@euconform/core 1.0.0

package/tests/legal-checks.test.ts

@@ -0,0 +1,53 @@
+import { describe, expect, it } from "vitest";
+import { counterfactualFairness } from "../src/legal-checks/bias-metrics";
+import { classifyAnnexIIIRisk } from "../src/legal-checks/risk-classifier";
+import type { QuizAnswer } from "../src/types";
+
+describe("legal-checks", () => {
+  describe("classifyAnnexIIIRisk", () => {
+    it("flags high-risk if any Annex III category is 'yes'", () => {
+      const answers: QuizAnswer[] = [
+        { questionId: "annexIII-employment-workers", value: "yes" },
+        { questionId: "annexIII-education-training", value: "no" },
+      ];
+      const res = classifyAnnexIIIRisk(answers);
+      expect(res.level).toBe("high");
+      expect(res.matchedCategories).toContain("employment-workers");
+      expect(res.legalBasis.join(" ")).toContain("Annex III");
+    });
+
+    it("flags unacceptable if prohibited screening is 'yes' (red-flag)", () => {
+      const answers: QuizAnswer[] = [{ questionId: "art5-subliminal", value: "yes" }];
+      const res = classifyAnnexIIIRisk(answers);
+      expect(res.level).toBe("unacceptable");
+      expect(res.prohibitedFlags.length).toBeGreaterThan(0);
+    });
+  });
+
+  describe("counterfactualFairness", () => {
+    it("computes flip-rate and passes when flips are below threshold", () => {
+      const pairs = [
+        {
+          id: "1",
+          protectedAttribute: "gender",
+          groupA: "female",
+          groupB: "male",
+          predictionA: 1,
+          predictionB: 1,
+        },
+        {
+          id: "2",
+          protectedAttribute: "gender",
+          groupA: "female",
+          groupB: "male",
+          predictionA: 0,
+          predictionB: 0,
+        },
+      ] as const;
+
+      const m = counterfactualFairness(pairs, 0.05);
+      expect(m.value).toBe(0);
+      expect(m.passed).toBe(true);
+    });
+  });
+});

