@aiassesstech/grillo 0.1.0

package/dist/api/server.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Grillo Cricket — REST API Server
+ *
+ * Lightweight HTTP server exposing Grillo's fleet management API.
+ * Uses Node.js built-in http module (zero external dependencies).
+ *
+ * Endpoints map 1:1 to the spec in SPEC-GRILLO-CRICKET section 10:
+ *   /api/grillo/agents/*          — Agent management
+ *   /api/grillo/assess/*          — Assessment operations
+ *   /api/grillo/certifications/*  — Certification & compliance
+ *   /api/grillo/drift/*           — Drift detection
+ */
+import type { AgentRegistry } from "../registry/agent-registry.js";
+import type { GrilloOrchestrator } from "../orchestration/orchestrator.js";
+import type { DriftDetector } from "../drift/detector.js";
+import type { FleetAnomalyDetector } from "../drift/fleet-anomaly.js";
+import type { AuditLog } from "../audit/audit-log.js";
+import type { ComplianceReportGenerator } from "../reports/compliance-report.js";
+import type { GrilloConfig } from "../config/schema.js";
+import type { DiscoveryService } from "../discovery/discovery-service.js";
+import type { GrilloEventBus } from "../events/event-bus.js";
+import type { ContinuousMonitor } from "../monitoring/continuous-monitor.js";
+import type { DashboardMetrics } from "../dashboard/metrics.js";
+export interface GrilloAPIServerOptions {
+    registry: AgentRegistry;
+    orchestrator: GrilloOrchestrator;
+    driftDetector: DriftDetector;
+    fleetAnomalyDetector: FleetAnomalyDetector;
+    auditLog: AuditLog;
+    reportGenerator: ComplianceReportGenerator;
+    config: GrilloConfig;
+    /** Phase 4 additions */
+    discoveryService?: DiscoveryService;
+    eventBus?: GrilloEventBus;
+    continuousMonitor?: ContinuousMonitor;
+    /** Phase 7: Dashboard */
+    dashboardMetrics?: DashboardMetrics;
+    port?: number;
+    host?: string;
+}
+export declare class GrilloAPIServer {
+    private readonly opts;
+    private server;
+    private readonly startedAt;
+    private activeConnections;
+    private _shuttingDown;
+    /** Phase 7: Cached dashboard HTML (regenerated on config change) */
+    private dashboardHTML;
+    constructor(opts: GrilloAPIServerOptions);
+    /**
+     * Start the API server.
+     */
+    start(): Promise<void>;
+    /**
+     * Graceful shutdown: stop accepting new connections,
+     * drain active connections, then close.
+     */
+    stop(options?: {
+        timeoutMs?: number;
+    }): Promise<void>;
+    /**
+     * Whether the server is in shutdown mode.
+     */
+    get shuttingDown(): boolean;
+    private handleRequest;
+    private json;
+}
+//# sourceMappingURL=server.d.ts.map

package/dist/api/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/api/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AACjF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGxD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAOhE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,aAAa,CAAC;IACxB,YAAY,EAAE,kBAAkB,CAAC;IACjC,aAAa,EAAE,aAAa,CAAC;IAC7B,oBAAoB,EAAE,oBAAoB,CAAC;IAC3C,QAAQ,EAAE,QAAQ,CAAC;IACnB,eAAe,EAAE,yBAAyB,CAAC;IAC3C,MAAM,EAAE,YAAY,CAAC;IACrB,wBAAwB;IACxB,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,yBAAyB;IACzB,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAyB;IAC9C,OAAO,CAAC,MAAM,CAA4B;IAC1C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoB;IAC9C,OAAO,CAAC,iBAAiB,CAAuC;IAChE,OAAO,CAAC,aAAa,CAAS;IAC9B,oEAAoE;IACpE,OAAO,CAAC,aAAa,CAAS;gBAElB,IAAI,EAAE,sBAAsB;IAKxC;;OAEG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAkBtB;;;OAGG;IACG,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAgC3D;;OAEG;IACH,IAAI,YAAY,IAAI,OAAO,CAE1B;YAMa,aAAa;IAmgB3B,OAAO,CAAC,IAAI;CAIb"}

package/dist/api/server.js

@@ -0,0 +1,596 @@
+/**
+ * Grillo Cricket — REST API Server
+ *
+ * Lightweight HTTP server exposing Grillo's fleet management API.
