@complior/engine 0.9.0

package/src/domain/registry/compute-agent-score.ts

@@ -0,0 +1,162 @@
+import type { AgentPassport } from '../../types/passport.types.js';
+import type { CompletenessResult } from '../passport/passport-validator.js';
+import type { ScanResult } from '../../types/common.types.js';
+import type { EvidenceChainSummary } from '../scanner/evidence-store.js';
+import { INDUSTRY_PATTERNS } from '../../data/industry-patterns.js';
+
+// --- Constants ---
+
+const WEIGHT_COMPLIANCE = 0.4;
+const WEIGHT_COMPLETENESS = 0.3;
+const BONUS_FRIA = 15;
+const BONUS_EVIDENCE = 15;
+
+const GRADE_A_THRESHOLD = 90;
+const GRADE_B_THRESHOLD = 75;
+const GRADE_C_THRESHOLD = 60;
+const GRADE_D_THRESHOLD = 40;
+
+const COMPLETENESS_WARNING_THRESHOLD = 80;
+
+const INDUSTRY_PREFIX = 'industry-';
+
+/** Canonical set of high-risk industry IDs, derived from INDUSTRY_PATTERNS */
+const HIGH_RISK_INDUSTRY_IDS = new Set(INDUSTRY_PATTERNS.map((p) => p.id));
+
+// --- Input / Output types ---
+
+export interface AgentRegistryInput {
+  readonly passport: AgentPassport;
+  readonly completeness: CompletenessResult;
+  readonly scanResult: ScanResult | null;
+  readonly evidenceSummary: EvidenceChainSummary;
+}
+
+export interface AgentRegistryEntry {
+  readonly name: string;
+  readonly displayName: string;
+  readonly agentId: string;
+  readonly riskClass: string;
+  readonly autonomyLevel: string;
+  readonly framework: string;
+  readonly passportCompleteness: number;
+  readonly complianceScore: number;
+  readonly friaStatus: 'completed' | 'pending';
+  readonly evidenceChain: {
+    readonly entries: number;
+    readonly valid: boolean;
+  };
+  readonly detectedIndustries: readonly string[];
+  readonly grade: 'A' | 'B' | 'C' | 'D' | 'F';
+  readonly issues: readonly string[];
+}
+
+// --- Helpers ---
+
+const extractIndustries = (scanResult: ScanResult | null): readonly string[] => {
+  if (!scanResult) return [];
+  const industries = new Set<string>();
+  for (const finding of scanResult.findings) {
+    if (finding.type === 'fail' && finding.checkId.startsWith(INDUSTRY_PREFIX)) {
+      industries.add(finding.checkId.slice(INDUSTRY_PREFIX.length));
+    }
+  }
+  return [...industries];
+};
+
+const computeGrade = (weightedScore: number): 'A' | 'B' | 'C' | 'D' | 'F' => {
+  if (weightedScore >= GRADE_A_THRESHOLD) return 'A';
+  if (weightedScore >= GRADE_B_THRESHOLD) return 'B';
+  if (weightedScore >= GRADE_C_THRESHOLD) return 'C';
+  if (weightedScore >= GRADE_D_THRESHOLD) return 'D';
+  return 'F';
+};
+
+interface IssueContext {
+  readonly name: string;
+  readonly friaCompleted: boolean;
+  readonly completenessScore: number;
+  readonly evidenceValid: boolean;
+  readonly evidenceEntries: number;
+  readonly riskClass: string;
+  readonly detectedIndustries: readonly string[];
+}
+
+const buildIssues = (ctx: IssueContext): readonly string[] => {
+  const issues: string[] = [];
+
+  if (!ctx.friaCompleted) {
+    issues.push(`FRIA not completed — run \`complior agent fria ${ctx.name}\``);
+  }
+
+  if (ctx.completenessScore < COMPLETENESS_WARNING_THRESHOLD) {
+    issues.push(`Passport only ${ctx.completenessScore}% complete — run \`complior agent init --force\``);
+  }
+
+  if (!ctx.evidenceValid && ctx.evidenceEntries > 0) {
+    issues.push('Evidence chain broken — investigate chain.json');
+  }
+
+  if (ctx.evidenceEntries === 0) {
+    issues.push('No evidence chain entries — run a scan to start collecting evidence');
+  }
+
+  const highRiskIndustry = ctx.detectedIndustries.find((ind) => HIGH_RISK_INDUSTRY_IDS.has(ind));
+  if (highRiskIndustry && ctx.riskClass !== 'high' && ctx.riskClass !== 'prohibited') {
+    issues.push(`High-risk industry detected (${highRiskIndustry}) but risk_class is '${ctx.riskClass}'`);
+  }
+
+  return issues;
+};
+
+// --- Main function ---
+
+export const computeAgentScore = (input: AgentRegistryInput): AgentRegistryEntry => {
+  const { passport, completeness, scanResult, evidenceSummary } = input;
+
+  const riskClass = passport.compliance.eu_ai_act.risk_class;
+  const complianceScore = scanResult?.score.totalScore ?? 0;
+  const friaCompleted = passport.compliance.fria_completed === true;
+  const evidenceValid = evidenceSummary.chainValid;
+  const evidenceEntries = evidenceSummary.totalEntries;
+  const detectedIndustries = extractIndustries(scanResult);
+
+  const friaBonus = friaCompleted ? BONUS_FRIA : 0;
+  const evidenceBonus = evidenceValid && evidenceEntries > 0 ? BONUS_EVIDENCE : 0;
+  const weightedScore =
+    complianceScore * WEIGHT_COMPLIANCE +
+    completeness.score * WEIGHT_COMPLETENESS +
+    friaBonus +
+    evidenceBonus;
+
+  const grade = computeGrade(weightedScore);
+
+  const issues = buildIssues({
+    name: passport.name,
+    friaCompleted,
+    completenessScore: completeness.score,
+    evidenceValid,
+    evidenceEntries,
+    riskClass,
+    detectedIndustries,
+  });
+
+  return {
+    name: passport.name,
+    displayName: passport.display_name,
+    agentId: passport.agent_id,
+    riskClass,
+    autonomyLevel: passport.autonomy_level,
+    framework: passport.framework,
+    passportCompleteness: completeness.score,
+    complianceScore,
+    friaStatus: friaCompleted ? 'completed' : 'pending',
+    evidenceChain: {
+      entries: evidenceEntries,
+      valid: evidenceValid,
+    },
+    detectedIndustries,
+    grade,
+    issues,
+  };
+};

