@solongate/proxy 0.59.5 → 0.61.0

package/dist/api-client/agents.d.ts

@@ -0,0 +1,10 @@
+import type { LiveAgents } from './types.js';
+export declare function live(opts?: {
+    limit?: number;
+    includeDeactivated?: boolean;
+}): Promise<LiveAgents>;
+/** Deep detail for a single agent by agent_id. Loosely typed (rich payload). */
+export declare function get(id: string, scan?: boolean): Promise<Record<string, unknown>>;
+export declare function anomalies(id: string, limit?: number): Promise<{
+    anomalies: Array<Record<string, unknown>>;
+}>;

package/dist/api-client/audit.d.ts

@@ -0,0 +1,22 @@
+import type { AuditList } from './types.js';
+export interface AuditQuery {
+    filter?: 'ALLOW' | 'DENY' | 'DENIED';
+    tool?: string;
+    limit?: number;
+    offset?: number;
+    from?: number;
+    to?: number;
+    agent_name?: string;
+    session_id?: string;
+    search?: string;
+    signal?: 'dlp' | 'ratelimit';
+}
+export declare function list(query?: AuditQuery): Promise<AuditList>;
+export declare function whitelist(id: string, scope?: 'exact' | 'tool'): Promise<{
+    ok: true;
+    deduped: boolean;
+    scope: string;
+    policy_id: string;
+    policy_version?: number;
+    message?: string;
+}>;

package/dist/api-client/client.d.ts

@@ -0,0 +1,39 @@
+export declare const DEFAULT_API_URL = "https://api.solongate.com";
+export interface Credentials {
+    apiKey: string;
+    apiUrl: string;
+}
+/**
+ * Thrown for any non-2xx response. `code`/`message` come from the API's
+ * `{ error: { code, message } }` envelope when present; `status` is the HTTP
+ * status. Callers render `.message` to the user.
+ */
+export declare class ApiError extends Error {
+    readonly status: number;
+    readonly code: string;
+    constructor(status: number, code: string, message: string);
+}
+/** Raised when no API key can be found — tells the user to run `solongate login`. */
+export declare class NotAuthenticatedError extends Error {
+    constructor();
+}
+/** True when a key is available without prompting. */
+export declare function isAuthenticated(): boolean;
+/**
+ * Resolve API key + URL. `apiUrl` override (from a `--api-url` flag) wins over
+ * every source. Throws NotAuthenticatedError when no key is found.
+ */
+export declare function resolveCredentials(apiUrlOverride?: string): Credentials;
+export interface RequestOptions {
+    query?: Record<string, string | number | boolean | undefined>;
+    body?: unknown;
+    timeoutMs?: number;
+    /** Override api URL for this request (rarely needed). */
+    apiUrl?: string;
+}
+/**
+ * Typed request against the v1 API. Returns the parsed JSON body (as T) for 2xx
+ * responses; throws ApiError otherwise. `ArrayBuffer` bodies (e.g. wasm) are not
+ * handled here — none of the CLI surfaces need them.
+ */
+export declare function request<T = unknown>(method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE', path: string, opts?: RequestOptions): Promise<T>;

package/dist/api-client/index.d.ts

@@ -0,0 +1,18 @@
+/**
+ * SolonGate Cloud API client — shared by the CLI commands and the Ink TUI.
+ * Import as `import { api } from './api-client/index.js'` then `api.policies.list()`.
+ */
+export * from './client.js';
+export * from './types.js';
+import * as policies from './policies.js';
+import * as settings from './settings.js';
+import * as stats from './stats.js';
+import * as audit from './audit.js';
+import * as agents from './agents.js';
+export declare const api: {
+    policies: typeof policies;
+    settings: typeof settings;
+    stats: typeof stats;
+    audit: typeof audit;
+    agents: typeof agents;
+};

