mergen-server 1.4.0

package/dist/routes/ci-gate.js

@@ -0,0 +1,232 @@
+import { Router } from "express";
+import { getStores } from "../storage/store-registry.js";
+import { analyzeSemanticRisk } from "../intelligence/action-risk.js";
+import { postmortemStore } from "../intelligence/postmortem-store.js";
+import { evaluateEnterprisePolicy, isAiActor } from "../intelligence/enterprise-policy-engine.js";
+import { evaluateDiffSize } from "../intelligence/diff-size.js";
+import { serviceGraph } from "../sensor/service-graph.js";
+import logger from "../sensor/logger.js";
+function createCIGateRouter() {
+  const router = Router();
+  router.post("/ci/gate", async (req, res) => {
+    const body = req.body;
+    const files = Array.isArray(body.files) ? body.files : [];
+    const prTitle = typeof body.prTitle === "string" ? body.prTitle.slice(0, 300) : "";
+    const diff = typeof body.diff === "string" ? body.diff.slice(0, 2e4) : "";
+    const actor = typeof body.actor === "string" ? body.actor.slice(0, 100) : "unknown";
+    const diffStats = body.diffStats && typeof body.diffStats === "object" ? {
+      filesChanged: Number(body.diffStats.filesChanged) || 0,
+      additions: Number(body.diffStats.additions) || 0,
+      deletions: Number(body.diffStats.deletions) || 0
+    } : null;
+    const prNumber = typeof body.prNumber === "number" && Number.isFinite(body.prNumber) ? body.prNumber : null;
+    const repo = typeof body.repo === "string" ? body.repo.slice(0, 200) : null;
+    const sha = typeof body.sha === "string" ? body.sha.slice(0, 64) : null;
+    const service = inferService(body.service, files);
+    const inferredTags = inferTagsFromContext(files, prTitle);
+    const now = /* @__PURE__ */ new Date();
+    const dayOfWeek = now.getUTCDay();
+    const hourOfDay = now.getUTCHours();
+    const matchedRules = [];
+    const reasons = [];
+    let verdict = "pass";
+    for (const tag of inferredTags) {
+      const rules = await getStores().overrides.getRulesForTag(tag, service, req.tenantId);
+      for (const rule of rules) {
+        matchedRules.push(rule);
+        const timeMatch = await getStores().overrides.hasRecentOverride(tag, service, dayOfWeek, hourOfDay, req.tenantId);
+        const dayName = rule.dayOfWeek != null ? ["Sunday", "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday"][rule.dayOfWeek] : null;
+        const hourDesc = rule.hourWindow ? `${rule.hourWindow[0]}:00\u2013${rule.hourWindow[1]}:00 UTC` : null;
+        if (rule.occurrences >= 3 && timeMatch) {
+          verdict = "block";
+          reasons.push(
+            `Corpus block: \`${tag}\` has been overridden ${rule.occurrences}\xD7 (reason: ${rule.overrideReason})` + (dayName ? ` \u2014 typically on ${dayName}` : "") + (hourDesc ? ` ${hourDesc}` : "") + ". This matches your current time window."
+          );
+        } else if (rule.occurrences >= 1) {
+          if (verdict === "pass") verdict = "warn";
+          reasons.push(
+            `Corpus warning: \`${tag}\` has been overridden ${rule.occurrences}\xD7 (reason: ${rule.overrideReason})` + (dayName ? ` \u2014 pattern clusters on ${dayName}` : "") + "."