package/src/domain/reporter/audit-report.test.ts

@@ -0,0 +1,87 @@
+import { describe, it, expect } from 'vitest';
+import { buildAuditReportData } from './audit-report.js';
+import type { ScanResult } from '../../types/common.types.js';
+
+const makeScanResult = (overrides?: Partial<ScanResult>): ScanResult => ({
+  score: {
+    totalScore: 72,
+    zone: 'yellow',
+    categoryScores: [
+      { category: 'Transparency', weight: 0.2, score: 60, obligationCount: 5, passedCount: 3 },
+      { category: 'Documentation', weight: 0.15, score: 80, obligationCount: 4, passedCount: 3 },
+    ],
+    criticalCapApplied: false,
+    totalChecks: 10,
+    passedChecks: 7,
+    failedChecks: 3,
+    skippedChecks: 0,
+  },
+  findings: [
+    { checkId: 'chk-1', type: 'fail', message: 'No AI disclosure', severity: 'high', obligationId: 'OBL-015', articleReference: 'Art. 50(1)', fix: 'Add AI disclosure component', file: 'src/app.tsx', line: 10 },
+    { checkId: 'chk-2', type: 'fail', message: 'No C2PA marking', severity: 'high', obligationId: 'OBL-016', articleReference: 'Art. 50(2)', fix: 'Add C2PA metadata' },
+    { checkId: 'chk-3', type: 'fail', message: 'Missing monitoring', severity: 'medium', obligationId: 'OBL-011', articleReference: 'Art. 26' },
+    { checkId: 'chk-4', type: 'pass', message: 'Logging present', severity: 'info' },
+  ],
+  projectPath: '/test',
+  scannedAt: new Date().toISOString(),
+  duration: 1200,
+  filesScanned: 50,
+  ...overrides,
+});
+
+describe('audit-report', () => {
+  it('builds report data with correct executive summary', () => {
+    const result = makeScanResult();
+    const report = buildAuditReportData(result, { organization: 'ACME Corp' });
+
+    expect(report.score).toBe(72);
+    expect(report.zone).toBe('Partial Compliance');
+    expect(report.organization).toBe('ACME Corp');
+    expect(report.executiveSummary.highIssues).toBe(2);
+    expect(report.executiveSummary.mediumIssues).toBe(1);
+    expect(report.executiveSummary.criticalIssues).toBe(0);
+    expect(report.executiveSummary.recommendedActions).toBe(3);
+  });
+
+  it('builds remediation plan sorted by severity', () => {
+    const result = makeScanResult();
+    const report = buildAuditReportData(result, {});
+
+    expect(report.remediationPlan.length).toBe(3);
+    expect(report.remediationPlan[0].obligationId).toBe('OBL-015');
+    expect(report.remediationPlan[0].priority).toBe(1);
+    expect(report.remediationPlan[0].effort).toBe('2-4 hours');
+  });
+
+  it('includes category breakdown from scan', () => {
+    const result = makeScanResult();
+    const report = buildAuditReportData(result, {});
+
+    expect(report.categoryBreakdown.length).toBe(2);
+    expect(report.categoryBreakdown[0].category).toBe('Transparency');
+  });
+
+  it('returns green zone label for high scores', () => {
+    const result = makeScanResult({
+      score: { ...makeScanResult().score, totalScore: 90, zone: 'green' },
+    });
+    const report = buildAuditReportData(result, {});
+    expect(report.zone).toBe('Good Compliance');
+  });
+
+  it('returns red zone label for low scores', () => {
+    const result = makeScanResult({
+      score: { ...makeScanResult().score, totalScore: 30, zone: 'red' },
+    });
+    const report = buildAuditReportData(result, {});
+    expect(report.zone).toBe('Critical Non-Compliance');
+  });
+
+  it('top recommendations come from highest severity findings', () => {
+    const result = makeScanResult();
+    const report = buildAuditReportData(result, {});
+
+    expect(report.executiveSummary.topRecommendations.length).toBe(3);
+    expect(report.executiveSummary.topRecommendations[0]).toBe('Add AI disclosure component');
+  });
+});

