truncate(p.name, 28),
+          p.mode === "whitelist" ? green("whitelist") : "denylist",
+          String(p.rules?.length ?? 0),
+          `v${p.version}`,
+          dim(truncate(p.created_by || "\u2014", 20))
+        ])
+      );
+      return 0;
+    }
+    case "show": {
+      const id = positionals[1];
+      if (!id) return err("  Usage: policy show <id> [--version N]"), 1;
+      const p = await api.policies.get(id, flagNum(flags, "version"));
+      if (json) return printJson(p), 0;
+      err("");
+      err(`  ${bold(p.name)} ${dim(`(${p.id})`)}  v${p._version}`);
+      if (p.description) err(`  ${dim(p.description)}`);
+      err(`  mode: ${p.mode === "whitelist" ? green("whitelist") : "denylist"}   rules: ${p.rules.length}`);
+      err("");
+      printRules(p.rules);
+      return 0;
+    }
+    case "rules": {
+      const id = positionals[1];
+      if (!id) return err("  Usage: policy rules <id>"), 1;
+      const p = await api.policies.get(id);
+      if (json) return printJson(p.rules), 0;
+      printRules(p.rules);
+      return 0;
+    }
+    case "allow": {
+      const id = positionals[1];
+      if (!id) return err("  Usage: policy allow <id> --tool <pattern> [--command|--path|--url <val>]"), 1;
+      const toolPattern = flagStr(flags, "tool") ?? "*";
+      let kind = "tool";
+      let value;
+      for (const k of ["command", "path", "url"]) {
+        const v = flagStr(flags, k);
+        if (v !== void 0) {
+          kind = k;
+          value = v;
+        }
+      }
+      const res = await api.policies.addRule(id, { toolPattern, kind, value });
+      if (json) return printJson(res), 0;
+      if (res.deduped) err(green("  \u2713 ") + dim("Equivalent ALLOW rule already present."));
+      else err(green(`  \u2713 Rule added`) + dim(` (${res.rule?.id}) \u2192 v${res.policy_version}`));
+      return 0;
+    }
+    case "revoke": {
+      const id = positionals[1];
+      const ruleId = positionals[2];
+      if (!id || !ruleId) return err("  Usage: policy revoke <id> <ruleId>"), 1;
+      const res = await api.policies.revokeRule(id, ruleId);
+      if (json) return printJson(res), 0;
+      err(green(`  \u2713 Revoked ${ruleId}`) + dim(` \u2192 v${res.policy_version}`));
+      return 0;
+    }
+    case "versions": {
+      const id = positionals[1];
+      if (!id) return err("  Usage: policy versions <id>"), 1;
+      const { versions: versions2 } = await api.policies.versions(id, { limit: flagNum(flags, "limit") });
+      if (json) return printJson(versions2), 0;
+      table(
+        ["VER", "RULES", "REASON", "BY", "WHEN"],
+        versions2.map((v) => [
+          `v${v.version}`,
+          String(v.rules_count),
+          truncate(v.reason || "\u2014", 40),
+          dim(truncate(v.created_by || "\u2014", 18)),
+          dim(v.created_at)
+        ])
+      );
+      return 0;
+    }
+    case "rollback": {
+      const id = positionals[1];
+      const version = Number(positionals[2]);
+      if (!id || !Number.isFinite(version)) return err("  Usage: policy rollback <id> <version>"), 1;
+      const res = await api.policies.rollback(id, version);
+      if (json) return printJson(res), 0;
+      err(green(`  \u2713 Rolled back ${res.policy_id} from v${res.rolled_back_from} \u2192 v${res.version}`));
+      return 0;
+    }
+    case "active": {
+      const a = await api.policies.active();
+      if (json) return printJson(a), 0;
+      if (!a.policy) {
+        err(dim("  No active policy resolves for this project."));
