@complior/engine 0.9.0

package/src/http/routes/status.route.ts

@@ -0,0 +1,66 @@
+import { Hono } from 'hono';
+import type { StatusService } from '../../services/status-service.js';
+import type { LlmPort } from '../../ports/llm.port.js';
+import { envKeyForTaskType, type TaskType } from '../../llm/routing/model-routing.js';
+
+export interface StatusRouteDeps {
+  readonly statusService: StatusService;
+  readonly llm?: LlmPort;
+}
+
+export const createStatusRoute = (deps: StatusRouteDeps) => {
+  const { statusService, llm } = deps;
+  const app = new Hono();
+
+  app.get('/status', (c) => {
+    return c.json(statusService.getStatus());
+  });
+
+  app.get('/llm/info', (c) => {
+    if (!llm) {
+      return c.json({ error: 'LLM_NOT_CONFIGURED', message: 'No LLM adapter available' }, 404);
+    }
+
+    const providers = llm.detectProviders();
+    const available = llm.getAvailableProviders();
+
+    if (available.length === 0) {
+      return c.json({
+        configured: false,
+        providers: providers.map((p) => ({ name: p.name, available: p.available })),
+      });
+    }
+
+    const taskTypes: readonly TaskType[] = ['classify', 'document-generation', 'code', 'report', 'chat', 'qa'];
+    const tasks: Record<string, { provider: string; modelId: string; reason: string; source: string; envVar?: string }> = {};
+
+    for (const task of taskTypes) {
+      try {
+        const selection = llm.routeModel(task);
+        const envKey = envKeyForTaskType(task);
+        const hasEnvOverride = !!process.env[envKey];
+        tasks[task] = {
+          provider: selection.provider,
+          modelId: selection.modelId,
+          reason: selection.reason,
+          source: hasEnvOverride ? 'env' : 'default',
+          ...(hasEnvOverride ? { envVar: envKey } : {}),
+        };
+      } catch {
+        // Skip tasks that fail routing
+      }
+    }
+
+    const providerSource = process.env['COMPLIOR_LLM_PROVIDER'] ? 'env' : 'auto';
+
+    return c.json({
+      configured: true,
+      activeProvider: available[0]!.name,
+      providerSource,
+      providers: providers.map((p) => ({ name: p.name, available: p.available })),
+      ...tasks,
+    });
+  });
+
+  return app;
+};