+ * Uses Node.js built-in http module (zero external dependencies).
+ *
+ * Endpoints map 1:1 to the spec in SPEC-GRILLO-CRICKET section 10:
+ *   /api/grillo/agents/*          — Agent management
+ *   /api/grillo/assess/*          — Assessment operations
+ *   /api/grillo/certifications/*  — Certification & compliance
+ *   /api/grillo/drift/*           — Drift detection
+ */
+import * as http from "node:http";
+import { AgentCategory, RiskTier } from "../registry/types.js";
+import { generateDashboardHTML } from "../dashboard/ui.js";
+export class GrilloAPIServer {
+    opts;
+    server = null;
+    startedAt = new Date();
+    activeConnections = new Set();
+    _shuttingDown = false;
+    /** Phase 7: Cached dashboard HTML (regenerated on config change) */
+    dashboardHTML;
+    constructor(opts) {
+        this.opts = opts;
+        this.dashboardHTML = generateDashboardHTML(opts.config);
+    }
+    /**
+     * Start the API server.
+     */
+    start() {
+        const port = this.opts.port ?? 18800;
+        const host = this.opts.host ?? "127.0.0.1";
+        return new Promise((resolve) => {
+            this.server = http.createServer((req, res) => {
+                // Track active connections for graceful shutdown
+                this.activeConnections.add(res);
+                res.on("close", () => this.activeConnections.delete(res));
+                this.handleRequest(req, res);
+            });
+            this.server.listen(port, host, () => {
+                console.log(`[grillo:api] Listening on http://${host}:${port}`);
+                resolve();
+            });
+        });
+    }
+    /**
+     * Graceful shutdown: stop accepting new connections,
+     * drain active connections, then close.
+     */
+    async stop(options) {
+        if (this._shuttingDown)
+            return;
+        this._shuttingDown = true;
+        const timeoutMs = options?.timeoutMs ?? 10000;
+        console.log(`[grillo:api] Shutting down gracefully (${timeoutMs}ms timeout, ` +
+            `${this.activeConnections.size} active connections)...`);
+        return new Promise((resolve) => {
+            // Force-resolve after timeout
+            const forceTimer = setTimeout(() => {
+                console.log("[grillo:api] Shutdown timeout reached, forcing close.");
+                this.server?.close();
+                resolve();
+            }, timeoutMs);
+            if (this.server) {
+                // Stop accepting new connections
+                this.server.close(() => {
+                    clearTimeout(forceTimer);
+                    console.log("[grillo:api] All connections drained. Shutdown complete.");
+                    resolve();
+                });
+            }
+            else {
+                clearTimeout(forceTimer);
+                resolve();
+            }
+        });
+    }
+    /**
+     * Whether the server is in shutdown mode.