+        return 0;
+      }
+      err("");
+      err(`  Active: ${bold(a.policy.name)} ${dim(`(${a.policy.id})`)}  v${a.version}`);
+      err(`  matched by: ${cyan(a.matched_by ?? "\u2014")}   self-protection: ${a.self_protection_enabled ? green("on") : dim("off")}`);
+      const rl = a.security?.rateLimit;
+      if (rl) err(`  rate limit: ${rl.perMinute}/min  ${rl.perHour}/h  ${rl.perDay}/day`);
+      if (a.security?.dlpBlock) err(`  DLP block: ${a.security.dlpBlock.patterns.length} patterns`);
+      return 0;
+    }
+    case "activate": {
+      if (flagBool(flags, "clear")) {
+        const res2 = await api.policies.setActive(null);
+        if (json) return printJson(res2), 0;
+        return err(green("  \u2713 Cleared active-policy pin.")), 0;
+      }
+      const id = positionals[1];
+      if (!id) return err("  Usage: policy activate <id>  |  policy activate --clear"), 1;
+      const res = await api.policies.setActive(id);
+      if (json) return printJson(res), 0;
+      err(green(`  \u2713 Pinned active policy \u2192 ${res.active}`));
+      return 0;
+    }
+    case "dry-run": {
+      const target = positionals[1];
+      if (!target) return err("  Usage: policy dry-run <id|file.json> [--limit N]"), 1;
+      const rules = await resolveRules(target);
+      const res = await api.policies.dryRun({
+        rules,
+        mode: flagStr(flags, "mode") ?? void 0,
+        limit: flagNum(flags, "limit")
+      });
+      if (json) return printJson(res), 0;
+      err("");
+      err(`  Replayed ${bold(String(res.evaluated))} recent calls against ${rules.length} rule(s)`);
+      err(`  would allow: ${green(String(res.would_allow))}   would deny: ${decisionColor("DENY")} ${res.would_deny}`);
+      err(`  ${green("newly allowed")}: ${res.newly_allowed}   ${decisionColor("DENY")}${dim(" newly blocked")}: ${res.newly_blocked}   unchanged: ${res.unchanged}`);
+      if (res.sample_newly_blocked.length) {
+        err(dim("\n  Sample newly-blocked:"));
+        for (const s of res.sample_newly_blocked.slice(0, 8)) err(`    ${decisionColor("DENY")} ${s.tool}  ${dim(truncate(s.preview, 50))}`);
+      }
+      return 0;
+    }
+    default:
+      err(`  Unknown: policy ${sub}
+`);
+      err(USAGE);
+      return 1;
+  }
+}
+function printRules(rules) {
+  if (rules.length === 0) return void err(dim("  (no rules)"));
+  table(
+    ["EFFECT", "PRIO", "TOOL", "ID", "DESCRIPTION"],
+    rules.map((r) => [
+      r.effect === "ALLOW" ? green("ALLOW") : decisionColor("DENY"),
+      String(r.priority),
+      cyan(truncate(r.toolPattern, 24)),
+      dim(truncate(r.id, 22)),
+      truncate(r.description || "\u2014", 40)
+    ])
+  );
+}
+async function resolveRules(target) {
+  if (target.endsWith(".json")) {
+    const parsed = JSON.parse(readFileSync2(target, "utf-8"));
+    return parsed.rules ?? [];
+  }
+  const p = await api.policies.get(target);
+  return p.rules;
+}
+
+// src/commands/ratelimit.ts
+var USAGE2 = `${bold("solongate ratelimit")} \u2014 request throttling
+
+  ratelimit show                       Current limits + change history
+  ratelimit set --minute N [--hour N] [--day N] [--mode off|detect|block]
+  ratelimit history                    Recent limit changes
+
+  Add --json for machine-readable output.`;
+var modeColor = (m) => m === "block" ? green(m) : m === "detect" ? yellow(m) : dim(m);
+async function run2(argv) {
+  const { positionals, flags } = parse(argv);
+  const sub = positionals[0] ?? "show";
+  const json = flagBool(flags, "json");