package/src/http/routes/supply-chain.route.ts

@@ -0,0 +1,121 @@
+import { readFile, writeFile, mkdir } from 'node:fs/promises';
+import { join } from 'node:path';
+import { Hono } from 'hono';
+import { z } from 'zod';
+import { parsePackageJson, parseRequirementsTxt, parseCargoToml, parseGoMod } from '../../domain/scanner/layers/layer3-parsers.js';
+import type { ParsedDependency } from '../../domain/scanner/layers/layer3-parsers.js';
+import { analyzeSupplyChain } from '../../domain/supply-chain/index.js';
+import { createEvidence } from '../../domain/scanner/evidence.js';
+import { REGISTRY_CARDS, REGISTRY_SLUG_PATTERN, getProviderName } from '../../data/registry-cards.js';
+import type { EvidenceStore } from '../../domain/scanner/evidence-store.js';
+import type { AuditStore } from '../../domain/audit/audit-trail.js';
+import { parseBody, parseQuery } from '../utils/validation.js';
+
+const SupplyChainRequestSchema = z.object({
+  path: z.string().min(1),
+});
+
+const ModelsQuerySchema = z.object({
+  provider: z.string().optional(),
+});
+
+export interface SupplyChainRouteDeps {
+  readonly evidenceStore?: EvidenceStore;
+  readonly auditStore?: AuditStore;
+}
+
+const DEP_FILES = [
+  { file: 'package.json', parser: parsePackageJson },
+  { file: 'requirements.txt', parser: parseRequirementsTxt },
+  { file: 'Cargo.toml', parser: parseCargoToml },
+  { file: 'go.mod', parser: parseGoMod },
+] as const;
+
+const CONFIG_FILES = ['package.json', '.env', '.env.local', 'config.json', 'config.ts', 'config.js'] as const;
+
+const tryReadFile = async (path: string): Promise<string | null> => {
+  try {
+    return await readFile(path, 'utf-8');
+  } catch {
+    return null;
+  }
+};
+
+const collectDependencies = async (projectPath: string): Promise<ParsedDependency[]> => {
+  const deps: ParsedDependency[] = [];
+  for (const { file, parser } of DEP_FILES) {
+    const content = await tryReadFile(join(projectPath, file));
+    if (content) deps.push(...parser(content));
+  }
+  return deps;
+};
+
+const detectModels = async (projectPath: string): Promise<string[]> => {
+  const models = new Set<string>();
+  for (const file of CONFIG_FILES) {
+    const content = await tryReadFile(join(projectPath, file));
+    if (content) {
+      for (const match of content.matchAll(REGISTRY_SLUG_PATTERN)) {
+        models.add(match[0]);
+      }
+    }
+  }
+  return [...models];
+};
+
+export const createSupplyChainRoute = (deps: SupplyChainRouteDeps) => {
+  const app = new Hono();
+
+  app.post('/supply-chain', async (c) => {
+    const data = await parseBody(c, SupplyChainRequestSchema);
+
+    const projectPath = data.path;
+    const allDeps = await collectDependencies(projectPath);
+    const detectedModels = await detectModels(projectPath);
+    const report = analyzeSupplyChain(projectPath, allDeps, detectedModels);
+
+    // Persist report
+    const reportsDir = join(projectPath, '.complior', 'reports');
+    await mkdir(reportsDir, { recursive: true });
+    const ts = new Date().toISOString().replace(/[:.]/g, '-');
+    const reportPath = join(reportsDir, `supply-chain-${ts}.json`);
+    await writeFile(reportPath, JSON.stringify(report, null, 2));
+
+    // Evidence chain (one entry per risk)
+    if (deps.evidenceStore && report.risks.length > 0) {
+      const evidenceItems = report.risks.map((risk, i) =>
+        createEvidence(`supply-chain-${i}`, 'L3', 'supply-chain', {
+          snippet: risk.description,
+          file: risk.packageName || undefined,
+        }),
+      );
+      await deps.evidenceStore.append(evidenceItems, `supply-chain-${Date.now()}`);
+    }
+
+    // Audit trail
+    if (deps.auditStore) {
+      await deps.auditStore.append('supply-chain.audited', {
+        projectPath,
+        totalDependencies: report.totalDependencies,
+        riskScore: report.riskScore,
+        risksCount: report.risks.length,
+        reportPath,
+      });
+    }
+
+    return c.json(report);
+  });
+
+  app.get('/supply-chain/models', async (c) => {
+    const query = parseQuery(c, ModelsQuerySchema);
+
+    const { provider } = query;
+    const cards = provider
+      ? REGISTRY_CARDS.filter((card) => getProviderName(card).toLowerCase() === provider.toLowerCase())
+      : REGISTRY_CARDS;
+
+    return c.json({ models: cards, total: cards.length });
+  });
+
+  return app;
+};

