@complior/engine 0.9.0

package/src/mcp/handlers.ts

@@ -0,0 +1,245 @@
+import type { ScanService } from '../services/scan-service.js';
+import type { FixService } from '../services/fix-service.js';
+import type { ScanResult } from '../types/common.types.js';
+import type { RegulationData } from '../data/regulation/regulation-loader.js';
+import type { Obligation } from '../data/schemas/schemas.js';
+import { toJsonOutput } from '../output/json-output.js';
+import { toGithubIssue } from '../output/github-issue.js';
+
+export interface McpHandlerDeps {
+  readonly scanService: ScanService;
+  readonly fixService: FixService;
+  readonly getProjectPath: () => string;
+  readonly getLastScanResult: () => ScanResult | null;
+  readonly getRegulationData: () => RegulationData;
+  readonly version: string;
+}
+
+export const createMcpHandlers = (deps: McpHandlerDeps) => {
+  const { scanService, fixService, getProjectPath, getLastScanResult, getRegulationData, version } = deps;
+
+  const complior_scan = async (args: { path?: string }) => {
+    const projectPath = args.path ?? getProjectPath();
+    const result = await scanService.scan(projectPath);
+    const topFindings = result.findings
+      .filter((f) => f.type === 'fail')
+      .slice(0, 10);
+
+    return {
+      content: [{
+        type: 'text' as const,
+        text: JSON.stringify({
+          score: result.score.totalScore,
+          zone: result.score.zone,
+          filesScanned: result.filesScanned,
+          violations: result.findings.filter((f) => f.type === 'fail').length,
+          passed: result.score.passedChecks,
+          criticalCapApplied: result.score.criticalCapApplied,
+          topFindings: topFindings.map((f) => ({
+            checkId: f.checkId,
+            severity: f.severity,
+            message: f.message,
+            article: f.articleReference,
+            fix: f.fix,
+          })),
+        }, null, 2),
+      }],
+    };
+  };
+
+  const complior_fix = async (args: { checkId: string; obligationId?: string }) => {
+    const plan = fixService.preview({
+      checkId: args.checkId,
+      type: 'fail',
+      message: '',
+      severity: 'high',
+      obligationId: args.obligationId,
+    });
+
+    if (!plan) {
+      return {
+        content: [{ type: 'text' as const, text: JSON.stringify({ error: 'No fix available for this finding' }) }],
+        isError: true,
+      };
+    }
+
+    const result = await fixService.applyFix(plan);
+    return {
+      content: [{
+        type: 'text' as const,
+        text: JSON.stringify({
+          applied: result.applied,
+          scoreBefore: result.scoreBefore,
+          scoreAfter: result.scoreAfter,
+          delta: result.scoreAfter - result.scoreBefore,
+          diff: plan.diff,
+          commitMessage: plan.commitMessage,
+          error: result.error,
+        }, null, 2),
+      }],
+    };
+  };
+
+  const complior_status = async () => {
+    const lastScan = getLastScanResult();
+    if (!lastScan) {
+      return {
+        content: [{ type: 'text' as const, text: JSON.stringify({ message: 'No scan results yet. Run complior_scan first.' }) }],
+      };
+    }
+
+    return {
+      content: [{
+        type: 'text' as const,
+        text: JSON.stringify({
+          score: lastScan.score.totalScore,
+          zone: lastScan.score.zone,
+          categories: lastScan.score.categoryScores.map((c) => ({
+            category: c.category,
+            score: c.score,
+            weight: c.weight,
+            passed: c.passedCount,
+            total: c.obligationCount,
+          })),
+          totalChecks: lastScan.score.totalChecks,
+          passed: lastScan.score.passedChecks,
+          failed: lastScan.score.failedChecks,
+          scannedAt: lastScan.scannedAt,
+        }, null, 2),
+      }],
+    };
+  };
+
+  const complior_explain = async (args: { article: string }) => {
+    const data = getRegulationData();
+    const query = args.article.toLowerCase();
+
+    // Search obligations
+    const matches = data.obligations.obligations.filter((o: Obligation) =>
+      o.obligation_id.toLowerCase().includes(query) ||
+      o.article_reference.toLowerCase().includes(query) ||
+      o.title.toLowerCase().includes(query),
+    );
+
+    if (matches.length === 0) {
+      return {
+        content: [{ type: 'text' as const, text: `No obligation found matching "${args.article}". Try: "Art. 50", "OBL-001", or a keyword.` }],
+      };
+    }
+
+    const explanations = matches.slice(0, 5).map((o: Obligation) => ({
+      id: o.obligation_id,
+      article: o.article_reference,
+      title: o.title,
+      description: o.description,
+      severity: o.severity,
+      deadline: o.deadline,
