@complior/engine 0.9.0

package/src/domain/reporter/pdf-renderer.ts

@@ -0,0 +1,282 @@
+import type { AuditReportData } from './audit-report.js';
+
+interface PdfDoc {
+  fontSize(size: number): PdfDoc;
+  font(name: string): PdfDoc;
+  fillColor(color: string): PdfDoc;
+  text(text: string, options?: Record<string, unknown>): PdfDoc;
+  text(text: string, x: number, y: number, options?: Record<string, unknown>): PdfDoc;
+  moveDown(lines?: number): PdfDoc;
+  addPage(): PdfDoc;
+  rect(x: number, y: number, w: number, h: number): PdfDoc;
+  fill(color: string): PdfDoc;
+  stroke(): PdfDoc;
+  strokeColor(color: string): PdfDoc;
+  lineWidth(width: number): PdfDoc;
+  moveTo(x: number, y: number): PdfDoc;
+  lineTo(x: number, y: number): PdfDoc;
+  end(): void;
+  pipe(stream: NodeJS.WritableStream): void;
+  on(event: string, handler: (...args: unknown[]) => void): void;
+  y: number;
+  page: { width: number; height: number };
+}
+
+const COLORS = {
+  brand: '#1a73e8',
+  red: '#e05d44',
+  yellow: '#dfb317',
+  green: '#97ca00',
+  dark: '#333333',
+  medium: '#666666',
+  light: '#999999',
+  bg: '#f5f5f5',
+  white: '#ffffff',
+};
+
+const SEVERITY_COLORS: Record<string, string> = {
+  critical: '#d32f2f',
+  high: '#e05d44',
+  medium: '#dfb317',
+  low: '#97ca00',
+  info: '#999999',
+};
+
+const ZONE_COLORS: Record<string, string> = {
+  'Good Compliance': COLORS.green,
+  'Partial Compliance': COLORS.yellow,
+  'Critical Non-Compliance': COLORS.red,
+};
+
+const ensureSpace = (doc: PdfDoc, needed: number) => {
+  if (doc.y + needed > doc.page.height - 60) {
+    doc.addPage();
+  }
+};
+
+const renderHeader = (doc: PdfDoc, data: AuditReportData) => {
+  doc.rect(0, 0, doc.page.width, 100).fill(COLORS.brand);
+
+  doc.fillColor(COLORS.white).fontSize(22).font('Helvetica-Bold');
+  doc.text(data.title, 50, 25, { width: doc.page.width - 100 });
+
+  doc.fontSize(10).font('Helvetica');
+  doc.text(`${data.organization} | ${data.date} | ${data.jurisdiction} | Complior v${data.version}`, 50, 60, { width: doc.page.width - 100 });
+
+  doc.fillColor(COLORS.dark);
+  doc.y = 120;
+};
+
+const renderExecutiveSummary = (doc: PdfDoc, data: AuditReportData) => {
+  ensureSpace(doc, 200);
+
+  doc.fontSize(16).font('Helvetica-Bold').fillColor(COLORS.brand);
+  doc.text('1. Executive Summary');
+  doc.moveDown(0.5);
+
+  doc.fontSize(11).font('Helvetica').fillColor(COLORS.dark);
+
+  const zoneColor = ZONE_COLORS[data.zone] ?? COLORS.medium;
+  doc.font('Helvetica-Bold').fillColor(zoneColor);
+  doc.text(`Score: ${data.score}/100 — ${data.zone}`);
+  doc.moveDown(0.3);
+
+  doc.font('Helvetica').fillColor(COLORS.dark);
+  const es = data.executiveSummary;
+  doc.text(`Critical issues: ${es.criticalIssues}`);
+  doc.text(`High issues: ${es.highIssues}`);
+  doc.text(`Medium issues: ${es.mediumIssues}`);
+  doc.text(`Low issues: ${es.lowIssues}`);
+  doc.text(`Total recommended actions: ${es.recommendedActions}`);
+  doc.moveDown(0.5);
+
+  if (es.topRecommendations.length > 0) {
+    doc.font('Helvetica-Bold').text('Top Recommendations:');
+    doc.font('Helvetica');
+    for (const rec of es.topRecommendations) {
+      doc.text(`  • ${rec}`, { indent: 10 });
+    }
+  }
+  doc.moveDown(1);
+};
+
+const renderScoreOverview = (doc: PdfDoc, data: AuditReportData) => {