package/src/http/routes/sync.route.ts

@@ -0,0 +1,328 @@
+import { Hono } from 'hono';
+import { readFile, readdir } from 'node:fs/promises';
+import { join } from 'node:path';
+import { z } from 'zod';
+import { createSaasClient, type SyncPassportPayload, type SyncDocPayload } from '../../infra/saas-client.js';
+import type { AgentPassport } from '../../types/passport.types.js';
+import type { ScanResult } from '../../types/common.types.js';
+import type { PassportService } from '../../services/passport-service.js';
+import type { AuditFilter, AuditEntry } from '../../domain/audit/audit-trail.js';
+import { mapDomain } from '../../domain/passport/builder/domain-mapper.js';
+import { createLogger } from '../../infra/logger.js';
+import { parseBody } from '../utils/validation.js';
+
+const log = createLogger('sync');
+
+const parseManifest = (raw: string): AgentPassport | null => {
+  const parsed: unknown = JSON.parse(raw);
+  if (typeof parsed !== 'object' || parsed === null) return null;
+  if (!('name' in parsed) || typeof parsed.name !== 'string') return null;
+  // Validated: has required `name` field — safe to treat as manifest
+  return parsed as AgentPassport;
+};
+
+const SyncRequestSchema = z.object({
+  token: z.string().min(1),
+  saasUrl: z.string().url('saasUrl is required — set PROJECT_API_URL or run `complior login`'),
+});
+
+// Map AgentPassport risk_class to SaaS riskLevel
+const mapRiskLevel = (riskClass?: string): string | undefined => {
+  if (!riskClass) return undefined;
+  const map: Record<string, string> = {
+    L1: 'minimal', L2: 'limited', L3: 'limited', L4: 'high', L5: 'high',
+    minimal: 'minimal', limited: 'limited', high: 'high', prohibited: 'prohibited',
+  };
+  return map[riskClass] ?? undefined;
+};
+
+// Map manifest to SaaS passport payload
+const mapPassport = (manifest: AgentPassport): SyncPassportPayload => ({
+  name: manifest.name,
+  vendorName: manifest.owner?.team ?? '',
+  vendorUrl: manifest.owner?.contact ?? undefined,
+  description: manifest.description,
+  purpose: manifest.disclosure?.disclosure_text ?? '',
+  domain: mapDomain(manifest),
+  riskLevel: mapRiskLevel(manifest.compliance?.eu_ai_act?.risk_class),
+  slug: manifest.agent_id,
+  detectionPatterns: manifest.permissions?.tools ?? [],
+  versions: { cli: manifest.version, manifest: manifest.manifest_version },
+  autonomyLevel: manifest.autonomy_level,
+  framework: manifest.framework,
+  modelProvider: manifest.model?.provider,
+  modelId: manifest.model?.model_id,
+  dataResidency: manifest.model?.data_residency ?? undefined,
+  lifecycleStatus: manifest.lifecycle?.status ?? undefined,
+  compliorScore: manifest.compliance?.complior_score != null ? Math.round(manifest.compliance.complior_score) : undefined,
+  manifestVersion: manifest.manifest_version,
+  signature: manifest.signature,
+  extendedFields: {
+    owner: manifest.owner,
+    constraints: manifest.constraints,
+    permissions: manifest.permissions,
+    logging: manifest.logging,
+    interop: manifest.interop,
+    source: manifest.source,
+    autonomy_evidence: manifest.autonomy_evidence,
+  },
+});
+
+// Document type mapping: CLI file patterns to SaaS document types
+const DOC_TYPE_MAP: Record<string, string> = {
+  'ai-literacy-policy': 'usage_policy',
+  'art5-screening-report': 'risk_assessment',
+  'technical-documentation': 'qms_template',
+  'monitoring-policy': 'monitoring_plan',
+  'worker-notification': 'employee_notification',
+  'fria': 'fria',
+  'declaration-of-conformity': 'transparency_notice',
+  'incident-report': 'incident_report',
+};
+
+interface SyncRouteDeps {
+  readonly getProjectPath: () => string;
+  readonly getLastScan: () => ScanResult | null;
+  readonly passportService?: PassportService;
+  readonly getAuditEntries?: (filter: AuditFilter) => Promise<readonly AuditEntry[]>;
+}
+
+export const createSyncRoute = (deps: SyncRouteDeps) => {
+  const app = new Hono();
+
+  // POST /sync/passport — push all passports to SaaS
+  app.post('/sync/passport', async (c) => {
+    const { token, saasUrl } = await parseBody(c, SyncRequestSchema);
+    const client = createSaasClient(saasUrl);
+    const projectPath = deps.getProjectPath();
+    const agentsDir = join(projectPath, '.complior', 'agents');
+
