@complior/engine 0.9.0

package/src/domain/scanner/checks/compliance-metadata.ts

@@ -0,0 +1,63 @@
+import type { CheckResult } from '../../../types/common.types.js';
+import type { ScanContext } from '../../../ports/scanner.port.js';
+
+const CHECK_ID = 'compliance-metadata';
+const OBLIGATION_ID = 'eu-ai-act-OBL-005';
+
+const WELL_KNOWN_PATH = '.well-known/ai-compliance.json';
+const COMPLIOR_DIR = '.complior/';
+
+const COMPLIANCE_META_PATTERNS: readonly RegExp[] = [
+  /\bai[-_]?compliance\b/i,
+  /\bcomplior\b/i,
+  /\beu[-_]?ai[-_]?act\b/i,
+  /\bcompliance[-_]?metadata\b/i,
+];
+
+const hasComplianceMetaTags = (content: string): boolean =>
+  COMPLIANCE_META_PATTERNS.some((p) => p.test(content));
+
+export const checkComplianceMetadata = (ctx: ScanContext): readonly CheckResult[] => {
+  for (const file of ctx.files) {
+    if (file.relativePath === WELL_KNOWN_PATH) {
+      return [{
+        type: 'pass',
+        checkId: CHECK_ID,
+        message: `Compliance metadata found at ${WELL_KNOWN_PATH}`,
+      }];
+    }
+  }
+
+  const compliorFiles = ctx.files.filter((f) =>
+    f.relativePath.startsWith(COMPLIOR_DIR),
+  );
+
+  if (compliorFiles.length > 0) {
+    return [{
+      type: 'pass',
+      checkId: CHECK_ID,
+      message: `.complior/ configuration directory found`,
+    }];
+  }
+
+  const htmlFiles = ctx.files.filter((f) => f.extension === '.html');
+  for (const file of htmlFiles) {
+    if (hasComplianceMetaTags(file.content)) {
+      return [{
+        type: 'pass',
+        checkId: CHECK_ID,
+        message: `Compliance metadata found in HTML: ${file.relativePath}`,
+      }];
+    }
+  }
+
+  return [{
+    type: 'fail',
+    checkId: CHECK_ID,
+    message: 'No compliance metadata found',
+    severity: 'low',
+    obligationId: OBLIGATION_ID,
+    articleReference: 'Art. 11',
+    fix: 'Add a .well-known/ai-compliance.json or .complior/ directory with compliance configuration',
+  }];
+};

package/src/domain/scanner/checks/content-marking.ts

@@ -0,0 +1,74 @@
+import { createPatternCheck } from './pattern-check-factory.js';
+
+const MARKING_PATTERNS: readonly RegExp[] = [
+  // C2PA / Content Authenticity Initiative
+  /\bc2pa\b/i,
+  /\bcontent-credentials\b/i,
+  /\bcontentcredentials\b/i,
+  /\bcontent[- ]?authenticity\b/i,
+  // Google SynthID
+  /\bsynthid\b/i,
+  /\bsynth[_-]?id\b/i,
+  // IPTC metadata
+  /\biptc\b/i,
+  /\bexif.*ai/i,
+  /\bdigitalSourceType\b/i,
+  // Invisible watermarking
+  /\binvisible[- ]?watermark\b/i,
+  /\bsteganograph/i,
+  /\brobust[- ]?watermark\b/i,
+  // Generic marking (require AI/content context)
+  /\bwatermark.*(?:ai|generat|synthe|content|media)/i,
+  /(?:ai|generat|synthe|content|media).*\bwatermark/i,
+  /\bai-generated\b/i,
+  /X-AI-Generated/i,
+  /\bsynthetic[- ]?media\b/i,
+  /\bdigital[- ]?provenance\b/i,
+  // SDK markers
+  /\bcontent[- ]?provenance\b/i,
+  /\bai[_-]?content[_-]?label\b/i,
+];
+
+const CONTENT_GENERATION_PATTERNS: readonly RegExp[] = [
+  // API calls
+  /\bgenerateImage\b/,
+  /\bgenerateVideo\b/,
+  /\bgenerateAudio\b/,
+  /\bimages\.generate\b/,
+  /\baudio\.speech\b/,
+  // Text-to-X modalities
+  /\btext-to-image\b/i,
+  /\btext-to-speech\b/i,
+  /\btext-to-video\b/i,
+  /\btext-to-audio\b/i,
+  /\bimage-to-image\b/i,
+  // Generic