+  ensureSpace(doc, 200);
+
+  doc.fontSize(16).font('Helvetica-Bold').fillColor(COLORS.brand);
+  doc.text('2. Score Overview');
+  doc.moveDown(0.5);
+
+  doc.fontSize(11).font('Helvetica').fillColor(COLORS.dark);
+  doc.text(`Total Checks: ${data.totalChecks}  |  Passed: ${data.passedChecks}  |  Failed: ${data.failedChecks}`);
+  doc.moveDown(0.5);
+
+  if (data.categoryBreakdown.length > 0) {
+    doc.font('Helvetica-Bold').text('Category Breakdown:');
+    doc.moveDown(0.3);
+    doc.font('Helvetica');
+    for (const cat of data.categoryBreakdown) {
+      const pct = cat.obligationCount > 0
+        ? Math.round((cat.passedCount / cat.obligationCount) * 100)
+        : 0;
+      doc.text(`  ${cat.category}: ${pct}% (${cat.passedCount}/${cat.obligationCount}, weight: ${Math.round(cat.weight * 100)}%)`);
+    }
+  }
+  doc.moveDown(1);
+};
+
+const renderFindings = (doc: PdfDoc, data: AuditReportData) => {
+  const failures = data.findings.filter((f) => f.type === 'fail');
+  if (failures.length === 0) return;
+
+  ensureSpace(doc, 100);
+  doc.fontSize(16).font('Helvetica-Bold').fillColor(COLORS.brand);
+  doc.text('3. Findings');
+  doc.moveDown(0.5);
+
+  const grouped: Record<string, typeof failures> = {};
+  for (const f of failures) {
+    const key = f.severity;
+    if (!grouped[key]) grouped[key] = [];
+    grouped[key].push(f);
+  }
+
+  const order = ['critical', 'high', 'medium', 'low', 'info'];
+  for (const sev of order) {
+    const group = grouped[sev];
+    if (!group || group.length === 0) continue;
+
+    ensureSpace(doc, 60);
+    const color = SEVERITY_COLORS[sev] ?? COLORS.medium;
+    doc.fontSize(13).font('Helvetica-Bold').fillColor(color);
+    doc.text(`${sev.toUpperCase()} (${group.length})`);
+    doc.moveDown(0.3);
+
+    doc.fontSize(10).font('Helvetica').fillColor(COLORS.dark);
+    for (const f of group) {
+      ensureSpace(doc, 40);
+      const obl = f.obligationId ? `${f.obligationId}: ` : '';
+      const art = f.articleReference ? ` [${f.articleReference}]` : '';
+      doc.text(`  • ${obl}${f.message}${art}`);
+      if (f.file) {
+        doc.fillColor(COLORS.light).text(`    File: ${f.file}${f.line ? `:${f.line}` : ''}`);
+        doc.fillColor(COLORS.dark);
+      }
+    }
+    doc.moveDown(0.5);
+  }
+  doc.moveDown(0.5);
+};
+
+const renderRemediationPlan = (doc: PdfDoc, data: AuditReportData) => {
+  if (data.remediationPlan.length === 0) return;
+
+  ensureSpace(doc, 100);
+  doc.fontSize(16).font('Helvetica-Bold').fillColor(COLORS.brand);
+  doc.text('4. Remediation Plan');
+  doc.moveDown(0.5);
+
+  doc.fontSize(10).font('Helvetica').fillColor(COLORS.dark);
+  for (const item of data.remediationPlan) {
+    ensureSpace(doc, 50);
+    doc.font('Helvetica-Bold');
+    doc.text(`#${item.priority}. ${item.obligationId} ${item.article ? `[${item.article}]` : ''}`);
+    doc.font('Helvetica');
+    doc.text(`  Action: ${item.description}`);
+    doc.text(`  Effort: ${item.effort}  |  Impact: ${item.impact}`);
+    doc.moveDown(0.3);
+  }
+  doc.moveDown(0.5);
+};
+
+const renderAppendix = (doc: PdfDoc) => {
+  doc.addPage();
+
+  doc.fontSize(16).font('Helvetica-Bold').fillColor(COLORS.brand);
+  doc.text('5. Appendix');
+  doc.moveDown(0.5);
+