+     */
+    get shuttingDown() {
+        return this._shuttingDown;
+    }
+    // ============================================================
+    // Request Router
+    // ============================================================
+    async handleRequest(req, res) {
+        const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
+        const method = req.method ?? "GET";
+        const pathname = url.pathname;
+        // CORS headers
+        res.setHeader("Access-Control-Allow-Origin", "*");
+        res.setHeader("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS");
+        res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
+        if (method === "OPTIONS") {
+            res.writeHead(204);
+            res.end();
+            return;
+        }
+        try {
+            // Reject new requests during shutdown
+            if (this._shuttingDown) {
+                res.setHeader("Connection", "close");
+                return this.json(res, 503, { error: "Server is shutting down" });
+            }
+            // ---- Phase 7: Dashboard Web UI ----
+            if (pathname === "/dashboard" || pathname === "/dashboard/") {
+                res.writeHead(200, {
+                    "Content-Type": "text/html; charset=utf-8",
+                    "Cache-Control": "no-cache",
+                });
+                res.end(this.dashboardHTML);
+                return;
+            }
+            // Dashboard data API — aggregated metrics
+            if (pathname === "/api/grillo/dashboard/overview" && method === "GET") {
+                if (!this.opts.dashboardMetrics) {
+                    return this.json(res, 501, { error: "Dashboard metrics not configured" });
+                }
+                const overview = this.opts.dashboardMetrics.getFleetOverview();
+                return this.json(res, 200, overview);
+            }
+            if (pathname === "/api/grillo/dashboard/hierarchy" && method === "GET") {
+                if (!this.opts.dashboardMetrics) {
+                    return this.json(res, 501, { error: "Dashboard metrics not configured" });
+                }
+                const hierarchy = this.opts.dashboardMetrics.getHierarchyOverview();
+                return this.json(res, 200, hierarchy);
+            }
+            if (pathname === "/api/grillo/dashboard/trends" && method === "GET") {
+                if (!this.opts.dashboardMetrics) {
+                    return this.json(res, 501, { error: "Dashboard metrics not configured" });
+                }
+                const days = Number(url.searchParams.get("days") ?? 30);
+                const trends = this.opts.dashboardMetrics.getFleetTrend(days);
+                return this.json(res, 200, trends);
+            }
+            const agentTrendMatch = pathname.match(/^\/api\/grillo\/dashboard\/agent\/([^/]+)$/);
+            if (agentTrendMatch && method === "GET") {
+                if (!this.opts.dashboardMetrics) {
+                    return this.json(res, 501, { error: "Dashboard metrics not configured" });
+                }
+                const agentId = agentTrendMatch[1];
+                const trend = this.opts.dashboardMetrics.getAgentTrend(agentId);
+                if (!trend)
+                    return this.json(res, 404, { error: `Agent not found: ${agentId}` });
+                return this.json(res, 200, trend);
+            }
+            // Health check (enhanced in Phase 4)
+            if (pathname === "/api/grillo/health") {
+                const uptimeMs = Date.now() - this.startedAt.getTime();
+                return this.json(res, 200, {
+                    status: "ok",
+                    version: "0.1.0",
+                    uptime: {
+                        ms: uptimeMs,
+                        human: formatUptime(uptimeMs),
+                    },
+                    services: {
+                        registry: { healthy: true, agents: this.opts.registry.size },
+                        auditLog: { healthy: true, entries: this.opts.auditLog.size },
+                        orchestrator: { healthy: true, running: this.opts.orchestrator.isRunning },
+                        monitor: {
+                            healthy: true,
+                            running: this.opts.continuousMonitor?.running ?? false,
+                        },
+                        discovery: {
+                            healthy: true,
+                            adapters: this.opts.discoveryService?.listAdapters().length ?? 0,
+                        },
+                        eventBus: {
+                            healthy: true,
+                            webhooks: this.opts.eventBus?.listWebhooks().length ?? 0,
+                        },
+                    },
+                    startedAt: this.startedAt.toISOString(),
+                    activeConnections: this.activeConnections.size,
+                });
+            }
+            // Readiness probe (Kubernetes-style)
+            if (pathname === "/api/grillo/ready") {
+                return this.json(res, 200, { ready: true });
+            }
+            // Liveness probe
