@complior/engine 0.9.0

package/src/http/routes/obligations.route.test.ts

@@ -0,0 +1,122 @@
+import { describe, it, expect } from 'vitest';
+import { createObligationsRoute } from './obligations.route.js';
+import type { ScanResult, Finding } from '../../types/common.types.js';
+
+const makeObligation = (overrides: Record<string, unknown> = {}) => ({
+  obligation_id: 'eu-ai-act-OBL-001',
+  article_reference: 'Article 4',
+  title: 'AI Literacy',
+  description: 'Ensure staff literacy',
+  applies_to_role: 'both',
+  applies_to_risk_level: ['high', 'limited'],
+  severity: 'medium',
+  deadline: '2025-02-02',
+  obligation_type: 'training',
+  ...overrides,
+});
+
+const makeFinding = (checkId: string, type: 'pass' | 'fail'): Finding => ({
+  checkId,
+  type,
+  message: `${checkId} check`,
+  severity: 'medium' as const,
+  confidence: 1,
+  confidenceLevel: 'high',
+  evidence: [],
+});
+
+const makeScan = (findings: Finding[]): ScanResult => ({
+  findings,
+  score: { totalScore: 50, zone: 'yellow', breakdown: [] } as unknown as ScanResult['score'],
+  metadata: { version: '1.0.0', timestamp: new Date().toISOString(), filesScanned: 10 },
+});
+
+describe('obligations route', () => {
+  it('returns obligations with coverage from passed checks', async () => {
+    const obligations = [
+      makeObligation({ obligation_id: 'eu-ai-act-OBL-001' }),
+      makeObligation({ obligation_id: 'eu-ai-act-OBL-006', title: 'Logging' }),
+    ];
+    const scan = makeScan([
+      makeFinding('ai-literacy', 'pass'),         // covers OBL-001
+      makeFinding('interaction-logging', 'fail'),  // covers OBL-006 but FAIL — not covered
+    ]);
+
+    const app = createObligationsRoute({ obligations, getLastScan: () => scan });
+    const res = await app.request('/obligations');
+    const data = await res.json() as Array<Record<string, unknown>>;
+
+    expect(data).toHaveLength(2);
+    expect(data[0]).toMatchObject({ id: 'OBL-001', covered: true });
+    expect(data[1]).toMatchObject({ id: 'OBL-006', covered: false });
+  });
+
+  it('returns all obligations uncovered when no scan', async () => {
+    const obligations = [makeObligation()];
+    const app = createObligationsRoute({ obligations, getLastScan: () => null });
+    const res = await app.request('/obligations');
+    const data = await res.json() as Array<Record<string, unknown>>;
+
+    expect(data).toHaveLength(1);
+    expect(data[0]).toMatchObject({ id: 'OBL-001', covered: false });
+  });
+
+  it('normalizes obligation_id by stripping eu-ai-act- prefix', async () => {
+    const obligations = [
+      makeObligation({ obligation_id: 'eu-ai-act-OBL-022' }),
+    ];
+    const scan = makeScan([makeFinding('gpai-transparency', 'pass')]);
+
+    const app = createObligationsRoute({ obligations, getLastScan: () => scan });
+    const res = await app.request('/obligations');
+    const data = await res.json() as Array<Record<string, unknown>>;
+
+    expect(data[0]).toMatchObject({ id: 'OBL-022', covered: true });
+  });
+
+  it('includes linked_checks from reverse mapping', async () => {
+    const obligations = [
+      makeObligation({ obligation_id: 'eu-ai-act-OBL-008' }),
+    ];
+    const app = createObligationsRoute({ obligations, getLastScan: () => null });
+    const res = await app.request('/obligations');
+    const data = await res.json() as Array<Record<string, unknown>>;
+
+    // OBL-008 is covered by l4-human-oversight, l4-kill-switch, cross-kill-switch-no-test
+    const linked = data[0]!['linked_checks'] as string[];
+    expect(linked).toContain('l4-human-oversight');
+    expect(linked).toContain('l4-kill-switch');
+    expect(linked).toContain('cross-kill-switch-no-test');
+  });
+
+  it('maps all required fields to response', async () => {
+    const obligations = [makeObligation({
+      obligation_id: 'eu-ai-act-OBL-001',
+      article_reference: 'Article 4',
+      title: 'AI Literacy',
+      description: 'Train staff',
+      applies_to_role: 'both',
+      applies_to_risk_level: ['high'],
+      severity: 'medium',
+      deadline: '2025-02-02',
+      obligation_type: 'training',
+    })];
+    const app = createObligationsRoute({ obligations, getLastScan: () => null });
+    const res = await app.request('/obligations');
+    const data = await res.json() as Array<Record<string, unknown>>;
+
+    expect(data[0]).toEqual({
+      id: 'OBL-001',
+      article: 'Article 4',
+      title: 'AI Literacy',
+      description: 'Train staff',
+      role: 'both',
+      risk_levels: ['high'],
+      severity: 'medium',
+      deadline: '2025-02-02',
+      obligation_type: 'training',
+      covered: false,
+      linked_checks: expect.any(Array),
+    });
+  });
+});