+  doc.fontSize(11).font('Helvetica-Bold').fillColor(COLORS.dark);
+  doc.text('Methodology');
+  doc.moveDown(0.3);
+  doc.fontSize(10).font('Helvetica');
+  doc.text('This report was generated by Complior — an automated EU AI Act compliance scanner.', { width: doc.page.width - 100 });
+  doc.text('Scoring uses weighted category analysis across 8 compliance areas.', { width: doc.page.width - 100 });
+  doc.text('Critical findings apply a score cap of 40%.', { width: doc.page.width - 100 });
+  doc.moveDown(0.5);
+
+  doc.fontSize(11).font('Helvetica-Bold');
+  doc.text('EU AI Act Timeline');
+  doc.moveDown(0.3);
+  doc.fontSize(10).font('Helvetica');
+  const milestones = [
+    '2024-08-01: AI Act enters into force',
+    '2025-02-02: Prohibited practices ban',
+    '2025-08-02: GPAI obligations apply',
+    '2026-08-02: Full enforcement for high-risk AI',
+    '2027-08-02: Existing high-risk AI systems transition',
+    '2030-08-02: Public sector legacy systems deadline',
+  ];
+  for (const m of milestones) {
+    doc.text(`  • ${m}`);
+  }
+  doc.moveDown(1);
+
+  doc.fontSize(8).fillColor(COLORS.light);
+  doc.text('DISCLAIMER: This report is generated by automated compliance scanning software.', { width: doc.page.width - 100 });
+  doc.text('It does not constitute legal advice. Consult qualified legal counsel for compliance decisions.', { width: doc.page.width - 100 });
+};
+
+const renderWatermark = (doc: PdfDoc, isFree: boolean) => {
+  if (!isFree) return;
+
+  doc.fontSize(8).fillColor('#cccccc').font('Helvetica');
+  doc.text(
+    'Generated by Complior — Free Tier',
+    50,
+    doc.page.height - 30,
+    { width: doc.page.width - 100, align: 'center' },
+  );
+};
+
+export const renderPdfReport = async (
+  data: AuditReportData,
+  outputPath: string,
+  options?: { readonly isFree?: boolean },
+): Promise<string> => {
+  const { default: PDFDocument } = await import('pdfkit');
+  const { createWriteStream } = await import('node:fs');
+  const { mkdir } = await import('node:fs/promises');
+  const { dirname } = await import('node:path');
+
+  await mkdir(dirname(outputPath), { recursive: true });
+
+  return new Promise((resolve, reject) => {
+    const doc = new PDFDocument({
+      size: 'A4',
+      margins: { top: 50, bottom: 50, left: 50, right: 50 },
+      info: {
+        Title: data.title,
+        Author: 'Complior',
+        Subject: `Compliance Report — ${data.organization}`,
+        Creator: `Complior v${data.version}`,
+      },
+    }) as unknown as PdfDoc;
+
+    const stream = createWriteStream(outputPath);
+    doc.pipe(stream);
+
+    renderHeader(doc, data);
+    renderExecutiveSummary(doc, data);
+    renderScoreOverview(doc, data);
+    renderFindings(doc, data);
+    renderRemediationPlan(doc, data);
+    renderAppendix(doc);
+    renderWatermark(doc, options?.isFree !== false);
+
+    doc.end();
+
+    stream.on('finish', () => resolve(outputPath));
+    stream.on('error', reject);
+  });
+};

package/src/domain/reporter/share.test.ts

@@ -0,0 +1,92 @@
+import { describe, it, expect } from 'vitest';
+import { createSharePayload, generateShareId } from './share.js';
+import type { ScanResult } from '../../types/common.types.js';
+import { ENGINE_VERSION } from '../../version.js';
+
+const makeScanResult = (overrides?: Partial<ScanResult>): ScanResult => ({
