@complior/engine 0.9.0

package/src/http/routes/events.route.ts

@@ -0,0 +1,71 @@
+import { Hono } from 'hono';
+import { streamSSE } from 'hono/streaming';
+import type { EventBusPort, EventHandler, EventMap } from '../../ports/events.port.js';
+
+export interface EventsRouteDeps {
+  readonly events: EventBusPort;
+}
+
+const FORWARDED_EVENTS: readonly (keyof EventMap)[] = [
+  'scan.completed',
+  'scan.started',
+  'scan.drift',
+  'score.updated',
+  'file.changed',
+  'gate.checked',
+  'fix.validated',
+  'fix.undone',
+  'agent.scan.completed',
+  'agent.score.updated',
+  'badge.generated',
+  'share.created',
+  'external-scan.completed',
+  'report.generated',
+];
+
+/** Subscribe to a typed event and forward its payload as SSE JSON. */
+const subscribeEvent = <K extends keyof EventMap>(
+  events: EventBusPort,
+  eventName: K,
+  write: (event: string, data: string) => void,
+): EventHandler<EventMap[K]> => {
+  const handler: EventHandler<EventMap[K]> = (payload) => {
+    write(eventName, JSON.stringify(payload));
+  };
+  events.on(eventName, handler);
+  return handler;
+};
+
+export const createEventsRoute = (deps: EventsRouteDeps) => {
+  const app = new Hono();
+
+  app.get('/events', (c) => {
+    return streamSSE(c, async (stream) => {
+      const handlers: Array<{ event: keyof EventMap; handler: EventHandler<EventMap[keyof EventMap]> }> = [];
+
+      const write = (event: string, data: string): void => {
+        stream.writeSSE({ event, data }).catch(() => {});
+      };
+
+      for (const eventName of FORWARDED_EVENTS) {
+        const handler = subscribeEvent(deps.events, eventName, write);
+        handlers.push({ event: eventName, handler });
+      }
+
+      // Keep alive — send comment ping every 30s
+      try {
+        while (true) {
+          await stream.writeSSE({ event: 'ping', data: '' });
+          await stream.sleep(30_000);
+        }
+      } finally {
+        // Cleanup listeners on disconnect
+        for (const { event, handler } of handlers) {
+          deps.events.off(event, handler);
+        }
+      }
+    });
+  });
+
+  return app;
+};

package/src/http/routes/external-scan.route.ts

@@ -0,0 +1,24 @@
+import { Hono } from 'hono';
+import { z } from 'zod';
+import type { ExternalScanService } from '../../services/external-scan-service.js';
+import { parseBody } from '../utils/validation.js';
+
+const ExternalScanSchema = z.object({
+  url: z.string().url(),
+  level: z.enum(['L1', 'L2', 'L3']).optional(),
+  timeout: z.number().int().min(5000).max(300000).optional(),
+});
+
+export const createExternalScanRoute = (getExternalScanService: () => Promise<ExternalScanService>) => {
+  const app = new Hono();
+
+  app.post('/scan-url', async (c) => {
+    const data = await parseBody(c, ExternalScanSchema);
+
+    const externalScanService = await getExternalScanService();
+    const result = await externalScanService.scan(data);
+    return c.json(result);
+  });
+
+  return app;
+};

package/src/http/routes/file.route.ts

@@ -0,0 +1,54 @@
+import { Hono } from 'hono';
+import { z } from 'zod';
+import type { FileService } from '../../services/file-service.js';
+import { parseBody, requireQuery } from '../utils/validation.js';
+
+const CreateFileSchema = z.object({
+  path: z.string().min(1),
+  content: z.string(),
+});
+
+const EditFileSchema = z.object({
+  path: z.string().min(1),
+  oldContent: z.string(),
+  newContent: z.string(),
+});
+
+const ReadFileSchema = z.object({
+  path: z.string().min(1),
+});
+
+export const createFileRoute = (fileService: FileService) => {
+  const app = new Hono();
+
+  app.post('/file/create', async (c) => {
+    const data = await parseBody(c, CreateFileSchema);
+
+    await fileService.create(data.path, data.content);
+    return c.json({ success: true, path: data.path });
+  });
+
+  app.post('/file/edit', async (c) => {
+    const data = await parseBody(c, EditFileSchema);
+
+    await fileService.edit(data.path, data.oldContent, data.newContent);
+    return c.json({ success: true, path: data.path });
+  });
+
+  app.post('/file/read', async (c) => {
+    const data = await parseBody(c, ReadFileSchema);
+
+    const content = await fileService.read(data.path);
+    return c.json({ content, path: data.path });
+  });
+
+  app.get('/file/list', async (c) => {
+    const path = requireQuery(c, 'path');
+    const pattern = c.req.query('pattern');
+
+    const files = await fileService.list(path, pattern);
+    return c.json({ files, count: files.length });
+  });
+
+  return app;
+};

