@complior/engine 0.9.0

package/data/regulations/jurisdictions/si.json

@@ -0,0 +1,15 @@
+{
+  "country_code": "SI",
+  "country_name": "Slovenia",
+  "msa_name": "Agency for Communication Networks and Services (AKOS)",
+  "msa_url": "https://www.akos-rs.si",
+  "msa_contact": "info.box@akos-rs.si",
+  "local_requirements": [
+    "Slovenian-language documentation mandatory for consumer AI systems",
+    "National DPA (IP RS) notification for AI processing personal data",
+    "Alignment with Slovenian National Programme for AI"
+  ],
+  "enforcement_date": "2026-08-02",
+  "language": "Slovenian",
+  "notes": "AKOS oversees communications networks and digital services including AI"
+}

package/data/regulations/jurisdictions/sk.json

@@ -0,0 +1,15 @@
+{
+  "country_code": "SK",
+  "country_name": "Slovakia",
+  "msa_name": "Regulatory Office for Network Industries (URSO)",
+  "msa_url": "https://www.urso.gov.sk",
+  "msa_contact": "urso@urso.gov.sk",
+  "local_requirements": [
+    "Slovak-language documentation required for consumer-facing AI",
+    "National DPA (UOOU SR) notification for high-risk AI",
+    "Alignment with Slovak Action Plan for AI Development"
+  ],
+  "enforcement_date": "2026-08-02",
+  "language": "Slovak",
+  "notes": "URSO handles network and digital market regulation including AI oversight"
+}

package/data/scanner/check-id-categories.json

@@ -0,0 +1,81 @@
+{
+  "mapping": {
+    "art5-screening": "prohibited_practices",
+    "risk-management": "risk_management",
+    "data-governance": "risk_management",
+    "qms": "risk_management",
+    "technical-documentation": "documentation",
+    "declaration-of-conformity": "documentation",
+    "compliance-metadata": "documentation",
+    "documentation": "documentation",
+    "passport-presence": "documentation",
+    "passport-completeness": "documentation",
+    "instructions-for-use": "transparency",
+    "ai-literacy": "organizational",
+    "monitoring-policy": "deployer_specific",
+    "fria": "deployer_specific",
+    "worker-notification": "monitoring_and_reporting",
+    "incident-report": "monitoring_and_reporting",
+
+    "l2-tech-documentation": "documentation",
+    "l2-art5-screening": "prohibited_practices",
+    "l2-risk-management": "risk_management",
+    "l2-data-governance": "risk_management",
+    "l2-qms": "risk_management",
+    "l2-instructions-for-use": "transparency",
+    "l2-ai-literacy": "organizational",
+    "l2-monitoring-policy": "deployer_specific",
+    "l2-fria": "deployer_specific",
+    "l2-declaration-conformity": "documentation",
+    "l2-worker-notification": "monitoring_and_reporting",
+    "l2-incident-report": "monitoring_and_reporting",
+    "l2-critical-infra-ai-policy": "risk_management",
+
+    "l3-ai-sdk-detected": "technical_safeguards",
+    "l3-dep-scan": "technical_safeguards",
+    "l3-missing-bias-testing": "risk_management",
+
+    "ai-disclosure": "transparency",
+    "content-marking": "transparency",
+    "interaction-logging": "technical_safeguards",
+    "gpai-transparency": "documentation",
+    "gpai-systemic-risk": "documentation",
+    "l4-disclosure": "transparency",
+    "l4-content-marking": "transparency",
+    "l4-human-oversight": "organizational",
+    "l4-kill-switch": "organizational",
+    "l4-logging": "technical_safeguards",
+    "l4-cybersecurity": "technical_safeguards",
+    "l4-accuracy-robustness": "technical_safeguards",
+    "l4-nhi-clean": "technical_safeguards",
+    "l4-data-governance": "risk_management",
+    "l4-gpai-transparency": "documentation",
+    "l4-conformity-assessment": "documentation",
+    "l4-deployer-monitoring": "deployer_specific",
+    "l4-record-keeping": "deployer_specific",
+    "l4-ast-wrapped-call": "transparency",
+
+    "git-freshness-risk-management": "risk_management",
+    "git-freshness-data-governance": "risk_management",
+    "git-freshness-qms": "risk_management",
+    "git-freshness-technical-documentation": "documentation",
+    "git-freshness-declaration-of-conformity": "documentation",
+    "git-freshness-instructions-for-use": "transparency",
+    "git-freshness-monitoring-policy": "deployer_specific",
+    "git-freshness-fria": "deployer_specific",
+    "git-freshness-worker-notification": "monitoring_and_reporting",
+    "git-freshness-incident-report": "monitoring_and_reporting",
+    "git-author-diversity-fria": "deployer_specific",
+    "git-author-diversity-risk-management": "risk_management",
+    "git-bulk-compliance": "organizational",
+
+    "ext-semgrep-complior-injection-js": "technical_safeguards",
+    "ext-semgrep-complior-injection-py": "technical_safeguards",
+    "ext-detect-secrets-Secret-Keyword": "technical_safeguards",
+    "ext-detect-secrets-Base64-High-Entropy": "technical_safeguards",
+    "ext-detect-secrets-Hex-High-Entropy": "technical_safeguards",
+    "ext-bandit-hardcoded-password": "technical_safeguards",
+    "ext-bandit-sql-injection": "technical_safeguards",
+    "ext-modelscan-malicious-model": "risk_management"
+  }
+}