+            if (pathname === "/api/grillo/live") {
+                return this.json(res, 200, { alive: true });
+            }
+            // ---- Discovery (Phase 4) ----
+            if (pathname === "/api/grillo/discover" && method === "POST") {
+                if (!this.opts.discoveryService) {
+                    return this.json(res, 501, { error: "Discovery service not configured" });
+                }
+                const result = await this.opts.discoveryService.discoverAndReconcile();
+                this.opts.eventBus?.emit("discovery:scan_completed", {
+                    source: "api",
+                    newAgents: result.registered.length,
+                    existingAgents: result.existing.length,
+                    orphanedAgents: result.orphaned.length,
+                    durationMs: result.durationMs,
+                });
+                return this.json(res, 200, result);
+            }
+            if (pathname === "/api/grillo/discover/health" && method === "GET") {
+                if (!this.opts.discoveryService) {
+                    return this.json(res, 501, { error: "Discovery service not configured" });
+                }
+                const health = await this.opts.discoveryService.healthCheck();
+                return this.json(res, 200, { adapters: health });
+            }
+            // ---- Events (Phase 4) ----
+            if (pathname === "/api/grillo/events" && method === "GET") {
+                if (!this.opts.eventBus) {
+                    return this.json(res, 501, { error: "Event bus not configured" });
+                }
+                const limitParam = url.searchParams.get("limit");
+                const eventFilter = url.searchParams.get("event");
+                const limit = limitParam ? parseInt(limitParam, 10) : 50;
+                const history = this.opts.eventBus.history({
+                    event: eventFilter,
+                    limit,
+                });
+                return this.json(res, 200, { events: history, total: history.length });
+            }
+            if (pathname === "/api/grillo/events/webhooks" && method === "GET") {
+                if (!this.opts.eventBus) {
+                    return this.json(res, 501, { error: "Event bus not configured" });
+                }
+                return this.json(res, 200, { webhooks: this.opts.eventBus.listWebhooks() });
+            }
+            if (pathname === "/api/grillo/events/webhooks" && method === "POST") {
+                if (!this.opts.eventBus) {
+                    return this.json(res, 501, { error: "Event bus not configured" });
+                }
+                const body = await readBody(req);
+                const webhookUrl = String(body.url ?? "");
+                const events = body.events ?? ["*"];
+                if (!webhookUrl) {
+                    return this.json(res, 400, { error: "Missing url" });
+                }
+                this.opts.eventBus.registerWebhook(webhookUrl, events);
+                return this.json(res, 201, { registered: true, url: webhookUrl, events });
+            }
+            // ---- Agent Management ----
+            if (pathname === "/api/grillo/agents" && method === "GET") {
+                return this.json(res, 200, {
+                    agents: this.opts.registry.all(),
+                    total: this.opts.registry.size,
+                });
+            }
+            if (pathname === "/api/grillo/agents/register" && method === "POST") {
+                const body = await readBody(req);
+                const agent = this.opts.registry.register({
+                    agentId: String(body.agentId ?? ""),
+                    agentName: String(body.agentName ?? body.agentId ?? ""),
+                    agentType: String(body.agentType ?? "agent"),
+                    category: body.category ?? AgentCategory.INTERNAL_UTILITY,
+                    provider: String(body.provider ?? ""),
+                    model: String(body.model ?? ""),
+                    riskTier: body.riskTier ?? RiskTier.MEDIUM,
+                    tags: Array.isArray(body.tags) ? body.tags : [],
+                    metadata: body.metadata ?? {},
+                });
+                this.opts.auditLog.append({
+                    action: "agent_registered",
+                    actor: "api",
+                    agentId: agent.agentId,
+                    description: `Agent ${agent.agentName} registered via API`,
+                });
+                return this.json(res, 201, agent);
+            }
+            if (pathname === "/api/grillo/agents/discover" && method === "POST") {
+                return this.json(res, 200, {
+                    message: "Discovery scan complete",
+                    registeredAgents: this.opts.registry.size,
+                    note: "Full auto-discovery integration coming in Phase 3",
+                });
+            }
+            // Agent by ID routes
+            const agentMatch = pathname.match(/^\/api\/grillo\/agents\/([^/]+)$/);
+            if (agentMatch) {
+                const agentId = agentMatch[1];