+      role: o.applies_to_role,
+    }));
+
+    return {
+      content: [{ type: 'text' as const, text: JSON.stringify(explanations, null, 2) }],
+    };
+  };
+
+  const complior_search_tool = async (args: { query: string }) => {
+    // Basic search through known AI tools from framework detector patterns
+    const knownTools = [
+      { name: 'OpenAI', pkg: 'openai', type: 'sdk', compliance: 'Art. 50 disclosure required for chatbots' },
+      { name: 'Anthropic', pkg: '@anthropic-ai/sdk', type: 'sdk', compliance: 'Art. 50 disclosure required' },
+      { name: 'Vercel AI SDK', pkg: 'ai', type: 'library', compliance: 'Framework-level disclosure possible' },
+      { name: 'LangChain', pkg: '@langchain/core', type: 'library', compliance: 'Logging middleware recommended (Art. 12)' },
+      { name: 'Hugging Face', pkg: '@huggingface/inference', type: 'sdk', compliance: 'Model card + Art. 50 required for GPAI' },
+      { name: 'Replicate', pkg: 'replicate', type: 'sdk', compliance: 'Art. 50.2 content marking for generated content' },
+      { name: 'Google Generative AI', pkg: '@google/generative-ai', type: 'sdk', compliance: 'Art. 50 disclosure required' },
+      { name: 'Mistral', pkg: '@mistralai/mistralai', type: 'sdk', compliance: 'GPAI obligations (Art. 53-55)' },
+      { name: 'Ollama', pkg: 'ollama', type: 'sdk', compliance: 'Local deployment, reduced but not zero obligations' },
+    ];
+
+    const query = args.query.toLowerCase();
+    const matches = knownTools.filter((t) =>
+      t.name.toLowerCase().includes(query) || t.pkg.toLowerCase().includes(query),
+    );
+
+    return {
+      content: [{
+        type: 'text' as const,
+        text: matches.length > 0
+          ? JSON.stringify(matches, null, 2)
+          : `No AI tool found matching "${args.query}". Known tools: ${knownTools.map((t) => t.name).join(', ')}`,
+      }],
+    };
+  };
+
+  const complior_classify = async (args: { description: string; domain?: string }) => {
+    const desc = args.description.toLowerCase();
+    const domain = args.domain?.toLowerCase();
+
+    // Deterministic risk classification based on keywords
+    let riskLevel = 'limited';
+    let reason = 'General AI system with transparency obligations';
+
+    if (domain === 'hr' || desc.includes('recruit') || desc.includes('hiring') || desc.includes('employment')) {
+      riskLevel = 'high';
+      reason = 'HR/Employment AI — Annex III.4, requires conformity assessment';
+    } else if (domain === 'healthcare' || desc.includes('medical') || desc.includes('diagnos')) {
+      riskLevel = 'high';
+      reason = 'Healthcare AI — Annex II+III, dual AI Act + MDR requirements';
+    } else if (domain === 'finance' || desc.includes('credit') || desc.includes('insurance') || desc.includes('scoring')) {
+      riskLevel = 'high';
+      reason = 'Finance AI — Annex III.5, FRIA required';
+    } else if (domain === 'education' || desc.includes('admission') || desc.includes('grading')) {
+      riskLevel = 'high';
+      reason = 'Education AI — Annex III.3, bias testing required';
+    } else if (desc.includes('biometric') || desc.includes('facial recognition')) {
+      riskLevel = 'unacceptable';
+      reason = 'Biometric identification — Art. 5 prohibited in most contexts';
+    } else if (desc.includes('manipulation') || desc.includes('subliminal')) {
+      riskLevel = 'unacceptable';
+      reason = 'Manipulative AI — Art. 5(1)(a) prohibited practice';
+    } else if (desc.includes('chatbot') || desc.includes('content generat')) {
+      riskLevel = 'limited';
+      reason = 'Chatbot/Content generation — Art. 50 transparency obligations';
+    }
+
+    return {
+      content: [{
+        type: 'text' as const,
+        text: JSON.stringify({ riskLevel, reason, domain: domain ?? 'general' }, null, 2),
+      }],
+    };
+  };
+
+  const complior_report = async (args: { format?: 'json' | 'markdown' }) => {
+    const lastScan = getLastScanResult();
+    if (!lastScan) {
+      return {
+        content: [{ type: 'text' as const, text: 'No scan results. Run complior_scan first.' }],
+        isError: true,
+      };
+    }
+
+    if (args.format === 'json') {
+      return {
+        content: [{ type: 'text' as const, text: JSON.stringify(toJsonOutput(lastScan, version), null, 2) }],
+      };
+    }
+
+    // Markdown report
+    return {
+      content: [{ type: 'text' as const, text: toGithubIssue(lastScan) }],
+    };
+  };
+
+  return Object.freeze({
+    complior_scan,
+    complior_fix,
+    complior_status,
+    complior_explain,
+    complior_search_tool,
+    complior_classify,
+    complior_report,
+  });
+};
+
+export type McpHandlers = ReturnType<typeof createMcpHandlers>;