+  /\bimage[- ]?generation\b/i,
+  /\bcontent[- ]?generation\b/i,
+  /\bvideo[- ]?generation\b/i,
+  /\baudio[- ]?generation\b/i,
+  /\bspeech[- ]?synthesis\b/i,
+  // Known models/services
+  /\bDALL[-.]?E\b/i,
+  /\bstable[- ]?diffusion\b/i,
+  /\bmidjourney\b/i,
+  /\bflux[._-]?(?:pro|dev|schnell|1)\b/i,
+  /\bsuno\b/i,
+  /\bsora\b/i,
+  /\belevenlabs\b/i,
+  /\bwhisper\b/i,
+  /\bdeepfake\b/i,
+];
+
+export const checkContentMarking = createPatternCheck({
+  checkId: 'content-marking',
+  articleRef: 'Art. 50(2)',
+  obligationId: 'eu-ai-act-OBL-016',
+  severity: 'high',
+  positivePatterns: MARKING_PATTERNS,
+  contextPatterns: CONTENT_GENERATION_PATTERNS,
+  passMessage: 'Content marking/provenance mechanisms found',
+  failMessage: 'AI content generation detected without marking/watermarking',
+  skipReason: 'No AI content generation detected',
+  fix: 'Implement C2PA content credentials or watermarking for AI-generated content',
+});

package/src/domain/scanner/checks/dep-deep-scan.test.ts

@@ -0,0 +1,318 @@
+import { describe, it, expect } from 'vitest';
+import { runDepDeepScan, depScanToCheckResults, COPYLEFT_LICENSES, KNOWN_VULNERABLE } from './dep-deep-scan.js';
+import type { ScanContext } from '../../../ports/scanner.port.js';
+
+const makeCtx = (files: { relativePath: string; content: string }[]): ScanContext => ({
+  projectPath: '/test',
+  files: files.map(f => ({
+    path: `/test/${f.relativePath}`,
+    relativePath: f.relativePath,
+    content: f.content,
+    extension: f.relativePath.split('.').pop() ?? '',
+  })),
+});
+
+describe('runDepDeepScan', () => {
+  it('analyzes package-lock.json with vulnerable deps', () => {
+    const ctx = makeCtx([{
+      relativePath: 'package-lock.json',
+      content: JSON.stringify({
+        lockfileVersion: 3,
+        packages: {
+          '': { name: 'app', version: '1.0.0' },
+          'node_modules/lodash': { version: '4.17.20', license: 'MIT' },
+          'node_modules/express': { version: '4.18.2', license: 'MIT' },
+        },
+      }),
+    }]);
+    const result = runDepDeepScan(ctx);
+    expect(result.totalDeps).toBe(2);
+    expect(result.directDeps).toBe(2);
+    expect(result.vulnerabilities).toHaveLength(1);
+    expect(result.vulnerabilities[0].cve).toBe('CVE-2021-23337');
+    expect(result.vulnerabilities[0].name).toBe('lodash');
+  });
+
+  it('detects copyleft license', () => {
+    const ctx = makeCtx([{
+      relativePath: 'package-lock.json',
+      content: JSON.stringify({
+        lockfileVersion: 3,
+        packages: {
+          '': { name: 'app' },
+          'node_modules/gpl-pkg': { version: '1.0.0', license: 'GPL-3.0' },
+        },
+      }),
+    }]);
+    const result = runDepDeepScan(ctx);
+    expect(result.licenseIssues).toHaveLength(1);
+    expect(result.licenseIssues[0].license).toBe('GPL-3.0');
+    expect(result.licenseIssues[0].name).toBe('gpl-pkg');
+  });
+
+  it('detects AGPL license', () => {
+    const ctx = makeCtx([{
+      relativePath: 'package-lock.json',
+      content: JSON.stringify({
+        lockfileVersion: 3,
+        packages: {
+          '': { name: 'app' },
+          'node_modules/agpl-lib': { version: '2.0.0', license: 'AGPL-3.0-only' },
+        },
+      }),
+    }]);
+    const result = runDepDeepScan(ctx);