+                if (method === "GET") {
+                    const agent = this.opts.registry.get(agentId);
+                    if (!agent)
+                        return this.json(res, 404, { error: `Agent not found: ${agentId}` });
+                    return this.json(res, 200, agent);
+                }
+                if (method === "DELETE") {
+                    const removed = this.opts.registry.deregister(agentId);
+                    if (!removed)
+                        return this.json(res, 404, { error: `Agent not found: ${agentId}` });
+                    this.opts.auditLog.append({
+                        action: "agent_deregistered",
+                        actor: "api",
+                        agentId,
+                        description: `Agent ${agentId} deregistered via API`,
+                    });
+                    return this.json(res, 200, { message: `Agent ${agentId} deregistered` });
+                }
+            }
+            // Agent category update
+            const categoryMatch = pathname.match(/^\/api\/grillo\/agents\/([^/]+)\/category$/);
+            if (categoryMatch && method === "PUT") {
+                const agentId = categoryMatch[1];
+                const agent = this.opts.registry.get(agentId);
+                if (!agent)
+                    return this.json(res, 404, { error: `Agent not found: ${agentId}` });
+                const body = await readBody(req);
+                // Re-register with new category
+                this.opts.registry.register({
+                    agentId,
+                    agentName: agent.agentName,
+                    agentType: agent.agentType,
+                    category: body.category,
+                    provider: agent.provider,
+                    model: agent.model,
+                    riskTier: body.riskTier ?? agent.riskTier,
+                });
+                return this.json(res, 200, this.opts.registry.get(agentId));
+            }
+            // ---- Assessment Operations ----
+            const assessMatch = pathname.match(/^\/api\/grillo\/assess\/([^/]+)$/);
+            if (assessMatch && method === "POST") {
+                const target = assessMatch[1];
+                if (target === "fleet") {
+                    const body = await readBody(req);
+                    const result = await this.opts.orchestrator.assessFleet({
+                        dryRun: body.dryRun === true,
+                    });
+                    return this.json(res, 200, result);
+                }
+                const agent = this.opts.registry.get(target);
+                if (!agent)
+                    return this.json(res, 404, { error: `Agent not found: ${target}` });
+                const body = await readBody(req);
+                const result = await this.opts.orchestrator.assessAgent(agent, {
+                    framework: body.framework ? String(body.framework) : undefined,
+                    dryRun: body.dryRun === true,
+                });
+                return this.json(res, 200, result);
+            }
+            // ---- Assessment Bypass (Phase 6) ----
+            const bypassMatch = pathname.match(/^\/api\/grillo\/assess\/([^/]+)\/bypass$/);
+            if (bypassMatch && method === "POST") {
+                const agentId = bypassMatch[1];
+                const agent = this.opts.registry.get(agentId);
+                if (!agent)
+                    return this.json(res, 404, { error: `Agent not found: ${agentId}` });
+                const body = await readBody(req);
+                const reason = String(body.reason ?? "");
+                const authorizedBy = String(body.authorizedBy ?? "");
+                const expiresInDays = Number(body.expiresInDays ?? 30);
+                if (!reason || !authorizedBy) {
+                    return this.json(res, 400, {
+                        error: "Both 'reason' and 'authorizedBy' are required for bypass authorization",
+                    });
+                }
+                // Grant bypass certification
+                const now = new Date();
+                const expiresAt = new Date(now.getTime() + expiresInDays * 24 * 60 * 60 * 1000);
+                const bypassRecord = {
+                    runId: `bypass-${Date.now()}-${agentId}`,
+                    framework: "bypass",
+                    level: 0,
+                    scores: {},
+                    passed: true,
+                    classification: "BYPASS — Manual Authorization",
+                    assessedAt: now,
+                    expiresAt,
+                    verifyUrl: "",
+                    metadata: {
+                        bypass: true,
+                        reason,
+                        authorizedBy,
+                        expiresInDays,
+                    },
+                };
+                this.opts.registry.recordAssessment(agentId, bypassRecord);
+                // Force status to CERTIFIED (bypass overrides PROBATION gate)
+                const { CertificationStatus } = await import("../registry/types.js");
+                this.opts.registry.updateStatus(agentId, CertificationStatus.CERTIFIED);