package/src/http/routes/fix.route.ts

@@ -0,0 +1,219 @@
+import { Hono } from 'hono';
+import { streamSSE } from 'hono/streaming';
+import { z } from 'zod';
+import type { FixService } from '../../services/fix-service.js';
+import type { UndoService } from '../../services/undo-service.js';
+import { parseBody } from '../utils/validation.js';
+
+const FixApplySchema = z.object({
+  checkId: z.string().min(1),
+  obligationId: z.string().optional(),
+  useAi: z.boolean().optional(),
+});
+
+const FixApplyAllSchema = z.object({
+  useAi: z.boolean().optional(),
+  projectPath: z.string().optional(),
+});
+
+const FixUndoSchema = z.object({
+  id: z.number().optional(),
+});
+
+export interface FixRouteDeps {
+  readonly fixService: FixService;
+  readonly undoService: UndoService;
+}
+
+export const createFixRoute = (deps: FixRouteDeps) => {
+  const { fixService, undoService } = deps;
+  const app = new Hono();
+
+  // Preview all available fixes
+  app.get('/fix/preview', (c) => {
+    const plans = fixService.previewAll();
+    return c.json({ fixes: plans, count: plans.length });
+  });
+
+  // Preview fix for a specific finding
+  app.post('/fix/preview', async (c) => {
+    const data = await parseBody(c, FixApplySchema);
+
+    // Build a minimal finding to preview
+    const plan = fixService.preview({
+      checkId: data.checkId,
+      type: 'fail',
+      message: '',
+      severity: 'high',
+      obligationId: data.obligationId,
+    });
+
+    if (!plan) {
+      return c.json({ error: 'NO_FIX', message: 'No auto-fix available for this finding', recommendation: 'Review and enrich document sections manually, or use --ai flag' }, 404);
+    }
+
+    return c.json(plan);
+  });
+
+  // Apply a specific fix
+  app.post('/fix/apply', async (c) => {
+    const data = await parseBody(c, FixApplySchema);
+
+    const plan = fixService.preview({
+      checkId: data.checkId,
+      type: 'fail',
+      message: '',
+      severity: 'high',
+      obligationId: data.obligationId,
+    });
+
+    if (!plan) {
+      return c.json({ error: 'NO_FIX', message: 'No auto-fix available for this finding', recommendation: 'Review and enrich document sections manually, or use --ai flag' }, 404);
+    }
+
+    const result = await fixService.applyFix(plan, data.useAi);
+    return c.json(result);
+  });
+
+  // Apply a fix and validate the result
+  app.post('/fix/apply-and-validate', async (c) => {
+    const data = await parseBody(c, FixApplySchema);
+
+    const plan = fixService.preview({
+      checkId: data.checkId,
+      type: 'fail',
+      message: '',
+      severity: 'high',
+      obligationId: data.obligationId,
+    });
+
+    if (!plan) {
+      return c.json({ error: 'NO_FIX', message: 'No auto-fix available for this finding', recommendation: 'Review and enrich document sections manually, or use --ai flag' }, 404);
+    }
+
+    const result = await fixService.applyAndValidate(plan, data.useAi);
+    return c.json({ result, validation: result.validation });
+  });
+
+  // Apply all available fixes (batch mode)
+  app.post('/fix/apply-all', async (c) => {
+    const data = await parseBody(c, FixApplyAllSchema);
+    const useAi = data.useAi ?? false;
+    const results = await fixService.applyAll(useAi, data.projectPath);
+    const applied = results.filter((r) => r.applied).length;
+    const failed = results.filter((r) => !r.applied).length;
+    const currentScore = fixService.getCurrentScore();
+    const scoreBefore = results[0]?.scoreBefore ?? currentScore;
+    const scoreAfter = results.at(-1)?.scoreAfter ?? currentScore;
+
+    const unfixedFindings = fixService.getUnfixedFindings();
+
+    return c.json({
+      results,
+      summary: { total: results.length, applied, failed, scoreBefore, scoreAfter },
+      unfixedFindings: unfixedFindings.map((f) => ({
+        checkId: f.checkId,
+        message: f.message,
+        severity: f.severity,
+        fix: f.fix,
+      })),
+    });
+  });
+
+  // Apply all fixes with SSE streaming progress
+  app.post('/fix/apply-all/stream', async (c) => {
+    const data = await parseBody(c, FixApplyAllSchema);
+    const useAi = data.useAi ?? false;
+
+    return streamSSE(c, async (stream) => {
+      try {
+        const plans = fixService.previewAll();
+        const currentScore = fixService.getCurrentScore();
+
+        // Emit start event
+        await stream.writeSSE({
+          event: 'fix:start',
+          data: JSON.stringify({ total: plans.length, useAi, scoreBefore: currentScore }),
+        });
+
+        // Apply fixes with progress callback
+        let index = 0;
+        const onProgress = async (event: {
+          type: 'applying' | 'applied' | 'failed';
+          checkId: string;
+          path: string;
+          action?: string;
+          scoreAfter?: number;
+          error?: string;
+        }): Promise<void> => {
+          if (event.type === 'applying') {
+            await stream.writeSSE({
+              event: 'fix:progress',
+              data: JSON.stringify({
+                index, checkId: event.checkId, path: event.path,
+                action: event.action ?? 'MODIFY', status: 'applying',
+              }),
+            });
+          } else if (event.type === 'applied') {
+            await stream.writeSSE({
+              event: 'fix:applied',
+              data: JSON.stringify({
+                index, checkId: event.checkId, path: event.path,
+                scoreAfter: event.scoreAfter,
+              }),
+            });
+            index++;
+          } else {
+            await stream.writeSSE({
+              event: 'fix:failed',
+              data: JSON.stringify({ index, checkId: event.checkId, error: event.error }),
+            });
+            index++;
+          }
+        };
+
+        const results = await fixService.applyAll(useAi, data.projectPath, onProgress);
+        const applied = results.filter((r) => r.applied).length;
+        const failed = results.filter((r) => !r.applied).length;
+        const scoreBefore = results[0]?.scoreBefore ?? currentScore;
+        const scoreAfter = results.at(-1)?.scoreAfter ?? currentScore;
+
+        const unfixedFindings = fixService.getUnfixedFindings();
+
+        await stream.writeSSE({
+          event: 'fix:done',
+          data: JSON.stringify({
+            summary: { total: results.length, applied, failed, scoreBefore, scoreAfter },
+            unfixedFindings: unfixedFindings.map((f) => ({
+              checkId: f.checkId, message: f.message, severity: f.severity, fix: f.fix,
+            })),
+          }),
+        });
+      } catch (err) {
+        await stream.writeSSE({
+          event: 'fix:error',
+          data: JSON.stringify({ error: err instanceof Error ? err.message : String(err) }),
+        });
+      }
+    });
+  });
+
+  // Undo a fix (last or by id)
+  app.post('/fix/undo', async (c) => {
+    const data = await parseBody(c, FixUndoSchema);
+
+    const validation = data.id != null
+      ? await undoService.undoById(data.id)
+      : await undoService.undoLast();
+
+    return c.json({ validation });
+  });
+
+  // Get fix history
+  app.get('/fix/history', async (c) => {
+    const history = await undoService.getHistory();
+    return c.json(history);
+  });
+
+  return app;
+};