+    expect(result.licenseIssues).toHaveLength(1);
+    expect(result.licenseIssues[0].license).toBe('AGPL-3.0-only');
+  });
+
+  it('returns empty results for no lock files', () => {
+    const ctx = makeCtx([{
+      relativePath: 'src/index.ts',
+      content: 'console.log("hello")',
+    }]);
+    const result = runDepDeepScan(ctx);
+    expect(result.totalDeps).toBe(0);
+    expect(result.directDeps).toBe(0);
+    expect(result.transitiveDeps).toBe(0);
+    expect(result.licenseIssues).toHaveLength(0);
+    expect(result.vulnerabilities).toHaveLength(0);
+    expect(result.ecosystems).toHaveLength(0);
+  });
+
+  it('identifies multiple vulnerabilities in same project', () => {
+    const ctx = makeCtx([{
+      relativePath: 'package-lock.json',
+      content: JSON.stringify({
+        lockfileVersion: 3,
+        packages: {
+          '': { name: 'app' },
+          'node_modules/minimist': { version: '1.2.5' },
+          'node_modules/shell-quote': { version: '1.7.3' },
+          'node_modules/jsonwebtoken': { version: '8.5.1' },
+        },
+      }),
+    }]);
+    const result = runDepDeepScan(ctx);
+    expect(result.vulnerabilities).toHaveLength(3);
+    const cves = result.vulnerabilities.map(v => v.cve);
+    expect(cves).toContain('CVE-2021-44906');
+    expect(cves).toContain('CVE-2021-42740');
+    expect(cves).toContain('CVE-2022-23529');
+  });
+
+  it('tracks ecosystem information', () => {
+    const ctx = makeCtx([
+      {
+        relativePath: 'package-lock.json',
+        content: JSON.stringify({
+          lockfileVersion: 3,
+          packages: {
+            '': { name: 'app' },
+            'node_modules/express': { version: '4.18.2' },
+          },
+        }),
+      },
+      {
+        relativePath: 'Cargo.lock',
+        content: `[[package]]\nname = "serde"\nversion = "1.0.193"\n`,
+      },
+    ]);
+    const result = runDepDeepScan(ctx);
+    expect(result.ecosystems).toContain('npm');
+    expect(result.ecosystems).toContain('cargo');
+  });
+
+  it('counts direct vs transitive deps from v1 lockfile', () => {
+    const ctx = makeCtx([{
+      relativePath: 'package-lock.json',
+      content: JSON.stringify({
+        lockfileVersion: 1,
+        dependencies: {
+          express: {
+            version: '4.18.2',
+            dependencies: {
+              'body-parser': { version: '1.20.1' },
+              'cookie': { version: '0.5.0' },
+            },
+          },
+        },
+      }),
+    }]);
+    const result = runDepDeepScan(ctx);
+    expect(result.totalDeps).toBe(3);
+    expect(result.directDeps).toBe(1);
+    expect(result.transitiveDeps).toBe(2);
+  });
+
+  it('handles safe dependencies without vulns or copyleft', () => {
+    const ctx = makeCtx([{
+      relativePath: 'package-lock.json',
+      content: JSON.stringify({
+        lockfileVersion: 3,
+        packages: {
+          '': { name: 'app' },
+          'node_modules/zod': { version: '3.22.4', license: 'MIT' },
+          'node_modules/hono': { version: '3.12.0', license: 'MIT' },
+        },
+      }),
+    }]);
+    const result = runDepDeepScan(ctx);
+    expect(result.totalDeps).toBe(2);
+    expect(result.vulnerabilities).toHaveLength(0);
+    expect(result.licenseIssues).toHaveLength(0);
+  });
