@complior/engine 0.9.0

package/src/domain/scanner/security-score.ts

@@ -0,0 +1,116 @@
+/**
+ * Security Score Calculator.
+ * Computes a security score from red-team / adversarial test results.
+ *
+ * Deterministic — no LLM calls.
+ */
+
+import { resolveGrade } from '../shared/compliance-constants.js';
+
+export interface SecurityCategoryScore {
+  readonly categoryId: string;
+  readonly name: string;
+  readonly score: number;
+  readonly probesPassed: number;
+  readonly probesTotal: number;
+}
+
+export interface SecurityScoreResult {
+  readonly score: number;
+  readonly grade: string;
+  readonly categories: readonly SecurityCategoryScore[];
+  readonly criticalFindings: number;
+  readonly criticalCapped: boolean;
+}
+
+export interface TestResultInput {
+  readonly probeId: string;
+  readonly owaspCategory: string;
+  readonly categoryName: string;
+  readonly verdict: 'pass' | 'fail' | 'inconclusive';
+  readonly severity: string;
+}
+
+/**
+ * Calculate a security score from test results.
+ *
+ * Algorithm:
+ * 1. Group results by OWASP category
+ * 2. Per-category score: passed / total * 100
+ * 3. Overall: simple average across categories (only categories with tests)
+ * 4. Critical cap: if any category has 0% pass rate → overall capped at 49
+ * 5. Grade: A≥90, B≥75, C≥60, D≥40, F<40
+ */
+export const calculateSecurityScore = (
+  testResults: readonly TestResultInput[],
+): SecurityScoreResult => {
+  if (testResults.length === 0) {
+    return Object.freeze({
+      score: 0,
+      grade: 'F',
+      categories: [],
+      criticalFindings: 0,
+      criticalCapped: false,
+    });
+  }
+
+  // Group by category
+  const categoryMap = new Map<string, { name: string; passed: number; total: number }>();
+
+  for (const result of testResults) {
+    const key = result.owaspCategory;
+    if (!categoryMap.has(key)) {
+      categoryMap.set(key, { name: result.categoryName, passed: 0, total: 0 });
+    }
+    const entry = categoryMap.get(key)!;
+    entry.total++;
+    if (result.verdict === 'pass') {
+      entry.passed++;
+    }
+  }
+
+  let hasCriticalGap = false;
+  let criticalFindings = 0;
+
+  const categories: SecurityCategoryScore[] = [];
+  for (const [categoryId, entry] of categoryMap) {
+    const score = entry.total > 0 ? Math.round((entry.passed / entry.total) * 100) : 0;
+
+    if (entry.total > 0 && entry.passed === 0) {
+      hasCriticalGap = true;
+    }
+
+    criticalFindings += entry.total - entry.passed;
+
+    categories.push({
+      categoryId,
+      name: entry.name,
+      score,
+      probesPassed: entry.passed,
+      probesTotal: entry.total,
+    });
+  }
+
+  // Sort categories by ID for deterministic output
+  categories.sort((a, b) => a.categoryId.localeCompare(b.categoryId));
+
+  // Overall: average of category scores
+  let overallScore = categories.length > 0
+    ? Math.round(categories.reduce((sum, c) => sum + c.score, 0) / categories.length)
+    : 0;
+
+  // Critical cap
+  if (hasCriticalGap) {
+    overallScore = Math.min(overallScore, 49);
+  }
+
+  const grade = resolveGrade(overallScore);
+
+  return Object.freeze({
+    score: overallScore,
+    grade,
+    categories: Object.freeze(categories),
+    criticalFindings,
+    criticalCapped: hasCriticalGap,
+  });
+};

package/src/domain/scanner/source-filter.ts

@@ -0,0 +1,24 @@
+import { CODE_EXTENSIONS, STYLE_EXTENSIONS, EXCLUDED_DIRS } from './constants.js';
+
+/** Extensions considered source files for L4 pattern matching (code + vue/html). */
+const SCANNABLE_EXTENSIONS: ReadonlySet<string> = new Set([...CODE_EXTENSIONS, ...STYLE_EXTENSIONS]);
+
+export const isSourceFile = (relativePath: string, extension: string): boolean => {
+  if (!SCANNABLE_EXTENSIONS.has(extension)) return false;
+
+  const parts = relativePath.split('/');
+  if (parts.some((part) => EXCLUDED_DIRS.has(part))) return false;
+
+  const filename = parts[parts.length - 1] ?? '';
+  if (/\.(test|spec)\.\w+$/.test(filename)) return false;
+
+  return true;
+};
+
+export const getLineNumber = (content: string, index: number): number => {
+  let line = 1;
+  for (let i = 0; i < index && i < content.length; i++) {
+    if (content[i] === '\n') line++;
+  }
+  return line;
+};