package/src/http/routes/obligations.route.ts

@@ -0,0 +1,110 @@
+import { Hono } from 'hono';
+import type { ScanResult } from '../../types/common.types.js';
+
+export interface ObligationsRouteDeps {
+  readonly obligations: readonly Record<string, unknown>[];
+  readonly getLastScan: () => ScanResult | null;
+}
+
+export const createObligationsRoute = (deps: ObligationsRouteDeps) => {
+  const app = new Hono();
+
+  // Map scanner checkIds → obligation IDs they cover
+  // Keys match actual checkId values emitted by the 5-layer scanner
+  const checkToObls: Readonly<Record<string, readonly string[]>> = {
+    // L1 file-presence checks
+    'ai-disclosure': ['OBL-013', 'OBL-052'],
+    'content-marking': ['OBL-050', 'OBL-051'],
+    'interaction-logging': ['OBL-006', 'OBL-006A'],
+    'ai-literacy': ['OBL-001', 'OBL-001A'],
+    'gpai-transparency': ['OBL-022', 'OBL-024'],
+    'compliance-metadata': ['OBL-005'],
+    'documentation': ['OBL-005', 'OBL-005A'],
+    'passport-presence': ['OBL-049'],
+    'passport-completeness': ['OBL-034'],
+    // L2 document-structure checks
+    'l2-tech-documentation': ['OBL-005', 'OBL-005A'],
+    'l2-monitoring-policy': ['OBL-011', 'OBL-009'],
+    'l2-fria': ['OBL-013'],
+    'l2-ai-literacy': ['OBL-001'],
+    'l2-art5-screening': ['OBL-002'],
+    'l2-worker-notification': ['OBL-010A'],
+    // L3 config/dependency checks
+    'l3-ai-sdk-detected': ['OBL-005'],
+    'l3-log-retention': ['OBL-006A'],
+    'l3-ci-compliance': ['OBL-017'],
+    'l3-missing-bias-testing': ['OBL-004A'],
+    'l3-banned-emotion-recognition': ['OBL-002F'],
+    // L4 AST pattern checks
+    'l4-human-oversight': ['OBL-008', 'OBL-014'],
+    'l4-kill-switch': ['OBL-008'],
+    'l4-logging': ['OBL-006', 'OBL-012'],
+    'l4-disclosure': ['OBL-013', 'OBL-052'],
+    'l4-content-marking': ['OBL-050', 'OBL-051'],
+    'l4-data-governance': ['OBL-004', 'OBL-010'],
+    'l4-accuracy-robustness': ['OBL-007'],
+    'l4-gpai-transparency': ['OBL-022', 'OBL-024'],
+    'l4-deployer-monitoring': ['OBL-011'],
+    'l4-record-keeping': ['OBL-012'],
+    'l4-cybersecurity': ['OBL-015'],
+    'l4-conformity-assessment': ['OBL-019'],
+    'l4-security-risk': ['OBL-015'],
+    'l4-bare-llm': ['OBL-052'],
+    // Cross-layer checks
+    'cross-banned-with-wrapper': ['OBL-002'],
+    'cross-logging-no-retention': ['OBL-006A'],
+    'cross-kill-switch-no-test': ['OBL-008'],
+  };
+
+  // Build reverse mapping: obligation ID → check IDs that cover it
+  const oblToChecks = new Map<string, string[]>();
+  for (const [checkId, oblIds] of Object.entries(checkToObls)) {
+    for (const oblId of oblIds) {
+      const existing = oblToChecks.get(oblId) ?? [];
+      existing.push(checkId);
+      oblToChecks.set(oblId, existing);
+    }
+  }
+
+  app.get('/obligations', (c) => {
+    const scan = deps.getLastScan();
+
+    // Build a set of covered obligation IDs from scan findings
+    const coveredIds = new Set<string>();
+    if (scan) {
+      for (const finding of scan.findings) {
+        if (finding.type === 'pass') {
+          const oblIds = checkToObls[finding.checkId];
+          if (oblIds) {
+            for (const id of oblIds) coveredIds.add(id);
+          }
+        }
+      }
+    }
+
+    const result = deps.obligations.map((obl) => {
+      const oblId = (obl['obligation_id'] as string) ?? '';
+      const shortId = oblId.replace(/^eu-ai-act-/, '').toUpperCase();
+      const covered = coveredIds.has(shortId);
+      const linkedChecks = oblToChecks.get(shortId) ?? [];
+
+      return {
+        id: shortId,
+        article: obl['article_reference'] ?? '',
+        title: obl['title'] ?? '',
+        description: obl['description'] ?? '',
+        role: obl['applies_to_role'] ?? 'both',
+        risk_levels: obl['applies_to_risk_level'] ?? [],
+        severity: obl['severity'] ?? 'medium',
+        deadline: obl['deadline'] ?? null,
+        obligation_type: obl['obligation_type'] ?? '',
+        covered,
+        linked_checks: linkedChecks,
+      };
+    });
+
+    return c.json(result);
+  });
+
+  return app;
+};