package/src/domain/reporter/audit-report.ts

@@ -0,0 +1,116 @@
+import type { ScanResult, Finding, CategoryScore } from '../../types/common.types.js';
+import { ENGINE_VERSION } from '../../version.js';
+
+export interface AuditReportData {
+  readonly title: string;
+  readonly organization: string;
+  readonly date: string;
+  readonly score: number;
+  readonly zone: string;
+  readonly jurisdiction: string;
+  readonly version: string;
+  readonly executiveSummary: {
+    readonly overallStatus: string;
+    readonly criticalIssues: number;
+    readonly highIssues: number;
+    readonly mediumIssues: number;
+    readonly lowIssues: number;
+    readonly recommendedActions: number;
+    readonly topRecommendations: readonly string[];
+  };
+  readonly categoryBreakdown: readonly CategoryScore[];
+  readonly findings: readonly Finding[];
+  readonly remediationPlan: readonly {
+    readonly priority: number;
+    readonly obligationId: string;
+    readonly article: string;
+    readonly description: string;
+    readonly effort: string;
+    readonly impact: string;
+  }[];
+  readonly totalChecks: number;
+  readonly passedChecks: number;
+  readonly failedChecks: number;
+}
+
+const EFFORT_MAP: Record<string, string> = {
+  critical: '4-8 hours',
+  high: '2-4 hours',
+  medium: '1-2 hours',
+  low: '< 1 hour',
+};
+
+const IMPACT_MAP: Record<string, string> = {
+  critical: '+10-15 points',
+  high: '+5-10 points',
+  medium: '+2-5 points',
+  low: '+1-2 points',
+};
+
+export const buildAuditReportData = (
+  scanResult: ScanResult,
+  options: {
+    readonly organization?: string;
+    readonly jurisdiction?: string;
+    readonly version?: string;
+  },
+): AuditReportData => {
+  const failures = scanResult.findings.filter((f) => f.type === 'fail');
+  const critical = failures.filter((f) => f.severity === 'critical');
+  const high = failures.filter((f) => f.severity === 'high');
+  const medium = failures.filter((f) => f.severity === 'medium');
+  const low = failures.filter((f) => f.severity === 'low');
+
+  const zoneLabel = scanResult.score.zone === 'green'
+    ? 'Good Compliance'
+    : scanResult.score.zone === 'yellow'
+      ? 'Partial Compliance'
+      : 'Critical Non-Compliance';
+
+  const topRecommendations = failures
+    .sort((a, b) => {
+      const order: Record<string, number> = { critical: 0, high: 1, medium: 2, low: 3, info: 4 };
+      return (order[a.severity] ?? 4) - (order[b.severity] ?? 4);
+    })
+    .slice(0, 3)
+    .map((f) => f.fix ?? f.message);
+
+  const remediationPlan = failures
+    .sort((a, b) => {
+      const order: Record<string, number> = { critical: 0, high: 1, medium: 2, low: 3, info: 4 };
+      return (order[a.severity] ?? 4) - (order[b.severity] ?? 4);
+    })
+    .map((f, i) => ({
+      priority: i + 1,
+      obligationId: f.obligationId ?? f.checkId,
+      article: f.articleReference ?? '',
+      description: f.fix ?? f.message,
+      effort: EFFORT_MAP[f.severity] ?? '1-2 hours',
+      impact: IMPACT_MAP[f.severity] ?? '+1-2 points',
+    }));
+
+  return {
+    title: 'Complior Audit Report',
+    organization: options.organization ?? 'Organization',
+    date: new Date().toISOString().split('T')[0],
+    score: scanResult.score.totalScore,
+    zone: zoneLabel,
+    jurisdiction: options.jurisdiction ?? 'EU AI Act',
+    version: options.version ?? ENGINE_VERSION,
+    executiveSummary: {
+      overallStatus: zoneLabel,
+      criticalIssues: critical.length,
+      highIssues: high.length,
+      mediumIssues: medium.length,
+      lowIssues: low.length,
+      recommendedActions: failures.length,
+      topRecommendations,
+    },
+    categoryBreakdown: scanResult.score.categoryScores,
+    findings: scanResult.findings,
+    remediationPlan,
+    totalChecks: scanResult.score.totalChecks,
+    passedChecks: scanResult.score.passedChecks,
+    failedChecks: scanResult.score.failedChecks,
+  };
+};