+          );
+        }
+      }
+    }
+    if (diff) {
+      const semantic = analyzeSemanticRisk(diff);
+      if (semantic.risk === "high") {
+        verdict = "block";
+        reasons.push(semantic.reason ?? "Blocked: destructive operation detected in diff. Review and replace with a reversible alternative before merging.");
+      } else if (semantic.risk === "medium" && verdict === "pass") {
+        verdict = "warn";
+        reasons.push(`Semantic risk MEDIUM: ${semantic.reason ?? "elevated-risk operation in diff"}`);
+      }
+    }
+    const enterpriseResult = evaluateEnterprisePolicy({
+      files,
+      actor,
+      service,
+      timestamp: Date.now()
+    });
+    if (enterpriseResult.triggeredRules.length > 0) {
+      if (enterpriseResult.verdict === "block") {
+        verdict = "block";
+      } else if (enterpriseResult.verdict === "warn" && verdict !== "block") {
+        verdict = "warn";
+      }
+      reasons.push(...enterpriseResult.reasons);
+    }
+    let diffSizeReport = null;
+    if (diffStats) {
+      diffSizeReport = evaluateDiffSize(diffStats, { actorIsAi: isAiActor(actor) });
+      if (diffSizeReport.requiresApproval) {
+        if (verdict !== "block") verdict = "warn";
+        reasons.push(`Diff size HIGH (${diffSizeReport.score}/100): ${diffSizeReport.recommendation}`);
+      } else if (diffSizeReport.level === "MEDIUM" && verdict === "pass") {
+        verdict = "warn";
+        reasons.push(`Diff size MEDIUM (${diffSizeReport.score}/100): ${diffSizeReport.recommendation}`);
+      }
+    }
+    const BLAST_RADIUS_THRESHOLD = 3;
+    const downstreamCount = service !== "unknown" ? serviceGraph.getUpstreamImpact(service).length : 0;
+    let blastRadiusEscalated = false;
+    if (verdict === "warn" && downstreamCount > BLAST_RADIUS_THRESHOLD && isAiActor(actor)) {
+      verdict = "block";
+      blastRadiusEscalated = true;
+      reasons.push(
+        `Blast radius: ${downstreamCount} downstream service(s) depend on \`${service}\` and the change was made by an AI actor \u2014 escalated from WARN to BLOCK.`
+      );
+    }
+    if (prTitle) {
+      const titleLower = prTitle.toLowerCase();
+      const summary = await getStores().overrides.getOverrideSummary(req.tenantId);
+      for (const entry of summary) {
+        if (titleLower.includes(entry.tag.replace(/_/g, " ")) || titleLower.includes(entry.tag.replace(/_/g, "-"))) {
+          if (verdict === "pass") verdict = "warn";
+          if (!reasons.some((r) => r.includes(entry.tag))) {
+            reasons.push(`PR title matches known override pattern: \`${entry.tag}\` (${entry.total} historical overrides)`);
+          }
+        }
+      }
+    }
+    const riskScore = computeRiskScore(verdict, matchedRules);
+    const recommendation = verdict === "block" ? "Review the override corpus before merging. This change touches areas your team has explicitly blocked in the past." : verdict === "warn" ? "Proceed with caution \u2014 this change touches areas with a history of operational overrides." : "No corpus conflicts found. Safe to merge based on execution history.";
+    logger.info({ verdict, riskScore, tags: inferredTags, service, actor, files: files.length }, "ci-gate: evaluated PR");
+    const lineHits = diff ? _linkDiffToDecisions(diff, matchedRules, reasons) : [];
+    await getStores().gateHistory.record(
+      { prNumber, repo, service, actor, verdict, riskScore, reasons, sha },
+      req.tenantId
+    );
+    res.json({
+      ok: true,
+      verdict,
+      riskScore,
+      reasons,
+      recommendation,
+      corpusMatches: matchedRules,
+      lineHits,
+      diffSize: diffSizeReport,
+      meta: {
+        service,
+        inferredTags,