+                this.opts.auditLog.append({
+                    action: "bypass_requested",
+                    actor: authorizedBy,
+                    agentId,
+                    description: `Assessment bypass granted for ${agent.agentName}. Reason: ${reason}. Expires: ${expiresAt.toISOString()}`,
+                    data: { reason, authorizedBy, expiresInDays, expiresAt: expiresAt.toISOString() },
+                });
+                this.opts.eventBus?.emit("assessment:bypass_granted", {
+                    agentId,
+                    agentName: agent.agentName,
+                    reason,
+                    authorizedBy,
+                    expiresAt: expiresAt.toISOString(),
+                });
+                return this.json(res, 200, {
+                    message: `Bypass granted for ${agent.agentName}`,
+                    agentId,
+                    status: "certified",
+                    bypassRecord,
+                    expiresAt: expiresAt.toISOString(),
+                });
+            }
+            const assessStatusMatch = pathname.match(/^\/api\/grillo\/assess\/([^/]+)\/status$/);
+            if (assessStatusMatch && method === "GET") {
+                const agentId = assessStatusMatch[1];
+                const agent = this.opts.registry.get(agentId);
+                if (!agent)
+                    return this.json(res, 404, { error: `Agent not found: ${agentId}` });
+                return this.json(res, 200, {
+                    agentId: agent.agentId,
+                    certificationStatus: agent.certificationStatus,
+                    lastAssessedAt: agent.lastAssessedAt,
+                    nextAssessmentDue: agent.nextAssessmentDue,
+                });
+            }
+            const assessHistoryMatch = pathname.match(/^\/api\/grillo\/assess\/([^/]+)\/history$/);
+            if (assessHistoryMatch && method === "GET") {
+                const agentId = assessHistoryMatch[1];
+                const agent = this.opts.registry.get(agentId);
+                if (!agent)
+                    return this.json(res, 404, { error: `Agent not found: ${agentId}` });
+                return this.json(res, 200, {
+                    agentId: agent.agentId,
+                    history: agent.certificationHistory,
+                });
+            }
+            if (pathname === "/api/grillo/assess/queue" && method === "GET") {
+                const { buildAssessmentQueue } = await import("../orchestration/queue.js");
+                const queue = buildAssessmentQueue(this.opts.registry.all(), this.opts.config);
+                return this.json(res, 200, { queue: queue.map((q) => ({
+                        agentId: q.agent.agentId,
+                        agentName: q.agent.agentName,
+                        priority: q.priority,
+                        reason: q.reason,
+                        framework: q.framework,
+                        level: q.level,
+                    })) });
+            }
+            // ---- Certifications & Compliance ----
+            if (pathname === "/api/grillo/certifications" && method === "GET") {
+                return this.json(res, 200, this.opts.registry.summary());
+            }
+            const certMatch = pathname.match(/^\/api\/grillo\/certifications\/([^/]+)$/);
+            if (certMatch && method === "GET") {
+                const agentId = certMatch[1];
+                const agent = this.opts.registry.get(agentId);
+                if (!agent)
+                    return this.json(res, 404, { error: `Agent not found: ${agentId}` });
+                const lastCert = agent.certificationHistory[agent.certificationHistory.length - 1];
+                return this.json(res, 200, {
+                    agentId: agent.agentId,
+                    status: agent.certificationStatus,
+                    hierarchicalProgress: agent.hierarchicalProgress,
+                    latestCertification: lastCert ?? null,
+                    totalAssessments: agent.certificationHistory.length,
+                });
+            }
+            const suspendMatch = pathname.match(/^\/api\/grillo\/certifications\/([^/]+)\/suspend$/);
+            if (suspendMatch && method === "POST") {
+                const agentId = suspendMatch[1];
+                try {
+                    const agent = this.opts.registry.updateStatus(agentId, "suspended");
+                    this.opts.auditLog.append({
+                        action: "certification_revoked",
+                        actor: "api",
+                        agentId,
+                        description: `Agent ${agentId} suspended via API`,
+                    });
+                    return this.json(res, 200, agent);
+                }
+                catch {
+                    return this.json(res, 404, { error: `Agent not found: ${agentId}` });
+                }
+            }
+            const reinstateMatch = pathname.match(/^\/api\/grillo\/certifications\/([^/]+)\/reinstate$/);
+            if (reinstateMatch && method === "POST") {
+                const agentId = reinstateMatch[1];