package/src/http/routes/frameworks.route.test.ts

@@ -0,0 +1,66 @@
+import { describe, it, expect } from 'vitest';
+import { createFrameworksRoute } from './frameworks.route.js';
+import type { FrameworkService } from '../../services/framework-service.js';
+import type { MultiFrameworkScoreResult, FrameworkScoreResult } from '../../types/framework.types.js';
+
+const mockScore: FrameworkScoreResult = {
+  frameworkId: 'test-fw',
+  frameworkName: 'Test Framework',
+  score: 75,
+  grade: 'B',
+  gradeType: 'letter',
+  gaps: 3,
+  totalChecks: 12,
+  passedChecks: 9,
+  categories: [],
+};
+
+const mockMulti: MultiFrameworkScoreResult = {
+  frameworks: [mockScore],
+  selectedFrameworkIds: ['test-fw'],
+  computedAt: new Date().toISOString(),
+};
+
+const mockService: FrameworkService = {
+  getScores: async () => mockMulti,
+  getScore: async (id: string) => (id === 'test-fw' ? mockScore : null),
+  listAvailable: () => ['test-fw', 'other-fw'],
+  listSelected: () => ['test-fw'],
+};
+
+describe('frameworks.route', () => {
+  const app = createFrameworksRoute({ frameworkService: mockService });
+
+  it('GET /frameworks returns available and selected', async () => {
+    const res = await app.request('/frameworks');
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.available).toEqual(['test-fw', 'other-fw']);
+    expect(body.selected).toEqual(['test-fw']);
+  });
+
+  it('GET /frameworks/scores returns multi-framework result', async () => {
+    const res = await app.request('/frameworks/scores');
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.frameworks).toHaveLength(1);
+    expect(body.frameworks[0].frameworkId).toBe('test-fw');
+    expect(body.frameworks[0].score).toBe(75);
+    expect(body.selectedFrameworkIds).toEqual(['test-fw']);
+  });
+
+  it('GET /frameworks/scores/:id returns single framework', async () => {
+    const res = await app.request('/frameworks/scores/test-fw');
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.frameworkId).toBe('test-fw');
+    expect(body.grade).toBe('B');
+  });
+
+  it('GET /frameworks/scores/:id returns 404 for unknown', async () => {
+    const res = await app.request('/frameworks/scores/nonexistent');
+    expect(res.status).toBe(404);
+    const body = await res.json();
+    expect(body.error).toBe('NOT_FOUND');
+  });
+});