+  score: {
+    totalScore: 72,
+    zone: 'yellow',
+    categoryScores: [],
+    criticalCapApplied: false,
+    totalChecks: 10,
+    passedChecks: 7,
+    failedChecks: 3,
+    skippedChecks: 0,
+  },
+  findings: [
+    { checkId: 'chk-1', type: 'fail', message: 'No AI disclosure', severity: 'high', obligationId: 'OBL-015', articleReference: 'Art. 50(1)', fix: 'Add AI disclosure component' },
+    { checkId: 'chk-2', type: 'fail', message: 'No C2PA marking', severity: 'high', obligationId: 'OBL-016', articleReference: 'Art. 50(2)', fix: 'Add C2PA metadata' },
+    { checkId: 'chk-3', type: 'fail', message: 'Missing monitoring', severity: 'medium', obligationId: 'OBL-011', articleReference: 'Art. 26' },
+    { checkId: 'chk-4', type: 'pass', message: 'Logging present', severity: 'info' },
+    { checkId: 'chk-5', type: 'pass', message: 'Documentation found', severity: 'info' },
+  ],
+  projectPath: '/test',
+  scannedAt: new Date().toISOString(),
+  duration: 1200,
+  filesScanned: 50,
+  ...overrides,
+});
+
+describe('share', () => {
+  describe('generateShareId', () => {
+    it('generates unique IDs with cpl_sh_ prefix', () => {
+      const id1 = generateShareId();
+      const id2 = generateShareId();
+      expect(id1).toMatch(/^cpl_sh_[0-9A-Za-z]{8}$/);
+      expect(id2).toMatch(/^cpl_sh_[0-9A-Za-z]{8}$/);
+      expect(id1).not.toBe(id2);
+    });
+  });
+
+  describe('createSharePayload', () => {
+    it('creates payload with correct score and findings count', () => {
+      const result = makeScanResult();
+      const payload = createSharePayload(result, ENGINE_VERSION);
+
+      expect(payload.score).toBe(72);
+      expect(payload.findingsCount.high).toBe(2);
+      expect(payload.findingsCount.medium).toBe(1);
+      expect(payload.findingsCount.critical).toBe(0);
+      expect(payload.findingsCount.low).toBe(0);
+      expect(payload.jurisdiction).toBe('EU AI Act');
+      expect(payload.scanType).toBe('code');
+      expect(payload.compliorVersion).toBe(ENGINE_VERSION);
+    });
+
+    it('returns top 5 findings sorted by severity (no file paths)', () => {
+      const result = makeScanResult();
+      const payload = createSharePayload(result, ENGINE_VERSION);
+
+      expect(payload.topFindings.length).toBe(3); // only 3 fail findings
+      expect(payload.topFindings[0].severity).toBe('high');
+      expect(payload.topFindings[0].obligationId).toBe('OBL-015');
+      // Verify no file paths leak
+      for (const f of payload.topFindings) {
+        expect(f).not.toHaveProperty('file');
+        expect(f).not.toHaveProperty('line');
+      }
+    });
+
+    it('sets expiration based on options', () => {
+      const result = makeScanResult();
+      const payload = createSharePayload(result, ENGINE_VERSION, { expirationDays: 90 });
+
+      const created = new Date(payload.createdAt);
+      const expires = new Date(payload.expiresAt);
+      const diffDays = (expires.getTime() - created.getTime()) / (1000 * 60 * 60 * 24);
+      expect(Math.round(diffDays)).toBe(90);
+    });
+
+    it('respects custom jurisdiction and scanType', () => {
+      const result = makeScanResult();
+      const payload = createSharePayload(result, ENGINE_VERSION, {
+        jurisdiction: 'UK AI Framework',