+        filesChecked: files.length,
+        actor,
+        blastRadius: { downstreamCount, threshold: BLAST_RADIUS_THRESHOLD, escalated: blastRadiusEscalated }
+      }
+    });
+  });
+  return router;
+}
+function inferService(explicit, files) {
+  if (explicit && explicit.trim()) return explicit.trim();
+  for (const file of files) {
+    const match = file.match(/^(?:apps|services|packages|src)\/([^/]+)\//);
+    if (match) return match[1];
+  }
+  return "unknown";
+}
+function inferTagsFromContext(files, prTitle) {
+  const tags = /* @__PURE__ */ new Set();
+  const dbFiles = files.some((f) => /db|database|migration|pool|sequelize|prisma|knex|typeorm/i.test(f));
+  if (dbFiles) {
+    tags.add("infra_db_connection_pool");
+    tags.add("n_plus_one_query");
+  }
+  if (files.some((f) => /auth|jwt|session|token|oauth|passport/i.test(f))) {
+    tags.add("auth_token_not_persisted");
+  }
+  if (files.some((f) => /cache|redis|memcache|memory|heap/i.test(f))) {
+    tags.add("oom_kill");
+  }
+  if (files.some((f) => /rate.?limit|throttl/i.test(f))) {
+    tags.add("rate_limit_cascade");
+  }
+  if (files.some((f) => /deploy|dockerfile|k8s|helm|\.yml|\.yaml|\.tf/i.test(f))) {
+    tags.add("deploy_config_drift");
+  }
+  const titleLower = prTitle.toLowerCase();
+  if (/pool|connection/.test(titleLower)) tags.add("infra_db_connection_pool");
+  if (/auth|token|session/.test(titleLower)) tags.add("auth_token_not_persisted");
+  if (/memory|oom|heap/.test(titleLower)) tags.add("oom_kill");
+  if (/rate.?limit|throttl/.test(titleLower)) tags.add("rate_limit_cascade");
+  if (/deploy|rollout|release/.test(titleLower)) tags.add("deploy_config_drift");
+  try {
+    const tagStats = postmortemStore.tagStats();
+    for (const { tag } of tagStats.slice(0, 20)) {
+      const tagSlug = tag.replace(/^infra_/, "").replace(/_/g, "");
+      if (files.some((f) => f.toLowerCase().replace(/[^a-z]/g, "").includes(tagSlug))) {
+        tags.add(tag);
+      }
+    }
+  } catch {
+  }
+  return [...tags];
+}
+function computeRiskScore(verdict, rules) {
+  if (verdict === "block") return Math.min(100, 70 + rules.length * 5);
+  if (verdict === "warn") return Math.min(69, 30 + rules.length * 10);
+  return Math.max(0, 10 - rules.length * 2);
+}
+function _linkDiffToDecisions(diff, matchedRules, reasons) {
+  const lines = diff.split("\n");
+  const hits = [];
+  const patterns = [];
+  for (const rule of matchedRules) {
+    const tag = rule.incidentTag ?? "";
+    const slug = tag.replace(/_/g, "[-_\\s]").replace(/\//g, "\\/");
+    if (slug) patterns.push({ pattern: new RegExp(slug, "i"), reason: `Corpus rule: ${tag} (${rule.overrideReason})` });
+  }
+  const semanticKeywords = [
+    { re: /DROP\s+TABLE|TRUNCATE|DELETE\s+FROM(?!\s+\w+\s+WHERE)/i, reason: "Destructive SQL operation" },
+    { re: /terraform\s+destroy|aws\s+s3\s+rm/i, reason: "Destructive infrastructure command" },
+    { re: /rm\s+-rf/i, reason: "Destructive filesystem command" },
+    { re: /ALTER\s+TABLE/i, reason: "Schema mutation" },
+    { re: /process\.env\.\w*(SECRET|KEY|TOKEN|PASS|PWD)/i, reason: "Potential secret exposure" },
+    { re: /kubectl\s+delete\s+namespace/i, reason: "Cluster-scope kubectl delete" }
+  ];
+  for (const kw of semanticKeywords) {
+    patterns.push({ pattern: kw.re, reason: kw.reason });
+  }
+  let lineNumber = 0;
+  for (const line of lines) {
+    lineNumber++;
+    if (!line.startsWith("+") || line.startsWith("+++")) continue;
+    const content = line.slice(1);
+    for (const { pattern, reason } of patterns) {
+      if (pattern.test(content)) {
+        if (!hits.some((h) => h.lineNumber === lineNumber)) {
+          hits.push({
+            lineNumber,
+            lineContent: content.slice(0, 200).trim(),