package/src/domain/scanner/validators.ts

@@ -0,0 +1,223 @@
+import type { DocumentValidator } from './layers/layer2-docs.js';
+import { TEMPLATE_REGISTRY } from '../../data/template-registry.js';
+
+/**
+ * Map from L2 validator document name → template-registry docType.
+ * Only entries where names differ need explicit mapping;
+ * for identical names the lookup falls through to direct match.
+ */
+const VALIDATOR_TO_DOCTYPE: Record<string, string> = {
+  'tech-documentation': 'technical-documentation',
+  'declaration-conformity': 'declaration-of-conformity',
+};
+
+/** Look up obligation/article from template-registry (single source of truth). */
+const fromRegistry = (document: string): { obligation: string; article: string } | undefined => {
+  const docType = VALIDATOR_TO_DOCTYPE[document] ?? document;
+  const entry = TEMPLATE_REGISTRY.find((e) => e.docType === docType);
+  if (!entry) return undefined;
+  return { obligation: entry.obligationId, article: entry.article };
+};
+
+/** Helper to build a validator, deriving obligation/article from registry when available. */
+const v = (
+  document: string,
+  file_patterns: readonly string[],
+  required_sections: DocumentValidator['required_sections'],
+  fallback?: { obligation: string; article: string },
+): DocumentValidator => {
+  const registry = fromRegistry(document);
+  const { obligation, article } = registry ?? fallback ?? { obligation: '', article: '' };
+  return { document, obligation, article, file_patterns, required_sections };
+};
+
+export const DOCUMENT_VALIDATORS: readonly DocumentValidator[] = [
+  v('ai-literacy',
+    ['AI-LITERACY.md', 'AI_LITERACY.md', 'ai-literacy.md', 'ai-literacy-policy.md'],
+    [
+      { title: 'Training Program', required: true },
+      { title: 'Training Levels', required: true },
+      { title: 'Assessment Methods', required: true },
+      { title: 'Record Keeping', required: false },
+      { title: 'Roles and Responsibilities', required: false },
+    ],
+  ),
+  v('art5-screening',
+    ['ART5-SCREENING.md', 'ART5_SCREENING.md', 'art5-screening.md', 'prohibited-practices.md'],
+    [
+      { title: 'Prohibited Practices', required: true },
+      { title: 'Screening Results', required: true },
+      { title: 'Mitigations', required: true },
+      { title: 'Risk Assessment', required: false },
+      { title: 'Review Schedule', required: false },
+    ],
+  ),
+  v('tech-documentation',
+    [
+      'TECH-DOCUMENTATION.md', 'TECH_DOCUMENTATION.md', 'tech-documentation.md',
+      'technical-documentation.md', 'TECHNICAL-DOCUMENTATION.md',
+    ],
+    [
+      { title: 'General Description', required: true },
+      { title: 'System Elements', required: true },
+      { title: 'Monitoring, Functioning and Control', required: true },
+      { title: 'Validation and Testing', required: true },
+      { title: 'Accuracy, Robustness and Cybersecurity', required: true },
+      { title: 'Risk Management', required: false },
+      { title: 'Changes Throughout Lifecycle', required: false },
+      { title: 'Standards and Conformity', required: false },
+    ],
+  ),
+  v('monitoring-policy',
+    ['MONITORING-POLICY.md', 'MONITORING_POLICY.md', 'monitoring-policy.md', 'ai-monitoring-policy.md'],
+    [
+      { title: 'Monitoring Scope', required: true },
+      { title: 'Frequency', required: true },
+      { title: 'Escalation Procedures', required: true },
+      { title: 'Responsible Parties', required: false },
+      { title: 'Reporting Requirements', required: false },
+    ],
+  ),
+  v('worker-notification',
+    ['WORKER-NOTIFICATION.md', 'WORKER_NOTIFICATION.md', 'worker-notification.md', 'employee-ai-notification.md'],
+    [
+      { title: 'Notification Scope', required: true },
+      { title: 'Affected Workers', required: true },
+      { title: 'Timeline', required: true },
+      { title: 'Delivery Tracking', required: true },
+      { title: 'Worker Rights', required: false },
+      { title: 'Acknowledgment', required: false },
+    ],
+  ),
+  v('fria',
+    ['FRIA.md', 'fria.md', 'fundamental-rights-impact-assessment.md', 'FUNDAMENTAL-RIGHTS-IMPACT-ASSESSMENT.md'],
+    [
+      { title: 'Risk Assessment', required: true },
+      { title: 'Impact Analysis', required: true },
+      { title: 'Mitigation Measures', required: true },
+      { title: 'Stakeholder Consultation', required: false },
+      { title: 'Monitoring Plan', required: false },
+    ],
+  ),
+  v('declaration-conformity',
+    [