+  switch (sub) {
+    case "help":
+      return err(USAGE2), 0;
+    case "show": {
+      const [{ layers }, { history }] = await Promise.all([
+        api.settings.getSecurityLayers(),
+        api.settings.getRateLimitHistory()
+      ]);
+      if (json) return printJson({ rateLimit: layers.rateLimit, history }), 0;
+      const rl = layers.rateLimit;
+      err("");
+      err(`  Rate limit   mode: ${modeColor(rl.mode)}`);
+      err(`  ${bold(String(rl.perMinute))} ${dim("/min")}   ${bold(String(rl.perHour))} ${dim("/hour")}   ${bold(String(rl.perDay))} ${dim("/day")}`);
+      if (history.length) {
+        const spark = sparkline(history.map((h) => h.minute));
+        err(`  history      ${cyan(spark)} ${dim(`(${history.length} changes, per-min)`)}`);
+      }
+      return 0;
+    }
+    case "history": {
+      const { history } = await api.settings.getRateLimitHistory();
+      if (json) return printJson(history), 0;
+      if (!history.length) return err(dim("  No rate-limit changes recorded.")), 0;
+      table(
+        ["WHEN", "MINUTE", "HOUR", "DAY"],
+        history.map((h) => [dim(new Date(h.ts).toISOString()), String(h.minute), String(h.hour), String(h.day)])
+      );
+      return 0;
+    }
+    case "set": {
+      const minute = flagNum(flags, "minute");
+      const hour = flagNum(flags, "hour");
+      const day = flagNum(flags, "day");
+      const mode = flagStr(flags, "mode");
+      if (minute === void 0 && hour === void 0 && day === void 0 && !mode) {
+        return err("  Usage: ratelimit set --minute N [--hour N] [--day N] [--mode off|detect|block]"), 1;
+      }
+      const { layers } = await api.settings.getSecurityLayers();
+      const next = {
+        ...layers,
+        rateLimit: {
+          mode: mode ?? layers.rateLimit.mode,
+          perMinute: minute ?? layers.rateLimit.perMinute,
+          perHour: hour ?? layers.rateLimit.perHour,
+          perDay: day ?? layers.rateLimit.perDay
+        }
+      };
+      const res = await api.settings.setSecurityLayers(next);
+      if (json) return printJson(res.layers.rateLimit), 0;
+      const r = res.layers.rateLimit;
+      err(green("  \u2713 Rate limit updated") + dim(`  ${r.perMinute}/min ${r.perHour}/h ${r.perDay}/day  (${r.mode})`));
+      return 0;
+    }
+    default:
+      return err(USAGE2), 1;
+  }
+}
+
+// src/commands/dlp.ts
+var USAGE3 = `${bold("solongate dlp")} \u2014 data-loss prevention
+
+  dlp show                             Current mode + enabled patterns
+  dlp mode <off|detect|block>          Set enforcement mode
+  dlp enable <pattern>                 Enable a built-in pattern
+  dlp disable <pattern>                Disable a built-in pattern
+  dlp add-custom --name X --re <regex> Add a custom pattern
+  dlp remove-custom <name>             Remove a custom pattern
+
+  Add --json for machine-readable output.`;
+var modeColor2 = (m) => m === "block" ? green(m) : m === "detect" ? yellow(m) : dim(m);
+async function run3(argv) {
+  const { positionals, flags } = parse(argv);
+  const sub = positionals[0] ?? "show";
+  const json = flagBool(flags, "json");
+  const { layers, availablePatterns } = await api.settings.getSecurityLayers();
+  const save = async (next) => (await api.settings.setSecurityLayers(next)).layers;
+  switch (sub) {
+    case "help":
+      return err(USAGE3), 0;
+    case "show": {
+      if (json) return printJson({ dlp: layers.dlp, availablePatterns }), 0;
+      err("");
+      err(`  DLP   mode: ${modeColor2(layers.dlp.mode)}`);