package/src/mcp/index.ts

@@ -0,0 +1,28 @@
+import type { ScanResult } from '../types/common.types.js';
+import { loadRegulationData } from '../data/regulation/regulation-loader.js';
+import { createLogger } from '../infra/logger.js';
+import { createMcpStack } from './create-mcp-stack.js';
+
+const main = async (): Promise<void> => {
+  const regulationData = await loadRegulationData();
+  const projectPath = process.env['COMPLIOR_PROJECT_PATH'] ?? process.cwd();
+  const { ENGINE_VERSION } = await import('../version.js');
+
+  let lastScanResult: ScanResult | null = null;
+
+  const { mcpServer } = await createMcpStack({
+    regulationData,
+    projectPath,
+    getLastScanResult: () => lastScanResult,
+    setLastScanResult: (r) => { lastScanResult = r; },
+    version: ENGINE_VERSION,
+  });
+
+  await mcpServer.start();
+};
+
+const log = createLogger('mcp');
+main().catch((err: unknown) => {
+  log.error('Complior MCP Server failed to start:', err);
+  process.exit(1);
+});

package/src/mcp/mcp-server.test.ts

@@ -0,0 +1,80 @@
+import { describe, it, expect } from 'vitest';
+import { MCP_TOOL_SCHEMAS } from './tools.js';
+import { createMcpHandlers } from './handlers.js';
+import type { ScanResult, ScoreBreakdown } from '../types/common.types.js';
+import { ENGINE_VERSION } from '../version.js';
+
+const makeScore = (): ScoreBreakdown => ({
+  totalScore: 42,
+  zone: 'red',
+  categoryScores: [{ category: 'Transparency', weight: 17, score: 30, obligationCount: 6, passedCount: 2 }],
+  criticalCapApplied: false,
+  totalChecks: 10,
+  passedChecks: 4,
+  failedChecks: 5,
+  skippedChecks: 1,
+});
+
+const makeScanResult = (): ScanResult => ({
+  score: makeScore(),
+  findings: [
+    { checkId: 'ai-disclosure', type: 'fail', message: 'No disclosure', severity: 'high', articleReference: 'Art. 50(1)' },
+    { checkId: 'docs', type: 'pass', message: 'OK', severity: 'info' },
+  ],
+  projectPath: '/test',
+  scannedAt: '2026-01-01T00:00:00Z',
+  duration: 100,
+  filesScanned: 50,
+});
+
+const mockHandlers = createMcpHandlers({
+  scanService: { scan: async () => makeScanResult() } as any,
+  fixService: { preview: () => null, applyFix: async () => ({}) } as any,
+  getProjectPath: () => '/test',
+  getLastScanResult: () => makeScanResult(),
+  getRegulationData: () => ({ obligations: { obligations: [{ id: 'OBL-001', article: 'Art. 4', title: 'AI Literacy', description: 'Test', severity: 'high', deadline: '2025-02-02', role: 'both' }] }, scoring: {} }) as any,
+  version: ENGINE_VERSION,
+});
+
+describe('MCP Tool Schemas', () => {
+  it('defines all 7 tools', () => {
+    const names = Object.keys(MCP_TOOL_SCHEMAS);
+    expect(names).toHaveLength(7);
+    expect(names).toContain('complior_scan');
+    expect(names).toContain('complior_fix');
+    expect(names).toContain('complior_status');
+    expect(names).toContain('complior_explain');
+    expect(names).toContain('complior_search_tool');
+    expect(names).toContain('complior_classify');
+    expect(names).toContain('complior_report');
+  });
+});
+
+describe('MCP Handlers', () => {
+  it('complior_scan returns score and findings', async () => {
+    const result = await mockHandlers.complior_scan({});
+    const data = JSON.parse(result.content[0].text);
+    expect(data.score).toBe(42);
+    expect(data.violations).toBe(1);
+    expect(data.topFindings).toHaveLength(1);
+  });
+
+  it('complior_status returns category breakdown', async () => {
+    const result = await mockHandlers.complior_status();
+    const data = JSON.parse(result.content[0].text);
+    expect(data.score).toBe(42);
+    expect(data.categories).toHaveLength(1);
+  });
+
+  it('complior_classify returns risk level', async () => {
+    const result = await mockHandlers.complior_classify({ description: 'HR recruitment screening tool', domain: 'hr' });
+    const data = JSON.parse(result.content[0].text);
+    expect(data.riskLevel).toBe('high');
+    expect(data.reason).toContain('HR');
+  });
+
+  it('complior_fix returns error for unknown finding', async () => {
+    const result = await mockHandlers.complior_fix({ checkId: 'unknown' });
+    expect(result.isError).toBe(true);
+  });
+});