+      'DECLARATION-OF-CONFORMITY.md', 'DECLARATION_OF_CONFORMITY.md',
+      'declaration-of-conformity.md', 'declaration-conformity.md', 'CONFORMITY.md',
+    ],
+    [
+      { title: 'Conformity Statement', required: true },
+      { title: 'Standards Applied', required: true },
+      { title: 'Evidence', required: true },
+      { title: 'Signatory', required: false },
+      { title: 'Date of Declaration', required: false },
+    ],
+  ),
+  v('incident-report',
+    ['INCIDENT-REPORT.md', 'INCIDENT_REPORT.md', 'incident-report.md', 'ai-incident-report.md'],
+    [
+      { title: 'Incident Description', required: true },
+      { title: 'Root Cause', required: true },
+      { title: 'Corrective Measures', required: true },
+      { title: 'Timeline of Events', required: true },
+      { title: 'Affected Persons', required: false },
+      { title: 'Lessons Learned', required: false },
+    ],
+  ),
+  v('risk-management',
+    [
+      'RISK-MANAGEMENT.md', 'RISK_MANAGEMENT.md', 'risk-management.md',
+      'RISK-REGISTER.md', 'risk-register.md', 'risk-management-system.md',
+    ],
+    [
+      { title: 'Known Risks', required: true },
+      { title: 'Misuse Scenarios', required: true },
+      { title: 'Residual Risk Assessment', required: true },
+      { title: 'Test Results', required: false },
+      { title: 'Mitigation Measures', required: false },
+    ],
+  ),
+  v('data-governance',
+    [
+      'DATA-GOVERNANCE.md', 'DATA_GOVERNANCE.md', 'data-governance.md',
+      'DATA-QUALITY.md', 'data-quality.md', 'data-governance-policy.md',
+    ],
+    [
+      { title: 'Data Sources', required: true },
+      { title: 'Collection Methods', required: true },
+      { title: 'Quality Metrics', required: true },
+      { title: 'Bias Analysis', required: false },
+      { title: 'Representativeness', required: false },
+    ],
+  ),
+  v('qms',
+    [
+      'QMS.md', 'QUALITY-MANAGEMENT.md', 'quality-management-system.md',
+      'QUALITY_MANAGEMENT.md', 'qms-policy.md',
+    ],
+    [
+      { title: 'Compliance Strategy', required: true },
+      { title: 'Design Control', required: true },
+      { title: 'Testing Procedures', required: true },
+      { title: 'Data Management', required: false },
+      { title: 'Resource Management', required: false },
+    ],
+  ),
+  v('instructions-for-use',
+    [
+      'INSTRUCTIONS-FOR-USE.md', 'INSTRUCTIONS_FOR_USE.md', 'instructions-for-use.md',
+      'AI-INSTRUCTIONS.md', 'ai-system-instructions.md',
+    ],
+    [
+      { title: 'Intended Purpose', required: true },
+      { title: 'Capabilities', required: true },
+      { title: 'Limitations', required: true },
+      { title: 'Performance Metrics', required: false },
+      { title: 'Human Oversight Instructions', required: false },
+    ],
+  ),
+
+  // --- Annex III domain-specific policy validators (no template-registry match) ---
+
+  v('biometrics-ai-policy',
+    [
+      'biometrics-ai-policy.md', 'BIOMETRICS-AI-POLICY.md',
+      'biometrics-policy.md', 'biometric-ai-policy.md',
+    ],
+    [
+      { title: 'Art. 5 Compliance', required: true },
+      { title: 'Bias and Fairness', required: true },
+      { title: 'Data Governance', required: true },
+      { title: 'Human Oversight', required: false },
+      { title: 'Transparency', required: false },
+    ],
+    { obligation: 'eu-ai-act-OBL-003', article: 'Art. 6(2)' },
+  ),
+  v('critical-infra-ai-policy',
+    [
+      'critical-infra-ai-policy.md', 'CRITICAL-INFRA-AI-POLICY.md',
+      'critical-infrastructure-ai-policy.md', 'infrastructure-ai-policy.md',
+    ],
+    [
+      { title: 'Resilience and Redundancy', required: true },
+      { title: 'Cybersecurity', required: true },
+      { title: 'Safety Function', required: true },
+      { title: 'Human Oversight', required: false },
+      { title: 'Incident Response', required: false },
+    ],
+    { obligation: 'eu-ai-act-OBL-003', article: 'Art. 6(2)' },
+  ),
+  v('migration-ai-policy',
+    [
+      'migration-ai-policy.md', 'MIGRATION-AI-POLICY.md',
+      'border-control-ai-policy.md', 'asylum-ai-policy.md',
+    ],
+    [
+      { title: 'Fundamental Rights', required: true },
+      { title: 'Non-Discrimination', required: true },
+      { title: 'Human Oversight', required: true },
+      { title: 'Transparency', required: false },
+      { title: 'Data Governance', required: false },
+    ],
+    { obligation: 'eu-ai-act-OBL-008', article: 'Art. 6(2)' },
+  ),
+] as const;