+            matchedPattern: pattern.source.slice(0, 80),
+            reason
+          });
+        }
+        break;
+      }
+    }
+    if (hits.length >= 20) break;
+  }
+  return hits;
+}
+export {
+  createCIGateRouter
+};

package/dist/routes/ci.js

@@ -0,0 +1,293 @@
+import { Router } from "express";
+import { store } from "../sensor/buffer.js";
+import logger from "../sensor/logger.js";
+function createCIRouter() {
+  const router = Router();
+  router.post("/ci/github", (req, res) => {
+    try {
+      const body = req.body;
+      const eventType = req.headers["x-github-event"];
+      let event = null;
+      if (eventType === "workflow_run" || body.workflow_run) {
+        const wr = body.workflow_run ?? body;
+        const sha = String(wr.head_sha ?? wr.sha ?? "");
+        event = {
+          type: "ci",
+          provider: "github_actions",
+          sha,
+          shortSha: sha.slice(0, 7),
+          branch: String(wr.head_branch ?? wr.branch ?? ""),
+          workflow: String(wr.name ?? wr.workflow ?? "workflow"),
+          job: String(wr.name ?? "run"),
+          status: normalizeGitHubStatus(String(wr.conclusion ?? wr.status ?? "unknown")),
+          durationMs: computeGitHubDuration(wr),
+          url: String(wr.html_url ?? wr.url ?? ""),
+          failedTests: [],
+          timestamp: parseGitHubTs(wr.updated_at ?? wr.created_at) ?? Date.now()
+        };
+      }
+      if (eventType === "check_run" || body.check_run) {
+        const cr = body.check_run ?? body;
+        const sha = String(cr.head_sha ?? "");
+        event = {
+          type: "ci",
+          provider: "github_actions",
+          sha,
+          shortSha: sha.slice(0, 7),
+          branch: "",
+          workflow: String(cr.app?.name ?? "GitHub"),
+          job: String(cr.name ?? "check"),
+          status: normalizeGitHubStatus(String(cr.conclusion ?? cr.status ?? "unknown")),
+          durationMs: computeGitHubDuration(cr),
+          url: String(cr.html_url ?? ""),
+          failedTests: [],
+          timestamp: parseGitHubTs(cr.completed_at ?? cr.started_at) ?? Date.now()
+        };
+      }
+      if (!event && body.sha) {
+        const sha = String(body.sha);
+        event = {
+          type: "ci",
+          provider: "github_actions",
+          sha,
+          shortSha: sha.slice(0, 7),
+          branch: String(body.branch ?? ""),
+          workflow: String(body.workflow ?? "workflow"),
+          job: String(body.job ?? "job"),
+          status: normalizeGitHubStatus(String(body.status ?? "unknown")),
+          durationMs: typeof body.duration_ms === "number" ? body.duration_ms : void 0,
+          url: String(body.url ?? body.run_url ?? ""),
+          failedTests: parseFailedTests(body.failed_tests),
+          timestamp: Date.now()
+        };
+      }
+      if (!event) {
+        res.status(400).json({ error: "unrecognised GitHub event shape" });
+        return;
+      }
+      store.push(event);
+      logger.info({ sha: event.sha.slice(0, 7), status: event.status, job: event.job }, "ci: github event ingested");
+      res.json({ ok: true, sha: event.sha, status: event.status });
+    } catch (err) {
+      logger.warn({ err }, "ci/github: parse error");
+      res.status(400).json({ error: "parse error" });
+    }
+  });
+  router.post("/ci/gitlab", (req, res) => {
+    try {
+      const body = req.body;
+      const sha = String(body.sha ?? body.checkout_sha ?? "");
+      const statusRaw = String(body.status ?? body.build_status ?? "unknown");
+      const event = {
+        type: "ci",
+        provider: "gitlab_ci",
+        sha,
+        shortSha: sha.slice(0, 7),
+        branch: String(body.ref ?? body.branch ?? "").replace("refs/heads/", ""),