+});
+
+describe('depScanToCheckResults', () => {
+  it('returns pass for no lock files', () => {
+    const result = depScanToCheckResults({
+      totalDeps: 0,
+      directDeps: 0,
+      transitiveDeps: 0,
+      licenseIssues: [],
+      vulnerabilities: [],
+      ecosystems: [],
+    });
+    expect(result).toHaveLength(1);
+    expect(result[0].type).toBe('pass');
+    expect(result[0].checkId).toBe('l3-dep-scan');
+  });
+
+  it('returns summary pass + fail checks for issues', () => {
+    const result = depScanToCheckResults({
+      totalDeps: 10,
+      directDeps: 3,
+      transitiveDeps: 7,
+      licenseIssues: [{ name: 'gpl-pkg', version: '1.0.0', license: 'GPL-3.0' }],
+      vulnerabilities: [{ name: 'lodash', version: '4.17.20', cve: 'CVE-2021-23337', severity: 'high', description: 'Prototype Pollution' }],
+      ecosystems: ['npm'],
+    });
+    expect(result.length).toBe(3); // 1 pass summary + 1 license + 1 vuln
+    expect(result[0].type).toBe('pass');
+    expect(result[0].checkId).toBe('l3-dep-scan');
+    expect(result[1].type).toBe('fail');
+    expect(result[1].checkId).toBe('l3-dep-license');
+    expect(result[2].type).toBe('fail');
+    expect(result[2].checkId).toBe('l3-dep-vuln');
+  });
+
+  it('maps vulnerability severity to check severity', () => {
+    const result = depScanToCheckResults({
+      totalDeps: 3,
+      directDeps: 3,
+      transitiveDeps: 0,
+      licenseIssues: [],
+      vulnerabilities: [
+        { name: 'minimist', version: '1.2.5', cve: 'CVE-2021-44906', severity: 'critical', description: 'Prototype Pollution' },
+        { name: 'semver', version: '7.3.7', cve: 'CVE-2022-25883', severity: 'medium', description: 'ReDoS' },
+      ],
+      ecosystems: ['npm'],
+    });
+    const criticalCheck = result.find(r => r.type === 'fail' && r.message.includes('minimist'));
+    const mediumCheck = result.find(r => r.type === 'fail' && r.message.includes('semver'));
+    expect(criticalCheck).toBeDefined();
+    if (criticalCheck?.type === 'fail') expect(criticalCheck.severity).toBe('critical');
+    expect(mediumCheck).toBeDefined();
+    if (mediumCheck?.type === 'fail') expect(mediumCheck.severity).toBe('medium');
+  });
+
+  it('includes article reference and obligation for license issues', () => {
+    const result = depScanToCheckResults({
+      totalDeps: 1,
+      directDeps: 1,
+      transitiveDeps: 0,
+      licenseIssues: [{ name: 'gpl-lib', version: '2.0.0', license: 'AGPL-3.0' }],
+      vulnerabilities: [],
+      ecosystems: ['npm'],
+    });
+    const licenseCheck = result.find(r => r.type === 'fail');
+    expect(licenseCheck).toBeDefined();
+    if (licenseCheck?.type === 'fail') {
+      expect(licenseCheck.obligationId).toBe('eu-ai-act-OBL-005');
+      expect(licenseCheck.articleReference).toBe('Art. 11 / Annex IV');
+      expect(licenseCheck.fix).toContain('AGPL-3.0');
+    }
+  });
+
+  it('includes article reference and obligation for vulnerabilities', () => {
+    const result = depScanToCheckResults({
+      totalDeps: 1,
+      directDeps: 1,
+      transitiveDeps: 0,
+      licenseIssues: [],
+      vulnerabilities: [{ name: 'lodash', version: '4.17.20', cve: 'CVE-2021-23337', severity: 'high', description: 'Pollution' }],
+      ecosystems: ['npm'],
+    });