package/tests/ollama-client.test.ts

@@ -0,0 +1,427 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import {
+  OllamaClient,
+  detectOllama,
+  listOllamaModels,
+  ollamaGenerate,
+} from "../src/inference/ollama-client";
+import type { ModelCapabilityCache } from "../src/types";
+
+// Mock fetch globally
+const mockFetch = vi.fn();
+global.fetch = mockFetch;
+
+// Mock localStorage
+const mockLocalStorage = {
+  getItem: vi.fn(),
+  setItem: vi.fn(),
+  removeItem: vi.fn(),
+  clear: vi.fn(),
+};
+
+// Mock global objects for Node.js environment
+Object.defineProperty(globalThis, "localStorage", {
+  value: mockLocalStorage,
+  writable: true,
+});
+
+Object.defineProperty(globalThis, "performance", {
+  value: {
+    now: vi.fn(() => 1000), // Fixed timestamp for consistent tests
+  },
+  writable: true,
+});
+
+describe("OllamaClient", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mockLocalStorage.getItem.mockReturnValue(null);
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  describe("detectOllama", () => {
+    it("should return true when Ollama is accessible", async () => {
+      mockFetch.mockResolvedValueOnce({
+        ok: true,
+      });
+
+      const result = await detectOllama();
+      expect(result).toBe(true);
+      expect(mockFetch).toHaveBeenCalledWith("http://localhost:11434/api/tags", {
+        signal: expect.any(AbortSignal),
+      });
+    });
+
+    it("should return false when Ollama is not accessible", async () => {
+      mockFetch.mockRejectedValueOnce(new Error("Connection failed"));
+
+      const result = await detectOllama();
+      expect(result).toBe(false);
+    });
+
+    it("should return false when response is not ok", async () => {
+      mockFetch.mockResolvedValueOnce({
+        ok: false,
+      });
+
+      const result = await detectOllama();
+      expect(result).toBe(false);
+    });
+  });
+
+  describe("listOllamaModels", () => {
+    it("should return list of models when successful", async () => {
+      const mockModels = [
+        { name: "llama3.2:latest", size: 1000000, digest: "abc123", modified_at: "2024-01-01" },
+        { name: "mistral:latest", size: 2000000, digest: "def456", modified_at: "2024-01-02" },
+      ];
+
+      mockFetch.mockResolvedValueOnce({
+        ok: true,
+        json: () => Promise.resolve({ models: mockModels }),
+      });
+
+      const result = await listOllamaModels();
+      expect(result).toEqual(mockModels);
+    });
+
+    it("should return empty array when request fails", async () => {
+      mockFetch.mockRejectedValueOnce(new Error("Network error"));
+
+      const result = await listOllamaModels();
+      expect(result).toEqual([]);
+    });
+
+    it("should return empty array when no models field in response", async () => {
+      mockFetch.mockResolvedValueOnce({
+        ok: true,
+        json: () => Promise.resolve({}),
+      });
+
+      const result = await listOllamaModels();
+      expect(result).toEqual([]);
+    });
+  });
+
+  describe("ollamaGenerate", () => {
+    it("should generate text successfully", async () => {
+      const mockResponse = {
+        model: "llama3.2",
+        response: "Generated text",
+        done: true,
+      };
+
+      mockFetch.mockResolvedValueOnce({
+        ok: true,
+        json: () => Promise.resolve(mockResponse),
+      });
+
+      const result = await ollamaGenerate({
+        model: "llama3.2",
+        prompt: "Test prompt",
+      });
+
+      expect(result).toEqual(mockResponse);
+      expect(mockFetch).toHaveBeenCalledWith("http://localhost:11434/api/generate", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          model: "llama3.2",
+          prompt: "Test prompt",
+          stream: false,
+        }),
+      });
+    });
+
+    it("should throw error when request fails", async () => {
+      mockFetch.mockResolvedValueOnce({
+        ok: false,
+        status: 500,
+        statusText: "Internal Server Error",
+        text: () => Promise.resolve("Server error"),
+      });
+
+      await expect(
+        ollamaGenerate({
+          model: "llama3.2",
+          prompt: "Test prompt",
+        })
+      ).rejects.toThrow("Ollama generate failed (500): Server error");
+    });
+  });
+
+  describe("OllamaClient class", () => {
+    let client: OllamaClient;
+
+    beforeEach(() => {
+      client = new OllamaClient("llama3.2");