package/src/domain/reporter/badge-generator.test.ts

@@ -0,0 +1,54 @@
+import { describe, it, expect } from 'vitest';
+import { generateBadgeSvg } from './badge-generator.js';
+import { generateComplianceMd } from './compliance-md.js';
+import { createMockScanResult, createMockFinding } from '../../test-helpers/factories.js';
+import { ENGINE_VERSION } from '../../version.js';
+
+describe('badge-generator', () => {
+  it('generates SVG with correct color per zone', () => {
+    const red = generateBadgeSvg(30, 'red', 'EU', '2026-02-19');
+    const yellow = generateBadgeSvg(65, 'yellow', 'EU', '2026-02-19');
+    const green = generateBadgeSvg(95, 'green', 'EU', '2026-02-19');
+
+    expect(red).toContain('#e05d44');
+    expect(red).toContain('30%');
+    expect(yellow).toContain('#dfb317');
+    expect(yellow).toContain('65%');
+    expect(green).toContain('#97ca00');
+    expect(green).toContain('95%');
+  });
+
+  it('produces different SVGs for different scores', () => {
+    const a = generateBadgeSvg(40, 'red', 'EU', '2026-02-19');
+    const b = generateBadgeSvg(85, 'green', 'EU', '2026-02-19');
+
+    expect(a).not.toBe(b);
+    expect(a).toContain('40%');
+    expect(b).toContain('85%');
+  });
+});
+
+describe('compliance-md', () => {
+  it('generates markdown with findings summary and top issues', () => {
+    const result = createMockScanResult({
+      findings: [
+        createMockFinding({ checkId: 'ai-disclosure', severity: 'high', message: 'Missing AI disclosure' }),
+        createMockFinding({ checkId: 'data-governance', severity: 'critical', message: 'No data governance policy' }),
+        createMockFinding({ checkId: 'logging', severity: 'medium', message: 'Interaction logging missing' }),
+      ],
+    });
+
+    const md = generateComplianceMd(result, ENGINE_VERSION);
+
+    expect(md).toContain('# Compliance Report');
+    expect(md).toContain('75%');
+    expect(md).toContain('ai-disclosure');
+    expect(md).toContain('data-governance');
+    expect(md).toContain('**[CRITICAL]**');
+    expect(md).toContain('**[HIGH]**');
+    // Top issues are sorted by severity (critical first)
+    const criticalIdx = md.indexOf('CRITICAL');
+    const highIdx = md.indexOf('HIGH', criticalIdx + 1);
+    expect(criticalIdx).toBeLessThan(highIdx);
+  });
+});