package/src/http/routes/frameworks.route.ts

@@ -0,0 +1,36 @@
+import { Hono } from 'hono';
+import type { FrameworkService } from '../../services/framework-service.js';
+
+interface FrameworksRouteDeps {
+  readonly frameworkService: FrameworkService;
+}
+
+export const createFrameworksRoute = (deps: FrameworksRouteDeps) => {
+  const app = new Hono();
+
+  // GET /frameworks — list available and selected frameworks
+  app.get('/frameworks', (c) => {
+    return c.json({
+      available: deps.frameworkService.listAvailable(),
+      selected: deps.frameworkService.listSelected(),
+    });
+  });
+
+  // GET /frameworks/scores — all selected framework scores
+  app.get('/frameworks/scores', async (c) => {
+    const result = await deps.frameworkService.getScores();
+    return c.json(result);
+  });
+
+  // GET /frameworks/scores/:id — single framework score
+  app.get('/frameworks/scores/:id', async (c) => {
+    const id = c.req.param('id');
+    const result = await deps.frameworkService.getScore(id);
+    if (!result) {
+      return c.json({ error: 'NOT_FOUND', message: `Framework '${id}' not found` }, 404);
+    }
+    return c.json(result);
+  });
+
+  return app;
+};

package/src/http/routes/git.route.ts

@@ -0,0 +1,27 @@
+import { Hono } from 'hono';
+import { z } from 'zod';
+import { gitOperation } from '../../infra/git-adapter.js';
+import { parseBody } from '../utils/validation.js';
+
+const GitRequestSchema = z.object({
+  action: z.enum(['status', 'diff', 'log', 'add', 'commit', 'branch']),
+  args: z.record(z.unknown()).optional(),
+  cwd: z.string().optional(),
+});
+
+export const createGitRoute = () => {
+  const app = new Hono();
+
+  app.post('/git', async (c) => {
+    const data = await parseBody(c, GitRequestSchema);
+
+    const result = await gitOperation(
+      data.action,
+      data.args,
+      data.cwd,
+    );
+    return c.json(result);
+  });
+
+  return app;
+};