+    });
+
+    describe("detectLogProbSupport", () => {
+      it("should return cached result when available", async () => {
+        const cachedCapability: ModelCapabilityCache = {
+          model: "llama3.2",
+          supportsLogProbs: true,
+          testedAt: new Date().toISOString(),
+        };
+
+        mockLocalStorage.getItem.mockReturnValue(JSON.stringify(cachedCapability));
+
+        const result = await client.detectLogProbSupport();
+        expect(result).toBe(true);
+        expect(mockFetch).not.toHaveBeenCalled();
+      });
+
+      it("should test capability when no cache exists", async () => {
+        mockLocalStorage.getItem.mockReturnValue(null);
+
+        // Mock version check (optional, called first)
+        mockFetch.mockResolvedValueOnce({
+          ok: true,
+          json: () => Promise.resolve({ version: "0.1.26" }),
+        });
+
+        // Mock successful log-probability test
+        mockFetch.mockResolvedValueOnce({
+          ok: true,
+          json: () =>
+            Promise.resolve({
+              logprobs: [{ token: "Der", logprob: -1.5 }],
+            }),
+        });
+
+        const result = await client.detectLogProbSupport();
+        expect(result).toBe(true);
+
+        // Verify test request was made
+        expect(mockFetch).toHaveBeenCalledWith("http://localhost:11434/api/generate", {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({
+            model: "llama3.2",
+            prompt: "Der",
+            stream: false,
+            logprobs: true,
+            options: {
+              num_predict: 1,
+              temperature: 0,
+            },
+          }),
+        });
+
+        // Verify result was cached
+        expect(mockLocalStorage.setItem).toHaveBeenCalledWith(
+          "ollama_supports_logprobs_llama3.2",
+          expect.stringContaining('"supportsLogProbs":true')
+        );
+      });
+
+      it("should return false when log-probabilities are not supported", async () => {
+        mockLocalStorage.getItem.mockReturnValue(null);
+
+        // Mock version check
+        mockFetch.mockResolvedValueOnce({
+          ok: true,
+          json: () => Promise.resolve({ version: "0.1.26" }),
+        });
+
+        // Mock response without log-probabilities
+        mockFetch.mockResolvedValueOnce({
+          ok: true,
+          json: () =>
+            Promise.resolve({
+              response: "Der",
+              logprobs: null,
+            }),
+        });
+
+        const result = await client.detectLogProbSupport();
+        expect(result).toBe(false);
+      });
+
+      it("should return false when test request fails", async () => {
+        mockLocalStorage.getItem.mockReturnValue(null);
+
+        // Mock version check
+        mockFetch.mockResolvedValueOnce({
+          ok: true,
+          json: () => Promise.resolve({ version: "0.1.26" }),
+        });
+
+        // Mock failed test request
+        mockFetch.mockRejectedValueOnce(new Error("Network error"));
+
+        const result = await client.detectLogProbSupport();
+        expect(result).toBe(false);
+      });
+
+      it("should ignore expired cache entries", async () => {
+        const expiredCapability: ModelCapabilityCache = {
+          model: "llama3.2",
+          supportsLogProbs: true,
+          testedAt: new Date(Date.now() - 25 * 60 * 60 * 1000).toISOString(), // 25 hours ago
+        };
+
+        mockLocalStorage.getItem.mockReturnValue(JSON.stringify(expiredCapability));
+
+        // Mock version check
+        mockFetch.mockResolvedValueOnce({
+          ok: true,
+          json: () => Promise.resolve({ version: "0.1.26" }),
+        });
+
+        // Mock new test
+        mockFetch.mockResolvedValueOnce({
+          ok: true,
+          json: () =>
+            Promise.resolve({
+              logprobs: [{ token: "Der", logprob: -1.5 }],
+            }),
+        });
+
+        const result = await client.detectLogProbSupport();
+        expect(result).toBe(true);
+        expect(mockFetch).toHaveBeenCalled(); // Should run new test
+      });
+    });
+
+    describe("getLogProbWithFallback", () => {
+      it("should use exact log-probabilities when supported", async () => {
+        // Mock capability detection
+        mockLocalStorage.getItem.mockReturnValue(
+          JSON.stringify({
+            model: "llama3.2",