package/dist/api-client/policies.d.ts

@@ -0,0 +1,82 @@
+import type { ActivePolicy, PolicyDetail, PolicyListEntry, PolicyMode, PolicyRule, PolicySet, PolicyVersion } from './types.js';
+export declare function list(): Promise<{
+    policies: PolicyListEntry[];
+}>;
+export declare function get(id: string, version?: number): Promise<PolicyDetail>;
+export declare function create(policy: PolicySet): Promise<PolicyDetail>;
+export declare function update(id: string, policy: PolicySet): Promise<PolicyDetail>;
+export declare function remove(id: string): Promise<{
+    deleted: boolean;
+    policy_id: string;
+}>;
+export interface RuleSpec {
+    toolPattern?: string;
+    kind?: 'command' | 'path' | 'url' | 'tool';
+    value?: string;
+}
+export declare function addRule(id: string, spec: RuleSpec): Promise<{
+    ok: true;
+    deduped: boolean;
+    rule?: PolicyRule;
+    policy_id: string;
+    policy_version?: number;
+    message?: string;
+}>;
+export declare function revokeRule(id: string, ruleId: string): Promise<{
+    ok: true;
+    revoked: string;
+    policy_id: string;
+    policy_version: number;
+}>;
+export declare function versions(id: string, opts?: {
+    limit?: number;
+    offset?: number;
+}): Promise<{
+    versions: PolicyVersion[];
+    pagination: {
+        total: number;
+        limit: number;
+        offset: number;
+    };
+}>;
+export declare function rollback(id: string, version: number): Promise<{
+    version: number;
+    rolled_back_from: number;
+    policy_id: string;
+    hash: string;
+}>;
+export declare function active(agentId?: string): Promise<ActivePolicy>;
+export declare function setActive(policyId: string | null): Promise<{
+    ok: true;
+    active: string | null;
+}>;
+export interface DryRunResult {
+    evaluated: number;
+    would_allow: number;
+    would_deny: number;
+    newly_blocked: number;
+    newly_allowed: number;
+    unchanged: number;
+    sample_newly_blocked: Array<{
+        tool: string;
+        preview: string;
+        predicted: string;
+        created_at: string;
+    }>;
+    sample_newly_allowed: Array<{
+        tool: string;
+        preview: string;
+        predicted: string;
+        created_at: string;
+    }>;
+    mode: PolicyMode;
+    sampled: number;
+    limit: number;
+}
+export declare function dryRun(body: {
+    rules: PolicyRule[] | Partial<PolicyRule>[];
+    mode?: PolicyMode;
+    limit?: number;
+    from?: number;
+    to?: number;
+}): Promise<DryRunResult>;

package/dist/api-client/settings.d.ts

@@ -0,0 +1,22 @@
+import type { RateLimitChange, SecurityLayers } from './types.js';
+export declare function getSecurityLayers(): Promise<{
+    layers: SecurityLayers;
+    availablePatterns: string[];
+}>;
+export declare function setSecurityLayers(layers: SecurityLayers): Promise<{
+    layers: SecurityLayers;
+}>;
+export declare function getRateLimitHistory(): Promise<{
+    history: RateLimitChange[];
+}>;
+export declare function clearRateLimitHistory(): Promise<{
+    history: RateLimitChange[];
+}>;
+export interface GuardStatus {
+    latest: number;
+    installed: number | null;
+    up_to_date: boolean;
+    device_count: number;
+    outdated_count: number;
+}
+export declare function getGuardStatus(): Promise<GuardStatus>;

package/dist/api-client/stats.d.ts

@@ -0,0 +1,9 @@
+import type { Drift, Stats, Timeseries } from './types.js';
+export declare function get(): Promise<Stats>;
+export declare function timeseries(opts?: {
+    period?: '24h' | '7d' | '30d' | 'all';
+    granularity?: '1h' | '1d';
+}): Promise<Timeseries>;
+export declare function drift(days?: number): Promise<Drift>;
+/** Rich insights payload — kept loosely typed; consumers pick fields they need. */
+export declare function securityInsights(days?: number): Promise<Record<string, unknown>>;

