@complior/engine 0.9.0

package/src/domain/eval/types.test.ts

@@ -0,0 +1,173 @@
+import { describe, it, expect } from 'vitest';
+import {
+  EvalCategorySchema,
+  EvalTierSchema,
+  EvalOptionsSchema,
+  AuditOptionsSchema,
+  EVAL_CATEGORIES,
+  EVAL_TIERS,
+  CATEGORY_META,
+  TIER_INCLUDES,
+  resolveIncludes,
+  resolveTierLabel,
+} from './types.js';
+
+describe('EvalCategory', () => {
+  it('has 11 categories', () => {
+    expect(EVAL_CATEGORIES).toHaveLength(11);
+  });
+
+  it('validates known categories', () => {
+    for (const cat of EVAL_CATEGORIES) {
+      expect(EvalCategorySchema.parse(cat)).toBe(cat);
+    }
+  });
+
+  it('rejects unknown category', () => {
+    expect(() => EvalCategorySchema.parse('unknown')).toThrow();
+  });
+});
+
+describe('CATEGORY_META', () => {
+  it('has metadata for all 11 categories', () => {
+    expect(CATEGORY_META).toHaveLength(11);
+    const ids = CATEGORY_META.map((m) => m.id);
+    for (const cat of EVAL_CATEGORIES) {
+      expect(ids).toContain(cat);
+    }
+  });
+
+  it('each entry has CT-N id', () => {
+    for (const meta of CATEGORY_META) {
+      expect(meta.ctId).toMatch(/^CT-\d+$/);
+    }
+  });
+});
+
+describe('EvalTier', () => {
+  it('has 4 tiers', () => {
+    expect(EVAL_TIERS).toHaveLength(4);
+  });
+
+  it('validates known tiers', () => {
+    for (const tier of EVAL_TIERS) {
+      expect(EvalTierSchema.parse(tier)).toBe(tier);
+    }
+  });
+
+  it('basic = deterministic only', () => {
+    expect(TIER_INCLUDES.basic).toEqual({ deterministic: true, llm: false, security: false });
+  });
+
+  it('full includes everything', () => {
+    expect(TIER_INCLUDES.full).toEqual({ deterministic: true, llm: true, security: true });
+  });
+
+  it('security = probes only', () => {
+    expect(TIER_INCLUDES.security).toEqual({ deterministic: false, llm: false, security: true });
+  });
+});
+
+describe('resolveIncludes', () => {
+  it('no flags → deterministic only', () => {
+    expect(resolveIncludes({})).toEqual({ deterministic: true, llm: false, security: false });
+  });
+
+  it('--llm → llm-judge only', () => {
+    expect(resolveIncludes({ llm: true })).toEqual({ deterministic: false, llm: true, security: false });
+  });
+
+  it('--security → security only', () => {
+    expect(resolveIncludes({ security: true })).toEqual({ deterministic: false, llm: false, security: true });
+  });
+
+  it('--full → everything', () => {
+    expect(resolveIncludes({ full: true })).toEqual({ deterministic: true, llm: true, security: true });
+  });
+
+  it('--det --llm → deterministic + llm', () => {
+    expect(resolveIncludes({ det: true, llm: true })).toEqual({ deterministic: true, llm: true, security: false });
+  });
+
+  it('--llm --security → llm + security (no det)', () => {
+    expect(resolveIncludes({ llm: true, security: true })).toEqual({ deterministic: false, llm: true, security: true });
+  });
+
+  it('--det --security → deterministic + security', () => {
+    expect(resolveIncludes({ det: true, security: true })).toEqual({ deterministic: true, llm: false, security: true });
+  });
+
+  it('--det alone → same as default', () => {
+    expect(resolveIncludes({ det: true })).toEqual({ deterministic: true, llm: false, security: false });
+  });
+});
+
+describe('resolveTierLabel', () => {
+  it('maps includes to tier labels', () => {
+    expect(resolveTierLabel({ deterministic: true, llm: false, security: false })).toBe('basic');
+    expect(resolveTierLabel({ deterministic: false, llm: true, security: false })).toBe('standard');
+    expect(resolveTierLabel({ deterministic: true, llm: true, security: false })).toBe('standard');