package/src/mcp/server.ts

@@ -0,0 +1,79 @@
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { z } from 'zod';
+import type { McpHandlers } from './handlers.js';
+import { MCP_TOOL_SCHEMAS } from './tools.js';
+import { createLogger } from '../infra/logger.js';
+
+export interface McpServerDeps {
+  readonly handlers: McpHandlers;
+  readonly version: string;
+}
+
+export const createMcpServer = (deps: McpServerDeps) => {
+  const { handlers, version } = deps;
+
+  const server = new McpServer(
+    { name: 'complior', version },
+    { capabilities: { tools: {} } },
+  );
+
+  // Register all 7 tools
+  server.tool(
+    'complior_scan',
+    MCP_TOOL_SCHEMAS.complior_scan.description,
+    MCP_TOOL_SCHEMAS.complior_scan.inputSchema,
+    async (args) => handlers.complior_scan(args),
+  );
+
+  server.tool(
+    'complior_fix',
+    MCP_TOOL_SCHEMAS.complior_fix.description,
+    MCP_TOOL_SCHEMAS.complior_fix.inputSchema,
+    async (args) => handlers.complior_fix(args),
+  );
+
+  server.tool(
+    'complior_status',
+    MCP_TOOL_SCHEMAS.complior_status.description,
+    {},
+    async () => handlers.complior_status(),
+  );
+
+  server.tool(
+    'complior_explain',
+    MCP_TOOL_SCHEMAS.complior_explain.description,
+    MCP_TOOL_SCHEMAS.complior_explain.inputSchema,
+    async (args) => handlers.complior_explain(args),
+  );
+
+  server.tool(
+    'complior_search_tool',
+    MCP_TOOL_SCHEMAS.complior_search_tool.description,
+    MCP_TOOL_SCHEMAS.complior_search_tool.inputSchema,
+    async (args) => handlers.complior_search_tool(args),
+  );
+
+  server.tool(
+    'complior_classify',
+    MCP_TOOL_SCHEMAS.complior_classify.description,
+    MCP_TOOL_SCHEMAS.complior_classify.inputSchema,
+    async (args) => handlers.complior_classify(args),
+  );
+
+  server.tool(
+    'complior_report',
+    MCP_TOOL_SCHEMAS.complior_report.description,
+    { format: z.enum(['json', 'markdown']).optional() },
+    async (args) => handlers.complior_report(args),
+  );
+
+  const start = async (): Promise<void> => {
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+    const log = createLogger('mcp');
+    log.info(`Complior MCP Server v${version} started on stdio`);
+  };
+
+  return Object.freeze({ start, server });
+};