package/data/scanner/confidence-params.json

@@ -0,0 +1,16 @@
+{
+  "layer_weights": {
+    "L1": 1.0,
+    "L2": 0.95,
+    "L3": 0.90,
+    "L4": 0.75,
+    "L5": 0.70
+  },
+  "score_multipliers": {
+    "PASS": 1.0,
+    "LIKELY_PASS": 0.75,
+    "UNCERTAIN": 0.5,
+    "LIKELY_FAIL": 0.25,
+    "FAIL": 0.0
+  }
+}

package/data/scanner/limits.json

@@ -0,0 +1,4 @@
+{
+  "max_files": 500,
+  "max_file_size_bytes": 1048576
+}

package/data/schemas/http-contract-sample.json

@@ -0,0 +1,79 @@
+{
+  "score": {
+    "totalScore": 72.5,
+    "zone": "yellow",
+    "categoryScores": [
+      {
+        "category": "documentation",
+        "weight": 0.25,
+        "score": 80.0,
+        "obligationCount": 5,
+        "passedCount": 4
+      },
+      {
+        "category": "technical",
+        "weight": 0.35,
+        "score": 65.0,
+        "obligationCount": 8,
+        "passedCount": 5
+      }
+    ],
+    "criticalCapApplied": false,
+    "confidenceSummary": { "average": 0.82, "low_confidence_count": 2 },
+    "totalChecks": 20,
+    "passedChecks": 14,
+    "failedChecks": 4,
+    "skippedChecks": 2
+  },
+  "findings": [
+    {
+      "checkId": "l4-bare-api-call",
+      "type": "info",
+      "message": "Bare OpenAI API call detected in src/ai/chat.ts:42. Consider @complior/sdk for runtime compliance.",
+      "severity": "info",
+      "file": "src/ai/chat.ts",
+      "line": 42,
+      "obligationId": "OBL-015",
+      "articleReference": "Art. 14(4)",
+      "fix": "Optional: wrap with @complior/sdk for runtime Art. 50/12/14 enforcement",
+      "codeContext": {
+        "lines": [
+          { "num": 40, "content": "async function chat(prompt: string) {" },
+          { "num": 41, "content": "  const client = new OpenAI();" },
+          { "num": 42, "content": "  return client.chat.completions.create({" },
+          { "num": 43, "content": "    model: 'gpt-4'," },
+          { "num": 44, "content": "    messages: [{ role: 'user', content: prompt }]" }
+        ],
+        "startLine": 40,
+        "highlightLine": 42
+      },
+      "priority": 3,
+      "confidence": 0.95,
+      "confidenceLevel": "high",
+      "evidence": [{ "source": "ast", "pattern": "new OpenAI()" }]
+    },
+    {
+      "checkId": "l1-missing-fria",
+      "type": "fail",
+      "message": "Missing Fundamental Rights Impact Assessment document",
+      "severity": "medium",
+      "obligationId": "OBL-028",
+      "articleReference": "Art. 27"
+    },
+    {
+      "checkId": "l3-no-logging",
+      "type": "fail",
+      "message": "No structured logging configuration found",
+      "severity": "medium",
+      "file": "package.json",
+      "line": 1
+    }
+  ],
+  "projectPath": "/home/user/my-ai-project",
+  "scannedAt": "2026-03-01T14:30:00Z",
+  "duration": 1250,
+  "filesScanned": 47,
+  "deepAnalysis": false,
+  "l5Cost": 0.0,
+  "regulationVersion": { "version": "1.0.0", "framework": "eu-ai-act" }
+}