+    const vulnCheck = result.find(r => r.type === 'fail');
+    expect(vulnCheck).toBeDefined();
+    if (vulnCheck?.type === 'fail') {
+      expect(vulnCheck.obligationId).toBe('eu-ai-act-OBL-015');
+      expect(vulnCheck.articleReference).toBe('Art. 15 (Accuracy, robustness, cybersecurity)');
+      expect(vulnCheck.fix).toContain('CVE-2021-23337');
+    }
+  });
+
+  it('summary message includes ecosystem names', () => {
+    const result = depScanToCheckResults({
+      totalDeps: 5,
+      directDeps: 2,
+      transitiveDeps: 3,
+      licenseIssues: [],
+      vulnerabilities: [],
+      ecosystems: ['npm', 'cargo'],
+    });
+    expect(result[0].type).toBe('pass');
+    expect(result[0].message).toContain('npm, cargo');
+    expect(result[0].message).toContain('5 dependencies');
+  });
+
+  it('returns only pass summary when no issues found', () => {
+    const result = depScanToCheckResults({
+      totalDeps: 15,
+      directDeps: 5,
+      transitiveDeps: 10,
+      licenseIssues: [],
+      vulnerabilities: [],
+      ecosystems: ['npm'],
+    });
+    expect(result).toHaveLength(1);
+    expect(result[0].type).toBe('pass');
+  });
+});
+
+describe('COPYLEFT_LICENSES', () => {
+  it('contains GPL variants', () => {
+    expect(COPYLEFT_LICENSES.has('GPL-3.0')).toBe(true);
+    expect(COPYLEFT_LICENSES.has('GPL-2.0-or-later')).toBe(true);
+  });
+
+  it('contains AGPL', () => {
+    expect(COPYLEFT_LICENSES.has('AGPL-3.0')).toBe(true);
+    expect(COPYLEFT_LICENSES.has('AGPL-3.0-only')).toBe(true);
+  });
+
+  it('does not flag MIT', () => {
+    expect(COPYLEFT_LICENSES.has('MIT')).toBe(false);
+  });
+
+  it('does not flag Apache-2.0', () => {
+    expect(COPYLEFT_LICENSES.has('Apache-2.0')).toBe(false);
+  });
+});
+
+describe('KNOWN_VULNERABLE', () => {
+  it('has at least 20 entries', () => {
+    expect(KNOWN_VULNERABLE.length).toBeGreaterThanOrEqual(20);
+  });
+
+  it('all entries have required fields', () => {
+    for (const vuln of KNOWN_VULNERABLE) {
+      expect(vuln.package).toBeTruthy();
+      expect(vuln.versions.length).toBeGreaterThan(0);
+      expect(vuln.cve).toMatch(/^CVE-\d{4}-\d+$/);
+      expect(['critical', 'high', 'medium']).toContain(vuln.severity);
+      expect(vuln.description).toBeTruthy();
+    }
+  });
+});

package/src/domain/scanner/checks/dep-deep-scan.ts

@@ -0,0 +1,137 @@
+import type { CheckResult, Severity } from '../../../types/common.types.js';
+import type { ScanContext } from '../../../ports/scanner.port.js';
+import { parseLockfiles, type LockfileDependency } from '../layers/lockfile-parsers.js';
+
+export const COPYLEFT_LICENSES = new Set([
+  'GPL-2.0', 'GPL-2.0-only', 'GPL-2.0-or-later',
+  'GPL-3.0', 'GPL-3.0-only', 'GPL-3.0-or-later',
+  'AGPL-3.0', 'AGPL-3.0-only', 'AGPL-3.0-or-later',
+  'LGPL-2.1', 'LGPL-2.1-only', 'LGPL-2.1-or-later',
+  'LGPL-3.0', 'LGPL-3.0-only', 'LGPL-3.0-or-later',
+  'SSPL-1.0',
+  'EUPL-1.2',
+  'MPL-2.0',
+  'CC-BY-SA-4.0',
+]);
+
+export interface KnownVulnerability {
+  readonly package: string;
+  readonly versions: readonly string[];
+  readonly cve: string;
+  readonly severity: 'critical' | 'high' | 'medium';
+  readonly description: string;
+}
+
+export const KNOWN_VULNERABLE: readonly KnownVulnerability[] = [
