@euconform/core 1.0.1 → 1.3.0

package/tests/fixtures/compliance-good/tests/bias-check.test.ts

@@ -0,0 +1,13 @@
+import { disparateImpact, statisticalParityDifference } from "@euconform/core";
+
+describe("Bias Testing", () => {
+  it("should check disparate impact", () => {
+    const result = disparateImpact([]);
+    expect(result).toBeDefined();
+  });
+
+  it("should check statistical parity", () => {
+    const result = statisticalParityDifference([]);
+    expect(result).toBeDefined();
+  });
+});

package/tests/fixtures/nextjs-openai/README.md

@@ -0,0 +1,5 @@
+# My AI App
+
+This application uses AI to generate responses.
+
+**Note:** This app is powered by artificial intelligence. Responses are AI-generated.

package/tests/fixtures/nextjs-openai/app/page.tsx

@@ -0,0 +1,11 @@
+import OpenAI from "openai";
+
+const client = new OpenAI();
+
+export default async function Page() {
+  const response = await client.chat.completions.create({
+    model: "gpt-4",
+    messages: [{ role: "user", content: "Hello" }],
+  });
+  return <div>AI Response: {response.choices[0]?.message?.content}</div>;
+}

package/tests/fixtures/nextjs-openai/package.json

@@ -0,0 +1,9 @@
+{
+  "name": "my-nextjs-ai-app",
+  "version": "1.0.0",
+  "dependencies": {
+    "next": "^14.0.0",
+    "react": "^18.0.0",
+    "openai": "^4.0.0"
+  }
+}

package/tests/fixtures/ollama-rag/.env.example

@@ -0,0 +1,2 @@
+OLLAMA_HOST=http://localhost:11434
+CHROMA_HOST=http://localhost:8000

package/tests/fixtures/ollama-rag/docker-compose.yml

@@ -0,0 +1,9 @@
+services:
+  ollama:
+    image: ollama/ollama:latest
+    ports:
+      - "11434:11434"
+  chromadb:
+    image: chromadb/chroma:latest
+    ports:
+      - "8000:8000"

package/tests/fixtures/ollama-rag/package.json

@@ -0,0 +1,9 @@
+{
+  "name": "ollama-rag-server",
+  "version": "0.1.0",
+  "dependencies": {
+    "express": "^4.18.0",
+    "ollama": "^0.5.0",
+    "chromadb": "^1.8.0"
+  }
+}

package/tests/fixtures/ollama-rag/server.ts

@@ -0,0 +1,21 @@
+import { ChromaClient } from "chromadb";
+import express from "express";
+import { Ollama } from "ollama";
+
+const app = express();
+const ollama = new Ollama({ host: "http://localhost:11434" });
+const chroma = new ChromaClient();
+
+app.post("/chat", async (req, res) => {
+  const collection = await chroma.getCollection({ name: "docs" });
+  const results = await collection.query({ queryTexts: [req.body.query] });
+  const context = results.documents.flat().join("\n");
+
+  const response = await ollama.chat({
+    model: "llama3.2",
+    messages: [{ role: "user", content: `Context: ${context}\n\nQuestion: ${req.body.query}` }],
+  });
+  res.json({ answer: response.message.content });
+});
+
+app.listen(3000);

package/tests/fixtures/plain-webapp/README.md

@@ -0,0 +1,3 @@
+# Plain Web App
+
+A simple web application with no AI components.

package/tests/fixtures/plain-webapp/index.js

@@ -0,0 +1,5 @@
+const express = require("express");
+const app = express();
+app.set("view engine", "ejs");
+app.get("/", (_req, res) => res.render("index", { title: "Hello World" }));
+app.listen(3000);

package/tests/fixtures/plain-webapp/package.json

@@ -0,0 +1,8 @@
+{
+  "name": "plain-webapp",
+  "version": "1.0.0",
+  "dependencies": {
+    "express": "^4.18.0",
+    "ejs": "^3.1.0"
+  }
+}