package/data/schemas/http-contract.json

@@ -0,0 +1,144 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://complior.ai/schemas/http-contract.json",
+  "title": "Complior HTTP Contract",
+  "description": "Shared types between TS engine (producer) and Rust TUI (consumer). Field names are camelCase in JSON. Rust uses #[serde(rename_all = \"camelCase\")] for automatic mapping.",
+  "$defs": {
+    "Severity": {
+      "type": "string",
+      "enum": ["critical", "high", "medium", "low", "info"]
+    },
+    "Zone": {
+      "type": "string",
+      "enum": ["red", "yellow", "green"]
+    },
+    "CheckResultType": {
+      "type": "string",
+      "enum": ["pass", "fail", "skip", "info"]
+    },
+    "CodeContextLine": {
+      "type": "object",
+      "required": ["num", "content"],
+      "properties": {
+        "num": { "type": "integer" },
+        "content": { "type": "string" }
+      },
+      "additionalProperties": false
+    },
+    "CodeContext": {
+      "type": "object",
+      "required": ["lines", "startLine"],
+      "properties": {
+        "lines": {
+          "type": "array",
+          "items": { "$ref": "#/$defs/CodeContextLine" }
+        },
+        "startLine": { "type": "integer" },
+        "highlightLine": { "type": "integer" }
+      },
+      "additionalProperties": false
+    },
+    "FixDiff": {
+      "type": "object",
+      "required": ["before", "after", "startLine", "filePath"],
+      "properties": {
+        "before": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "after": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "startLine": { "type": "integer" },
+        "filePath": { "type": "string" },
+        "importLine": { "type": "string" }
+      },
+      "additionalProperties": false
+    },
+    "Finding": {
+      "type": "object",
+      "required": ["checkId", "type", "message", "severity"],
+      "properties": {
+        "checkId": { "type": "string" },
+        "type": { "$ref": "#/$defs/CheckResultType" },
+        "message": { "type": "string" },
+        "severity": { "$ref": "#/$defs/Severity" },
+        "file": { "type": "string" },
+        "line": { "type": "integer" },
+        "obligationId": { "type": "string" },
+        "articleReference": { "type": "string" },
+        "fix": { "type": "string" },
+        "priority": { "type": "integer" },
+        "confidence": { "type": "integer" },
+        "confidenceLevel": { "type": "string" },
+        "evidence": {
+          "type": "array",
+          "items": { "type": "object" }
+        },
+        "codeContext": { "$ref": "#/$defs/CodeContext" },
+        "fixDiff": { "$ref": "#/$defs/FixDiff" }
+      },
+      "additionalProperties": false
+    },
+    "CategoryScore": {
+      "type": "object",
+      "required": ["category", "weight", "score", "obligationCount", "passedCount"],
+      "properties": {
+        "category": { "type": "string" },
+        "weight": { "type": "number" },
+        "score": { "type": "number" },
+        "obligationCount": { "type": "integer" },
+        "passedCount": { "type": "integer" }
+      },
+      "additionalProperties": false
+    },
+    "ScoreBreakdown": {
+      "type": "object",
+      "required": [
+        "totalScore", "zone", "categoryScores",
+        "criticalCapApplied", "totalChecks", "passedChecks",
+        "failedChecks", "skippedChecks"
+      ],
+      "properties": {
+        "totalScore": { "type": "number" },
+        "zone": { "$ref": "#/$defs/Zone" },
+        "categoryScores": {
+          "type": "array",
+          "items": { "$ref": "#/$defs/CategoryScore" }
+        },
+        "criticalCapApplied": { "type": "boolean" },
+        "totalChecks": { "type": "integer" },
+        "passedChecks": { "type": "integer" },
+        "failedChecks": { "type": "integer" },
+        "skippedChecks": { "type": "integer" },
+        "confidenceSummary": { "type": "object" }
+      },
+      "additionalProperties": false
+    },
+    "ScanResult": {
+      "type": "object",
+      "required": [
+        "score", "findings", "projectPath",
+        "scannedAt", "duration", "filesScanned"
+      ],
+      "properties": {
+        "score": { "$ref": "#/$defs/ScoreBreakdown" },
+        "findings": {
+          "type": "array",
+          "items": { "$ref": "#/$defs/Finding" }
+        },
+        "projectPath": { "type": "string" },
+        "scannedAt": { "type": "string" },
+        "duration": { "type": "number" },
+        "filesScanned": { "type": "integer" },
+        "deepAnalysis": { "type": "boolean" },
+        "l5Cost": { "type": "number" },
+        "regulationVersion": { "type": "object" }
+      },
+      "additionalProperties": false
+    }
+  },
+  "type": "object",
+  "$ref": "#/$defs/ScanResult"
+}