package/src/domain/reporter/badge-generator.ts

@@ -0,0 +1,40 @@
+import type { ScoreZone } from '../../types/common.types.js';
+
+const ZONE_COLORS: Record<ScoreZone, string> = {
+  red: '#e05d44',
+  yellow: '#dfb317',
+  green: '#97ca00',
+};
+
+const LABEL = 'compliance';
+const LABEL_WIDTH = 78;
+const VALUE_WIDTH = 56;
+
+export const generateBadgeSvg = (
+  score: number,
+  zone: ScoreZone,
+  jurisdiction: string,
+  date: string,
+): string => {
+  const color = ZONE_COLORS[zone];
+  const totalWidth = LABEL_WIDTH + VALUE_WIDTH;
+  const scoreText = `${Math.round(score)}%`;
+
+  return `<svg xmlns="http://www.w3.org/2000/svg" width="${totalWidth}" height="20" role="img" aria-label="${LABEL}: ${scoreText}">
+  <title>${LABEL}: ${scoreText} (${jurisdiction}, ${date})</title>
+  <linearGradient id="s" x2="0" y2="100%">
+    <stop offset="0" stop-color="#bbb" stop-opacity=".1"/>
+    <stop offset="1" stop-opacity=".1"/>
+  </linearGradient>
+  <clipPath id="r"><rect width="${totalWidth}" height="20" rx="3" fill="#fff"/></clipPath>
+  <g clip-path="url(#r)">
+    <rect width="${LABEL_WIDTH}" height="20" fill="#555"/>
+    <rect x="${LABEL_WIDTH}" width="${VALUE_WIDTH}" height="20" fill="${color}"/>
+    <rect width="${totalWidth}" height="20" fill="url(#s)"/>
+  </g>
+  <g fill="#fff" text-anchor="middle" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" text-rendering="geometricPrecision" font-size="11">
+    <text x="${LABEL_WIDTH / 2}" y="14">${LABEL}</text>
+    <text x="${LABEL_WIDTH + VALUE_WIDTH / 2}" y="14">${scoreText}</text>
+  </g>
+</svg>`;
+};

package/src/domain/reporter/compliance-md.ts

@@ -0,0 +1,45 @@
+import { compareSeverity } from '../../types/common.types.js';
+import type { ScanResult } from '../../types/common.types.js';
+
+export const generateComplianceMd = (result: ScanResult, version: string): string => {
+  const { score, findings, scannedAt } = result;
+  const failFindings = findings.filter((f) => f.type === 'fail');
+  const topIssues = failFindings
+    .sort((a, b) => compareSeverity(a.severity, b.severity))
+    .slice(0, 5);
+
+  const findingsTable = failFindings.length > 0
+    ? `| Check ID | Severity | Message |
+|----------|----------|---------|
+${failFindings.map((f) => `| ${f.checkId} | ${f.severity} | ${f.message} |`).join('\n')}`
+    : '_No compliance issues found._';
+
+  const topIssuesList = topIssues.length > 0
+    ? topIssues.map((f, i) => `${i + 1}. **[${f.severity.toUpperCase()}]** ${f.checkId}: ${f.message}`).join('\n')
+    : '_None_';
+
+  return `# Compliance Report
+
+> Generated by Complior v${version} on ${scannedAt}
+
+## Score
+
+| Metric | Value |
+|--------|-------|
+| Total Score | **${score.totalScore}%** |
+| Zone | ${score.zone} |
+| Checks | ${score.totalChecks} total, ${score.passedChecks} passed, ${score.failedChecks} failed |
+
+## Findings Summary
+
+${findingsTable}
+
+## Top Issues
+
+${topIssuesList}
+
+---
+
+![Compliance Badge](.complior/badge.svg)
+`;
+};

package/src/domain/reporter/index.ts

@@ -0,0 +1,7 @@
+export { buildAuditReportData } from './audit-report.js';
+export type { AuditReportData } from './audit-report.js';
+export { generateBadgeSvg } from './badge-generator.js';
+export { generateComplianceMd } from './compliance-md.js';
+export { renderPdfReport } from './pdf-renderer.js';
+export { generateShareId, createSharePayload } from './share.js';
+export type { ShareFinding, SharePayload } from './share.js';