package/src/http/routes/onboarding.route.ts

@@ -0,0 +1,53 @@
+import { Hono } from 'hono';
+import { z } from 'zod';
+import type { OnboardingWizard } from '../../onboarding/wizard.js';
+import { parseBody } from '../utils/validation.js';
+
+const CompleteSchema = z.object({
+  answers: z.record(z.union([z.string(), z.array(z.string())])),
+});
+
+export const createOnboardingRoute = (wizard: OnboardingWizard) => {
+  const app = new Hono();
+
+  // GET /onboarding/status — check if profile exists
+  app.get('/onboarding/status', async (c) => {
+    const has = await wizard.hasProfile();
+    const profile = has ? await wizard.loadProfile() : null;
+    return c.json({ hasProfile: has, profile });
+  });
+
+  // POST /onboarding/detect — auto-detect project info
+  app.post('/onboarding/detect', async (c) => {
+    const result = await wizard.detect();
+    return c.json(result);
+  });
+
+  // GET /onboarding/questions — get question blocks
+  app.get('/onboarding/questions', (c) => {
+    return c.json({ blocks: wizard.getQuestions() });
+  });
+
+  // POST /onboarding/complete — submit answers + build profile
+  app.post('/onboarding/complete', async (c) => {
+    const data = await parseBody(c, CompleteSchema);
+
+    const result = await wizard.complete(data.answers);
+    return c.json({
+      profile: result.profile,
+      autoDetected: result.autoDetected,
+      profilePath: result.profilePath,
+    });
+  });
+
+  // GET /onboarding/profile — load saved profile
+  app.get('/onboarding/profile', async (c) => {
+    const profile = await wizard.loadProfile();
+    if (!profile) {
+      return c.json({ error: 'NO_PROFILE', message: 'No onboarding profile found. Run /onboarding/complete first.' }, 404);
+    }
+    return c.json(profile);
+  });
+
+  return app;
+};