+    let files: string[];
+    try {
+      files = (await readdir(agentsDir)).filter((f) => f.endsWith('-manifest.json'));
+    } catch {
+      return c.json({ synced: 0, created: 0, updated: 0, conflicts: 0, results: [], message: 'No passports found' });
+    }
+
+    const results: Record<string, unknown>[] = [];
+    let created = 0;
+    let updated = 0;
+    let conflicts = 0;
+
+    for (const file of files) {
+      try {
+        const content = await readFile(join(agentsDir, file), 'utf-8');
+        const manifest = parseManifest(content);
+        if (!manifest) { results.push({ name: file, action: 'error', error: 'Invalid manifest' }); continue; }
+        const payload = mapPassport(manifest);
+        const result = await client.syncPassport(token, payload);
+        results.push({ name: manifest.name, ...result });
+        if (result.action === 'created') created++;
+        if (result.action === 'updated') updated++;
+        if (Array.isArray(result.conflicts) && result.conflicts.length > 0) conflicts++;
+      } catch (err) {
+        log.error(`Failed to sync passport ${file}:`, err);
+        results.push({ name: file, action: 'error', error: String(err) });
+      }
+    }
+
+    return c.json({ synced: files.length, created, updated, conflicts, results });
+  });
+
+  // POST /sync/scan — push last scan results to SaaS
+  app.post('/sync/scan', async (c) => {
+    const { token, saasUrl } = await parseBody(c, SyncRequestSchema);
+    const client = createSaasClient(saasUrl);
+    const lastScan = deps.getLastScan();
+
+    if (!lastScan) {
+      return c.json({ processed: 0, tools: [], message: 'No scan results. Run a scan first.' });
+    }
+
+    // Read passports for tool detection
+    const projectPath = deps.getProjectPath();
+    const agentsDir2 = join(projectPath, '.complior', 'agents');
+    const toolsDetected: { name: string; version?: string; vendor?: string; category?: string }[] = [];
+
+    try {
+      const files = (await readdir(agentsDir2)).filter((f) => f.endsWith('-manifest.json'));
+      for (const file of files) {
+        try {
+          const content = await readFile(join(agentsDir2, file), 'utf-8');
+          const manifest = parseManifest(content);
+          if (!manifest) continue;
+          toolsDetected.push({
+            name: manifest.name,
+            version: manifest.version,
+            vendor: manifest.owner?.team,
+            category: manifest.type,
+          });
+        } catch (parseErr) { log.debug(`Skipping invalid passport ${file}:`, parseErr); }
+      }
+    } catch { /* no passports dir — expected when no agents discovered */ }
+
+    if (toolsDetected.length === 0) {
+      toolsDetected.push({ name: 'unknown-project', category: 'other' });
+    }
+
+    const payload = {
+      projectPath,
+      score: lastScan.score?.totalScore,
+      findings: lastScan.findings?.map((f) => ({
+        severity: f.severity ?? 'info',
+        message: f.message ?? '',
+        tool: f.checkId,
+      })) ?? [],
+      toolsDetected,
+    };
+
+    const result = await client.syncScan(token, payload);
+    return c.json(result);
+  });
+
+  // POST /sync/fria — push structured FRIA assessments to SaaS
+  app.post('/sync/fria', async (c) => {
+    const { token, saasUrl } = await parseBody(c, SyncRequestSchema);
+    const client = createSaasClient(saasUrl);
+    const projectPath = deps.getProjectPath();
+    const reportsDir = join(projectPath, '.complior', 'reports');
+
+    let friaFiles: string[];
+    try {
+      friaFiles = (await readdir(reportsDir)).filter((f) => f.startsWith('fria-') && f.endsWith('.json'));
+    } catch {
+      return c.json({ synced: 0, created: 0, updated: 0, results: [], message: 'No FRIA reports found' });
+    }
+
+    const results: Record<string, unknown>[] = [];
+    let created = 0;
+    let updated = 0;
+
+    for (const file of friaFiles) {
+      try {
+        const content = await readFile(join(reportsDir, file), 'utf-8');
+        const payload: Record<string, unknown> = JSON.parse(content);
+        const result = await client.syncFria(token, payload);
+        const name = (payload['toolSlug'] as string) ?? file;
+        results.push({ name, ...result });
+        if (result.action === 'created') created++;