+        scanType: 'external',
+      });
+
+      expect(payload.jurisdiction).toBe('UK AI Framework');
+      expect(payload.scanType).toBe('external');
+    });
+  });
+});

package/src/domain/reporter/share.ts

@@ -0,0 +1,80 @@
+import type { ScanResult, Finding } from '../../types/common.types.js';
+
+export interface ShareFinding {
+  readonly obligationId: string;
+  readonly article: string;
+  readonly severity: string;
+  readonly title: string;
+  readonly recommendation: string;
+}
+
+export interface SharePayload {
+  readonly id: string;
+  readonly createdAt: string;
+  readonly expiresAt: string;
+  readonly score: number;
+  readonly jurisdiction: string;
+  readonly findingsCount: {
+    readonly critical: number;
+    readonly high: number;
+    readonly medium: number;
+    readonly low: number;
+  };
+  readonly topFindings: readonly ShareFinding[];
+  readonly scanType: 'code' | 'external';
+  readonly compliorVersion: string;
+}
+
+const BASE62_CHARS = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';
+
+export const generateShareId = (): string => {
+  let id = '';
+  for (let i = 0; i < 8; i++) {
+    id += BASE62_CHARS[Math.floor(Math.random() * BASE62_CHARS.length)];
+  }
+  return `cpl_sh_${id}`;
+};
+
+const findingToShareFinding = (f: Finding): ShareFinding => ({
+  obligationId: f.obligationId ?? f.checkId,
+  article: f.articleReference ?? '',
+  severity: f.severity,
+  title: f.message,
+  recommendation: f.fix ?? 'Review and address this finding.',
+});
+
+export const createSharePayload = (
+  scanResult: ScanResult,
+  version: string,
+  options?: { readonly jurisdiction?: string; readonly scanType?: 'code' | 'external'; readonly expirationDays?: number },
+): SharePayload => {
+  const now = new Date();
+  const expirationDays = options?.expirationDays ?? 30;
+  const expiresAt = new Date(now.getTime() + expirationDays * 24 * 60 * 60 * 1000);
+
+  const findings = scanResult.findings.filter((f) => f.type === 'fail');
+  const critical = findings.filter((f) => f.severity === 'critical').length;
+  const high = findings.filter((f) => f.severity === 'high').length;
+  const medium = findings.filter((f) => f.severity === 'medium').length;
+  const low = findings.filter((f) => f.severity === 'low').length;
+
+  const topFindings = findings
+    .sort((a, b) => {
+      const order: Record<string, number> = { critical: 0, high: 1, medium: 2, low: 3, info: 4 };
+      return (order[a.severity] ?? 4) - (order[b.severity] ?? 4);
+    })
+    .slice(0, 5)
+    .map(findingToShareFinding);
+
+  return {
+    id: generateShareId(),
+    createdAt: now.toISOString(),
+    expiresAt: expiresAt.toISOString(),
+    score: scanResult.score.totalScore,
+    jurisdiction: options?.jurisdiction ?? 'EU AI Act',
+    findingsCount: { critical, high, medium, low },
+    topFindings,
+    scanType: options?.scanType ?? 'code',
+    compliorVersion: version,
+  };
+};

package/src/domain/scanner/ast/swc-analyzer.test.ts

@@ -0,0 +1,49 @@
+import { describe, it, expect } from 'vitest';
+import { analyzeStructure } from './swc-analyzer.js';
+
+describe('analyzeStructure', () => {
+  it('detects LLM calls without error handling', () => {
+    const code = `const result = await client.create({ model: 'gpt-4' });`;