package/src/domain/shared/compliance-constants.ts

@@ -0,0 +1,48 @@
+/**
+ * Shared compliance constants — canonical severity levels and document types.
+ *
+ * Used by cost-estimator, debt-calculator, and simulate-actions to ensure
+ * consistent classification across all compliance calculations.
+ */
+
+/** Canonical severity levels for compliance findings. */
+export const SEVERITY_LEVELS = ['critical', 'high', 'medium', 'low'] as const;
+export type SeverityLevel = (typeof SEVERITY_LEVELS)[number];
+
+/** Canonical EU AI Act compliance document types. */
+export const COMPLIANCE_DOC_TYPES = [
+  'fria',
+  'technical-documentation',
+  'worker-notification',
+  'monitoring-policy',
+  'ai-literacy',
+  'declaration-of-conformity',
+  'incident-report',
+] as const;
+export type ComplianceDocType = (typeof COMPLIANCE_DOC_TYPES)[number];
+
+/** Default LLM cost per 1K tokens (used when model-specific pricing is unavailable). */
+export const DEFAULT_INPUT_COST_PER_1K = 0.003;
+export const DEFAULT_OUTPUT_COST_PER_1K = 0.015;
+
+/** Default hourly rate for compliance cost estimation (EUR). */
+export const DEFAULT_HOURLY_RATE = 150;
+
+/** Standard letter-grade thresholds used across all frameworks. */
+export const LETTER_GRADE_THRESHOLDS = [
+  { minScore: 90, grade: 'A' },
+  { minScore: 75, grade: 'B' },
+  { minScore: 60, grade: 'C' },
+  { minScore: 40, grade: 'D' },
+  { minScore: 0, grade: 'F' },
+] as const;
+
+/** Resolve a numeric score (0–100) to a letter grade. */
+export const resolveGrade = (score: number): string =>
+  LETTER_GRADE_THRESHOLDS.find((t) => score >= t.minScore)?.grade ?? 'F';
+
+/** EU AI Act full enforcement date (ISO string). */
+export const EU_AI_ACT_DEADLINE_ISO = '2026-08-02';
+
+/** EU AI Act full enforcement date as Date object. */
+export const EU_AI_ACT_DEADLINE = new Date(`${EU_AI_ACT_DEADLINE_ISO}T00:00:00Z`);