+        if (result.action === 'updated') updated++;
+      } catch (err) {
+        log.error(`Failed to sync FRIA ${file}:`, err);
+        results.push({ name: file, action: 'error', error: String(err) });
+      }
+    }
+
+    return c.json({ synced: friaFiles.length, created, updated, results });
+  });
+
+  // POST /sync/documents — push compliance docs to SaaS
+  app.post('/sync/documents', async (c) => {
+    const { token, saasUrl } = await parseBody(c, SyncRequestSchema);
+    const client = createSaasClient(saasUrl);
+    const projectPath = deps.getProjectPath();
+    const reportsDir = join(projectPath, '.complior', 'reports');
+
+    let files: string[];
+    try {
+      files = (await readdir(reportsDir)).filter((f) => f.endsWith('.md'));
+    } catch {
+      return c.json({ synced: 0, created: 0, updated: 0, results: [], message: 'No compliance docs found' });
+    }
+
+    const documents: SyncDocPayload[] = [];
+    for (const file of files) {
+      // Strip fria- prefix and .md extension for type mapping
+      const baseName = file.replace(/^fria-/, '').replace(/-manifest/, '').replace('.md', '');
+      const docType = file.startsWith('fria-') ? 'fria' : DOC_TYPE_MAP[baseName];
+      if (!docType) continue;
+
+      try {
+        const content = await readFile(join(reportsDir, file), 'utf-8');
+        documents.push({
+          type: docType,
+          title: file.replace('.md', '').replace(/-/g, ' ').replace(/\b\w/g, (ch) => ch.toUpperCase()),
+          content,
+        });
+      } catch {
+        log.warn(`Failed to read doc: ${file}`);
+      }
+    }
+
+    if (documents.length === 0) {
+      return c.json({ synced: 0, created: 0, updated: 0, results: [], message: 'No mappable docs found' });
+    }
+
+    const result = await client.syncDocuments(token, documents);
+    return c.json(result);
+  });
+
+  // POST /sync/audit — push audit trail entries to SaaS
+  app.post('/sync/audit', async (c) => {
+    const { token, saasUrl } = await parseBody(c, SyncRequestSchema);
+    const client = createSaasClient(saasUrl);
+
+    const entries = deps.getAuditEntries
+      ? await deps.getAuditEntries({})
+      : [];
+
+    if (entries.length === 0) {
+      return c.json({ synced: 0, message: 'No audit entries to sync' });
+    }
+
+    const serializable = entries.map(e => ({ ...e }));
+    const result = await client.syncAudit(token, serializable);
+    return c.json(result);
+  });
+
+  // POST /sync/evidence — push evidence chain summary to SaaS
+  app.post('/sync/evidence', async (c) => {
+    const { token, saasUrl } = await parseBody(c, SyncRequestSchema);
+    const client = createSaasClient(saasUrl);
+
+    const summary = deps.passportService
+      ? await deps.passportService.getEvidenceChainSummary()
+      : { totalEntries: 0, scanCount: 0, firstEntry: '', lastEntry: '', chainValid: true, uniqueFindings: 0 };
+
+    const result = await client.syncEvidence(token, { ...summary });
+    return c.json(result);
+  });
+
+  // POST /sync/registry — push agent registry scores to SaaS
+  app.post('/sync/registry', async (c) => {
+    const { token, saasUrl } = await parseBody(c, SyncRequestSchema);
+    const client = createSaasClient(saasUrl);
+
+    const entries = deps.passportService
+      ? await deps.passportService.getAgentRegistry()
+      : [];
+
+    if (entries.length === 0) {
+      return c.json({ synced: 0, message: 'No registry entries to sync' });
+    }
+
+    const serializable = entries.map(e => ({ ...e }));
+    const result = await client.syncRegistry(token, serializable);
+    return c.json(result);
+  });
+
+  // GET /sync/status — proxy SaaS sync status
+  app.get('/sync/status', async (c) => {
+    const token = c.req.header('Authorization')?.replace('Bearer ', '') ?? c.req.query('token') ?? '';
+    const saasUrl = c.req.query('saasUrl') ?? '';
+
+    if (!token || !saasUrl) {
+      return c.json({ authenticated: false, stats: null });
+    }
+
+    try {
+      const client = createSaasClient(saasUrl);
+      const status = await client.syncStatus(token);
+      return c.json({ authenticated: true, ...status });
+    } catch {
+      return c.json({ authenticated: false, stats: null });
+    }
+  });
+
+  return app;
+};