+    expect(resolveTierLabel({ deterministic: true, llm: true, security: true })).toBe('full');
+    expect(resolveTierLabel({ deterministic: false, llm: false, security: true })).toBe('security');
+    expect(resolveTierLabel({ deterministic: true, llm: false, security: true })).toBe('security');
+  });
+});
+
+describe('EvalOptionsSchema', () => {
+  it('parses valid options', () => {
+    const result = EvalOptionsSchema.parse({
+      target: 'http://localhost:4000/api/chat',
+    });
+    expect(result.target).toBe('http://localhost:4000/api/chat');
+  });
+
+  it('parses with flag booleans', () => {
+    const result = EvalOptionsSchema.parse({
+      target: 'http://localhost:4000',
+      llm: true,
+      security: true,
+    });
+    expect(result.llm).toBe(true);
+    expect(result.security).toBe(true);
+  });
+
+  it('rejects missing target', () => {
+    expect(() => EvalOptionsSchema.parse({})).toThrow();
+  });
+
+  it('rejects invalid URL', () => {
+    expect(() => EvalOptionsSchema.parse({ target: 'not-a-url' })).toThrow();
+  });
+
+  it('accepts optional fields', () => {
+    const result = EvalOptionsSchema.parse({
+      target: 'http://localhost:4000',
+      full: true,
+      categories: ['bias', 'transparency'],
+      agent: 'my-agent',
+      model: 'gpt-4o',
+      apiKey: 'sk-test',
+      threshold: 80,
+      json: true,
+      ci: true,
+    });
+    expect(result.full).toBe(true);
+    expect(result.categories).toEqual(['bias', 'transparency']);
+    expect(result.threshold).toBe(80);
+  });
+
+  it('rejects threshold > 100', () => {
+    expect(() => EvalOptionsSchema.parse({ target: 'http://localhost:4000', threshold: 150 })).toThrow();
+  });
+});
+
+describe('AuditOptionsSchema', () => {
+  it('parses valid audit options', () => {
+    const result = AuditOptionsSchema.parse({ target: 'http://localhost:4000' });
+    expect(result.target).toBe('http://localhost:4000');
+  });
+
+  it('rejects invalid target', () => {
+    expect(() => AuditOptionsSchema.parse({ target: '' })).toThrow();
+  });
+});

package/src/domain/eval/types.ts

@@ -0,0 +1,244 @@
+/**
+ * Core types for the `complior eval` subsystem.
+ *
+ * Eval sends probes to EXTERNAL AI endpoints (via TargetAdapter) and evaluates
+ * responses for EU AI Act compliance. Two probe families:
+ *   - 380 conformity tests (CT-1..CT-11, 11 categories)
+ *   - 300 security probes (OWASP LLM Top 10)
+ */
+
+import { z } from 'zod';
+
+// ── Eval Categories (11 conformity areas) ───────────────────────
+
+export const EVAL_CATEGORIES = [
+  'transparency',
+  'oversight',
+  'explanation',
+  'bias',
+  'accuracy',
+  'robustness',
+  'prohibited',
+  'logging',
+  'risk-awareness',
+  'gpai',
+  'industry',
+] as const;
+
+export type EvalCategory = (typeof EVAL_CATEGORIES)[number];
+
+export const EvalCategorySchema = z.enum(EVAL_CATEGORIES);
+
+// ── Category metadata ───────────────────────────────────────────
+
+export interface CategoryMeta {
+  readonly id: EvalCategory;
+  readonly label: string;
+  readonly ctId: string;          // CT-1..CT-11
+  readonly euAiActArticles: readonly string[];
+  readonly description: string;
+}
+
+export const CATEGORY_META: readonly CategoryMeta[] = Object.freeze([
+  { id: 'transparency', label: 'Transparency', ctId: 'CT-1', euAiActArticles: ['Art.13', 'Art.52'], description: 'AI system identifies itself and discloses AI nature' },
+  { id: 'oversight', label: 'Human Oversight', ctId: 'CT-2', euAiActArticles: ['Art.14'], description: 'Meaningful human control and escalation paths' },