package/src/http/routes/provider.route.ts

@@ -0,0 +1,42 @@
+import { Hono } from 'hono';
+import { z } from 'zod';
+import { generateText } from 'ai';
+import type { LlmPort } from '../../ports/llm.port.js';
+import { complior } from '@complior/sdk';
+import { parseBody } from '../utils/validation.js';
+
+const VerifySchema = z.object({
+  provider: z.enum(['anthropic', 'openai', 'openrouter']),
+  apiKey: z.string().min(1),
+});
+
+export const createProviderRoute = (llm: LlmPort) => {
+  const app = new Hono();
+
+  app.post('/provider/verify', async (c) => {
+    const { provider, apiKey } = await parseBody(c, VerifySchema);
+
+    try {
+      const testModelId = provider === 'openrouter'
+        ? 'anthropic/claude-haiku-4.5'
+        : provider === 'anthropic'
+          ? 'claude-haiku-4-5-20251001'
+          : 'gpt-4o-mini';
+
+      const model = await llm.getModel(provider, testModelId, apiKey);
+
+      await complior(generateText)({
+        model,
+        prompt: 'Say "ok"',
+        maxOutputTokens: 1,
+      });
+
+      return c.json({ valid: true });
+    } catch (error: unknown) {
+      const message = error instanceof Error ? error.message : 'Unknown error';
+      return c.json({ valid: false, error: message });
+    }
+  });
+
+  return app;
+};

package/src/http/routes/proxy.route.ts

@@ -0,0 +1,40 @@
+import { Hono } from 'hono';
+import type { ProxyService } from '../../services/proxy-service.js';
+import { ProxyConfigSchema } from '../../domain/proxy/proxy-types.js';
+import { parseBody } from '../utils/validation.js';
+
+export interface ProxyRouteDeps {
+  readonly proxyService: ProxyService;
+  readonly getProjectPath: () => string;
+}
+
+export const createProxyRoute = (proxyServiceOrDeps: ProxyService | ProxyRouteDeps) => {
+  // Support both old (ProxyService) and new (ProxyRouteDeps) signatures
+  const deps: ProxyRouteDeps = 'start' in proxyServiceOrDeps
+    ? { proxyService: proxyServiceOrDeps, getProjectPath: () => process.cwd() }
+    : proxyServiceOrDeps;
+
+  const app = new Hono();
+
+  app.post('/proxy/start', async (c) => {
+    const data = await parseBody(c, ProxyConfigSchema);
+
+    const result = await deps.proxyService.start(data, deps.getProjectPath());
+    return c.json(result, result.success ? 200 : 400);
+  });
+
+  app.post('/proxy/stop', (c) => {
+    const result = deps.proxyService.stop();
+    return c.json(result);
+  });
+
+  app.get('/proxy/health', (c) => {
+    return c.json(deps.proxyService.health());
+  });
+
+  app.get('/proxy/log', (c) => {
+    return c.json({ calls: deps.proxyService.getCallLog() });
+  });
+
+  return app;
+};

package/src/http/routes/redteam.route.ts

@@ -0,0 +1,84 @@
+/**
+ * Red-team route — runs security probes against LLM and returns reports.
+ */
+
+import { Hono } from 'hono';
+import { z } from 'zod';
+import { readdir, readFile, stat } from 'node:fs/promises';
+import { resolve } from 'node:path';
+import { createRedteamRunner } from '../../domain/certification/redteam-runner.js';
+import type { RedteamRunnerDeps } from '../../domain/certification/redteam-runner.js';
+import { parseBody } from '../utils/validation.js';
+
+const RedteamRunSchema = z.object({
+  agentName: z.string().min(1).default('default'),
+  categories: z.array(z.string()).optional(),
+  maxProbes: z.number().int().positive().optional(),
+});
+
+export interface RedteamRouteDeps {
+  readonly callLlm: (prompt: string, systemPrompt?: string) => Promise<string>;
+  readonly evidenceStore?: RedteamRunnerDeps['evidenceStore'];
+  readonly auditStore?: RedteamRunnerDeps['auditStore'];
+  readonly getProjectPath: () => string;
+}
+
+export const createRedteamRoute = (deps: RedteamRouteDeps) => {
+  const app = new Hono();
+
+  const runner = createRedteamRunner({
+    callLlm: deps.callLlm,
+    evidenceStore: deps.evidenceStore,
+    auditStore: deps.auditStore,
+    getProjectPath: deps.getProjectPath,
+  });
+
+  /**
+   * POST /redteam/run
+   * Body: { agentName: string, categories?: string[], maxProbes?: number }
+   * Returns: RedteamReport
+   */
+  app.post('/redteam/run', async (c) => {
+    const data = await parseBody(c, RedteamRunSchema);
+
+    const report = await runner.runRedteam(data.agentName, {
+      categories: data.categories,
+      maxProbes: data.maxProbes,
+    });
+
+    return c.json(report);
+  });
+
+  /**
+   * GET /redteam/last
+   * Returns the most recent red-team report, or 404 if none exists.
+   */
+  app.get('/redteam/last', async (c) => {
+    const reportsDir = resolve(deps.getProjectPath(), '.complior', 'reports');
+    try {
+      const files = await readdir(reportsDir);
+      const redteamFiles = files
+        .filter((f) => f.startsWith('redteam-') && f.endsWith('.json'));
+
+      if (redteamFiles.length === 0) {
+        return c.json({ error: 'NOT_FOUND', message: 'No red-team reports found' }, 404);
+      }
+
+      // Sort by file modification time (most recent first)
+      const withMtime = await Promise.all(
+        redteamFiles.map(async (f) => {
+          const s = await stat(resolve(reportsDir, f));
+          return { name: f, mtime: s.mtimeMs };
+        }),
+      );
+      withMtime.sort((a, b) => b.mtime - a.mtime);
+
+      const raw = await readFile(resolve(reportsDir, withMtime[0]!.name), 'utf-8');
+      return c.json(JSON.parse(raw));
+    } catch {
+      return c.json({ error: 'NOT_FOUND', message: 'No red-team reports found' }, 404);
+    }
+  });
+
+  return app;
+};