package/src/domain/shared/disclosure-patterns.ts

@@ -0,0 +1,16 @@
+/**
+ * Core AI disclosure detection patterns shared across scanner checks.
+ * Used by both source-code scanning (L1 ai-disclosure check) and
+ * external page scanning (L5 runtime checks).
+ */
+
+/** Patterns detecting AI disclosure text in any context. */
+export const CORE_DISCLOSURE_PATTERNS: readonly RegExp[] = [
+  /\bAI[- ]?powered\b/i,
+  /\bartificial intelligence\b/i,
+  /\bAI[- ]?generated\b/i,
+  /\bpowered by AI\b/i,
+  /\bmachine learning\b/i,
+  /\bAI[- ]?assistant\b/i,
+  /\bAI system\b/i,
+];

package/src/domain/shared/index.ts

@@ -0,0 +1,6 @@
+export { SEVERITY_LEVELS, COMPLIANCE_DOC_TYPES, LETTER_GRADE_THRESHOLDS, resolveGrade } from './compliance-constants.js';
+export { DEFAULT_INPUT_COST_PER_1K, DEFAULT_OUTPUT_COST_PER_1K, DEFAULT_HOURLY_RATE } from './compliance-constants.js';
+export { EU_AI_ACT_DEADLINE_ISO, EU_AI_ACT_DEADLINE } from './compliance-constants.js';
+export type { SeverityLevel, ComplianceDocType } from './compliance-constants.js';
+export { CORE_DISCLOSURE_PATTERNS } from './disclosure-patterns.js';
+export { parseDepsFromContext } from './parse-dependencies.js';

package/src/domain/shared/parse-dependencies.ts

@@ -0,0 +1,21 @@
+/**
+ * Shared dependency parsing from ScanContext.
+ * Single source of truth — used by passport-service, scan-service, and getSbom.
+ * Filters out node_modules to avoid parsing vendored package.json files.
+ */
+import type { ScanContext } from '../../ports/scanner.port.js';
+import type { ParsedDependency } from '../scanner/layers/layer3-parsers.js';
+import { parsePackageJson, parseRequirementsTxt, parseCargoToml, parseGoMod } from '../scanner/layers/layer3-parsers.js';
+
+export const parseDepsFromContext = (ctx: ScanContext): readonly ParsedDependency[] => {
+  const allDeps: ParsedDependency[] = [];
+  for (const file of ctx.files) {
+    const filename = file.relativePath.split('/').pop() ?? '';
+    if (filename === 'package.json' && !file.relativePath.includes('node_modules'))
+      allDeps.push(...parsePackageJson(file.content));
+    else if (filename === 'requirements.txt') allDeps.push(...parseRequirementsTxt(file.content));
+    else if (filename === 'Cargo.toml') allDeps.push(...parseCargoToml(file.content));
+    else if (filename === 'go.mod') allDeps.push(...parseGoMod(file.content));
+  }
+  return allDeps;
+};