+    const findings = analyzeStructure(code, 'src/chat.ts', '.ts');
+    const missing = findings.find((f) => f.type === 'missing-error-handling');
+    expect(missing).toBeDefined();
+  });
+
+  it('does not flag LLM calls with try-catch', () => {
+    const code = `try { const result = await client.create({}); } catch (e) { console.error(e); }`;
+    const findings = analyzeStructure(code, 'src/chat.ts', '.ts');
+    const missing = findings.find((f) => f.type === 'missing-error-handling');
+    expect(missing).toBeUndefined();
+  });
+
+  it('detects safety config mutations', () => {
+    const code = `config.safety = false;\noptions.moderation = 'none';`;
+    const findings = analyzeStructure(code, 'src/config.ts', '.ts');
+    const mutations = findings.filter((f) => f.type === 'safety-mutation');
+    expect(mutations.length).toBeGreaterThanOrEqual(1);
+  });
+
+  it('detects unsafe method calls', () => {
+    const code = `client.dangerouslyAllow('all');`;
+    const findings = analyzeStructure(code, 'src/setup.ts', '.ts');
+    expect(findings.some((f) => f.type === 'safety-mutation')).toBe(true);
+  });
+
+  it('detects Python compliance decorators', () => {
+    const code = `@require_approval\ndef process_data():\n    pass`;
+    const findings = analyzeStructure(code, 'src/handler.py', '.py');
+    expect(findings.some((f) => f.type === 'decorator-pattern')).toBe(true);
+  });
+
+  it('returns empty for clean code', () => {
+    const code = `const x = 1;\nconst y = 2;`;
+    const findings = analyzeStructure(code, 'src/utils.ts', '.ts');
+    expect(findings).toEqual([]);
+  });
+
+  it('returns empty for non-supported extension', () => {
+    const code = `killSwitch = true`;
+    const findings = analyzeStructure(code, 'src/readme.md', '.md');
+    expect(findings).toEqual([]);
+  });
+});

package/src/domain/scanner/ast/swc-analyzer.ts

@@ -0,0 +1,124 @@
+/**
+ * Lightweight structural analysis for TypeScript/JavaScript code.
+ * Approximates AST patterns using targeted regex (no external parser dependency).
+ * Detects: bare LLM calls vs wrapped calls, safety config mutations, error handling.
+ */
+
+import { getLineNumber } from '../source-filter.js';
+import { AST_SUPPORTED_EXTENSIONS } from '../constants.js';
+
+export interface StructuralFinding {
+  readonly type: 'bare-call' | 'wrapped-call' | 'safety-mutation' | 'missing-error-handling' | 'decorator-pattern';
+  readonly file: string;
+  readonly line: number;
+  readonly description: string;
+  readonly confidence: number; // 0-100
+}
+
+/** Detect function definitions that wrap LLM calls with pre/post logic */
+const WRAPPER_PATTERNS = [
+  // Function that calls LLM and has logging/validation
+  /(?:async\s+)?function\s+\w+[^{]*\{[^}]*(?:log|validate|check|verify|audit)[^}]*(?:create|generate|invoke|chat|complete)[^}]*\}/gs,
+  // Arrow function with compliance logic
+  /const\s+\w+\s*=\s*(?:async\s+)?\([^)]*\)\s*(?::\s*\w+)?\s*=>\s*\{[^}]*(?:log|validate|check)[^}]*(?:create|generate)[^}]*\}/gs,
+];
+
+/** Detect safety config mutations (disabling safety features) */
+const SAFETY_MUTATION_PATTERNS = [
+  /(?:config|options|settings)\s*\.\s*(?:safety|moderation|filter|guard)\s*=\s*(?:false|'none'|"none"|null|0|undefined)/gi,
+  /(?:disable|skip|bypass)(?:Safety|Moderation|Filter|Guard|Check|Validation)\s*[=(]/gi,