package/data/semgrep-rules/bare-call.yaml

@@ -0,0 +1,37 @@
+rules:
+  - id: complior.bare-call
+    patterns:
+      - pattern-either:
+          # Python — OpenAI
+          - pattern: openai.ChatCompletion.create(...)
+          - pattern: openai.Completion.create(...)
+          - pattern: $CLIENT.chat.completions.create(...)
+          - pattern: $CLIENT.completions.create(...)
+          # Python — Anthropic
+          - pattern: $CLIENT.messages.create(...)
+          - pattern: anthropic.Anthropic(...).messages.create(...)
+          # JS/TS — constructors (bare usage without wrapper)
+          - pattern: new OpenAI(...)
+          - pattern: new Anthropic(...)
+          # JS/TS — Vercel AI SDK
+          - pattern: generateText(...)
+          - pattern: streamText(...)
+      - pattern-not-inside: complior(...)
+      - pattern-not-inside: compliorAgent(...)
+    message: >
+      Bare LLM API call detected. Consider wrapping with @complior/sdk
+      (complior() or compliorAgent()) for runtime EU AI Act enforcement:
+      AI disclosure (Art. 50), interaction logging (Art. 12),
+      content marking (Art. 50(2)), and human oversight (Art. 14).
+      This is informational — bare calls are not a compliance violation.
+    severity: INFO
+    languages: [python, javascript, typescript]
+    metadata:
+      category: ai-compliance
+      subcategory: unwrapped-call
+      article: "Art. 50(1)"
+      obligation: OBL-015
+      cwe:
+        - "CWE-778: Insufficient Logging"
+      confidence: HIGH
+      impact: HIGH

package/data/semgrep-rules/injection.yaml

@@ -0,0 +1,73 @@
+rules:
+  - id: complior.injection
+    patterns:
+      - pattern-either:
+          # Python — f-strings in messages
+          - pattern: |
+              $CLIENT.chat.completions.create(
+                ...,
+                messages=[..., {"role": "user", "content": f"...{$VAR}..."}, ...],
+                ...
+              )
+          - pattern: |
+              $CLIENT.messages.create(
+                ...,
+                messages=[..., {"role": "user", "content": f"...{$VAR}..."}, ...],
+                ...
+              )
+          # Python — .format()
+          - pattern: |
+              $CLIENT.chat.completions.create(
+                ...,
+                messages=[..., {"role": "user", "content": "...{}...".format($VAR)}, ...],
+                ...
+              )
+          # Python — concatenation
+          - pattern: |
+              $CLIENT.chat.completions.create(
+                ...,
+                messages=[..., {"role": "user", "content": "..." + $VAR + "..."}, ...],
+                ...
+              )
+    message: >
+      Potential prompt injection: user-controlled input interpolated directly
+      into an LLM prompt. This allows adversarial prompt manipulation,
+      violating EU AI Act Art. 15 (robustness) and Art. 9 (risk management).
+      Use parameterized prompts, input validation, or the @complior/sdk
+      sanitize hook.
+    severity: ERROR
+    languages: [python]
+    metadata:
+      category: security
+      subcategory: prompt-injection
+      article: "Art. 15"
+      obligation: OBL-006
+      cwe:
+        - "CWE-77: Command Injection"
+        - "CWE-94: Improper Control of Generation of Code"
+      confidence: MEDIUM
+      impact: HIGH
+
+  - id: complior.injection-js
+    patterns:
+      - pattern-either:
+          # Template literals in message content
+          - pattern: "{role: \"user\", content: `...${$VAR}...`}"
+          # String concatenation in message content
+          - pattern: "{role: \"user\", content: $PREFIX + $USER_INPUT}"
+          - pattern: "{role: \"user\", content: $PREFIX + $USER_INPUT + $SUFFIX}"
+    message: >
+      Potential prompt injection: user input interpolated via template literal
+      or concatenation into LLM message. Violates EU AI Act Art. 15
+      (robustness). Use parameterized prompts or input sanitization.
+    severity: ERROR
+    languages: [javascript, typescript]
+    metadata:
+      category: security
+      subcategory: prompt-injection
+      article: "Art. 15"
+      obligation: OBL-006
+      cwe:
+        - "CWE-77: Command Injection"
+      confidence: MEDIUM
+      impact: HIGH