package/dist/api-client/types.d.ts

@@ -0,0 +1,224 @@
+/**
+ * Wire types for the SolonGate v1 API, as consumed by the CLI.
+ *
+ * NOTE ON CASING: the API is inconsistent — policy list/version/audit responses
+ * use snake_case (created_by, _version, tool_name), while settings/alerts/agents
+ * baselines use camelCase (perMinute, windowSeconds). These types reflect what
+ * the wire actually sends; the command/TUI layers read them as-is.
+ */
+export type TrustLevel = 'UNTRUSTED' | 'VERIFIED' | 'TRUSTED';
+export type Permission = 'READ' | 'WRITE' | 'EXECUTE' | 'NETWORK';
+export type PolicyEffect = 'ALLOW' | 'DENY';
+export type PolicyMode = 'denylist' | 'whitelist';
+export interface Constraint {
+    allowed?: string[];
+    denied?: string[];
+}
+export interface PolicyRule {
+    id: string;
+    description: string;
+    effect: PolicyEffect;
+    priority: number;
+    toolPattern: string;
+    permission?: Permission | Permission[];
+    minimumTrustLevel: TrustLevel;
+    enabled: boolean;
+    pathConstraints?: Constraint & {
+        rootDirectory?: string;
+        allowSymlinks?: boolean;
+    };
+    commandConstraints?: Constraint;
+    filenameConstraints?: Constraint;
+    urlConstraints?: Constraint;
+    argumentConstraints?: Record<string, unknown>;
+}
+export interface PolicySet {
+    id: string;
+    name: string;
+    description?: string;
+    version?: number;
+    rules: PolicyRule[];
+    mode?: PolicyMode;
+    agents?: string[];
+}
+export interface PolicyListEntry {
+    id: string;
+    name: string;
+    rules: PolicyRule[];
+    mode: PolicyMode;
+    version: number;
+    hash: string;
+    created_by: string;
+    created_at: string;
+}
+export interface PolicyDetail extends PolicySet {
+    _version: number;
+    _hash: string;
+    _created_at: string;
+}
+export interface PolicyVersion {
+    version: number;
+    hash: string;
+    reason: string;
+    created_by: string | null;
+    created_at: string;
+    rules_count: number;
+}
+export interface ActivePolicy {
+    policy: PolicySet | null;
+    version?: number;
+    hash?: string;
+    matched_by?: 'pinned' | 'policy-id' | 'agent' | 'wildcard';
+    self_protection_enabled: boolean;
+    security: {
+        rateLimit: {
+            perMinute: number;
+            perHour: number;
+            perDay: number;
+        } | null;
+        dlpBlock: {
+            patterns: string[];
+            custom: unknown[];
+        } | null;
+        dlpRedact: {
+            patterns: string[];
+            custom: unknown[];
+        } | null;
+        ghost: {
+            patterns: string[];
+        } | null;
+        localLogs: unknown;
+    };
+    hook_versions: {
+        guard: number;
+        audit: number;
+        shield: number;
+    };
+}
+export type LayerMode = 'off' | 'detect' | 'block';
+export interface SecurityLayers {
+    rateLimit: {
+        mode: LayerMode;
+        perMinute: number;
+        perHour: number;
+        perDay: number;
+    };
+    dlp: {
+        mode: LayerMode;
+        patterns: string[];
+        custom: {
+            name: string;
+            re: string;
+        }[];
+    };
+    ghost: {
+        mode: 'off' | 'on';
+        patterns: string[];
+    };
+}
+export interface RateLimitChange {
+    ts: number;
+    minute: number;
+    hour: number;
+    day: number;
+}
+export interface Stats {
+    total_calls: number;
+    allowed: number;
+    denied: number;
+    active_policies: number;
+    registered_tools: number;
+    recent_activity: Array<{
+        id: string;
+        tool_name: string;
+        decision: string;
+        trust_level: string;
+        evaluation_time_ms: number | null;
+        created_at: string;
+    }>;
+}
+export interface TimeseriesPoint {
+    timestamp: string;
+    total: number;
+    allowed: number;
+    denied: number;
+    avg_eval_time_ms: number;
+}
+export interface Timeseries {
+    timeseries: TimeseriesPoint[];
+    period: string;
+    granularity: 'hour' | 'day' | 'month';
+}
+export interface Drift {
+    days: number;
+    total_current: number;
+    total_previous: number;
+    rules: Array<{
+        rule_id: string | null;
+        reason: string | null;
+        last_tool: string | null;
+        current: number;
+        previous: number;
+        delta: number;
+        delta_pct: number | null;
+        is_new: boolean;
+        spike: boolean;
+    }>;
+}
+export interface AuditEntry {
+    id: string;
+    request_id: string;
+    session_id: string | null;
+    tool_name: string;
+    server_name: string;
+    permission: string;
+    trust_level: string;
+    decision: string;
+    matched_rule_id: string | null;
+    reason: string | null;
+    evaluation_time_ms: number | null;
+    arguments_summary: Record<string, unknown> | null;
+    dlp_matches: string[];
+    rate_limit_burst: boolean;
+    agent_id: string | null;
+    agent_name: string | null;
+    created_at: string;
+}
+export interface AuditList {
+    entries: AuditEntry[];
+    total: number;
+    limit: number;
+    offset: number;
+    rate_limit_per_minute: number;
+}
+export interface LiveAgent {
+    session_id: string;
+    agent_id: string | null;
+    agent_name: string | null;
+    status: 'active' | 'idle' | 'deactivated';
+    started_at: string;
+    last_seen_at: string;
+    total_calls: number;
+    allowed_calls: number;
+    denied_calls: number;
+    dlp_events: number;
+    rate_limit_events: number;
+    pi_detections: number;
+    tool_mix: {
+        read: number;
+        write: number;
+        execute: number;
+        network: number;
+    };
+    character: string;
+    trust_score: number;
+    recent_anomalies: number;
+}
+export interface LiveAgents {
+    agents: LiveAgent[];
+    counts: {
+        active: number;
+        idle: number;
+        deactivated: number;
+    };
+}