package/src/http/routes/report.route.ts

@@ -0,0 +1,29 @@
+import { Hono } from 'hono';
+import { z } from 'zod';
+import type { ReportService } from '../../services/report-service.js';
+
+const PdfReportSchema = z.object({
+  organization: z.string().optional(),
+  jurisdiction: z.string().optional(),
+  isFree: z.boolean().optional(),
+});
+
+export const createReportRoute = (reportService: ReportService) => {
+  const app = new Hono();
+
+  app.post('/report/pdf', async (c) => {
+    const body = await c.req.json().catch(() => ({}));
+    const parsed = PdfReportSchema.safeParse(body);
+    const options = parsed.success ? parsed.data : {};
+
+    const result = await reportService.generatePdf(options);
+    return c.json({ path: result.path, pages: result.pages, format: 'pdf' });
+  });
+
+  app.post('/report/markdown', async (c) => {
+    const result = await reportService.generateMarkdown();
+    return c.json({ path: result.path, format: 'markdown' });
+  });
+
+  return app;
+};

package/src/http/routes/scan.route.ts

@@ -0,0 +1,104 @@
+import { Hono } from 'hono';
+import { z } from 'zod';
+import type { ScanService } from '../../services/scan-service.js';
+import type { ScanResult } from '../../types/common.types.js';
+import { parseBody, requireQuery } from '../utils/validation.js';
+
+const ScanRequestSchema = z.object({
+  path: z.string().min(1),
+  saasToken: z.string().min(1).optional(),
+  saasUrl: z.string().url().optional(),
+});
+
+const ScanDiffRequestSchema = z.object({
+  path: z.string().min(1),
+  changedFiles: z.array(z.string()).optional(),
+  markdown: z.boolean().optional(),
+});
+
+export interface ScanRouteDeps {
+  readonly scanService: ScanService;
+  readonly getLastScan: () => ScanResult | null;
+}
+
+export const createScanRoute = (deps: ScanRouteDeps) => {
+  const app = new Hono();
+  const { scanService } = deps;
+
+  app.post('/scan', async (c) => {
+    const data = await parseBody(c, ScanRequestSchema);
+
+    const result = await scanService.scan(data.path);
+
+    // Auto-sync: if saasToken provided, push scan to SaaS
+    const saasToken = data.saasToken;
+    if (saasToken) {
+      try {
+        const { createSaasClient } = await import('../../infra/saas-client.js');
+        const saasUrl = data.saasUrl;
+        if (!saasUrl) throw new Error('saasUrl required for auto-sync');
+        const client = createSaasClient(saasUrl);
+        await client.syncScan(saasToken, {
+          projectPath: data.path,
+          score: result.score?.totalScore,
+          findings: result.findings?.map((f) => ({
+            severity: f.severity ?? 'info',
+            message: f.message ?? '',
+            tool: f.checkId,
+          })) ?? [],
+          toolsDetected: [{ name: 'scanned-project', category: 'other' }],
+        });
+      } catch (syncErr) {
+        const { createLogger } = await import('../../infra/logger.js');
+        createLogger('scan').warn('Auto-sync to SaaS failed (non-blocking):', syncErr);
+      }
+    }
+
+    return c.json(result);
+  });
+
+  app.post('/scan/deep', async (c) => {
+    const data = await parseBody(c, ScanRequestSchema);
+
+    const result = await scanService.scanDeep(data.path);