+                try {
+                    const agent = this.opts.registry.updateStatus(agentId, "expired");
+                    this.opts.auditLog.append({
+                        action: "agent_reinstated",
+                        actor: "api",
+                        agentId,
+                        description: `Agent ${agentId} reinstated via API`,
+                    });
+                    return this.json(res, 200, agent);
+                }
+                catch {
+                    return this.json(res, 404, { error: `Agent not found: ${agentId}` });
+                }
+            }
+            if (pathname === "/api/grillo/compliance/report" && method === "GET") {
+                const format = url.searchParams.get("format") ?? "json";
+                const period = url.searchParams.get("period") ?? "30d";
+                const report = this.opts.reportGenerator.generate({ format, period });
+                if (format === "json") {
+                    return this.json(res, 200, JSON.parse(report));
+                }
+                res.writeHead(200, { "Content-Type": format === "csv" ? "text/csv" : "text/markdown" });
+                res.end(report);
+                return;
+            }
+            // ---- Drift ----
+            const driftAgentMatch = pathname.match(/^\/api\/grillo\/drift\/([^/]+)$/);
+            if (driftAgentMatch && method === "GET") {
+                const target = driftAgentMatch[1];
+                if (target === "fleet") {
+                    const agents = this.opts.registry.all().filter((a) => a.driftBaseline !== null);
+                    const reports = agents.map((a) => {
+                        const lastCert = a.certificationHistory[a.certificationHistory.length - 1];
+                        return this.opts.driftDetector.analyze(a, lastCert?.scores ?? {});
+                    });
+                    const anomalies = this.opts.fleetAnomalyDetector.analyze(reports, agents);
+                    return this.json(res, 200, { reports, anomalies });
+                }
+                const agent = this.opts.registry.get(target);
+                if (!agent)
+                    return this.json(res, 404, { error: `Agent not found: ${target}` });
+                if (!agent.driftBaseline)
+                    return this.json(res, 200, { message: "No baseline established" });
+                const lastCert = agent.certificationHistory[agent.certificationHistory.length - 1];
+                const report = this.opts.driftDetector.analyze(agent, lastCert?.scores ?? {});
+                return this.json(res, 200, report);
+            }
+            // ---- Audit ----
+            if (pathname === "/api/grillo/audit" && method === "GET") {
+                const agentId = url.searchParams.get("agentId");
+                const entries = agentId
+                    ? this.opts.auditLog.forAgent(agentId)
+                    : this.opts.auditLog.recent(100);
+                const verification = this.opts.auditLog.verifyChain();
+                return this.json(res, 200, { entries, verification });
+            }
+            // ---- 404 ----
+            return this.json(res, 404, {
+                error: "Not Found",
+                path: pathname,
+                method,
+            });
+        }
+        catch (error) {
+            console.error("[grillo:api] Error:", error);
+            return this.json(res, 500, {
+                error: "Internal Server Error",
+                message: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+    // ============================================================
+    // Helpers
+    // ============================================================
+    json(res, status, data) {
+        res.writeHead(status, { "Content-Type": "application/json" });
+        res.end(JSON.stringify(data, dateReplacer, 2));
+    }
+}
+// ================================================================
+// Utilities
+// ================================================================
+function readBody(req) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        req.on("data", (chunk) => chunks.push(chunk));
+        req.on("end", () => {
+            try {
+                const raw = Buffer.concat(chunks).toString("utf-8");
+                resolve(raw ? JSON.parse(raw) : {});
+            }
+            catch {
+                resolve({});
+            }
+        });
+        req.on("error", reject);
+    });
+}
+function dateReplacer(_key, value) {
+    if (value instanceof Date)
+        return value.toISOString();
+    return value;
+}
+function formatUptime(ms) {
+    const seconds = Math.floor(ms / 1000);
+    const minutes = Math.floor(seconds / 60);
+    const hours = Math.floor(minutes / 60);
+    const days = Math.floor(hours / 24);
+    if (days > 0)
+        return `${days}d ${hours % 24}h ${minutes % 60}m`;
+    if (hours > 0)
+        return `${hours}h ${minutes % 60}m ${seconds % 60}s`;
+    if (minutes > 0)
+        return `${minutes}m ${seconds % 60}s`;
+    return `${seconds}s`;
+}
+//# sourceMappingURL=server.js.map