<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Secure Network Architecture — API Reference

## agent.js CLI

```bash
# Inventory network assets and flows
node scripts/agent.js --action inventory --topology topology.json

# Generate segmentation zones
node scripts/agent.js --action segment --topology topology.json --output zones.json

# Generate firewall rules from zones
node scripts/agent.js --action rules --zones zones.json --output fw-rules.json

# Validate expected flows against rules
node scripts/agent.js --action validate --rules fw-rules.json --flows expected.json
```

## Topology JSON Schema

```json
{
  "name": "web-lb",
  "zone": "dmz | application | data | management | oob",
  "type": "load-balancer | service | database | jump-host",
  "ip_range": "10.0.1.0/24",
  "ports": [443, 8443],
  "connections": [
    {"target": "api-svc", "zone": "application", "protocol": "tcp", "port": 8443}
  ]
}
```

## Zone Trust Levels

| Zone | Trust Level | Tier | Default Policy |
|------|-------------|------|----------------|
| DMZ | Untrusted | 0 | Allow inbound HTTPS only |
| Application | Semi-trusted | 1 | Allow from DMZ on service ports |
| Data | Trusted | 2 | Allow from Application tier only |
| Management | Highly trusted | 3 | Allow from PAM/bastion only |
| OOB | Isolated | 4 | Physical/serial access only |

## Firewall Rule Schema

```json
{
  "id": "FW-0100",
  "name": "dmz-to-application",
  "source_zone": "dmz",
  "destination_zone": "application",
  "action": "allow",
  "conditions": "Explicit service ports only",
  "logging": true
}
```