+  { id: 'explanation', label: 'Explanation Quality', ctId: 'CT-3', euAiActArticles: ['Art.13(1)', 'Art.86'], description: 'Clear reasoning and decision explanation' },
+  { id: 'bias', label: 'Bias & Fairness', ctId: 'CT-4', euAiActArticles: ['Art.10', 'Art.15'], description: 'Equal treatment regardless of protected characteristics' },
+  { id: 'accuracy', label: 'Accuracy', ctId: 'CT-5', euAiActArticles: ['Art.15', 'Art.9'], description: 'Factual correctness and hallucination resistance' },
+  { id: 'robustness', label: 'Robustness', ctId: 'CT-6', euAiActArticles: ['Art.15', 'Art.9'], description: 'Graceful handling of adversarial and edge-case input' },
+  { id: 'prohibited', label: 'Prohibited Practices', ctId: 'CT-7', euAiActArticles: ['Art.5'], description: 'Refusal of social scoring, manipulation, exploitation' },
+  { id: 'logging', label: 'Logging & Audit', ctId: 'CT-8', euAiActArticles: ['Art.12', 'Art.19'], description: 'Structured, timestamped, PII-safe audit logs' },
+  { id: 'risk-awareness', label: 'Risk Awareness', ctId: 'CT-9', euAiActArticles: ['Art.9'], description: 'Self-awareness of limitations, scope, and failure modes' },
+  { id: 'gpai', label: 'GPAI Transparency', ctId: 'CT-10', euAiActArticles: ['Art.52', 'Art.53'], description: 'General-purpose AI model and provider identification' },
+  { id: 'industry', label: 'Industry-Specific', ctId: 'CT-11', euAiActArticles: ['Art.6', 'Annex III'], description: 'Domain-specific compliance (HR, education, finance, healthcare)' },
+]);
+
+// ── Eval Tier ───────────────────────────────────────────────────
+
+export const EVAL_TIERS = ['basic', 'standard', 'full', 'security'] as const;
+export type EvalTier = (typeof EVAL_TIERS)[number];
+
+export const EvalTierSchema = z.enum(EVAL_TIERS);
+
+/** What each tier includes. */
+export const TIER_INCLUDES: Record<EvalTier, { deterministic: boolean; llm: boolean; security: boolean }> = {
+  basic:    { deterministic: true,  llm: false, security: false },
+  standard: { deterministic: false, llm: true,  security: false },
+  full:     { deterministic: true,  llm: true,  security: true },
+  security: { deterministic: false, llm: false, security: true },
+};
+
+// ── Flag-based resolution (replaces tier) ────────────────────
+
+export interface EvalIncludes {
+  readonly deterministic: boolean;
+  readonly llm: boolean;
+  readonly security: boolean;
+}
+
+/** Resolve boolean CLI flags into includes (composable: each flag toggles its test set). */
+export const resolveIncludes = (opts: { det?: boolean; llm?: boolean; security?: boolean; full?: boolean }): EvalIncludes => {
+  if (opts.full) {
+    return { deterministic: true, llm: true, security: true };
+  }
+  // If any explicit flag → compose from flags
+  if (opts.det || opts.llm || opts.security) {
+    return {
+      deterministic: opts.det ?? false,
+      llm: opts.llm ?? false,
+      security: opts.security ?? false,
+    };
+  }
+  // Default (no flags): deterministic only
+  return { deterministic: true, llm: false, security: false };
+};
+
+/** Derive a tier label from resolved includes (for display/result). */
+export const resolveTierLabel = (includes: EvalIncludes): EvalTier => {
+  if (includes.deterministic && includes.llm && includes.security) return 'full';
+  if (includes.llm) return 'standard';   // any combo with LLM → standard
+  if (includes.security) return 'security';
+  return 'basic';
+};
+
+// ── Evaluation method ───────────────────────────────────────────
+
+export type EvalMethod = 'deterministic' | 'llm-judge';
+
+// ── Conformity Test ─────────────────────────────────────────────
+
+export interface ConformityTest {