+  { package: 'lodash', versions: ['4.17.20', '4.17.19', '4.17.15', '4.17.11'], cve: 'CVE-2021-23337', severity: 'high', description: 'Prototype Pollution via template' },
+  { package: 'minimist', versions: ['1.2.5', '1.2.4', '1.2.3', '0.2.1'], cve: 'CVE-2021-44906', severity: 'critical', description: 'Prototype Pollution' },
+  { package: 'node-fetch', versions: ['2.6.1', '2.6.0', '1.7.3'], cve: 'CVE-2022-0235', severity: 'high', description: 'Exposure of Sensitive Information' },
+  { package: 'tar', versions: ['6.1.0', '6.0.5', '4.4.15'], cve: 'CVE-2021-37712', severity: 'high', description: 'Arbitrary File Creation/Overwrite' },
+  { package: 'glob-parent', versions: ['5.1.1', '5.1.0', '3.1.0'], cve: 'CVE-2021-35065', severity: 'high', description: 'Regular Expression Denial of Service' },
+  { package: 'json5', versions: ['2.2.1', '2.2.0', '1.0.1'], cve: 'CVE-2022-46175', severity: 'high', description: 'Prototype Pollution' },
+  { package: 'semver', versions: ['7.3.7', '7.3.5', '6.3.0'], cve: 'CVE-2022-25883', severity: 'medium', description: 'Regular Expression Denial of Service' },
+  { package: 'yaml', versions: ['2.1.1', '2.1.0', '1.10.2'], cve: 'CVE-2023-2251', severity: 'medium', description: 'Arbitrary Code Execution' },
+  { package: 'word-wrap', versions: ['1.2.3', '1.2.2'], cve: 'CVE-2023-26115', severity: 'medium', description: 'Regular Expression Denial of Service' },
+  { package: 'tough-cookie', versions: ['4.1.2', '4.1.1', '4.0.0'], cve: 'CVE-2023-26136', severity: 'medium', description: 'Prototype Pollution' },
+  { package: 'xml2js', versions: ['0.5.0', '0.4.23'], cve: 'CVE-2023-0842', severity: 'medium', description: 'Prototype Pollution' },
+  { package: 'express', versions: ['4.17.1', '4.17.0', '4.16.4'], cve: 'CVE-2024-29041', severity: 'medium', description: 'Open Redirect in malformed URLs' },
+  { package: 'axios', versions: ['1.6.0', '1.5.1', '0.21.1'], cve: 'CVE-2023-45857', severity: 'medium', description: 'Cross-Site Request Forgery via cookie exposure' },
+  { package: 'ua-parser-js', versions: ['0.7.31', '0.7.28'], cve: 'CVE-2022-25927', severity: 'high', description: 'Regular Expression Denial of Service' },
+  { package: 'qs', versions: ['6.10.3', '6.9.7', '6.5.3'], cve: 'CVE-2022-24999', severity: 'high', description: 'Prototype Pollution' },
+  { package: 'decode-uri-component', versions: ['0.2.0', '0.2.1'], cve: 'CVE-2022-38900', severity: 'high', description: 'Improper Input Validation / DoS' },
+  { package: 'jsonwebtoken', versions: ['8.5.1', '8.5.0', '8.4.0'], cve: 'CVE-2022-23529', severity: 'critical', description: 'Improper Restriction of Security Token Assignment' },
+  { package: 'shell-quote', versions: ['1.7.2', '1.7.3'], cve: 'CVE-2021-42740', severity: 'critical', description: 'Command Injection' },
+  { package: 'cross-fetch', versions: ['3.1.4', '3.1.5'], cve: 'CVE-2022-1365', severity: 'medium', description: 'Exposure of Sensitive Information' },
+  { package: 'ansi-regex', versions: ['5.0.0', '4.1.0', '3.0.0'], cve: 'CVE-2021-3807', severity: 'high', description: 'Regular Expression Denial of Service' },
+  { package: 'moment', versions: ['2.29.3', '2.29.2', '2.29.1'], cve: 'CVE-2022-31129', severity: 'high', description: 'Path Traversal / ReDoS' },