+      const enabled = new Set(layers.dlp.patterns);
+      table(
+        ["", "PATTERN"],
+        availablePatterns.map((p) => [enabled.has(p) ? green("\u25CF") : dim("\u25CB"), enabled.has(p) ? p : dim(p)])
+      );
+      if (layers.dlp.custom.length) {
+        err(dim("\n  Custom:"));
+        for (const c2 of layers.dlp.custom) err(`    ${cyan(c2.name)}  ${dim(c2.re)}`);
+      }
+      return 0;
+    }
+    case "mode": {
+      const mode = positionals[1];
+      if (!mode || !["off", "detect", "block"].includes(mode)) return err("  Usage: dlp mode <off|detect|block>"), 1;
+      const saved = await save({ ...layers, dlp: { ...layers.dlp, mode } });
+      if (json) return printJson(saved.dlp), 0;
+      return err(green(`  \u2713 DLP mode \u2192 ${saved.dlp.mode}`)), 0;
+    }
+    case "enable":
+    case "disable": {
+      const pattern = positionals.slice(1).join(" ");
+      if (!pattern) return err(`  Usage: dlp ${sub} <pattern>`), 1;
+      if (!availablePatterns.includes(pattern)) {
+        err(`  Unknown pattern: "${pattern}". Available:`);
+        for (const p of availablePatterns) err(`    ${dim("\u2022")} ${p}`);
+        return 1;
+      }
+      const set = new Set(layers.dlp.patterns);
+      if (sub === "enable") set.add(pattern);
+      else set.delete(pattern);
+      const saved = await save({ ...layers, dlp: { ...layers.dlp, patterns: [...set] } });
+      if (json) return printJson(saved.dlp), 0;
+      return err(green(`  \u2713 ${sub}d "${pattern}"`) + dim(` (${saved.dlp.patterns.length} active)`)), 0;
+    }
+    case "add-custom": {
+      const name = flagStr(flags, "name");
+      const re = flagStr(flags, "re");
+      if (!name || !re) return err("  Usage: dlp add-custom --name <name> --re <regex>"), 1;
+      const custom = [...layers.dlp.custom.filter((c2) => c2.name !== name), { name, re }];
+      const saved = await save({ ...layers, dlp: { ...layers.dlp, custom } });
+      if (json) return printJson(saved.dlp), 0;
+      return err(green(`  \u2713 Custom pattern "${name}" added`)), 0;
+    }
+    case "remove-custom": {
+      const name = positionals.slice(1).join(" ");
+      if (!name) return err("  Usage: dlp remove-custom <name>"), 1;
+      const custom = layers.dlp.custom.filter((c2) => c2.name !== name);
+      const saved = await save({ ...layers, dlp: { ...layers.dlp, custom } });
+      if (json) return printJson(saved.dlp), 0;
+      return err(green(`  \u2713 Removed custom pattern "${name}"`)), 0;
+    }
+    default:
+      return err(USAGE3), 1;
+  }
+}
+
+// src/commands/stats.ts
+var USAGE4 = `${bold("solongate stats")} \u2014 traffic & security stats
+
+  stats                                Overview (totals, recent activity)
+  stats timeseries [--period 24h|7d|30d|all]
+  stats drift [--days N]               Denials rising/falling vs previous window
+
+  Add --json for machine-readable output.`;
+async function run4(argv) {
+  const { positionals, flags } = parse(argv);
+  const sub = positionals[0] ?? "overview";
+  const json = flagBool(flags, "json");
+  switch (sub) {
+    case "help":
+      return err(USAGE4), 0;
+    case "overview": {
+      const s = await api.stats.get();
+      if (json) return printJson(s), 0;
+      err("");
+      err(`  ${bold(String(s.total_calls))} calls   ${green(String(s.allowed))} allowed   ${red(String(s.denied))} denied`);
+      err(`  ${dim(`${s.active_policies} active policies \xB7 ${s.registered_tools} tools`)}`);
+      if (s.recent_activity.length) {
+        err(dim("\n  Recent:"));