+  readonly id: string;            // e.g. "CT-1-001"
+  readonly category: EvalCategory;
+  readonly name: string;
+  readonly description: string;
+  readonly method: EvalMethod;
+  readonly probe: string;         // Prompt to send to target
+  readonly euAiActRef: string;    // e.g. "Art.13(1)"
+
+  // Deterministic eval fields (only when method === 'deterministic')
+  readonly passPatterns?: readonly RegExp[];
+  readonly failPatterns?: readonly RegExp[];
+  readonly checkHeaders?: readonly string[];   // Response headers to check
+  readonly checkStatus?: number;               // Expected HTTP status
+  readonly maxLatencyMs?: number;              // Max acceptable latency
+
+  // LLM-judge fields (only when method === 'llm-judge')
+  readonly judgePrompt?: string;
+  readonly scale?: 'binary' | '1-5';
+  readonly passThreshold?: number;             // Minimum score to pass (1-5 scale)
+
+  // Multi-turn test support
+  readonly followUp?: string;      // Optional follow-up probe
+  readonly pairWith?: string;      // For bias A/B pair testing (ID of partner)
+
+  // Metadata
+  readonly severity: 'critical' | 'high' | 'medium' | 'low';
+  readonly tags?: readonly string[];
+}
+
+// ── Test Result ─────────────────────────────────────────────────
+
+export interface TestResult {
+  readonly testId: string;
+  readonly category: EvalCategory;
+  readonly name: string;
+  readonly method: EvalMethod;
+  readonly verdict: 'pass' | 'fail' | 'error' | 'skip' | 'inconclusive';
+  readonly score: number;         // 0-100
+  readonly confidence: number;    // 0-100
+  readonly reasoning: string;
+  readonly probe: string;
+  readonly response: string;
+  readonly latencyMs: number;
+  readonly timestamp: string;
+  readonly owaspCategory?: string; // OWASP LLM Top 10 (e.g. 'LLM01') — security probes only
+  readonly severity?: 'critical' | 'high' | 'medium' | 'low'; // Carried from ConformityTest/probe
+}
+
+// ── Category Score ──────────────────────────────────────────────
+
+export interface CategoryScore {
+  readonly category: EvalCategory;
+  readonly score: number;         // 0-100
+  readonly grade: string;         // A-F
+  readonly passed: number;
+  readonly failed: number;
+  readonly errors: number;
+  readonly inconclusive: number;
+  readonly skipped: number;
+  readonly total: number;
+}
+
+// ── Eval Result (top-level) ─────────────────────────────────────
+
+export interface EvalResult {
+  readonly target: string;
+  readonly tier: EvalTier;
+  readonly overallScore: number;
+  readonly grade: string;
+  readonly categories: readonly CategoryScore[];
+  readonly securityScore?: number;
+  readonly securityGrade?: string;
+  readonly results: readonly TestResult[];
+  readonly totalTests: number;
+  readonly passed: number;
+  readonly failed: number;
+  readonly errors: number;
+  readonly inconclusive: number;
+  readonly skipped: number;
+  readonly duration: number;      // ms
+  readonly timestamp: string;
+  readonly criticalCapped: boolean;
+  readonly agent?: string;        // Agent passport name
+  readonly adapterName?: string;  // Target adapter type (openai, anthropic, ollama, http)
+}
+
+// ── Eval Options (input to runner) ──────────────────────────────
+
+export const EvalOptionsSchema = z.object({
+  target: z.string().url(),
+  det: z.boolean().optional(),
+  llm: z.boolean().optional(),
+  security: z.boolean().optional(),
+  full: z.boolean().optional(),
+  categories: z.array(EvalCategorySchema).optional(),
+  agent: z.string().optional(),
+  model: z.string().optional(),
+  apiKey: z.string().optional(),
+  path: z.string().optional(),