package/dist/commands/agents.d.ts

@@ -0,0 +1,4 @@
+/** `solongate agents` — the live feed. */
+export declare function runAgents(argv: string[]): Promise<number>;
+/** `solongate agent <id>` — deep detail for one agent. */
+export declare function runAgent(argv: string[]): Promise<number>;

package/dist/commands/args.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Minimal flag parser for the CLI commands. Supports:
+ *   --flag value      → flags.flag = "value"
+ *   --flag=value      → flags.flag = "value"
+ *   --bool            → flags.bool = true (when next token is another flag / absent)
+ * Everything else is collected as positional args, in order.
+ */
+export interface ParsedArgs {
+    positionals: string[];
+    flags: Record<string, string | boolean>;
+}
+export declare function parse(argv: string[]): ParsedArgs;
+export declare function flagStr(flags: Record<string, string | boolean>, name: string): string | undefined;
+export declare function flagNum(flags: Record<string, string | boolean>, name: string): number | undefined;
+export declare function flagBool(flags: Record<string, string | boolean>, name: string): boolean;

package/dist/commands/audit.d.ts

@@ -0,0 +1 @@
+export declare function run(argv: string[]): Promise<number>;

package/dist/commands/dlp.d.ts

@@ -0,0 +1 @@
+export declare function run(argv: string[]): Promise<number>;

package/dist/commands/format.d.ts

@@ -0,0 +1,22 @@
+export declare const out: (s?: string) => void;
+export declare const err: (s?: string) => void;
+/** Print a value as pretty JSON to stdout (the machine contract). */
+export declare function printJson(value: unknown): void;
+export declare const dim: (s: string) => string;
+export declare const bold: (s: string) => string;
+export declare const green: (s: string) => string;
+export declare const red: (s: string) => string;
+export declare const yellow: (s: string) => string;
+export declare const cyan: (s: string) => string;
+/** Color a decision string (ALLOW green, DENY/DENIED red). */
+export declare function decisionColor(decision: string): string;
+/**
+ * Render an aligned table to stderr. `headers` are dimmed; each row is an array
+ * of already-colored (or plain) strings. Columns size to their widest cell.
+ */
+export declare function table(headers: string[], rows: string[][]): void;
+/** Truncate to n chars with an ellipsis. */
+export declare function truncate(s: string, n: number): string;
+/** Best-effort relative time from an ISO/date string. */
+export declare function ago(ts: string | number): string;
+export declare function sparkline(values: number[]): string;

package/dist/commands/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Run a management command. `command` is the subcommand name (e.g. 'policy'),
+ * `argv` are the tokens after it. Never throws — resolves to an exit code.
+ */
+export declare function runCommand(command: string, argv: string[]): Promise<number>;
+/** The subcommand names this router owns (used by src/index.ts to route). */
+export declare const COMMAND_NAMES: readonly ["policy", "ratelimit", "dlp", "stats", "audit", "agents", "agent"];