package/src/http/routes/tools.route.ts

@@ -0,0 +1,29 @@
+import { Hono } from 'hono';
+import type { ToolManager } from '../../infra/tool-manager.js';
+
+export interface ToolsRouteDeps {
+  readonly toolManager: ToolManager;
+}
+
+export const createToolsRoute = (deps: ToolsRouteDeps) => {
+  const app = new Hono();
+  const { toolManager } = deps;
+
+  app.get('/tools/status', async (c) => {
+    const uvAvailable = await toolManager.isUvAvailable();
+    const statuses = await toolManager.getToolStatus();
+    return c.json({
+      uvAvailable,
+      tools: statuses,
+    });
+  });
+
+  app.post('/tools/update', async (c) => {
+    const statuses = await toolManager.updateTools();
+    return c.json({
+      tools: statuses,
+    });
+  });
+
+  return app;
+};

package/src/http/routes/whatif.route.ts

@@ -0,0 +1,96 @@
+import { Hono } from 'hono';
+import { z } from 'zod';
+import { parseBody } from '../utils/validation.js';
+import type { WhatIfRequest, WhatIfResult } from '../../domain/whatif/scenario-engine.js';
+import type { GeneratedConfig } from '../../domain/whatif/config-fixer.js';
+import type { SimulationInput, SimulationResult } from '../../domain/whatif/simulate-actions.js';
+import type { OnboardingProfile } from '../../onboarding/profile.js';
+import type { ScanResult, ScoreBreakdown } from '../../types/common.types.js';
+
+const WhatIfSchema = z.object({
+  type: z.enum(['jurisdiction', 'tool', 'risk_level']),
+  params: z.record(z.string()),
+});
+
+const SimulateActionSchema = z.object({
+  type: z.enum(['fix', 'add-doc', 'complete-passport']),
+  target: z.string(),
+});
+
+const SimulateSchema = z.object({
+  actions: z.array(SimulateActionSchema).min(1),
+  passportCompleteness: z.number().min(0).max(100).optional(),
+});
+
+export interface WhatIfRouteDeps {
+  readonly loadProfile: () => Promise<OnboardingProfile | null>;
+  readonly getLastScore: () => ScoreBreakdown | null;
+  readonly getLastScan?: () => ScanResult | null;
+  readonly analyzeScenario: (request: WhatIfRequest) => WhatIfResult;
+  readonly generateAllConfigs: (profile: OnboardingProfile) => readonly GeneratedConfig[];
+  readonly simulateActions: (input: SimulationInput) => SimulationResult;
+}
+
+export const createWhatIfRoute = (deps: WhatIfRouteDeps) => {
+  const app = new Hono();
+
+  // POST /whatif — analyze a what-if scenario
+  app.post('/whatif', async (c) => {
+    const data = await parseBody(c, WhatIfSchema);
+
+    const profile = await deps.loadProfile();
+    if (!profile) {
+      return c.json({ error: 'NO_PROFILE', message: 'Run onboarding first (/onboarding/complete)' }, 400);
+    }
+
+    const score = deps.getLastScore();
+    if (!score) {
+      return c.json({ error: 'NO_SCAN', message: 'Run a scan first (/scan)' }, 400);
+    }
+
+    const result = deps.analyzeScenario({
+      type: data.type,
+      params: data.params,
+      currentProfile: profile,
+      currentScore: score,
+    });
+
+    return c.json(result);
+  });
+
+  // POST /whatif/config — generate compliance configs from profile
+  app.post('/whatif/config', async (c) => {
+    const profile = await deps.loadProfile();
+    if (!profile) {
+      return c.json({ error: 'NO_PROFILE', message: 'Run onboarding first (/onboarding/complete)' }, 400);
+    }
+
+    const configs = deps.generateAllConfigs(profile);
+    return c.json({ configs });
+  });
+
+  // POST /simulate — US-S05-25: batch compliance simulation (what-if for fixes/docs/passport)
+  app.post('/simulate', async (c) => {
+    const data = await parseBody(c, SimulateSchema);
+
+    const scanResult = deps.getLastScan?.();
+    if (!scanResult) {
+      return c.json({ error: 'NO_SCAN', message: 'No scan results available. Run a scan first.' }, 400);
+    }
+
+    const result = deps.simulateActions({
+      actions: data.actions,
+      currentScore: scanResult.score.totalScore,
+      findings: scanResult.findings.map((f) => ({
+        checkId: f.checkId,
+        severity: f.severity,
+        status: f.type ?? 'fail',
+      })),
+      passportCompleteness: data.passportCompleteness ?? 50,
+    });
+
+    return c.json(result);
+  });
+
+  return app;
+};

package/src/http/utils/validation.ts

@@ -0,0 +1,31 @@
+/**
+ * HTTP request validation helpers.
+ * Replaces repeated json().catch() + safeParse() boilerplate in route files.
+ */
+import type { Context } from 'hono';
+import type { ZodType, z } from 'zod';
+import { ValidationError } from '../../types/errors.js';
+
+/** Parse and validate JSON body against a Zod schema. Throws ValidationError on failure. */
+export const parseBody = async <S extends ZodType>(c: Context, schema: S): Promise<z.output<S>> => {
+  const body = await c.req.json().catch(() => {
+    throw new ValidationError('Invalid JSON body');
+  });
+  const parsed = schema.safeParse(body);
+  if (!parsed.success) throw new ValidationError(`Invalid request: ${parsed.error.message}`);
+  return parsed.data;
+};
+
+/** Validate query parameters against a Zod schema. Throws ValidationError on failure. */
+export const parseQuery = <S extends ZodType>(c: Context, schema: S): z.output<S> => {
+  const parsed = schema.safeParse(c.req.query());
+  if (!parsed.success) throw new ValidationError(`Invalid query: ${parsed.error.message}`);
+  return parsed.data;
+};
+
+/** Extract a required query parameter. Throws ValidationError if missing. */
+export const requireQuery = (c: Context, param: string): string => {
+  const value = c.req.query(param);
+  if (!value) throw new ValidationError(`Missing "${param}" query parameter`);
+  return value;
+};

package/src/index.ts

@@ -0,0 +1 @@
+export { loadApplication } from './composition-root.js';