+  threshold: z.number().min(0).max(100).optional(),
+  json: z.boolean().optional(),
+  ci: z.boolean().optional(),
+  // Custom adapter fields
+  requestTemplate: z.string().optional(),   // JSON template with {{probe}} placeholder
+  responsePath: z.string().optional(),      // Dot-path to response text (e.g. "result.text")
+  headers: z.string().optional(),           // JSON string of custom headers
+  // Concurrency
+  concurrency: z.number().int().min(1).max(50).optional(), // Parallel test execution (default: 1)
+});
+
+export type EvalOptions = z.infer<typeof EvalOptionsSchema>;
+
+// ── Audit Options ───────────────────────────────────────────────
+
+export const AuditOptionsSchema = z.object({
+  target: z.string().url(),
+  agent: z.string().optional(),
+  path: z.string().optional(),
+  json: z.boolean().optional(),
+});
+
+export type AuditOptions = z.infer<typeof AuditOptionsSchema>;
+
+// ── Progress callback ───────────────────────────────────────────
+
+export interface EvalProgress {
+  readonly phase: 'health' | 'deterministic' | 'llm-judge' | 'security' | 'scoring' | 'done';
+  readonly completed: number;
+  readonly total: number;
+  readonly currentTest?: string;
+  readonly lastResult?: TestResult;
+}
+
+export type EvalProgressCallback = (progress: EvalProgress) => void | Promise<void>;

package/src/domain/eval/verdict-utils.ts

@@ -0,0 +1,45 @@
+/**
+ * Shared verdict counting and score calculation for eval subsystem.
+ *
+ * Single source of truth — used by eval-runner, conformity-score,
+ * security-integration, and eval-evidence.
+ */
+
+// ── Verdict counting ────────────────────────────────────────────
+
+export interface VerdictCounts {
+  readonly passed: number;
+  readonly failed: number;
+  readonly errors: number;
+  readonly inconclusive: number;
+  readonly skipped: number;
+}
+
+/** Count verdicts from test results. Avoids repeated .filter() chains. */
+export const countVerdicts = (
+  results: readonly { verdict: string }[],
+): VerdictCounts => {
+  let passed = 0, failed = 0, errors = 0, inconclusive = 0, skipped = 0;
+  for (const r of results) {
+    switch (r.verdict) {
+      case 'pass': passed++; break;
+      case 'fail': failed++; break;
+      case 'error': errors++; break;
+      case 'inconclusive': inconclusive++; break;
+      case 'skip': skipped++; break;
+    }
+  }
+  return { passed, failed, errors, inconclusive, skipped };
+};
+
+// ── Verdict predicates ──────────────────────────────────────────
+
+/** True when a test result represents a failure (fail or error). */
+export const isFailedVerdict = (r: { verdict: string }): boolean =>
+  r.verdict === 'fail' || r.verdict === 'error';
+
+// ── Score calculation ───────────────────────────────────────────
+
+/** Calculate percentage score with division-by-zero protection. */
+export const calculateScore = (passed: number, total: number): number =>
+  total > 0 ? Math.round((passed / total) * 100) : 0;

package/src/domain/fixer/create-fixer.ts

@@ -0,0 +1,101 @@
+import type { Finding } from '../../types/common.types.js';
+import type { FixPlan, FixAction, FixContext } from './types.js';
+import { findStrategy } from './strategies/index.js';
+import { generateUnifiedDiff } from './diff.js';
+
+export interface FixerDeps {
+  readonly getFramework: () => string;
+  readonly getProjectPath: () => string;
+  readonly getExistingFiles: () => readonly string[];
+}
+
+const descFor = (checkId: string, filePath: string, line: number): string => {
+  if (checkId.includes('bare-call') || checkId.includes('bare')) return `wrap bare LLM call at ${filePath}:${line}`;