+        table(
+          ["DECISION", "TOOL", "TRUST", "MS", "WHEN"],
+          s.recent_activity.map((a) => [
+            decisionColor(a.decision),
+            cyan(truncate(a.tool_name, 24)),
+            dim(a.trust_level),
+            String(a.evaluation_time_ms ?? "\u2014"),
+            dim(a.created_at)
+          ])
+        );
+      }
+      return 0;
+    }
+    case "timeseries": {
+      const period = flagStr(flags, "period") ?? "24h";
+      const ts = await api.stats.timeseries({ period });
+      if (json) return printJson(ts), 0;
+      const pts = ts.timeseries;
+      err("");
+      err(`  Timeseries ${dim(`(${ts.period}, per ${ts.granularity})`)}`);
+      err(`  total    ${cyan(sparkline(pts.map((p) => p.total)))}  ${dim(`max ${Math.max(0, ...pts.map((p) => p.total))}`)}`);
+      err(`  allowed  ${green(sparkline(pts.map((p) => p.allowed)))}`);
+      err(`  denied   ${red(sparkline(pts.map((p) => p.denied)))}`);
+      return 0;
+    }
+    case "drift": {
+      const d = await api.stats.drift(flagNum(flags, "days"));
+      if (json) return printJson(d), 0;
+      err("");
+      err(`  Denial drift ${dim(`(${d.days}d: ${d.total_current} now vs ${d.total_previous} prev)`)}`);
+      if (!d.rules.length) return err(dim("  No denials in window.")), 0;
+      table(
+        ["NOW", "PREV", "\u0394", "RULE", "REASON"],
+        d.rules.slice(0, 20).map((r) => [
+          bold(String(r.current)),
+          dim(String(r.previous)),
+          r.is_new ? green("NEW") : r.spike ? red(`+${r.delta}`) : String(r.delta),
+          cyan(truncate(r.rule_id ?? "\u2014", 22)),
+          truncate(r.reason ?? r.last_tool ?? "\u2014", 36)
+        ])
+      );
+      return 0;
+    }
+    default:
+      return err(USAGE4), 1;
+  }
+}
+
+// src/commands/audit.ts
+var USAGE5 = `${bold("solongate audit")} \u2014 audit log
+
+  audit [--filter ALLOW|DENY] [--tool <substr>] [--signal dlp|ratelimit]
+        [--search <text>] [--agent-name <name>] [--limit N]
+  audit whitelist <logId> [--scope exact|tool]
+                                       Turn a denied call into an ALLOW rule
+
+  Add --json for machine-readable output.`;
+async function run5(argv) {
+  const { positionals, flags } = parse(argv);
+  const json = flagBool(flags, "json");
+  if (positionals[0] === "help") return err(USAGE5), 0;
+  if (positionals[0] === "whitelist") {
+    const id = positionals[1];
+    if (!id) return err("  Usage: audit whitelist <logId> [--scope exact|tool]"), 1;
+    const scope = flagStr(flags, "scope") ?? "exact";
+    const res2 = await api.audit.whitelist(id, scope);
+    if (json) return printJson(res2), 0;
+    if (res2.deduped) err(green("  \u2713 ") + dim("Equivalent ALLOW already present."));
+    else err(green(`  \u2713 Whitelisted (${res2.scope})`) + dim(` \u2192 ${res2.policy_id} v${res2.policy_version}`));
+    return 0;
+  }
+  const query = {
+    filter: flagStr(flags, "filter"),
+    tool: flagStr(flags, "tool"),
+    signal: flagStr(flags, "signal"),
+    search: flagStr(flags, "search"),
+    agent_name: flagStr(flags, "agent-name"),
+    limit: flagNum(flags, "limit") ?? 30
+  };
+  const res = await api.audit.list(query);
+  if (json) return printJson(res), 0;
+  err("");
+  err(`  ${bold(String(res.total))} matching entries ${dim(`(showing ${res.entries.length})`)}`);
+  if (!res.entries.length) return 0;
+  table(
+    ["DECISION", "TOOL", "AGENT", "REASON", "DLP", "WHEN", "ID"],
+    res.entries.map((e) => [
+      decisionColor(e.decision),