+  /(?:safety|moderation|filter)\s*:\s*(?:false|'none'|"none"|'off'|"off")/gi,
+  /\.(?:unsafe|dangerouslyAllow|skipValidation|noCheck)\s*\(/gi,
+];
+
+/** Detect try-catch around LLM calls ([\s\S]*? allows nested braces) */
+const TRY_CATCH_LLM = /try\s*\{[\s\S]*?(?:\.create|\.generate|\.invoke|\.chat|generateText|streamText)[\s\S]*?\}\s*catch/gs;
+
+/** Detect Python decorator patterns for compliance */
+const PYTHON_DECORATOR_PATTERNS = [
+  /@(?:require_approval|log_ai_call|audit|compliance|rate_limit|authorize|validate_input)/g,
+  /def\s+\w+\s*\([^)]*\)\s*(?:->.*)?:\s*\n\s+"""[^"]*compliance[^"]*"""/gi,
+];
+
+export const analyzeStructure = (
+  content: string,
+  filePath: string,
+  extension: string,
+): readonly StructuralFinding[] => {
+  const findings: StructuralFinding[] = [];
+
+  const getLine = (index: number): number => getLineNumber(content, index);
+
+  if (AST_SUPPORTED_EXTENSIONS.has(extension)) {
+    // Check for LLM calls without try-catch
+    const llmCallRegex = /(?:\.create|\.generate|\.invoke|\.chat|generateText|streamText)\s*\(/g;
+    let match: RegExpExecArray | null;
+
+    while ((match = llmCallRegex.exec(content)) !== null) {
+      const lineNum = getLine(match.index);
+
+      // Check if this call is inside a try-catch
+      const hasTryCatch = TRY_CATCH_LLM.test(content);
+      TRY_CATCH_LLM.lastIndex = 0; // Reset
+
+      if (!hasTryCatch) {
+        findings.push({
+          type: 'missing-error-handling',
+          file: filePath,
+          line: lineNum,
+          description: `LLM call without try-catch error handling at line ${lineNum}`,
+          confidence: 70,
+        });
+      }
+    }
+
+    // Check for wrapper patterns (positive — compliance mechanism)
+    for (const pattern of WRAPPER_PATTERNS) {
+      pattern.lastIndex = 0;
+      let wrapMatch: RegExpExecArray | null;
+      while ((wrapMatch = pattern.exec(content)) !== null) {
+        findings.push({
+          type: 'wrapped-call',
+          file: filePath,
+          line: getLine(wrapMatch.index),
+          description: 'LLM call with pre/post compliance logic (wrapper pattern)',
+          confidence: 75,
+        });
+      }
+    }
+
+    // Check for safety mutations
+    for (const pattern of SAFETY_MUTATION_PATTERNS) {
+      pattern.lastIndex = 0;
+      let safetyMatch: RegExpExecArray | null;
+      while ((safetyMatch = pattern.exec(content)) !== null) {
+        findings.push({
+          type: 'safety-mutation',
+          file: filePath,
+          line: getLine(safetyMatch.index),
+          description: `Safety feature disabled/bypassed: "${safetyMatch[0].trim()}"`,
+          confidence: 85,
+        });
+      }
+    }
+  }
+
+  if (extension === '.py') {
+    // Python decorator patterns
+    for (const pattern of PYTHON_DECORATOR_PATTERNS) {
+      pattern.lastIndex = 0;
+      let decMatch: RegExpExecArray | null;
+      while ((decMatch = pattern.exec(content)) !== null) {
+        findings.push({
+          type: 'decorator-pattern',
+          file: filePath,
+          line: getLine(decMatch.index),
+          description: `Compliance decorator: "${decMatch[0].trim()}"`,
+          confidence: 80,
+        });
+      }
+    }
+  }
+
+  return findings;
+};