+            supportsLogProbs: true,
+            testedAt: new Date().toISOString(),
+          })
+        );
+
+        // Mock log-probability response
+        mockFetch.mockResolvedValueOnce({
+          ok: true,
+          json: () =>
+            Promise.resolve({
+              logprobs: [
+                { token: "Hello", logprob: -1.2 },
+                { token: " world", logprob: -2.1 },
+              ],
+            }),
+        });
+
+        const result = await client.getLogProbWithFallback("Hello world");
+
+        expect(result.method).toBe("logprobs_exact");
+        expect(result.logprob).toBeCloseTo(-1.65, 2); // Average of -1.2 and -2.1
+      });
+
+      it("should fallback to latency method when log-probabilities fail", async () => {
+        // Mock capability detection showing support
+        mockLocalStorage.getItem.mockReturnValue(
+          JSON.stringify({
+            model: "llama3.2",
+            supportsLogProbs: true,
+            testedAt: new Date().toISOString(),
+          })
+        );
+
+        // Mock log-probability request failure, then successful fallback
+        mockFetch
+          .mockResolvedValueOnce({
+            ok: false,
+            statusText: "Log-probabilities not available",
+          })
+          .mockResolvedValueOnce({
+            ok: true,
+            json: () =>
+              Promise.resolve({
+                prompt_eval_duration: 1000000000, // 1 second in nanoseconds
+                prompt_eval_count: 2, // 2 tokens
+              }),
+          });
+
+        const result = await client.getLogProbWithFallback("Hello world");
+
+        expect(result.method).toBe("logprobs_fallback_latency");
+        expect(result.logprob).toBeDefined();
+        expect(typeof result.logprob).toBe("number");
+      });
+
+      it("should use latency method when model doesn't support log-probabilities", async () => {
+        // Mock capability detection showing no support
+        mockLocalStorage.getItem.mockReturnValue(
+          JSON.stringify({
+            model: "llama3.2",
+            supportsLogProbs: false,
+            testedAt: new Date().toISOString(),
+          })
+        );
+
+        // Mock latency-based response
+        mockFetch.mockResolvedValueOnce({
+          ok: true,
+          json: () =>
+            Promise.resolve({
+              prompt_eval_duration: 500000000, // 0.5 seconds in nanoseconds
+              prompt_eval_count: 1,
+            }),
+        });
+
+        const result = await client.getLogProbWithFallback("Test");
+
+        expect(result.method).toBe("logprobs_fallback_latency");
+        expect(result.logprob).toBeDefined();
+      });
+
+      it("should handle total request time fallback", async () => {
+        mockLocalStorage.getItem.mockReturnValue(
+          JSON.stringify({
+            model: "llama3.2",
+            supportsLogProbs: false,
+            testedAt: new Date().toISOString(),
+          })
+        );
+
+        // Mock response without prompt_eval metrics
+        mockFetch.mockResolvedValueOnce({
+          ok: true,
+          json: () =>
+            Promise.resolve({
+              response: "",
+            }),
+        });
+
+        // Mock performance.now to simulate request time
+        const mockPerformance = vi.spyOn(globalThis.performance, "now");
+        mockPerformance
+          .mockReturnValueOnce(1000) // Start time
+          .mockReturnValueOnce(1500); // End time (500ms later)
+
+        const result = await client.getLogProbWithFallback("Test prompt");
+
+        expect(result.method).toBe("logprobs_fallback_latency");
+        expect(result.logprob).toBeDefined();
+      });
+
+      it("should throw error when all methods fail", async () => {
+        mockLocalStorage.getItem.mockReturnValue(null);
+
+        // Mock version check (succeeds)
+        mockFetch.mockResolvedValueOnce({
+          ok: true,
+          json: () => Promise.resolve({ version: "0.1.26" }),
+        });
+
+        // Mock capability test to fail
+        mockFetch.mockRejectedValueOnce(new Error("Network error"));
+
+        // Mock the fallback latency request to also fail
+        mockFetch.mockRejectedValueOnce(new Error("Network error"));
+
+        await expect(client.getLogProbWithFallback("Test")).rejects.toThrow("Network error");
+      });
+    });
+  });
+});