package/src/mcp/tools.ts

@@ -0,0 +1,48 @@
+import { z } from 'zod';
+
+export const MCP_TOOL_SCHEMAS = {
+  complior_scan: {
+    description: 'Scan a project for EU AI Act compliance. Returns score, violations, and top findings.',
+    inputSchema: {
+      path: z.string().optional().describe('Project path to scan (default: current directory)'),
+    },
+  },
+  complior_fix: {
+    description: 'Auto-fix a specific compliance violation. Returns diff preview and score delta.',
+    inputSchema: {
+      checkId: z.string().describe('Check ID of the finding to fix (e.g., "ai-disclosure")'),
+      obligationId: z.string().optional().describe('Obligation ID (e.g., "eu-ai-act-OBL-015")'),
+    },
+  },
+  complior_status: {
+    description: 'Get current compliance score and category breakdown from the last scan.',
+    inputSchema: {},
+  },
+  complior_explain: {
+    description: 'Explain an EU AI Act article or obligation in plain language with code implications.',
+    inputSchema: {
+      article: z.string().describe('Article reference (e.g., "Art. 50" or "OBL-015")'),
+    },
+  },
+  complior_search_tool: {
+    description: 'Search the AI tool catalog for compliance information about a specific tool.',
+    inputSchema: {
+      query: z.string().describe('Tool name or keyword (e.g., "openai", "langchain")'),
+    },
+  },
+  complior_classify: {
+    description: 'Classify the risk level of an AI system based on its description and domain.',
+    inputSchema: {
+      description: z.string().describe('Description of the AI system'),
+      domain: z.string().optional().describe('Business domain (e.g., "healthcare", "finance", "hr")'),
+    },
+  },
+  complior_report: {
+    description: 'Generate a compliance report in JSON or Markdown format.',
+    inputSchema: {
+      format: z.enum(['json', 'markdown']).optional().describe('Output format (default: markdown)'),
+    },
+  },
+} as const;
+
+export type McpToolName = keyof typeof MCP_TOOL_SCHEMAS;