+  if (checkId.startsWith('l4-nhi-') || checkId.startsWith('ext-detect-secrets-')) return `externalize secret at ${filePath}:${line}`;
+  if (checkId === 'l4-security-risk' || checkId.includes('unsafe-deser') || checkId.includes('injection')) return `fix security risk at ${filePath}:${line}`;
+  if (checkId === 'l4-ast-missing-error-handling' || checkId.includes('missing-error-handling')) return `add error handling at ${filePath}:${line}`;
+  if (checkId.startsWith('l3-banned-')) return `remove banned dependency from ${filePath}`;
+  if (checkId.startsWith('ext-bandit-')) return `fix security issue at ${filePath}:${line}`;
+  return `inline fix at ${filePath}:${line}`;
+};
+
+const commitMsgFor = (checkId: string, article: string): string => {
+  if (checkId.includes('bare-call') || checkId.includes('bare')) return `fix: wrap bare LLM call with @complior/sdk (${article || 'Art. 50'}) -- via Complior`;
+  if (checkId.startsWith('l4-nhi-') || checkId.startsWith('ext-detect-secrets-')) return `fix: externalize hardcoded secret (${article || 'Art. 15'}) -- via Complior`;
+  if (checkId === 'l4-security-risk' || checkId.includes('unsafe-deser') || checkId.includes('injection')) return `fix: remediate security risk (${article || 'Art. 15'}) -- via Complior`;
+  if (checkId === 'l4-ast-missing-error-handling' || checkId.includes('missing-error-handling')) return `fix: add LLM error handling (${article || 'Art. 14'}) -- via Complior`;
+  if (checkId.startsWith('l3-banned-')) return `fix: remove banned dependency (${article || 'Art. 5'}) -- via Complior`;
+  if (checkId.startsWith('ext-bandit-')) return `fix: remediate security issue (${article || 'Art. 15'}) -- via Complior`;
+  return `fix: inline compliance fix (${article || 'EU AI Act'}) -- via Complior`;
+};
+
+const buildInlineFixPlan = (finding: Finding): FixPlan => {
+  const diff = finding.fixDiff!;
+  const desc = descFor(finding.checkId, diff.filePath, diff.startLine);
+  const action: FixAction = {
+    type: 'splice',
+    path: diff.filePath,
+    beforeLines: diff.before,
+    afterLines: diff.after,
+    startLine: diff.startLine,
+    importLine: diff.importLine,
+    description: `Inline fix: ${desc}`,
+  };
+
+  return {
+    obligationId: finding.obligationId ?? '',
+    checkId: finding.checkId,
+    article: finding.articleReference ?? '',
+    fixType: 'code_injection',
+    framework: '',
+    actions: [action],
+    diff: generateUnifiedDiff(diff.filePath, diff.before.join('\n'), diff.after.join('\n')),
+    scoreImpact: 6,
+    commitMessage: commitMsgFor(finding.checkId, finding.articleReference ?? ''),
+    description: `Inline fix: ${desc}`,
+  };
+};
+
+export const createFixer = (deps: FixerDeps) => {
+  const { getFramework, getProjectPath, getExistingFiles } = deps;
+
+  const buildContext = (options?: { useAi?: boolean }): FixContext => ({
+    projectPath: getProjectPath(),
+    framework: getFramework(),
+    existingFiles: getExistingFiles(),
+    useAi: options?.useAi,
+  });
+
+  const generateFix = (finding: Finding, options?: { useAi?: boolean }): FixPlan | null => {
+    if (finding.type !== 'fail') return null;
+    // Priority 1: Inline fix from scanner fixDiff
+    if (finding.fixDiff) return buildInlineFixPlan(finding);
+    // Priority 2: Strategy-based scaffold
+    return findStrategy(finding, buildContext(options));
+  };
+
+  const generateFixes = (findings: readonly Finding[], options?: { useAi?: boolean }): readonly FixPlan[] => {
+    const plans: FixPlan[] = [];
+    const seen = new Set<string>();
+    for (const finding of findings) {
+      const plan = generateFix(finding, options);
+      if (plan === null) continue;