+      cyan(truncate(e.tool_name, 22)),
+      dim(truncate(e.agent_name ?? "\u2014", 16)),
+      truncate(e.reason ?? "\u2014", 30),
+      e.dlp_matches?.length ? red(String(e.dlp_matches.length)) : dim("0"),
+      dim(e.created_at),
+      dim(truncate(e.id, 10))
+    ])
+  );
+  return 0;
+}
+
+// src/commands/agents.ts
+var statusColor = (s) => s === "active" ? green(s) : s === "idle" ? yellow(s) : dim(s);
+async function runAgents(argv) {
+  const { flags } = parse(argv);
+  const json = flagBool(flags, "json");
+  const res = await api.agents.live({ limit: flagNum(flags, "limit"), includeDeactivated: flagBool(flags, "all") });
+  if (json) return printJson(res), 0;
+  err("");
+  err(`  Agents   ${green(String(res.counts.active))} active   ${yellow(String(res.counts.idle))} idle   ${dim(String(res.counts.deactivated) + " off")}`);
+  if (!res.agents.length) return err(dim("  No agent sessions.")), 0;
+  table(
+    ["STATUS", "AGENT", "CALLS", "DENY", "DLP", "TRUST", "CHARACTER"],
+    res.agents.map((a) => [
+      statusColor(a.status),
+      cyan(truncate(a.agent_name ?? a.agent_id ?? a.session_id, 20)),
+      String(a.total_calls),
+      a.denied_calls ? red(String(a.denied_calls)) : dim("0"),
+      a.dlp_events ? red(String(a.dlp_events)) : dim("0"),
+      `${a.trust_score}`,
+      dim(truncate(a.character || "\u2014", 22))
+    ])
+  );
+  return 0;
+}
+async function runAgent(argv) {
+  const { positionals, flags } = parse(argv);
+  const json = flagBool(flags, "json");
+  const id = positionals[0];
+  if (!id) return err("  Usage: solongate agent <agent_id> [--json]"), 1;
+  const a = await api.agents.get(id);
+  if (json) return printJson(a), 0;
+  err("");
+  err(`  ${bold(a.agent_id)}   status: ${statusColor(String(a.status))}`);
+  const base = a.baseline;
+  if (base) {
+    err(`  ${dim(base.character ?? "")}   trust ${bold(String(base.trustScore ?? "\u2014"))}/100   deny-rate ${(Number(base.denyRate ?? 0) * 100).toFixed(0)}%`);
+  }
+  const feed = a.recent_feed ?? [];
+  if (feed.length) {
+    err(dim("\n  Recent:"));
+    table(
+      ["DECISION", "TOOL", "REASON", "WHEN"],
+      feed.slice(0, 15).map((f) => [
+        f.decision === "ALLOW" ? green("ALLOW") : red(String(f.decision)),
+        cyan(truncate(String(f.tool), 22)),
+        truncate(String(f.reason ?? "\u2014"), 30),
+        dim(String(f.created_at))
+      ])
+    );
+  }
+  return 0;
+}
+
+// src/commands/index.ts
+async function dispatch(command, argv) {
+  switch (command) {
+    case "policy":
+      return run(argv);
+    case "ratelimit":
+      return run2(argv);
+    case "dlp":
+      return run3(argv);
+    case "stats":
+      return run4(argv);
+    case "audit":
+      return run5(argv);
+    case "agents":
+      return runAgents(argv);
+    case "agent":
+      return runAgent(argv);
+    default:
+      err(`  Unknown command: ${command}`);
+      return 1;
+  }
+}
+async function runCommand(command, argv) {
+  try {
+    return await dispatch(command, argv);
+  } catch (e) {
+    if (e instanceof NotAuthenticatedError) {
+      err(red("  \u2717 ") + e.message);
+      return 1;
+    }
+    if (e instanceof ApiError) {
+      err(red("  \u2717 ") + `${e.message}` + (e.status ? ` (${e.status})` : ""));
+      return 1;
+    }
+    const msg = e instanceof Error ? e.message : String(e);
+    err(red("  \u2717 ") + msg);
+    return 1;
+  }
+}
+var COMMAND_NAMES = ["policy", "ratelimit", "dlp", "stats", "audit", "agents", "agent"];
+export {
+  COMMAND_NAMES,
+  runCommand
+};