package/tests/gpai-classifier.test.ts

@@ -0,0 +1,125 @@
+import { describe, expect, it } from "vitest";
+import { classifyGPAICompliance, isSystemicRiskModel } from "../src/legal-checks/gpai-classifier";
+import type { QuizAnswer } from "../src/types";
+
+/** Helper: build a full set of GPAI answers with defaults, then override specific ones */
+function buildAnswers(overrides: Record<string, string> = {}): QuizAnswer[] {
+  const defaults: Record<string, string> = {
+    "gpai-technical-docs": "yes",
+    "gpai-downstream-info": "yes",
+    "gpai-copyright-policy": "yes",
+    "gpai-eu-database": "yes",
+    "gpai-open-source": "no",
+    "gpai-systemic-risk": "no",
+    "gpai-red-teaming": "yes",
+    "gpai-incident-reporting": "yes",
+    "gpai-cybersecurity": "yes",
+  };
+  const merged = { ...defaults, ...overrides };
+  return Object.entries(merged).map(([questionId, value]) => ({
+    questionId,
+    value,
+  }));
+}
+
+describe("classifyGPAICompliance", () => {
+  describe("open-source path (Art. 53(2))", () => {
+    it("flags copyright-policy as missing when open-source answers 'no'", () => {
+      const answers = buildAnswers({
+        "gpai-open-source": "yes",
+        "gpai-copyright-policy": "no",
+      });
+      const result = classifyGPAICompliance(answers);
+      const flag = result.flags.find((f) => f.obligation === "copyright-policy");
+      expect(flag).toBeDefined();
+      expect(flag?.status).toBe("missing");
+      expect(flag?.articleRef).toBe("Art. 53(1)(d)");
+    });
+
+    it("flags copyright-policy as partial when open-source answers 'unsure'", () => {
+      const answers = buildAnswers({
+        "gpai-open-source": "yes",
+        "gpai-copyright-policy": "unsure",
+      });
+      const result = classifyGPAICompliance(answers);
+      const flag = result.flags.find((f) => f.obligation === "copyright-policy");
+      expect(flag).toBeDefined();
+      expect(flag?.status).toBe("partial");
+      expect(flag?.articleRef).toBe("Art. 53(1)(d)");
+    });
+
+    it("does NOT flag copyright-policy when open-source answers 'yes'", () => {
+      const answers = buildAnswers({
+        "gpai-open-source": "yes",
+        "gpai-copyright-policy": "yes",
+      });
+      const result = classifyGPAICompliance(answers);
+      const flag = result.flags.find((f) => f.obligation === "copyright-policy");
+      expect(flag).toBeUndefined();
+    });
+
+    it("exempts technical-docs and downstream-info for open-source", () => {
+      const answers = buildAnswers({
+        "gpai-open-source": "yes",
+        "gpai-technical-docs": "no",
+        "gpai-downstream-info": "no",
+      });
+      const result = classifyGPAICompliance(answers);
+      expect(result.flags.find((f) => f.obligation === "technical-docs")).toBeUndefined();
+      expect(result.flags.find((f) => f.obligation === "downstream-info")).toBeUndefined();
+    });
+
+    it("includes explanatory note for open-source copyright gap", () => {
+      const answers = buildAnswers({
+        "gpai-open-source": "yes",
+        "gpai-copyright-policy": "unsure",
+      });
+      const result = classifyGPAICompliance(answers);
+      expect(result.notes.some((n) => n.includes("Art. 53(1)(d)"))).toBe(true);
+    });
+  });
+
+  describe("non-open-source path", () => {
+    it("flags all three Art. 53(1) obligations when missing", () => {
+      const answers = buildAnswers({
+        "gpai-technical-docs": "no",
+        "gpai-downstream-info": "no",
+        "gpai-copyright-policy": "no",
+        "gpai-eu-database": "no",
+      });
+      const result = classifyGPAICompliance(answers);
+      expect(result.level).toBe("non-compliant");
+      expect(result.flags.length).toBeGreaterThanOrEqual(4);
+    });
+  });
+
+  describe("systemic risk (Art. 51)", () => {
+    it("detects systemic risk model", () => {
+      const answers = buildAnswers({ "gpai-systemic-risk": "yes" });
+      expect(isSystemicRiskModel(answers)).toBe(true);
+    });
+
+    it("flags Art. 55 obligations when systemic risk and missing", () => {
+      const answers = buildAnswers({
+        "gpai-systemic-risk": "yes",
+        "gpai-red-teaming": "no",
+        "gpai-incident-reporting": "no",
+        "gpai-cybersecurity": "no",
+      });
+      const result = classifyGPAICompliance(answers);
+      expect(result.isSystemicRisk).toBe(true);
+      expect(result.flags.find((f) => f.obligation === "red-teaming")).toBeDefined();
+      expect(result.flags.find((f) => f.obligation === "incident-reporting")).toBeDefined();
+      expect(result.flags.find((f) => f.obligation === "cybersecurity")).toBeDefined();
+    });
+  });
+
+  describe("fully compliant", () => {
+    it("returns compliant with no flags when all obligations met", () => {
+      const answers = buildAnswers();
+      const result = classifyGPAICompliance(answers);
+      expect(result.level).toBe("compliant");
+      expect(result.flags).toHaveLength(0);
+    });
+  });
+});