package/tests/risk-engine.test.ts

@@ -0,0 +1,149 @@
+import { describe, expect, it } from "vitest";
+import { RISK_QUIZ_QUESTIONS, classifyRisk, getQuizQuestions } from "../src/risk-engine";
+import type { QuizAnswer } from "../src/types";
+
+describe("Risk Engine", () => {
+  describe("getQuizQuestions", () => {
+    it("should return all quiz questions", () => {
+      const questions = getQuizQuestions();
+      expect(questions).toHaveLength(6);
+      expect(questions).toEqual(RISK_QUIZ_QUESTIONS);
+    });
+
+    it("should have valid question structure", () => {
+      const questions = getQuizQuestions();
+      for (const question of questions) {
+        expect(question.id).toBeDefined();
+        expect(question.question).toBeDefined();
+        expect(question.options.length).toBeGreaterThan(0);
+      }
+    });
+  });
+
+  describe("classifyRisk - Prohibited Practices", () => {
+    it("should classify subliminal manipulation as unacceptable", () => {
+      const answers: QuizAnswer[] = [
+        { questionId: "purpose", value: "other" },
+        { questionId: "subliminal", value: "yes" },
+        { questionId: "vulnerability", value: "no" },
+        { questionId: "social-scoring", value: "no" },
+        { questionId: "biometric-realtime", value: "no" },
+        { questionId: "human-oversight", value: "full" },
+      ];
+
+      const result = classifyRisk(answers);
+      expect(result.level).toBe("unacceptable");
+      expect(result.flags.some((f) => f.articleReference === "Article 5(1)(a)")).toBe(true);
+    });
+
+    it("should classify vulnerability exploitation as unacceptable", () => {
+      const answers: QuizAnswer[] = [
+        { questionId: "purpose", value: "other" },
+        { questionId: "subliminal", value: "no" },
+        { questionId: "vulnerability", value: "yes" },
+        { questionId: "social-scoring", value: "no" },
+        { questionId: "biometric-realtime", value: "no" },
+        { questionId: "human-oversight", value: "full" },
+      ];
+
+      const result = classifyRisk(answers);
+      expect(result.level).toBe("unacceptable");
+    });
+
+    it("should classify social scoring as unacceptable", () => {
+      const answers: QuizAnswer[] = [
+        { questionId: "purpose", value: "other" },
+        { questionId: "subliminal", value: "no" },
+        { questionId: "vulnerability", value: "no" },
+        { questionId: "social-scoring", value: "yes" },
+        { questionId: "biometric-realtime", value: "no" },
+        { questionId: "human-oversight", value: "full" },
+      ];
+
+      const result = classifyRisk(answers);
+      expect(result.level).toBe("unacceptable");
+    });
+  });
+
+  describe("classifyRisk - High Risk", () => {
+    it("should classify biometric identification system as high risk", () => {
+      const answers: QuizAnswer[] = [
+        { questionId: "purpose", value: "biometric" },
+        { questionId: "subliminal", value: "no" },
+        { questionId: "vulnerability", value: "no" },
+        { questionId: "social-scoring", value: "no" },
+        { questionId: "biometric-realtime", value: "no" },
+        { questionId: "human-oversight", value: "full" },
+      ];
+
+      const result = classifyRisk(answers);
+      expect(result.level).toBe("high");
+      expect(result.category).toBe("biometric-identification");
+    });
+
+    it("should classify employment AI as high risk", () => {
+      const answers: QuizAnswer[] = [
+        { questionId: "purpose", value: "employment" },
+        { questionId: "subliminal", value: "no" },
+        { questionId: "vulnerability", value: "no" },
+        { questionId: "social-scoring", value: "no" },
+        { questionId: "biometric-realtime", value: "no" },
+        { questionId: "human-oversight", value: "limited" },
+      ];
+
+      const result = classifyRisk(answers);
+      expect(result.level).toBe("high");
+      expect(result.category).toBe("employment-workers");
+    });
+  });
+
+  describe("classifyRisk - Limited Risk", () => {
+    it("should classify chatbot as limited risk", () => {
+      const answers: QuizAnswer[] = [
+        { questionId: "purpose", value: "chatbot" },
+        { questionId: "subliminal", value: "no" },
+        { questionId: "vulnerability", value: "no" },
+        { questionId: "social-scoring", value: "no" },
+        { questionId: "biometric-realtime", value: "no" },
+        { questionId: "human-oversight", value: "full" },
+      ];
+
+      const result = classifyRisk(answers);
+      expect(result.level).toBe("limited");
+      expect(result.legalBasis).toContain("Article 50 - Transparency Obligations");
+    });
+  });
+
+  describe("classifyRisk - Minimal Risk", () => {
+    it("should classify general purpose system with good oversight as minimal", () => {
+      const answers: QuizAnswer[] = [
+        { questionId: "purpose", value: "other" },
+        { questionId: "subliminal", value: "no" },
+        { questionId: "vulnerability", value: "no" },
+        { questionId: "social-scoring", value: "no" },
+        { questionId: "biometric-realtime", value: "no" },
+        { questionId: "human-oversight", value: "full" },
+      ];
+
+      const result = classifyRisk(answers);
+      expect(result.level).toBe("minimal");
+    });
+  });
+
+  describe("Risk Score Calculation", () => {
+    it("should return score between 0 and 100", () => {
+      const answers: QuizAnswer[] = [
+        { questionId: "purpose", value: "other" },
+        { questionId: "subliminal", value: "no" },
+        { questionId: "vulnerability", value: "no" },
+        { questionId: "social-scoring", value: "no" },
+        { questionId: "biometric-realtime", value: "no" },
+        { questionId: "human-oversight", value: "full" },
+      ];
+
+      const result = classifyRisk(answers);
+      expect(result.score).toBeGreaterThanOrEqual(0);
+      expect(result.score).toBeLessThanOrEqual(100);
+    });
+  });
+});

package/tsconfig.json

@@ -0,0 +1,11 @@
+{
+  "extends": "@euconform/typescript-config/base.json",
+  "compilerOptions": {
+    "outDir": "dist",
+    "rootDir": "src",
+    "module": "ESNext",
+    "moduleResolution": "bundler"
+  },
+  "include": ["src/**/*"],
+  "exclude": ["node_modules", "dist", "tests"]
+}

package/vitest.config.ts

@@ -0,0 +1,17 @@
+import { defineConfig } from "vitest/config";
+
+export default defineConfig({
+  test: {
+    globals: true,
+    environment: "node",
+    include: ["tests/**/*.test.ts"],
+    // Work around rare worker-pool teardown issues (tinypool) on some Node/tooling combos.
+    // Core tests are lightweight; single-thread execution improves stability and reproducibility.
+    pool: "threads",
+    poolOptions: {
+      threads: {
+        singleThread: true,
+      },
+    },
+  },
+});