+        workflow: String(body.pipeline?.name ?? body.project?.name ?? "pipeline"),
+        job: String(body.build_name ?? body.name ?? "job"),
+        status: normalizeGitLabStatus(statusRaw),
+        url: String(body.build_url ?? body.pipeline?.url ?? ""),
+        failedTests: parseFailedTests(body.failed_tests),
+        timestamp: Date.now()
+      };
+      store.push(event);
+      res.json({ ok: true, sha: event.sha, status: event.status });
+    } catch (err) {
+      logger.warn({ err }, "ci/gitlab: parse error");
+      res.status(400).json({ error: "parse error" });
+    }
+  });
+  router.post("/ci/azure-devops", (req, res) => {
+    try {
+      const body = req.body;
+      const resource = body.resource ?? body;
+      const eventType = String(body.eventType ?? body.event ?? "");
+      if (eventType && eventType !== "build.complete" && eventType !== "ms.vss-build.build-completed-event") {
+        res.json({ ok: true, skipped: true, reason: `eventType ${eventType} not processed` });
+        return;
+      }
+      const sha = String(resource.sourceVersion ?? resource.sourceVersionId ?? resource.commitId ?? "");
+      const definition = resource.definition ?? resource.plan ?? {};
+      const project = resource.project ?? body.resourceContainers?.project ?? {};
+      const links = resource._links ?? {};
+      const resultRaw = String(resource.result ?? resource.buildResult ?? "unknown").toLowerCase();
+      const status = resultRaw === "succeeded" ? "success" : resultRaw === "failed" || resultRaw === "partiallySucceeded" ? "failure" : resultRaw === "canceled" || resultRaw === "cancelled" ? "cancelled" : "failure";
+      const startMs = resource.startTime ? new Date(String(resource.startTime)).getTime() : null;
+      const finishMs = resource.finishTime ? new Date(String(resource.finishTime)).getTime() : null;
+      const durationMs = startMs && finishMs && finishMs > startMs ? finishMs - startMs : void 0;
+      const event = {
+        type: "ci",
+        provider: "azure_devops",
+        sha,
+        shortSha: sha.slice(0, 7),
+        branch: String(resource.sourceBranch ?? resource.branch ?? "").replace("refs/heads/", ""),
+        workflow: String(project.name ?? definition.name ?? "pipeline"),
+        job: String(resource.buildNumber ?? definition.name ?? "build"),
+        status,
+        durationMs,
+        url: links.web?.href ?? String(resource.url ?? resource.buildUrl ?? ""),
+        failedTests: [],
+        timestamp: finishMs ?? Date.now()
+      };
+      store.push(event);
+      logger.info({ sha: event.sha.slice(0, 7), status: event.status }, "ci/azure-devops: event ingested");
+      res.json({ ok: true, sha: event.sha, status: event.status });
+    } catch (err) {
+      logger.warn({ err }, "ci/azure-devops: parse error");
+      res.status(400).json({ error: "parse error" });
+    }
+  });
+  router.post("/ci/jenkins", (req, res) => {
+    try {
+      const body = req.body;
+      const build = body.build ?? body;
+      const scm = build.scm ?? {};
+      const phase = String(build.phase ?? "").toUpperCase();
+      if (phase && phase !== "COMPLETED" && phase !== "FINISHED") {
+        res.json({ ok: true, skipped: true, reason: `phase ${phase} not processed` });
+        return;
+      }
+      const sha = String(scm.commit ?? scm.sha ?? build.sha ?? "");
+      const statusRaw = String(build.status ?? build.result ?? "UNKNOWN").toUpperCase();
+      const status = statusRaw === "SUCCESS" ? "success" : statusRaw === "FAILURE" || statusRaw === "FAILED" ? "failure" : statusRaw === "ABORTED" ? "cancelled" : statusRaw === "UNSTABLE" ? "failure" : "failure";
+      const event = {
+        type: "ci",