+      // Deduplicate: splice by path:startLine, others by output path
+      const key = plan.actions[0]?.type === 'splice'
+        ? `${plan.actions[0].path}:${plan.actions[0].startLine}`
+        : plan.actions[0]?.path ?? plan.checkId;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      plans.push(plan);
+    }
+    return plans;
+  };
+
+  const previewFix = (finding: Finding): FixPlan | null => {
+    return generateFix(finding);
+  };
+
+  return Object.freeze({ generateFix, generateFixes, previewFix });
+};
+
+export type Fixer = ReturnType<typeof createFixer>;

package/src/domain/fixer/diff.ts

@@ -0,0 +1,70 @@
+export const generateUnifiedDiff = (
+  filePath: string,
+  oldContent: string,
+  newContent: string,
+): string => {
+  const oldLines = oldContent.split('\n');
+  const newLines = newContent.split('\n');
+
+  const lines: string[] = [
+    `--- a/${filePath}`,
+    `+++ b/${filePath}`,
+  ];
+
+  // Simple diff: show removed and added lines
+  const maxLen = Math.max(oldLines.length, newLines.length);
+  let chunkStart = -1;
+  let chunkOld: string[] = [];
+  let chunkNew: string[] = [];
+  let context: string[] = [];
+
+  const flushChunk = (): void => {
+    if (chunkOld.length === 0 && chunkNew.length === 0) return;
+    const oldStart = Math.max(1, chunkStart - context.length + 1);
+    const oldCount = context.length + chunkOld.length;
+    const newCount = context.length + chunkNew.length;
+    lines.push(`@@ -${oldStart},${oldCount} +${oldStart},${newCount} @@`);
+    for (const c of context) lines.push(` ${c}`);
+    for (const r of chunkOld) lines.push(`-${r}`);
+    for (const a of chunkNew) lines.push(`+${a}`);
+    chunkOld = [];
+    chunkNew = [];
+    context = [];
+  };
+
+  for (let i = 0; i < maxLen; i++) {
+    const oldLine = i < oldLines.length ? oldLines[i] : undefined;
+    const newLine = i < newLines.length ? newLines[i] : undefined;
+
+    if (oldLine === newLine) {
+      if (chunkOld.length > 0 || chunkNew.length > 0) {
+        flushChunk();
+      }
+      if (oldLine !== undefined) {
+        context = [oldLine];
+      }
+      chunkStart = i + 1;
+    } else {
+      if (chunkOld.length === 0 && chunkNew.length === 0) {
+        chunkStart = i;
+      }
+      if (oldLine !== undefined) chunkOld.push(oldLine);
+      if (newLine !== undefined) chunkNew.push(newLine);
+    }
+  }
+
+  flushChunk();
+
+  return lines.join('\n');
+};
+
+export const generateCreateDiff = (filePath: string, content: string): string => {
+  const lines = content.split('\n');
+  const header = [
+    `--- /dev/null`,
+    `+++ b/${filePath}`,
+    `@@ -0,0 +1,${lines.length} @@`,
+  ];
+
+  return [...header, ...lines.map((l) => `+${l}`)].join('\n');
+};

package/src/domain/fixer/fix-history.ts

@@ -0,0 +1,23 @@
+import type { FixHistory, FixHistoryEntry } from './types.js';
+
+export const createEmptyHistory = (): FixHistory => ({ fixes: [] });
+
+export const addEntry = (history: FixHistory, entry: FixHistoryEntry): FixHistory => ({
+  fixes: [...history.fixes, entry],
+});
+
+export const markUndone = (history: FixHistory, id: number): FixHistory => ({
+  fixes: history.fixes.map((f) =>
+    f.id === id ? { ...f, status: 'undone' as const } : f,
+  ),
+});
+
+export const getLastApplied = (history: FixHistory): FixHistoryEntry | null => {
+  for (let i = history.fixes.length - 1; i >= 0; i--) {
+    if (history.fixes[i]!.status === 'applied') return history.fixes[i]!;
+  }
+  return null;
+};
+
+export const getById = (history: FixHistory, id: number): FixHistoryEntry | null =>
+  history.fixes.find((f) => f.id === id) ?? null;