+  { package: 'protobufjs', versions: ['7.2.3', '7.1.2', '6.11.3'], cve: 'CVE-2023-36665', severity: 'critical', description: 'Prototype Pollution' },
+  { package: 'fast-xml-parser', versions: ['4.2.4', '4.2.2'], cve: 'CVE-2023-34104', severity: 'high', description: 'Prototype Pollution' },
+  { package: 'postcss', versions: ['8.4.14', '8.4.12', '7.0.39'], cve: 'CVE-2023-44270', severity: 'medium', description: 'Line return parsing' },
+  { package: 'ip', versions: ['2.0.0', '1.1.8', '1.1.5'], cve: 'CVE-2024-29415', severity: 'high', description: 'SSRF via isPublic() bypass' },
+];
+
+export interface DepScanResult {
+  readonly totalDeps: number;
+  readonly directDeps: number;
+  readonly transitiveDeps: number;
+  readonly licenseIssues: readonly { name: string; version: string; license: string }[];
+  readonly vulnerabilities: readonly { name: string; version: string; cve: string; severity: string; description: string }[];
+  readonly ecosystems: readonly string[];
+}
+
+export const runDepDeepScan = (ctx: ScanContext): DepScanResult => {
+  const deps = parseLockfiles(ctx.files);
+
+  const directDeps = deps.filter(d => d.isDirect).length;
+  const transitiveDeps = deps.filter(d => !d.isDirect).length;
+
+  const licenseIssues = deps
+    .filter((d): d is LockfileDependency & { license: string } => d.license !== undefined && COPYLEFT_LICENSES.has(d.license))
+    .map(d => ({ name: d.name, version: d.version, license: d.license }));
+
+  const vulnerabilities: { name: string; version: string; cve: string; severity: string; description: string }[] = [];
+  for (const dep of deps) {
+    for (const vuln of KNOWN_VULNERABLE) {
+      if (dep.name === vuln.package && vuln.versions.includes(dep.version)) {
+        vulnerabilities.push({
+          name: dep.name,
+          version: dep.version,
+          cve: vuln.cve,
+          severity: vuln.severity,
+          description: vuln.description,
+        });
+      }
+    }
+  }
+
+  const ecosystems = [...new Set(deps.map(d => d.ecosystem))];
+
+  return { totalDeps: deps.length, directDeps, transitiveDeps, licenseIssues, vulnerabilities, ecosystems };
+};
+
+const toSeverity = (s: string): Severity =>
+  (s === 'critical' || s === 'high' || s === 'medium') ? s : 'high';
+
+export const depScanToCheckResults = (result: DepScanResult): readonly CheckResult[] => {
+  const checks: CheckResult[] = [];
+
+  // Summary pass/fail
+  if (result.totalDeps === 0) {
+    checks.push({ type: 'pass', checkId: 'l3-dep-scan', message: 'No lock files found for dependency analysis' });
+    return checks;
+  }
+
+  checks.push({
+    type: 'pass',
+    checkId: 'l3-dep-scan',
+    message: `Analyzed ${result.totalDeps} dependencies (${result.directDeps} direct, ${result.transitiveDeps} transitive) across ${result.ecosystems.join(', ')}`,
+  });
+
+  // License issues
+  for (const issue of result.licenseIssues) {
+    checks.push({
+      type: 'fail',
+      checkId: 'l3-dep-license',
+      message: `Copyleft license ${issue.license} in dependency ${issue.name}@${issue.version}`,
+      severity: 'medium',
+      obligationId: 'eu-ai-act-OBL-005',
+      articleReference: 'Art. 11 / Annex IV',
+      fix: `Review license compatibility of ${issue.name}@${issue.version} (${issue.license}). Consider replacing with a permissively-licensed alternative.`,
+    });