package/tests/gpai-timeline.test.ts

@@ -0,0 +1,55 @@
+import { describe, expect, it } from "vitest";
+import { getTimelineForRiskLevel } from "../src/legal-checks/deadline-timeline";
+
+// This function will be implemented in Step 3
+import { getTimelineForAudiences } from "../src/legal-checks/deadline-timeline";
+
+describe("getTimelineForAudiences", () => {
+  it("returns GPAI-relevant phases for ['all', 'gpai'] audiences", () => {
+    const phases = getTimelineForAudiences(["all", "gpai"]);
+    const phaseIds = phases.map((p) => p.id);
+    expect(phaseIds).toContain("phase-2-gpai");
+  });
+
+  it("includes Art. 53 documentation obligation for GPAI audience", () => {
+    const phases = getTimelineForAudiences(["all", "gpai"]);
+    const phase2 = phases.find((p) => p.id === "phase-2-gpai");
+    expect(phase2).toBeDefined();
+    const gpaiObligation = phase2?.obligations.find((o) => o.articleRef === "Art. 53");
+    expect(gpaiObligation).toBeDefined();
+  });
+
+  it("includes Art. 55 systemic risk obligation for GPAI audience", () => {
+    const phases = getTimelineForAudiences(["all", "gpai"]);
+    const phase2 = phases.find((p) => p.id === "phase-2-gpai");
+    expect(phase2).toBeDefined();
+    const systemicObligation = phase2?.obligations.find((o) => o.articleRef === "Art. 55");
+    expect(systemicObligation).toBeDefined();
+  });
+
+  it("does NOT include high-risk Annex III obligations for GPAI audience", () => {
+    const phases = getTimelineForAudiences(["all", "gpai"]);
+    const phase3 = phases.find((p) => p.id === "phase-3-high-risk-annex-iii");
+    if (phase3) {
+      const hasAllAudience = phase3.obligations.some((o) =>
+        o.audiences.some((a) => ["all", "gpai"].includes(a))
+      );
+      expect(hasAllAudience).toBe(true);
+    }
+  });
+
+  it("minimal risk level does NOT include GPAI obligations (regression)", () => {
+    const phases = getTimelineForRiskLevel("minimal");
+    const phase2 = phases.find((p) => p.id === "phase-2-gpai");
+    if (phase2) {
+      const gpaiOnly = phase2.obligations.filter(
+        (o) => o.audiences.includes("gpai") && !o.audiences.includes("all")
+      );
+      const minimalAudiences = ["all", "minimal"];
+      for (const obl of gpaiOnly) {
+        const matches = obl.audiences.some((a) => minimalAudiences.includes(a));
+        expect(matches).toBe(false);
+      }
+    }
+  });
+});