+        provider: "jenkins",
+        sha,
+        shortSha: sha.slice(0, 7),
+        branch: String(scm.branch ?? build.branch ?? "").replace("refs/heads/", ""),
+        workflow: String(body.name ?? body.job ?? "pipeline"),
+        job: `${body.name ?? "build"} #${build.number ?? "?"}`,
+        status,
+        durationMs: typeof build.duration === "number" ? build.duration : void 0,
+        url: String(build.full_url ?? build.url ?? ""),
+        failedTests: parseFailedTests(build.test_summary ?? build.failedTests),
+        timestamp: Date.now()
+      };
+      store.push(event);
+      logger.info({ sha: event.sha.slice(0, 7), status: event.status }, "ci/jenkins: event ingested");
+      res.json({ ok: true, sha: event.sha, status: event.status });
+    } catch (err) {
+      logger.warn({ err }, "ci/jenkins: parse error");
+      res.status(400).json({ error: "parse error" });
+    }
+  });
+  router.post("/ci/generic", (req, res) => {
+    try {
+      const body = req.body;
+      if (!body.sha || !body.status) {
+        res.status(400).json({ error: "sha and status are required" });
+        return;
+      }
+      const sha = String(body.sha);
+      const event = {
+        type: "ci",
+        provider: body.provider ?? "unknown",
+        sha,
+        shortSha: sha.slice(0, 7),
+        branch: String(body.branch ?? ""),
+        workflow: String(body.workflow ?? ""),
+        job: String(body.job ?? "job"),
+        status: normalizeGenericStatus(String(body.status)),
+        durationMs: typeof body.duration_ms === "number" ? body.duration_ms : void 0,
+        url: String(body.url ?? ""),
+        failedTests: parseFailedTests(body.failed_tests),
+        timestamp: Date.now()
+      };
+      store.push(event);
+      res.json({ ok: true, sha: event.sha, status: event.status });
+    } catch (err) {
+      logger.warn({ err }, "ci/generic: parse error");
+      res.status(400).json({ error: "parse error" });
+    }
+  });
+  router.post("/deployments", (req, res) => {
+    try {
+      const body = req.body;
+      if (!body.sha || !body.environment || !body.status) {
+        res.status(400).json({ error: "sha, environment, and status are required" });
+        return;
+      }
+      const sha = String(body.sha);
+      const event = {
+        type: "deployment",
+        environment: String(body.environment),
+        sha,
+        shortSha: sha.slice(0, 7),
+        version: String(body.version ?? body.tag ?? ""),
+        service: String(body.service ?? body.app ?? ""),
+        status: normalizeDeployStatus(String(body.status)),
+        url: String(body.url ?? ""),
+        actor: String(body.actor ?? body.deployer ?? ""),
+        timestamp: Date.now()
+      };
+      store.push(event);
+      logger.info(
+        { sha: event.sha.slice(0, 7), env: event.environment, status: event.status },
+        "ci: deployment event ingested"
+      );
+      res.json({ ok: true, sha: event.sha, environment: event.environment, status: event.status });
+    } catch (err) {
+      logger.warn({ err }, "deployments: parse error");
+      res.status(400).json({ error: "parse error" });
+    }
+  });
+  return router;
+}
+function normalizeGitHubStatus(s) {
+  if (s === "success") return "success";
+  if (s === "failure" || s === "timed_out" || s === "startup_failure") return "failure";
+  if (s === "cancelled") return "cancelled";
+  if (s === "skipped" || s === "neutral") return "skipped";
+  return "failure";
+}
+function normalizeGitLabStatus(s) {
+  if (s === "success" || s === "passed") return "success";
+  if (s === "failed") return "failure";
+  if (s === "canceled") return "cancelled";
+  if (s === "skipped") return "skipped";
+  return "failure";