package/data/semgrep-rules/missing-error-handling.yaml

@@ -0,0 +1,58 @@
+rules:
+  - id: complior.missing-error-handling
+    patterns:
+      - pattern-either:
+          - pattern: await $CLIENT.chat.completions.create(...)
+          - pattern: await $CLIENT.completions.create(...)
+          - pattern: await $CLIENT.messages.create(...)
+          - pattern: await $CLIENT.embeddings.create(...)
+          - pattern: await generateText(...)
+          - pattern: await streamText(...)
+      - pattern-not-inside: |
+          try { ... } catch ($ERR) { ... }
+    message: >
+      LLM API call without error handling. LLM calls can fail from rate limits,
+      network errors, content filtering, or quota exhaustion. Unhandled errors
+      in AI systems violate EU AI Act Art. 15 (robustness) and may cause
+      undefined system behavior. Wrap in try/catch with fallback logic.
+    severity: WARNING
+    languages: [javascript, typescript]
+    metadata:
+      category: robustness
+      subcategory: error-handling
+      article: "Art. 15"
+      obligation: OBL-015
+      cwe:
+        - "CWE-755: Improper Handling of Exceptional Conditions"
+        - "CWE-391: Unchecked Error Condition"
+      confidence: MEDIUM
+      impact: MEDIUM
+
+  - id: complior.missing-error-handling-python
+    patterns:
+      - pattern-either:
+          - pattern: $CLIENT.chat.completions.create(...)
+          - pattern: $CLIENT.completions.create(...)
+          - pattern: $CLIENT.messages.create(...)
+          - pattern: $CLIENT.embeddings.create(...)
+          - pattern: openai.ChatCompletion.create(...)
+      - pattern-not-inside: |
+          try:
+            ...
+          except $ERR:
+            ...
+    message: >
+      LLM API call without error handling. Unhandled exceptions from LLM APIs
+      violate EU AI Act Art. 15 (robustness). Wrap in try/except with
+      appropriate fallback logic.
+    severity: WARNING
+    languages: [python]
+    metadata:
+      category: robustness
+      subcategory: error-handling
+      article: "Art. 15"
+      obligation: OBL-015
+      cwe:
+        - "CWE-755: Improper Handling of Exceptional Conditions"
+      confidence: MEDIUM
+      impact: MEDIUM

package/data/semgrep-rules/unsafe-deser.yaml

@@ -0,0 +1,65 @@
+rules:
+  - id: complior.unsafe-deser
+    patterns:
+      - pattern-either:
+          # Python pickle family
+          - pattern: pickle.load(...)
+          - pattern: pickle.loads(...)
+          - pattern: _pickle.load(...)
+          - pattern: _pickle.loads(...)
+          - pattern: cPickle.load(...)
+          - pattern: cPickle.loads(...)
+          # Python marshal / shelve
+          - pattern: marshal.load(...)
+          - pattern: marshal.loads(...)
+          - pattern: shelve.open(...)
+          # Python YAML (unsafe loaders)
+          - pattern: yaml.load(...)
+          - pattern: yaml.unsafe_load(...)
+          # PyTorch — unsafe model loading
+          - pattern: torch.load(...)
+          # Python dill
+          - pattern: dill.load(...)
+          - pattern: dill.loads(...)
+    message: >
+      Unsafe deserialization detected. pickle, marshal, yaml.load, and
+      torch.load can execute arbitrary code on untrusted input — a critical
+      supply-chain risk for AI systems. Violates EU AI Act Art. 15
+      (cybersecurity). Use safe alternatives: json, yaml.safe_load(),
+      safetensors, torch.load(..., weights_only=True).
+    severity: ERROR
+    languages: [python]
+    metadata:
+      category: security
+      subcategory: unsafe-deserialization
+      article: "Art. 15"
+      obligation: OBL-006
+      cwe:
+        - "CWE-502: Deserialization of Untrusted Data"
+      confidence: HIGH
+      impact: HIGH
+
+  - id: complior.unsafe-deser-js
+    patterns:
+      - pattern-either:
+          - pattern: eval(...)
+          - pattern: new Function(...)
+          - pattern: vm.runInNewContext(...)
+          - pattern: vm.runInThisContext(...)
+    message: >
+      Unsafe code execution detected. eval(), Function(), and vm.runIn*()
+      on untrusted input can lead to code injection. In AI systems this
+      violates EU AI Act Art. 15 (cybersecurity). Use JSON.parse() with
+      Zod/schema validation instead.
+    severity: ERROR
+    languages: [javascript, typescript]
+    metadata:
+      category: security
+      subcategory: unsafe-deserialization
+      article: "Art. 15"
+      obligation: OBL-006
+      cwe:
+        - "CWE-502: Deserialization of Untrusted Data"
+        - "CWE-94: Improper Control of Generation of Code"
+      confidence: MEDIUM
+      impact: HIGH