package/src/http/routes/guided-onboarding.route.ts

@@ -0,0 +1,65 @@
+import { Hono } from 'hono';
+import { ValidationError } from '../../types/errors.js';
+import type { OnboardingService } from '../../services/onboarding-service.js';
+import { TOTAL_STEPS } from '../../domain/onboarding/guided-onboarding.js';
+
+export interface GuidedOnboardingDeps {
+  readonly onboardingService: OnboardingService;
+}
+
+const toProgress = (status: { steps: readonly { status: string }[]; totalSteps: number }) => {
+  const completedSteps = status.steps.filter(
+    (s) => s.status === 'completed' || s.status === 'skipped',
+  ).length;
+  return {
+    completedSteps,
+    totalSteps: status.totalSteps,
+    percentage: Math.round((completedSteps / status.totalSteps) * 100),
+  };
+};
+
+export const createGuidedOnboardingRoute = (deps: GuidedOnboardingDeps) => {
+  const app = new Hono();
+
+  // POST /onboarding/guided/start — start or resume guided onboarding
+  app.post('/onboarding/guided/start', async (c) => {
+    const status = await deps.onboardingService.start();
+    return c.json({ state: status, progress: toProgress(status) });
+  });
+
+  // GET /onboarding/guided/status — get current state
+  app.get('/onboarding/guided/status', async (c) => {
+    const status = await deps.onboardingService.getStatus();
+    return c.json({ state: status, progress: toProgress(status) });
+  });
+
+  // POST /onboarding/guided/step/:n — execute step n
+  app.post('/onboarding/guided/step/:n', async (c) => {
+    const stepNum = parseInt(c.req.param('n'), 10);
+    if (isNaN(stepNum) || stepNum < 1 || stepNum > TOTAL_STEPS) {
+      throw new ValidationError(`Step must be between 1 and ${TOTAL_STEPS}`);
+    }
+
+    const result = await deps.onboardingService.advanceStep(stepNum);
+
+    if (!result.success) {
+      throw new ValidationError(result.message);
+    }
+
+    const status = await deps.onboardingService.getStatus();
+    return c.json({
+      step: result.step,
+      data: result.data,
+      state: status,
+      progress: toProgress(status),
+    });
+  });
+
+  // POST /onboarding/guided/reset — reset onboarding progress
+  app.post('/onboarding/guided/reset', async (c) => {
+    const status = await deps.onboardingService.reset();
+    return c.json({ state: status, progress: { completedSteps: 0, totalSteps: status.totalSteps, percentage: 0 } });
+  });
+
+  return app;
+};

package/src/http/routes/import.route.ts

@@ -0,0 +1,64 @@
+/**
+ * Import route — handles external tool result imports.
+ * Currently supports: Promptfoo red-team JSON.
+ */
+
+import { Hono } from 'hono';
+import { writeFile, mkdir } from 'node:fs/promises';
+import { resolve } from 'node:path';
+import { importFromPromptfoo } from '../../domain/import/promptfoo-importer.js';
+import { createEvidence } from '../../domain/scanner/evidence.js';
+import type { EvidenceStore } from '../../domain/scanner/evidence-store.js';
+
+export interface ImportRouteDeps {
+  readonly evidenceStore?: EvidenceStore;
+  readonly getProjectPath: () => string;
+}
+
+export const createImportRoute = (deps: ImportRouteDeps) => {
+  const app = new Hono();
+
+  /**
+   * POST /import/promptfoo
+   * Body: Promptfoo JSON output (redteam results)
+   * Returns: PromptfooImportResult with security score
+   */
+  app.post('/import/promptfoo', async (c) => {
+    const body = await c.req.json();
+
+    let result;
+    try {
+      result = importFromPromptfoo(body);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      if (message.startsWith('VALIDATION_ERROR:')) {
+        return c.json({ error: 'VALIDATION_ERROR', message }, 400);
+      }
+      return c.json({ error: 'IMPORT_ERROR', message }, 500);
+    }
+
+    // Save import result
+    const projectPath = deps.getProjectPath();
+    const importsDir = resolve(projectPath, '.complior', 'imports');
+    await mkdir(importsDir, { recursive: true });
+    const filename = `promptfoo-${new Date().toISOString().replace(/[:.]/g, '-')}.json`;
+    await writeFile(resolve(importsDir, filename), JSON.stringify(result, null, 2));
+
+    // Record evidence
+    if (deps.evidenceStore) {
+      const evidence = [
+        createEvidence(
+          `promptfoo-import-${result.timestamp}`,
+          'security',
+          'security-import',
+          { snippet: `Imported ${result.probesRun} probes: score=${result.securityScore.score} grade=${result.securityScore.grade}` },
+        ),
+      ];
+      deps.evidenceStore.append(evidence, `import-${result.timestamp}`).catch(() => {});
+    }
+
+    return c.json(result);
+  });
+
+  return app;
+};

package/src/http/routes/jurisdiction.route.ts

@@ -0,0 +1,22 @@
+import { Hono } from 'hono';
+import { listJurisdictions, getJurisdiction } from '../../data/regulation/jurisdiction-data.js';
+import { NotFoundError } from '../../types/errors.js';
+
+export const createJurisdictionRoute = () => {
+  const app = new Hono();
+
+  app.get('/jurisdictions', (c) => {
+    return c.json({ jurisdictions: listJurisdictions() });
+  });
+
+  app.get('/jurisdictions/:code', (c) => {
+    const code = c.req.param('code');
+    const jurisdiction = getJurisdiction(code);
+    if (!jurisdiction) {
+      throw new NotFoundError(`Jurisdiction not found: ${code}`);
+    }
+    return c.json(jurisdiction);
+  });
+
+  return app;
+};