+}
+function normalizeGenericStatus(s) {
+  const lower = s.toLowerCase();
+  if (lower === "success" || lower === "pass" || lower === "passed") return "success";
+  if (lower === "failure" || lower === "fail" || lower === "failed") return "failure";
+  if (lower === "cancelled" || lower === "canceled") return "cancelled";
+  if (lower === "skipped") return "skipped";
+  return "failure";
+}
+function normalizeDeployStatus(s) {
+  const lower = s.toLowerCase();
+  if (lower === "started" || lower === "in_progress") return "started";
+  if (lower === "success" || lower === "deployed") return "success";
+  if (lower === "failure" || lower === "failed") return "failure";
+  if (lower === "rollback") return "rollback";
+  return "started";
+}
+function computeGitHubDuration(obj) {
+  const start = parseGitHubTs(obj.run_started_at ?? obj.started_at ?? obj.created_at);
+  const end = parseGitHubTs(obj.updated_at ?? obj.completed_at);
+  if (start && end && end > start) return end - start;
+  return void 0;
+}
+function parseGitHubTs(val) {
+  if (!val) return null;
+  const d = new Date(String(val));
+  return isNaN(d.getTime()) ? null : d.getTime();
+}
+function parseFailedTests(val) {
+  if (!Array.isArray(val)) return [];
+  return val.slice(0, 50).map((t) => {
+    if (typeof t === "string") return { name: t };
+    const obj = t;
+    return {
+      name: String(obj.name ?? obj.title ?? "unknown"),
+      error: obj.error ? String(obj.error) : void 0,
+      file: obj.file ? String(obj.file) : void 0
+    };
+  });
+}
+export {
+  createCIRouter
+};

package/dist/routes/compliance-report.js

@@ -0,0 +1,24 @@
+import { Router } from "express";
+import { buildComplianceReport, renderComplianceHtml } from "../intelligence/compliance-report.js";
+function createComplianceReportRouter() {
+  const router = Router();
+  router.get("/compliance/report", async (req, res) => {
+    const now = Date.now();
+    const format = (req.query.format ?? "json").toLowerCase();
+    const from = Number(req.query.from ?? now - 30 * 24 * 60 * 60 * 1e3);
+    const to = Number(req.query.to ?? now);
+    const report = await buildComplianceReport(from, to);
+    if (format === "html") {
+      res.setHeader("Content-Type", "text/html; charset=utf-8");
+      res.setHeader("Content-Security-Policy", "default-src 'none'; style-src 'unsafe-inline'");
+      res.setHeader("Cache-Control", "no-store");
+      res.send(renderComplianceHtml(report));
+      return;
+    }
+    res.json({ ok: true, report });
+  });
+  return router;
+}
+export {
+  createComplianceReportRouter
+};

package/dist/routes/confidence.js

@@ -0,0 +1,30 @@
+import { Router } from "express";
+import { confidenceStore, ConfidenceReportSchema } from "../intelligence/confidence-report.js";
+function createConfidenceRouter() {
+  const router = Router();
+  router.post("/confidence-reports", (req, res) => {
+    const parsed = ConfidenceReportSchema.safeParse(req.body);
+    if (!parsed.success) {
+      res.status(400).json({ error: "validation failed", details: parsed.error.issues });
+      return;
+    }
+    const report = confidenceStore.add(parsed.data);
+    res.status(201).json({ ok: true, report });
+  });
+  router.get("/confidence-reports", (req, res) => {
+    const limit = Math.min(100, Math.max(1, Number(req.query.limit ?? 20)));
+    res.json({ ok: true, reports: confidenceStore.list(limit) });
+  });
+  router.get("/confidence-reports/:id", (req, res) => {
+    const report = confidenceStore.get(req.params.id);
+    if (!report) {
+      res.status(404).json({ error: "report not found" });
+      return;
+    }
+    res.json({ ok: true, report });
+  });
+  return router;
+}
+export {
+  createConfidenceRouter
+};