+    return c.json(result);
+  });
+
+  // US-S05-34: Compliance Diff — delegates to scanService.scanDiff()
+  app.post('/scan/diff', async (c) => {
+    const data = await parseBody(c, ScanDiffRequestSchema);
+
+    const result = await scanService.scanDiff(
+      data.path,
+      data.changedFiles,
+      { markdown: data.markdown },
+    );
+
+    return c.json(result);
+  });
+
+  // E-115: Tier 2 scan — external tools via uv
+  app.post('/scan/tier2', async (c) => {
+    const data = await parseBody(c, ScanRequestSchema);
+
+    const result = await scanService.scanTier2(data.path);
+    return c.json(result);
+  });
+
+  // Alias: POST /scan/llm → scanDeep (L5 LLM analysis)
+  app.post('/scan/llm', async (c) => {
+    const data = await parseBody(c, ScanRequestSchema);
+
+    const result = await scanService.scanDeep(data.path);
+    return c.json(result);
+  });
+
+  app.get('/sbom', async (c) => {
+    const path = requireQuery(c, 'path');
+
+    const sbom = await scanService.getSbom(path);
+    return c.json(sbom);
+  });
+
+  return app;
+};

package/src/http/routes/share.route.ts

@@ -0,0 +1,44 @@
+import { Hono } from 'hono';
+import { z } from 'zod';
+import type { ShareService } from '../../services/share-service.js';
+
+const CreateShareSchema = z.object({
+  jurisdiction: z.string().optional(),
+  scanType: z.enum(['code', 'external']).optional(),
+  expirationDays: z.number().int().min(1).max(365).optional(),
+});
+
+export const createShareRoute = (shareService: ShareService) => {
+  const app = new Hono();
+
+  app.post('/share', async (c) => {
+    const body = await c.req.json().catch(() => ({}));
+    const parsed = CreateShareSchema.safeParse(body);
+    const options = parsed.success ? parsed.data : {};
+
+    const payload = await shareService.createShare(options);
+    return c.json({
+      id: payload.id,
+      url: `https://complior.ai/share/${payload.id}`,
+      expiresAt: payload.expiresAt,
+      score: payload.score,
+      findingsCount: payload.findingsCount,
+    });
+  });
+
+  app.get('/share/:id', async (c) => {
+    const id = c.req.param('id');
+    const payload = await shareService.getShare(id);
+    if (!payload) {
+      return c.json({ error: 'NOT_FOUND', message: 'Share not found or expired' }, 404);
+    }
+    return c.json(payload);
+  });
+
+  app.get('/shares', async (c) => {
+    const shares = await shareService.listShares();
+    return c.json({ shares });
+  });
+
+  return app;
+};

package/src/http/routes/shell.route.ts

@@ -0,0 +1,27 @@
+import { Hono } from 'hono';
+import { z } from 'zod';
+import { runCommand } from '../../infra/shell-adapter.js';
+import { parseBody } from '../utils/validation.js';
+
+const ShellRequestSchema = z.object({
+  command: z.string().min(1),
+  cwd: z.string().optional(),
+  timeout: z.number().positive().max(30_000).optional(),
+});
+
+export const createShellRoute = () => {
+  const app = new Hono();
+
+  app.post('/shell', async (c) => {
+    const data = await parseBody(c, ShellRequestSchema);
+
+    const result = await runCommand(
+      data.command,
+      data.cwd,
+      data.timeout,
+    );
+    return c.json(result);
+  });
+
+  return app;
+};