package/src/onboarding/auto-detect.ts

@@ -0,0 +1,164 @@
+import { readFile, readdir, access } from 'node:fs/promises';
+import { join } from 'node:path';
+
+export interface AutoDetectResult {
+  readonly language: string;
+  readonly framework: string;
+  readonly cicd: string;
+  readonly deployment: string;
+  readonly aiLibraries: string[];
+  readonly hasDockerCompose: boolean;
+  readonly hasEnvExample: boolean;
+  readonly detectedModels: string[];
+  readonly confidence: number;
+}
+
+const fileExists = async (path: string): Promise<boolean> => {
+  try { await access(path); return true; } catch { return false; }
+};
+
+const detectLanguage = (deps: Record<string, string>): string => {
+  if (deps['typescript'] || deps['ts-node'] || deps['tsx']) return 'TypeScript';
+  if (deps['@types/node']) return 'TypeScript';
+  return 'JavaScript';
+};
+
+const detectFramework = (deps: Record<string, string>): string => {
+  if (deps['next']) return 'Next.js';
+  if (deps['@nestjs/core']) return 'NestJS';
+  if (deps['express']) return 'Express';
+  if (deps['fastify']) return 'Fastify';
+  if (deps['hono']) return 'Hono';
+  if (deps['react']) return 'React';
+  if (deps['vue']) return 'Vue';
+  if (deps['@angular/core']) return 'Angular';
+  if (deps['django'] || deps['flask']) return 'Python';
+  return 'unknown';
+};
+
+const AI_LIBRARIES: ReadonlyMap<string, string> = new Map([
+  ['openai', 'OpenAI SDK'],
+  ['@anthropic-ai/sdk', 'Anthropic SDK'],
+  ['ai', 'Vercel AI SDK'],
+  ['@langchain/core', 'LangChain'],
+  ['@huggingface/inference', 'Hugging Face'],
+  ['replicate', 'Replicate'],
+  ['@mistralai/mistralai', 'Mistral'],
+  ['@google/generative-ai', 'Google GenAI'],
+  ['ollama', 'Ollama'],
+  ['cohere-ai', 'Cohere'],
+]);
+
+const MODEL_PATTERNS: readonly RegExp[] = [
+  /\bgpt-4[a-z0-9-]*/g,
+  /\bgpt-3\.5[a-z0-9-]*/g,
+  /\bclaude-[a-z0-9.-]*/g,
+  /\bgemini-[a-z0-9.-]*/g,
+  /\bmistral-[a-z0-9.-]*/g,
+];
+
+const detectModels = (sources: readonly string[]): string[] => {
+  const models = new Set<string>();
+  for (const src of sources) {
+    for (const pattern of MODEL_PATTERNS) {
+      for (const match of src.matchAll(pattern)) {
+        models.add(match[0]);
+      }
+    }
+  }
+  return [...models];
+};
+
+export const autoDetect = async (projectPath: string): Promise<AutoDetectResult> => {
+  let language = 'unknown';
+  let framework = 'unknown';
+  const aiLibraries: string[] = [];
+  let cicd = 'none';
+  let deployment = 'unknown';
+  let confidence = 0;
+  let signals = 0;
+
+  // Package.json
+  const pkgPath = join(projectPath, 'package.json');
+  const pkgContent = await readFile(pkgPath, 'utf-8').catch(() => null);
+
+  if (pkgContent) {
+    const isRec = (v: unknown): v is Record<string, unknown> =>
+      typeof v === 'object' && v !== null;
+    const raw: unknown = JSON.parse(pkgContent);
+    const pkg = isRec(raw) ? raw : {};
+    const rawDeps = isRec(pkg['dependencies']) ? pkg['dependencies'] : {};
+    const rawDevDeps = isRec(pkg['devDependencies']) ? pkg['devDependencies'] : {};
+    const deps: Record<string, string> = {};
+    for (const [k, v] of Object.entries({ ...rawDeps, ...rawDevDeps })) {
+      if (typeof v === 'string') deps[k] = v;
+    }
+    language = detectLanguage(deps);
+    framework = detectFramework(deps);
+    signals += 2;
+
+    for (const [pkg, name] of AI_LIBRARIES) {
+      if (deps[pkg]) aiLibraries.push(name);
+    }
+    if (aiLibraries.length > 0) signals++;
+  }
+
+  // Python
+  const reqPath = join(projectPath, 'requirements.txt');
+  if (!pkgContent && await fileExists(reqPath)) {
+    language = 'Python';
+    const req = await readFile(reqPath, 'utf-8').catch(() => '');
+    if (req.includes('django')) framework = 'Django';
+    else if (req.includes('fastapi')) framework = 'FastAPI';
+    else if (req.includes('flask')) framework = 'Flask';
+    signals++;
+  }
+
+  // CI/CD
+  const ghActions = join(projectPath, '.github', 'workflows');
+  const gitlabCi = join(projectPath, '.gitlab-ci.yml');
+  if (await fileExists(ghActions)) { cicd = 'github-actions'; signals++; }
+  else if (await fileExists(gitlabCi)) { cicd = 'gitlab-ci'; signals++; }
+
+  // Deployment
+  const hasDockerfile = await fileExists(join(projectPath, 'Dockerfile'));
+  const hasDockerCompose = await fileExists(join(projectPath, 'docker-compose.yml')) ||
+    await fileExists(join(projectPath, 'docker-compose.yaml'));
+  const hasVercelJson = await fileExists(join(projectPath, 'vercel.json'));
+
+  if (hasDockerfile) { deployment = 'Docker'; signals++; }
+  else if (hasVercelJson) { deployment = 'Vercel'; signals++; }
+
+  const hasEnvExample = await fileExists(join(projectPath, '.env.example')) ||
+    await fileExists(join(projectPath, '.env.local'));
+
+  // Model detection from source files
+  const srcDirs = ['src', 'app', 'lib', 'pages', 'components'];
+  const sourceSnippets: string[] = [];
+  for (const dir of srcDirs) {
+    const dirPath = join(projectPath, dir);
+    const entries = await readdir(dirPath, { withFileTypes: true }).catch(() => []);
+    for (const entry of entries.slice(0, 20)) {
+      if (entry.isFile() && /\.(ts|tsx|js|jsx|py)$/.test(entry.name)) {
+        const content = await readFile(join(dirPath, entry.name), 'utf-8').catch(() => '');
+        if (content) sourceSnippets.push(content);
+      }
+    }
+  }
+  const detectedModels = detectModels(sourceSnippets);
+  if (detectedModels.length > 0) signals++;
+
+  confidence = Math.min(1.0, signals / 6);
+
+  return {
+    language,
+    framework,
+    cicd,
+    deployment,
+    aiLibraries,
+    hasDockerCompose: hasDockerCompose,
+    hasEnvExample,
+    detectedModels,
+    confidence,
+  };
+};