+  }
+
+  // Vulnerabilities
+  for (const vuln of result.vulnerabilities) {
+    checks.push({
+      type: 'fail',
+      checkId: 'l3-dep-vuln',
+      message: `Known vulnerability ${vuln.cve} in ${vuln.name}@${vuln.version}: ${vuln.description}`,
+      severity: toSeverity(vuln.severity),
+      obligationId: 'eu-ai-act-OBL-015',
+      articleReference: 'Art. 15 (Accuracy, robustness, cybersecurity)',
+      fix: `Update ${vuln.name} to a patched version. See ${vuln.cve} for details.`,
+    });
+  }
+
+  return checks;
+};

package/src/domain/scanner/checks/documentation.test.ts

@@ -0,0 +1,88 @@
+import { describe, it, expect } from 'vitest';
+import { checkDocumentation } from './documentation.js';
+import { createScanFile, createScanCtx } from '../../../test-helpers/factories.js';
+
+describe('checkDocumentation', () => {
+  it('passes when COMPLIANCE.md exists', () => {
+    const ctx = createScanCtx([
+      createScanFile('COMPLIANCE.md', '# Compliance Documentation'),
+    ]);
+
+    const results = checkDocumentation(ctx);
+
+    expect(results).toHaveLength(1);
+    expect(results[0].type).toBe('pass');
+    expect(results[0].checkId).toBe('documentation');
+  });
+
+  it('passes when .complior/ directory has files', () => {
+    const ctx = createScanCtx([
+      createScanFile('.complior/config.json', '{"version": "1.0"}'),
+    ]);
+
+    const results = checkDocumentation(ctx);
+
+    expect(results).toHaveLength(1);
+    expect(results[0].type).toBe('pass');
+  });
+
+  it('passes when docs/ contains compliance content', () => {
+    const ctx = createScanCtx([
+      createScanFile('docs/regulatory.md', 'This document covers EU AI Act compliance requirements'),
+    ]);
+
+    const results = checkDocumentation(ctx);
+
+    expect(results).toHaveLength(1);
+    expect(results[0].type).toBe('pass');
+  });
+
+  it('fails when no compliance documentation found', () => {
+    const ctx = createScanCtx([
+      createScanFile('README.md', '# My Project\nA simple web app'),
+    ]);
+
+    const results = checkDocumentation(ctx);
+
+    expect(results).toHaveLength(1);
+    expect(results[0].type).toBe('fail');
+    if (results[0].type === 'fail') {
+      expect(results[0].severity).toBe('medium');
+      expect(results[0].obligationId).toBe('eu-ai-act-OBL-019');
+      expect(results[0].fix).toBeDefined();
+    }
+  });
+
+  it('fails when docs/ has unrelated content', () => {
+    const ctx = createScanCtx([
+      createScanFile('docs/setup.md', '# Setup Guide\nRun npm install'),
+    ]);
+
+    const results = checkDocumentation(ctx);
+
+    expect(results).toHaveLength(1);
+    expect(results[0].type).toBe('fail');
+  });
+
+  it('detects case-insensitive compliance doc names', () => {
+    const ctx = createScanCtx([
+      createScanFile('compliance.md', '# compliance info'),
+    ]);
+
+    const results = checkDocumentation(ctx);
+
+    expect(results).toHaveLength(1);
+    expect(results[0].type).toBe('pass');
+  });
+
+  it('detects AI-COMPLIANCE named files', () => {
+    const ctx = createScanCtx([
+      createScanFile('AI-COMPLIANCE.md', '# AI Compliance'),
+    ]);
+
+    const results = checkDocumentation(ctx);
+
+    expect(results).toHaveLength(1);
+    expect(results[0].type).toBe('pass');
+  });
+});