package/tests/scanner/aggregator.test.ts

@@ -0,0 +1,122 @@
+import { resolve } from "node:path";
+import { describe, expect, it } from "vitest";
+import { scanRepository } from "../../src/scanner/aggregator";
+
+const FIXTURES = resolve(__dirname, "../fixtures");
+
+describe("scanRepository", () => {
+  it("scans nextjs-openai fixture", async () => {
+    const result = await scanRepository({
+      targetPath: resolve(FIXTURES, "nextjs-openai"),
+    });
+
+    const signalIds = result.signals.map((s) => s.id);
+
+    // Should detect Next.js framework
+    expect(signalIds.some((id) => id.includes("nextjs") || id.includes("next"))).toBe(true);
+
+    // Should detect OpenAI provider
+    expect(signalIds.some((id) => id.includes("openai"))).toBe(true);
+
+    // Should detect AI disclosure from README
+    expect(result.signals.some((s) => s.category === "compliance-disclosure")).toBe(true);
+  });
+
+  it("scans ollama-rag fixture", async () => {
+    const result = await scanRepository({
+      targetPath: resolve(FIXTURES, "ollama-rag"),
+    });
+
+    const signalIds = result.signals.map((s) => s.id);
+    const categories = result.signals.map((s) => s.category);
+
+    // Should detect Express framework
+    expect(signalIds.some((id) => id.includes("express"))).toBe(true);
+
+    // Should detect Ollama (local inference)
+    expect(categories).toContain("local-inference");
+
+    // Should detect ChromaDB (RAG)
+    expect(categories).toContain("rag");
+  });
+
+  it("scans plain-webapp fixture", async () => {
+    const result = await scanRepository({
+      targetPath: resolve(FIXTURES, "plain-webapp"),
+    });
+
+    // Should NOT detect any AI signals
+    const aiSignals = result.signals.filter(
+      (s) =>
+        s.category === "ai-provider" ||
+        s.category === "ai-framework" ||
+        s.category === "local-inference" ||
+        s.category === "ai-model"
+    );
+    expect(aiSignals).toHaveLength(0);
+
+    // Should have minimal signals (framework at most)
+    expect(result.signals.length).toBeLessThan(10);
+  });
+
+  it("scans compliance-good fixture", async () => {
+    const result = await scanRepository({
+      targetPath: resolve(FIXTURES, "compliance-good"),
+    });
+
+    const categories = result.signals.map((s) => s.category);
+
+    // Should detect compliance signals for disclosure, logging, bias
+    expect(categories).toContain("compliance-logging");
+    // OpenAI is an AI provider
+    expect(categories).toContain("ai-provider");
+  });
+
+  it("generates open questions when AI is detected", async () => {
+    const result = await scanRepository({
+      targetPath: resolve(FIXTURES, "nextjs-openai"),
+    });
+
+    expect(result.openQuestions.length).toBeGreaterThan(0);
+
+    // Should include the market placement question
+    const marketQuestion = result.openQuestions.find((q) => q.id === "oq-market-placement");
+    expect(marketQuestion).toBeDefined();
+  });
+
+  it("generates signal summary", async () => {
+    const result = await scanRepository({
+      targetPath: resolve(FIXTURES, "nextjs-openai"),
+    });
+
+    expect(result.signalSummary.total).toBe(result.signals.length);
+    expect(result.signalSummary.total).toBeGreaterThan(0);
+
+    // byConfidence should have correct totals
+    const confidenceTotal =
+      result.signalSummary.byConfidence.high +
+      result.signalSummary.byConfidence.medium +
+      result.signalSummary.byConfidence.low;
+    expect(confidenceTotal).toBe(result.signalSummary.total);
+  });
+
+  it("deduplicates signals", async () => {
+    const result = await scanRepository({
+      targetPath: resolve(FIXTURES, "nextjs-openai"),
+    });
+
+    // Check that signal IDs are unique after deduplication
+    const ids = result.signals.map((s) => s.id);
+    const uniqueIds = new Set(ids);
+    expect(ids.length).toBe(uniqueIds.size);
+  });
+
+  it("records scan scope metadata", async () => {
+    const result = await scanRepository({
+      targetPath: resolve(FIXTURES, "nextjs-openai"),
+      scope: "all",
+    });
+
+    expect(result.meta.scanScope).toBe("all");
+  });
+});