package/src/domain/supply-chain/dependency-analyzer.ts

@@ -0,0 +1,138 @@
+import type { ParsedDependency } from '../scanner/layers/layer3-parsers.js';
+import { isBannedPackage, isAiSdkPackage, BIAS_TESTING_PACKAGES } from '../scanner/rules/banned-packages.js';
+import { REGISTRY_CARDS, findRegistryCard, isGpaiSystemic, getProviderName } from '../../data/registry-cards.js';
+import type { SupplyChainRisk, SupplyChainReport } from './types.js';
+
+export const SUPPLY_CHAIN_OBLIGATIONS = ['OBL-026', 'OBL-005'] as const;
+
+const SEVERITY_SCORES: Record<SupplyChainRisk['severity'], number> = {
+  critical: 25,
+  high: 15,
+  medium: 5,
+  low: 1,
+};
+
+/** Classify a single dependency into risks, SDK flag, and bias-testing flag. */
+const classifyDependency = (dep: ParsedDependency) => {
+  const risks: SupplyChainRisk[] = [];
+  let isAiSdk = false;
+  let isBiasTest = false;
+
+  const banned = isBannedPackage(dep.name);
+  if (banned) {
+    risks.push({
+      type: 'banned-package',
+      severity: 'critical',
+      packageName: dep.name,
+      packageVersion: dep.version,
+      ecosystem: dep.ecosystem,
+      description: `Banned package "${dep.name}" detected: ${banned.reason}`,
+      articleRef: 'Art.5',
+      obligationId: 'OBL-005',
+    });
+  }
+
+  const sdkProvider = isAiSdkPackage(dep.name);
+  if (sdkProvider) {
+    isAiSdk = true;
+
+    // Check if provider has a registry card
+    const providerHasCard = REGISTRY_CARDS.some(
+      (c) => getProviderName(c).toLowerCase() === sdkProvider.toLowerCase(),
+    );
+    if (!providerHasCard) {
+      risks.push({
+        type: 'ai-sdk-no-card',
+        severity: 'low',
+        packageName: dep.name,
+        packageVersion: dep.version,
+        ecosystem: dep.ecosystem,
+        description: `AI SDK "${dep.name}" (${sdkProvider}) has no matching registry card`,
+        articleRef: 'Art.25',
+        obligationId: 'OBL-026',
+      });
+    }
+  }
+
+  if (BIAS_TESTING_PACKAGES.has(dep.name)) {
+    isBiasTest = true;
+  }
+
+  return { risks, isAiSdk, isBiasTest };
+};
+
+export const analyzeSupplyChain = (
+  projectPath: string,
+  dependencies: readonly ParsedDependency[],
+  detectedModels: readonly string[],
+): SupplyChainReport => {
+  const startTime = Date.now();
+  const risks: SupplyChainRisk[] = [];
+
+  let aiSdkCount = 0;
+  let bannedCount = 0;
+  let hasBiasTesting = false;
+
+  // Single pass: classify each dependency
+  for (const dep of dependencies) {
+    const result = classifyDependency(dep);
+    risks.push(...result.risks);
+    if (result.isAiSdk) aiSdkCount++;
+    if (result.risks.some((r) => r.type === 'banned-package')) bannedCount++;
+    if (result.isBiasTest) hasBiasTesting = true;
+  }
+
+  // Flag missing bias testing if AI SDKs are present
+  if (aiSdkCount > 0 && !hasBiasTesting) {
+    risks.push({
+      type: 'missing-bias-testing',
+      severity: 'medium',
+      packageName: '',
+      packageVersion: '',
+      ecosystem: '',
+      description: `${aiSdkCount} AI SDK(s) detected but no bias testing package (fairlearn, aif360, aequitas, etc.)`,
+      articleRef: 'Art.10',
+      obligationId: 'OBL-026',
+    });
+  }
+
+  // Match detected models to cards and flag systemic risk
+  const matchedCards = detectedModels
+    .map((id) => findRegistryCard(id))
+    .filter((c): c is NonNullable<typeof c> => c !== undefined);
+
+  for (const card of matchedCards) {
+    if (isGpaiSystemic(card)) {
+      risks.push({
+        type: 'gpai-systemic',
+        severity: 'high',
+        packageName: card.slug,
+        packageVersion: '',
+        ecosystem: getProviderName(card).toLowerCase(),
+        description: `Model "${card.name}" by ${getProviderName(card)} is classified as GPAI with systemic risk (Art.51)`,
+        articleRef: 'Art.51',
+        obligationId: 'OBL-026',
+      });
+    }
+  }
+
+  // Compute risk score (capped at 100)
+  const riskScore = Math.min(
+    100,
+    risks.reduce((sum, r) => sum + SEVERITY_SCORES[r.severity], 0),
+  );
+
+  return Object.freeze({
+    projectPath,
+    timestamp: new Date().toISOString(),
+    duration: Date.now() - startTime,
+    totalDependencies: dependencies.length,
+    aiSdkCount,
+    bannedCount,
+    risks: Object.freeze([...risks]),
+    riskScore,
+    detectedModels: Object.freeze([...detectedModels]),
+    registryCards: Object.freeze([...matchedCards]),
+    obligationRefs: Object.freeze([...SUPPLY_CHAIN_OBLIGATIONS]),
+  });
+};

package/src/domain/supply-chain/index.ts

@@ -0,0 +1,3 @@
+export { analyzeSupplyChain, SUPPLY_CHAIN_OBLIGATIONS } from './dependency-analyzer.js';
+export type { SupplyChainRisk, SupplyChainReport, SupplyChainRiskType } from './types.js';
+export type { RegistryToolCard, EuAiActModelAssessment } from '../../data/registry-cards.js';